projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
mac80211: expose txq queue depth and size to drivers
[linux-2.6-block.git] / net / mac80211 / rx.c
CommitLineData
571ecf67
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
84040805 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
d98ad83e 6 * Copyright 2013-2014 Intel Mobile Communications GmbH
571ecf67
JB		 7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 */
12
ab46623e 13#include <linux/jiffies.h>
5a0e3ad6 14#include <linux/slab.h>
571ecf67
JB		 15#include <linux/kernel.h>
16#include <linux/skbuff.h>
17#include <linux/netdevice.h>
18#include <linux/etherdevice.h>
d4e46a3d 19#include <linux/rcupdate.h>
bc3b2d7f 20#include <linux/export.h>
571ecf67
JB		 21#include <net/mac80211.h>
22#include <net/ieee80211_radiotap.h>
d26ad377 23#include <asm/unaligned.h>
571ecf67
JB		 24
25#include "ieee80211_i.h"
24487981 26#include "driver-ops.h"
2c8dccc7 27#include "led.h"
33b64eb2 28#include "mesh.h"
571ecf67
JB		 29#include "wep.h"
30#include "wpa.h"
31#include "tkip.h"
32#include "wme.h"
1d8d3dec 33#include "rate.h"
571ecf67 34
5a490510
JB		 35static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
36{
37 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
38
39 u64_stats_update_begin(&tstats->syncp);
40 tstats->rx_packets++;
41 tstats->rx_bytes += len;
42 u64_stats_update_end(&tstats->syncp);
43}
44
a6828493
JB		 45static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
46 enum nl80211_iftype type)
47{
48 __le16 fc = hdr->frame_control;
49
50 if (ieee80211_is_data(fc)) {
51 if (len < 24) /* drop incorrect hdr len (data) */
52 return NULL;
53
54 if (ieee80211_has_a4(fc))
55 return NULL;
56 if (ieee80211_has_tods(fc))
57 return hdr->addr1;
58 if (ieee80211_has_fromds(fc))
59 return hdr->addr2;
60
61 return hdr->addr3;
62 }
63
64 if (ieee80211_is_mgmt(fc)) {
65 if (len < 24) /* drop incorrect hdr len (mgmt) */
66 return NULL;
67 return hdr->addr3;
68 }
69
70 if (ieee80211_is_ctl(fc)) {
71 if (ieee80211_is_pspoll(fc))
72 return hdr->addr1;
73
74 if (ieee80211_is_back_req(fc)) {
75 switch (type) {
76 case NL80211_IFTYPE_STATION:
77 return hdr->addr2;
78 case NL80211_IFTYPE_AP:
79 case NL80211_IFTYPE_AP_VLAN:
80 return hdr->addr1;
81 default:
82 break; /* fall through to the return */
83 }
84 }
85 }
86
87 return NULL;
88}
89
b2e7771e
JB		 90/*
91 * monitor mode reception
92 *
93 * This function cleans up the SKB, i.e. it removes all the stuff
94 * only useful for monitoring.
95 */
96static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
1f7bba79
JB		 97 struct sk_buff *skb,
98 unsigned int rtap_vendor_space)
b2e7771e 99{
30686bf7 100 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
b2e7771e 101 if (likely(skb->len > FCS_LEN))
e3cf8b3f 102 __pskb_trim(skb, skb->len - FCS_LEN);
b2e7771e
JB		 103 else {
104 /* driver bug */
105 WARN_ON(1);
106 dev_kfree_skb(skb);
0624760c 107 return NULL;
b2e7771e
JB		 108 }
109 }
110
1f7bba79
JB		 111 __pskb_pull(skb, rtap_vendor_space);
112
b2e7771e
JB		 113 return skb;
114}
115
1f7bba79
JB		 116static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
117 unsigned int rtap_vendor_space)
b2e7771e 118{
f1d58c25 119 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1f7bba79
JB		 120 struct ieee80211_hdr *hdr;
121
122 hdr = (void *)(skb->data + rtap_vendor_space);
b2e7771e 123
4c298677 124 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
17883048
GB		 125 RX_FLAG_FAILED_PLCP_CRC |
126 RX_FLAG_ONLY_MONITOR))
6b59db7d
ZG		 127 return true;
128
1f7bba79 129 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
6b59db7d
ZG		 130 return true;
131
87228f57
HH		 132 if (ieee80211_is_ctl(hdr->frame_control) &&
133 !ieee80211_is_pspoll(hdr->frame_control) &&
134 !ieee80211_is_back_req(hdr->frame_control))
6b59db7d
ZG		 135 return true;
136
137 return false;
b2e7771e
JB		 138}
139
601ae7f2 140static int
1f7bba79
JB		 141ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
142 struct ieee80211_rx_status *status,
143 struct sk_buff *skb)
601ae7f2
BR		 144{
145 int len;
146
147 /* always present fields */
a144f378 148 len = sizeof(struct ieee80211_radiotap_header) + 8;
601ae7f2 149
a144f378 150 /* allocate extra bitmaps */
a144f378
JB		 151 if (status->chains)
152 len += 4 * hweight8(status->chains);
90b9e446
JB		 153
154 if (ieee80211_have_rx_timestamp(status)) {
155 len = ALIGN(len, 8);
601ae7f2 156 len += 8;
90b9e446 157 }
30686bf7 158 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
601ae7f2 159 len += 1;
601ae7f2 160
a144f378
JB		 161 /* antenna field, if we don't have per-chain info */
162 if (!status->chains)
163 len += 1;
164
90b9e446
JB		 165 /* padding for RX_FLAGS if necessary */
166 len = ALIGN(len, 2);
601ae7f2 167
6d744bac
JB		 168 if (status->flag & RX_FLAG_HT) /* HT info */
169 len += 3;
170
4c298677 171 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
90b9e446 172 len = ALIGN(len, 4);
4c298677
JB		 173 len += 8;
174 }
175
51648921
JB		 176 if (status->flag & RX_FLAG_VHT) {
177 len = ALIGN(len, 2);
178 len += 12;
179 }
180
a144f378
JB		 181 if (status->chains) {
182 /* antenna and antenna signal fields */
183 len += 2 * hweight8(status->chains);
184 }
185
1f7bba79
JB		 186 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
187 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
188
189 /* vendor presence bitmap */
190 len += 4;
191 /* alignment for fixed 6-byte vendor data header */
192 len = ALIGN(len, 2);
193 /* vendor data header */
194 len += 6;
195 if (WARN_ON(rtap->align == 0))
196 rtap->align = 1;
197 len = ALIGN(len, rtap->align);
198 len += rtap->len + rtap->pad;
199 }
200
601ae7f2
BR		 201 return len;
202}
203
00ea6deb 204/*
601ae7f2
BR		 205 * ieee80211_add_rx_radiotap_header - add radiotap header
206 *
207 * add a radiotap header containing all the fields which the hardware provided.
208 */
209static void
210ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
211 struct sk_buff *skb,
601ae7f2 212 struct ieee80211_rate *rate,
973ef21a 213 int rtap_len, bool has_fcs)
601ae7f2 214{
f1d58c25 215 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
601ae7f2
BR		 216 struct ieee80211_radiotap_header *rthdr;
217 unsigned char *pos;
a144f378
JB		 218 __le32 *it_present;
219 u32 it_present_val;
6a86b9c7 220 u16 rx_flags = 0;
a5e70697 221 u16 channel_flags = 0;
a144f378
JB		 222 int mpdulen, chain;
223 unsigned long chains = status->chains;
1f7bba79
JB		 224 struct ieee80211_vendor_radiotap rtap = {};
225
226 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
227 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
228 /* rtap.len and rtap.pad are undone immediately */
229 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
230 }
f4bda337
TP		 231
232 mpdulen = skb->len;
30686bf7 233 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
f4bda337 234 mpdulen += FCS_LEN;
601ae7f2
BR		 235
236 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
1f7bba79 237 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
a144f378 238 it_present = &rthdr->it_present;
601ae7f2
BR		 239
240 /* radiotap header, set always present flags */
0059b2b1 241 rthdr->it_len = cpu_to_le16(rtap_len);
a144f378
JB		 242 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
243 BIT(IEEE80211_RADIOTAP_CHANNEL) |
244 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
245
246 if (!status->chains)
247 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
248
249 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
250 it_present_val |=
251 BIT(IEEE80211_RADIOTAP_EXT) |
252 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
253 put_unaligned_le32(it_present_val, it_present);
254 it_present++;
255 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
256 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
257 }
601ae7f2 258
1f7bba79
JB		 259 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
260 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
261 BIT(IEEE80211_RADIOTAP_EXT);
262 put_unaligned_le32(it_present_val, it_present);
263 it_present++;
264 it_present_val = rtap.present;
265 }
266
a144f378
JB		 267 put_unaligned_le32(it_present_val, it_present);
268
269 pos = (void *)(it_present + 1);
270
601ae7f2
BR		 271 /* the order of the following fields is important */
272
273 /* IEEE80211_RADIOTAP_TSFT */
f4bda337 274 if (ieee80211_have_rx_timestamp(status)) {
90b9e446
JB		 275 /* padding */
276 while ((pos - (u8 *)rthdr) & 7)
277 *pos++ = 0;
f4bda337
TP		 278 put_unaligned_le64(
279 ieee80211_calculate_rx_timestamp(local, status,
280 mpdulen, 0),
281 pos);
1df332e8 282 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
601ae7f2
BR		 283 pos += 8;
284 }
285
286 /* IEEE80211_RADIOTAP_FLAGS */
30686bf7 287 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
601ae7f2 288 *pos |= IEEE80211_RADIOTAP_F_FCS;
aae89831
JB		 289 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
290 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
b4f28bbb
BR		 291 if (status->flag & RX_FLAG_SHORTPRE)
292 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR		 293 pos++;
294
295 /* IEEE80211_RADIOTAP_RATE */
5614618e 296 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
0fb8ca45 297 /*
f8d1ccf1 298 * Without rate information don't add it. If we have,
38f37be2 299 * MCS information is a separate field in radiotap,
73b48099
JB		 300 * added below. The byte here is needed as padding
301 * for the channel though, so initialise it to 0.
0fb8ca45
JM		 302 */
303 *pos = 0;
8d6f658e 304 } else {
2103dec1 305 int shift = 0;
ebe6c7ba 306 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2103dec1
SW		 307 if (status->flag & RX_FLAG_10MHZ)
308 shift = 1;
309 else if (status->flag & RX_FLAG_5MHZ)
310 shift = 2;
311 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
8d6f658e 312 }
601ae7f2
BR		 313 pos++;
314
315 /* IEEE80211_RADIOTAP_CHANNEL */
6a86b9c7 316 put_unaligned_le16(status->freq, pos);
601ae7f2 317 pos += 2;
a5e70697
SW		 318 if (status->flag & RX_FLAG_10MHZ)
319 channel_flags |= IEEE80211_CHAN_HALF;
320 else if (status->flag & RX_FLAG_5MHZ)
321 channel_flags |= IEEE80211_CHAN_QUARTER;
322
601ae7f2 323 if (status->band == IEEE80211_BAND_5GHZ)
a5e70697 324 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
5614618e 325 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
a5e70697 326 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
f8d1ccf1 327 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
a5e70697 328 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
f8d1ccf1 329 else if (rate)
3a5c5e81 330 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
f8d1ccf1 331 else
a5e70697
SW		 332 channel_flags |= IEEE80211_CHAN_2GHZ;
333 put_unaligned_le16(channel_flags, pos);
601ae7f2
BR		 334 pos += 2;
335
336 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
30686bf7 337 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
fe8431f8 338 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
601ae7f2
BR		 339 *pos = status->signal;
340 rthdr->it_present |=
341 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
342 pos++;
343 }
344
601ae7f2
BR		 345 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
346
a144f378
JB		 347 if (!status->chains) {
348 /* IEEE80211_RADIOTAP_ANTENNA */
349 *pos = status->antenna;
350 pos++;
351 }
601ae7f2 352
601ae7f2
BR		 353 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
354
355 /* IEEE80211_RADIOTAP_RX_FLAGS */
356 /* ensure 2 byte alignment for the 2 byte field as required */
6a86b9c7 357 if ((pos - (u8 *)rthdr) & 1)
90b9e446 358 *pos++ = 0;
aae89831 359 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
6a86b9c7
JB		 360 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
361 put_unaligned_le16(rx_flags, pos);
601ae7f2 362 pos += 2;
6d744bac
JB		 363
364 if (status->flag & RX_FLAG_HT) {
786677d1
OR		 365 unsigned int stbc;
366
6d744bac 367 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
ac55d2fe 368 *pos++ = local->hw.radiotap_mcs_details;
6d744bac
JB		 369 *pos = 0;
370 if (status->flag & RX_FLAG_SHORT_GI)
371 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
372 if (status->flag & RX_FLAG_40MHZ)
373 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
ac55d2fe
JB		 374 if (status->flag & RX_FLAG_HT_GF)
375 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
63c361f5
EG		 376 if (status->flag & RX_FLAG_LDPC)
377 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
786677d1
OR		 378 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
379 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
6d744bac
JB		 380 pos++;
381 *pos++ = status->rate_idx;
382 }
4c298677
JB		 383
384 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
385 u16 flags = 0;
386
387 /* ensure 4 byte alignment */
388 while ((pos - (u8 *)rthdr) & 3)
389 pos++;
390 rthdr->it_present |=
391 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
392 put_unaligned_le32(status->ampdu_reference, pos);
393 pos += 4;
4c298677
JB		 394 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
395 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
396 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
397 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
398 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
399 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
400 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
401 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
402 put_unaligned_le16(flags, pos);
403 pos += 2;
404 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
405 *pos++ = status->ampdu_delimiter_crc;
406 else
407 *pos++ = 0;
408 *pos++ = 0;
409 }
90b9e446 410
51648921
JB		 411 if (status->flag & RX_FLAG_VHT) {
412 u16 known = local->hw.radiotap_vht_details;
413
414 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
51648921
JB		 415 put_unaligned_le16(known, pos);
416 pos += 2;
417 /* flags */
418 if (status->flag & RX_FLAG_SHORT_GI)
419 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
63c361f5
EG		 420 /* in VHT, STBC is binary */
421 if (status->flag & RX_FLAG_STBC_MASK)
422 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
fb378c23
EG		 423 if (status->vht_flag & RX_VHT_FLAG_BF)
424 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
51648921
JB		 425 pos++;
426 /* bandwidth */
1b8d242a 427 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
51648921 428 *pos++ = 4;
1b8d242a 429 else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
51648921
JB		 430 *pos++ = 11;
431 else if (status->flag & RX_FLAG_40MHZ)
432 *pos++ = 1;
433 else /* 20 MHz */
434 *pos++ = 0;
435 /* MCS/NSS */
436 *pos = (status->rate_idx << 4) | status->vht_nss;
437 pos += 4;
438 /* coding field */
63c361f5
EG		 439 if (status->flag & RX_FLAG_LDPC)
440 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
51648921
JB		 441 pos++;
442 /* group ID */
443 pos++;
444 /* partial_aid */
445 pos += 2;
446 }
447
a144f378
JB		 448 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
449 *pos++ = status->chain_signal[chain];
450 *pos++ = chain;
451 }
1f7bba79
JB		 452
453 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
454 /* ensure 2 byte alignment for the vendor field as required */
455 if ((pos - (u8 *)rthdr) & 1)
456 *pos++ = 0;
457 *pos++ = rtap.oui[0];
458 *pos++ = rtap.oui[1];
459 *pos++ = rtap.oui[2];
460 *pos++ = rtap.subns;
461 put_unaligned_le16(rtap.len, pos);
462 pos += 2;
463 /* align the actual payload as requested */
464 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
465 *pos++ = 0;
466 /* data (and possible padding) already follows */
467 }
601ae7f2
BR		 468}
469
b2e7771e
JB		 470/*
471 * This function copies a received frame to all monitor interfaces and
472 * returns a cleaned-up SKB that no longer includes the FCS nor the
473 * radiotap header the driver might have added.
474 */
475static struct sk_buff *
476ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a 477 struct ieee80211_rate *rate)
b2e7771e 478{
f1d58c25 479 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
b2e7771e 480 struct ieee80211_sub_if_data *sdata;
1f7bba79 481 int rt_hdrlen, needed_headroom;
b2e7771e
JB		 482 struct sk_buff *skb, *skb2;
483 struct net_device *prev_dev = NULL;
484 int present_fcs_len = 0;
1f7bba79
JB		 485 unsigned int rtap_vendor_space = 0;
486
487 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
488 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
489
490 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
491 }
b2e7771e
JB		 492
493 /*
494 * First, we may need to make a copy of the skb because
495 * (1) we need to modify it for radiotap (if not present), and
496 * (2) the other RX handlers will modify the skb we got.
497 *
498 * We don't need to, of course, if we aren't going to return
499 * the SKB because it has a bad FCS/PLCP checksum.
