rx.c 85 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084
  1. /*
  2. * Copyright 2002-2005, Instant802 Networks, Inc.
  3. * Copyright 2005-2006, Devicescape Software, Inc.
  4. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  5. * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License version 2 as
  9. * published by the Free Software Foundation.
  10. */
  11. #include <linux/jiffies.h>
  12. #include <linux/slab.h>
  13. #include <linux/kernel.h>
  14. #include <linux/skbuff.h>
  15. #include <linux/netdevice.h>
  16. #include <linux/etherdevice.h>
  17. #include <linux/rcupdate.h>
  18. #include <linux/export.h>
  19. #include <net/mac80211.h>
  20. #include <net/ieee80211_radiotap.h>
  21. #include "ieee80211_i.h"
  22. #include "driver-ops.h"
  23. #include "led.h"
  24. #include "mesh.h"
  25. #include "wep.h"
  26. #include "wpa.h"
  27. #include "tkip.h"
  28. #include "wme.h"
  29. /*
  30. * monitor mode reception
  31. *
  32. * This function cleans up the SKB, i.e. it removes all the stuff
  33. * only useful for monitoring.
  34. */
  35. static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  36. struct sk_buff *skb)
  37. {
  38. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
  39. if (likely(skb->len > FCS_LEN))
  40. __pskb_trim(skb, skb->len - FCS_LEN);
  41. else {
  42. /* driver bug */
  43. WARN_ON(1);
  44. dev_kfree_skb(skb);
  45. skb = NULL;
  46. }
  47. }
  48. return skb;
  49. }
  50. static inline int should_drop_frame(struct sk_buff *skb,
  51. int present_fcs_len)
  52. {
  53. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  54. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  55. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  56. return 1;
  57. if (unlikely(skb->len < 16 + present_fcs_len))
  58. return 1;
  59. if (ieee80211_is_ctl(hdr->frame_control) &&
  60. !ieee80211_is_pspoll(hdr->frame_control) &&
  61. !ieee80211_is_back_req(hdr->frame_control))
  62. return 1;
  63. return 0;
  64. }
  65. static int
  66. ieee80211_rx_radiotap_len(struct ieee80211_local *local,
  67. struct ieee80211_rx_status *status)
  68. {
  69. int len;
  70. /* always present fields */
  71. len = sizeof(struct ieee80211_radiotap_header) + 9;
  72. if (status->flag & RX_FLAG_MACTIME_MPDU)
  73. len += 8;
  74. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
  75. len += 1;
  76. if (len & 1) /* padding for RX_FLAGS if necessary */
  77. len++;
  78. if (status->flag & RX_FLAG_HT) /* HT info */
  79. len += 3;
  80. return len;
  81. }
  82. /*
  83. * ieee80211_add_rx_radiotap_header - add radiotap header
  84. *
  85. * add a radiotap header containing all the fields which the hardware provided.
  86. */
  87. static void
  88. ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
  89. struct sk_buff *skb,
  90. struct ieee80211_rate *rate,
  91. int rtap_len)
  92. {
  93. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  94. struct ieee80211_radiotap_header *rthdr;
  95. unsigned char *pos;
  96. u16 rx_flags = 0;
  97. rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
  98. memset(rthdr, 0, rtap_len);
  99. /* radiotap header, set always present flags */
  100. rthdr->it_present =
  101. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  102. (1 << IEEE80211_RADIOTAP_CHANNEL) |
  103. (1 << IEEE80211_RADIOTAP_ANTENNA) |
  104. (1 << IEEE80211_RADIOTAP_RX_FLAGS));
  105. rthdr->it_len = cpu_to_le16(rtap_len);
  106. pos = (unsigned char *)(rthdr+1);
  107. /* the order of the following fields is important */
  108. /* IEEE80211_RADIOTAP_TSFT */
  109. if (status->flag & RX_FLAG_MACTIME_MPDU) {
  110. put_unaligned_le64(status->mactime, pos);
  111. rthdr->it_present |=
  112. cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
  113. pos += 8;
  114. }
  115. /* IEEE80211_RADIOTAP_FLAGS */
  116. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  117. *pos |= IEEE80211_RADIOTAP_F_FCS;
  118. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  119. *pos |= IEEE80211_RADIOTAP_F_BADFCS;
  120. if (status->flag & RX_FLAG_SHORTPRE)
  121. *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
  122. pos++;
  123. /* IEEE80211_RADIOTAP_RATE */
  124. if (status->flag & RX_FLAG_HT) {
  125. /*
  126. * MCS information is a separate field in radiotap,
  127. * added below. The byte here is needed as padding
  128. * for the channel though, so initialise it to 0.
  129. */
  130. *pos = 0;
  131. } else {
  132. rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
  133. *pos = rate->bitrate / 5;
  134. }
  135. pos++;
  136. /* IEEE80211_RADIOTAP_CHANNEL */
  137. put_unaligned_le16(status->freq, pos);
  138. pos += 2;
  139. if (status->band == IEEE80211_BAND_5GHZ)
  140. put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
  141. pos);
  142. else if (status->flag & RX_FLAG_HT)
  143. put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
  144. pos);
  145. else if (rate->flags & IEEE80211_RATE_ERP_G)
  146. put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
  147. pos);
  148. else
  149. put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
  150. pos);
  151. pos += 2;
  152. /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
  153. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
  154. *pos = status->signal;
  155. rthdr->it_present |=
  156. cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
  157. pos++;
  158. }
  159. /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
  160. /* IEEE80211_RADIOTAP_ANTENNA */
  161. *pos = status->antenna;
  162. pos++;
  163. /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
  164. /* IEEE80211_RADIOTAP_RX_FLAGS */
  165. /* ensure 2 byte alignment for the 2 byte field as required */
  166. if ((pos - (u8 *)rthdr) & 1)
  167. pos++;
  168. if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
  169. rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
  170. put_unaligned_le16(rx_flags, pos);
  171. pos += 2;
  172. if (status->flag & RX_FLAG_HT) {
  173. rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
  174. *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
  175. IEEE80211_RADIOTAP_MCS_HAVE_GI |
  176. IEEE80211_RADIOTAP_MCS_HAVE_BW;
  177. *pos = 0;
  178. if (status->flag & RX_FLAG_SHORT_GI)
  179. *pos |= IEEE80211_RADIOTAP_MCS_SGI;
  180. if (status->flag & RX_FLAG_40MHZ)
  181. *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
  182. pos++;
  183. *pos++ = status->rate_idx;
  184. }
  185. }
  186. /*
  187. * This function copies a received frame to all monitor interfaces and
  188. * returns a cleaned-up SKB that no longer includes the FCS nor the
  189. * radiotap header the driver might have added.
  190. */
  191. static struct sk_buff *
  192. ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
  193. struct ieee80211_rate *rate)
  194. {
  195. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
  196. struct ieee80211_sub_if_data *sdata;
  197. int needed_headroom = 0;
  198. struct sk_buff *skb, *skb2;
  199. struct net_device *prev_dev = NULL;
  200. int present_fcs_len = 0;
  201. /*
  202. * First, we may need to make a copy of the skb because
  203. * (1) we need to modify it for radiotap (if not present), and
  204. * (2) the other RX handlers will modify the skb we got.
  205. *
  206. * We don't need to, of course, if we aren't going to return
  207. * the SKB because it has a bad FCS/PLCP checksum.
  208. */
  209. /* room for the radiotap header based on driver features */
  210. needed_headroom = ieee80211_rx_radiotap_len(local, status);
  211. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  212. present_fcs_len = FCS_LEN;
  213. /* make sure hdr->frame_control is on the linear part */
  214. if (!pskb_may_pull(origskb, 2)) {
  215. dev_kfree_skb(origskb);
  216. return NULL;
  217. }
  218. if (!local->monitors) {
  219. if (should_drop_frame(origskb, present_fcs_len)) {
  220. dev_kfree_skb(origskb);
  221. return NULL;
  222. }
  223. return remove_monitor_info(local, origskb);
  224. }
  225. if (should_drop_frame(origskb, present_fcs_len)) {
  226. /* only need to expand headroom if necessary */
  227. skb = origskb;
  228. origskb = NULL;
  229. /*
  230. * This shouldn't trigger often because most devices have an
  231. * RX header they pull before we get here, and that should
  232. * be big enough for our radiotap information. We should
  233. * probably export the length to drivers so that we can have
  234. * them allocate enough headroom to start with.
  235. */
  236. if (skb_headroom(skb) < needed_headroom &&
  237. pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
  238. dev_kfree_skb(skb);
  239. return NULL;
  240. }
  241. } else {
  242. /*
  243. * Need to make a copy and possibly remove radiotap header
  244. * and FCS from the original.
  245. */
  246. skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
  247. origskb = remove_monitor_info(local, origskb);
  248. if (!skb)
  249. return origskb;
  250. }
  251. /* prepend radiotap information */
  252. ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
  253. skb_reset_mac_header(skb);
  254. skb->ip_summed = CHECKSUM_UNNECESSARY;
  255. skb->pkt_type = PACKET_OTHERHOST;
  256. skb->protocol = htons(ETH_P_802_2);
  257. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  258. if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
  259. continue;
  260. if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
  261. continue;
  262. if (!ieee80211_sdata_running(sdata))
  263. continue;
  264. if (prev_dev) {
  265. skb2 = skb_clone(skb, GFP_ATOMIC);
  266. if (skb2) {
  267. skb2->dev = prev_dev;
  268. netif_receive_skb(skb2);
  269. }
  270. }
  271. prev_dev = sdata->dev;
  272. sdata->dev->stats.rx_packets++;
  273. sdata->dev->stats.rx_bytes += skb->len;
  274. }
  275. if (prev_dev) {
  276. skb->dev = prev_dev;
  277. netif_receive_skb(skb);
  278. } else
  279. dev_kfree_skb(skb);
  280. return origskb;
  281. }
  282. static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  283. {
  284. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  285. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  286. int tid, seqno_idx, security_idx;
  287. /* does the frame have a qos control field? */
  288. if (ieee80211_is_data_qos(hdr->frame_control)) {
  289. u8 *qc = ieee80211_get_qos_ctl(hdr);
  290. /* frame has qos control */
  291. tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
  292. if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
  293. status->rx_flags |= IEEE80211_RX_AMSDU;
  294. seqno_idx = tid;
  295. security_idx = tid;
  296. } else {
  297. /*
  298. * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
  299. *
  300. * Sequence numbers for management frames, QoS data
  301. * frames with a broadcast/multicast address in the
  302. * Address 1 field, and all non-QoS data frames sent
  303. * by QoS STAs are assigned using an additional single
  304. * modulo-4096 counter, [...]
  305. *
  306. * We also use that counter for non-QoS STAs.
  307. */
  308. seqno_idx = NUM_RX_DATA_QUEUES;
  309. security_idx = 0;
  310. if (ieee80211_is_mgmt(hdr->frame_control))
  311. security_idx = NUM_RX_DATA_QUEUES;
  312. tid = 0;
  313. }
  314. rx->seqno_idx = seqno_idx;
  315. rx->security_idx = security_idx;
  316. /* Set skb->priority to 1d tag if highest order bit of TID is not set.
  317. * For now, set skb->priority to 0 for other cases. */
  318. rx->skb->priority = (tid > 7) ? 0 : tid;
  319. }
  320. /**
  321. * DOC: Packet alignment
  322. *
  323. * Drivers always need to pass packets that are aligned to two-byte boundaries
  324. * to the stack.
  325. *
  326. * Additionally, should, if possible, align the payload data in a way that
  327. * guarantees that the contained IP header is aligned to a four-byte
  328. * boundary. In the case of regular frames, this simply means aligning the
  329. * payload to a four-byte boundary (because either the IP header is directly
  330. * contained, or IV/RFC1042 headers that have a length divisible by four are
  331. * in front of it). If the payload data is not properly aligned and the
  332. * architecture doesn't support efficient unaligned operations, mac80211
  333. * will align the data.
  334. *
  335. * With A-MSDU frames, however, the payload data address must yield two modulo
  336. * four because there are 14-byte 802.3 headers within the A-MSDU frames that
  337. * push the IP header further back to a multiple of four again. Thankfully, the
  338. * specs were sane enough this time around to require padding each A-MSDU
  339. * subframe to a length that is a multiple of four.
  340. *
  341. * Padding like Atheros hardware adds which is between the 802.11 header and
  342. * the payload is not supported, the driver is required to move the 802.11
  343. * header to be directly in front of the payload in that case.
