1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #include <linux/jiffies.h> 13 #include <linux/slab.h> 14 #include <linux/kernel.h> 15 #include <linux/skbuff.h> 16 #include <linux/netdevice.h> 17 #include <linux/etherdevice.h> 18 #include <linux/rcupdate.h> 19 #include <linux/export.h> 20 #include <net/mac80211.h> 21 #include <net/ieee80211_radiotap.h> 22 #include <asm/unaligned.h> 23 24 #include "ieee80211_i.h" 25 #include "driver-ops.h" 26 #include "led.h" 27 #include "mesh.h" 28 #include "wep.h" 29 #include "wpa.h" 30 #include "tkip.h" 31 #include "wme.h" 32 #include "rate.h" 33 34 /* 35 * monitor mode reception 36 * 37 * This function cleans up the SKB, i.e. it removes all the stuff 38 * only useful for monitoring. 39 */ 40 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local, 41 struct sk_buff *skb) 42 { 43 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) { 44 if (likely(skb->len > FCS_LEN)) 45 __pskb_trim(skb, skb->len - FCS_LEN); 46 else { 47 /* driver bug */ 48 WARN_ON(1); 49 dev_kfree_skb(skb); 50 return NULL; 51 } 52 } 53 54 return skb; 55 } 56 57 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len) 58 { 59 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 60 struct ieee80211_hdr *hdr = (void *)skb->data; 61 62 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 63 RX_FLAG_FAILED_PLCP_CRC | 64 RX_FLAG_AMPDU_IS_ZEROLEN)) 65 return true; 66 67 if (unlikely(skb->len < 16 + present_fcs_len)) 68 return true; 69 70 if (ieee80211_is_ctl(hdr->frame_control) && 71 !ieee80211_is_pspoll(hdr->frame_control) && 72 !ieee80211_is_back_req(hdr->frame_control)) 73 return true; 74 75 return false; 76 } 77 78 static int 79 ieee80211_rx_radiotap_space(struct ieee80211_local *local, 80 struct ieee80211_rx_status *status) 81 { 82 int len; 83 84 /* always present fields */ 85 len = sizeof(struct ieee80211_radiotap_header) + 8; 86 87 /* allocate extra bitmaps */ 88 if (status->chains) 89 len += 4 * hweight8(status->chains); 90 91 if (ieee80211_have_rx_timestamp(status)) { 92 len = ALIGN(len, 8); 93 len += 8; 94 } 95 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 96 len += 1; 97 98 /* antenna field, if we don't have per-chain info */ 99 if (!status->chains) 100 len += 1; 101 102 /* padding for RX_FLAGS if necessary */ 103 len = ALIGN(len, 2); 104 105 if (status->flag & RX_FLAG_HT) /* HT info */ 106 len += 3; 107 108 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 109 len = ALIGN(len, 4); 110 len += 8; 111 } 112 113 if (status->flag & RX_FLAG_VHT) { 114 len = ALIGN(len, 2); 115 len += 12; 116 } 117 118 if (status->chains) { 119 /* antenna and antenna signal fields */ 120 len += 2 * hweight8(status->chains); 121 } 122 123 return len; 124 } 125 126 /* 127 * ieee80211_add_rx_radiotap_header - add radiotap header 128 * 129 * add a radiotap header containing all the fields which the hardware provided. 130 */ 131 static void 132 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 133 struct sk_buff *skb, 134 struct ieee80211_rate *rate, 135 int rtap_len, bool has_fcs) 136 { 137 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 138 struct ieee80211_radiotap_header *rthdr; 139 unsigned char *pos; 140 __le32 *it_present; 141 u32 it_present_val; 142 u16 rx_flags = 0; 143 u16 channel_flags = 0; 144 int mpdulen, chain; 145 unsigned long chains = status->chains; 146 147 mpdulen = skb->len; 148 if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))) 149 mpdulen += FCS_LEN; 150 151 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len); 152 memset(rthdr, 0, rtap_len); 153 it_present = &rthdr->it_present; 154 155 /* radiotap header, set always present flags */ 156 rthdr->it_len = cpu_to_le16(rtap_len); 157 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 158 BIT(IEEE80211_RADIOTAP_CHANNEL) | 159 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 160 161 if (!status->chains) 162 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 163 164 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 165 it_present_val |= 166 BIT(IEEE80211_RADIOTAP_EXT) | 167 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 168 put_unaligned_le32(it_present_val, it_present); 169 it_present++; 170 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 171 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 172 } 173 174 put_unaligned_le32(it_present_val, it_present); 175 176 pos = (void *)(it_present + 1); 177 178 /* the order of the following fields is important */ 179 180 /* IEEE80211_RADIOTAP_TSFT */ 181 if (ieee80211_have_rx_timestamp(status)) { 182 /* padding */ 183 while ((pos - (u8 *)rthdr) & 7) 184 *pos++ = 0; 185 put_unaligned_le64( 186 ieee80211_calculate_rx_timestamp(local, status, 187 mpdulen, 0), 188 pos); 189 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 190 pos += 8; 191 } 192 193 /* IEEE80211_RADIOTAP_FLAGS */ 194 if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)) 195 *pos |= IEEE80211_RADIOTAP_F_FCS; 196 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 197 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 198 if (status->flag & RX_FLAG_SHORTPRE) 199 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 200 pos++; 201 202 /* IEEE80211_RADIOTAP_RATE */ 203 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) { 204 /* 205 * Without rate information don't add it. If we have, 206 * MCS information is a separate field in radiotap, 207 * added below. The byte here is needed as padding 208 * for the channel though, so initialise it to 0. 209 */ 210 *pos = 0; 211 } else { 212 int shift = 0; 213 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 214 if (status->flag & RX_FLAG_10MHZ) 215 shift = 1; 216 else if (status->flag & RX_FLAG_5MHZ) 217 shift = 2; 218 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 219 } 220 pos++; 221 222 /* IEEE80211_RADIOTAP_CHANNEL */ 223 put_unaligned_le16(status->freq, pos); 224 pos += 2; 225 if (status->flag & RX_FLAG_10MHZ) 226 channel_flags |= IEEE80211_CHAN_HALF; 227 else if (status->flag & RX_FLAG_5MHZ) 228 channel_flags |= IEEE80211_CHAN_QUARTER; 229 230 if (status->band == IEEE80211_BAND_5GHZ) 231 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 232 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 233 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 234 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 235 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 236 else if (rate) 237 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 238 else 239 channel_flags |= IEEE80211_CHAN_2GHZ; 240 put_unaligned_le16(channel_flags, pos); 241 pos += 2; 242 243 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 244 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM && 245 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 246 *pos = status->signal; 247 rthdr->it_present |= 248 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 249 pos++; 250 } 251 252 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 253 254 if (!status->chains) { 255 /* IEEE80211_RADIOTAP_ANTENNA */ 256 *pos = status->antenna; 257 pos++; 258 } 259 260 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 261 262 /* IEEE80211_RADIOTAP_RX_FLAGS */ 263 /* ensure 2 byte alignment for the 2 byte field as required */ 264 if ((pos - (u8 *)rthdr) & 1) 265 *pos++ = 0; 266 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 267 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 268 put_unaligned_le16(rx_flags, pos); 269 pos += 2; 270 271 if (status->flag & RX_FLAG_HT) { 272 unsigned int stbc; 273 274 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 275 *pos++ = local->hw.radiotap_mcs_details; 276 *pos = 0; 277 if (status->flag & RX_FLAG_SHORT_GI) 278 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 279 if (status->flag & RX_FLAG_40MHZ) 280 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 281 if (status->flag & RX_FLAG_HT_GF) 282 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 283 if (status->flag & RX_FLAG_LDPC) 284 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 285 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT; 286 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 287 pos++; 288 *pos++ = status->rate_idx; 289 } 290 291 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 292 u16 flags = 0; 293 294 /* ensure 4 byte alignment */ 295 while ((pos - (u8 *)rthdr) & 3) 296 pos++; 297 rthdr->it_present |= 298 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 299 put_unaligned_le32(status->ampdu_reference, pos); 300 pos += 4; 301 if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN) 302 flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN; 303 if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN) 304 flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN; 305 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 306 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 307 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 308 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 309 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 310 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 311 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 312 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 313 put_unaligned_le16(flags, pos); 314 pos += 2; 315 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 316 *pos++ = status->ampdu_delimiter_crc; 317 else 318 *pos++ = 0; 319 *pos++ = 0; 320 } 321 322 if (status->flag & RX_FLAG_VHT) { 323 u16 known = local->hw.radiotap_vht_details; 324 325 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 326 /* known field - how to handle 80+80? */ 327 if (status->vht_flag & RX_VHT_FLAG_80P80MHZ) 328 known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH; 329 put_unaligned_le16(known, pos); 330 pos += 2; 331 /* flags */ 332 if (status->flag & RX_FLAG_SHORT_GI) 333 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 334 /* in VHT, STBC is binary */ 335 if (status->flag & RX_FLAG_STBC_MASK) 336 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 337 if (status->vht_flag & RX_VHT_FLAG_BF) 338 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 339 pos++; 340 /* bandwidth */ 341 if (status->vht_flag & RX_VHT_FLAG_80MHZ) 342 *pos++ = 4; 343 else if (status->vht_flag & RX_VHT_FLAG_80P80MHZ) 344 *pos++ = 0; /* marked not known above */ 345 else if (status->vht_flag & RX_VHT_FLAG_160MHZ) 346 *pos++ = 11; 347 else if (status->flag & RX_FLAG_40MHZ) 348 *pos++ = 1; 349 else /* 20 MHz */ 350 *pos++ = 0; 351 /* MCS/NSS */ 352 *pos = (status->rate_idx << 4) | status->vht_nss; 353 pos += 4; 354 /* coding field */ 355 if (status->flag & RX_FLAG_LDPC) 356 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 357 pos++; 358 /* group ID */ 359 pos++; 360 /* partial_aid */ 361 pos += 2; 362 } 363 364 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 365 *pos++ = status->chain_signal[chain]; 366 *pos++ = chain; 367 } 368 } 369 370 /* 371 * This function copies a received frame to all monitor interfaces and 372 * returns a cleaned-up SKB that no longer includes the FCS nor the 373 * radiotap header the driver might have added. 374 */ 375 static struct sk_buff * 376 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 377 struct ieee80211_rate *rate) 378 { 379 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 380 struct ieee80211_sub_if_data *sdata; 381 int needed_headroom; 382 struct sk_buff *skb, *skb2; 383 struct net_device *prev_dev = NULL; 384 int present_fcs_len = 0; 385 386 /* 387 * First, we may need to make a copy of the skb because 388 * (1) we need to modify it for radiotap (if not present), and 389 * (2) the other RX handlers will modify the skb we got. 390 * 391 * We don't need to, of course, if we aren't going to return 392 * the SKB because it has a bad FCS/PLCP checksum. 393 */ 394 395 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) 396 present_fcs_len = FCS_LEN; 397 398 /* ensure hdr->frame_control is in skb head */ 399 if (!pskb_may_pull(origskb, 2)) { 400 dev_kfree_skb(origskb); 401 return NULL; 402 } 403 404 if (!local->monitors) { 405 if (should_drop_frame(origskb, present_fcs_len)) { 406 dev_kfree_skb(origskb); 407 return NULL; 408 } 409 410 return remove_monitor_info(local, origskb); 411 } 412 413 /* room for the radiotap header based on driver features */ 414 needed_headroom = ieee80211_rx_radiotap_space(local, status); 415 416 if (should_drop_frame(origskb, present_fcs_len)) { 417 /* only need to expand headroom if necessary */ 418 skb = origskb; 419 origskb = NULL; 420 421 /* 422 * This shouldn't trigger often because most devices have an 423 * RX header they pull before we get here, and that should 424 * be big enough for our radiotap information. We should 425 * probably export the length to drivers so that we can have 426 * them allocate enough headroom to start with. 427 */ 428 if (skb_headroom(skb) < needed_headroom && 429 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 430 dev_kfree_skb(skb); 431 return NULL; 432 } 433 } else { 434 /* 435 * Need to make a copy and possibly remove radiotap header 436 * and FCS from the original. 