rx.c 84 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057
  1. /*
  2. * Copyright 2002-2005, Instant802 Networks, Inc.
  3. * Copyright 2005-2006, Devicescape Software, Inc.
  4. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  5. * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License version 2 as
  9. * published by the Free Software Foundation.
  10. */
  11. #include <linux/jiffies.h>
  12. #include <linux/slab.h>
  13. #include <linux/kernel.h>
  14. #include <linux/skbuff.h>
  15. #include <linux/netdevice.h>
  16. #include <linux/etherdevice.h>
  17. #include <linux/rcupdate.h>
  18. #include <net/mac80211.h>
  19. #include <net/ieee80211_radiotap.h>
  20. #include "ieee80211_i.h"
  21. #include "driver-ops.h"
  22. #include "led.h"
  23. #include "mesh.h"
  24. #include "wep.h"
  25. #include "wpa.h"
  26. #include "tkip.h"
  27. #include "wme.h"
  28. /*
  29. * monitor mode reception
  30. *
  31. * This function cleans up the SKB, i.e. it removes all the stuff
  32. * only useful for monitoring.
  33. */
  34. static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  35. struct sk_buff *skb)
  36. {
  37. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
  38. if (likely(skb->len > FCS_LEN))
  39. __pskb_trim(skb, skb->len - FCS_LEN);
  40. else {
  41. /* driver bug */
  42. WARN_ON(1);
  43. dev_kfree_skb(skb);
  44. skb = NULL;
  45. }
  46. }
  47. return skb;
  48. }
  49. static inline int should_drop_frame(struct sk_buff *skb,
  50. int present_fcs_len)
  51. {
  52. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  53. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  54. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  55. return 1;
  56. if (unlikely(skb->len < 16 + present_fcs_len))
  57. return 1;
  58. if (ieee80211_is_ctl(hdr->frame_control) &&
  59. !ieee80211_is_pspoll(hdr->frame_control) &&
  60. !ieee80211_is_back_req(hdr->frame_control))
  61. return 1;
  62. return 0;
  63. }
  64. static int
  65. ieee80211_rx_radiotap_len(struct ieee80211_local *local,
  66. struct ieee80211_rx_status *status)
  67. {
  68. int len;
  69. /* always present fields */
  70. len = sizeof(struct ieee80211_radiotap_header) + 9;
  71. if (status->flag & RX_FLAG_MACTIME_MPDU)
  72. len += 8;
  73. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
  74. len += 1;
  75. if (len & 1) /* padding for RX_FLAGS if necessary */
  76. len++;
  77. if (status->flag & RX_FLAG_HT) /* HT info */
  78. len += 3;
  79. return len;
  80. }
  81. /*
  82. * ieee80211_add_rx_radiotap_header - add radiotap header
  83. *
  84. * add a radiotap header containing all the fields which the hardware provided.
  85. */
  86. static void
  87. ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
  88. struct sk_buff *skb,
  89. struct ieee80211_rate *rate,
  90. int rtap_len)
  91. {
  92. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  93. struct ieee80211_radiotap_header *rthdr;
  94. unsigned char *pos;
  95. u16 rx_flags = 0;
  96. rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
  97. memset(rthdr, 0, rtap_len);
  98. /* radiotap header, set always present flags */
  99. rthdr->it_present =
  100. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  101. (1 << IEEE80211_RADIOTAP_CHANNEL) |
  102. (1 << IEEE80211_RADIOTAP_ANTENNA) |
  103. (1 << IEEE80211_RADIOTAP_RX_FLAGS));
  104. rthdr->it_len = cpu_to_le16(rtap_len);
  105. pos = (unsigned char *)(rthdr+1);
  106. /* the order of the following fields is important */
  107. /* IEEE80211_RADIOTAP_TSFT */
  108. if (status->flag & RX_FLAG_MACTIME_MPDU) {
  109. put_unaligned_le64(status->mactime, pos);
  110. rthdr->it_present |=
  111. cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
  112. pos += 8;
  113. }
  114. /* IEEE80211_RADIOTAP_FLAGS */
  115. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  116. *pos |= IEEE80211_RADIOTAP_F_FCS;
  117. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  118. *pos |= IEEE80211_RADIOTAP_F_BADFCS;
  119. if (status->flag & RX_FLAG_SHORTPRE)
  120. *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
  121. pos++;
  122. /* IEEE80211_RADIOTAP_RATE */
  123. if (status->flag & RX_FLAG_HT) {
  124. /*
  125. * MCS information is a separate field in radiotap,
  126. * added below. The byte here is needed as padding
  127. * for the channel though, so initialise it to 0.
  128. */
  129. *pos = 0;
  130. } else {
  131. rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
  132. *pos = rate->bitrate / 5;
  133. }
  134. pos++;
  135. /* IEEE80211_RADIOTAP_CHANNEL */
  136. put_unaligned_le16(status->freq, pos);
  137. pos += 2;
  138. if (status->band == IEEE80211_BAND_5GHZ)
  139. put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
  140. pos);
  141. else if (status->flag & RX_FLAG_HT)
  142. put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
  143. pos);
  144. else if (rate->flags & IEEE80211_RATE_ERP_G)
  145. put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
  146. pos);
  147. else
  148. put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
  149. pos);
  150. pos += 2;
  151. /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
  152. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
  153. *pos = status->signal;
  154. rthdr->it_present |=
  155. cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
  156. pos++;
  157. }
  158. /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
  159. /* IEEE80211_RADIOTAP_ANTENNA */
  160. *pos = status->antenna;
  161. pos++;
  162. /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
  163. /* IEEE80211_RADIOTAP_RX_FLAGS */
  164. /* ensure 2 byte alignment for the 2 byte field as required */
  165. if ((pos - (u8 *)rthdr) & 1)
  166. pos++;
  167. if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
  168. rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
  169. put_unaligned_le16(rx_flags, pos);
  170. pos += 2;
  171. if (status->flag & RX_FLAG_HT) {
  172. rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
  173. *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
  174. IEEE80211_RADIOTAP_MCS_HAVE_GI |
  175. IEEE80211_RADIOTAP_MCS_HAVE_BW;
  176. *pos = 0;
  177. if (status->flag & RX_FLAG_SHORT_GI)
  178. *pos |= IEEE80211_RADIOTAP_MCS_SGI;
  179. if (status->flag & RX_FLAG_40MHZ)
  180. *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
  181. pos++;
  182. *pos++ = status->rate_idx;
  183. }
  184. }
  185. /*
  186. * This function copies a received frame to all monitor interfaces and
  187. * returns a cleaned-up SKB that no longer includes the FCS nor the
  188. * radiotap header the driver might have added.
  189. */
  190. static struct sk_buff *
  191. ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
  192. struct ieee80211_rate *rate)
  193. {
  194. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
  195. struct ieee80211_sub_if_data *sdata;
  196. int needed_headroom = 0;
  197. struct sk_buff *skb, *skb2;
  198. struct net_device *prev_dev = NULL;
  199. int present_fcs_len = 0;
  200. /*
  201. * First, we may need to make a copy of the skb because
  202. * (1) we need to modify it for radiotap (if not present), and
  203. * (2) the other RX handlers will modify the skb we got.
  204. *
  205. * We don't need to, of course, if we aren't going to return
  206. * the SKB because it has a bad FCS/PLCP checksum.
  207. */
  208. /* room for the radiotap header based on driver features */
  209. needed_headroom = ieee80211_rx_radiotap_len(local, status);
  210. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  211. present_fcs_len = FCS_LEN;
  212. /* make sure hdr->frame_control is on the linear part */
  213. if (!pskb_may_pull(origskb, 2)) {
  214. dev_kfree_skb(origskb);
  215. return NULL;
  216. }
  217. if (!local->monitors) {
  218. if (should_drop_frame(origskb, present_fcs_len)) {
  219. dev_kfree_skb(origskb);
  220. return NULL;
  221. }
  222. return remove_monitor_info(local, origskb);
  223. }
  224. if (should_drop_frame(origskb, present_fcs_len)) {
  225. /* only need to expand headroom if necessary */
  226. skb = origskb;
  227. origskb = NULL;
  228. /*
  229. * This shouldn't trigger often because most devices have an
  230. * RX header they pull before we get here, and that should
  231. * be big enough for our radiotap information. We should
  232. * probably export the length to drivers so that we can have
  233. * them allocate enough headroom to start with.
  234. */
  235. if (skb_headroom(skb) < needed_headroom &&
  236. pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
  237. dev_kfree_skb(skb);
  238. return NULL;
  239. }
  240. } else {
  241. /*
  242. * Need to make a copy and possibly remove radiotap header
  243. * and FCS from the original.
  244. */
  245. skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
  246. origskb = remove_monitor_info(local, origskb);
  247. if (!skb)
  248. return origskb;
  249. }
  250. /* prepend radiotap information */
  251. ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
  252. skb_reset_mac_header(skb);
  253. skb->ip_summed = CHECKSUM_UNNECESSARY;
  254. skb->pkt_type = PACKET_OTHERHOST;
  255. skb->protocol = htons(ETH_P_802_2);
  256. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  257. if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
  258. continue;
  259. if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
  260. continue;
  261. if (!ieee80211_sdata_running(sdata))
  262. continue;
  263. if (prev_dev) {
  264. skb2 = skb_clone(skb, GFP_ATOMIC);
  265. if (skb2) {
  266. skb2->dev = prev_dev;
  267. netif_receive_skb(skb2);
  268. }
  269. }
  270. prev_dev = sdata->dev;
  271. sdata->dev->stats.rx_packets++;
  272. sdata->dev->stats.rx_bytes += skb->len;
  273. }
  274. if (prev_dev) {
  275. skb->dev = prev_dev;
  276. netif_receive_skb(skb);
  277. } else
  278. dev_kfree_skb(skb);
  279. return origskb;
  280. }
  281. static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  282. {
  283. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  284. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  285. int tid, seqno_idx, security_idx;
  286. /* does the frame have a qos control field? */
  287. if (ieee80211_is_data_qos(hdr->frame_control)) {
  288. u8 *qc = ieee80211_get_qos_ctl(hdr);
  289. /* frame has qos control */
  290. tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
  291. if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
  292. status->rx_flags |= IEEE80211_RX_AMSDU;
  293. seqno_idx = tid;
  294. security_idx = tid;
  295. } else {
  296. /*
  297. * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
  298. *
  299. * Sequence numbers for management frames, QoS data
  300. * frames with a broadcast/multicast address in the
  301. * Address 1 field, and all non-QoS data frames sent
  302. * by QoS STAs are assigned using an additional single
  303. * modulo-4096 counter, [...]
  304. *
  305. * We also use that counter for non-QoS STAs.
  306. */
  307. seqno_idx = NUM_RX_DATA_QUEUES;
  308. security_idx = 0;
  309. if (ieee80211_is_mgmt(hdr->frame_control))
  310. security_idx = NUM_RX_DATA_QUEUES;
  311. tid = 0;
  312. }
  313. rx->seqno_idx = seqno_idx;
  314. rx->security_idx = security_idx;
  315. /* Set skb->priority to 1d tag if highest order bit of TID is not set.
  316. * For now, set skb->priority to 0 for other cases. */
  317. rx->skb->priority = (tid > 7) ? 0 : tid;
  318. }
  319. /**
  320. * DOC: Packet alignment
  321. *
  322. * Drivers always need to pass packets that are aligned to two-byte boundaries
  323. * to the stack.
  324. *
  325. * Additionally, should, if possible, align the payload data in a way that
  326. * guarantees that the contained IP header is aligned to a four-byte
  327. * boundary. In the case of regular frames, this simply means aligning the
  328. * payload to a four-byte boundary (because either the IP header is directly
  329. * contained, or IV/RFC1042 headers that have a length divisible by four are
  330. * in front of it). If the payload data is not properly aligned and the
  331. * architecture doesn't support efficient unaligned operations, mac80211
  332. * will align the data.
  333. *
  334. * With A-MSDU frames, however, the payload data address must yield two modulo
  335. * four because there are 14-byte 802.3 headers within the A-MSDU frames that
  336. * push the IP header further back to a multiple of four again. Thankfully, the
  337. * specs were sane enough this time around to require padding each A-MSDU
  338. * subframe to a length that is a multiple of four.
