projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
wifi: mac80211: RCU-ify link/link_conf pointers
[linux-block.git] / net / mac80211 / rx.c
CommitLineData
d2912cb1 1// SPDX-License-Identifier: GPL-2.0-only
571ecf67
JB		 2/*
3 * Copyright 2002-2005, Instant802 Networks, Inc.
4 * Copyright 2005-2006, Devicescape Software, Inc.
5 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
84040805 6 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
d98ad83e 7 * Copyright 2013-2014 Intel Mobile Communications GmbH
b7540d8f 8 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
23a5f0af 9 * Copyright (C) 2018-2022 Intel Corporation
571ecf67
JB		 10 */
11
ab46623e 12#include <linux/jiffies.h>
5a0e3ad6 13#include <linux/slab.h>
571ecf67
JB		 14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
d4e46a3d 18#include <linux/rcupdate.h>
bc3b2d7f 19#include <linux/export.h>
183f47fc 20#include <linux/kcov.h>
06470f74 21#include <linux/bitops.h>
571ecf67
JB		 22#include <net/mac80211.h>
23#include <net/ieee80211_radiotap.h>
d26ad377 24#include <asm/unaligned.h>
571ecf67
JB		 25
26#include "ieee80211_i.h"
24487981 27#include "driver-ops.h"
2c8dccc7 28#include "led.h"
33b64eb2 29#include "mesh.h"
571ecf67
JB		 30#include "wep.h"
31#include "wpa.h"
32#include "tkip.h"
33#include "wme.h"
1d8d3dec 34#include "rate.h"
571ecf67 35
b2e7771e
JB		 36/*
37 * monitor mode reception
38 *
39 * This function cleans up the SKB, i.e. it removes all the stuff
40 * only useful for monitoring.
41 */
c1129924
JB		 42static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
43 unsigned int present_fcs_len,
44 unsigned int rtap_space)
b2e7771e 45{
c1129924
JB		 46 struct ieee80211_hdr *hdr;
47 unsigned int hdrlen;
48 __le16 fc;
49
30841f5c
JB		 50 if (present_fcs_len)
51 __pskb_trim(skb, skb->len - present_fcs_len);
c096b92a 52 __pskb_pull(skb, rtap_space);
c1129924
JB		 53
54 hdr = (void *)skb->data;
55 fc = hdr->frame_control;
56
57 /*
58 * Remove the HT-Control field (if present) on management
59 * frames after we've sent the frame to monitoring. We
60 * (currently) don't need it, and don't properly parse
61 * frames with it present, due to the assumption of a
62 * fixed management header length.
63 */
64 if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
65 return skb;
66
67 hdrlen = ieee80211_hdrlen(fc);
68 hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
69
70 if (!pskb_may_pull(skb, hdrlen)) {
71 dev_kfree_skb(skb);
72 return NULL;
73 }
74
75 memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
76 hdrlen - IEEE80211_HT_CTL_LEN);
77 __pskb_pull(skb, IEEE80211_HT_CTL_LEN);
78
79 return skb;
b2e7771e
JB		 80}
81
1f7bba79 82static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
c096b92a 83 unsigned int rtap_space)
b2e7771e 84{
f1d58c25 85 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1f7bba79
JB		 86 struct ieee80211_hdr *hdr;
87
c096b92a 88 hdr = (void *)(skb->data + rtap_space);
b2e7771e 89
4c298677 90 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
17883048 91 RX_FLAG_FAILED_PLCP_CRC |
c3d1f875
ST		 92 RX_FLAG_ONLY_MONITOR |
93 RX_FLAG_NO_PSDU))
6b59db7d
ZG		 94 return true;
95
c096b92a 96 if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
6b59db7d
ZG		 97 return true;
98
87228f57
HH		 99 if (ieee80211_is_ctl(hdr->frame_control) &&
100 !ieee80211_is_pspoll(hdr->frame_control) &&
101 !ieee80211_is_back_req(hdr->frame_control))
6b59db7d
ZG		 102 return true;
103
104 return false;
b2e7771e
JB		 105}
106
601ae7f2 107static int
1f7bba79
JB		 108ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
109 struct ieee80211_rx_status *status,
110 struct sk_buff *skb)
601ae7f2
BR		 111{
112 int len;
113
114 /* always present fields */
a144f378 115 len = sizeof(struct ieee80211_radiotap_header) + 8;
601ae7f2 116
a144f378 117 /* allocate extra bitmaps */
a144f378
JB		 118 if (status->chains)
119 len += 4 * hweight8(status->chains);
efc38dd7
JB		 120 /* vendor presence bitmap */
121 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)
122 len += 4;
90b9e446
JB		 123
124 if (ieee80211_have_rx_timestamp(status)) {
125 len = ALIGN(len, 8);
601ae7f2 126 len += 8;
90b9e446 127 }
30686bf7 128 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
601ae7f2 129 len += 1;
601ae7f2 130
a144f378
JB		 131 /* antenna field, if we don't have per-chain info */
132 if (!status->chains)
133 len += 1;
134
90b9e446
JB		 135 /* padding for RX_FLAGS if necessary */
136 len = ALIGN(len, 2);
601ae7f2 137
da6a4352 138 if (status->encoding == RX_ENC_HT) /* HT info */
6d744bac
JB		 139 len += 3;
140
4c298677 141 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
90b9e446 142 len = ALIGN(len, 4);
4c298677
JB		 143 len += 8;
144 }
145
da6a4352 146 if (status->encoding == RX_ENC_VHT) {
51648921
JB		 147 len = ALIGN(len, 2);
148 len += 12;
149 }
150
99ee7cae
JB		 151 if (local->hw.radiotap_timestamp.units_pos >= 0) {
152 len = ALIGN(len, 8);
153 len += 12;
154 }
155
41cbb0f5
LC		 156 if (status->encoding == RX_ENC_HE &&
157 status->flag & RX_FLAG_RADIOTAP_HE) {
158 len = ALIGN(len, 2);
159 len += 12;
160 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
161 }
162
163 if (status->encoding == RX_ENC_HE &&
164 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
165 len = ALIGN(len, 2);
166 len += 12;
167 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
168 }
169
c3d1f875
ST		 170 if (status->flag & RX_FLAG_NO_PSDU)
171 len += 1;
172
d1332e7b
ST		 173 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
174 len = ALIGN(len, 2);
175 len += 4;
176 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
177 }
178
a144f378
JB		 179 if (status->chains) {
180 /* antenna and antenna signal fields */
181 len += 2 * hweight8(status->chains);
182 }
183
1f7bba79 184 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
c15353be
LK		 185 struct ieee80211_vendor_radiotap *rtap;
186 int vendor_data_offset = 0;
187
188 /*
189 * The position to look at depends on the existence (or non-
190 * existence) of other elements, so take that into account...
191 */
192 if (status->flag & RX_FLAG_RADIOTAP_HE)
193 vendor_data_offset +=
194 sizeof(struct ieee80211_radiotap_he);
195 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
196 vendor_data_offset +=
197 sizeof(struct ieee80211_radiotap_he_mu);
198 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
199 vendor_data_offset +=
200 sizeof(struct ieee80211_radiotap_lsig);
201
202 rtap = (void *)&skb->data[vendor_data_offset];
1f7bba79 203
1f7bba79
JB		 204 /* alignment for fixed 6-byte vendor data header */
205 len = ALIGN(len, 2);
206 /* vendor data header */
207 len += 6;
208 if (WARN_ON(rtap->align == 0))
209 rtap->align = 1;
210 len = ALIGN(len, rtap->align);
211 len += rtap->len + rtap->pad;
212 }
213
601ae7f2
BR		 214 return len;
215}
216
f057d140
JB		 217static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
218 struct sta_info *sta,
219 struct sk_buff *skb)
0044cc17
JB		 220{
221 skb_queue_tail(&sdata->skb_queue, skb);
222 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
223 if (sta)
046d2e7c 224 sta->deflink.rx_stats.packets++;
0044cc17
JB		 225}
226
f057d140
JB		 227static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
228 struct sta_info *sta,
229 struct sk_buff *skb)
230{
231 skb->protocol = 0;
232 __ieee80211_queue_skb_to_iface(sdata, sta, skb);
233}
234
9e478066
JB		 235static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
236 struct sk_buff *skb,
c096b92a 237 int rtap_space)
9e478066
JB		 238{
239 struct {
240 struct ieee80211_hdr_3addr hdr;
241 u8 category;
242 u8 action_code;
7c53eb5d 243 } __packed __aligned(2) action;
9e478066
JB		 244
245 if (!sdata)
246 return;
247
248 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
249
c096b92a 250 if (skb->len < rtap_space + sizeof(action) +
9e478066
JB		 251 VHT_MUMIMO_GROUPS_DATA_LEN)
252 return;
253
254 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
255 return;
256
c096b92a 257 skb_copy_bits(skb, rtap_space, &action, sizeof(action));
9e478066
JB		 258
259 if (!ieee80211_is_action(action.hdr.frame_control))
260 return;
261
262 if (action.category != WLAN_CATEGORY_VHT)
263 return;
264
265 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
266 return;
267
268 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
269 return;
270
271 skb = skb_copy(skb, GFP_ATOMIC);
272 if (!skb)
273 return;
274
0044cc17 275 ieee80211_queue_skb_to_iface(sdata, NULL, skb);
9e478066
JB		 276}
277
00ea6deb 278/*
601ae7f2
BR		 279 * ieee80211_add_rx_radiotap_header - add radiotap header
280 *
281 * add a radiotap header containing all the fields which the hardware provided.
282 */
283static void
284ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
285 struct sk_buff *skb,
601ae7f2 286 struct ieee80211_rate *rate,
973ef21a 287 int rtap_len, bool has_fcs)
601ae7f2 288{
f1d58c25 289 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
601ae7f2
BR		 290 struct ieee80211_radiotap_header *rthdr;
291 unsigned char *pos;
a144f378
JB		 292 __le32 *it_present;
293 u32 it_present_val;
6a86b9c7 294 u16 rx_flags = 0;
a5e70697 295 u16 channel_flags = 0;
a144f378
JB		 296 int mpdulen, chain;
297 unsigned long chains = status->chains;
1f7bba79 298 struct ieee80211_vendor_radiotap rtap = {};
41cbb0f5
LC		 299 struct ieee80211_radiotap_he he = {};
300 struct ieee80211_radiotap_he_mu he_mu = {};
d1332e7b 301 struct ieee80211_radiotap_lsig lsig = {};
41cbb0f5
LC		 302
303 if (status->flag & RX_FLAG_RADIOTAP_HE) {
304 he = *(struct ieee80211_radiotap_he *)skb->data;
305 skb_pull(skb, sizeof(he));
306 WARN_ON_ONCE(status->encoding != RX_ENC_HE);
307 }
308
309 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
310 he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
311 skb_pull(skb, sizeof(he_mu));
312 }
1f7bba79 313
d1332e7b
ST		 314 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
315 lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
316 skb_pull(skb, sizeof(lsig));
317 }
318
1f7bba79
JB		 319 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
320 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
321 /* rtap.len and rtap.pad are undone immediately */
322 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
323 }
f4bda337
TP		 324
325 mpdulen = skb->len;
30686bf7 326 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
f4bda337 327 mpdulen += FCS_LEN;
601ae7f2 328
d58ff351 329 rthdr = skb_push(skb, rtap_len);
1f7bba79 330 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
a144f378 331 it_present = &rthdr->it_present;
601ae7f2
BR		 332
333 /* radiotap header, set always present flags */
0059b2b1 334 rthdr->it_len = cpu_to_le16(rtap_len);
a144f378
JB		 335 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
336 BIT(IEEE80211_RADIOTAP_CHANNEL) |
337 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
338
339 if (!status->chains)
340 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
341
342 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
343 it_present_val |=
344 BIT(IEEE80211_RADIOTAP_EXT) |
345 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
346 put_unaligned_le32(it_present_val, it_present);
347 it_present++;
348 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
349 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
350 }
601ae7f2 351
1f7bba79
JB		 352 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
353 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
354 BIT(IEEE80211_RADIOTAP_EXT);
355 put_unaligned_le32(it_present_val, it_present);
356 it_present++;
357 it_present_val = rtap.present;
358 }
359
a144f378
JB		 360 put_unaligned_le32(it_present_val, it_present);
361
8c89f7b3
KC		 362 /* This references through an offset into it_optional[] rather
363 * than via it_present otherwise later uses of pos will cause
364 * the compiler to think we have walked past the end of the
365 * struct member.
366 */
c033a38a 367 pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
a144f378 368
601ae7f2
BR		 369 /* the order of the following fields is important */
370
371 /* IEEE80211_RADIOTAP_TSFT */
f4bda337 372 if (ieee80211_have_rx_timestamp(status)) {
90b9e446
JB		 373 /* padding */
374 while ((pos - (u8 *)rthdr) & 7)
375 *pos++ = 0;
f4bda337
TP		 376 put_unaligned_le64(
377 ieee80211_calculate_rx_timestamp(local, status,
378 mpdulen, 0),
379 pos);
5cafd378 380 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
601ae7f2
BR		 381 pos += 8;
382 }
383
384 /* IEEE80211_RADIOTAP_FLAGS */
30686bf7 385 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
601ae7f2 386 *pos |= IEEE80211_RADIOTAP_F_FCS;
aae89831
JB		 387 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
388 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
7fdd69c5 389 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
b4f28bbb 390 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR		 391 pos++;
392
393 /* IEEE80211_RADIOTAP_RATE */
da6a4352 394 if (!rate || status->encoding != RX_ENC_LEGACY) {
0fb8ca45 395 /*
f8d1ccf1 396 * Without rate information don't add it. If we have,
38f37be2 397 * MCS information is a separate field in radiotap,
73b48099
JB		 398 * added below. The byte here is needed as padding
399 * for the channel though, so initialise it to 0.
0fb8ca45
JM		 400 */
401 *pos = 0;
8d6f658e 402 } else {
2103dec1 403 int shift = 0;
5cafd378 404 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
da6a4352 405 if (status->bw == RATE_INFO_BW_10)
2103dec1 406 shift = 1;
da6a4352 407 else if (status->bw == RATE_INFO_BW_5)
2103dec1
SW		 408 shift = 2;
409 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
8d6f658e 410 }
601ae7f2
BR		 411 pos++;
412
413 /* IEEE80211_RADIOTAP_CHANNEL */
3b23c184 414 /* TODO: frequency offset in KHz */
6a86b9c7 415 put_unaligned_le16(status->freq, pos);
601ae7f2 416 pos += 2;
da6a4352 417 if (status->bw == RATE_INFO_BW_10)
a5e70697 418 channel_flags |= IEEE80211_CHAN_HALF;
da6a4352 419 else if (status->bw == RATE_INFO_BW_5)
a5e70697
SW		 420 channel_flags |= IEEE80211_CHAN_QUARTER;
421
412a84b5
AD		 422 if (status->band == NL80211_BAND_5GHZ ||
423 status->band == NL80211_BAND_6GHZ)
a5e70697 424 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
da6a4352 425 else if (status->encoding != RX_ENC_LEGACY)
a5e70697 426 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
f8d1ccf1 427 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
a5e70697 428 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
f8d1ccf1 429 else if (rate)
3a5c5e81 430 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
f8d1ccf1 431 else
a5e70697
SW		 432 channel_flags |= IEEE80211_CHAN_2GHZ;
433 put_unaligned_le16(channel_flags, pos);
601ae7f2
BR		 434 pos += 2;
435
436 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
30686bf7 437 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
fe8431f8 438 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
601ae7f2
BR		 439 *pos = status->signal;
440 rthdr->it_present |=
5cafd378 441 cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
601ae7f2
BR		 442 pos++;
443 }
444
601ae7f2
BR		 445 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
446
a144f378
JB		 447 if (!status->chains) {
448 /* IEEE80211_RADIOTAP_ANTENNA */
449 *pos = status->antenna;
450 pos++;
451 }
601ae7f2 452
601ae7f2
BR		 453 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
454
455 /* IEEE80211_RADIOTAP_RX_FLAGS */
456 /* ensure 2 byte alignment for the 2 byte field as required */
6a86b9c7 457 if ((pos - (u8 *)rthdr) & 1)
90b9e446 458 *pos++ = 0;
aae89831 459 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
6a86b9c7
JB		 460 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
461 put_unaligned_le16(rx_flags, pos);
601ae7f2 462 pos += 2;
6d744bac 463
da6a4352 464 if (status->encoding == RX_ENC_HT) {
786677d1
OR		 465 unsigned int stbc;
466
5cafd378 467 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
57553c3a
P		 468 *pos = local->hw.radiotap_mcs_details;
469 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
470 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
471 if (status->enc_flags & RX_ENC_FLAG_LDPC)
472 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
473 pos++;
6d744bac 474 *pos = 0;
7fdd69c5 475 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
6d744bac 476 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
da6a4352 477 if (status->bw == RATE_INFO_BW_40)
6d744bac 478 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
7fdd69c5 479 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
ac55d2fe 480 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
7fdd69c5 481 if (status->enc_flags & RX_ENC_FLAG_LDPC)
63c361f5 482 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
7fdd69c5 483 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
786677d1 484 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
6d744bac
JB		 485 pos++;
486 *pos++ = status->rate_idx;
487 }
4c298677
JB		 488
489 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
490 u16 flags = 0;
491
492 /* ensure 4 byte alignment */
493 while ((pos - (u8 *)rthdr) & 3)
494 pos++;
495 rthdr->it_present |=
5cafd378 496 cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
4c298677
JB		 497 put_unaligned_le32(status->ampdu_reference, pos);
498 pos += 4;
4c298677
JB		 499 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
500 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
501 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
502 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
503 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
504 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
505 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
506 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
7299d6f7
JB		 507 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
508 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
509 if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
510 flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
4c298677
JB		 511 put_unaligned_le16(flags, pos);
512 pos += 2;
513 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
514 *pos++ = status->ampdu_delimiter_crc;
515 else
516 *pos++ = 0;
517 *pos++ = 0;
518 }
90b9e446 519
da6a4352 520 if (status->encoding == RX_ENC_VHT) {
51648921
JB		 521 u16 known = local->hw.radiotap_vht_details;
522
5cafd378 523 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
51648921
JB		 524 put_unaligned_le16(known, pos);
525 pos += 2;
526 /* flags */
7fdd69c5 527 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
51648921 528 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
63c361f5 529 /* in VHT, STBC is binary */
7fdd69c5 530 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
63c361f5 531 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
7fdd69c5 532 if (status->enc_flags & RX_ENC_FLAG_BF)
fb378c23 533 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
51648921
JB		 534 pos++;
535 /* bandwidth */
da6a4352
JB		 536 switch (status->bw) {
537 case RATE_INFO_BW_80:
51648921 538 *pos++ = 4;
da6a4352
JB		 539 break;
540 case RATE_INFO_BW_160:
51648921 541 *pos++ = 11;
da6a4352
JB		 542 break;
543 case RATE_INFO_BW_40:
51648921 544 *pos++ = 1;
da6a4352
JB		 545 break;
546 default:
51648921 547 *pos++ = 0;
da6a4352 548 }
51648921 549 /* MCS/NSS */
8613c948 550 *pos = (status->rate_idx << 4) | status->nss;
51648921
JB		 551 pos += 4;
552 /* coding field */
7fdd69c5 553 if (status->enc_flags & RX_ENC_FLAG_LDPC)
63c361f5 554 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
51648921
JB		 555 pos++;
556 /* group ID */
557 pos++;
558 /* partial_aid */
559 pos += 2;
560 }
561
99ee7cae
JB		 562 if (local->hw.radiotap_timestamp.units_pos >= 0) {
563 u16 accuracy = 0;
564 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
565
566 rthdr->it_present |=
5cafd378 567 cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
99ee7cae
JB		 568
569 /* ensure 8 byte alignment */
570 while ((pos - (u8 *)rthdr) & 7)
571 pos++;
572
573 put_unaligned_le64(status->device_timestamp, pos);
574 pos += sizeof(u64);
575
576 if (local->hw.radiotap_timestamp.accuracy >= 0) {
577 accuracy = local->hw.radiotap_timestamp.accuracy;
578 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
579 }
580 put_unaligned_le16(accuracy, pos);
581 pos += sizeof(u16);
582
583 *pos++ = local->hw.radiotap_timestamp.units_pos;
584 *pos++ = flags;
585 }
586
41cbb0f5
LC		 587 if (status->encoding == RX_ENC_HE &&
588 status->flag & RX_FLAG_RADIOTAP_HE) {
331aead5 589#define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
41cbb0f5
LC		 590
591 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
592 he.data6 |= HE_PREP(DATA6_NSTS,
593 FIELD_GET(RX_ENC_FLAG_STBC_MASK,
594 status->enc_flags));
595 he.data3 |= HE_PREP(DATA3_STBC, 1);
596 } else {
597 he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
598 }
599
600#define CHECK_GI(s) \
601 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
602 (int)NL80211_RATE_INFO_HE_GI_##s)
603
604 CHECK_GI(0_8);
605 CHECK_GI(1_6);
606 CHECK_GI(3_2);
607
608 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
609 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
610 he.data3 |= HE_PREP(DATA3_CODING,
611 !!(status->enc_flags & RX_ENC_FLAG_LDPC));
612
613 he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
614
615 switch (status->bw) {
616 case RATE_INFO_BW_20:
617 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
618 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
619 break;
620 case RATE_INFO_BW_40:
621 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
622 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
623 break;
624 case RATE_INFO_BW_80:
625 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
626 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
627 break;
628 case RATE_INFO_BW_160:
629 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
630 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
631 break;
632 case RATE_INFO_BW_HE_RU:
633#define CHECK_RU_ALLOC(s) \
634 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
635 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
636
637 CHECK_RU_ALLOC(26);
638 CHECK_RU_ALLOC(52);
639 CHECK_RU_ALLOC(106);
640 CHECK_RU_ALLOC(242);
641 CHECK_RU_ALLOC(484);
642 CHECK_RU_ALLOC(996);
643 CHECK_RU_ALLOC(2x996);
644
645 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
646 status->he_ru + 4);
647 break;
648 default:
649 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
650 }
651
652 /* ensure 2 byte alignment */
653 while ((pos - (u8 *)rthdr) & 1)
654 pos++;
5cafd378 655 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
41cbb0f5
LC		 656 memcpy(pos, &he, sizeof(he));
657 pos += sizeof(he);
658 }
659
660 if (status->encoding == RX_ENC_HE &&
661 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
662 /* ensure 2 byte alignment */
663 while ((pos - (u8 *)rthdr) & 1)
664 pos++;
5cafd378 665 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
41cbb0f5
LC		 666 memcpy(pos, &he_mu, sizeof(he_mu));
667 pos += sizeof(he_mu);
668 }
669
c3d1f875
ST		 670 if (status->flag & RX_FLAG_NO_PSDU) {
671 rthdr->it_present |=
5cafd378 672 cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
c3d1f875
ST		 673 *pos++ = status->zero_length_psdu_type;
674 }
675
d1332e7b
ST		 676 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
677 /* ensure 2 byte alignment */
678 while ((pos - (u8 *)rthdr) & 1)
679 pos++;
5cafd378 680 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
d1332e7b
ST		 681 memcpy(pos, &lsig, sizeof(lsig));
682 pos += sizeof(lsig);
683 }
684
a144f378
JB		 685 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
686 *pos++ = status->chain_signal[chain];
687 *pos++ = chain;
688 }
1f7bba79
JB		 689
690 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
691 /* ensure 2 byte alignment for the vendor field as required */
692 if ((pos - (u8 *)rthdr) & 1)
693 *pos++ = 0;
694 *pos++ = rtap.oui[0];
695 *pos++ = rtap.oui[1];
696 *pos++ = rtap.oui[2];
697 *pos++ = rtap.subns;
698 put_unaligned_le16(rtap.len, pos);
699 pos += 2;
700 /* align the actual payload as requested */
701 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
702 *pos++ = 0;
703 /* data (and possible padding) already follows */
704 }
601ae7f2
BR		 705}
706
127f60bf
JB		 707static struct sk_buff *
708ieee80211_make_monitor_skb(struct ieee80211_local *local,
709 struct sk_buff **origskb,
710 struct ieee80211_rate *rate,
c096b92a 711 int rtap_space, bool use_origskb)
127f60bf
JB		 712{
713 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
714 int rt_hdrlen, needed_headroom;
715 struct sk_buff *skb;
716
717 /* room for the radiotap header based on driver features */
718 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
c096b92a 719 needed_headroom = rt_hdrlen - rtap_space;
127f60bf
JB		 720
721 if (use_origskb) {
722 /* only need to expand headroom if necessary */
723 skb = *origskb;
724 *origskb = NULL;
725
726 /*
727 * This shouldn't trigger often because most devices have an
728 * RX header they pull before we get here, and that should
729 * be big enough for our radiotap information. We should
730 * probably export the length to drivers so that we can have
731 * them allocate enough headroom to start with.
