projects/linux·blob master · refs

5776 lines · 160.5 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright 2002-2005, Instant802 Networks, Inc.
4 * Copyright 2005-2006, Devicescape Software, Inc.
5 * Copyright 2006-2007 Jiri Benc <[email protected]>
6 * Copyright 2007-2010 Johannes Berg <[email protected]>
7 * Copyright 2013-2014 Intel Mobile Communications GmbH
8 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9 * Copyright (C) 2018-2026 Intel Corporation
10 */
11
12#include <linux/jiffies.h>
13#include <linux/slab.h>
14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
18#include <linux/rcupdate.h>
19#include <linux/export.h>
20#include <linux/kcov.h>
21#include <linux/bitops.h>
22#include <kunit/visibility.h>
23#include <net/mac80211.h>
24#include <net/ieee80211_radiotap.h>
25#include <linux/unaligned.h>
26
27#include "ieee80211_i.h"
28#include "driver-ops.h"
29#include "led.h"
30#include "mesh.h"
31#include "wep.h"
32#include "wpa.h"
33#include "tkip.h"
34#include "wme.h"
35#include "rate.h"
36
37/*
38 * monitor mode reception
39 *
40 * This function cleans up the SKB, i.e. it removes all the stuff
41 * only useful for monitoring.
42 */
43static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
44 unsigned int present_fcs_len,
45 unsigned int rtap_space)
46{
47 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
48 struct ieee80211_hdr *hdr;
49 unsigned int hdrlen;
50 __le16 fc;
51
52 if (present_fcs_len)
53 __pskb_trim(skb, skb->len - present_fcs_len);
54 pskb_pull(skb, rtap_space);
55
56 /* After pulling radiotap header, clear all flags that indicate
57 * info in skb->data.
58 */
59 status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |
60 RX_FLAG_RADIOTAP_LSIG |
61 RX_FLAG_RADIOTAP_HE_MU |
62 RX_FLAG_RADIOTAP_HE |
63 RX_FLAG_RADIOTAP_VHT);
64
65 hdr = (void *)skb->data;
66 fc = hdr->frame_control;
67
68 /*
69 * Remove the HT-Control field (if present) on management
70 * frames after we've sent the frame to monitoring. We
71 * (currently) don't need it, and don't properly parse
72 * frames with it present, due to the assumption of a
73 * fixed management header length.
74 */
75 if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
76 return skb;
77
78 hdrlen = ieee80211_hdrlen(fc);
79 hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
80
81 if (!pskb_may_pull(skb, hdrlen)) {
82 dev_kfree_skb(skb);
83 return NULL;
84 }
85
86 memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
87 hdrlen - IEEE80211_HT_CTL_LEN);
88 pskb_pull(skb, IEEE80211_HT_CTL_LEN);
89
90 return skb;
91}
92
93static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
94 unsigned int rtap_space)
95{
96 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
97 struct ieee80211_hdr *hdr;
98
99 hdr = (void *)(skb->data + rtap_space);
100
101 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
102 RX_FLAG_FAILED_PLCP_CRC |
103 RX_FLAG_ONLY_MONITOR |
104 RX_FLAG_NO_PSDU))
105 return true;
106
107 if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
108 return true;
109
110 if (ieee80211_is_ctl(hdr->frame_control) &&
111 !ieee80211_is_pspoll(hdr->frame_control) &&
112 !ieee80211_is_back_req(hdr->frame_control))
113 return true;
114
115 return false;
116}
117
118static int
119ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
120 struct ieee80211_rx_status *status,
121 struct sk_buff *skb)
122{
123 int len;
124
125 /* always present fields */
126 len = sizeof(struct ieee80211_radiotap_header) + 8;
127
128 /* allocate extra bitmaps */
129 if (status->chains)
130 len += 4 * hweight8(status->chains);
131
132 if (ieee80211_have_rx_timestamp(status)) {
133 len = ALIGN(len, 8);
134 len += 8;
135 }
136 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
137 len += 1;
138
139 /* antenna field, if we don't have per-chain info */
140 if (!status->chains)
141 len += 1;
142
143 /* padding for RX_FLAGS if necessary */
144 len = ALIGN(len, 2);
145
146 if (status->encoding == RX_ENC_HT) /* HT info */
147 len += 3;
148
149 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
150 len = ALIGN(len, 4);
151 len += 8;
152 }
153
154 if (status->encoding == RX_ENC_VHT) {
155 /* Included even if RX_FLAG_RADIOTAP_VHT is not set */
156 len = ALIGN(len, 2);
157 len += 12;
158 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_vht) != 12);
159 }
160
161 if (local->hw.radiotap_timestamp.units_pos >= 0) {
162 len = ALIGN(len, 8);
163 len += 12;
164 }
165
166 if (status->encoding == RX_ENC_HE &&
167 status->flag & RX_FLAG_RADIOTAP_HE) {
168 len = ALIGN(len, 2);
169 len += 12;
170 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
171 }
172
173 if (status->encoding == RX_ENC_HE &&
174 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
175 len = ALIGN(len, 2);
176 len += 12;
177 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
178 }
179
180 if (status->flag & RX_FLAG_NO_PSDU)
181 len += 1;
182
183 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
184 len = ALIGN(len, 2);
185 len += 4;
186 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
187 }
188
189 if (status->chains) {
190 /* antenna and antenna signal fields */
191 len += 2 * hweight8(status->chains);
192 }
193
194 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
195 int tlv_offset = 0;
196
197 /*
198 * The position to look at depends on the existence (or non-
199 * existence) of other elements, so take that into account...
200 */
201 if (status->flag & RX_FLAG_RADIOTAP_VHT)
202 tlv_offset +=
203 sizeof(struct ieee80211_radiotap_vht);
204 if (status->flag & RX_FLAG_RADIOTAP_HE)
205 tlv_offset +=
206 sizeof(struct ieee80211_radiotap_he);
207 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
208 tlv_offset +=
209 sizeof(struct ieee80211_radiotap_he_mu);
210 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
211 tlv_offset +=
212 sizeof(struct ieee80211_radiotap_lsig);
213
214 /* ensure 4 byte alignment for TLV */
215 len = ALIGN(len, 4);
216
217 /* TLVs until the mac header */
218 len += skb_mac_header(skb) - &skb->data[tlv_offset];
219 }
220
221 return len;
222}
223
224static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
225 int link_id,
226 struct sta_info *sta,
227 struct sk_buff *skb)
228{
229 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
230
231 if (link_id >= 0) {
232 status->link_valid = 1;
233 status->link_id = link_id;
234 } else {
235 status->link_valid = 0;
236 }
237
238 skb_queue_tail(&sdata->skb_queue, skb);
239 wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
240 if (sta) {
241 struct link_sta_info *link_sta_info;
242
243 if (link_id >= 0) {
244 link_sta_info = rcu_dereference(sta->link[link_id]);
245 if (!link_sta_info)
246 return;
247 } else {
248 link_sta_info = &sta->deflink;
249 }
250
251 link_sta_info->rx_stats.packets++;
252 }
253}
254
255static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
256 int link_id,
257 struct sta_info *sta,
258 struct sk_buff *skb)
259{
260 skb->protocol = 0;
261 __ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
262}
263
264static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
265 struct sk_buff *skb,
266 int rtap_space)
267{
268 struct {
269 struct ieee80211_hdr_3addr hdr;
270 u8 category;
271 u8 action_code;
272 } __packed __aligned(2) action;
273
274 if (!sdata)
275 return;
276
277 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE(action_code));
278
279 if (skb->len < rtap_space + sizeof(action) +
280 VHT_MUMIMO_GROUPS_DATA_LEN)
281 return;
282
283 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
284 return;
285
286 skb_copy_bits(skb, rtap_space, &action, sizeof(action));
287
288 if (!ieee80211_is_action(action.hdr.frame_control))
289 return;
290
291 if (action.category != WLAN_CATEGORY_VHT)
292 return;
293
294 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
295 return;
296
297 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
298 return;
299
300 skb = skb_copy(skb, GFP_ATOMIC);
301 if (!skb)
302 return;
303
304 ieee80211_queue_skb_to_iface(sdata, -1, NULL, skb);
305}
306
307/*
308 * ieee80211_add_rx_radiotap_header - add radiotap header
309 *
310 * add a radiotap header containing all the fields which the hardware provided.
311 */
312static void
313ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
314 struct sk_buff *skb,
315 struct ieee80211_rate *rate,
316 int rtap_len, bool has_fcs)
317{
318 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
319 struct ieee80211_radiotap_header *rthdr;
320 unsigned char *pos;
321 __le32 *it_present;
322 u32 it_present_val;
323 u16 rx_flags = 0;
324 u16 channel_flags = 0;
325 u32 tlvs_len = 0;
326 int mpdulen, chain;
327 unsigned long chains = status->chains;
328 struct ieee80211_radiotap_vht vht = {};
329 struct ieee80211_radiotap_he he = {};
330 struct ieee80211_radiotap_he_mu he_mu = {};
331 struct ieee80211_radiotap_lsig lsig = {};
332
333 if (status->flag & RX_FLAG_RADIOTAP_VHT) {
334 vht = *(struct ieee80211_radiotap_vht *)skb->data;
335 skb_pull(skb, sizeof(vht));
336 WARN_ON_ONCE(status->encoding != RX_ENC_VHT);
337 }
338
339 if (status->flag & RX_FLAG_RADIOTAP_HE) {
340 he = *(struct ieee80211_radiotap_he *)skb->data;
341 skb_pull(skb, sizeof(he));
342 WARN_ON_ONCE(status->encoding != RX_ENC_HE);
343 }
344
345 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
346 he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
347 skb_pull(skb, sizeof(he_mu));
348 }
349
350 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
351 lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
352 skb_pull(skb, sizeof(lsig));
353 }
354
355 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
356 /* data is pointer at tlv all other info was pulled off */
357 tlvs_len = skb_mac_header(skb) - skb->data;
358 }
359
360 mpdulen = skb->len;
361 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
362 mpdulen += FCS_LEN;
363
364 rthdr = skb_push(skb, rtap_len - tlvs_len);
365 memset(rthdr, 0, rtap_len - tlvs_len);
366 it_present = &rthdr->it_present;
367
368 /* radiotap header, set always present flags */
369 rthdr->it_len = cpu_to_le16(rtap_len);
370 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
371 BIT(IEEE80211_RADIOTAP_CHANNEL) |
372 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
373
374 if (!status->chains)
375 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
376
377 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
378 it_present_val |=
379 BIT(IEEE80211_RADIOTAP_EXT) |
380 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
381 put_unaligned_le32(it_present_val, it_present);
382 it_present++;
383 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
384 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
385 }
386
387 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
388 it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
389
390 put_unaligned_le32(it_present_val, it_present);
391
392 /* This references through an offset into it_optional[] rather
393 * than via it_present otherwise later uses of pos will cause
394 * the compiler to think we have walked past the end of the
395 * struct member.