  339. *
  340. * Padding like Atheros hardware adds which is between the 802.11 header and
  341. * the payload is not supported, the driver is required to move the 802.11
  342. * header to be directly in front of the payload in that case.
  343. */
  344. static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
  345. {
  346. #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
  347. WARN_ONCE((unsigned long)rx->skb->data & 1,
  348. "unaligned packet at 0x%p\n", rx->skb->data);
  349. #endif
  350. }
  351. /* rx handlers */
  352. static ieee80211_rx_result debug_noinline
  353. ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
  354. {
  355. struct ieee80211_local *local = rx->local;
  356. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  357. struct sk_buff *skb = rx->skb;
  358. if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
  359. !local->sched_scanning))
  360. return RX_CONTINUE;
  361. if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
  362. test_bit(SCAN_SW_SCANNING, &local->scanning) ||
  363. local->sched_scanning)
  364. return ieee80211_scan_rx(rx->sdata, skb);
  365. /* scanning finished during invoking of handlers */
  366. I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
  367. return RX_DROP_UNUSABLE;
  368. }
  369. static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
  370. {
  371. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  372. if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
  373. return 0;
  374. return ieee80211_is_robust_mgmt_frame(hdr);
  375. }
  376. static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
  377. {
  378. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  379. if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
  380. return 0;
  381. return ieee80211_is_robust_mgmt_frame(hdr);
  382. }
  383. /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
  384. static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
  385. {
  386. struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
  387. struct ieee80211_mmie *mmie;
  388. if (skb->len < 24 + sizeof(*mmie) ||
  389. !is_multicast_ether_addr(hdr->da))
  390. return -1;
  391. if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
  392. return -1; /* not a robust management frame */
  393. mmie = (struct ieee80211_mmie *)
  394. (skb->data + skb->len - sizeof(*mmie));
  395. if (mmie->element_id != WLAN_EID_MMIE ||
  396. mmie->length != sizeof(*mmie) - 2)
  397. return -1;
  398. return le16_to_cpu(mmie->key_id);
  399. }
  400. static ieee80211_rx_result
  401. ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
  402. {
  403. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  404. char *dev_addr = rx->sdata->vif.addr;
  405. if (ieee80211_is_data(hdr->frame_control)) {
  406. if (is_multicast_ether_addr(hdr->addr1)) {
  407. if (ieee80211_has_tods(hdr->frame_control) ||
  408. !ieee80211_has_fromds(hdr->frame_control))
  409. return RX_DROP_MONITOR;
  410. if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
  411. return RX_DROP_MONITOR;
  412. } else {
  413. if (!ieee80211_has_a4(hdr->frame_control))
  414. return RX_DROP_MONITOR;
  415. if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
  416. return RX_DROP_MONITOR;
  417. }
  418. }
  419. /* If there is not an established peer link and this is not a peer link
  420. * establisment frame, beacon or probe, drop the frame.
  421. */
  422. if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
  423. struct ieee80211_mgmt *mgmt;
  424. if (!ieee80211_is_mgmt(hdr->frame_control))
  425. return RX_DROP_MONITOR;
  426. if (ieee80211_is_action(hdr->frame_control)) {
  427. u8 category;
  428. mgmt = (struct ieee80211_mgmt *)hdr;
  429. category = mgmt->u.action.category;
  430. if (category != WLAN_CATEGORY_MESH_ACTION &&
  431. category != WLAN_CATEGORY_SELF_PROTECTED)
  432. return RX_DROP_MONITOR;
  433. return RX_CONTINUE;
  434. }
  435. if (ieee80211_is_probe_req(hdr->frame_control) ||
  436. ieee80211_is_probe_resp(hdr->frame_control) ||
  437. ieee80211_is_beacon(hdr->frame_control) ||
  438. ieee80211_is_auth(hdr->frame_control))
  439. return RX_CONTINUE;
  440. return RX_DROP_MONITOR;
  441. }
  442. return RX_CONTINUE;
  443. }
  444. #define SEQ_MODULO 0x1000
  445. #define SEQ_MASK 0xfff
  446. static inline int seq_less(u16 sq1, u16 sq2)
  447. {
  448. return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
  449. }
  450. static inline u16 seq_inc(u16 sq)
  451. {
  452. return (sq + 1) & SEQ_MASK;
  453. }
  454. static inline u16 seq_sub(u16 sq1, u16 sq2)
  455. {
  456. return (sq1 - sq2) & SEQ_MASK;
  457. }
  458. static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
  459. struct tid_ampdu_rx *tid_agg_rx,
  460. int index)
  461. {
  462. struct ieee80211_local *local = hw_to_local(hw);
  463. struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
  464. struct ieee80211_rx_status *status;
  465. lockdep_assert_held(&tid_agg_rx->reorder_lock);
  466. if (!skb)
  467. goto no_frame;
  468. /* release the frame from the reorder ring buffer */
  469. tid_agg_rx->stored_mpdu_num--;
  470. tid_agg_rx->reorder_buf[index] = NULL;
  471. status = IEEE80211_SKB_RXCB(skb);
  472. status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
  473. skb_queue_tail(&local->rx_skb_queue, skb);
  474. no_frame:
  475. tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
  476. }
  477. static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
  478. struct tid_ampdu_rx *tid_agg_rx,
  479. u16 head_seq_num)
  480. {
  481. int index;
  482. lockdep_assert_held(&tid_agg_rx->reorder_lock);
  483. while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
  484. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
  485. tid_agg_rx->buf_size;
  486. ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
  487. }
  488. }
  489. /*
  490. * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
  491. * the skb was added to the buffer longer than this time ago, the earlier
  492. * frames that have not yet been received are assumed to be lost and the skb
  493. * can be released for processing. This may also release other skb's from the
  494. * reorder buffer if there are no additional gaps between the frames.
  495. *
  496. * Callers must hold tid_agg_rx->reorder_lock.
  497. */
  498. #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
  499. static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
  500. struct tid_ampdu_rx *tid_agg_rx)
  501. {
  502. int index, j;
  503. lockdep_assert_held(&tid_agg_rx->reorder_lock);
  504. /* release the buffer until next missing frame */
  505. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
  506. tid_agg_rx->buf_size;
  507. if (!tid_agg_rx->reorder_buf[index] &&
  508. tid_agg_rx->stored_mpdu_num > 1) {
  509. /*
  510. * No buffers ready to be released, but check whether any
  511. * frames in the reorder buffer have timed out.
  512. */
  513. int skipped = 1;
  514. for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
  515. j = (j + 1) % tid_agg_rx->buf_size) {
  516. if (!tid_agg_rx->reorder_buf[j]) {
  517. skipped++;
  518. continue;
  519. }
  520. if (skipped &&
  521. !time_after(jiffies, tid_agg_rx->reorder_time[j] +
  522. HT_RX_REORDER_BUF_TIMEOUT))
  523. goto set_release_timer;
  524. #ifdef CONFIG_MAC80211_HT_DEBUG
  525. if (net_ratelimit())
  526. wiphy_debug(hw->wiphy,
  527. "release an RX reorder frame due to timeout on earlier frames\n");
  528. #endif
  529. ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
  530. /*
  531. * Increment the head seq# also for the skipped slots.
  532. */
  533. tid_agg_rx->head_seq_num =
  534. (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
  535. skipped = 0;
  536. }
  537. } else while (tid_agg_rx->reorder_buf[index]) {
  538. ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
  539. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
  540. tid_agg_rx->buf_size;
  541. }
  542. if (tid_agg_rx->stored_mpdu_num) {
  543. j = index = seq_sub(tid_agg_rx->head_seq_num,
  544. tid_agg_rx->ssn) % tid_agg_rx->buf_size;
  545. for (; j != (index - 1) % tid_agg_rx->buf_size;
  546. j = (j + 1) % tid_agg_rx->buf_size) {
  547. if (tid_agg_rx->reorder_buf[j])
  548. break;
  549. }
  550. set_release_timer:
  551. mod_timer(&tid_agg_rx->reorder_timer,
  552. tid_agg_rx->reorder_time[j] + 1 +
  553. HT_RX_REORDER_BUF_TIMEOUT);
  554. } else {
  555. del_timer(&tid_agg_rx->reorder_timer);
  556. }
  557. }
  558. /*
  559. * As this function belongs to the RX path it must be under
  560. * rcu_read_lock protection. It returns false if the frame
  561. * can be processed immediately, true if it was consumed.
  562. */
  563. static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  564. struct tid_ampdu_rx *tid_agg_rx,
  565. struct sk_buff *skb)
  566. {
  567. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  568. u16 sc = le16_to_cpu(hdr->seq_ctrl);
  569. u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
  570. u16 head_seq_num, buf_size;
  571. int index;
  572. bool ret = true;
  573. spin_lock(&tid_agg_rx->reorder_lock);
  574. buf_size = tid_agg_rx->buf_size;
  575. head_seq_num = tid_agg_rx->head_seq_num;
  576. /* frame with out of date sequence number */
  577. if (seq_less(mpdu_seq_num, head_seq_num)) {
  578. dev_kfree_skb(skb);
  579. goto out;
  580. }
  581. /*
  582. * If frame the sequence number exceeds our buffering window
  583. * size release some previous frames to make room for this one.
  584. */
  585. if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
  586. head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
  587. /* release stored frames up to new head to stack */
  588. ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
  589. }
  590. /* Now the new frame is always in the range of the reordering buffer */
  591. index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
  592. /* check if we already stored this frame */
  593. if (tid_agg_rx->reorder_buf[index]) {
  594. dev_kfree_skb(skb);
  595. goto out;
  596. }
  597. /*
  598. * If the current MPDU is in the right order and nothing else
  599. * is stored we can process it directly, no need to buffer it.
  600. * If it is first but there's something stored, we may be able
  601. * to release frames after this one.
  602. */
  603. if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
  604. tid_agg_rx->stored_mpdu_num == 0) {
  605. tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
  606. ret = false;
  607. goto out;
  608. }
  609. /* put the frame in the reordering buffer */
  610. tid_agg_rx->reorder_buf[index] = skb;
  611. tid_agg_rx->reorder_time[index] = jiffies;
  612. tid_agg_rx->stored_mpdu_num++;
  613. ieee80211_sta_reorder_release(hw, tid_agg_rx);
  614. out:
  615. spin_unlock(&tid_agg_rx->reorder_lock);
  616. return ret;
  617. }
  618. /*
  619. * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
  620. * true if the MPDU was buffered, false if it should be processed.
  621. */
  622. static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
  623. {
  624. struct sk_buff *skb = rx->skb;
  625. struct ieee80211_local *local = rx->local;
  626. struct ieee80211_hw *hw = &local->hw;
  627. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  628. struct sta_info *sta = rx->sta;
  629. struct tid_ampdu_rx *tid_agg_rx;
  630. u16 sc;
  631. int tid;
  632. if (!ieee80211_is_data_qos(hdr->frame_control))
  633. goto dont_reorder;
  634. /*
  635. * filter the QoS data rx stream according to
  636. * STA/TID and check if this STA/TID is on aggregation
  637. */
  638. if (!sta)
  639. goto dont_reorder;
  640. tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
  641. tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
  642. if (!tid_agg_rx)
  643. goto dont_reorder;
  644. /* qos null data frames are excluded */
  645. if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
  646. goto dont_reorder;
  647. /* new, potentially un-ordered, ampdu frame - process it */
  648. /* reset session timer */
  649. if (tid_agg_rx->timeout)
  650. mod_timer(&tid_agg_rx->session_timer,
  651. TU_TO_EXP_TIME(tid_agg_rx->timeout));
  652. /* if this mpdu is fragmented - terminate rx aggregation session */
  653. sc = le16_to_cpu(hdr->seq_ctrl);
  654. if (sc & IEEE80211_SCTL_FRAG) {
  655. skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
  656. skb_queue_tail(&rx->sdata->skb_queue, skb);
  657. ieee80211_queue_work(&local->hw, &rx->sdata->work);
  658. return;
  659. }
  660. /*
  661. * No locking needed -- we will only ever process one
  662. * RX packet at a time, and thus own tid_agg_rx. All
  663. * other code manipulating it needs to (and does) make
  664. * sure that we cannot get to it any more before doing
  665. * anything with it.