732 */
733 if (skb_headroom(skb) < needed_headroom &&
734 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
735 dev_kfree_skb(skb);
736 return NULL;
737 }
738 } else {
739 /*
740 * Need to make a copy and possibly remove radiotap header
741 * and FCS from the original.
742 */
ec61cd49
JA		 743 skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD,
744 0, GFP_ATOMIC);
127f60bf
JB		 745
746 if (!skb)
747 return NULL;
748 }
749
750 /* prepend radiotap information */
751 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
752
753 skb_reset_mac_header(skb);
754 skb->ip_summed = CHECKSUM_UNNECESSARY;
755 skb->pkt_type = PACKET_OTHERHOST;
756 skb->protocol = htons(ETH_P_802_2);
757
758 return skb;
759}
760
b2e7771e
JB		 761/*
762 * This function copies a received frame to all monitor interfaces and
763 * returns a cleaned-up SKB that no longer includes the FCS nor the
764 * radiotap header the driver might have added.
765 */
766static struct sk_buff *
767ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a 768 struct ieee80211_rate *rate)
b2e7771e 769{
f1d58c25 770 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
b2e7771e 771 struct ieee80211_sub_if_data *sdata;
127f60bf 772 struct sk_buff *monskb = NULL;
b2e7771e 773 int present_fcs_len = 0;
c096b92a 774 unsigned int rtap_space = 0;
42bd20d9
AE		 775 struct ieee80211_sub_if_data *monitor_sdata =
776 rcu_dereference(local->monitor_sdata);
127f60bf 777 bool only_monitor = false;
8020919a 778 unsigned int min_head_len;
1f7bba79 779
41cbb0f5
LC		 780 if (status->flag & RX_FLAG_RADIOTAP_HE)
781 rtap_space += sizeof(struct ieee80211_radiotap_he);
782
783 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
784 rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
785
d359bbce
IP		 786 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
787 rtap_space += sizeof(struct ieee80211_radiotap_lsig);
788
1f7bba79 789 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
d359bbce
IP		 790 struct ieee80211_vendor_radiotap *rtap =
791 (void *)(origskb->data + rtap_space);
1f7bba79 792
c096b92a 793 rtap_space += sizeof(*rtap) + rtap->len + rtap->pad;
1f7bba79 794 }
b2e7771e 795
8020919a
IP		 796 min_head_len = rtap_space;
797
b2e7771e
JB		 798 /*
799 * First, we may need to make a copy of the skb because
800 * (1) we need to modify it for radiotap (if not present), and
801 * (2) the other RX handlers will modify the skb we got.
802 *
803 * We don't need to, of course, if we aren't going to return
804 * the SKB because it has a bad FCS/PLCP checksum.
805 */
0869aea0 806
8020919a
IP		 807 if (!(status->flag & RX_FLAG_NO_PSDU)) {
808 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
809 if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
810 /* driver bug */
811 WARN_ON(1);
812 dev_kfree_skb(origskb);
813 return NULL;
814 }
815 present_fcs_len = FCS_LEN;
30841f5c 816 }
8020919a
IP		 817
818 /* also consider the hdr->frame_control */
819 min_head_len += 2;
30841f5c 820 }
b2e7771e 821
8020919a
IP		 822 /* ensure that the expected data elements are in skb head */
823 if (!pskb_may_pull(origskb, min_head_len)) {
e3cf8b3f
ZY		 824 dev_kfree_skb(origskb);
825 return NULL;
826 }
827
c096b92a 828 only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space);
127f60bf 829
17883048 830 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
127f60bf 831 if (only_monitor) {
b2e7771e
JB		 832 dev_kfree_skb(origskb);
833 return NULL;
834 }
835
c1129924
JB		 836 return ieee80211_clean_skb(origskb, present_fcs_len,
837 rtap_space);
b2e7771e
JB		 838 }
839
c096b92a 840 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space);
9e478066 841
f64331d5 842 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
127f60bf
JB		 843 bool last_monitor = list_is_last(&sdata->u.mntr.list,
844 &local->mon_list);
845
846 if (!monskb)
847 monskb = ieee80211_make_monitor_skb(local, &origskb,
c096b92a 848 rate, rtap_space,
127f60bf
JB		 849 only_monitor &&
850 last_monitor);
851
852 if (monskb) {
853 struct sk_buff *skb;
854
855 if (last_monitor) {
856 skb = monskb;
857 monskb = NULL;
858 } else {
859 skb = skb_clone(monskb, GFP_ATOMIC);
860 }
861
862 if (skb) {
863 skb->dev = sdata->dev;
36ec144f 864 dev_sw_netstats_rx_add(skb->dev, skb->len);
127f60bf 865 netif_receive_skb(skb);
b2e7771e
JB		 866 }
867 }
868
127f60bf
JB		 869 if (last_monitor)
870 break;
b2e7771e
JB		 871 }
872
127f60bf
JB		 873 /* this happens if last_monitor was erroneously false */
874 dev_kfree_skb(monskb);
875
876 /* ditto */
877 if (!origskb)
878 return NULL;
b2e7771e 879
c1129924 880 return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space);
b2e7771e
JB		 881}
882
5cf121c3 883static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 884{
238f74a2 885 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 886 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
9e26297a 887 int tid, seqno_idx, security_idx;
6e0d114d
JB		 888
889 /* does the frame have a qos control field? */
238f74a2
HH		 890 if (ieee80211_is_data_qos(hdr->frame_control)) {
891 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 892 /* frame has qos control */
238f74a2 893 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
04b7dcf9 894 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
554891e6 895 status->rx_flags |= IEEE80211_RX_AMSDU;
9e26297a
JB		 896
897 seqno_idx = tid;
898 security_idx = tid;
6e0d114d 899 } else {
1411f9b5
JB		 900 /*
901 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
902 *
903 * Sequence numbers for management frames, QoS data
904 * frames with a broadcast/multicast address in the
905 * Address 1 field, and all non-QoS data frames sent
906 * by QoS STAs are assigned using an additional single
907 * modulo-4096 counter, [...]
908 *
909 * We also use that counter for non-QoS STAs.
910 */
5a306f58 911 seqno_idx = IEEE80211_NUM_TIDS;
9e26297a
JB		 912 security_idx = 0;
913 if (ieee80211_is_mgmt(hdr->frame_control))
5a306f58 914 security_idx = IEEE80211_NUM_TIDS;
9e26297a 915 tid = 0;
6e0d114d 916 }
52865dfd 917
9e26297a
JB		 918 rx->seqno_idx = seqno_idx;
919 rx->security_idx = security_idx;
6e0d114d
JB		 920 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
921 * For now, set skb->priority to 0 for other cases. */
922 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 923}
6e0d114d 924
d1c3a37c
JB		 925/**
926 * DOC: Packet alignment
927 *
928 * Drivers always need to pass packets that are aligned to two-byte boundaries
929 * to the stack.
930 *
931 * Additionally, should, if possible, align the payload data in a way that
932 * guarantees that the contained IP header is aligned to a four-byte
933 * boundary. In the case of regular frames, this simply means aligning the
934 * payload to a four-byte boundary (because either the IP header is directly
935 * contained, or IV/RFC1042 headers that have a length divisible by four are
59d9cb07
KV		 936 * in front of it). If the payload data is not properly aligned and the
937 * architecture doesn't support efficient unaligned operations, mac80211
938 * will align the data.
d1c3a37c
JB		 939 *
940 * With A-MSDU frames, however, the payload data address must yield two modulo
941 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
942 * push the IP header further back to a multiple of four again. Thankfully, the
943 * specs were sane enough this time around to require padding each A-MSDU
944 * subframe to a length that is a multiple of four.
945 *
25985edc 946 * Padding like Atheros hardware adds which is between the 802.11 header and
d1c3a37c
JB		 947 * the payload is not supported, the driver is required to move the 802.11
948 * header to be directly in front of the payload in that case.
949 */
950static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
38f3714d 951{
59d9cb07 952#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
441275e1 953 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
d1c3a37c 954#endif
6e0d114d
JB		 955}
956
6368e4b1 957
571ecf67
JB		 958/* rx handlers */
959
3cfcf6ac
JM		 960static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
961{
962 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
963
d8ca16db 964 if (is_multicast_ether_addr(hdr->addr1))
3cfcf6ac
JM		 965 return 0;
966
d8ca16db 967 return ieee80211_is_robust_mgmt_frame(skb);
3cfcf6ac
JM		 968}
969
970
971static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
972{
973 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
974
d8ca16db 975 if (!is_multicast_ether_addr(hdr->addr1))
3cfcf6ac
JM		 976 return 0;
977
d8ca16db 978 return ieee80211_is_robust_mgmt_frame(skb);
3cfcf6ac
JM		 979}
980
981
982/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
983static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
984{
985 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
986 struct ieee80211_mmie *mmie;
56c52da2 987 struct ieee80211_mmie_16 *mmie16;
3cfcf6ac 988
1df332e8 989 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
3cfcf6ac
JM		 990 return -1;
991
af2d14b0
JM		 992 if (!ieee80211_is_robust_mgmt_frame(skb) &&
993 !ieee80211_is_beacon(hdr->frame_control))
3cfcf6ac
JM		 994 return -1; /* not a robust management frame */
995
996 mmie = (struct ieee80211_mmie *)
997 (skb->data + skb->len - sizeof(*mmie));
56c52da2
JM		 998 if (mmie->element_id == WLAN_EID_MMIE &&
999 mmie->length == sizeof(*mmie) - 2)
1000 return le16_to_cpu(mmie->key_id);
1001
1002 mmie16 = (struct ieee80211_mmie_16 *)
1003 (skb->data + skb->len - sizeof(*mmie16));
1004 if (skb->len >= 24 + sizeof(*mmie16) &&
1005 mmie16->element_id == WLAN_EID_MMIE &&
1006 mmie16->length == sizeof(*mmie16) - 2)
1007 return le16_to_cpu(mmie16->key_id);
1008
1009 return -1;
3cfcf6ac
JM		 1010}
1011
23a5f0af 1012static int ieee80211_get_keyid(struct sk_buff *skb)
2475b1cc
MS		 1013{
1014 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
23a5f0af
JB		 1015 __le16 fc = hdr->frame_control;
1016 int hdrlen = ieee80211_hdrlen(fc);
2475b1cc
MS		 1017 u8 keyid;
1018
23a5f0af
JB		 1019 /* WEP, TKIP, CCMP and GCMP */
1020 if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
2475b1cc
MS		 1021 return -EINVAL;
1022
23a5f0af 1023 skb_copy_bits(skb, hdrlen + 3, &keyid, 1);
96fc6efb 1024
23a5f0af 1025 keyid >>= 6;
2475b1cc
MS		 1026
1027 return keyid;
1028}
1029
1df332e8 1030static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 1031{
a7767f95 1032 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
47846c9b 1033 char *dev_addr = rx->sdata->vif.addr;
d6d1a5a7 1034
a7767f95 1035 if (ieee80211_is_data(hdr->frame_control)) {
3c5772a5
JC		 1036 if (is_multicast_ether_addr(hdr->addr1)) {
1037 if (ieee80211_has_tods(hdr->frame_control) ||
1df332e8 1038 !ieee80211_has_fromds(hdr->frame_control))
3c5772a5 1039 return RX_DROP_MONITOR;
b203ca39 1040 if (ether_addr_equal(hdr->addr3, dev_addr))
3c5772a5
JC		 1041 return RX_DROP_MONITOR;
1042 } else {
1043 if (!ieee80211_has_a4(hdr->frame_control))
1044 return RX_DROP_MONITOR;
b203ca39 1045 if (ether_addr_equal(hdr->addr4, dev_addr))
3c5772a5
JC		 1046 return RX_DROP_MONITOR;
1047 }
33b64eb2
LCC		 1048 }
1049
1050 /* If there is not an established peer link and this is not a peer link
1051 * establisment frame, beacon or probe, drop the frame.
1052 */
1053
57cf8043 1054 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
33b64eb2 1055 struct ieee80211_mgmt *mgmt;
d6d1a5a7 1056
a7767f95 1057 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC		 1058 return RX_DROP_MONITOR;
1059
a7767f95 1060 if (ieee80211_is_action(hdr->frame_control)) {
d3aaec8a 1061 u8 category;
9b395bc3
JB		 1062
1063 /* make sure category field is present */
1064 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
1065 return RX_DROP_MONITOR;
1066
33b64eb2 1067 mgmt = (struct ieee80211_mgmt *)hdr;
d3aaec8a
JC		 1068 category = mgmt->u.action.category;
1069 if (category != WLAN_CATEGORY_MESH_ACTION &&
1df332e8 1070 category != WLAN_CATEGORY_SELF_PROTECTED)
33b64eb2 1071 return RX_DROP_MONITOR;
33b64eb2 1072 return RX_CONTINUE;
33b64eb2
LCC		 1073 }
1074
a7767f95
HH		 1075 if (ieee80211_is_probe_req(hdr->frame_control) ||
1076 ieee80211_is_probe_resp(hdr->frame_control) ||
71839121
JC		 1077 ieee80211_is_beacon(hdr->frame_control) ||
1078 ieee80211_is_auth(hdr->frame_control))
a7767f95
HH		 1079 return RX_CONTINUE;
1080
1081 return RX_DROP_MONITOR;
a7767f95
HH		 1082 }
1083
902acc78
JB		 1084 return RX_CONTINUE;
1085}
33b64eb2 1086
fb4ea054
JB		 1087static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1088 int index)
1089{
1090 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1091 struct sk_buff *tail = skb_peek_tail(frames);
1092 struct ieee80211_rx_status *status;
1093
06470f74
SS		 1094 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1095 return true;
1096
fb4ea054
JB		 1097 if (!tail)
1098 return false;
1099
1100 status = IEEE80211_SKB_RXCB(tail);
1101 if (status->flag & RX_FLAG_AMSDU_MORE)
1102 return false;
1103
1104 return true;
1105}
1106
d3b2fb53 1107static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1edfb1af 1108 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 1109 int index,
1110 struct sk_buff_head *frames)
1edfb1af 1111{
83eb935e
MK		 1112 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1113 struct sk_buff *skb;
4cfda47b 1114 struct ieee80211_rx_status *status;
1edfb1af 1115
dd318575
JB		 1116 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1117
83eb935e 1118 if (skb_queue_empty(skb_list))
1edfb1af
JB		 1119 goto no_frame;
1120
fb4ea054 1121 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
83eb935e
MK		 1122 __skb_queue_purge(skb_list);
1123 goto no_frame;
1124 }
1125
1126 /* release frames from the reorder ring buffer */
1edfb1af 1127 tid_agg_rx->stored_mpdu_num--;
83eb935e
MK		 1128 while ((skb = __skb_dequeue(skb_list))) {
1129 status = IEEE80211_SKB_RXCB(skb);
1130 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1131 __skb_queue_tail(frames, skb);
1132 }
1edfb1af
JB		 1133
1134no_frame:
06470f74 1135 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
9a886586 1136 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1edfb1af
JB		 1137}
1138
d3b2fb53 1139static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1edfb1af 1140 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 1141 u16 head_seq_num,
1142 struct sk_buff_head *frames)
1edfb1af
JB		 1143{
1144 int index;
1145
dd318575
JB		 1146 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1147
9a886586 1148 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2e3049b7 1149 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
f9e124fb
CL		 1150 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1151 frames);
1edfb1af
JB		 1152 }
1153}
1154
1155/*
1156 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1157 * the skb was added to the buffer longer than this time ago, the earlier
1158 * frames that have not yet been received are assumed to be lost and the skb
1159 * can be released for processing. This may also release other skb's from the
1160 * reorder buffer if there are no additional gaps between the frames.
2bff8ebf
CL		 1161 *
1162 * Callers must hold tid_agg_rx->reorder_lock.
1edfb1af
JB		 1163 */
1164#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1165
d3b2fb53 1166static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
f9e124fb
CL		 1167 struct tid_ampdu_rx *tid_agg_rx,
1168 struct sk_buff_head *frames)
aa0c8636 1169{
83eb935e 1170 int index, i, j;
aa0c8636 1171
dd318575
JB		 1172 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1173
aa0c8636 1174 /* release the buffer until next missing frame */
2e3049b7 1175 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
fb4ea054 1176 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
07ae2dfc 1177 tid_agg_rx->stored_mpdu_num) {
aa0c8636
CL		 1178 /*
1179 * No buffers ready to be released, but check whether any
1180 * frames in the reorder buffer have timed out.
1181 */
aa0c8636
CL		 1182 int skipped = 1;
1183 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1184 j = (j + 1) % tid_agg_rx->buf_size) {
fb4ea054 1185 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
aa0c8636
CL		 1186 skipped++;
1187 continue;
1188 }
499fe9a4
DH		 1189 if (skipped &&
1190 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
aa0c8636 1191 HT_RX_REORDER_BUF_TIMEOUT))
2bff8ebf 1192 goto set_release_timer;
aa0c8636 1193
83eb935e
MK		 1194 /* don't leave incomplete A-MSDUs around */
1195 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1196 i = (i + 1) % tid_agg_rx->buf_size)
1197 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
1198
bdcbd8e0
JB		 1199 ht_dbg_ratelimited(sdata,
1200 "release an RX reorder frame due to timeout on earlier frames\n");
f9e124fb
CL		 1201 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1202 frames);
aa0c8636
CL		 1203
1204 /*
1205 * Increment the head seq# also for the skipped slots.
1206 */
1207 tid_agg_rx->head_seq_num =
9a886586
JB		 1208 (tid_agg_rx->head_seq_num +
1209 skipped) & IEEE80211_SN_MASK;
aa0c8636
CL		 1210 skipped = 0;
1211 }
fb4ea054 1212 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
f9e124fb
CL		 1213 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1214 frames);
2e3049b7 1215 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
aa0c8636 1216 }
2bff8ebf
CL		 1217
1218 if (tid_agg_rx->stored_mpdu_num) {
2e3049b7 1219 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
2bff8ebf
CL		 1220
1221 for (; j != (index - 1) % tid_agg_rx->buf_size;
1222 j = (j + 1) % tid_agg_rx->buf_size) {
fb4ea054 1223 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
2bff8ebf
CL		 1224 break;
1225 }
1226
1227 set_release_timer:
1228
788211d8
JB		 1229 if (!tid_agg_rx->removed)
1230 mod_timer(&tid_agg_rx->reorder_timer,
1231 tid_agg_rx->reorder_time[j] + 1 +
1232 HT_RX_REORDER_BUF_TIMEOUT);
2bff8ebf
CL		 1233 } else {
1234 del_timer(&tid_agg_rx->reorder_timer);
1235 }
aa0c8636
CL		 1236}
1237
1edfb1af
JB		 1238/*
1239 * As this function belongs to the RX path it must be under
1240 * rcu_read_lock protection. It returns false if the frame
1241 * can be processed immediately, true if it was consumed.
1242 */
d3b2fb53 1243static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1edfb1af 1244 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 1245 struct sk_buff *skb,
1246 struct sk_buff_head *frames)
1edfb1af
JB		 1247{
1248 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
83eb935e 1249 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1edfb1af
JB		 1250 u16 sc = le16_to_cpu(hdr->seq_ctrl);
1251 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1252 u16 head_seq_num, buf_size;
1253 int index;
2bff8ebf 1254 bool ret = true;
1edfb1af 1255
dd318575
JB		 1256 spin_lock(&tid_agg_rx->reorder_lock);
1257
4549cf2b
MK		 1258 /*
1259 * Offloaded BA sessions have no known starting sequence number so pick
1260 * one from first Rxed frame for this tid after BA was started.
1261 */
1262 if (unlikely(tid_agg_rx->auto_seq)) {
1263 tid_agg_rx->auto_seq = false;
1264 tid_agg_rx->ssn = mpdu_seq_num;
1265 tid_agg_rx->head_seq_num = mpdu_seq_num;
1266 }
1267
1edfb1af
JB		 1268 buf_size = tid_agg_rx->buf_size;
1269 head_seq_num = tid_agg_rx->head_seq_num;
1270
b7540d8f
SS		 1271 /*
1272 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1273 * be reordered.
1274 */
1275 if (unlikely(!tid_agg_rx->started)) {
1276 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1277 ret = false;
1278 goto out;
1279 }
1280 tid_agg_rx->started = true;
1281 }
1282
1edfb1af 1283 /* frame with out of date sequence number */
9a886586 1284 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1edfb1af 1285 dev_kfree_skb(skb);
2bff8ebf 1286 goto out;
1edfb1af
JB		 1287 }
1288
1289 /*
1290 * If frame the sequence number exceeds our buffering window
1291 * size release some previous frames to make room for this one.
1292 */
9a886586
JB		 1293 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1294 head_seq_num = ieee80211_sn_inc(
1295 ieee80211_sn_sub(mpdu_seq_num, buf_size));
1edfb1af 1296 /* release stored frames up to new head to stack */
d3b2fb53 1297 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
f9e124fb 1298 head_seq_num, frames);
1edfb1af
JB		 1299 }
1300
1301 /* Now the new frame is always in the range of the reordering buffer */
1302
2e3049b7 1303 index = mpdu_seq_num % tid_agg_rx->buf_size;
1edfb1af
JB		 1304
1305 /* check if we already stored this frame */
fb4ea054 1306 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1edfb1af 1307 dev_kfree_skb(skb);
2bff8ebf 1308 goto out;
1edfb1af
JB		 1309 }
1310
1311 /*
1312 * If the current MPDU is in the right order and nothing else
1313 * is stored we can process it directly, no need to buffer it.
c835b214
JB		 1314 * If it is first but there's something stored, we may be able
1315 * to release frames after this one.
1edfb1af
JB		 1316 */
1317 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1318 tid_agg_rx->stored_mpdu_num == 0) {
83eb935e
MK		 1319 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1320 tid_agg_rx->head_seq_num =
1321 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
2bff8ebf
CL		 1322 ret = false;
1323 goto out;
1edfb1af
JB		 1324 }
1325
1326 /* put the frame in the reordering buffer */
83eb935e
MK		 1327 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1328 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1329 tid_agg_rx->reorder_time[index] = jiffies;
1330 tid_agg_rx->stored_mpdu_num++;
1331 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1332 }
1edfb1af 1333
2bff8ebf
CL		 1334 out:
1335 spin_unlock(&tid_agg_rx->reorder_lock);
1336 return ret;
1edfb1af
JB		 1337}
1338
1339/*
1340 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1341 * true if the MPDU was buffered, false if it should be processed.