  344. */
  345. static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
  346. {
  347. #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
  348. WARN_ONCE((unsigned long)rx->skb->data & 1,
  349. "unaligned packet at 0x%p\n", rx->skb->data);
  350. #endif
  351. }
  352. /* rx handlers */
  353. static ieee80211_rx_result debug_noinline
  354. ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
  355. {
  356. struct ieee80211_local *local = rx->local;
  357. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  358. struct sk_buff *skb = rx->skb;
  359. if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
  360. !local->sched_scanning))
  361. return RX_CONTINUE;
  362. if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
  363. test_bit(SCAN_SW_SCANNING, &local->scanning) ||
  364. local->sched_scanning)
  365. return ieee80211_scan_rx(rx->sdata, skb);
  366. /* scanning finished during invoking of handlers */
  367. I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
  368. return RX_DROP_UNUSABLE;
  369. }
  370. static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
  371. {
  372. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  373. if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
  374. return 0;
  375. return ieee80211_is_robust_mgmt_frame(hdr);
  376. }
  377. static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
  378. {
  379. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  380. if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
  381. return 0;
  382. return ieee80211_is_robust_mgmt_frame(hdr);
  383. }
  384. /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
  385. static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
  386. {
  387. struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
  388. struct ieee80211_mmie *mmie;
  389. if (skb->len < 24 + sizeof(*mmie) ||
  390. !is_multicast_ether_addr(hdr->da))
  391. return -1;
  392. if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
  393. return -1; /* not a robust management frame */
  394. mmie = (struct ieee80211_mmie *)
  395. (skb->data + skb->len - sizeof(*mmie));
  396. if (mmie->element_id != WLAN_EID_MMIE ||
  397. mmie->length != sizeof(*mmie) - 2)
  398. return -1;
  399. return le16_to_cpu(mmie->key_id);
  400. }
  401. static ieee80211_rx_result
  402. ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
  403. {
  404. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  405. char *dev_addr = rx->sdata->vif.addr;
  406. if (ieee80211_is_data(hdr->frame_control)) {
  407. if (is_multicast_ether_addr(hdr->addr1)) {
  408. if (ieee80211_has_tods(hdr->frame_control) ||
  409. !ieee80211_has_fromds(hdr->frame_control))
  410. return RX_DROP_MONITOR;
  411. if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
  412. return RX_DROP_MONITOR;
  413. } else {
  414. if (!ieee80211_has_a4(hdr->frame_control))
  415. return RX_DROP_MONITOR;
  416. if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
  417. return RX_DROP_MONITOR;
  418. }
  419. }
  420. /* If there is not an established peer link and this is not a peer link
  421. * establisment frame, beacon or probe, drop the frame.
  422. */
  423. if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
  424. struct ieee80211_mgmt *mgmt;
  425. if (!ieee80211_is_mgmt(hdr->frame_control))
  426. return RX_DROP_MONITOR;
  427. if (ieee80211_is_action(hdr->frame_control)) {
  428. u8 category;
  429. mgmt = (struct ieee80211_mgmt *)hdr;
  430. category = mgmt->u.action.category;
  431. if (category != WLAN_CATEGORY_MESH_ACTION &&
  432. category != WLAN_CATEGORY_SELF_PROTECTED)
  433. return RX_DROP_MONITOR;
  434. return RX_CONTINUE;
  435. }
  436. if (ieee80211_is_probe_req(hdr->frame_control) ||
  437. ieee80211_is_probe_resp(hdr->frame_control) ||
  438. ieee80211_is_beacon(hdr->frame_control) ||
  439. ieee80211_is_auth(hdr->frame_control))
  440. return RX_CONTINUE;
  441. return RX_DROP_MONITOR;
  442. }
  443. return RX_CONTINUE;
  444. }
  445. #define SEQ_MODULO 0x1000
  446. #define SEQ_MASK 0xfff
  447. static inline int seq_less(u16 sq1, u16 sq2)
  448. {
  449. return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
  450. }
  451. static inline u16 seq_inc(u16 sq)
  452. {
  453. return (sq + 1) & SEQ_MASK;
  454. }
  455. static inline u16 seq_sub(u16 sq1, u16 sq2)
  456. {
  457. return (sq1 - sq2) & SEQ_MASK;
  458. }
  459. static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
  460. struct tid_ampdu_rx *tid_agg_rx,
  461. int index)
  462. {
  463. struct ieee80211_local *local = hw_to_local(hw);
  464. struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
  465. struct ieee80211_rx_status *status;
  466. lockdep_assert_held(&tid_agg_rx->reorder_lock);
  467. if (!skb)
  468. goto no_frame;
  469. /* release the frame from the reorder ring buffer */
  470. tid_agg_rx->stored_mpdu_num--;
  471. tid_agg_rx->reorder_buf[index] = NULL;
  472. status = IEEE80211_SKB_RXCB(skb);
  473. status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
  474. skb_queue_tail(&local->rx_skb_queue, skb);
  475. no_frame:
  476. tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
  477. }
  478. static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
  479. struct tid_ampdu_rx *tid_agg_rx,
  480. u16 head_seq_num)
  481. {
  482. int index;
  483. lockdep_assert_held(&tid_agg_rx->reorder_lock);
  484. while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
  485. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
  486. tid_agg_rx->buf_size;
  487. ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
  488. }
  489. }
  490. /*
  491. * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
  492. * the skb was added to the buffer longer than this time ago, the earlier
  493. * frames that have not yet been received are assumed to be lost and the skb
  494. * can be released for processing. This may also release other skb's from the
  495. * reorder buffer if there are no additional gaps between the frames.
  496. *
  497. * Callers must hold tid_agg_rx->reorder_lock.
  498. */
  499. #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
  500. static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
  501. struct tid_ampdu_rx *tid_agg_rx)
  502. {
  503. int index, j;
  504. lockdep_assert_held(&tid_agg_rx->reorder_lock);
  505. /* release the buffer until next missing frame */
  506. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
  507. tid_agg_rx->buf_size;
  508. if (!tid_agg_rx->reorder_buf[index] &&
  509. tid_agg_rx->stored_mpdu_num > 1) {
  510. /*
  511. * No buffers ready to be released, but check whether any
  512. * frames in the reorder buffer have timed out.
  513. */
  514. int skipped = 1;
  515. for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
  516. j = (j + 1) % tid_agg_rx->buf_size) {
  517. if (!tid_agg_rx->reorder_buf[j]) {
  518. skipped++;
  519. continue;
  520. }
  521. if (skipped &&
  522. !time_after(jiffies, tid_agg_rx->reorder_time[j] +
  523. HT_RX_REORDER_BUF_TIMEOUT))
  524. goto set_release_timer;
  525. #ifdef CONFIG_MAC80211_HT_DEBUG
  526. if (net_ratelimit())
  527. wiphy_debug(hw->wiphy,
  528. "release an RX reorder frame due to timeout on earlier frames\n");
  529. #endif
  530. ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
  531. /*
  532. * Increment the head seq# also for the skipped slots.
  533. */
  534. tid_agg_rx->head_seq_num =
  535. (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
  536. skipped = 0;
  537. }
  538. } else while (tid_agg_rx->reorder_buf[index]) {
  539. ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
  540. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
  541. tid_agg_rx->buf_size;
  542. }
  543. if (tid_agg_rx->stored_mpdu_num) {
  544. j = index = seq_sub(tid_agg_rx->head_seq_num,
  545. tid_agg_rx->ssn) % tid_agg_rx->buf_size;
  546. for (; j != (index - 1) % tid_agg_rx->buf_size;
  547. j = (j + 1) % tid_agg_rx->buf_size) {
  548. if (tid_agg_rx->reorder_buf[j])
  549. break;
  550. }
  551. set_release_timer:
  552. mod_timer(&tid_agg_rx->reorder_timer,
  553. tid_agg_rx->reorder_time[j] + 1 +
  554. HT_RX_REORDER_BUF_TIMEOUT);
  555. } else {
  556. del_timer(&tid_agg_rx->reorder_timer);
  557. }
  558. }
  559. /*
  560. * As this function belongs to the RX path it must be under
  561. * rcu_read_lock protection. It returns false if the frame
  562. * can be processed immediately, true if it was consumed.
  563. */
  564. static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  565. struct tid_ampdu_rx *tid_agg_rx,
  566. struct sk_buff *skb)
  567. {
  568. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  569. u16 sc = le16_to_cpu(hdr->seq_ctrl);
  570. u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
  571. u16 head_seq_num, buf_size;
  572. int index;
  573. bool ret = true;
  574. spin_lock(&tid_agg_rx->reorder_lock);
  575. buf_size = tid_agg_rx->buf_size;
  576. head_seq_num = tid_agg_rx->head_seq_num;
  577. /* frame with out of date sequence number */
  578. if (seq_less(mpdu_seq_num, head_seq_num)) {
  579. dev_kfree_skb(skb);
  580. goto out;
  581. }
  582. /*
  583. * If frame the sequence number exceeds our buffering window
  584. * size release some previous frames to make room for this one.
  585. */
  586. if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
  587. head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
  588. /* release stored frames up to new head to stack */
  589. ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
  590. }
  591. /* Now the new frame is always in the range of the reordering buffer */
  592. index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
  593. /* check if we already stored this frame */
  594. if (tid_agg_rx->reorder_buf[index]) {
  595. dev_kfree_skb(skb);
  596. goto out;
  597. }
  598. /*
  599. * If the current MPDU is in the right order and nothing else
  600. * is stored we can process it directly, no need to buffer it.
  601. * If it is first but there's something stored, we may be able
  602. * to release frames after this one.
  603. */
  604. if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
  605. tid_agg_rx->stored_mpdu_num == 0) {
  606. tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
  607. ret = false;
  608. goto out;
  609. }
  610. /* put the frame in the reordering buffer */
  611. tid_agg_rx->reorder_buf[index] = skb;
  612. tid_agg_rx->reorder_time[index] = jiffies;
  613. tid_agg_rx->stored_mpdu_num++;
  614. ieee80211_sta_reorder_release(hw, tid_agg_rx);
  615. out:
  616. spin_unlock(&tid_agg_rx->reorder_lock);
  617. return ret;
  618. }
  619. /*
  620. * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
  621. * true if the MPDU was buffered, false if it should be processed.
  622. */
  623. static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
  624. {
  625. struct sk_buff *skb = rx->skb;
  626. struct ieee80211_local *local = rx->local;
  627. struct ieee80211_hw *hw = &local->hw;
  628. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  629. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  630. struct sta_info *sta = rx->sta;
  631. struct tid_ampdu_rx *tid_agg_rx;
  632. u16 sc;
  633. u8 tid, ack_policy;
  634. if (!ieee80211_is_data_qos(hdr->frame_control))
  635. goto dont_reorder;
  636. /*
  637. * filter the QoS data rx stream according to
  638. * STA/TID and check if this STA/TID is on aggregation
  639. */
  640. if (!sta)
  641. goto dont_reorder;
  642. ack_policy = *ieee80211_get_qos_ctl(hdr) &
  643. IEEE80211_QOS_CTL_ACK_POLICY_MASK;
  644. tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
  645. tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
  646. if (!tid_agg_rx)
  647. goto dont_reorder;
  648. /* qos null data frames are excluded */
  649. if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
  650. goto dont_reorder;
  651. /* not part of a BA session */
  652. if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
  653. ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
  654. goto dont_reorder;
  655. /* not actually part of this BA session */
  656. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  657. goto dont_reorder;
  658. /* new, potentially un-ordered, ampdu frame - process it */
  659. /* reset session timer */
  660. if (tid_agg_rx->timeout)
  661. mod_timer(&tid_agg_rx->session_timer,
  662. TU_TO_EXP_TIME(tid_agg_rx->timeout));
  663. /* if this mpdu is fragmented - terminate rx aggregation session */
  664. sc = le16_to_cpu(hdr->seq_ctrl);
  665. if (sc & IEEE80211_SCTL_FRAG) {
  666. skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
  667. skb_queue_tail(&rx->sdata->skb_queue, skb);
  668. ieee80211_queue_work(&local->hw, &rx->sdata->work);
  669. return;
  670. }
  671. /*
  672. * No locking needed -- we will only ever process one
  673. * RX packet at a time, and thus own tid_agg_rx. All
  674. * other code manipulating it needs to (and does) make
  675. * sure that we cannot get to it any more before doing
  676. * anything with it.
