projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'asoc-4.18' into asoc-next
[linux-2.6-block.git] / net / mac80211 / rx.c
CommitLineData
571ecf67
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
84040805 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
d98ad83e 6 * Copyright 2013-2014 Intel Mobile Communications GmbH
b7540d8f 7 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
571ecf67
JB		 8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
12 */
13
ab46623e 14#include <linux/jiffies.h>
5a0e3ad6 15#include <linux/slab.h>
571ecf67
JB		 16#include <linux/kernel.h>
17#include <linux/skbuff.h>
18#include <linux/netdevice.h>
19#include <linux/etherdevice.h>
d4e46a3d 20#include <linux/rcupdate.h>
bc3b2d7f 21#include <linux/export.h>
06470f74 22#include <linux/bitops.h>
571ecf67
JB		 23#include <net/mac80211.h>
24#include <net/ieee80211_radiotap.h>
d26ad377 25#include <asm/unaligned.h>
571ecf67
JB		 26
27#include "ieee80211_i.h"
24487981 28#include "driver-ops.h"
2c8dccc7 29#include "led.h"
33b64eb2 30#include "mesh.h"
571ecf67
JB		 31#include "wep.h"
32#include "wpa.h"
33#include "tkip.h"
34#include "wme.h"
1d8d3dec 35#include "rate.h"
571ecf67 36
5a490510
JB		 37static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
38{
39 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
40
41 u64_stats_update_begin(&tstats->syncp);
42 tstats->rx_packets++;
43 tstats->rx_bytes += len;
44 u64_stats_update_end(&tstats->syncp);
45}
46
a6828493
JB		 47static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
48 enum nl80211_iftype type)
49{
50 __le16 fc = hdr->frame_control;
51
52 if (ieee80211_is_data(fc)) {
53 if (len < 24) /* drop incorrect hdr len (data) */
54 return NULL;
55
56 if (ieee80211_has_a4(fc))
57 return NULL;
58 if (ieee80211_has_tods(fc))
59 return hdr->addr1;
60 if (ieee80211_has_fromds(fc))
61 return hdr->addr2;
62
63 return hdr->addr3;
64 }
65
66 if (ieee80211_is_mgmt(fc)) {
67 if (len < 24) /* drop incorrect hdr len (mgmt) */
68 return NULL;
69 return hdr->addr3;
70 }
71
72 if (ieee80211_is_ctl(fc)) {
73 if (ieee80211_is_pspoll(fc))
74 return hdr->addr1;
75
76 if (ieee80211_is_back_req(fc)) {
77 switch (type) {
78 case NL80211_IFTYPE_STATION:
79 return hdr->addr2;
80 case NL80211_IFTYPE_AP:
81 case NL80211_IFTYPE_AP_VLAN:
82 return hdr->addr1;
83 default:
84 break; /* fall through to the return */
85 }
86 }
87 }
88
89 return NULL;
90}
91
b2e7771e
JB		 92/*
93 * monitor mode reception
94 *
95 * This function cleans up the SKB, i.e. it removes all the stuff
96 * only useful for monitoring.
97 */
30841f5c
JB		 98static void remove_monitor_info(struct sk_buff *skb,
99 unsigned int present_fcs_len,
100 unsigned int rtap_vendor_space)
b2e7771e 101{
30841f5c
JB		 102 if (present_fcs_len)
103 __pskb_trim(skb, skb->len - present_fcs_len);
1f7bba79 104 __pskb_pull(skb, rtap_vendor_space);
b2e7771e
JB		 105}
106
1f7bba79
JB		 107static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
108 unsigned int rtap_vendor_space)
b2e7771e 109{
f1d58c25 110 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1f7bba79
JB		 111 struct ieee80211_hdr *hdr;
112
113 hdr = (void *)(skb->data + rtap_vendor_space);
b2e7771e 114
4c298677 115 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
17883048
GB		 116 RX_FLAG_FAILED_PLCP_CRC |
117 RX_FLAG_ONLY_MONITOR))
6b59db7d
ZG		 118 return true;
119
1f7bba79 120 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
6b59db7d
ZG		 121 return true;
122
87228f57
HH		 123 if (ieee80211_is_ctl(hdr->frame_control) &&
124 !ieee80211_is_pspoll(hdr->frame_control) &&
125 !ieee80211_is_back_req(hdr->frame_control))
6b59db7d
ZG		 126 return true;
127
128 return false;
b2e7771e
JB		 129}
130
601ae7f2 131static int
1f7bba79
JB		 132ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
133 struct ieee80211_rx_status *status,
134 struct sk_buff *skb)
601ae7f2
BR		 135{
136 int len;
137
138 /* always present fields */
a144f378 139 len = sizeof(struct ieee80211_radiotap_header) + 8;
601ae7f2 140
a144f378 141 /* allocate extra bitmaps */
a144f378
JB		 142 if (status->chains)
143 len += 4 * hweight8(status->chains);
90b9e446
JB		 144
145 if (ieee80211_have_rx_timestamp(status)) {
146 len = ALIGN(len, 8);
601ae7f2 147 len += 8;
90b9e446 148 }
30686bf7 149 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
601ae7f2 150 len += 1;
601ae7f2 151
a144f378
JB		 152 /* antenna field, if we don't have per-chain info */
153 if (!status->chains)
154 len += 1;
155
90b9e446
JB		 156 /* padding for RX_FLAGS if necessary */
157 len = ALIGN(len, 2);
601ae7f2 158
da6a4352 159 if (status->encoding == RX_ENC_HT) /* HT info */
6d744bac
JB		 160 len += 3;
161
4c298677 162 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
90b9e446 163 len = ALIGN(len, 4);
4c298677
JB		 164 len += 8;
165 }
166
da6a4352 167 if (status->encoding == RX_ENC_VHT) {
51648921
JB		 168 len = ALIGN(len, 2);
169 len += 12;
170 }
171
99ee7cae
JB		 172 if (local->hw.radiotap_timestamp.units_pos >= 0) {
173 len = ALIGN(len, 8);
174 len += 12;
175 }
176
a144f378
JB		 177 if (status->chains) {
178 /* antenna and antenna signal fields */
179 len += 2 * hweight8(status->chains);
180 }
181
1f7bba79
JB		 182 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
183 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
184
185 /* vendor presence bitmap */
186 len += 4;
187 /* alignment for fixed 6-byte vendor data header */
188 len = ALIGN(len, 2);
189 /* vendor data header */
190 len += 6;
191 if (WARN_ON(rtap->align == 0))
192 rtap->align = 1;
193 len = ALIGN(len, rtap->align);
194 len += rtap->len + rtap->pad;
195 }
196
601ae7f2
BR		 197 return len;
198}
199
9e478066
JB		 200static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
201 struct sk_buff *skb,
202 int rtap_vendor_space)
203{
204 struct {
205 struct ieee80211_hdr_3addr hdr;
206 u8 category;
207 u8 action_code;
208 } __packed action;
209
210 if (!sdata)
211 return;
212
213 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
214
215 if (skb->len < rtap_vendor_space + sizeof(action) +
216 VHT_MUMIMO_GROUPS_DATA_LEN)
217 return;
218
219 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
220 return;
221
222 skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));
223
224 if (!ieee80211_is_action(action.hdr.frame_control))
225 return;
226
227 if (action.category != WLAN_CATEGORY_VHT)
228 return;
229
230 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
231 return;
232
233 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
234 return;
235
236 skb = skb_copy(skb, GFP_ATOMIC);
237 if (!skb)
238 return;
239
9e478066
JB		 240 skb_queue_tail(&sdata->skb_queue, skb);
241 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
242}
243
00ea6deb 244/*
601ae7f2
BR		 245 * ieee80211_add_rx_radiotap_header - add radiotap header
246 *
247 * add a radiotap header containing all the fields which the hardware provided.
248 */
249static void
250ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
251 struct sk_buff *skb,
601ae7f2 252 struct ieee80211_rate *rate,
973ef21a 253 int rtap_len, bool has_fcs)
601ae7f2 254{
f1d58c25 255 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
601ae7f2
BR		 256 struct ieee80211_radiotap_header *rthdr;
257 unsigned char *pos;
a144f378
JB		 258 __le32 *it_present;
259 u32 it_present_val;
6a86b9c7 260 u16 rx_flags = 0;
a5e70697 261 u16 channel_flags = 0;
a144f378
JB		 262 int mpdulen, chain;
263 unsigned long chains = status->chains;
1f7bba79
JB		 264 struct ieee80211_vendor_radiotap rtap = {};
265
266 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
267 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
268 /* rtap.len and rtap.pad are undone immediately */
269 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
270 }
f4bda337
TP		 271
272 mpdulen = skb->len;
30686bf7 273 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
f4bda337 274 mpdulen += FCS_LEN;
601ae7f2 275
d58ff351 276 rthdr = skb_push(skb, rtap_len);
1f7bba79 277 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
a144f378 278 it_present = &rthdr->it_present;
601ae7f2
BR		 279
280 /* radiotap header, set always present flags */
0059b2b1 281 rthdr->it_len = cpu_to_le16(rtap_len);
a144f378
JB		 282 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
283 BIT(IEEE80211_RADIOTAP_CHANNEL) |
284 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
285
286 if (!status->chains)
287 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
288
289 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
290 it_present_val |=
291 BIT(IEEE80211_RADIOTAP_EXT) |
292 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
293 put_unaligned_le32(it_present_val, it_present);
294 it_present++;
295 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
296 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
297 }
601ae7f2 298
1f7bba79
JB		 299 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
300 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
301 BIT(IEEE80211_RADIOTAP_EXT);
302 put_unaligned_le32(it_present_val, it_present);
303 it_present++;
304 it_present_val = rtap.present;
305 }
306
a144f378
JB		 307 put_unaligned_le32(it_present_val, it_present);
308
309 pos = (void *)(it_present + 1);
310
601ae7f2
BR		 311 /* the order of the following fields is important */
312
313 /* IEEE80211_RADIOTAP_TSFT */
f4bda337 314 if (ieee80211_have_rx_timestamp(status)) {
90b9e446
JB		 315 /* padding */
316 while ((pos - (u8 *)rthdr) & 7)
317 *pos++ = 0;
f4bda337
TP		 318 put_unaligned_le64(
319 ieee80211_calculate_rx_timestamp(local, status,
320 mpdulen, 0),
321 pos);
1df332e8 322 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
601ae7f2
BR		 323 pos += 8;
324 }
325
326 /* IEEE80211_RADIOTAP_FLAGS */
30686bf7 327 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
601ae7f2 328 *pos |= IEEE80211_RADIOTAP_F_FCS;
aae89831
JB		 329 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
330 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
7fdd69c5 331 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
b4f28bbb 332 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR		 333 pos++;
334
335 /* IEEE80211_RADIOTAP_RATE */
da6a4352 336 if (!rate || status->encoding != RX_ENC_LEGACY) {
0fb8ca45 337 /*
f8d1ccf1 338 * Without rate information don't add it. If we have,
38f37be2 339 * MCS information is a separate field in radiotap,
73b48099
JB		 340 * added below. The byte here is needed as padding
341 * for the channel though, so initialise it to 0.
0fb8ca45
JM		 342 */
343 *pos = 0;
8d6f658e 344 } else {
2103dec1 345 int shift = 0;
ebe6c7ba 346 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
da6a4352 347 if (status->bw == RATE_INFO_BW_10)
2103dec1 348 shift = 1;
da6a4352 349 else if (status->bw == RATE_INFO_BW_5)
2103dec1
SW		 350 shift = 2;
351 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
8d6f658e 352 }
601ae7f2
BR		 353 pos++;
354
355 /* IEEE80211_RADIOTAP_CHANNEL */
6a86b9c7 356 put_unaligned_le16(status->freq, pos);
601ae7f2 357 pos += 2;
da6a4352 358 if (status->bw == RATE_INFO_BW_10)
a5e70697 359 channel_flags |= IEEE80211_CHAN_HALF;
da6a4352 360 else if (status->bw == RATE_INFO_BW_5)
a5e70697
SW		 361 channel_flags |= IEEE80211_CHAN_QUARTER;
362
57fbcce3 363 if (status->band == NL80211_BAND_5GHZ)
a5e70697 364 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
da6a4352 365 else if (status->encoding != RX_ENC_LEGACY)
a5e70697 366 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
f8d1ccf1 367 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
a5e70697 368 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
f8d1ccf1 369 else if (rate)
3a5c5e81 370 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
f8d1ccf1 371 else
a5e70697
SW		 372 channel_flags |= IEEE80211_CHAN_2GHZ;
373 put_unaligned_le16(channel_flags, pos);
601ae7f2
BR		 374 pos += 2;
375
376 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
30686bf7 377 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
fe8431f8 378 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
601ae7f2
BR		 379 *pos = status->signal;
380 rthdr->it_present |=
381 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
382 pos++;
383 }
384
601ae7f2
BR		 385 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
386
a144f378
JB		 387 if (!status->chains) {
388 /* IEEE80211_RADIOTAP_ANTENNA */
389 *pos = status->antenna;
390 pos++;
391 }
601ae7f2 392
601ae7f2
BR		 393 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
394
395 /* IEEE80211_RADIOTAP_RX_FLAGS */
396 /* ensure 2 byte alignment for the 2 byte field as required */
6a86b9c7 397 if ((pos - (u8 *)rthdr) & 1)
90b9e446 398 *pos++ = 0;
aae89831 399 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
6a86b9c7
JB		 400 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
401 put_unaligned_le16(rx_flags, pos);
601ae7f2 402 pos += 2;
6d744bac 403
da6a4352 404 if (status->encoding == RX_ENC_HT) {
786677d1
OR		 405 unsigned int stbc;
406
6d744bac 407 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
ac55d2fe 408 *pos++ = local->hw.radiotap_mcs_details;
6d744bac 409 *pos = 0;
7fdd69c5 410 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
6d744bac 411 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
da6a4352 412 if (status->bw == RATE_INFO_BW_40)
6d744bac 413 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
7fdd69c5 414 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
ac55d2fe 415 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
7fdd69c5 416 if (status->enc_flags & RX_ENC_FLAG_LDPC)
63c361f5 417 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
7fdd69c5 418 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
786677d1 419 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
6d744bac
JB		 420 pos++;
421 *pos++ = status->rate_idx;
422 }
4c298677
JB		 423
424 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
425 u16 flags = 0;
426
427 /* ensure 4 byte alignment */
428 while ((pos - (u8 *)rthdr) & 3)
429 pos++;
430 rthdr->it_present |=
431 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
432 put_unaligned_le32(status->ampdu_reference, pos);
433 pos += 4;
4c298677
JB		 434 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
435 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
436 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
437 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
438 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
439 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
440 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
441 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
7299d6f7
JB		 442 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
443 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
444 if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
445 flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
4c298677
JB		 446 put_unaligned_le16(flags, pos);
447 pos += 2;
448 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
449 *pos++ = status->ampdu_delimiter_crc;
450 else
451 *pos++ = 0;
452 *pos++ = 0;
453 }
90b9e446 454
da6a4352 455 if (status->encoding == RX_ENC_VHT) {
51648921
JB		 456 u16 known = local->hw.radiotap_vht_details;
457
458 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
51648921
JB		 459 put_unaligned_le16(known, pos);
460 pos += 2;
461 /* flags */
7fdd69c5 462 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
51648921 463 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
63c361f5 464 /* in VHT, STBC is binary */
7fdd69c5 465 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
63c361f5 466 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
7fdd69c5 467 if (status->enc_flags & RX_ENC_FLAG_BF)
fb378c23 468 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
51648921
JB		 469 pos++;
470 /* bandwidth */
da6a4352
JB		 471 switch (status->bw) {
472 case RATE_INFO_BW_80:
51648921 473 *pos++ = 4;
da6a4352
JB		 474 break;
475 case RATE_INFO_BW_160:
51648921 476 *pos++ = 11;
da6a4352
JB		 477 break;
478 case RATE_INFO_BW_40:
51648921 479 *pos++ = 1;
da6a4352
JB		 480 break;
481 default:
51648921 482 *pos++ = 0;
da6a4352 483 }
51648921 484 /* MCS/NSS */
8613c948 485 *pos = (status->rate_idx << 4) | status->nss;
51648921
JB		 486 pos += 4;
487 /* coding field */
7fdd69c5 488 if (status->enc_flags & RX_ENC_FLAG_LDPC)
63c361f5 489 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
51648921
JB		 490 pos++;
491 /* group ID */
492 pos++;
493 /* partial_aid */
494 pos += 2;
495 }
496
99ee7cae
JB		 497 if (local->hw.radiotap_timestamp.units_pos >= 0) {
498 u16 accuracy = 0;
499 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
500
501 rthdr->it_present |=
502 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);
503
504 /* ensure 8 byte alignment */
505 while ((pos - (u8 *)rthdr) & 7)
506 pos++;
507
508 put_unaligned_le64(status->device_timestamp, pos);
509 pos += sizeof(u64);
510
511 if (local->hw.radiotap_timestamp.accuracy >= 0) {
512 accuracy = local->hw.radiotap_timestamp.accuracy;
513 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
514 }
515 put_unaligned_le16(accuracy, pos);
516 pos += sizeof(u16);
517
518 *pos++ = local->hw.radiotap_timestamp.units_pos;
519 *pos++ = flags;
520 }
521
a144f378
JB		 522 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
523 *pos++ = status->chain_signal[chain];
524 *pos++ = chain;
525 }
1f7bba79
JB		 526
527 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
528 /* ensure 2 byte alignment for the vendor field as required */
529 if ((pos - (u8 *)rthdr) & 1)
530 *pos++ = 0;
531 *pos++ = rtap.oui[0];
532 *pos++ = rtap.oui[1];
533 *pos++ = rtap.oui[2];
534 *pos++ = rtap.subns;
535 put_unaligned_le16(rtap.len, pos);
536 pos += 2;
537 /* align the actual payload as requested */
538 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
539 *pos++ = 0;
540 /* data (and possible padding) already follows */
541 }
601ae7f2
BR		 542}
543
127f60bf
JB		 544static struct sk_buff *
545ieee80211_make_monitor_skb(struct ieee80211_local *local,
546 struct sk_buff **origskb,
547 struct ieee80211_rate *rate,
548 int rtap_vendor_space, bool use_origskb)
549{
550 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
551 int rt_hdrlen, needed_headroom;
552 struct sk_buff *skb;
553
554 /* room for the radiotap header based on driver features */
555 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
556 needed_headroom = rt_hdrlen - rtap_vendor_space;
557
558 if (use_origskb) {
559 /* only need to expand headroom if necessary */
560 skb = *origskb;
561 *origskb = NULL;
562
563 /*
564 * This shouldn't trigger often because most devices have an
565 * RX header they pull before we get here, and that should
566 * be big enough for our radiotap information. We should
567 * probably export the length to drivers so that we can have
568 * them allocate enough headroom to start with.
569 */
570 if (skb_headroom(skb) < needed_headroom &&
571 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
572 dev_kfree_skb(skb);
573 return NULL;
574 }
575 } else {
576 /*
577 * Need to make a copy and possibly remove radiotap header
578 * and FCS from the original.
579 */
580 skb = skb_copy_expand(*origskb, needed_headroom, 0, GFP_ATOMIC);
581
582 if (!skb)
583 return NULL;
584 }
585
586 /* prepend radiotap information */
587 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
588
589 skb_reset_mac_header(skb);
590 skb->ip_summed = CHECKSUM_UNNECESSARY;
591 skb->pkt_type = PACKET_OTHERHOST;
592 skb->protocol = htons(ETH_P_802_2);
593
594 return skb;
595}
596
b2e7771e
JB		 597/*
598 * This function copies a received frame to all monitor interfaces and
599 * returns a cleaned-up SKB that no longer includes the FCS nor the
600 * radiotap header the driver might have added.
601 */
602static struct sk_buff *
603ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a 604 struct ieee80211_rate *rate)
b2e7771e 605{
f1d58c25 606 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
b2e7771e 607 struct ieee80211_sub_if_data *sdata;
127f60bf 608 struct sk_buff *monskb = NULL;
b2e7771e 609 int present_fcs_len = 0;
1f7bba79 610 unsigned int rtap_vendor_space = 0;
42bd20d9
AE		 611 struct ieee80211_sub_if_data *monitor_sdata =
612 rcu_dereference(local->monitor_sdata);
127f60bf 613 bool only_monitor = false;
1f7bba79
JB		 614
615 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
616 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
617
618 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
619 }
b2e7771e
JB		 620
621 /*
622 * First, we may need to make a copy of the skb because
623 * (1) we need to modify it for radiotap (if not present), and
624 * (2) the other RX handlers will modify the skb we got.