500 */
0869aea0 501
30686bf7 502 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
b2e7771e
JB		 503 present_fcs_len = FCS_LEN;
504
1f7bba79
JB		 505 /* ensure hdr->frame_control and vendor radiotap data are in skb head */
506 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
e3cf8b3f
ZY		 507 dev_kfree_skb(origskb);
508 return NULL;
509 }
510
17883048 511 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
1f7bba79
JB		 512 if (should_drop_frame(origskb, present_fcs_len,
513 rtap_vendor_space)) {
b2e7771e
JB		 514 dev_kfree_skb(origskb);
515 return NULL;
516 }
517
1f7bba79 518 return remove_monitor_info(local, origskb, rtap_vendor_space);
b2e7771e
JB		 519 }
520
751413ea 521 /* room for the radiotap header based on driver features */
1f7bba79
JB		 522 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
523 needed_headroom = rt_hdrlen - rtap_vendor_space;
751413ea 524
1f7bba79 525 if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
b2e7771e
JB		 526 /* only need to expand headroom if necessary */
527 skb = origskb;
528 origskb = NULL;
529
530 /*
531 * This shouldn't trigger often because most devices have an
532 * RX header they pull before we get here, and that should
533 * be big enough for our radiotap information. We should
534 * probably export the length to drivers so that we can have
535 * them allocate enough headroom to start with.
536 */
537 if (skb_headroom(skb) < needed_headroom &&
c49e5ea3 538 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
b2e7771e
JB		 539 dev_kfree_skb(skb);
540 return NULL;
541 }
542 } else {
543 /*
544 * Need to make a copy and possibly remove radiotap header
545 * and FCS from the original.
546 */
547 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
548
1f7bba79
JB		 549 origskb = remove_monitor_info(local, origskb,
550 rtap_vendor_space);
b2e7771e
JB		 551
552 if (!skb)
553 return origskb;
554 }
555
0869aea0 556 /* prepend radiotap information */
1f7bba79 557 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
b2e7771e 558
ce3edf6d 559 skb_reset_mac_header(skb);
b2e7771e
JB		 560 skb->ip_summed = CHECKSUM_UNNECESSARY;
561 skb->pkt_type = PACKET_OTHERHOST;
562 skb->protocol = htons(ETH_P_802_2);
563
564 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
05c914fe 565 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
b2e7771e
JB		 566 continue;
567
3d30d949
MW		 568 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
569 continue;
570
9607e6b6 571 if (!ieee80211_sdata_running(sdata))
47846c9b
JB		 572 continue;
573
b2e7771e
JB		 574 if (prev_dev) {
575 skb2 = skb_clone(skb, GFP_ATOMIC);
576 if (skb2) {
577 skb2->dev = prev_dev;
5548a8a1 578 netif_receive_skb(skb2);
b2e7771e
JB		 579 }
580 }
581
582 prev_dev = sdata->dev;
5a490510 583 ieee80211_rx_stats(sdata->dev, skb->len);
b2e7771e
JB		 584 }
585
586 if (prev_dev) {
587 skb->dev = prev_dev;
5548a8a1 588 netif_receive_skb(skb);
b2e7771e
JB		 589 } else
590 dev_kfree_skb(skb);
591
592 return origskb;
593}
594
5cf121c3 595static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 596{
238f74a2 597 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 598 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
9e26297a 599 int tid, seqno_idx, security_idx;
6e0d114d
JB		 600
601 /* does the frame have a qos control field? */
238f74a2
HH		 602 if (ieee80211_is_data_qos(hdr->frame_control)) {
603 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 604 /* frame has qos control */
238f74a2 605 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
04b7dcf9 606 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
554891e6 607 status->rx_flags |= IEEE80211_RX_AMSDU;
9e26297a
JB		 608
609 seqno_idx = tid;
610 security_idx = tid;
6e0d114d 611 } else {
1411f9b5
JB		 612 /*
613 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
614 *
615 * Sequence numbers for management frames, QoS data
616 * frames with a broadcast/multicast address in the
617 * Address 1 field, and all non-QoS data frames sent
618 * by QoS STAs are assigned using an additional single
619 * modulo-4096 counter, [...]
620 *
621 * We also use that counter for non-QoS STAs.
622 */
5a306f58 623 seqno_idx = IEEE80211_NUM_TIDS;
9e26297a
JB		 624 security_idx = 0;
625 if (ieee80211_is_mgmt(hdr->frame_control))
5a306f58 626 security_idx = IEEE80211_NUM_TIDS;
9e26297a 627 tid = 0;
6e0d114d 628 }
52865dfd 629
9e26297a
JB		 630 rx->seqno_idx = seqno_idx;
631 rx->security_idx = security_idx;
6e0d114d
JB		 632 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
633 * For now, set skb->priority to 0 for other cases. */
634 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 635}
6e0d114d 636
d1c3a37c
JB		 637/**
638 * DOC: Packet alignment
639 *
640 * Drivers always need to pass packets that are aligned to two-byte boundaries
641 * to the stack.
642 *
643 * Additionally, should, if possible, align the payload data in a way that
644 * guarantees that the contained IP header is aligned to a four-byte
645 * boundary. In the case of regular frames, this simply means aligning the
646 * payload to a four-byte boundary (because either the IP header is directly
647 * contained, or IV/RFC1042 headers that have a length divisible by four are
59d9cb07
KV		 648 * in front of it). If the payload data is not properly aligned and the
649 * architecture doesn't support efficient unaligned operations, mac80211
650 * will align the data.
d1c3a37c
JB		 651 *
652 * With A-MSDU frames, however, the payload data address must yield two modulo
653 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
654 * push the IP header further back to a multiple of four again. Thankfully, the
655 * specs were sane enough this time around to require padding each A-MSDU
656 * subframe to a length that is a multiple of four.
657 *
25985edc 658 * Padding like Atheros hardware adds which is between the 802.11 header and
d1c3a37c
JB		 659 * the payload is not supported, the driver is required to move the 802.11
660 * header to be directly in front of the payload in that case.
661 */
662static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
38f3714d 663{
59d9cb07 664#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
441275e1 665 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
d1c3a37c 666#endif
6e0d114d
JB		 667}
668
6368e4b1 669
571ecf67
JB		 670/* rx handlers */
671
3cfcf6ac
JM		 672static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
673{
674 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
675
d8ca16db 676 if (is_multicast_ether_addr(hdr->addr1))
3cfcf6ac
JM		 677 return 0;
678
d8ca16db 679 return ieee80211_is_robust_mgmt_frame(skb);
3cfcf6ac
JM		 680}
681
682
683static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
684{
685 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
686
d8ca16db 687 if (!is_multicast_ether_addr(hdr->addr1))
3cfcf6ac
JM		 688 return 0;
689
d8ca16db 690 return ieee80211_is_robust_mgmt_frame(skb);
3cfcf6ac
JM		 691}
692
693
694/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
695static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
696{
697 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
698 struct ieee80211_mmie *mmie;
56c52da2 699 struct ieee80211_mmie_16 *mmie16;
3cfcf6ac 700
1df332e8 701 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
3cfcf6ac
JM		 702 return -1;
703
d8ca16db 704 if (!ieee80211_is_robust_mgmt_frame(skb))
3cfcf6ac
JM		 705 return -1; /* not a robust management frame */
706
707 mmie = (struct ieee80211_mmie *)
708 (skb->data + skb->len - sizeof(*mmie));
56c52da2
JM		 709 if (mmie->element_id == WLAN_EID_MMIE &&
710 mmie->length == sizeof(*mmie) - 2)
711 return le16_to_cpu(mmie->key_id);
712
713 mmie16 = (struct ieee80211_mmie_16 *)
714 (skb->data + skb->len - sizeof(*mmie16));
715 if (skb->len >= 24 + sizeof(*mmie16) &&
716 mmie16->element_id == WLAN_EID_MMIE &&
717 mmie16->length == sizeof(*mmie16) - 2)
718 return le16_to_cpu(mmie16->key_id);
719
720 return -1;
3cfcf6ac
JM		 721}
722
2475b1cc
MS		 723static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
724 struct sk_buff *skb)
725{
726 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
727 __le16 fc;
728 int hdrlen;
729 u8 keyid;
730
731 fc = hdr->frame_control;
732 hdrlen = ieee80211_hdrlen(fc);
733
734 if (skb->len < hdrlen + cs->hdr_len)
735 return -EINVAL;
736
737 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
738 keyid &= cs->key_idx_mask;
739 keyid >>= cs->key_idx_shift;
740
741 return keyid;
742}
743
1df332e8 744static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 745{
a7767f95 746 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
47846c9b 747 char *dev_addr = rx->sdata->vif.addr;
d6d1a5a7 748
a7767f95 749 if (ieee80211_is_data(hdr->frame_control)) {
3c5772a5
JC		 750 if (is_multicast_ether_addr(hdr->addr1)) {
751 if (ieee80211_has_tods(hdr->frame_control) ||
1df332e8 752 !ieee80211_has_fromds(hdr->frame_control))
3c5772a5 753 return RX_DROP_MONITOR;
b203ca39 754 if (ether_addr_equal(hdr->addr3, dev_addr))
3c5772a5
JC		 755 return RX_DROP_MONITOR;
756 } else {
757 if (!ieee80211_has_a4(hdr->frame_control))
758 return RX_DROP_MONITOR;
b203ca39 759 if (ether_addr_equal(hdr->addr4, dev_addr))
3c5772a5
JC		 760 return RX_DROP_MONITOR;
761 }
33b64eb2
LCC		 762 }
763
764 /* If there is not an established peer link and this is not a peer link
765 * establisment frame, beacon or probe, drop the frame.
766 */
767
57cf8043 768 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
33b64eb2 769 struct ieee80211_mgmt *mgmt;
d6d1a5a7 770
a7767f95 771 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC		 772 return RX_DROP_MONITOR;
773
a7767f95 774 if (ieee80211_is_action(hdr->frame_control)) {
d3aaec8a 775 u8 category;
9b395bc3
JB		 776
777 /* make sure category field is present */
778 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
779 return RX_DROP_MONITOR;
780
33b64eb2 781 mgmt = (struct ieee80211_mgmt *)hdr;
d3aaec8a
JC		 782 category = mgmt->u.action.category;
783 if (category != WLAN_CATEGORY_MESH_ACTION &&
1df332e8 784 category != WLAN_CATEGORY_SELF_PROTECTED)
33b64eb2 785 return RX_DROP_MONITOR;
33b64eb2 786 return RX_CONTINUE;
33b64eb2
LCC		 787 }
788
a7767f95
HH		 789 if (ieee80211_is_probe_req(hdr->frame_control) ||
790 ieee80211_is_probe_resp(hdr->frame_control) ||
71839121
JC		 791 ieee80211_is_beacon(hdr->frame_control) ||
792 ieee80211_is_auth(hdr->frame_control))
a7767f95
HH		 793 return RX_CONTINUE;
794
795 return RX_DROP_MONITOR;
a7767f95
HH		 796 }
797
902acc78
JB		 798 return RX_CONTINUE;
799}
33b64eb2 800
d3b2fb53 801static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1edfb1af 802 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 803 int index,
804 struct sk_buff_head *frames)
1edfb1af 805{
83eb935e
MK		 806 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
807 struct sk_buff *skb;
4cfda47b 808 struct ieee80211_rx_status *status;
1edfb1af 809
dd318575
JB		 810 lockdep_assert_held(&tid_agg_rx->reorder_lock);
811
83eb935e 812 if (skb_queue_empty(skb_list))
1edfb1af
JB		 813 goto no_frame;
814
83eb935e
MK		 815 if (!ieee80211_rx_reorder_ready(skb_list)) {
816 __skb_queue_purge(skb_list);
817 goto no_frame;
818 }
819
820 /* release frames from the reorder ring buffer */
1edfb1af 821 tid_agg_rx->stored_mpdu_num--;
83eb935e
MK		 822 while ((skb = __skb_dequeue(skb_list))) {
823 status = IEEE80211_SKB_RXCB(skb);
824 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
825 __skb_queue_tail(frames, skb);
826 }
1edfb1af
JB		 827
828no_frame:
9a886586 829 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1edfb1af
JB		 830}
831
d3b2fb53 832static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1edfb1af 833 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 834 u16 head_seq_num,
835 struct sk_buff_head *frames)
1edfb1af
JB		 836{
837 int index;
838
dd318575
JB		 839 lockdep_assert_held(&tid_agg_rx->reorder_lock);
840
9a886586 841 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2e3049b7 842 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
f9e124fb
CL		 843 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
844 frames);
1edfb1af
JB		 845 }
846}
847
848/*
849 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
850 * the skb was added to the buffer longer than this time ago, the earlier
851 * frames that have not yet been received are assumed to be lost and the skb
852 * can be released for processing. This may also release other skb's from the
853 * reorder buffer if there are no additional gaps between the frames.
2bff8ebf
CL		 854 *
855 * Callers must hold tid_agg_rx->reorder_lock.
1edfb1af
JB		 856 */
857#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
858
d3b2fb53 859static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
f9e124fb
CL		 860 struct tid_ampdu_rx *tid_agg_rx,
861 struct sk_buff_head *frames)
aa0c8636 862{
83eb935e 863 int index, i, j;
aa0c8636 864
dd318575
JB		 865 lockdep_assert_held(&tid_agg_rx->reorder_lock);
866
aa0c8636 867 /* release the buffer until next missing frame */
2e3049b7 868 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
83eb935e 869 if (!ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index]) &&
07ae2dfc 870 tid_agg_rx->stored_mpdu_num) {
aa0c8636
CL		 871 /*
872 * No buffers ready to be released, but check whether any
873 * frames in the reorder buffer have timed out.
874 */
aa0c8636
CL		 875 int skipped = 1;
876 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
877 j = (j + 1) % tid_agg_rx->buf_size) {
83eb935e
MK		 878 if (!ieee80211_rx_reorder_ready(
879 &tid_agg_rx->reorder_buf[j])) {
aa0c8636
CL		 880 skipped++;
881 continue;
882 }
499fe9a4
DH		 883 if (skipped &&
884 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
aa0c8636 885 HT_RX_REORDER_BUF_TIMEOUT))
2bff8ebf 886 goto set_release_timer;
aa0c8636 887
83eb935e
MK		 888 /* don't leave incomplete A-MSDUs around */
889 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
890 i = (i + 1) % tid_agg_rx->buf_size)
891 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
892
bdcbd8e0
JB		 893 ht_dbg_ratelimited(sdata,
894 "release an RX reorder frame due to timeout on earlier frames\n");
f9e124fb
CL		 895 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
896 frames);
aa0c8636
CL		 897
898 /*
899 * Increment the head seq# also for the skipped slots.
900 */
901 tid_agg_rx->head_seq_num =
9a886586
JB		 902 (tid_agg_rx->head_seq_num +
903 skipped) & IEEE80211_SN_MASK;
aa0c8636
CL		 904 skipped = 0;
905 }
83eb935e
MK		 906 } else while (ieee80211_rx_reorder_ready(
907 &tid_agg_rx->reorder_buf[index])) {
f9e124fb
CL		 908 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
909 frames);
2e3049b7 910 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
aa0c8636 911 }
2bff8ebf
CL		 912
913 if (tid_agg_rx->stored_mpdu_num) {
2e3049b7 914 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
2bff8ebf
CL		 915
916 for (; j != (index - 1) % tid_agg_rx->buf_size;
917 j = (j + 1) % tid_agg_rx->buf_size) {
83eb935e
MK		 918 if (ieee80211_rx_reorder_ready(
919 &tid_agg_rx->reorder_buf[j]))
2bff8ebf
CL		 920 break;
921 }
922
923 set_release_timer:
924
788211d8
JB		 925 if (!tid_agg_rx->removed)
926 mod_timer(&tid_agg_rx->reorder_timer,
927 tid_agg_rx->reorder_time[j] + 1 +
928 HT_RX_REORDER_BUF_TIMEOUT);
2bff8ebf
CL		 929 } else {
930 del_timer(&tid_agg_rx->reorder_timer);
931 }
aa0c8636
CL		 932}
933
1edfb1af
JB		 934/*
935 * As this function belongs to the RX path it must be under
936 * rcu_read_lock protection. It returns false if the frame
937 * can be processed immediately, true if it was consumed.
938 */
d3b2fb53 939static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1edfb1af 940 struct tid_ampdu_rx *tid_agg_rx,
f9e124fb
CL		 941 struct sk_buff *skb,
942 struct sk_buff_head *frames)
1edfb1af
JB		 943{
944 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
83eb935e 945 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1edfb1af
JB		 946 u16 sc = le16_to_cpu(hdr->seq_ctrl);
947 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
948 u16 head_seq_num, buf_size;
949 int index;
2bff8ebf 950 bool ret = true;
1edfb1af 951
dd318575
JB		 952 spin_lock(&tid_agg_rx->reorder_lock);
953
4549cf2b
MK		 954 /*
955 * Offloaded BA sessions have no known starting sequence number so pick
956 * one from first Rxed frame for this tid after BA was started.
957 */
958 if (unlikely(tid_agg_rx->auto_seq)) {
959 tid_agg_rx->auto_seq = false;
960 tid_agg_rx->ssn = mpdu_seq_num;
961 tid_agg_rx->head_seq_num = mpdu_seq_num;
962 }
963
1edfb1af
JB		 964 buf_size = tid_agg_rx->buf_size;
965 head_seq_num = tid_agg_rx->head_seq_num;
966
967 /* frame with out of date sequence number */
9a886586 968 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1edfb1af 969 dev_kfree_skb(skb);
2bff8ebf 970 goto out;
1edfb1af
JB		 971 }
972
973 /*
974 * If frame the sequence number exceeds our buffering window
975 * size release some previous frames to make room for this one.