  666. */
  667. if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
  668. return;
  669. dont_reorder:
  670. skb_queue_tail(&local->rx_skb_queue, skb);
  671. }
  672. static ieee80211_rx_result debug_noinline
  673. ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
  674. {
  675. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  676. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  677. /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
  678. if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
  679. if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
  680. rx->sta->last_seq_ctrl[rx->seqno_idx] ==
  681. hdr->seq_ctrl)) {
  682. if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
  683. rx->local->dot11FrameDuplicateCount++;
  684. rx->sta->num_duplicates++;
  685. }
  686. return RX_DROP_UNUSABLE;
  687. } else
  688. rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
  689. }
  690. if (unlikely(rx->skb->len < 16)) {
  691. I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
  692. return RX_DROP_MONITOR;
  693. }
  694. /* Drop disallowed frame classes based on STA auth/assoc state;
  695. * IEEE 802.11, Chap 5.5.
  696. *
  697. * mac80211 filters only based on association state, i.e. it drops
  698. * Class 3 frames from not associated stations. hostapd sends
  699. * deauth/disassoc frames when needed. In addition, hostapd is
  700. * responsible for filtering on both auth and assoc states.
  701. */
  702. if (ieee80211_vif_is_mesh(&rx->sdata->vif))
  703. return ieee80211_rx_mesh_check(rx);
  704. if (unlikely((ieee80211_is_data(hdr->frame_control) ||
  705. ieee80211_is_pspoll(hdr->frame_control)) &&
  706. rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
  707. rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
  708. (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
  709. if (rx->sta && rx->sta->dummy &&
  710. ieee80211_is_data_present(hdr->frame_control)) {
  711. u16 ethertype;
  712. u8 *payload;
  713. payload = rx->skb->data +
  714. ieee80211_hdrlen(hdr->frame_control);
  715. ethertype = (payload[6] << 8) | payload[7];
  716. if (cpu_to_be16(ethertype) ==
  717. rx->sdata->control_port_protocol)
  718. return RX_CONTINUE;
  719. }
  720. return RX_DROP_MONITOR;
  721. }
  722. return RX_CONTINUE;
  723. }
  724. static ieee80211_rx_result debug_noinline
  725. ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
  726. {
  727. struct sk_buff *skb = rx->skb;
  728. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  729. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  730. int keyidx;
  731. int hdrlen;
  732. ieee80211_rx_result result = RX_DROP_UNUSABLE;
  733. struct ieee80211_key *sta_ptk = NULL;
  734. int mmie_keyidx = -1;
  735. __le16 fc;
  736. /*
  737. * Key selection 101
  738. *
  739. * There are four types of keys:
  740. * - GTK (group keys)
  741. * - IGTK (group keys for management frames)
  742. * - PTK (pairwise keys)
  743. * - STK (station-to-station pairwise keys)
  744. *
  745. * When selecting a key, we have to distinguish between multicast
  746. * (including broadcast) and unicast frames, the latter can only
  747. * use PTKs and STKs while the former always use GTKs and IGTKs.
  748. * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
  749. * unicast frames can also use key indices like GTKs. Hence, if we
  750. * don't have a PTK/STK we check the key index for a WEP key.
  751. *
  752. * Note that in a regular BSS, multicast frames are sent by the
  753. * AP only, associated stations unicast the frame to the AP first
  754. * which then multicasts it on their behalf.
  755. *
  756. * There is also a slight problem in IBSS mode: GTKs are negotiated
  757. * with each station, that is something we don't currently handle.
  758. * The spec seems to expect that one negotiates the same key with
  759. * every station but there's no such requirement; VLANs could be
  760. * possible.
  761. */
  762. /*
  763. * No point in finding a key and decrypting if the frame is neither
  764. * addressed to us nor a multicast frame.
  765. */
  766. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  767. return RX_CONTINUE;
  768. /* start without a key */
  769. rx->key = NULL;
  770. if (rx->sta)
  771. sta_ptk = rcu_dereference(rx->sta->ptk);
  772. fc = hdr->frame_control;
  773. if (!ieee80211_has_protected(fc))
  774. mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
  775. if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
  776. rx->key = sta_ptk;
  777. if ((status->flag & RX_FLAG_DECRYPTED) &&
  778. (status->flag & RX_FLAG_IV_STRIPPED))
  779. return RX_CONTINUE;
  780. /* Skip decryption if the frame is not protected. */
  781. if (!ieee80211_has_protected(fc))
  782. return RX_CONTINUE;
  783. } else if (mmie_keyidx >= 0) {
  784. /* Broadcast/multicast robust management frame / BIP */
  785. if ((status->flag & RX_FLAG_DECRYPTED) &&
  786. (status->flag & RX_FLAG_IV_STRIPPED))
  787. return RX_CONTINUE;
  788. if (mmie_keyidx < NUM_DEFAULT_KEYS ||
  789. mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
  790. return RX_DROP_MONITOR; /* unexpected BIP keyidx */
  791. if (rx->sta)
  792. rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
  793. if (!rx->key)
  794. rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
  795. } else if (!ieee80211_has_protected(fc)) {
  796. /*
  797. * The frame was not protected, so skip decryption. However, we
  798. * need to set rx->key if there is a key that could have been
  799. * used so that the frame may be dropped if encryption would
  800. * have been expected.
  801. */
  802. struct ieee80211_key *key = NULL;
  803. struct ieee80211_sub_if_data *sdata = rx->sdata;
  804. int i;
  805. if (ieee80211_is_mgmt(fc) &&
  806. is_multicast_ether_addr(hdr->addr1) &&
  807. (key = rcu_dereference(rx->sdata->default_mgmt_key)))
  808. rx->key = key;
  809. else {
  810. if (rx->sta) {
  811. for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
  812. key = rcu_dereference(rx->sta->gtk[i]);
  813. if (key)
  814. break;
  815. }
  816. }
  817. if (!key) {
  818. for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
  819. key = rcu_dereference(sdata->keys[i]);
  820. if (key)
  821. break;
  822. }
  823. }
  824. if (key)
  825. rx->key = key;
  826. }
  827. return RX_CONTINUE;
  828. } else {
  829. u8 keyid;
  830. /*
  831. * The device doesn't give us the IV so we won't be
  832. * able to look up the key. That's ok though, we
  833. * don't need to decrypt the frame, we just won't
  834. * be able to keep statistics accurate.
  835. * Except for key threshold notifications, should
  836. * we somehow allow the driver to tell us which key
  837. * the hardware used if this flag is set?
  838. */
  839. if ((status->flag & RX_FLAG_DECRYPTED) &&
  840. (status->flag & RX_FLAG_IV_STRIPPED))
  841. return RX_CONTINUE;
  842. hdrlen = ieee80211_hdrlen(fc);
  843. if (rx->skb->len < 8 + hdrlen)
  844. return RX_DROP_UNUSABLE; /* TODO: count this? */
  845. /*
  846. * no need to call ieee80211_wep_get_keyidx,
  847. * it verifies a bunch of things we've done already
  848. */
  849. skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
  850. keyidx = keyid >> 6;
  851. /* check per-station GTK first, if multicast packet */
  852. if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
  853. rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
  854. /* if not found, try default key */
  855. if (!rx->key) {
  856. rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
  857. /*
  858. * RSNA-protected unicast frames should always be
  859. * sent with pairwise or station-to-station keys,
  860. * but for WEP we allow using a key index as well.
  861. */
  862. if (rx->key &&
  863. rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
  864. rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
  865. !is_multicast_ether_addr(hdr->addr1))
  866. rx->key = NULL;
  867. }
  868. }
  869. if (rx->key) {
  870. if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
  871. return RX_DROP_MONITOR;
  872. rx->key->tx_rx_count++;
  873. /* TODO: add threshold stuff again */
  874. } else {
  875. return RX_DROP_MONITOR;
  876. }
  877. if (skb_linearize(rx->skb))
  878. return RX_DROP_UNUSABLE;
  879. /* the hdr variable is invalid now! */
  880. switch (rx->key->conf.cipher) {
  881. case WLAN_CIPHER_SUITE_WEP40:
  882. case WLAN_CIPHER_SUITE_WEP104:
  883. /* Check for weak IVs if possible */
  884. if (rx->sta && ieee80211_is_data(fc) &&
  885. (!(status->flag & RX_FLAG_IV_STRIPPED) ||
  886. !(status->flag & RX_FLAG_DECRYPTED)) &&
  887. ieee80211_wep_is_weak_iv(rx->skb, rx->key))
  888. rx->sta->wep_weak_iv_count++;
  889. result = ieee80211_crypto_wep_decrypt(rx);
  890. break;
  891. case WLAN_CIPHER_SUITE_TKIP:
  892. result = ieee80211_crypto_tkip_decrypt(rx);
  893. break;
  894. case WLAN_CIPHER_SUITE_CCMP:
  895. result = ieee80211_crypto_ccmp_decrypt(rx);
  896. break;
  897. case WLAN_CIPHER_SUITE_AES_CMAC:
  898. result = ieee80211_crypto_aes_cmac_decrypt(rx);
  899. break;
  900. default:
  901. /*
  902. * We can reach here only with HW-only algorithms
  903. * but why didn't it decrypt the frame?!
  904. */
  905. return RX_DROP_UNUSABLE;
  906. }
  907. /* either the frame has been decrypted or will be dropped */
  908. status->flag |= RX_FLAG_DECRYPTED;
  909. return result;
  910. }
  911. static ieee80211_rx_result debug_noinline
  912. ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
  913. {
  914. struct ieee80211_local *local;
  915. struct ieee80211_hdr *hdr;
  916. struct sk_buff *skb;
  917. local = rx->local;
  918. skb = rx->skb;
  919. hdr = (struct ieee80211_hdr *) skb->data;
  920. if (!local->pspolling)
  921. return RX_CONTINUE;
  922. if (!ieee80211_has_fromds(hdr->frame_control))
  923. /* this is not from AP */
  924. return RX_CONTINUE;
  925. if (!ieee80211_is_data(hdr->frame_control))
  926. return RX_CONTINUE;
  927. if (!ieee80211_has_moredata(hdr->frame_control)) {
  928. /* AP has no more frames buffered for us */
  929. local->pspolling = false;
  930. return RX_CONTINUE;
  931. }
  932. /* more data bit is set, let's request a new frame from the AP */
  933. ieee80211_send_pspoll(local, rx->sdata);
  934. return RX_CONTINUE;
  935. }
  936. static void ap_sta_ps_start(struct sta_info *sta)
  937. {
  938. struct ieee80211_sub_if_data *sdata = sta->sdata;
  939. struct ieee80211_local *local = sdata->local;
  940. atomic_inc(&sdata->bss->num_sta_ps);
  941. set_sta_flag(sta, WLAN_STA_PS_STA);
  942. if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
  943. drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
  944. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  945. printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
  946. sdata->name, sta->sta.addr, sta->sta.aid);
  947. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  948. }
  949. static void ap_sta_ps_end(struct sta_info *sta)
  950. {
  951. struct ieee80211_sub_if_data *sdata = sta->sdata;
  952. atomic_dec(&sdata->bss->num_sta_ps);
  953. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  954. printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
  955. sdata->name, sta->sta.addr, sta->sta.aid);
  956. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  957. if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
  958. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  959. printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
  960. sdata->name, sta->sta.addr, sta->sta.aid);
  961. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  962. return;
  963. }
  964. ieee80211_sta_ps_deliver_wakeup(sta);
  965. }
  966. int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
  967. {
  968. struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
  969. bool in_ps;
  970. WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
  971. /* Don't let the same PS state be set twice */
  972. in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
  973. if ((start && in_ps) || (!start && !in_ps))
  974. return -EINVAL;
  975. if (start)
  976. ap_sta_ps_start(sta_inf);
  977. else
  978. ap_sta_ps_end(sta_inf);
  979. return 0;
  980. }
  981. EXPORT_SYMBOL(ieee80211_sta_ps_transition);
  982. static ieee80211_rx_result debug_noinline
  983. ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
  984. {
  985. struct ieee80211_sub_if_data *sdata = rx->sdata;
  986. struct ieee80211_hdr *hdr = (void *)rx->skb->data;
  987. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  988. int tid, ac;
  989. if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
  990. return RX_CONTINUE;
  991. if (sdata->vif.type != NL80211_IFTYPE_AP &&
  992. sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
  993. return RX_CONTINUE;
  994. /*
  995. * The device handles station powersave, so don't do anything about
  996. * uAPSD and PS-Poll frames (the latter shouldn't even come up from
  997. * it to mac80211 since they're handled.)
