1
2
3
4
5
6
7
8
9
10
11
12#include <linux/jiffies.h>
13#include <linux/slab.h>
14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
18#include <linux/rcupdate.h>
19#include <linux/export.h>
20#include <linux/bitops.h>
21#include <net/mac80211.h>
22#include <net/ieee80211_radiotap.h>
23#include <asm/unaligned.h>
24
25#include "ieee80211_i.h"
26#include "driver-ops.h"
27#include "led.h"
28#include "mesh.h"
29#include "wep.h"
30#include "wpa.h"
31#include "tkip.h"
32#include "wme.h"
33#include "rate.h"
34
35static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
36{
37 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
38
39 u64_stats_update_begin(&tstats->syncp);
40 tstats->rx_packets++;
41 tstats->rx_bytes += len;
42 u64_stats_update_end(&tstats->syncp);
43}
44
45static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
46 enum nl80211_iftype type)
47{
48 __le16 fc = hdr->frame_control;
49
50 if (ieee80211_is_data(fc)) {
51 if (len < 24)
52 return NULL;
53
54 if (ieee80211_has_a4(fc))
55 return NULL;
56 if (ieee80211_has_tods(fc))
57 return hdr->addr1;
58 if (ieee80211_has_fromds(fc))
59 return hdr->addr2;
60
61 return hdr->addr3;
62 }
63
64 if (ieee80211_is_mgmt(fc)) {
65 if (len < 24)
66 return NULL;
67 return hdr->addr3;
68 }
69
70 if (ieee80211_is_ctl(fc)) {
71 if (ieee80211_is_pspoll(fc))
72 return hdr->addr1;
73
74 if (ieee80211_is_back_req(fc)) {
75 switch (type) {
76 case NL80211_IFTYPE_STATION:
77 return hdr->addr2;
78 case NL80211_IFTYPE_AP:
79 case NL80211_IFTYPE_AP_VLAN:
80 return hdr->addr1;
81 default:
82 break;
83 }
84 }
85 }
86
87 return NULL;
88}
89
90
91
92
93
94
95
96static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
97 unsigned int present_fcs_len,
98 unsigned int rtap_space)
99{
100 struct ieee80211_hdr *hdr;
101 unsigned int hdrlen;
102 __le16 fc;
103
104 if (present_fcs_len)
105 __pskb_trim(skb, skb->len - present_fcs_len);
106 __pskb_pull(skb, rtap_space);
107
108 hdr = (void *)skb->data;
109 fc = hdr->frame_control;
110
111
112
113
114
115
116
117
118 if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
119 return skb;
120
121 hdrlen = ieee80211_hdrlen(fc);
122 hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
123
124 if (!pskb_may_pull(skb, hdrlen)) {
125 dev_kfree_skb(skb);
126 return NULL;
127 }
128
129 memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
130 hdrlen - IEEE80211_HT_CTL_LEN);
131 __pskb_pull(skb, IEEE80211_HT_CTL_LEN);
132
133 return skb;
134}
135
136static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
137 unsigned int rtap_space)
138{
139 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
140 struct ieee80211_hdr *hdr;
141
142 hdr = (void *)(skb->data + rtap_space);
143
144 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
145 RX_FLAG_FAILED_PLCP_CRC |
146 RX_FLAG_ONLY_MONITOR |
147 RX_FLAG_NO_PSDU))
148 return true;
149
150 if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
151 return true;
152
153 if (ieee80211_is_ctl(hdr->frame_control) &&
154 !ieee80211_is_pspoll(hdr->frame_control) &&
155 !ieee80211_is_back_req(hdr->frame_control))
156 return true;
157
158 return false;
159}
160
161static int
162ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
163 struct ieee80211_rx_status *status,
164 struct sk_buff *skb)
165{
166 int len;
167
168
169 len = sizeof(struct ieee80211_radiotap_header) + 8;
170
171
172 if (status->chains)
173 len += 4 * hweight8(status->chains);
174
175 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)
176 len += 4;
177
178 if (ieee80211_have_rx_timestamp(status)) {
179 len = ALIGN(len, 8);
180 len += 8;
181 }
182 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
183 len += 1;
184
185
186 if (!status->chains)
187 len += 1;
188
189
190 len = ALIGN(len, 2);
191
192 if (status->encoding == RX_ENC_HT)
193 len += 3;
194
195 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
196 len = ALIGN(len, 4);
197 len += 8;
198 }
199
200 if (status->encoding == RX_ENC_VHT) {
201 len = ALIGN(len, 2);
202 len += 12;
203 }
204
205 if (local->hw.radiotap_timestamp.units_pos >= 0) {
206 len = ALIGN(len, 8);
207 len += 12;
208 }
209
210 if (status->encoding == RX_ENC_HE &&
211 status->flag & RX_FLAG_RADIOTAP_HE) {
212 len = ALIGN(len, 2);
213 len += 12;
214 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
215 }
216
217 if (status->encoding == RX_ENC_HE &&
218 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
219 len = ALIGN(len, 2);
220 len += 12;
221 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
222 }
223
224 if (status->flag & RX_FLAG_NO_PSDU)
225 len += 1;
226
227 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
228 len = ALIGN(len, 2);
229 len += 4;
230 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
231 }
232
233 if (status->chains) {
234
235 len += 2 * hweight8(status->chains);
236 }
237
238 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
239 struct ieee80211_vendor_radiotap *rtap;
240 int vendor_data_offset = 0;
241
242
243
244
245
246 if (status->flag & RX_FLAG_RADIOTAP_HE)
247 vendor_data_offset +=
248 sizeof(struct ieee80211_radiotap_he);
249 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
250 vendor_data_offset +=
251 sizeof(struct ieee80211_radiotap_he_mu);
252 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
253 vendor_data_offset +=
254 sizeof(struct ieee80211_radiotap_lsig);
255
256 rtap = (void *)&skb->data[vendor_data_offset];
257
258
259 len = ALIGN(len, 2);
260
261 len += 6;
262 if (WARN_ON(rtap->align == 0))
263 rtap->align = 1;
264 len = ALIGN(len, rtap->align);
265 len += rtap->len + rtap->pad;
266 }
267
268 return len;
269}
270
271static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
272 struct sk_buff *skb,
273 int rtap_space)
274{
275 struct {
276 struct ieee80211_hdr_3addr hdr;
277 u8 category;
278 u8 action_code;
279 } __packed __aligned(2) action;
280
281 if (!sdata)
282 return;
283
284 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
285
286 if (skb->len < rtap_space + sizeof(action) +
287 VHT_MUMIMO_GROUPS_DATA_LEN)
288 return;
289
290 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
291 return;
292
293 skb_copy_bits(skb, rtap_space, &action, sizeof(action));
294
295 if (!ieee80211_is_action(action.hdr.frame_control))
296 return;
297
298 if (action.category != WLAN_CATEGORY_VHT)
299 return;
300
301 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
302 return;
303
304 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
305 return;
306
307 skb = skb_copy(skb, GFP_ATOMIC);
308 if (!skb)
309 return;
310
311 skb_queue_tail(&sdata->skb_queue, skb);
312 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
313}
314
315
316
317
318
319
320static void
321ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
322 struct sk_buff *skb,
323 struct ieee80211_rate *rate,
324 int rtap_len, bool has_fcs)
325{
326 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
327 struct ieee80211_radiotap_header *rthdr;
328 unsigned char *pos;
329 __le32 *it_present;
330 u32 it_present_val;
331 u16 rx_flags = 0;
332 u16 channel_flags = 0;
333 int mpdulen, chain;
334 unsigned long chains = status->chains;
335 struct ieee80211_vendor_radiotap rtap = {};
336 struct ieee80211_radiotap_he he = {};
337 struct ieee80211_radiotap_he_mu he_mu = {};
338 struct ieee80211_radiotap_lsig lsig = {};
339
340 if (status->flag & RX_FLAG_RADIOTAP_HE) {
341 he = *(struct ieee80211_radiotap_he *)skb->data;
342 skb_pull(skb, sizeof(he));
343 WARN_ON_ONCE(status->encoding != RX_ENC_HE);
344 }
345
346 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
347 he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
348 skb_pull(skb, sizeof(he_mu));
349 }
350
351 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
352 lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
353 skb_pull(skb, sizeof(lsig));
354 }
355
356 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
357 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
358
359 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
360 }
361
362 mpdulen = skb->len;
363 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
364 mpdulen += FCS_LEN;
365
366 rthdr = skb_push(skb, rtap_len);
367 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
368 it_present = &rthdr->it_present;
369
370
371 rthdr->it_len = cpu_to_le16(rtap_len);
372 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
373 BIT(IEEE80211_RADIOTAP_CHANNEL) |
374 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
375
376 if (!status->chains)
377 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
378
379 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
380 it_present_val |=
381 BIT(IEEE80211_RADIOTAP_EXT) |
382 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
383 put_unaligned_le32(it_present_val, it_present);
384 it_present++;
385 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
386 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
387 }
388
389 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
390 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
391 BIT(IEEE80211_RADIOTAP_EXT);
392 put_unaligned_le32(it_present_val, it_present);
393 it_present++;
394 it_present_val = rtap.present;
395 }
396
397 put_unaligned_le32(it_present_val, it_present);
398
399 pos = (void *)(it_present + 1);
400
401
402
403
404 if (ieee80211_have_rx_timestamp(status)) {
405
406 while ((pos - (u8 *)rthdr) & 7)
407 *pos++ = 0;
408 put_unaligned_le64(
409 ieee80211_calculate_rx_timestamp(local, status,
410 mpdulen, 0),
411 pos);
412 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
413 pos += 8;
414 }
415
416
417 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
418 *pos |= IEEE80211_RADIOTAP_F_FCS;
419 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
420 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
421 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
422 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
423 pos++;
424
425
426 if (!rate || status->encoding != RX_ENC_LEGACY) {
427
428
429
430
431
432
433 *pos = 0;
434 } else {
435 int shift = 0;
436 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
437 if (status->bw == RATE_INFO_BW_10)
438 shift = 1;
439 else if (status->bw == RATE_INFO_BW_5)
440 shift = 2;
441 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
442 }
443 pos++;
444
445
446
447 put_unaligned_le16(status->freq, pos);
448 pos += 2;
449 if (status->bw == RATE_INFO_BW_10)
450 channel_flags |= IEEE80211_CHAN_HALF;
451 else if (status->bw == RATE_INFO_BW_5)
452 channel_flags |= IEEE80211_CHAN_QUARTER;
453
454 if (status->band == NL80211_BAND_5GHZ ||
455 status->band == NL80211_BAND_6GHZ)
456 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
457 else if (status->encoding != RX_ENC_LEGACY)
458 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
459 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
460 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
461 else if (rate)
462 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
463 else
464 channel_flags |= IEEE80211_CHAN_2GHZ;
465 put_unaligned_le16(channel_flags, pos);
466 pos += 2;
467
468
469 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
470 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
471 *pos = status->signal;
472 rthdr->it_present |=
473 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
474 pos++;
475 }
476
477
478
479 if (!status->chains) {
480
481 *pos = status->antenna;
482 pos++;
483 }
484
485
486
487
488
489 if ((pos - (u8 *)rthdr) & 1)
490 *pos++ = 0;
491 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
492 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
493 put_unaligned_le16(rx_flags, pos);
494 pos += 2;
495
496 if (status->encoding == RX_ENC_HT) {
497 unsigned int stbc;
498
499 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
500 *pos++ = local->hw.radiotap_mcs_details;
501 *pos = 0;
502 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
503 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
504 if (status->bw == RATE_INFO_BW_40)
505 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
506 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
507 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
508 if (status->enc_flags & RX_ENC_FLAG_LDPC)
509 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
510 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
511 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
512 pos++;
513 *pos++ = status->rate_idx;
514 }
515
516 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
517 u16 flags = 0;
518
519
520 while ((pos - (u8 *)rthdr) & 3)
521 pos++;
522 rthdr->it_present |=
523 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
524 put_unaligned_le32(status->ampdu_reference, pos);
525 pos += 4;
526 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
527 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
528 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
529 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
530 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
531 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
532 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
533 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
534 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
535 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
536 if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
537 flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
538 put_unaligned_le16(flags, pos);
539 pos += 2;
540 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
541 *pos++ = status->ampdu_delimiter_crc;
542 else
543 *pos++ = 0;
544 *pos++ = 0;
545 }
546
547 if (status->encoding == RX_ENC_VHT) {
548 u16 known = local->hw.radiotap_vht_details;
549
550 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
551 put_unaligned_le16(known, pos);
552 pos += 2;
553
554 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
555 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
556
557 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
558 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
559 if (status->enc_flags & RX_ENC_FLAG_BF)
560 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
561 pos++;
562
563 switch (status->bw) {
564 case RATE_INFO_BW_80:
565 *pos++ = 4;
566 break;
567 case RATE_INFO_BW_160:
568 *pos++ = 11;
569 break;
570 case RATE_INFO_BW_40:
571 *pos++ = 1;
572 break;
573 default:
574 *pos++ = 0;
575 }
576
577 *pos = (status->rate_idx << 4) | status->nss;
578 pos += 4;
579
580 if (status->enc_flags & RX_ENC_FLAG_LDPC)
581 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
582 pos++;
583
584 pos++;
585
586 pos += 2;
587 }
588
589 if (local->hw.radiotap_timestamp.units_pos >= 0) {
590 u16 accuracy = 0;
591 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
592
593 rthdr->it_present |=
594 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);
595
596
597 while ((pos - (u8 *)rthdr) & 7)
598 pos++;
599
600 put_unaligned_le64(status->device_timestamp, pos);
601 pos += sizeof(u64);
602
603 if (local->hw.radiotap_timestamp.accuracy >= 0) {
604 accuracy = local->hw.radiotap_timestamp.accuracy;
605 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
606 }
607 put_unaligned_le16(accuracy, pos);
608 pos += sizeof(u16);
609
610 *pos++ = local->hw.radiotap_timestamp.units_pos;
611 *pos++ = flags;
612 }
613
614 if (status->encoding == RX_ENC_HE &&