1342 */
f9e124fb
CL		 1343static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1344 struct sk_buff_head *frames)
1edfb1af 1345{
2569a826 1346 struct sk_buff *skb = rx->skb;
1edfb1af 1347 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2569a826 1348 struct sta_info *sta = rx->sta;
1edfb1af
JB		 1349 struct tid_ampdu_rx *tid_agg_rx;
1350 u16 sc;
6cc00d54 1351 u8 tid, ack_policy;
1edfb1af 1352
051a41fa
JB		 1353 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1354 is_multicast_ether_addr(hdr->addr1))
2569a826 1355 goto dont_reorder;
1edfb1af
JB		 1356
1357 /*
1358 * filter the QoS data rx stream according to
1359 * STA/TID and check if this STA/TID is on aggregation
1360 */
1361
1edfb1af 1362 if (!sta)
2569a826 1363 goto dont_reorder;
1edfb1af 1364
6cc00d54
TP		 1365 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1366 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
a1f2ba04 1367 tid = ieee80211_get_tid(hdr);
1edfb1af 1368
a87f736d 1369 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
bfe40fa3
JB		 1370 if (!tid_agg_rx) {
1371 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1372 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1373 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1374 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1375 WLAN_BACK_RECIPIENT,
1376 WLAN_REASON_QSTA_REQUIRE_SETUP);
a87f736d 1377 goto dont_reorder;
bfe40fa3 1378 }
1edfb1af
JB		 1379
1380 /* qos null data frames are excluded */
1381 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
a87f736d 1382 goto dont_reorder;
1edfb1af 1383
6cc00d54 1384 /* not part of a BA session */
5e469ed9 1385 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
6cc00d54
TP		 1386 goto dont_reorder;
1387
1edfb1af
JB		 1388 /* new, potentially un-ordered, ampdu frame - process it */
1389
1390 /* reset session timer */
1391 if (tid_agg_rx->timeout)
12d3952f 1392 tid_agg_rx->last_rx = jiffies;
1edfb1af
JB		 1393
1394 /* if this mpdu is fragmented - terminate rx aggregation session */
1395 sc = le16_to_cpu(hdr->seq_ctrl);
1396 if (sc & IEEE80211_SCTL_FRAG) {
0044cc17 1397 ieee80211_queue_skb_to_iface(rx->sdata, NULL, skb);
2569a826 1398 return;
1edfb1af
JB		 1399 }
1400
a87f736d
JB		 1401 /*
1402 * No locking needed -- we will only ever process one
1403 * RX packet at a time, and thus own tid_agg_rx. All
1404 * other code manipulating it needs to (and does) make
1405 * sure that we cannot get to it any more before doing
1406 * anything with it.
1407 */
f9e124fb
CL		 1408 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1409 frames))
2569a826
JB		 1410 return;
1411
1412 dont_reorder:
f9e124fb 1413 __skb_queue_tail(frames, skb);
1edfb1af 1414}
33b64eb2 1415
49461622 1416static ieee80211_rx_result debug_noinline
0395442a 1417ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
571ecf67 1418{
a7767f95 1419 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 1420 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 1421
f9cfa5f3
SS		 1422 if (status->flag & RX_FLAG_DUP_VALIDATED)
1423 return RX_CONTINUE;
1424
6b0f3274
JB		 1425 /*
1426 * Drop duplicate 802.11 retransmissions
1427 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1428 */
0395442a
JB		 1429
1430 if (rx->skb->len < 24)
1431 return RX_CONTINUE;
1432
1433 if (ieee80211_is_ctl(hdr->frame_control) ||
30b2f0be 1434 ieee80211_is_any_nullfunc(hdr->frame_control) ||
0395442a
JB		 1435 is_multicast_ether_addr(hdr->addr1))
1436 return RX_CONTINUE;
1437
a732fa70
JB		 1438 if (!rx->sta)
1439 return RX_CONTINUE;
1440
1441 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1442 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1443 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
046d2e7c 1444 rx->sta->deflink.rx_stats.num_duplicates++;
a732fa70
JB		 1445 return RX_DROP_UNUSABLE;
1446 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1447 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
571ecf67
JB		 1448 }
1449
0395442a
JB		 1450 return RX_CONTINUE;
1451}
1452
1453static ieee80211_rx_result debug_noinline
1454ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1455{
1456 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1457
571ecf67
JB		 1458 /* Drop disallowed frame classes based on STA auth/assoc state;
1459 * IEEE 802.11, Chap 5.5.
1460 *
ccd7b362
JB		 1461 * mac80211 filters only based on association state, i.e. it drops
1462 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB		 1463 * deauth/disassoc frames when needed. In addition, hostapd is
1464 * responsible for filtering on both auth and assoc states.
1465 */
33b64eb2 1466
902acc78 1467 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 1468 return ieee80211_rx_mesh_check(rx);
33b64eb2 1469
a7767f95
HH		 1470 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1471 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 1472 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
239281f8 1473 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
c2c98fde 1474 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
7852e361
JB		 1475 /*
1476 * accept port control frames from the AP even when it's not
1477 * yet marked ASSOC to prevent a race where we don't set the
1478 * assoc bit quickly enough before it sends the first frame
1479 */
1480 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
2a33bee2 1481 ieee80211_is_data_present(hdr->frame_control)) {
6dbda2d0
JB		 1482 unsigned int hdrlen;
1483 __be16 ethertype;
1484
1485 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1486
1487 if (rx->skb->len < hdrlen + 8)
1488 return RX_DROP_MONITOR;
1489
1490 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1491 if (ethertype == rx->sdata->control_port_protocol)
2a33bee2
GE		 1492 return RX_CONTINUE;
1493 }
21fc7560
JB		 1494
1495 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1496 cfg80211_rx_spurious_frame(rx->sdata->dev,
1497 hdr->addr2,
1498 GFP_ATOMIC))
1499 return RX_DROP_UNUSABLE;
1500
e4c26add 1501 return RX_DROP_MONITOR;
2a33bee2 1502 }
571ecf67 1503
9ae54c84 1504 return RX_CONTINUE;
570bd537
JB		 1505}
1506
1507
572e0012
KV		 1508static ieee80211_rx_result debug_noinline
1509ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1510{
1511 struct ieee80211_local *local;
1512 struct ieee80211_hdr *hdr;
1513 struct sk_buff *skb;
1514
1515 local = rx->local;
1516 skb = rx->skb;
1517 hdr = (struct ieee80211_hdr *) skb->data;
1518
1519 if (!local->pspolling)
1520 return RX_CONTINUE;
1521
1522 if (!ieee80211_has_fromds(hdr->frame_control))
1523 /* this is not from AP */
1524 return RX_CONTINUE;
1525
1526 if (!ieee80211_is_data(hdr->frame_control))
1527 return RX_CONTINUE;
1528
1529 if (!ieee80211_has_moredata(hdr->frame_control)) {
1530 /* AP has no more frames buffered for us */
1531 local->pspolling = false;
1532 return RX_CONTINUE;
1533 }
1534
1535 /* more data bit is set, let's request a new frame from the AP */
1536 ieee80211_send_pspoll(local, rx->sdata);
1537
1538 return RX_CONTINUE;
1539}
1540
d012a605 1541static void sta_ps_start(struct sta_info *sta)
571ecf67 1542{
133b8226 1543 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 1544 struct ieee80211_local *local = sdata->local;
d012a605 1545 struct ps_data *ps;
ba8c3d6f 1546 int tid;
0795af57 1547
d012a605
MP		 1548 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1549 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1550 ps = &sdata->bss->ps;
1551 else
1552 return;
1553
1554 atomic_inc(&ps->num_sta_ps);
c2c98fde 1555 set_sta_flag(sta, WLAN_STA_PS_STA);
30686bf7 1556 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
d057e5a3 1557 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
bdcbd8e0
JB		 1558 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1559 sta->sta.addr, sta->sta.aid);
ba8c3d6f 1560
17c18bf8
JB		 1561 ieee80211_clear_fast_xmit(sta);
1562
ba8c3d6f
FF		 1563 if (!sta->sta.txq[0])
1564 return;
1565
adf8ed01 1566 for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
b49c15e1 1567 struct ieee80211_txq *txq = sta->sta.txq[tid];
942741da 1568 struct txq_info *txqi = to_txq_info(txq);
b49c15e1 1569
942741da
FF		 1570 spin_lock(&local->active_txq_lock[txq->ac]);
1571 if (!list_empty(&txqi->schedule_order))
1572 list_del_init(&txqi->schedule_order);
1573 spin_unlock(&local->active_txq_lock[txq->ac]);
b49c15e1
FF		 1574
1575 if (txq_has_queue(txq))
ba8c3d6f
FF		 1576 set_bit(tid, &sta->txq_buffered_tids);
1577 else
1578 clear_bit(tid, &sta->txq_buffered_tids);
1579 }
571ecf67
JB		 1580}
1581
d012a605 1582static void sta_ps_end(struct sta_info *sta)
571ecf67 1583{
bdcbd8e0
JB		 1584 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1585 sta->sta.addr, sta->sta.aid);
004c872e 1586
c2c98fde 1587 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
e3685e03
JB		 1588 /*
1589 * Clear the flag only if the other one is still set
1590 * so that the TX path won't start TX'ing new frames
1591 * directly ... In the case that the driver flag isn't
1592 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1593 */
1594 clear_sta_flag(sta, WLAN_STA_PS_STA);
bdcbd8e0
JB		 1595 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1596 sta->sta.addr, sta->sta.aid);
af818581
JB		 1597 return;
1598 }
1599
5ac2e350
JB		 1600 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1601 clear_sta_flag(sta, WLAN_STA_PS_STA);
af818581 1602 ieee80211_sta_ps_deliver_wakeup(sta);
571ecf67
JB		 1603}
1604
cf47161a 1605int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
d057e5a3 1606{
cf47161a 1607 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
d057e5a3
AN		 1608 bool in_ps;
1609
cf47161a 1610 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
d057e5a3
AN		 1611
1612 /* Don't let the same PS state be set twice */
cf47161a 1613 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
d057e5a3
AN		 1614 if ((start && in_ps) || (!start && !in_ps))
1615 return -EINVAL;
1616
1617 if (start)
cf47161a 1618 sta_ps_start(sta);
d057e5a3 1619 else
cf47161a 1620 sta_ps_end(sta);
d057e5a3
AN		 1621
1622 return 0;
1623}
1624EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1625
46fa38e8
JB		 1626void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1627{
1628 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1629
1630 if (test_sta_flag(sta, WLAN_STA_SP))
1631 return;
1632
1633 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1634 ieee80211_sta_ps_deliver_poll_response(sta);
1635 else
1636 set_sta_flag(sta, WLAN_STA_PSPOLL);
1637}
1638EXPORT_SYMBOL(ieee80211_sta_pspoll);
1639
1640void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1641{
1642 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
731977e9 1643 int ac = ieee80211_ac_from_tid(tid);
46fa38e8
JB		 1644
1645 /*
0aa419ec
EG		 1646 * If this AC is not trigger-enabled do nothing unless the
1647 * driver is calling us after it already checked.
46fa38e8
JB		 1648 *
1649 * NB: This could/should check a separate bitmap of trigger-
1650 * enabled queues, but for now we only implement uAPSD w/o
1651 * TSPEC changes to the ACs, so they're always the same.
1652 */
f438ceb8
EG		 1653 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1654 tid != IEEE80211_NUM_TIDS)
46fa38e8
JB		 1655 return;
1656
1657 /* if we are in a service period, do nothing */
1658 if (test_sta_flag(sta, WLAN_STA_SP))
1659 return;
1660
1661 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1662 ieee80211_sta_ps_deliver_uapsd(sta);
1663 else
1664 set_sta_flag(sta, WLAN_STA_UAPSD);
1665}
1666EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1667
47086fc5
JB		 1668static ieee80211_rx_result debug_noinline
1669ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1670{
1671 struct ieee80211_sub_if_data *sdata = rx->sdata;
1672 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1673 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
47086fc5 1674
5c90067c 1675 if (!rx->sta)
47086fc5
JB		 1676 return RX_CONTINUE;
1677
1678 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1679 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1680 return RX_CONTINUE;
1681
1682 /*
1683 * The device handles station powersave, so don't do anything about
1684 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1685 * it to mac80211 since they're handled.)
1686 */
30686bf7 1687 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
47086fc5
JB		 1688 return RX_CONTINUE;
1689
1690 /*
1691 * Don't do anything if the station isn't already asleep. In
1692 * the uAPSD case, the station will probably be marked asleep,
1693 * in the PS-Poll case the station must be confused ...
1694 */
c2c98fde 1695 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
47086fc5
JB		 1696 return RX_CONTINUE;
1697
1698 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
46fa38e8 1699 ieee80211_sta_pspoll(&rx->sta->sta);
47086fc5
JB		 1700
1701 /* Free PS Poll skb here instead of returning RX_DROP that would
1702 * count as an dropped frame. */
1703 dev_kfree_skb(rx->skb);
1704
1705 return RX_QUEUED;
1706 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1707 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1708 ieee80211_has_pm(hdr->frame_control) &&
1709 (ieee80211_is_data_qos(hdr->frame_control) ||
1710 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
a1f2ba04 1711 u8 tid = ieee80211_get_tid(hdr);
47086fc5 1712
46fa38e8 1713 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
47086fc5
JB		 1714 }
1715
1716 return RX_CONTINUE;
1717}
1718
49461622 1719static ieee80211_rx_result debug_noinline
5cf121c3 1720ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB		 1721{
1722 struct sta_info *sta = rx->sta;
eb9fb5b8
JB		 1723 struct sk_buff *skb = rx->skb;
1724 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1725 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
ef0621e8 1726 int i;
571ecf67
JB		 1727
1728 if (!sta)
9ae54c84 1729 return RX_CONTINUE;
571ecf67 1730
b291ba11
JB		 1731 /*
1732 * Update last_rx only for IBSS packets which are for the current
e584da5e
AQ		 1733 * BSSID and for station already AUTHORIZED to avoid keeping the
1734 * current IBSS network alive in cases where other STAs start
1735 * using different BSSID. This will also give the station another
1736 * chance to restart the authentication/authorization in case
1737 * something went wrong the first time.
b291ba11 1738 */
05c914fe 1739 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 1740 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 1741 NL80211_IFTYPE_ADHOC);
e584da5e
AQ		 1742 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1743 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
046d2e7c 1744 sta->deflink.rx_stats.last_rx = jiffies;
f4ebddf9 1745 if (ieee80211_is_data(hdr->frame_control) &&
4f6b1b3d 1746 !is_multicast_ether_addr(hdr->addr1))
046d2e7c 1747 sta->deflink.rx_stats.last_rate =
4f6b1b3d 1748 sta_stats_encode_rate(status);
3af6334c 1749 }
239281f8 1750 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
046d2e7c 1751 sta->deflink.rx_stats.last_rx = jiffies;
09a740ce 1752 } else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
f879ac8e 1753 !is_multicast_ether_addr(hdr->addr1)) {
b291ba11 1754 /*
33b64eb2
LCC		 1755 * Mesh beacons will update last_rx when if they are found to
1756 * match the current local configuration when processed.
571ecf67 1757 */
046d2e7c 1758 sta->deflink.rx_stats.last_rx = jiffies;
4f6b1b3d 1759 if (ieee80211_is_data(hdr->frame_control))
046d2e7c 1760 sta->deflink.rx_stats.last_rate = sta_stats_encode_rate(status);
571ecf67
JB		 1761 }
1762
046d2e7c 1763 sta->deflink.rx_stats.fragments++;
0f9c5a61 1764
046d2e7c
S		 1765 u64_stats_update_begin(&rx->sta->deflink.rx_stats.syncp);
1766 sta->deflink.rx_stats.bytes += rx->skb->len;
1767 u64_stats_update_end(&rx->sta->deflink.rx_stats.syncp);
0f9c5a61 1768
fe8431f8 1769 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
046d2e7c
S		 1770 sta->deflink.rx_stats.last_signal = status->signal;
1771 ewma_signal_add(&sta->deflink.rx_stats_avg.signal,
1772 -status->signal);
fe8431f8 1773 }
571ecf67 1774
ef0621e8 1775 if (status->chains) {
046d2e7c 1776 sta->deflink.rx_stats.chains = status->chains;
ef0621e8
FF		 1777 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1778 int signal = status->chain_signal[i];
1779
1780 if (!(status->chains & BIT(i)))
1781 continue;
1782
046d2e7c
S		 1783 sta->deflink.rx_stats.chain_signal_last[i] = signal;
1784 ewma_signal_add(&sta->deflink.rx_stats_avg.chain_signal[i],
e5a9f8d0 1785 -signal);
ef0621e8
FF		 1786 }
1787 }
1788
09a740ce
TP		 1789 if (ieee80211_is_s1g_beacon(hdr->frame_control))
1790 return RX_CONTINUE;
1791
72eaa43a
JB		 1792 /*
1793 * Change STA power saving mode only at the end of a frame
9fef6544
EG		 1794 * exchange sequence, and only for a data or management
1795 * frame as specified in IEEE 802.11-2016 11.2.3.2
72eaa43a 1796 */
30686bf7 1797 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
d057e5a3 1798 !ieee80211_has_morefrags(hdr->frame_control) &&
20932750 1799 !is_multicast_ether_addr(hdr->addr1) &&
9fef6544
EG		 1800 (ieee80211_is_mgmt(hdr->frame_control) ||
1801 ieee80211_is_data(hdr->frame_control)) &&
4cfda47b 1802 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
05c914fe 1803 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
9fef6544 1804 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
c2c98fde 1805 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
b4ba544c 1806 if (!ieee80211_has_pm(hdr->frame_control))
d012a605 1807 sta_ps_end(sta);
72eaa43a
JB		 1808 } else {
1809 if (ieee80211_has_pm(hdr->frame_control))
d012a605 1810 sta_ps_start(sta);
72eaa43a 1811 }
571ecf67
JB		 1812 }
1813
3f52b7e3
MP		 1814 /* mesh power save support */
1815 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1816 ieee80211_mps_rx_h_sta_process(sta, hdr);
1817
22403def
JB		 1818 /*
1819 * Drop (qos-)data::nullfunc frames silently, since they
1820 * are used only to control station power saving mode.
1821 */
30b2f0be 1822 if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
571ecf67 1823 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
d524215f
FF		 1824
1825 /*
1826 * If we receive a 4-addr nullfunc frame from a STA
e7f4a940
JB		 1827 * that was not moved to a 4-addr STA vlan yet send
1828 * the event to userspace and for older hostapd drop
1829 * the frame to the monitor interface.
d524215f
FF		 1830 */
1831 if (ieee80211_has_a4(hdr->frame_control) &&
1832 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1833 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
e7f4a940
JB		 1834 !rx->sdata->u.vlan.sta))) {
1835 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1836 cfg80211_rx_unexpected_4addr_frame(
1837 rx->sdata->dev, sta->sta.addr,
1838 GFP_ATOMIC);
d524215f 1839 return RX_DROP_MONITOR;
e7f4a940 1840 }
22403def
JB		 1841 /*
1842 * Update counter and free packet here to avoid
1843 * counting this as a dropped packed.
1844 */
046d2e7c 1845 sta->deflink.rx_stats.packets++;
571ecf67 1846 dev_kfree_skb(rx->skb);
9ae54c84 1847 return RX_QUEUED;
571ecf67
JB		 1848 }
1849
9ae54c84 1850 return RX_CONTINUE;
571ecf67
JB		 1851} /* ieee80211_rx_h_sta_process */
1852
af2d14b0
JM		 1853static struct ieee80211_key *
1854ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1855{
1856 struct ieee80211_key *key = NULL;
1857 struct ieee80211_sub_if_data *sdata = rx->sdata;
1858 int idx2;
1859
1860 /* Make sure key gets set if either BIGTK key index is set so that
1861 * ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
1862 * Beacon frames and Beacon frames that claim to use another BIGTK key
1863 * index (i.e., a key that we do not have).
1864 */
1865
1866 if (idx < 0) {
1867 idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
1868 idx2 = idx + 1;
1869 } else {
1870 if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1871 idx2 = idx + 1;
1872 else
1873 idx2 = idx - 1;
1874 }
1875
1876 if (rx->sta)
046d2e7c 1877 key = rcu_dereference(rx->sta->deflink.gtk[idx]);
af2d14b0 1878 if (!key)
bfd8403a 1879 key = rcu_dereference(sdata->deflink.gtk[idx]);
af2d14b0 1880 if (!key && rx->sta)
046d2e7c 1881 key = rcu_dereference(rx->sta->deflink.gtk[idx2]);
af2d14b0 1882 if (!key)
bfd8403a 1883 key = rcu_dereference(sdata->deflink.gtk[idx2]);
af2d14b0
JM		 1884
1885 return key;
1886}
1887
86c228a7
JA		 1888static ieee80211_rx_result debug_noinline
1889ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1890{
1891 struct sk_buff *skb = rx->skb;
1892 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1893 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1894 int keyidx;
86c228a7
JA		 1895 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1896 struct ieee80211_key *sta_ptk = NULL;
96fc6efb 1897 struct ieee80211_key *ptk_idx = NULL;
86c228a7
JA		 1898 int mmie_keyidx = -1;
1899 __le16 fc;
1900
09a740ce
TP		 1901 if (ieee80211_is_ext(hdr->frame_control))
1902 return RX_CONTINUE;
1903
86c228a7
JA		 1904 /*
1905 * Key selection 101
1906 *
af2d14b0 1907 * There are five types of keys:
86c228a7
JA		 1908 * - GTK (group keys)
1909 * - IGTK (group keys for management frames)
af2d14b0 1910 * - BIGTK (group keys for Beacon frames)
86c228a7
JA		 1911 * - PTK (pairwise keys)
1912 * - STK (station-to-station pairwise keys)
1913 *
1914 * When selecting a key, we have to distinguish between multicast
1915 * (including broadcast) and unicast frames, the latter can only
af2d14b0
JM		 1916 * use PTKs and STKs while the former always use GTKs, IGTKs, and
1917 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
1918 * then unicast frames can also use key indices like GTKs. Hence, if we
86c228a7
JA		 1919 * don't have a PTK/STK we check the key index for a WEP key.
1920 *
1921 * Note that in a regular BSS, multicast frames are sent by the
1922 * AP only, associated stations unicast the frame to the AP first
1923 * which then multicasts it on their behalf.
1924 *
1925 * There is also a slight problem in IBSS mode: GTKs are negotiated
1926 * with each station, that is something we don't currently handle.
1927 * The spec seems to expect that one negotiates the same key with
1928 * every station but there's no such requirement; VLANs could be
1929 * possible.
1930 */
1931
86c228a7
JA		 1932 /* start without a key */
1933 rx->key = NULL;
2475b1cc 1934 fc = hdr->frame_control;
86c228a7 1935
2475b1cc
MS		 1936 if (rx->sta) {
1937 int keyid = rx->sta->ptk_idx;
96fc6efb 1938 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
86c228a7 1939
77dfc2bc
XS		 1940 if (ieee80211_has_protected(fc) &&
1941 !(status->flag & RX_FLAG_IV_STRIPPED)) {
23a5f0af 1942 keyid = ieee80211_get_keyid(rx->skb);
96fc6efb 1943
2475b1cc
MS		 1944 if (unlikely(keyid < 0))
1945 return RX_DROP_UNUSABLE;
96fc6efb
AW		 1946
1947 ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
2475b1cc 1948 }
2475b1cc 1949 }
86c228a7
JA		 1950
1951 if (!ieee80211_has_protected(fc))
1952 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1953
1954 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
96fc6efb 1955 rx->key = ptk_idx ? ptk_idx : sta_ptk;
86c228a7
JA		 1956 if ((status->flag & RX_FLAG_DECRYPTED) &&
1957 (status->flag & RX_FLAG_IV_STRIPPED))
1958 return RX_CONTINUE;
1959 /* Skip decryption if the frame is not protected. */
1960 if (!ieee80211_has_protected(fc))
1961 return RX_CONTINUE;
af2d14b0
JM		 1962 } else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
1963 /* Broadcast/multicast robust management frame / BIP */
1964 if ((status->flag & RX_FLAG_DECRYPTED) &&
1965 (status->flag & RX_FLAG_IV_STRIPPED))
1966 return RX_CONTINUE;
1967
1968 if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
1969 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
9eaf183a
JM		 1970 NUM_DEFAULT_BEACON_KEYS) {
1971 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1972 skb->data,
1973 skb->len);
af2d14b0 1974 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
9eaf183a 1975 }
af2d14b0
JM		 1976
1977 rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
1978 if (!rx->key)
1979 return RX_CONTINUE; /* Beacon protection not in use */
86c228a7
JA		 1980 } else if (mmie_keyidx >= 0) {
1981 /* Broadcast/multicast robust management frame / BIP */
1982 if ((status->flag & RX_FLAG_DECRYPTED) &&
1983 (status->flag & RX_FLAG_IV_STRIPPED))
1984 return RX_CONTINUE;
1985
1986 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1987 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1988 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
46f6b060
MH		 1989 if (rx->sta) {
1990 if (ieee80211_is_group_privacy_action(skb) &&
1991 test_sta_flag(rx->sta, WLAN_STA_MFP))
1992 return RX_DROP_MONITOR;
1993
046d2e7c 1994 rx->key = rcu_dereference(rx->sta->deflink.gtk[mmie_keyidx]);
46f6b060 1995 }
86c228a7 1996 if (!rx->key)
bfd8403a 1997 rx->key = rcu_dereference(rx->sdata->deflink.gtk[mmie_keyidx]);
86c228a7
JA		 1998 } else if (!ieee80211_has_protected(fc)) {
1999 /*
2000 * The frame was not protected, so skip decryption. However, we
2001 * need to set rx->key if there is a key that could have been
2002 * used so that the frame may be dropped if encryption would
2003 * have been expected.