  998. */
  999. if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
  1000. return RX_CONTINUE;
  1001. /*
  1002. * Don't do anything if the station isn't already asleep. In
  1003. * the uAPSD case, the station will probably be marked asleep,
  1004. * in the PS-Poll case the station must be confused ...
  1005. */
  1006. if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
  1007. return RX_CONTINUE;
  1008. if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
  1009. if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
  1010. if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
  1011. ieee80211_sta_ps_deliver_poll_response(rx->sta);
  1012. else
  1013. set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
  1014. }
  1015. /* Free PS Poll skb here instead of returning RX_DROP that would
  1016. * count as an dropped frame. */
  1017. dev_kfree_skb(rx->skb);
  1018. return RX_QUEUED;
  1019. } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
  1020. !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
  1021. ieee80211_has_pm(hdr->frame_control) &&
  1022. (ieee80211_is_data_qos(hdr->frame_control) ||
  1023. ieee80211_is_qos_nullfunc(hdr->frame_control))) {
  1024. tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
  1025. ac = ieee802_1d_to_ac[tid & 7];
  1026. /*
  1027. * If this AC is not trigger-enabled do nothing.
  1028. *
  1029. * NB: This could/should check a separate bitmap of trigger-
  1030. * enabled queues, but for now we only implement uAPSD w/o
  1031. * TSPEC changes to the ACs, so they're always the same.
  1032. */
  1033. if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
  1034. return RX_CONTINUE;
  1035. /* if we are in a service period, do nothing */
  1036. if (test_sta_flag(rx->sta, WLAN_STA_SP))
  1037. return RX_CONTINUE;
  1038. if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
  1039. ieee80211_sta_ps_deliver_uapsd(rx->sta);
  1040. else
  1041. set_sta_flag(rx->sta, WLAN_STA_UAPSD);
  1042. }
  1043. return RX_CONTINUE;
  1044. }
  1045. static ieee80211_rx_result debug_noinline
  1046. ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
  1047. {
  1048. struct sta_info *sta = rx->sta;
  1049. struct sk_buff *skb = rx->skb;
  1050. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  1051. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  1052. if (!sta)
  1053. return RX_CONTINUE;
  1054. /*
  1055. * Update last_rx only for IBSS packets which are for the current
  1056. * BSSID to avoid keeping the current IBSS network alive in cases
  1057. * where other STAs start using different BSSID.
  1058. */
  1059. if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
  1060. u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
  1061. NL80211_IFTYPE_ADHOC);
  1062. if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
  1063. sta->last_rx = jiffies;
  1064. if (ieee80211_is_data(hdr->frame_control)) {
  1065. sta->last_rx_rate_idx = status->rate_idx;
  1066. sta->last_rx_rate_flag = status->flag;
  1067. }
  1068. }
  1069. } else if (!is_multicast_ether_addr(hdr->addr1)) {
  1070. /*
  1071. * Mesh beacons will update last_rx when if they are found to
  1072. * match the current local configuration when processed.
  1073. */
  1074. sta->last_rx = jiffies;
  1075. if (ieee80211_is_data(hdr->frame_control)) {
  1076. sta->last_rx_rate_idx = status->rate_idx;
  1077. sta->last_rx_rate_flag = status->flag;
  1078. }
  1079. }
  1080. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1081. return RX_CONTINUE;
  1082. if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
  1083. ieee80211_sta_rx_notify(rx->sdata, hdr);
  1084. sta->rx_fragments++;
  1085. sta->rx_bytes += rx->skb->len;
  1086. sta->last_signal = status->signal;
  1087. ewma_add(&sta->avg_signal, -status->signal);
  1088. /*
  1089. * Change STA power saving mode only at the end of a frame
  1090. * exchange sequence.
  1091. */
  1092. if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
  1093. !ieee80211_has_morefrags(hdr->frame_control) &&
  1094. !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
  1095. (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
  1096. rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
  1097. if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
  1098. /*
  1099. * Ignore doze->wake transitions that are
  1100. * indicated by non-data frames, the standard
  1101. * is unclear here, but for example going to
  1102. * PS mode and then scanning would cause a
  1103. * doze->wake transition for the probe request,
  1104. * and that is clearly undesirable.
  1105. */
  1106. if (ieee80211_is_data(hdr->frame_control) &&
  1107. !ieee80211_has_pm(hdr->frame_control))
  1108. ap_sta_ps_end(sta);
  1109. } else {
  1110. if (ieee80211_has_pm(hdr->frame_control))
  1111. ap_sta_ps_start(sta);
  1112. }
  1113. }
  1114. /*
  1115. * Drop (qos-)data::nullfunc frames silently, since they
  1116. * are used only to control station power saving mode.
  1117. */
  1118. if (ieee80211_is_nullfunc(hdr->frame_control) ||
  1119. ieee80211_is_qos_nullfunc(hdr->frame_control)) {
  1120. I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
  1121. /*
  1122. * If we receive a 4-addr nullfunc frame from a STA
  1123. * that was not moved to a 4-addr STA vlan yet, drop
  1124. * the frame to the monitor interface, to make sure
  1125. * that hostapd sees it
  1126. */
  1127. if (ieee80211_has_a4(hdr->frame_control) &&
  1128. (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
  1129. (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1130. !rx->sdata->u.vlan.sta)))
  1131. return RX_DROP_MONITOR;
  1132. /*
  1133. * Update counter and free packet here to avoid
  1134. * counting this as a dropped packed.
  1135. */
  1136. sta->rx_packets++;
  1137. dev_kfree_skb(rx->skb);
  1138. return RX_QUEUED;
  1139. }
  1140. return RX_CONTINUE;
  1141. } /* ieee80211_rx_h_sta_process */
  1142. static inline struct ieee80211_fragment_entry *
  1143. ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
  1144. unsigned int frag, unsigned int seq, int rx_queue,
  1145. struct sk_buff **skb)
  1146. {
  1147. struct ieee80211_fragment_entry *entry;
  1148. int idx;
  1149. idx = sdata->fragment_next;
  1150. entry = &sdata->fragments[sdata->fragment_next++];
  1151. if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
  1152. sdata->fragment_next = 0;
  1153. if (!skb_queue_empty(&entry->skb_list)) {
  1154. #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
  1155. struct ieee80211_hdr *hdr =
  1156. (struct ieee80211_hdr *) entry->skb_list.next->data;
  1157. printk(KERN_DEBUG "%s: RX reassembly removed oldest "
  1158. "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
  1159. "addr1=%pM addr2=%pM\n",
  1160. sdata->name, idx,
  1161. jiffies - entry->first_frag_time, entry->seq,
  1162. entry->last_frag, hdr->addr1, hdr->addr2);
  1163. #endif
  1164. __skb_queue_purge(&entry->skb_list);
  1165. }
  1166. __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
  1167. *skb = NULL;
  1168. entry->first_frag_time = jiffies;
  1169. entry->seq = seq;
  1170. entry->rx_queue = rx_queue;
  1171. entry->last_frag = frag;
  1172. entry->ccmp = 0;
  1173. entry->extra_len = 0;
  1174. return entry;
  1175. }
  1176. static inline struct ieee80211_fragment_entry *
  1177. ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
  1178. unsigned int frag, unsigned int seq,
  1179. int rx_queue, struct ieee80211_hdr *hdr)
  1180. {
  1181. struct ieee80211_fragment_entry *entry;
  1182. int i, idx;
  1183. idx = sdata->fragment_next;
  1184. for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
  1185. struct ieee80211_hdr *f_hdr;
  1186. idx--;
  1187. if (idx < 0)
  1188. idx = IEEE80211_FRAGMENT_MAX - 1;
  1189. entry = &sdata->fragments[idx];
  1190. if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
  1191. entry->rx_queue != rx_queue ||
  1192. entry->last_frag + 1 != frag)
  1193. continue;
  1194. f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
  1195. /*
  1196. * Check ftype and addresses are equal, else check next fragment
  1197. */
  1198. if (((hdr->frame_control ^ f_hdr->frame_control) &
  1199. cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
  1200. compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
  1201. compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
  1202. continue;
  1203. if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
  1204. __skb_queue_purge(&entry->skb_list);
  1205. continue;
  1206. }
  1207. return entry;
  1208. }
  1209. return NULL;
  1210. }
  1211. static ieee80211_rx_result debug_noinline
  1212. ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
  1213. {
  1214. struct ieee80211_hdr *hdr;
  1215. u16 sc;
  1216. __le16 fc;
  1217. unsigned int frag, seq;
  1218. struct ieee80211_fragment_entry *entry;
  1219. struct sk_buff *skb;
  1220. struct ieee80211_rx_status *status;
  1221. hdr = (struct ieee80211_hdr *)rx->skb->data;
  1222. fc = hdr->frame_control;
  1223. sc = le16_to_cpu(hdr->seq_ctrl);
  1224. frag = sc & IEEE80211_SCTL_FRAG;
  1225. if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
  1226. (rx->skb)->len < 24 ||
  1227. is_multicast_ether_addr(hdr->addr1))) {
  1228. /* not fragmented */
  1229. goto out;
  1230. }
  1231. I802_DEBUG_INC(rx->local->rx_handlers_fragments);
  1232. if (skb_linearize(rx->skb))
  1233. return RX_DROP_UNUSABLE;
  1234. /*
  1235. * skb_linearize() might change the skb->data and
  1236. * previously cached variables (in this case, hdr) need to
  1237. * be refreshed with the new data.
  1238. */
  1239. hdr = (struct ieee80211_hdr *)rx->skb->data;
  1240. seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
  1241. if (frag == 0) {
  1242. /* This is the first fragment of a new frame. */
  1243. entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
  1244. rx->seqno_idx, &(rx->skb));
  1245. if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
  1246. ieee80211_has_protected(fc)) {
  1247. int queue = rx->security_idx;
  1248. /* Store CCMP PN so that we can verify that the next
  1249. * fragment has a sequential PN value. */
  1250. entry->ccmp = 1;
  1251. memcpy(entry->last_pn,
  1252. rx->key->u.ccmp.rx_pn[queue],
  1253. CCMP_PN_LEN);
  1254. }
  1255. return RX_QUEUED;
  1256. }
  1257. /* This is a fragment for a frame that should already be pending in
  1258. * fragment cache. Add this fragment to the end of the pending entry.
  1259. */
  1260. entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
  1261. rx->seqno_idx, hdr);
  1262. if (!entry) {
  1263. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  1264. return RX_DROP_MONITOR;
  1265. }
  1266. /* Verify that MPDUs within one MSDU have sequential PN values.
  1267. * (IEEE 802.11i, 8.3.3.4.5) */
  1268. if (entry->ccmp) {
  1269. int i;
  1270. u8 pn[CCMP_PN_LEN], *rpn;
  1271. int queue;
  1272. if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
  1273. return RX_DROP_UNUSABLE;
  1274. memcpy(pn, entry->last_pn, CCMP_PN_LEN);
  1275. for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
  1276. pn[i]++;
  1277. if (pn[i])
  1278. break;
  1279. }
  1280. queue = rx->security_idx;
  1281. rpn = rx->key->u.ccmp.rx_pn[queue];
  1282. if (memcmp(pn, rpn, CCMP_PN_LEN))
  1283. return RX_DROP_UNUSABLE;
  1284. memcpy(entry->last_pn, pn, CCMP_PN_LEN);
  1285. }
  1286. skb_pull(rx->skb, ieee80211_hdrlen(fc));
  1287. __skb_queue_tail(&entry->skb_list, rx->skb);
  1288. entry->last_frag = frag;
  1289. entry->extra_len += rx->skb->len;
  1290. if (ieee80211_has_morefrags(fc)) {
  1291. rx->skb = NULL;
  1292. return RX_QUEUED;
  1293. }
  1294. rx->skb = __skb_dequeue(&entry->skb_list);
  1295. if (skb_tailroom(rx->skb) < entry->extra_len) {
  1296. I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
  1297. if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
  1298. GFP_ATOMIC))) {
  1299. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  1300. __skb_queue_purge(&entry->skb_list);
  1301. return RX_DROP_UNUSABLE;
  1302. }
  1303. }
  1304. while ((skb = __skb_dequeue(&entry->skb_list))) {
  1305. memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
  1306. dev_kfree_skb(skb);
  1307. }
  1308. /* Complete frame has been reassembled - process it now */
  1309. status = IEEE80211_SKB_RXCB(rx->skb);
  1310. status->rx_flags |= IEEE80211_RX_FRAGMENTED;
  1311. out:
  1312. if (rx->sta)
  1313. rx->sta->rx_packets++;
  1314. if (is_multicast_ether_addr(hdr->addr1))
  1315. rx->local->dot11MulticastReceivedFrameCount++;
  1316. else
  1317. ieee80211_led_rx(rx->local);
  1318. return RX_CONTINUE;
  1319. }
  1320. static ieee80211_rx_result debug_noinline
  1321. ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
  1322. {
  1323. u8 *data = rx->skb->data;
  1324. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
  1325. if (!ieee80211_is_data_qos(hdr->frame_control))
  1326. return RX_CONTINUE;
  1327. /* remove the qos control field, update frame type and meta-data */
  1328. memmove(data + IEEE80211_QOS_CTL_LEN, data,
  1329. ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
  1330. hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
  1331. /* change frame type to non QOS */
  1332. hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
  1333. return RX_CONTINUE;
  1334. }
  1335. static int
  1336. ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
  1337. {
  1338. if (unlikely(!rx->sta ||
  1339. !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
  1340. return -EACCES;
  1341. return 0;
  1342. }
  1343. static int
  1344. ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
  1345. {
  1346. struct sk_buff *skb = rx->skb;
  1347. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  1348. /*
  1349. * Pass through unencrypted frames if the hardware has
  1350. * decrypted them already.