  677. */
  678. if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
  679. return;
  680. dont_reorder:
  681. skb_queue_tail(&local->rx_skb_queue, skb);
  682. }
  683. static ieee80211_rx_result debug_noinline
  684. ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
  685. {
  686. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  687. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  688. /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
  689. if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
  690. if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
  691. rx->sta->last_seq_ctrl[rx->seqno_idx] ==
  692. hdr->seq_ctrl)) {
  693. if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
  694. rx->local->dot11FrameDuplicateCount++;
  695. rx->sta->num_duplicates++;
  696. }
  697. return RX_DROP_UNUSABLE;
  698. } else
  699. rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
  700. }
  701. if (unlikely(rx->skb->len < 16)) {
  702. I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
  703. return RX_DROP_MONITOR;
  704. }
  705. /* Drop disallowed frame classes based on STA auth/assoc state;
  706. * IEEE 802.11, Chap 5.5.
  707. *
  708. * mac80211 filters only based on association state, i.e. it drops
  709. * Class 3 frames from not associated stations. hostapd sends
  710. * deauth/disassoc frames when needed. In addition, hostapd is
  711. * responsible for filtering on both auth and assoc states.
  712. */
  713. if (ieee80211_vif_is_mesh(&rx->sdata->vif))
  714. return ieee80211_rx_mesh_check(rx);
  715. if (unlikely((ieee80211_is_data(hdr->frame_control) ||
  716. ieee80211_is_pspoll(hdr->frame_control)) &&
  717. rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
  718. rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
  719. (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
  720. if (rx->sta && rx->sta->dummy &&
  721. ieee80211_is_data_present(hdr->frame_control)) {
  722. u16 ethertype;
  723. u8 *payload;
  724. payload = rx->skb->data +
  725. ieee80211_hdrlen(hdr->frame_control);
  726. ethertype = (payload[6] << 8) | payload[7];
  727. if (cpu_to_be16(ethertype) ==
  728. rx->sdata->control_port_protocol)
  729. return RX_CONTINUE;
  730. }
  731. if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
  732. cfg80211_rx_spurious_frame(rx->sdata->dev,
  733. hdr->addr2,
  734. GFP_ATOMIC))
  735. return RX_DROP_UNUSABLE;
  736. return RX_DROP_MONITOR;
  737. }
  738. return RX_CONTINUE;
  739. }
  740. static ieee80211_rx_result debug_noinline
  741. ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
  742. {
  743. struct sk_buff *skb = rx->skb;
  744. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  745. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  746. int keyidx;
  747. int hdrlen;
  748. ieee80211_rx_result result = RX_DROP_UNUSABLE;
  749. struct ieee80211_key *sta_ptk = NULL;
  750. int mmie_keyidx = -1;
  751. __le16 fc;
  752. /*
  753. * Key selection 101
  754. *
  755. * There are four types of keys:
  756. * - GTK (group keys)
  757. * - IGTK (group keys for management frames)
  758. * - PTK (pairwise keys)
  759. * - STK (station-to-station pairwise keys)
  760. *
  761. * When selecting a key, we have to distinguish between multicast
  762. * (including broadcast) and unicast frames, the latter can only
  763. * use PTKs and STKs while the former always use GTKs and IGTKs.
  764. * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
  765. * unicast frames can also use key indices like GTKs. Hence, if we
  766. * don't have a PTK/STK we check the key index for a WEP key.
  767. *
  768. * Note that in a regular BSS, multicast frames are sent by the
  769. * AP only, associated stations unicast the frame to the AP first
  770. * which then multicasts it on their behalf.
  771. *
  772. * There is also a slight problem in IBSS mode: GTKs are negotiated
  773. * with each station, that is something we don't currently handle.
  774. * The spec seems to expect that one negotiates the same key with
  775. * every station but there's no such requirement; VLANs could be
  776. * possible.
  777. */
  778. /*
  779. * No point in finding a key and decrypting if the frame is neither
  780. * addressed to us nor a multicast frame.
  781. */
  782. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  783. return RX_CONTINUE;
  784. /* start without a key */
  785. rx->key = NULL;
  786. if (rx->sta)
  787. sta_ptk = rcu_dereference(rx->sta->ptk);
  788. fc = hdr->frame_control;
  789. if (!ieee80211_has_protected(fc))
  790. mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
  791. if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
  792. rx->key = sta_ptk;
  793. if ((status->flag & RX_FLAG_DECRYPTED) &&
  794. (status->flag & RX_FLAG_IV_STRIPPED))
  795. return RX_CONTINUE;
  796. /* Skip decryption if the frame is not protected. */
  797. if (!ieee80211_has_protected(fc))
  798. return RX_CONTINUE;
  799. } else if (mmie_keyidx >= 0) {
  800. /* Broadcast/multicast robust management frame / BIP */
  801. if ((status->flag & RX_FLAG_DECRYPTED) &&
  802. (status->flag & RX_FLAG_IV_STRIPPED))
  803. return RX_CONTINUE;
  804. if (mmie_keyidx < NUM_DEFAULT_KEYS ||
  805. mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
  806. return RX_DROP_MONITOR; /* unexpected BIP keyidx */
  807. if (rx->sta)
  808. rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
  809. if (!rx->key)
  810. rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
  811. } else if (!ieee80211_has_protected(fc)) {
  812. /*
  813. * The frame was not protected, so skip decryption. However, we
  814. * need to set rx->key if there is a key that could have been
  815. * used so that the frame may be dropped if encryption would
  816. * have been expected.
  817. */
  818. struct ieee80211_key *key = NULL;
  819. struct ieee80211_sub_if_data *sdata = rx->sdata;
  820. int i;
  821. if (ieee80211_is_mgmt(fc) &&
  822. is_multicast_ether_addr(hdr->addr1) &&
  823. (key = rcu_dereference(rx->sdata->default_mgmt_key)))
  824. rx->key = key;
  825. else {
  826. if (rx->sta) {
  827. for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
  828. key = rcu_dereference(rx->sta->gtk[i]);
  829. if (key)
  830. break;
  831. }
  832. }
  833. if (!key) {
  834. for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
  835. key = rcu_dereference(sdata->keys[i]);
  836. if (key)
  837. break;
  838. }
  839. }
  840. if (key)
  841. rx->key = key;
  842. }
  843. return RX_CONTINUE;
  844. } else {
  845. u8 keyid;
  846. /*
  847. * The device doesn't give us the IV so we won't be
  848. * able to look up the key. That's ok though, we
  849. * don't need to decrypt the frame, we just won't
  850. * be able to keep statistics accurate.
  851. * Except for key threshold notifications, should
  852. * we somehow allow the driver to tell us which key
  853. * the hardware used if this flag is set?
  854. */
  855. if ((status->flag & RX_FLAG_DECRYPTED) &&
  856. (status->flag & RX_FLAG_IV_STRIPPED))
  857. return RX_CONTINUE;
  858. hdrlen = ieee80211_hdrlen(fc);
  859. if (rx->skb->len < 8 + hdrlen)
  860. return RX_DROP_UNUSABLE; /* TODO: count this? */
  861. /*
  862. * no need to call ieee80211_wep_get_keyidx,
  863. * it verifies a bunch of things we've done already
  864. */
  865. skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
  866. keyidx = keyid >> 6;
  867. /* check per-station GTK first, if multicast packet */
  868. if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
  869. rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
  870. /* if not found, try default key */
  871. if (!rx->key) {
  872. rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
  873. /*
  874. * RSNA-protected unicast frames should always be
  875. * sent with pairwise or station-to-station keys,
  876. * but for WEP we allow using a key index as well.
  877. */
  878. if (rx->key &&
  879. rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
  880. rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
  881. !is_multicast_ether_addr(hdr->addr1))
  882. rx->key = NULL;
  883. }
  884. }
  885. if (rx->key) {
  886. if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
  887. return RX_DROP_MONITOR;
  888. rx->key->tx_rx_count++;
  889. /* TODO: add threshold stuff again */
  890. } else {
  891. return RX_DROP_MONITOR;
  892. }
  893. if (skb_linearize(rx->skb))
  894. return RX_DROP_UNUSABLE;
  895. /* the hdr variable is invalid now! */
  896. switch (rx->key->conf.cipher) {
  897. case WLAN_CIPHER_SUITE_WEP40:
  898. case WLAN_CIPHER_SUITE_WEP104:
  899. /* Check for weak IVs if possible */
  900. if (rx->sta && ieee80211_is_data(fc) &&
  901. (!(status->flag & RX_FLAG_IV_STRIPPED) ||
  902. !(status->flag & RX_FLAG_DECRYPTED)) &&
  903. ieee80211_wep_is_weak_iv(rx->skb, rx->key))
  904. rx->sta->wep_weak_iv_count++;
  905. result = ieee80211_crypto_wep_decrypt(rx);
  906. break;
  907. case WLAN_CIPHER_SUITE_TKIP:
  908. result = ieee80211_crypto_tkip_decrypt(rx);
  909. break;
  910. case WLAN_CIPHER_SUITE_CCMP:
  911. result = ieee80211_crypto_ccmp_decrypt(rx);
  912. break;
  913. case WLAN_CIPHER_SUITE_AES_CMAC:
  914. result = ieee80211_crypto_aes_cmac_decrypt(rx);
  915. break;
  916. default:
  917. /*
  918. * We can reach here only with HW-only algorithms
  919. * but why didn't it decrypt the frame?!
  920. */
  921. return RX_DROP_UNUSABLE;
  922. }
  923. /* either the frame has been decrypted or will be dropped */
  924. status->flag |= RX_FLAG_DECRYPTED;
  925. return result;
  926. }
  927. static ieee80211_rx_result debug_noinline
  928. ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
  929. {
  930. struct ieee80211_local *local;
  931. struct ieee80211_hdr *hdr;
  932. struct sk_buff *skb;
  933. local = rx->local;
  934. skb = rx->skb;
  935. hdr = (struct ieee80211_hdr *) skb->data;
  936. if (!local->pspolling)
  937. return RX_CONTINUE;
  938. if (!ieee80211_has_fromds(hdr->frame_control))
  939. /* this is not from AP */
  940. return RX_CONTINUE;
  941. if (!ieee80211_is_data(hdr->frame_control))
  942. return RX_CONTINUE;
  943. if (!ieee80211_has_moredata(hdr->frame_control)) {
  944. /* AP has no more frames buffered for us */
  945. local->pspolling = false;
  946. return RX_CONTINUE;
  947. }
  948. /* more data bit is set, let's request a new frame from the AP */
  949. ieee80211_send_pspoll(local, rx->sdata);
  950. return RX_CONTINUE;
  951. }
  952. static void ap_sta_ps_start(struct sta_info *sta)
  953. {
  954. struct ieee80211_sub_if_data *sdata = sta->sdata;
  955. struct ieee80211_local *local = sdata->local;
  956. atomic_inc(&sdata->bss->num_sta_ps);
  957. set_sta_flag(sta, WLAN_STA_PS_STA);
  958. if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
  959. drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
  960. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  961. printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
  962. sdata->name, sta->sta.addr, sta->sta.aid);
  963. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  964. }
  965. static void ap_sta_ps_end(struct sta_info *sta)
  966. {
  967. struct ieee80211_sub_if_data *sdata = sta->sdata;
  968. atomic_dec(&sdata->bss->num_sta_ps);
  969. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  970. printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
  971. sdata->name, sta->sta.addr, sta->sta.aid);
  972. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  973. if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
  974. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  975. printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
  976. sdata->name, sta->sta.addr, sta->sta.aid);
  977. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  978. return;
  979. }
  980. ieee80211_sta_ps_deliver_wakeup(sta);
  981. }
  982. int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
  983. {
  984. struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
  985. bool in_ps;
  986. WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
  987. /* Don't let the same PS state be set twice */
  988. in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
  989. if ((start && in_ps) || (!start && !in_ps))
  990. return -EINVAL;
  991. if (start)
  992. ap_sta_ps_start(sta_inf);
  993. else
  994. ap_sta_ps_end(sta_inf);
  995. return 0;
  996. }
  997. EXPORT_SYMBOL(ieee80211_sta_ps_transition);
  998. static ieee80211_rx_result debug_noinline
  999. ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
  1000. {
  1001. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1002. struct ieee80211_hdr *hdr = (void *)rx->skb->data;
  1003. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1004. int tid, ac;
  1005. if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1006. return RX_CONTINUE;
  1007. if (sdata->vif.type != NL80211_IFTYPE_AP &&
  1008. sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
  1009. return RX_CONTINUE;
  1010. /*
  1011. * The device handles station powersave, so don't do anything about
  1012. * uAPSD and PS-Poll frames (the latter shouldn't even come up from
  1013. * it to mac80211 since they're handled.)