615 status->flag & RX_FLAG_RADIOTAP_HE) {
616#define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
617
618 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
619 he.data6 |= HE_PREP(DATA6_NSTS,
620 FIELD_GET(RX_ENC_FLAG_STBC_MASK,
621 status->enc_flags));
622 he.data3 |= HE_PREP(DATA3_STBC, 1);
623 } else {
624 he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
625 }
626
627#define CHECK_GI(s) \
628 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
629 (int)NL80211_RATE_INFO_HE_GI_##s)
630
631 CHECK_GI(0_8);
632 CHECK_GI(1_6);
633 CHECK_GI(3_2);
634
635 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
636 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
637 he.data3 |= HE_PREP(DATA3_CODING,
638 !!(status->enc_flags & RX_ENC_FLAG_LDPC));
639
640 he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
641
642 switch (status->bw) {
643 case RATE_INFO_BW_20:
644 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
645 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
646 break;
647 case RATE_INFO_BW_40:
648 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
649 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
650 break;
651 case RATE_INFO_BW_80:
652 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
653 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
654 break;
655 case RATE_INFO_BW_160:
656 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
657 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
658 break;
659 case RATE_INFO_BW_HE_RU:
660#define CHECK_RU_ALLOC(s) \
661 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
662 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
663
664 CHECK_RU_ALLOC(26);
665 CHECK_RU_ALLOC(52);
666 CHECK_RU_ALLOC(106);
667 CHECK_RU_ALLOC(242);
668 CHECK_RU_ALLOC(484);
669 CHECK_RU_ALLOC(996);
670 CHECK_RU_ALLOC(2x996);
671
672 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
673 status->he_ru + 4);
674 break;
675 default:
676 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
677 }
678
679
680 while ((pos - (u8 *)rthdr) & 1)
681 pos++;
682 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE);
683 memcpy(pos, &he, sizeof(he));
684 pos += sizeof(he);
685 }
686
687 if (status->encoding == RX_ENC_HE &&
688 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
689
690 while ((pos - (u8 *)rthdr) & 1)
691 pos++;
692 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE_MU);
693 memcpy(pos, &he_mu, sizeof(he_mu));
694 pos += sizeof(he_mu);
695 }
696
697 if (status->flag & RX_FLAG_NO_PSDU) {
698 rthdr->it_present |=
699 cpu_to_le32(1 << IEEE80211_RADIOTAP_ZERO_LEN_PSDU);
700 *pos++ = status->zero_length_psdu_type;
701 }
702
703 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
704
705 while ((pos - (u8 *)rthdr) & 1)
706 pos++;
707 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_LSIG);
708 memcpy(pos, &lsig, sizeof(lsig));
709 pos += sizeof(lsig);
710 }
711
712 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
713 *pos++ = status->chain_signal[chain];
714 *pos++ = chain;
715 }
716
717 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
718
719 if ((pos - (u8 *)rthdr) & 1)
720 *pos++ = 0;
721 *pos++ = rtap.oui[0];
722 *pos++ = rtap.oui[1];
723 *pos++ = rtap.oui[2];
724 *pos++ = rtap.subns;
725 put_unaligned_le16(rtap.len, pos);
726 pos += 2;
727
728 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
729 *pos++ = 0;
730
731 }
732}
733
734static struct sk_buff *
735ieee80211_make_monitor_skb(struct ieee80211_local *local,
736 struct sk_buff **origskb,
737 struct ieee80211_rate *rate,
738 int rtap_space, bool use_origskb)
739{
740 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
741 int rt_hdrlen, needed_headroom;
742 struct sk_buff *skb;
743
744
745 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
746 needed_headroom = rt_hdrlen - rtap_space;
747
748 if (use_origskb) {
749
750 skb = *origskb;
751 *origskb = NULL;
752
753
754
755
756
757
758
759
760 if (skb_headroom(skb) < needed_headroom &&
761 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
762 dev_kfree_skb(skb);
763 return NULL;
764 }
765 } else {
766
767
768
769
770 skb = skb_copy_expand(*origskb, needed_headroom, 0, GFP_ATOMIC);
771
772 if (!skb)
773 return NULL;
774 }
775
776
777 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
778
779 skb_reset_mac_header(skb);
780 skb->ip_summed = CHECKSUM_UNNECESSARY;
781 skb->pkt_type = PACKET_OTHERHOST;
782 skb->protocol = htons(ETH_P_802_2);
783
784 return skb;
785}
786
787
788
789
790
791
792static struct sk_buff *
793ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
794 struct ieee80211_rate *rate)
795{
796 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
797 struct ieee80211_sub_if_data *sdata;
798 struct sk_buff *monskb = NULL;
799 int present_fcs_len = 0;
800 unsigned int rtap_space = 0;
801 struct ieee80211_sub_if_data *monitor_sdata =
802 rcu_dereference(local->monitor_sdata);
803 bool only_monitor = false;
804 unsigned int min_head_len;
805
806 if (status->flag & RX_FLAG_RADIOTAP_HE)
807 rtap_space += sizeof(struct ieee80211_radiotap_he);
808
809 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
810 rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
811
812 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
813 rtap_space += sizeof(struct ieee80211_radiotap_lsig);
814
815 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
816 struct ieee80211_vendor_radiotap *rtap =
817 (void *)(origskb->data + rtap_space);
818
819 rtap_space += sizeof(*rtap) + rtap->len + rtap->pad;
820 }
821
822 min_head_len = rtap_space;
823
824
825
826
827
828
829
830
831
832
833 if (!(status->flag & RX_FLAG_NO_PSDU)) {
834 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
835 if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
836
837 WARN_ON(1);
838 dev_kfree_skb(origskb);
839 return NULL;
840 }
841 present_fcs_len = FCS_LEN;
842 }
843
844
845 min_head_len += 2;
846 }
847
848
849 if (!pskb_may_pull(origskb, min_head_len)) {
850 dev_kfree_skb(origskb);
851 return NULL;
852 }
853
854 only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space);
855
856 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
857 if (only_monitor) {
858 dev_kfree_skb(origskb);
859 return NULL;
860 }
861
862 return ieee80211_clean_skb(origskb, present_fcs_len,
863 rtap_space);
864 }
865
866 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space);
867
868 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
869 bool last_monitor = list_is_last(&sdata->u.mntr.list,
870 &local->mon_list);
871
872 if (!monskb)
873 monskb = ieee80211_make_monitor_skb(local, &origskb,
874 rate, rtap_space,
875 only_monitor &&
876 last_monitor);
877
878 if (monskb) {
879 struct sk_buff *skb;
880
881 if (last_monitor) {
882 skb = monskb;
883 monskb = NULL;
884 } else {
885 skb = skb_clone(monskb, GFP_ATOMIC);
886 }
887
888 if (skb) {
889 skb->dev = sdata->dev;
890 ieee80211_rx_stats(skb->dev, skb->len);
891 netif_receive_skb(skb);
892 }
893 }
894
895 if (last_monitor)
896 break;
897 }
898
899
900 dev_kfree_skb(monskb);
901
902
903 if (!origskb)
904 return NULL;
905
906 return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space);
907}
908
909static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
910{
911 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
912 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
913 int tid, seqno_idx, security_idx;
914
915
916 if (ieee80211_is_data_qos(hdr->frame_control)) {
917 u8 *qc = ieee80211_get_qos_ctl(hdr);
918
919 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
920 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
921 status->rx_flags |= IEEE80211_RX_AMSDU;
922
923 seqno_idx = tid;
924 security_idx = tid;
925 } else {
926
927
928
929
930
931
932
933
934
935
936
937 seqno_idx = IEEE80211_NUM_TIDS;
938 security_idx = 0;
939 if (ieee80211_is_mgmt(hdr->frame_control))
940 security_idx = IEEE80211_NUM_TIDS;
941 tid = 0;
942 }
943
944 rx->seqno_idx = seqno_idx;
945 rx->security_idx = security_idx;
946
947
948 rx->skb->priority = (tid > 7) ? 0 : tid;
949}
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
977{
978#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
979 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
980#endif
981}
982
983
984
985
986static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
987{
988 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
989
990 if (is_multicast_ether_addr(hdr->addr1))
991 return 0;
992
993 return ieee80211_is_robust_mgmt_frame(skb);
994}
995
996
997static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
998{
999 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1000
1001 if (!is_multicast_ether_addr(hdr->addr1))
1002 return 0;
1003
1004 return ieee80211_is_robust_mgmt_frame(skb);
1005}
1006
1007
1008
1009static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
1010{
1011 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
1012 struct ieee80211_mmie *mmie;
1013 struct ieee80211_mmie_16 *mmie16;
1014
1015 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
1016 return -1;
1017
1018 if (!ieee80211_is_robust_mgmt_frame(skb) &&
1019 !ieee80211_is_beacon(hdr->frame_control))
1020 return -1;
1021
1022 mmie = (struct ieee80211_mmie *)
1023 (skb->data + skb->len - sizeof(*mmie));
1024 if (mmie->element_id == WLAN_EID_MMIE &&
1025 mmie->length == sizeof(*mmie) - 2)
1026 return le16_to_cpu(mmie->key_id);
1027
1028 mmie16 = (struct ieee80211_mmie_16 *)
1029 (skb->data + skb->len - sizeof(*mmie16));
1030 if (skb->len >= 24 + sizeof(*mmie16) &&
1031 mmie16->element_id == WLAN_EID_MMIE &&
1032 mmie16->length == sizeof(*mmie16) - 2)
1033 return le16_to_cpu(mmie16->key_id);
1034
1035 return -1;
1036}
1037
1038static int ieee80211_get_keyid(struct sk_buff *skb,
1039 const struct ieee80211_cipher_scheme *cs)
1040{
1041 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1042 __le16 fc;
1043 int hdrlen;
1044 int minlen;
1045 u8 key_idx_off;
1046 u8 key_idx_shift;
1047 u8 keyid;
1048
1049 fc = hdr->frame_control;
1050 hdrlen = ieee80211_hdrlen(fc);
1051
1052 if (cs) {
1053 minlen = hdrlen + cs->hdr_len;
1054 key_idx_off = hdrlen + cs->key_idx_off;
1055 key_idx_shift = cs->key_idx_shift;
1056 } else {
1057
1058 minlen = hdrlen + IEEE80211_WEP_IV_LEN;
1059 key_idx_off = hdrlen + 3;
1060 key_idx_shift = 6;
1061 }
1062
1063 if (unlikely(skb->len < minlen))
1064 return -EINVAL;
1065
1066 skb_copy_bits(skb, key_idx_off, &keyid, 1);
1067
1068 if (cs)
1069 keyid &= cs->key_idx_mask;
1070 keyid >>= key_idx_shift;
1071
1072
1073 if (unlikely(keyid >= NUM_DEFAULT_KEYS))
1074 return -EINVAL;
1075
1076 return keyid;
1077}
1078
1079static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1080{
1081 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1082 char *dev_addr = rx->sdata->vif.addr;
1083
1084 if (ieee80211_is_data(hdr->frame_control)) {
1085 if (is_multicast_ether_addr(hdr->addr1)) {
1086 if (ieee80211_has_tods(hdr->frame_control) ||
1087 !ieee80211_has_fromds(hdr->frame_control))
1088 return RX_DROP_MONITOR;
1089 if (ether_addr_equal(hdr->addr3, dev_addr))
1090 return RX_DROP_MONITOR;
1091 } else {
1092 if (!ieee80211_has_a4(hdr->frame_control))
1093 return RX_DROP_MONITOR;
1094 if (ether_addr_equal(hdr->addr4, dev_addr))
1095 return RX_DROP_MONITOR;
1096 }
1097 }
1098
1099
1100
1101
1102
1103 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
1104 struct ieee80211_mgmt *mgmt;
1105
1106 if (!ieee80211_is_mgmt(hdr->frame_control))
1107 return RX_DROP_MONITOR;
1108
1109 if (ieee80211_is_action(hdr->frame_control)) {
1110 u8 category;
1111
1112
1113 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
1114 return RX_DROP_MONITOR;
1115
1116 mgmt = (struct ieee80211_mgmt *)hdr;
1117 category = mgmt->u.action.category;
1118 if (category != WLAN_CATEGORY_MESH_ACTION &&
1119 category != WLAN_CATEGORY_SELF_PROTECTED)
1120 return RX_DROP_MONITOR;
1121 return RX_CONTINUE;
1122 }
1123
1124 if (ieee80211_is_probe_req(hdr->frame_control) ||
1125 ieee80211_is_probe_resp(hdr->frame_control) ||
1126 ieee80211_is_beacon(hdr->frame_control) ||
1127 ieee80211_is_auth(hdr->frame_control))
1128 return RX_CONTINUE;
1129
1130 return RX_DROP_MONITOR;
1131 }
1132
1133 return RX_CONTINUE;
1134}
1135
1136static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1137 int index)
1138{
1139 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1140 struct sk_buff *tail = skb_peek_tail(frames);
1141 struct ieee80211_rx_status *status;
1142
1143 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1144 return true;
1145
1146 if (!tail)
1147 return false;
1148
1149 status = IEEE80211_SKB_RXCB(tail);
1150 if (status->flag & RX_FLAG_AMSDU_MORE)
1151 return false;
1152
1153 return true;
1154}
1155
1156static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1157 struct tid_ampdu_rx *tid_agg_rx,
1158 int index,
1159 struct sk_buff_head *frames)
1160{
1161 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1162 struct sk_buff *skb;
1163 struct ieee80211_rx_status *status;
1164
1165 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1166
1167 if (skb_queue_empty(skb_list))
1168 goto no_frame;
1169
1170 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1171 __skb_queue_purge(skb_list);
1172 goto no_frame;
1173 }
1174
1175
1176 tid_agg_rx->stored_mpdu_num--;
1177 while ((skb = __skb_dequeue(skb_list))) {
1178 status = IEEE80211_SKB_RXCB(skb);
1179 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1180 __skb_queue_tail(frames, skb);
1181 }
1182
1183no_frame:
1184 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1185 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1186}
1187
1188static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1189 struct tid_ampdu_rx *tid_agg_rx,
1190 u16 head_seq_num,
1191 struct sk_buff_head *frames)
1192{
1193 int index;
1194
1195 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1196
1197 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
1198 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1199 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1200 frames);
1201 }
1202}
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1214
1215static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1216 struct tid_ampdu_rx *tid_agg_rx,
1217 struct sk_buff_head *frames)
1218{
1219 int index, i, j;
1220
1221 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1222
1223
1224 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1225 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1226 tid_agg_rx->stored_mpdu_num) {
1227
1228
1229
1230
1231 int skipped = 1;
1232 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1233 j = (j + 1) % tid_agg_rx->buf_size) {
1234 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
1235 skipped++;
1236 continue;
1237 }
1238 if (skipped &&
1239 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
1240 HT_RX_REORDER_BUF_TIMEOUT))
1241 goto set_release_timer;
1242
1243
1244 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1245 i = (i + 1) % tid_agg_rx->buf_size)
1246 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
1247
1248 ht_dbg_ratelimited(sdata,
1249 "release an RX reorder frame due to timeout on earlier frames\n");
1250 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1251 frames);
1252
1253
1254
1255
1256 tid_agg_rx->head_seq_num =
1257 (tid_agg_rx->head_seq_num +
1258 skipped) & IEEE80211_SN_MASK;
1259 skipped = 0;