437 */ 438 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC); 439 440 origskb = remove_monitor_info(local, origskb); 441 442 if (!skb) 443 return origskb; 444 } 445 446 /* prepend radiotap information */ 447 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 448 true); 449 450 skb_reset_mac_header(skb); 451 skb->ip_summed = CHECKSUM_UNNECESSARY; 452 skb->pkt_type = PACKET_OTHERHOST; 453 skb->protocol = htons(ETH_P_802_2); 454 455 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 456 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 457 continue; 458 459 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) 460 continue; 461 462 if (!ieee80211_sdata_running(sdata)) 463 continue; 464 465 if (prev_dev) { 466 skb2 = skb_clone(skb, GFP_ATOMIC); 467 if (skb2) { 468 skb2->dev = prev_dev; 469 netif_receive_skb(skb2); 470 } 471 } 472 473 prev_dev = sdata->dev; 474 sdata->dev->stats.rx_packets++; 475 sdata->dev->stats.rx_bytes += skb->len; 476 } 477 478 if (prev_dev) { 479 skb->dev = prev_dev; 480 netif_receive_skb(skb); 481 } else 482 dev_kfree_skb(skb); 483 484 return origskb; 485 } 486 487 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 488 { 489 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 490 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 491 int tid, seqno_idx, security_idx; 492 493 /* does the frame have a qos control field? */ 494 if (ieee80211_is_data_qos(hdr->frame_control)) { 495 u8 *qc = ieee80211_get_qos_ctl(hdr); 496 /* frame has qos control */ 497 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 498 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 499 status->rx_flags |= IEEE80211_RX_AMSDU; 500 501 seqno_idx = tid; 502 security_idx = tid; 503 } else { 504 /* 505 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 506 * 507 * Sequence numbers for management frames, QoS data 508 * frames with a broadcast/multicast address in the 509 * Address 1 field, and all non-QoS data frames sent 510 * by QoS STAs are assigned using an additional single 511 * modulo-4096 counter, [...] 512 * 513 * We also use that counter for non-QoS STAs. 514 */ 515 seqno_idx = IEEE80211_NUM_TIDS; 516 security_idx = 0; 517 if (ieee80211_is_mgmt(hdr->frame_control)) 518 security_idx = IEEE80211_NUM_TIDS; 519 tid = 0; 520 } 521 522 rx->seqno_idx = seqno_idx; 523 rx->security_idx = security_idx; 524 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 525 * For now, set skb->priority to 0 for other cases. */ 526 rx->skb->priority = (tid > 7) ? 0 : tid; 527 } 528 529 /** 530 * DOC: Packet alignment 531 * 532 * Drivers always need to pass packets that are aligned to two-byte boundaries 533 * to the stack. 534 * 535 * Additionally, should, if possible, align the payload data in a way that 536 * guarantees that the contained IP header is aligned to a four-byte 537 * boundary. In the case of regular frames, this simply means aligning the 538 * payload to a four-byte boundary (because either the IP header is directly 539 * contained, or IV/RFC1042 headers that have a length divisible by four are 540 * in front of it). If the payload data is not properly aligned and the 541 * architecture doesn't support efficient unaligned operations, mac80211 542 * will align the data. 543 * 544 * With A-MSDU frames, however, the payload data address must yield two modulo 545 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 546 * push the IP header further back to a multiple of four again. Thankfully, the 547 * specs were sane enough this time around to require padding each A-MSDU 548 * subframe to a length that is a multiple of four. 549 * 550 * Padding like Atheros hardware adds which is between the 802.11 header and 551 * the payload is not supported, the driver is required to move the 802.11 552 * header to be directly in front of the payload in that case. 553 */ 554 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 555 { 556 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 557 WARN_ONCE((unsigned long)rx->skb->data & 1, 558 "unaligned packet at 0x%p\n", rx->skb->data); 559 #endif 560 } 561 562 563 /* rx handlers */ 564 565 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 566 { 567 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 568 569 if (is_multicast_ether_addr(hdr->addr1)) 570 return 0; 571 572 return ieee80211_is_robust_mgmt_frame(skb); 573 } 574 575 576 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 577 { 578 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 579 580 if (!is_multicast_ether_addr(hdr->addr1)) 581 return 0; 582 583 return ieee80211_is_robust_mgmt_frame(skb); 584 } 585 586 587 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 588 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 589 { 590 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 591 struct ieee80211_mmie *mmie; 592 593 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 594 return -1; 595 596 if (!ieee80211_is_robust_mgmt_frame(skb)) 597 return -1; /* not a robust management frame */ 598 599 mmie = (struct ieee80211_mmie *) 600 (skb->data + skb->len - sizeof(*mmie)); 601 if (mmie->element_id != WLAN_EID_MMIE || 602 mmie->length != sizeof(*mmie) - 2) 603 return -1; 604 605 return le16_to_cpu(mmie->key_id); 606 } 607 608 static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs, 609 struct sk_buff *skb) 610 { 611 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 612 __le16 fc; 613 int hdrlen; 614 u8 keyid; 615 616 fc = hdr->frame_control; 617 hdrlen = ieee80211_hdrlen(fc); 618 619 if (skb->len < hdrlen + cs->hdr_len) 620 return -EINVAL; 621 622 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1); 623 keyid &= cs->key_idx_mask; 624 keyid >>= cs->key_idx_shift; 625 626 return keyid; 627 } 628 629 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 630 { 631 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 632 char *dev_addr = rx->sdata->vif.addr; 633 634 if (ieee80211_is_data(hdr->frame_control)) { 635 if (is_multicast_ether_addr(hdr->addr1)) { 636 if (ieee80211_has_tods(hdr->frame_control) || 637 !ieee80211_has_fromds(hdr->frame_control)) 638 return RX_DROP_MONITOR; 639 if (ether_addr_equal(hdr->addr3, dev_addr)) 640 return RX_DROP_MONITOR; 641 } else { 642 if (!ieee80211_has_a4(hdr->frame_control)) 643 return RX_DROP_MONITOR; 644 if (ether_addr_equal(hdr->addr4, dev_addr)) 645 return RX_DROP_MONITOR; 646 } 647 } 648 649 /* If there is not an established peer link and this is not a peer link 650 * establisment frame, beacon or probe, drop the frame. 651 */ 652 653 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 654 struct ieee80211_mgmt *mgmt; 655 656 if (!ieee80211_is_mgmt(hdr->frame_control)) 657 return RX_DROP_MONITOR; 658 659 if (ieee80211_is_action(hdr->frame_control)) { 660 u8 category; 661 662 /* make sure category field is present */ 663 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 664 return RX_DROP_MONITOR; 665 666 mgmt = (struct ieee80211_mgmt *)hdr; 667 category = mgmt->u.action.category; 668 if (category != WLAN_CATEGORY_MESH_ACTION && 669 category != WLAN_CATEGORY_SELF_PROTECTED) 670 return RX_DROP_MONITOR; 671 return RX_CONTINUE; 672 } 673 674 if (ieee80211_is_probe_req(hdr->frame_control) || 675 ieee80211_is_probe_resp(hdr->frame_control) || 676 ieee80211_is_beacon(hdr->frame_control) || 677 ieee80211_is_auth(hdr->frame_control)) 678 return RX_CONTINUE; 679 680 return RX_DROP_MONITOR; 681 } 682 683 return RX_CONTINUE; 684 } 685 686 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 687 struct tid_ampdu_rx *tid_agg_rx, 688 int index, 689 struct sk_buff_head *frames) 690 { 691 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index]; 692 struct sk_buff *skb; 693 struct ieee80211_rx_status *status; 694 695 lockdep_assert_held(&tid_agg_rx->reorder_lock); 696 697 if (skb_queue_empty(skb_list)) 698 goto no_frame; 699 700 if (!ieee80211_rx_reorder_ready(skb_list)) { 701 __skb_queue_purge(skb_list); 702 goto no_frame; 703 } 704 705 /* release frames from the reorder ring buffer */ 706 tid_agg_rx->stored_mpdu_num--; 707 while ((skb = __skb_dequeue(skb_list))) { 708 status = IEEE80211_SKB_RXCB(skb); 709 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 710 __skb_queue_tail(frames, skb); 711 } 712 713 no_frame: 714 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 715 } 716 717 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 718 struct tid_ampdu_rx *tid_agg_rx, 719 u16 head_seq_num, 720 struct sk_buff_head *frames) 721 { 722 int index; 723 724 lockdep_assert_held(&tid_agg_rx->reorder_lock); 725 726 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 727 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 728 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 729 frames); 730 } 731 } 732 733 /* 734 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 735 * the skb was added to the buffer longer than this time ago, the earlier 736 * frames that have not yet been received are assumed to be lost and the skb 737 * can be released for processing. This may also release other skb's from the 738 * reorder buffer if there are no additional gaps between the frames. 739 * 740 * Callers must hold tid_agg_rx->reorder_lock. 741 */ 742 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 743 744 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 745 struct tid_ampdu_rx *tid_agg_rx, 746 struct sk_buff_head *frames) 747 { 748 int index, i, j; 749 750 lockdep_assert_held(&tid_agg_rx->reorder_lock); 751 752 /* release the buffer until next missing frame */ 753 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 754 if (!ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index]) && 755 tid_agg_rx->stored_mpdu_num) { 756 /* 757 * No buffers ready to be released, but check whether any 758 * frames in the reorder buffer have timed out. 759 */ 760 int skipped = 1; 761 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 762 j = (j + 1) % tid_agg_rx->buf_size) { 763 if (!ieee80211_rx_reorder_ready( 764 &tid_agg_rx->reorder_buf[j])) { 765 skipped++; 766 continue; 767 } 768 if (skipped && 769 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 770 HT_RX_REORDER_BUF_TIMEOUT)) 771 goto set_release_timer; 772 773 /* don't leave incomplete A-MSDUs around */ 774 for (i = (index + 1) % tid_agg_rx->buf_size; i != j; 775 i = (i + 1) % tid_agg_rx->buf_size) 776 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]); 777 778 ht_dbg_ratelimited(sdata, 779 "release an RX reorder frame due to timeout on earlier frames\n"); 780 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 781 frames); 782 783 /* 784 * Increment the head seq# also for the skipped slots. 785 */ 786 tid_agg_rx->head_seq_num = 787 (tid_agg_rx->head_seq_num + 788 skipped) & IEEE80211_SN_MASK; 789 skipped = 0; 790 } 791 } else while (ieee80211_rx_reorder_ready( 792 &tid_agg_rx->reorder_buf[index])) { 793 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 794 frames); 795 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 796 } 797 798 if (tid_agg_rx->stored_mpdu_num) { 799 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 800 801 for (; j != (index - 1) % tid_agg_rx->buf_size; 802 j = (j + 1) % tid_agg_rx->buf_size) { 803 if (ieee80211_rx_reorder_ready( 804 &tid_agg_rx->reorder_buf[j])) 805 break; 806 } 807 808 set_release_timer: 809 810 mod_timer(&tid_agg_rx->reorder_timer, 811 tid_agg_rx->reorder_time[j] + 1 + 812 HT_RX_REORDER_BUF_TIMEOUT); 813 } else { 814 del_timer(&tid_agg_rx->reorder_timer); 815 } 816 } 817 818 /* 819 * As this function belongs to the RX path it must be under 820 * rcu_read_lock protection. It returns false if the frame 821 * can be processed immediately, true if it was consumed. 822 */ 823 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 824 struct tid_ampdu_rx *tid_agg_rx, 825 struct sk_buff *skb, 826 struct sk_buff_head *frames) 827 { 828 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 829 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 830 u16 sc = le16_to_cpu(hdr->seq_ctrl); 831 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 832 u16 head_seq_num, buf_size; 833 int index; 834 bool ret = true; 835 836 spin_lock(&tid_agg_rx->reorder_lock); 837 838 buf_size = tid_agg_rx->buf_size; 839 head_seq_num = tid_agg_rx->head_seq_num; 840 841 /* frame with out of date sequence number */ 842 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 843 dev_kfree_skb(skb); 844 goto out; 845 } 846 847 /* 848 * If frame the sequence number exceeds our buffering window 849 * size release some previous frames to make room for this one. 850 */ 851 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 852 head_seq_num = ieee80211_sn_inc( 853 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 854 /* release stored frames up to new head to stack */ 855 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 856 head_seq_num, frames); 857 } 858 859 /* Now the new frame is always in the range of the reordering buffer */ 860 861 index = mpdu_seq_num % tid_agg_rx->buf_size; 862 863 /* check if we already stored this frame */ 864 if (ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index])) { 865 dev_kfree_skb(skb); 866 goto out; 867 } 868 869 /* 870 * If the current MPDU is in the right order and nothing else 871 * is stored we can process it directly, no need to buffer it. 872 * If it is first but there's something stored, we may be able 873 * to release frames after this one. 874 */ 875 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 876 tid_agg_rx->stored_mpdu_num == 0) { 877 if (!