  1014. */
  1015. if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
  1016. return RX_CONTINUE;
  1017. /*
  1018. * Don't do anything if the station isn't already asleep. In
  1019. * the uAPSD case, the station will probably be marked asleep,
  1020. * in the PS-Poll case the station must be confused ...
  1021. */
  1022. if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
  1023. return RX_CONTINUE;
  1024. if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
  1025. if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
  1026. if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
  1027. ieee80211_sta_ps_deliver_poll_response(rx->sta);
  1028. else
  1029. set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
  1030. }
  1031. /* Free PS Poll skb here instead of returning RX_DROP that would
  1032. * count as an dropped frame. */
  1033. dev_kfree_skb(rx->skb);
  1034. return RX_QUEUED;
  1035. } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
  1036. !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
  1037. ieee80211_has_pm(hdr->frame_control) &&
  1038. (ieee80211_is_data_qos(hdr->frame_control) ||
  1039. ieee80211_is_qos_nullfunc(hdr->frame_control))) {
  1040. tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
  1041. ac = ieee802_1d_to_ac[tid & 7];
  1042. /*
  1043. * If this AC is not trigger-enabled do nothing.
  1044. *
  1045. * NB: This could/should check a separate bitmap of trigger-
  1046. * enabled queues, but for now we only implement uAPSD w/o
  1047. * TSPEC changes to the ACs, so they're always the same.
  1048. */
  1049. if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
  1050. return RX_CONTINUE;
  1051. /* if we are in a service period, do nothing */
  1052. if (test_sta_flag(rx->sta, WLAN_STA_SP))
  1053. return RX_CONTINUE;
  1054. if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
  1055. ieee80211_sta_ps_deliver_uapsd(rx->sta);
  1056. else
  1057. set_sta_flag(rx->sta, WLAN_STA_UAPSD);
  1058. }
  1059. return RX_CONTINUE;
  1060. }
  1061. static ieee80211_rx_result debug_noinline
  1062. ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
  1063. {
  1064. struct sta_info *sta = rx->sta;
  1065. struct sk_buff *skb = rx->skb;
  1066. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  1067. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  1068. if (!sta)
  1069. return RX_CONTINUE;
  1070. /*
  1071. * Update last_rx only for IBSS packets which are for the current
  1072. * BSSID to avoid keeping the current IBSS network alive in cases
  1073. * where other STAs start using different BSSID.
  1074. */
  1075. if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
  1076. u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
  1077. NL80211_IFTYPE_ADHOC);
  1078. if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
  1079. sta->last_rx = jiffies;
  1080. if (ieee80211_is_data(hdr->frame_control)) {
  1081. sta->last_rx_rate_idx = status->rate_idx;
  1082. sta->last_rx_rate_flag = status->flag;
  1083. }
  1084. }
  1085. } else if (!is_multicast_ether_addr(hdr->addr1)) {
  1086. /*
  1087. * Mesh beacons will update last_rx when if they are found to
  1088. * match the current local configuration when processed.
  1089. */
  1090. sta->last_rx = jiffies;
  1091. if (ieee80211_is_data(hdr->frame_control)) {
  1092. sta->last_rx_rate_idx = status->rate_idx;
  1093. sta->last_rx_rate_flag = status->flag;
  1094. }
  1095. }
  1096. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1097. return RX_CONTINUE;
  1098. if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
  1099. ieee80211_sta_rx_notify(rx->sdata, hdr);
  1100. sta->rx_fragments++;
  1101. sta->rx_bytes += rx->skb->len;
  1102. sta->last_signal = status->signal;
  1103. ewma_add(&sta->avg_signal, -status->signal);
  1104. /*
  1105. * Change STA power saving mode only at the end of a frame
  1106. * exchange sequence.
  1107. */
  1108. if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
  1109. !ieee80211_has_morefrags(hdr->frame_control) &&
  1110. !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
  1111. (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
  1112. rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
  1113. if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
  1114. /*
  1115. * Ignore doze->wake transitions that are
  1116. * indicated by non-data frames, the standard
  1117. * is unclear here, but for example going to
  1118. * PS mode and then scanning would cause a
  1119. * doze->wake transition for the probe request,
  1120. * and that is clearly undesirable.
  1121. */
  1122. if (ieee80211_is_data(hdr->frame_control) &&
  1123. !ieee80211_has_pm(hdr->frame_control))
  1124. ap_sta_ps_end(sta);
  1125. } else {
  1126. if (ieee80211_has_pm(hdr->frame_control))
  1127. ap_sta_ps_start(sta);
  1128. }
  1129. }
  1130. /*
  1131. * Drop (qos-)data::nullfunc frames silently, since they
  1132. * are used only to control station power saving mode.
  1133. */
  1134. if (ieee80211_is_nullfunc(hdr->frame_control) ||
  1135. ieee80211_is_qos_nullfunc(hdr->frame_control)) {
  1136. I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
  1137. /*
  1138. * If we receive a 4-addr nullfunc frame from a STA
  1139. * that was not moved to a 4-addr STA vlan yet send
  1140. * the event to userspace and for older hostapd drop
  1141. * the frame to the monitor interface.
  1142. */
  1143. if (ieee80211_has_a4(hdr->frame_control) &&
  1144. (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
  1145. (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1146. !rx->sdata->u.vlan.sta))) {
  1147. if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
  1148. cfg80211_rx_unexpected_4addr_frame(
  1149. rx->sdata->dev, sta->sta.addr,
  1150. GFP_ATOMIC);
  1151. return RX_DROP_MONITOR;
  1152. }
  1153. /*
  1154. * Update counter and free packet here to avoid
  1155. * counting this as a dropped packed.
  1156. */
  1157. sta->rx_packets++;
  1158. dev_kfree_skb(rx->skb);
  1159. return RX_QUEUED;
  1160. }
  1161. return RX_CONTINUE;
  1162. } /* ieee80211_rx_h_sta_process */
  1163. static inline struct ieee80211_fragment_entry *
  1164. ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
  1165. unsigned int frag, unsigned int seq, int rx_queue,
  1166. struct sk_buff **skb)
  1167. {
  1168. struct ieee80211_fragment_entry *entry;
  1169. int idx;
  1170. idx = sdata->fragment_next;
  1171. entry = &sdata->fragments[sdata->fragment_next++];
  1172. if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
  1173. sdata->fragment_next = 0;
  1174. if (!skb_queue_empty(&entry->skb_list)) {
  1175. #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
  1176. struct ieee80211_hdr *hdr =
  1177. (struct ieee80211_hdr *) entry->skb_list.next->data;
  1178. printk(KERN_DEBUG "%s: RX reassembly removed oldest "
  1179. "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
  1180. "addr1=%pM addr2=%pM\n",
  1181. sdata->name, idx,
  1182. jiffies - entry->first_frag_time, entry->seq,
  1183. entry->last_frag, hdr->addr1, hdr->addr2);
  1184. #endif
  1185. __skb_queue_purge(&entry->skb_list);
  1186. }
  1187. __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
  1188. *skb = NULL;
  1189. entry->first_frag_time = jiffies;
  1190. entry->seq = seq;
  1191. entry->rx_queue = rx_queue;
  1192. entry->last_frag = frag;
  1193. entry->ccmp = 0;
  1194. entry->extra_len = 0;
  1195. return entry;
  1196. }
  1197. static inline struct ieee80211_fragment_entry *
  1198. ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
  1199. unsigned int frag, unsigned int seq,
  1200. int rx_queue, struct ieee80211_hdr *hdr)
  1201. {
  1202. struct ieee80211_fragment_entry *entry;
  1203. int i, idx;
  1204. idx = sdata->fragment_next;
  1205. for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
  1206. struct ieee80211_hdr *f_hdr;
  1207. idx--;
  1208. if (idx < 0)
  1209. idx = IEEE80211_FRAGMENT_MAX - 1;
  1210. entry = &sdata->fragments[idx];
  1211. if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
  1212. entry->rx_queue != rx_queue ||
  1213. entry->last_frag + 1 != frag)
  1214. continue;
  1215. f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
  1216. /*
  1217. * Check ftype and addresses are equal, else check next fragment
  1218. */
  1219. if (((hdr->frame_control ^ f_hdr->frame_control) &
  1220. cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
  1221. compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
  1222. compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
  1223. continue;
  1224. if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
  1225. __skb_queue_purge(&entry->skb_list);
  1226. continue;
  1227. }
  1228. return entry;
  1229. }
  1230. return NULL;
  1231. }
  1232. static ieee80211_rx_result debug_noinline
  1233. ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
  1234. {
  1235. struct ieee80211_hdr *hdr;
  1236. u16 sc;
  1237. __le16 fc;
  1238. unsigned int frag, seq;
  1239. struct ieee80211_fragment_entry *entry;
  1240. struct sk_buff *skb;
  1241. struct ieee80211_rx_status *status;
  1242. hdr = (struct ieee80211_hdr *)rx->skb->data;
  1243. fc = hdr->frame_control;
  1244. sc = le16_to_cpu(hdr->seq_ctrl);
  1245. frag = sc & IEEE80211_SCTL_FRAG;
  1246. if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
  1247. (rx->skb)->len < 24 ||
  1248. is_multicast_ether_addr(hdr->addr1))) {
  1249. /* not fragmented */
  1250. goto out;
  1251. }
  1252. I802_DEBUG_INC(rx->local->rx_handlers_fragments);
  1253. if (skb_linearize(rx->skb))
  1254. return RX_DROP_UNUSABLE;
  1255. /*
  1256. * skb_linearize() might change the skb->data and
  1257. * previously cached variables (in this case, hdr) need to
  1258. * be refreshed with the new data.
  1259. */
  1260. hdr = (struct ieee80211_hdr *)rx->skb->data;
  1261. seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
  1262. if (frag == 0) {
  1263. /* This is the first fragment of a new frame. */
  1264. entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
  1265. rx->seqno_idx, &(rx->skb));
  1266. if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
  1267. ieee80211_has_protected(fc)) {
  1268. int queue = rx->security_idx;
  1269. /* Store CCMP PN so that we can verify that the next
  1270. * fragment has a sequential PN value. */
  1271. entry->ccmp = 1;
  1272. memcpy(entry->last_pn,
  1273. rx->key->u.ccmp.rx_pn[queue],
  1274. CCMP_PN_LEN);
  1275. }
  1276. return RX_QUEUED;
  1277. }
  1278. /* This is a fragment for a frame that should already be pending in
  1279. * fragment cache. Add this fragment to the end of the pending entry.
  1280. */
  1281. entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
  1282. rx->seqno_idx, hdr);
  1283. if (!entry) {
  1284. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  1285. return RX_DROP_MONITOR;
  1286. }
  1287. /* Verify that MPDUs within one MSDU have sequential PN values.