1260 }
1261 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1262 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1263 frames);
1264 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1265 }
1266
1267 if (tid_agg_rx->stored_mpdu_num) {
1268 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1269
1270 for (; j != (index - 1) % tid_agg_rx->buf_size;
1271 j = (j + 1) % tid_agg_rx->buf_size) {
1272 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
1273 break;
1274 }
1275
1276 set_release_timer:
1277
1278 if (!tid_agg_rx->removed)
1279 mod_timer(&tid_agg_rx->reorder_timer,
1280 tid_agg_rx->reorder_time[j] + 1 +
1281 HT_RX_REORDER_BUF_TIMEOUT);
1282 } else {
1283 del_timer(&tid_agg_rx->reorder_timer);
1284 }
1285}
1286
1287
1288
1289
1290
1291
1292static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1293 struct tid_ampdu_rx *tid_agg_rx,
1294 struct sk_buff *skb,
1295 struct sk_buff_head *frames)
1296{
1297 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1298 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1299 u16 sc = le16_to_cpu(hdr->seq_ctrl);
1300 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1301 u16 head_seq_num, buf_size;
1302 int index;
1303 bool ret = true;
1304
1305 spin_lock(&tid_agg_rx->reorder_lock);
1306
1307
1308
1309
1310
1311 if (unlikely(tid_agg_rx->auto_seq)) {
1312 tid_agg_rx->auto_seq = false;
1313 tid_agg_rx->ssn = mpdu_seq_num;
1314 tid_agg_rx->head_seq_num = mpdu_seq_num;
1315 }
1316
1317 buf_size = tid_agg_rx->buf_size;
1318 head_seq_num = tid_agg_rx->head_seq_num;
1319
1320
1321
1322
1323
1324 if (unlikely(!tid_agg_rx->started)) {
1325 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1326 ret = false;
1327 goto out;
1328 }
1329 tid_agg_rx->started = true;
1330 }
1331
1332
1333 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1334 dev_kfree_skb(skb);
1335 goto out;
1336 }
1337
1338
1339
1340
1341
1342 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1343 head_seq_num = ieee80211_sn_inc(
1344 ieee80211_sn_sub(mpdu_seq_num, buf_size));
1345
1346 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1347 head_seq_num, frames);
1348 }
1349
1350
1351
1352 index = mpdu_seq_num % tid_agg_rx->buf_size;
1353
1354
1355 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1356 dev_kfree_skb(skb);
1357 goto out;
1358 }
1359
1360
1361
1362
1363
1364
1365
1366 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1367 tid_agg_rx->stored_mpdu_num == 0) {
1368 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1369 tid_agg_rx->head_seq_num =
1370 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1371 ret = false;
1372 goto out;
1373 }
1374
1375
1376 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1377 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1378 tid_agg_rx->reorder_time[index] = jiffies;
1379 tid_agg_rx->stored_mpdu_num++;
1380 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1381 }
1382
1383 out:
1384 spin_unlock(&tid_agg_rx->reorder_lock);
1385 return ret;
1386}
1387
1388
1389
1390
1391
1392static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1393 struct sk_buff_head *frames)
1394{
1395 struct sk_buff *skb = rx->skb;
1396 struct ieee80211_local *local = rx->local;
1397 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1398 struct sta_info *sta = rx->sta;
1399 struct tid_ampdu_rx *tid_agg_rx;
1400 u16 sc;
1401 u8 tid, ack_policy;
1402
1403 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1404 is_multicast_ether_addr(hdr->addr1))
1405 goto dont_reorder;
1406
1407
1408
1409
1410
1411
1412 if (!sta)
1413 goto dont_reorder;
1414
1415 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1416 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1417 tid = ieee80211_get_tid(hdr);
1418
1419 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1420 if (!tid_agg_rx) {
1421 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1422 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1423 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1424 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1425 WLAN_BACK_RECIPIENT,
1426 WLAN_REASON_QSTA_REQUIRE_SETUP);
1427 goto dont_reorder;
1428 }
1429
1430
1431 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1432 goto dont_reorder;
1433
1434
1435 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1436 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1437 goto dont_reorder;
1438
1439
1440
1441
1442 if (tid_agg_rx->timeout)
1443 tid_agg_rx->last_rx = jiffies;
1444
1445
1446 sc = le16_to_cpu(hdr->seq_ctrl);
1447 if (sc & IEEE80211_SCTL_FRAG) {
1448 skb_queue_tail(&rx->sdata->skb_queue, skb);
1449 ieee80211_queue_work(&local->hw, &rx->sdata->work);
1450 return;
1451 }
1452
1453
1454
1455
1456
1457
1458
1459
1460 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1461 frames))
1462 return;
1463
1464 dont_reorder:
1465 __skb_queue_tail(frames, skb);
1466}
1467
1468static ieee80211_rx_result debug_noinline
1469ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1470{
1471 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1472 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1473
1474 if (status->flag & RX_FLAG_DUP_VALIDATED)
1475 return RX_CONTINUE;
1476
1477
1478
1479
1480
1481
1482 if (rx->skb->len < 24)
1483 return RX_CONTINUE;
1484
1485 if (ieee80211_is_ctl(hdr->frame_control) ||
1486 ieee80211_is_any_nullfunc(hdr->frame_control) ||
1487 is_multicast_ether_addr(hdr->addr1))
1488 return RX_CONTINUE;
1489
1490 if (!rx->sta)
1491 return RX_CONTINUE;
1492
1493 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1494 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1495 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1496 rx->sta->rx_stats.num_duplicates++;
1497 return RX_DROP_UNUSABLE;
1498 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1499 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1500 }
1501
1502 return RX_CONTINUE;
1503}
1504
1505static ieee80211_rx_result debug_noinline
1506ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1507{
1508 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1520 return ieee80211_rx_mesh_check(rx);
1521
1522 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1523 ieee80211_is_pspoll(hdr->frame_control)) &&
1524 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1525 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1526 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1527 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1528
1529
1530
1531
1532
1533 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1534 ieee80211_is_data_present(hdr->frame_control)) {
1535 unsigned int hdrlen;
1536 __be16 ethertype;
1537
1538 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1539
1540 if (rx->skb->len < hdrlen + 8)
1541 return RX_DROP_MONITOR;
1542
1543 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2);
1544 if (ethertype == rx->sdata->control_port_protocol)
1545 return RX_CONTINUE;
1546 }
1547
1548 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1549 cfg80211_rx_spurious_frame(rx->sdata->dev,
1550 hdr->addr2,
1551 GFP_ATOMIC))
1552 return RX_DROP_UNUSABLE;
1553
1554 return RX_DROP_MONITOR;
1555 }
1556
1557 return RX_CONTINUE;
1558}
1559
1560
1561static ieee80211_rx_result debug_noinline
1562ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1563{
1564 struct ieee80211_local *local;
1565 struct ieee80211_hdr *hdr;
1566 struct sk_buff *skb;
1567
1568 local = rx->local;
1569 skb = rx->skb;
1570 hdr = (struct ieee80211_hdr *) skb->data;
1571
1572 if (!local->pspolling)
1573 return RX_CONTINUE;
1574
1575 if (!ieee80211_has_fromds(hdr->frame_control))
1576
1577 return RX_CONTINUE;
1578
1579 if (!ieee80211_is_data(hdr->frame_control))
1580 return RX_CONTINUE;
1581
1582 if (!ieee80211_has_moredata(hdr->frame_control)) {
1583
1584 local->pspolling = false;
1585 return RX_CONTINUE;
1586 }
1587
1588
1589 ieee80211_send_pspoll(local, rx->sdata);
1590
1591 return RX_CONTINUE;
1592}
1593
1594static void sta_ps_start(struct sta_info *sta)
1595{
1596 struct ieee80211_sub_if_data *sdata = sta->sdata;
1597 struct ieee80211_local *local = sdata->local;
1598 struct ps_data *ps;
1599 int tid;
1600
1601 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1602 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1603 ps = &sdata->bss->ps;
1604 else
1605 return;
1606
1607 atomic_inc(&ps->num_sta_ps);
1608 set_sta_flag(sta, WLAN_STA_PS_STA);
1609 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1610 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1611 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1612 sta->sta.addr, sta->sta.aid);
1613
1614 ieee80211_clear_fast_xmit(sta);
1615
1616 if (!sta->sta.txq[0])
1617 return;
1618
1619 for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1620 struct ieee80211_txq *txq = sta->sta.txq[tid];
1621 struct txq_info *txqi = to_txq_info(txq);
1622
1623 spin_lock(&local->active_txq_lock[txq->ac]);
1624 if (!list_empty(&txqi->schedule_order))
1625 list_del_init(&txqi->schedule_order);
1626 spin_unlock(&local->active_txq_lock[txq->ac]);
1627
1628 if (txq_has_queue(txq))
1629 set_bit(tid, &sta->txq_buffered_tids);
1630 else
1631 clear_bit(tid, &sta->txq_buffered_tids);
1632 }
1633}
1634
1635static void sta_ps_end(struct sta_info *sta)
1636{
1637 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1638 sta->sta.addr, sta->sta.aid);
1639
1640 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1641
1642
1643
1644
1645
1646
1647 clear_sta_flag(sta, WLAN_STA_PS_STA);
1648 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1649 sta->sta.addr, sta->sta.aid);
1650 return;
1651 }
1652
1653 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1654 clear_sta_flag(sta, WLAN_STA_PS_STA);
1655 ieee80211_sta_ps_deliver_wakeup(sta);
1656}
1657
1658int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1659{
1660 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1661 bool in_ps;
1662
1663 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1664
1665
1666 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1667 if ((start && in_ps) || (!start && !in_ps))
1668 return -EINVAL;
1669
1670 if (start)
1671 sta_ps_start(sta);
1672 else
1673 sta_ps_end(sta);
1674
1675 return 0;
1676}
1677EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1678
1679void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1680{
1681 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1682
1683 if (test_sta_flag(sta, WLAN_STA_SP))
1684 return;
1685
1686 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1687 ieee80211_sta_ps_deliver_poll_response(sta);
1688 else
1689 set_sta_flag(sta, WLAN_STA_PSPOLL);
1690}
1691EXPORT_SYMBOL(ieee80211_sta_pspoll);
1692
1693void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1694{
1695 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1696 int ac = ieee80211_ac_from_tid(tid);
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1707 tid != IEEE80211_NUM_TIDS)
1708 return;
1709
1710
1711 if (test_sta_flag(sta, WLAN_STA_SP))
1712 return;
1713
1714 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1715 ieee80211_sta_ps_deliver_uapsd(sta);
1716 else
1717 set_sta_flag(sta, WLAN_STA_UAPSD);
1718}
1719EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1720
1721static ieee80211_rx_result debug_noinline
1722ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1723{
1724 struct ieee80211_sub_if_data *sdata = rx->sdata;
1725 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1726 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1727
1728 if (!rx->sta)
1729 return RX_CONTINUE;
1730
1731 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1732 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1733 return RX_CONTINUE;
1734
1735
1736
1737
1738
1739
1740 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1741 return RX_CONTINUE;
1742
1743
1744
1745
1746
1747
1748 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1749 return RX_CONTINUE;
1750
1751 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1752 ieee80211_sta_pspoll(&rx->sta->sta);
1753
1754
1755
1756 dev_kfree_skb(rx->skb);
1757
1758 return RX_QUEUED;
1759 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1760 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1761 ieee80211_has_pm(hdr->frame_control) &&
1762 (ieee80211_is_data_qos(hdr->frame_control) ||
1763 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1764 u8 tid = ieee80211_get_tid(hdr);
1765
1766 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1767 }
1768
1769 return RX_CONTINUE;
1770}
1771
1772static ieee80211_rx_result debug_noinline
1773ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1774{
1775 struct sta_info *sta = rx->sta;
1776 struct sk_buff *skb = rx->skb;
1777 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1778 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1779 int i;
1780
1781 if (!sta)
1782 return RX_CONTINUE;
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1793 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1794 NL80211_IFTYPE_ADHOC);
1795 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1796 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1797 sta->rx_stats.last_rx = jiffies;
1798 if (ieee80211_is_data(hdr->frame_control) &&
1799 !is_multicast_ether_addr(hdr->addr1))
1800 sta->rx_stats.last_rate =
1801 sta_stats_encode_rate(status);
1802 }
1803 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1804 sta->rx_stats.last_rx = jiffies;
1805 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1806
1807
1808
1809
1810 sta->rx_stats.last_rx = jiffies;
1811 if (ieee80211_is_data(hdr->frame_control))
1812 sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1813 }
1814
1815 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1816 ieee80211_sta_rx_notify(rx->sdata, hdr);
1817
1818 sta->rx_stats.fragments++;
1819
1820 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
1821 sta->rx_stats.bytes += rx->skb->len;
1822 u64_stats_update_end(&rx->sta->rx_stats.syncp);
1823
1824 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1825 sta->rx_stats.last_signal = status->signal;
1826 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal);
1827 }
1828
1829 if (status->chains) {
1830 sta->rx_stats.chains = status->chains;
1831 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1832 int signal = status->chain_signal[i];
1833
1834 if (!(status->chains & BIT(i)))
1835 continue;
1836
1837 sta->rx_stats.chain_signal_last[i] = signal;
1838 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
1839 -signal);
1840 }
1841 }
1842
1843
1844
1845
1846
1847
1848 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1849 !ieee80211_has_morefrags(hdr->frame_control) &&
1850 !is_multicast_ether_addr(hdr->addr1) &&
1851 (ieee80211_is_mgmt(hdr->frame_control) ||
1852 ieee80211_is_data(hdr->frame_control)) &&
1853 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1854 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1855 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1856 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1857 if (!ieee80211_has_pm(hdr->frame_control))
1858 sta_ps_end(sta);
1859 } else {
1860 if (ieee80211_has_pm(hdr->frame_control))
1861 sta_ps_start(sta);
1862 }
1863 }
1864
1865
1866 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1867 ieee80211_mps_rx_h_sta_process(sta, hdr);
1868
1869
1870
1871
1872
1873 if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