396 */
397 pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
398
399 /* the order of the following fields is important */
400
401 /* IEEE80211_RADIOTAP_TSFT */
402 if (ieee80211_have_rx_timestamp(status)) {
403 /* padding */
404 while ((pos - (u8 *)rthdr) & 7)
405 *pos++ = 0;
406 put_unaligned_le64(
407 ieee80211_calculate_rx_timestamp(&local->hw, status,
408 mpdulen, 0),
409 pos);
410 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
411 pos += 8;
412 }
413
414 /* IEEE80211_RADIOTAP_FLAGS */
415 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
416 *pos |= IEEE80211_RADIOTAP_F_FCS;
417 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
418 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
419 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
420 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
421 pos++;
422
423 /* IEEE80211_RADIOTAP_RATE */
424 if (!rate || status->encoding != RX_ENC_LEGACY) {
425 /*
426 * Without rate information don't add it. If we have,
427 * MCS information is a separate field in radiotap,
428 * added below. The byte here is needed as padding
429 * for the channel though, so initialise it to 0.
430 */
431 *pos = 0;
432 } else {
433 int shift = 0;
434 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
435 if (status->bw == RATE_INFO_BW_10)
436 shift = 1;
437 else if (status->bw == RATE_INFO_BW_5)
438 shift = 2;
439 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
440 }
441 pos++;
442
443 /* IEEE80211_RADIOTAP_CHANNEL */
444 /* TODO: frequency offset in KHz */
445 put_unaligned_le16(status->freq, pos);
446 pos += 2;
447 if (status->bw == RATE_INFO_BW_10)
448 channel_flags |= IEEE80211_CHAN_HALF;
449 else if (status->bw == RATE_INFO_BW_5)
450 channel_flags |= IEEE80211_CHAN_QUARTER;
451
452 if (status->band == NL80211_BAND_5GHZ ||
453 status->band == NL80211_BAND_6GHZ)
454 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
455 else if (status->encoding != RX_ENC_LEGACY)
456 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
457 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
458 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
459 else if (rate)
460 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
461 else
462 channel_flags |= IEEE80211_CHAN_2GHZ;
463 put_unaligned_le16(channel_flags, pos);
464 pos += 2;
465
466 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
467 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
468 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
469 *pos = status->signal;
470 rthdr->it_present |=
471 cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
472 pos++;
473 }
474
475 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
476
477 if (!status->chains) {
478 /* IEEE80211_RADIOTAP_ANTENNA */
479 *pos = status->antenna;
480 pos++;
481 }
482
483 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
484
485 /* IEEE80211_RADIOTAP_RX_FLAGS */
486 /* ensure 2 byte alignment for the 2 byte field as required */
487 if ((pos - (u8 *)rthdr) & 1)
488 *pos++ = 0;
489 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
490 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
491 put_unaligned_le16(rx_flags, pos);
492 pos += 2;
493
494 if (status->encoding == RX_ENC_HT) {
495 unsigned int stbc;
496
497 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
498 *pos = local->hw.radiotap_mcs_details;
499 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
500 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
501 if (status->enc_flags & RX_ENC_FLAG_LDPC)
502 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
503 pos++;
504 *pos = 0;
505 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
506 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
507 if (status->bw == RATE_INFO_BW_40)
508 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
509 if (status->enc_flags & RX_ENC_FLAG_HT_GF)
510 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
511 if (status->enc_flags & RX_ENC_FLAG_LDPC)
512 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
513 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
514 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
515 pos++;
516 *pos++ = status->rate_idx;
517 }
518
519 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
520 u16 flags = 0;
521
522 /* ensure 4 byte alignment */
523 while ((pos - (u8 *)rthdr) & 3)
524 pos++;
525 rthdr->it_present |=
526 cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
527 put_unaligned_le32(status->ampdu_reference, pos);
528 pos += 4;
529 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
530 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
531 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
532 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
533 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
534 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
535 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
536 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
537 if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
538 flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
539 put_unaligned_le16(flags, pos);
540 pos += 2;
541 *pos++ = 0;
542 *pos++ = 0;
543 }
544
545 if (status->encoding == RX_ENC_VHT) {
546 u16 fill = local->hw.radiotap_vht_details;
547
548 /* Leave driver filled fields alone */
549 fill &= ~le16_to_cpu(vht.known);
550 vht.known |= cpu_to_le16(fill);
551
552 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_GI &&
553 status->enc_flags & RX_ENC_FLAG_SHORT_GI)
554 vht.flags |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
555 /* in VHT, STBC is binary */
556 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_STBC &&
557 status->enc_flags & RX_ENC_FLAG_STBC_MASK)
558 vht.flags |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
559 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_BEAMFORMED &&
560 status->enc_flags & RX_ENC_FLAG_BF)
561 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
562
563 if (fill & IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH) {
564 switch (status->bw) {
565 case RATE_INFO_BW_40:
566 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_40;
567 break;
568 case RATE_INFO_BW_80:
569 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_80;
570 break;
571 case RATE_INFO_BW_160:
572 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_160;
573 break;
574 default:
575 vht.bandwidth = IEEE80211_RADIOTAP_VHT_BW_20;
576 break;
577 }
578 }
579
580 /*
581 * If the driver filled in mcs_nss[0], then do not touch it.
582 *
583 * Otherwise, put some information about MCS/NSS into the
584 * user 0 field. Note that this is not technically correct for
585 * an MU frame as we might have decoded a different user.
586 */
587 if (!vht.mcs_nss[0]) {
588 vht.mcs_nss[0] = (status->rate_idx << 4) | status->nss;
589
590 /* coding field */
591 if (status->enc_flags & RX_ENC_FLAG_LDPC)
592 vht.coding |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
593 }
594
595 /* ensure 2 byte alignment */
596 while ((pos - (u8 *)rthdr) & 1)
597 pos++;
598 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
599 memcpy(pos, &vht, sizeof(vht));
600 pos += sizeof(vht);
601 }
602
603 if (local->hw.radiotap_timestamp.units_pos >= 0) {
604 u16 accuracy = 0;
605 u8 flags;
606 u64 ts;
607
608 rthdr->it_present |=
609 cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
610
611 /* ensure 8 byte alignment */
612 while ((pos - (u8 *)rthdr) & 7)
613 pos++;
614
615 if (status->flag & RX_FLAG_MACTIME_IS_RTAP_TS64) {
616 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT;
617 ts = status->mactime;
618 } else {
619 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
620 ts = status->device_timestamp;
621 }
622
623 put_unaligned_le64(ts, pos);
624 pos += sizeof(u64);
625
626 if (local->hw.radiotap_timestamp.accuracy >= 0) {
627 accuracy = local->hw.radiotap_timestamp.accuracy;
628 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
629 }
630 put_unaligned_le16(accuracy, pos);
631 pos += sizeof(u16);
632
633 *pos++ = local->hw.radiotap_timestamp.units_pos;
634 *pos++ = flags;
635 }
636
637 if (status->encoding == RX_ENC_HE &&
638 status->flag & RX_FLAG_RADIOTAP_HE) {
639#define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
640
641 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
642 he.data6 |= HE_PREP(DATA6_NSTS,
643 FIELD_GET(RX_ENC_FLAG_STBC_MASK,
644 status->enc_flags));
645 he.data3 |= HE_PREP(DATA3_STBC, 1);
646 } else {
647 he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
648 }
649
650#define CHECK_GI(s) \
651 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
652 (int)NL80211_RATE_INFO_HE_GI_##s)
653
654 CHECK_GI(0_8);
655 CHECK_GI(1_6);
656 CHECK_GI(3_2);
657
658 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
659 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
660 he.data3 |= HE_PREP(DATA3_CODING,
661 !!(status->enc_flags & RX_ENC_FLAG_LDPC));
662
663 he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
664
665 switch (status->bw) {
666 case RATE_INFO_BW_20:
667 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
668 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
669 break;
670 case RATE_INFO_BW_40:
671 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
672 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
673 break;
674 case RATE_INFO_BW_80:
675 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
676 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
677 break;
678 case RATE_INFO_BW_160:
679 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
680 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
681 break;
682 case RATE_INFO_BW_HE_RU:
683#define CHECK_RU_ALLOC(s) \
684 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
685 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
686
687 CHECK_RU_ALLOC(26);
688 CHECK_RU_ALLOC(52);
689 CHECK_RU_ALLOC(106);
690 CHECK_RU_ALLOC(242);
691 CHECK_RU_ALLOC(484);
692 CHECK_RU_ALLOC(996);
693 CHECK_RU_ALLOC(2x996);
694
695 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
696 status->he_ru + 4);
697 break;
698 default:
699 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
700 }
701
702 /* ensure 2 byte alignment */
703 while ((pos - (u8 *)rthdr) & 1)
704 pos++;
705 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
706 memcpy(pos, &he, sizeof(he));
707 pos += sizeof(he);
708 }
709
710 if (status->encoding == RX_ENC_HE &&
711 status->flag & RX_FLAG_RADIOTAP_HE_MU) {
712 /* ensure 2 byte alignment */
713 while ((pos - (u8 *)rthdr) & 1)
714 pos++;
715 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
716 memcpy(pos, &he_mu, sizeof(he_mu));
717 pos += sizeof(he_mu);
718 }
719
720 if (status->flag & RX_FLAG_NO_PSDU) {
721 rthdr->it_present |=
722 cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
723 *pos++ = status->zero_length_psdu_type;
724 }
725
726 if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
727 /* ensure 2 byte alignment */
728 while ((pos - (u8 *)rthdr) & 1)
729 pos++;
730 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
731 memcpy(pos, &lsig, sizeof(lsig));
732 pos += sizeof(lsig);
733 }
734
735 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
736 *pos++ = status->chain_signal[chain];
737 *pos++ = chain;
738 }
739}
740
741static struct sk_buff *
742ieee80211_make_monitor_skb(struct ieee80211_local *local,
743 struct sk_buff **origskb,
744 struct ieee80211_rate *rate,
745 int rtap_space, bool use_origskb)
746{
747 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
748 int rt_hdrlen, needed_headroom;
749 struct sk_buff *skb;
750
751 /* room for the radiotap header based on driver features */
752 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
753 needed_headroom = rt_hdrlen - rtap_space;
754
755 if (use_origskb) {
756 /* only need to expand headroom if necessary */
757 skb = *origskb;
758 *origskb = NULL;
759
760 /*
761 * This shouldn't trigger often because most devices have an
762 * RX header they pull before we get here, and that should
763 * be big enough for our radiotap information. We should
764 * probably export the length to drivers so that we can have
765 * them allocate enough headroom to start with.
766 */
767 if (skb_headroom(skb) < needed_headroom &&
768 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
769 dev_kfree_skb(skb);
770 return NULL;
771 }
772 } else {
773 /*
774 * Need to make a copy and possibly remove radiotap header
775 * and FCS from the original.