976 */
9a886586
JB		 977 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
978 head_seq_num = ieee80211_sn_inc(
979 ieee80211_sn_sub(mpdu_seq_num, buf_size));
1edfb1af 980 /* release stored frames up to new head to stack */
d3b2fb53 981 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
f9e124fb 982 head_seq_num, frames);
1edfb1af
JB		 983 }
984
985 /* Now the new frame is always in the range of the reordering buffer */
986
2e3049b7 987 index = mpdu_seq_num % tid_agg_rx->buf_size;
1edfb1af
JB		 988
989 /* check if we already stored this frame */
83eb935e 990 if (ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index])) {
1edfb1af 991 dev_kfree_skb(skb);
2bff8ebf 992 goto out;
1edfb1af
JB		 993 }
994
995 /*
996 * If the current MPDU is in the right order and nothing else
997 * is stored we can process it directly, no need to buffer it.
c835b214
JB		 998 * If it is first but there's something stored, we may be able
999 * to release frames after this one.
1edfb1af
JB		 1000 */
1001 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1002 tid_agg_rx->stored_mpdu_num == 0) {
83eb935e
MK		 1003 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1004 tid_agg_rx->head_seq_num =
1005 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
2bff8ebf
CL		 1006 ret = false;
1007 goto out;
1edfb1af
JB		 1008 }
1009
1010 /* put the frame in the reordering buffer */
83eb935e
MK		 1011 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1012 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1013 tid_agg_rx->reorder_time[index] = jiffies;
1014 tid_agg_rx->stored_mpdu_num++;
1015 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1016 }
1edfb1af 1017
2bff8ebf
CL		 1018 out:
1019 spin_unlock(&tid_agg_rx->reorder_lock);
1020 return ret;
1edfb1af
JB		 1021}
1022
1023/*
1024 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1025 * true if the MPDU was buffered, false if it should be processed.
1026 */
f9e124fb
CL		 1027static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1028 struct sk_buff_head *frames)
1edfb1af 1029{
2569a826
JB		 1030 struct sk_buff *skb = rx->skb;
1031 struct ieee80211_local *local = rx->local;
1edfb1af 1032 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2569a826 1033 struct sta_info *sta = rx->sta;
1edfb1af
JB		 1034 struct tid_ampdu_rx *tid_agg_rx;
1035 u16 sc;
6cc00d54 1036 u8 tid, ack_policy;
1edfb1af 1037
051a41fa
JB		 1038 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1039 is_multicast_ether_addr(hdr->addr1))
2569a826 1040 goto dont_reorder;
1edfb1af
JB		 1041
1042 /*
1043 * filter the QoS data rx stream according to
1044 * STA/TID and check if this STA/TID is on aggregation
1045 */
1046
1edfb1af 1047 if (!sta)
2569a826 1048 goto dont_reorder;
1edfb1af 1049
6cc00d54
TP		 1050 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1051 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1edfb1af
JB		 1052 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1053
a87f736d
JB		 1054 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1055 if (!tid_agg_rx)
1056 goto dont_reorder;
1edfb1af
JB		 1057
1058 /* qos null data frames are excluded */
1059 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
a87f736d 1060 goto dont_reorder;
1edfb1af 1061
6cc00d54
TP		 1062 /* not part of a BA session */
1063 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1064 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1065 goto dont_reorder;
1066
1edfb1af
JB		 1067 /* new, potentially un-ordered, ampdu frame - process it */
1068
1069 /* reset session timer */
1070 if (tid_agg_rx->timeout)
12d3952f 1071 tid_agg_rx->last_rx = jiffies;
1edfb1af
JB		 1072
1073 /* if this mpdu is fragmented - terminate rx aggregation session */
1074 sc = le16_to_cpu(hdr->seq_ctrl);
1075 if (sc & IEEE80211_SCTL_FRAG) {
c1475ca9 1076 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
344eec67
JB		 1077 skb_queue_tail(&rx->sdata->skb_queue, skb);
1078 ieee80211_queue_work(&local->hw, &rx->sdata->work);
2569a826 1079 return;
1edfb1af
JB		 1080 }
1081
a87f736d
JB		 1082 /*
1083 * No locking needed -- we will only ever process one
1084 * RX packet at a time, and thus own tid_agg_rx. All
1085 * other code manipulating it needs to (and does) make
1086 * sure that we cannot get to it any more before doing
1087 * anything with it.
1088 */
f9e124fb
CL		 1089 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1090 frames))
2569a826
JB		 1091 return;
1092
1093 dont_reorder:
f9e124fb 1094 __skb_queue_tail(frames, skb);
1edfb1af 1095}
33b64eb2 1096
49461622 1097static ieee80211_rx_result debug_noinline
0395442a 1098ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
571ecf67 1099{
a7767f95 1100 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 1101 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 1102
f9cfa5f3
SS		 1103 if (status->flag & RX_FLAG_DUP_VALIDATED)
1104 return RX_CONTINUE;
1105
6b0f3274
JB		 1106 /*
1107 * Drop duplicate 802.11 retransmissions
1108 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1109 */
0395442a
JB		 1110
1111 if (rx->skb->len < 24)
1112 return RX_CONTINUE;
1113
1114 if (ieee80211_is_ctl(hdr->frame_control) ||
1115 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
1116 is_multicast_ether_addr(hdr->addr1))
1117 return RX_CONTINUE;
1118
a732fa70
JB		 1119 if (!rx->sta)
1120 return RX_CONTINUE;
1121
1122 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1123 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1124 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
e5a9f8d0 1125 rx->sta->rx_stats.num_duplicates++;
a732fa70
JB		 1126 return RX_DROP_UNUSABLE;
1127 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1128 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
571ecf67
JB		 1129 }
1130
0395442a
JB		 1131 return RX_CONTINUE;
1132}
1133
1134static ieee80211_rx_result debug_noinline
1135ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1136{
1137 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1138
571ecf67
JB		 1139 /* Drop disallowed frame classes based on STA auth/assoc state;
1140 * IEEE 802.11, Chap 5.5.
1141 *
ccd7b362
JB		 1142 * mac80211 filters only based on association state, i.e. it drops
1143 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB		 1144 * deauth/disassoc frames when needed. In addition, hostapd is
1145 * responsible for filtering on both auth and assoc states.
1146 */
33b64eb2 1147
902acc78 1148 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 1149 return ieee80211_rx_mesh_check(rx);
33b64eb2 1150
a7767f95
HH		 1151 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1152 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 1153 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1be7fe8d 1154 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
239281f8 1155 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
c2c98fde 1156 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
7852e361
JB		 1157 /*
1158 * accept port control frames from the AP even when it's not
1159 * yet marked ASSOC to prevent a race where we don't set the
1160 * assoc bit quickly enough before it sends the first frame
1161 */
1162 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
2a33bee2 1163 ieee80211_is_data_present(hdr->frame_control)) {
6dbda2d0
JB		 1164 unsigned int hdrlen;
1165 __be16 ethertype;
1166
1167 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1168
1169 if (rx->skb->len < hdrlen + 8)
1170 return RX_DROP_MONITOR;
1171
1172 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1173 if (ethertype == rx->sdata->control_port_protocol)
2a33bee2
GE		 1174 return RX_CONTINUE;
1175 }
21fc7560
JB		 1176
1177 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1178 cfg80211_rx_spurious_frame(rx->sdata->dev,
1179 hdr->addr2,
1180 GFP_ATOMIC))
1181 return RX_DROP_UNUSABLE;
1182
e4c26add 1183 return RX_DROP_MONITOR;
2a33bee2 1184 }
571ecf67 1185
9ae54c84 1186 return RX_CONTINUE;
570bd537
JB		 1187}
1188
1189
572e0012
KV		 1190static ieee80211_rx_result debug_noinline
1191ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1192{
1193 struct ieee80211_local *local;
1194 struct ieee80211_hdr *hdr;
1195 struct sk_buff *skb;
1196
1197 local = rx->local;
1198 skb = rx->skb;
1199 hdr = (struct ieee80211_hdr *) skb->data;
1200
1201 if (!local->pspolling)
1202 return RX_CONTINUE;
1203
1204 if (!ieee80211_has_fromds(hdr->frame_control))
1205 /* this is not from AP */
1206 return RX_CONTINUE;
1207
1208 if (!ieee80211_is_data(hdr->frame_control))
1209 return RX_CONTINUE;
1210
1211 if (!ieee80211_has_moredata(hdr->frame_control)) {
1212 /* AP has no more frames buffered for us */
1213 local->pspolling = false;
1214 return RX_CONTINUE;
1215 }
1216
1217 /* more data bit is set, let's request a new frame from the AP */
1218 ieee80211_send_pspoll(local, rx->sdata);
1219
1220 return RX_CONTINUE;
1221}
1222
d012a605 1223static void sta_ps_start(struct sta_info *sta)
571ecf67 1224{
133b8226 1225 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 1226 struct ieee80211_local *local = sdata->local;
d012a605 1227 struct ps_data *ps;
ba8c3d6f 1228 int tid;
0795af57 1229
d012a605
MP		 1230 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1231 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1232 ps = &sdata->bss->ps;
1233 else
1234 return;
1235
1236 atomic_inc(&ps->num_sta_ps);
c2c98fde 1237 set_sta_flag(sta, WLAN_STA_PS_STA);
30686bf7 1238 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
d057e5a3 1239 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
bdcbd8e0
JB		 1240 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1241 sta->sta.addr, sta->sta.aid);
ba8c3d6f 1242
17c18bf8
JB		 1243 ieee80211_clear_fast_xmit(sta);
1244
ba8c3d6f
FF		 1245 if (!sta->sta.txq[0])
1246 return;
1247
1248 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
1249 struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
1250
1251 if (!skb_queue_len(&txqi->queue))
1252 set_bit(tid, &sta->txq_buffered_tids);
1253 else
1254 clear_bit(tid, &sta->txq_buffered_tids);
1255 }
571ecf67
JB		 1256}
1257
d012a605 1258static void sta_ps_end(struct sta_info *sta)
571ecf67 1259{
bdcbd8e0
JB		 1260 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1261 sta->sta.addr, sta->sta.aid);
004c872e 1262
c2c98fde 1263 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
e3685e03
JB		 1264 /*
1265 * Clear the flag only if the other one is still set
1266 * so that the TX path won't start TX'ing new frames
1267 * directly ... In the case that the driver flag isn't
1268 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1269 */
1270 clear_sta_flag(sta, WLAN_STA_PS_STA);
bdcbd8e0
JB		 1271 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1272 sta->sta.addr, sta->sta.aid);
af818581
JB		 1273 return;
1274 }
1275
5ac2e350
JB		 1276 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1277 clear_sta_flag(sta, WLAN_STA_PS_STA);
af818581 1278 ieee80211_sta_ps_deliver_wakeup(sta);
571ecf67
JB		 1279}
1280
cf47161a 1281int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
d057e5a3 1282{
cf47161a 1283 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
d057e5a3
AN		 1284 bool in_ps;
1285
cf47161a 1286 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
d057e5a3
AN		 1287
1288 /* Don't let the same PS state be set twice */
cf47161a 1289 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
d057e5a3
AN		 1290 if ((start && in_ps) || (!start && !in_ps))
1291 return -EINVAL;
1292
1293 if (start)
cf47161a 1294 sta_ps_start(sta);
d057e5a3 1295 else
cf47161a 1296 sta_ps_end(sta);
d057e5a3
AN		 1297
1298 return 0;
1299}
1300EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1301
47086fc5
JB		 1302static ieee80211_rx_result debug_noinline
1303ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1304{
1305 struct ieee80211_sub_if_data *sdata = rx->sdata;
1306 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1307 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1308 int tid, ac;
1309
5c90067c 1310 if (!rx->sta)
47086fc5
JB		 1311 return RX_CONTINUE;
1312
1313 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1314 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1315 return RX_CONTINUE;
1316
1317 /*
1318 * The device handles station powersave, so don't do anything about
1319 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1320 * it to mac80211 since they're handled.)
1321 */
30686bf7 1322 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
47086fc5
JB		 1323 return RX_CONTINUE;
1324
1325 /*
1326 * Don't do anything if the station isn't already asleep. In
1327 * the uAPSD case, the station will probably be marked asleep,
1328 * in the PS-Poll case the station must be confused ...
1329 */
c2c98fde 1330 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
47086fc5
JB		 1331 return RX_CONTINUE;
1332
1333 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
c2c98fde
JB		 1334 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
1335 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
deeaee19
JB		 1336 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1337 else
c2c98fde 1338 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
deeaee19 1339 }
47086fc5
JB		 1340
1341 /* Free PS Poll skb here instead of returning RX_DROP that would
1342 * count as an dropped frame. */
1343 dev_kfree_skb(rx->skb);
1344
1345 return RX_QUEUED;
1346 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1347 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1348 ieee80211_has_pm(hdr->frame_control) &&
1349 (ieee80211_is_data_qos(hdr->frame_control) ||
1350 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1351 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1352 ac = ieee802_1d_to_ac[tid & 7];
1353
1354 /*
1355 * If this AC is not trigger-enabled do nothing.
1356 *
1357 * NB: This could/should check a separate bitmap of trigger-
1358 * enabled queues, but for now we only implement uAPSD w/o
1359 * TSPEC changes to the ACs, so they're always the same.
1360 */
1361 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
1362 return RX_CONTINUE;
1363
1364 /* if we are in a service period, do nothing */
c2c98fde 1365 if (test_sta_flag(rx->sta, WLAN_STA_SP))
47086fc5
JB		 1366 return RX_CONTINUE;
1367
c2c98fde 1368 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
47086fc5
JB		 1369 ieee80211_sta_ps_deliver_uapsd(rx->sta);
1370 else
c2c98fde 1371 set_sta_flag(rx->sta, WLAN_STA_UAPSD);
47086fc5
JB		 1372 }
1373
1374 return RX_CONTINUE;
1375}
1376
49461622 1377static ieee80211_rx_result debug_noinline
5cf121c3 1378ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB		 1379{
1380 struct sta_info *sta = rx->sta;
eb9fb5b8
JB		 1381 struct sk_buff *skb = rx->skb;
1382 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1383 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
ef0621e8 1384 int i;
571ecf67
JB		 1385
1386 if (!sta)
9ae54c84 1387 return RX_CONTINUE;
571ecf67 1388
b291ba11
JB		 1389 /*
1390 * Update last_rx only for IBSS packets which are for the current
e584da5e
AQ		 1391 * BSSID and for station already AUTHORIZED to avoid keeping the
1392 * current IBSS network alive in cases where other STAs start
1393 * using different BSSID. This will also give the station another
1394 * chance to restart the authentication/authorization in case
1395 * something went wrong the first time.
b291ba11 1396 */
05c914fe 1397 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 1398 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 1399 NL80211_IFTYPE_ADHOC);
e584da5e
AQ		 1400 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1401 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
e5a9f8d0 1402 sta->rx_stats.last_rx = jiffies;
f4ebddf9
HR		 1403 if (ieee80211_is_data(hdr->frame_control) &&
1404 !is_multicast_ether_addr(hdr->addr1)) {
e5a9f8d0
JB		 1405 sta->rx_stats.last_rate_idx =
1406 status->rate_idx;
1407 sta->rx_stats.last_rate_flag =
1408 status->flag;
1409 sta->rx_stats.last_rate_vht_flag =
1410 status->vht_flag;
1411 sta->rx_stats.last_rate_vht_nss =
1412 status->vht_nss;
3af6334c
FF		 1413 }
1414 }
239281f8 1415 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
e5a9f8d0 1416 sta->rx_stats.last_rx = jiffies;
b291ba11
JB		 1417 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1418 /*
33b64eb2
LCC		 1419 * Mesh beacons will update last_rx when if they are found to
1420 * match the current local configuration when processed.
571ecf67 1421 */
e5a9f8d0 1422 sta->rx_stats.last_rx = jiffies;
3af6334c 1423 if (ieee80211_is_data(hdr->frame_control)) {
e5a9f8d0
JB		 1424 sta->rx_stats.last_rate_idx = status->rate_idx;
1425 sta->rx_stats.last_rate_flag = status->flag;
1426 sta->rx_stats.last_rate_vht_flag = status->vht_flag;
1427 sta->rx_stats.last_rate_vht_nss = status->vht_nss;
3af6334c 1428 }
571ecf67
JB		 1429 }
1430
3cf335d5
KV		 1431 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1432 ieee80211_sta_rx_notify(rx->sdata, hdr);
1433
e5a9f8d0
JB		 1434 sta->rx_stats.fragments++;
1435 sta->rx_stats.bytes += rx->skb->len;
fe8431f8 1436 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
e5a9f8d0
JB		 1437 sta->rx_stats.last_signal = status->signal;
1438 ewma_signal_add(&sta->rx_stats.avg_signal, -status->signal);
fe8431f8 1439 }
571ecf67 1440
ef0621e8 1441 if (status->chains) {
e5a9f8d0 1442 sta->rx_stats.chains = status->chains;
ef0621e8
FF		 1443 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1444 int signal = status->chain_signal[i];
1445
1446 if (!(status->chains & BIT(i)))
1447 continue;
1448
e5a9f8d0
JB		 1449 sta->rx_stats.chain_signal_last[i] = signal;
1450 ewma_signal_add(&sta->rx_stats.chain_signal_avg[i],
1451 -signal);
ef0621e8
FF		 1452 }
1453 }
1454
72eaa43a
JB		 1455 /*
1456 * Change STA power saving mode only at the end of a frame
1457 * exchange sequence.