625 *
626 * We don't need to, of course, if we aren't going to return
627 * the SKB because it has a bad FCS/PLCP checksum.
628 */
0869aea0 629
30841f5c
JB		 630 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
631 if (unlikely(origskb->len <= FCS_LEN)) {
632 /* driver bug */
633 WARN_ON(1);
634 dev_kfree_skb(origskb);
635 return NULL;
636 }
b2e7771e 637 present_fcs_len = FCS_LEN;
30841f5c 638 }
b2e7771e 639
1f7bba79
JB		 640 /* ensure hdr->frame_control and vendor radiotap data are in skb head */
641 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
e3cf8b3f
ZY		 642 dev_kfree_skb(origskb);
643 return NULL;
644 }
645
127f60bf
JB		 646 only_monitor = should_drop_frame(origskb, present_fcs_len,
647 rtap_vendor_space);
648
17883048 649 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
127f60bf 650 if (only_monitor) {
b2e7771e
JB		 651 dev_kfree_skb(origskb);
652 return NULL;
653 }
654
30841f5c
JB		 655 remove_monitor_info(origskb, present_fcs_len,
656 rtap_vendor_space);
657 return origskb;
b2e7771e
JB		 658 }
659
9e478066
JB		 660 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);
661
f64331d5 662 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
127f60bf
JB		 663 bool last_monitor = list_is_last(&sdata->u.mntr.list,
664 &local->mon_list);
665
666 if (!monskb)
667 monskb = ieee80211_make_monitor_skb(local, &origskb,
668 rate,
669 rtap_vendor_space,
670 only_monitor &&
671 last_monitor);
672
673 if (monskb) {
674 struct sk_buff *skb;
675
676 if (last_monitor) {
677 skb = monskb;
678 monskb = NULL;
679 } else {
680 skb = skb_clone(monskb, GFP_ATOMIC);
681 }
682
683 if (skb) {
684 skb->dev = sdata->dev;
685 ieee80211_rx_stats(skb->dev, skb->len);
686 netif_receive_skb(skb);
b2e7771e
JB		 687 }
688 }
689
127f60bf
JB		 690 if (last_monitor)
691 break;
b2e7771e
JB		 692 }
693
127f60bf
JB		 694 /* this happens if last_monitor was erroneously false */
695 dev_kfree_skb(monskb);
696
697 /* ditto */
698 if (!origskb)
699 return NULL;
b2e7771e 700
127f60bf 701 remove_monitor_info(origskb, present_fcs_len, rtap_vendor_space);
b2e7771e
JB		 702 return origskb;
703}
704
5cf121c3 705static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 706{
238f74a2 707 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 708 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
9e26297a 709 int tid, seqno_idx, security_idx;
6e0d114d
JB		 710
711 /* does the frame have a qos control field? */
238f74a2
HH		 712 if (ieee80211_is_data_qos(hdr->frame_control)) {
713 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 714 /* frame has qos control */
238f74a2 715 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
04b7dcf9 716 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
554891e6 717 status->rx_flags |= IEEE80211_RX_AMSDU;
9e26297a
JB		 718
719 seqno_idx = tid;
720 security_idx = tid;
6e0d114d 721 } else {
1411f9b5
JB		 722 /*
723 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
724 *
725 * Sequence numbers for management frames, QoS data
726 * frames with a broadcast/multicast address in the
727 * Address 1 field, and all non-QoS data frames sent
728 * by QoS STAs are assigned using an additional single
729 * modulo-4096 counter, [...]
730 *
731 * We also use that counter for non-QoS STAs.
732 */
5a306f58 733 seqno_idx = IEEE80211_NUM_TIDS;
9e26297a
JB		 734 security_idx = 0;
735 if (ieee80211_is_mgmt(hdr->frame_control))
5a306f58 736 security_idx = IEEE80211_NUM_TIDS;
9e26297a 737 tid = 0;
6e0d114d 738 }
52865dfd 739
9e26297a
JB		 740 rx->seqno_idx = seqno_idx;
741 rx->security_idx = security_idx;
6e0d114d
JB		 742 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
743 * For now, set skb->priority to 0 for other cases. */
744 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 745}
6e0d114d 746
d1c3a37c
JB		 747/**
748 * DOC: Packet alignment
749 *
750 * Drivers always need to pass packets that are aligned to two-byte boundaries
751 * to the stack.
752 *
753 * Additionally, should, if possible, align the payload data in a way that
754 * guarantees that the contained IP header is aligned to a four-byte
755 * boundary. In the case of regular frames, this simply means aligning the
756 * payload to a four-byte boundary (because either the IP header is directly
757 * contained, or IV/RFC1042 headers that have a length divisible by four are
59d9cb07
KV		 758 * in front of it). If the payload data is not properly aligned and the
759 * architecture doesn't support efficient unaligned operations, mac80211
760 * will align the data.
d1c3a37c
JB		 761 *
762 * With A-MSDU frames, however, the payload data address must yield two modulo
763 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
764 * push the IP header further back to a multiple of four again. Thankfully, the
765 * specs were sane enough this time around to require padding each A-MSDU
766 * subframe to a length that is a multiple of four.
767 *
25985edc 768 * Padding like Atheros hardware adds which is between the 802.11 header and
d1c3a37c
JB		 769 * the payload is not supported, the driver is required to move the 802.11
770 * header to be directly in front of the payload in that case.
771 */
772static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
38f3714d 773{
59d9cb07 774#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
441275e1 775 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
d1c3a37c 776#endif
6e0d114d
JB		 777}
778
6368e4b1 779
571ecf67
JB		 780/* rx handlers */
781
3cfcf6ac
JM		 782static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
783{
784 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
785
d8ca16db 786 if (is_multicast_ether_addr(hdr->addr1))
3cfcf6ac
JM		 787 return 0;
788
d8ca16db 789 return ieee80211_is_robust_mgmt_frame(skb);
3cfcf6ac
JM		 790}
791
792
793static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
794{
795 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
796
d8ca16db 797 if (!is_multicast_ether_addr(hdr->addr1))
3cfcf6ac
JM		 798 return 0;
799
d8ca16db 800 return ieee80211_is_robust_mgmt_frame(skb);
3cfcf6ac
JM		 801}
802
803
804/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
805static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
806{
807 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
808 struct ieee80211_mmie *mmie;
56c52da2 809 struct ieee80211_mmie_16 *mmie16;
3cfcf6ac 810
1df332e8 811 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
3cfcf6ac
JM		 812 return -1;
813
d8ca16db 814 if (!ieee80211_is_robust_mgmt_frame(skb))
3cfcf6ac
JM		 815 return -1; /* not a robust management frame */
816
817 mmie = (struct ieee80211_mmie *)
818 (skb->data + skb->len - sizeof(*mmie));
56c52da2
JM		 819 if (mmie->element_id == WLAN_EID_MMIE &&
820 mmie->length == sizeof(*mmie) - 2)
821 return le16_to_cpu(mmie->key_id);
822
823 mmie16 = (struct ieee80211_mmie_16 *)
824 (skb->data + skb->len - sizeof(*mmie16));
825 if (skb->len >= 24 + sizeof(*mmie16) &&
826 mmie16->element_id == WLAN_EID_MMIE &&
827 mmie16->length == sizeof(*mmie16) - 2)
828 return le16_to_cpu(mmie16->key_id);
829
830 return -1;
3cfcf6ac
JM		 831}
832
2c61cf9c
JB		 833static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
834 struct sk_buff *skb)
2475b1cc
MS		 835{
836 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
837 __le16 fc;
838 int hdrlen;
839 u8 keyid;
840
841 fc = hdr->frame_control;
842 hdrlen = ieee80211_hdrlen(fc);
843
844 if (skb->len < hdrlen + cs->hdr_len)
845 return -EINVAL;
846
847 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
848 keyid &= cs->key_idx_mask;
849 keyid >>= cs->key_idx_shift;
850
851 return keyid;
852}
853
1df332e8 854static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 855{
a7767f95 856 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
47846c9b 857 char *dev_addr = rx->sdata->vif.addr;
d6d1a5a7 858
a7767f95 859 if (ieee80211_is_data(hdr->frame_control)) {
3c5772a5
JC		 860 if (is_multicast_ether_addr(hdr->addr1)) {
861 if (ieee80211_has_tods(hdr->frame_control) ||
1df332e8 862 !ieee80211_has_fromds(hdr->frame_control))
3c5772a5 863 return RX_DROP_MONITOR;
b203ca39 864 if (ether_addr_equal(hdr->addr3, dev_addr))
3c5772a5
JC		 865 return RX_DROP_MONITOR;
866 } else {
867 if (!ieee80211_has_a4(hdr->frame_control))
868 return RX_DROP_MONITOR;
b203ca39 869 if (ether_addr_equal(hdr->addr4, dev_addr))
3c5772a5
JC		 870 return RX_DROP_MONITOR;
871 }
33b64eb2
LCC		 872 }
873
874 /* If there is not an established peer link and this is not a peer link
875 * establisment frame, beacon or probe, drop the frame.
876 */
877
57cf8043 878 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
33b64eb2 879 struct ieee80211_mgmt *mgmt;
d6d1a5a7 880
a7767f95 881 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC		 882 return RX_DROP_MONITOR;
883
a7767f95 884 if (ieee80211_is_action(hdr->frame_control)) {
d3aaec8a 885 u8 category;
9b395bc3
JB		 886
887 /* make sure category field is present */
888 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
889 return RX_DROP_MONITOR;
890
33b64eb2 891 mgmt = (struct ieee80211_mgmt *)hdr;
d3aaec8a
JC		 892 category = mgmt->u.action.category;
893 if (category != WLAN_CATEGORY_MESH_ACTION &&
1df332e8 894 category != WLAN_CATEGORY_SELF_PROTECTED)
33b64eb2 895 return RX_DROP_MONITOR;
33b64eb2 896 return RX_CONTINUE;
33b64eb2
LCC		 897 }
898
a7767f95
HH		 899 if (ieee80211_is_probe_req(hdr->frame_control) ||
900 ieee80211_is_probe_resp(hdr->frame_control) ||
71839121
JC		 901 ieee80211_is_beacon(hdr->frame_control) ||
902 ieee80211_is_auth(hdr->frame_control))
a7767f95
HH		 903 return RX_CONTINUE;
904
905 return RX_DROP_MONITOR;
a7767f95
HH		 906 }
907
902acc78
JB		 908 return RX_CONTINUE;
909}
33b64eb2 910
fb4ea054
JB		 911static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
912 int index)
913{
914 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
915 struct sk_buff *tail = skb_peek_tail(frames);
916 struct ieee80211_rx_status *status;
917
06470f74
SS		 918 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
919 return true;
920
fb4ea054
JB		 921 if (!tail)
922 return false;
923
924 status = IEEE80211_SKB_RXCB(tail);
925 if (status->flag & RX_FLAG_AMSDU_MORE)
926 return false;
927
928 return true;
929}
930
d3b2fb53 931static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1edfb1af 932 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 933 int index,
934 struct sk_buff_head *frames)
1edfb1af 935{
83eb935e
MK		 936 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
937 struct sk_buff *skb;
4cfda47b 938 struct ieee80211_rx_status *status;
1edfb1af 939
dd318575
JB		 940 lockdep_assert_held(&tid_agg_rx->reorder_lock);
941
83eb935e 942 if (skb_queue_empty(skb_list))
1edfb1af
JB		 943 goto no_frame;
944
fb4ea054 945 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
83eb935e
MK		 946 __skb_queue_purge(skb_list);
947 goto no_frame;
948 }
949
950 /* release frames from the reorder ring buffer */
1edfb1af 951 tid_agg_rx->stored_mpdu_num--;
83eb935e
MK		 952 while ((skb = __skb_dequeue(skb_list))) {
953 status = IEEE80211_SKB_RXCB(skb);
954 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
955 __skb_queue_tail(frames, skb);
956 }
1edfb1af
JB		 957
958no_frame:
06470f74 959 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
9a886586 960 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1edfb1af
JB		 961}
962
d3b2fb53 963static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1edfb1af 964 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 965 u16 head_seq_num,
966 struct sk_buff_head *frames)
1edfb1af
JB		 967{
968 int index;
969
dd318575
JB		 970 lockdep_assert_held(&tid_agg_rx->reorder_lock);
971
9a886586 972 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2e3049b7 973 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
f9e124fb
CL		 974 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
975 frames);
1edfb1af
JB		 976 }
977}
978
979/*
980 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
981 * the skb was added to the buffer longer than this time ago, the earlier
982 * frames that have not yet been received are assumed to be lost and the skb
983 * can be released for processing. This may also release other skb's from the
984 * reorder buffer if there are no additional gaps between the frames.
2bff8ebf
CL		 985 *
986 * Callers must hold tid_agg_rx->reorder_lock.
1edfb1af
JB		 987 */
988#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
989
d3b2fb53 990static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
f9e124fb
CL		 991 struct tid_ampdu_rx *tid_agg_rx,
992 struct sk_buff_head *frames)
aa0c8636 993{
83eb935e 994 int index, i, j;
aa0c8636 995
dd318575
JB		 996 lockdep_assert_held(&tid_agg_rx->reorder_lock);
997
aa0c8636 998 /* release the buffer until next missing frame */
2e3049b7 999 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
fb4ea054 1000 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
07ae2dfc 1001 tid_agg_rx->stored_mpdu_num) {
aa0c8636
CL		 1002 /*
1003 * No buffers ready to be released, but check whether any
1004 * frames in the reorder buffer have timed out.
1005 */
aa0c8636
CL		 1006 int skipped = 1;
1007 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1008 j = (j + 1) % tid_agg_rx->buf_size) {
fb4ea054 1009 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
aa0c8636
CL		 1010 skipped++;
1011 continue;
1012 }
499fe9a4
DH		 1013 if (skipped &&
1014 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
aa0c8636 1015 HT_RX_REORDER_BUF_TIMEOUT))
2bff8ebf 1016 goto set_release_timer;
aa0c8636 1017
83eb935e
MK		 1018 /* don't leave incomplete A-MSDUs around */
1019 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1020 i = (i + 1) % tid_agg_rx->buf_size)
1021 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
1022
bdcbd8e0
JB		 1023 ht_dbg_ratelimited(sdata,
1024 "release an RX reorder frame due to timeout on earlier frames\n");
f9e124fb
CL		 1025 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1026 frames);
aa0c8636
CL		 1027
1028 /*
1029 * Increment the head seq# also for the skipped slots.
1030 */
1031 tid_agg_rx->head_seq_num =
9a886586
JB		 1032 (tid_agg_rx->head_seq_num +
1033 skipped) & IEEE80211_SN_MASK;
aa0c8636
CL		 1034 skipped = 0;
1035 }
fb4ea054 1036 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
f9e124fb
CL		 1037 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1038 frames);
2e3049b7 1039 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
aa0c8636 1040 }
2bff8ebf
CL		 1041
1042 if (tid_agg_rx->stored_mpdu_num) {
2e3049b7 1043 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
2bff8ebf
CL		 1044
1045 for (; j != (index - 1) % tid_agg_rx->buf_size;
1046 j = (j + 1) % tid_agg_rx->buf_size) {
fb4ea054 1047 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
2bff8ebf
CL		 1048 break;
1049 }
1050
1051 set_release_timer:
1052
788211d8
JB		 1053 if (!tid_agg_rx->removed)
1054 mod_timer(&tid_agg_rx->reorder_timer,
1055 tid_agg_rx->reorder_time[j] + 1 +
1056 HT_RX_REORDER_BUF_TIMEOUT);
2bff8ebf
CL		 1057 } else {
1058 del_timer(&tid_agg_rx->reorder_timer);
1059 }
aa0c8636
CL		 1060}
1061
1edfb1af
JB		 1062/*
1063 * As this function belongs to the RX path it must be under
1064 * rcu_read_lock protection. It returns false if the frame
1065 * can be processed immediately, true if it was consumed.
1066 */
d3b2fb53 1067static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1edfb1af 1068 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 1069 struct sk_buff *skb,
1070 struct sk_buff_head *frames)
1edfb1af
JB		 1071{
1072 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
83eb935e 1073 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1edfb1af
JB		 1074 u16 sc = le16_to_cpu(hdr->seq_ctrl);
1075 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1076 u16 head_seq_num, buf_size;
1077 int index;
2bff8ebf 1078 bool ret = true;
1edfb1af 1079
dd318575
JB		 1080 spin_lock(&tid_agg_rx->reorder_lock);
1081
4549cf2b
MK		 1082 /*
1083 * Offloaded BA sessions have no known starting sequence number so pick
1084 * one from first Rxed frame for this tid after BA was started.
1085 */
1086 if (unlikely(tid_agg_rx->auto_seq)) {
1087 tid_agg_rx->auto_seq = false;
1088 tid_agg_rx->ssn = mpdu_seq_num;
1089 tid_agg_rx->head_seq_num = mpdu_seq_num;
1090 }
1091
1edfb1af
JB		 1092 buf_size = tid_agg_rx->buf_size;
1093 head_seq_num = tid_agg_rx->head_seq_num;
1094
b7540d8f
SS		 1095 /*
1096 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1097 * be reordered.
1098 */
1099 if (unlikely(!tid_agg_rx->started)) {
1100 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1101 ret = false;
1102 goto out;
1103 }
1104 tid_agg_rx->started = true;
1105 }
1106
1edfb1af 1107 /* frame with out of date sequence number */
9a886586 1108 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1edfb1af 1109 dev_kfree_skb(skb);
2bff8ebf 1110 goto out;
1edfb1af
JB		 1111 }
1112
1113 /*
1114 * If frame the sequence number exceeds our buffering window
1115 * size release some previous frames to make room for this one.
1116 */
9a886586
JB		 1117 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1118 head_seq_num = ieee80211_sn_inc(
1119 ieee80211_sn_sub(mpdu_seq_num, buf_size));
1edfb1af 1120 /* release stored frames up to new head to stack */
d3b2fb53 1121 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
f9e124fb 1122 head_seq_num, frames);
1edfb1af
JB		 1123 }
1124
1125 /* Now the new frame is always in the range of the reordering buffer */
1126
2e3049b7 1127 index = mpdu_seq_num % tid_agg_rx->buf_size;
1edfb1af
JB		 1128
1129 /* check if we already stored this frame */
fb4ea054 1130 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1edfb1af 1131 dev_kfree_skb(skb);
2bff8ebf 1132 goto out;
1edfb1af
JB		 1133 }
1134
1135 /*
1136 * If the current MPDU is in the right order and nothing else
1137 * is stored we can process it directly, no need to buffer it.
c835b214
JB		 1138 * If it is first but there's something stored, we may be able
1139 * to release frames after this one.
1edfb1af
JB		 1140 */
1141 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1142 tid_agg_rx->stored_mpdu_num == 0) {
83eb935e
MK		 1143 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1144 tid_agg_rx->head_seq_num =
1145 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
2bff8ebf
CL		 1146 ret = false;
1147 goto out;
1edfb1af
JB		 1148 }
1149
1150 /* put the frame in the reordering buffer */
83eb935e
MK		 1151 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1152 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1153 tid_agg_rx->reorder_time[index] = jiffies;
1154 tid_agg_rx->stored_mpdu_num++;
1155 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1156 }
1edfb1af 1157
2bff8ebf
CL		 1158 out:
1159 spin_unlock(&tid_agg_rx->reorder_lock);
1160 return ret;
1edfb1af
JB		 1161}
1162
1163/*
1164 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1165 * true if the MPDU was buffered, false if it should be processed.