  1288. * (IEEE 802.11i, 8.3.3.4.5) */
  1289. if (entry->ccmp) {
  1290. int i;
  1291. u8 pn[CCMP_PN_LEN], *rpn;
  1292. int queue;
  1293. if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
  1294. return RX_DROP_UNUSABLE;
  1295. memcpy(pn, entry->last_pn, CCMP_PN_LEN);
  1296. for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
  1297. pn[i]++;
  1298. if (pn[i])
  1299. break;
  1300. }
  1301. queue = rx->security_idx;
  1302. rpn = rx->key->u.ccmp.rx_pn[queue];
  1303. if (memcmp(pn, rpn, CCMP_PN_LEN))
  1304. return RX_DROP_UNUSABLE;
  1305. memcpy(entry->last_pn, pn, CCMP_PN_LEN);
  1306. }
  1307. skb_pull(rx->skb, ieee80211_hdrlen(fc));
  1308. __skb_queue_tail(&entry->skb_list, rx->skb);
  1309. entry->last_frag = frag;
  1310. entry->extra_len += rx->skb->len;
  1311. if (ieee80211_has_morefrags(fc)) {
  1312. rx->skb = NULL;
  1313. return RX_QUEUED;
  1314. }
  1315. rx->skb = __skb_dequeue(&entry->skb_list);
  1316. if (skb_tailroom(rx->skb) < entry->extra_len) {
  1317. I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
  1318. if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
  1319. GFP_ATOMIC))) {
  1320. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  1321. __skb_queue_purge(&entry->skb_list);
  1322. return RX_DROP_UNUSABLE;
  1323. }
  1324. }
  1325. while ((skb = __skb_dequeue(&entry->skb_list))) {
  1326. memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
  1327. dev_kfree_skb(skb);
  1328. }
  1329. /* Complete frame has been reassembled - process it now */
  1330. status = IEEE80211_SKB_RXCB(rx->skb);
  1331. status->rx_flags |= IEEE80211_RX_FRAGMENTED;
  1332. out:
  1333. if (rx->sta)
  1334. rx->sta->rx_packets++;
  1335. if (is_multicast_ether_addr(hdr->addr1))
  1336. rx->local->dot11MulticastReceivedFrameCount++;
  1337. else
  1338. ieee80211_led_rx(rx->local);
  1339. return RX_CONTINUE;
  1340. }
  1341. static ieee80211_rx_result debug_noinline
  1342. ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
  1343. {
  1344. u8 *data = rx->skb->data;
  1345. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
  1346. if (!ieee80211_is_data_qos(hdr->frame_control))
  1347. return RX_CONTINUE;
  1348. /* remove the qos control field, update frame type and meta-data */
  1349. memmove(data + IEEE80211_QOS_CTL_LEN, data,
  1350. ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
  1351. hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
  1352. /* change frame type to non QOS */
  1353. hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
  1354. return RX_CONTINUE;
  1355. }
  1356. static int
  1357. ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
  1358. {
  1359. if (unlikely(!rx->sta ||
  1360. !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
  1361. return -EACCES;
  1362. return 0;
  1363. }
  1364. static int
  1365. ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
  1366. {
  1367. struct sk_buff *skb = rx->skb;
  1368. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  1369. /*
  1370. * Pass through unencrypted frames if the hardware has
  1371. * decrypted them already.
  1372. */
  1373. if (status->flag & RX_FLAG_DECRYPTED)
  1374. return 0;
  1375. /* Drop unencrypted frames if key is set. */
  1376. if (unlikely(!ieee80211_has_protected(fc) &&
  1377. !ieee80211_is_nullfunc(fc) &&
  1378. ieee80211_is_data(fc) &&
  1379. (rx->key || rx->sdata->drop_unencrypted)))
  1380. return -EACCES;
  1381. return 0;
  1382. }
  1383. static int
  1384. ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
  1385. {
  1386. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1387. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1388. __le16 fc = hdr->frame_control;
  1389. /*
  1390. * Pass through unencrypted frames if the hardware has
  1391. * decrypted them already.
  1392. */
  1393. if (status->flag & RX_FLAG_DECRYPTED)
  1394. return 0;
  1395. if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
  1396. if (unlikely(!ieee80211_has_protected(fc) &&
  1397. ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
  1398. rx->key)) {
  1399. if (ieee80211_is_deauth(fc))
  1400. cfg80211_send_unprot_deauth(rx->sdata->dev,
  1401. rx->skb->data,
  1402. rx->skb->len);
  1403. else if (ieee80211_is_disassoc(fc))
  1404. cfg80211_send_unprot_disassoc(rx->sdata->dev,
  1405. rx->skb->data,
  1406. rx->skb->len);
  1407. return -EACCES;
  1408. }
  1409. /* BIP does not use Protected field, so need to check MMIE */
  1410. if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
  1411. ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
  1412. if (ieee80211_is_deauth(fc))
  1413. cfg80211_send_unprot_deauth(rx->sdata->dev,
  1414. rx->skb->data,
  1415. rx->skb->len);
  1416. else if (ieee80211_is_disassoc(fc))
  1417. cfg80211_send_unprot_disassoc(rx->sdata->dev,
  1418. rx->skb->data,
  1419. rx->skb->len);
  1420. return -EACCES;
  1421. }
  1422. /*
  1423. * When using MFP, Action frames are not allowed prior to
  1424. * having configured keys.
  1425. */
  1426. if (unlikely(ieee80211_is_action(fc) && !rx->key &&
  1427. ieee80211_is_robust_mgmt_frame(
  1428. (struct ieee80211_hdr *) rx->skb->data)))
  1429. return -EACCES;
  1430. }
  1431. return 0;
  1432. }
  1433. static int
  1434. __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
  1435. {
  1436. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1437. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1438. bool check_port_control = false;
  1439. struct ethhdr *ehdr;
  1440. int ret;
  1441. *port_control = false;
  1442. if (ieee80211_has_a4(hdr->frame_control) &&
  1443. sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
  1444. return -1;
  1445. if (sdata->vif.type == NL80211_IFTYPE_STATION &&
  1446. !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
  1447. if (!sdata->u.mgd.use_4addr)
  1448. return -1;
  1449. else
  1450. check_port_control = true;
  1451. }
  1452. if (is_multicast_ether_addr(hdr->addr1) &&
  1453. sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
  1454. return -1;
  1455. ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
  1456. if (ret < 0)
  1457. return ret;
  1458. ehdr = (struct ethhdr *) rx->skb->data;
  1459. if (ehdr->h_proto == rx->sdata->control_port_protocol)
  1460. *port_control = true;
  1461. else if (check_port_control)
  1462. return -1;
  1463. return 0;
  1464. }
  1465. /*
  1466. * requires that rx->skb is a frame with ethernet header
  1467. */
  1468. static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
  1469. {
  1470. static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
  1471. = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
  1472. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1473. /*
  1474. * Allow EAPOL frames to us/the PAE group address regardless
  1475. * of whether the frame was encrypted or not.
  1476. */
  1477. if (ehdr->h_proto == rx->sdata->control_port_protocol &&
  1478. (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
  1479. compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
  1480. return true;
  1481. if (ieee80211_802_1x_port_control(rx) ||
  1482. ieee80211_drop_unencrypted(rx, fc))
  1483. return false;
  1484. return true;
  1485. }
  1486. /*
  1487. * requires that rx->skb is a frame with ethernet header
  1488. */
  1489. static void
  1490. ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
  1491. {
  1492. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1493. struct net_device *dev = sdata->dev;
  1494. struct sk_buff *skb, *xmit_skb;
  1495. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1496. struct sta_info *dsta;
  1497. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1498. skb = rx->skb;
  1499. xmit_skb = NULL;
  1500. if ((sdata->vif.type == NL80211_IFTYPE_AP ||
  1501. sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
  1502. !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
  1503. (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
  1504. (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
  1505. if (is_multicast_ether_addr(ehdr->h_dest)) {
  1506. /*
  1507. * send multicast frames both to higher layers in
  1508. * local net stack and back to the wireless medium
  1509. */
  1510. xmit_skb = skb_copy(skb, GFP_ATOMIC);
  1511. if (!xmit_skb && net_ratelimit())
  1512. printk(KERN_DEBUG "%s: failed to clone "
  1513. "multicast frame\n", dev->name);
  1514. } else {
  1515. dsta = sta_info_get(sdata, skb->data);
  1516. if (dsta) {
  1517. /*
  1518. * The destination station is associated to
  1519. * this AP (in this VLAN), so send the frame
  1520. * directly to it and do not pass it to local
  1521. * net stack.
  1522. */
  1523. xmit_skb = skb;
  1524. skb = NULL;
  1525. }
  1526. }
  1527. }
  1528. if (skb) {
  1529. int align __maybe_unused;
  1530. #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
  1531. /*
  1532. * 'align' will only take the values 0 or 2 here
  1533. * since all frames are required to be aligned
  1534. * to 2-byte boundaries when being passed to
  1535. * mac80211. That also explains the __skb_push()
  1536. * below.
  1537. */
  1538. align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
  1539. if (align) {
  1540. if (WARN_ON(skb_headroom(skb) < 3)) {
  1541. dev_kfree_skb(skb);
  1542. skb = NULL;
  1543. } else {
  1544. u8 *data = skb->data;
  1545. size_t len = skb_headlen(skb);
  1546. skb->data -= align;
  1547. memmove(skb->data, data, len);
  1548. skb_set_tail_pointer(skb, len);
  1549. }
  1550. }
  1551. #endif
  1552. if (skb) {
  1553. /* deliver to local stack */
  1554. skb->protocol = eth_type_trans(skb, dev);
  1555. memset(skb->cb, 0, sizeof(skb->cb));
  1556. netif_receive_skb(skb);
  1557. }
  1558. }
  1559. if (xmit_skb) {
  1560. /* send to wireless media */
  1561. xmit_skb->protocol = htons(ETH_P_802_3);
  1562. skb_reset_network_header(xmit_skb);
  1563. skb_reset_mac_header(xmit_skb);
  1564. dev_queue_xmit(xmit_skb);
  1565. }
  1566. }
  1567. static ieee80211_rx_result debug_noinline
  1568. ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
  1569. {
  1570. struct net_device *dev = rx->sdata->dev;
  1571. struct sk_buff *skb = rx->skb;
  1572. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  1573. __le16 fc = hdr->frame_control;
  1574. struct sk_buff_head frame_list;
  1575. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1576. if (unlikely(!ieee80211_is_data(fc)))
  1577. return RX_CONTINUE;
  1578. if (unlikely(!ieee80211_is_data_present(fc)))
  1579. return RX_DROP_MONITOR;
  1580. if (!(status->rx_flags & IEEE80211_RX_AMSDU))
  1581. return RX_CONTINUE;
  1582. if (ieee80211_has_a4(hdr->frame_control) &&
  1583. rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1584. !rx->sdata->u.vlan.sta)
  1585. return RX_DROP_UNUSABLE;
  1586. if (is_multicast_ether_addr(hdr->addr1) &&
  1587. ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1588. rx->sdata->u.vlan.sta) ||
  1589. (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
  1590. rx->sdata->u.mgd.use_4addr)))
  1591. return RX_DROP_UNUSABLE;
  1592. skb->dev = dev;
  1593. __skb_queue_head_init(&frame_list);
  1594. if (skb_linearize(skb))
  1595. return RX_DROP_UNUSABLE;
  1596. ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
  1597. rx->sdata->vif.type,
  1598. rx->local->hw.extra_tx_headroom, true);
  1599. while (!skb_queue_empty(&frame_list)) {
  1600. rx->skb = __skb_dequeue(&frame_list);
  1601. if (!ieee80211_frame_allowed(rx, fc)) {
  1602. dev_kfree_skb(rx->skb);
  1603. continue;
  1604. }
  1605. dev->stats.rx_packets++;
  1606. dev->stats.rx_bytes += rx->skb->len;
  1607. ieee80211_deliver_skb(rx);
  1608. }
  1609. return RX_QUEUED;
  1610. }
  1611. #ifdef CONFIG_MAC80211_MESH
  1612. static ieee80211_rx_result
  1613. ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
  1614. {
  1615. struct ieee80211_hdr *fwd_hdr, *hdr;
  1616. struct ieee80211_tx_info *info;
  1617. struct ieee80211s_hdr *mesh_hdr;
  1618. struct sk_buff *skb = rx->skb, *fwd_skb;
  1619. struct ieee80211_local *local = rx->local;
  1620. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1621. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  1622. struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
  1623. __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
  1624. u16 q, hdrlen;
  1625. hdr = (struct ieee80211_hdr *) skb->data;
  1626. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  1627. mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
  1628. /* frame is in RMC, don't forward */
  1629. if (ieee80211_is_data(hdr->frame_control) &&
  1630. is_multicast_ether_addr(hdr->addr1) &&
  1631. mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
  1632. return RX_DROP_MONITOR;
  1633. if (!ieee80211_is_data(hdr->frame_control))
  1634. return RX_CONTINUE;
  1635. if (!mesh_hdr->ttl)
  1636. return RX_DROP_MONITOR;
  1637. if (mesh_hdr->flags & MESH_FLAGS_AE) {
  1638. struct mesh_path *mppath;
  1639. char *proxied_addr;
  1640. char *mpp_addr;
  1641. if (is_multicast_ether_addr(hdr->addr1)) {
  1642. mpp_addr = hdr->addr3;
  1643. proxied_addr = mesh_hdr->eaddr1;
  1644. } else {
  1645. mpp_addr = hdr->addr4;
  1646. proxied_addr = mesh_hdr->eaddr2;
  1647. }
  1648. rcu_read_lock();
  1649. mppath = mpp_path_lookup(proxied_addr, sdata);
  1650. if (!mppath) {
  1651. mpp_path_add(proxied_addr, mpp_addr, sdata);
  1652. } else {
  1653. spin_lock_bh(&mppath->state_lock);
  1654. if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
  1655. memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
  1656. spin_unlock_bh(&mppath->state_lock);
  1657. }
  1658. rcu_read_unlock();
  1659. }
  1660. /* Frame has reached destination. Don't forward */
  1661. if (!is_multicast_ether_addr(hdr->addr1) &&
  1662. compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
  1663. return RX_CONTINUE;
  1664. q = ieee80211_select_queue_80211(local, skb, hdr);
  1665. if (ieee80211_queue_stopped(&local->hw, q)) {
  1666. IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
  1667. return RX_DROP_MONITOR;
  1668. }
  1669. skb_set_queue_mapping(skb, q);
  1670. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1671. goto out;
  1672. if (!--mesh_hdr->ttl) {
  1673. IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
  1674. return RX_DROP_MONITOR;
  1675. }
  1676. fwd_skb = skb_copy(skb, GFP_ATOMIC);
  1677. if (!fwd_skb) {
  1678. if (net_ratelimit())
  1679. printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
  1680. sdata->name);
  1681. goto out;
  1682. }
  1683. fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
  1684. info = IEEE80211_SKB_CB(fwd_skb);
  1685. memset(info, 0, sizeof(*info));
  1686. info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
  1687. info->control.vif = &rx->sdata->vif;
  1688. info->control.jiffies = jiffies;
  1689. if (is_multicast_ether_addr(fwd_hdr->addr1)) {
  1690. IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
  1691. memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
  1692. } else if (!mesh_nexthop_lookup(fwd_skb, sdata)) {
  1693. IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
  1694. } else {
  1695. /* unable to resolve next hop */
  1696. mesh_path_error_tx(ifmsh->mshcfg.element_ttl, fwd_hdr->addr3,
  1697. 0, reason, fwd_hdr->addr2, sdata);
  1698. IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
  1699. return RX_DROP_MONITOR;
  1700. }
  1701. IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
  1702. ieee80211_add_pending_skb(local, fwd_skb);
  1703. out:
  1704. if (is_multicast_ether_addr(hdr->addr1) ||
  1705. sdata->dev->flags & IFF_PROMISC)
  1706. return RX_CONTINUE;
  1707. else
  1708. return RX_DROP_MONITOR;
  1709. }
  1710. #endif
  1711. static ieee80211_rx_result debug_noinline
  1712. ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
  1713. {
  1714. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1715. struct ieee80211_local *local = rx->local;
  1716. struct net_device *dev = sdata->dev;
  1717. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1718. __le16 fc = hdr->frame_control;
  1719. bool port_control;
  1720. int err;
  1721. if (unlikely(!ieee80211_is_data(hdr->frame_control)))
  1722. return RX_CONTINUE;
  1723. if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
  1724. return RX_DROP_MONITOR;
  1725. /*
  1726. * Send unexpected-4addr-frame event to hostapd. For older versions,
  1727. * also drop the frame to cooked monitor interfaces.