776 */
777 skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD,
778 0, GFP_ATOMIC);
779
780 if (!skb)
781 return NULL;
782 }
783
784 /* prepend radiotap information */
785 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
786
787 skb_reset_mac_header(skb);
788 skb->ip_summed = CHECKSUM_UNNECESSARY;
789 skb->pkt_type = PACKET_OTHERHOST;
790 skb->protocol = htons(ETH_P_802_2);
791
792 return skb;
793}
794
795static bool
796ieee80211_validate_monitor_radio(struct ieee80211_sub_if_data *sdata,
797 struct ieee80211_local *local,
798 struct ieee80211_rx_status *status)
799{
800 struct wiphy *wiphy = local->hw.wiphy;
801 int i, freq, bw;
802
803 if (!wiphy->n_radio)
804 return true;
805
806 switch (status->bw) {
807 case RATE_INFO_BW_20:
808 bw = 20000;
809 break;
810 case RATE_INFO_BW_40:
811 bw = 40000;
812 break;
813 case RATE_INFO_BW_80:
814 bw = 80000;
815 break;
816 case RATE_INFO_BW_160:
817 bw = 160000;
818 break;
819 case RATE_INFO_BW_320:
820 bw = 320000;
821 break;
822 default:
823 return false;
824 }
825
826 freq = MHZ_TO_KHZ(status->freq);
827
828 for (i = 0; i < wiphy->n_radio; i++) {
829 if (!(sdata->wdev.radio_mask & BIT(i)))
830 continue;
831
832 if (!ieee80211_radio_freq_range_valid(&wiphy->radio[i], freq, bw))
833 continue;
834
835 return true;
836 }
837 return false;
838}
839
840/*
841 * This function copies a received frame to all monitor interfaces and
842 * returns a cleaned-up SKB that no longer includes the FCS nor the
843 * radiotap header the driver might have added.
844 */
845static struct sk_buff *
846ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
847 struct ieee80211_rate *rate)
848{
849 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
850 struct ieee80211_sub_if_data *sdata, *prev_sdata = NULL;
851 struct sk_buff *skb, *monskb = NULL;
852 int present_fcs_len = 0;
853 unsigned int rtap_space = 0;
854 struct ieee80211_sub_if_data *monitor_sdata =
855 rcu_dereference(local->monitor_sdata);
856 bool only_monitor = false;
857 unsigned int min_head_len;
858
859 if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&
860 !skb_mac_header_was_set(origskb))) {
861 /* with this skb no way to know where frame payload starts */
862 dev_kfree_skb(origskb);
863 return NULL;
864 }
865
866 if (status->flag & RX_FLAG_RADIOTAP_VHT)
867 rtap_space += sizeof(struct ieee80211_radiotap_vht);
868
869 if (status->flag & RX_FLAG_RADIOTAP_HE)
870 rtap_space += sizeof(struct ieee80211_radiotap_he);
871
872 if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
873 rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
874
875 if (status->flag & RX_FLAG_RADIOTAP_LSIG)
876 rtap_space += sizeof(struct ieee80211_radiotap_lsig);
877
878 if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
879 rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];
880
881 min_head_len = rtap_space;
882
883 /*
884 * First, we may need to make a copy of the skb because
885 * (1) we need to modify it for radiotap (if not present), and
886 * (2) the other RX handlers will modify the skb we got.
887 *
888 * We don't need to, of course, if we aren't going to return
889 * the SKB because it has a bad FCS/PLCP checksum.
890 */
891
892 if (!(status->flag & RX_FLAG_NO_PSDU)) {
893 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
894 if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
895 /* driver bug */
896 WARN_ON(1);
897 dev_kfree_skb(origskb);
898 return NULL;
899 }
900 present_fcs_len = FCS_LEN;
901 }
902
903 /* also consider the hdr->frame_control */
904 min_head_len += 2;
905 }
906
907 /* ensure that the expected data elements are in skb head */
908 if (!pskb_may_pull(origskb, min_head_len)) {
909 dev_kfree_skb(origskb);
910 return NULL;
911 }
912
913 only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space);
914
915 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
916 if (only_monitor) {
917 dev_kfree_skb(origskb);
918 return NULL;
919 }
920
921 return ieee80211_clean_skb(origskb, present_fcs_len,
922 rtap_space);
923 }
924
925 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space);
926
927 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
928 struct cfg80211_chan_def *chandef;
929
930 chandef = &sdata->vif.bss_conf.chanreq.oper;
931 if (chandef->chan &&
932 chandef->chan->center_freq != status->freq)
933 continue;
934
935 if (ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR) &&
936 !ieee80211_validate_monitor_radio(sdata, local, status))
937 continue;
938
939 if (!prev_sdata) {
940 prev_sdata = sdata;
941 continue;
942 }
943
944 if (ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR))
945 ieee80211_handle_mu_mimo_mon(sdata, origskb, rtap_space);
946
947 if (!monskb)
948 monskb = ieee80211_make_monitor_skb(local, &origskb,
949 rate, rtap_space,
950 false);
951 if (!monskb)
952 continue;
953
954 skb = skb_clone(monskb, GFP_ATOMIC);
955 if (!skb)
956 continue;
957
958 skb->dev = prev_sdata->dev;
959 dev_sw_netstats_rx_add(skb->dev, skb->len);
960 netif_receive_skb(skb);
961 prev_sdata = sdata;
962 }
963
964 if (prev_sdata) {
965 if (monskb)
966 skb = monskb;
967 else
968 skb = ieee80211_make_monitor_skb(local, &origskb,
969 rate, rtap_space,
970 only_monitor);
971 if (skb) {
972 skb->dev = prev_sdata->dev;
973 dev_sw_netstats_rx_add(skb->dev, skb->len);
974 netif_receive_skb(skb);
975 }
976 }
977
978 if (!origskb)
979 return NULL;
980
981 return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space);
982}
983
984static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
985{
986 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
987 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
988 int tid, seqno_idx, security_idx;
989
990 /* does the frame have a qos control field? */
991 if (ieee80211_is_data_qos(hdr->frame_control)) {
992 u8 *qc = ieee80211_get_qos_ctl(hdr);
993 /* frame has qos control */
994 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
995 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
996 status->rx_flags |= IEEE80211_RX_AMSDU;
997
998 seqno_idx = tid;
999 security_idx = tid;
1000 } else {
1001 /*
1002 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
1003 *
1004 * Sequence numbers for management frames, QoS data
1005 * frames with a broadcast/multicast address in the
1006 * Address 1 field, and all non-QoS data frames sent
1007 * by QoS STAs are assigned using an additional single
1008 * modulo-4096 counter, [...]
1009 *
1010 * We also use that counter for non-QoS STAs.
1011 */
1012 seqno_idx = IEEE80211_NUM_TIDS;
1013 security_idx = 0;
1014 if (ieee80211_is_mgmt(hdr->frame_control))
1015 security_idx = IEEE80211_NUM_TIDS;
1016 tid = 0;
1017 }
1018
1019 rx->seqno_idx = seqno_idx;
1020 rx->security_idx = security_idx;
1021 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
1022 * For now, set skb->priority to 0 for other cases. */
1023 rx->skb->priority = (tid > 7) ? 0 : tid;
1024}
1025
1026/**
1027 * DOC: Packet alignment
1028 *
1029 * Drivers always need to pass packets that are aligned to two-byte boundaries
1030 * to the stack.
1031 *
1032 * Additionally, they should, if possible, align the payload data in a way that
1033 * guarantees that the contained IP header is aligned to a four-byte
1034 * boundary. In the case of regular frames, this simply means aligning the
1035 * payload to a four-byte boundary (because either the IP header is directly
1036 * contained, or IV/RFC1042 headers that have a length divisible by four are
1037 * in front of it). If the payload data is not properly aligned and the
1038 * architecture doesn't support efficient unaligned operations, mac80211
1039 * will align the data.
1040 *
1041 * With A-MSDU frames, however, the payload data address must yield two modulo
1042 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
1043 * push the IP header further back to a multiple of four again. Thankfully, the
1044 * specs were sane enough this time around to require padding each A-MSDU
1045 * subframe to a length that is a multiple of four.
1046 *
1047 * Padding like Atheros hardware adds which is between the 802.11 header and
1048 * the payload is not supported; the driver is required to move the 802.11
1049 * header to be directly in front of the payload in that case.
1050 */
1051static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
1052{
1053#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1054 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
1055#endif
1056}
1057
1058
1059/* rx handlers */
1060
1061static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
1062{
1063 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1064
1065 if (is_multicast_ether_addr(hdr->addr1))
1066 return 0;
1067
1068 return ieee80211_is_robust_mgmt_frame(skb);
1069}
1070
1071
1072static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
1073{
1074 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1075
1076 if (!is_multicast_ether_addr(hdr->addr1))
1077 return 0;
1078
1079 return ieee80211_is_robust_mgmt_frame(skb);
1080}
1081
1082
1083/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
1084static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
1085{
1086 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
1087 struct ieee80211_mmie *mmie;
1088 struct ieee80211_mmie_16 *mmie16;
1089
1090 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
1091 return -1;
1092
1093 if (!ieee80211_is_robust_mgmt_frame(skb) &&
1094 !ieee80211_is_beacon(hdr->frame_control))
1095 return -1; /* not a robust management frame */
1096
1097 mmie = (struct ieee80211_mmie *)
1098 (skb->data + skb->len - sizeof(*mmie));
1099 if (mmie->element_id == WLAN_EID_MMIE &&
1100 mmie->length == sizeof(*mmie) - 2)
1101 return le16_to_cpu(mmie->key_id);
1102
1103 mmie16 = (struct ieee80211_mmie_16 *)
1104 (skb->data + skb->len - sizeof(*mmie16));
1105 if (skb->len >= 24 + sizeof(*mmie16) &&
1106 mmie16->element_id == WLAN_EID_MMIE &&
1107 mmie16->length == sizeof(*mmie16) - 2)
1108 return le16_to_cpu(mmie16->key_id);
1109
1110 return -1;
1111}
1112
1113static int ieee80211_get_keyid(struct sk_buff *skb)
1114{
1115 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1116 __le16 fc = hdr->frame_control;
1117 int hdrlen = ieee80211_hdrlen(fc);
1118 u8 keyid;
1119
1120 /* WEP, TKIP, CCMP and GCMP */
1121 if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
1122 return -EINVAL;
1123
1124 skb_copy_bits(skb, hdrlen + 3, &keyid, 1);
1125
1126 keyid >>= 6;
1127
1128 return keyid;
1129}
1130
1131static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1132{
1133 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1134 char *dev_addr = rx->sdata->vif.addr;
1135
1136 if (ieee80211_is_data(hdr->frame_control)) {
1137 if (is_multicast_ether_addr(hdr->addr1)) {
1138 if (ieee80211_has_tods(hdr->frame_control) ||
1139 !ieee80211_has_fromds(hdr->frame_control))
1140 return RX_DROP_U_MESH_DS_BITS;
1141 if (ether_addr_equal(hdr->addr3, dev_addr))
1142 return RX_DROP_U_MESH_A3_MISMATCH;
1143 } else {
1144 if (!ieee80211_has_a4(hdr->frame_control))
1145 return RX_DROP_U_MESH_NO_A4;
1146 if (ether_addr_equal(hdr->addr4, dev_addr))
1147 return RX_DROP_U_MESH_A4_MISMATCH;
1148 }
1149 }
1150
1151 /* If there is not an established peer link and this is not a peer link
1152 * establisment frame, beacon or probe, drop the frame.