1458 */
30686bf7 1459 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
d057e5a3 1460 !ieee80211_has_morefrags(hdr->frame_control) &&
4cfda47b 1461 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
05c914fe 1462 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
b4ba544c
JB		 1463 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1464 /* PM bit is only checked in frames where it isn't reserved,
1465 * in AP mode it's reserved in non-bufferable management frames
1466 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
1467 */
1468 (!ieee80211_is_mgmt(hdr->frame_control) ||
1469 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
c2c98fde 1470 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
b4ba544c 1471 if (!ieee80211_has_pm(hdr->frame_control))
d012a605 1472 sta_ps_end(sta);
72eaa43a
JB		 1473 } else {
1474 if (ieee80211_has_pm(hdr->frame_control))
d012a605 1475 sta_ps_start(sta);
72eaa43a 1476 }
571ecf67
JB		 1477 }
1478
3f52b7e3
MP		 1479 /* mesh power save support */
1480 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1481 ieee80211_mps_rx_h_sta_process(sta, hdr);
1482
22403def
JB		 1483 /*
1484 * Drop (qos-)data::nullfunc frames silently, since they
1485 * are used only to control station power saving mode.
1486 */
1487 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1488 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
571ecf67 1489 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
d524215f
FF		 1490
1491 /*
1492 * If we receive a 4-addr nullfunc frame from a STA
e7f4a940
JB		 1493 * that was not moved to a 4-addr STA vlan yet send
1494 * the event to userspace and for older hostapd drop
1495 * the frame to the monitor interface.
d524215f
FF		 1496 */
1497 if (ieee80211_has_a4(hdr->frame_control) &&
1498 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1499 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
e7f4a940
JB		 1500 !rx->sdata->u.vlan.sta))) {
1501 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1502 cfg80211_rx_unexpected_4addr_frame(
1503 rx->sdata->dev, sta->sta.addr,
1504 GFP_ATOMIC);
d524215f 1505 return RX_DROP_MONITOR;
e7f4a940 1506 }
22403def
JB		 1507 /*
1508 * Update counter and free packet here to avoid
1509 * counting this as a dropped packed.
1510 */
e5a9f8d0 1511 sta->rx_stats.packets++;
571ecf67 1512 dev_kfree_skb(rx->skb);
9ae54c84 1513 return RX_QUEUED;
571ecf67
JB		 1514 }
1515
9ae54c84 1516 return RX_CONTINUE;
571ecf67
JB		 1517} /* ieee80211_rx_h_sta_process */
1518
86c228a7
JA		 1519static ieee80211_rx_result debug_noinline
1520ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1521{
1522 struct sk_buff *skb = rx->skb;
1523 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1524 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1525 int keyidx;
1526 int hdrlen;
1527 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1528 struct ieee80211_key *sta_ptk = NULL;
1529 int mmie_keyidx = -1;
1530 __le16 fc;
2475b1cc 1531 const struct ieee80211_cipher_scheme *cs = NULL;
86c228a7
JA		 1532
1533 /*
1534 * Key selection 101
1535 *
1536 * There are four types of keys:
1537 * - GTK (group keys)
1538 * - IGTK (group keys for management frames)
1539 * - PTK (pairwise keys)
1540 * - STK (station-to-station pairwise keys)
1541 *
1542 * When selecting a key, we have to distinguish between multicast
1543 * (including broadcast) and unicast frames, the latter can only
1544 * use PTKs and STKs while the former always use GTKs and IGTKs.
1545 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1546 * unicast frames can also use key indices like GTKs. Hence, if we
1547 * don't have a PTK/STK we check the key index for a WEP key.
1548 *
1549 * Note that in a regular BSS, multicast frames are sent by the
1550 * AP only, associated stations unicast the frame to the AP first
1551 * which then multicasts it on their behalf.
1552 *
1553 * There is also a slight problem in IBSS mode: GTKs are negotiated
1554 * with each station, that is something we don't currently handle.
1555 * The spec seems to expect that one negotiates the same key with
1556 * every station but there's no such requirement; VLANs could be
1557 * possible.
1558 */
1559
86c228a7
JA		 1560 /* start without a key */
1561 rx->key = NULL;
2475b1cc 1562 fc = hdr->frame_control;
86c228a7 1563
2475b1cc
MS		 1564 if (rx->sta) {
1565 int keyid = rx->sta->ptk_idx;
86c228a7 1566
2475b1cc
MS		 1567 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1568 cs = rx->sta->cipher_scheme;
1569 keyid = iwl80211_get_cs_keyid(cs, rx->skb);
1570 if (unlikely(keyid < 0))
1571 return RX_DROP_UNUSABLE;
1572 }
1573 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1574 }
86c228a7
JA		 1575
1576 if (!ieee80211_has_protected(fc))
1577 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1578
1579 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1580 rx->key = sta_ptk;
1581 if ((status->flag & RX_FLAG_DECRYPTED) &&
1582 (status->flag & RX_FLAG_IV_STRIPPED))
1583 return RX_CONTINUE;
1584 /* Skip decryption if the frame is not protected. */
1585 if (!ieee80211_has_protected(fc))
1586 return RX_CONTINUE;
1587 } else if (mmie_keyidx >= 0) {
1588 /* Broadcast/multicast robust management frame / BIP */
1589 if ((status->flag & RX_FLAG_DECRYPTED) &&
1590 (status->flag & RX_FLAG_IV_STRIPPED))
1591 return RX_CONTINUE;
1592
1593 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1594 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1595 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
1596 if (rx->sta)
1597 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1598 if (!rx->key)
1599 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1600 } else if (!ieee80211_has_protected(fc)) {
1601 /*
1602 * The frame was not protected, so skip decryption. However, we
1603 * need to set rx->key if there is a key that could have been
1604 * used so that the frame may be dropped if encryption would
1605 * have been expected.
1606 */
1607 struct ieee80211_key *key = NULL;
1608 struct ieee80211_sub_if_data *sdata = rx->sdata;
1609 int i;
1610
1611 if (ieee80211_is_mgmt(fc) &&
1612 is_multicast_ether_addr(hdr->addr1) &&
1613 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1614 rx->key = key;
1615 else {
1616 if (rx->sta) {
1617 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1618 key = rcu_dereference(rx->sta->gtk[i]);
1619 if (key)
1620 break;
1621 }
1622 }
1623 if (!key) {
1624 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1625 key = rcu_dereference(sdata->keys[i]);
1626 if (key)
1627 break;
1628 }
1629 }
1630 if (key)
1631 rx->key = key;
1632 }
1633 return RX_CONTINUE;
1634 } else {
1635 u8 keyid;
2475b1cc 1636
86c228a7
JA		 1637 /*
1638 * The device doesn't give us the IV so we won't be
1639 * able to look up the key. That's ok though, we
1640 * don't need to decrypt the frame, we just won't
1641 * be able to keep statistics accurate.
1642 * Except for key threshold notifications, should
1643 * we somehow allow the driver to tell us which key
1644 * the hardware used if this flag is set?
1645 */
1646 if ((status->flag & RX_FLAG_DECRYPTED) &&
1647 (status->flag & RX_FLAG_IV_STRIPPED))
1648 return RX_CONTINUE;
1649
1650 hdrlen = ieee80211_hdrlen(fc);
1651
2475b1cc
MS		 1652 if (cs) {
1653 keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
86c228a7 1654
2475b1cc
MS		 1655 if (unlikely(keyidx < 0))
1656 return RX_DROP_UNUSABLE;
1657 } else {
1658 if (rx->skb->len < 8 + hdrlen)
1659 return RX_DROP_UNUSABLE; /* TODO: count this? */
1660 /*
1661 * no need to call ieee80211_wep_get_keyidx,
1662 * it verifies a bunch of things we've done already
1663 */
1664 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1665 keyidx = keyid >> 6;
1666 }
86c228a7
JA		 1667
1668 /* check per-station GTK first, if multicast packet */
1669 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1670 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1671
1672 /* if not found, try default key */
1673 if (!rx->key) {
1674 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1675
1676 /*
1677 * RSNA-protected unicast frames should always be
1678 * sent with pairwise or station-to-station keys,
1679 * but for WEP we allow using a key index as well.
1680 */
1681 if (rx->key &&
1682 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1683 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1684 !is_multicast_ether_addr(hdr->addr1))
1685 rx->key = NULL;
1686 }
1687 }
1688
1689 if (rx->key) {
1690 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1691 return RX_DROP_MONITOR;
1692
86c228a7
JA		 1693 /* TODO: add threshold stuff again */
1694 } else {
1695 return RX_DROP_MONITOR;
1696 }
1697
1698 switch (rx->key->conf.cipher) {
1699 case WLAN_CIPHER_SUITE_WEP40:
1700 case WLAN_CIPHER_SUITE_WEP104:
1701 result = ieee80211_crypto_wep_decrypt(rx);
1702 break;
1703 case WLAN_CIPHER_SUITE_TKIP:
1704 result = ieee80211_crypto_tkip_decrypt(rx);
1705 break;
1706 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db
JM		 1707 result = ieee80211_crypto_ccmp_decrypt(
1708 rx, IEEE80211_CCMP_MIC_LEN);
1709 break;
1710 case WLAN_CIPHER_SUITE_CCMP_256:
1711 result = ieee80211_crypto_ccmp_decrypt(
1712 rx, IEEE80211_CCMP_256_MIC_LEN);
86c228a7
JA		 1713 break;
1714 case WLAN_CIPHER_SUITE_AES_CMAC:
1715 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1716 break;
56c52da2
JM		 1717 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1718 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
1719 break;
8ade538b
JM		 1720 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1721 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1722 result = ieee80211_crypto_aes_gmac_decrypt(rx);
1723 break;
00b9cfa3
JM		 1724 case WLAN_CIPHER_SUITE_GCMP:
1725 case WLAN_CIPHER_SUITE_GCMP_256:
1726 result = ieee80211_crypto_gcmp_decrypt(rx);
1727 break;
86c228a7 1728 default:
2475b1cc 1729 result = ieee80211_crypto_hw_decrypt(rx);
86c228a7
JA		 1730 }
1731
1732 /* the hdr variable is invalid after the decrypt handlers */
1733
1734 /* either the frame has been decrypted or will be dropped */
1735 status->flag |= RX_FLAG_DECRYPTED;
1736
1737 return result;
1738}
1739
571ecf67
JB		 1740static inline struct ieee80211_fragment_entry *
1741ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1742 unsigned int frag, unsigned int seq, int rx_queue,
1743 struct sk_buff **skb)
1744{
1745 struct ieee80211_fragment_entry *entry;
571ecf67 1746
571ecf67
JB		 1747 entry = &sdata->fragments[sdata->fragment_next++];
1748 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1749 sdata->fragment_next = 0;
1750
bdcbd8e0 1751 if (!skb_queue_empty(&entry->skb_list))
571ecf67 1752 __skb_queue_purge(&entry->skb_list);
571ecf67
JB		 1753
1754 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1755 *skb = NULL;
1756 entry->first_frag_time = jiffies;
1757 entry->seq = seq;
1758 entry->rx_queue = rx_queue;
1759 entry->last_frag = frag;
1760 entry->ccmp = 0;
1761 entry->extra_len = 0;
1762
1763 return entry;
1764}
1765
1766static inline struct ieee80211_fragment_entry *
1767ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
b73d70ad 1768 unsigned int frag, unsigned int seq,
571ecf67
JB		 1769 int rx_queue, struct ieee80211_hdr *hdr)
1770{
1771 struct ieee80211_fragment_entry *entry;
1772 int i, idx;
1773
1774 idx = sdata->fragment_next;
1775 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1776 struct ieee80211_hdr *f_hdr;
571ecf67
JB		 1777
1778 idx--;
1779 if (idx < 0)
1780 idx = IEEE80211_FRAGMENT_MAX - 1;
1781
1782 entry = &sdata->fragments[idx];
1783 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1784 entry->rx_queue != rx_queue ||
1785 entry->last_frag + 1 != frag)
1786 continue;
1787
b73d70ad 1788 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
571ecf67 1789
b73d70ad
HH		 1790 /*
1791 * Check ftype and addresses are equal, else check next fragment
1792 */
1793 if (((hdr->frame_control ^ f_hdr->frame_control) &
1794 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
b203ca39
JP		 1795 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1796 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
571ecf67
JB		 1797 continue;
1798
ab46623e 1799 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB		 1800 __skb_queue_purge(&entry->skb_list);
1801 continue;
1802 }
1803 return entry;
1804 }
1805
1806 return NULL;
1807}
1808
49461622 1809static ieee80211_rx_result debug_noinline
5cf121c3 1810ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67
JB		 1811{
1812 struct ieee80211_hdr *hdr;
1813 u16 sc;
358c8d9d 1814 __le16 fc;
571ecf67
JB		 1815 unsigned int frag, seq;
1816 struct ieee80211_fragment_entry *entry;
1817 struct sk_buff *skb;
554891e6 1818 struct ieee80211_rx_status *status;
571ecf67 1819
b73d70ad 1820 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 1821 fc = hdr->frame_control;
f7fbf70e
JC		 1822
1823 if (ieee80211_is_ctl(fc))
1824 return RX_CONTINUE;
1825
571ecf67
JB		 1826 sc = le16_to_cpu(hdr->seq_ctrl);
1827 frag = sc & IEEE80211_SCTL_FRAG;
1828
b8fff407 1829 if (is_multicast_ether_addr(hdr->addr1)) {
c206ca67 1830 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
d025933e 1831 goto out_no_led;
571ecf67 1832 }
b8fff407 1833
d025933e
AM		 1834 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1835 goto out;
1836
571ecf67
JB		 1837 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1838
e3cf8b3f
ZY		 1839 if (skb_linearize(rx->skb))
1840 return RX_DROP_UNUSABLE;
1841
058897a4
AK		 1842 /*
1843 * skb_linearize() might change the skb->data and
1844 * previously cached variables (in this case, hdr) need to
1845 * be refreshed with the new data.
1846 */
1847 hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB		 1848 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1849
1850 if (frag == 0) {
1851 /* This is the first fragment of a new frame. */
1852 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
9e26297a 1853 rx->seqno_idx, &(rx->skb));
2b2ba0db
JM		 1854 if (rx->key &&
1855 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
1856 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256) &&
358c8d9d 1857 ieee80211_has_protected(fc)) {
9e26297a 1858 int queue = rx->security_idx;
571ecf67
JB		 1859 /* Store CCMP PN so that we can verify that the next
1860 * fragment has a sequential PN value. */
1861 entry->ccmp = 1;
1862 memcpy(entry->last_pn,
9190252c 1863 rx->key->u.ccmp.rx_pn[queue],
4325f6ca 1864 IEEE80211_CCMP_PN_LEN);
571ecf67 1865 }
9ae54c84 1866 return RX_QUEUED;
571ecf67
JB		 1867 }
1868
1869 /* This is a fragment for a frame that should already be pending in
1870 * fragment cache. Add this fragment to the end of the pending entry.
1871 */
9e26297a
JB		 1872 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
1873 rx->seqno_idx, hdr);
571ecf67
JB		 1874 if (!entry) {
1875 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 1876 return RX_DROP_MONITOR;
571ecf67
JB		 1877 }
1878
1879 /* Verify that MPDUs within one MSDU have sequential PN values.
1880 * (IEEE 802.11i, 8.3.3.4.5) */
1881 if (entry->ccmp) {
1882 int i;
4325f6ca 1883 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
9190252c 1884 int queue;
2b2ba0db
JM		 1885 if (!rx->key ||
1886 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
1887 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256))
e4c26add 1888 return RX_DROP_UNUSABLE;
4325f6ca
JB		 1889 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
1890 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
571ecf67
JB		 1891 pn[i]++;
1892 if (pn[i])
1893 break;
1894 }
9e26297a 1895 queue = rx->security_idx;
9190252c 1896 rpn = rx->key->u.ccmp.rx_pn[queue];
4325f6ca 1897 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
e4c26add 1898 return RX_DROP_UNUSABLE;
4325f6ca 1899 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
571ecf67
JB		 1900 }
1901
358c8d9d 1902 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB		 1903 __skb_queue_tail(&entry->skb_list, rx->skb);
1904 entry->last_frag = frag;
1905 entry->extra_len += rx->skb->len;
358c8d9d 1906 if (ieee80211_has_morefrags(fc)) {
571ecf67 1907 rx->skb = NULL;
9ae54c84 1908 return RX_QUEUED;
571ecf67
JB		 1909 }
1910
1911 rx->skb = __skb_dequeue(&entry->skb_list);
1912 if (skb_tailroom(rx->skb) < entry->extra_len) {
f1160434 1913 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
571ecf67
JB		 1914 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1915 GFP_ATOMIC))) {
1916 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1917 __skb_queue_purge(&entry->skb_list);
e4c26add 1918 return RX_DROP_UNUSABLE;
571ecf67
JB		 1919 }
1920 }
1921 while ((skb = __skb_dequeue(&entry->skb_list))) {
1922 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1923 dev_kfree_skb(skb);
1924 }
1925
1926 /* Complete frame has been reassembled - process it now */
554891e6 1927 status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67
JB		 1928
1929 out:
d025933e
AM		 1930 ieee80211_led_rx(rx->local);
1931 out_no_led:
571ecf67 1932 if (rx->sta)
e5a9f8d0 1933 rx->sta->rx_stats.packets++;
9ae54c84 1934 return RX_CONTINUE;
571ecf67
JB		 1935}
1936
1df332e8 1937static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 1938{
1df332e8 1939 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 1940 return -EACCES;
571ecf67 1941
76ee65bf 1942 return 0;
571ecf67
JB		 1943}
1944
1df332e8 1945static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 1946{
eb9fb5b8
JB		 1947 struct sk_buff *skb = rx->skb;
1948 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1949
3017b80b 1950 /*
7848ba7d
JB		 1951 * Pass through unencrypted frames if the hardware has
1952 * decrypted them already.