2004 */
2005 struct ieee80211_key *key = NULL;
2006 struct ieee80211_sub_if_data *sdata = rx->sdata;
2007 int i;
2008
af2d14b0
JM		 2009 if (ieee80211_is_beacon(fc)) {
2010 key = ieee80211_rx_get_bigtk(rx, -1);
2011 } else if (ieee80211_is_mgmt(fc) &&
2012 is_multicast_ether_addr(hdr->addr1)) {
bfd8403a 2013 key = rcu_dereference(rx->sdata->deflink.default_mgmt_key);
af2d14b0 2014 } else {
86c228a7
JA		 2015 if (rx->sta) {
2016 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
046d2e7c 2017 key = rcu_dereference(rx->sta->deflink.gtk[i]);
86c228a7
JA		 2018 if (key)
2019 break;
2020 }
2021 }
2022 if (!key) {
2023 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
bfd8403a 2024 key = rcu_dereference(sdata->deflink.gtk[i]);
86c228a7
JA		 2025 if (key)
2026 break;
2027 }
2028 }
86c228a7 2029 }
af2d14b0
JM		 2030 if (key)
2031 rx->key = key;
86c228a7
JA		 2032 return RX_CONTINUE;
2033 } else {
86c228a7
JA		 2034 /*
2035 * The device doesn't give us the IV so we won't be
2036 * able to look up the key. That's ok though, we
2037 * don't need to decrypt the frame, we just won't
2038 * be able to keep statistics accurate.
2039 * Except for key threshold notifications, should
2040 * we somehow allow the driver to tell us which key
2041 * the hardware used if this flag is set?
2042 */
2043 if ((status->flag & RX_FLAG_DECRYPTED) &&
2044 (status->flag & RX_FLAG_IV_STRIPPED))
2045 return RX_CONTINUE;
2046
23a5f0af 2047 keyidx = ieee80211_get_keyid(rx->skb);
86c228a7 2048
96fc6efb
AW		 2049 if (unlikely(keyidx < 0))
2050 return RX_DROP_UNUSABLE;
86c228a7
JA		 2051
2052 /* check per-station GTK first, if multicast packet */
2053 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
046d2e7c 2054 rx->key = rcu_dereference(rx->sta->deflink.gtk[keyidx]);
86c228a7
JA		 2055
2056 /* if not found, try default key */
2057 if (!rx->key) {
bfd8403a
JB		 2058 if (is_multicast_ether_addr(hdr->addr1))
2059 rx->key = rcu_dereference(rx->sdata->deflink.gtk[keyidx]);
2060 if (!rx->key)
2061 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
86c228a7
JA		 2062
2063 /*
2064 * RSNA-protected unicast frames should always be
2065 * sent with pairwise or station-to-station keys,
2066 * but for WEP we allow using a key index as well.
2067 */
2068 if (rx->key &&
2069 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2070 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2071 !is_multicast_ether_addr(hdr->addr1))
2072 rx->key = NULL;
2073 }
2074 }
2075
2076 if (rx->key) {
2077 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2078 return RX_DROP_MONITOR;
2079
86c228a7
JA		 2080 /* TODO: add threshold stuff again */
2081 } else {
2082 return RX_DROP_MONITOR;
2083 }
2084
2085 switch (rx->key->conf.cipher) {
2086 case WLAN_CIPHER_SUITE_WEP40:
2087 case WLAN_CIPHER_SUITE_WEP104:
2088 result = ieee80211_crypto_wep_decrypt(rx);
2089 break;
2090 case WLAN_CIPHER_SUITE_TKIP:
2091 result = ieee80211_crypto_tkip_decrypt(rx);
2092 break;
2093 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db
JM		 2094 result = ieee80211_crypto_ccmp_decrypt(
2095 rx, IEEE80211_CCMP_MIC_LEN);
2096 break;
2097 case WLAN_CIPHER_SUITE_CCMP_256:
2098 result = ieee80211_crypto_ccmp_decrypt(
2099 rx, IEEE80211_CCMP_256_MIC_LEN);
86c228a7
JA		 2100 break;
2101 case WLAN_CIPHER_SUITE_AES_CMAC:
2102 result = ieee80211_crypto_aes_cmac_decrypt(rx);
2103 break;
56c52da2
JM		 2104 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2105 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
2106 break;
8ade538b
JM		 2107 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2108 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2109 result = ieee80211_crypto_aes_gmac_decrypt(rx);
2110 break;
00b9cfa3
JM		 2111 case WLAN_CIPHER_SUITE_GCMP:
2112 case WLAN_CIPHER_SUITE_GCMP_256:
2113 result = ieee80211_crypto_gcmp_decrypt(rx);
2114 break;
86c228a7 2115 default:
23a5f0af 2116 result = RX_DROP_UNUSABLE;
86c228a7
JA		 2117 }
2118
2119 /* the hdr variable is invalid after the decrypt handlers */
2120
2121 /* either the frame has been decrypted or will be dropped */
2122 status->flag |= RX_FLAG_DECRYPTED;
2123
9eaf183a
JM		 2124 if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE))
2125 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2126 skb->data, skb->len);
2127
86c228a7
JA		 2128 return result;
2129}
2130
3a11ce08
JB		 2131void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2132{
2133 int i;
2134
2135 for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2136 skb_queue_head_init(&cache->entries[i].skb_list);
2137}
2138
2139void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2140{
2141 int i;
2142
2143 for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2144 __skb_queue_purge(&cache->entries[i].skb_list);
2145}
2146
571ecf67 2147static inline struct ieee80211_fragment_entry *
3a11ce08 2148ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
571ecf67
JB		 2149 unsigned int frag, unsigned int seq, int rx_queue,
2150 struct sk_buff **skb)
2151{
2152 struct ieee80211_fragment_entry *entry;
571ecf67 2153
3a11ce08
JB		 2154 entry = &cache->entries[cache->next++];
2155 if (cache->next >= IEEE80211_FRAGMENT_MAX)
2156 cache->next = 0;
571ecf67 2157
3a11ce08 2158 __skb_queue_purge(&entry->skb_list);
571ecf67
JB		 2159
2160 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
2161 *skb = NULL;
2162 entry->first_frag_time = jiffies;
2163 entry->seq = seq;
2164 entry->rx_queue = rx_queue;
2165 entry->last_frag = frag;
9acc54be 2166 entry->check_sequential_pn = false;
571ecf67
JB		 2167 entry->extra_len = 0;
2168
2169 return entry;
2170}
2171
2172static inline struct ieee80211_fragment_entry *
3a11ce08 2173ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
b73d70ad 2174 unsigned int frag, unsigned int seq,
571ecf67
JB		 2175 int rx_queue, struct ieee80211_hdr *hdr)
2176{
2177 struct ieee80211_fragment_entry *entry;
2178 int i, idx;
2179
3a11ce08 2180 idx = cache->next;
571ecf67
JB		 2181 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2182 struct ieee80211_hdr *f_hdr;
7957a9de 2183 struct sk_buff *f_skb;
571ecf67
JB		 2184
2185 idx--;
2186 if (idx < 0)
2187 idx = IEEE80211_FRAGMENT_MAX - 1;
2188
3a11ce08 2189 entry = &cache->entries[idx];
571ecf67
JB		 2190 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2191 entry->rx_queue != rx_queue ||
2192 entry->last_frag + 1 != frag)
2193 continue;
2194
7957a9de
DM		 2195 f_skb = __skb_peek(&entry->skb_list);
2196 f_hdr = (struct ieee80211_hdr *) f_skb->data;
571ecf67 2197
b73d70ad
HH		 2198 /*
2199 * Check ftype and addresses are equal, else check next fragment
2200 */
2201 if (((hdr->frame_control ^ f_hdr->frame_control) &
2202 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
b203ca39
JP		 2203 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
2204 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
571ecf67
JB		 2205 continue;
2206
ab46623e 2207 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB		 2208 __skb_queue_purge(&entry->skb_list);
2209 continue;
2210 }
2211 return entry;
2212 }
2213
2214 return NULL;
2215}
2216
965a7d72
MV		 2217static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2218{
2219 return rx->key &&
2220 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2221 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2222 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2223 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2224 ieee80211_has_protected(fc);
2225}
2226
49461622 2227static ieee80211_rx_result debug_noinline
5cf121c3 2228ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67 2229{
3a11ce08 2230 struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
571ecf67
JB		 2231 struct ieee80211_hdr *hdr;
2232 u16 sc;
358c8d9d 2233 __le16 fc;
571ecf67
JB		 2234 unsigned int frag, seq;
2235 struct ieee80211_fragment_entry *entry;
2236 struct sk_buff *skb;
3edc6b0d 2237 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 2238
b73d70ad 2239 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 2240 fc = hdr->frame_control;
f7fbf70e 2241
09a740ce 2242 if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
f7fbf70e
JC		 2243 return RX_CONTINUE;
2244
571ecf67
JB		 2245 sc = le16_to_cpu(hdr->seq_ctrl);
2246 frag = sc & IEEE80211_SCTL_FRAG;
2247
3a11ce08
JB		 2248 if (rx->sta)
2249 cache = &rx->sta->frags;
2250
d025933e
AM		 2251 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2252 goto out;
2253
a9799541
JB		 2254 if (is_multicast_ether_addr(hdr->addr1))
2255 return RX_DROP_MONITOR;
2256
571ecf67
JB		 2257 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2258
e3cf8b3f
ZY		 2259 if (skb_linearize(rx->skb))
2260 return RX_DROP_UNUSABLE;
2261
058897a4
AK		 2262 /*
2263 * skb_linearize() might change the skb->data and
2264 * previously cached variables (in this case, hdr) need to
2265 * be refreshed with the new data.
2266 */
2267 hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB		 2268 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2269
2270 if (frag == 0) {
2271 /* This is the first fragment of a new frame. */
3a11ce08 2272 entry = ieee80211_reassemble_add(cache, frag, seq,
9e26297a 2273 rx->seqno_idx, &(rx->skb));
965a7d72 2274 if (requires_sequential_pn(rx, fc)) {
9e26297a 2275 int queue = rx->security_idx;
9acc54be
JB		 2276
2277 /* Store CCMP/GCMP PN so that we can verify that the
2278 * next fragment has a sequential PN value.
2279 */
2280 entry->check_sequential_pn = true;
7e44a0b5 2281 entry->is_protected = true;
94034c40 2282 entry->key_color = rx->key->color;
571ecf67 2283 memcpy(entry->last_pn,
9190252c 2284 rx->key->u.ccmp.rx_pn[queue],
4325f6ca 2285 IEEE80211_CCMP_PN_LEN);
9acc54be
JB		 2286 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2287 u.ccmp.rx_pn) !=
2288 offsetof(struct ieee80211_key,
2289 u.gcmp.rx_pn));
2290 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2291 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2292 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2293 IEEE80211_GCMP_PN_LEN);
3edc6b0d
WG		 2294 } else if (rx->key &&
2295 (ieee80211_has_protected(fc) ||
2296 (status->flag & RX_FLAG_DECRYPTED))) {
7e44a0b5
JB		 2297 entry->is_protected = true;
2298 entry->key_color = rx->key->color;
571ecf67 2299 }
9ae54c84 2300 return RX_QUEUED;
571ecf67
JB		 2301 }
2302
2303 /* This is a fragment for a frame that should already be pending in
2304 * fragment cache. Add this fragment to the end of the pending entry.
2305 */
3a11ce08 2306 entry = ieee80211_reassemble_find(cache, frag, seq,
9e26297a 2307 rx->seqno_idx, hdr);
571ecf67
JB		 2308 if (!entry) {
2309 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 2310 return RX_DROP_MONITOR;
571ecf67
JB		 2311 }
2312
9acc54be
JB		 2313 /* "The receiver shall discard MSDUs and MMPDUs whose constituent
2314 * MPDU PN values are not incrementing in steps of 1."
2315 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2316 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2317 */
2318 if (entry->check_sequential_pn) {
571ecf67 2319 int i;
4325f6ca 2320 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
9acc54be 2321
965a7d72 2322 if (!requires_sequential_pn(rx, fc))
e4c26add 2323 return RX_DROP_UNUSABLE;
94034c40
MV		 2324
2325 /* Prevent mixed key and fragment cache attacks */
2326 if (entry->key_color != rx->key->color)
2327 return RX_DROP_UNUSABLE;
2328
4325f6ca
JB		 2329 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2330 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
571ecf67
JB		 2331 pn[i]++;
2332 if (pn[i])
2333 break;
2334 }
bf30ca92
JB		 2335
2336 rpn = rx->ccm_gcm.pn;
4325f6ca 2337 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
e4c26add 2338 return RX_DROP_UNUSABLE;
4325f6ca 2339 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
7e44a0b5 2340 } else if (entry->is_protected &&
3edc6b0d
WG		 2341 (!rx->key ||
2342 (!ieee80211_has_protected(fc) &&
2343 !(status->flag & RX_FLAG_DECRYPTED)) ||
7e44a0b5
JB		 2344 rx->key->color != entry->key_color)) {
2345 /* Drop this as a mixed key or fragment cache attack, even
2346 * if for TKIP Michael MIC should protect us, and WEP is a
2347 * lost cause anyway.
2348 */
2349 return RX_DROP_UNUSABLE;
3edc6b0d
WG		 2350 } else if (entry->is_protected && rx->key &&
2351 entry->key_color != rx->key->color &&
2352 (status->flag & RX_FLAG_DECRYPTED)) {
2353 return RX_DROP_UNUSABLE;
571ecf67
JB		 2354 }
2355
358c8d9d 2356 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB		 2357 __skb_queue_tail(&entry->skb_list, rx->skb);
2358 entry->last_frag = frag;
2359 entry->extra_len += rx->skb->len;
358c8d9d 2360 if (ieee80211_has_morefrags(fc)) {
571ecf67 2361 rx->skb = NULL;
9ae54c84 2362 return RX_QUEUED;
571ecf67
JB		 2363 }
2364
2365 rx->skb = __skb_dequeue(&entry->skb_list);
2366 if (skb_tailroom(rx->skb) < entry->extra_len) {
f1160434 2367 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
571ecf67
JB		 2368 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2369 GFP_ATOMIC))) {
2370 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2371 __skb_queue_purge(&entry->skb_list);
e4c26add 2372 return RX_DROP_UNUSABLE;
571ecf67
JB		 2373 }
2374 }
2375 while ((skb = __skb_dequeue(&entry->skb_list))) {
59ae1d12 2376 skb_put_data(rx->skb, skb->data, skb->len);
571ecf67
JB		 2377 dev_kfree_skb(skb);
2378 }
2379
571ecf67 2380 out:
d025933e 2381 ieee80211_led_rx(rx->local);
571ecf67 2382 if (rx->sta)
046d2e7c 2383 rx->sta->deflink.rx_stats.packets++;
9ae54c84 2384 return RX_CONTINUE;
571ecf67
JB		 2385}
2386
1df332e8 2387static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 2388{
1df332e8 2389 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 2390 return -EACCES;
571ecf67 2391
76ee65bf 2392 return 0;
571ecf67
JB		 2393}
2394
1df332e8 2395static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 2396{
0b467b63 2397 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
eb9fb5b8
JB		 2398 struct sk_buff *skb = rx->skb;
2399 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2400
3017b80b 2401 /*
7848ba7d
JB		 2402 * Pass through unencrypted frames if the hardware has
2403 * decrypted them already.
3017b80b 2404 */
eb9fb5b8 2405 if (status->flag & RX_FLAG_DECRYPTED)
76ee65bf 2406 return 0;
571ecf67 2407
0b467b63
MT		 2408 /* check mesh EAPOL frames first */
2409 if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
2410 ieee80211_is_data(fc))) {
2411 struct ieee80211s_hdr *mesh_hdr;
2412 u16 hdr_len = ieee80211_hdrlen(fc);
2413 u16 ethertype_offset;
2414 __be16 ethertype;
2415
2416 if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
2417 goto drop_check;
2418
2419 /* make sure fixed part of mesh header is there, also checks skb len */
2420 if (!pskb_may_pull(rx->skb, hdr_len + 6))
2421 goto drop_check;
2422
2423 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
2424 ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
2425 sizeof(rfc1042_header);
2426
2427 if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
2428 ethertype == rx->sdata->control_port_protocol)
2429 return 0;
2430 }
2431
2432drop_check:
571ecf67 2433 /* Drop unencrypted frames if key is set. */
358c8d9d 2434 if (unlikely(!ieee80211_has_protected(fc) &&
30b2f0be 2435 !ieee80211_is_any_nullfunc(fc) &&
e8f4fb7c 2436 ieee80211_is_data(fc) && rx->key))
76ee65bf 2437 return -EACCES;
bef5d1c7
JB		 2438
2439 return 0;
2440}
2441
1df332e8 2442static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
bef5d1c7
JB		 2443{
2444 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
e3efca0a 2445 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
bef5d1c7 2446 __le16 fc = hdr->frame_control;
bef5d1c7 2447
e3efca0a
JM		 2448 /*
2449 * Pass through unencrypted frames if the hardware has
2450 * decrypted them already.
2451 */
2452 if (status->flag & RX_FLAG_DECRYPTED)
2453 return 0;
bef5d1c7 2454
c2c98fde 2455 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
d211e90e
JM		 2456 if (unlikely(!ieee80211_has_protected(fc) &&
2457 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
cf4e594e 2458 rx->key)) {
6ff57cf8
JB		 2459 if (ieee80211_is_deauth(fc) ||
2460 ieee80211_is_disassoc(fc))
2461 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2462 rx->skb->data,
2463 rx->skb->len);
f2ca3ea4 2464 return -EACCES;
cf4e594e 2465 }
f2ca3ea4 2466 /* BIP does not use Protected field, so need to check MMIE */
f64f9e71 2467 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
cf4e594e 2468 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
6ff57cf8
JB		 2469 if (ieee80211_is_deauth(fc) ||
2470 ieee80211_is_disassoc(fc))
2471 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2472 rx->skb->data,
2473 rx->skb->len);
f2ca3ea4 2474 return -EACCES;
cf4e594e 2475 }
af2d14b0 2476 if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
9eaf183a
JM		 2477 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2478 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2479 rx->skb->data,
2480 rx->skb->len);
af2d14b0 2481 return -EACCES;
9eaf183a 2482 }
f2ca3ea4
JM		 2483 /*
2484 * When using MFP, Action frames are not allowed prior to
2485 * having configured keys.
2486 */
2487 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
d8ca16db 2488 ieee80211_is_robust_mgmt_frame(rx->skb)))
f2ca3ea4
JM		 2489 return -EACCES;
2490 }
b3fc9c6c 2491
76ee65bf 2492 return 0;
571ecf67
JB		 2493}
2494
76ee65bf 2495static int
4114fa21 2496__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
571ecf67 2497{
eb9fb5b8 2498 struct ieee80211_sub_if_data *sdata = rx->sdata;
f14543ee 2499 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
fbb327c5
FF		 2500 bool check_port_control = false;
2501 struct ethhdr *ehdr;
2502 int ret;
f14543ee 2503
4114fa21 2504 *port_control = false;
9bc383de
JB		 2505 if (ieee80211_has_a4(hdr->frame_control) &&
2506 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
f14543ee 2507 return -1;
9bc383de 2508
fbb327c5
FF		 2509 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2510 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2511
2512 if (!sdata->u.mgd.use_4addr)
2513 return -1;
1ecef20c 2514 else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))
fbb327c5
FF		 2515 check_port_control = true;
2516 }
2517
9bc383de 2518 if (is_multicast_ether_addr(hdr->addr1) &&
fbb327c5 2519 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
f14543ee 2520 return -1;
571ecf67 2521
fbb327c5 2522 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
4114fa21 2523 if (ret < 0)
fbb327c5
FF		 2524 return ret;
2525
2526 ehdr = (struct ethhdr *) rx->skb->data;
4114fa21
FF		 2527 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2528 *port_control = true;
2529 else if (check_port_control)
fbb327c5
FF		 2530 return -1;
2531
2532 return 0;
76ee65bf 2533}
571ecf67 2534
ce3edf6d
JB		 2535/*
2536 * requires that rx->skb is a frame with ethernet header
2537 */
358c8d9d 2538static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 2539{
c97c23e3 2540 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB		 2541 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2542 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2543
2544 /*
a8c4d76a
JB		 2545 * Allow EAPOL frames to us/the PAE group address regardless of
2546 * whether the frame was encrypted or not, and always disallow
2547 * all other destination addresses for them.
ce3edf6d 2548 */
a8c4d76a
JB		 2549 if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2550 return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2551 ether_addr_equal(ehdr->h_dest, pae_group_addr);
ce3edf6d
JB		 2552
2553 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 2554 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB		 2555 return false;
2556
2557 return true;
2558}
2559
018f6fbf
DK		 2560static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2561 struct ieee80211_rx_data *rx)
2562{
2563 struct ieee80211_sub_if_data *sdata = rx->sdata;
2564 struct net_device *dev = sdata->dev;
2565
2566 if (unlikely((skb->protocol == sdata->control_port_protocol ||
7f3f96ce
MT		 2567 (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2568 !sdata->control_port_no_preauth)) &&
018f6fbf
DK		 2569 sdata->control_port_over_nl80211)) {
2570 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
f8b43c5c 2571 bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
018f6fbf 2572
a948f713 2573 cfg80211_rx_control_port(dev, skb, noencrypt);
018f6fbf
DK		 2574 dev_kfree_skb(skb);
2575 } else {
a8c4d76a
JB		 2576 struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2577
c8a41c6a
DK		 2578 memset(skb->cb, 0, sizeof(skb->cb));
2579
a8c4d76a
JB		 2580 /*
2581 * 802.1X over 802.11 requires that the authenticator address
2582 * be used for EAPOL frames. However, 802.1X allows the use of
2583 * the PAE group address instead. If the interface is part of
2584 * a bridge and we pass the frame with the PAE group address,
2585 * then the bridge will forward it to the network (even if the
2586 * client was not associated yet), which isn't supposed to
2587 * happen.