  1351. */
  1352. if (status->flag & RX_FLAG_DECRYPTED)
  1353. return 0;
  1354. /* Drop unencrypted frames if key is set. */
  1355. if (unlikely(!ieee80211_has_protected(fc) &&
  1356. !ieee80211_is_nullfunc(fc) &&
  1357. ieee80211_is_data(fc) &&
  1358. (rx->key || rx->sdata->drop_unencrypted)))
  1359. return -EACCES;
  1360. return 0;
  1361. }
  1362. static int
  1363. ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
  1364. {
  1365. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1366. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1367. __le16 fc = hdr->frame_control;
  1368. /*
  1369. * Pass through unencrypted frames if the hardware has
  1370. * decrypted them already.
  1371. */
  1372. if (status->flag & RX_FLAG_DECRYPTED)
  1373. return 0;
  1374. if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
  1375. if (unlikely(!ieee80211_has_protected(fc) &&
  1376. ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
  1377. rx->key)) {
  1378. if (ieee80211_is_deauth(fc))
  1379. cfg80211_send_unprot_deauth(rx->sdata->dev,
  1380. rx->skb->data,
  1381. rx->skb->len);
  1382. else if (ieee80211_is_disassoc(fc))
  1383. cfg80211_send_unprot_disassoc(rx->sdata->dev,
  1384. rx->skb->data,
  1385. rx->skb->len);
  1386. return -EACCES;
  1387. }
  1388. /* BIP does not use Protected field, so need to check MMIE */
  1389. if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
  1390. ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
  1391. if (ieee80211_is_deauth(fc))
  1392. cfg80211_send_unprot_deauth(rx->sdata->dev,
  1393. rx->skb->data,
  1394. rx->skb->len);
  1395. else if (ieee80211_is_disassoc(fc))
  1396. cfg80211_send_unprot_disassoc(rx->sdata->dev,
  1397. rx->skb->data,
  1398. rx->skb->len);
  1399. return -EACCES;
  1400. }
  1401. /*
  1402. * When using MFP, Action frames are not allowed prior to
  1403. * having configured keys.
  1404. */
  1405. if (unlikely(ieee80211_is_action(fc) && !rx->key &&
  1406. ieee80211_is_robust_mgmt_frame(
  1407. (struct ieee80211_hdr *) rx->skb->data)))
  1408. return -EACCES;
  1409. }
  1410. return 0;
  1411. }
  1412. static int
  1413. __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
  1414. {
  1415. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1416. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1417. bool check_port_control = false;
  1418. struct ethhdr *ehdr;
  1419. int ret;
  1420. *port_control = false;
  1421. if (ieee80211_has_a4(hdr->frame_control) &&
  1422. sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
  1423. return -1;
  1424. if (sdata->vif.type == NL80211_IFTYPE_STATION &&
  1425. !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
  1426. if (!sdata->u.mgd.use_4addr)
  1427. return -1;
  1428. else
  1429. check_port_control = true;
  1430. }
  1431. if (is_multicast_ether_addr(hdr->addr1) &&
  1432. sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
  1433. return -1;
  1434. ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
  1435. if (ret < 0)
  1436. return ret;
  1437. ehdr = (struct ethhdr *) rx->skb->data;
  1438. if (ehdr->h_proto == rx->sdata->control_port_protocol)
  1439. *port_control = true;
  1440. else if (check_port_control)
  1441. return -1;
  1442. return 0;
  1443. }
  1444. /*
  1445. * requires that rx->skb is a frame with ethernet header
  1446. */
  1447. static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
  1448. {
  1449. static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
  1450. = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
  1451. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1452. /*
  1453. * Allow EAPOL frames to us/the PAE group address regardless
  1454. * of whether the frame was encrypted or not.
  1455. */
  1456. if (ehdr->h_proto == rx->sdata->control_port_protocol &&
  1457. (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
  1458. compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
  1459. return true;
  1460. if (ieee80211_802_1x_port_control(rx) ||
  1461. ieee80211_drop_unencrypted(rx, fc))
  1462. return false;
  1463. return true;
  1464. }
  1465. /*
  1466. * requires that rx->skb is a frame with ethernet header
  1467. */
  1468. static void
  1469. ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
  1470. {
  1471. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1472. struct net_device *dev = sdata->dev;
  1473. struct sk_buff *skb, *xmit_skb;
  1474. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1475. struct sta_info *dsta;
  1476. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1477. skb = rx->skb;
  1478. xmit_skb = NULL;
  1479. if ((sdata->vif.type == NL80211_IFTYPE_AP ||
  1480. sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
  1481. !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
  1482. (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
  1483. (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
  1484. if (is_multicast_ether_addr(ehdr->h_dest)) {
  1485. /*
  1486. * send multicast frames both to higher layers in
  1487. * local net stack and back to the wireless medium
  1488. */
  1489. xmit_skb = skb_copy(skb, GFP_ATOMIC);
  1490. if (!xmit_skb && net_ratelimit())
  1491. printk(KERN_DEBUG "%s: failed to clone "
  1492. "multicast frame\n", dev->name);
  1493. } else {
  1494. dsta = sta_info_get(sdata, skb->data);
  1495. if (dsta) {
  1496. /*
  1497. * The destination station is associated to
  1498. * this AP (in this VLAN), so send the frame
  1499. * directly to it and do not pass it to local
  1500. * net stack.
  1501. */
  1502. xmit_skb = skb;
  1503. skb = NULL;
  1504. }
  1505. }
  1506. }
  1507. if (skb) {
  1508. int align __maybe_unused;
  1509. #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
  1510. /*
  1511. * 'align' will only take the values 0 or 2 here
  1512. * since all frames are required to be aligned
  1513. * to 2-byte boundaries when being passed to
  1514. * mac80211. That also explains the __skb_push()
  1515. * below.
  1516. */
  1517. align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
  1518. if (align) {
  1519. if (WARN_ON(skb_headroom(skb) < 3)) {
  1520. dev_kfree_skb(skb);
  1521. skb = NULL;
  1522. } else {
  1523. u8 *data = skb->data;
  1524. size_t len = skb_headlen(skb);
  1525. skb->data -= align;
  1526. memmove(skb->data, data, len);
  1527. skb_set_tail_pointer(skb, len);
  1528. }
  1529. }
  1530. #endif
  1531. if (skb) {
  1532. /* deliver to local stack */
  1533. skb->protocol = eth_type_trans(skb, dev);
  1534. memset(skb->cb, 0, sizeof(skb->cb));
  1535. netif_receive_skb(skb);
  1536. }
  1537. }
  1538. if (xmit_skb) {
  1539. /* send to wireless media */
  1540. xmit_skb->protocol = htons(ETH_P_802_3);
  1541. skb_reset_network_header(xmit_skb);
  1542. skb_reset_mac_header(xmit_skb);
  1543. dev_queue_xmit(xmit_skb);
  1544. }
  1545. }
  1546. static ieee80211_rx_result debug_noinline
  1547. ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
  1548. {
  1549. struct net_device *dev = rx->sdata->dev;
  1550. struct sk_buff *skb = rx->skb;
  1551. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  1552. __le16 fc = hdr->frame_control;
  1553. struct sk_buff_head frame_list;
  1554. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1555. if (unlikely(!ieee80211_is_data(fc)))
  1556. return RX_CONTINUE;
  1557. if (unlikely(!ieee80211_is_data_present(fc)))
  1558. return RX_DROP_MONITOR;
  1559. if (!(status->rx_flags & IEEE80211_RX_AMSDU))
  1560. return RX_CONTINUE;
  1561. if (ieee80211_has_a4(hdr->frame_control) &&
  1562. rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1563. !rx->sdata->u.vlan.sta)
  1564. return RX_DROP_UNUSABLE;
  1565. if (is_multicast_ether_addr(hdr->addr1) &&
  1566. ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1567. rx->sdata->u.vlan.sta) ||
  1568. (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
  1569. rx->sdata->u.mgd.use_4addr)))
  1570. return RX_DROP_UNUSABLE;
  1571. skb->dev = dev;
  1572. __skb_queue_head_init(&frame_list);
  1573. if (skb_linearize(skb))
  1574. return RX_DROP_UNUSABLE;
  1575. ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
  1576. rx->sdata->vif.type,
  1577. rx->local->hw.extra_tx_headroom, true);
  1578. while (!skb_queue_empty(&frame_list)) {
  1579. rx->skb = __skb_dequeue(&frame_list);
  1580. if (!ieee80211_frame_allowed(rx, fc)) {
  1581. dev_kfree_skb(rx->skb);
  1582. continue;
  1583. }
  1584. dev->stats.rx_packets++;
  1585. dev->stats.rx_bytes += rx->skb->len;
  1586. ieee80211_deliver_skb(rx);
  1587. }
  1588. return RX_QUEUED;
  1589. }
  1590. #ifdef CONFIG_MAC80211_MESH
  1591. static ieee80211_rx_result
  1592. ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
  1593. {
  1594. struct ieee80211_hdr *hdr;
  1595. struct ieee80211s_hdr *mesh_hdr;
  1596. unsigned int hdrlen;
  1597. struct sk_buff *skb = rx->skb, *fwd_skb;
  1598. struct ieee80211_local *local = rx->local;
  1599. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1600. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  1601. hdr = (struct ieee80211_hdr *) skb->data;
  1602. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  1603. mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
  1604. /* frame is in RMC, don't forward */
  1605. if (ieee80211_is_data(hdr->frame_control) &&
  1606. is_multicast_ether_addr(hdr->addr1) &&
  1607. mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
  1608. return RX_DROP_MONITOR;
  1609. if (!ieee80211_is_data(hdr->frame_control))
  1610. return RX_CONTINUE;
  1611. if (!mesh_hdr->ttl)
  1612. /* illegal frame */
  1613. return RX_DROP_MONITOR;
  1614. if (ieee80211_queue_stopped(&local->hw, skb_get_queue_mapping(skb))) {
  1615. IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
  1616. dropped_frames_congestion);
  1617. return RX_DROP_MONITOR;
  1618. }
  1619. if (mesh_hdr->flags & MESH_FLAGS_AE) {
  1620. struct mesh_path *mppath;
  1621. char *proxied_addr;
  1622. char *mpp_addr;
  1623. if (is_multicast_ether_addr(hdr->addr1)) {
  1624. mpp_addr = hdr->addr3;
  1625. proxied_addr = mesh_hdr->eaddr1;
  1626. } else {
  1627. mpp_addr = hdr->addr4;
  1628. proxied_addr = mesh_hdr->eaddr2;
  1629. }
  1630. rcu_read_lock();
  1631. mppath = mpp_path_lookup(proxied_addr, sdata);
  1632. if (!mppath) {
  1633. mpp_path_add(proxied_addr, mpp_addr, sdata);
  1634. } else {
  1635. spin_lock_bh(&mppath->state_lock);
  1636. if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
  1637. memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
  1638. spin_unlock_bh(&mppath->state_lock);
  1639. }
  1640. rcu_read_unlock();
  1641. }
  1642. /* Frame has reached destination. Don't forward */
  1643. if (!is_multicast_ether_addr(hdr->addr1) &&
  1644. compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
  1645. return RX_CONTINUE;
  1646. mesh_hdr->ttl--;
  1647. if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
  1648. if (!mesh_hdr->ttl)
  1649. IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
  1650. dropped_frames_ttl);
  1651. else {
  1652. struct ieee80211_hdr *fwd_hdr;
  1653. struct ieee80211_tx_info *info;
  1654. fwd_skb = skb_copy(skb, GFP_ATOMIC);
  1655. if (!fwd_skb && net_ratelimit())
  1656. printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
  1657. sdata->name);
  1658. if (!fwd_skb)
  1659. goto out;
  1660. fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
  1661. memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
  1662. info = IEEE80211_SKB_CB(fwd_skb);
  1663. memset(info, 0, sizeof(*info));
  1664. info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
  1665. info->control.vif = &rx->sdata->vif;
  1666. if (is_multicast_ether_addr(fwd_hdr->addr1)) {
  1667. IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
  1668. fwded_mcast);
  1669. skb_set_queue_mapping(fwd_skb,
  1670. ieee80211_select_queue(sdata, fwd_skb));
  1671. ieee80211_set_qos_hdr(sdata, fwd_skb);
  1672. } else {
  1673. int err;
  1674. /*
  1675. * Save TA to addr1 to send TA a path error if a
  1676. * suitable next hop is not found
  1677. */
  1678. memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