3017b80b 1953 */
eb9fb5b8 1954 if (status->flag & RX_FLAG_DECRYPTED)
76ee65bf 1955 return 0;
571ecf67
JB		 1956
1957 /* Drop unencrypted frames if key is set. */
358c8d9d
HH		 1958 if (unlikely(!ieee80211_has_protected(fc) &&
1959 !ieee80211_is_nullfunc(fc) &&
e8f4fb7c 1960 ieee80211_is_data(fc) && rx->key))
76ee65bf 1961 return -EACCES;
bef5d1c7
JB		 1962
1963 return 0;
1964}
1965
1df332e8 1966static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
bef5d1c7
JB		 1967{
1968 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
e3efca0a 1969 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
bef5d1c7 1970 __le16 fc = hdr->frame_control;
bef5d1c7 1971
e3efca0a
JM		 1972 /*
1973 * Pass through unencrypted frames if the hardware has
1974 * decrypted them already.
1975 */
1976 if (status->flag & RX_FLAG_DECRYPTED)
1977 return 0;
bef5d1c7 1978
c2c98fde 1979 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
d211e90e
JM		 1980 if (unlikely(!ieee80211_has_protected(fc) &&
1981 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
cf4e594e 1982 rx->key)) {
6ff57cf8
JB		 1983 if (ieee80211_is_deauth(fc) ||
1984 ieee80211_is_disassoc(fc))
1985 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1986 rx->skb->data,
1987 rx->skb->len);
f2ca3ea4 1988 return -EACCES;
cf4e594e 1989 }
f2ca3ea4 1990 /* BIP does not use Protected field, so need to check MMIE */
f64f9e71 1991 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
cf4e594e 1992 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
6ff57cf8
JB		 1993 if (ieee80211_is_deauth(fc) ||
1994 ieee80211_is_disassoc(fc))
1995 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1996 rx->skb->data,
1997 rx->skb->len);
f2ca3ea4 1998 return -EACCES;
cf4e594e 1999 }
f2ca3ea4
JM		 2000 /*
2001 * When using MFP, Action frames are not allowed prior to
2002 * having configured keys.
2003 */
2004 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
d8ca16db 2005 ieee80211_is_robust_mgmt_frame(rx->skb)))
f2ca3ea4
JM		 2006 return -EACCES;
2007 }
b3fc9c6c 2008
76ee65bf 2009 return 0;
571ecf67
JB		 2010}
2011
76ee65bf 2012static int
4114fa21 2013__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
571ecf67 2014{
eb9fb5b8 2015 struct ieee80211_sub_if_data *sdata = rx->sdata;
f14543ee 2016 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
fbb327c5
FF		 2017 bool check_port_control = false;
2018 struct ethhdr *ehdr;
2019 int ret;
f14543ee 2020
4114fa21 2021 *port_control = false;
9bc383de
JB		 2022 if (ieee80211_has_a4(hdr->frame_control) &&
2023 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
f14543ee 2024 return -1;
9bc383de 2025
fbb327c5
FF		 2026 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2027 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2028
2029 if (!sdata->u.mgd.use_4addr)
2030 return -1;
2031 else
2032 check_port_control = true;
2033 }
2034
9bc383de 2035 if (is_multicast_ether_addr(hdr->addr1) &&
fbb327c5 2036 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
f14543ee 2037 return -1;
571ecf67 2038
fbb327c5 2039 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
4114fa21 2040 if (ret < 0)
fbb327c5
FF		 2041 return ret;
2042
2043 ehdr = (struct ethhdr *) rx->skb->data;
4114fa21
FF		 2044 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2045 *port_control = true;
2046 else if (check_port_control)
fbb327c5
FF		 2047 return -1;
2048
2049 return 0;
76ee65bf 2050}
571ecf67 2051
ce3edf6d
JB		 2052/*
2053 * requires that rx->skb is a frame with ethernet header
2054 */
358c8d9d 2055static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 2056{
c97c23e3 2057 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB		 2058 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2059 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2060
2061 /*
2062 * Allow EAPOL frames to us/the PAE group address regardless
2063 * of whether the frame was encrypted or not.
2064 */
a621fa4d 2065 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
3bc7945e
JP		 2066 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2067 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
ce3edf6d
JB		 2068 return true;
2069
2070 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 2071 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB		 2072 return false;
2073
2074 return true;
2075}
2076
2077/*
2078 * requires that rx->skb is a frame with ethernet header
2079 */
76ee65bf 2080static void
5cf121c3 2081ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf 2082{
eb9fb5b8
JB		 2083 struct ieee80211_sub_if_data *sdata = rx->sdata;
2084 struct net_device *dev = sdata->dev;
76ee65bf 2085 struct sk_buff *skb, *xmit_skb;
ce3edf6d
JB		 2086 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2087 struct sta_info *dsta;
571ecf67 2088
76ee65bf
RR		 2089 skb = rx->skb;
2090 xmit_skb = NULL;
571ecf67 2091
5a490510
JB		 2092 ieee80211_rx_stats(dev, skb->len);
2093
05c914fe
JB		 2094 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2095 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 2096 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
9bc383de 2097 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
ce3edf6d
JB		 2098 if (is_multicast_ether_addr(ehdr->h_dest)) {
2099 /*
2100 * send multicast frames both to higher layers in
2101 * local net stack and back to the wireless medium
2102 */
76ee65bf 2103 xmit_skb = skb_copy(skb, GFP_ATOMIC);
e87cc472 2104 if (!xmit_skb)
bdcbd8e0 2105 net_info_ratelimited("%s: failed to clone multicast frame\n",
e87cc472 2106 dev->name);
571ecf67 2107 } else {
abe60632
JB		 2108 dsta = sta_info_get(sdata, skb->data);
2109 if (dsta) {
ce3edf6d
JB		 2110 /*
2111 * The destination station is associated to
2112 * this AP (in this VLAN), so send the frame
2113 * directly to it and do not pass it to local
2114 * net stack.
571ecf67 2115 */
76ee65bf 2116 xmit_skb = skb;
571ecf67
JB		 2117 skb = NULL;
2118 }
571ecf67
JB		 2119 }
2120 }
2121
59d9cb07 2122#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
9e890a1f
JB		 2123 if (skb) {
2124 /* 'align' will only take the values 0 or 2 here since all
2125 * frames are required to be aligned to 2-byte boundaries
2126 * when being passed to mac80211; the code here works just
2127 * as well if that isn't true, but mac80211 assumes it can
2128 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
d1c3a37c 2129 */
9e890a1f
JB		 2130 int align;
2131
2132 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
d1c3a37c
JB		 2133 if (align) {
2134 if (WARN_ON(skb_headroom(skb) < 3)) {
2135 dev_kfree_skb(skb);
2136 skb = NULL;
2137 } else {
2138 u8 *data = skb->data;
8ce0b589
ZY		 2139 size_t len = skb_headlen(skb);
2140 skb->data -= align;
2141 memmove(skb->data, data, len);
2142 skb_set_tail_pointer(skb, len);
d1c3a37c
JB		 2143 }
2144 }
9e890a1f 2145 }
d1c3a37c
JB		 2146#endif
2147
9e890a1f
JB		 2148 if (skb) {
2149 /* deliver to local stack */
2150 skb->protocol = eth_type_trans(skb, dev);
2151 memset(skb->cb, 0, sizeof(skb->cb));
af9f9b22
JB		 2152 if (rx->napi)
2153 napi_gro_receive(rx->napi, skb);
06d181a8
JB		 2154 else
2155 netif_receive_skb(skb);
571ecf67
JB		 2156 }
2157
76ee65bf 2158 if (xmit_skb) {
aef6c928
HS		 2159 /*
2160 * Send to wireless media and increase priority by 256 to
2161 * keep the received priority instead of reclassifying
2162 * the frame (see cfg80211_classify8021d).
2163 */
2164 xmit_skb->priority += 256;
f831e909 2165 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB		 2166 skb_reset_network_header(xmit_skb);
2167 skb_reset_mac_header(xmit_skb);
76ee65bf 2168 dev_queue_xmit(xmit_skb);
571ecf67 2169 }
76ee65bf
RR		 2170}
2171
49461622 2172static ieee80211_rx_result debug_noinline
5cf121c3 2173ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
fd4c7f2f 2174{
eb9fb5b8 2175 struct net_device *dev = rx->sdata->dev;
eaf85ca7 2176 struct sk_buff *skb = rx->skb;
358c8d9d
HH		 2177 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2178 __le16 fc = hdr->frame_control;
eaf85ca7 2179 struct sk_buff_head frame_list;
554891e6 2180 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
fd4c7f2f 2181
358c8d9d 2182 if (unlikely(!ieee80211_is_data(fc)))
9ae54c84 2183 return RX_CONTINUE;
fd4c7f2f 2184
358c8d9d 2185 if (unlikely(!ieee80211_is_data_present(fc)))
e4c26add 2186 return RX_DROP_MONITOR;
fd4c7f2f 2187
554891e6 2188 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
9ae54c84 2189 return RX_CONTINUE;
fd4c7f2f 2190
eaf85ca7
ZY		 2191 if (ieee80211_has_a4(hdr->frame_control) &&
2192 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2193 !rx->sdata->u.vlan.sta)
e4c26add 2194 return RX_DROP_UNUSABLE;
fd4c7f2f 2195
eaf85ca7
ZY		 2196 if (is_multicast_ether_addr(hdr->addr1) &&
2197 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2198 rx->sdata->u.vlan.sta) ||
2199 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
2200 rx->sdata->u.mgd.use_4addr)))
e4c26add 2201 return RX_DROP_UNUSABLE;
fd4c7f2f 2202
eaf85ca7
ZY		 2203 skb->dev = dev;
2204 __skb_queue_head_init(&frame_list);
fd4c7f2f 2205
e3cf8b3f
ZY		 2206 if (skb_linearize(skb))
2207 return RX_DROP_UNUSABLE;
2208
eaf85ca7
ZY		 2209 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2210 rx->sdata->vif.type,
8b3becad 2211 rx->local->hw.extra_tx_headroom, true);
fd4c7f2f 2212
eaf85ca7
ZY		 2213 while (!skb_queue_empty(&frame_list)) {
2214 rx->skb = __skb_dequeue(&frame_list);
fd4c7f2f 2215
358c8d9d 2216 if (!ieee80211_frame_allowed(rx, fc)) {
eaf85ca7 2217 dev_kfree_skb(rx->skb);
ce3edf6d
JB		 2218 continue;
2219 }
fd4c7f2f
RR		 2220
2221 ieee80211_deliver_skb(rx);
2222 }
2223
9ae54c84 2224 return RX_QUEUED;
fd4c7f2f
RR		 2225}
2226
bf94e17b 2227#ifdef CONFIG_MAC80211_MESH
b0dee578 2228static ieee80211_rx_result
e32f85f7
LCC		 2229ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2230{
30789eb6
TP		 2231 struct ieee80211_hdr *fwd_hdr, *hdr;
2232 struct ieee80211_tx_info *info;
e32f85f7 2233 struct ieee80211s_hdr *mesh_hdr;
e32f85f7 2234 struct sk_buff *skb = rx->skb, *fwd_skb;
3b8d81e0 2235 struct ieee80211_local *local = rx->local;
eb9fb5b8 2236 struct ieee80211_sub_if_data *sdata = rx->sdata;
30789eb6 2237 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
cf440128 2238 u16 ac, q, hdrlen;
e32f85f7
LCC		 2239
2240 hdr = (struct ieee80211_hdr *) skb->data;
2241 hdrlen = ieee80211_hdrlen(hdr->frame_control);
9b395bc3
JB		 2242
2243 /* make sure fixed part of mesh header is there, also checks skb len */
2244 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2245 return RX_DROP_MONITOR;
2246
2247 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2248
2249 /* make sure full mesh header is there, also checks skb len */
2250 if (!pskb_may_pull(rx->skb,
2251 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2252 return RX_DROP_MONITOR;
2253
2254 /* reload pointers */
2255 hdr = (struct ieee80211_hdr *) skb->data;
e32f85f7
LCC		 2256 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2257
d0c22119
BC		 2258 if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2259 return RX_DROP_MONITOR;
2260
2157fdd6
TP		 2261 /* frame is in RMC, don't forward */
2262 if (ieee80211_is_data(hdr->frame_control) &&
2263 is_multicast_ether_addr(hdr->addr1) &&
bf7cd94d 2264 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2157fdd6
TP		 2265 return RX_DROP_MONITOR;
2266
5c90067c 2267 if (!ieee80211_is_data(hdr->frame_control))
e32f85f7
LCC		 2268 return RX_CONTINUE;
2269
2270 if (!mesh_hdr->ttl)
e32f85f7
LCC		 2271 return RX_DROP_MONITOR;
2272
43b7b314 2273 if (mesh_hdr->flags & MESH_FLAGS_AE) {
79617dee 2274 struct mesh_path *mppath;
43b7b314
JC		 2275 char *proxied_addr;
2276 char *mpp_addr;
2277
2278 if (is_multicast_ether_addr(hdr->addr1)) {
2279 mpp_addr = hdr->addr3;
2280 proxied_addr = mesh_hdr->eaddr1;
9b395bc3
JB		 2281 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
2282 /* has_a4 already checked in ieee80211_rx_mesh_check */
43b7b314
JC		 2283 mpp_addr = hdr->addr4;
2284 proxied_addr = mesh_hdr->eaddr2;
9b395bc3
JB		 2285 } else {
2286 return RX_DROP_MONITOR;
43b7b314 2287 }
79617dee 2288
79617dee 2289 rcu_read_lock();
bf7cd94d 2290 mppath = mpp_path_lookup(sdata, proxied_addr);
79617dee 2291 if (!mppath) {
bf7cd94d 2292 mpp_path_add(sdata, proxied_addr, mpp_addr);
79617dee
Y		 2293 } else {
2294 spin_lock_bh(&mppath->state_lock);
b203ca39 2295 if (!ether_addr_equal(mppath->mpp, mpp_addr))
43b7b314 2296 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
79617dee
Y		 2297 spin_unlock_bh(&mppath->state_lock);
2298 }
2299 rcu_read_unlock();
2300 }
2301
3c5772a5
JC		 2302 /* Frame has reached destination. Don't forward */
2303 if (!is_multicast_ether_addr(hdr->addr1) &&
b203ca39 2304 ether_addr_equal(sdata->vif.addr, hdr->addr3))
e32f85f7
LCC		 2305 return RX_CONTINUE;
2306
cf440128
MK		 2307 ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2308 q = sdata->vif.hw_queue[ac];
d3c1597b 2309 if (ieee80211_queue_stopped(&local->hw, q)) {
30789eb6 2310 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
d3c1597b
TP		 2311 return RX_DROP_MONITOR;
2312 }
2313 skb_set_queue_mapping(skb, q);
e32f85f7 2314
30789eb6
TP		 2315 if (!--mesh_hdr->ttl) {
2316 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2ac64cd1 2317 goto out;
30789eb6
TP		 2318 }
2319
d665508b
CYY		 2320 if (!ifmsh->mshcfg.dot11MeshForwarding)
2321 goto out;
2322
30789eb6
TP		 2323 fwd_skb = skb_copy(skb, GFP_ATOMIC);
2324 if (!fwd_skb) {
bdcbd8e0 2325 net_info_ratelimited("%s: failed to clone mesh frame\n",
e87cc472 2326 sdata->name);
30789eb6
TP		 2327 goto out;
2328 }
2329
2330 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
9d6d6f49 2331 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
30789eb6
TP		 2332 info = IEEE80211_SKB_CB(fwd_skb);
2333 memset(info, 0, sizeof(*info));
2334 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2335 info->control.vif = &rx->sdata->vif;
2336 info->control.jiffies = jiffies;
2337 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2338 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2339 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3f52b7e3
MP		 2340 /* update power mode indication when forwarding */
2341 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
bf7cd94d 2342 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
3f52b7e3 2343 /* mesh power mode flags updated in mesh_nexthop_lookup */
30789eb6
TP		 2344 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2345 } else {
2346 /* unable to resolve next hop */
bf7cd94d 2347 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
f63f8421
CYY		 2348 fwd_hdr->addr3, 0,
2349 WLAN_REASON_MESH_PATH_NOFORWARD,
2350 fwd_hdr->addr2);
30789eb6 2351 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
74b8cc3d 2352 kfree_skb(fwd_skb);
30789eb6 2353 return RX_DROP_MONITOR;
e32f85f7
LCC		 2354 }
2355
30789eb6
TP		 2356 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2357 ieee80211_add_pending_skb(local, fwd_skb);
b51aff05 2358 out:
df140465 2359 if (is_multicast_ether_addr(hdr->addr1))
e32f85f7 2360 return RX_CONTINUE;
df140465 2361 return RX_DROP_MONITOR;
e32f85f7 2362}
bf94e17b 2363#endif
e32f85f7 2364
49461622 2365static ieee80211_rx_result debug_noinline
5cf121c3 2366ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf 2367{
eb9fb5b8 2368 struct ieee80211_sub_if_data *sdata = rx->sdata;
e15276a4 2369 struct ieee80211_local *local = rx->local;
eb9fb5b8 2370 struct net_device *dev = sdata->dev;
358c8d9d
HH		 2371 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2372 __le16 fc = hdr->frame_control;
4114fa21 2373 bool port_control;
ce3edf6d 2374 int err;
76ee65bf 2375
358c8d9d 2376 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 2377 return RX_CONTINUE;
76ee65bf 2378
358c8d9d 2379 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 2380 return RX_DROP_MONITOR;
76ee65bf 2381
79c892b8 2382 if (rx->sta) {
3d6dc343 2383 /* The seqno index has the same property as needed
79c892b8
JB		 2384 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2385 * for non-QoS-data frames. Here we know it's a data
2386 * frame, so count MSDUs.