(status->flag & RX_FLAG_AMSDU_MORE)) 878 tid_agg_rx->head_seq_num = 879 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 880 ret = false; 881 goto out; 882 } 883 884 /* put the frame in the reordering buffer */ 885 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb); 886 if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 887 tid_agg_rx->reorder_time[index] = jiffies; 888 tid_agg_rx->stored_mpdu_num++; 889 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 890 } 891 892 out: 893 spin_unlock(&tid_agg_rx->reorder_lock); 894 return ret; 895 } 896 897 /* 898 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 899 * true if the MPDU was buffered, false if it should be processed. 900 */ 901 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 902 struct sk_buff_head *frames) 903 { 904 struct sk_buff *skb = rx->skb; 905 struct ieee80211_local *local = rx->local; 906 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 907 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 908 struct sta_info *sta = rx->sta; 909 struct tid_ampdu_rx *tid_agg_rx; 910 u16 sc; 911 u8 tid, ack_policy; 912 913 if (!ieee80211_is_data_qos(hdr->frame_control) || 914 is_multicast_ether_addr(hdr->addr1)) 915 goto dont_reorder; 916 917 /* 918 * filter the QoS data rx stream according to 919 * STA/TID and check if this STA/TID is on aggregation 920 */ 921 922 if (!sta) 923 goto dont_reorder; 924 925 ack_policy = *ieee80211_get_qos_ctl(hdr) & 926 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 927 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 928 929 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 930 if (!tid_agg_rx) 931 goto dont_reorder; 932 933 /* qos null data frames are excluded */ 934 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 935 goto dont_reorder; 936 937 /* not part of a BA session */ 938 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 939 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 940 goto dont_reorder; 941 942 /* not actually part of this BA session */ 943 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 944 goto dont_reorder; 945 946 /* new, potentially un-ordered, ampdu frame - process it */ 947 948 /* reset session timer */ 949 if (tid_agg_rx->timeout) 950 tid_agg_rx->last_rx = jiffies; 951 952 /* if this mpdu is fragmented - terminate rx aggregation session */ 953 sc = le16_to_cpu(hdr->seq_ctrl); 954 if (sc & IEEE80211_SCTL_FRAG) { 955 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 956 skb_queue_tail(&rx->sdata->skb_queue, skb); 957 ieee80211_queue_work(&local->hw, &rx->sdata->work); 958 return; 959 } 960 961 /* 962 * No locking needed -- we will only ever process one 963 * RX packet at a time, and thus own tid_agg_rx. All 964 * other code manipulating it needs to (and does) make 965 * sure that we cannot get to it any more before doing 966 * anything with it. 967 */ 968 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 969 frames)) 970 return; 971 972 dont_reorder: 973 __skb_queue_tail(frames, skb); 974 } 975 976 static ieee80211_rx_result debug_noinline 977 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 978 { 979 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 980 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 981 982 /* 983 * Drop duplicate 802.11 retransmissions 984 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 985 */ 986 if (rx->skb->len >= 24 && rx->sta && 987 !ieee80211_is_ctl(hdr->frame_control) && 988 !ieee80211_is_qos_nullfunc(hdr->frame_control) && 989 !is_multicast_ether_addr(hdr->addr1)) { 990 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 991 rx->sta->last_seq_ctrl[rx->seqno_idx] == 992 hdr->seq_ctrl)) { 993 if (status->rx_flags & IEEE80211_RX_RA_MATCH) { 994 rx->local->dot11FrameDuplicateCount++; 995 rx->sta->num_duplicates++; 996 } 997 return RX_DROP_UNUSABLE; 998 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 999 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1000 } 1001 } 1002 1003 if (unlikely(rx->skb->len < 16)) { 1004 I802_DEBUG_INC(rx->local->rx_handlers_drop_short); 1005 return RX_DROP_MONITOR; 1006 } 1007 1008 /* Drop disallowed frame classes based on STA auth/assoc state; 1009 * IEEE 802.11, Chap 5.5. 1010 * 1011 * mac80211 filters only based on association state, i.e. it drops 1012 * Class 3 frames from not associated stations. hostapd sends 1013 * deauth/disassoc frames when needed. In addition, hostapd is 1014 * responsible for filtering on both auth and assoc states. 1015 */ 1016 1017 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1018 return ieee80211_rx_mesh_check(rx); 1019 1020 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1021 ieee80211_is_pspoll(hdr->frame_control)) && 1022 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1023 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1024 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1025 /* 1026 * accept port control frames from the AP even when it's not 1027 * yet marked ASSOC to prevent a race where we don't set the 1028 * assoc bit quickly enough before it sends the first frame 1029 */ 1030 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1031 ieee80211_is_data_present(hdr->frame_control)) { 1032 unsigned int hdrlen; 1033 __be16 ethertype; 1034 1035 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1036 1037 if (rx->skb->len < hdrlen + 8) 1038 return RX_DROP_MONITOR; 1039 1040 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1041 if (ethertype == rx->sdata->control_port_protocol) 1042 return RX_CONTINUE; 1043 } 1044 1045 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1046 cfg80211_rx_spurious_frame(rx->sdata->dev, 1047 hdr->addr2, 1048 GFP_ATOMIC)) 1049 return RX_DROP_UNUSABLE; 1050 1051 return RX_DROP_MONITOR; 1052 } 1053 1054 return RX_CONTINUE; 1055 } 1056 1057 1058 static ieee80211_rx_result debug_noinline 1059 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1060 { 1061 struct ieee80211_local *local; 1062 struct ieee80211_hdr *hdr; 1063 struct sk_buff *skb; 1064 1065 local = rx->local; 1066 skb = rx->skb; 1067 hdr = (struct ieee80211_hdr *) skb->data; 1068 1069 if (!local->pspolling) 1070 return RX_CONTINUE; 1071 1072 if (!ieee80211_has_fromds(hdr->frame_control)) 1073 /* this is not from AP */ 1074 return RX_CONTINUE; 1075 1076 if (!ieee80211_is_data(hdr->frame_control)) 1077 return RX_CONTINUE; 1078 1079 if (!ieee80211_has_moredata(hdr->frame_control)) { 1080 /* AP has no more frames buffered for us */ 1081 local->pspolling = false; 1082 return RX_CONTINUE; 1083 } 1084 1085 /* more data bit is set, let's request a new frame from the AP */ 1086 ieee80211_send_pspoll(local, rx->sdata); 1087 1088 return RX_CONTINUE; 1089 } 1090 1091 static void sta_ps_start(struct sta_info *sta) 1092 { 1093 struct ieee80211_sub_if_data *sdata = sta->sdata; 1094 struct ieee80211_local *local = sdata->local; 1095 struct ps_data *ps; 1096 1097 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1098 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1099 ps = &sdata->bss->ps; 1100 else 1101 return; 1102 1103 atomic_inc(&ps->num_sta_ps); 1104 set_sta_flag(sta, WLAN_STA_PS_STA); 1105 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS)) 1106 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1107 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1108 sta->sta.addr, sta->sta.aid); 1109 } 1110 1111 static void sta_ps_end(struct sta_info *sta) 1112 { 1113 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1114 sta->sta.addr, sta->sta.aid); 1115 1116 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1117 /* 1118 * Clear the flag only if the other one is still set 1119 * so that the TX path won't start TX'ing new frames 1120 * directly ... In the case that the driver flag isn't 1121 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1122 */ 1123 clear_sta_flag(sta, WLAN_STA_PS_STA); 1124 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1125 sta->sta.addr, sta->sta.aid); 1126 return; 1127 } 1128 1129 set_sta_flag(sta, WLAN_STA_PS_DELIVER); 1130 clear_sta_flag(sta, WLAN_STA_PS_STA); 1131 ieee80211_sta_ps_deliver_wakeup(sta); 1132 } 1133 1134 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start) 1135 { 1136 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta); 1137 bool in_ps; 1138 1139 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS)); 1140 1141 /* Don't let the same PS state be set twice */ 1142 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA); 1143 if ((start && in_ps) || (!start && !in_ps)) 1144 return -EINVAL; 1145 1146 if (start) 1147 sta_ps_start(sta_inf); 1148 else 1149 sta_ps_end(sta_inf); 1150 1151 return 0; 1152 } 1153 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1154 1155 static ieee80211_rx_result debug_noinline 1156 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1157 { 1158 struct ieee80211_sub_if_data *sdata = rx->sdata; 1159 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1160 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1161 int tid, ac; 1162 1163 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1164 return RX_CONTINUE; 1165 1166 if (sdata->vif.type != NL80211_IFTYPE_AP && 1167 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1168 return RX_CONTINUE; 1169 1170 /* 1171 * The device handles station powersave, so don't do anything about 1172 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1173 * it to mac80211 since they're handled.) 1174 */ 1175 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS) 1176 return RX_CONTINUE; 1177 1178 /* 1179 * Don't do anything if the station isn't already asleep. In 1180 * the uAPSD case, the station will probably be marked asleep, 1181 * in the PS-Poll case the station must be confused ... 1182 */ 1183 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1184 return RX_CONTINUE; 1185 1186 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1187 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) { 1188 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1189 ieee80211_sta_ps_deliver_poll_response(rx->sta); 1190 else 1191 set_sta_flag(rx->sta, WLAN_STA_PSPOLL); 1192 } 1193 1194 /* Free PS Poll skb here instead of returning RX_DROP that would 1195 * count as an dropped frame. */ 1196 dev_kfree_skb(rx->skb); 1197 1198 return RX_QUEUED; 1199 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1200 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1201 ieee80211_has_pm(hdr->frame_control) && 1202 (ieee80211_is_data_qos(hdr->frame_control) || 1203 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1204 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1205 ac = ieee802_1d_to_ac[tid & 7]; 1206 1207 /* 1208 * If this AC is not trigger-enabled do nothing. 1209 * 1210 * NB: This could/should check a separate bitmap of trigger- 1211 * enabled queues, but for now we only implement uAPSD w/o 1212 * TSPEC changes to the ACs, so they're always the same. 1213 */ 1214 if (!(rx->sta->sta.uapsd_queues & BIT(ac))) 1215 return RX_CONTINUE; 1216 1217 /* if we are in a service period, do nothing */ 1218 if (test_sta_flag(rx->sta, WLAN_STA_SP)) 1219 return RX_CONTINUE; 1220 1221 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1222 ieee80211_sta_ps_deliver_uapsd(rx->sta); 1223 else 1224 set_sta_flag(rx->sta, WLAN_STA_UAPSD); 1225 } 1226 1227 return RX_CONTINUE; 1228 } 1229 1230 static ieee80211_rx_result debug_noinline 1231 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1232 { 1233 struct sta_info *sta = rx->sta; 1234 struct sk_buff *skb = rx->skb; 1235 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1236 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1237 int i; 1238 1239 if (!sta) 1240 return RX_CONTINUE; 1241 1242 /* 1243 * Update last_rx only for IBSS packets which are for the current 1244 * BSSID and for station already AUTHORIZED to avoid keeping the 1245 * current IBSS network alive in cases where other STAs start 1246 * using different BSSID. This will also give the station another 1247 * chance to restart the authentication/authorization in case 1248 * something went wrong the first time. 1249 */ 1250 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1251 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1252 NL80211_IFTYPE_ADHOC); 1253 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1254 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1255 sta->last_rx = jiffies; 1256 if (ieee80211_is_data(hdr->frame_control) && 1257 !is_multicast_ether_addr(hdr->addr1)) { 1258 sta->last_rx_rate_idx = status->rate_idx; 1259 sta->last_rx_rate_flag = status->flag; 1260 sta->last_rx_rate_vht_flag = status->vht_flag; 1261 sta->last_rx_rate_vht_nss = status->vht_nss; 1262 } 1263 } 1264 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1265 /* 1266 * Mesh beacons will update last_rx when if they are found to 1267 * match the current local configuration when processed. 1268 */ 1269 sta->last_rx = jiffies; 1270 if (ieee80211_is_data(hdr->frame_control)) { 1271 sta->last_rx_rate_idx = status->rate_idx; 1272 sta->last_rx_rate_flag = status->flag; 1273 sta->last_rx_rate_vht_flag = status->vht_flag; 1274 sta->last_rx_rate_vht_nss = status->vht_nss; 1275 } 1276 } 1277 1278 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1279 return RX_CONTINUE; 1280 1281 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1282 ieee80211_sta_rx_notify(rx->sdata, hdr); 1283 1284 sta->rx_fragments++; 1285 sta->rx_bytes += rx->skb->len; 1286 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1287 sta->last_signal = status->signal; 1288 ewma_add(&sta->avg_signal, -status->signal); 1289 } 1290 1291 if (status->chains) { 1292 sta->chains = status->chains; 1293 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1294 int signal = status->chain_signal[i]; 1295 1296 if (!