1166 */
f9e124fb
CL		 1167static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1168 struct sk_buff_head *frames)
1edfb1af 1169{
2569a826
JB		 1170 struct sk_buff *skb = rx->skb;
1171 struct ieee80211_local *local = rx->local;
1edfb1af 1172 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2569a826 1173 struct sta_info *sta = rx->sta;
1edfb1af
JB		 1174 struct tid_ampdu_rx *tid_agg_rx;
1175 u16 sc;
6cc00d54 1176 u8 tid, ack_policy;
1edfb1af 1177
051a41fa
JB		 1178 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1179 is_multicast_ether_addr(hdr->addr1))
2569a826 1180 goto dont_reorder;
1edfb1af
JB		 1181
1182 /*
1183 * filter the QoS data rx stream according to
1184 * STA/TID and check if this STA/TID is on aggregation
1185 */
1186
1edfb1af 1187 if (!sta)
2569a826 1188 goto dont_reorder;
1edfb1af 1189
6cc00d54
TP		 1190 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1191 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
a1f2ba04 1192 tid = ieee80211_get_tid(hdr);
1edfb1af 1193
a87f736d 1194 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
bfe40fa3
JB		 1195 if (!tid_agg_rx) {
1196 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1197 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1198 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1199 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1200 WLAN_BACK_RECIPIENT,
1201 WLAN_REASON_QSTA_REQUIRE_SETUP);
a87f736d 1202 goto dont_reorder;
bfe40fa3 1203 }
1edfb1af
JB		 1204
1205 /* qos null data frames are excluded */
1206 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
a87f736d 1207 goto dont_reorder;
1edfb1af 1208
6cc00d54
TP		 1209 /* not part of a BA session */
1210 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1211 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1212 goto dont_reorder;
1213
1edfb1af
JB		 1214 /* new, potentially un-ordered, ampdu frame - process it */
1215
1216 /* reset session timer */
1217 if (tid_agg_rx->timeout)
12d3952f 1218 tid_agg_rx->last_rx = jiffies;
1edfb1af
JB		 1219
1220 /* if this mpdu is fragmented - terminate rx aggregation session */
1221 sc = le16_to_cpu(hdr->seq_ctrl);
1222 if (sc & IEEE80211_SCTL_FRAG) {
344eec67
JB		 1223 skb_queue_tail(&rx->sdata->skb_queue, skb);
1224 ieee80211_queue_work(&local->hw, &rx->sdata->work);
2569a826 1225 return;
1edfb1af
JB		 1226 }
1227
a87f736d
JB		 1228 /*
1229 * No locking needed -- we will only ever process one
1230 * RX packet at a time, and thus own tid_agg_rx. All
1231 * other code manipulating it needs to (and does) make
1232 * sure that we cannot get to it any more before doing
1233 * anything with it.
1234 */
f9e124fb
CL		 1235 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1236 frames))
2569a826
JB		 1237 return;
1238
1239 dont_reorder:
f9e124fb 1240 __skb_queue_tail(frames, skb);
1edfb1af 1241}
33b64eb2 1242
49461622 1243static ieee80211_rx_result debug_noinline
0395442a 1244ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
571ecf67 1245{
a7767f95 1246 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 1247 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 1248
f9cfa5f3
SS		 1249 if (status->flag & RX_FLAG_DUP_VALIDATED)
1250 return RX_CONTINUE;
1251
6b0f3274
JB		 1252 /*
1253 * Drop duplicate 802.11 retransmissions
1254 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1255 */
0395442a
JB		 1256
1257 if (rx->skb->len < 24)
1258 return RX_CONTINUE;
1259
1260 if (ieee80211_is_ctl(hdr->frame_control) ||
1261 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
1262 is_multicast_ether_addr(hdr->addr1))
1263 return RX_CONTINUE;
1264
a732fa70
JB		 1265 if (!rx->sta)
1266 return RX_CONTINUE;
1267
1268 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1269 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1270 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
e5a9f8d0 1271 rx->sta->rx_stats.num_duplicates++;
a732fa70
JB		 1272 return RX_DROP_UNUSABLE;
1273 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1274 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
571ecf67
JB		 1275 }
1276
0395442a
JB		 1277 return RX_CONTINUE;
1278}
1279
1280static ieee80211_rx_result debug_noinline
1281ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1282{
1283 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1284
571ecf67
JB		 1285 /* Drop disallowed frame classes based on STA auth/assoc state;
1286 * IEEE 802.11, Chap 5.5.
1287 *
ccd7b362
JB		 1288 * mac80211 filters only based on association state, i.e. it drops
1289 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB		 1290 * deauth/disassoc frames when needed. In addition, hostapd is
1291 * responsible for filtering on both auth and assoc states.
1292 */
33b64eb2 1293
902acc78 1294 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 1295 return ieee80211_rx_mesh_check(rx);
33b64eb2 1296
a7767f95
HH		 1297 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1298 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 1299 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1be7fe8d 1300 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
239281f8 1301 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
c2c98fde 1302 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
7852e361
JB		 1303 /*
1304 * accept port control frames from the AP even when it's not
1305 * yet marked ASSOC to prevent a race where we don't set the
1306 * assoc bit quickly enough before it sends the first frame
1307 */
1308 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
2a33bee2 1309 ieee80211_is_data_present(hdr->frame_control)) {
6dbda2d0
JB		 1310 unsigned int hdrlen;
1311 __be16 ethertype;
1312
1313 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1314
1315 if (rx->skb->len < hdrlen + 8)
1316 return RX_DROP_MONITOR;
1317
1318 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1319 if (ethertype == rx->sdata->control_port_protocol)
2a33bee2
GE		 1320 return RX_CONTINUE;
1321 }
21fc7560
JB		 1322
1323 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1324 cfg80211_rx_spurious_frame(rx->sdata->dev,
1325 hdr->addr2,
1326 GFP_ATOMIC))
1327 return RX_DROP_UNUSABLE;
1328
e4c26add 1329 return RX_DROP_MONITOR;
2a33bee2 1330 }
571ecf67 1331
9ae54c84 1332 return RX_CONTINUE;
570bd537
JB		 1333}
1334
1335
572e0012
KV		 1336static ieee80211_rx_result debug_noinline
1337ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1338{
1339 struct ieee80211_local *local;
1340 struct ieee80211_hdr *hdr;
1341 struct sk_buff *skb;
1342
1343 local = rx->local;
1344 skb = rx->skb;
1345 hdr = (struct ieee80211_hdr *) skb->data;
1346
1347 if (!local->pspolling)
1348 return RX_CONTINUE;
1349
1350 if (!ieee80211_has_fromds(hdr->frame_control))
1351 /* this is not from AP */
1352 return RX_CONTINUE;
1353
1354 if (!ieee80211_is_data(hdr->frame_control))
1355 return RX_CONTINUE;
1356
1357 if (!ieee80211_has_moredata(hdr->frame_control)) {
1358 /* AP has no more frames buffered for us */
1359 local->pspolling = false;
1360 return RX_CONTINUE;
1361 }
1362
1363 /* more data bit is set, let's request a new frame from the AP */
1364 ieee80211_send_pspoll(local, rx->sdata);
1365
1366 return RX_CONTINUE;
1367}
1368
d012a605 1369static void sta_ps_start(struct sta_info *sta)
571ecf67 1370{
133b8226 1371 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 1372 struct ieee80211_local *local = sdata->local;
d012a605 1373 struct ps_data *ps;
ba8c3d6f 1374 int tid;
0795af57 1375
d012a605
MP		 1376 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1377 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1378 ps = &sdata->bss->ps;
1379 else
1380 return;
1381
1382 atomic_inc(&ps->num_sta_ps);
c2c98fde 1383 set_sta_flag(sta, WLAN_STA_PS_STA);
30686bf7 1384 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
d057e5a3 1385 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
bdcbd8e0
JB		 1386 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1387 sta->sta.addr, sta->sta.aid);
ba8c3d6f 1388
17c18bf8
JB		 1389 ieee80211_clear_fast_xmit(sta);
1390
ba8c3d6f
FF		 1391 if (!sta->sta.txq[0])
1392 return;
1393
1394 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
bb42f2d1 1395 if (txq_has_queue(sta->sta.txq[tid]))
ba8c3d6f
FF		 1396 set_bit(tid, &sta->txq_buffered_tids);
1397 else
1398 clear_bit(tid, &sta->txq_buffered_tids);
1399 }
571ecf67
JB		 1400}
1401
d012a605 1402static void sta_ps_end(struct sta_info *sta)
571ecf67 1403{
bdcbd8e0
JB		 1404 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1405 sta->sta.addr, sta->sta.aid);
004c872e 1406
c2c98fde 1407 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
e3685e03
JB		 1408 /*
1409 * Clear the flag only if the other one is still set
1410 * so that the TX path won't start TX'ing new frames
1411 * directly ... In the case that the driver flag isn't
1412 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1413 */
1414 clear_sta_flag(sta, WLAN_STA_PS_STA);
bdcbd8e0
JB		 1415 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1416 sta->sta.addr, sta->sta.aid);
af818581
JB		 1417 return;
1418 }
1419
5ac2e350
JB		 1420 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1421 clear_sta_flag(sta, WLAN_STA_PS_STA);
af818581 1422 ieee80211_sta_ps_deliver_wakeup(sta);
571ecf67
JB		 1423}
1424
cf47161a 1425int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
d057e5a3 1426{
cf47161a 1427 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
d057e5a3
AN		 1428 bool in_ps;
1429
cf47161a 1430 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
d057e5a3
AN		 1431
1432 /* Don't let the same PS state be set twice */
cf47161a 1433 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
d057e5a3
AN		 1434 if ((start && in_ps) || (!start && !in_ps))
1435 return -EINVAL;
1436
1437 if (start)
cf47161a 1438 sta_ps_start(sta);
d057e5a3 1439 else
cf47161a 1440 sta_ps_end(sta);
d057e5a3
AN		 1441
1442 return 0;
1443}
1444EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1445
46fa38e8
JB		 1446void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1447{
1448 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1449
1450 if (test_sta_flag(sta, WLAN_STA_SP))
1451 return;
1452
1453 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1454 ieee80211_sta_ps_deliver_poll_response(sta);
1455 else
1456 set_sta_flag(sta, WLAN_STA_PSPOLL);
1457}
1458EXPORT_SYMBOL(ieee80211_sta_pspoll);
1459
1460void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1461{
1462 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
731977e9 1463 int ac = ieee80211_ac_from_tid(tid);
46fa38e8
JB		 1464
1465 /*
0aa419ec
EG		 1466 * If this AC is not trigger-enabled do nothing unless the
1467 * driver is calling us after it already checked.
46fa38e8
JB		 1468 *
1469 * NB: This could/should check a separate bitmap of trigger-
1470 * enabled queues, but for now we only implement uAPSD w/o
1471 * TSPEC changes to the ACs, so they're always the same.
1472 */
f438ceb8
EG		 1473 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1474 tid != IEEE80211_NUM_TIDS)
46fa38e8
JB		 1475 return;
1476
1477 /* if we are in a service period, do nothing */
1478 if (test_sta_flag(sta, WLAN_STA_SP))
1479 return;
1480
1481 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1482 ieee80211_sta_ps_deliver_uapsd(sta);
1483 else
1484 set_sta_flag(sta, WLAN_STA_UAPSD);
1485}
1486EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1487
47086fc5
JB		 1488static ieee80211_rx_result debug_noinline
1489ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1490{
1491 struct ieee80211_sub_if_data *sdata = rx->sdata;
1492 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1493 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
47086fc5 1494
5c90067c 1495 if (!rx->sta)
47086fc5
JB		 1496 return RX_CONTINUE;
1497
1498 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1499 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1500 return RX_CONTINUE;
1501
1502 /*
1503 * The device handles station powersave, so don't do anything about
1504 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1505 * it to mac80211 since they're handled.)
1506 */
30686bf7 1507 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
47086fc5
JB		 1508 return RX_CONTINUE;
1509
1510 /*
1511 * Don't do anything if the station isn't already asleep. In
1512 * the uAPSD case, the station will probably be marked asleep,
1513 * in the PS-Poll case the station must be confused ...
1514 */
c2c98fde 1515 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
47086fc5
JB		 1516 return RX_CONTINUE;
1517
1518 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
46fa38e8 1519 ieee80211_sta_pspoll(&rx->sta->sta);
47086fc5
JB		 1520
1521 /* Free PS Poll skb here instead of returning RX_DROP that would
1522 * count as an dropped frame. */
1523 dev_kfree_skb(rx->skb);
1524
1525 return RX_QUEUED;
1526 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1527 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1528 ieee80211_has_pm(hdr->frame_control) &&
1529 (ieee80211_is_data_qos(hdr->frame_control) ||
1530 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
a1f2ba04 1531 u8 tid = ieee80211_get_tid(hdr);
47086fc5 1532
46fa38e8 1533 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
47086fc5
JB		 1534 }
1535
1536 return RX_CONTINUE;
1537}
1538
49461622 1539static ieee80211_rx_result debug_noinline
5cf121c3 1540ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB		 1541{
1542 struct sta_info *sta = rx->sta;
eb9fb5b8
JB		 1543 struct sk_buff *skb = rx->skb;
1544 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1545 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
ef0621e8 1546 int i;
571ecf67
JB		 1547
1548 if (!sta)
9ae54c84 1549 return RX_CONTINUE;
571ecf67 1550
b291ba11
JB		 1551 /*
1552 * Update last_rx only for IBSS packets which are for the current
e584da5e
AQ		 1553 * BSSID and for station already AUTHORIZED to avoid keeping the
1554 * current IBSS network alive in cases where other STAs start
1555 * using different BSSID. This will also give the station another
1556 * chance to restart the authentication/authorization in case
1557 * something went wrong the first time.
b291ba11 1558 */
05c914fe 1559 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 1560 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 1561 NL80211_IFTYPE_ADHOC);
e584da5e
AQ		 1562 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1563 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
e5a9f8d0 1564 sta->rx_stats.last_rx = jiffies;
f4ebddf9 1565 if (ieee80211_is_data(hdr->frame_control) &&
4f6b1b3d
JB		 1566 !is_multicast_ether_addr(hdr->addr1))
1567 sta->rx_stats.last_rate =
1568 sta_stats_encode_rate(status);
3af6334c 1569 }
239281f8 1570 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
e5a9f8d0 1571 sta->rx_stats.last_rx = jiffies;
b291ba11
JB		 1572 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1573 /*
33b64eb2
LCC		 1574 * Mesh beacons will update last_rx when if they are found to
1575 * match the current local configuration when processed.
571ecf67 1576 */
e5a9f8d0 1577 sta->rx_stats.last_rx = jiffies;
4f6b1b3d
JB		 1578 if (ieee80211_is_data(hdr->frame_control))
1579 sta->rx_stats.last_rate = sta_stats_encode_rate(status);
571ecf67
JB		 1580 }
1581
3cf335d5
KV		 1582 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1583 ieee80211_sta_rx_notify(rx->sdata, hdr);
1584
e5a9f8d0 1585 sta->rx_stats.fragments++;
0f9c5a61
JB		 1586
1587 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
e5a9f8d0 1588 sta->rx_stats.bytes += rx->skb->len;
0f9c5a61
JB		 1589 u64_stats_update_end(&rx->sta->rx_stats.syncp);
1590
fe8431f8 1591 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
e5a9f8d0 1592 sta->rx_stats.last_signal = status->signal;
0be6ed13 1593 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal);
fe8431f8 1594 }
571ecf67 1595
ef0621e8 1596 if (status->chains) {
e5a9f8d0 1597 sta->rx_stats.chains = status->chains;
ef0621e8
FF		 1598 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1599 int signal = status->chain_signal[i];
1600
1601 if (!(status->chains & BIT(i)))
1602 continue;
1603
e5a9f8d0 1604 sta->rx_stats.chain_signal_last[i] = signal;
0be6ed13 1605 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
e5a9f8d0 1606 -signal);
ef0621e8
FF		 1607 }
1608 }
1609
72eaa43a
JB		 1610 /*
1611 * Change STA power saving mode only at the end of a frame
9fef6544
EG		 1612 * exchange sequence, and only for a data or management
1613 * frame as specified in IEEE 802.11-2016 11.2.3.2
72eaa43a 1614 */
30686bf7 1615 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
d057e5a3 1616 !ieee80211_has_morefrags(hdr->frame_control) &&
9fef6544
EG		 1617 (ieee80211_is_mgmt(hdr->frame_control) ||
1618 ieee80211_is_data(hdr->frame_control)) &&
4cfda47b 1619 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
05c914fe 1620 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
9fef6544 1621 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
c2c98fde 1622 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
b4ba544c 1623 if (!ieee80211_has_pm(hdr->frame_control))
d012a605 1624 sta_ps_end(sta);
72eaa43a
JB		 1625 } else {
1626 if (ieee80211_has_pm(hdr->frame_control))
d012a605 1627 sta_ps_start(sta);
72eaa43a 1628 }
571ecf67
JB		 1629 }
1630
3f52b7e3
MP		 1631 /* mesh power save support */
1632 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1633 ieee80211_mps_rx_h_sta_process(sta, hdr);
1634
22403def
JB		 1635 /*
1636 * Drop (qos-)data::nullfunc frames silently, since they
1637 * are used only to control station power saving mode.
1638 */
1639 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1640 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
571ecf67 1641 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
d524215f
FF		 1642
1643 /*
1644 * If we receive a 4-addr nullfunc frame from a STA
e7f4a940
JB		 1645 * that was not moved to a 4-addr STA vlan yet send
1646 * the event to userspace and for older hostapd drop
1647 * the frame to the monitor interface.
d524215f
FF		 1648 */
1649 if (ieee80211_has_a4(hdr->frame_control) &&
1650 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1651 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
e7f4a940
JB		 1652 !rx->sdata->u.vlan.sta))) {
1653 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1654 cfg80211_rx_unexpected_4addr_frame(
1655 rx->sdata->dev, sta->sta.addr,
1656 GFP_ATOMIC);
d524215f 1657 return RX_DROP_MONITOR;
e7f4a940 1658 }
22403def
JB		 1659 /*
1660 * Update counter and free packet here to avoid
1661 * counting this as a dropped packed.
1662 */
e5a9f8d0 1663 sta->rx_stats.packets++;
571ecf67 1664 dev_kfree_skb(rx->skb);
9ae54c84 1665 return RX_QUEUED;
571ecf67
JB		 1666 }
1667
9ae54c84 1668 return RX_CONTINUE;
571ecf67
JB		 1669} /* ieee80211_rx_h_sta_process */
1670
86c228a7
JA		 1671static ieee80211_rx_result debug_noinline
1672ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1673{
1674 struct sk_buff *skb = rx->skb;
1675 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1676 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1677 int keyidx;
1678 int hdrlen;
1679 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1680 struct ieee80211_key *sta_ptk = NULL;
1681 int mmie_keyidx = -1;
1682 __le16 fc;
2475b1cc 1683 const struct ieee80211_cipher_scheme *cs = NULL;
86c228a7
JA		 1684
1685 /*
1686 * Key selection 101
1687 *
1688 * There are four types of keys:
1689 * - GTK (group keys)
1690 * - IGTK (group keys for management frames)
1691 * - PTK (pairwise keys)
1692 * - STK (station-to-station pairwise keys)
1693 *
1694 * When selecting a key, we have to distinguish between multicast
1695 * (including broadcast) and unicast frames, the latter can only
1696 * use PTKs and STKs while the former always use GTKs and IGTKs.
1697 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1698 * unicast frames can also use key indices like GTKs. Hence, if we
1699 * don't have a PTK/STK we check the key index for a WEP key.
1700 *
1701 * Note that in a regular BSS, multicast frames are sent by the
1702 * AP only, associated stations unicast the frame to the AP first
1703 * which then multicasts it on their behalf.
1704 *
1705 * There is also a slight problem in IBSS mode: GTKs are negotiated
1706 * with each station, that is something we don't currently handle.
1707 * The spec seems to expect that one negotiates the same key with
1708 * every station but there's no such requirement; VLANs could be
1709 * possible.