2387 */
e5a9f8d0 2388 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
79c892b8
JB		 2389 }
2390
f14543ee 2391 /*
e7f4a940
JB		 2392 * Send unexpected-4addr-frame event to hostapd. For older versions,
2393 * also drop the frame to cooked monitor interfaces.
f14543ee
FF		 2394 */
2395 if (ieee80211_has_a4(hdr->frame_control) &&
e7f4a940
JB		 2396 sdata->vif.type == NL80211_IFTYPE_AP) {
2397 if (rx->sta &&
2398 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2399 cfg80211_rx_unexpected_4addr_frame(
2400 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
f14543ee 2401 return RX_DROP_MONITOR;
e7f4a940 2402 }
f14543ee 2403
4114fa21 2404 err = __ieee80211_data_to_8023(rx, &port_control);
76ee65bf 2405 if (unlikely(err))
e4c26add 2406 return RX_DROP_UNUSABLE;
76ee65bf 2407
358c8d9d 2408 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 2409 return RX_DROP_MONITOR;
ce3edf6d 2410
8a4d32f3
AN		 2411 /* directly handle TDLS channel switch requests/responses */
2412 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2413 cpu_to_be16(ETH_P_TDLS))) {
2414 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2415
2416 if (pskb_may_pull(rx->skb,
2417 offsetof(struct ieee80211_tdls_data, u)) &&
2418 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2419 tf->category == WLAN_CATEGORY_TDLS &&
2420 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2421 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
c8ff71e6
AN		 2422 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2423 schedule_work(&local->tdls_chsw_work);
8a4d32f3 2424 if (rx->sta)
e5a9f8d0 2425 rx->sta->rx_stats.packets++;
8a4d32f3
AN		 2426
2427 return RX_QUEUED;
2428 }
2429 }
2430
4114fa21
FF		 2431 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2432 unlikely(port_control) && sdata->bss) {
2433 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2434 u.ap);
2435 dev = sdata->dev;
2436 rx->sdata = sdata;
2437 }
2438
76ee65bf
RR		 2439 rx->skb->dev = dev;
2440
08ca944e 2441 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
8c99f691
RM		 2442 !is_multicast_ether_addr(
2443 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2444 (!local->scanning &&
2445 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
e15276a4
VN		 2446 mod_timer(&local->dynamic_ps_timer, jiffies +
2447 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2448 }
2449
76ee65bf 2450 ieee80211_deliver_skb(rx);
571ecf67 2451
9ae54c84 2452 return RX_QUEUED;
571ecf67
JB		 2453}
2454
49461622 2455static ieee80211_rx_result debug_noinline
f9e124fb 2456ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
71364716 2457{
71364716 2458 struct sk_buff *skb = rx->skb;
a7767f95 2459 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR		 2460 struct tid_ampdu_rx *tid_agg_rx;
2461 u16 start_seq_num;
2462 u16 tid;
2463
a7767f95 2464 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 2465 return RX_CONTINUE;
71364716 2466
a7767f95 2467 if (ieee80211_is_back_req(bar->frame_control)) {
8ae5977f
JB		 2468 struct {
2469 __le16 control, start_seq_num;
2470 } __packed bar_data;
6382246e
EG		 2471 struct ieee80211_event event = {
2472 .type = BAR_RX_EVENT,
2473 };
8ae5977f 2474
71364716 2475 if (!rx->sta)
a02ae758 2476 return RX_DROP_MONITOR;
8ae5977f
JB		 2477
2478 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2479 &bar_data, sizeof(bar_data)))
2480 return RX_DROP_MONITOR;
2481
8ae5977f 2482 tid = le16_to_cpu(bar_data.control) >> 12;
a87f736d
JB		 2483
2484 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2485 if (!tid_agg_rx)
a02ae758 2486 return RX_DROP_MONITOR;
71364716 2487
8ae5977f 2488 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
6382246e
EG		 2489 event.u.ba.tid = tid;
2490 event.u.ba.ssn = start_seq_num;
2491 event.u.ba.sta = &rx->sta->sta;
71364716
RR		 2492
2493 /* reset session timer */
20ad19d0
JB		 2494 if (tid_agg_rx->timeout)
2495 mod_timer(&tid_agg_rx->session_timer,
2496 TU_TO_EXP_TIME(tid_agg_rx->timeout));
71364716 2497
dd318575 2498 spin_lock(&tid_agg_rx->reorder_lock);
a02ae758 2499 /* release stored frames up to start of BAR */
d3b2fb53 2500 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
f9e124fb 2501 start_seq_num, frames);
dd318575
JB		 2502 spin_unlock(&tid_agg_rx->reorder_lock);
2503
6382246e
EG		 2504 drv_event_callback(rx->local, rx->sdata, &event);
2505
a02ae758
JB		 2506 kfree_skb(skb);
2507 return RX_QUEUED;
71364716
RR		 2508 }
2509
08daecae
JB		 2510 /*
2511 * After this point, we only want management frames,
2512 * so we can drop all remaining control frames to
2513 * cooked monitor interfaces.
2514 */
2515 return RX_DROP_MONITOR;
71364716
RR		 2516}
2517
f4f727a6
JM		 2518static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2519 struct ieee80211_mgmt *mgmt,
2520 size_t len)
fea14732
JM		 2521{
2522 struct ieee80211_local *local = sdata->local;
2523 struct sk_buff *skb;
2524 struct ieee80211_mgmt *resp;
2525
b203ca39 2526 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
fea14732
JM		 2527 /* Not to own unicast address */
2528 return;
2529 }
2530
b203ca39
JP		 2531 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2532 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
77fdaa12 2533 /* Not from the current AP or not associated yet. */
fea14732
JM		 2534 return;
2535 }
2536
2537 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2538 /* Too short SA Query request frame */
2539 return;
2540 }
2541
2542 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2543 if (skb == NULL)
2544 return;
2545
2546 skb_reserve(skb, local->hw.extra_tx_headroom);
2547 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2548 memset(resp, 0, 24);
2549 memcpy(resp->da, mgmt->sa, ETH_ALEN);
47846c9b 2550 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
46900298 2551 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
fea14732
JM		 2552 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2553 IEEE80211_STYPE_ACTION);
2554 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2555 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2556 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2557 memcpy(resp->u.action.u.sa_query.trans_id,
2558 mgmt->u.action.u.sa_query.trans_id,
2559 WLAN_SA_QUERY_TR_ID_LEN);
2560
62ae67be 2561 ieee80211_tx_skb(sdata, skb);
fea14732
JM		 2562}
2563
2e161f78
JB		 2564static ieee80211_rx_result debug_noinline
2565ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2566{
2567 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2568 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2569
2570 /*
2571 * From here on, look only at management frames.
2572 * Data and control frames are already handled,
2573 * and unknown (reserved) frames are useless.
2574 */
2575 if (rx->skb->len < 24)
2576 return RX_DROP_MONITOR;
2577
2578 if (!ieee80211_is_mgmt(mgmt->frame_control))
2579 return RX_DROP_MONITOR;
2580
ee971924
JB		 2581 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2582 ieee80211_is_beacon(mgmt->frame_control) &&
2583 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
804483e9
JB		 2584 int sig = 0;
2585
30686bf7 2586 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
804483e9
JB		 2587 sig = status->signal;
2588
ee971924
JB		 2589 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2590 rx->skb->data, rx->skb->len,
37c73b5f 2591 status->freq, sig);
ee971924
JB		 2592 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2593 }
2594
2e161f78
JB		 2595 if (ieee80211_drop_unencrypted_mgmt(rx))
2596 return RX_DROP_UNUSABLE;
2597
2598 return RX_CONTINUE;
2599}
2600
de1ede7a
JB		 2601static ieee80211_rx_result debug_noinline
2602ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2603{
2604 struct ieee80211_local *local = rx->local;
eb9fb5b8 2605 struct ieee80211_sub_if_data *sdata = rx->sdata;
de1ede7a 2606 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2607 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
de1ede7a
JB		 2608 int len = rx->skb->len;
2609
2610 if (!ieee80211_is_action(mgmt->frame_control))
2611 return RX_CONTINUE;
2612
026331c4
JM		 2613 /* drop too small frames */
2614 if (len < IEEE80211_MIN_ACTION_SIZE)
84040805 2615 return RX_DROP_UNUSABLE;
de1ede7a 2616
815b8092 2617 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
cd7760e6
SW		 2618 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2619 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
84040805 2620 return RX_DROP_UNUSABLE;
de1ede7a 2621
de1ede7a 2622 switch (mgmt->u.action.category) {
1d8d3dec
JB		 2623 case WLAN_CATEGORY_HT:
2624 /* reject HT action frames from stations not supporting HT */
2625 if (!rx->sta->sta.ht_cap.ht_supported)
2626 goto invalid;
2627
2628 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2629 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2630 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2631 sdata->vif.type != NL80211_IFTYPE_AP &&
2632 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2633 break;
2634
ec61cd63 2635 /* verify action & smps_control/chanwidth are present */
1d8d3dec
JB		 2636 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2637 goto invalid;
2638
2639 switch (mgmt->u.action.u.ht_smps.action) {
2640 case WLAN_HT_ACTION_SMPS: {
2641 struct ieee80211_supported_band *sband;
af0ed69b 2642 enum ieee80211_smps_mode smps_mode;
1d8d3dec
JB		 2643
2644 /* convert to HT capability */
2645 switch (mgmt->u.action.u.ht_smps.smps_control) {
2646 case WLAN_HT_SMPS_CONTROL_DISABLED:
af0ed69b 2647 smps_mode = IEEE80211_SMPS_OFF;
1d8d3dec
JB		 2648 break;
2649 case WLAN_HT_SMPS_CONTROL_STATIC:
af0ed69b 2650 smps_mode = IEEE80211_SMPS_STATIC;
1d8d3dec
JB		 2651 break;
2652 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
af0ed69b 2653 smps_mode = IEEE80211_SMPS_DYNAMIC;
1d8d3dec
JB		 2654 break;
2655 default:
2656 goto invalid;
2657 }
1d8d3dec
JB		 2658
2659 /* if no change do nothing */
af0ed69b 2660 if (rx->sta->sta.smps_mode == smps_mode)
1d8d3dec 2661 goto handled;
af0ed69b 2662 rx->sta->sta.smps_mode = smps_mode;
1d8d3dec
JB		 2663
2664 sband = rx->local->hw.wiphy->bands[status->band];
2665
64f68e5d
JB		 2666 rate_control_rate_update(local, sband, rx->sta,
2667 IEEE80211_RC_SMPS_CHANGED);
1d8d3dec
JB		 2668 goto handled;
2669 }
ec61cd63
JB		 2670 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2671 struct ieee80211_supported_band *sband;
2672 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
1c45c5ce 2673 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
ec61cd63
JB		 2674
2675 /* If it doesn't support 40 MHz it can't change ... */
e1a0c6b3
JB		 2676 if (!(rx->sta->sta.ht_cap.cap &
2677 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
ec61cd63
JB		 2678 goto handled;
2679
e1a0c6b3 2680 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
1c45c5ce 2681 max_bw = IEEE80211_STA_RX_BW_20;
e1a0c6b3 2682 else
1c45c5ce
EP		 2683 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2684
2685 /* set cur_max_bandwidth and recalc sta bw */
2686 rx->sta->cur_max_bandwidth = max_bw;
2687 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
ec61cd63 2688
e1a0c6b3 2689 if (rx->sta->sta.bandwidth == new_bw)
ec61cd63
JB		 2690 goto handled;
2691
1c45c5ce 2692 rx->sta->sta.bandwidth = new_bw;
ec61cd63
JB		 2693 sband = rx->local->hw.wiphy->bands[status->band];
2694
2695 rate_control_rate_update(local, sband, rx->sta,
2696 IEEE80211_RC_BW_CHANGED);
2697 goto handled;
2698 }
1d8d3dec
JB		 2699 default:
2700 goto invalid;
2701 }
2702
0af83d3d 2703 break;
1b3a2e49
JB		 2704 case WLAN_CATEGORY_PUBLIC:
2705 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2706 goto invalid;
2707 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2708 break;
2709 if (!rx->sta)
2710 break;
2711 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2712 break;
2713 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2714 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2715 break;
2716 if (len < offsetof(struct ieee80211_mgmt,
2717 u.action.u.ext_chan_switch.variable))
2718 goto invalid;
2719 goto queue;
0af83d3d
JB		 2720 case WLAN_CATEGORY_VHT:
2721 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2722 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2723 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2724 sdata->vif.type != NL80211_IFTYPE_AP &&
2725 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2726 break;
2727
2728 /* verify action code is present */
2729 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2730 goto invalid;
2731
2732 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2733 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
2734 u8 opmode;
2735
2736 /* verify opmode is present */
2737 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2738 goto invalid;
2739
2740 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
2741
2742 ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
cf1e05c6 2743 opmode, status->band);
0af83d3d
JB		 2744 goto handled;
2745 }
23a1f8d4
SS		 2746 case WLAN_VHT_ACTION_GROUPID_MGMT: {
2747 if (len < IEEE80211_MIN_ACTION_SIZE + 25)
2748 goto invalid;
2749 goto queue;
2750 }
0af83d3d
JB		 2751 default:
2752 break;
2753 }
1d8d3dec 2754 break;
de1ede7a 2755 case WLAN_CATEGORY_BACK:
8abd3f9b 2756 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
ae2772b3 2757 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
8abd3f9b 2758 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
13c40c54
AS		 2759 sdata->vif.type != NL80211_IFTYPE_AP &&
2760 sdata->vif.type != NL80211_IFTYPE_ADHOC)
84040805 2761 break;
8abd3f9b 2762
026331c4
JM		 2763 /* verify action_code is present */
2764 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2765 break;
2766
de1ede7a
JB		 2767 switch (mgmt->u.action.u.addba_req.action_code) {
2768 case WLAN_ACTION_ADDBA_REQ:
2769 if (len < (IEEE80211_MIN_ACTION_SIZE +
2770 sizeof(mgmt->u.action.u.addba_req)))
bed7ee6e
JB		 2771 goto invalid;
2772 break;
de1ede7a
JB		 2773 case WLAN_ACTION_ADDBA_RESP:
2774 if (len < (IEEE80211_MIN_ACTION_SIZE +
2775 sizeof(mgmt->u.action.u.addba_resp)))
bed7ee6e
JB		 2776 goto invalid;
2777 break;
de1ede7a
JB		 2778 case WLAN_ACTION_DELBA:
2779 if (len < (IEEE80211_MIN_ACTION_SIZE +
2780 sizeof(mgmt->u.action.u.delba)))
bed7ee6e
JB		 2781 goto invalid;
2782 break;
2783 default:
2784 goto invalid;
de1ede7a 2785 }
bed7ee6e 2786
8b58ff83 2787 goto queue;
39192c0b 2788 case WLAN_CATEGORY_SPECTRUM_MGMT:
026331c4
JM		 2789 /* verify action_code is present */
2790 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2791 break;
2792
39192c0b
JB		 2793 switch (mgmt->u.action.u.measurement.action_code) {
2794 case WLAN_ACTION_SPCT_MSR_REQ:
cd7760e6
SW		 2795 if (status->band != IEEE80211_BAND_5GHZ)
2796 break;
2797
39192c0b
JB		 2798 if (len < (IEEE80211_MIN_ACTION_SIZE +
2799 sizeof(mgmt->u.action.u.measurement)))
84040805 2800 break;
cd7760e6
SW		 2801
2802 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2803 break;
2804
39192c0b 2805 ieee80211_process_measurement_req(sdata, mgmt, len);
84040805 2806 goto handled;
cd7760e6
SW		 2807 case WLAN_ACTION_SPCT_CHL_SWITCH: {
2808 u8 *bssid;
2809 if (len < (IEEE80211_MIN_ACTION_SIZE +
2810 sizeof(mgmt->u.action.u.chan_switch)))
84040805 2811 break;
cc32abd4 2812
cd7760e6 2813 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
b8456a14
CYY		 2814 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2815 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
cd7760e6
SW		 2816 break;
2817
2818 if (sdata->vif.type == NL80211_IFTYPE_STATION)
2819 bssid = sdata->u.mgd.bssid;
2820 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2821 bssid = sdata->u.ibss.bssid;
b8456a14
CYY		 2822 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
2823 bssid = mgmt->sa;
cd7760e6
SW		 2824 else
2825 break;
2826
2827 if (!ether_addr_equal(mgmt->bssid, bssid))
84040805 2828 break;
c481ec97 2829
8b58ff83 2830 goto queue;
cd7760e6 2831 }
39192c0b
JB		 2832 }
2833 break;
fea14732
JM		 2834 case WLAN_CATEGORY_SA_QUERY:
2835 if (len < (IEEE80211_MIN_ACTION_SIZE +
2836 sizeof(mgmt->u.action.u.sa_query)))
84040805
JB		 2837 break;
2838
fea14732
JM		 2839 switch (mgmt->u.action.u.sa_query.action) {
2840 case WLAN_ACTION_SA_QUERY_REQUEST:
2841 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2842 break;
fea14732 2843 ieee80211_process_sa_query_req(sdata, mgmt, len);
84040805 2844 goto handled;
fea14732
JM		 2845 }
2846 break;
8db09850 2847 case WLAN_CATEGORY_SELF_PROTECTED:
9b395bc3
JB		 2848 if (len < (IEEE80211_MIN_ACTION_SIZE +
2849 sizeof(mgmt->u.action.u.self_prot.action_code)))
2850 break;
2851
8db09850
TP		 2852 switch (mgmt->u.action.u.self_prot.action_code) {
2853 case WLAN_SP_MESH_PEERING_OPEN:
2854 case WLAN_SP_MESH_PEERING_CLOSE:
2855 case WLAN_SP_MESH_PEERING_CONFIRM:
2856 if (!ieee80211_vif_is_mesh(&sdata->vif))
2857 goto invalid;
a6dad6a2 2858 if (sdata->u.mesh.user_mpm)
8db09850
TP		 2859 /* userspace handles this frame */
2860 break;
2861 goto queue;
2862 case WLAN_SP_MGK_INFORM:
2863 case WLAN_SP_MGK_ACK:
2864 if (!ieee80211_vif_is_mesh(&sdata->vif))
2865 goto invalid;
2866 break;
2867 }
2868 break;
d3aaec8a 2869 case WLAN_CATEGORY_MESH_ACTION:
9b395bc3
JB		 2870 if (len < (IEEE80211_MIN_ACTION_SIZE +
2871 sizeof(mgmt->u.action.u.mesh_action.action_code)))
2872 break;
2873
77a121c3
JB		 2874 if (!ieee80211_vif_is_mesh(&sdata->vif))
2875 break;
25d49e4d 2876 if (mesh_action_is_path_sel(mgmt) &&
1df332e8 2877 !mesh_path_sel_is_hwmp(sdata))
c7108a71
JC		 2878 break;
2879 goto queue;
84040805 2880 }
026331c4 2881
2e161f78
JB		 2882 return RX_CONTINUE;
2883
bed7ee6e 2884 invalid:
554891e6 2885 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2e161f78
JB		 2886 /* will return in the next handlers */
2887 return RX_CONTINUE;
2888
2889 handled:
2890 if (rx->sta)
e5a9f8d0 2891 rx->sta->rx_stats.packets++;
2e161f78
JB		 2892 dev_kfree_skb(rx->skb);
2893 return RX_QUEUED;
2894
2895 queue:
2896 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2897 skb_queue_tail(&sdata->skb_queue, rx->skb);
2898 ieee80211_queue_work(&local->hw, &sdata->work);
2899 if (rx->sta)
e5a9f8d0 2900 rx->sta->rx_stats.packets++;
2e161f78
JB		 2901 return RX_QUEUED;
2902}
2903
2904static ieee80211_rx_result debug_noinline
2905ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2906{
554891e6 2907 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
804483e9 2908 int sig = 0;
2e161f78
JB		 2909
2910 /* skip known-bad action frames and return them in the next handler */
554891e6 2911 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2e161f78 2912 return RX_CONTINUE;
d7907448 2913
026331c4
JM		 2914 /*
2915 * Getting here means the kernel doesn't know how to handle
2916 * it, but maybe userspace does ... include returned frames
2917 * so userspace can register for those to know whether ones
2918 * it transmitted were processed or returned.