(status->chains & BIT(i))) 1297 continue; 1298 1299 sta->chain_signal_last[i] = signal; 1300 ewma_add(&sta->chain_signal_avg[i], -signal); 1301 } 1302 } 1303 1304 /* 1305 * Change STA power saving mode only at the end of a frame 1306 * exchange sequence. 1307 */ 1308 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) && 1309 !ieee80211_has_morefrags(hdr->frame_control) && 1310 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1311 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1312 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1313 /* PM bit is only checked in frames where it isn't reserved, 1314 * in AP mode it's reserved in non-bufferable management frames 1315 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field) 1316 */ 1317 (!ieee80211_is_mgmt(hdr->frame_control) || 1318 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) { 1319 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1320 if (!ieee80211_has_pm(hdr->frame_control)) 1321 sta_ps_end(sta); 1322 } else { 1323 if (ieee80211_has_pm(hdr->frame_control)) 1324 sta_ps_start(sta); 1325 } 1326 } 1327 1328 /* mesh power save support */ 1329 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1330 ieee80211_mps_rx_h_sta_process(sta, hdr); 1331 1332 /* 1333 * Drop (qos-)data::nullfunc frames silently, since they 1334 * are used only to control station power saving mode. 1335 */ 1336 if (ieee80211_is_nullfunc(hdr->frame_control) || 1337 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1338 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1339 1340 /* 1341 * If we receive a 4-addr nullfunc frame from a STA 1342 * that was not moved to a 4-addr STA vlan yet send 1343 * the event to userspace and for older hostapd drop 1344 * the frame to the monitor interface. 1345 */ 1346 if (ieee80211_has_a4(hdr->frame_control) && 1347 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1348 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1349 !rx->sdata->u.vlan.sta))) { 1350 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1351 cfg80211_rx_unexpected_4addr_frame( 1352 rx->sdata->dev, sta->sta.addr, 1353 GFP_ATOMIC); 1354 return RX_DROP_MONITOR; 1355 } 1356 /* 1357 * Update counter and free packet here to avoid 1358 * counting this as a dropped packed. 1359 */ 1360 sta->rx_packets++; 1361 dev_kfree_skb(rx->skb); 1362 return RX_QUEUED; 1363 } 1364 1365 return RX_CONTINUE; 1366 } /* ieee80211_rx_h_sta_process */ 1367 1368 static ieee80211_rx_result debug_noinline 1369 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1370 { 1371 struct sk_buff *skb = rx->skb; 1372 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1373 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1374 int keyidx; 1375 int hdrlen; 1376 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1377 struct ieee80211_key *sta_ptk = NULL; 1378 int mmie_keyidx = -1; 1379 __le16 fc; 1380 const struct ieee80211_cipher_scheme *cs = NULL; 1381 1382 /* 1383 * Key selection 101 1384 * 1385 * There are four types of keys: 1386 * - GTK (group keys) 1387 * - IGTK (group keys for management frames) 1388 * - PTK (pairwise keys) 1389 * - STK (station-to-station pairwise keys) 1390 * 1391 * When selecting a key, we have to distinguish between multicast 1392 * (including broadcast) and unicast frames, the latter can only 1393 * use PTKs and STKs while the former always use GTKs and IGTKs. 1394 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1395 * unicast frames can also use key indices like GTKs. Hence, if we 1396 * don't have a PTK/STK we check the key index for a WEP key. 1397 * 1398 * Note that in a regular BSS, multicast frames are sent by the 1399 * AP only, associated stations unicast the frame to the AP first 1400 * which then multicasts it on their behalf. 1401 * 1402 * There is also a slight problem in IBSS mode: GTKs are negotiated 1403 * with each station, that is something we don't currently handle. 1404 * The spec seems to expect that one negotiates the same key with 1405 * every station but there's no such requirement; VLANs could be 1406 * possible. 1407 */ 1408 1409 /* 1410 * No point in finding a key and decrypting if the frame is neither 1411 * addressed to us nor a multicast frame. 1412 */ 1413 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1414 return RX_CONTINUE; 1415 1416 /* start without a key */ 1417 rx->key = NULL; 1418 fc = hdr->frame_control; 1419 1420 if (rx->sta) { 1421 int keyid = rx->sta->ptk_idx; 1422 1423 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) { 1424 cs = rx->sta->cipher_scheme; 1425 keyid = iwl80211_get_cs_keyid(cs, rx->skb); 1426 if (unlikely(keyid < 0)) 1427 return RX_DROP_UNUSABLE; 1428 } 1429 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1430 } 1431 1432 if (!ieee80211_has_protected(fc)) 1433 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1434 1435 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1436 rx->key = sta_ptk; 1437 if ((status->flag & RX_FLAG_DECRYPTED) && 1438 (status->flag & RX_FLAG_IV_STRIPPED)) 1439 return RX_CONTINUE; 1440 /* Skip decryption if the frame is not protected. */ 1441 if (!ieee80211_has_protected(fc)) 1442 return RX_CONTINUE; 1443 } else if (mmie_keyidx >= 0) { 1444 /* Broadcast/multicast robust management frame / BIP */ 1445 if ((status->flag & RX_FLAG_DECRYPTED) && 1446 (status->flag & RX_FLAG_IV_STRIPPED)) 1447 return RX_CONTINUE; 1448 1449 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1450 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1451 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1452 if (rx->sta) 1453 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1454 if (!rx->key) 1455 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1456 } else if (!ieee80211_has_protected(fc)) { 1457 /* 1458 * The frame was not protected, so skip decryption. However, we 1459 * need to set rx->key if there is a key that could have been 1460 * used so that the frame may be dropped if encryption would 1461 * have been expected. 1462 */ 1463 struct ieee80211_key *key = NULL; 1464 struct ieee80211_sub_if_data *sdata = rx->sdata; 1465 int i; 1466 1467 if (ieee80211_is_mgmt(fc) && 1468 is_multicast_ether_addr(hdr->addr1) && 1469 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1470 rx->key = key; 1471 else { 1472 if (rx->sta) { 1473 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1474 key = rcu_dereference(rx->sta->gtk[i]); 1475 if (key) 1476 break; 1477 } 1478 } 1479 if (!key) { 1480 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1481 key = rcu_dereference(sdata->keys[i]); 1482 if (key) 1483 break; 1484 } 1485 } 1486 if (key) 1487 rx->key = key; 1488 } 1489 return RX_CONTINUE; 1490 } else { 1491 u8 keyid; 1492 1493 /* 1494 * The device doesn't give us the IV so we won't be 1495 * able to look up the key. That's ok though, we 1496 * don't need to decrypt the frame, we just won't 1497 * be able to keep statistics accurate. 1498 * Except for key threshold notifications, should 1499 * we somehow allow the driver to tell us which key 1500 * the hardware used if this flag is set? 1501 */ 1502 if ((status->flag & RX_FLAG_DECRYPTED) && 1503 (status->flag & RX_FLAG_IV_STRIPPED)) 1504 return RX_CONTINUE; 1505 1506 hdrlen = ieee80211_hdrlen(fc); 1507 1508 if (cs) { 1509 keyidx = iwl80211_get_cs_keyid(cs, rx->skb); 1510 1511 if (unlikely(keyidx < 0)) 1512 return RX_DROP_UNUSABLE; 1513 } else { 1514 if (rx->skb->len < 8 + hdrlen) 1515 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1516 /* 1517 * no need to call ieee80211_wep_get_keyidx, 1518 * it verifies a bunch of things we've done already 1519 */ 1520 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1521 keyidx = keyid >> 6; 1522 } 1523 1524 /* check per-station GTK first, if multicast packet */ 1525 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1526 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1527 1528 /* if not found, try default key */ 1529 if (!rx->key) { 1530 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1531 1532 /* 1533 * RSNA-protected unicast frames should always be 1534 * sent with pairwise or station-to-station keys, 1535 * but for WEP we allow using a key index as well. 1536 */ 1537 if (rx->key && 1538 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1539 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1540 !is_multicast_ether_addr(hdr->addr1)) 1541 rx->key = NULL; 1542 } 1543 } 1544 1545 if (rx->key) { 1546 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1547 return RX_DROP_MONITOR; 1548 1549 rx->key->tx_rx_count++; 1550 /* TODO: add threshold stuff again */ 1551 } else { 1552 return RX_DROP_MONITOR; 1553 } 1554 1555 switch (rx->key->conf.cipher) { 1556 case WLAN_CIPHER_SUITE_WEP40: 1557 case WLAN_CIPHER_SUITE_WEP104: 1558 result = ieee80211_crypto_wep_decrypt(rx); 1559 break; 1560 case WLAN_CIPHER_SUITE_TKIP: 1561 result = ieee80211_crypto_tkip_decrypt(rx); 1562 break; 1563 case WLAN_CIPHER_SUITE_CCMP: 1564 result = ieee80211_crypto_ccmp_decrypt(rx); 1565 break; 1566 case WLAN_CIPHER_SUITE_AES_CMAC: 1567 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1568 break; 1569 default: 1570 result = ieee80211_crypto_hw_decrypt(rx); 1571 } 1572 1573 /* the hdr variable is invalid after the decrypt handlers */ 1574 1575 /* either the frame has been decrypted or will be dropped */ 1576 status->flag |= RX_FLAG_DECRYPTED; 1577 1578 return result; 1579 } 1580 1581 static inline struct ieee80211_fragment_entry * 1582 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 1583 unsigned int frag, unsigned int seq, int rx_queue, 1584 struct sk_buff **skb) 1585 { 1586 struct ieee80211_fragment_entry *entry; 1587 1588 entry = &sdata->fragments[sdata->fragment_next++]; 1589 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 1590 sdata->fragment_next = 0; 1591 1592 if (!skb_queue_empty(&entry->skb_list)) 1593 __skb_queue_purge(&entry->skb_list); 1594 1595 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 1596 *skb = NULL; 1597 entry->first_frag_time = jiffies; 1598 entry->seq = seq; 1599 entry->rx_queue = rx_queue; 1600 entry->last_frag = frag; 1601 entry->ccmp = 0; 1602 entry->extra_len = 0; 1603 1604 return entry; 1605 } 1606 1607 static inline struct ieee80211_fragment_entry * 1608 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 1609 unsigned int frag, unsigned int seq, 1610 int rx_queue, struct ieee80211_hdr *hdr) 1611 { 1612 struct ieee80211_fragment_entry *entry; 1613 int i, idx; 1614 1615 idx = sdata->fragment_next; 1616 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 1617 struct ieee80211_hdr *f_hdr; 1618 1619 idx--; 1620 if (idx < 0) 1621 idx = IEEE80211_FRAGMENT_MAX - 1; 1622 1623 entry = &sdata->fragments[idx]; 1624 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 1625 entry->rx_queue != rx_queue || 1626 entry->last_frag + 1 != frag) 1627 continue; 1628 1629 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 1630 1631 /* 1632 * Check ftype and addresses are equal, else check next fragment 1633 */ 1634 if (((hdr->frame_control ^ f_hdr->frame_control) & 1635 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 1636 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 1637 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 1638 continue; 1639 1640 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 1641 __skb_queue_purge(&entry->skb_list); 1642 continue; 1643 } 1644 return entry; 1645 } 1646 1647 return NULL; 1648 } 1649 1650 static ieee80211_rx_result debug_noinline 1651 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 1652 { 1653 struct ieee80211_hdr *hdr; 1654 u16 sc; 1655 __le16 fc; 1656 unsigned int frag, seq; 1657 struct ieee80211_fragment_entry *entry; 1658 struct sk_buff *skb; 1659 struct ieee80211_rx_status *status; 1660 1661 hdr = (struct ieee80211_hdr *)rx->skb->data; 1662 fc = hdr->frame_control; 1663 1664 if (ieee80211_is_ctl(fc)) 1665 return RX_CONTINUE; 1666 1667 sc = le16_to_cpu(hdr->seq_ctrl); 1668 frag = sc & IEEE80211_SCTL_FRAG; 1669 1670 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) || 1671 is_multicast_ether_addr(hdr->addr1))) { 1672 /* not fragmented */ 1673 goto out; 1674 } 1675 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 1676 1677 if (skb_linearize(rx->skb)) 1678 return RX_DROP_UNUSABLE; 1679 1680 /* 1681 * skb_linearize() might change the skb->data and 1682 * previously cached variables (in this case, hdr) need to 1683 * be refreshed with the new data. 1684 */ 1685 hdr = (struct ieee80211_hdr *)rx->skb->data; 1686 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 1687 1688 if (frag == 0) { 1689 /* This is the first fragment of a new frame. */ 1690 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 1691 rx->seqno_idx, &(rx->skb)); 1692 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP && 1693 ieee80211_has_protected(fc)) { 1694 int queue = rx->security_idx; 1695 /* Store CCMP PN so that we can verify that the next 1696 * fragment has a sequential PN value. */ 1697 entry->ccmp = 1; 1698 memcpy(entry->last_pn, 1699 rx->key->u.ccmp.rx_pn[queue], 1700 IEEE80211_CCMP_PN_LEN); 1701 } 1702 return RX_QUEUED; 1703 } 1704 1705 /* This is a fragment for a frame that should already be pending in 1706 * fragment cache. Add this fragment to the end of the pending entry. 