1710 */
1711
86c228a7
JA		 1712 /* start without a key */
1713 rx->key = NULL;
2475b1cc 1714 fc = hdr->frame_control;
86c228a7 1715
2475b1cc
MS		 1716 if (rx->sta) {
1717 int keyid = rx->sta->ptk_idx;
86c228a7 1718
2475b1cc
MS		 1719 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1720 cs = rx->sta->cipher_scheme;
2c61cf9c 1721 keyid = ieee80211_get_cs_keyid(cs, rx->skb);
2475b1cc
MS		 1722 if (unlikely(keyid < 0))
1723 return RX_DROP_UNUSABLE;
1724 }
1725 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1726 }
86c228a7
JA		 1727
1728 if (!ieee80211_has_protected(fc))
1729 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1730
1731 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1732 rx->key = sta_ptk;
1733 if ((status->flag & RX_FLAG_DECRYPTED) &&
1734 (status->flag & RX_FLAG_IV_STRIPPED))
1735 return RX_CONTINUE;
1736 /* Skip decryption if the frame is not protected. */
1737 if (!ieee80211_has_protected(fc))
1738 return RX_CONTINUE;
1739 } else if (mmie_keyidx >= 0) {
1740 /* Broadcast/multicast robust management frame / BIP */
1741 if ((status->flag & RX_FLAG_DECRYPTED) &&
1742 (status->flag & RX_FLAG_IV_STRIPPED))
1743 return RX_CONTINUE;
1744
1745 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1746 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1747 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
46f6b060
MH		 1748 if (rx->sta) {
1749 if (ieee80211_is_group_privacy_action(skb) &&
1750 test_sta_flag(rx->sta, WLAN_STA_MFP))
1751 return RX_DROP_MONITOR;
1752
86c228a7 1753 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
46f6b060 1754 }
86c228a7
JA		 1755 if (!rx->key)
1756 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1757 } else if (!ieee80211_has_protected(fc)) {
1758 /*
1759 * The frame was not protected, so skip decryption. However, we
1760 * need to set rx->key if there is a key that could have been
1761 * used so that the frame may be dropped if encryption would
1762 * have been expected.
1763 */
1764 struct ieee80211_key *key = NULL;
1765 struct ieee80211_sub_if_data *sdata = rx->sdata;
1766 int i;
1767
1768 if (ieee80211_is_mgmt(fc) &&
1769 is_multicast_ether_addr(hdr->addr1) &&
1770 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1771 rx->key = key;
1772 else {
1773 if (rx->sta) {
1774 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1775 key = rcu_dereference(rx->sta->gtk[i]);
1776 if (key)
1777 break;
1778 }
1779 }
1780 if (!key) {
1781 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1782 key = rcu_dereference(sdata->keys[i]);
1783 if (key)
1784 break;
1785 }
1786 }
1787 if (key)
1788 rx->key = key;
1789 }
1790 return RX_CONTINUE;
1791 } else {
1792 u8 keyid;
2475b1cc 1793
86c228a7
JA		 1794 /*
1795 * The device doesn't give us the IV so we won't be
1796 * able to look up the key. That's ok though, we
1797 * don't need to decrypt the frame, we just won't
1798 * be able to keep statistics accurate.
1799 * Except for key threshold notifications, should
1800 * we somehow allow the driver to tell us which key
1801 * the hardware used if this flag is set?
1802 */
1803 if ((status->flag & RX_FLAG_DECRYPTED) &&
1804 (status->flag & RX_FLAG_IV_STRIPPED))
1805 return RX_CONTINUE;
1806
1807 hdrlen = ieee80211_hdrlen(fc);
1808
2475b1cc 1809 if (cs) {
2c61cf9c 1810 keyidx = ieee80211_get_cs_keyid(cs, rx->skb);
86c228a7 1811
2475b1cc
MS		 1812 if (unlikely(keyidx < 0))
1813 return RX_DROP_UNUSABLE;
1814 } else {
1815 if (rx->skb->len < 8 + hdrlen)
1816 return RX_DROP_UNUSABLE; /* TODO: count this? */
1817 /*
1818 * no need to call ieee80211_wep_get_keyidx,
1819 * it verifies a bunch of things we've done already
1820 */
1821 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1822 keyidx = keyid >> 6;
1823 }
86c228a7
JA		 1824
1825 /* check per-station GTK first, if multicast packet */
1826 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1827 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1828
1829 /* if not found, try default key */
1830 if (!rx->key) {
1831 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1832
1833 /*
1834 * RSNA-protected unicast frames should always be
1835 * sent with pairwise or station-to-station keys,
1836 * but for WEP we allow using a key index as well.
1837 */
1838 if (rx->key &&
1839 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1840 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1841 !is_multicast_ether_addr(hdr->addr1))
1842 rx->key = NULL;
1843 }
1844 }
1845
1846 if (rx->key) {
1847 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1848 return RX_DROP_MONITOR;
1849
86c228a7
JA		 1850 /* TODO: add threshold stuff again */
1851 } else {
1852 return RX_DROP_MONITOR;
1853 }
1854
1855 switch (rx->key->conf.cipher) {
1856 case WLAN_CIPHER_SUITE_WEP40:
1857 case WLAN_CIPHER_SUITE_WEP104:
1858 result = ieee80211_crypto_wep_decrypt(rx);
1859 break;
1860 case WLAN_CIPHER_SUITE_TKIP:
1861 result = ieee80211_crypto_tkip_decrypt(rx);
1862 break;
1863 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db
JM		 1864 result = ieee80211_crypto_ccmp_decrypt(
1865 rx, IEEE80211_CCMP_MIC_LEN);
1866 break;
1867 case WLAN_CIPHER_SUITE_CCMP_256:
1868 result = ieee80211_crypto_ccmp_decrypt(
1869 rx, IEEE80211_CCMP_256_MIC_LEN);
86c228a7
JA		 1870 break;
1871 case WLAN_CIPHER_SUITE_AES_CMAC:
1872 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1873 break;
56c52da2
JM		 1874 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1875 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
1876 break;
8ade538b
JM		 1877 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1878 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1879 result = ieee80211_crypto_aes_gmac_decrypt(rx);
1880 break;
00b9cfa3
JM		 1881 case WLAN_CIPHER_SUITE_GCMP:
1882 case WLAN_CIPHER_SUITE_GCMP_256:
1883 result = ieee80211_crypto_gcmp_decrypt(rx);
1884 break;
86c228a7 1885 default:
2475b1cc 1886 result = ieee80211_crypto_hw_decrypt(rx);
86c228a7
JA		 1887 }
1888
1889 /* the hdr variable is invalid after the decrypt handlers */
1890
1891 /* either the frame has been decrypted or will be dropped */
1892 status->flag |= RX_FLAG_DECRYPTED;
1893
1894 return result;
1895}
1896
571ecf67
JB		 1897static inline struct ieee80211_fragment_entry *
1898ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1899 unsigned int frag, unsigned int seq, int rx_queue,
1900 struct sk_buff **skb)
1901{
1902 struct ieee80211_fragment_entry *entry;
571ecf67 1903
571ecf67
JB		 1904 entry = &sdata->fragments[sdata->fragment_next++];
1905 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1906 sdata->fragment_next = 0;
1907
bdcbd8e0 1908 if (!skb_queue_empty(&entry->skb_list))
571ecf67 1909 __skb_queue_purge(&entry->skb_list);
571ecf67
JB		 1910
1911 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1912 *skb = NULL;
1913 entry->first_frag_time = jiffies;
1914 entry->seq = seq;
1915 entry->rx_queue = rx_queue;
1916 entry->last_frag = frag;
9acc54be 1917 entry->check_sequential_pn = false;
571ecf67
JB		 1918 entry->extra_len = 0;
1919
1920 return entry;
1921}
1922
1923static inline struct ieee80211_fragment_entry *
1924ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
b73d70ad 1925 unsigned int frag, unsigned int seq,
571ecf67
JB		 1926 int rx_queue, struct ieee80211_hdr *hdr)
1927{
1928 struct ieee80211_fragment_entry *entry;
1929 int i, idx;
1930
1931 idx = sdata->fragment_next;
1932 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1933 struct ieee80211_hdr *f_hdr;
571ecf67
JB		 1934
1935 idx--;
1936 if (idx < 0)
1937 idx = IEEE80211_FRAGMENT_MAX - 1;
1938
1939 entry = &sdata->fragments[idx];
1940 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1941 entry->rx_queue != rx_queue ||
1942 entry->last_frag + 1 != frag)
1943 continue;
1944
b73d70ad 1945 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
571ecf67 1946
b73d70ad
HH		 1947 /*
1948 * Check ftype and addresses are equal, else check next fragment
1949 */
1950 if (((hdr->frame_control ^ f_hdr->frame_control) &
1951 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
b203ca39
JP		 1952 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1953 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
571ecf67
JB		 1954 continue;
1955
ab46623e 1956 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB		 1957 __skb_queue_purge(&entry->skb_list);
1958 continue;
1959 }
1960 return entry;
1961 }
1962
1963 return NULL;
1964}
1965
49461622 1966static ieee80211_rx_result debug_noinline
5cf121c3 1967ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67
JB		 1968{
1969 struct ieee80211_hdr *hdr;
1970 u16 sc;
358c8d9d 1971 __le16 fc;
571ecf67
JB		 1972 unsigned int frag, seq;
1973 struct ieee80211_fragment_entry *entry;
1974 struct sk_buff *skb;
1975
b73d70ad 1976 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 1977 fc = hdr->frame_control;
f7fbf70e
JC		 1978
1979 if (ieee80211_is_ctl(fc))
1980 return RX_CONTINUE;
1981
571ecf67
JB		 1982 sc = le16_to_cpu(hdr->seq_ctrl);
1983 frag = sc & IEEE80211_SCTL_FRAG;
1984
b8fff407 1985 if (is_multicast_ether_addr(hdr->addr1)) {
c206ca67 1986 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
d025933e 1987 goto out_no_led;
571ecf67 1988 }
b8fff407 1989
d025933e
AM		 1990 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1991 goto out;
1992
571ecf67
JB		 1993 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1994
e3cf8b3f
ZY		 1995 if (skb_linearize(rx->skb))
1996 return RX_DROP_UNUSABLE;
1997
058897a4
AK		 1998 /*
1999 * skb_linearize() might change the skb->data and
2000 * previously cached variables (in this case, hdr) need to
2001 * be refreshed with the new data.
2002 */
2003 hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB		 2004 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2005
2006 if (frag == 0) {
2007 /* This is the first fragment of a new frame. */
2008 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
9e26297a 2009 rx->seqno_idx, &(rx->skb));
2b2ba0db
JM		 2010 if (rx->key &&
2011 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
9acc54be
JB		 2012 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2013 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2014 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
358c8d9d 2015 ieee80211_has_protected(fc)) {
9e26297a 2016 int queue = rx->security_idx;
9acc54be
JB		 2017
2018 /* Store CCMP/GCMP PN so that we can verify that the
2019 * next fragment has a sequential PN value.
2020 */
2021 entry->check_sequential_pn = true;
571ecf67 2022 memcpy(entry->last_pn,
9190252c 2023 rx->key->u.ccmp.rx_pn[queue],
4325f6ca 2024 IEEE80211_CCMP_PN_LEN);
9acc54be
JB		 2025 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2026 u.ccmp.rx_pn) !=
2027 offsetof(struct ieee80211_key,
2028 u.gcmp.rx_pn));
2029 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2030 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2031 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2032 IEEE80211_GCMP_PN_LEN);
571ecf67 2033 }
9ae54c84 2034 return RX_QUEUED;
571ecf67
JB		 2035 }
2036
2037 /* This is a fragment for a frame that should already be pending in
2038 * fragment cache. Add this fragment to the end of the pending entry.
2039 */
9e26297a
JB		 2040 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
2041 rx->seqno_idx, hdr);
571ecf67
JB		 2042 if (!entry) {
2043 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 2044 return RX_DROP_MONITOR;
571ecf67
JB		 2045 }
2046
9acc54be
JB		 2047 /* "The receiver shall discard MSDUs and MMPDUs whose constituent
2048 * MPDU PN values are not incrementing in steps of 1."
2049 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2050 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2051 */
2052 if (entry->check_sequential_pn) {
571ecf67 2053 int i;
4325f6ca 2054 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
9190252c 2055 int queue;
9acc54be 2056
2b2ba0db
JM		 2057 if (!rx->key ||
2058 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
9acc54be
JB		 2059 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
2060 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
2061 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
e4c26add 2062 return RX_DROP_UNUSABLE;
4325f6ca
JB		 2063 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2064 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
571ecf67
JB		 2065 pn[i]++;
2066 if (pn[i])
2067 break;
2068 }
9e26297a 2069 queue = rx->security_idx;
9190252c 2070 rpn = rx->key->u.ccmp.rx_pn[queue];
4325f6ca 2071 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
e4c26add 2072 return RX_DROP_UNUSABLE;
4325f6ca 2073 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
571ecf67
JB		 2074 }
2075
358c8d9d 2076 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB		 2077 __skb_queue_tail(&entry->skb_list, rx->skb);
2078 entry->last_frag = frag;
2079 entry->extra_len += rx->skb->len;
358c8d9d 2080 if (ieee80211_has_morefrags(fc)) {
571ecf67 2081 rx->skb = NULL;
9ae54c84 2082 return RX_QUEUED;
571ecf67
JB		 2083 }
2084
2085 rx->skb = __skb_dequeue(&entry->skb_list);
2086 if (skb_tailroom(rx->skb) < entry->extra_len) {
f1160434 2087 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
571ecf67
JB		 2088 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2089 GFP_ATOMIC))) {
2090 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2091 __skb_queue_purge(&entry->skb_list);
e4c26add 2092 return RX_DROP_UNUSABLE;
571ecf67
JB		 2093 }
2094 }
2095 while ((skb = __skb_dequeue(&entry->skb_list))) {
59ae1d12 2096 skb_put_data(rx->skb, skb->data, skb->len);
571ecf67
JB		 2097 dev_kfree_skb(skb);
2098 }
2099
571ecf67 2100 out:
d025933e
AM		 2101 ieee80211_led_rx(rx->local);
2102 out_no_led:
571ecf67 2103 if (rx->sta)
e5a9f8d0 2104 rx->sta->rx_stats.packets++;
9ae54c84 2105 return RX_CONTINUE;
571ecf67
JB		 2106}
2107
1df332e8 2108static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 2109{
1df332e8 2110 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 2111 return -EACCES;
571ecf67 2112
76ee65bf 2113 return 0;
571ecf67
JB		 2114}
2115
1df332e8 2116static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 2117{
eb9fb5b8
JB		 2118 struct sk_buff *skb = rx->skb;
2119 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2120
3017b80b 2121 /*
7848ba7d
JB		 2122 * Pass through unencrypted frames if the hardware has
2123 * decrypted them already.
3017b80b 2124 */
eb9fb5b8 2125 if (status->flag & RX_FLAG_DECRYPTED)
76ee65bf 2126 return 0;
571ecf67
JB		 2127
2128 /* Drop unencrypted frames if key is set. */
358c8d9d
HH		 2129 if (unlikely(!ieee80211_has_protected(fc) &&
2130 !ieee80211_is_nullfunc(fc) &&
e8f4fb7c 2131 ieee80211_is_data(fc) && rx->key))
76ee65bf 2132 return -EACCES;
bef5d1c7
JB		 2133
2134 return 0;
2135}
2136
1df332e8 2137static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
bef5d1c7
JB		 2138{
2139 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
e3efca0a 2140 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
bef5d1c7 2141 __le16 fc = hdr->frame_control;
bef5d1c7 2142
e3efca0a
JM		 2143 /*
2144 * Pass through unencrypted frames if the hardware has
2145 * decrypted them already.
2146 */
2147 if (status->flag & RX_FLAG_DECRYPTED)
2148 return 0;
bef5d1c7 2149
c2c98fde 2150 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
d211e90e
JM		 2151 if (unlikely(!ieee80211_has_protected(fc) &&
2152 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
cf4e594e 2153 rx->key)) {
6ff57cf8
JB		 2154 if (ieee80211_is_deauth(fc) ||
2155 ieee80211_is_disassoc(fc))
2156 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2157 rx->skb->data,
2158 rx->skb->len);
f2ca3ea4 2159 return -EACCES;
cf4e594e 2160 }
f2ca3ea4 2161 /* BIP does not use Protected field, so need to check MMIE */
f64f9e71 2162 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
cf4e594e 2163 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
6ff57cf8
JB		 2164 if (ieee80211_is_deauth(fc) ||
2165 ieee80211_is_disassoc(fc))
2166 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2167 rx->skb->data,
2168 rx->skb->len);
f2ca3ea4 2169 return -EACCES;
cf4e594e 2170 }
f2ca3ea4
JM		 2171 /*
2172 * When using MFP, Action frames are not allowed prior to
2173 * having configured keys.
2174 */
2175 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
d8ca16db 2176 ieee80211_is_robust_mgmt_frame(rx->skb)))
f2ca3ea4
JM		 2177 return -EACCES;
2178 }
b3fc9c6c 2179
76ee65bf 2180 return 0;
571ecf67
JB		 2181}
2182
76ee65bf 2183static int
4114fa21 2184__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
571ecf67 2185{
eb9fb5b8 2186 struct ieee80211_sub_if_data *sdata = rx->sdata;
f14543ee 2187 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
fbb327c5
FF		 2188 bool check_port_control = false;
2189 struct ethhdr *ehdr;
2190 int ret;
f14543ee 2191
4114fa21 2192 *port_control = false;
9bc383de
JB		 2193 if (ieee80211_has_a4(hdr->frame_control) &&
2194 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
f14543ee 2195 return -1;
9bc383de 2196
fbb327c5
FF		 2197 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2198 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2199
2200 if (!sdata->u.mgd.use_4addr)
2201 return -1;
2202 else
2203 check_port_control = true;
2204 }
2205
9bc383de 2206 if (is_multicast_ether_addr(hdr->addr1) &&
fbb327c5 2207 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
f14543ee 2208 return -1;
571ecf67 2209
fbb327c5 2210 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
4114fa21 2211 if (ret < 0)
fbb327c5
FF		 2212 return ret;
2213
2214 ehdr = (struct ethhdr *) rx->skb->data;
4114fa21
FF		 2215 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2216 *port_control = true;
2217 else if (check_port_control)
fbb327c5
FF		 2218 return -1;
2219
2220 return 0;
76ee65bf 2221}
571ecf67 2222
ce3edf6d
JB		 2223/*
2224 * requires that rx->skb is a frame with ethernet header
2225 */
358c8d9d 2226static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 2227{
c97c23e3 2228 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB		 2229 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2230 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2231
2232 /*
2233 * Allow EAPOL frames to us/the PAE group address regardless
2234 * of whether the frame was encrypted or not.
2235 */
a621fa4d 2236 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
3bc7945e
JP		 2237 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2238 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
ce3edf6d
JB		 2239 return true;
2240
2241 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 2242 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB		 2243 return false;
2244
2245 return true;
2246}
2247
018f6fbf
DK		 2248static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2249 struct ieee80211_rx_data *rx)
2250{
2251 struct ieee80211_sub_if_data *sdata = rx->sdata;
2252 struct net_device *dev = sdata->dev;
2253
2254 if (unlikely((skb->protocol == sdata->control_port_protocol ||
2255 skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) &&
2256 sdata->control_port_over_nl80211)) {
2257 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2258 bool noencrypt = status->flag & RX_FLAG_DECRYPTED;
2259 struct ethhdr *ehdr = eth_hdr(skb);
2260
2261 cfg80211_rx_control_port(dev, skb->data, skb->len,
2262 ehdr->h_source,
2263 be16_to_cpu(skb->protocol), noencrypt);
2264 dev_kfree_skb(skb);
2265 } else {
2266 /* deliver to local stack */
2267 if (rx->napi)
2268 napi_gro_receive(rx->napi, skb);
2269 else
2270 netif_receive_skb(skb);
2271 }
2272}
2273
ce3edf6d
JB		 2274/*
2275 * requires that rx->skb is a frame with ethernet header
2276 */
76ee65bf 2277static void
5cf121c3 2278ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf 2279{
eb9fb5b8
JB		 2280 struct ieee80211_sub_if_data *sdata = rx->sdata;
2281 struct net_device *dev = sdata->dev;
76ee65bf 2282 struct sk_buff *skb, *xmit_skb;
ce3edf6d
JB		 2283 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2284 struct sta_info *dsta;
571ecf67 2285
76ee65bf
RR		 2286 skb = rx->skb;
2287 xmit_skb = NULL;
571ecf67 2288
5a490510
JB		 2289 ieee80211_rx_stats(dev, skb->len);
2290
de8f18d3
JB		 2291 if (rx->sta) {
2292 /* The seqno index has the same property as needed
2293 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2294 * for non-QoS-data frames. Here we know it's a data
2295 * frame, so count MSDUs.