2588 * To avoid that, rewrite the destination address to our own
2589 * address, so that the authenticator (e.g. hostapd) will see
2590 * the frame, but bridge won't forward it anywhere else. Note
2591 * that due to earlier filtering, the only other address can
610d086d
DW		 2592 * be the PAE group address, unless the hardware allowed them
2593 * through in 802.3 offloaded mode.
a8c4d76a
JB		 2594 */
2595 if (unlikely(skb->protocol == sdata->control_port_protocol &&
2596 !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2597 ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
2598
018f6fbf 2599 /* deliver to local stack */
c5d1686b
FF		 2600 if (rx->list)
2601 list_add_tail(&skb->list, rx->list);
018f6fbf
DK		 2602 else
2603 netif_receive_skb(skb);
2604 }
2605}
2606
ce3edf6d
JB		 2607/*
2608 * requires that rx->skb is a frame with ethernet header
2609 */
76ee65bf 2610static void
5cf121c3 2611ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf 2612{
eb9fb5b8
JB		 2613 struct ieee80211_sub_if_data *sdata = rx->sdata;
2614 struct net_device *dev = sdata->dev;
76ee65bf 2615 struct sk_buff *skb, *xmit_skb;
ce3edf6d
JB		 2616 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2617 struct sta_info *dsta;
571ecf67 2618
76ee65bf
RR		 2619 skb = rx->skb;
2620 xmit_skb = NULL;
571ecf67 2621
36ec144f 2622 dev_sw_netstats_rx_add(dev, skb->len);
5a490510 2623
de8f18d3
JB		 2624 if (rx->sta) {
2625 /* The seqno index has the same property as needed
2626 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2627 * for non-QoS-data frames. Here we know it's a data
2628 * frame, so count MSDUs.
2629 */
046d2e7c
S		 2630 u64_stats_update_begin(&rx->sta->deflink.rx_stats.syncp);
2631 rx->sta->deflink.rx_stats.msdu[rx->seqno_idx]++;
2632 u64_stats_update_end(&rx->sta->deflink.rx_stats.syncp);
de8f18d3
JB		 2633 }
2634
05c914fe
JB		 2635 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2636 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 2637 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
a8c4d76a 2638 ehdr->h_proto != rx->sdata->control_port_protocol &&
9bc383de 2639 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
72f15d53
MB		 2640 if (is_multicast_ether_addr(ehdr->h_dest) &&
2641 ieee80211_vif_get_num_mcast_if(sdata) != 0) {
ce3edf6d
JB		 2642 /*
2643 * send multicast frames both to higher layers in
2644 * local net stack and back to the wireless medium
2645 */
76ee65bf 2646 xmit_skb = skb_copy(skb, GFP_ATOMIC);
e87cc472 2647 if (!xmit_skb)
bdcbd8e0 2648 net_info_ratelimited("%s: failed to clone multicast frame\n",
e87cc472 2649 dev->name);
42dca5ef
JB		 2650 } else if (!is_multicast_ether_addr(ehdr->h_dest) &&
2651 !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {
2652 dsta = sta_info_get(sdata, ehdr->h_dest);
abe60632 2653 if (dsta) {
ce3edf6d
JB		 2654 /*
2655 * The destination station is associated to
2656 * this AP (in this VLAN), so send the frame
2657 * directly to it and do not pass it to local
2658 * net stack.
571ecf67 2659 */
76ee65bf 2660 xmit_skb = skb;
571ecf67
JB		 2661 skb = NULL;
2662 }
571ecf67
JB		 2663 }
2664 }
2665
59d9cb07 2666#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
9e890a1f
JB		 2667 if (skb) {
2668 /* 'align' will only take the values 0 or 2 here since all
2669 * frames are required to be aligned to 2-byte boundaries
2670 * when being passed to mac80211; the code here works just
2671 * as well if that isn't true, but mac80211 assumes it can
2672 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
d1c3a37c 2673 */
9e890a1f
JB		 2674 int align;
2675
2676 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
d1c3a37c
JB		 2677 if (align) {
2678 if (WARN_ON(skb_headroom(skb) < 3)) {
2679 dev_kfree_skb(skb);
2680 skb = NULL;
2681 } else {
2682 u8 *data = skb->data;
8ce0b589
ZY		 2683 size_t len = skb_headlen(skb);
2684 skb->data -= align;
2685 memmove(skb->data, data, len);
2686 skb_set_tail_pointer(skb, len);
d1c3a37c
JB		 2687 }
2688 }
9e890a1f 2689 }
d1c3a37c
JB		 2690#endif
2691
9e890a1f 2692 if (skb) {
9e890a1f 2693 skb->protocol = eth_type_trans(skb, dev);
018f6fbf 2694 ieee80211_deliver_skb_to_local_stack(skb, rx);
571ecf67
JB		 2695 }
2696
76ee65bf 2697 if (xmit_skb) {
aef6c928
HS		 2698 /*
2699 * Send to wireless media and increase priority by 256 to
2700 * keep the received priority instead of reclassifying
2701 * the frame (see cfg80211_classify8021d).
2702 */
2703 xmit_skb->priority += 256;
f831e909 2704 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB		 2705 skb_reset_network_header(xmit_skb);
2706 skb_reset_mac_header(xmit_skb);
76ee65bf 2707 dev_queue_xmit(xmit_skb);
571ecf67 2708 }
76ee65bf
RR		 2709}
2710
49461622 2711static ieee80211_rx_result debug_noinline
24bba078 2712__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
fd4c7f2f 2713{
eb9fb5b8 2714 struct net_device *dev = rx->sdata->dev;
eaf85ca7 2715 struct sk_buff *skb = rx->skb;
358c8d9d
HH		 2716 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2717 __le16 fc = hdr->frame_control;
eaf85ca7 2718 struct sk_buff_head frame_list;
7f6990c8 2719 struct ethhdr ethhdr;
e2b5227f 2720 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
fd4c7f2f 2721
ea720935 2722 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
e2b5227f
JB		 2723 check_da = NULL;
2724 check_sa = NULL;
2725 } else switch (rx->sdata->vif.type) {
2726 case NL80211_IFTYPE_AP:
2727 case NL80211_IFTYPE_AP_VLAN:
2728 check_da = NULL;
2729 break;
2730 case NL80211_IFTYPE_STATION:
2731 if (!rx->sta ||
2732 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
2733 check_sa = NULL;
2734 break;
2735 case NL80211_IFTYPE_MESH_POINT:
2736 check_sa = NULL;
2737 break;
2738 default:
2739 break;
ea720935 2740 }
fd4c7f2f 2741
eaf85ca7
ZY		 2742 skb->dev = dev;
2743 __skb_queue_head_init(&frame_list);
fd4c7f2f 2744
7f6990c8
JB		 2745 if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
2746 rx->sdata->vif.addr,
24bba078 2747 rx->sdata->vif.type,
a1d5ff56 2748 data_offset, true))
7f6990c8
JB		 2749 return RX_DROP_UNUSABLE;
2750
eaf85ca7
ZY		 2751 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2752 rx->sdata->vif.type,
8b935ee2 2753 rx->local->hw.extra_tx_headroom,
e2b5227f 2754 check_da, check_sa);
fd4c7f2f 2755
eaf85ca7
ZY		 2756 while (!skb_queue_empty(&frame_list)) {
2757 rx->skb = __skb_dequeue(&frame_list);
fd4c7f2f 2758
358c8d9d 2759 if (!ieee80211_frame_allowed(rx, fc)) {
eaf85ca7 2760 dev_kfree_skb(rx->skb);
ce3edf6d
JB		 2761 continue;
2762 }
fd4c7f2f
RR		 2763
2764 ieee80211_deliver_skb(rx);
2765 }
2766
9ae54c84 2767 return RX_QUEUED;
fd4c7f2f
RR		 2768}
2769
24bba078
FF		 2770static ieee80211_rx_result debug_noinline
2771ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2772{
2773 struct sk_buff *skb = rx->skb;
2774 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2775 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2776 __le16 fc = hdr->frame_control;
2777
2778 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2779 return RX_CONTINUE;
2780
2781 if (unlikely(!ieee80211_is_data(fc)))
2782 return RX_CONTINUE;
2783
2784 if (unlikely(!ieee80211_is_data_present(fc)))
2785 return RX_DROP_MONITOR;
2786
2787 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2788 switch (rx->sdata->vif.type) {
2789 case NL80211_IFTYPE_AP_VLAN:
2790 if (!rx->sdata->u.vlan.sta)
2791 return RX_DROP_UNUSABLE;
2792 break;
2793 case NL80211_IFTYPE_STATION:
2794 if (!rx->sdata->u.mgd.use_4addr)
2795 return RX_DROP_UNUSABLE;
2796 break;
2797 default:
2798 return RX_DROP_UNUSABLE;
2799 }
2800 }
2801
2802 if (is_multicast_ether_addr(hdr->addr1))
2803 return RX_DROP_UNUSABLE;
2804
270032a2
JB		 2805 if (rx->key) {
2806 /*
2807 * We should not receive A-MSDUs on pre-HT connections,
2808 * and HT connections cannot use old ciphers. Thus drop
2809 * them, as in those cases we couldn't even have SPP
2810 * A-MSDUs or such.
2811 */
2812 switch (rx->key->conf.cipher) {
2813 case WLAN_CIPHER_SUITE_WEP40:
2814 case WLAN_CIPHER_SUITE_WEP104:
2815 case WLAN_CIPHER_SUITE_TKIP:
2816 return RX_DROP_UNUSABLE;
2817 default:
2818 break;
2819 }
2820 }
2821
24bba078
FF		 2822 return __ieee80211_rx_h_amsdu(rx, 0);
2823}
2824
bf94e17b 2825#ifdef CONFIG_MAC80211_MESH
b0dee578 2826static ieee80211_rx_result
e32f85f7
LCC		 2827ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2828{
30789eb6
TP		 2829 struct ieee80211_hdr *fwd_hdr, *hdr;
2830 struct ieee80211_tx_info *info;
e32f85f7 2831 struct ieee80211s_hdr *mesh_hdr;
e32f85f7 2832 struct sk_buff *skb = rx->skb, *fwd_skb;
3b8d81e0 2833 struct ieee80211_local *local = rx->local;
eb9fb5b8 2834 struct ieee80211_sub_if_data *sdata = rx->sdata;
30789eb6 2835 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
cf440128 2836 u16 ac, q, hdrlen;
51d0af22 2837 int tailroom = 0;
e32f85f7
LCC		 2838
2839 hdr = (struct ieee80211_hdr *) skb->data;
2840 hdrlen = ieee80211_hdrlen(hdr->frame_control);
9b395bc3
JB		 2841
2842 /* make sure fixed part of mesh header is there, also checks skb len */
2843 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2844 return RX_DROP_MONITOR;
2845
2846 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2847
2848 /* make sure full mesh header is there, also checks skb len */
2849 if (!pskb_may_pull(rx->skb,
2850 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2851 return RX_DROP_MONITOR;
2852
2853 /* reload pointers */
2854 hdr = (struct ieee80211_hdr *) skb->data;
e32f85f7
LCC		 2855 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2856
d0c22119
BC		 2857 if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2858 return RX_DROP_MONITOR;
2859
2157fdd6
TP		 2860 /* frame is in RMC, don't forward */
2861 if (ieee80211_is_data(hdr->frame_control) &&
2862 is_multicast_ether_addr(hdr->addr1) &&
bf7cd94d 2863 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2157fdd6
TP		 2864 return RX_DROP_MONITOR;
2865
5c90067c 2866 if (!ieee80211_is_data(hdr->frame_control))
e32f85f7
LCC		 2867 return RX_CONTINUE;
2868
2869 if (!mesh_hdr->ttl)
e32f85f7
LCC		 2870 return RX_DROP_MONITOR;
2871
43b7b314 2872 if (mesh_hdr->flags & MESH_FLAGS_AE) {
79617dee 2873 struct mesh_path *mppath;
43b7b314
JC		 2874 char *proxied_addr;
2875 char *mpp_addr;
2876
2877 if (is_multicast_ether_addr(hdr->addr1)) {
2878 mpp_addr = hdr->addr3;
2879 proxied_addr = mesh_hdr->eaddr1;
5667c86a
RM		 2880 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
2881 MESH_FLAGS_AE_A5_A6) {
9b395bc3 2882 /* has_a4 already checked in ieee80211_rx_mesh_check */
43b7b314
JC		 2883 mpp_addr = hdr->addr4;
2884 proxied_addr = mesh_hdr->eaddr2;
9b395bc3
JB		 2885 } else {
2886 return RX_DROP_MONITOR;
43b7b314 2887 }
79617dee 2888
79617dee 2889 rcu_read_lock();
bf7cd94d 2890 mppath = mpp_path_lookup(sdata, proxied_addr);
79617dee 2891 if (!mppath) {
bf7cd94d 2892 mpp_path_add(sdata, proxied_addr, mpp_addr);
79617dee
Y		 2893 } else {
2894 spin_lock_bh(&mppath->state_lock);
b203ca39 2895 if (!ether_addr_equal(mppath->mpp, mpp_addr))
43b7b314 2896 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
ab1c7906 2897 mppath->exp_time = jiffies;
79617dee
Y		 2898 spin_unlock_bh(&mppath->state_lock);
2899 }
2900 rcu_read_unlock();
2901 }
2902
3c5772a5
JC		 2903 /* Frame has reached destination. Don't forward */
2904 if (!is_multicast_ether_addr(hdr->addr1) &&
b203ca39 2905 ether_addr_equal(sdata->vif.addr, hdr->addr3))
e32f85f7
LCC		 2906 return RX_CONTINUE;
2907
859ae701 2908 ac = ieee802_1d_to_ac[skb->priority];
cf440128 2909 q = sdata->vif.hw_queue[ac];
d3c1597b 2910 if (ieee80211_queue_stopped(&local->hw, q)) {
30789eb6 2911 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
d3c1597b
TP		 2912 return RX_DROP_MONITOR;
2913 }
859ae701 2914 skb_set_queue_mapping(skb, ac);
e32f85f7 2915
30789eb6 2916 if (!--mesh_hdr->ttl) {
a0dc0203
BC		 2917 if (!is_multicast_ether_addr(hdr->addr1))
2918 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
2919 dropped_frames_ttl);
2ac64cd1 2920 goto out;
30789eb6
TP		 2921 }
2922
d665508b
CYY		 2923 if (!ifmsh->mshcfg.dot11MeshForwarding)
2924 goto out;
2925
51d0af22
FF		 2926 if (sdata->crypto_tx_tailroom_needed_cnt)
2927 tailroom = IEEE80211_ENCRYPT_TAILROOM;
2928
c38c39bf 2929 fwd_skb = skb_copy_expand(skb, local->tx_headroom +
23a5f0af 2930 IEEE80211_ENCRYPT_HEADROOM,
51d0af22 2931 tailroom, GFP_ATOMIC);
0c3d5a96 2932 if (!fwd_skb)
30789eb6 2933 goto out;
30789eb6 2934
942bd107 2935 fwd_skb->dev = sdata->dev;
30789eb6 2936 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
9d6d6f49 2937 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
30789eb6
TP		 2938 info = IEEE80211_SKB_CB(fwd_skb);
2939 memset(info, 0, sizeof(*info));
cc20ff2c 2940 info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
30789eb6
TP		 2941 info->control.vif = &rx->sdata->vif;
2942 info->control.jiffies = jiffies;
2943 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2944 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2945 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3f52b7e3
MP		 2946 /* update power mode indication when forwarding */
2947 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
bf7cd94d 2948 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
3f52b7e3 2949 /* mesh power mode flags updated in mesh_nexthop_lookup */
30789eb6
TP		 2950 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2951 } else {
2952 /* unable to resolve next hop */
bf7cd94d 2953 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
f63f8421
CYY		 2954 fwd_hdr->addr3, 0,
2955 WLAN_REASON_MESH_PATH_NOFORWARD,
2956 fwd_hdr->addr2);
30789eb6 2957 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
74b8cc3d 2958 kfree_skb(fwd_skb);
30789eb6 2959 return RX_DROP_MONITOR;
e32f85f7
LCC		 2960 }
2961
30789eb6
TP		 2962 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2963 ieee80211_add_pending_skb(local, fwd_skb);
b51aff05 2964 out:
df140465 2965 if (is_multicast_ether_addr(hdr->addr1))
e32f85f7 2966 return RX_CONTINUE;
df140465 2967 return RX_DROP_MONITOR;
e32f85f7 2968}
bf94e17b 2969#endif
e32f85f7 2970
49461622 2971static ieee80211_rx_result debug_noinline
5cf121c3 2972ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf 2973{
eb9fb5b8 2974 struct ieee80211_sub_if_data *sdata = rx->sdata;
e15276a4 2975 struct ieee80211_local *local = rx->local;
eb9fb5b8 2976 struct net_device *dev = sdata->dev;
358c8d9d
HH		 2977 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2978 __le16 fc = hdr->frame_control;
4114fa21 2979 bool port_control;
ce3edf6d 2980 int err;
76ee65bf 2981
358c8d9d 2982 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 2983 return RX_CONTINUE;
76ee65bf 2984
358c8d9d 2985 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 2986 return RX_DROP_MONITOR;
76ee65bf 2987
f14543ee 2988 /*
e7f4a940
JB		 2989 * Send unexpected-4addr-frame event to hostapd. For older versions,
2990 * also drop the frame to cooked monitor interfaces.
f14543ee
FF		 2991 */
2992 if (ieee80211_has_a4(hdr->frame_control) &&
e7f4a940
JB		 2993 sdata->vif.type == NL80211_IFTYPE_AP) {
2994 if (rx->sta &&
2995 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2996 cfg80211_rx_unexpected_4addr_frame(
2997 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
f14543ee 2998 return RX_DROP_MONITOR;
e7f4a940 2999 }
f14543ee 3000
4114fa21 3001 err = __ieee80211_data_to_8023(rx, &port_control);
76ee65bf 3002 if (unlikely(err))
e4c26add 3003 return RX_DROP_UNUSABLE;
76ee65bf 3004
358c8d9d 3005 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 3006 return RX_DROP_MONITOR;
ce3edf6d 3007
8a4d32f3
AN		 3008 /* directly handle TDLS channel switch requests/responses */
3009 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3010 cpu_to_be16(ETH_P_TDLS))) {
3011 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3012
3013 if (pskb_may_pull(rx->skb,
3014 offsetof(struct ieee80211_tdls_data, u)) &&
3015 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3016 tf->category == WLAN_CATEGORY_TDLS &&
3017 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3018 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
f057d140
JB		 3019 rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3020 __ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb);
8a4d32f3
AN		 3021 return RX_QUEUED;
3022 }
3023 }
3024
4114fa21
FF		 3025 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3026 unlikely(port_control) && sdata->bss) {
3027 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3028 u.ap);
3029 dev = sdata->dev;
3030 rx->sdata = sdata;
3031 }
3032
76ee65bf
RR		 3033 rx->skb->dev = dev;
3034
602fae42
JB		 3035 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3036 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
8c99f691
RM		 3037 !is_multicast_ether_addr(
3038 ((struct ethhdr *)rx->skb->data)->h_dest) &&
3039 (!local->scanning &&
602fae42
JB		 3040 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3041 mod_timer(&local->dynamic_ps_timer, jiffies +
3042 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
e15276a4 3043
76ee65bf 3044 ieee80211_deliver_skb(rx);
571ecf67 3045
9ae54c84 3046 return RX_QUEUED;
571ecf67
JB		 3047}
3048
49461622 3049static ieee80211_rx_result debug_noinline
f9e124fb 3050ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
71364716 3051{
71364716 3052 struct sk_buff *skb = rx->skb;
a7767f95 3053 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR		 3054 struct tid_ampdu_rx *tid_agg_rx;
3055 u16 start_seq_num;
3056 u16 tid;
3057
a7767f95 3058 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 3059 return RX_CONTINUE;
71364716 3060
a7767f95 3061 if (ieee80211_is_back_req(bar->frame_control)) {
8ae5977f
JB		 3062 struct {
3063 __le16 control, start_seq_num;
3064 } __packed bar_data;
6382246e
EG		 3065 struct ieee80211_event event = {
3066 .type = BAR_RX_EVENT,
3067 };
8ae5977f 3068
71364716 3069 if (!rx->sta)
a02ae758 3070 return RX_DROP_MONITOR;
8ae5977f
JB		 3071
3072 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3073 &bar_data, sizeof(bar_data)))
3074 return RX_DROP_MONITOR;
3075
8ae5977f 3076 tid = le16_to_cpu(bar_data.control) >> 12;
a87f736d 3077
53f24974
JB		 3078 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3079 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
3080 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
3081 WLAN_BACK_RECIPIENT,
3082 WLAN_REASON_QSTA_REQUIRE_SETUP);
3083
a87f736d
JB		 3084 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3085 if (!tid_agg_rx)
a02ae758 3086 return RX_DROP_MONITOR;
71364716 3087
8ae5977f 3088 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
6382246e
EG		 3089 event.u.ba.tid = tid;
3090 event.u.ba.ssn = start_seq_num;
3091 event.u.ba.sta = &rx->sta->sta;
71364716
RR		 3092
3093 /* reset session timer */
20ad19d0
JB		 3094 if (tid_agg_rx->timeout)
3095 mod_timer(&tid_agg_rx->session_timer,
3096 TU_TO_EXP_TIME(tid_agg_rx->timeout));
71364716 3097
dd318575 3098 spin_lock(&tid_agg_rx->reorder_lock);
a02ae758 3099 /* release stored frames up to start of BAR */
d3b2fb53 3100 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
f9e124fb 3101 start_seq_num, frames);
dd318575
JB		 3102 spin_unlock(&tid_agg_rx->reorder_lock);
3103
6382246e
EG		 3104 drv_event_callback(rx->local, rx->sdata, &event);
3105
a02ae758
JB		 3106 kfree_skb(skb);
3107 return RX_QUEUED;
71364716
RR		 3108 }
3109
08daecae
JB		 3110 /*
3111 * After this point, we only want management frames,
3112 * so we can drop all remaining control frames to
3113 * cooked monitor interfaces.
3114 */
3115 return RX_DROP_MONITOR;
71364716
RR		 3116}
3117
f4f727a6
JM		 3118static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3119 struct ieee80211_mgmt *mgmt,
3120 size_t len)
fea14732
JM		 3121{
3122 struct ieee80211_local *local = sdata->local;
3123 struct sk_buff *skb;
3124 struct ieee80211_mgmt *resp;
3125
b203ca39 3126 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
fea14732
JM		 3127 /* Not to own unicast address */
3128 return;
3129 }
3130
bfd8403a
JB		 3131 if (!ether_addr_equal(mgmt->sa, sdata->deflink.u.mgd.bssid) ||
3132 !ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid)) {
77fdaa12 3133 /* Not from the current AP or not associated yet. */
fea14732
JM		 3134 return;
3135 }
3136
3137 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
3138 /* Too short SA Query request frame */
3139 return;
3140 }
3141
3142 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
3143 if (skb == NULL)
3144 return;
3145
3146 skb_reserve(skb, local->hw.extra_tx_headroom);
b080db58 3147 resp = skb_put_zero(skb, 24);
fea14732 3148 memcpy(resp->da, mgmt->sa, ETH_ALEN);
47846c9b 3149 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
bfd8403a 3150 memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
fea14732
JM		 3151 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3152 IEEE80211_STYPE_ACTION);
3153 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
3154 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3155 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
3156 memcpy(resp->u.action.u.sa_query.trans_id,
3157 mgmt->u.action.u.sa_query.trans_id,
3158 WLAN_SA_QUERY_TR_ID_LEN);
3159
62ae67be 3160 ieee80211_tx_skb(sdata, skb);
fea14732
JM		 3161}
3162
6d945a33
LB		 3163static void
3164ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3165{
3166 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3167 const struct element *ie;
3168 size_t baselen;
3169
3170 if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
3171 NL80211_EXT_FEATURE_BSS_COLOR))
3172 return;
3173
3174 if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3175 return;
3176
d0a9123e 3177 if (rx->sdata->vif.bss_conf.csa_active)
6d945a33
LB		 3178 return;
3179
3180 baselen = mgmt->u.beacon.variable - rx->skb->data;
3181 if (baselen > rx->skb->len)
3182 return;
3183
3184 ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
3185 mgmt->u.beacon.variable,
3186 rx->skb->len - baselen);
3187 if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3188 ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
3189 struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
3190 const struct ieee80211_he_operation *he_oper;
3191 u8 color;
3192
3193 he_oper = (void *)(ie->data + 1);
3194 if (le32_get_bits(he_oper->he_oper_params,
3195 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3196 return;
3197
3198 color = le32_get_bits(he_oper->he_oper_params,
3199 IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3200 if (color == bss_conf->he_bss_color.color)
3201 ieeee80211_obss_color_collision_notify(&rx->sdata->vif,
03895c84
LB		 3202 BIT_ULL(color),
3203 GFP_ATOMIC);
6d945a33
LB		 3204 }
3205}
3206
2e161f78
JB		 3207static ieee80211_rx_result debug_noinline
3208ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3209{
3210 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 3211 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78 3212
09a740ce
TP		 3213 if (ieee80211_is_s1g_beacon(mgmt->frame_control))
3214 return RX_CONTINUE;
3215
2e161f78
JB		 3216 /*
3217 * From here on, look only at management frames.