1153 */
1154
1155 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
1156 struct ieee80211_mgmt *mgmt;
1157
1158 if (!ieee80211_is_mgmt(hdr->frame_control))
1159 return RX_DROP_U_MESH_UNEXP_DATA;
1160
1161 if (ieee80211_is_action(hdr->frame_control)) {
1162 u8 category;
1163
1164 /* make sure category field is present */
1165 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(category))
1166 return RX_DROP_U_RUNT_ACTION;
1167
1168 mgmt = (struct ieee80211_mgmt *)hdr;
1169 category = mgmt->u.action.category;
1170 if (category != WLAN_CATEGORY_MESH_ACTION &&
1171 category != WLAN_CATEGORY_SELF_PROTECTED)
1172 return RX_DROP_U_MESH_WRONG_ACTION;
1173 return RX_CONTINUE;
1174 }
1175
1176 if (ieee80211_is_probe_req(hdr->frame_control) ||
1177 ieee80211_is_probe_resp(hdr->frame_control) ||
1178 ieee80211_is_beacon(hdr->frame_control) ||
1179 ieee80211_is_auth(hdr->frame_control))
1180 return RX_CONTINUE;
1181
1182 return RX_DROP_U_MESH_UNEXP_MGMT;
1183 }
1184
1185 return RX_CONTINUE;
1186}
1187
1188static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1189 int index)
1190{
1191 struct sk_buff_head *frames = &tid_agg_rx->reorder[index].buf;
1192 struct sk_buff *tail = skb_peek_tail(frames);
1193 struct ieee80211_rx_status *status;
1194
1195 if (tid_agg_rx->reorder_buf_filtered &&
1196 tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1197 return true;
1198
1199 if (!tail)
1200 return false;
1201
1202 status = IEEE80211_SKB_RXCB(tail);
1203 if (status->flag & RX_FLAG_AMSDU_MORE)
1204 return false;
1205
1206 return true;
1207}
1208
1209static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1210 struct tid_ampdu_rx *tid_agg_rx,
1211 int index,
1212 struct sk_buff_head *frames)
1213{
1214 struct sk_buff_head *skb_list = &tid_agg_rx->reorder[index].buf;
1215 struct sk_buff *skb;
1216 struct ieee80211_rx_status *status;
1217
1218 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1219
1220 if (skb_queue_empty(skb_list))
1221 goto no_frame;
1222
1223 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1224 __skb_queue_purge(skb_list);
1225 goto no_frame;
1226 }
1227
1228 /* release frames from the reorder ring buffer */
1229 tid_agg_rx->stored_mpdu_num--;
1230 while ((skb = __skb_dequeue(skb_list))) {
1231 status = IEEE80211_SKB_RXCB(skb);
1232 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1233 __skb_queue_tail(frames, skb);
1234 }
1235
1236no_frame:
1237 if (tid_agg_rx->reorder_buf_filtered)
1238 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1239 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1240}
1241
1242static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1243 struct tid_ampdu_rx *tid_agg_rx,
1244 u16 head_seq_num,
1245 struct sk_buff_head *frames)
1246{
1247 int index;
1248
1249 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1250
1251 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
1252 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1253 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1254 frames);
1255 }
1256}
1257
1258/*
1259 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1260 * the skb was added to the buffer longer than this time ago, the earlier
1261 * frames that have not yet been received are assumed to be lost and the skb
1262 * can be released for processing. This may also release other skb's from the
1263 * reorder buffer if there are no additional gaps between the frames.
1264 *
1265 * Callers must hold tid_agg_rx->reorder_lock.
1266 */
1267#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1268
1269static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1270 struct tid_ampdu_rx *tid_agg_rx,
1271 struct sk_buff_head *frames)
1272{
1273 int index, i, j;
1274
1275 lockdep_assert_held(&tid_agg_rx->reorder_lock);
1276
1277 /* release the buffer until next missing frame */
1278 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1279 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1280 tid_agg_rx->stored_mpdu_num) {
1281 /*
1282 * No buffers ready to be released, but check whether any
1283 * frames in the reorder buffer have timed out.
1284 */
1285 int skipped = 1;
1286 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1287 j = (j + 1) % tid_agg_rx->buf_size) {
1288 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
1289 skipped++;
1290 continue;
1291 }
1292 if (skipped &&
1293 !time_after(jiffies, tid_agg_rx->reorder[j].time +
1294 HT_RX_REORDER_BUF_TIMEOUT))
1295 goto set_release_timer;
1296
1297 /* don't leave incomplete A-MSDUs around */
1298 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1299 i = (i + 1) % tid_agg_rx->buf_size)
1300 __skb_queue_purge(&tid_agg_rx->reorder[i].buf);
1301
1302 ht_dbg_ratelimited(sdata,
1303 "release an RX reorder frame due to timeout on earlier frames\n");
1304 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1305 frames);
1306
1307 /*
1308 * Increment the head seq# also for the skipped slots.
1309 */
1310 tid_agg_rx->head_seq_num =
1311 (tid_agg_rx->head_seq_num +
1312 skipped) & IEEE80211_SN_MASK;
1313 skipped = 0;
1314 }
1315 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1316 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1317 frames);
1318 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1319 }
1320
1321 if (tid_agg_rx->stored_mpdu_num) {
1322 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1323
1324 for (; j != (index - 1) % tid_agg_rx->buf_size;
1325 j = (j + 1) % tid_agg_rx->buf_size) {
1326 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
1327 break;
1328 }
1329
1330 set_release_timer:
1331
1332 if (!tid_agg_rx->removed)
1333 mod_timer(&tid_agg_rx->reorder_timer,
1334 tid_agg_rx->reorder[j].time + 1 +
1335 HT_RX_REORDER_BUF_TIMEOUT);
1336 } else {
1337 timer_delete(&tid_agg_rx->reorder_timer);
1338 }
1339}
1340
1341/*
1342 * As this function belongs to the RX path it must be under
1343 * rcu_read_lock protection. It returns false if the frame
1344 * can be processed immediately, true if it was consumed.
1345 */
1346static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1347 struct tid_ampdu_rx *tid_agg_rx,
1348 struct sk_buff *skb,
1349 struct sk_buff_head *frames)
1350{
1351 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1352 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1353 u16 mpdu_seq_num = ieee80211_get_sn(hdr);
1354 u16 head_seq_num, buf_size;
1355 int index;
1356 bool ret = true;
1357
1358 spin_lock(&tid_agg_rx->reorder_lock);
1359
1360 /*
1361 * Offloaded BA sessions have no known starting sequence number so pick
1362 * one from first Rxed frame for this tid after BA was started.
1363 */
1364 if (unlikely(tid_agg_rx->auto_seq)) {
1365 tid_agg_rx->auto_seq = false;
1366 tid_agg_rx->ssn = mpdu_seq_num;
1367 tid_agg_rx->head_seq_num = mpdu_seq_num;
1368 }
1369
1370 buf_size = tid_agg_rx->buf_size;
1371 head_seq_num = tid_agg_rx->head_seq_num;
1372
1373 /*
1374 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1375 * be reordered.
1376 */
1377 if (unlikely(!tid_agg_rx->started)) {
1378 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1379 ret = false;
1380 goto out;
1381 }
1382 tid_agg_rx->started = true;
1383 }
1384
1385 /* frame with out of date sequence number */
1386 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1387 dev_kfree_skb(skb);
1388 goto out;
1389 }
1390
1391 /*
1392 * If frame the sequence number exceeds our buffering window
1393 * size release some previous frames to make room for this one.
1394 */
1395 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1396 head_seq_num = ieee80211_sn_inc(
1397 ieee80211_sn_sub(mpdu_seq_num, buf_size));
1398 /* release stored frames up to new head to stack */
1399 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1400 head_seq_num, frames);
1401 }
1402
1403 /* Now the new frame is always in the range of the reordering buffer */
1404
1405 index = mpdu_seq_num % tid_agg_rx->buf_size;
1406
1407 /* check if we already stored this frame */
1408 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1409 dev_kfree_skb(skb);
1410 goto out;
1411 }
1412
1413 /*
1414 * If the current MPDU is in the right order and nothing else
1415 * is stored we can process it directly, no need to buffer it.
1416 * If it is first but there's something stored, we may be able
1417 * to release frames after this one.
1418 */
1419 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1420 tid_agg_rx->stored_mpdu_num == 0) {
1421 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1422 tid_agg_rx->head_seq_num =
1423 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1424 ret = false;
1425 goto out;
1426 }
1427
1428 /* put the frame in the reordering buffer */
1429 __skb_queue_tail(&tid_agg_rx->reorder[index].buf, skb);
1430 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1431 tid_agg_rx->reorder[index].time = jiffies;
1432 tid_agg_rx->stored_mpdu_num++;
1433 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1434 }
1435
1436 out:
1437 spin_unlock(&tid_agg_rx->reorder_lock);
1438 return ret;
1439}
1440
1441/*
1442 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1443 * true if the MPDU was buffered, false if it should be processed.
1444 */
1445static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1446 struct sk_buff_head *frames)
1447{
1448 struct sk_buff *skb = rx->skb;
1449 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1450 struct sta_info *sta = rx->sta;
1451 struct tid_ampdu_rx *tid_agg_rx;
1452 u16 sc;
1453 u8 tid, ack_policy;
1454
1455 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1456 is_multicast_ether_addr(hdr->addr1))
1457 goto dont_reorder;
1458
1459 /*
1460 * filter the QoS data rx stream according to
1461 * STA/TID and check if this STA/TID is on aggregation
1462 */
1463
1464 if (!sta)
1465 goto dont_reorder;
1466
1467 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1468 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1469 tid = ieee80211_get_tid(hdr);
1470
1471 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1472 if (!tid_agg_rx) {
1473 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1474 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1475 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1476 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1477 WLAN_BACK_RECIPIENT,
1478 WLAN_REASON_QSTA_REQUIRE_SETUP,
1479 ieee80211_s1g_use_ndp_ba(rx->sdata,
1480 rx->sta));
1481 goto dont_reorder;
1482 }
1483
1484 /* qos null data frames are excluded */
1485 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1486 goto dont_reorder;
1487
1488 /* not part of a BA session */
1489 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
1490 goto dont_reorder;
1491
1492 /* new, potentially un-ordered, ampdu frame - process it */
1493
1494 /* reset session timer */
1495 if (tid_agg_rx->timeout)
1496 tid_agg_rx->last_rx = jiffies;
1497
1498 /* if this mpdu is fragmented - terminate rx aggregation session */
1499 sc = le16_to_cpu(hdr->seq_ctrl);
1500 if (sc & IEEE80211_SCTL_FRAG) {
1501 ieee80211_queue_skb_to_iface(rx->sdata, rx->link_id, NULL, skb);
1502 return;
1503 }
1504
1505 /*
1506 * No locking needed -- we will only ever process one
1507 * RX packet at a time, and thus own tid_agg_rx. All
1508 * other code manipulating it needs to (and does) make
1509 * sure that we cannot get to it any more before doing
1510 * anything with it.