1874 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1875
1876
1877
1878
1879
1880
1881
1882 if (ieee80211_has_a4(hdr->frame_control) &&
1883 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1884 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1885 !rx->sdata->u.vlan.sta))) {
1886 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1887 cfg80211_rx_unexpected_4addr_frame(
1888 rx->sdata->dev, sta->sta.addr,
1889 GFP_ATOMIC);
1890 return RX_DROP_MONITOR;
1891 }
1892
1893
1894
1895
1896 sta->rx_stats.packets++;
1897 dev_kfree_skb(rx->skb);
1898 return RX_QUEUED;
1899 }
1900
1901 return RX_CONTINUE;
1902}
1903
1904static struct ieee80211_key *
1905ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1906{
1907 struct ieee80211_key *key = NULL;
1908 struct ieee80211_sub_if_data *sdata = rx->sdata;
1909 int idx2;
1910
1911
1912
1913
1914
1915
1916
1917 if (idx < 0) {
1918 idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
1919 idx2 = idx + 1;
1920 } else {
1921 if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1922 idx2 = idx + 1;
1923 else
1924 idx2 = idx - 1;
1925 }
1926
1927 if (rx->sta)
1928 key = rcu_dereference(rx->sta->gtk[idx]);
1929 if (!key)
1930 key = rcu_dereference(sdata->keys[idx]);
1931 if (!key && rx->sta)
1932 key = rcu_dereference(rx->sta->gtk[idx2]);
1933 if (!key)
1934 key = rcu_dereference(sdata->keys[idx2]);
1935
1936 return key;
1937}
1938
1939static ieee80211_rx_result debug_noinline
1940ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1941{
1942 struct sk_buff *skb = rx->skb;
1943 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1944 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1945 int keyidx;
1946 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1947 struct ieee80211_key *sta_ptk = NULL;
1948 struct ieee80211_key *ptk_idx = NULL;
1949 int mmie_keyidx = -1;
1950 __le16 fc;
1951 const struct ieee80211_cipher_scheme *cs = NULL;
1952
1953
1954
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968
1969
1970
1971
1972
1973
1974
1975
1976
1977
1978
1979
1980
1981
1982 rx->key = NULL;
1983 fc = hdr->frame_control;
1984
1985 if (rx->sta) {
1986 int keyid = rx->sta->ptk_idx;
1987 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1988
1989 if (ieee80211_has_protected(fc)) {
1990 cs = rx->sta->cipher_scheme;
1991 keyid = ieee80211_get_keyid(rx->skb, cs);
1992
1993 if (unlikely(keyid < 0))
1994 return RX_DROP_UNUSABLE;
1995
1996 ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
1997 }
1998 }
1999
2000 if (!ieee80211_has_protected(fc))
2001 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
2002
2003 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
2004 rx->key = ptk_idx ? ptk_idx : sta_ptk;
2005 if ((status->flag & RX_FLAG_DECRYPTED) &&
2006 (status->flag & RX_FLAG_IV_STRIPPED))
2007 return RX_CONTINUE;
2008
2009 if (!ieee80211_has_protected(fc))
2010 return RX_CONTINUE;
2011 } else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
2012
2013 if ((status->flag & RX_FLAG_DECRYPTED) &&
2014 (status->flag & RX_FLAG_IV_STRIPPED))
2015 return RX_CONTINUE;
2016
2017 if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
2018 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
2019 NUM_DEFAULT_BEACON_KEYS) {
2020 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2021 skb->data,
2022 skb->len);
2023 return RX_DROP_MONITOR;
2024 }
2025
2026 rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
2027 if (!rx->key)
2028 return RX_CONTINUE;
2029 } else if (mmie_keyidx >= 0) {
2030
2031 if ((status->flag & RX_FLAG_DECRYPTED) &&
2032 (status->flag & RX_FLAG_IV_STRIPPED))
2033 return RX_CONTINUE;
2034
2035 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
2036 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2037 return RX_DROP_MONITOR;
2038 if (rx->sta) {
2039 if (ieee80211_is_group_privacy_action(skb) &&
2040 test_sta_flag(rx->sta, WLAN_STA_MFP))
2041 return RX_DROP_MONITOR;
2042
2043 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
2044 }
2045 if (!rx->key)
2046 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
2047 } else if (!ieee80211_has_protected(fc)) {
2048
2049
2050
2051
2052
2053
2054 struct ieee80211_key *key = NULL;
2055 struct ieee80211_sub_if_data *sdata = rx->sdata;
2056 int i;
2057
2058 if (ieee80211_is_beacon(fc)) {
2059 key = ieee80211_rx_get_bigtk(rx, -1);
2060 } else if (ieee80211_is_mgmt(fc) &&
2061 is_multicast_ether_addr(hdr->addr1)) {
2062 key = rcu_dereference(rx->sdata->default_mgmt_key);
2063 } else {
2064 if (rx->sta) {
2065 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2066 key = rcu_dereference(rx->sta->gtk[i]);
2067 if (key)
2068 break;
2069 }
2070 }
2071 if (!key) {
2072 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2073 key = rcu_dereference(sdata->keys[i]);
2074 if (key)
2075 break;
2076 }
2077 }
2078 }
2079 if (key)
2080 rx->key = key;
2081 return RX_CONTINUE;
2082 } else {
2083
2084
2085
2086
2087
2088
2089
2090
2091
2092 if ((status->flag & RX_FLAG_DECRYPTED) &&
2093 (status->flag & RX_FLAG_IV_STRIPPED))
2094 return RX_CONTINUE;
2095
2096 keyidx = ieee80211_get_keyid(rx->skb, cs);
2097
2098 if (unlikely(keyidx < 0))
2099 return RX_DROP_UNUSABLE;
2100
2101
2102 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
2103 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
2104
2105
2106 if (!rx->key) {
2107 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2108
2109
2110
2111
2112
2113
2114 if (rx->key &&
2115 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2116 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2117 !is_multicast_ether_addr(hdr->addr1))
2118 rx->key = NULL;
2119 }
2120 }
2121
2122 if (rx->key) {
2123 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2124 return RX_DROP_MONITOR;
2125
2126
2127 } else {
2128 return RX_DROP_MONITOR;
2129 }
2130
2131 switch (rx->key->conf.cipher) {
2132 case WLAN_CIPHER_SUITE_WEP40:
2133 case WLAN_CIPHER_SUITE_WEP104:
2134 result = ieee80211_crypto_wep_decrypt(rx);
2135 break;
2136 case WLAN_CIPHER_SUITE_TKIP:
2137 result = ieee80211_crypto_tkip_decrypt(rx);
2138 break;
2139 case WLAN_CIPHER_SUITE_CCMP:
2140 result = ieee80211_crypto_ccmp_decrypt(
2141 rx, IEEE80211_CCMP_MIC_LEN);
2142 break;
2143 case WLAN_CIPHER_SUITE_CCMP_256:
2144 result = ieee80211_crypto_ccmp_decrypt(
2145 rx, IEEE80211_CCMP_256_MIC_LEN);
2146 break;
2147 case WLAN_CIPHER_SUITE_AES_CMAC:
2148 result = ieee80211_crypto_aes_cmac_decrypt(rx);
2149 break;
2150 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2151 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
2152 break;
2153 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2154 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2155 result = ieee80211_crypto_aes_gmac_decrypt(rx);
2156 break;
2157 case WLAN_CIPHER_SUITE_GCMP:
2158 case WLAN_CIPHER_SUITE_GCMP_256:
2159 result = ieee80211_crypto_gcmp_decrypt(rx);
2160 break;
2161 default:
2162 result = ieee80211_crypto_hw_decrypt(rx);
2163 }
2164
2165
2166
2167
2168 status->flag |= RX_FLAG_DECRYPTED;
2169
2170 if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE))
2171 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2172 skb->data, skb->len);
2173
2174 return result;
2175}
2176
2177static inline struct ieee80211_fragment_entry *
2178ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
2179 unsigned int frag, unsigned int seq, int rx_queue,
2180 struct sk_buff **skb)
2181{
2182 struct ieee80211_fragment_entry *entry;
2183
2184 entry = &sdata->fragments[sdata->fragment_next++];
2185 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
2186 sdata->fragment_next = 0;
2187
2188 if (!skb_queue_empty(&entry->skb_list))
2189 __skb_queue_purge(&entry->skb_list);
2190
2191 __skb_queue_tail(&entry->skb_list, *skb);
2192 *skb = NULL;
2193 entry->first_frag_time = jiffies;
2194 entry->seq = seq;
2195 entry->rx_queue = rx_queue;
2196 entry->last_frag = frag;
2197 entry->check_sequential_pn = false;
2198 entry->extra_len = 0;
2199
2200 return entry;
2201}
2202
2203static inline struct ieee80211_fragment_entry *
2204ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
2205 unsigned int frag, unsigned int seq,
2206 int rx_queue, struct ieee80211_hdr *hdr)
2207{
2208 struct ieee80211_fragment_entry *entry;
2209 int i, idx;
2210
2211 idx = sdata->fragment_next;
2212 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2213 struct ieee80211_hdr *f_hdr;
2214 struct sk_buff *f_skb;
2215
2216 idx--;
2217 if (idx < 0)
2218 idx = IEEE80211_FRAGMENT_MAX - 1;
2219
2220 entry = &sdata->fragments[idx];
2221 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2222 entry->rx_queue != rx_queue ||
2223 entry->last_frag + 1 != frag)
2224 continue;
2225
2226 f_skb = __skb_peek(&entry->skb_list);
2227 f_hdr = (struct ieee80211_hdr *) f_skb->data;
2228
2229
2230
2231
2232 if (((hdr->frame_control ^ f_hdr->frame_control) &
2233 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2234 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
2235 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
2236 continue;
2237
2238 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2239 __skb_queue_purge(&entry->skb_list);
2240 continue;
2241 }
2242 return entry;
2243 }
2244
2245 return NULL;
2246}
2247
2248static ieee80211_rx_result debug_noinline
2249ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2250{
2251 struct ieee80211_hdr *hdr;
2252 u16 sc;
2253 __le16 fc;
2254 unsigned int frag, seq;
2255 struct ieee80211_fragment_entry *entry;
2256 struct sk_buff *skb;
2257
2258 hdr = (struct ieee80211_hdr *)rx->skb->data;
2259 fc = hdr->frame_control;
2260
2261 if (ieee80211_is_ctl(fc))
2262 return RX_CONTINUE;
2263
2264 sc = le16_to_cpu(hdr->seq_ctrl);
2265 frag = sc & IEEE80211_SCTL_FRAG;
2266
2267 if (is_multicast_ether_addr(hdr->addr1)) {
2268 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
2269 goto out_no_led;
2270 }
2271
2272 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2273 goto out;
2274
2275 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2276
2277 if (skb_linearize(rx->skb))
2278 return RX_DROP_UNUSABLE;
2279
2280
2281
2282
2283
2284
2285 hdr = (struct ieee80211_hdr *)rx->skb->data;
2286 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2287
2288 if (frag == 0) {
2289
2290 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
2291 rx->seqno_idx, &(rx->skb));
2292 if (rx->key &&
2293 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2294 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2295 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2296 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2297 ieee80211_has_protected(fc)) {
2298 int queue = rx->security_idx;
2299
2300
2301
2302
2303 entry->check_sequential_pn = true;
2304 memcpy(entry->last_pn,
2305 rx->key->u.ccmp.rx_pn[queue],
2306 IEEE80211_CCMP_PN_LEN);
2307 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2308 u.ccmp.rx_pn) !=
2309 offsetof(struct ieee80211_key,
2310 u.gcmp.rx_pn));
2311 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2312 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2313 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2314 IEEE80211_GCMP_PN_LEN);
2315 }
2316 return RX_QUEUED;
2317 }
2318
2319
2320
2321
2322 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
2323 rx->seqno_idx, hdr);
2324 if (!entry) {
2325 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2326 return RX_DROP_MONITOR;
2327 }
2328
2329
2330
2331
2332
2333
2334 if (entry->check_sequential_pn) {
2335 int i;
2336 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2337 int queue;
2338
2339 if (!rx->key ||
2340 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
2341 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
2342 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
2343 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
2344 return RX_DROP_UNUSABLE;
2345 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2346 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2347 pn[i]++;
2348 if (pn[i])
2349 break;
2350 }
2351 queue = rx->security_idx;
2352 rpn = rx->key->u.ccmp.rx_pn[queue];
2353 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
2354 return RX_DROP_UNUSABLE;
2355 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2356 }
2357
2358 skb_pull(rx->skb, ieee80211_hdrlen(fc));
2359 __skb_queue_tail(&entry->skb_list, rx->skb);
2360 entry->last_frag = frag;
2361 entry->extra_len += rx->skb->len;
2362 if (ieee80211_has_morefrags(fc)) {
2363 rx->skb = NULL;
2364 return RX_QUEUED;
2365 }
2366
2367 rx->skb = __skb_dequeue(&entry->skb_list);
2368 if (skb_tailroom(rx->skb) < entry->extra_len) {
2369 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2370 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2371 GFP_ATOMIC))) {
2372 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2373 __skb_queue_purge(&entry->skb_list);
2374 return RX_DROP_UNUSABLE;
2375 }
2376 }
2377 while ((skb = __skb_dequeue(&entry->skb_list))) {
2378 skb_put_data(rx->skb, skb->data, skb->len);
2379 dev_kfree_skb(skb);
2380 }
2381
2382 out:
2383 ieee80211_led_rx(rx->local);
2384 out_no_led:
2385 if (rx->sta)
2386 rx->sta->rx_stats.packets++;
2387 return RX_CONTINUE;
2388}
2389
2390static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2391{
2392 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2393 return -EACCES;
2394
2395 return 0;
2396}
2397
2398static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2399{
2400 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
2401 struct sk_buff *skb = rx->skb;
2402 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2403
2404
2405
2406
2407
2408 if (status->flag & RX_FLAG_DECRYPTED)
2409 return 0;
2410
2411
2412 if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
2413 ieee80211_is_data(fc))) {
2414 struct ieee80211s_hdr *mesh_hdr;
2415 u16 hdr_len = ieee80211_hdrlen(fc);
2416 u16 ethertype_offset;
2417 __be16 ethertype;
2418
2419 if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
2420 goto drop_check;
2421
2422
2423 if (!pskb_may_pull(rx->skb, hdr_len + 6))
2424 goto drop_check;
2425
2426 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
2427 ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
2428 sizeof(rfc1042_header);
2429
2430 if (skb_copy_bits(rx->skb, ethertype_offset, ðertype, 2) == 0 &&
2431 ethertype == rx->sdata->control_port_protocol)
2432 return 0;
2433 }
2434
2435drop_check:
2436
2437 if (unlikely(!ieee80211_has_protected(fc) &&
2438 !ieee80211_is_any_nullfunc(fc) &&
2439 ieee80211_is_data(fc) && rx->key))
2440 return -EACCES;
2441
2442 return 0;
2443}
2444
2445static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2446{
2447 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2448 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2449 __le16 fc = hdr->frame_control;
2450
2451
2452
2453
2454
2455 if (status->flag & RX_FLAG_DECRYPTED)
2456 return 0;
2457
2458 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2459 if (unlikely(!ieee80211_has_protected(fc) &&
2460 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
2461 rx->key)) {
2462 if (ieee80211_is_deauth(fc) ||
2463 ieee80211_is_disassoc(fc))
2464 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2465 rx->skb->data,
2466 rx->skb->len);
2467 return -EACCES;
2468 }
2469
2470 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2471 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2472 if (ieee80211_is_deauth(fc) ||