3218 * Data and control frames are already handled,
3219 * and unknown (reserved) frames are useless.
3220 */
3221 if (rx->skb->len < 24)
3222 return RX_DROP_MONITOR;
3223
3224 if (!ieee80211_is_mgmt(mgmt->frame_control))
3225 return RX_DROP_MONITOR;
3226
ee971924
JB		 3227 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3228 ieee80211_is_beacon(mgmt->frame_control) &&
3229 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
804483e9
JB		 3230 int sig = 0;
3231
6d945a33
LB		 3232 /* sw bss color collision detection */
3233 ieee80211_rx_check_bss_color_collision(rx);
3234
1ad22fb5
T		 3235 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3236 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
804483e9
JB		 3237 sig = status->signal;
3238
e76fede8
TP		 3239 cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,
3240 rx->skb->data, rx->skb->len,
3241 ieee80211_rx_status_to_khz(status),
3242 sig);
ee971924
JB		 3243 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3244 }
3245
2e161f78
JB		 3246 if (ieee80211_drop_unencrypted_mgmt(rx))
3247 return RX_DROP_UNUSABLE;
3248
3249 return RX_CONTINUE;
3250}
3251
f5a4c24e
LB		 3252static bool
3253ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3254{
3255 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
f5a4c24e 3256 struct ieee80211_sub_if_data *sdata = rx->sdata;
f5a4c24e
LB		 3257
3258 /* TWT actions are only supported in AP for the moment */
3259 if (sdata->vif.type != NL80211_IFTYPE_AP)
3260 return false;
3261
3262 if (!rx->local->ops->add_twt_setup)
3263 return false;
3264
68ba1131 3265 if (!sdata->vif.bss_conf.twt_responder)
f5a4c24e
LB		 3266 return false;
3267
3268 if (!rx->sta)
3269 return false;
3270
3271 switch (mgmt->u.action.u.s1g.action_code) {
3272 case WLAN_S1G_TWT_SETUP: {
3273 struct ieee80211_twt_setup *twt;
3274
3275 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3276 1 + /* action code */
3277 sizeof(struct ieee80211_twt_setup) +
3278 2 /* TWT req_type agrt */)
3279 break;
3280
3281 twt = (void *)mgmt->u.action.u.s1g.variable;
3282 if (twt->element_id != WLAN_EID_S1G_TWT)
3283 break;
3284
3285 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3286 4 + /* action code + token + tlv */
3287 twt->length)
3288 break;
3289
3290 return true; /* queue the frame */
3291 }
3292 case WLAN_S1G_TWT_TEARDOWN:
3293 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
3294 break;
3295
3296 return true; /* queue the frame */
3297 default:
3298 break;
3299 }
3300
3301 return false;
3302}
3303
de1ede7a
JB		 3304static ieee80211_rx_result debug_noinline
3305ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3306{
3307 struct ieee80211_local *local = rx->local;
eb9fb5b8 3308 struct ieee80211_sub_if_data *sdata = rx->sdata;
de1ede7a 3309 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 3310 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
de1ede7a
JB		 3311 int len = rx->skb->len;
3312
3313 if (!ieee80211_is_action(mgmt->frame_control))
3314 return RX_CONTINUE;
3315
026331c4
JM		 3316 /* drop too small frames */
3317 if (len < IEEE80211_MIN_ACTION_SIZE)
84040805 3318 return RX_DROP_UNUSABLE;
de1ede7a 3319
815b8092 3320 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
cd7760e6
SW		 3321 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3322 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
84040805 3323 return RX_DROP_UNUSABLE;
de1ede7a 3324
de1ede7a 3325 switch (mgmt->u.action.category) {
1d8d3dec
JB		 3326 case WLAN_CATEGORY_HT:
3327 /* reject HT action frames from stations not supporting HT */
046d2e7c 3328 if (!rx->sta->sta.deflink.ht_cap.ht_supported)
1d8d3dec
JB		 3329 goto invalid;
3330
3331 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3332 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3333 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3334 sdata->vif.type != NL80211_IFTYPE_AP &&
3335 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3336 break;
3337
ec61cd63 3338 /* verify action & smps_control/chanwidth are present */
1d8d3dec
JB		 3339 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3340 goto invalid;
3341
3342 switch (mgmt->u.action.u.ht_smps.action) {
3343 case WLAN_HT_ACTION_SMPS: {
3344 struct ieee80211_supported_band *sband;
af0ed69b 3345 enum ieee80211_smps_mode smps_mode;
ff84e7bf 3346 struct sta_opmode_info sta_opmode = {};
1d8d3dec 3347
c4d800dc
IP		 3348 if (sdata->vif.type != NL80211_IFTYPE_AP &&
3349 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3350 goto handled;
3351
1d8d3dec
JB		 3352 /* convert to HT capability */
3353 switch (mgmt->u.action.u.ht_smps.smps_control) {
3354 case WLAN_HT_SMPS_CONTROL_DISABLED:
af0ed69b 3355 smps_mode = IEEE80211_SMPS_OFF;
1d8d3dec
JB		 3356 break;
3357 case WLAN_HT_SMPS_CONTROL_STATIC:
af0ed69b 3358 smps_mode = IEEE80211_SMPS_STATIC;
1d8d3dec
JB		 3359 break;
3360 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
af0ed69b 3361 smps_mode = IEEE80211_SMPS_DYNAMIC;
1d8d3dec
JB		 3362 break;
3363 default:
3364 goto invalid;
3365 }
1d8d3dec
JB		 3366
3367 /* if no change do nothing */
af0ed69b 3368 if (rx->sta->sta.smps_mode == smps_mode)
1d8d3dec 3369 goto handled;
af0ed69b 3370 rx->sta->sta.smps_mode = smps_mode;
57566b20 3371 sta_opmode.smps_mode =
3372 ieee80211_smps_mode_to_smps_mode(smps_mode);
ff84e7bf 3373 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
1d8d3dec
JB		 3374
3375 sband = rx->local->hw.wiphy->bands[status->band];
3376
b4f85443 3377 rate_control_rate_update(local, sband, rx->sta, 0,
64f68e5d 3378 IEEE80211_RC_SMPS_CHANGED);
ff84e7bf 3379 cfg80211_sta_opmode_change_notify(sdata->dev,
3380 rx->sta->addr,
3381 &sta_opmode,
c752cac9 3382 GFP_ATOMIC);
1d8d3dec
JB		 3383 goto handled;
3384 }
ec61cd63
JB		 3385 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3386 struct ieee80211_supported_band *sband;
3387 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
1c45c5ce 3388 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
ff84e7bf 3389 struct sta_opmode_info sta_opmode = {};
ec61cd63
JB		 3390
3391 /* If it doesn't support 40 MHz it can't change ... */
046d2e7c 3392 if (!(rx->sta->sta.deflink.ht_cap.cap &
e1a0c6b3 3393 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
ec61cd63
JB		 3394 goto handled;
3395
e1a0c6b3 3396 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
1c45c5ce 3397 max_bw = IEEE80211_STA_RX_BW_20;
e1a0c6b3 3398 else
c71420db 3399 max_bw = ieee80211_sta_cap_rx_bw(&rx->sta->deflink);
1c45c5ce
EP		 3400
3401 /* set cur_max_bandwidth and recalc sta bw */
046d2e7c 3402 rx->sta->deflink.cur_max_bandwidth = max_bw;
c71420db 3403 new_bw = ieee80211_sta_cur_vht_bw(&rx->sta->deflink);
ec61cd63 3404
046d2e7c 3405 if (rx->sta->sta.deflink.bandwidth == new_bw)
ec61cd63
JB		 3406 goto handled;
3407
046d2e7c 3408 rx->sta->sta.deflink.bandwidth = new_bw;
ec61cd63 3409 sband = rx->local->hw.wiphy->bands[status->band];
97f5f425 3410 sta_opmode.bw =
c71420db 3411 ieee80211_sta_rx_bw_to_chan_width(&rx->sta->deflink);
ff84e7bf 3412 sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
ec61cd63 3413
b4f85443 3414 rate_control_rate_update(local, sband, rx->sta, 0,
ec61cd63 3415 IEEE80211_RC_BW_CHANGED);
ff84e7bf 3416 cfg80211_sta_opmode_change_notify(sdata->dev,
3417 rx->sta->addr,
3418 &sta_opmode,
c752cac9 3419 GFP_ATOMIC);
ec61cd63
JB		 3420 goto handled;
3421 }
1d8d3dec
JB		 3422 default:
3423 goto invalid;
3424 }
3425
0af83d3d 3426 break;
1b3a2e49
JB		 3427 case WLAN_CATEGORY_PUBLIC:
3428 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3429 goto invalid;
3430 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3431 break;
3432 if (!rx->sta)
3433 break;
bfd8403a 3434 if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))
1b3a2e49
JB		 3435 break;
3436 if (mgmt->u.action.u.ext_chan_switch.action_code !=
3437 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3438 break;
3439 if (len < offsetof(struct ieee80211_mgmt,
3440 u.action.u.ext_chan_switch.variable))
3441 goto invalid;
3442 goto queue;
0af83d3d
JB		 3443 case WLAN_CATEGORY_VHT:
3444 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3445 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3446 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3447 sdata->vif.type != NL80211_IFTYPE_AP &&
3448 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3449 break;
3450
3451 /* verify action code is present */
3452 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3453 goto invalid;
3454
3455 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
3456 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
0af83d3d
JB		 3457 /* verify opmode is present */
3458 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3459 goto invalid;
d2941df8 3460 goto queue;
0af83d3d 3461 }
23a1f8d4
SS		 3462 case WLAN_VHT_ACTION_GROUPID_MGMT: {
3463 if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3464 goto invalid;
3465 goto queue;
3466 }
0af83d3d
JB		 3467 default:
3468 break;
3469 }
1d8d3dec 3470 break;
de1ede7a 3471 case WLAN_CATEGORY_BACK:
8abd3f9b 3472 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
ae2772b3 3473 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
8abd3f9b 3474 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
13c40c54
AS		 3475 sdata->vif.type != NL80211_IFTYPE_AP &&
3476 sdata->vif.type != NL80211_IFTYPE_ADHOC)
84040805 3477 break;
8abd3f9b 3478
026331c4
JM		 3479 /* verify action_code is present */
3480 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3481 break;
3482
de1ede7a
JB		 3483 switch (mgmt->u.action.u.addba_req.action_code) {
3484 case WLAN_ACTION_ADDBA_REQ:
3485 if (len < (IEEE80211_MIN_ACTION_SIZE +
3486 sizeof(mgmt->u.action.u.addba_req)))
bed7ee6e
JB		 3487 goto invalid;
3488 break;
de1ede7a
JB		 3489 case WLAN_ACTION_ADDBA_RESP:
3490 if (len < (IEEE80211_MIN_ACTION_SIZE +
3491 sizeof(mgmt->u.action.u.addba_resp)))
bed7ee6e
JB		 3492 goto invalid;
3493 break;
de1ede7a
JB		 3494 case WLAN_ACTION_DELBA:
3495 if (len < (IEEE80211_MIN_ACTION_SIZE +
3496 sizeof(mgmt->u.action.u.delba)))
bed7ee6e
JB		 3497 goto invalid;
3498 break;
3499 default:
3500 goto invalid;
de1ede7a 3501 }
bed7ee6e 3502
8b58ff83 3503 goto queue;
39192c0b 3504 case WLAN_CATEGORY_SPECTRUM_MGMT:
026331c4
JM		 3505 /* verify action_code is present */
3506 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3507 break;
3508
39192c0b
JB		 3509 switch (mgmt->u.action.u.measurement.action_code) {
3510 case WLAN_ACTION_SPCT_MSR_REQ:
57fbcce3 3511 if (status->band != NL80211_BAND_5GHZ)
cd7760e6
SW		 3512 break;
3513
39192c0b
JB		 3514 if (len < (IEEE80211_MIN_ACTION_SIZE +
3515 sizeof(mgmt->u.action.u.measurement)))
84040805 3516 break;
cd7760e6
SW		 3517
3518 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3519 break;
3520
39192c0b 3521 ieee80211_process_measurement_req(sdata, mgmt, len);
84040805 3522 goto handled;
cd7760e6
SW		 3523 case WLAN_ACTION_SPCT_CHL_SWITCH: {
3524 u8 *bssid;
3525 if (len < (IEEE80211_MIN_ACTION_SIZE +
3526 sizeof(mgmt->u.action.u.chan_switch)))
84040805 3527 break;
cc32abd4 3528
cd7760e6 3529 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
b8456a14
CYY		 3530 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3531 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
cd7760e6
SW		 3532 break;
3533
3534 if (sdata->vif.type == NL80211_IFTYPE_STATION)
bfd8403a 3535 bssid = sdata->deflink.u.mgd.bssid;
cd7760e6
SW		 3536 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3537 bssid = sdata->u.ibss.bssid;
b8456a14
CYY		 3538 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3539 bssid = mgmt->sa;
cd7760e6
SW		 3540 else
3541 break;
3542
3543 if (!ether_addr_equal(mgmt->bssid, bssid))
84040805 3544 break;
c481ec97 3545
8b58ff83 3546 goto queue;
cd7760e6 3547 }
39192c0b
JB		 3548 }
3549 break;
8db09850 3550 case WLAN_CATEGORY_SELF_PROTECTED:
9b395bc3
JB		 3551 if (len < (IEEE80211_MIN_ACTION_SIZE +
3552 sizeof(mgmt->u.action.u.self_prot.action_code)))
3553 break;
3554
8db09850
TP		 3555 switch (mgmt->u.action.u.self_prot.action_code) {
3556 case WLAN_SP_MESH_PEERING_OPEN:
3557 case WLAN_SP_MESH_PEERING_CLOSE:
3558 case WLAN_SP_MESH_PEERING_CONFIRM:
3559 if (!ieee80211_vif_is_mesh(&sdata->vif))
3560 goto invalid;
a6dad6a2 3561 if (sdata->u.mesh.user_mpm)
8db09850
TP		 3562 /* userspace handles this frame */
3563 break;
3564 goto queue;
3565 case WLAN_SP_MGK_INFORM:
3566 case WLAN_SP_MGK_ACK:
3567 if (!ieee80211_vif_is_mesh(&sdata->vif))
3568 goto invalid;
3569 break;
3570 }
3571 break;
d3aaec8a 3572 case WLAN_CATEGORY_MESH_ACTION:
9b395bc3
JB		 3573 if (len < (IEEE80211_MIN_ACTION_SIZE +
3574 sizeof(mgmt->u.action.u.mesh_action.action_code)))
3575 break;
3576
77a121c3
JB		 3577 if (!ieee80211_vif_is_mesh(&sdata->vif))
3578 break;
25d49e4d 3579 if (mesh_action_is_path_sel(mgmt) &&
1df332e8 3580 !mesh_path_sel_is_hwmp(sdata))
c7108a71
JC		 3581 break;
3582 goto queue;
f5a4c24e
LB		 3583 case WLAN_CATEGORY_S1G:
3584 switch (mgmt->u.action.u.s1g.action_code) {
3585 case WLAN_S1G_TWT_SETUP:
3586 case WLAN_S1G_TWT_TEARDOWN:
3587 if (ieee80211_process_rx_twt_action(rx))
3588 goto queue;
3589 break;
3590 default:
3591 break;
3592 }
3593 break;
84040805 3594 }
026331c4 3595
2e161f78
JB		 3596 return RX_CONTINUE;
3597
bed7ee6e 3598 invalid:
554891e6 3599 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2e161f78
JB		 3600 /* will return in the next handlers */
3601 return RX_CONTINUE;
3602
3603 handled:
3604 if (rx->sta)
046d2e7c 3605 rx->sta->deflink.rx_stats.packets++;
2e161f78
JB		 3606 dev_kfree_skb(rx->skb);
3607 return RX_QUEUED;
3608
3609 queue:
0044cc17 3610 ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb);
2e161f78
JB		 3611 return RX_QUEUED;
3612}
3613
3614static ieee80211_rx_result debug_noinline
3615ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3616{
554891e6 3617 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
804483e9 3618 int sig = 0;
2e161f78
JB		 3619
3620 /* skip known-bad action frames and return them in the next handler */
554891e6 3621 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2e161f78 3622 return RX_CONTINUE;
d7907448 3623
026331c4
JM		 3624 /*
3625 * Getting here means the kernel doesn't know how to handle
3626 * it, but maybe userspace does ... include returned frames
3627 * so userspace can register for those to know whether ones
3628 * it transmitted were processed or returned.
3629 */
026331c4 3630
1ad22fb5
T		 3631 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3632 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
804483e9
JB		 3633 sig = status->signal;
3634
e76fede8
TP		 3635 if (cfg80211_rx_mgmt_khz(&rx->sdata->wdev,
3636 ieee80211_rx_status_to_khz(status), sig,
3637 rx->skb->data, rx->skb->len, 0)) {
2e161f78 3638 if (rx->sta)
046d2e7c 3639 rx->sta->deflink.rx_stats.packets++;
2e161f78
JB		 3640 dev_kfree_skb(rx->skb);
3641 return RX_QUEUED;
3642 }
3643
2e161f78
JB		 3644 return RX_CONTINUE;
3645}
3646
1ea02224
JB		 3647static ieee80211_rx_result debug_noinline
3648ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
3649{
3650 struct ieee80211_sub_if_data *sdata = rx->sdata;
3651 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3652 int len = rx->skb->len;
3653
3654 if (!ieee80211_is_action(mgmt->frame_control))
3655 return RX_CONTINUE;
3656
3657 switch (mgmt->u.action.category) {
3658 case WLAN_CATEGORY_SA_QUERY:
3659 if (len < (IEEE80211_MIN_ACTION_SIZE +
3660 sizeof(mgmt->u.action.u.sa_query)))
3661 break;
3662
3663 switch (mgmt->u.action.u.sa_query.action) {
3664 case WLAN_ACTION_SA_QUERY_REQUEST:
3665 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3666 break;
3667 ieee80211_process_sa_query_req(sdata, mgmt, len);
3668 goto handled;
3669 }
3670 break;
3671 }
3672
3673 return RX_CONTINUE;
3674
3675 handled:
3676 if (rx->sta)
046d2e7c 3677 rx->sta->deflink.rx_stats.packets++;
1ea02224
JB		 3678 dev_kfree_skb(rx->skb);
3679 return RX_QUEUED;
3680}
3681
2e161f78
JB		 3682static ieee80211_rx_result debug_noinline
3683ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3684{
3685 struct ieee80211_local *local = rx->local;
3686 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3687 struct sk_buff *nskb;
3688 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 3689 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 3690
3691 if (!ieee80211_is_action(mgmt->frame_control))
3692 return RX_CONTINUE;
3693
3694 /*
3695 * For AP mode, hostapd is responsible for handling any action
3696 * frames that we didn't handle, including returning unknown
3697 * ones. For all other modes we will return them to the sender,
3698 * setting the 0x80 bit in the action category, as required by
4b5ebccc 3699 * 802.11-2012 9.24.4.
2e161f78
JB		 3700 * Newer versions of hostapd shall also use the management frame
3701 * registration mechanisms, but older ones still use cooked
3702 * monitor interfaces so push all frames there.
3703 */
554891e6 3704 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2e161f78
JB		 3705 (sdata->vif.type == NL80211_IFTYPE_AP ||
3706 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3707 return RX_DROP_MONITOR;
026331c4 3708
4b5ebccc
JB		 3709 if (is_multicast_ether_addr(mgmt->da))
3710 return RX_DROP_MONITOR;
3711
84040805
JB		 3712 /* do not return rejected action frames */
3713 if (mgmt->u.action.category & 0x80)
3714 return RX_DROP_UNUSABLE;
3715
3716 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3717 GFP_ATOMIC);
3718 if (nskb) {
292b4df6 3719 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
84040805 3720
292b4df6
JL		 3721 nmgmt->u.action.category |= 0x80;
3722 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3723 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
84040805
JB		 3724
3725 memset(nskb->cb, 0, sizeof(nskb->cb));
3726
07e5a5f5
JB		 3727 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3728 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3729
3730 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3731 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3732 IEEE80211_TX_CTL_NO_CCK_RATE;
30686bf7 3733 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
07e5a5f5
JB		 3734 info->hw_queue =
3735 local->hw.offchannel_tx_hw_queue;
3736 }
3737
3738 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
08aca29a 3739 status->band);
de1ede7a 3740 }
39192c0b
JB		 3741 dev_kfree_skb(rx->skb);
3742 return RX_QUEUED;
de1ede7a
JB		 3743}
3744
09a740ce
TP		 3745static ieee80211_rx_result debug_noinline
3746ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
3747{
3748 struct ieee80211_sub_if_data *sdata = rx->sdata;
3749 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
3750
3751 if (!ieee80211_is_ext(hdr->frame_control))
3752 return RX_CONTINUE;
3753
3754 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3755 return RX_DROP_MONITOR;
3756
3757 /* for now only beacons are ext, so queue them */
0044cc17 3758 ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb);
09a740ce
TP		 3759
3760 return RX_QUEUED;
3761}
3762
49461622 3763static ieee80211_rx_result debug_noinline
5cf121c3 3764ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 3765{
eb9fb5b8 3766 struct ieee80211_sub_if_data *sdata = rx->sdata;
77a121c3
JB		 3767 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3768 __le16 stype;
571ecf67 3769
77a121c3 3770 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
472dbc45 3771
77a121c3
JB		 3772 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3773 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
239281f8 3774 sdata->vif.type != NL80211_IFTYPE_OCB &&
77a121c3
JB		 3775 sdata->vif.type != NL80211_IFTYPE_STATION)
3776 return RX_DROP_MONITOR;
472dbc45 3777
77a121c3 3778 switch (stype) {
66e67e41 3779 case cpu_to_le16(IEEE80211_STYPE_AUTH):
77a121c3
JB		 3780 case cpu_to_le16(IEEE80211_STYPE_BEACON):
3781 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3782 /* process for all: mesh, mlme, ibss */
3783 break;
95697f99
JB		 3784 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3785 if (is_multicast_ether_addr(mgmt->da) &&
3786 !is_broadcast_ether_addr(mgmt->da))
3787 return RX_DROP_MONITOR;
3788
3789 /* process only for station/IBSS */
3790 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3791 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3792 return RX_DROP_MONITOR;
3793 break;
66e67e41
JB		 3794 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3795 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
77a121c3 3796 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2c31333a
CL		 3797 if (is_multicast_ether_addr(mgmt->da) &&
3798 !is_broadcast_ether_addr(mgmt->da))
3799 return RX_DROP_MONITOR;
3800
77a121c3
JB		 3801 /* process only for station */
3802 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3803 return RX_DROP_MONITOR;
3804 break;
3805 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
9fb04b50
TP		 3806 /* process only for ibss and mesh */
3807 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3808 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
77a121c3
JB		 3809 return RX_DROP_MONITOR;
3810 break;
3811 default:
3812 return RX_DROP_MONITOR;
3813 }
f9d540ee 3814
0044cc17 3815 ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb);
46900298 3816
77a121c3 3817 return RX_QUEUED;
571ecf67
JB		 3818}
3819
5f0b7de5
JB		 3820static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3821 struct ieee80211_rate *rate)
3d30d949
MW		 3822{
3823 struct ieee80211_sub_if_data *sdata;
3824 struct ieee80211_local *local = rx->local;
3d30d949
MW		 3825 struct sk_buff *skb = rx->skb, *skb2;
3826 struct net_device *prev_dev = NULL;
eb9fb5b8 3827 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
293702a3 3828 int needed_headroom;
3d30d949 3829
554891e6
JB		 3830 /*
3831 * If cooked monitor has been processed already, then
3832 * don't do it again. If not, set the flag.