1707 */ 1708 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 1709 rx->seqno_idx, hdr); 1710 if (!entry) { 1711 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1712 return RX_DROP_MONITOR; 1713 } 1714 1715 /* Verify that MPDUs within one MSDU have sequential PN values. 1716 * (IEEE 802.11i, 8.3.3.4.5) */ 1717 if (entry->ccmp) { 1718 int i; 1719 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 1720 int queue; 1721 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP) 1722 return RX_DROP_UNUSABLE; 1723 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 1724 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 1725 pn[i]++; 1726 if (pn[i]) 1727 break; 1728 } 1729 queue = rx->security_idx; 1730 rpn = rx->key->u.ccmp.rx_pn[queue]; 1731 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 1732 return RX_DROP_UNUSABLE; 1733 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 1734 } 1735 1736 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 1737 __skb_queue_tail(&entry->skb_list, rx->skb); 1738 entry->last_frag = frag; 1739 entry->extra_len += rx->skb->len; 1740 if (ieee80211_has_morefrags(fc)) { 1741 rx->skb = NULL; 1742 return RX_QUEUED; 1743 } 1744 1745 rx->skb = __skb_dequeue(&entry->skb_list); 1746 if (skb_tailroom(rx->skb) < entry->extra_len) { 1747 I802_DEBUG_INC(rx->local->rx_expand_skb_head2); 1748 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 1749 GFP_ATOMIC))) { 1750 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1751 __skb_queue_purge(&entry->skb_list); 1752 return RX_DROP_UNUSABLE; 1753 } 1754 } 1755 while ((skb = __skb_dequeue(&entry->skb_list))) { 1756 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len); 1757 dev_kfree_skb(skb); 1758 } 1759 1760 /* Complete frame has been reassembled - process it now */ 1761 status = IEEE80211_SKB_RXCB(rx->skb); 1762 status->rx_flags |= IEEE80211_RX_FRAGMENTED; 1763 1764 out: 1765 if (rx->sta) 1766 rx->sta->rx_packets++; 1767 if (is_multicast_ether_addr(hdr->addr1)) 1768 rx->local->dot11MulticastReceivedFrameCount++; 1769 else 1770 ieee80211_led_rx(rx->local); 1771 return RX_CONTINUE; 1772 } 1773 1774 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 1775 { 1776 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 1777 return -EACCES; 1778 1779 return 0; 1780 } 1781 1782 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 1783 { 1784 struct sk_buff *skb = rx->skb; 1785 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1786 1787 /* 1788 * Pass through unencrypted frames if the hardware has 1789 * decrypted them already. 1790 */ 1791 if (status->flag & RX_FLAG_DECRYPTED) 1792 return 0; 1793 1794 /* Drop unencrypted frames if key is set. */ 1795 if (unlikely(!ieee80211_has_protected(fc) && 1796 !ieee80211_is_nullfunc(fc) && 1797 ieee80211_is_data(fc) && 1798 (rx->key || rx->sdata->drop_unencrypted))) 1799 return -EACCES; 1800 1801 return 0; 1802 } 1803 1804 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 1805 { 1806 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1807 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1808 __le16 fc = hdr->frame_control; 1809 1810 /* 1811 * Pass through unencrypted frames if the hardware has 1812 * decrypted them already. 1813 */ 1814 if (status->flag & RX_FLAG_DECRYPTED) 1815 return 0; 1816 1817 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 1818 if (unlikely(!ieee80211_has_protected(fc) && 1819 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 1820 rx->key)) { 1821 if (ieee80211_is_deauth(fc) || 1822 ieee80211_is_disassoc(fc)) 1823 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1824 rx->skb->data, 1825 rx->skb->len); 1826 return -EACCES; 1827 } 1828 /* BIP does not use Protected field, so need to check MMIE */ 1829 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 1830 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 1831 if (ieee80211_is_deauth(fc) || 1832 ieee80211_is_disassoc(fc)) 1833 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1834 rx->skb->data, 1835 rx->skb->len); 1836 return -EACCES; 1837 } 1838 /* 1839 * When using MFP, Action frames are not allowed prior to 1840 * having configured keys. 1841 */ 1842 if (unlikely(ieee80211_is_action(fc) && !rx->key && 1843 ieee80211_is_robust_mgmt_frame(rx->skb))) 1844 return -EACCES; 1845 } 1846 1847 return 0; 1848 } 1849 1850 static int 1851 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 1852 { 1853 struct ieee80211_sub_if_data *sdata = rx->sdata; 1854 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1855 bool check_port_control = false; 1856 struct ethhdr *ehdr; 1857 int ret; 1858 1859 *port_control = false; 1860 if (ieee80211_has_a4(hdr->frame_control) && 1861 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 1862 return -1; 1863 1864 if (sdata->vif.type == NL80211_IFTYPE_STATION && 1865 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 1866 1867 if (!sdata->u.mgd.use_4addr) 1868 return -1; 1869 else 1870 check_port_control = true; 1871 } 1872 1873 if (is_multicast_ether_addr(hdr->addr1) && 1874 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 1875 return -1; 1876 1877 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 1878 if (ret < 0) 1879 return ret; 1880 1881 ehdr = (struct ethhdr *) rx->skb->data; 1882 if (ehdr->h_proto == rx->sdata->control_port_protocol) 1883 *port_control = true; 1884 else if (check_port_control) 1885 return -1; 1886 1887 return 0; 1888 } 1889 1890 /* 1891 * requires that rx->skb is a frame with ethernet header 1892 */ 1893 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 1894 { 1895 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 1896 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 1897 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1898 1899 /* 1900 * Allow EAPOL frames to us/the PAE group address regardless 1901 * of whether the frame was encrypted or not. 1902 */ 1903 if (ehdr->h_proto == rx->sdata->control_port_protocol && 1904 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 1905 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 1906 return true; 1907 1908 if (ieee80211_802_1x_port_control(rx) || 1909 ieee80211_drop_unencrypted(rx, fc)) 1910 return false; 1911 1912 return true; 1913 } 1914 1915 /* 1916 * requires that rx->skb is a frame with ethernet header 1917 */ 1918 static void 1919 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 1920 { 1921 struct ieee80211_sub_if_data *sdata = rx->sdata; 1922 struct net_device *dev = sdata->dev; 1923 struct sk_buff *skb, *xmit_skb; 1924 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1925 struct sta_info *dsta; 1926 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1927 1928 skb = rx->skb; 1929 xmit_skb = NULL; 1930 1931 if ((sdata->vif.type == NL80211_IFTYPE_AP || 1932 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1933 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 1934 (status->rx_flags & IEEE80211_RX_RA_MATCH) && 1935 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 1936 if (is_multicast_ether_addr(ehdr->h_dest)) { 1937 /* 1938 * send multicast frames both to higher layers in 1939 * local net stack and back to the wireless medium 1940 */ 1941 xmit_skb = skb_copy(skb, GFP_ATOMIC); 1942 if (!xmit_skb) 1943 net_info_ratelimited("%s: failed to clone multicast frame\n", 1944 dev->name); 1945 } else { 1946 dsta = sta_info_get(sdata, skb->data); 1947 if (dsta) { 1948 /* 1949 * The destination station is associated to 1950 * this AP (in this VLAN), so send the frame 1951 * directly to it and do not pass it to local 1952 * net stack. 1953 */ 1954 xmit_skb = skb; 1955 skb = NULL; 1956 } 1957 } 1958 } 1959 1960 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1961 if (skb) { 1962 /* 'align' will only take the values 0 or 2 here since all 1963 * frames are required to be aligned to 2-byte boundaries 1964 * when being passed to mac80211; the code here works just 1965 * as well if that isn't true, but mac80211 assumes it can 1966 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 1967 */ 1968 int align; 1969 1970 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 1971 if (align) { 1972 if (WARN_ON(skb_headroom(skb) < 3)) { 1973 dev_kfree_skb(skb); 1974 skb = NULL; 1975 } else { 1976 u8 *data = skb->data; 1977 size_t len = skb_headlen(skb); 1978 skb->data -= align; 1979 memmove(skb->data, data, len); 1980 skb_set_tail_pointer(skb, len); 1981 } 1982 } 1983 } 1984 #endif 1985 1986 if (skb) { 1987 /* deliver to local stack */ 1988 skb->protocol = eth_type_trans(skb, dev); 1989 memset(skb->cb, 0, sizeof(skb->cb)); 1990 if (rx->local->napi) 1991 napi_gro_receive(rx->local->napi, skb); 1992 else 1993 netif_receive_skb(skb); 1994 } 1995 1996 if (xmit_skb) { 1997 /* 1998 * Send to wireless media and increase priority by 256 to 1999 * keep the received priority instead of reclassifying 2000 * the frame (see cfg80211_classify8021d). 2001 */ 2002 xmit_skb->priority += 256; 2003 xmit_skb->protocol = htons(ETH_P_802_3); 2004 skb_reset_network_header(xmit_skb); 2005 skb_reset_mac_header(xmit_skb); 2006 dev_queue_xmit(xmit_skb); 2007 } 2008 } 2009 2010 static ieee80211_rx_result debug_noinline 2011 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 2012 { 2013 struct net_device *dev = rx->sdata->dev; 2014 struct sk_buff *skb = rx->skb; 2015 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2016 __le16 fc = hdr->frame_control; 2017 struct sk_buff_head frame_list; 2018 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2019 2020 if (unlikely(!ieee80211_is_data(fc))) 2021 return RX_CONTINUE; 2022 2023 if (unlikely(!ieee80211_is_data_present(fc))) 2024 return RX_DROP_MONITOR; 2025 2026 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2027 return RX_CONTINUE; 2028 2029 if (ieee80211_has_a4(hdr->frame_control) && 2030 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2031 !rx->sdata->u.vlan.sta) 2032 return RX_DROP_UNUSABLE; 2033 2034 if (is_multicast_ether_addr(hdr->addr1) && 2035 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2036 rx->sdata->u.vlan.sta) || 2037 (rx->sdata->vif.type == NL80211_IFTYPE_STATION && 2038 rx->sdata->u.mgd.use_4addr))) 2039 return RX_DROP_UNUSABLE; 2040 2041 skb->dev = dev; 2042 __skb_queue_head_init(&frame_list); 2043 2044 if (skb_linearize(skb)) 2045 return RX_DROP_UNUSABLE; 2046 2047 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2048 rx->sdata->vif.type, 2049 rx->local->hw.extra_tx_headroom, true); 2050 2051 while (!skb_queue_empty(&frame_list)) { 2052 rx->skb = __skb_dequeue(&frame_list); 2053 2054 if (!ieee80211_frame_allowed(rx, fc)) { 2055 dev_kfree_skb(rx->skb); 2056 continue; 2057 } 2058 dev->stats.rx_packets++; 2059 dev->stats.rx_bytes += rx->skb->len; 2060 2061 ieee80211_deliver_skb(rx); 2062 } 2063 2064 return RX_QUEUED; 2065 } 2066 2067 #ifdef CONFIG_MAC80211_MESH 2068 static ieee80211_rx_result 2069 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2070 { 2071 struct ieee80211_hdr *fwd_hdr, *hdr; 2072 struct ieee80211_tx_info *info; 2073 struct ieee80211s_hdr *mesh_hdr; 2074 struct sk_buff *skb = rx->skb, *fwd_skb; 2075 struct ieee80211_local *local = rx->local; 2076 struct ieee80211_sub_if_data *sdata = rx->sdata; 2077 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2078 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2079 u16 q, hdrlen; 2080 2081 hdr = (struct ieee80211_hdr *) skb->data; 2082 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2083 2084 /* make sure fixed part of mesh header is there, also checks skb len */ 2085 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2086 return RX_DROP_MONITOR; 2087 2088 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2089 2090 /* make sure full mesh header is there, also checks skb len */ 2091 if (!pskb_may_pull(rx->skb, 2092 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2093 return RX_DROP_MONITOR; 2094 2095 /* reload pointers */ 2096 hdr = (struct ieee80211_hdr *) skb->data; 2097 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2098 2099 /* frame is in RMC, don't forward */ 2100 if (ieee80211_is_data(hdr->frame_control) && 2101 is_multicast_ether_addr(hdr->addr1) && 2102 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2103 return RX_DROP_MONITOR; 2104 2105 if (!ieee80211_is_data(hdr->frame_control) || 2106 !(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2107 return RX_CONTINUE; 2108 2109 if (!mesh_hdr->ttl) 2110 return RX_DROP_MONITOR; 2111 2112 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2113 struct mesh_path *mppath; 2114 char *proxied_addr; 2115 char *mpp_addr; 2116 2117 if (is_multicast_ether_addr(hdr->addr1)) { 2118 mpp_addr = hdr->addr3; 2119 proxied_addr = mesh_hdr->eaddr1; 2120 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { 2121 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2122 mpp_addr = hdr->addr4; 2123 proxied_addr = mesh_hdr->eaddr2; 2124 } else { 2125 return RX_DROP_MONITOR; 2126 } 2127 2128 rcu_read_lock(); 2129 mppath = mpp_path_lookup(sdata, proxied_addr); 2130 if (!mppath) { 2131 mpp_path_add(sdata, proxied_addr, mpp_addr); 2132 } else { 2133 spin_lock_bh(&mppath->state_lock); 2134 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2135 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2136 spin_unlock_bh(&mppath->state_lock); 2137 } 2138 rcu_read_unlock(); 2139 } 2140 2141 /* Frame has reached destination. Don't forward */ 2142 if (!is_multicast_ether_addr(hdr->addr1) && 2143 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2144 return RX_CONTINUE; 2145 2146 q = ieee80211_select_queue_80211(sdata, skb, hdr); 2147 if (ieee80211_queue_stopped(&local->hw, q)) { 2148 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2149 return RX_DROP_MONITOR; 2150 } 2151 skb_set_queue_mapping(skb, q); 2152 2153 if (!