1511 */
1512 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1513 frames))
1514 return;
1515
1516 dont_reorder:
1517 __skb_queue_tail(frames, skb);
1518}
1519
1520static ieee80211_rx_result debug_noinline
1521ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1522{
1523 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1524 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1525
1526 if (status->flag & RX_FLAG_DUP_VALIDATED)
1527 return RX_CONTINUE;
1528
1529 if (ieee80211_is_ext(hdr->frame_control))
1530 return RX_CONTINUE;
1531
1532 /*
1533 * Drop duplicate 802.11 retransmissions
1534 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1535 */
1536
1537 if (rx->skb->len < 24)
1538 return RX_CONTINUE;
1539
1540 if (ieee80211_is_ctl(hdr->frame_control) ||
1541 ieee80211_is_any_nullfunc(hdr->frame_control))
1542 return RX_CONTINUE;
1543
1544 if (!rx->sta)
1545 return RX_CONTINUE;
1546
1547 if (unlikely(is_multicast_ether_addr(hdr->addr1))) {
1548 struct ieee80211_sub_if_data *sdata = rx->sdata;
1549 u16 sn = ieee80211_get_sn(hdr);
1550
1551 if (!ieee80211_is_data_present(hdr->frame_control))
1552 return RX_CONTINUE;
1553
1554 if (!ieee80211_vif_is_mld(&sdata->vif) ||
1555 sdata->vif.type != NL80211_IFTYPE_STATION)
1556 return RX_CONTINUE;
1557
1558 if (sdata->u.mgd.mcast_seq_last != IEEE80211_SN_MODULO &&
1559 ieee80211_sn_less_eq(sn, sdata->u.mgd.mcast_seq_last))
1560 return RX_DROP_U_DUP;
1561
1562 sdata->u.mgd.mcast_seq_last = sn;
1563 return RX_CONTINUE;
1564 }
1565
1566 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1567 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1568 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1569 rx->link_sta->rx_stats.num_duplicates++;
1570 return RX_DROP_U_DUP;
1571 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1572 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1573 }
1574
1575 return RX_CONTINUE;
1576}
1577
1578static ieee80211_rx_result debug_noinline
1579ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1580{
1581 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1582
1583 /* Drop disallowed frame classes based on STA auth/assoc state;
1584 * IEEE 802.11, Chap 5.5.
1585 *
1586 * mac80211 filters only based on association state, i.e. it drops
1587 * Class 3 frames from not associated stations. hostapd sends
1588 * deauth/disassoc frames when needed. In addition, hostapd is
1589 * responsible for filtering on both auth and assoc states.
1590 */
1591
1592 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1593 return ieee80211_rx_mesh_check(rx);
1594
1595 /*
1596 * Wi-Fi Aware (TM) 4.0 specification 6.2.5:
1597 * For NAN_DATA, unicast data frames must have A2 (source)
1598 * assigned to an active NDP. If not the frame must be dropped
1599 * and NAN Data Path termination frame should be sent. Notify
1600 * user space so it can do so.
1601 */
1602 if (rx->sdata->vif.type == NL80211_IFTYPE_NAN_DATA) {
1603 if (ieee80211_is_data(hdr->frame_control) &&
1604 !is_multicast_ether_addr(hdr->addr1) &&
1605 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC))) {
1606 if (cfg80211_rx_spurious_frame(rx->sdata->dev, hdr->addr2,
1607 rx->link_id, GFP_ATOMIC))
1608 return RX_DROP_U_SPURIOUS_NOTIF;
1609 return RX_DROP_U_SPURIOUS;
1610 }
1611 return RX_CONTINUE;
1612 }
1613
1614 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1615 ieee80211_is_pspoll(hdr->frame_control)) &&
1616 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1617 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1618 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1619 /*
1620 * accept port control frames from the AP even when it's not
1621 * yet marked ASSOC to prevent a race where we don't set the
1622 * assoc bit quickly enough before it sends the first frame
1623 */
1624 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1625 ieee80211_is_data_present(hdr->frame_control)) {
1626 unsigned int hdrlen;
1627 __be16 ethertype;
1628
1629 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1630
1631 if (rx->skb->len < hdrlen + 8)
1632 return RX_DROP_U_RUNT_DATA;
1633
1634 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1635 if (ethertype == rx->sdata->control_port_protocol)
1636 return RX_CONTINUE;
1637 }
1638
1639 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1640 cfg80211_rx_spurious_frame(rx->sdata->dev, hdr->addr2,
1641 rx->link_id, GFP_ATOMIC))
1642 return RX_DROP_U_SPURIOUS_NOTIF;
1643
1644 return RX_DROP_U_SPURIOUS;
1645 }
1646
1647 return RX_CONTINUE;
1648}
1649
1650
1651static ieee80211_rx_result debug_noinline
1652ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1653{
1654 struct ieee80211_local *local;
1655 struct ieee80211_hdr *hdr;
1656 struct sk_buff *skb;
1657
1658 local = rx->local;
1659 skb = rx->skb;
1660 hdr = (struct ieee80211_hdr *) skb->data;
1661
1662 if (!local->pspolling)
1663 return RX_CONTINUE;
1664
1665 if (!ieee80211_has_fromds(hdr->frame_control))
1666 /* this is not from AP */
1667 return RX_CONTINUE;
1668
1669 if (!ieee80211_is_data(hdr->frame_control))
1670 return RX_CONTINUE;
1671
1672 if (!ieee80211_has_moredata(hdr->frame_control)) {
1673 /* AP has no more frames buffered for us */
1674 local->pspolling = false;
1675 return RX_CONTINUE;
1676 }
1677
1678 /* more data bit is set, let's request a new frame from the AP */
1679 ieee80211_send_pspoll(local, rx->sdata);
1680
1681 return RX_CONTINUE;
1682}
1683
1684static void sta_ps_start(struct sta_info *sta)
1685{
1686 struct ieee80211_sub_if_data *sdata = sta->sdata;
1687 struct ieee80211_local *local = sdata->local;
1688 struct ps_data *ps;
1689 int tid;
1690
1691 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1692 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1693 ps = &sdata->bss->ps;
1694 else
1695 return;
1696
1697 atomic_inc(&ps->num_sta_ps);
1698 set_sta_flag(sta, WLAN_STA_PS_STA);
1699 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1700 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1701 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1702 sta->sta.addr, sta->sta.aid);
1703
1704 ieee80211_clear_fast_xmit(sta);
1705
1706 for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1707 struct ieee80211_txq *txq = sta->sta.txq[tid];
1708 struct txq_info *txqi = to_txq_info(txq);
1709
1710 spin_lock(&local->active_txq_lock[txq->ac]);
1711 if (!list_empty(&txqi->schedule_order))
1712 list_del_init(&txqi->schedule_order);
1713 spin_unlock(&local->active_txq_lock[txq->ac]);
1714
1715 if (txq_has_queue(txq))
1716 set_bit(tid, &sta->txq_buffered_tids);
1717 else
1718 clear_bit(tid, &sta->txq_buffered_tids);
1719 }
1720
1721 sta_info_recalc_tim(sta);
1722}
1723
1724static void sta_ps_end(struct sta_info *sta)
1725{
1726 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1727 sta->sta.addr, sta->sta.aid);
1728
1729 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1730 /*
1731 * Clear the flag only if the other one is still set
1732 * so that the TX path won't start TX'ing new frames
1733 * directly ... In the case that the driver flag isn't
1734 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1735 */
1736 clear_sta_flag(sta, WLAN_STA_PS_STA);
1737 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1738 sta->sta.addr, sta->sta.aid);
1739 return;
1740 }
1741
1742 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1743 clear_sta_flag(sta, WLAN_STA_PS_STA);
1744 ieee80211_sta_ps_deliver_wakeup(sta);
1745}
1746
1747int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1748{
1749 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1750 bool in_ps;
1751
1752 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1753
1754 /* Don't let the same PS state be set twice */
1755 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1756 if ((start && in_ps) || (!start && !in_ps))
1757 return -EINVAL;
1758
1759 if (start)
1760 sta_ps_start(sta);
1761 else
1762 sta_ps_end(sta);
1763
1764 return 0;
1765}
1766EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1767
1768void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1769{
1770 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1771
1772 if (test_sta_flag(sta, WLAN_STA_SP))
1773 return;
1774
1775 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1776 ieee80211_sta_ps_deliver_poll_response(sta);
1777 else
1778 set_sta_flag(sta, WLAN_STA_PSPOLL);
1779}
1780EXPORT_SYMBOL(ieee80211_sta_pspoll);
1781
1782void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1783{
1784 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1785 int ac = ieee80211_ac_from_tid(tid);
1786
1787 /*
1788 * If this AC is not trigger-enabled do nothing unless the
1789 * driver is calling us after it already checked.
1790 *
1791 * NB: This could/should check a separate bitmap of trigger-
1792 * enabled queues, but for now we only implement uAPSD w/o
1793 * TSPEC changes to the ACs, so they're always the same.
1794 */
1795 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1796 tid != IEEE80211_NUM_TIDS)
1797 return;
1798
1799 /* if we are in a service period, do nothing */
1800 if (test_sta_flag(sta, WLAN_STA_SP))
1801 return;
1802
1803 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1804 ieee80211_sta_ps_deliver_uapsd(sta);
1805 else
1806 set_sta_flag(sta, WLAN_STA_UAPSD);
1807}
1808EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1809
1810static ieee80211_rx_result debug_noinline
1811ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1812{
1813 struct ieee80211_sub_if_data *sdata = rx->sdata;
1814 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1815 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1816
1817 if (!rx->sta)
1818 return RX_CONTINUE;
1819
1820 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1821 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1822 return RX_CONTINUE;
1823
1824 /*
1825 * The device handles station powersave, so don't do anything about
1826 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1827 * it to mac80211 since they're handled.)
1828 */
1829 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1830 return RX_CONTINUE;
1831
1832 /*
1833 * Don't do anything if the station isn't already asleep. In
1834 * the uAPSD case, the station will probably be marked asleep,
1835 * in the PS-Poll case the station must be confused ...
1836 */
1837 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1838 return RX_CONTINUE;
1839
1840 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1841 ieee80211_sta_pspoll(&rx->sta->sta);
1842
1843 /* Free PS Poll skb here instead of returning RX_DROP that would
1844 * count as an dropped frame. */
1845 dev_kfree_skb(rx->skb);
1846
1847 return RX_QUEUED;
1848 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1849 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1850 ieee80211_has_pm(hdr->frame_control) &&
1851 (ieee80211_is_data_qos(hdr->frame_control) ||
1852 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1853 u8 tid = ieee80211_get_tid(hdr);
1854
1855 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1856 }
1857
1858 return RX_CONTINUE;
1859}
1860
1861static ieee80211_rx_result debug_noinline
1862ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1863{
1864 struct sta_info *sta = rx->sta;
1865 struct link_sta_info *link_sta = rx->link_sta;
1866 struct sk_buff *skb = rx->skb;
1867 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1868 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1869 int i;
1870
1871 if (!sta || !link_sta)
1872 return RX_CONTINUE;
1873
1874 /*
1875 * Update last_rx only for IBSS packets which are for the current
1876 * BSSID and for station already AUTHORIZED to avoid keeping the
1877 * current IBSS network alive in cases where other STAs start
1878 * using different BSSID. This will also give the station another
1879 * chance to restart the authentication/authorization in case
1880 * something went wrong the first time.