  1728. */
  1729. if (ieee80211_has_a4(hdr->frame_control) &&
  1730. sdata->vif.type == NL80211_IFTYPE_AP) {
  1731. if (rx->sta &&
  1732. !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
  1733. cfg80211_rx_unexpected_4addr_frame(
  1734. rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
  1735. return RX_DROP_MONITOR;
  1736. }
  1737. err = __ieee80211_data_to_8023(rx, &port_control);
  1738. if (unlikely(err))
  1739. return RX_DROP_UNUSABLE;
  1740. if (!ieee80211_frame_allowed(rx, fc))
  1741. return RX_DROP_MONITOR;
  1742. if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
  1743. unlikely(port_control) && sdata->bss) {
  1744. sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
  1745. u.ap);
  1746. dev = sdata->dev;
  1747. rx->sdata = sdata;
  1748. }
  1749. rx->skb->dev = dev;
  1750. dev->stats.rx_packets++;
  1751. dev->stats.rx_bytes += rx->skb->len;
  1752. if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
  1753. !is_multicast_ether_addr(
  1754. ((struct ethhdr *)rx->skb->data)->h_dest) &&
  1755. (!local->scanning &&
  1756. !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
  1757. mod_timer(&local->dynamic_ps_timer, jiffies +
  1758. msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
  1759. }
  1760. ieee80211_deliver_skb(rx);
  1761. return RX_QUEUED;
  1762. }
  1763. static ieee80211_rx_result debug_noinline
  1764. ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
  1765. {
  1766. struct ieee80211_local *local = rx->local;
  1767. struct ieee80211_hw *hw = &local->hw;
  1768. struct sk_buff *skb = rx->skb;
  1769. struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
  1770. struct tid_ampdu_rx *tid_agg_rx;
  1771. u16 start_seq_num;
  1772. u16 tid;
  1773. if (likely(!ieee80211_is_ctl(bar->frame_control)))
  1774. return RX_CONTINUE;
  1775. if (ieee80211_is_back_req(bar->frame_control)) {
  1776. struct {
  1777. __le16 control, start_seq_num;
  1778. } __packed bar_data;
  1779. if (!rx->sta)
  1780. return RX_DROP_MONITOR;
  1781. if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
  1782. &bar_data, sizeof(bar_data)))
  1783. return RX_DROP_MONITOR;
  1784. tid = le16_to_cpu(bar_data.control) >> 12;
  1785. tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
  1786. if (!tid_agg_rx)
  1787. return RX_DROP_MONITOR;
  1788. start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
  1789. /* reset session timer */
  1790. if (tid_agg_rx->timeout)
  1791. mod_timer(&tid_agg_rx->session_timer,
  1792. TU_TO_EXP_TIME(tid_agg_rx->timeout));
  1793. spin_lock(&tid_agg_rx->reorder_lock);
  1794. /* release stored frames up to start of BAR */
  1795. ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
  1796. spin_unlock(&tid_agg_rx->reorder_lock);
  1797. kfree_skb(skb);
  1798. return RX_QUEUED;
  1799. }
  1800. /*
  1801. * After this point, we only want management frames,
  1802. * so we can drop all remaining control frames to
  1803. * cooked monitor interfaces.
  1804. */
  1805. return RX_DROP_MONITOR;
  1806. }
  1807. static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
  1808. struct ieee80211_mgmt *mgmt,
  1809. size_t len)
  1810. {
  1811. struct ieee80211_local *local = sdata->local;
  1812. struct sk_buff *skb;
  1813. struct ieee80211_mgmt *resp;
  1814. if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
  1815. /* Not to own unicast address */
  1816. return;
  1817. }
  1818. if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
  1819. compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
  1820. /* Not from the current AP or not associated yet. */
  1821. return;
  1822. }
  1823. if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
  1824. /* Too short SA Query request frame */
  1825. return;
  1826. }
  1827. skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
  1828. if (skb == NULL)
  1829. return;
  1830. skb_reserve(skb, local->hw.extra_tx_headroom);
  1831. resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
  1832. memset(resp, 0, 24);
  1833. memcpy(resp->da, mgmt->sa, ETH_ALEN);
  1834. memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
  1835. memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  1836. resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  1837. IEEE80211_STYPE_ACTION);
  1838. skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
  1839. resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
  1840. resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
  1841. memcpy(resp->u.action.u.sa_query.trans_id,
  1842. mgmt->u.action.u.sa_query.trans_id,
  1843. WLAN_SA_QUERY_TR_ID_LEN);
  1844. ieee80211_tx_skb(sdata, skb);
  1845. }
  1846. static ieee80211_rx_result debug_noinline
  1847. ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
  1848. {
  1849. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  1850. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1851. /*
  1852. * From here on, look only at management frames.
  1853. * Data and control frames are already handled,
  1854. * and unknown (reserved) frames are useless.
  1855. */
  1856. if (rx->skb->len < 24)
  1857. return RX_DROP_MONITOR;
  1858. if (!ieee80211_is_mgmt(mgmt->frame_control))
  1859. return RX_DROP_MONITOR;
  1860. if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
  1861. ieee80211_is_beacon(mgmt->frame_control) &&
  1862. !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
  1863. struct ieee80211_rx_status *status;
  1864. status = IEEE80211_SKB_RXCB(rx->skb);
  1865. cfg80211_report_obss_beacon(rx->local->hw.wiphy,
  1866. rx->skb->data, rx->skb->len,
  1867. status->freq, GFP_ATOMIC);
  1868. rx->flags |= IEEE80211_RX_BEACON_REPORTED;
  1869. }
  1870. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1871. return RX_DROP_MONITOR;
  1872. if (ieee80211_drop_unencrypted_mgmt(rx))
  1873. return RX_DROP_UNUSABLE;
  1874. return RX_CONTINUE;
  1875. }
  1876. static ieee80211_rx_result debug_noinline
  1877. ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
  1878. {
  1879. struct ieee80211_local *local = rx->local;
  1880. struct ieee80211_sub_if_data *sdata = rx->sdata;
  1881. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  1882. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  1883. int len = rx->skb->len;
  1884. if (!ieee80211_is_action(mgmt->frame_control))
  1885. return RX_CONTINUE;
  1886. /* drop too small frames */
  1887. if (len < IEEE80211_MIN_ACTION_SIZE)
  1888. return RX_DROP_UNUSABLE;
  1889. if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
  1890. return RX_DROP_UNUSABLE;
  1891. if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
  1892. return RX_DROP_UNUSABLE;
  1893. switch (mgmt->u.action.category) {
  1894. case WLAN_CATEGORY_BACK:
  1895. if (sdata->vif.type != NL80211_IFTYPE_STATION &&
  1896. sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
  1897. sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  1898. sdata->vif.type != NL80211_IFTYPE_AP)
  1899. break;
  1900. /* verify action_code is present */
  1901. if (len < IEEE80211_MIN_ACTION_SIZE + 1)
  1902. break;
  1903. switch (mgmt->u.action.u.addba_req.action_code) {
  1904. case WLAN_ACTION_ADDBA_REQ:
  1905. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1906. sizeof(mgmt->u.action.u.addba_req)))
  1907. goto invalid;
  1908. break;
  1909. case WLAN_ACTION_ADDBA_RESP:
  1910. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1911. sizeof(mgmt->u.action.u.addba_resp)))
  1912. goto invalid;
  1913. break;
  1914. case WLAN_ACTION_DELBA:
  1915. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1916. sizeof(mgmt->u.action.u.delba)))
  1917. goto invalid;
  1918. break;
  1919. default:
  1920. goto invalid;
  1921. }
  1922. goto queue;
  1923. case WLAN_CATEGORY_SPECTRUM_MGMT:
  1924. if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
  1925. break;
  1926. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1927. break;
  1928. /* verify action_code is present */
  1929. if (len < IEEE80211_MIN_ACTION_SIZE + 1)
  1930. break;
  1931. switch (mgmt->u.action.u.measurement.action_code) {
  1932. case WLAN_ACTION_SPCT_MSR_REQ:
  1933. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1934. sizeof(mgmt->u.action.u.measurement)))
  1935. break;
  1936. ieee80211_process_measurement_req(sdata, mgmt, len);
  1937. goto handled;
  1938. case WLAN_ACTION_SPCT_CHL_SWITCH:
  1939. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1940. sizeof(mgmt->u.action.u.chan_switch)))
  1941. break;
  1942. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1943. break;
  1944. if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
  1945. break;
  1946. goto queue;
  1947. }
  1948. break;
  1949. case WLAN_CATEGORY_SA_QUERY:
  1950. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1951. sizeof(mgmt->u.action.u.sa_query)))
  1952. break;
  1953. switch (mgmt->u.action.u.sa_query.action) {
  1954. case WLAN_ACTION_SA_QUERY_REQUEST:
  1955. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1956. break;
  1957. ieee80211_process_sa_query_req(sdata, mgmt, len);
  1958. goto handled;
  1959. }
  1960. break;
  1961. case WLAN_CATEGORY_SELF_PROTECTED:
  1962. switch (mgmt->u.action.u.self_prot.action_code) {
  1963. case WLAN_SP_MESH_PEERING_OPEN:
  1964. case WLAN_SP_MESH_PEERING_CLOSE:
  1965. case WLAN_SP_MESH_PEERING_CONFIRM:
  1966. if (!ieee80211_vif_is_mesh(&sdata->vif))
  1967. goto invalid;
  1968. if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
  1969. /* userspace handles this frame */
  1970. break;
  1971. goto queue;
  1972. case WLAN_SP_MGK_INFORM:
  1973. case WLAN_SP_MGK_ACK:
  1974. if (!ieee80211_vif_is_mesh(&sdata->vif))
  1975. goto invalid;
  1976. break;
  1977. }
  1978. break;
  1979. case WLAN_CATEGORY_MESH_ACTION:
  1980. if (!ieee80211_vif_is_mesh(&sdata->vif))
  1981. break;
  1982. if (mesh_action_is_path_sel(mgmt) &&
  1983. (!mesh_path_sel_is_hwmp(sdata)))
  1984. break;
  1985. goto queue;
  1986. }
  1987. return RX_CONTINUE;
  1988. invalid:
  1989. status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
  1990. /* will return in the next handlers */
  1991. return RX_CONTINUE;
  1992. handled:
  1993. if (rx->sta)
  1994. rx->sta->rx_packets++;
  1995. dev_kfree_skb(rx->skb);
  1996. return RX_QUEUED;
  1997. queue:
  1998. rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
  1999. skb_queue_tail(&sdata->skb_queue, rx->skb);
  2000. ieee80211_queue_work(&local->hw, &sdata->work);
  2001. if (rx->sta)
  2002. rx->sta->rx_packets++;
  2003. return RX_QUEUED;
  2004. }
  2005. static ieee80211_rx_result debug_noinline
  2006. ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
  2007. {
  2008. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  2009. /* skip known-bad action frames and return them in the next handler */
  2010. if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
  2011. return RX_CONTINUE;
  2012. /*
  2013. * Getting here means the kernel doesn't know how to handle
  2014. * it, but maybe userspace does ... include returned frames
  2015. * so userspace can register for those to know whether ones
  2016. * it transmitted were processed or returned.