2473 ieee80211_is_disassoc(fc))
2474 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2475 rx->skb->data,
2476 rx->skb->len);
2477 return -EACCES;
2478 }
2479 if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2480 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2481 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2482 rx->skb->data,
2483 rx->skb->len);
2484 return -EACCES;
2485 }
2486
2487
2488
2489
2490 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2491 ieee80211_is_robust_mgmt_frame(rx->skb)))
2492 return -EACCES;
2493 }
2494
2495 return 0;
2496}
2497
2498static int
2499__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2500{
2501 struct ieee80211_sub_if_data *sdata = rx->sdata;
2502 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2503 bool check_port_control = false;
2504 struct ethhdr *ehdr;
2505 int ret;
2506
2507 *port_control = false;
2508 if (ieee80211_has_a4(hdr->frame_control) &&
2509 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2510 return -1;
2511
2512 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2513 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2514
2515 if (!sdata->u.mgd.use_4addr)
2516 return -1;
2517 else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))
2518 check_port_control = true;
2519 }
2520
2521 if (is_multicast_ether_addr(hdr->addr1) &&
2522 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2523 return -1;
2524
2525 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2526 if (ret < 0)
2527 return ret;
2528
2529 ehdr = (struct ethhdr *) rx->skb->data;
2530 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2531 *port_control = true;
2532 else if (check_port_control)
2533 return -1;
2534
2535 return 0;
2536}
2537
2538
2539
2540
2541static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2542{
2543 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2544 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2545 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2546
2547
2548
2549
2550
2551 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
2552 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2553 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
2554 return true;
2555
2556 if (ieee80211_802_1x_port_control(rx) ||
2557 ieee80211_drop_unencrypted(rx, fc))
2558 return false;
2559
2560 return true;
2561}
2562
2563static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2564 struct ieee80211_rx_data *rx)
2565{
2566 struct ieee80211_sub_if_data *sdata = rx->sdata;
2567 struct net_device *dev = sdata->dev;
2568
2569 if (unlikely((skb->protocol == sdata->control_port_protocol ||
2570 (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2571 !sdata->control_port_no_preauth)) &&
2572 sdata->control_port_over_nl80211)) {
2573 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2574 bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2575
2576 cfg80211_rx_control_port(dev, skb, noencrypt);
2577 dev_kfree_skb(skb);
2578 } else {
2579 memset(skb->cb, 0, sizeof(skb->cb));
2580
2581
2582 if (rx->list)
2583 list_add_tail(&skb->list, rx->list);
2584 else
2585 netif_receive_skb(skb);
2586 }
2587}
2588
2589
2590
2591
2592static void
2593ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2594{
2595 struct ieee80211_sub_if_data *sdata = rx->sdata;
2596 struct net_device *dev = sdata->dev;
2597 struct sk_buff *skb, *xmit_skb;
2598 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2599 struct sta_info *dsta;
2600
2601 skb = rx->skb;
2602 xmit_skb = NULL;
2603
2604 ieee80211_rx_stats(dev, skb->len);
2605
2606 if (rx->sta) {
2607
2608
2609
2610
2611
2612 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
2613 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
2614 u64_stats_update_end(&rx->sta->rx_stats.syncp);
2615 }
2616
2617 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2618 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2619 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2620 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2621 if (is_multicast_ether_addr(ehdr->h_dest) &&
2622 ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2623
2624
2625
2626
2627 xmit_skb = skb_copy(skb, GFP_ATOMIC);
2628 if (!xmit_skb)
2629 net_info_ratelimited("%s: failed to clone multicast frame\n",
2630 dev->name);
2631 } else if (!is_multicast_ether_addr(ehdr->h_dest) &&
2632 !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {
2633 dsta = sta_info_get(sdata, ehdr->h_dest);
2634 if (dsta) {
2635
2636
2637
2638
2639
2640
2641 xmit_skb = skb;
2642 skb = NULL;
2643 }
2644 }
2645 }
2646
2647#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2648 if (skb) {
2649
2650
2651
2652
2653
2654
2655 int align;
2656
2657 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2658 if (align) {
2659 if (WARN_ON(skb_headroom(skb) < 3)) {
2660 dev_kfree_skb(skb);
2661 skb = NULL;
2662 } else {
2663 u8 *data = skb->data;
2664 size_t len = skb_headlen(skb);
2665 skb->data -= align;
2666 memmove(skb->data, data, len);
2667 skb_set_tail_pointer(skb, len);
2668 }
2669 }
2670 }
2671#endif
2672
2673 if (skb) {
2674 skb->protocol = eth_type_trans(skb, dev);
2675 ieee80211_deliver_skb_to_local_stack(skb, rx);
2676 }
2677
2678 if (xmit_skb) {
2679
2680
2681
2682
2683
2684 xmit_skb->priority += 256;
2685 xmit_skb->protocol = htons(ETH_P_802_3);
2686 skb_reset_network_header(xmit_skb);
2687 skb_reset_mac_header(xmit_skb);
2688 dev_queue_xmit(xmit_skb);
2689 }
2690}
2691
2692static ieee80211_rx_result debug_noinline
2693__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
2694{
2695 struct net_device *dev = rx->sdata->dev;
2696 struct sk_buff *skb = rx->skb;
2697 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2698 __le16 fc = hdr->frame_control;
2699 struct sk_buff_head frame_list;
2700 struct ethhdr ethhdr;
2701 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
2702
2703 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2704 check_da = NULL;
2705 check_sa = NULL;
2706 } else switch (rx->sdata->vif.type) {
2707 case NL80211_IFTYPE_AP:
2708 case NL80211_IFTYPE_AP_VLAN:
2709 check_da = NULL;
2710 break;
2711 case NL80211_IFTYPE_STATION:
2712 if (!rx->sta ||
2713 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
2714 check_sa = NULL;
2715 break;
2716 case NL80211_IFTYPE_MESH_POINT:
2717 check_sa = NULL;
2718 break;
2719 default:
2720 break;
2721 }
2722
2723 skb->dev = dev;
2724 __skb_queue_head_init(&frame_list);
2725
2726 if (ieee80211_data_to_8023_exthdr(skb, ðhdr,
2727 rx->sdata->vif.addr,
2728 rx->sdata->vif.type,
2729 data_offset))
2730 return RX_DROP_UNUSABLE;
2731
2732 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2733 rx->sdata->vif.type,
2734 rx->local->hw.extra_tx_headroom,
2735 check_da, check_sa);
2736
2737 while (!skb_queue_empty(&frame_list)) {
2738 rx->skb = __skb_dequeue(&frame_list);
2739
2740 if (!ieee80211_frame_allowed(rx, fc)) {
2741 dev_kfree_skb(rx->skb);
2742 continue;
2743 }
2744
2745 ieee80211_deliver_skb(rx);
2746 }
2747
2748 return RX_QUEUED;
2749}
2750
2751static ieee80211_rx_result debug_noinline
2752ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2753{
2754 struct sk_buff *skb = rx->skb;
2755 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2756 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2757 __le16 fc = hdr->frame_control;
2758
2759 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2760 return RX_CONTINUE;
2761
2762 if (unlikely(!ieee80211_is_data(fc)))
2763 return RX_CONTINUE;
2764
2765 if (unlikely(!ieee80211_is_data_present(fc)))
2766 return RX_DROP_MONITOR;
2767
2768 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2769 switch (rx->sdata->vif.type) {
2770 case NL80211_IFTYPE_AP_VLAN:
2771 if (!rx->sdata->u.vlan.sta)
2772 return RX_DROP_UNUSABLE;
2773 break;
2774 case NL80211_IFTYPE_STATION:
2775 if (!rx->sdata->u.mgd.use_4addr)
2776 return RX_DROP_UNUSABLE;
2777 break;
2778 default:
2779 return RX_DROP_UNUSABLE;
2780 }
2781 }
2782
2783 if (is_multicast_ether_addr(hdr->addr1))
2784 return RX_DROP_UNUSABLE;
2785
2786 return __ieee80211_rx_h_amsdu(rx, 0);
2787}
2788
2789#ifdef CONFIG_MAC80211_MESH
2790static ieee80211_rx_result
2791ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2792{
2793 struct ieee80211_hdr *fwd_hdr, *hdr;
2794 struct ieee80211_tx_info *info;
2795 struct ieee80211s_hdr *mesh_hdr;
2796 struct sk_buff *skb = rx->skb, *fwd_skb;
2797 struct ieee80211_local *local = rx->local;
2798 struct ieee80211_sub_if_data *sdata = rx->sdata;
2799 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2800 u16 ac, q, hdrlen;
2801 int tailroom = 0;
2802
2803 hdr = (struct ieee80211_hdr *) skb->data;
2804 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2805
2806
2807 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2808 return RX_DROP_MONITOR;
2809
2810 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2811
2812
2813 if (!pskb_may_pull(rx->skb,
2814 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2815 return RX_DROP_MONITOR;
2816
2817
2818 hdr = (struct ieee80211_hdr *) skb->data;
2819 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2820
2821 if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2822 return RX_DROP_MONITOR;
2823
2824
2825 if (ieee80211_is_data(hdr->frame_control) &&
2826 is_multicast_ether_addr(hdr->addr1) &&
2827 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2828 return RX_DROP_MONITOR;
2829
2830 if (!ieee80211_is_data(hdr->frame_control))
2831 return RX_CONTINUE;
2832
2833 if (!mesh_hdr->ttl)
2834 return RX_DROP_MONITOR;
2835
2836 if (mesh_hdr->flags & MESH_FLAGS_AE) {
2837 struct mesh_path *mppath;
2838 char *proxied_addr;
2839 char *mpp_addr;
2840
2841 if (is_multicast_ether_addr(hdr->addr1)) {
2842 mpp_addr = hdr->addr3;
2843 proxied_addr = mesh_hdr->eaddr1;
2844 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
2845 MESH_FLAGS_AE_A5_A6) {
2846
2847 mpp_addr = hdr->addr4;
2848 proxied_addr = mesh_hdr->eaddr2;
2849 } else {
2850 return RX_DROP_MONITOR;
2851 }
2852
2853 rcu_read_lock();
2854 mppath = mpp_path_lookup(sdata, proxied_addr);
2855 if (!mppath) {
2856 mpp_path_add(sdata, proxied_addr, mpp_addr);
2857 } else {
2858 spin_lock_bh(&mppath->state_lock);
2859 if (!ether_addr_equal(mppath->mpp, mpp_addr))
2860 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2861 mppath->exp_time = jiffies;
2862 spin_unlock_bh(&mppath->state_lock);
2863 }
2864 rcu_read_unlock();
2865 }
2866
2867
2868 if (!is_multicast_ether_addr(hdr->addr1) &&
2869 ether_addr_equal(sdata->vif.addr, hdr->addr3))
2870 return RX_CONTINUE;
2871
2872 ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2873 q = sdata->vif.hw_queue[ac];
2874 if (ieee80211_queue_stopped(&local->hw, q)) {
2875 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2876 return RX_DROP_MONITOR;
2877 }
2878 skb_set_queue_mapping(skb, q);
2879
2880 if (!--mesh_hdr->ttl) {
2881 if (!is_multicast_ether_addr(hdr->addr1))
2882 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
2883 dropped_frames_ttl);
2884 goto out;
2885 }
2886
2887 if (!ifmsh->mshcfg.dot11MeshForwarding)
2888 goto out;
2889
2890 if (sdata->crypto_tx_tailroom_needed_cnt)
2891 tailroom = IEEE80211_ENCRYPT_TAILROOM;
2892
2893 fwd_skb = skb_copy_expand(skb, local->tx_headroom +
2894 sdata->encrypt_headroom,
2895 tailroom, GFP_ATOMIC);
2896 if (!fwd_skb)
2897 goto out;
2898
2899 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
2900 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2901 info = IEEE80211_SKB_CB(fwd_skb);
2902 memset(info, 0, sizeof(*info));
2903 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2904 info->control.vif = &rx->sdata->vif;
2905 info->control.jiffies = jiffies;
2906 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2907 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2908 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2909
2910 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2911 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2912
2913 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2914 } else {
2915
2916 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2917 fwd_hdr->addr3, 0,
2918 WLAN_REASON_MESH_PATH_NOFORWARD,
2919 fwd_hdr->addr2);
2920 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2921 kfree_skb(fwd_skb);
2922 return RX_DROP_MONITOR;
2923 }
2924
2925 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2926 ieee80211_add_pending_skb(local, fwd_skb);
2927 out:
2928 if (is_multicast_ether_addr(hdr->addr1))
2929 return RX_CONTINUE;
2930 return RX_DROP_MONITOR;
2931}
2932#endif
2933
2934static ieee80211_rx_result debug_noinline
2935ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2936{
2937 struct ieee80211_sub_if_data *sdata = rx->sdata;
2938 struct ieee80211_local *local = rx->local;
2939 struct net_device *dev = sdata->dev;
2940 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2941 __le16 fc = hdr->frame_control;
2942 bool port_control;
2943 int err;
2944
2945 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2946 return RX_CONTINUE;
2947
2948 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
2949 return RX_DROP_MONITOR;
2950
2951
2952
2953
2954
2955 if (ieee80211_has_a4(hdr->frame_control) &&
2956 sdata->vif.type == NL80211_IFTYPE_AP) {
2957 if (rx->sta &&
2958 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2959 cfg80211_rx_unexpected_4addr_frame(
2960 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2961 return RX_DROP_MONITOR;
2962 }
2963
2964 err = __ieee80211_data_to_8023(rx, &port_control);
2965 if (unlikely(err))
2966 return RX_DROP_UNUSABLE;
2967
2968 if (!ieee80211_frame_allowed(rx, fc))
2969 return RX_DROP_MONITOR;
2970
2971
2972 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2973 cpu_to_be16(ETH_P_TDLS))) {
2974 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2975
2976 if (pskb_may_pull(rx->skb,
2977 offsetof(struct ieee80211_tdls_data, u)) &&
2978 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2979 tf->category == WLAN_CATEGORY_TDLS &&
2980 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2981 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
2982 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2983 schedule_work(&local->tdls_chsw_work);
2984 if (rx->sta)
2985 rx->sta->rx_stats.packets++;
2986
2987 return RX_QUEUED;
2988 }
2989 }
2990
2991 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2992 unlikely(port_control) && sdata->bss) {
2993 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2994 u.ap);
2995 dev = sdata->dev;
2996 rx->sdata = sdata;
2997 }
2998
2999 rx->skb->dev = dev;
3000
3001 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3002 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3003 !is_multicast_ether_addr(
3004 ((struct ethhdr *)rx->skb->data)->h_dest) &&
3005 (!local->scanning &&
3006 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3007 mod_timer(&local->dynamic_ps_timer, jiffies +
3008 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
3009
3010 ieee80211_deliver_skb(rx);
3011
3012 return RX_QUEUED;
3013}
3014
3015static ieee80211_rx_result debug_noinline
3016ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3017{
3018 struct sk_buff *skb = rx->skb;
3019 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3020 struct tid_ampdu_rx *tid_agg_rx;
3021 u16 start_seq_num;
3022 u16 tid;
3023