3833 */
3834 if (rx->flags & IEEE80211_RX_CMNTR)
7c1e1831 3835 goto out_free_skb;
554891e6 3836 rx->flags |= IEEE80211_RX_CMNTR;
7c1e1831 3837
152c477a
JB		 3838 /* If there are no cooked monitor interfaces, just free the SKB */
3839 if (!local->cooked_mntrs)
3840 goto out_free_skb;
3841
1f7bba79
JB		 3842 /* vendor data is long removed here */
3843 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
293702a3 3844 /* room for the radiotap header based on driver features */
1f7bba79 3845 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3d30d949 3846
293702a3
JB		 3847 if (skb_headroom(skb) < needed_headroom &&
3848 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3849 goto out_free_skb;
3d30d949 3850
293702a3 3851 /* prepend radiotap information */
973ef21a
FF		 3852 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3853 false);
3d30d949 3854
d57a544d 3855 skb_reset_mac_header(skb);
3d30d949
MW		 3856 skb->ip_summed = CHECKSUM_UNNECESSARY;
3857 skb->pkt_type = PACKET_OTHERHOST;
3858 skb->protocol = htons(ETH_P_802_2);
3859
3860 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
9607e6b6 3861 if (!ieee80211_sdata_running(sdata))
3d30d949
MW		 3862 continue;
3863
05c914fe 3864 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
d8212184 3865 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
3d30d949
MW		 3866 continue;
3867
3868 if (prev_dev) {
3869 skb2 = skb_clone(skb, GFP_ATOMIC);
3870 if (skb2) {
3871 skb2->dev = prev_dev;
5548a8a1 3872 netif_receive_skb(skb2);
3d30d949
MW		 3873 }
3874 }
3875
3876 prev_dev = sdata->dev;
36ec144f 3877 dev_sw_netstats_rx_add(sdata->dev, skb->len);
3d30d949
MW		 3878 }
3879
3880 if (prev_dev) {
3881 skb->dev = prev_dev;
5548a8a1 3882 netif_receive_skb(skb);
554891e6
JB		 3883 return;
3884 }
3d30d949
MW		 3885
3886 out_free_skb:
3887 dev_kfree_skb(skb);
3888}
3889
aa0c8636
CL		 3890static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3891 ieee80211_rx_result res)
3892{
3893 switch (res) {
3894 case RX_DROP_MONITOR:
3895 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3896 if (rx->sta)
046d2e7c 3897 rx->sta->deflink.rx_stats.dropped++;
fc0561dc 3898 fallthrough;
aa0c8636
CL		 3899 case RX_CONTINUE: {
3900 struct ieee80211_rate *rate = NULL;
3901 struct ieee80211_supported_band *sband;
3902 struct ieee80211_rx_status *status;
3903
3904 status = IEEE80211_SKB_RXCB((rx->skb));
3905
3906 sband = rx->local->hw.wiphy->bands[status->band];
41cbb0f5 3907 if (status->encoding == RX_ENC_LEGACY)
aa0c8636
CL		 3908 rate = &sband->bitrates[status->rate_idx];
3909
3910 ieee80211_rx_cooked_monitor(rx, rate);
3911 break;
3912 }
3913 case RX_DROP_UNUSABLE:
3914 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3915 if (rx->sta)
046d2e7c 3916 rx->sta->deflink.rx_stats.dropped++;
aa0c8636
CL		 3917 dev_kfree_skb(rx->skb);
3918 break;
3919 case RX_QUEUED:
3920 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3921 break;
3922 }
3923}
571ecf67 3924
f9e124fb
CL		 3925static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3926 struct sk_buff_head *frames)
58905290 3927{
58905290 3928 ieee80211_rx_result res = RX_DROP_MONITOR;
aa0c8636 3929 struct sk_buff *skb;
8944b79f 3930
e32f85f7
LCC		 3931#define CALL_RXH(rxh) \
3932 do { \
3933 res = rxh(rx); \
3934 if (res != RX_CONTINUE) \
2569a826 3935 goto rxh_next; \
8ebaa5b0 3936 } while (0)
49461622 3937
45ceeee8
JB		 3938 /* Lock here to avoid hitting all of the data used in the RX
3939 * path (e.g. key data, station data, ...) concurrently when
3940 * a frame is released from the reorder buffer due to timeout
3941 * from the timer, potentially concurrently with RX from the
3942 * driver.
3943 */
f9e124fb 3944 spin_lock_bh(&rx->local->rx_path_lock);
24a8fdad 3945
f9e124fb 3946 while ((skb = __skb_dequeue(frames))) {
2569a826
JB		 3947 /*
3948 * all the other fields are valid across frames
3949 * that belong to an aMPDU since they are on the
3950 * same TID from the same station
3951 */
3952 rx->skb = skb;
3953
8ebaa5b0
JB		 3954 CALL_RXH(ieee80211_rx_h_check_more_data);
3955 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
3956 CALL_RXH(ieee80211_rx_h_sta_process);
3957 CALL_RXH(ieee80211_rx_h_decrypt);
3958 CALL_RXH(ieee80211_rx_h_defragment);
3959 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
2569a826 3960 /* must be after MMIC verify so header is counted in MPDU mic */
bf94e17b 3961#ifdef CONFIG_MAC80211_MESH
aa0c8636 3962 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2569a826 3963 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 3964#endif
8ebaa5b0
JB		 3965 CALL_RXH(ieee80211_rx_h_amsdu);
3966 CALL_RXH(ieee80211_rx_h_data);
f9e124fb
CL		 3967
3968 /* special treatment -- needs the queue */
3969 res = ieee80211_rx_h_ctrl(rx, frames);
3970 if (res != RX_CONTINUE)
3971 goto rxh_next;
3972
8ebaa5b0
JB		 3973 CALL_RXH(ieee80211_rx_h_mgmt_check);
3974 CALL_RXH(ieee80211_rx_h_action);
3975 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
1ea02224 3976 CALL_RXH(ieee80211_rx_h_action_post_userspace);
8ebaa5b0 3977 CALL_RXH(ieee80211_rx_h_action_return);
09a740ce 3978 CALL_RXH(ieee80211_rx_h_ext);
8ebaa5b0 3979 CALL_RXH(ieee80211_rx_h_mgmt);
49461622 3980
aa0c8636
CL		 3981 rxh_next:
3982 ieee80211_rx_handlers_result(rx, res);
f9e124fb 3983
49461622 3984#undef CALL_RXH
aa0c8636 3985 }
24a8fdad 3986
f9e124fb 3987 spin_unlock_bh(&rx->local->rx_path_lock);
aa0c8636
CL		 3988}
3989
4406c376 3990static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
aa0c8636 3991{
f9e124fb 3992 struct sk_buff_head reorder_release;
aa0c8636
CL		 3993 ieee80211_rx_result res = RX_DROP_MONITOR;
3994
f9e124fb
CL		 3995 __skb_queue_head_init(&reorder_release);
3996
aa0c8636
CL		 3997#define CALL_RXH(rxh) \
3998 do { \
3999 res = rxh(rx); \
4000 if (res != RX_CONTINUE) \
4001 goto rxh_next; \
8ebaa5b0 4002 } while (0)
aa0c8636 4003
8ebaa5b0
JB		 4004 CALL_RXH(ieee80211_rx_h_check_dup);
4005 CALL_RXH(ieee80211_rx_h_check);
aa0c8636 4006
f9e124fb 4007 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
aa0c8636 4008
f9e124fb 4009 ieee80211_rx_handlers(rx, &reorder_release);
aa0c8636 4010 return;
49461622 4011
2569a826 4012 rxh_next:
aa0c8636
CL		 4013 ieee80211_rx_handlers_result(rx, res);
4014
4015#undef CALL_RXH
58905290
JB		 4016}
4017
2bff8ebf 4018/*
dd318575
JB		 4019 * This function makes calls into the RX path, therefore
4020 * it has to be invoked under RCU read lock.
2bff8ebf
CL		 4021 */
4022void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4023{
f9e124fb 4024 struct sk_buff_head frames;
554891e6
JB		 4025 struct ieee80211_rx_data rx = {
4026 .sta = sta,
4027 .sdata = sta->sdata,
4028 .local = sta->local,
9e26297a
JB		 4029 /* This is OK -- must be QoS data frame */
4030 .security_idx = tid,
4031 .seqno_idx = tid,
892b3bce 4032 .link_id = -1,
554891e6 4033 };
2c15a0cf
CL		 4034 struct tid_ampdu_rx *tid_agg_rx;
4035
4036 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4037 if (!tid_agg_rx)
4038 return;
2bff8ebf 4039
f9e124fb
CL		 4040 __skb_queue_head_init(&frames);
4041
2c15a0cf 4042 spin_lock(&tid_agg_rx->reorder_lock);
f9e124fb 4043 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
2c15a0cf 4044 spin_unlock(&tid_agg_rx->reorder_lock);
2bff8ebf 4045
b497de63
EG		 4046 if (!skb_queue_empty(&frames)) {
4047 struct ieee80211_event event = {
4048 .type = BA_FRAME_TIMEOUT,
4049 .u.ba.tid = tid,
4050 .u.ba.sta = &sta->sta,
4051 };
4052 drv_event_callback(rx.local, rx.sdata, &event);
4053 }
4054
f9e124fb 4055 ieee80211_rx_handlers(&rx, &frames);
2bff8ebf
CL		 4056}
4057
06470f74
SS		 4058void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4059 u16 ssn, u64 filtered,
4060 u16 received_mpdus)
4061{
4062 struct sta_info *sta;
4063 struct tid_ampdu_rx *tid_agg_rx;
4064 struct sk_buff_head frames;
4065 struct ieee80211_rx_data rx = {
4066 /* This is OK -- must be QoS data frame */
4067 .security_idx = tid,
4068 .seqno_idx = tid,
892b3bce 4069 .link_id = -1,
06470f74
SS		 4070 };
4071 int i, diff;
4072
4073 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4074 return;
4075
4076 __skb_queue_head_init(&frames);
4077
4078 sta = container_of(pubsta, struct sta_info, sta);
4079
4080 rx.sta = sta;
4081 rx.sdata = sta->sdata;
4082 rx.local = sta->local;
4083
4084 rcu_read_lock();
4085 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4086 if (!tid_agg_rx)
4087 goto out;
4088
4089 spin_lock_bh(&tid_agg_rx->reorder_lock);
4090
4091 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4092 int release;
4093
4094 /* release all frames in the reorder buffer */
4095 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4096 IEEE80211_SN_MODULO;
4097 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
4098 release, &frames);
4099 /* update ssn to match received ssn */
4100 tid_agg_rx->head_seq_num = ssn;
4101 } else {
4102 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
4103 &frames);
4104 }
4105
4106 /* handle the case that received ssn is behind the mac ssn.
4107 * it can be tid_agg_rx->buf_size behind and still be valid */
4108 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4109 if (diff >= tid_agg_rx->buf_size) {
4110 tid_agg_rx->reorder_buf_filtered = 0;
4111 goto release;
4112 }
4113 filtered = filtered >> diff;
4114 ssn += diff;
4115
4116 /* update bitmap */
4117 for (i = 0; i < tid_agg_rx->buf_size; i++) {
4118 int index = (ssn + i) % tid_agg_rx->buf_size;
4119
4120 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4121 if (filtered & BIT_ULL(i))
4122 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4123 }
4124
4125 /* now process also frames that the filter marking released */
4126 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4127
4128release:
4129 spin_unlock_bh(&tid_agg_rx->reorder_lock);
4130
4131 ieee80211_rx_handlers(&rx, &frames);
4132
4133 out:
4134 rcu_read_unlock();
4135}
4136EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4137
571ecf67
JB		 4138/* main receive path */
4139
7e60096f
JB		 4140static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4141{
4142 return ether_addr_equal(raddr, addr) ||
4143 is_broadcast_ether_addr(raddr);
4144}
4145
892b3bce
JB		 4146static bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
4147 const u8 *addr, int *out_link_id)
4148{
4149 unsigned int link_id;
4150
4151 /* non-MLO, or MLD address replaced by hardware */
4152 if (ether_addr_equal(sdata->vif.addr, addr))
4153 return true;
4154
4155 if (!sdata->vif.valid_links)
4156 return false;
4157
4158 for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
d8675a63
JB		 4159 struct ieee80211_bss_conf *conf;
4160
4161 conf = rcu_dereference(sdata->vif.link_conf[link_id]);
4162
4163 if (!conf)
892b3bce 4164 continue;
d8675a63 4165 if (ether_addr_equal(conf->addr, addr)) {
892b3bce
JB		 4166 if (out_link_id)
4167 *out_link_id = link_id;
4168 return true;
4169 }
4170 }
4171
4172 return false;
4173}
4174
a58fbe1a 4175static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
23a24def 4176{
20b01f80 4177 struct ieee80211_sub_if_data *sdata = rx->sdata;
eb9fb5b8 4178 struct sk_buff *skb = rx->skb;
a58fbe1a 4179 struct ieee80211_hdr *hdr = (void *)skb->data;
eb9fb5b8
JB		 4180 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4181 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
09a740ce
TP		 4182 bool multicast = is_multicast_ether_addr(hdr->addr1) ||
4183 ieee80211_is_s1g_beacon(hdr->frame_control);
23a24def 4184
51fb61e7 4185 switch (sdata->vif.type) {
05c914fe 4186 case NL80211_IFTYPE_STATION:
9bc383de 4187 if (!bssid && !sdata->u.mgd.use_4addr)
3c2723f5 4188 return false;
588f7d39
JB		 4189 if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4190 return false;
a58fbe1a
JB		 4191 if (multicast)
4192 return true;
892b3bce 4193 return ieee80211_is_our_addr(sdata, hdr->addr1, &rx->link_id);
05c914fe 4194 case NL80211_IFTYPE_ADHOC:
23a24def 4195 if (!bssid)
3c2723f5 4196 return false;
6329b8d9 4197 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
a6555f84
Y		 4198 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
4199 !is_valid_ether_addr(hdr->addr2))
3c2723f5 4200 return false;
a58fbe1a 4201 if (ieee80211_is_beacon(hdr->frame_control))
3c2723f5 4202 return true;
a58fbe1a 4203 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3c2723f5 4204 return false;
a58fbe1a
JB		 4205 if (!multicast &&
4206 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
df140465 4207 return false;
a58fbe1a 4208 if (!rx->sta) {
0fb8ca45 4209 int rate_idx;
da6a4352 4210 if (status->encoding != RX_ENC_LEGACY)
5614618e 4211 rate_idx = 0; /* TODO: HT/VHT rates */
0fb8ca45 4212 else
eb9fb5b8 4213 rate_idx = status->rate_idx;
8bf11d8d
JB		 4214 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
4215 BIT(rate_idx));
0fb8ca45 4216 }
a58fbe1a 4217 return true;
239281f8
RL		 4218 case NL80211_IFTYPE_OCB:
4219 if (!bssid)
4220 return false;
cc117298 4221 if (!ieee80211_is_data_present(hdr->frame_control))
239281f8 4222 return false;
a58fbe1a 4223 if (!is_broadcast_ether_addr(bssid))
239281f8 4224 return false;
a58fbe1a
JB		 4225 if (!multicast &&
4226 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
df140465 4227 return false;
a58fbe1a 4228 if (!rx->sta) {
239281f8 4229 int rate_idx;
da6a4352 4230 if (status->encoding != RX_ENC_LEGACY)
239281f8
RL		 4231 rate_idx = 0; /* TODO: HT rates */
4232 else
4233 rate_idx = status->rate_idx;
4234 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
4235 BIT(rate_idx));
4236 }
a58fbe1a 4237 return true;
05c914fe 4238 case NL80211_IFTYPE_MESH_POINT:
736a80bb
JB		 4239 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
4240 return false;
a58fbe1a
JB		 4241 if (multicast)
4242 return true;
4243 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
05c914fe
JB		 4244 case NL80211_IFTYPE_AP_VLAN:
4245 case NL80211_IFTYPE_AP:
a58fbe1a 4246 if (!bssid)
892b3bce
JB		 4247 return ieee80211_is_our_addr(sdata, hdr->addr1,
4248 &rx->link_id);
a58fbe1a 4249
892b3bce
JB		 4250 if (!is_broadcast_ether_addr(bssid) &&
4251 !ieee80211_is_our_addr(sdata, bssid, NULL)) {
3df6eaea
JB		 4252 /*
4253 * Accept public action frames even when the
4254 * BSSID doesn't match, this is used for P2P
4255 * and location updates. Note that mac80211
4256 * itself never looks at these frames.
4257 */
2b9ccd4e 4258 if (!multicast &&
892b3bce
JB		 4259 !ieee80211_is_our_addr(sdata, hdr->addr1,
4260 &rx->link_id))
3c2723f5 4261 return false;
d48b2968 4262 if (ieee80211_is_public_action(hdr, skb->len))
3c2723f5 4263 return true;
5c90067c 4264 return ieee80211_is_beacon(hdr->frame_control);
a58fbe1a
JB		 4265 }
4266
4267 if (!ieee80211_has_tods(hdr->frame_control)) {
db8e1732
AN		 4268 /* ignore data frames to TDLS-peers */
4269 if (ieee80211_is_data(hdr->frame_control))
4270 return false;
4271 /* ignore action frames to TDLS-peers */
4272 if (ieee80211_is_action(hdr->frame_control) &&
1ec7bae8 4273 !is_broadcast_ether_addr(bssid) &&
db8e1732
AN		 4274 !ether_addr_equal(bssid, hdr->addr1))
4275 return false;
23a24def 4276 }
3018e947
JB		 4277
4278 /*
4279 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
4280 * the BSSID - we've checked that already but may have accepted
4281 * the wildcard (ff:ff:ff:ff:ff:ff).
4282 *
4283 * It also says:
4284 * The BSSID of the Data frame is determined as follows:
4285 * a) If the STA is contained within an AP or is associated
4286 * with an AP, the BSSID is the address currently in use
4287 * by the STA contained in the AP.
4288 *
4289 * So we should not accept data frames with an address that's
4290 * multicast.
4291 *
4292 * Accepting it also opens a security problem because stations
4293 * could encrypt it with the GTK and inject traffic that way.
4294 */
4295 if (ieee80211_is_data(hdr->frame_control) && multicast)
4296 return false;
4297
a58fbe1a 4298 return true;
f142c6b9 4299 case NL80211_IFTYPE_P2P_DEVICE:
a58fbe1a
JB		 4300 return ieee80211_is_public_action(hdr, skb->len) ||
4301 ieee80211_is_probe_req(hdr->frame_control) ||
4302 ieee80211_is_probe_resp(hdr->frame_control) ||
4303 ieee80211_is_beacon(hdr->frame_control);
cb3b7d87
AB		 4304 case NL80211_IFTYPE_NAN:
4305 /* Currently no frames on NAN interface are allowed */
4306 return false;
2ca27bcf 4307 default:
fb1c1cd6 4308 break;
23a24def
JB		 4309 }
4310
a58fbe1a
JB		 4311 WARN_ON_ONCE(1);
4312 return false;
23a24def
JB		 4313}
4314
49ddf8e6
JB		 4315void ieee80211_check_fast_rx(struct sta_info *sta)
4316{
4317 struct ieee80211_sub_if_data *sdata = sta->sdata;
4318 struct ieee80211_local *local = sdata->local;
4319 struct ieee80211_key *key;
4320 struct ieee80211_fast_rx fastrx = {
4321 .dev = sdata->dev,
4322 .vif_type = sdata->vif.type,
4323 .control_port_protocol = sdata->control_port_protocol,
4324 }, *old, *new = NULL;
80a915ec 4325 bool set_offload = false;
49ddf8e6 4326 bool assign = false;
80a915ec 4327 bool offload;
49ddf8e6
JB		 4328
4329 /* use sparse to check that we don't return without updating */
4330 __acquire(check_fast_rx);
4331
4332 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4333 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4334 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
4335 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
4336
c9c5962b
JB		 4337 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4338
49ddf8e6
JB		 4339 /* fast-rx doesn't do reordering */
4340 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4341 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4342 goto clear;
4343
4344 switch (sdata->vif.type) {
4345 case NL80211_IFTYPE_STATION:
49ddf8e6
JB		 4346 if (sta->sta.tdls) {
4347 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4348 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4349 fastrx.expected_ds_bits = 0;
4350 } else {
49ddf8e6
JB		 4351 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4352 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4353 fastrx.expected_ds_bits =
4354 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4355 }
1d870162 4356
9251a473
FF		 4357 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4358 fastrx.expected_ds_bits |=
4359 cpu_to_le16(IEEE80211_FCTL_TODS);
4360 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4361 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4362 }
4363
1d870162
FF		 4364 if (!sdata->u.mgd.powersave)
4365 break;
4366
4367 /* software powersave is a huge mess, avoid all of it */
4368 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4369 goto clear;
4370 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4371 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4372 goto clear;
49ddf8e6
JB		 4373 break;
4374 case NL80211_IFTYPE_AP_VLAN:
4375 case NL80211_IFTYPE_AP:
4376 /* parallel-rx requires this, at least with calls to
4377 * ieee80211_sta_ps_transition()
4378 */
4379 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4380 goto clear;
4381 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4382 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4383 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4384
4385 fastrx.internal_forward =
4386 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4387 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4388 !sdata->u.vlan.sta);
59cae5b9
FF		 4389
4390 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4391 sdata->u.vlan.sta) {
4392 fastrx.expected_ds_bits |=
4393 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4394 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4395 fastrx.internal_forward = 0;
4396 }
4397
49ddf8e6
JB		 4398 break;
4399 default:
4400 goto clear;
4401 }
4402
4403 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
4404 goto clear;
4405
4406 rcu_read_lock();
4407 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
622d3b4e
FF		 4408 if (!key)
4409 key = rcu_dereference(sdata->default_unicast_key);
49ddf8e6
JB		 4410 if (key) {
4411 switch (key->conf.cipher) {
4412 case WLAN_CIPHER_SUITE_TKIP:
4413 /* we don't want to deal with MMIC in fast-rx */
4414 goto clear_rcu;
4415 case WLAN_CIPHER_SUITE_CCMP:
4416 case WLAN_CIPHER_SUITE_CCMP_256:
4417 case WLAN_CIPHER_SUITE_GCMP:
4418 case WLAN_CIPHER_SUITE_GCMP_256:
4419 break;
4420 default:
96fc6efb
AW		 4421 /* We also don't want to deal with
4422 * WEP or cipher scheme.