  1679. ETH_ALEN);
  1680. err = mesh_nexthop_lookup(fwd_skb, sdata);
  1681. /* Failed to immediately resolve next hop:
  1682. * fwded frame was dropped or will be added
  1683. * later to the pending skb queue. */
  1684. if (err)
  1685. return RX_DROP_MONITOR;
  1686. IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
  1687. fwded_unicast);
  1688. }
  1689. IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
  1690. fwded_frames);
  1691. ieee80211_add_pending_skb(local, fwd_skb);
  1692. }
  1693. }
  1694. out:
  1695. if (is_multicast_ether_addr(hdr->addr1) ||
  1696. sdata->dev->flags & IFF_PROMISC)
  1697. return RX_CONTINUE;
  1698. else
  1699. return RX_DROP_MONITOR;
  1700. }
  1701. #endif
  1702. static ieee80211_rx_result debug_noinline
  1703. ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
  1704. {
  1705. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1706. struct ieee80211_local *local = rx->local;
  1707. struct net_device *dev = sdata->dev;
  1708. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1709. __le16 fc = hdr->frame_control;
  1710. bool port_control;
  1711. int err;
  1712. if (unlikely(!ieee80211_is_data(hdr->frame_control)))
  1713. return RX_CONTINUE;
  1714. if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
  1715. return RX_DROP_MONITOR;
  1716. /*
  1717. * Allow the cooked monitor interface of an AP to see 4-addr frames so
  1718. * that a 4-addr station can be detected and moved into a separate VLAN
  1719. */
  1720. if (ieee80211_has_a4(hdr->frame_control) &&
  1721. sdata->vif.type == NL80211_IFTYPE_AP)
  1722. return RX_DROP_MONITOR;
  1723. err = __ieee80211_data_to_8023(rx, &port_control);
  1724. if (unlikely(err))
  1725. return RX_DROP_UNUSABLE;
  1726. if (!ieee80211_frame_allowed(rx, fc))
  1727. return RX_DROP_MONITOR;
  1728. if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1729. unlikely(port_control) && sdata->bss) {
  1730. sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
  1731. u.ap);
  1732. dev = sdata->dev;
  1733. rx->sdata = sdata;
  1734. }
  1735. rx->skb->dev = dev;
  1736. dev->stats.rx_packets++;
  1737. dev->stats.rx_bytes += rx->skb->len;
  1738. if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
  1739. !is_multicast_ether_addr(
  1740. ((struct ethhdr *)rx->skb->data)->h_dest) &&
  1741. (!local->scanning &&
  1742. !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
  1743. mod_timer(&local->dynamic_ps_timer, jiffies +
  1744. msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
  1745. }
  1746. ieee80211_deliver_skb(rx);
  1747. return RX_QUEUED;
  1748. }
  1749. static ieee80211_rx_result debug_noinline
  1750. ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
  1751. {
  1752. struct ieee80211_local *local = rx->local;
  1753. struct ieee80211_hw *hw = &local->hw;
  1754. struct sk_buff *skb = rx->skb;
  1755. struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
  1756. struct tid_ampdu_rx *tid_agg_rx;
  1757. u16 start_seq_num;
  1758. u16 tid;
  1759. if (likely(!ieee80211_is_ctl(bar->frame_control)))
  1760. return RX_CONTINUE;
  1761. if (ieee80211_is_back_req(bar->frame_control)) {
  1762. struct {
  1763. __le16 control, start_seq_num;
  1764. } __packed bar_data;
  1765. if (!rx->sta)
  1766. return RX_DROP_MONITOR;
  1767. if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
  1768. &bar_data, sizeof(bar_data)))
  1769. return RX_DROP_MONITOR;
  1770. tid = le16_to_cpu(bar_data.control) >> 12;
  1771. tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
  1772. if (!tid_agg_rx)
  1773. return RX_DROP_MONITOR;
  1774. start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
  1775. /* reset session timer */
  1776. if (tid_agg_rx->timeout)
  1777. mod_timer(&tid_agg_rx->session_timer,
  1778. TU_TO_EXP_TIME(tid_agg_rx->timeout));
  1779. spin_lock(&tid_agg_rx->reorder_lock);
  1780. /* release stored frames up to start of BAR */
  1781. ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
  1782. spin_unlock(&tid_agg_rx->reorder_lock);
  1783. kfree_skb(skb);
  1784. return RX_QUEUED;
  1785. }
  1786. /*
  1787. * After this point, we only want management frames,
  1788. * so we can drop all remaining control frames to
  1789. * cooked monitor interfaces.
  1790. */
  1791. return RX_DROP_MONITOR;
  1792. }
  1793. static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
  1794. struct ieee80211_mgmt *mgmt,
  1795. size_t len)
  1796. {
  1797. struct ieee80211_local *local = sdata->local;
  1798. struct sk_buff *skb;
  1799. struct ieee80211_mgmt *resp;
  1800. if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
  1801. /* Not to own unicast address */
  1802. return;
  1803. }
  1804. if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
  1805. compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
  1806. /* Not from the current AP or not associated yet. */
  1807. return;
  1808. }
  1809. if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
  1810. /* Too short SA Query request frame */
  1811. return;
  1812. }
  1813. skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
  1814. if (skb == NULL)
  1815. return;
  1816. skb_reserve(skb, local->hw.extra_tx_headroom);
  1817. resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
  1818. memset(resp, 0, 24);
  1819. memcpy(resp->da, mgmt->sa, ETH_ALEN);
  1820. memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
  1821. memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  1822. resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  1823. IEEE80211_STYPE_ACTION);
  1824. skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
  1825. resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
  1826. resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
  1827. memcpy(resp->u.action.u.sa_query.trans_id,
  1828. mgmt->u.action.u.sa_query.trans_id,
  1829. WLAN_SA_QUERY_TR_ID_LEN);
  1830. ieee80211_tx_skb(sdata, skb);
  1831. }
  1832. static ieee80211_rx_result debug_noinline
  1833. ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
  1834. {
  1835. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  1836. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1837. /*
  1838. * From here on, look only at management frames.
  1839. * Data and control frames are already handled,
  1840. * and unknown (reserved) frames are useless.
  1841. */
  1842. if (rx->skb->len < 24)
  1843. return RX_DROP_MONITOR;
  1844. if (!ieee80211_is_mgmt(mgmt->frame_control))
  1845. return RX_DROP_MONITOR;
  1846. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1847. return RX_DROP_MONITOR;
  1848. if (ieee80211_drop_unencrypted_mgmt(rx))
  1849. return RX_DROP_UNUSABLE;
  1850. return RX_CONTINUE;
  1851. }
  1852. static ieee80211_rx_result debug_noinline
  1853. ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
  1854. {
  1855. struct ieee80211_local *local = rx->local;
  1856. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1857. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  1858. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1859. int len = rx->skb->len;
  1860. if (!ieee80211_is_action(mgmt->frame_control))
  1861. return RX_CONTINUE;
  1862. /* drop too small frames */
  1863. if (len < IEEE80211_MIN_ACTION_SIZE)
  1864. return RX_DROP_UNUSABLE;
  1865. if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
  1866. return RX_DROP_UNUSABLE;
  1867. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1868. return RX_DROP_UNUSABLE;
  1869. switch (mgmt->u.action.category) {
  1870. case WLAN_CATEGORY_BACK:
  1871. /*
  1872. * The aggregation code is not prepared to handle
  1873. * anything but STA/AP due to the BSSID handling;
  1874. * IBSS could work in the code but isn't supported
  1875. * by drivers or the standard.
  1876. */
  1877. if (sdata->vif.type != NL80211_IFTYPE_STATION &&
  1878. sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  1879. sdata->vif.type != NL80211_IFTYPE_AP)
  1880. break;
  1881. /* verify action_code is present */
  1882. if (len < IEEE80211_MIN_ACTION_SIZE + 1)
  1883. break;
  1884. switch (mgmt->u.action.u.addba_req.action_code) {
  1885. case WLAN_ACTION_ADDBA_REQ:
  1886. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1887. sizeof(mgmt->u.action.u.addba_req)))
  1888. goto invalid;
  1889. break;
  1890. case WLAN_ACTION_ADDBA_RESP:
  1891. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1892. sizeof(mgmt->u.action.u.addba_resp)))
  1893. goto invalid;
  1894. break;
  1895. case WLAN_ACTION_DELBA:
  1896. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1897. sizeof(mgmt->u.action.u.delba)))
  1898. goto invalid;
  1899. break;
  1900. default:
  1901. goto invalid;
  1902. }
  1903. goto queue;
  1904. case WLAN_CATEGORY_SPECTRUM_MGMT:
  1905. if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
  1906. break;
  1907. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1908. break;
  1909. /* verify action_code is present */
  1910. if (len < IEEE80211_MIN_ACTION_SIZE + 1)
  1911. break;
  1912. switch (mgmt->u.action.u.measurement.action_code) {
  1913. case WLAN_ACTION_SPCT_MSR_REQ:
  1914. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1915. sizeof(mgmt->u.action.u.measurement)))
  1916. break;
  1917. ieee80211_process_measurement_req(sdata, mgmt, len);
  1918. goto handled;
  1919. case WLAN_ACTION_SPCT_CHL_SWITCH:
  1920. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1921. sizeof(mgmt->u.action.u.chan_switch)))
  1922. break;
  1923. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1924. break;
  1925. if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
  1926. break;
  1927. goto queue;
  1928. }
  1929. break;
  1930. case WLAN_CATEGORY_SA_QUERY:
  1931. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1932. sizeof(mgmt->u.action.u.sa_query)))
  1933. break;
  1934. switch (mgmt->u.action.u.sa_query.action) {
  1935. case WLAN_ACTION_SA_QUERY_REQUEST:
  1936. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1937. break;
  1938. ieee80211_process_sa_query_req(sdata, mgmt, len);
  1939. goto handled;
  1940. }
  1941. break;
  1942. case WLAN_CATEGORY_SELF_PROTECTED:
  1943. switch (mgmt->u.action.u.self_prot.action_code) {
  1944. case WLAN_SP_MESH_PEERING_OPEN:
  1945. case WLAN_SP_MESH_PEERING_CLOSE:
  1946. case WLAN_SP_MESH_PEERING_CONFIRM:
  1947. if (!ieee80211_vif_is_mesh(&sdata->vif))
  1948. goto invalid;
  1949. if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
  1950. /* userspace handles this frame */
  1951. break;
  1952. goto queue;
  1953. case WLAN_SP_MGK_INFORM:
  1954. case WLAN_SP_MGK_ACK:
  1955. if (!ieee80211_vif_is_mesh(&sdata->vif))
  1956. goto invalid;
  1957. break;
  1958. }
  1959. break;
  1960. case WLAN_CATEGORY_MESH_ACTION:
  1961. if (!ieee80211_vif_is_mesh(&sdata->vif))
  1962. break;
  1963. if (mesh_action_is_path_sel(mgmt) &&
  1964. (!mesh_path_sel_is_hwmp(sdata)))
  1965. break;
  1966. goto queue;
  1967. }
  1968. return RX_CONTINUE;
  1969. invalid:
  1970. status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
  1971. /* will return in the next handlers */
  1972. return RX_CONTINUE;
  1973. handled:
  1974. if (rx->sta)
  1975. rx->sta->rx_packets++;
  1976. dev_kfree_skb(rx->skb);
  1977. return RX_QUEUED;
  1978. queue:
  1979. rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
  1980. skb_queue_tail(&sdata->skb_queue, rx->skb);
  1981. ieee80211_queue_work(&local->hw, &sdata->work);
  1982. if (rx->sta)
  1983. rx->sta->rx_packets++;
  1984. return RX_QUEUED;
  1985. }
  1986. static ieee80211_rx_result debug_noinline
  1987. ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
  1988. {
  1989. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1990. /* skip known-bad action frames and return them in the next handler */
  1991. if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
  1992. return RX_CONTINUE;
  1993. /*
  1994. * Getting here means the kernel doesn't know how to handle
  1995. * it, but maybe userspace does ... include returned frames
  1996. * so userspace can register for those to know whether ones
  1997. * it transmitted were processed or returned.