1881 */
1882 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1883 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1884 NL80211_IFTYPE_ADHOC);
1885 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1886 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1887 link_sta->rx_stats.last_rx = jiffies;
1888 if (ieee80211_is_data_present(hdr->frame_control) &&
1889 !is_multicast_ether_addr(hdr->addr1))
1890 link_sta->rx_stats.last_rate =
1891 sta_stats_encode_rate(status);
1892 }
1893 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1894 link_sta->rx_stats.last_rx = jiffies;
1895 } else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
1896 !is_multicast_ether_addr(hdr->addr1)) {
1897 /*
1898 * Mesh beacons will update last_rx when if they are found to
1899 * match the current local configuration when processed.
1900 */
1901 link_sta->rx_stats.last_rx = jiffies;
1902 if (ieee80211_is_data_present(hdr->frame_control))
1903 link_sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1904 }
1905
1906 link_sta->rx_stats.fragments++;
1907
1908 u64_stats_update_begin(&link_sta->rx_stats.syncp);
1909 u64_stats_add(&link_sta->rx_stats.bytes, rx->skb->len);
1910 u64_stats_update_end(&link_sta->rx_stats.syncp);
1911
1912 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1913 link_sta->rx_stats.last_signal = status->signal;
1914 ewma_signal_add(&link_sta->rx_stats_avg.signal,
1915 -status->signal);
1916 }
1917
1918 if (status->chains) {
1919 link_sta->rx_stats.chains = status->chains;
1920 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1921 int signal = status->chain_signal[i];
1922
1923 if (!(status->chains & BIT(i)))
1924 continue;
1925
1926 link_sta->rx_stats.chain_signal_last[i] = signal;
1927 ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
1928 -signal);
1929 }
1930 }
1931
1932 if (ieee80211_is_s1g_beacon(hdr->frame_control))
1933 return RX_CONTINUE;
1934
1935 /*
1936 * Change STA power saving mode only at the end of a frame
1937 * exchange sequence, and only for a data or management
1938 * frame as specified in IEEE 802.11-2016 11.2.3.2
1939 */
1940 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1941 !ieee80211_has_morefrags(hdr->frame_control) &&
1942 !is_multicast_ether_addr(hdr->addr1) &&
1943 (ieee80211_is_mgmt(hdr->frame_control) ||
1944 ieee80211_is_data(hdr->frame_control)) &&
1945 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1946 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1947 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1948 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1949 if (!ieee80211_has_pm(hdr->frame_control))
1950 sta_ps_end(sta);
1951 } else {
1952 if (ieee80211_has_pm(hdr->frame_control))
1953 sta_ps_start(sta);
1954 }
1955 }
1956
1957 /* mesh power save support */
1958 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1959 ieee80211_mps_rx_h_sta_process(sta, hdr);
1960
1961 /*
1962 * Drop (qos-)data::nullfunc frames silently, since they
1963 * are used only to control station power saving mode.
1964 */
1965 if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
1966 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1967
1968 /*
1969 * If we receive a 4-addr nullfunc frame from a STA
1970 * that was not moved to a 4-addr STA vlan yet send
1971 * the event to userspace and for older hostapd drop
1972 * the frame to the monitor interface.
1973 */
1974 if (ieee80211_has_a4(hdr->frame_control) &&
1975 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1976 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1977 !rx->sdata->u.vlan.sta))) {
1978 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1979 cfg80211_rx_unexpected_4addr_frame(
1980 rx->sdata->dev, sta->sta.addr,
1981 rx->link_id, GFP_ATOMIC);
1982 return RX_DROP_U_UNEXPECTED_4ADDR_FRAME;
1983 }
1984 /*
1985 * Update counter and free packet here to avoid
1986 * counting this as a dropped packed.
1987 */
1988 link_sta->rx_stats.packets++;
1989 dev_kfree_skb(rx->skb);
1990 return RX_QUEUED;
1991 }
1992
1993 return RX_CONTINUE;
1994} /* ieee80211_rx_h_sta_process */
1995
1996static struct ieee80211_key *
1997ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1998{
1999 struct ieee80211_key *key = NULL;
2000 int idx2;
2001
2002 /* Make sure key gets set if either BIGTK key index is set so that
2003 * ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
2004 * Beacon frames and Beacon frames that claim to use another BIGTK key
2005 * index (i.e., a key that we do not have).
2006 */
2007
2008 if (idx < 0) {
2009 idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
2010 idx2 = idx + 1;
2011 } else {
2012 if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2013 idx2 = idx + 1;
2014 else
2015 idx2 = idx - 1;
2016 }
2017
2018 if (rx->link_sta)
2019 key = rcu_dereference(rx->link_sta->gtk[idx]);
2020 if (!key)
2021 key = rcu_dereference(rx->link->gtk[idx]);
2022 if (!key && rx->link_sta)
2023 key = rcu_dereference(rx->link_sta->gtk[idx2]);
2024 if (!key)
2025 key = rcu_dereference(rx->link->gtk[idx2]);
2026
2027 return key;
2028}
2029
2030static ieee80211_rx_result debug_noinline
2031ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
2032{
2033 struct sk_buff *skb = rx->skb;
2034 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2035 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2036 int keyidx;
2037 ieee80211_rx_result result = RX_DROP_U_DECRYPT_FAIL;
2038 struct ieee80211_key *sta_ptk = NULL;
2039 struct ieee80211_key *ptk_idx = NULL;
2040 int mmie_keyidx = -1;
2041 __le16 fc;
2042
2043 if (ieee80211_is_ext(hdr->frame_control))
2044 return RX_CONTINUE;
2045
2046 /*
2047 * Key selection 101
2048 *
2049 * There are five types of keys:
2050 * - GTK (group keys)
2051 * - IGTK (group keys for management frames)
2052 * - BIGTK (group keys for Beacon frames)
2053 * - PTK (pairwise keys)
2054 * - STK (station-to-station pairwise keys)
2055 *
2056 * When selecting a key, we have to distinguish between multicast
2057 * (including broadcast) and unicast frames, the latter can only
2058 * use PTKs and STKs while the former always use GTKs, IGTKs, and
2059 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
2060 * then unicast frames can also use key indices like GTKs. Hence, if we
2061 * don't have a PTK/STK we check the key index for a WEP key.
2062 *
2063 * Note that in a regular BSS, multicast frames are sent by the
2064 * AP only, associated stations unicast the frame to the AP first
2065 * which then multicasts it on their behalf.
2066 *
2067 * There is also a slight problem in IBSS mode: GTKs are negotiated
2068 * with each station, that is something we don't currently handle.
2069 * The spec seems to expect that one negotiates the same key with
2070 * every station but there's no such requirement; VLANs could be
2071 * possible.
2072 */
2073
2074 /* start without a key */
2075 rx->key = NULL;
2076 fc = hdr->frame_control;
2077
2078 if (rx->sta) {
2079 int keyid = rx->sta->ptk_idx;
2080 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
2081
2082 if (ieee80211_has_protected(fc) &&
2083 !(status->flag & RX_FLAG_IV_STRIPPED)) {
2084 keyid = ieee80211_get_keyid(rx->skb);
2085
2086 if (unlikely(keyid < 0))
2087 return RX_DROP_U_NO_KEY_ID;
2088
2089 ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
2090 }
2091 }
2092
2093 if (!ieee80211_has_protected(fc))
2094 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
2095
2096 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
2097 rx->key = ptk_idx ? ptk_idx : sta_ptk;
2098 if ((status->flag & RX_FLAG_DECRYPTED) &&
2099 (status->flag & RX_FLAG_IV_STRIPPED))
2100 return RX_CONTINUE;
2101 /* Skip decryption if the frame is not protected. */
2102 if (!ieee80211_has_protected(fc))
2103 return RX_CONTINUE;
2104 } else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
2105 /* Broadcast/multicast robust management frame / BIP */
2106 if ((status->flag & RX_FLAG_DECRYPTED) &&
2107 (status->flag & RX_FLAG_IV_STRIPPED))
2108 return RX_CONTINUE;
2109
2110 if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
2111 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
2112 NUM_DEFAULT_BEACON_KEYS) {
2113 if (rx->sdata->dev)
2114 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2115 skb->data,
2116 skb->len);
2117 return RX_DROP_U_BAD_BCN_KEYIDX;
2118 }
2119
2120 rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
2121 if (!rx->key)
2122 return RX_CONTINUE; /* Beacon protection not in use */
2123 } else if (mmie_keyidx >= 0) {
2124 /* Broadcast/multicast robust management frame / BIP */
2125 if ((status->flag & RX_FLAG_DECRYPTED) &&
2126 (status->flag & RX_FLAG_IV_STRIPPED))
2127 return RX_CONTINUE;
2128
2129 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
2130 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2131 return RX_DROP_U_BAD_MGMT_KEYIDX; /* unexpected BIP keyidx */
2132 if (rx->link_sta) {
2133 if (ieee80211_is_group_privacy_action(skb) &&
2134 test_sta_flag(rx->sta, WLAN_STA_MFP))
2135 return RX_DROP_U_UNPROTECTED;
2136
2137 rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);
2138 }
2139 if (!rx->key)
2140 rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);
2141 } else if (!ieee80211_has_protected(fc)) {
2142 /*
2143 * The frame was not protected, so skip decryption. However, we
2144 * need to set rx->key if there is a key that could have been
2145 * used so that the frame may be dropped if encryption would
2146 * have been expected.
2147 */
2148 struct ieee80211_key *key = NULL;
2149 int i;
2150
2151 if (ieee80211_is_beacon(fc)) {
2152 key = ieee80211_rx_get_bigtk(rx, -1);
2153 } else if (ieee80211_is_mgmt(fc) &&
2154 is_multicast_ether_addr(hdr->addr1)) {
2155 key = rcu_dereference(rx->link->default_mgmt_key);
2156 } else {
2157 if (rx->link_sta) {
2158 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2159 key = rcu_dereference(rx->link_sta->gtk[i]);
2160 if (key)
2161 break;
2162 }
2163 }
2164 if (!key) {
2165 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2166 key = rcu_dereference(rx->link->gtk[i]);
2167 if (key)
2168 break;
2169 }
2170 }
2171 }
2172 if (key)
2173 rx->key = key;
2174 return RX_CONTINUE;
2175 } else {
2176 /*
2177 * The device doesn't give us the IV so we won't be
2178 * able to look up the key. That's ok though, we
2179 * don't need to decrypt the frame, we just won't
2180 * be able to keep statistics accurate.
2181 * Except for key threshold notifications, should
2182 * we somehow allow the driver to tell us which key
2183 * the hardware used if this flag is set?