2296 */
0f9c5a61 2297 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
de8f18d3 2298 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
0f9c5a61 2299 u64_stats_update_end(&rx->sta->rx_stats.syncp);
de8f18d3
JB		 2300 }
2301
05c914fe
JB		 2302 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2303 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 2304 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
9bc383de 2305 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
72f15d53
MB		 2306 if (is_multicast_ether_addr(ehdr->h_dest) &&
2307 ieee80211_vif_get_num_mcast_if(sdata) != 0) {
ce3edf6d
JB		 2308 /*
2309 * send multicast frames both to higher layers in
2310 * local net stack and back to the wireless medium
2311 */
76ee65bf 2312 xmit_skb = skb_copy(skb, GFP_ATOMIC);
e87cc472 2313 if (!xmit_skb)
bdcbd8e0 2314 net_info_ratelimited("%s: failed to clone multicast frame\n",
e87cc472 2315 dev->name);
72f15d53 2316 } else if (!is_multicast_ether_addr(ehdr->h_dest)) {
abe60632
JB		 2317 dsta = sta_info_get(sdata, skb->data);
2318 if (dsta) {
ce3edf6d
JB		 2319 /*
2320 * The destination station is associated to
2321 * this AP (in this VLAN), so send the frame
2322 * directly to it and do not pass it to local
2323 * net stack.
571ecf67 2324 */
76ee65bf 2325 xmit_skb = skb;
571ecf67
JB		 2326 skb = NULL;
2327 }
571ecf67
JB		 2328 }
2329 }
2330
59d9cb07 2331#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
9e890a1f
JB		 2332 if (skb) {
2333 /* 'align' will only take the values 0 or 2 here since all
2334 * frames are required to be aligned to 2-byte boundaries
2335 * when being passed to mac80211; the code here works just
2336 * as well if that isn't true, but mac80211 assumes it can
2337 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
d1c3a37c 2338 */
9e890a1f
JB		 2339 int align;
2340
2341 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
d1c3a37c
JB		 2342 if (align) {
2343 if (WARN_ON(skb_headroom(skb) < 3)) {
2344 dev_kfree_skb(skb);
2345 skb = NULL;
2346 } else {
2347 u8 *data = skb->data;
8ce0b589
ZY		 2348 size_t len = skb_headlen(skb);
2349 skb->data -= align;
2350 memmove(skb->data, data, len);
2351 skb_set_tail_pointer(skb, len);
d1c3a37c
JB		 2352 }
2353 }
9e890a1f 2354 }
d1c3a37c
JB		 2355#endif
2356
9e890a1f 2357 if (skb) {
9e890a1f
JB		 2358 skb->protocol = eth_type_trans(skb, dev);
2359 memset(skb->cb, 0, sizeof(skb->cb));
018f6fbf
DK		 2360
2361 ieee80211_deliver_skb_to_local_stack(skb, rx);
571ecf67
JB		 2362 }
2363
76ee65bf 2364 if (xmit_skb) {
aef6c928
HS		 2365 /*
2366 * Send to wireless media and increase priority by 256 to
2367 * keep the received priority instead of reclassifying
2368 * the frame (see cfg80211_classify8021d).
2369 */
2370 xmit_skb->priority += 256;
f831e909 2371 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB		 2372 skb_reset_network_header(xmit_skb);
2373 skb_reset_mac_header(xmit_skb);
76ee65bf 2374 dev_queue_xmit(xmit_skb);
571ecf67 2375 }
76ee65bf
RR		 2376}
2377
49461622 2378static ieee80211_rx_result debug_noinline
24bba078 2379__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
fd4c7f2f 2380{
eb9fb5b8 2381 struct net_device *dev = rx->sdata->dev;
eaf85ca7 2382 struct sk_buff *skb = rx->skb;
358c8d9d
HH		 2383 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2384 __le16 fc = hdr->frame_control;
eaf85ca7 2385 struct sk_buff_head frame_list;
7f6990c8 2386 struct ethhdr ethhdr;
e2b5227f 2387 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
fd4c7f2f 2388
ea720935 2389 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
e2b5227f
JB		 2390 check_da = NULL;
2391 check_sa = NULL;
2392 } else switch (rx->sdata->vif.type) {
2393 case NL80211_IFTYPE_AP:
2394 case NL80211_IFTYPE_AP_VLAN:
2395 check_da = NULL;
2396 break;
2397 case NL80211_IFTYPE_STATION:
2398 if (!rx->sta ||
2399 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
2400 check_sa = NULL;
2401 break;
2402 case NL80211_IFTYPE_MESH_POINT:
2403 check_sa = NULL;
2404 break;
2405 default:
2406 break;
ea720935 2407 }
fd4c7f2f 2408
eaf85ca7
ZY		 2409 skb->dev = dev;
2410 __skb_queue_head_init(&frame_list);
fd4c7f2f 2411
7f6990c8
JB		 2412 if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
2413 rx->sdata->vif.addr,
24bba078
FF		 2414 rx->sdata->vif.type,
2415 data_offset))
7f6990c8
JB		 2416 return RX_DROP_UNUSABLE;
2417
eaf85ca7
ZY		 2418 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2419 rx->sdata->vif.type,
8b935ee2 2420 rx->local->hw.extra_tx_headroom,
e2b5227f 2421 check_da, check_sa);
fd4c7f2f 2422
eaf85ca7
ZY		 2423 while (!skb_queue_empty(&frame_list)) {
2424 rx->skb = __skb_dequeue(&frame_list);
fd4c7f2f 2425
358c8d9d 2426 if (!ieee80211_frame_allowed(rx, fc)) {
eaf85ca7 2427 dev_kfree_skb(rx->skb);
ce3edf6d
JB		 2428 continue;
2429 }
fd4c7f2f
RR		 2430
2431 ieee80211_deliver_skb(rx);
2432 }
2433
9ae54c84 2434 return RX_QUEUED;
fd4c7f2f
RR		 2435}
2436
24bba078
FF		 2437static ieee80211_rx_result debug_noinline
2438ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2439{
2440 struct sk_buff *skb = rx->skb;
2441 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2442 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2443 __le16 fc = hdr->frame_control;
2444
2445 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2446 return RX_CONTINUE;
2447
2448 if (unlikely(!ieee80211_is_data(fc)))
2449 return RX_CONTINUE;
2450
2451 if (unlikely(!ieee80211_is_data_present(fc)))
2452 return RX_DROP_MONITOR;
2453
2454 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2455 switch (rx->sdata->vif.type) {
2456 case NL80211_IFTYPE_AP_VLAN:
2457 if (!rx->sdata->u.vlan.sta)
2458 return RX_DROP_UNUSABLE;
2459 break;
2460 case NL80211_IFTYPE_STATION:
2461 if (!rx->sdata->u.mgd.use_4addr)
2462 return RX_DROP_UNUSABLE;
2463 break;
2464 default:
2465 return RX_DROP_UNUSABLE;
2466 }
2467 }
2468
2469 if (is_multicast_ether_addr(hdr->addr1))
2470 return RX_DROP_UNUSABLE;
2471
2472 return __ieee80211_rx_h_amsdu(rx, 0);
2473}
2474
bf94e17b 2475#ifdef CONFIG_MAC80211_MESH
b0dee578 2476static ieee80211_rx_result
e32f85f7
LCC		 2477ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2478{
30789eb6
TP		 2479 struct ieee80211_hdr *fwd_hdr, *hdr;
2480 struct ieee80211_tx_info *info;
e32f85f7 2481 struct ieee80211s_hdr *mesh_hdr;
e32f85f7 2482 struct sk_buff *skb = rx->skb, *fwd_skb;
3b8d81e0 2483 struct ieee80211_local *local = rx->local;
eb9fb5b8 2484 struct ieee80211_sub_if_data *sdata = rx->sdata;
30789eb6 2485 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
cf440128 2486 u16 ac, q, hdrlen;
e32f85f7
LCC		 2487
2488 hdr = (struct ieee80211_hdr *) skb->data;
2489 hdrlen = ieee80211_hdrlen(hdr->frame_control);
9b395bc3
JB		 2490
2491 /* make sure fixed part of mesh header is there, also checks skb len */
2492 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2493 return RX_DROP_MONITOR;
2494
2495 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2496
2497 /* make sure full mesh header is there, also checks skb len */
2498 if (!pskb_may_pull(rx->skb,
2499 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2500 return RX_DROP_MONITOR;
2501
2502 /* reload pointers */
2503 hdr = (struct ieee80211_hdr *) skb->data;
e32f85f7
LCC		 2504 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2505
d0c22119
BC		 2506 if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2507 return RX_DROP_MONITOR;
2508
2157fdd6
TP		 2509 /* frame is in RMC, don't forward */
2510 if (ieee80211_is_data(hdr->frame_control) &&
2511 is_multicast_ether_addr(hdr->addr1) &&
bf7cd94d 2512 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2157fdd6
TP		 2513 return RX_DROP_MONITOR;
2514
5c90067c 2515 if (!ieee80211_is_data(hdr->frame_control))
e32f85f7
LCC		 2516 return RX_CONTINUE;
2517
2518 if (!mesh_hdr->ttl)
e32f85f7
LCC		 2519 return RX_DROP_MONITOR;
2520
43b7b314 2521 if (mesh_hdr->flags & MESH_FLAGS_AE) {
79617dee 2522 struct mesh_path *mppath;
43b7b314
JC		 2523 char *proxied_addr;
2524 char *mpp_addr;
2525
2526 if (is_multicast_ether_addr(hdr->addr1)) {
2527 mpp_addr = hdr->addr3;
2528 proxied_addr = mesh_hdr->eaddr1;
5667c86a
RM		 2529 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
2530 MESH_FLAGS_AE_A5_A6) {
9b395bc3 2531 /* has_a4 already checked in ieee80211_rx_mesh_check */
43b7b314
JC		 2532 mpp_addr = hdr->addr4;
2533 proxied_addr = mesh_hdr->eaddr2;
9b395bc3
JB		 2534 } else {
2535 return RX_DROP_MONITOR;
43b7b314 2536 }
79617dee 2537
79617dee 2538 rcu_read_lock();
bf7cd94d 2539 mppath = mpp_path_lookup(sdata, proxied_addr);
79617dee 2540 if (!mppath) {
bf7cd94d 2541 mpp_path_add(sdata, proxied_addr, mpp_addr);
79617dee
Y		 2542 } else {
2543 spin_lock_bh(&mppath->state_lock);
b203ca39 2544 if (!ether_addr_equal(mppath->mpp, mpp_addr))
43b7b314 2545 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
ab1c7906 2546 mppath->exp_time = jiffies;
79617dee
Y		 2547 spin_unlock_bh(&mppath->state_lock);
2548 }
2549 rcu_read_unlock();
2550 }
2551
3c5772a5
JC		 2552 /* Frame has reached destination. Don't forward */
2553 if (!is_multicast_ether_addr(hdr->addr1) &&
b203ca39 2554 ether_addr_equal(sdata->vif.addr, hdr->addr3))
e32f85f7
LCC		 2555 return RX_CONTINUE;
2556
cf440128
MK		 2557 ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2558 q = sdata->vif.hw_queue[ac];
d3c1597b 2559 if (ieee80211_queue_stopped(&local->hw, q)) {
30789eb6 2560 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
d3c1597b
TP		 2561 return RX_DROP_MONITOR;
2562 }
2563 skb_set_queue_mapping(skb, q);
e32f85f7 2564
30789eb6
TP		 2565 if (!--mesh_hdr->ttl) {
2566 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2ac64cd1 2567 goto out;
30789eb6
TP		 2568 }
2569
d665508b
CYY		 2570 if (!ifmsh->mshcfg.dot11MeshForwarding)
2571 goto out;
2572
c38c39bf
CI		 2573 fwd_skb = skb_copy_expand(skb, local->tx_headroom +
2574 sdata->encrypt_headroom, 0, GFP_ATOMIC);
0c3d5a96 2575 if (!fwd_skb)
30789eb6 2576 goto out;
30789eb6
TP		 2577
2578 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
9d6d6f49 2579 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
30789eb6
TP		 2580 info = IEEE80211_SKB_CB(fwd_skb);
2581 memset(info, 0, sizeof(*info));
2582 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2583 info->control.vif = &rx->sdata->vif;
2584 info->control.jiffies = jiffies;
2585 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2586 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2587 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3f52b7e3
MP		 2588 /* update power mode indication when forwarding */
2589 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
bf7cd94d 2590 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
3f52b7e3 2591 /* mesh power mode flags updated in mesh_nexthop_lookup */
30789eb6
TP		 2592 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2593 } else {
2594 /* unable to resolve next hop */
bf7cd94d 2595 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
f63f8421
CYY		 2596 fwd_hdr->addr3, 0,
2597 WLAN_REASON_MESH_PATH_NOFORWARD,
2598 fwd_hdr->addr2);
30789eb6 2599 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
74b8cc3d 2600 kfree_skb(fwd_skb);
30789eb6 2601 return RX_DROP_MONITOR;
e32f85f7
LCC		 2602 }
2603
30789eb6
TP		 2604 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2605 ieee80211_add_pending_skb(local, fwd_skb);
b51aff05 2606 out:
df140465 2607 if (is_multicast_ether_addr(hdr->addr1))
e32f85f7 2608 return RX_CONTINUE;
df140465 2609 return RX_DROP_MONITOR;
e32f85f7 2610}
bf94e17b 2611#endif
e32f85f7 2612
49461622 2613static ieee80211_rx_result debug_noinline
5cf121c3 2614ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf 2615{
eb9fb5b8 2616 struct ieee80211_sub_if_data *sdata = rx->sdata;
e15276a4 2617 struct ieee80211_local *local = rx->local;
eb9fb5b8 2618 struct net_device *dev = sdata->dev;
358c8d9d
HH		 2619 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2620 __le16 fc = hdr->frame_control;
4114fa21 2621 bool port_control;
ce3edf6d 2622 int err;
76ee65bf 2623
358c8d9d 2624 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 2625 return RX_CONTINUE;
76ee65bf 2626
358c8d9d 2627 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 2628 return RX_DROP_MONITOR;
76ee65bf 2629
f14543ee 2630 /*
e7f4a940
JB		 2631 * Send unexpected-4addr-frame event to hostapd. For older versions,
2632 * also drop the frame to cooked monitor interfaces.
f14543ee
FF		 2633 */
2634 if (ieee80211_has_a4(hdr->frame_control) &&
e7f4a940
JB		 2635 sdata->vif.type == NL80211_IFTYPE_AP) {
2636 if (rx->sta &&
2637 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2638 cfg80211_rx_unexpected_4addr_frame(
2639 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
f14543ee 2640 return RX_DROP_MONITOR;
e7f4a940 2641 }
f14543ee 2642
4114fa21 2643 err = __ieee80211_data_to_8023(rx, &port_control);
76ee65bf 2644 if (unlikely(err))
e4c26add 2645 return RX_DROP_UNUSABLE;
76ee65bf 2646
358c8d9d 2647 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 2648 return RX_DROP_MONITOR;
ce3edf6d 2649
8a4d32f3
AN		 2650 /* directly handle TDLS channel switch requests/responses */
2651 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2652 cpu_to_be16(ETH_P_TDLS))) {
2653 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2654
2655 if (pskb_may_pull(rx->skb,
2656 offsetof(struct ieee80211_tdls_data, u)) &&
2657 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2658 tf->category == WLAN_CATEGORY_TDLS &&
2659 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2660 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
c8ff71e6
AN		 2661 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2662 schedule_work(&local->tdls_chsw_work);
8a4d32f3 2663 if (rx->sta)
e5a9f8d0 2664 rx->sta->rx_stats.packets++;
8a4d32f3
AN		 2665
2666 return RX_QUEUED;
2667 }
2668 }
2669
4114fa21
FF		 2670 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2671 unlikely(port_control) && sdata->bss) {
2672 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2673 u.ap);
2674 dev = sdata->dev;
2675 rx->sdata = sdata;
2676 }
2677
76ee65bf
RR		 2678 rx->skb->dev = dev;
2679
602fae42
JB		 2680 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
2681 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
8c99f691
RM		 2682 !is_multicast_ether_addr(
2683 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2684 (!local->scanning &&
602fae42
JB		 2685 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
2686 mod_timer(&local->dynamic_ps_timer, jiffies +
2687 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
e15276a4 2688
76ee65bf 2689 ieee80211_deliver_skb(rx);
571ecf67 2690
9ae54c84 2691 return RX_QUEUED;
571ecf67
JB		 2692}
2693
49461622 2694static ieee80211_rx_result debug_noinline
f9e124fb 2695ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
71364716 2696{
71364716 2697 struct sk_buff *skb = rx->skb;
a7767f95 2698 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR		 2699 struct tid_ampdu_rx *tid_agg_rx;
2700 u16 start_seq_num;
2701 u16 tid;
2702
a7767f95 2703 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 2704 return RX_CONTINUE;
71364716 2705
a7767f95 2706 if (ieee80211_is_back_req(bar->frame_control)) {
8ae5977f
JB		 2707 struct {
2708 __le16 control, start_seq_num;
2709 } __packed bar_data;
6382246e
EG		 2710 struct ieee80211_event event = {
2711 .type = BAR_RX_EVENT,
2712 };
8ae5977f 2713
71364716 2714 if (!rx->sta)
a02ae758 2715 return RX_DROP_MONITOR;
8ae5977f
JB		 2716
2717 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2718 &bar_data, sizeof(bar_data)))
2719 return RX_DROP_MONITOR;
2720
8ae5977f 2721 tid = le16_to_cpu(bar_data.control) >> 12;
a87f736d 2722
53f24974
JB		 2723 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
2724 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
2725 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
2726 WLAN_BACK_RECIPIENT,
2727 WLAN_REASON_QSTA_REQUIRE_SETUP);
2728
a87f736d
JB		 2729 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2730 if (!tid_agg_rx)
a02ae758 2731 return RX_DROP_MONITOR;
71364716 2732
8ae5977f 2733 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
6382246e
EG		 2734 event.u.ba.tid = tid;
2735 event.u.ba.ssn = start_seq_num;
2736 event.u.ba.sta = &rx->sta->sta;
71364716
RR		 2737
2738 /* reset session timer */
20ad19d0
JB		 2739 if (tid_agg_rx->timeout)
2740 mod_timer(&tid_agg_rx->session_timer,
2741 TU_TO_EXP_TIME(tid_agg_rx->timeout));
71364716 2742
dd318575 2743 spin_lock(&tid_agg_rx->reorder_lock);
a02ae758 2744 /* release stored frames up to start of BAR */
d3b2fb53 2745 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
f9e124fb 2746 start_seq_num, frames);
dd318575
JB		 2747 spin_unlock(&tid_agg_rx->reorder_lock);
2748
6382246e
EG		 2749 drv_event_callback(rx->local, rx->sdata, &event);
2750
a02ae758
JB		 2751 kfree_skb(skb);
2752 return RX_QUEUED;
71364716
RR		 2753 }
2754
08daecae
JB		 2755 /*
2756 * After this point, we only want management frames,
2757 * so we can drop all remaining control frames to
2758 * cooked monitor interfaces.
2759 */
2760 return RX_DROP_MONITOR;
71364716
RR		 2761}
2762
f4f727a6
JM		 2763static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2764 struct ieee80211_mgmt *mgmt,
2765 size_t len)
fea14732
JM		 2766{
2767 struct ieee80211_local *local = sdata->local;
2768 struct sk_buff *skb;
2769 struct ieee80211_mgmt *resp;
2770
b203ca39 2771 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
fea14732
JM		 2772 /* Not to own unicast address */
2773 return;
2774 }
2775
b203ca39
JP		 2776 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2777 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
77fdaa12 2778 /* Not from the current AP or not associated yet. */
fea14732
JM		 2779 return;
2780 }
2781
2782 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2783 /* Too short SA Query request frame */
2784 return;
2785 }
2786
2787 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2788 if (skb == NULL)
2789 return;
2790
2791 skb_reserve(skb, local->hw.extra_tx_headroom);
b080db58 2792 resp = skb_put_zero(skb, 24);
fea14732 2793 memcpy(resp->da, mgmt->sa, ETH_ALEN);
47846c9b 2794 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
46900298 2795 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
fea14732
JM		 2796 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2797 IEEE80211_STYPE_ACTION);
2798 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2799 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2800 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2801 memcpy(resp->u.action.u.sa_query.trans_id,
2802 mgmt->u.action.u.sa_query.trans_id,
2803 WLAN_SA_QUERY_TR_ID_LEN);
2804
62ae67be 2805 ieee80211_tx_skb(sdata, skb);
fea14732
JM		 2806}
2807
2e161f78
JB		 2808static ieee80211_rx_result debug_noinline
2809ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2810{
2811 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2812 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2813
2814 /*
2815 * From here on, look only at management frames.