3024 if (likely(!ieee80211_is_ctl(bar->frame_control)))
3025 return RX_CONTINUE;
3026
3027 if (ieee80211_is_back_req(bar->frame_control)) {
3028 struct {
3029 __le16 control, start_seq_num;
3030 } __packed bar_data;
3031 struct ieee80211_event event = {
3032 .type = BAR_RX_EVENT,
3033 };
3034
3035 if (!rx->sta)
3036 return RX_DROP_MONITOR;
3037
3038 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3039 &bar_data, sizeof(bar_data)))
3040 return RX_DROP_MONITOR;
3041
3042 tid = le16_to_cpu(bar_data.control) >> 12;
3043
3044 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3045 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
3046 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
3047 WLAN_BACK_RECIPIENT,
3048 WLAN_REASON_QSTA_REQUIRE_SETUP);
3049
3050 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3051 if (!tid_agg_rx)
3052 return RX_DROP_MONITOR;
3053
3054 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3055 event.u.ba.tid = tid;
3056 event.u.ba.ssn = start_seq_num;
3057 event.u.ba.sta = &rx->sta->sta;
3058
3059
3060 if (tid_agg_rx->timeout)
3061 mod_timer(&tid_agg_rx->session_timer,
3062 TU_TO_EXP_TIME(tid_agg_rx->timeout));
3063
3064 spin_lock(&tid_agg_rx->reorder_lock);
3065
3066 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
3067 start_seq_num, frames);
3068 spin_unlock(&tid_agg_rx->reorder_lock);
3069
3070 drv_event_callback(rx->local, rx->sdata, &event);
3071
3072 kfree_skb(skb);
3073 return RX_QUEUED;
3074 }
3075
3076
3077
3078
3079
3080
3081 return RX_DROP_MONITOR;
3082}
3083
3084static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3085 struct ieee80211_mgmt *mgmt,
3086 size_t len)
3087{
3088 struct ieee80211_local *local = sdata->local;
3089 struct sk_buff *skb;
3090 struct ieee80211_mgmt *resp;
3091
3092 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
3093
3094 return;
3095 }
3096
3097 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
3098 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
3099
3100 return;
3101 }
3102
3103 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
3104
3105 return;
3106 }
3107
3108 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
3109 if (skb == NULL)
3110 return;
3111
3112 skb_reserve(skb, local->hw.extra_tx_headroom);
3113 resp = skb_put_zero(skb, 24);
3114 memcpy(resp->da, mgmt->sa, ETH_ALEN);
3115 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3116 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
3117 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3118 IEEE80211_STYPE_ACTION);
3119 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
3120 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3121 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
3122 memcpy(resp->u.action.u.sa_query.trans_id,
3123 mgmt->u.action.u.sa_query.trans_id,
3124 WLAN_SA_QUERY_TR_ID_LEN);
3125
3126 ieee80211_tx_skb(sdata, skb);
3127}
3128
3129static ieee80211_rx_result debug_noinline
3130ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3131{
3132 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3133 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3134
3135
3136
3137
3138
3139
3140 if (rx->skb->len < 24)
3141 return RX_DROP_MONITOR;
3142
3143 if (!ieee80211_is_mgmt(mgmt->frame_control))
3144 return RX_DROP_MONITOR;
3145
3146 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3147 ieee80211_is_beacon(mgmt->frame_control) &&
3148 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3149 int sig = 0;
3150
3151 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3152 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3153 sig = status->signal;
3154
3155 cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,
3156 rx->skb->data, rx->skb->len,
3157 ieee80211_rx_status_to_khz(status),
3158 sig);
3159 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3160 }
3161
3162 if (ieee80211_drop_unencrypted_mgmt(rx))
3163 return RX_DROP_UNUSABLE;
3164
3165 return RX_CONTINUE;
3166}
3167
3168static ieee80211_rx_result debug_noinline
3169ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3170{
3171 struct ieee80211_local *local = rx->local;
3172 struct ieee80211_sub_if_data *sdata = rx->sdata;
3173 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3174 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3175 int len = rx->skb->len;
3176
3177 if (!ieee80211_is_action(mgmt->frame_control))
3178 return RX_CONTINUE;
3179
3180
3181 if (len < IEEE80211_MIN_ACTION_SIZE)
3182 return RX_DROP_UNUSABLE;
3183
3184 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3185 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3186 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3187 return RX_DROP_UNUSABLE;
3188
3189 switch (mgmt->u.action.category) {
3190 case WLAN_CATEGORY_HT:
3191
3192 if (!rx->sta->sta.ht_cap.ht_supported)
3193 goto invalid;
3194
3195 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3196 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3197 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3198 sdata->vif.type != NL80211_IFTYPE_AP &&
3199 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3200 break;
3201
3202
3203 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3204 goto invalid;
3205
3206 switch (mgmt->u.action.u.ht_smps.action) {
3207 case WLAN_HT_ACTION_SMPS: {
3208 struct ieee80211_supported_band *sband;
3209 enum ieee80211_smps_mode smps_mode;
3210 struct sta_opmode_info sta_opmode = {};
3211
3212 if (sdata->vif.type != NL80211_IFTYPE_AP &&
3213 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3214 goto handled;
3215
3216
3217 switch (mgmt->u.action.u.ht_smps.smps_control) {
3218 case WLAN_HT_SMPS_CONTROL_DISABLED:
3219 smps_mode = IEEE80211_SMPS_OFF;
3220 break;
3221 case WLAN_HT_SMPS_CONTROL_STATIC:
3222 smps_mode = IEEE80211_SMPS_STATIC;
3223 break;
3224 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3225 smps_mode = IEEE80211_SMPS_DYNAMIC;
3226 break;
3227 default:
3228 goto invalid;
3229 }
3230
3231
3232 if (rx->sta->sta.smps_mode == smps_mode)
3233 goto handled;
3234 rx->sta->sta.smps_mode = smps_mode;
3235 sta_opmode.smps_mode =
3236 ieee80211_smps_mode_to_smps_mode(smps_mode);
3237 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3238
3239 sband = rx->local->hw.wiphy->bands[status->band];
3240
3241 rate_control_rate_update(local, sband, rx->sta,
3242 IEEE80211_RC_SMPS_CHANGED);
3243 cfg80211_sta_opmode_change_notify(sdata->dev,
3244 rx->sta->addr,
3245 &sta_opmode,
3246 GFP_ATOMIC);
3247 goto handled;
3248 }
3249 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3250 struct ieee80211_supported_band *sband;
3251 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
3252 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
3253 struct sta_opmode_info sta_opmode = {};
3254
3255
3256 if (!(rx->sta->sta.ht_cap.cap &
3257 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3258 goto handled;
3259
3260 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
3261 max_bw = IEEE80211_STA_RX_BW_20;
3262 else
3263 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
3264
3265
3266 rx->sta->cur_max_bandwidth = max_bw;
3267 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
3268
3269 if (rx->sta->sta.bandwidth == new_bw)
3270 goto handled;
3271
3272 rx->sta->sta.bandwidth = new_bw;
3273 sband = rx->local->hw.wiphy->bands[status->band];
3274 sta_opmode.bw =
3275 ieee80211_sta_rx_bw_to_chan_width(rx->sta);
3276 sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
3277
3278 rate_control_rate_update(local, sband, rx->sta,
3279 IEEE80211_RC_BW_CHANGED);
3280 cfg80211_sta_opmode_change_notify(sdata->dev,
3281 rx->sta->addr,
3282 &sta_opmode,
3283 GFP_ATOMIC);
3284 goto handled;
3285 }
3286 default:
3287 goto invalid;
3288 }
3289
3290 break;
3291 case WLAN_CATEGORY_PUBLIC:
3292 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3293 goto invalid;
3294 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3295 break;
3296 if (!rx->sta)
3297 break;
3298 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
3299 break;
3300 if (mgmt->u.action.u.ext_chan_switch.action_code !=
3301 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3302 break;
3303 if (len < offsetof(struct ieee80211_mgmt,
3304 u.action.u.ext_chan_switch.variable))
3305 goto invalid;
3306 goto queue;
3307 case WLAN_CATEGORY_VHT:
3308 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3309 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3310 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3311 sdata->vif.type != NL80211_IFTYPE_AP &&
3312 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3313 break;
3314
3315
3316 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3317 goto invalid;
3318
3319 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
3320 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3321
3322 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3323 goto invalid;
3324 goto queue;
3325 }
3326 case WLAN_VHT_ACTION_GROUPID_MGMT: {
3327 if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3328 goto invalid;
3329 goto queue;
3330 }
3331 default:
3332 break;
3333 }
3334 break;
3335 case WLAN_CATEGORY_BACK:
3336 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3337 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3338 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3339 sdata->vif.type != NL80211_IFTYPE_AP &&
3340 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3341 break;
3342
3343
3344 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3345 break;
3346
3347 switch (mgmt->u.action.u.addba_req.action_code) {
3348 case WLAN_ACTION_ADDBA_REQ:
3349 if (len < (IEEE80211_MIN_ACTION_SIZE +
3350 sizeof(mgmt->u.action.u.addba_req)))
3351 goto invalid;
3352 break;
3353 case WLAN_ACTION_ADDBA_RESP:
3354 if (len < (IEEE80211_MIN_ACTION_SIZE +
3355 sizeof(mgmt->u.action.u.addba_resp)))
3356 goto invalid;
3357 break;
3358 case WLAN_ACTION_DELBA:
3359 if (len < (IEEE80211_MIN_ACTION_SIZE +
3360 sizeof(mgmt->u.action.u.delba)))
3361 goto invalid;
3362 break;
3363 default:
3364 goto invalid;
3365 }
3366
3367 goto queue;
3368 case WLAN_CATEGORY_SPECTRUM_MGMT:
3369
3370 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3371 break;
3372
3373 switch (mgmt->u.action.u.measurement.action_code) {
3374 case WLAN_ACTION_SPCT_MSR_REQ:
3375 if (status->band != NL80211_BAND_5GHZ)
3376 break;
3377
3378 if (len < (IEEE80211_MIN_ACTION_SIZE +
3379 sizeof(mgmt->u.action.u.measurement)))
3380 break;
3381
3382 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3383 break;
3384
3385 ieee80211_process_measurement_req(sdata, mgmt, len);
3386 goto handled;
3387 case WLAN_ACTION_SPCT_CHL_SWITCH: {
3388 u8 *bssid;
3389 if (len < (IEEE80211_MIN_ACTION_SIZE +
3390 sizeof(mgmt->u.action.u.chan_switch)))
3391 break;
3392
3393 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3394 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3395 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3396 break;
3397
3398 if (sdata->vif.type == NL80211_IFTYPE_STATION)
3399 bssid = sdata->u.mgd.bssid;
3400 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3401 bssid = sdata->u.ibss.bssid;
3402 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3403 bssid = mgmt->sa;
3404 else
3405 break;
3406
3407 if (!ether_addr_equal(mgmt->bssid, bssid))
3408 break;
3409
3410 goto queue;
3411 }
3412 }
3413 break;
3414 case WLAN_CATEGORY_SELF_PROTECTED:
3415 if (len < (IEEE80211_MIN_ACTION_SIZE +
3416 sizeof(mgmt->u.action.u.self_prot.action_code)))
3417 break;
3418
3419 switch (mgmt->u.action.u.self_prot.action_code) {
3420 case WLAN_SP_MESH_PEERING_OPEN:
3421 case WLAN_SP_MESH_PEERING_CLOSE:
3422 case WLAN_SP_MESH_PEERING_CONFIRM:
3423 if (!ieee80211_vif_is_mesh(&sdata->vif))
3424 goto invalid;
3425 if (sdata->u.mesh.user_mpm)
3426
3427 break;
3428 goto queue;
3429 case WLAN_SP_MGK_INFORM:
3430 case WLAN_SP_MGK_ACK:
3431 if (!ieee80211_vif_is_mesh(&sdata->vif))
3432 goto invalid;
3433 break;
3434 }
3435 break;
3436 case WLAN_CATEGORY_MESH_ACTION:
3437 if (len < (IEEE80211_MIN_ACTION_SIZE +
3438 sizeof(mgmt->u.action.u.mesh_action.action_code)))
3439 break;
3440
3441 if (!ieee80211_vif_is_mesh(&sdata->vif))
3442 break;
3443 if (mesh_action_is_path_sel(mgmt) &&
3444 !mesh_path_sel_is_hwmp(sdata))
3445 break;
3446 goto queue;
3447 }
3448
3449 return RX_CONTINUE;
3450
3451 invalid:
3452 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3453
3454 return RX_CONTINUE;
3455
3456 handled:
3457 if (rx->sta)
3458 rx->sta->rx_stats.packets++;
3459 dev_kfree_skb(rx->skb);
3460 return RX_QUEUED;
3461
3462 queue:
3463 skb_queue_tail(&sdata->skb_queue, rx->skb);
3464 ieee80211_queue_work(&local->hw, &sdata->work);
3465 if (rx->sta)
3466 rx->sta->rx_stats.packets++;
3467 return RX_QUEUED;
3468}
3469
3470static ieee80211_rx_result debug_noinline
3471ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3472{
3473 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3474 int sig = 0;
3475
3476
3477 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3478 return RX_CONTINUE;
3479
3480
3481
3482
3483
3484
3485
3486
3487 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3488 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3489 sig = status->signal;
3490
3491 if (cfg80211_rx_mgmt_khz(&rx->sdata->wdev,
3492 ieee80211_rx_status_to_khz(status), sig,
3493 rx->skb->data, rx->skb->len, 0)) {
3494 if (rx->sta)
3495 rx->sta->rx_stats.packets++;
3496 dev_kfree_skb(rx->skb);
3497 return RX_QUEUED;
3498 }
3499
3500 return RX_CONTINUE;
3501}
3502
3503static ieee80211_rx_result debug_noinline
3504ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
3505{
3506 struct ieee80211_sub_if_data *sdata = rx->sdata;
3507 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3508 int len = rx->skb->len;
3509
3510 if (!ieee80211_is_action(mgmt->frame_control))
3511 return RX_CONTINUE;
3512
3513 switch (mgmt->u.action.category) {
3514 case WLAN_CATEGORY_SA_QUERY:
3515 if (len < (IEEE80211_MIN_ACTION_SIZE +
3516 sizeof(mgmt->u.action.u.sa_query)))
3517 break;
3518
3519 switch (mgmt->u.action.u.sa_query.action) {
3520 case WLAN_ACTION_SA_QUERY_REQUEST:
3521 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3522 break;
3523 ieee80211_process_sa_query_req(sdata, mgmt, len);
3524 goto handled;
3525 }
3526 break;
3527 }
3528
3529 return RX_CONTINUE;
3530
3531 handled:
3532 if (rx->sta)
3533 rx->sta->rx_stats.packets++;
3534 dev_kfree_skb(rx->skb);
3535 return RX_QUEUED;
3536}
3537
3538static ieee80211_rx_result debug_noinline
3539ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3540{
3541 struct ieee80211_local *local = rx->local;
3542 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3543 struct sk_buff *nskb;
3544 struct ieee80211_sub_if_data *sdata = rx->sdata;
3545 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3546
3547 if (!ieee80211_is_action(mgmt->frame_control))
3548 return RX_CONTINUE;
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3561 (sdata->vif.type == NL80211_IFTYPE_AP ||
3562 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3563 return RX_DROP_MONITOR;
3564
3565 if (is_multicast_ether_addr(mgmt->da))
3566 return RX_DROP_MONITOR;
3567
3568
3569 if (mgmt->u.action.category & 0x80)
3570 return RX_DROP_UNUSABLE;
3571
3572 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3573 GFP_ATOMIC);
3574 if (nskb) {
3575 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3576
3577 nmgmt->u.action.category |= 0x80;