  2017. */
  2018. if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
  2019. rx->skb->data, rx->skb->len,
  2020. GFP_ATOMIC)) {
  2021. if (rx->sta)
  2022. rx->sta->rx_packets++;
  2023. dev_kfree_skb(rx->skb);
  2024. return RX_QUEUED;
  2025. }
  2026. return RX_CONTINUE;
  2027. }
  2028. static ieee80211_rx_result debug_noinline
  2029. ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
  2030. {
  2031. struct ieee80211_local *local = rx->local;
  2032. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  2033. struct sk_buff *nskb;
  2034. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2035. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
  2036. if (!ieee80211_is_action(mgmt->frame_control))
  2037. return RX_CONTINUE;
  2038. /*
  2039. * For AP mode, hostapd is responsible for handling any action
  2040. * frames that we didn't handle, including returning unknown
  2041. * ones. For all other modes we will return them to the sender,
  2042. * setting the 0x80 bit in the action category, as required by
  2043. * 802.11-2007 7.3.1.11.
  2044. * Newer versions of hostapd shall also use the management frame
  2045. * registration mechanisms, but older ones still use cooked
  2046. * monitor interfaces so push all frames there.
  2047. */
  2048. if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
  2049. (sdata->vif.type == NL80211_IFTYPE_AP ||
  2050. sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
  2051. return RX_DROP_MONITOR;
  2052. /* do not return rejected action frames */
  2053. if (mgmt->u.action.category & 0x80)
  2054. return RX_DROP_UNUSABLE;
  2055. nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
  2056. GFP_ATOMIC);
  2057. if (nskb) {
  2058. struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
  2059. nmgmt->u.action.category |= 0x80;
  2060. memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
  2061. memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
  2062. memset(nskb->cb, 0, sizeof(nskb->cb));
  2063. ieee80211_tx_skb(rx->sdata, nskb);
  2064. }
  2065. dev_kfree_skb(rx->skb);
  2066. return RX_QUEUED;
  2067. }
  2068. static ieee80211_rx_result debug_noinline
  2069. ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
  2070. {
  2071. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2072. ieee80211_rx_result rxs;
  2073. struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
  2074. __le16 stype;
  2075. rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
  2076. if (rxs != RX_CONTINUE)
  2077. return rxs;
  2078. stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
  2079. if (!ieee80211_vif_is_mesh(&sdata->vif) &&
  2080. sdata->vif.type != NL80211_IFTYPE_ADHOC &&
  2081. sdata->vif.type != NL80211_IFTYPE_STATION)
  2082. return RX_DROP_MONITOR;
  2083. switch (stype) {
  2084. case cpu_to_le16(IEEE80211_STYPE_BEACON):
  2085. case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
  2086. /* process for all: mesh, mlme, ibss */
  2087. break;
  2088. case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
  2089. case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
  2090. if (is_multicast_ether_addr(mgmt->da) &&
  2091. !is_broadcast_ether_addr(mgmt->da))
  2092. return RX_DROP_MONITOR;
  2093. /* process only for station */
  2094. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  2095. return RX_DROP_MONITOR;
  2096. break;
  2097. case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
  2098. case cpu_to_le16(IEEE80211_STYPE_AUTH):
  2099. /* process only for ibss */
  2100. if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
  2101. return RX_DROP_MONITOR;
  2102. break;
  2103. default:
  2104. return RX_DROP_MONITOR;
  2105. }
  2106. /* queue up frame and kick off work to process it */
  2107. rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
  2108. skb_queue_tail(&sdata->skb_queue, rx->skb);
  2109. ieee80211_queue_work(&rx->local->hw, &sdata->work);
  2110. if (rx->sta)
  2111. rx->sta->rx_packets++;
  2112. return RX_QUEUED;
  2113. }
  2114. /* TODO: use IEEE80211_RX_FRAGMENTED */
  2115. static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
  2116. struct ieee80211_rate *rate)
  2117. {
  2118. struct ieee80211_sub_if_data *sdata;
  2119. struct ieee80211_local *local = rx->local;
  2120. struct ieee80211_rtap_hdr {
  2121. struct ieee80211_radiotap_header hdr;
  2122. u8 flags;
  2123. u8 rate_or_pad;
  2124. __le16 chan_freq;
  2125. __le16 chan_flags;
  2126. } __packed *rthdr;
  2127. struct sk_buff *skb = rx->skb, *skb2;
  2128. struct net_device *prev_dev = NULL;
  2129. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2130. /*
  2131. * If cooked monitor has been processed already, then
  2132. * don't do it again. If not, set the flag.
  2133. */
  2134. if (rx->flags & IEEE80211_RX_CMNTR)
  2135. goto out_free_skb;
  2136. rx->flags |= IEEE80211_RX_CMNTR;
  2137. /* If there are no cooked monitor interfaces, just free the SKB */
  2138. if (!local->cooked_mntrs)
  2139. goto out_free_skb;
  2140. if (skb_headroom(skb) < sizeof(*rthdr) &&
  2141. pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
  2142. goto out_free_skb;
  2143. rthdr = (void *)skb_push(skb, sizeof(*rthdr));
  2144. memset(rthdr, 0, sizeof(*rthdr));
  2145. rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
  2146. rthdr->hdr.it_present =
  2147. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  2148. (1 << IEEE80211_RADIOTAP_CHANNEL));
  2149. if (rate) {
  2150. rthdr->rate_or_pad = rate->bitrate / 5;
  2151. rthdr->hdr.it_present |=
  2152. cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
  2153. }
  2154. rthdr->chan_freq = cpu_to_le16(status->freq);
  2155. if (status->band == IEEE80211_BAND_5GHZ)
  2156. rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
  2157. IEEE80211_CHAN_5GHZ);
  2158. else
  2159. rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
  2160. IEEE80211_CHAN_2GHZ);
  2161. skb_set_mac_header(skb, 0);
  2162. skb->ip_summed = CHECKSUM_UNNECESSARY;
  2163. skb->pkt_type = PACKET_OTHERHOST;
  2164. skb->protocol = htons(ETH_P_802_2);
  2165. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  2166. if (!ieee80211_sdata_running(sdata))
  2167. continue;
  2168. if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
  2169. !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
  2170. continue;
  2171. if (prev_dev) {
  2172. skb2 = skb_clone(skb, GFP_ATOMIC);
  2173. if (skb2) {
  2174. skb2->dev = prev_dev;
  2175. netif_receive_skb(skb2);
  2176. }
  2177. }
  2178. prev_dev = sdata->dev;
  2179. sdata->dev->stats.rx_packets++;
  2180. sdata->dev->stats.rx_bytes += skb->len;
  2181. }
  2182. if (prev_dev) {
  2183. skb->dev = prev_dev;
  2184. netif_receive_skb(skb);
  2185. return;
  2186. }
  2187. out_free_skb:
  2188. dev_kfree_skb(skb);
  2189. }
  2190. static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
  2191. ieee80211_rx_result res)
  2192. {
  2193. switch (res) {
  2194. case RX_DROP_MONITOR:
  2195. I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
  2196. if (rx->sta)
  2197. rx->sta->rx_dropped++;
  2198. /* fall through */
  2199. case RX_CONTINUE: {
  2200. struct ieee80211_rate *rate = NULL;
  2201. struct ieee80211_supported_band *sband;
  2202. struct ieee80211_rx_status *status;
  2203. status = IEEE80211_SKB_RXCB((rx->skb));
  2204. sband = rx->local->hw.wiphy->bands[status->band];
  2205. if (!(status->flag & RX_FLAG_HT))
  2206. rate = &sband->bitrates[status->rate_idx];
  2207. ieee80211_rx_cooked_monitor(rx, rate);
  2208. break;
  2209. }
  2210. case RX_DROP_UNUSABLE:
  2211. I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
  2212. if (rx->sta)
  2213. rx->sta->rx_dropped++;
  2214. dev_kfree_skb(rx->skb);
  2215. break;
  2216. case RX_QUEUED:
  2217. I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
  2218. break;
  2219. }
  2220. }
  2221. static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
  2222. {
  2223. ieee80211_rx_result res = RX_DROP_MONITOR;
  2224. struct sk_buff *skb;
  2225. #define CALL_RXH(rxh) \
  2226. do { \
  2227. res = rxh(rx); \
  2228. if (res != RX_CONTINUE) \
  2229. goto rxh_next; \
  2230. } while (0);
  2231. spin_lock(&rx->local->rx_skb_queue.lock);
  2232. if (rx->local->running_rx_handler)
  2233. goto unlock;
  2234. rx->local->running_rx_handler = true;
  2235. while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
  2236. spin_unlock(&rx->local->rx_skb_queue.lock);
  2237. /*
  2238. * all the other fields are valid across frames
  2239. * that belong to an aMPDU since they are on the
  2240. * same TID from the same station
  2241. */
  2242. rx->skb = skb;
  2243. CALL_RXH(ieee80211_rx_h_decrypt)
  2244. CALL_RXH(ieee80211_rx_h_check_more_data)
  2245. CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
  2246. CALL_RXH(ieee80211_rx_h_sta_process)
  2247. CALL_RXH(ieee80211_rx_h_defragment)
  2248. CALL_RXH(ieee80211_rx_h_michael_mic_verify)
  2249. /* must be after MMIC verify so header is counted in MPDU mic */
  2250. #ifdef CONFIG_MAC80211_MESH
  2251. if (ieee80211_vif_is_mesh(&rx->sdata->vif))
  2252. CALL_RXH(ieee80211_rx_h_mesh_fwding);
  2253. #endif
  2254. CALL_RXH(ieee80211_rx_h_remove_qos_control)
  2255. CALL_RXH(ieee80211_rx_h_amsdu)
  2256. CALL_RXH(ieee80211_rx_h_data)
  2257. CALL_RXH(ieee80211_rx_h_ctrl);
  2258. CALL_RXH(ieee80211_rx_h_mgmt_check)
  2259. CALL_RXH(ieee80211_rx_h_action)
  2260. CALL_RXH(ieee80211_rx_h_userspace_mgmt)
  2261. CALL_RXH(ieee80211_rx_h_action_return)
  2262. CALL_RXH(ieee80211_rx_h_mgmt)
  2263. rxh_next:
  2264. ieee80211_rx_handlers_result(rx, res);
  2265. spin_lock(&rx->local->rx_skb_queue.lock);
  2266. #undef CALL_RXH
  2267. }
  2268. rx->local->running_rx_handler = false;
  2269. unlock:
  2270. spin_unlock(&rx->local->rx_skb_queue.lock);
  2271. }
  2272. static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
  2273. {
  2274. ieee80211_rx_result res = RX_DROP_MONITOR;
  2275. #define CALL_RXH(rxh) \
  2276. do { \
  2277. res = rxh(rx); \
  2278. if (res != RX_CONTINUE) \
  2279. goto rxh_next; \
  2280. } while (0);
  2281. CALL_RXH(ieee80211_rx_h_passive_scan)
  2282. CALL_RXH(ieee80211_rx_h_check)
  2283. ieee80211_rx_reorder_ampdu(rx);
  2284. ieee80211_rx_handlers(rx);
  2285. return;
  2286. rxh_next:
  2287. ieee80211_rx_handlers_result(rx, res);
  2288. #undef CALL_RXH
  2289. }
  2290. /*
  2291. * This function makes calls into the RX path, therefore
  2292. * it has to be invoked under RCU read lock.