2816 * Data and control frames are already handled,
2817 * and unknown (reserved) frames are useless.
2818 */
2819 if (rx->skb->len < 24)
2820 return RX_DROP_MONITOR;
2821
2822 if (!ieee80211_is_mgmt(mgmt->frame_control))
2823 return RX_DROP_MONITOR;
2824
ee971924
JB		 2825 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2826 ieee80211_is_beacon(mgmt->frame_control) &&
2827 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
804483e9
JB		 2828 int sig = 0;
2829
1ad22fb5
T		 2830 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
2831 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
804483e9
JB		 2832 sig = status->signal;
2833
ee971924
JB		 2834 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2835 rx->skb->data, rx->skb->len,
37c73b5f 2836 status->freq, sig);
ee971924
JB		 2837 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2838 }
2839
2e161f78
JB		 2840 if (ieee80211_drop_unencrypted_mgmt(rx))
2841 return RX_DROP_UNUSABLE;
2842
2843 return RX_CONTINUE;
2844}
2845
de1ede7a
JB		 2846static ieee80211_rx_result debug_noinline
2847ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2848{
2849 struct ieee80211_local *local = rx->local;
eb9fb5b8 2850 struct ieee80211_sub_if_data *sdata = rx->sdata;
de1ede7a 2851 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2852 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
de1ede7a
JB		 2853 int len = rx->skb->len;
2854
2855 if (!ieee80211_is_action(mgmt->frame_control))
2856 return RX_CONTINUE;
2857
026331c4
JM		 2858 /* drop too small frames */
2859 if (len < IEEE80211_MIN_ACTION_SIZE)
84040805 2860 return RX_DROP_UNUSABLE;
de1ede7a 2861
815b8092 2862 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
cd7760e6
SW		 2863 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2864 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
84040805 2865 return RX_DROP_UNUSABLE;
de1ede7a 2866
de1ede7a 2867 switch (mgmt->u.action.category) {
1d8d3dec
JB		 2868 case WLAN_CATEGORY_HT:
2869 /* reject HT action frames from stations not supporting HT */
2870 if (!rx->sta->sta.ht_cap.ht_supported)
2871 goto invalid;
2872
2873 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2874 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2875 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2876 sdata->vif.type != NL80211_IFTYPE_AP &&
2877 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2878 break;
2879
ec61cd63 2880 /* verify action & smps_control/chanwidth are present */
1d8d3dec
JB		 2881 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2882 goto invalid;
2883
2884 switch (mgmt->u.action.u.ht_smps.action) {
2885 case WLAN_HT_ACTION_SMPS: {
2886 struct ieee80211_supported_band *sband;
af0ed69b 2887 enum ieee80211_smps_mode smps_mode;
ff84e7bf 2888 struct sta_opmode_info sta_opmode = {};
1d8d3dec
JB		 2889
2890 /* convert to HT capability */
2891 switch (mgmt->u.action.u.ht_smps.smps_control) {
2892 case WLAN_HT_SMPS_CONTROL_DISABLED:
af0ed69b 2893 smps_mode = IEEE80211_SMPS_OFF;
1d8d3dec
JB		 2894 break;
2895 case WLAN_HT_SMPS_CONTROL_STATIC:
af0ed69b 2896 smps_mode = IEEE80211_SMPS_STATIC;
1d8d3dec
JB		 2897 break;
2898 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
af0ed69b 2899 smps_mode = IEEE80211_SMPS_DYNAMIC;
1d8d3dec
JB		 2900 break;
2901 default:
2902 goto invalid;
2903 }
1d8d3dec
JB		 2904
2905 /* if no change do nothing */
af0ed69b 2906 if (rx->sta->sta.smps_mode == smps_mode)
1d8d3dec 2907 goto handled;
af0ed69b 2908 rx->sta->sta.smps_mode = smps_mode;
57566b20 2909 sta_opmode.smps_mode =
2910 ieee80211_smps_mode_to_smps_mode(smps_mode);
ff84e7bf 2911 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
1d8d3dec
JB		 2912
2913 sband = rx->local->hw.wiphy->bands[status->band];
2914
64f68e5d
JB		 2915 rate_control_rate_update(local, sband, rx->sta,
2916 IEEE80211_RC_SMPS_CHANGED);
ff84e7bf 2917 cfg80211_sta_opmode_change_notify(sdata->dev,
2918 rx->sta->addr,
2919 &sta_opmode,
2920 GFP_KERNEL);
1d8d3dec
JB		 2921 goto handled;
2922 }
ec61cd63
JB		 2923 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2924 struct ieee80211_supported_band *sband;
2925 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
1c45c5ce 2926 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
ff84e7bf 2927 struct sta_opmode_info sta_opmode = {};
ec61cd63
JB		 2928
2929 /* If it doesn't support 40 MHz it can't change ... */
e1a0c6b3
JB		 2930 if (!(rx->sta->sta.ht_cap.cap &
2931 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
ec61cd63
JB		 2932 goto handled;
2933
e1a0c6b3 2934 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
1c45c5ce 2935 max_bw = IEEE80211_STA_RX_BW_20;
e1a0c6b3 2936 else
1c45c5ce
EP		 2937 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2938
2939 /* set cur_max_bandwidth and recalc sta bw */
2940 rx->sta->cur_max_bandwidth = max_bw;
2941 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
ec61cd63 2942
e1a0c6b3 2943 if (rx->sta->sta.bandwidth == new_bw)
ec61cd63
JB		 2944 goto handled;
2945
1c45c5ce 2946 rx->sta->sta.bandwidth = new_bw;
ec61cd63 2947 sband = rx->local->hw.wiphy->bands[status->band];
97f5f425 2948 sta_opmode.bw =
2949 ieee80211_sta_rx_bw_to_chan_width(rx->sta);
ff84e7bf 2950 sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
ec61cd63
JB		 2951
2952 rate_control_rate_update(local, sband, rx->sta,
2953 IEEE80211_RC_BW_CHANGED);
ff84e7bf 2954 cfg80211_sta_opmode_change_notify(sdata->dev,
2955 rx->sta->addr,
2956 &sta_opmode,
2957 GFP_KERNEL);
ec61cd63
JB		 2958 goto handled;
2959 }
1d8d3dec
JB		 2960 default:
2961 goto invalid;
2962 }
2963
0af83d3d 2964 break;
1b3a2e49
JB		 2965 case WLAN_CATEGORY_PUBLIC:
2966 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2967 goto invalid;
2968 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2969 break;
2970 if (!rx->sta)
2971 break;
2972 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2973 break;
2974 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2975 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2976 break;
2977 if (len < offsetof(struct ieee80211_mgmt,
2978 u.action.u.ext_chan_switch.variable))
2979 goto invalid;
2980 goto queue;
0af83d3d
JB		 2981 case WLAN_CATEGORY_VHT:
2982 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2983 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2984 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2985 sdata->vif.type != NL80211_IFTYPE_AP &&
2986 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2987 break;
2988
2989 /* verify action code is present */
2990 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2991 goto invalid;
2992
2993 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2994 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
0af83d3d
JB		 2995 /* verify opmode is present */
2996 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2997 goto invalid;
d2941df8 2998 goto queue;
0af83d3d 2999 }
23a1f8d4
SS		 3000 case WLAN_VHT_ACTION_GROUPID_MGMT: {
3001 if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3002 goto invalid;
3003 goto queue;
3004 }
0af83d3d
JB		 3005 default:
3006 break;
3007 }
1d8d3dec 3008 break;
de1ede7a 3009 case WLAN_CATEGORY_BACK:
8abd3f9b 3010 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
ae2772b3 3011 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
8abd3f9b 3012 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
13c40c54
AS		 3013 sdata->vif.type != NL80211_IFTYPE_AP &&
3014 sdata->vif.type != NL80211_IFTYPE_ADHOC)
84040805 3015 break;
8abd3f9b 3016
026331c4
JM		 3017 /* verify action_code is present */
3018 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3019 break;
3020
de1ede7a
JB		 3021 switch (mgmt->u.action.u.addba_req.action_code) {
3022 case WLAN_ACTION_ADDBA_REQ:
3023 if (len < (IEEE80211_MIN_ACTION_SIZE +
3024 sizeof(mgmt->u.action.u.addba_req)))
bed7ee6e
JB		 3025 goto invalid;
3026 break;
de1ede7a
JB		 3027 case WLAN_ACTION_ADDBA_RESP:
3028 if (len < (IEEE80211_MIN_ACTION_SIZE +
3029 sizeof(mgmt->u.action.u.addba_resp)))
bed7ee6e
JB		 3030 goto invalid;
3031 break;
de1ede7a
JB		 3032 case WLAN_ACTION_DELBA:
3033 if (len < (IEEE80211_MIN_ACTION_SIZE +
3034 sizeof(mgmt->u.action.u.delba)))
bed7ee6e
JB		 3035 goto invalid;
3036 break;
3037 default:
3038 goto invalid;
de1ede7a 3039 }
bed7ee6e 3040
8b58ff83 3041 goto queue;
39192c0b 3042 case WLAN_CATEGORY_SPECTRUM_MGMT:
026331c4
JM		 3043 /* verify action_code is present */
3044 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3045 break;
3046
39192c0b
JB		 3047 switch (mgmt->u.action.u.measurement.action_code) {
3048 case WLAN_ACTION_SPCT_MSR_REQ:
57fbcce3 3049 if (status->band != NL80211_BAND_5GHZ)
cd7760e6
SW		 3050 break;
3051
39192c0b
JB		 3052 if (len < (IEEE80211_MIN_ACTION_SIZE +
3053 sizeof(mgmt->u.action.u.measurement)))
84040805 3054 break;
cd7760e6
SW		 3055
3056 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3057 break;
3058
39192c0b 3059 ieee80211_process_measurement_req(sdata, mgmt, len);
84040805 3060 goto handled;
cd7760e6
SW		 3061 case WLAN_ACTION_SPCT_CHL_SWITCH: {
3062 u8 *bssid;
3063 if (len < (IEEE80211_MIN_ACTION_SIZE +
3064 sizeof(mgmt->u.action.u.chan_switch)))
84040805 3065 break;
cc32abd4 3066
cd7760e6 3067 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
b8456a14
CYY		 3068 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3069 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
cd7760e6
SW		 3070 break;
3071
3072 if (sdata->vif.type == NL80211_IFTYPE_STATION)
3073 bssid = sdata->u.mgd.bssid;
3074 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3075 bssid = sdata->u.ibss.bssid;
b8456a14
CYY		 3076 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3077 bssid = mgmt->sa;
cd7760e6
SW		 3078 else
3079 break;
3080
3081 if (!ether_addr_equal(mgmt->bssid, bssid))
84040805 3082 break;
c481ec97 3083
8b58ff83 3084 goto queue;
cd7760e6 3085 }
39192c0b
JB		 3086 }
3087 break;
fea14732
JM		 3088 case WLAN_CATEGORY_SA_QUERY:
3089 if (len < (IEEE80211_MIN_ACTION_SIZE +
3090 sizeof(mgmt->u.action.u.sa_query)))
84040805
JB		 3091 break;
3092
fea14732
JM		 3093 switch (mgmt->u.action.u.sa_query.action) {
3094 case WLAN_ACTION_SA_QUERY_REQUEST:
3095 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 3096 break;
fea14732 3097 ieee80211_process_sa_query_req(sdata, mgmt, len);
84040805 3098 goto handled;
fea14732
JM		 3099 }
3100 break;
8db09850 3101 case WLAN_CATEGORY_SELF_PROTECTED:
9b395bc3
JB		 3102 if (len < (IEEE80211_MIN_ACTION_SIZE +
3103 sizeof(mgmt->u.action.u.self_prot.action_code)))
3104 break;
3105
8db09850
TP		 3106 switch (mgmt->u.action.u.self_prot.action_code) {
3107 case WLAN_SP_MESH_PEERING_OPEN:
3108 case WLAN_SP_MESH_PEERING_CLOSE:
3109 case WLAN_SP_MESH_PEERING_CONFIRM:
3110 if (!ieee80211_vif_is_mesh(&sdata->vif))
3111 goto invalid;
a6dad6a2 3112 if (sdata->u.mesh.user_mpm)
8db09850
TP		 3113 /* userspace handles this frame */
3114 break;
3115 goto queue;
3116 case WLAN_SP_MGK_INFORM:
3117 case WLAN_SP_MGK_ACK:
3118 if (!ieee80211_vif_is_mesh(&sdata->vif))
3119 goto invalid;
3120 break;
3121 }
3122 break;
d3aaec8a 3123 case WLAN_CATEGORY_MESH_ACTION:
9b395bc3
JB		 3124 if (len < (IEEE80211_MIN_ACTION_SIZE +
3125 sizeof(mgmt->u.action.u.mesh_action.action_code)))
3126 break;
3127
77a121c3
JB		 3128 if (!ieee80211_vif_is_mesh(&sdata->vif))
3129 break;
25d49e4d 3130 if (mesh_action_is_path_sel(mgmt) &&
1df332e8 3131 !mesh_path_sel_is_hwmp(sdata))
c7108a71
JC		 3132 break;
3133 goto queue;
84040805 3134 }
026331c4 3135
2e161f78
JB		 3136 return RX_CONTINUE;
3137
bed7ee6e 3138 invalid:
554891e6 3139 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2e161f78
JB		 3140 /* will return in the next handlers */
3141 return RX_CONTINUE;
3142
3143 handled:
3144 if (rx->sta)
e5a9f8d0 3145 rx->sta->rx_stats.packets++;
2e161f78
JB		 3146 dev_kfree_skb(rx->skb);
3147 return RX_QUEUED;
3148
3149 queue:
2e161f78
JB		 3150 skb_queue_tail(&sdata->skb_queue, rx->skb);
3151 ieee80211_queue_work(&local->hw, &sdata->work);
3152 if (rx->sta)
e5a9f8d0 3153 rx->sta->rx_stats.packets++;
2e161f78
JB		 3154 return RX_QUEUED;
3155}
3156
3157static ieee80211_rx_result debug_noinline
3158ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3159{
554891e6 3160 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
804483e9 3161 int sig = 0;
2e161f78
JB		 3162
3163 /* skip known-bad action frames and return them in the next handler */
554891e6 3164 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2e161f78 3165 return RX_CONTINUE;
d7907448 3166
026331c4
JM		 3167 /*
3168 * Getting here means the kernel doesn't know how to handle
3169 * it, but maybe userspace does ... include returned frames
3170 * so userspace can register for those to know whether ones
3171 * it transmitted were processed or returned.
3172 */
026331c4 3173
1ad22fb5
T		 3174 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3175 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
804483e9
JB		 3176 sig = status->signal;
3177
71bbc994 3178 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
970fdfa8 3179 rx->skb->data, rx->skb->len, 0)) {
2e161f78 3180 if (rx->sta)
e5a9f8d0 3181 rx->sta->rx_stats.packets++;
2e161f78
JB		 3182 dev_kfree_skb(rx->skb);
3183 return RX_QUEUED;
3184 }
3185
2e161f78
JB		 3186 return RX_CONTINUE;
3187}
3188
3189static ieee80211_rx_result debug_noinline
3190ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3191{
3192 struct ieee80211_local *local = rx->local;
3193 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3194 struct sk_buff *nskb;
3195 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 3196 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 3197
3198 if (!ieee80211_is_action(mgmt->frame_control))
3199 return RX_CONTINUE;
3200
3201 /*
3202 * For AP mode, hostapd is responsible for handling any action
3203 * frames that we didn't handle, including returning unknown
3204 * ones. For all other modes we will return them to the sender,
3205 * setting the 0x80 bit in the action category, as required by
4b5ebccc 3206 * 802.11-2012 9.24.4.
2e161f78
JB		 3207 * Newer versions of hostapd shall also use the management frame
3208 * registration mechanisms, but older ones still use cooked
3209 * monitor interfaces so push all frames there.
3210 */
554891e6 3211 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2e161f78
JB		 3212 (sdata->vif.type == NL80211_IFTYPE_AP ||
3213 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3214 return RX_DROP_MONITOR;
026331c4 3215
4b5ebccc
JB		 3216 if (is_multicast_ether_addr(mgmt->da))
3217 return RX_DROP_MONITOR;
3218
84040805
JB		 3219 /* do not return rejected action frames */
3220 if (mgmt->u.action.category & 0x80)
3221 return RX_DROP_UNUSABLE;
3222
3223 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3224 GFP_ATOMIC);
3225 if (nskb) {
292b4df6 3226 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
84040805 3227
292b4df6
JL		 3228 nmgmt->u.action.category |= 0x80;
3229 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3230 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
84040805
JB		 3231
3232 memset(nskb->cb, 0, sizeof(nskb->cb));
3233
07e5a5f5
JB		 3234 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3235 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3236
3237 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3238 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3239 IEEE80211_TX_CTL_NO_CCK_RATE;
30686bf7 3240 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
07e5a5f5
JB		 3241 info->hw_queue =
3242 local->hw.offchannel_tx_hw_queue;
3243 }
3244
3245 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
3246 status->band);
de1ede7a 3247 }
39192c0b
JB		 3248 dev_kfree_skb(rx->skb);
3249 return RX_QUEUED;
de1ede7a
JB		 3250}
3251
49461622 3252static ieee80211_rx_result debug_noinline
5cf121c3 3253ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 3254{
eb9fb5b8 3255 struct ieee80211_sub_if_data *sdata = rx->sdata;
77a121c3
JB		 3256 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3257 __le16 stype;
571ecf67 3258
77a121c3 3259 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
472dbc45 3260
77a121c3
JB		 3261 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3262 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
239281f8 3263 sdata->vif.type != NL80211_IFTYPE_OCB &&
77a121c3
JB		 3264 sdata->vif.type != NL80211_IFTYPE_STATION)
3265 return RX_DROP_MONITOR;
472dbc45 3266
77a121c3 3267 switch (stype) {
66e67e41 3268 case cpu_to_le16(IEEE80211_STYPE_AUTH):
77a121c3
JB		 3269 case cpu_to_le16(IEEE80211_STYPE_BEACON):
3270 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3271 /* process for all: mesh, mlme, ibss */
3272 break;
66e67e41
JB		 3273 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3274 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
77a121c3
JB		 3275 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3276 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2c31333a
CL		 3277 if (is_multicast_ether_addr(mgmt->da) &&
3278 !is_broadcast_ether_addr(mgmt->da))
3279 return RX_DROP_MONITOR;
3280
77a121c3
JB		 3281 /* process only for station */
3282 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3283 return RX_DROP_MONITOR;
3284 break;
3285 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
9fb04b50
TP		 3286 /* process only for ibss and mesh */
3287 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3288 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
77a121c3
JB		 3289 return RX_DROP_MONITOR;
3290 break;
3291 default:
3292 return RX_DROP_MONITOR;
3293 }
f9d540ee 3294
77a121c3
JB		 3295 /* queue up frame and kick off work to process it */
3296 skb_queue_tail(&sdata->skb_queue, rx->skb);
3297 ieee80211_queue_work(&rx->local->hw, &sdata->work);
8b58ff83 3298 if (rx->sta)
e5a9f8d0 3299 rx->sta->rx_stats.packets++;
46900298 3300
77a121c3 3301 return RX_QUEUED;
571ecf67
JB		 3302}
3303
5f0b7de5
JB		 3304static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3305 struct ieee80211_rate *rate)
3d30d949
MW		 3306{
3307 struct ieee80211_sub_if_data *sdata;
3308 struct ieee80211_local *local = rx->local;
3d30d949
MW		 3309 struct sk_buff *skb = rx->skb, *skb2;
3310 struct net_device *prev_dev = NULL;
eb9fb5b8 3311 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
293702a3 3312 int needed_headroom;
3d30d949 3313
554891e6
JB		 3314 /*
3315 * If cooked monitor has been processed already, then
3316 * don't do it again. If not, set the flag.