3578 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3579 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3580
3581 memset(nskb->cb, 0, sizeof(nskb->cb));
3582
3583 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3584 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3585
3586 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3587 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3588 IEEE80211_TX_CTL_NO_CCK_RATE;
3589 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3590 info->hw_queue =
3591 local->hw.offchannel_tx_hw_queue;
3592 }
3593
3594 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
3595 status->band);
3596 }
3597 dev_kfree_skb(rx->skb);
3598 return RX_QUEUED;
3599}
3600
3601static ieee80211_rx_result debug_noinline
3602ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3603{
3604 struct ieee80211_sub_if_data *sdata = rx->sdata;
3605 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3606 __le16 stype;
3607
3608 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3609
3610 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3611 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3612 sdata->vif.type != NL80211_IFTYPE_OCB &&
3613 sdata->vif.type != NL80211_IFTYPE_STATION)
3614 return RX_DROP_MONITOR;
3615
3616 switch (stype) {
3617 case cpu_to_le16(IEEE80211_STYPE_AUTH):
3618 case cpu_to_le16(IEEE80211_STYPE_BEACON):
3619 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3620
3621 break;
3622 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3623 if (is_multicast_ether_addr(mgmt->da) &&
3624 !is_broadcast_ether_addr(mgmt->da))
3625 return RX_DROP_MONITOR;
3626
3627
3628 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3629 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3630 return RX_DROP_MONITOR;
3631 break;
3632 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3633 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3634 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3635 if (is_multicast_ether_addr(mgmt->da) &&
3636 !is_broadcast_ether_addr(mgmt->da))
3637 return RX_DROP_MONITOR;
3638
3639
3640 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3641 return RX_DROP_MONITOR;
3642 break;
3643 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3644
3645 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3646 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3647 return RX_DROP_MONITOR;
3648 break;
3649 default:
3650 return RX_DROP_MONITOR;
3651 }
3652
3653
3654 skb_queue_tail(&sdata->skb_queue, rx->skb);
3655 ieee80211_queue_work(&rx->local->hw, &sdata->work);
3656 if (rx->sta)
3657 rx->sta->rx_stats.packets++;
3658
3659 return RX_QUEUED;
3660}
3661
3662static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3663 struct ieee80211_rate *rate)
3664{
3665 struct ieee80211_sub_if_data *sdata;
3666 struct ieee80211_local *local = rx->local;
3667 struct sk_buff *skb = rx->skb, *skb2;
3668 struct net_device *prev_dev = NULL;
3669 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3670 int needed_headroom;
3671
3672
3673
3674
3675
3676 if (rx->flags & IEEE80211_RX_CMNTR)
3677 goto out_free_skb;
3678 rx->flags |= IEEE80211_RX_CMNTR;
3679
3680
3681 if (!local->cooked_mntrs)
3682 goto out_free_skb;
3683
3684
3685 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3686
3687 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3688
3689 if (skb_headroom(skb) < needed_headroom &&
3690 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3691 goto out_free_skb;
3692
3693
3694 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3695 false);
3696
3697 skb_reset_mac_header(skb);
3698 skb->ip_summed = CHECKSUM_UNNECESSARY;
3699 skb->pkt_type = PACKET_OTHERHOST;
3700 skb->protocol = htons(ETH_P_802_2);
3701
3702 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3703 if (!ieee80211_sdata_running(sdata))
3704 continue;
3705
3706 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3707 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
3708 continue;
3709
3710 if (prev_dev) {
3711 skb2 = skb_clone(skb, GFP_ATOMIC);
3712 if (skb2) {
3713 skb2->dev = prev_dev;
3714 netif_receive_skb(skb2);
3715 }
3716 }
3717
3718 prev_dev = sdata->dev;
3719 ieee80211_rx_stats(sdata->dev, skb->len);
3720 }
3721
3722 if (prev_dev) {
3723 skb->dev = prev_dev;
3724 netif_receive_skb(skb);
3725 return;
3726 }
3727
3728 out_free_skb:
3729 dev_kfree_skb(skb);
3730}
3731
3732static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3733 ieee80211_rx_result res)
3734{
3735 switch (res) {
3736 case RX_DROP_MONITOR:
3737 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3738 if (rx->sta)
3739 rx->sta->rx_stats.dropped++;
3740 fallthrough;
3741 case RX_CONTINUE: {
3742 struct ieee80211_rate *rate = NULL;
3743 struct ieee80211_supported_band *sband;
3744 struct ieee80211_rx_status *status;
3745
3746 status = IEEE80211_SKB_RXCB((rx->skb));
3747
3748 sband = rx->local->hw.wiphy->bands[status->band];
3749 if (status->encoding == RX_ENC_LEGACY)
3750 rate = &sband->bitrates[status->rate_idx];
3751
3752 ieee80211_rx_cooked_monitor(rx, rate);
3753 break;
3754 }
3755 case RX_DROP_UNUSABLE:
3756 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3757 if (rx->sta)
3758 rx->sta->rx_stats.dropped++;
3759 dev_kfree_skb(rx->skb);
3760 break;
3761 case RX_QUEUED:
3762 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3763 break;
3764 }
3765}
3766
3767static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3768 struct sk_buff_head *frames)
3769{
3770 ieee80211_rx_result res = RX_DROP_MONITOR;
3771 struct sk_buff *skb;
3772
3773#define CALL_RXH(rxh) \
3774 do { \
3775 res = rxh(rx); \
3776 if (res != RX_CONTINUE) \
3777 goto rxh_next; \
3778 } while (0)
3779
3780
3781
3782
3783
3784
3785
3786 spin_lock_bh(&rx->local->rx_path_lock);
3787
3788 while ((skb = __skb_dequeue(frames))) {
3789
3790
3791
3792
3793
3794 rx->skb = skb;
3795
3796 CALL_RXH(ieee80211_rx_h_check_more_data);
3797 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
3798 CALL_RXH(ieee80211_rx_h_sta_process);
3799 CALL_RXH(ieee80211_rx_h_decrypt);
3800 CALL_RXH(ieee80211_rx_h_defragment);
3801 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
3802
3803#ifdef CONFIG_MAC80211_MESH
3804 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3805 CALL_RXH(ieee80211_rx_h_mesh_fwding);
3806#endif
3807 CALL_RXH(ieee80211_rx_h_amsdu);
3808 CALL_RXH(ieee80211_rx_h_data);
3809
3810
3811 res = ieee80211_rx_h_ctrl(rx, frames);
3812 if (res != RX_CONTINUE)
3813 goto rxh_next;
3814
3815 CALL_RXH(ieee80211_rx_h_mgmt_check);
3816 CALL_RXH(ieee80211_rx_h_action);
3817 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
3818 CALL_RXH(ieee80211_rx_h_action_post_userspace);
3819 CALL_RXH(ieee80211_rx_h_action_return);
3820 CALL_RXH(ieee80211_rx_h_mgmt);
3821
3822 rxh_next:
3823 ieee80211_rx_handlers_result(rx, res);
3824
3825#undef CALL_RXH
3826 }
3827
3828 spin_unlock_bh(&rx->local->rx_path_lock);
3829}
3830
3831static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3832{
3833 struct sk_buff_head reorder_release;
3834 ieee80211_rx_result res = RX_DROP_MONITOR;
3835
3836 __skb_queue_head_init(&reorder_release);
3837
3838#define CALL_RXH(rxh) \
3839 do { \
3840 res = rxh(rx); \
3841 if (res != RX_CONTINUE) \
3842 goto rxh_next; \
3843 } while (0)
3844
3845 CALL_RXH(ieee80211_rx_h_check_dup);
3846 CALL_RXH(ieee80211_rx_h_check);
3847
3848 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3849
3850 ieee80211_rx_handlers(rx, &reorder_release);
3851 return;
3852
3853 rxh_next:
3854 ieee80211_rx_handlers_result(rx, res);
3855
3856#undef CALL_RXH
3857}
3858
3859
3860
3861
3862
3863void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3864{
3865 struct sk_buff_head frames;
3866 struct ieee80211_rx_data rx = {
3867 .sta = sta,
3868 .sdata = sta->sdata,
3869 .local = sta->local,
3870
3871 .security_idx = tid,
3872 .seqno_idx = tid,
3873 };
3874 struct tid_ampdu_rx *tid_agg_rx;
3875
3876 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3877 if (!tid_agg_rx)
3878 return;
3879
3880 __skb_queue_head_init(&frames);
3881
3882 spin_lock(&tid_agg_rx->reorder_lock);
3883 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3884 spin_unlock(&tid_agg_rx->reorder_lock);
3885
3886 if (!skb_queue_empty(&frames)) {
3887 struct ieee80211_event event = {
3888 .type = BA_FRAME_TIMEOUT,
3889 .u.ba.tid = tid,
3890 .u.ba.sta = &sta->sta,
3891 };
3892 drv_event_callback(rx.local, rx.sdata, &event);
3893 }
3894
3895 ieee80211_rx_handlers(&rx, &frames);
3896}
3897
3898void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
3899 u16 ssn, u64 filtered,
3900 u16 received_mpdus)
3901{
3902 struct sta_info *sta;
3903 struct tid_ampdu_rx *tid_agg_rx;
3904 struct sk_buff_head frames;
3905 struct ieee80211_rx_data rx = {
3906
3907 .security_idx = tid,
3908 .seqno_idx = tid,
3909 };
3910 int i, diff;
3911
3912 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
3913 return;
3914
3915 __skb_queue_head_init(&frames);
3916
3917 sta = container_of(pubsta, struct sta_info, sta);
3918
3919 rx.sta = sta;
3920 rx.sdata = sta->sdata;
3921 rx.local = sta->local;
3922
3923 rcu_read_lock();
3924 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3925 if (!tid_agg_rx)
3926 goto out;
3927
3928 spin_lock_bh(&tid_agg_rx->reorder_lock);
3929
3930 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
3931 int release;
3932
3933
3934 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
3935 IEEE80211_SN_MODULO;
3936 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
3937 release, &frames);
3938
3939 tid_agg_rx->head_seq_num = ssn;
3940 } else {
3941 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
3942 &frames);
3943 }
3944
3945
3946
3947 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
3948 if (diff >= tid_agg_rx->buf_size) {
3949 tid_agg_rx->reorder_buf_filtered = 0;
3950 goto release;
3951 }
3952 filtered = filtered >> diff;
3953 ssn += diff;
3954
3955
3956 for (i = 0; i < tid_agg_rx->buf_size; i++) {
3957 int index = (ssn + i) % tid_agg_rx->buf_size;
3958
3959 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
3960 if (filtered & BIT_ULL(i))
3961 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
3962 }
3963
3964
3965 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3966
3967release:
3968 spin_unlock_bh(&tid_agg_rx->reorder_lock);
3969
3970 ieee80211_rx_handlers(&rx, &frames);
3971
3972 out:
3973 rcu_read_unlock();
3974}
3975EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
3976
3977
3978
3979static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
3980{
3981 struct ieee80211_sub_if_data *sdata = rx->sdata;
3982 struct sk_buff *skb = rx->skb;
3983 struct ieee80211_hdr *hdr = (void *)skb->data;
3984 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3985 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3986 bool multicast = is_multicast_ether_addr(hdr->addr1);
3987
3988 switch (sdata->vif.type) {
3989 case NL80211_IFTYPE_STATION:
3990 if (!bssid && !sdata->u.mgd.use_4addr)
3991 return false;
3992 if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
3993 return false;
3994 if (multicast)
3995 return true;
3996 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3997 case NL80211_IFTYPE_ADHOC:
3998 if (!bssid)
3999 return false;
4000 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
4001 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
4002 return false;
4003 if (ieee80211_is_beacon(hdr->frame_control))
4004 return true;
4005 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
4006 return false;
4007 if (!multicast &&
4008 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
4009 return false;
4010 if (!rx->sta) {
4011 int rate_idx;
4012 if (status->encoding != RX_ENC_LEGACY)
4013 rate_idx = 0;
4014 else
4015 rate_idx = status->rate_idx;
4016 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
4017 BIT(rate_idx));
4018 }
4019 return true;
4020 case NL80211_IFTYPE_OCB:
4021 if (!bssid)
4022 return false;
4023 if (!ieee80211_is_data_present(hdr->frame_control))
4024 return false;
4025 if (!is_broadcast_ether_addr(bssid))
4026 return false;
4027 if (!multicast &&
4028 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
4029 return false;
4030 if (!rx->sta) {
4031 int rate_idx;
4032 if (status->encoding != RX_ENC_LEGACY)
4033 rate_idx = 0;
4034 else
4035 rate_idx = status->rate_idx;
4036 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
4037 BIT(rate_idx));
4038 }
4039 return true;
4040 case NL80211_IFTYPE_MESH_POINT:
4041 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
4042 return false;
4043 if (multicast)
4044 return true;
4045 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
4046 case NL80211_IFTYPE_AP_VLAN:
4047 case NL80211_IFTYPE_AP:
4048 if (!bssid)
4049 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
4050
4051 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
4052
4053
4054
4055
4056
4057
4058 if (!multicast &&
4059 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
4060 return false;
4061 if (ieee80211_is_public_action(hdr, skb->len))
4062 return true;
4063 return ieee80211_is_beacon(hdr->frame_control);
4064 }
4065
4066 if (!ieee80211_has_tods(hdr->frame_control)) {
4067
4068 if (ieee80211_is_data(hdr->frame_control))
4069 return false;
4070
4071 if (ieee80211_is_action(hdr->frame_control) &&
4072 !is_broadcast_ether_addr(bssid) &&
4073 !ether_addr_equal(bssid, hdr->addr1))
4074 return false;
4075 }
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085
4086
4087
4088
4089
4090
4091
4092
4093
4094 if (ieee80211_is_data(hdr->frame_control) && multicast)
4095 return false;
4096
4097 return true;
4098 case NL80211_IFTYPE_WDS:
4099 if (bssid || !ieee80211_is_data(hdr->frame_control))
4100 return false;
4101 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
4102 case NL80211_IFTYPE_P2P_DEVICE:
4103 return ieee80211_is_public_action(hdr, skb->len) ||
4104 ieee80211_is_probe_req(hdr->frame_control) ||
4105 ieee80211_is_probe_resp(hdr->frame_control) ||
4106 ieee80211_is_beacon(hdr->frame_control);
4107 case NL80211_IFTYPE_NAN:
4108
4109 return false;
4110 default:
4111 break;
4112 }
4113
4114 WARN_ON_ONCE(1);
4115 return false;
4116}
4117
4118void ieee80211_check_fast_rx(struct sta_info *sta)
4119{
4120 struct ieee80211_sub_if_data *sdata = sta->sdata;
4121 struct ieee80211_local *local = sdata->local;
4122 struct ieee80211_key *key;
4123 struct ieee80211_fast_rx fastrx = {
4124 .dev = sdata->dev,
4125 .vif_type = sdata->vif.type,
4126 .control_port_protocol = sdata->control_port_protocol,
4127 }, *old, *new = NULL;
4128 bool assign = false;
4129
4130
4131 __acquire(check_fast_rx);
4132
4133 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4134 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4135 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
4136 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
4137
4138 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4139
4140
4141 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4142 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4143 goto clear;
4144
4145 switch (sdata->vif.type) {
4146 case NL80211_IFTYPE_STATION:
4147 if (sta->sta.tdls) {
4148 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4149 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4150 fastrx.expected_ds_bits = 0;
4151 } else {
4152 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0;