2184 */
2185 if ((status->flag & RX_FLAG_DECRYPTED) &&
2186 (status->flag & RX_FLAG_IV_STRIPPED))
2187 return RX_CONTINUE;
2188
2189 keyidx = ieee80211_get_keyid(rx->skb);
2190
2191 if (unlikely(keyidx < 0))
2192 return RX_DROP_U_NO_KEY_ID;
2193
2194 /* check per-station GTK first, if multicast packet */
2195 if (is_multicast_ether_addr(hdr->addr1) && rx->link_sta)
2196 rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);
2197
2198 /* if not found, try default key */
2199 if (!rx->key) {
2200 if (is_multicast_ether_addr(hdr->addr1))
2201 rx->key = rcu_dereference(rx->link->gtk[keyidx]);
2202 if (!rx->key)
2203 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2204
2205 /*
2206 * RSNA-protected unicast frames should always be
2207 * sent with pairwise or station-to-station keys,
2208 * but for WEP we allow using a key index as well.
2209 */
2210 if (rx->key &&
2211 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2212 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2213 !is_multicast_ether_addr(hdr->addr1))
2214 rx->key = NULL;
2215 }
2216 }
2217
2218 if (rx->key) {
2219 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2220 return RX_DROP_U_KEY_TAINTED;
2221
2222 /* TODO: add threshold stuff again */
2223 } else {
2224 return RX_DROP_U_UNPROTECTED;
2225 }
2226
2227 switch (rx->key->conf.cipher) {
2228 case WLAN_CIPHER_SUITE_WEP40:
2229 case WLAN_CIPHER_SUITE_WEP104:
2230 result = ieee80211_crypto_wep_decrypt(rx);
2231 break;
2232 case WLAN_CIPHER_SUITE_TKIP:
2233 result = ieee80211_crypto_tkip_decrypt(rx);
2234 break;
2235 case WLAN_CIPHER_SUITE_CCMP:
2236 result = ieee80211_crypto_ccmp_decrypt(
2237 rx, IEEE80211_CCMP_MIC_LEN);
2238 break;
2239 case WLAN_CIPHER_SUITE_CCMP_256:
2240 result = ieee80211_crypto_ccmp_decrypt(
2241 rx, IEEE80211_CCMP_256_MIC_LEN);
2242 break;
2243 case WLAN_CIPHER_SUITE_AES_CMAC:
2244 result = ieee80211_crypto_aes_cmac_decrypt(
2245 rx, IEEE80211_CMAC_128_MIC_LEN);
2246 break;
2247 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2248 result = ieee80211_crypto_aes_cmac_decrypt(
2249 rx, IEEE80211_CMAC_256_MIC_LEN);
2250 break;
2251 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2252 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2253 result = ieee80211_crypto_aes_gmac_decrypt(rx);
2254 break;
2255 case WLAN_CIPHER_SUITE_GCMP:
2256 case WLAN_CIPHER_SUITE_GCMP_256:
2257 result = ieee80211_crypto_gcmp_decrypt(rx);
2258 break;
2259 default:
2260 result = RX_DROP_U_BAD_CIPHER;
2261 }
2262
2263 /* the hdr variable is invalid after the decrypt handlers */
2264
2265 /* either the frame has been decrypted or will be dropped */
2266 status->flag |= RX_FLAG_DECRYPTED;
2267
2268 if (unlikely(ieee80211_is_beacon(fc) && RX_RES_IS_UNUSABLE(result) &&
2269 rx->sdata->dev))
2270 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2271 skb->data, skb->len);
2272
2273 return result;
2274}
2275
2276void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2277{
2278 int i;
2279
2280 for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2281 skb_queue_head_init(&cache->entries[i].skb_list);
2282}
2283
2284void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2285{
2286 int i;
2287
2288 for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2289 __skb_queue_purge(&cache->entries[i].skb_list);
2290}
2291
2292static inline struct ieee80211_fragment_entry *
2293ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
2294 unsigned int frag, unsigned int seq, int rx_queue,
2295 struct sk_buff **skb)
2296{
2297 struct ieee80211_fragment_entry *entry;
2298
2299 entry = &cache->entries[cache->next++];
2300 if (cache->next >= IEEE80211_FRAGMENT_MAX)
2301 cache->next = 0;
2302
2303 __skb_queue_purge(&entry->skb_list);
2304
2305 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
2306 *skb = NULL;
2307 entry->first_frag_time = jiffies;
2308 entry->seq = seq;
2309 entry->rx_queue = rx_queue;
2310 entry->last_frag = frag;
2311 entry->check_sequential_pn = false;
2312 entry->extra_len = 0;
2313
2314 return entry;
2315}
2316
2317static inline struct ieee80211_fragment_entry *
2318ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
2319 unsigned int frag, unsigned int seq,
2320 int rx_queue, struct ieee80211_hdr *hdr)
2321{
2322 struct ieee80211_fragment_entry *entry;
2323 int i, idx;
2324
2325 idx = cache->next;
2326 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2327 struct ieee80211_hdr *f_hdr;
2328 struct sk_buff *f_skb;
2329
2330 idx--;
2331 if (idx < 0)
2332 idx = IEEE80211_FRAGMENT_MAX - 1;
2333
2334 entry = &cache->entries[idx];
2335 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2336 entry->rx_queue != rx_queue ||
2337 entry->last_frag + 1 != frag)
2338 continue;
2339
2340 f_skb = __skb_peek(&entry->skb_list);
2341 f_hdr = (struct ieee80211_hdr *) f_skb->data;
2342
2343 /*
2344 * Check ftype and addresses are equal, else check next fragment
2345 */
2346 if (((hdr->frame_control ^ f_hdr->frame_control) &
2347 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2348 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
2349 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
2350 continue;
2351
2352 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2353 __skb_queue_purge(&entry->skb_list);
2354 continue;
2355 }
2356 return entry;
2357 }
2358
2359 return NULL;
2360}
2361
2362static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2363{
2364 return rx->key &&
2365 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2366 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2367 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2368 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2369 ieee80211_has_protected(fc);
2370}
2371
2372static ieee80211_rx_result debug_noinline
2373ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2374{
2375 struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
2376 struct ieee80211_hdr *hdr;
2377 u16 sc;
2378 __le16 fc;
2379 unsigned int frag, seq;
2380 struct ieee80211_fragment_entry *entry;
2381 struct sk_buff *skb;
2382 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2383
2384 hdr = (struct ieee80211_hdr *)rx->skb->data;
2385 fc = hdr->frame_control;
2386
2387 if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
2388 return RX_CONTINUE;
2389
2390 sc = le16_to_cpu(hdr->seq_ctrl);
2391 frag = sc & IEEE80211_SCTL_FRAG;
2392
2393 if (rx->sta)
2394 cache = &rx->sta->frags;
2395
2396 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2397 goto out;
2398
2399 if (is_multicast_ether_addr(hdr->addr1))
2400 return RX_DROP_U_MCAST_FRAGMENT;
2401
2402 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2403
2404 if (skb_linearize(rx->skb))
2405 return RX_DROP_U_OOM;
2406
2407 /*
2408 * skb_linearize() might change the skb->data and
2409 * previously cached variables (in this case, hdr) need to
2410 * be refreshed with the new data.
2411 */
2412 hdr = (struct ieee80211_hdr *)rx->skb->data;
2413 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2414
2415 if (frag == 0) {
2416 /* This is the first fragment of a new frame. */
2417 entry = ieee80211_reassemble_add(cache, frag, seq,
2418 rx->seqno_idx, &(rx->skb));
2419 if (requires_sequential_pn(rx, fc)) {
2420 int queue = rx->security_idx;
2421
2422 /* Store CCMP/GCMP PN so that we can verify that the
2423 * next fragment has a sequential PN value.
2424 */
2425 entry->check_sequential_pn = true;
2426 entry->is_protected = true;
2427 entry->key_color = rx->key->color;
2428 memcpy(entry->last_pn,
2429 rx->key->u.ccmp.rx_pn[queue],
2430 IEEE80211_CCMP_PN_LEN);
2431 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2432 u.ccmp.rx_pn) !=
2433 offsetof(struct ieee80211_key,
2434 u.gcmp.rx_pn));
2435 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2436 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2437 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2438 IEEE80211_GCMP_PN_LEN);
2439 } else if (rx->key &&
2440 (ieee80211_has_protected(fc) ||
2441 (status->flag & RX_FLAG_DECRYPTED))) {
2442 entry->is_protected = true;
2443 entry->key_color = rx->key->color;
2444 }
2445 return RX_QUEUED;
2446 }
2447
2448 /* This is a fragment for a frame that should already be pending in
2449 * fragment cache. Add this fragment to the end of the pending entry.
2450 */
2451 entry = ieee80211_reassemble_find(cache, frag, seq,
2452 rx->seqno_idx, hdr);
2453 if (!entry) {
2454 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2455 return RX_DROP_U_DEFRAG_MISMATCH;
2456 }
2457
2458 /* "The receiver shall discard MSDUs and MMPDUs whose constituent
2459 * MPDU PN values are not incrementing in steps of 1."
2460 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2461 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2462 */
2463 if (entry->check_sequential_pn) {
2464 int i;
2465 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2466
2467 if (!requires_sequential_pn(rx, fc))
2468 return RX_DROP_U_NONSEQ_PN;
2469
2470 /* Prevent mixed key and fragment cache attacks */
2471 if (entry->key_color != rx->key->color)
2472 return RX_DROP_U_BAD_KEY_COLOR;
2473
2474 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2475 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2476 pn[i]++;
2477 if (pn[i])
2478 break;
2479 }
2480
2481 rpn = rx->ccm_gcm.pn;
2482 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
2483 return RX_DROP_U_REPLAY;
2484 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2485 } else if (entry->is_protected &&
2486 (!rx->key ||
2487 (!ieee80211_has_protected(fc) &&
2488 !(status->flag & RX_FLAG_DECRYPTED)) ||
2489 rx->key->color != entry->key_color)) {
2490 /* Drop this as a mixed key or fragment cache attack, even
2491 * if for TKIP Michael MIC should protect us, and WEP is a
2492 * lost cause anyway.