3317 */
3318 if (rx->flags & IEEE80211_RX_CMNTR)
7c1e1831 3319 goto out_free_skb;
554891e6 3320 rx->flags |= IEEE80211_RX_CMNTR;
7c1e1831 3321
152c477a
JB		 3322 /* If there are no cooked monitor interfaces, just free the SKB */
3323 if (!local->cooked_mntrs)
3324 goto out_free_skb;
3325
1f7bba79
JB		 3326 /* vendor data is long removed here */
3327 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
293702a3 3328 /* room for the radiotap header based on driver features */
1f7bba79 3329 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3d30d949 3330
293702a3
JB		 3331 if (skb_headroom(skb) < needed_headroom &&
3332 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3333 goto out_free_skb;
3d30d949 3334
293702a3 3335 /* prepend radiotap information */
973ef21a
FF		 3336 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3337 false);
3d30d949 3338
d57a544d 3339 skb_reset_mac_header(skb);
3d30d949
MW		 3340 skb->ip_summed = CHECKSUM_UNNECESSARY;
3341 skb->pkt_type = PACKET_OTHERHOST;
3342 skb->protocol = htons(ETH_P_802_2);
3343
3344 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
9607e6b6 3345 if (!ieee80211_sdata_running(sdata))
3d30d949
MW		 3346 continue;
3347
05c914fe 3348 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
d8212184 3349 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
3d30d949
MW		 3350 continue;
3351
3352 if (prev_dev) {
3353 skb2 = skb_clone(skb, GFP_ATOMIC);
3354 if (skb2) {
3355 skb2->dev = prev_dev;
5548a8a1 3356 netif_receive_skb(skb2);
3d30d949
MW		 3357 }
3358 }
3359
3360 prev_dev = sdata->dev;
5a490510 3361 ieee80211_rx_stats(sdata->dev, skb->len);
3d30d949
MW		 3362 }
3363
3364 if (prev_dev) {
3365 skb->dev = prev_dev;
5548a8a1 3366 netif_receive_skb(skb);
554891e6
JB		 3367 return;
3368 }
3d30d949
MW		 3369
3370 out_free_skb:
3371 dev_kfree_skb(skb);
3372}
3373
aa0c8636
CL		 3374static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3375 ieee80211_rx_result res)
3376{
3377 switch (res) {
3378 case RX_DROP_MONITOR:
3379 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3380 if (rx->sta)
e5a9f8d0 3381 rx->sta->rx_stats.dropped++;
aa0c8636
CL		 3382 /* fall through */
3383 case RX_CONTINUE: {
3384 struct ieee80211_rate *rate = NULL;
3385 struct ieee80211_supported_band *sband;
3386 struct ieee80211_rx_status *status;
3387
3388 status = IEEE80211_SKB_RXCB((rx->skb));
3389
3390 sband = rx->local->hw.wiphy->bands[status->band];
da6a4352
JB		 3391 if (!(status->encoding == RX_ENC_HT) &&
3392 !(status->encoding == RX_ENC_VHT))
aa0c8636
CL		 3393 rate = &sband->bitrates[status->rate_idx];
3394
3395 ieee80211_rx_cooked_monitor(rx, rate);
3396 break;
3397 }
3398 case RX_DROP_UNUSABLE:
3399 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3400 if (rx->sta)
e5a9f8d0 3401 rx->sta->rx_stats.dropped++;
aa0c8636
CL		 3402 dev_kfree_skb(rx->skb);
3403 break;
3404 case RX_QUEUED:
3405 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3406 break;
3407 }
3408}
571ecf67 3409
f9e124fb
CL		 3410static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3411 struct sk_buff_head *frames)
58905290 3412{
58905290 3413 ieee80211_rx_result res = RX_DROP_MONITOR;
aa0c8636 3414 struct sk_buff *skb;
8944b79f 3415
e32f85f7
LCC		 3416#define CALL_RXH(rxh) \
3417 do { \
3418 res = rxh(rx); \
3419 if (res != RX_CONTINUE) \
2569a826 3420 goto rxh_next; \
8ebaa5b0 3421 } while (0)
49461622 3422
45ceeee8
JB		 3423 /* Lock here to avoid hitting all of the data used in the RX
3424 * path (e.g. key data, station data, ...) concurrently when
3425 * a frame is released from the reorder buffer due to timeout
3426 * from the timer, potentially concurrently with RX from the
3427 * driver.
3428 */
f9e124fb 3429 spin_lock_bh(&rx->local->rx_path_lock);
24a8fdad 3430
f9e124fb 3431 while ((skb = __skb_dequeue(frames))) {
2569a826
JB		 3432 /*
3433 * all the other fields are valid across frames
3434 * that belong to an aMPDU since they are on the
3435 * same TID from the same station
3436 */
3437 rx->skb = skb;
3438
8ebaa5b0
JB		 3439 CALL_RXH(ieee80211_rx_h_check_more_data);
3440 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
3441 CALL_RXH(ieee80211_rx_h_sta_process);
3442 CALL_RXH(ieee80211_rx_h_decrypt);
3443 CALL_RXH(ieee80211_rx_h_defragment);
3444 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
2569a826 3445 /* must be after MMIC verify so header is counted in MPDU mic */
bf94e17b 3446#ifdef CONFIG_MAC80211_MESH
aa0c8636 3447 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2569a826 3448 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 3449#endif
8ebaa5b0
JB		 3450 CALL_RXH(ieee80211_rx_h_amsdu);
3451 CALL_RXH(ieee80211_rx_h_data);
f9e124fb
CL		 3452
3453 /* special treatment -- needs the queue */
3454 res = ieee80211_rx_h_ctrl(rx, frames);
3455 if (res != RX_CONTINUE)
3456 goto rxh_next;
3457
8ebaa5b0
JB		 3458 CALL_RXH(ieee80211_rx_h_mgmt_check);
3459 CALL_RXH(ieee80211_rx_h_action);
3460 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
3461 CALL_RXH(ieee80211_rx_h_action_return);
3462 CALL_RXH(ieee80211_rx_h_mgmt);
49461622 3463
aa0c8636
CL		 3464 rxh_next:
3465 ieee80211_rx_handlers_result(rx, res);
f9e124fb 3466
49461622 3467#undef CALL_RXH
aa0c8636 3468 }
24a8fdad 3469
f9e124fb 3470 spin_unlock_bh(&rx->local->rx_path_lock);
aa0c8636
CL		 3471}
3472
4406c376 3473static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
aa0c8636 3474{
f9e124fb 3475 struct sk_buff_head reorder_release;
aa0c8636
CL		 3476 ieee80211_rx_result res = RX_DROP_MONITOR;
3477
f9e124fb
CL		 3478 __skb_queue_head_init(&reorder_release);
3479
aa0c8636
CL		 3480#define CALL_RXH(rxh) \
3481 do { \
3482 res = rxh(rx); \
3483 if (res != RX_CONTINUE) \
3484 goto rxh_next; \
8ebaa5b0 3485 } while (0)
aa0c8636 3486
8ebaa5b0
JB		 3487 CALL_RXH(ieee80211_rx_h_check_dup);
3488 CALL_RXH(ieee80211_rx_h_check);
aa0c8636 3489
f9e124fb 3490 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
aa0c8636 3491
f9e124fb 3492 ieee80211_rx_handlers(rx, &reorder_release);
aa0c8636 3493 return;
49461622 3494
2569a826 3495 rxh_next:
aa0c8636
CL		 3496 ieee80211_rx_handlers_result(rx, res);
3497
3498#undef CALL_RXH
58905290
JB		 3499}
3500
2bff8ebf 3501/*
dd318575
JB		 3502 * This function makes calls into the RX path, therefore
3503 * it has to be invoked under RCU read lock.
2bff8ebf
CL		 3504 */
3505void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3506{
f9e124fb 3507 struct sk_buff_head frames;
554891e6
JB		 3508 struct ieee80211_rx_data rx = {
3509 .sta = sta,
3510 .sdata = sta->sdata,
3511 .local = sta->local,
9e26297a
JB		 3512 /* This is OK -- must be QoS data frame */
3513 .security_idx = tid,
3514 .seqno_idx = tid,
af9f9b22 3515 .napi = NULL, /* must be NULL to not have races */
554891e6 3516 };
2c15a0cf
CL		 3517 struct tid_ampdu_rx *tid_agg_rx;
3518
3519 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3520 if (!tid_agg_rx)
3521 return;
2bff8ebf 3522
f9e124fb
CL		 3523 __skb_queue_head_init(&frames);
3524
2c15a0cf 3525 spin_lock(&tid_agg_rx->reorder_lock);
f9e124fb 3526 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
2c15a0cf 3527 spin_unlock(&tid_agg_rx->reorder_lock);
2bff8ebf 3528
b497de63
EG		 3529 if (!skb_queue_empty(&frames)) {
3530 struct ieee80211_event event = {
3531 .type = BA_FRAME_TIMEOUT,
3532 .u.ba.tid = tid,
3533 .u.ba.sta = &sta->sta,
3534 };
3535 drv_event_callback(rx.local, rx.sdata, &event);
3536 }
3537
f9e124fb 3538 ieee80211_rx_handlers(&rx, &frames);
2bff8ebf
CL		 3539}
3540
06470f74
SS		 3541void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
3542 u16 ssn, u64 filtered,
3543 u16 received_mpdus)
3544{
3545 struct sta_info *sta;
3546 struct tid_ampdu_rx *tid_agg_rx;
3547 struct sk_buff_head frames;
3548 struct ieee80211_rx_data rx = {
3549 /* This is OK -- must be QoS data frame */
3550 .security_idx = tid,
3551 .seqno_idx = tid,
3552 };
3553 int i, diff;
3554
3555 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
3556 return;
3557
3558 __skb_queue_head_init(&frames);
3559
3560 sta = container_of(pubsta, struct sta_info, sta);
3561
3562 rx.sta = sta;
3563 rx.sdata = sta->sdata;
3564 rx.local = sta->local;
3565
3566 rcu_read_lock();
3567 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3568 if (!tid_agg_rx)
3569 goto out;
3570
3571 spin_lock_bh(&tid_agg_rx->reorder_lock);
3572
3573 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
3574 int release;
3575
3576 /* release all frames in the reorder buffer */
3577 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
3578 IEEE80211_SN_MODULO;
3579 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
3580 release, &frames);
3581 /* update ssn to match received ssn */
3582 tid_agg_rx->head_seq_num = ssn;
3583 } else {
3584 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
3585 &frames);
3586 }
3587
3588 /* handle the case that received ssn is behind the mac ssn.
3589 * it can be tid_agg_rx->buf_size behind and still be valid */
3590 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
3591 if (diff >= tid_agg_rx->buf_size) {
3592 tid_agg_rx->reorder_buf_filtered = 0;
3593 goto release;
3594 }
3595 filtered = filtered >> diff;
3596 ssn += diff;
3597
3598 /* update bitmap */
3599 for (i = 0; i < tid_agg_rx->buf_size; i++) {
3600 int index = (ssn + i) % tid_agg_rx->buf_size;
3601
3602 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
3603 if (filtered & BIT_ULL(i))
3604 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
3605 }
3606
3607 /* now process also frames that the filter marking released */
3608 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3609
3610release:
3611 spin_unlock_bh(&tid_agg_rx->reorder_lock);
3612
3613 ieee80211_rx_handlers(&rx, &frames);
3614
3615 out:
3616 rcu_read_unlock();
3617}
3618EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
3619
571ecf67
JB		 3620/* main receive path */
3621
a58fbe1a 3622static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
23a24def 3623{
20b01f80 3624 struct ieee80211_sub_if_data *sdata = rx->sdata;
eb9fb5b8 3625 struct sk_buff *skb = rx->skb;
a58fbe1a 3626 struct ieee80211_hdr *hdr = (void *)skb->data;
eb9fb5b8
JB		 3627 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3628 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
e5f2e067 3629 bool multicast = is_multicast_ether_addr(hdr->addr1);
23a24def 3630
51fb61e7 3631 switch (sdata->vif.type) {
05c914fe 3632 case NL80211_IFTYPE_STATION:
9bc383de 3633 if (!bssid && !sdata->u.mgd.use_4addr)
3c2723f5 3634 return false;
a58fbe1a
JB		 3635 if (multicast)
3636 return true;
3637 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
05c914fe 3638 case NL80211_IFTYPE_ADHOC:
23a24def 3639 if (!bssid)
3c2723f5 3640 return false;
6329b8d9
FF		 3641 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3642 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3c2723f5 3643 return false;
a58fbe1a 3644 if (ieee80211_is_beacon(hdr->frame_control))
3c2723f5 3645 return true;
a58fbe1a 3646 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3c2723f5 3647 return false;
a58fbe1a
JB		 3648 if (!multicast &&
3649 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
df140465 3650 return false;
a58fbe1a 3651 if (!rx->sta) {
0fb8ca45 3652 int rate_idx;
da6a4352 3653 if (status->encoding != RX_ENC_LEGACY)
5614618e 3654 rate_idx = 0; /* TODO: HT/VHT rates */
0fb8ca45 3655 else
eb9fb5b8 3656 rate_idx = status->rate_idx;
8bf11d8d
JB		 3657 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3658 BIT(rate_idx));
0fb8ca45 3659 }
a58fbe1a 3660 return true;
239281f8
RL		 3661 case NL80211_IFTYPE_OCB:
3662 if (!bssid)
3663 return false;
cc117298 3664 if (!ieee80211_is_data_present(hdr->frame_control))
239281f8 3665 return false;
a58fbe1a 3666 if (!is_broadcast_ether_addr(bssid))
239281f8 3667 return false;
a58fbe1a
JB		 3668 if (!multicast &&
3669 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
df140465 3670 return false;
a58fbe1a 3671 if (!rx->sta) {
239281f8 3672 int rate_idx;
da6a4352 3673 if (status->encoding != RX_ENC_LEGACY)
239281f8
RL		 3674 rate_idx = 0; /* TODO: HT rates */
3675 else
3676 rate_idx = status->rate_idx;
3677 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3678 BIT(rate_idx));
3679 }
a58fbe1a 3680 return true;
05c914fe 3681 case NL80211_IFTYPE_MESH_POINT:
736a80bb
JB		 3682 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
3683 return false;
a58fbe1a
JB		 3684 if (multicast)
3685 return true;
3686 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
05c914fe
JB		 3687 case NL80211_IFTYPE_AP_VLAN:
3688 case NL80211_IFTYPE_AP:
a58fbe1a
JB		 3689 if (!bssid)
3690 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3691
3692 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3df6eaea
JB		 3693 /*
3694 * Accept public action frames even when the
3695 * BSSID doesn't match, this is used for P2P
3696 * and location updates. Note that mac80211
3697 * itself never looks at these frames.
3698 */
2b9ccd4e
JB		 3699 if (!multicast &&
3700 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3c2723f5 3701 return false;
d48b2968 3702 if (ieee80211_is_public_action(hdr, skb->len))
3c2723f5 3703 return true;
5c90067c 3704 return ieee80211_is_beacon(hdr->frame_control);
a58fbe1a
JB		 3705 }
3706
3707 if (!ieee80211_has_tods(hdr->frame_control)) {
db8e1732
AN		 3708 /* ignore data frames to TDLS-peers */
3709 if (ieee80211_is_data(hdr->frame_control))
3710 return false;
3711 /* ignore action frames to TDLS-peers */
3712 if (ieee80211_is_action(hdr->frame_control) &&
1ec7bae8 3713 !is_broadcast_ether_addr(bssid) &&
db8e1732
AN		 3714 !ether_addr_equal(bssid, hdr->addr1))
3715 return false;
23a24def 3716 }
3018e947
JB		 3717
3718 /*
3719 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
3720 * the BSSID - we've checked that already but may have accepted
3721 * the wildcard (ff:ff:ff:ff:ff:ff).
3722 *
3723 * It also says:
3724 * The BSSID of the Data frame is determined as follows:
3725 * a) If the STA is contained within an AP or is associated
3726 * with an AP, the BSSID is the address currently in use
3727 * by the STA contained in the AP.
3728 *
3729 * So we should not accept data frames with an address that's
3730 * multicast.
3731 *
3732 * Accepting it also opens a security problem because stations
3733 * could encrypt it with the GTK and inject traffic that way.
3734 */
3735 if (ieee80211_is_data(hdr->frame_control) && multicast)
3736 return false;
3737
a58fbe1a 3738 return true;
05c914fe 3739 case NL80211_IFTYPE_WDS:
a7767f95 3740 if (bssid || !ieee80211_is_data(hdr->frame_control))
3c2723f5 3741 return false;
a58fbe1a 3742 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
f142c6b9 3743 case NL80211_IFTYPE_P2P_DEVICE:
a58fbe1a
JB		 3744 return ieee80211_is_public_action(hdr, skb->len) ||
3745 ieee80211_is_probe_req(hdr->frame_control) ||
3746 ieee80211_is_probe_resp(hdr->frame_control) ||
3747 ieee80211_is_beacon(hdr->frame_control);
cb3b7d87
AB		 3748 case NL80211_IFTYPE_NAN:
3749 /* Currently no frames on NAN interface are allowed */
3750 return false;
2ca27bcf 3751 default:
fb1c1cd6 3752 break;
23a24def
JB		 3753 }
3754
a58fbe1a
JB		 3755 WARN_ON_ONCE(1);
3756 return false;
23a24def
JB		 3757}
3758
49ddf8e6
JB		 3759void ieee80211_check_fast_rx(struct sta_info *sta)
3760{
3761 struct ieee80211_sub_if_data *sdata = sta->sdata;
3762 struct ieee80211_local *local = sdata->local;
3763 struct ieee80211_key *key;
3764 struct ieee80211_fast_rx fastrx = {
3765 .dev = sdata->dev,
3766 .vif_type = sdata->vif.type,
3767 .control_port_protocol = sdata->control_port_protocol,
3768 }, *old, *new = NULL;
3769 bool assign = false;
3770
3771 /* use sparse to check that we don't return without updating */
3772 __acquire(check_fast_rx);
3773
3774 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
3775 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
3776 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
3777 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
3778
c9c5962b
JB		 3779 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
3780
49ddf8e6
JB		 3781 /* fast-rx doesn't do reordering */
3782 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
3783 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
3784 goto clear;
3785
3786 switch (sdata->vif.type) {
3787 case NL80211_IFTYPE_STATION:
49ddf8e6
JB		 3788 if (sta->sta.tdls) {
3789 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
3790 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3791 fastrx.expected_ds_bits = 0;
3792 } else {
3793 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0;
3794 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
3795 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
3796 fastrx.expected_ds_bits =
3797 cpu_to_le16(IEEE80211_FCTL_FROMDS);
3798 }
1d870162 3799
9251a473
FF		 3800 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
3801 fastrx.expected_ds_bits |=
3802 cpu_to_le16(IEEE80211_FCTL_TODS);
3803 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
3804 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
3805 }
3806
1d870162
FF		 3807 if (!sdata->u.mgd.powersave)
3808 break;
3809
3810 /* software powersave is a huge mess, avoid all of it */
3811 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
3812 goto clear;
3813 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
3814 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
3815 goto clear;
49ddf8e6
JB		 3816 break;
3817 case NL80211_IFTYPE_AP_VLAN:
3818 case NL80211_IFTYPE_AP:
3819 /* parallel-rx requires this, at least with calls to
3820 * ieee80211_sta_ps_transition()
3821 */
3822 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
3823 goto clear;
3824 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
3825 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3826 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
3827
3828 fastrx.internal_forward =
3829 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
3830 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
3831 !sdata->u.vlan.sta);
59cae5b9
FF		 3832
3833 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3834 sdata->u.vlan.sta) {
3835 fastrx.expected_ds_bits |=
3836 cpu_to_le16(IEEE80211_FCTL_FROMDS);
3837 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
3838 fastrx.internal_forward = 0;
3839 }
3840
49ddf8e6
JB		 3841 break;
3842 default:
3843 goto clear;
3844 }
3845
3846 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
3847 goto clear;
3848
3849 rcu_read_lock();
3850 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
3851 if (key) {
3852 switch (key->conf.cipher) {
3853 case WLAN_CIPHER_SUITE_TKIP:
3854 /* we don't want to deal with MMIC in fast-rx */
3855 goto clear_rcu;
3856 case WLAN_CIPHER_SUITE_CCMP:
3857 case WLAN_CIPHER_SUITE_CCMP_256:
3858 case WLAN_CIPHER_SUITE_GCMP:
3859 case WLAN_CIPHER_SUITE_GCMP_256:
3860 break;
3861 default:
3862 /* we also don't want to deal with WEP or cipher scheme
3863 * since those require looking up the key idx in the
3864 * frame, rather than assuming the PTK is used
3865 * (we need to revisit this once we implement the real
3866 * PTK index, which is now valid in the spec, but we
3867 * haven't implemented that part yet)
3868 */
3869 goto clear_rcu;
3870 }
3871
3872 fastrx.key = true;
3873 fastrx.icv_len = key->conf.icv_len;
3874 }
3875
3876 assign = true;
3877 clear_rcu:
3878 rcu_read_unlock();
3879 clear:
3880 __release(check_fast_rx);
3881
3882 if (assign)
3883 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
3884
3885 spin_lock_bh(&sta->lock);
3886 old = rcu_dereference_protected(sta->fast_rx, true);
3887 rcu_assign_pointer(sta->fast_rx, new);
3888 spin_unlock_bh(&sta->lock);
3889
3890 if (old)
3891 kfree_rcu(old, rcu_head);
3892}
3893
3894void ieee80211_clear_fast_rx(struct sta_info *sta)
3895{
3896 struct ieee80211_fast_rx *old;
3897
3898 spin_lock_bh(&sta->lock);
3899 old = rcu_dereference_protected(sta->fast_rx, true);
3900 RCU_INIT_POINTER(sta->fast_rx, NULL);
3901 spin_unlock_bh(&sta->lock);
3902
3903 if (old)
3904 kfree_rcu(old, rcu_head);
3905}
3906
3907void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
3908{
3909 struct ieee80211_local *local = sdata->local;
3910 struct sta_info *sta;
3911
3912 lockdep_assert_held(&local->sta_mtx);
3913
3914 list_for_each_entry_rcu(sta, &local->sta_list, list) {
3915 if (sdata != sta->sdata &&
3916 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
3917 continue;
3918 ieee80211_check_fast_rx(sta);
3919 }
3920}
3921
3922void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
3923{
3924 struct ieee80211_local *local = sdata->local;
3925
3926 mutex_lock(&local->sta_mtx);
3927 __ieee80211_check_fast_rx_iface(sdata);
3928 mutex_unlock(&local->sta_mtx);
3929}
3930
3931static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
3932 struct ieee80211_fast_rx *fast_rx)
3933{
3934 struct sk_buff *skb = rx->skb;
3935 struct ieee80211_hdr *hdr = (void *)skb->data;
3936 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3937 struct sta_info *sta = rx->sta;
3938 int orig_len = skb->len;
24bba078
FF		 3939 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
3940 int snap_offs = hdrlen;
49ddf8e6
JB		 3941 struct {
3942 u8 snap[sizeof(rfc1042_header)];
3943 __be16 proto;
3944 } *payload __aligned(2);
3945 struct {
3946 u8 da[ETH_ALEN];
3947 u8 sa[ETH_ALEN];
3948 } addrs __aligned(2);
c9c5962b
JB		 3949 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
3950
3951 if (fast_rx->uses_rss)
3952 stats = this_cpu_ptr(sta->pcpu_rx_stats);
49ddf8e6
JB		 3953
3954 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
3955 * to a common data structure; drivers can implement that per queue
3956 * but we don't have that information in mac80211
3957 */
3958 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
3959 return false;
3960
3961#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
3962
3963 /* If using encryption, we also need to have:
3964 * - PN_VALIDATED: similar, but the implementation is tricky
3965 * - DECRYPTED: necessary for PN_VALIDATED
3966 */
3967 if (fast_rx->key &&
3968 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
3969 return false;
3970
49ddf8e6
JB		 3971 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3972 return false;
3973
3974 if (unlikely(ieee80211_is_frag(hdr)))
3975 return false;
3976
3977 /* Since our interface address cannot be multicast, this
3978 * implicitly also rejects multicast frames without the
3979 * explicit check.