  1998. */
  1999. if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
  2000. rx->skb->data, rx->skb->len,
  2001. GFP_ATOMIC)) {
  2002. if (rx->sta)
  2003. rx->sta->rx_packets++;
  2004. dev_kfree_skb(rx->skb);
  2005. return RX_QUEUED;
  2006. }
  2007. return RX_CONTINUE;
  2008. }
  2009. static ieee80211_rx_result debug_noinline
  2010. ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
  2011. {
  2012. struct ieee80211_local *local = rx->local;
  2013. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  2014. struct sk_buff *nskb;
  2015. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2016. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  2017. if (!ieee80211_is_action(mgmt->frame_control))
  2018. return RX_CONTINUE;
  2019. /*
  2020. * For AP mode, hostapd is responsible for handling any action
  2021. * frames that we didn't handle, including returning unknown
  2022. * ones. For all other modes we will return them to the sender,
  2023. * setting the 0x80 bit in the action category, as required by
  2024. * 802.11-2007 7.3.1.11.
  2025. * Newer versions of hostapd shall also use the management frame
  2026. * registration mechanisms, but older ones still use cooked
  2027. * monitor interfaces so push all frames there.
  2028. */
  2029. if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
  2030. (sdata->vif.type == NL80211_IFTYPE_AP ||
  2031. sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
  2032. return RX_DROP_MONITOR;
  2033. /* do not return rejected action frames */
  2034. if (mgmt->u.action.category & 0x80)
  2035. return RX_DROP_UNUSABLE;
  2036. nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
  2037. GFP_ATOMIC);
  2038. if (nskb) {
  2039. struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
  2040. nmgmt->u.action.category |= 0x80;
  2041. memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
  2042. memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
  2043. memset(nskb->cb, 0, sizeof(nskb->cb));
  2044. ieee80211_tx_skb(rx->sdata, nskb);
  2045. }
  2046. dev_kfree_skb(rx->skb);
  2047. return RX_QUEUED;
  2048. }
  2049. static ieee80211_rx_result debug_noinline
  2050. ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
  2051. {
  2052. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2053. ieee80211_rx_result rxs;
  2054. struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
  2055. __le16 stype;
  2056. rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
  2057. if (rxs != RX_CONTINUE)
  2058. return rxs;
  2059. stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
  2060. if (!ieee80211_vif_is_mesh(&sdata->vif) &&
  2061. sdata->vif.type != NL80211_IFTYPE_ADHOC &&
  2062. sdata->vif.type != NL80211_IFTYPE_STATION)
  2063. return RX_DROP_MONITOR;
  2064. switch (stype) {
  2065. case cpu_to_le16(IEEE80211_STYPE_BEACON):
  2066. case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
  2067. /* process for all: mesh, mlme, ibss */
  2068. break;
  2069. case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
  2070. case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
  2071. if (is_multicast_ether_addr(mgmt->da) &&
  2072. !is_broadcast_ether_addr(mgmt->da))
  2073. return RX_DROP_MONITOR;
  2074. /* process only for station */
  2075. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  2076. return RX_DROP_MONITOR;
  2077. break;
  2078. case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
  2079. case cpu_to_le16(IEEE80211_STYPE_AUTH):
  2080. /* process only for ibss */
  2081. if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
  2082. return RX_DROP_MONITOR;
  2083. break;
  2084. default:
  2085. return RX_DROP_MONITOR;
  2086. }
  2087. /* queue up frame and kick off work to process it */
  2088. rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
  2089. skb_queue_tail(&sdata->skb_queue, rx->skb);
  2090. ieee80211_queue_work(&rx->local->hw, &sdata->work);
  2091. if (rx->sta)
  2092. rx->sta->rx_packets++;
  2093. return RX_QUEUED;
  2094. }
  2095. /* TODO: use IEEE80211_RX_FRAGMENTED */
  2096. static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
  2097. struct ieee80211_rate *rate)
  2098. {
  2099. struct ieee80211_sub_if_data *sdata;
  2100. struct ieee80211_local *local = rx->local;
  2101. struct ieee80211_rtap_hdr {
  2102. struct ieee80211_radiotap_header hdr;
  2103. u8 flags;
  2104. u8 rate_or_pad;
  2105. __le16 chan_freq;
  2106. __le16 chan_flags;
  2107. } __packed *rthdr;
  2108. struct sk_buff *skb = rx->skb, *skb2;
  2109. struct net_device *prev_dev = NULL;
  2110. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2111. /*
  2112. * If cooked monitor has been processed already, then
  2113. * don't do it again. If not, set the flag.
  2114. */
  2115. if (rx->flags & IEEE80211_RX_CMNTR)
  2116. goto out_free_skb;
  2117. rx->flags |= IEEE80211_RX_CMNTR;
  2118. if (skb_headroom(skb) < sizeof(*rthdr) &&
  2119. pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
  2120. goto out_free_skb;
  2121. rthdr = (void *)skb_push(skb, sizeof(*rthdr));
  2122. memset(rthdr, 0, sizeof(*rthdr));
  2123. rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
  2124. rthdr->hdr.it_present =
  2125. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  2126. (1 << IEEE80211_RADIOTAP_CHANNEL));
  2127. if (rate) {
  2128. rthdr->rate_or_pad = rate->bitrate / 5;
  2129. rthdr->hdr.it_present |=
  2130. cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
  2131. }
  2132. rthdr->chan_freq = cpu_to_le16(status->freq);
  2133. if (status->band == IEEE80211_BAND_5GHZ)
  2134. rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
  2135. IEEE80211_CHAN_5GHZ);
  2136. else
  2137. rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
  2138. IEEE80211_CHAN_2GHZ);
  2139. skb_set_mac_header(skb, 0);
  2140. skb->ip_summed = CHECKSUM_UNNECESSARY;
  2141. skb->pkt_type = PACKET_OTHERHOST;
  2142. skb->protocol = htons(ETH_P_802_2);
  2143. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  2144. if (!ieee80211_sdata_running(sdata))
  2145. continue;
  2146. if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
  2147. !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
  2148. continue;
  2149. if (prev_dev) {
  2150. skb2 = skb_clone(skb, GFP_ATOMIC);
  2151. if (skb2) {
  2152. skb2->dev = prev_dev;
  2153. netif_receive_skb(skb2);
  2154. }
  2155. }
  2156. prev_dev = sdata->dev;
  2157. sdata->dev->stats.rx_packets++;
  2158. sdata->dev->stats.rx_bytes += skb->len;
  2159. }
  2160. if (prev_dev) {
  2161. skb->dev = prev_dev;
  2162. netif_receive_skb(skb);
  2163. return;
  2164. }
  2165. out_free_skb:
  2166. dev_kfree_skb(skb);
  2167. }
  2168. static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
  2169. ieee80211_rx_result res)
  2170. {
  2171. switch (res) {
  2172. case RX_DROP_MONITOR:
  2173. I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
  2174. if (rx->sta)
  2175. rx->sta->rx_dropped++;
  2176. /* fall through */
  2177. case RX_CONTINUE: {
  2178. struct ieee80211_rate *rate = NULL;
  2179. struct ieee80211_supported_band *sband;
  2180. struct ieee80211_rx_status *status;
  2181. status = IEEE80211_SKB_RXCB((rx->skb));
  2182. sband = rx->local->hw.wiphy->bands[status->band];
  2183. if (!(status->flag & RX_FLAG_HT))
  2184. rate = &sband->bitrates[status->rate_idx];
  2185. ieee80211_rx_cooked_monitor(rx, rate);
  2186. break;
  2187. }
  2188. case RX_DROP_UNUSABLE:
  2189. I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
  2190. if (rx->sta)
  2191. rx->sta->rx_dropped++;
  2192. dev_kfree_skb(rx->skb);
  2193. break;
  2194. case RX_QUEUED:
  2195. I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
  2196. break;
  2197. }
  2198. }
  2199. static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
  2200. {
  2201. ieee80211_rx_result res = RX_DROP_MONITOR;
  2202. struct sk_buff *skb;
  2203. #define CALL_RXH(rxh) \
  2204. do { \
  2205. res = rxh(rx); \
  2206. if (res != RX_CONTINUE) \
  2207. goto rxh_next; \
  2208. } while (0);
  2209. spin_lock(&rx->local->rx_skb_queue.lock);
  2210. if (rx->local->running_rx_handler)
  2211. goto unlock;
  2212. rx->local->running_rx_handler = true;
  2213. while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
  2214. spin_unlock(&rx->local->rx_skb_queue.lock);
  2215. /*
  2216. * all the other fields are valid across frames
  2217. * that belong to an aMPDU since they are on the
  2218. * same TID from the same station
  2219. */
  2220. rx->skb = skb;
  2221. CALL_RXH(ieee80211_rx_h_decrypt)
  2222. CALL_RXH(ieee80211_rx_h_check_more_data)
  2223. CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
  2224. CALL_RXH(ieee80211_rx_h_sta_process)
  2225. CALL_RXH(ieee80211_rx_h_defragment)
  2226. CALL_RXH(ieee80211_rx_h_michael_mic_verify)
  2227. /* must be after MMIC verify so header is counted in MPDU mic */
  2228. #ifdef CONFIG_MAC80211_MESH
  2229. if (ieee80211_vif_is_mesh(&rx->sdata->vif))
  2230. CALL_RXH(ieee80211_rx_h_mesh_fwding);
  2231. #endif
  2232. CALL_RXH(ieee80211_rx_h_remove_qos_control)
  2233. CALL_RXH(ieee80211_rx_h_amsdu)
  2234. CALL_RXH(ieee80211_rx_h_data)
  2235. CALL_RXH(ieee80211_rx_h_ctrl);
  2236. CALL_RXH(ieee80211_rx_h_mgmt_check)
  2237. CALL_RXH(ieee80211_rx_h_action)
  2238. CALL_RXH(ieee80211_rx_h_userspace_mgmt)
  2239. CALL_RXH(ieee80211_rx_h_action_return)
  2240. CALL_RXH(ieee80211_rx_h_mgmt)
  2241. rxh_next:
  2242. ieee80211_rx_handlers_result(rx, res);
  2243. spin_lock(&rx->local->rx_skb_queue.lock);
  2244. #undef CALL_RXH
  2245. }
  2246. rx->local->running_rx_handler = false;
  2247. unlock:
  2248. spin_unlock(&rx->local->rx_skb_queue.lock);
  2249. }
  2250. static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
  2251. {
  2252. ieee80211_rx_result res = RX_DROP_MONITOR;
  2253. #define CALL_RXH(rxh) \
  2254. do { \
  2255. res = rxh(rx); \
  2256. if (res != RX_CONTINUE) \
  2257. goto rxh_next; \
  2258. } while (0);
  2259. CALL_RXH(ieee80211_rx_h_passive_scan)
  2260. CALL_RXH(ieee80211_rx_h_check)
  2261. ieee80211_rx_reorder_ampdu(rx);
  2262. ieee80211_rx_handlers(rx);
  2263. return;
  2264. rxh_next:
  2265. ieee80211_rx_handlers_result(rx, res);
  2266. #undef CALL_RXH
  2267. }
  2268. /*
  2269. * This function makes calls into the RX path, therefore
  2270. * it has to be invoked under RCU read lock.