  2293. */
  2294. void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
  2295. {
  2296. struct ieee80211_rx_data rx = {
  2297. .sta = sta,
  2298. .sdata = sta->sdata,
  2299. .local = sta->local,
  2300. /* This is OK -- must be QoS data frame */
  2301. .security_idx = tid,
  2302. .seqno_idx = tid,
  2303. .flags = 0,
  2304. };
  2305. struct tid_ampdu_rx *tid_agg_rx;
  2306. tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
  2307. if (!tid_agg_rx)
  2308. return;
  2309. spin_lock(&tid_agg_rx->reorder_lock);
  2310. ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
  2311. spin_unlock(&tid_agg_rx->reorder_lock);
  2312. ieee80211_rx_handlers(&rx);
  2313. }
  2314. /* main receive path */
  2315. static int prepare_for_handlers(struct ieee80211_rx_data *rx,
  2316. struct ieee80211_hdr *hdr)
  2317. {
  2318. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2319. struct sk_buff *skb = rx->skb;
  2320. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2321. u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
  2322. int multicast = is_multicast_ether_addr(hdr->addr1);
  2323. switch (sdata->vif.type) {
  2324. case NL80211_IFTYPE_STATION:
  2325. if (!bssid && !sdata->u.mgd.use_4addr)
  2326. return 0;
  2327. if (!multicast &&
  2328. compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
  2329. if (!(sdata->dev->flags & IFF_PROMISC) ||
  2330. sdata->u.mgd.use_4addr)
  2331. return 0;
  2332. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2333. }
  2334. break;
  2335. case NL80211_IFTYPE_ADHOC:
  2336. if (!bssid)
  2337. return 0;
  2338. if (ieee80211_is_beacon(hdr->frame_control)) {
  2339. return 1;
  2340. }
  2341. else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
  2342. if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
  2343. return 0;
  2344. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2345. } else if (!multicast &&
  2346. compare_ether_addr(sdata->vif.addr,
  2347. hdr->addr1) != 0) {
  2348. if (!(sdata->dev->flags & IFF_PROMISC))
  2349. return 0;
  2350. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2351. } else if (!rx->sta) {
  2352. int rate_idx;
  2353. if (status->flag & RX_FLAG_HT)
  2354. rate_idx = 0; /* TODO: HT rates */
  2355. else
  2356. rate_idx = status->rate_idx;
  2357. rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
  2358. hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
  2359. }
  2360. break;
  2361. case NL80211_IFTYPE_MESH_POINT:
  2362. if (!multicast &&
  2363. compare_ether_addr(sdata->vif.addr,
  2364. hdr->addr1) != 0) {
  2365. if (!(sdata->dev->flags & IFF_PROMISC))
  2366. return 0;
  2367. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2368. }
  2369. break;
  2370. case NL80211_IFTYPE_AP_VLAN:
  2371. case NL80211_IFTYPE_AP:
  2372. if (!bssid) {
  2373. if (compare_ether_addr(sdata->vif.addr,
  2374. hdr->addr1))
  2375. return 0;
  2376. } else if (!ieee80211_bssid_match(bssid,
  2377. sdata->vif.addr)) {
  2378. if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
  2379. !ieee80211_is_beacon(hdr->frame_control) &&
  2380. !(ieee80211_is_action(hdr->frame_control) &&
  2381. sdata->vif.p2p))
  2382. return 0;
  2383. status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
  2384. }
  2385. break;
  2386. case NL80211_IFTYPE_WDS:
  2387. if (bssid || !ieee80211_is_data(hdr->frame_control))
  2388. return 0;
  2389. if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
  2390. return 0;
  2391. break;
  2392. default:
  2393. /* should never get here */
  2394. WARN_ON(1);
  2395. break;
  2396. }
  2397. return 1;
  2398. }
  2399. /*
  2400. * This function returns whether or not the SKB
  2401. * was destined for RX processing or not, which,
  2402. * if consume is true, is equivalent to whether
  2403. * or not the skb was consumed.
  2404. */
  2405. static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
  2406. struct sk_buff *skb, bool consume)
  2407. {
  2408. struct ieee80211_local *local = rx->local;
  2409. struct ieee80211_sub_if_data *sdata = rx->sdata;
  2410. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2411. struct ieee80211_hdr *hdr = (void *)skb->data;
  2412. int prepares;
  2413. rx->skb = skb;
  2414. status->rx_flags |= IEEE80211_RX_RA_MATCH;
  2415. prepares = prepare_for_handlers(rx, hdr);
  2416. if (!prepares)
  2417. return false;
  2418. if (!consume) {
  2419. skb = skb_copy(skb, GFP_ATOMIC);
  2420. if (!skb) {
  2421. if (net_ratelimit())
  2422. wiphy_debug(local->hw.wiphy,
  2423. "failed to copy skb for %s\n",
  2424. sdata->name);
  2425. return true;
  2426. }
  2427. rx->skb = skb;
  2428. }
  2429. ieee80211_invoke_rx_handlers(rx);
  2430. return true;
  2431. }
  2432. /*
  2433. * This is the actual Rx frames handler. as it blongs to Rx path it must
  2434. * be called with rcu_read_lock protection.
  2435. */
  2436. static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
  2437. struct sk_buff *skb)
  2438. {
  2439. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2440. struct ieee80211_local *local = hw_to_local(hw);
  2441. struct ieee80211_sub_if_data *sdata;
  2442. struct ieee80211_hdr *hdr;
  2443. __le16 fc;
  2444. struct ieee80211_rx_data rx;
  2445. struct ieee80211_sub_if_data *prev;
  2446. struct sta_info *sta, *tmp, *prev_sta;
  2447. int err = 0;
  2448. fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
  2449. memset(&rx, 0, sizeof(rx));
  2450. rx.skb = skb;
  2451. rx.local = local;
  2452. if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
  2453. local->dot11ReceivedFragmentCount++;
  2454. if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
  2455. test_bit(SCAN_SW_SCANNING, &local->scanning)))
  2456. status->rx_flags |= IEEE80211_RX_IN_SCAN;
  2457. if (ieee80211_is_mgmt(fc))
  2458. err = skb_linearize(skb);
  2459. else
  2460. err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
  2461. if (err) {
  2462. dev_kfree_skb(skb);
  2463. return;
  2464. }
  2465. hdr = (struct ieee80211_hdr *)skb->data;
  2466. ieee80211_parse_qos(&rx);
  2467. ieee80211_verify_alignment(&rx);
  2468. if (ieee80211_is_data(fc)) {
  2469. prev_sta = NULL;
  2470. for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
  2471. if (!prev_sta) {
  2472. prev_sta = sta;
  2473. continue;
  2474. }
  2475. rx.sta = prev_sta;
  2476. rx.sdata = prev_sta->sdata;
  2477. ieee80211_prepare_and_rx_handle(&rx, skb, false);
  2478. prev_sta = sta;
  2479. }
  2480. if (prev_sta) {
  2481. rx.sta = prev_sta;
  2482. rx.sdata = prev_sta->sdata;
  2483. if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
  2484. return;
  2485. goto out;
  2486. }
  2487. }
  2488. prev = NULL;
  2489. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  2490. if (!ieee80211_sdata_running(sdata))
  2491. continue;
  2492. if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
  2493. sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
  2494. continue;
  2495. /*
  2496. * frame is destined for this interface, but if it's
  2497. * not also for the previous one we handle that after
  2498. * the loop to avoid copying the SKB once too much
  2499. */
  2500. if (!prev) {
  2501. prev = sdata;
  2502. continue;
  2503. }
  2504. rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
  2505. rx.sdata = prev;
  2506. ieee80211_prepare_and_rx_handle(&rx, skb, false);
  2507. prev = sdata;
  2508. }
  2509. if (prev) {
  2510. rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
  2511. rx.sdata = prev;
  2512. if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
  2513. return;
  2514. }
  2515. out:
  2516. dev_kfree_skb(skb);
  2517. }
  2518. /*
  2519. * This is the receive path handler. It is called by a low level driver when an
  2520. * 802.11 MPDU is received from the hardware.
  2521. */
  2522. void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
  2523. {
  2524. struct ieee80211_local *local = hw_to_local(hw);
  2525. struct ieee80211_rate *rate = NULL;
  2526. struct ieee80211_supported_band *sband;
  2527. struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  2528. WARN_ON_ONCE(softirq_count() == 0);
  2529. if (WARN_ON(status->band < 0 ||
  2530. status->band >= IEEE80211_NUM_BANDS))
  2531. goto drop;
  2532. sband = local->hw.wiphy->bands[status->band];
  2533. if (WARN_ON(!sband))
  2534. goto drop;
  2535. /*
  2536. * If we're suspending, it is possible although not too likely
  2537. * that we'd be receiving frames after having already partially
  2538. * quiesced the stack. We can't process such frames then since
  2539. * that might, for example, cause stations to be added or other
  2540. * driver callbacks be invoked.
  2541. */
  2542. if (unlikely(local->quiescing || local->suspended))
  2543. goto drop;
  2544. /*
  2545. * The same happens when we're not even started,
  2546. * but that's worth a warning.
  2547. */
  2548. if (WARN_ON(!local->started))
  2549. goto drop;
  2550. if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
  2551. /*
  2552. * Validate the rate, unless a PLCP error means that
  2553. * we probably can't have a valid rate here anyway.
  2554. */
  2555. if (status->flag & RX_FLAG_HT) {
  2556. /*
  2557. * rate_idx is MCS index, which can be [0-76]
  2558. * as documented on:
  2559. *
  2560. * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
  2561. *
  2562. * Anything else would be some sort of driver or
  2563. * hardware error. The driver should catch hardware
  2564. * errors.
  2565. */
  2566. if (WARN((status->rate_idx < 0 ||
  2567. status->rate_idx > 76),
  2568. "Rate marked as an HT rate but passed "
  2569. "status->rate_idx is not "
  2570. "an MCS index [0-76]: %d (0x%02x)\n",
  2571. status->rate_idx,
  2572. status->rate_idx))
  2573. goto drop;
  2574. } else {
  2575. if (WARN_ON(status->rate_idx < 0 ||
  2576. status->rate_idx >= sband->n_bitrates))
  2577. goto drop;
  2578. rate = &sband->bitrates[status->rate_idx];
  2579. }
  2580. }
  2581. status->rx_flags = 0;
  2582. /*
  2583. * key references and virtual interfaces are protected using RCU
  2584. * and this requires that we are in a read-side RCU section during
  2585. * receive processing
  2586. */
  2587. rcu_read_lock();
  2588. /*
  2589. * Frames with failed FCS/PLCP checksum are not returned,
  2590. * all other frames are returned without radiotap header
  2591. * if it was previously present.
  2592. * Also, frames with less than 16 bytes are dropped.
  2593. */
  2594. skb = ieee80211_rx_monitor(local, skb, rate);
  2595. if (!skb) {
  2596. rcu_read_unlock();
  2597. return;
  2598. }
  2599. ieee80211_tpt_led_trig_rx(local,
  2600. ((struct ieee80211_hdr *)skb->data)->frame_control,
  2601. skb->len);
  2602. __ieee80211_rx_handle_packet(hw, skb);
  2603. rcu_read_unlock();
  2604. return;
  2605. drop:
  2606. kfree_skb(skb);
  2607. }
  2608. EXPORT_SYMBOL(ieee80211_rx);
  2609. /* This is a version of the rx handler that can be called from hard irq
  2610. * context. Post the skb on the queue and schedule the tasklet */
  2611. void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
  2612. {
  2613. struct ieee80211_local *local = hw_to_local(hw);
  2614. BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
  2615. skb->pkt_type = IEEE80211_RX_MSG;
  2616. skb_queue_tail(&local->skb_queue, skb);
  2617. tasklet_schedule(&local->tasklet);
  2618. }
  2619. EXPORT_SYMBOL(ieee80211_rx_irqsafe);