2919 */
026331c4 2920
30686bf7 2921 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
804483e9
JB		 2922 sig = status->signal;
2923
71bbc994 2924 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
970fdfa8 2925 rx->skb->data, rx->skb->len, 0)) {
2e161f78 2926 if (rx->sta)
e5a9f8d0 2927 rx->sta->rx_stats.packets++;
2e161f78
JB		 2928 dev_kfree_skb(rx->skb);
2929 return RX_QUEUED;
2930 }
2931
2e161f78
JB		 2932 return RX_CONTINUE;
2933}
2934
2935static ieee80211_rx_result debug_noinline
2936ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2937{
2938 struct ieee80211_local *local = rx->local;
2939 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2940 struct sk_buff *nskb;
2941 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 2942 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2943
2944 if (!ieee80211_is_action(mgmt->frame_control))
2945 return RX_CONTINUE;
2946
2947 /*
2948 * For AP mode, hostapd is responsible for handling any action
2949 * frames that we didn't handle, including returning unknown
2950 * ones. For all other modes we will return them to the sender,
2951 * setting the 0x80 bit in the action category, as required by
4b5ebccc 2952 * 802.11-2012 9.24.4.
2e161f78
JB		 2953 * Newer versions of hostapd shall also use the management frame
2954 * registration mechanisms, but older ones still use cooked
2955 * monitor interfaces so push all frames there.
2956 */
554891e6 2957 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2e161f78
JB		 2958 (sdata->vif.type == NL80211_IFTYPE_AP ||
2959 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2960 return RX_DROP_MONITOR;
026331c4 2961
4b5ebccc
JB		 2962 if (is_multicast_ether_addr(mgmt->da))
2963 return RX_DROP_MONITOR;
2964
84040805
JB		 2965 /* do not return rejected action frames */
2966 if (mgmt->u.action.category & 0x80)
2967 return RX_DROP_UNUSABLE;
2968
2969 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2970 GFP_ATOMIC);
2971 if (nskb) {
292b4df6 2972 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
84040805 2973
292b4df6
JL		 2974 nmgmt->u.action.category |= 0x80;
2975 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2976 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
84040805
JB		 2977
2978 memset(nskb->cb, 0, sizeof(nskb->cb));
2979
07e5a5f5
JB		 2980 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
2981 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
2982
2983 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
2984 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
2985 IEEE80211_TX_CTL_NO_CCK_RATE;
30686bf7 2986 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
07e5a5f5
JB		 2987 info->hw_queue =
2988 local->hw.offchannel_tx_hw_queue;
2989 }
2990
2991 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
2992 status->band);
de1ede7a 2993 }
39192c0b
JB		 2994 dev_kfree_skb(rx->skb);
2995 return RX_QUEUED;
de1ede7a
JB		 2996}
2997
49461622 2998static ieee80211_rx_result debug_noinline
5cf121c3 2999ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 3000{
eb9fb5b8 3001 struct ieee80211_sub_if_data *sdata = rx->sdata;
77a121c3
JB		 3002 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3003 __le16 stype;
571ecf67 3004
77a121c3 3005 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
472dbc45 3006
77a121c3
JB		 3007 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3008 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
239281f8 3009 sdata->vif.type != NL80211_IFTYPE_OCB &&
77a121c3
JB		 3010 sdata->vif.type != NL80211_IFTYPE_STATION)
3011 return RX_DROP_MONITOR;
472dbc45 3012
77a121c3 3013 switch (stype) {
66e67e41 3014 case cpu_to_le16(IEEE80211_STYPE_AUTH):
77a121c3
JB		 3015 case cpu_to_le16(IEEE80211_STYPE_BEACON):
3016 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3017 /* process for all: mesh, mlme, ibss */
3018 break;
66e67e41
JB		 3019 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3020 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
77a121c3
JB		 3021 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3022 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2c31333a
CL		 3023 if (is_multicast_ether_addr(mgmt->da) &&
3024 !is_broadcast_ether_addr(mgmt->da))
3025 return RX_DROP_MONITOR;
3026
77a121c3
JB		 3027 /* process only for station */
3028 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3029 return RX_DROP_MONITOR;
3030 break;
3031 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
9fb04b50
TP		 3032 /* process only for ibss and mesh */
3033 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3034 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
77a121c3
JB		 3035 return RX_DROP_MONITOR;
3036 break;
3037 default:
3038 return RX_DROP_MONITOR;
3039 }
f9d540ee 3040
77a121c3 3041 /* queue up frame and kick off work to process it */
c1475ca9 3042 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
77a121c3
JB		 3043 skb_queue_tail(&sdata->skb_queue, rx->skb);
3044 ieee80211_queue_work(&rx->local->hw, &sdata->work);
8b58ff83 3045 if (rx->sta)
e5a9f8d0 3046 rx->sta->rx_stats.packets++;
46900298 3047
77a121c3 3048 return RX_QUEUED;
571ecf67
JB		 3049}
3050
5f0b7de5
JB		 3051static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3052 struct ieee80211_rate *rate)
3d30d949
MW		 3053{
3054 struct ieee80211_sub_if_data *sdata;
3055 struct ieee80211_local *local = rx->local;
3d30d949
MW		 3056 struct sk_buff *skb = rx->skb, *skb2;
3057 struct net_device *prev_dev = NULL;
eb9fb5b8 3058 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
293702a3 3059 int needed_headroom;
3d30d949 3060
554891e6
JB		 3061 /*
3062 * If cooked monitor has been processed already, then
3063 * don't do it again. If not, set the flag.
3064 */
3065 if (rx->flags & IEEE80211_RX_CMNTR)
7c1e1831 3066 goto out_free_skb;
554891e6 3067 rx->flags |= IEEE80211_RX_CMNTR;
7c1e1831 3068
152c477a
JB		 3069 /* If there are no cooked monitor interfaces, just free the SKB */
3070 if (!local->cooked_mntrs)
3071 goto out_free_skb;
3072
1f7bba79
JB		 3073 /* vendor data is long removed here */
3074 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
293702a3 3075 /* room for the radiotap header based on driver features */
1f7bba79 3076 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3d30d949 3077
293702a3
JB		 3078 if (skb_headroom(skb) < needed_headroom &&
3079 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3080 goto out_free_skb;
3d30d949 3081
293702a3 3082 /* prepend radiotap information */
973ef21a
FF		 3083 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3084 false);
3d30d949
MW		 3085
3086 skb_set_mac_header(skb, 0);
3087 skb->ip_summed = CHECKSUM_UNNECESSARY;
3088 skb->pkt_type = PACKET_OTHERHOST;
3089 skb->protocol = htons(ETH_P_802_2);
3090
3091 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
9607e6b6 3092 if (!ieee80211_sdata_running(sdata))
3d30d949
MW		 3093 continue;
3094
05c914fe 3095 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3d30d949
MW		 3096 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
3097 continue;
3098
3099 if (prev_dev) {
3100 skb2 = skb_clone(skb, GFP_ATOMIC);
3101 if (skb2) {
3102 skb2->dev = prev_dev;
5548a8a1 3103 netif_receive_skb(skb2);
3d30d949
MW		 3104 }
3105 }
3106
3107 prev_dev = sdata->dev;
5a490510 3108 ieee80211_rx_stats(sdata->dev, skb->len);
3d30d949
MW		 3109 }
3110
3111 if (prev_dev) {
3112 skb->dev = prev_dev;
5548a8a1 3113 netif_receive_skb(skb);
554891e6
JB		 3114 return;
3115 }
3d30d949
MW		 3116
3117 out_free_skb:
3118 dev_kfree_skb(skb);
3119}
3120
aa0c8636
CL		 3121static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3122 ieee80211_rx_result res)
3123{
3124 switch (res) {
3125 case RX_DROP_MONITOR:
3126 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3127 if (rx->sta)
e5a9f8d0 3128 rx->sta->rx_stats.dropped++;
aa0c8636
CL		 3129 /* fall through */
3130 case RX_CONTINUE: {
3131 struct ieee80211_rate *rate = NULL;
3132 struct ieee80211_supported_band *sband;
3133 struct ieee80211_rx_status *status;
3134
3135 status = IEEE80211_SKB_RXCB((rx->skb));
3136
3137 sband = rx->local->hw.wiphy->bands[status->band];
5614618e
JB		 3138 if (!(status->flag & RX_FLAG_HT) &&
3139 !(status->flag & RX_FLAG_VHT))
aa0c8636
CL		 3140 rate = &sband->bitrates[status->rate_idx];
3141
3142 ieee80211_rx_cooked_monitor(rx, rate);
3143 break;
3144 }
3145 case RX_DROP_UNUSABLE:
3146 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3147 if (rx->sta)
e5a9f8d0 3148 rx->sta->rx_stats.dropped++;
aa0c8636
CL		 3149 dev_kfree_skb(rx->skb);
3150 break;
3151 case RX_QUEUED:
3152 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3153 break;
3154 }
3155}
571ecf67 3156
f9e124fb
CL		 3157static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3158 struct sk_buff_head *frames)
58905290 3159{
58905290 3160 ieee80211_rx_result res = RX_DROP_MONITOR;
aa0c8636 3161 struct sk_buff *skb;
8944b79f 3162
e32f85f7
LCC		 3163#define CALL_RXH(rxh) \
3164 do { \
3165 res = rxh(rx); \
3166 if (res != RX_CONTINUE) \
2569a826 3167 goto rxh_next; \
e32f85f7 3168 } while (0);
49461622 3169
45ceeee8
JB		 3170 /* Lock here to avoid hitting all of the data used in the RX
3171 * path (e.g. key data, station data, ...) concurrently when
3172 * a frame is released from the reorder buffer due to timeout
3173 * from the timer, potentially concurrently with RX from the
3174 * driver.
3175 */
f9e124fb 3176 spin_lock_bh(&rx->local->rx_path_lock);
24a8fdad 3177
f9e124fb 3178 while ((skb = __skb_dequeue(frames))) {
2569a826
JB		 3179 /*
3180 * all the other fields are valid across frames
3181 * that belong to an aMPDU since they are on the
3182 * same TID from the same station
3183 */
3184 rx->skb = skb;
3185
2569a826 3186 CALL_RXH(ieee80211_rx_h_check_more_data)
47086fc5 3187 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
2569a826 3188 CALL_RXH(ieee80211_rx_h_sta_process)
86c228a7 3189 CALL_RXH(ieee80211_rx_h_decrypt)
2569a826 3190 CALL_RXH(ieee80211_rx_h_defragment)
2569a826
JB		 3191 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
3192 /* must be after MMIC verify so header is counted in MPDU mic */
bf94e17b 3193#ifdef CONFIG_MAC80211_MESH
aa0c8636 3194 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2569a826 3195 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 3196#endif
2154c81c 3197 CALL_RXH(ieee80211_rx_h_amsdu)
2569a826 3198 CALL_RXH(ieee80211_rx_h_data)
f9e124fb
CL		 3199
3200 /* special treatment -- needs the queue */
3201 res = ieee80211_rx_h_ctrl(rx, frames);
3202 if (res != RX_CONTINUE)
3203 goto rxh_next;
3204
2e161f78 3205 CALL_RXH(ieee80211_rx_h_mgmt_check)
2569a826 3206 CALL_RXH(ieee80211_rx_h_action)
2e161f78
JB		 3207 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
3208 CALL_RXH(ieee80211_rx_h_action_return)
2569a826 3209 CALL_RXH(ieee80211_rx_h_mgmt)
49461622 3210
aa0c8636
CL		 3211 rxh_next:
3212 ieee80211_rx_handlers_result(rx, res);
f9e124fb 3213
49461622 3214#undef CALL_RXH
aa0c8636 3215 }
24a8fdad 3216
f9e124fb 3217 spin_unlock_bh(&rx->local->rx_path_lock);
aa0c8636
CL		 3218}
3219
4406c376 3220static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
aa0c8636 3221{
f9e124fb 3222 struct sk_buff_head reorder_release;
aa0c8636
CL		 3223 ieee80211_rx_result res = RX_DROP_MONITOR;
3224
f9e124fb
CL		 3225 __skb_queue_head_init(&reorder_release);
3226
aa0c8636
CL		 3227#define CALL_RXH(rxh) \
3228 do { \
3229 res = rxh(rx); \
3230 if (res != RX_CONTINUE) \
3231 goto rxh_next; \
3232 } while (0);
3233
0395442a 3234 CALL_RXH(ieee80211_rx_h_check_dup)
aa0c8636
CL		 3235 CALL_RXH(ieee80211_rx_h_check)
3236
f9e124fb 3237 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
aa0c8636 3238
f9e124fb 3239 ieee80211_rx_handlers(rx, &reorder_release);
aa0c8636 3240 return;
49461622 3241
2569a826 3242 rxh_next:
aa0c8636
CL		 3243 ieee80211_rx_handlers_result(rx, res);
3244
3245#undef CALL_RXH
58905290
JB		 3246}
3247
2bff8ebf 3248/*
dd318575
JB		 3249 * This function makes calls into the RX path, therefore
3250 * it has to be invoked under RCU read lock.