4153 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4154 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4155 fastrx.expected_ds_bits =
4156 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4157 }
4158
4159 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4160 fastrx.expected_ds_bits |=
4161 cpu_to_le16(IEEE80211_FCTL_TODS);
4162 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4163 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4164 }
4165
4166 if (!sdata->u.mgd.powersave)
4167 break;
4168
4169
4170 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4171 goto clear;
4172 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4173 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4174 goto clear;
4175 break;
4176 case NL80211_IFTYPE_AP_VLAN:
4177 case NL80211_IFTYPE_AP:
4178
4179
4180
4181 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4182 goto clear;
4183 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4184 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4185 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4186
4187 fastrx.internal_forward =
4188 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4189 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4190 !sdata->u.vlan.sta);
4191
4192 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4193 sdata->u.vlan.sta) {
4194 fastrx.expected_ds_bits |=
4195 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4196 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4197 fastrx.internal_forward = 0;
4198 }
4199
4200 break;
4201 default:
4202 goto clear;
4203 }
4204
4205 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
4206 goto clear;
4207
4208 rcu_read_lock();
4209 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4210 if (key) {
4211 switch (key->conf.cipher) {
4212 case WLAN_CIPHER_SUITE_TKIP:
4213
4214 goto clear_rcu;
4215 case WLAN_CIPHER_SUITE_CCMP:
4216 case WLAN_CIPHER_SUITE_CCMP_256:
4217 case WLAN_CIPHER_SUITE_GCMP:
4218 case WLAN_CIPHER_SUITE_GCMP_256:
4219 break;
4220 default:
4221
4222
4223
4224 goto clear_rcu;
4225 }
4226
4227 fastrx.key = true;
4228 fastrx.icv_len = key->conf.icv_len;
4229 }
4230
4231 assign = true;
4232 clear_rcu:
4233 rcu_read_unlock();
4234 clear:
4235 __release(check_fast_rx);
4236
4237 if (assign)
4238 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
4239
4240 spin_lock_bh(&sta->lock);
4241 old = rcu_dereference_protected(sta->fast_rx, true);
4242 rcu_assign_pointer(sta->fast_rx, new);
4243 spin_unlock_bh(&sta->lock);
4244
4245 if (old)
4246 kfree_rcu(old, rcu_head);
4247}
4248
4249void ieee80211_clear_fast_rx(struct sta_info *sta)
4250{
4251 struct ieee80211_fast_rx *old;
4252
4253 spin_lock_bh(&sta->lock);
4254 old = rcu_dereference_protected(sta->fast_rx, true);
4255 RCU_INIT_POINTER(sta->fast_rx, NULL);
4256 spin_unlock_bh(&sta->lock);
4257
4258 if (old)
4259 kfree_rcu(old, rcu_head);
4260}
4261
4262void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4263{
4264 struct ieee80211_local *local = sdata->local;
4265 struct sta_info *sta;
4266
4267 lockdep_assert_held(&local->sta_mtx);
4268
4269 list_for_each_entry(sta, &local->sta_list, list) {
4270 if (sdata != sta->sdata &&
4271 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4272 continue;
4273 ieee80211_check_fast_rx(sta);
4274 }
4275}
4276
4277void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4278{
4279 struct ieee80211_local *local = sdata->local;
4280
4281 mutex_lock(&local->sta_mtx);
4282 __ieee80211_check_fast_rx_iface(sdata);
4283 mutex_unlock(&local->sta_mtx);
4284}
4285
4286static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4287 struct ieee80211_fast_rx *fast_rx)
4288{
4289 struct sk_buff *skb = rx->skb;
4290 struct ieee80211_hdr *hdr = (void *)skb->data;
4291 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4292 struct sta_info *sta = rx->sta;
4293 int orig_len = skb->len;
4294 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
4295 int snap_offs = hdrlen;
4296 struct {
4297 u8 snap[sizeof(rfc1042_header)];
4298 __be16 proto;
4299 } *payload __aligned(2);
4300 struct {
4301 u8 da[ETH_ALEN];
4302 u8 sa[ETH_ALEN];
4303 } addrs __aligned(2);
4304 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
4305
4306 if (fast_rx->uses_rss)
4307 stats = this_cpu_ptr(sta->pcpu_rx_stats);
4308
4309
4310
4311
4312
4313 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4314 return false;
4315
4316#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4317
4318
4319
4320
4321
4322 if (fast_rx->key &&
4323 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
4324 return false;
4325
4326 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
4327 return false;
4328
4329 if (unlikely(ieee80211_is_frag(hdr)))
4330 return false;
4331
4332
4333
4334
4335
4336
4337
4338
4339
4340
4341 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
4342 return false;
4343
4344 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
4345 IEEE80211_FCTL_TODS)) !=
4346 fast_rx->expected_ds_bits)
4347 return false;
4348
4349
4350
4351
4352 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
4353
4354 snap_offs += IEEE80211_CCMP_HDR_LEN;
4355 }
4356
4357 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) {
4358 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
4359 goto drop;
4360
4361 payload = (void *)(skb->data + snap_offs);
4362
4363 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
4364 return false;
4365
4366
4367
4368
4369
4370
4371 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4372 payload->proto == fast_rx->control_port_protocol))
4373 return false;
4374 }
4375
4376
4377
4378 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4379 pskb_trim(skb, skb->len - fast_rx->icv_len))
4380 goto drop;
4381
4382 if (unlikely(fast_rx->sta_notify)) {
4383 ieee80211_sta_rx_notify(rx->sdata, hdr);
4384 fast_rx->sta_notify = false;
4385 }
4386
4387
4388 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4389 stats->last_signal = status->signal;
4390 if (!fast_rx->uses_rss)
4391 ewma_signal_add(&sta->rx_stats_avg.signal,
4392 -status->signal);
4393 }
4394
4395 if (status->chains) {
4396 int i;
4397
4398 stats->chains = status->chains;
4399 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4400 int signal = status->chain_signal[i];
4401
4402 if (!(status->chains & BIT(i)))
4403 continue;
4404
4405 stats->chain_signal_last[i] = signal;
4406 if (!fast_rx->uses_rss)
4407 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
4408 -signal);
4409 }
4410 }
4411
4412
4413 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
4414 goto drop;
4415
4416 if (status->rx_flags & IEEE80211_RX_AMSDU) {
4417 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
4418 RX_QUEUED)
4419 goto drop;
4420
4421 return true;
4422 }
4423
4424 stats->last_rx = jiffies;
4425 stats->last_rate = sta_stats_encode_rate(status);
4426
4427 stats->fragments++;
4428 stats->packets++;
4429
4430
4431 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
4432 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
4433
4434 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
4435
4436 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4437
4438 skb->dev = fast_rx->dev;
4439
4440 ieee80211_rx_stats(fast_rx->dev, skb->len);
4441
4442
4443
4444
4445
4446
4447 u64_stats_update_begin(&stats->syncp);
4448 stats->msdu[rx->seqno_idx]++;
4449 stats->bytes += orig_len;
4450 u64_stats_update_end(&stats->syncp);
4451
4452 if (fast_rx->internal_forward) {
4453 struct sk_buff *xmit_skb = NULL;
4454 if (is_multicast_ether_addr(addrs.da)) {
4455 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4456 } else if (!ether_addr_equal(addrs.da, addrs.sa) &&
4457 sta_info_get(rx->sdata, addrs.da)) {
4458 xmit_skb = skb;
4459 skb = NULL;
4460 }
4461
4462 if (xmit_skb) {
4463
4464
4465
4466
4467
4468 xmit_skb->priority += 256;
4469 xmit_skb->protocol = htons(ETH_P_802_3);
4470 skb_reset_network_header(xmit_skb);
4471 skb_reset_mac_header(xmit_skb);
4472 dev_queue_xmit(xmit_skb);
4473 }
4474
4475 if (!skb)
4476 return true;
4477 }
4478
4479
4480 skb->protocol = eth_type_trans(skb, fast_rx->dev);
4481 memset(skb->cb, 0, sizeof(skb->cb));
4482 if (rx->list)
4483 list_add_tail(&skb->list, rx->list);
4484 else
4485 netif_receive_skb(skb);
4486
4487 return true;
4488 drop:
4489 dev_kfree_skb(skb);
4490 stats->dropped++;
4491 return true;
4492}
4493
4494
4495
4496
4497
4498
4499
4500static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4501 struct sk_buff *skb, bool consume)
4502{
4503 struct ieee80211_local *local = rx->local;
4504 struct ieee80211_sub_if_data *sdata = rx->sdata;
4505
4506 rx->skb = skb;
4507
4508
4509
4510
4511
4512
4513
4514
4515 if (consume && rx->sta) {
4516 struct ieee80211_fast_rx *fast_rx;
4517
4518 fast_rx = rcu_dereference(rx->sta->fast_rx);
4519 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4520 return true;
4521 }
4522
4523 if (!ieee80211_accept_frame(rx))
4524 return false;
4525
4526 if (!consume) {
4527 skb = skb_copy(skb, GFP_ATOMIC);
4528 if (!skb) {
4529 if (net_ratelimit())
4530 wiphy_debug(local->hw.wiphy,
4531 "failed to copy skb for %s\n",
4532 sdata->name);
4533 return true;
4534 }
4535
4536 rx->skb = skb;
4537 }
4538
4539 ieee80211_invoke_rx_handlers(rx);
4540 return true;
4541}
4542
4543
4544
4545
4546
4547static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
4548 struct ieee80211_sta *pubsta,
4549 struct sk_buff *skb,
4550 struct list_head *list)
4551{
4552 struct ieee80211_local *local = hw_to_local(hw);
4553 struct ieee80211_sub_if_data *sdata;
4554 struct ieee80211_hdr *hdr;
4555 __le16 fc;
4556 struct ieee80211_rx_data rx;
4557 struct ieee80211_sub_if_data *prev;
4558 struct rhlist_head *tmp;
4559 int err = 0;
4560
4561 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
4562 memset(&rx, 0, sizeof(rx));
4563 rx.skb = skb;
4564 rx.local = local;
4565 rx.list = list;
4566
4567 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
4568 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
4569
4570 if (ieee80211_is_mgmt(fc)) {
4571
4572 if (skb->len < ieee80211_hdrlen(fc))
4573 err = -ENOBUFS;
4574 else
4575 err = skb_linearize(skb);
4576 } else {
4577 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4578 }
4579
4580 if (err) {
4581 dev_kfree_skb(skb);
4582 return;
4583 }
4584
4585 hdr = (struct ieee80211_hdr *)skb->data;
4586 ieee80211_parse_qos(&rx);
4587 ieee80211_verify_alignment(&rx);
4588
4589 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
4590 ieee80211_is_beacon(hdr->frame_control)))
4591 ieee80211_scan_rx(local, skb);
4592
4593 if (ieee80211_is_data(fc)) {
4594 struct sta_info *sta, *prev_sta;
4595
4596 if (pubsta) {
4597 rx.sta = container_of(pubsta, struct sta_info, sta);
4598 rx.sdata = rx.sta->sdata;
4599 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4600 return;
4601 goto out;
4602 }
4603
4604 prev_sta = NULL;
4605
4606 for_each_sta_info(local, hdr->addr2, sta, tmp) {
4607 if (!prev_sta) {
4608 prev_sta = sta;
4609 continue;
4610 }
4611
4612 rx.sta = prev_sta;
4613 rx.sdata = prev_sta->sdata;
4614 ieee80211_prepare_and_rx_handle(&rx, skb, false);
4615
4616 prev_sta = sta;
4617 }
4618
4619 if (prev_sta) {
4620 rx.sta = prev_sta;
4621 rx.sdata = prev_sta->sdata;
4622
4623 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4624 return;
4625 goto out;
4626 }
4627 }
4628
4629 prev = NULL;
4630
4631 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4632 if (!ieee80211_sdata_running(sdata))
4633 continue;
4634
4635 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
4636 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
4637 continue;
4638
4639
4640
4641
4642
4643
4644
4645 if (!prev) {
4646 prev = sdata;
4647 continue;
4648 }
4649
4650 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4651 rx.sdata = prev;
4652 ieee80211_prepare_and_rx_handle(&rx, skb, false);
4653
4654 prev = sdata;
4655 }
4656
4657 if (prev) {
4658 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4659 rx.sdata = prev;
4660
4661 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4662 return;
4663 }
4664
4665 out:
4666 dev_kfree_skb(skb);
4667}
4668
4669
4670
4671
4672
4673void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
4674 struct sk_buff *skb, struct list_head *list)
4675{
4676 struct ieee80211_local *local = hw_to_local(hw);
4677 struct ieee80211_rate *rate = NULL;
4678 struct ieee80211_supported_band *sband;
4679 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4680
4681 WARN_ON_ONCE(softirq_count() == 0);
4682
4683 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
4684 goto drop;
4685
4686 sband = local->hw.wiphy->bands[status->band];
4687 if (WARN_ON(!sband))
4688 goto drop;
4689
4690
4691
4692
4693
4694
4695
4696
4697 if (unlikely(local->quiescing || local->suspended))
4698 goto drop;
4699
4700
4701 if (unlikely(local->in_reconfig))
4702 goto drop;
4703
4704
4705
4706
4707
4708 if (WARN_ON(!local->started))
4709 goto drop;
4710
4711 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
4712
4713
4714
4715
4716
4717 switch (status->encoding) {
4718 case RX_ENC_HT:
4719
4720
4721
4722
4723
4724
4725
4726
4727
4728
4729 if (WARN(status->rate_idx > 76,
4730 "Rate marked as an HT rate but passed "
4731 "status->rate_idx is not "
4732 "an MCS index [0-76]: %d (0x%02x)\n",
4733 status->rate_idx,
4734 status->rate_idx))
4735 goto drop;
4736 break;
4737 case RX_ENC_VHT:
4738 if (WARN_ONCE(status->rate_idx > 9 ||
4739 !status->nss ||
4740 status->nss > 8,
4741 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
4742 status->rate_idx, status->nss))
4743 goto drop;
4744 break;
4745 case RX_ENC_HE:
4746 if (WARN_ONCE(status->rate_idx > 11 ||
4747 !status->nss ||
4748 status->nss > 8,
4749 "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
4750 status->rate_idx, status->nss))
4751 goto drop;
4752 break;
4753 default:
4754 WARN_ON_ONCE(1);
4755 fallthrough;
4756 case RX_ENC_LEGACY:
4757 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
4758 goto drop;
4759 rate = &sband->bitrates[status->rate_idx];
4760 }
4761 }
4762
4763 status->rx_flags = 0;
4764
4765
4766
4767
4768
4769
4770
4771 skb = ieee80211_rx_monitor(local, skb, rate);
4772 if (!skb)
4773 return;
4774
4775 ieee80211_tpt_led_trig_rx(local,
4776 ((struct ieee80211_hdr *)skb->data)->frame_control,
4777 skb->len);
4778
4779 __ieee80211_rx_handle_packet(hw, pubsta, skb, list);
4780
4781 return;
4782 drop:
4783 kfree_skb(skb);
4784}
4785EXPORT_SYMBOL(ieee80211_rx_list);
4786
4787void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
4788 struct sk_buff *skb, struct napi_struct *napi)
4789{
4790 struct sk_buff *tmp;
4791 LIST_HEAD(list);
4792
4793
4794
4795
4796
4797
4798
4799 rcu_read_lock();
4800 ieee80211_rx_list(hw, pubsta, skb, &list);
4801 rcu_read_unlock();
4802
4803 if (!napi) {
4804 netif_receive_skb_list(&list);
4805 return;
4806 }
4807
4808 list_for_each_entry_safe(skb, tmp, &list, list) {
4809 skb_list_del_init(skb);
4810 napi_gro_receive(napi, skb);
4811 }
4812}
4813EXPORT_SYMBOL(ieee80211_rx_napi);
4814
4815
4816
4817void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
4818{
4819 struct ieee80211_local *local = hw_to_local(hw);
4820
4821 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
4822
4823 skb->pkt_type = IEEE80211_RX_MSG;
4824 skb_queue_tail(&local->skb_queue, skb);
4825 tasklet_schedule(&local->tasklet);
4826}
4827EXPORT_SYMBOL(ieee80211_rx_irqsafe);
4828