  2271. */
  2272. void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
  2273. {
  2274. struct ieee80211_rx_data rx = {
  2275. .sta = sta,
  2276. .sdata = sta->sdata,
  2277. .local = sta->local,
  2278. /* This is OK -- must be QoS data frame */
  2279. .security_idx = tid,
  2280. .seqno_idx = tid,
  2281. .flags = 0,
  2282. };
  2283. struct tid_ampdu_rx *tid_agg_rx;
  2284. tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
  2285. if (!tid_agg_rx)
  2286. return;
  2287. spin_lock(&tid_agg_rx->reorder_lock);
  2288. ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
  2289. spin_unlock(&tid_agg_rx->reorder_lock);
  2290. ieee80211_rx_handlers(&rx);
  2291. }
  2292. /* main receive path */
  2293. static int prepare_for_handlers(struct ieee80211_rx_data *rx,
  2294. struct ieee80211_hdr *hdr)
  2295. {
  2296. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2297. struct sk_buff *skb = rx->skb;
  2298. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2299. u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
  2300. int multicast = is_multicast_ether_addr(hdr->addr1);
  2301. switch (sdata->vif.type) {
  2302. case NL80211_IFTYPE_STATION:
  2303. if (!bssid && !sdata->u.mgd.use_4addr)
  2304. return 0;
  2305. if (!multicast &&
  2306. compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
  2307. if (!(sdata->dev->flags & IFF_PROMISC) ||
  2308. sdata->u.mgd.use_4addr)
  2309. return 0;
  2310. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2311. }
  2312. break;
  2313. case NL80211_IFTYPE_ADHOC:
  2314. if (!bssid)
  2315. return 0;
  2316. if (ieee80211_is_beacon(hdr->frame_control)) {
  2317. return 1;
  2318. }
  2319. else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
  2320. if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
  2321. return 0;
  2322. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2323. } else if (!multicast &&
  2324. compare_ether_addr(sdata->vif.addr,
  2325. hdr->addr1) != 0) {
  2326. if (!(sdata->dev->flags & IFF_PROMISC))
  2327. return 0;
  2328. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2329. } else if (!rx->sta) {
  2330. int rate_idx;
  2331. if (status->flag & RX_FLAG_HT)
  2332. rate_idx = 0; /* TODO: HT rates */
  2333. else
  2334. rate_idx = status->rate_idx;
  2335. rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
  2336. hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
  2337. }
  2338. break;
  2339. case NL80211_IFTYPE_MESH_POINT:
  2340. if (!multicast &&
  2341. compare_ether_addr(sdata->vif.addr,
  2342. hdr->addr1) != 0) {
  2343. if (!(sdata->dev->flags & IFF_PROMISC))
  2344. return 0;
  2345. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2346. }
  2347. break;
  2348. case NL80211_IFTYPE_AP_VLAN:
  2349. case NL80211_IFTYPE_AP:
  2350. if (!bssid) {
  2351. if (compare_ether_addr(sdata->vif.addr,
  2352. hdr->addr1))
  2353. return 0;
  2354. } else if (!ieee80211_bssid_match(bssid,
  2355. sdata->vif.addr)) {
  2356. if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
  2357. !ieee80211_is_beacon(hdr->frame_control) &&
  2358. !(ieee80211_is_action(hdr->frame_control) &&
  2359. sdata->vif.p2p))
  2360. return 0;
  2361. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2362. }
  2363. break;
  2364. case NL80211_IFTYPE_WDS:
  2365. if (bssid || !ieee80211_is_data(hdr->frame_control))
  2366. return 0;
  2367. if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
  2368. return 0;
  2369. break;
  2370. default:
  2371. /* should never get here */
  2372. WARN_ON(1);
  2373. break;
  2374. }
  2375. return 1;
  2376. }
  2377. /*
  2378. * This function returns whether or not the SKB
  2379. * was destined for RX processing or not, which,
  2380. * if consume is true, is equivalent to whether
  2381. * or not the skb was consumed.
  2382. */
  2383. static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
  2384. struct sk_buff *skb, bool consume)
  2385. {
  2386. struct ieee80211_local *local = rx->local;
  2387. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2388. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2389. struct ieee80211_hdr *hdr = (void *)skb->data;
  2390. int prepares;
  2391. rx->skb = skb;
  2392. status->rx_flags |= IEEE80211_RX_RA_MATCH;
  2393. prepares = prepare_for_handlers(rx, hdr);
  2394. if (!prepares)
  2395. return false;
  2396. if (!consume) {
  2397. skb = skb_copy(skb, GFP_ATOMIC);
  2398. if (!skb) {
  2399. if (net_ratelimit())
  2400. wiphy_debug(local->hw.wiphy,
  2401. "failed to copy skb for %s\n",
  2402. sdata->name);
  2403. return true;
  2404. }
  2405. rx->skb = skb;
  2406. }
  2407. ieee80211_invoke_rx_handlers(rx);
  2408. return true;
  2409. }
  2410. /*
  2411. * This is the actual Rx frames handler. as it blongs to Rx path it must
  2412. * be called with rcu_read_lock protection.
  2413. */
  2414. static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
  2415. struct sk_buff *skb)
  2416. {
  2417. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2418. struct ieee80211_local *local = hw_to_local(hw);
  2419. struct ieee80211_sub_if_data *sdata;
  2420. struct ieee80211_hdr *hdr;
  2421. __le16 fc;
  2422. struct ieee80211_rx_data rx;
  2423. struct ieee80211_sub_if_data *prev;
  2424. struct sta_info *sta, *tmp, *prev_sta;
  2425. int err = 0;
  2426. fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
  2427. memset(&rx, 0, sizeof(rx));
  2428. rx.skb = skb;
  2429. rx.local = local;
  2430. if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
  2431. local->dot11ReceivedFragmentCount++;
  2432. if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
  2433. test_bit(SCAN_SW_SCANNING, &local->scanning)))
  2434. status->rx_flags |= IEEE80211_RX_IN_SCAN;
  2435. if (ieee80211_is_mgmt(fc))
  2436. err = skb_linearize(skb);
  2437. else
  2438. err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
  2439. if (err) {
  2440. dev_kfree_skb(skb);
  2441. return;
  2442. }
  2443. hdr = (struct ieee80211_hdr *)skb->data;
  2444. ieee80211_parse_qos(&rx);
  2445. ieee80211_verify_alignment(&rx);
  2446. if (ieee80211_is_data(fc)) {
  2447. prev_sta = NULL;
  2448. for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
  2449. if (!prev_sta) {
  2450. prev_sta = sta;
  2451. continue;
  2452. }
  2453. rx.sta = prev_sta;
  2454. rx.sdata = prev_sta->sdata;
  2455. ieee80211_prepare_and_rx_handle(&rx, skb, false);
  2456. prev_sta = sta;
  2457. }
  2458. if (prev_sta) {
  2459. rx.sta = prev_sta;
  2460. rx.sdata = prev_sta->sdata;
  2461. if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
  2462. return;
  2463. goto out;
  2464. }
  2465. }
  2466. prev = NULL;
  2467. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  2468. if (!ieee80211_sdata_running(sdata))
  2469. continue;
  2470. if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
  2471. sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  2472. continue;
  2473. /*
  2474. * frame is destined for this interface, but if it's
  2475. * not also for the previous one we handle that after
  2476. * the loop to avoid copying the SKB once too much
  2477. */
  2478. if (!prev) {
  2479. prev = sdata;
  2480. continue;
  2481. }
  2482. rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
  2483. rx.sdata = prev;
  2484. ieee80211_prepare_and_rx_handle(&rx, skb, false);
  2485. prev = sdata;
  2486. }
  2487. if (prev) {
  2488. rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
  2489. rx.sdata = prev;
  2490. if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
  2491. return;
  2492. }
  2493. out:
  2494. dev_kfree_skb(skb);
  2495. }
  2496. /*
  2497. * This is the receive path handler. It is called by a low level driver when an
  2498. * 802.11 MPDU is received from the hardware.
  2499. */
  2500. void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
  2501. {
  2502. struct ieee80211_local *local = hw_to_local(hw);
  2503. struct ieee80211_rate *rate = NULL;
  2504. struct ieee80211_supported_band *sband;
  2505. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2506. WARN_ON_ONCE(softirq_count() == 0);
  2507. if (WARN_ON(status->band < 0 ||
  2508. status->band >= IEEE80211_NUM_BANDS))
  2509. goto drop;
  2510. sband = local->hw.wiphy->bands[status->band];
  2511. if (WARN_ON(!sband))
  2512. goto drop;
  2513. /*
  2514. * If we're suspending, it is possible although not too likely
  2515. * that we'd be receiving frames after having already partially
  2516. * quiesced the stack. We can't process such frames then since
  2517. * that might, for example, cause stations to be added or other
  2518. * driver callbacks be invoked.
  2519. */
  2520. if (unlikely(local->quiescing || local->suspended))
  2521. goto drop;
  2522. /*
  2523. * The same happens when we're not even started,
  2524. * but that's worth a warning.
  2525. */
  2526. if (WARN_ON(!local->started))
  2527. goto drop;
  2528. if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
  2529. /*
  2530. * Validate the rate, unless a PLCP error means that
  2531. * we probably can't have a valid rate here anyway.
  2532. */
  2533. if (status->flag & RX_FLAG_HT) {
  2534. /*
  2535. * rate_idx is MCS index, which can be [0-76]
  2536. * as documented on:
  2537. *
  2538. * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
  2539. *
  2540. * Anything else would be some sort of driver or
  2541. * hardware error. The driver should catch hardware
  2542. * errors.
  2543. */
  2544. if (WARN((status->rate_idx < 0 ||
  2545. status->rate_idx > 76),
  2546. "Rate marked as an HT rate but passed "
  2547. "status->rate_idx is not "
  2548. "an MCS index [0-76]: %d (0x%02x)\n",
  2549. status->rate_idx,
  2550. status->rate_idx))
  2551. goto drop;
  2552. } else {
  2553. if (WARN_ON(status->rate_idx < 0 ||
  2554. status->rate_idx >= sband->n_bitrates))
  2555. goto drop;
  2556. rate = &sband->bitrates[status->rate_idx];
  2557. }
  2558. }
  2559. status->rx_flags = 0;
  2560. /*
  2561. * key references and virtual interfaces are protected using RCU
  2562. * and this requires that we are in a read-side RCU section during
  2563. * receive processing
  2564. */
  2565. rcu_read_lock();
  2566. /*
  2567. * Frames with failed FCS/PLCP checksum are not returned,
  2568. * all other frames are returned without radiotap header
  2569. * if it was previously present.
  2570. * Also, frames with less than 16 bytes are dropped.
  2571. */
  2572. skb = ieee80211_rx_monitor(local, skb, rate);
  2573. if (!skb) {
  2574. rcu_read_unlock();
  2575. return;
  2576. }
  2577. ieee80211_tpt_led_trig_rx(local,
  2578. ((struct ieee80211_hdr *)skb->data)->frame_control,
  2579. skb->len);
  2580. __ieee80211_rx_handle_packet(hw, skb);
  2581. rcu_read_unlock();
  2582. return;
  2583. drop:
  2584. kfree_skb(skb);
  2585. }
  2586. EXPORT_SYMBOL(ieee80211_rx);
  2587. /* This is a version of the rx handler that can be called from hard irq
  2588. * context. Post the skb on the queue and schedule the tasklet */
  2589. void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
  2590. {
  2591. struct ieee80211_local *local = hw_to_local(hw);
  2592. BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
  2593. skb->pkt_type = IEEE80211_RX_MSG;
  2594. skb_queue_tail(&local->skb_queue, skb);
  2595. tasklet_schedule(&local->tasklet);
  2596. }
  2597. EXPORT_SYMBOL(ieee80211_rx_irqsafe);