--mesh_hdr->ttl) { 2154 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2155 goto out; 2156 } 2157 2158 if (!ifmsh->mshcfg.dot11MeshForwarding) 2159 goto out; 2160 2161 fwd_skb = skb_copy(skb, GFP_ATOMIC); 2162 if (!fwd_skb) { 2163 net_info_ratelimited("%s: failed to clone mesh frame\n", 2164 sdata->name); 2165 goto out; 2166 } 2167 2168 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2169 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2170 info = IEEE80211_SKB_CB(fwd_skb); 2171 memset(info, 0, sizeof(*info)); 2172 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2173 info->control.vif = &rx->sdata->vif; 2174 info->control.jiffies = jiffies; 2175 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2176 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2177 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2178 /* update power mode indication when forwarding */ 2179 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2180 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2181 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2182 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2183 } else { 2184 /* unable to resolve next hop */ 2185 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2186 fwd_hdr->addr3, 0, 2187 WLAN_REASON_MESH_PATH_NOFORWARD, 2188 fwd_hdr->addr2); 2189 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2190 kfree_skb(fwd_skb); 2191 return RX_DROP_MONITOR; 2192 } 2193 2194 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2195 ieee80211_add_pending_skb(local, fwd_skb); 2196 out: 2197 if (is_multicast_ether_addr(hdr->addr1) || 2198 sdata->dev->flags & IFF_PROMISC) 2199 return RX_CONTINUE; 2200 else 2201 return RX_DROP_MONITOR; 2202 } 2203 #endif 2204 2205 static ieee80211_rx_result debug_noinline 2206 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2207 { 2208 struct ieee80211_sub_if_data *sdata = rx->sdata; 2209 struct ieee80211_local *local = rx->local; 2210 struct net_device *dev = sdata->dev; 2211 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2212 __le16 fc = hdr->frame_control; 2213 bool port_control; 2214 int err; 2215 2216 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2217 return RX_CONTINUE; 2218 2219 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2220 return RX_DROP_MONITOR; 2221 2222 /* 2223 * Send unexpected-4addr-frame event to hostapd. For older versions, 2224 * also drop the frame to cooked monitor interfaces. 2225 */ 2226 if (ieee80211_has_a4(hdr->frame_control) && 2227 sdata->vif.type == NL80211_IFTYPE_AP) { 2228 if (rx->sta && 2229 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2230 cfg80211_rx_unexpected_4addr_frame( 2231 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2232 return RX_DROP_MONITOR; 2233 } 2234 2235 err = __ieee80211_data_to_8023(rx, &port_control); 2236 if (unlikely(err)) 2237 return RX_DROP_UNUSABLE; 2238 2239 if (!ieee80211_frame_allowed(rx, fc)) 2240 return RX_DROP_MONITOR; 2241 2242 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2243 unlikely(port_control) && sdata->bss) { 2244 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2245 u.ap); 2246 dev = sdata->dev; 2247 rx->sdata = sdata; 2248 } 2249 2250 rx->skb->dev = dev; 2251 2252 dev->stats.rx_packets++; 2253 dev->stats.rx_bytes += rx->skb->len; 2254 2255 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2256 !is_multicast_ether_addr( 2257 ((struct ethhdr *)rx->skb->data)->h_dest) && 2258 (!local->scanning && 2259 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) { 2260 mod_timer(&local->dynamic_ps_timer, jiffies + 2261 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2262 } 2263 2264 ieee80211_deliver_skb(rx); 2265 2266 return RX_QUEUED; 2267 } 2268 2269 static ieee80211_rx_result debug_noinline 2270 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2271 { 2272 struct sk_buff *skb = rx->skb; 2273 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2274 struct tid_ampdu_rx *tid_agg_rx; 2275 u16 start_seq_num; 2276 u16 tid; 2277 2278 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2279 return RX_CONTINUE; 2280 2281 if (ieee80211_is_back_req(bar->frame_control)) { 2282 struct { 2283 __le16 control, start_seq_num; 2284 } __packed bar_data; 2285 2286 if (!rx->sta) 2287 return RX_DROP_MONITOR; 2288 2289 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2290 &bar_data, sizeof(bar_data))) 2291 return RX_DROP_MONITOR; 2292 2293 tid = le16_to_cpu(bar_data.control) >> 12; 2294 2295 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2296 if (!tid_agg_rx) 2297 return RX_DROP_MONITOR; 2298 2299 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2300 2301 /* reset session timer */ 2302 if (tid_agg_rx->timeout) 2303 mod_timer(&tid_agg_rx->session_timer, 2304 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2305 2306 spin_lock(&tid_agg_rx->reorder_lock); 2307 /* release stored frames up to start of BAR */ 2308 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2309 start_seq_num, frames); 2310 spin_unlock(&tid_agg_rx->reorder_lock); 2311 2312 kfree_skb(skb); 2313 return RX_QUEUED; 2314 } 2315 2316 /* 2317 * After this point, we only want management frames, 2318 * so we can drop all remaining control frames to 2319 * cooked monitor interfaces. 2320 */ 2321 return RX_DROP_MONITOR; 2322 } 2323 2324 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2325 struct ieee80211_mgmt *mgmt, 2326 size_t len) 2327 { 2328 struct ieee80211_local *local = sdata->local; 2329 struct sk_buff *skb; 2330 struct ieee80211_mgmt *resp; 2331 2332 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2333 /* Not to own unicast address */ 2334 return; 2335 } 2336 2337 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2338 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2339 /* Not from the current AP or not associated yet. */ 2340 return; 2341 } 2342 2343 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2344 /* Too short SA Query request frame */ 2345 return; 2346 } 2347 2348 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2349 if (skb == NULL) 2350 return; 2351 2352 skb_reserve(skb, local->hw.extra_tx_headroom); 2353 resp = (struct ieee80211_mgmt *) skb_put(skb, 24); 2354 memset(resp, 0, 24); 2355 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2356 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2357 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2358 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2359 IEEE80211_STYPE_ACTION); 2360 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2361 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2362 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2363 memcpy(resp->u.action.u.sa_query.trans_id, 2364 mgmt->u.action.u.sa_query.trans_id, 2365 WLAN_SA_QUERY_TR_ID_LEN); 2366 2367 ieee80211_tx_skb(sdata, skb); 2368 } 2369 2370 static ieee80211_rx_result debug_noinline 2371 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2372 { 2373 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2374 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2375 2376 /* 2377 * From here on, look only at management frames. 2378 * Data and control frames are already handled, 2379 * and unknown (reserved) frames are useless. 2380 */ 2381 if (rx->skb->len < 24) 2382 return RX_DROP_MONITOR; 2383 2384 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2385 return RX_DROP_MONITOR; 2386 2387 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2388 ieee80211_is_beacon(mgmt->frame_control) && 2389 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2390 int sig = 0; 2391 2392 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 2393 sig = status->signal; 2394 2395 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2396 rx->skb->data, rx->skb->len, 2397 status->freq, sig); 2398 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2399 } 2400 2401 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2402 return RX_DROP_MONITOR; 2403 2404 if (ieee80211_drop_unencrypted_mgmt(rx)) 2405 return RX_DROP_UNUSABLE; 2406 2407 return RX_CONTINUE; 2408 } 2409 2410 static ieee80211_rx_result debug_noinline 2411 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2412 { 2413 struct ieee80211_local *local = rx->local; 2414 struct ieee80211_sub_if_data *sdata = rx->sdata; 2415 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2416 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2417 int len = rx->skb->len; 2418 2419 if (!ieee80211_is_action(mgmt->frame_control)) 2420 return RX_CONTINUE; 2421 2422 /* drop too small frames */ 2423 if (len < IEEE80211_MIN_ACTION_SIZE) 2424 return RX_DROP_UNUSABLE; 2425 2426 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2427 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 2428 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 2429 return RX_DROP_UNUSABLE; 2430 2431 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2432 return RX_DROP_UNUSABLE; 2433 2434 switch (mgmt->u.action.category) { 2435 case WLAN_CATEGORY_HT: 2436 /* reject HT action frames from stations not supporting HT */ 2437 if (!rx->sta->sta.ht_cap.ht_supported) 2438 goto invalid; 2439 2440 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2441 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2442 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2443 sdata->vif.type != NL80211_IFTYPE_AP && 2444 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2445 break; 2446 2447 /* verify action & smps_control/chanwidth are present */ 2448 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2449 goto invalid; 2450 2451 switch (mgmt->u.action.u.ht_smps.action) { 2452 case WLAN_HT_ACTION_SMPS: { 2453 struct ieee80211_supported_band *sband; 2454 enum ieee80211_smps_mode smps_mode; 2455 2456 /* convert to HT capability */ 2457 switch (mgmt->u.action.u.ht_smps.smps_control) { 2458 case WLAN_HT_SMPS_CONTROL_DISABLED: 2459 smps_mode = IEEE80211_SMPS_OFF; 2460 break; 2461 case WLAN_HT_SMPS_CONTROL_STATIC: 2462 smps_mode = IEEE80211_SMPS_STATIC; 2463 break; 2464 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 2465 smps_mode = IEEE80211_SMPS_DYNAMIC; 2466 break; 2467 default: 2468 goto invalid; 2469 } 2470 2471 /* if no change do nothing */ 2472 if (rx->sta->sta.smps_mode == smps_mode) 2473 goto handled; 2474 rx->sta->sta.smps_mode = smps_mode; 2475 2476 sband = rx->local->hw.wiphy->bands[status->band]; 2477 2478 rate_control_rate_update(local, sband, rx->sta, 2479 IEEE80211_RC_SMPS_CHANGED); 2480 goto handled; 2481 } 2482 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 2483 struct ieee80211_supported_band *sband; 2484 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 2485 enum ieee80211_sta_rx_bandwidth new_bw; 2486 2487 /* If it doesn't support 40 MHz it can't change ... */ 2488 if (!(rx->sta->sta.ht_cap.cap & 2489 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 2490 goto handled; 2491 2492 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 2493 new_bw = IEEE80211_STA_RX_BW_20; 2494 else 2495 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 2496 2497 if (rx->sta->sta.bandwidth == new_bw) 2498 goto handled; 2499 2500 sband = rx->local->hw.wiphy->bands[status->band]; 2501 2502 rate_control_rate_update(local, sband, rx->sta, 2503 IEEE80211_RC_BW_CHANGED); 2504 goto handled; 2505 } 2506 default: 2507 goto invalid; 2508 } 2509 2510 break; 2511 case WLAN_CATEGORY_PUBLIC: 2512 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2513 goto invalid; 2514 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2515 break; 2516 if (!rx->sta) 2517 break; 2518 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2519 break; 2520 if (mgmt->u.action.u.ext_chan_switch.action_code != 2521 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 2522 break; 2523 if (len < offsetof(struct ieee80211_mgmt, 2524 u.action.u.ext_chan_switch.variable)) 2525 goto invalid; 2526 goto queue; 2527 case WLAN_CATEGORY_VHT: 2528 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2529 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2530 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2531 sdata->vif.type != NL80211_IFTYPE_AP && 2532 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2533 break; 2534 2535 /* verify action code is present */ 2536 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2537 goto invalid; 2538 2539 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 2540 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 2541 u8 opmode; 2542 2543 /* verify opmode is present */ 2544 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2545 goto invalid; 2546 2547 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode; 2548 2549 ieee80211_vht_handle_opmode(rx->sdata, rx->sta, 2550 opmode, status->band, 2551 false); 2552 goto handled; 2553 } 2554 default: 2555 break; 2556 } 2557 break; 2558 case WLAN_CATEGORY_BACK: 2559 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2560 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2561 