3980 *
3981 * We shouldn't get any *data* frames not addressed to us
3982 * (AP mode will accept multicast *management* frames), but
3983 * punting here will make it go through the full checks in
3984 * ieee80211_accept_frame().
3985 */
3986 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
3987 return false;
3988
3989 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
3990 IEEE80211_FCTL_TODS)) !=
3991 fast_rx->expected_ds_bits)
b323ac19 3992 return false;
49ddf8e6
JB		 3993
3994 /* assign the key to drop unencrypted frames (later)
3995 * and strip the IV/MIC if necessary
3996 */
3997 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
3998 /* GCMP header length is the same */
3999 snap_offs += IEEE80211_CCMP_HDR_LEN;
4000 }
4001
24bba078
FF		 4002 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
4003 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
4004 goto drop;
49ddf8e6 4005
24bba078 4006 payload = (void *)(skb->data + snap_offs);
49ddf8e6 4007
24bba078
FF		 4008 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
4009 return false;
4010
4011 /* Don't handle these here since they require special code.
4012 * Accept AARP and IPX even though they should come with a
4013 * bridge-tunnel header - but if we get them this way then
4014 * there's little point in discarding them.
4015 */
4016 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4017 payload->proto == fast_rx->control_port_protocol))
4018 return false;
4019 }
49ddf8e6
JB		 4020
4021 /* after this point, don't punt to the slowpath! */
4022
4023 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4024 pskb_trim(skb, skb->len - fast_rx->icv_len))
4025 goto drop;
4026
4027 if (unlikely(fast_rx->sta_notify)) {
4028 ieee80211_sta_rx_notify(rx->sdata, hdr);
4029 fast_rx->sta_notify = false;
4030 }
4031
4032 /* statistics part of ieee80211_rx_h_sta_process() */
49ddf8e6 4033 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
c9c5962b
JB		 4034 stats->last_signal = status->signal;
4035 if (!fast_rx->uses_rss)
4036 ewma_signal_add(&sta->rx_stats_avg.signal,
4037 -status->signal);
49ddf8e6
JB		 4038 }
4039
4040 if (status->chains) {
4041 int i;
4042
c9c5962b 4043 stats->chains = status->chains;
49ddf8e6
JB		 4044 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4045 int signal = status->chain_signal[i];
4046
4047 if (!(status->chains & BIT(i)))
4048 continue;
4049
c9c5962b
JB		 4050 stats->chain_signal_last[i] = signal;
4051 if (!fast_rx->uses_rss)
4052 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
4053 -signal);
49ddf8e6
JB		 4054 }
4055 }
4056 /* end of statistics */
4057
4058 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
4059 goto drop;
4060
24bba078
FF		 4061 if (status->rx_flags & IEEE80211_RX_AMSDU) {
4062 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
4063 RX_QUEUED)
4064 goto drop;
4065
4066 return true;
4067 }
4068
4069 stats->last_rx = jiffies;
4070 stats->last_rate = sta_stats_encode_rate(status);
4071
4072 stats->fragments++;
4073 stats->packets++;
4074
49ddf8e6
JB		 4075 /* do the header conversion - first grab the addresses */
4076 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
4077 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
4078 /* remove the SNAP but leave the ethertype */
4079 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
4080 /* push the addresses in front */
4081 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4082
4083 skb->dev = fast_rx->dev;
4084
4085 ieee80211_rx_stats(fast_rx->dev, skb->len);
4086
4087 /* The seqno index has the same property as needed
4088 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4089 * for non-QoS-data frames. Here we know it's a data
4090 * frame, so count MSDUs.
4091 */
c9c5962b
JB		 4092 u64_stats_update_begin(&stats->syncp);
4093 stats->msdu[rx->seqno_idx]++;
4094 stats->bytes += orig_len;
4095 u64_stats_update_end(&stats->syncp);
49ddf8e6
JB		 4096
4097 if (fast_rx->internal_forward) {
eeb0d56f
JB		 4098 struct sk_buff *xmit_skb = NULL;
4099 bool multicast = is_multicast_ether_addr(skb->data);
49ddf8e6 4100
eeb0d56f
JB		 4101 if (multicast) {
4102 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4103 } else if (sta_info_get(rx->sdata, skb->data)) {
4104 xmit_skb = skb;
4105 skb = NULL;
4106 }
49ddf8e6 4107
eeb0d56f 4108 if (xmit_skb) {
49ddf8e6
JB		 4109 /*
4110 * Send to wireless media and increase priority by 256
4111 * to keep the received priority instead of
4112 * reclassifying the frame (see cfg80211_classify8021d).
4113 */
eeb0d56f
JB		 4114 xmit_skb->priority += 256;
4115 xmit_skb->protocol = htons(ETH_P_802_3);
4116 skb_reset_network_header(xmit_skb);
4117 skb_reset_mac_header(xmit_skb);
4118 dev_queue_xmit(xmit_skb);
49ddf8e6 4119 }
eeb0d56f
JB		 4120
4121 if (!skb)
4122 return true;
49ddf8e6
JB		 4123 }
4124
4125 /* deliver to local stack */
4126 skb->protocol = eth_type_trans(skb, fast_rx->dev);
4127 memset(skb->cb, 0, sizeof(skb->cb));
4128 if (rx->napi)
4129 napi_gro_receive(rx->napi, skb);
4130 else
4131 netif_receive_skb(skb);
4132
4133 return true;
4134 drop:
4135 dev_kfree_skb(skb);
c9c5962b 4136 stats->dropped++;
49ddf8e6
JB		 4137 return true;
4138}
4139
4406c376
JB		 4140/*
4141 * This function returns whether or not the SKB
4142 * was destined for RX processing or not, which,
4143 * if consume is true, is equivalent to whether
4144 * or not the skb was consumed.
4145 */
4146static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4147 struct sk_buff *skb, bool consume)
4148{
4149 struct ieee80211_local *local = rx->local;
4150 struct ieee80211_sub_if_data *sdata = rx->sdata;
4406c376
JB		 4151
4152 rx->skb = skb;
4406c376 4153
49ddf8e6
JB		 4154 /* See if we can do fast-rx; if we have to copy we already lost,
4155 * so punt in that case. We should never have to deliver a data
4156 * frame to multiple interfaces anyway.
4157 *
4158 * We skip the ieee80211_accept_frame() call and do the necessary
4159 * checking inside ieee80211_invoke_fast_rx().
4160 */
4161 if (consume && rx->sta) {
4162 struct ieee80211_fast_rx *fast_rx;
4163
4164 fast_rx = rcu_dereference(rx->sta->fast_rx);
4165 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4166 return true;
4167 }
4168
a58fbe1a 4169 if (!ieee80211_accept_frame(rx))
4406c376
JB		 4170 return false;
4171
4406c376
JB		 4172 if (!consume) {
4173 skb = skb_copy(skb, GFP_ATOMIC);
4174 if (!skb) {
4175 if (net_ratelimit())
4176 wiphy_debug(local->hw.wiphy,
b305dae4 4177 "failed to copy skb for %s\n",
4406c376
JB		 4178 sdata->name);
4179 return true;
4180 }
4181
4182 rx->skb = skb;
4183 }
4184
4185 ieee80211_invoke_rx_handlers(rx);
4186 return true;
4187}
4188
571ecf67 4189/*
6b59db7d 4190 * This is the actual Rx frames handler. as it belongs to Rx path it must
6368e4b1 4191 * be called with rcu_read_lock protection.
571ecf67 4192 */
71ebb4aa 4193static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
d63b548f 4194 struct ieee80211_sta *pubsta,
af9f9b22
JB		 4195 struct sk_buff *skb,
4196 struct napi_struct *napi)
571ecf67
JB		 4197{
4198 struct ieee80211_local *local = hw_to_local(hw);
4199 struct ieee80211_sub_if_data *sdata;
571ecf67 4200 struct ieee80211_hdr *hdr;
e3cf8b3f 4201 __le16 fc;
5cf121c3 4202 struct ieee80211_rx_data rx;
4406c376 4203 struct ieee80211_sub_if_data *prev;
83e7e4ce 4204 struct rhlist_head *tmp;
e3cf8b3f 4205 int err = 0;
571ecf67 4206
e3cf8b3f 4207 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
571ecf67
JB		 4208 memset(&rx, 0, sizeof(rx));
4209 rx.skb = skb;
4210 rx.local = local;
af9f9b22 4211 rx.napi = napi;
72abd81b 4212
e3cf8b3f 4213 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
c206ca67 4214 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
571ecf67 4215
4a4f1a58
JB		 4216 if (ieee80211_is_mgmt(fc)) {
4217 /* drop frame if too short for header */
4218 if (skb->len < ieee80211_hdrlen(fc))
4219 err = -ENOBUFS;
4220 else
4221 err = skb_linearize(skb);
4222 } else {
e3cf8b3f 4223 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4a4f1a58 4224 }
e3cf8b3f
ZY		 4225
4226 if (err) {
4227 dev_kfree_skb(skb);
4228 return;
4229 }
4230
4231 hdr = (struct ieee80211_hdr *)skb->data;
38f3714d 4232 ieee80211_parse_qos(&rx);
d1c3a37c 4233 ieee80211_verify_alignment(&rx);
38f3714d 4234
d48b2968
JB		 4235 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
4236 ieee80211_is_beacon(hdr->frame_control)))
4237 ieee80211_scan_rx(local, skb);
4238
19d19e96 4239 if (ieee80211_is_data(fc)) {
d63b548f 4240 struct sta_info *sta, *prev_sta;
7bedd0cf 4241
19d19e96
JB		 4242 if (pubsta) {
4243 rx.sta = container_of(pubsta, struct sta_info, sta);
4244 rx.sdata = rx.sta->sdata;
4245 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4246 return;
4247 goto out;
4248 }
4249
56af3268 4250 prev_sta = NULL;
4406c376 4251
83e7e4ce 4252 for_each_sta_info(local, hdr->addr2, sta, tmp) {
56af3268
BG		 4253 if (!prev_sta) {
4254 prev_sta = sta;
4255 continue;
4256 }
4257
4258 rx.sta = prev_sta;
4259 rx.sdata = prev_sta->sdata;
4406c376 4260 ieee80211_prepare_and_rx_handle(&rx, skb, false);
abe60632 4261
56af3268 4262 prev_sta = sta;
4406c376 4263 }
56af3268
BG		 4264
4265 if (prev_sta) {
4266 rx.sta = prev_sta;
4267 rx.sdata = prev_sta->sdata;
4268
4406c376 4269 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
56af3268 4270 return;
8e26d5ad 4271 goto out;
56af3268 4272 }
4406c376
JB		 4273 }
4274
4b0dd98e 4275 prev = NULL;
b2e7771e 4276
4b0dd98e
JB		 4277 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4278 if (!ieee80211_sdata_running(sdata))
4279 continue;
340e11f3 4280
4b0dd98e
JB		 4281 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
4282 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
4283 continue;
340e11f3 4284
4b0dd98e
JB		 4285 /*
4286 * frame is destined for this interface, but if it's
4287 * not also for the previous one we handle that after
4288 * the loop to avoid copying the SKB once too much
4289 */
4bb29f8c 4290
4b0dd98e 4291 if (!prev) {
abe60632 4292 prev = sdata;
4b0dd98e 4293 continue;
340e11f3 4294 }
4bb29f8c 4295
7852e361 4296 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4b0dd98e
JB		 4297 rx.sdata = prev;
4298 ieee80211_prepare_and_rx_handle(&rx, skb, false);
4bb29f8c 4299
4b0dd98e
JB		 4300 prev = sdata;
4301 }
4302
4303 if (prev) {
7852e361 4304 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4b0dd98e 4305 rx.sdata = prev;
4406c376 4306
4b0dd98e
JB		 4307 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4308 return;
571ecf67 4309 }
4406c376 4310
8e26d5ad 4311 out:
4406c376 4312 dev_kfree_skb(skb);
571ecf67 4313}
6368e4b1
RR		 4314
4315/*
4316 * This is the receive path handler. It is called by a low level driver when an
4317 * 802.11 MPDU is received from the hardware.
4318 */
d63b548f
JB		 4319void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
4320 struct sk_buff *skb, struct napi_struct *napi)
6368e4b1
RR		 4321{
4322 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB		 4323 struct ieee80211_rate *rate = NULL;
4324 struct ieee80211_supported_band *sband;
f1d58c25 4325 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
8318d78a 4326
d20ef63d
JB		 4327 WARN_ON_ONCE(softirq_count() == 0);
4328
57fbcce3 4329 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
77a980dc 4330 goto drop;
8318d78a
JB		 4331
4332 sband = local->hw.wiphy->bands[status->band];
77a980dc
JB		 4333 if (WARN_ON(!sband))
4334 goto drop;
8318d78a 4335
89c3a8ac
JB		 4336 /*
4337 * If we're suspending, it is possible although not too likely
4338 * that we'd be receiving frames after having already partially
4339 * quiesced the stack. We can't process such frames then since
4340 * that might, for example, cause stations to be added or other
4341 * driver callbacks be invoked.
4342 */
77a980dc
JB		 4343 if (unlikely(local->quiescing || local->suspended))
4344 goto drop;
89c3a8ac 4345
04800ada
AN		 4346 /* We might be during a HW reconfig, prevent Rx for the same reason */
4347 if (unlikely(local->in_reconfig))
4348 goto drop;
4349
ea77f12f
JB		 4350 /*
4351 * The same happens when we're not even started,
4352 * but that's worth a warning.
4353 */
77a980dc
JB		 4354 if (WARN_ON(!local->started))
4355 goto drop;
ea77f12f 4356
fc885189 4357 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
e5d6eb83 4358 /*
fc885189
JB		 4359 * Validate the rate, unless a PLCP error means that
4360 * we probably can't have a valid rate here anyway.
e5d6eb83 4361 */
fc885189 4362
da6a4352
JB		 4363 switch (status->encoding) {
4364 case RX_ENC_HT:
fc885189
JB		 4365 /*
4366 * rate_idx is MCS index, which can be [0-76]
4367 * as documented on:
4368 *
4369 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
4370 *
4371 * Anything else would be some sort of driver or
4372 * hardware error. The driver should catch hardware
4373 * errors.
4374 */
444e3803 4375 if (WARN(status->rate_idx > 76,
fc885189
JB		 4376 "Rate marked as an HT rate but passed "
4377 "status->rate_idx is not "
4378 "an MCS index [0-76]: %d (0x%02x)\n",
4379 status->rate_idx,
4380 status->rate_idx))
4381 goto drop;
da6a4352
JB		 4382 break;
4383 case RX_ENC_VHT:
5614618e 4384 if (WARN_ONCE(status->rate_idx > 9 ||
8613c948
JB		 4385 !status->nss ||
4386 status->nss > 8,
5614618e 4387 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
8613c948 4388 status->rate_idx, status->nss))
5614618e 4389 goto drop;
da6a4352
JB		 4390 break;
4391 default:
4392 WARN_ON_ONCE(1);
4393 /* fall through */
4394 case RX_ENC_LEGACY:
444e3803 4395 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
fc885189
JB		 4396 goto drop;
4397 rate = &sband->bitrates[status->rate_idx];
4398 }
0fb8ca45 4399 }
6368e4b1 4400
554891e6
JB		 4401 status->rx_flags = 0;
4402
6368e4b1
RR		 4403 /*
4404 * key references and virtual interfaces are protected using RCU
4405 * and this requires that we are in a read-side RCU section during
4406 * receive processing
4407 */
4408 rcu_read_lock();
4409
4410 /*
4411 * Frames with failed FCS/PLCP checksum are not returned,
4412 * all other frames are returned without radiotap header
4413 * if it was previously present.
4414 * Also, frames with less than 16 bytes are dropped.
4415 */
f1d58c25 4416 skb = ieee80211_rx_monitor(local, skb, rate);
6368e4b1
RR		 4417 if (!skb) {
4418 rcu_read_unlock();
4419 return;
4420 }
4421
e1e54068
JB		 4422 ieee80211_tpt_led_trig_rx(local,
4423 ((struct ieee80211_hdr *)skb->data)->frame_control,
4424 skb->len);
d63b548f
JB		 4425
4426 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi);
6368e4b1
RR		 4427
4428 rcu_read_unlock();
77a980dc
JB		 4429
4430 return;
4431 drop:
4432 kfree_skb(skb);
6368e4b1 4433}
af9f9b22 4434EXPORT_SYMBOL(ieee80211_rx_napi);
571ecf67
JB		 4435
4436/* This is a version of the rx handler that can be called from hard irq
4437 * context. Post the skb on the queue and schedule the tasklet */
f1d58c25 4438void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
571ecf67
JB		 4439{
4440 struct ieee80211_local *local = hw_to_local(hw);
4441
4442 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
4443
571ecf67
JB		 4444 skb->pkt_type = IEEE80211_RX_MSG;
4445 skb_queue_tail(&local->skb_queue, skb);
4446 tasklet_schedule(&local->tasklet);
4447}
4448EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Linux 6.x block layer and io_uring tree(s)