2bff8ebf
CL		 3251 */
3252void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3253{
f9e124fb 3254 struct sk_buff_head frames;
554891e6
JB		 3255 struct ieee80211_rx_data rx = {
3256 .sta = sta,
3257 .sdata = sta->sdata,
3258 .local = sta->local,
9e26297a
JB		 3259 /* This is OK -- must be QoS data frame */
3260 .security_idx = tid,
3261 .seqno_idx = tid,
af9f9b22 3262 .napi = NULL, /* must be NULL to not have races */
554891e6 3263 };
2c15a0cf
CL		 3264 struct tid_ampdu_rx *tid_agg_rx;
3265
3266 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3267 if (!tid_agg_rx)
3268 return;
2bff8ebf 3269
f9e124fb
CL		 3270 __skb_queue_head_init(&frames);
3271
2c15a0cf 3272 spin_lock(&tid_agg_rx->reorder_lock);
f9e124fb 3273 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
2c15a0cf 3274 spin_unlock(&tid_agg_rx->reorder_lock);
2bff8ebf 3275
b497de63
EG		 3276 if (!skb_queue_empty(&frames)) {
3277 struct ieee80211_event event = {
3278 .type = BA_FRAME_TIMEOUT,
3279 .u.ba.tid = tid,
3280 .u.ba.sta = &sta->sta,
3281 };
3282 drv_event_callback(rx.local, rx.sdata, &event);
3283 }
3284
f9e124fb 3285 ieee80211_rx_handlers(&rx, &frames);
2bff8ebf
CL		 3286}
3287
571ecf67
JB		 3288/* main receive path */
3289
a58fbe1a 3290static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
23a24def 3291{
20b01f80 3292 struct ieee80211_sub_if_data *sdata = rx->sdata;
eb9fb5b8 3293 struct sk_buff *skb = rx->skb;
a58fbe1a 3294 struct ieee80211_hdr *hdr = (void *)skb->data;
eb9fb5b8
JB		 3295 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3296 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
23a24def
JB		 3297 int multicast = is_multicast_ether_addr(hdr->addr1);
3298
51fb61e7 3299 switch (sdata->vif.type) {
05c914fe 3300 case NL80211_IFTYPE_STATION:
9bc383de 3301 if (!bssid && !sdata->u.mgd.use_4addr)
3c2723f5 3302 return false;
a58fbe1a
JB		 3303 if (multicast)
3304 return true;
3305 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
05c914fe 3306 case NL80211_IFTYPE_ADHOC:
23a24def 3307 if (!bssid)
3c2723f5 3308 return false;
6329b8d9
FF		 3309 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3310 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3c2723f5 3311 return false;
a58fbe1a 3312 if (ieee80211_is_beacon(hdr->frame_control))
3c2723f5 3313 return true;
a58fbe1a 3314 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3c2723f5 3315 return false;
a58fbe1a
JB		 3316 if (!multicast &&
3317 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
df140465 3318 return false;
a58fbe1a 3319 if (!rx->sta) {
0fb8ca45 3320 int rate_idx;
5614618e
JB		 3321 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3322 rate_idx = 0; /* TODO: HT/VHT rates */
0fb8ca45 3323 else
eb9fb5b8 3324 rate_idx = status->rate_idx;
8bf11d8d
JB		 3325 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3326 BIT(rate_idx));
0fb8ca45 3327 }
a58fbe1a 3328 return true;
239281f8
RL		 3329 case NL80211_IFTYPE_OCB:
3330 if (!bssid)
3331 return false;
cc117298 3332 if (!ieee80211_is_data_present(hdr->frame_control))
239281f8 3333 return false;
a58fbe1a 3334 if (!is_broadcast_ether_addr(bssid))
239281f8 3335 return false;
a58fbe1a
JB		 3336 if (!multicast &&
3337 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
df140465 3338 return false;
a58fbe1a 3339 if (!rx->sta) {
239281f8
RL		 3340 int rate_idx;
3341 if (status->flag & RX_FLAG_HT)
3342 rate_idx = 0; /* TODO: HT rates */
3343 else
3344 rate_idx = status->rate_idx;
3345 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3346 BIT(rate_idx));
3347 }
a58fbe1a 3348 return true;
05c914fe 3349 case NL80211_IFTYPE_MESH_POINT:
a58fbe1a
JB		 3350 if (multicast)
3351 return true;
3352 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
05c914fe
JB		 3353 case NL80211_IFTYPE_AP_VLAN:
3354 case NL80211_IFTYPE_AP:
a58fbe1a
JB		 3355 if (!bssid)
3356 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3357
3358 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3df6eaea
JB		 3359 /*
3360 * Accept public action frames even when the
3361 * BSSID doesn't match, this is used for P2P
3362 * and location updates. Note that mac80211
3363 * itself never looks at these frames.
3364 */
2b9ccd4e
JB		 3365 if (!multicast &&
3366 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3c2723f5 3367 return false;
d48b2968 3368 if (ieee80211_is_public_action(hdr, skb->len))
3c2723f5 3369 return true;
5c90067c 3370 return ieee80211_is_beacon(hdr->frame_control);
a58fbe1a
JB		 3371 }
3372
3373 if (!ieee80211_has_tods(hdr->frame_control)) {
db8e1732
AN		 3374 /* ignore data frames to TDLS-peers */
3375 if (ieee80211_is_data(hdr->frame_control))
3376 return false;
3377 /* ignore action frames to TDLS-peers */
3378 if (ieee80211_is_action(hdr->frame_control) &&
3379 !ether_addr_equal(bssid, hdr->addr1))
3380 return false;
23a24def 3381 }
a58fbe1a 3382 return true;
05c914fe 3383 case NL80211_IFTYPE_WDS:
a7767f95 3384 if (bssid || !ieee80211_is_data(hdr->frame_control))
3c2723f5 3385 return false;
a58fbe1a 3386 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
f142c6b9 3387 case NL80211_IFTYPE_P2P_DEVICE:
a58fbe1a
JB		 3388 return ieee80211_is_public_action(hdr, skb->len) ||
3389 ieee80211_is_probe_req(hdr->frame_control) ||
3390 ieee80211_is_probe_resp(hdr->frame_control) ||
3391 ieee80211_is_beacon(hdr->frame_control);
2ca27bcf 3392 default:
fb1c1cd6 3393 break;
23a24def
JB		 3394 }
3395
a58fbe1a
JB		 3396 WARN_ON_ONCE(1);
3397 return false;
23a24def
JB		 3398}
3399
4406c376
JB		 3400/*
3401 * This function returns whether or not the SKB
3402 * was destined for RX processing or not, which,
3403 * if consume is true, is equivalent to whether
3404 * or not the skb was consumed.
3405 */
3406static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
3407 struct sk_buff *skb, bool consume)
3408{
3409 struct ieee80211_local *local = rx->local;
3410 struct ieee80211_sub_if_data *sdata = rx->sdata;
4406c376
JB		 3411
3412 rx->skb = skb;
4406c376 3413
a58fbe1a 3414 if (!ieee80211_accept_frame(rx))
4406c376
JB		 3415 return false;
3416
4406c376
JB		 3417 if (!consume) {
3418 skb = skb_copy(skb, GFP_ATOMIC);
3419 if (!skb) {
3420 if (net_ratelimit())
3421 wiphy_debug(local->hw.wiphy,
b305dae4 3422 "failed to copy skb for %s\n",
4406c376
JB		 3423 sdata->name);
3424 return true;
3425 }
3426
3427 rx->skb = skb;
3428 }
3429
3430 ieee80211_invoke_rx_handlers(rx);
3431 return true;
3432}
3433
571ecf67 3434/*
6b59db7d 3435 * This is the actual Rx frames handler. as it belongs to Rx path it must
6368e4b1 3436 * be called with rcu_read_lock protection.
571ecf67 3437 */
71ebb4aa 3438static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
af9f9b22
JB		 3439 struct sk_buff *skb,
3440 struct napi_struct *napi)
571ecf67
JB		 3441{
3442 struct ieee80211_local *local = hw_to_local(hw);
3443 struct ieee80211_sub_if_data *sdata;
571ecf67 3444 struct ieee80211_hdr *hdr;
e3cf8b3f 3445 __le16 fc;
5cf121c3 3446 struct ieee80211_rx_data rx;
4406c376 3447 struct ieee80211_sub_if_data *prev;
7bedd0cf
JB		 3448 struct sta_info *sta, *prev_sta;
3449 struct rhash_head *tmp;
e3cf8b3f 3450 int err = 0;
571ecf67 3451
e3cf8b3f 3452 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
571ecf67
JB		 3453 memset(&rx, 0, sizeof(rx));
3454 rx.skb = skb;
3455 rx.local = local;
af9f9b22 3456 rx.napi = napi;
72abd81b 3457
e3cf8b3f 3458 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
c206ca67 3459 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
571ecf67 3460
4a4f1a58
JB		 3461 if (ieee80211_is_mgmt(fc)) {
3462 /* drop frame if too short for header */
3463 if (skb->len < ieee80211_hdrlen(fc))
3464 err = -ENOBUFS;
3465 else
3466 err = skb_linearize(skb);
3467 } else {
e3cf8b3f 3468 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4a4f1a58 3469 }
e3cf8b3f
ZY		 3470
3471 if (err) {
3472 dev_kfree_skb(skb);
3473 return;
3474 }
3475
3476 hdr = (struct ieee80211_hdr *)skb->data;
38f3714d 3477 ieee80211_parse_qos(&rx);
d1c3a37c 3478 ieee80211_verify_alignment(&rx);
38f3714d 3479
d48b2968
JB		 3480 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
3481 ieee80211_is_beacon(hdr->frame_control)))
3482 ieee80211_scan_rx(local, skb);
3483
e3cf8b3f 3484 if (ieee80211_is_data(fc)) {
7bedd0cf
JB		 3485 const struct bucket_table *tbl;
3486
56af3268 3487 prev_sta = NULL;
4406c376 3488
7bedd0cf
JB		 3489 tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
3490
3491 for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) {
56af3268
BG		 3492 if (!prev_sta) {
3493 prev_sta = sta;
3494 continue;
3495 }
3496
3497 rx.sta = prev_sta;
3498 rx.sdata = prev_sta->sdata;
4406c376 3499 ieee80211_prepare_and_rx_handle(&rx, skb, false);
abe60632 3500
56af3268 3501 prev_sta = sta;
4406c376 3502 }
56af3268
BG		 3503
3504 if (prev_sta) {
3505 rx.sta = prev_sta;
3506 rx.sdata = prev_sta->sdata;
3507
4406c376 3508 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
56af3268 3509 return;
8e26d5ad 3510 goto out;
56af3268 3511 }
4406c376
JB		 3512 }
3513
4b0dd98e 3514 prev = NULL;
b2e7771e 3515
4b0dd98e
JB		 3516 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3517 if (!ieee80211_sdata_running(sdata))
3518 continue;
340e11f3 3519
4b0dd98e
JB		 3520 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
3521 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3522 continue;
340e11f3 3523
4b0dd98e
JB		 3524 /*
3525 * frame is destined for this interface, but if it's
3526 * not also for the previous one we handle that after
3527 * the loop to avoid copying the SKB once too much
3528 */
4bb29f8c 3529
4b0dd98e 3530 if (!prev) {
abe60632 3531 prev = sdata;
4b0dd98e 3532 continue;
340e11f3 3533 }
4bb29f8c 3534
7852e361 3535 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4b0dd98e
JB		 3536 rx.sdata = prev;
3537 ieee80211_prepare_and_rx_handle(&rx, skb, false);
4bb29f8c 3538
4b0dd98e
JB		 3539 prev = sdata;
3540 }
3541
3542 if (prev) {
7852e361 3543 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4b0dd98e 3544 rx.sdata = prev;
4406c376 3545
4b0dd98e
JB		 3546 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3547 return;
571ecf67 3548 }
4406c376 3549
8e26d5ad 3550 out:
4406c376 3551 dev_kfree_skb(skb);
571ecf67 3552}
6368e4b1
RR		 3553
3554/*
3555 * This is the receive path handler. It is called by a low level driver when an
3556 * 802.11 MPDU is received from the hardware.
3557 */
af9f9b22
JB		 3558void ieee80211_rx_napi(struct ieee80211_hw *hw, struct sk_buff *skb,
3559 struct napi_struct *napi)
6368e4b1
RR		 3560{
3561 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB		 3562 struct ieee80211_rate *rate = NULL;
3563 struct ieee80211_supported_band *sband;
f1d58c25 3564 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
8318d78a 3565
d20ef63d
JB		 3566 WARN_ON_ONCE(softirq_count() == 0);
3567
444e3803 3568 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
77a980dc 3569 goto drop;
8318d78a
JB		 3570
3571 sband = local->hw.wiphy->bands[status->band];
77a980dc
JB		 3572 if (WARN_ON(!sband))
3573 goto drop;
8318d78a 3574
89c3a8ac
JB		 3575 /*
3576 * If we're suspending, it is possible although not too likely
3577 * that we'd be receiving frames after having already partially
3578 * quiesced the stack. We can't process such frames then since
3579 * that might, for example, cause stations to be added or other
3580 * driver callbacks be invoked.
3581 */
77a980dc
JB		 3582 if (unlikely(local->quiescing || local->suspended))
3583 goto drop;
89c3a8ac 3584
04800ada
AN		 3585 /* We might be during a HW reconfig, prevent Rx for the same reason */
3586 if (unlikely(local->in_reconfig))
3587 goto drop;
3588
ea77f12f
JB		 3589 /*
3590 * The same happens when we're not even started,
3591 * but that's worth a warning.
3592 */
77a980dc
JB		 3593 if (WARN_ON(!local->started))
3594 goto drop;
ea77f12f 3595
fc885189 3596 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
e5d6eb83 3597 /*
fc885189
JB		 3598 * Validate the rate, unless a PLCP error means that
3599 * we probably can't have a valid rate here anyway.
e5d6eb83 3600 */
fc885189
JB		 3601
3602 if (status->flag & RX_FLAG_HT) {
3603 /*
3604 * rate_idx is MCS index, which can be [0-76]
3605 * as documented on:
3606 *
3607 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
3608 *
3609 * Anything else would be some sort of driver or
3610 * hardware error. The driver should catch hardware
3611 * errors.
3612 */
444e3803 3613 if (WARN(status->rate_idx > 76,
fc885189
JB		 3614 "Rate marked as an HT rate but passed "
3615 "status->rate_idx is not "
3616 "an MCS index [0-76]: %d (0x%02x)\n",
3617 status->rate_idx,
3618 status->rate_idx))
3619 goto drop;
5614618e
JB		 3620 } else if (status->flag & RX_FLAG_VHT) {
3621 if (WARN_ONCE(status->rate_idx > 9 ||
3622 !status->vht_nss ||
3623 status->vht_nss > 8,
3624 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
3625 status->rate_idx, status->vht_nss))
3626 goto drop;
fc885189 3627 } else {
444e3803 3628 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
fc885189
JB		 3629 goto drop;
3630 rate = &sband->bitrates[status->rate_idx];
3631 }
0fb8ca45 3632 }
6368e4b1 3633
554891e6
JB		 3634 status->rx_flags = 0;
3635
6368e4b1
RR		 3636 /*
3637 * key references and virtual interfaces are protected using RCU
3638 * and this requires that we are in a read-side RCU section during
3639 * receive processing
3640 */
3641 rcu_read_lock();
3642
3643 /*
3644 * Frames with failed FCS/PLCP checksum are not returned,
3645 * all other frames are returned without radiotap header
3646 * if it was previously present.
3647 * Also, frames with less than 16 bytes are dropped.
3648 */
f1d58c25 3649 skb = ieee80211_rx_monitor(local, skb, rate);
6368e4b1
RR		 3650 if (!skb) {
3651 rcu_read_unlock();
3652 return;
3653 }
3654
e1e54068
JB		 3655 ieee80211_tpt_led_trig_rx(local,
3656 ((struct ieee80211_hdr *)skb->data)->frame_control,
3657 skb->len);
af9f9b22 3658 __ieee80211_rx_handle_packet(hw, skb, napi);
6368e4b1
RR		 3659
3660 rcu_read_unlock();
77a980dc
JB		 3661
3662 return;
3663 drop:
3664 kfree_skb(skb);
6368e4b1 3665}
af9f9b22 3666EXPORT_SYMBOL(ieee80211_rx_napi);
571ecf67
JB		 3667
3668/* This is a version of the rx handler that can be called from hard irq
3669 * context. Post the skb on the queue and schedule the tasklet */
f1d58c25 3670void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
571ecf67
JB		 3671{
3672 struct ieee80211_local *local = hw_to_local(hw);
3673
3674 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
3675
571ecf67
JB		 3676 skb->pkt_type = IEEE80211_RX_MSG;
3677 skb_queue_tail(&local->skb_queue, skb);
3678 tasklet_schedule(&local->tasklet);
3679}
3680EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Linux 6.x block layer and io_uring tree(s)