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2562 sdata->vif.type != NL80211_IFTYPE_AP && 2563 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2564 break; 2565 2566 /* verify action_code is present */ 2567 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2568 break; 2569 2570 switch (mgmt->u.action.u.addba_req.action_code) { 2571 case WLAN_ACTION_ADDBA_REQ: 2572 if (len < (IEEE80211_MIN_ACTION_SIZE + 2573 sizeof(mgmt->u.action.u.addba_req))) 2574 goto invalid; 2575 break; 2576 case WLAN_ACTION_ADDBA_RESP: 2577 if (len < (IEEE80211_MIN_ACTION_SIZE + 2578 sizeof(mgmt->u.action.u.addba_resp))) 2579 goto invalid; 2580 break; 2581 case WLAN_ACTION_DELBA: 2582 if (len < (IEEE80211_MIN_ACTION_SIZE + 2583 sizeof(mgmt->u.action.u.delba))) 2584 goto invalid; 2585 break; 2586 default: 2587 goto invalid; 2588 } 2589 2590 goto queue; 2591 case WLAN_CATEGORY_SPECTRUM_MGMT: 2592 /* verify action_code is present */ 2593 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2594 break; 2595 2596 switch (mgmt->u.action.u.measurement.action_code) { 2597 case WLAN_ACTION_SPCT_MSR_REQ: 2598 if (status->band != IEEE80211_BAND_5GHZ) 2599 break; 2600 2601 if (len < (IEEE80211_MIN_ACTION_SIZE + 2602 sizeof(mgmt->u.action.u.measurement))) 2603 break; 2604 2605 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2606 break; 2607 2608 ieee80211_process_measurement_req(sdata, mgmt, len); 2609 goto handled; 2610 case WLAN_ACTION_SPCT_CHL_SWITCH: { 2611 u8 *bssid; 2612 if (len < (IEEE80211_MIN_ACTION_SIZE + 2613 sizeof(mgmt->u.action.u.chan_switch))) 2614 break; 2615 2616 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2617 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2618 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2619 break; 2620 2621 if (sdata->vif.type == NL80211_IFTYPE_STATION) 2622 bssid = sdata->u.mgd.bssid; 2623 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 2624 bssid = sdata->u.ibss.bssid; 2625 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 2626 bssid = mgmt->sa; 2627 else 2628 break; 2629 2630 if (!ether_addr_equal(mgmt->bssid, bssid)) 2631 break; 2632 2633 goto queue; 2634 } 2635 } 2636 break; 2637 case WLAN_CATEGORY_SA_QUERY: 2638 if (len < (IEEE80211_MIN_ACTION_SIZE + 2639 sizeof(mgmt->u.action.u.sa_query))) 2640 break; 2641 2642 switch (mgmt->u.action.u.sa_query.action) { 2643 case WLAN_ACTION_SA_QUERY_REQUEST: 2644 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2645 break; 2646 ieee80211_process_sa_query_req(sdata, mgmt, len); 2647 goto handled; 2648 } 2649 break; 2650 case WLAN_CATEGORY_SELF_PROTECTED: 2651 if (len < (IEEE80211_MIN_ACTION_SIZE + 2652 sizeof(mgmt->u.action.u.self_prot.action_code))) 2653 break; 2654 2655 switch (mgmt->u.action.u.self_prot.action_code) { 2656 case WLAN_SP_MESH_PEERING_OPEN: 2657 case WLAN_SP_MESH_PEERING_CLOSE: 2658 case WLAN_SP_MESH_PEERING_CONFIRM: 2659 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2660 goto invalid; 2661 if (sdata->u.mesh.user_mpm) 2662 /* userspace handles this frame */ 2663 break; 2664 goto queue; 2665 case WLAN_SP_MGK_INFORM: 2666 case WLAN_SP_MGK_ACK: 2667 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2668 goto invalid; 2669 break; 2670 } 2671 break; 2672 case WLAN_CATEGORY_MESH_ACTION: 2673 if (len < (IEEE80211_MIN_ACTION_SIZE + 2674 sizeof(mgmt->u.action.u.mesh_action.action_code))) 2675 break; 2676 2677 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2678 break; 2679 if (mesh_action_is_path_sel(mgmt) && 2680 !mesh_path_sel_is_hwmp(sdata)) 2681 break; 2682 goto queue; 2683 } 2684 2685 return RX_CONTINUE; 2686 2687 invalid: 2688 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 2689 /* will return in the next handlers */ 2690 return RX_CONTINUE; 2691 2692 handled: 2693 if (rx->sta) 2694 rx->sta->rx_packets++; 2695 dev_kfree_skb(rx->skb); 2696 return RX_QUEUED; 2697 2698 queue: 2699 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2700 skb_queue_tail(&sdata->skb_queue, rx->skb); 2701 ieee80211_queue_work(&local->hw, &sdata->work); 2702 if (rx->sta) 2703 rx->sta->rx_packets++; 2704 return RX_QUEUED; 2705 } 2706 2707 static ieee80211_rx_result debug_noinline 2708 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 2709 { 2710 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2711 int sig = 0; 2712 2713 /* skip known-bad action frames and return them in the next handler */ 2714 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 2715 return RX_CONTINUE; 2716 2717 /* 2718 * Getting here means the kernel doesn't know how to handle 2719 * it, but maybe userspace does ... include returned frames 2720 * so userspace can register for those to know whether ones 2721 * it transmitted were processed or returned. 2722 */ 2723 2724 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 2725 sig = status->signal; 2726 2727 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 2728 rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) { 2729 if (rx->sta) 2730 rx->sta->rx_packets++; 2731 dev_kfree_skb(rx->skb); 2732 return RX_QUEUED; 2733 } 2734 2735 return RX_CONTINUE; 2736 } 2737 2738 static ieee80211_rx_result debug_noinline 2739 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 2740 { 2741 struct ieee80211_local *local = rx->local; 2742 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2743 struct sk_buff *nskb; 2744 struct ieee80211_sub_if_data *sdata = rx->sdata; 2745 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2746 2747 if (!ieee80211_is_action(mgmt->frame_control)) 2748 return RX_CONTINUE; 2749 2750 /* 2751 * For AP mode, hostapd is responsible for handling any action 2752 * frames that we didn't handle, including returning unknown 2753 * ones. For all other modes we will return them to the sender, 2754 * setting the 0x80 bit in the action category, as required by 2755 * 802.11-2012 9.24.4. 2756 * Newer versions of hostapd shall also use the management frame 2757 * registration mechanisms, but older ones still use cooked 2758 * monitor interfaces so push all frames there. 2759 */ 2760 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 2761 (sdata->vif.type == NL80211_IFTYPE_AP || 2762 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 2763 return RX_DROP_MONITOR; 2764 2765 if (is_multicast_ether_addr(mgmt->da)) 2766 return RX_DROP_MONITOR; 2767 2768 /* do not return rejected action frames */ 2769 if (mgmt->u.action.category & 0x80) 2770 return RX_DROP_UNUSABLE; 2771 2772 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 2773 GFP_ATOMIC); 2774 if (nskb) { 2775 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 2776 2777 nmgmt->u.action.category |= 0x80; 2778 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 2779 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 2780 2781 memset(nskb->cb, 0, sizeof(nskb->cb)); 2782 2783 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 2784 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 2785 2786 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 2787 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 2788 IEEE80211_TX_CTL_NO_CCK_RATE; 2789 if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) 2790 info->hw_queue = 2791 local->hw.offchannel_tx_hw_queue; 2792 } 2793 2794 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 2795 status->band); 2796 } 2797 dev_kfree_skb(rx->skb); 2798 return RX_QUEUED; 2799 } 2800 2801 static ieee80211_rx_result debug_noinline 2802 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 2803 { 2804 struct ieee80211_sub_if_data *sdata = rx->sdata; 2805 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 2806 __le16 stype; 2807 2808 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 2809 2810 if (!ieee80211_vif_is_mesh(&sdata->vif) && 2811 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2812 sdata->vif.type != NL80211_IFTYPE_STATION) 2813 return RX_DROP_MONITOR; 2814 2815 switch (stype) { 2816 case cpu_to_le16(IEEE80211_STYPE_AUTH): 2817 case cpu_to_le16(IEEE80211_STYPE_BEACON): 2818 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 2819 /* process for all: mesh, mlme, ibss */ 2820 break; 2821 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 2822 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 2823 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 2824 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 2825 if (is_multicast_ether_addr(mgmt->da) && 2826 !is_broadcast_ether_addr(mgmt->da)) 2827 return RX_DROP_MONITOR; 2828 2829 /* process only for station */ 2830 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2831 return RX_DROP_MONITOR; 2832 break; 2833 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 2834 /* process only for ibss and mesh */ 2835 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 2836 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2837 return RX_DROP_MONITOR; 2838 break; 2839 default: 2840 return RX_DROP_MONITOR; 2841 } 2842 2843 /* queue up frame and kick off work to process it */ 2844 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2845 skb_queue_tail(&sdata->skb_queue, rx->skb); 2846 ieee80211_queue_work(&rx->local->hw, &sdata->work); 2847 if (rx->sta) 2848 rx->sta->rx_packets++; 2849 2850 return RX_QUEUED; 2851 } 2852 2853 /* TODO: use IEEE80211_RX_FRAGMENTED */ 2854 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 2855 struct ieee80211_rate *rate) 2856 { 2857 struct ieee80211_sub_if_data *sdata; 2858 struct ieee80211_local *local = rx->local; 2859 struct sk_buff *skb = rx->skb, *skb2; 2860 struct net_device *prev_dev = NULL; 2861 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2862 int needed_headroom; 2863 2864 /* 2865 * If cooked monitor has been processed already, then 2866 * don't do it again. If not, set the flag. 2867 */ 2868 if (rx->flags & IEEE80211_RX_CMNTR) 2869 goto out_free_skb; 2870 rx->flags |= IEEE80211_RX_CMNTR; 2871 2872 /* If there are no cooked monitor interfaces, just free the SKB */ 2873 if (!local->cooked_mntrs) 2874 goto out_free_skb; 2875 2876 /* room for the radiotap header based on driver features */ 2877 needed_headroom = ieee80211_rx_radiotap_space(local, status); 2878 2879 if (skb_headroom(skb) < needed_headroom && 2880 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 2881 goto out_free_skb; 2882 2883 /* prepend radiotap information */ 2884 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 2885 false); 2886 2887 skb_set_mac_header(skb, 0); 2888 skb->ip_summed = CHECKSUM_UNNECESSARY; 2889 skb->pkt_type = PACKET_OTHERHOST; 2890 skb->protocol = htons(ETH_P_802_2); 2891 2892 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 2893 if (!ieee80211_sdata_running(sdata)) 2894 continue; 2895 2896 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 2897 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)) 2898 continue; 2899 2900 if (prev_dev) { 2901 skb2 = skb_clone(skb, GFP_ATOMIC); 2902 if (skb2) { 2903 skb2->dev = prev_dev; 2904 netif_receive_skb(skb2); 2905 } 2906 } 2907 2908 prev_dev = sdata->dev; 2909 sdata->dev->stats.rx_packets++; 2910 sdata->dev->stats.rx_bytes += skb->len; 2911 } 2912 2913 if (prev_dev) { 2914 skb->dev = prev_dev; 2915 netif_receive_skb(skb); 2916 return; 2917 } 2918 2919 out_free_skb: 2920 dev_kfree_skb(skb); 2921 } 2922 2923 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 2924 ieee80211_rx_result res) 2925 { 2926 switch (res) { 2927 case RX_DROP_MONITOR: 2928 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 2929 if (rx->sta) 2930 rx->sta->rx_dropped++; 2931 /* fall through */ 2932 case RX_CONTINUE: { 2933 struct ieee80211_rate *rate = NULL; 2934 struct ieee80211_supported_band *sband; 2935 struct ieee80211_rx_status *status; 2936 2937 status = IEEE80211_SKB_RXCB((rx->skb)); 2938 2939 sband = rx->local->hw.wiphy->bands[status->band]; 2940 if (!(status->flag & RX_FLAG_HT) && 2941 !