49ddf8e6
JB		 4423 */
4424 goto clear_rcu;
4425 }
4426
4427 fastrx.key = true;
4428 fastrx.icv_len = key->conf.icv_len;
4429 }
4430
4431 assign = true;
4432 clear_rcu:
4433 rcu_read_unlock();
4434 clear:
4435 __release(check_fast_rx);
4436
4437 if (assign)
4438 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
4439
80a915ec
FF		 4440 offload = assign &&
4441 (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED);
4442
4443 if (offload)
4444 set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4445 else
4446 set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4447
4448 if (set_offload)
4449 drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
4450
49ddf8e6
JB		 4451 spin_lock_bh(&sta->lock);
4452 old = rcu_dereference_protected(sta->fast_rx, true);
4453 rcu_assign_pointer(sta->fast_rx, new);
4454 spin_unlock_bh(&sta->lock);
4455
4456 if (old)
4457 kfree_rcu(old, rcu_head);
4458}
4459
4460void ieee80211_clear_fast_rx(struct sta_info *sta)
4461{
4462 struct ieee80211_fast_rx *old;
4463
4464 spin_lock_bh(&sta->lock);
4465 old = rcu_dereference_protected(sta->fast_rx, true);
4466 RCU_INIT_POINTER(sta->fast_rx, NULL);
4467 spin_unlock_bh(&sta->lock);
4468
4469 if (old)
4470 kfree_rcu(old, rcu_head);
4471}
4472
4473void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4474{
4475 struct ieee80211_local *local = sdata->local;
4476 struct sta_info *sta;
4477
4478 lockdep_assert_held(&local->sta_mtx);
4479
253216ff 4480 list_for_each_entry(sta, &local->sta_list, list) {
49ddf8e6
JB		 4481 if (sdata != sta->sdata &&
4482 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4483 continue;
4484 ieee80211_check_fast_rx(sta);
4485 }
4486}
4487
4488void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4489{
4490 struct ieee80211_local *local = sdata->local;
4491
4492 mutex_lock(&local->sta_mtx);
4493 __ieee80211_check_fast_rx_iface(sdata);
4494 mutex_unlock(&local->sta_mtx);
4495}
4496
80a915ec
FF		 4497static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4498 struct ieee80211_fast_rx *fast_rx,
4499 int orig_len)
4500{
4501 struct ieee80211_sta_rx_stats *stats;
4502 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4503 struct sta_info *sta = rx->sta;
4504 struct sk_buff *skb = rx->skb;
4505 void *sa = skb->data + ETH_ALEN;
4506 void *da = skb->data;
4507
046d2e7c 4508 stats = &sta->deflink.rx_stats;
80a915ec 4509 if (fast_rx->uses_rss)
046d2e7c 4510 stats = this_cpu_ptr(sta->deflink.pcpu_rx_stats);
80a915ec
FF		 4511
4512 /* statistics part of ieee80211_rx_h_sta_process() */
4513 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4514 stats->last_signal = status->signal;
4515 if (!fast_rx->uses_rss)
046d2e7c 4516 ewma_signal_add(&sta->deflink.rx_stats_avg.signal,
80a915ec
FF		 4517 -status->signal);
4518 }
4519
4520 if (status->chains) {
4521 int i;
4522
4523 stats->chains = status->chains;
4524 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4525 int signal = status->chain_signal[i];
4526
4527 if (!(status->chains & BIT(i)))
4528 continue;
4529
4530 stats->chain_signal_last[i] = signal;
4531 if (!fast_rx->uses_rss)
046d2e7c 4532 ewma_signal_add(&sta->deflink.rx_stats_avg.chain_signal[i],
80a915ec
FF		 4533 -signal);
4534 }
4535 }
4536 /* end of statistics */
4537
4538 stats->last_rx = jiffies;
4539 stats->last_rate = sta_stats_encode_rate(status);
4540
4541 stats->fragments++;
4542 stats->packets++;
4543
4544 skb->dev = fast_rx->dev;
4545
4546 dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
4547
4548 /* The seqno index has the same property as needed
4549 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4550 * for non-QoS-data frames. Here we know it's a data
4551 * frame, so count MSDUs.
4552 */
4553 u64_stats_update_begin(&stats->syncp);
4554 stats->msdu[rx->seqno_idx]++;
4555 stats->bytes += orig_len;
4556 u64_stats_update_end(&stats->syncp);
4557
4558 if (fast_rx->internal_forward) {
4559 struct sk_buff *xmit_skb = NULL;
4560 if (is_multicast_ether_addr(da)) {
4561 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4562 } else if (!ether_addr_equal(da, sa) &&
4563 sta_info_get(rx->sdata, da)) {
4564 xmit_skb = skb;
4565 skb = NULL;
4566 }
4567
4568 if (xmit_skb) {
4569 /*
4570 * Send to wireless media and increase priority by 256
4571 * to keep the received priority instead of
4572 * reclassifying the frame (see cfg80211_classify8021d).
4573 */
4574 xmit_skb->priority += 256;
4575 xmit_skb->protocol = htons(ETH_P_802_3);
4576 skb_reset_network_header(xmit_skb);
4577 skb_reset_mac_header(xmit_skb);
4578 dev_queue_xmit(xmit_skb);
4579 }
4580
4581 if (!skb)
4582 return;
4583 }
4584
4585 /* deliver to local stack */
4586 skb->protocol = eth_type_trans(skb, fast_rx->dev);
610d086d 4587 ieee80211_deliver_skb_to_local_stack(skb, rx);
80a915ec
FF		 4588}
4589
49ddf8e6
JB		 4590static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4591 struct ieee80211_fast_rx *fast_rx)
4592{
4593 struct sk_buff *skb = rx->skb;
4594 struct ieee80211_hdr *hdr = (void *)skb->data;
4595 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4596 struct sta_info *sta = rx->sta;
4597 int orig_len = skb->len;
24bba078
FF		 4598 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
4599 int snap_offs = hdrlen;
49ddf8e6
JB		 4600 struct {
4601 u8 snap[sizeof(rfc1042_header)];
4602 __be16 proto;
4603 } *payload __aligned(2);
4604 struct {
4605 u8 da[ETH_ALEN];
4606 u8 sa[ETH_ALEN];
4607 } addrs __aligned(2);
046d2e7c 4608 struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats;
c9c5962b 4609
49ddf8e6
JB		 4610 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
4611 * to a common data structure; drivers can implement that per queue
4612 * but we don't have that information in mac80211
4613 */
4614 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4615 return false;
4616
4617#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4618
4619 /* If using encryption, we also need to have:
4620 * - PN_VALIDATED: similar, but the implementation is tricky
4621 * - DECRYPTED: necessary for PN_VALIDATED
4622 */
4623 if (fast_rx->key &&
4624 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
4625 return false;
4626
49ddf8e6
JB		 4627 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
4628 return false;
4629
4630 if (unlikely(ieee80211_is_frag(hdr)))
4631 return false;
4632
4633 /* Since our interface address cannot be multicast, this
4634 * implicitly also rejects multicast frames without the
4635 * explicit check.
4636 *
4637 * We shouldn't get any *data* frames not addressed to us
4638 * (AP mode will accept multicast *management* frames), but
4639 * punting here will make it go through the full checks in
4640 * ieee80211_accept_frame().
4641 */
4642 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
4643 return false;
4644
4645 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
4646 IEEE80211_FCTL_TODS)) !=
4647 fast_rx->expected_ds_bits)
b323ac19 4648 return false;
49ddf8e6
JB		 4649
4650 /* assign the key to drop unencrypted frames (later)
4651 * and strip the IV/MIC if necessary
4652 */
4653 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
4654 /* GCMP header length is the same */
4655 snap_offs += IEEE80211_CCMP_HDR_LEN;
4656 }
4657
24bba078
FF		 4658 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
4659 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
4660 goto drop;
49ddf8e6 4661
24bba078 4662 payload = (void *)(skb->data + snap_offs);
49ddf8e6 4663
24bba078
FF		 4664 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
4665 return false;
4666
4667 /* Don't handle these here since they require special code.
4668 * Accept AARP and IPX even though they should come with a
4669 * bridge-tunnel header - but if we get them this way then
4670 * there's little point in discarding them.
4671 */
4672 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4673 payload->proto == fast_rx->control_port_protocol))
4674 return false;
4675 }
49ddf8e6
JB		 4676
4677 /* after this point, don't punt to the slowpath! */
4678
4679 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4680 pskb_trim(skb, skb->len - fast_rx->icv_len))
4681 goto drop;
4682
49ddf8e6
JB		 4683 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
4684 goto drop;
4685
24bba078
FF		 4686 if (status->rx_flags & IEEE80211_RX_AMSDU) {
4687 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
4688 RX_QUEUED)
4689 goto drop;
4690
4691 return true;
4692 }
4693
49ddf8e6
JB		 4694 /* do the header conversion - first grab the addresses */
4695 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
4696 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
667aa742
JB		 4697 skb_postpull_rcsum(skb, skb->data + snap_offs,
4698 sizeof(rfc1042_header) + 2);
49ddf8e6
JB		 4699 /* remove the SNAP but leave the ethertype */
4700 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
4701 /* push the addresses in front */
4702 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4703
80a915ec 4704 ieee80211_rx_8023(rx, fast_rx, orig_len);
49ddf8e6
JB		 4705
4706 return true;
4707 drop:
4708 dev_kfree_skb(skb);
80a915ec 4709 if (fast_rx->uses_rss)
046d2e7c 4710 stats = this_cpu_ptr(sta->deflink.pcpu_rx_stats);
80a915ec 4711
c9c5962b 4712 stats->dropped++;
49ddf8e6
JB		 4713 return true;
4714}
4715
4406c376
JB		 4716/*
4717 * This function returns whether or not the SKB
4718 * was destined for RX processing or not, which,
4719 * if consume is true, is equivalent to whether
4720 * or not the skb was consumed.
4721 */
4722static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4723 struct sk_buff *skb, bool consume)
4724{
4725 struct ieee80211_local *local = rx->local;
4726 struct ieee80211_sub_if_data *sdata = rx->sdata;
4406c376
JB		 4727
4728 rx->skb = skb;
4406c376 4729
49ddf8e6
JB		 4730 /* See if we can do fast-rx; if we have to copy we already lost,
4731 * so punt in that case. We should never have to deliver a data
4732 * frame to multiple interfaces anyway.
4733 *
4734 * We skip the ieee80211_accept_frame() call and do the necessary
4735 * checking inside ieee80211_invoke_fast_rx().
4736 */
4737 if (consume && rx->sta) {
4738 struct ieee80211_fast_rx *fast_rx;
4739
4740 fast_rx = rcu_dereference(rx->sta->fast_rx);
4741 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4742 return true;
4743 }
4744
a58fbe1a 4745 if (!ieee80211_accept_frame(rx))
4406c376
JB		 4746 return false;
4747
4406c376
JB		 4748 if (!consume) {
4749 skb = skb_copy(skb, GFP_ATOMIC);
4750 if (!skb) {
4751 if (net_ratelimit())
4752 wiphy_debug(local->hw.wiphy,
b305dae4 4753 "failed to copy skb for %s\n",
4406c376
JB		 4754 sdata->name);
4755 return true;
4756 }
4757
4758 rx->skb = skb;
4759 }
4760
4761 ieee80211_invoke_rx_handlers(rx);
4762 return true;
4763}
4764
80a915ec
FF		 4765static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
4766 struct ieee80211_sta *pubsta,
4767 struct sk_buff *skb,
4768 struct list_head *list)
4769{
4770 struct ieee80211_local *local = hw_to_local(hw);
4771 struct ieee80211_fast_rx *fast_rx;
4772 struct ieee80211_rx_data rx;
4773
4774 memset(&rx, 0, sizeof(rx));
4775 rx.skb = skb;
4776 rx.local = local;
4777 rx.list = list;
892b3bce 4778 rx.link_id = -1;
80a915ec
FF		 4779
4780 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
4781
4782 /* drop frame if too short for header */
4783 if (skb->len < sizeof(struct ethhdr))
4784 goto drop;
4785
4786 if (!pubsta)
4787 goto drop;
4788
4789 rx.sta = container_of(pubsta, struct sta_info, sta);
4790 rx.sdata = rx.sta->sdata;
4791
4792 fast_rx = rcu_dereference(rx.sta->fast_rx);
4793 if (!fast_rx)
4794 goto drop;
4795
4796 ieee80211_rx_8023(&rx, fast_rx, skb->len);
4797 return;
4798
4799drop:
4800 dev_kfree_skb(skb);
4801}
4802
892b3bce
JB		 4803static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
4804 struct sk_buff *skb, bool consume)
4805{
4806 struct link_sta_info *link_sta;
4807 struct ieee80211_hdr *hdr = (void *)skb->data;
4808
4809 /*
4810 * Look up link station first, in case there's a
4811 * chance that they might have a link address that
4812 * is identical to the MLD address, that way we'll
4813 * have the link information if needed.
4814 */
4815 link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
4816 if (link_sta) {
4817 rx->sta = link_sta->sta;
4818 rx->link_id = link_sta->link_id;
4819 } else {
4820 rx->sta = sta_info_get_bss(rx->sdata, hdr->addr2);
4821 }
4822
4823 return ieee80211_prepare_and_rx_handle(rx, skb, consume);
4824}
4825
571ecf67 4826/*
6b59db7d 4827 * This is the actual Rx frames handler. as it belongs to Rx path it must
6368e4b1 4828 * be called with rcu_read_lock protection.
571ecf67 4829 */
71ebb4aa 4830static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
d63b548f 4831 struct ieee80211_sta *pubsta,
af9f9b22 4832 struct sk_buff *skb,
c5d1686b 4833 struct list_head *list)
571ecf67
JB		 4834{
4835 struct ieee80211_local *local = hw_to_local(hw);
4836 struct ieee80211_sub_if_data *sdata;
571ecf67 4837 struct ieee80211_hdr *hdr;
e3cf8b3f 4838 __le16 fc;
5cf121c3 4839 struct ieee80211_rx_data rx;
4406c376 4840 struct ieee80211_sub_if_data *prev;
83e7e4ce 4841 struct rhlist_head *tmp;
e3cf8b3f 4842 int err = 0;
571ecf67 4843
e3cf8b3f 4844 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
571ecf67
JB		 4845 memset(&rx, 0, sizeof(rx));
4846 rx.skb = skb;
4847 rx.local = local;
c5d1686b 4848 rx.list = list;
892b3bce 4849 rx.link_id = -1;
72abd81b 4850
e3cf8b3f 4851 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
c206ca67 4852 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
571ecf67 4853
4a4f1a58
JB		 4854 if (ieee80211_is_mgmt(fc)) {
4855 /* drop frame if too short for header */
4856 if (skb->len < ieee80211_hdrlen(fc))
4857 err = -ENOBUFS;
4858 else
4859 err = skb_linearize(skb);
4860 } else {
e3cf8b3f 4861 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4a4f1a58 4862 }
e3cf8b3f
ZY		 4863
4864 if (err) {
4865 dev_kfree_skb(skb);
4866 return;
4867 }
4868
4869 hdr = (struct ieee80211_hdr *)skb->data;
38f3714d 4870 ieee80211_parse_qos(&rx);
d1c3a37c 4871 ieee80211_verify_alignment(&rx);
38f3714d 4872
d48b2968 4873 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
cd418ba6
TP		 4874 ieee80211_is_beacon(hdr->frame_control) ||
4875 ieee80211_is_s1g_beacon(hdr->frame_control)))
d48b2968
JB		 4876 ieee80211_scan_rx(local, skb);
4877
19d19e96 4878 if (ieee80211_is_data(fc)) {
d63b548f 4879 struct sta_info *sta, *prev_sta;
7bedd0cf 4880
19d19e96
JB		 4881 if (pubsta) {
4882 rx.sta = container_of(pubsta, struct sta_info, sta);
4883 rx.sdata = rx.sta->sdata;
4884 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4885 return;
4886 goto out;
4887 }
4888
56af3268 4889 prev_sta = NULL;
4406c376 4890
83e7e4ce 4891 for_each_sta_info(local, hdr->addr2, sta, tmp) {
56af3268
BG		 4892 if (!prev_sta) {
4893 prev_sta = sta;
4894 continue;
4895 }
4896
4897 rx.sta = prev_sta;
4898 rx.sdata = prev_sta->sdata;
4406c376 4899 ieee80211_prepare_and_rx_handle(&rx, skb, false);
abe60632 4900
56af3268 4901 prev_sta = sta;
4406c376 4902 }
56af3268
BG		 4903
4904 if (prev_sta) {
4905 rx.sta = prev_sta;
4906 rx.sdata = prev_sta->sdata;
4907
4406c376 4908 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
56af3268 4909 return;
8e26d5ad 4910 goto out;
56af3268 4911 }
4406c376
JB		 4912 }
4913
4b0dd98e 4914 prev = NULL;
b2e7771e 4915
4b0dd98e
JB		 4916 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4917 if (!ieee80211_sdata_running(sdata))
4918 continue;
340e11f3 4919
4b0dd98e
JB		 4920 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
4921 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
4922 continue;
340e11f3 4923
4b0dd98e
JB		 4924 /*
4925 * frame is destined for this interface, but if it's
4926 * not also for the previous one we handle that after
4927 * the loop to avoid copying the SKB once too much
4928 */
4bb29f8c 4929
4b0dd98e 4930 if (!prev) {
abe60632 4931 prev = sdata;
4b0dd98e 4932 continue;
340e11f3 4933 }
4bb29f8c 4934
4b0dd98e 4935 rx.sdata = prev;
892b3bce 4936 ieee80211_rx_for_interface(&rx, skb, false);
4bb29f8c 4937
4b0dd98e
JB		 4938 prev = sdata;
4939 }
4940
4941 if (prev) {
4b0dd98e 4942 rx.sdata = prev;
4406c376 4943
892b3bce 4944 if (ieee80211_rx_for_interface(&rx, skb, true))
4b0dd98e 4945 return;
571ecf67 4946 }
4406c376 4947
8e26d5ad 4948 out:
4406c376 4949 dev_kfree_skb(skb);
571ecf67 4950}
6368e4b1
RR		 4951
4952/*
4953 * This is the receive path handler. It is called by a low level driver when an
4954 * 802.11 MPDU is received from the hardware.
4955 */
c5d1686b
FF		 4956void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
4957 struct sk_buff *skb, struct list_head *list)
6368e4b1
RR		 4958{
4959 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB		 4960 struct ieee80211_rate *rate = NULL;
4961 struct ieee80211_supported_band *sband;
f1d58c25 4962 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
30f6cf96 4963 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
8318d78a 4964
d20ef63d
JB		 4965 WARN_ON_ONCE(softirq_count() == 0);
4966
57fbcce3 4967 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
77a980dc 4968 goto drop;
8318d78a
JB		 4969
4970 sband = local->hw.wiphy->bands[status->band];
77a980dc
JB		 4971 if (WARN_ON(!sband))
4972 goto drop;
8318d78a 4973
89c3a8ac
JB		 4974 /*
4975 * If we're suspending, it is possible although not too likely
4976 * that we'd be receiving frames after having already partially
4977 * quiesced the stack. We can't process such frames then since
4978 * that might, for example, cause stations to be added or other
4979 * driver callbacks be invoked.
4980 */
77a980dc
JB		 4981 if (unlikely(local->quiescing || local->suspended))
4982 goto drop;
89c3a8ac 4983
04800ada
AN		 4984 /* We might be during a HW reconfig, prevent Rx for the same reason */
4985 if (unlikely(local->in_reconfig))
4986 goto drop;
4987
ea77f12f
JB		 4988 /*
4989 * The same happens when we're not even started,
4990 * but that's worth a warning.
4991 */
77a980dc
JB		 4992 if (WARN_ON(!local->started))
4993 goto drop;
ea77f12f 4994
fc885189 4995 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
e5d6eb83 4996 /*
fc885189
JB		 4997 * Validate the rate, unless a PLCP error means that
4998 * we probably can't have a valid rate here anyway.
e5d6eb83 4999 */
fc885189 5000
da6a4352
JB		 5001 switch (status->encoding) {
5002 case RX_ENC_HT:
fc885189
JB		 5003 /*
5004 * rate_idx is MCS index, which can be [0-76]
5005 * as documented on:
5006 *
59d4bfc1 5007 * https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
fc885189
JB		 5008 *
5009 * Anything else would be some sort of driver or
5010 * hardware error. The driver should catch hardware
5011 * errors.
5012 */
444e3803 5013 if (WARN(status->rate_idx > 76,
fc885189
JB		 5014 "Rate marked as an HT rate but passed "
5015 "status->rate_idx is not "
5016 "an MCS index [0-76]: %d (0x%02x)\n",
5017 status->rate_idx,
5018 status->rate_idx))
5019 goto drop;
da6a4352
JB		 5020 break;
5021 case RX_ENC_VHT:
04be6d33 5022 if (WARN_ONCE(status->rate_idx > 11 ||
8613c948
JB		 5023 !status->nss ||
5024 status->nss > 8,
5614618e 5025 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
8613c948 5026 status->rate_idx, status->nss))
5614618e 5027 goto drop;
da6a4352 5028 break;
41cbb0f5
LC		 5029 case RX_ENC_HE:
5030 if (WARN_ONCE(status->rate_idx > 11 ||
5031 !status->nss ||
5032 status->nss > 8,
5033 "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5034 status->rate_idx, status->nss))
5035 goto drop;
5036 break;
da6a4352
JB		 5037 default:
5038 WARN_ON_ONCE(1);
fc0561dc 5039 fallthrough;
da6a4352 5040 case RX_ENC_LEGACY:
444e3803 5041 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
fc885189
JB		 5042 goto drop;
5043 rate = &sband->bitrates[status->rate_idx];
5044 }
0fb8ca45 5045 }
6368e4b1 5046
554891e6
JB		 5047 status->rx_flags = 0;
5048
261e411b
AN		 5049 kcov_remote_start_common(skb_get_kcov_handle(skb));
5050
6368e4b1
RR		 5051 /*
5052 * Frames with failed FCS/PLCP checksum are not returned,
5053 * all other frames are returned without radiotap header
5054 * if it was previously present.
5055 * Also, frames with less than 16 bytes are dropped.
5056 */
80a915ec
FF		 5057 if (!(status->flag & RX_FLAG_8023))
5058 skb = ieee80211_rx_monitor(local, skb, rate);
261e411b 5059 if (skb) {
30f6cf96
FF		 5060 if ((status->flag & RX_FLAG_8023) ||
5061 ieee80211_is_data_present(hdr->frame_control))
5062 ieee80211_tpt_led_trig_rx(local, skb->len);
d63b548f 5063
80a915ec
FF		 5064 if (status->flag & RX_FLAG_8023)
5065 __ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5066 else
5067 __ieee80211_rx_handle_packet(hw, pubsta, skb, list);
261e411b 5068 }
77a980dc 5069
261e411b 5070 kcov_remote_stop();
77a980dc
JB		 5071 return;
5072 drop:
5073 kfree_skb(skb);
6368e4b1 5074}
c5d1686b
FF		 5075EXPORT_SYMBOL(ieee80211_rx_list);
5076
5077void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5078 struct sk_buff *skb, struct napi_struct *napi)
5079{
5080 struct sk_buff *tmp;
5081 LIST_HEAD(list);
5082
5083
5084 /*
5085 * key references and virtual interfaces are protected using RCU
5086 * and this requires that we are in a read-side RCU section during
5087 * receive processing
5088 */
5089 rcu_read_lock();
5090 ieee80211_rx_list(hw, pubsta, skb, &list);
5091 rcu_read_unlock();
5092
5093 if (!napi) {
5094 netif_receive_skb_list(&list);
5095 return;
5096 }
5097
5098 list_for_each_entry_safe(skb, tmp, &list, list) {
5099 skb_list_del_init(skb);
5100 napi_gro_receive(napi, skb);
5101 }
5102}
af9f9b22 5103EXPORT_SYMBOL(ieee80211_rx_napi);
571ecf67
JB		 5104
5105/* This is a version of the rx handler that can be called from hard irq
5106 * context. Post the skb on the queue and schedule the tasklet */
f1d58c25 5107void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
571ecf67
JB		 5108{
5109 struct ieee80211_local *local = hw_to_local(hw);
5110
5111 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5112
571ecf67
JB		 5113 skb->pkt_type = IEEE80211_RX_MSG;
5114 skb_queue_tail(&local->skb_queue, skb);
5115 tasklet_schedule(&local->tasklet);
5116}
5117EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Linux 6.x block layer and io_uring tree(s)