(status->flag & RX_FLAG_VHT)) 2942 rate = &sband->bitrates[status->rate_idx]; 2943 2944 ieee80211_rx_cooked_monitor(rx, rate); 2945 break; 2946 } 2947 case RX_DROP_UNUSABLE: 2948 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 2949 if (rx->sta) 2950 rx->sta->rx_dropped++; 2951 dev_kfree_skb(rx->skb); 2952 break; 2953 case RX_QUEUED: 2954 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 2955 break; 2956 } 2957 } 2958 2959 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 2960 struct sk_buff_head *frames) 2961 { 2962 ieee80211_rx_result res = RX_DROP_MONITOR; 2963 struct sk_buff *skb; 2964 2965 #define CALL_RXH(rxh) \ 2966 do { \ 2967 res = rxh(rx); \ 2968 if (res != RX_CONTINUE) \ 2969 goto rxh_next; \ 2970 } while (0); 2971 2972 spin_lock_bh(&rx->local->rx_path_lock); 2973 2974 while ((skb = __skb_dequeue(frames))) { 2975 /* 2976 * all the other fields are valid across frames 2977 * that belong to an aMPDU since they are on the 2978 * same TID from the same station 2979 */ 2980 rx->skb = skb; 2981 2982 CALL_RXH(ieee80211_rx_h_check_more_data) 2983 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll) 2984 CALL_RXH(ieee80211_rx_h_sta_process) 2985 CALL_RXH(ieee80211_rx_h_decrypt) 2986 CALL_RXH(ieee80211_rx_h_defragment) 2987 CALL_RXH(ieee80211_rx_h_michael_mic_verify) 2988 /* must be after MMIC verify so header is counted in MPDU mic */ 2989 #ifdef CONFIG_MAC80211_MESH 2990 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 2991 CALL_RXH(ieee80211_rx_h_mesh_fwding); 2992 #endif 2993 CALL_RXH(ieee80211_rx_h_amsdu) 2994 CALL_RXH(ieee80211_rx_h_data) 2995 2996 /* special treatment -- needs the queue */ 2997 res = ieee80211_rx_h_ctrl(rx, frames); 2998 if (res != RX_CONTINUE) 2999 goto rxh_next; 3000 3001 CALL_RXH(ieee80211_rx_h_mgmt_check) 3002 CALL_RXH(ieee80211_rx_h_action) 3003 CALL_RXH(ieee80211_rx_h_userspace_mgmt) 3004 CALL_RXH(ieee80211_rx_h_action_return) 3005 CALL_RXH(ieee80211_rx_h_mgmt) 3006 3007 rxh_next: 3008 ieee80211_rx_handlers_result(rx, res); 3009 3010 #undef CALL_RXH 3011 } 3012 3013 spin_unlock_bh(&rx->local->rx_path_lock); 3014 } 3015 3016 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 3017 { 3018 struct sk_buff_head reorder_release; 3019 ieee80211_rx_result res = RX_DROP_MONITOR; 3020 3021 __skb_queue_head_init(&reorder_release); 3022 3023 #define CALL_RXH(rxh) \ 3024 do { \ 3025 res = rxh(rx); \ 3026 if (res != RX_CONTINUE) \ 3027 goto rxh_next; \ 3028 } while (0); 3029 3030 CALL_RXH(ieee80211_rx_h_check) 3031 3032 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 3033 3034 ieee80211_rx_handlers(rx, &reorder_release); 3035 return; 3036 3037 rxh_next: 3038 ieee80211_rx_handlers_result(rx, res); 3039 3040 #undef CALL_RXH 3041 } 3042 3043 /* 3044 * This function makes calls into the RX path, therefore 3045 * it has to be invoked under RCU read lock. 3046 */ 3047 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3048 { 3049 struct sk_buff_head frames; 3050 struct ieee80211_rx_data rx = { 3051 .sta = sta, 3052 .sdata = sta->sdata, 3053 .local = sta->local, 3054 /* This is OK -- must be QoS data frame */ 3055 .security_idx = tid, 3056 .seqno_idx = tid, 3057 .flags = 0, 3058 }; 3059 struct tid_ampdu_rx *tid_agg_rx; 3060 3061 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3062 if (!tid_agg_rx) 3063 return; 3064 3065 __skb_queue_head_init(&frames); 3066 3067 spin_lock(&tid_agg_rx->reorder_lock); 3068 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3069 spin_unlock(&tid_agg_rx->reorder_lock); 3070 3071 ieee80211_rx_handlers(&rx, &frames); 3072 } 3073 3074 /* main receive path */ 3075 3076 static bool prepare_for_handlers(struct ieee80211_rx_data *rx, 3077 struct ieee80211_hdr *hdr) 3078 { 3079 struct ieee80211_sub_if_data *sdata = rx->sdata; 3080 struct sk_buff *skb = rx->skb; 3081 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3082 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3083 int multicast = is_multicast_ether_addr(hdr->addr1); 3084 3085 switch (sdata->vif.type) { 3086 case NL80211_IFTYPE_STATION: 3087 if (!bssid && !sdata->u.mgd.use_4addr) 3088 return false; 3089 if (!multicast && 3090 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3091 if (!(sdata->dev->flags & IFF_PROMISC) || 3092 sdata->u.mgd.use_4addr) 3093 return false; 3094 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3095 } 3096 break; 3097 case NL80211_IFTYPE_ADHOC: 3098 if (!bssid) 3099 return false; 3100 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3101 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3102 return false; 3103 if (ieee80211_is_beacon(hdr->frame_control)) { 3104 return true; 3105 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) { 3106 return false; 3107 } else if (!multicast && 3108 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3109 if (!(sdata->dev->flags & IFF_PROMISC)) 3110 return false; 3111 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3112 } else if (!rx->sta) { 3113 int rate_idx; 3114 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 3115 rate_idx = 0; /* TODO: HT/VHT rates */ 3116 else 3117 rate_idx = status->rate_idx; 3118 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3119 BIT(rate_idx)); 3120 } 3121 break; 3122 case NL80211_IFTYPE_MESH_POINT: 3123 if (!multicast && 3124 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3125 if (!(sdata->dev->flags & IFF_PROMISC)) 3126 return false; 3127 3128 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3129 } 3130 break; 3131 case NL80211_IFTYPE_AP_VLAN: 3132 case NL80211_IFTYPE_AP: 3133 if (!bssid) { 3134 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3135 return false; 3136 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3137 /* 3138 * Accept public action frames even when the 3139 * BSSID doesn't match, this is used for P2P 3140 * and location updates. Note that mac80211 3141 * itself never looks at these frames. 3142 */ 3143 if (!multicast && 3144 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3145 return false; 3146 if (ieee80211_is_public_action(hdr, skb->len)) 3147 return true; 3148 if (!ieee80211_is_beacon(hdr->frame_control)) 3149 return false; 3150 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3151 } else if (!ieee80211_has_tods(hdr->frame_control)) { 3152 /* ignore data frames to TDLS-peers */ 3153 if (ieee80211_is_data(hdr->frame_control)) 3154 return false; 3155 /* ignore action frames to TDLS-peers */ 3156 if (ieee80211_is_action(hdr->frame_control) && 3157 !ether_addr_equal(bssid, hdr->addr1)) 3158 return false; 3159 } 3160 break; 3161 case NL80211_IFTYPE_WDS: 3162 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3163 return false; 3164 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2)) 3165 return false; 3166 break; 3167 case NL80211_IFTYPE_P2P_DEVICE: 3168 if (!ieee80211_is_public_action(hdr, skb->len) && 3169 !ieee80211_is_probe_req(hdr->frame_control) && 3170 !ieee80211_is_probe_resp(hdr->frame_control) && 3171 !ieee80211_is_beacon(hdr->frame_control)) 3172 return false; 3173 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) && 3174 !multicast) 3175 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3176 break; 3177 default: 3178 /* should never get here */ 3179 WARN_ON_ONCE(1); 3180 break; 3181 } 3182 3183 return true; 3184 } 3185 3186 /* 3187 * This function returns whether or not the SKB 3188 * was destined for RX processing or not, which, 3189 * if consume is true, is equivalent to whether 3190 * or not the skb was consumed. 3191 */ 3192 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 3193 struct sk_buff *skb, bool consume) 3194 { 3195 struct ieee80211_local *local = rx->local; 3196 struct ieee80211_sub_if_data *sdata = rx->sdata; 3197 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3198 struct ieee80211_hdr *hdr = (void *)skb->data; 3199 3200 rx->skb = skb; 3201 status->rx_flags |= IEEE80211_RX_RA_MATCH; 3202 3203 if (!prepare_for_handlers(rx, hdr)) 3204 return false; 3205 3206 if (!consume) { 3207 skb = skb_copy(skb, GFP_ATOMIC); 3208 if (!skb) { 3209 if (net_ratelimit()) 3210 wiphy_debug(local->hw.wiphy, 3211 "failed to copy skb for %s\n", 3212 sdata->name); 3213 return true; 3214 } 3215 3216 rx->skb = skb; 3217 } 3218 3219 ieee80211_invoke_rx_handlers(rx); 3220 return true; 3221 } 3222 3223 /* 3224 * This is the actual Rx frames handler. as it belongs to Rx path it must 3225 * be called with rcu_read_lock protection. 3226 */ 3227 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 3228 struct sk_buff *skb) 3229 { 3230 struct ieee80211_local *local = hw_to_local(hw); 3231 struct ieee80211_sub_if_data *sdata; 3232 struct ieee80211_hdr *hdr; 3233 __le16 fc; 3234 struct ieee80211_rx_data rx; 3235 struct ieee80211_sub_if_data *prev; 3236 struct sta_info *sta, *tmp, *prev_sta; 3237 int err = 0; 3238 3239 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 3240 memset(&rx, 0, sizeof(rx)); 3241 rx.skb = skb; 3242 rx.local = local; 3243 3244 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 3245 local->dot11ReceivedFragmentCount++; 3246 3247 if (ieee80211_is_mgmt(fc)) { 3248 /* drop frame if too short for header */ 3249 if (skb->len < ieee80211_hdrlen(fc)) 3250 err = -ENOBUFS; 3251 else 3252 err = skb_linearize(skb); 3253 } else { 3254 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 3255 } 3256 3257 if (err) { 3258 dev_kfree_skb(skb); 3259 return; 3260 } 3261 3262 hdr = (struct ieee80211_hdr *)skb->data; 3263 ieee80211_parse_qos(&rx); 3264 ieee80211_verify_alignment(&rx); 3265 3266 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 3267 ieee80211_is_beacon(hdr->frame_control))) 3268 ieee80211_scan_rx(local, skb); 3269 3270 if (ieee80211_is_data(fc)) { 3271 prev_sta = NULL; 3272 3273 for_each_sta_info(local, hdr->addr2, sta, tmp) { 3274 if (!prev_sta) { 3275 prev_sta = sta; 3276 continue; 3277 } 3278 3279 rx.sta = prev_sta; 3280 rx.sdata = prev_sta->sdata; 3281 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3282 3283 prev_sta = sta; 3284 } 3285 3286 if (prev_sta) { 3287 rx.sta = prev_sta; 3288 rx.sdata = prev_sta->sdata; 3289 3290 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3291 return; 3292 goto out; 3293 } 3294 } 3295 3296 prev = NULL; 3297 3298 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3299 if (!ieee80211_sdata_running(sdata)) 3300 continue; 3301 3302 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 3303 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 3304 continue; 3305 3306 /* 3307 * frame is destined for this interface, but if it's 3308 * not also for the previous one we handle that after 3309 * the loop to avoid copying the SKB once too much 3310 */ 3311 3312 if (!prev) { 3313 prev = sdata; 3314 continue; 3315 } 3316 3317 rx.sta = sta_info_get_bss(prev, hdr->addr2); 3318 rx.sdata = prev; 3319 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3320 3321 prev = sdata; 3322 } 3323 3324 if (prev) { 3325 rx.sta = sta_info_get_bss(prev, hdr->addr2); 3326 rx.sdata = prev; 3327 3328 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3329 return; 3330 } 3331 3332 out: 3333 dev_kfree_skb(skb); 3334 } 3335 3336 /* 3337 * This is the receive path handler. It is called by a low level driver when an 3338 * 802.11 MPDU is received from the hardware. 3339 */ 3340 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb) 3341 { 3342 struct ieee80211_local *local = hw_to_local(hw); 3343 struct ieee80211_rate *rate = NULL; 3344 struct ieee80211_supported_band *sband; 3345 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3346 3347 WARN_ON_ONCE(softirq_count() == 0); 3348 3349 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS)) 3350 goto drop; 3351 3352 sband = local->hw.wiphy->bands[status->band]; 3353 if (WARN_ON(!sband)) 3354 goto drop; 3355 3356 /* 3357 * If we're suspending, it is possible although not too likely 3358 * that we'd be receiving frames after having already partially 3359 * quiesced the stack. We can't process such frames then since 3360 * that might, for example, cause stations to be added or other 3361 * driver callbacks be invoked. 3362 */ 3363 if (unlikely(local->quiescing || local->suspended)) 3364 goto drop; 3365 3366 /* We might be during a HW reconfig, prevent Rx for the same reason */ 3367 if (unlikely(local->in_reconfig)) 3368 goto drop; 3369 3370 /* 3371 * The same happens when we're not even started, 3372 * but that's worth a warning. 3373 */ 3374 if (WARN_ON(!local->started)) 3375 goto drop; 3376 3377 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 3378 /* 3379 * Validate the rate, unless a PLCP error means that 3380 * we probably can't have a valid rate here anyway. 3381 */ 3382 3383 if (status->flag & RX_FLAG_HT) { 3384 /* 3385 * rate_idx is MCS index, which can be [0-76] 3386 * as documented on: 3387 * 3388 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 3389 * 3390 * Anything else would be some sort of driver or 3391 * hardware error. The driver should catch hardware 3392 * errors. 3393 */ 3394 if (WARN(status->rate_idx > 76, 3395 "Rate marked as an HT rate but passed " 3396 "status->rate_idx is not " 3397 "an MCS index [0-76]: %d (0x%02x)\n", 3398 status->rate_idx, 3399 status->rate_idx)) 3400 goto drop; 3401 } else if (status->flag & RX_FLAG_VHT) { 3402 if (WARN_ONCE(status->rate_idx > 9 || 3403 !status->vht_nss || 3404 status->vht_nss > 8, 3405 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 3406 status->rate_idx, status->vht_nss)) 3407 goto drop; 3408 } else { 3409 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 3410 goto drop; 3411 rate = &sband->bitrates[status->rate_idx]; 3412 } 3413 } 3414 3415 status->rx_flags = 0; 3416 3417 /* 3418 * key references and virtual interfaces are protected using RCU 3419 * and this requires that we are in a read-side RCU section during 3420 * receive processing 3421 */ 3422 rcu_read_lock(); 3423 3424 /* 3425 * Frames with failed FCS/PLCP checksum are not returned, 3426 * all other frames are returned without radiotap header 3427 * if it was previously present. 3428 * Also, frames with less than 16 bytes are dropped. 3429 */ 3430 skb = ieee80211_rx_monitor(local, skb, rate); 3431 if (!skb) { 3432 rcu_read_unlock(); 3433 return; 3434 } 3435 3436 ieee80211_tpt_led_trig_rx(local, 3437 ((struct ieee80211_hdr *)skb->data)->frame_control, 3438 skb->len); 3439 __ieee80211_rx_handle_packet(hw, skb); 3440 3441 rcu_read_unlock(); 3442 3443 return; 3444 drop: 3445 kfree_skb(skb); 3446 } 3447 EXPORT_SYMBOL(ieee80211_rx); 3448 3449 /* This is a version of the rx handler that can be called from hard irq 3450 * context. Post the skb on the queue and schedule the tasklet */ 3451 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 3452 { 3453 struct ieee80211_local *local = hw_to_local(hw); 3454 3455 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 3456 3457 skb->pkt_type = IEEE80211_RX_MSG; 3458 skb_queue_tail(&local->skb_queue, skb); 3459 tasklet_schedule(&local->tasklet); 3460 } 3461 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 3462