2493 */
2494 return RX_DROP_U_EXPECT_DEFRAG_PROT;
2495 } else if (entry->is_protected && rx->key &&
2496 entry->key_color != rx->key->color &&
2497 (status->flag & RX_FLAG_DECRYPTED)) {
2498 return RX_DROP_U_BAD_KEY_COLOR;
2499 }
2500
2501 skb_pull(rx->skb, ieee80211_hdrlen(fc));
2502 if (unlikely((u32)entry->extra_len + rx->skb->len > U16_MAX)) {
2503 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2504 __skb_queue_purge(&entry->skb_list);
2505 return RX_DROP_U_DEFRAG_OVERFLOW;
2506 }
2507
2508 __skb_queue_tail(&entry->skb_list, rx->skb);
2509 entry->last_frag = frag;
2510 entry->extra_len += rx->skb->len;
2511 if (ieee80211_has_morefrags(fc)) {
2512 rx->skb = NULL;
2513 return RX_QUEUED;
2514 }
2515
2516 rx->skb = __skb_dequeue(&entry->skb_list);
2517 if (skb_tailroom(rx->skb) < entry->extra_len) {
2518 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2519 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2520 GFP_ATOMIC))) {
2521 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2522 __skb_queue_purge(&entry->skb_list);
2523 return RX_DROP_U_OOM;
2524 }
2525 }
2526 while ((skb = __skb_dequeue(&entry->skb_list))) {
2527 skb_put_data(rx->skb, skb->data, skb->len);
2528 dev_kfree_skb(skb);
2529 }
2530
2531 out:
2532 ieee80211_led_rx(rx->local);
2533 if (rx->sta)
2534 rx->link_sta->rx_stats.packets++;
2535 return RX_CONTINUE;
2536}
2537
2538static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2539{
2540 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2541 return -EACCES;
2542
2543 return 0;
2544}
2545
2546static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2547{
2548 struct sk_buff *skb = rx->skb;
2549 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2550
2551 /*
2552 * Pass through unencrypted frames if the hardware has
2553 * decrypted them already.
2554 */
2555 if (status->flag & RX_FLAG_DECRYPTED)
2556 return 0;
2557
2558 /* Drop unencrypted frames if key is set. */
2559 if (unlikely(!ieee80211_has_protected(fc) &&
2560 !ieee80211_is_any_nullfunc(fc) &&
2561 ieee80211_is_data(fc) && rx->key))
2562 return -EACCES;
2563
2564 return 0;
2565}
2566
2567VISIBLE_IF_MAC80211_KUNIT ieee80211_rx_result
2568ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2569{
2570 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2571 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2572 __le16 fc = mgmt->frame_control;
2573
2574 /*
2575 * Pass through unencrypted frames if the hardware has
2576 * decrypted them already.
2577 */
2578 if (status->flag & RX_FLAG_DECRYPTED)
2579 return RX_CONTINUE;
2580
2581 /* drop unicast protected dual (that wasn't protected) */
2582 if (ieee80211_is_action(fc) &&
2583 mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
2584 return RX_DROP_U_UNPROT_DUAL;
2585
2586 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2587 if (unlikely(!ieee80211_has_protected(fc) &&
2588 ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {
2589 if (ieee80211_is_deauth(fc) ||
2590 ieee80211_is_disassoc(fc)) {
2591 /*
2592 * Permit unprotected deauth/disassoc frames
2593 * during 4-way-HS (key is installed after HS).
2594 */
2595 if (!rx->key)
2596 return RX_CONTINUE;
2597
2598 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2599 rx->skb->data,
2600 rx->skb->len);
2601 }
2602 return RX_DROP_U_UNPROT_UCAST_MGMT;
2603 }
2604 /* BIP does not use Protected field, so need to check MMIE */
2605 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2606 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2607 if (ieee80211_is_deauth(fc) ||
2608 ieee80211_is_disassoc(fc))
2609 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2610 rx->skb->data,
2611 rx->skb->len);
2612 return RX_DROP_U_UNPROT_MCAST_MGMT;
2613 }
2614 if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2615 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2616 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2617 rx->skb->data,
2618 rx->skb->len);
2619 return RX_DROP_U_UNPROT_BEACON;
2620 }
2621 /*
2622 * When using MFP, Action frames are not allowed prior to
2623 * having configured keys.
2624 */
2625 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2626 ieee80211_is_robust_mgmt_frame(rx->skb)))
2627 return RX_DROP_U_UNPROT_ACTION;
2628
2629 /* drop unicast public action frames when using MPF */
2630 if (is_unicast_ether_addr(mgmt->da) &&
2631 ieee80211_is_protected_dual_of_public_action(rx->skb))
2632 return RX_DROP_U_UNPROT_UNICAST_PUB_ACTION;
2633 }
2634
2635 /*
2636 * Drop robust action frames before assoc regardless of MFP state,
2637 * after assoc we also have decided on MFP or not.
2638 */
2639 if (ieee80211_is_action(fc) &&
2640 ieee80211_is_robust_mgmt_frame(rx->skb) &&
2641 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))
2642 return RX_DROP_U_UNPROT_ROBUST_ACTION;
2643
2644 /*
2645 * Drop unprotected (Re)Association Request/Response frame received from
2646 * an EPP Peer.
2647 */
2648 if (!ieee80211_has_protected(fc) &&
2649 ieee80211_require_encrypted_assoc(fc, rx->sta))
2650 return RX_DROP_U_UNPROT_UCAST_MGMT;
2651
2652 return RX_CONTINUE;
2653}
2654EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_drop_unencrypted_mgmt);
2655
2656static ieee80211_rx_result
2657__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2658{
2659 struct ieee80211_sub_if_data *sdata = rx->sdata;
2660 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2661 bool check_port_control = false;
2662 struct ethhdr *ehdr;
2663 int ret;
2664
2665 *port_control = false;
2666 if (ieee80211_has_a4(hdr->frame_control) &&
2667 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2668 return RX_DROP_U_UNEXPECTED_VLAN_4ADDR;
2669
2670 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2671 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2672 if (!sdata->u.mgd.use_4addr)
2673 return RX_DROP_U_UNEXPECTED_STA_4ADDR;
2674 else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))
2675 check_port_control = true;
2676 }
2677
2678 if (is_multicast_ether_addr(hdr->addr1) &&
2679 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2680 return RX_DROP_U_UNEXPECTED_VLAN_MCAST;
2681
2682 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2683 if (ret < 0)
2684 return RX_DROP_U_INVALID_8023;
2685
2686 ehdr = (struct ethhdr *) rx->skb->data;
2687 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2688 *port_control = true;
2689 else if (check_port_control)
2690 return RX_DROP_U_NOT_PORT_CONTROL;
2691
2692 return RX_CONTINUE;
2693}
2694
2695bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
2696 const u8 *addr, int *out_link_id)
2697{
2698 unsigned int link_id;
2699
2700 /* non-MLO, or MLD address replaced by hardware */
2701 if (ether_addr_equal(sdata->vif.addr, addr))
2702 return true;
2703
2704 if (!ieee80211_vif_is_mld(&sdata->vif))
2705 return false;
2706
2707 for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
2708 struct ieee80211_bss_conf *conf;
2709
2710 conf = rcu_dereference(sdata->vif.link_conf[link_id]);
2711
2712 if (!conf)
2713 continue;
2714 if (ether_addr_equal(conf->addr, addr)) {
2715 if (out_link_id)
2716 *out_link_id = link_id;
2717 return true;
2718 }
2719 }
2720
2721 return false;
2722}
2723
2724/*
2725 * requires that rx->skb is a frame with ethernet header
2726 */
2727static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2728{
2729 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2730 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2731 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2732
2733 /*
2734 * Allow EAPOL frames to us/the PAE group address regardless of
2735 * whether the frame was encrypted or not, and always disallow
2736 * all other destination addresses for them.
2737 */
2738 if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2739 return ieee80211_is_our_addr(rx->sdata, ehdr->h_dest, NULL) ||
2740 ether_addr_equal(ehdr->h_dest, pae_group_addr);
2741
2742 if (ieee80211_802_1x_port_control(rx) ||
2743 ieee80211_drop_unencrypted(rx, fc))
2744 return false;
2745
2746 return true;
2747}
2748
2749static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2750 struct ieee80211_rx_data *rx)
2751{
2752 struct ieee80211_sub_if_data *sdata = rx->sdata;
2753 struct net_device *dev = sdata->dev;
2754
2755 if (unlikely((skb->protocol == sdata->control_port_protocol ||
2756 (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2757 !sdata->control_port_no_preauth)) &&
2758 sdata->control_port_over_nl80211)) {
2759 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2760 bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2761
2762 cfg80211_rx_control_port(dev, skb, noencrypt, rx->link_id);
2763 dev_kfree_skb(skb);
2764 } else {
2765 struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2766
2767 memset(skb->cb, 0, sizeof(skb->cb));
2768
2769 /*
2770 * 802.1X over 802.11 requires that the authenticator address
2771 * be used for EAPOL frames. However, 802.1X allows the use of
2772 * the PAE group address instead. If the interface is part of
2773 * a bridge and we pass the frame with the PAE group address,
2774 * then the bridge will forward it to the network (even if the
2775 * client was not associated yet), which isn't supposed to
2776 * happen.
2777 * To avoid that, rewrite the destination address to our own
2778 * address, so that the authenticator (e.g. hostapd) will see
2779 * the frame, but bridge won't forward it anywhere else. Note
2780 * that due to earlier filtering, the only other address can
2781 * be the PAE group address, unless the hardware allowed them
2782 * through in 802.3 offloaded mode.
2783 */
2784 if (unlikely(skb->protocol == sdata->control_port_protocol &&
2785 !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2786 ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
2787
2788 /* deliver to local stack */
2789 if (rx->list)
2790 list_add_tail(&skb->list, rx->list);
2791 else
2792 netif_receive_skb(skb);
2793 }
2794}
2795
2796/*
2797 * requires that rx->skb is a frame with ethernet header
2798 */
2799static void
2800ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2801{
2802 struct ieee80211_sub_if_data *sdata = rx->sdata;
2803 struct net_device *dev = sdata->dev;
2804 struct sk_buff *skb, *xmit_skb;
2805 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2806 struct sta_info *dsta;
2807
2808 skb = rx->skb;
2809 xmit_skb = NULL;
2810
2811 dev_sw_netstats_rx_add(dev, skb->len);
2812
2813 if (rx->sta) {
2814 /* The seqno index has the same property as needed
2815 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2816 * for non-QoS-data frames. Here we know it's a data
2817 * frame, so count MSDUs.
2818 */
2819 u64_stats_update_begin(&rx->link_sta->rx_stats.syncp);
2820 u64_stats_inc(&rx->link_sta->rx_stats.msdu[rx->seqno_idx]);
2821 u64_stats_update_end(&rx->link_sta->rx_stats.syncp);
2822 }
2823
2824 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2825 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2826 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2827 ehdr->h_proto != rx->sdata->control_port_protocol &&
2828 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2829 if (is_multicast_ether_addr(ehdr->h_dest) &&
2830 ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2831 /*
2832 * send multicast frames both to higher layers in
2833 * local net stack and back to the wireless medium
2834 */
2835 xmit_skb = skb_copy(skb, GFP_ATOMIC);
2836 if (!xmit_skb)
2837 net_info_ratelimited("%s: failed to clone multicast frame\n",
2838 dev->name);
2839 } else if (!is_multicast_ether_addr(ehdr->h_dest) &&
2840 !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {
2841 dsta = sta_info_get(sdata, ehdr->h_dest);
2842 if (dsta) {
2843 /*
2844 * The destination station is associated to
2845 * this AP (in this VLAN), so send the frame
2846 * directly to it and do not pass it to local
2847 * net stack.
2848 */
2849 xmit_skb = skb;
2850 skb = NULL;
2851 }
2852 }
2853 }
2854
2855#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2856 if (skb) {
2857 /* 'align' will only take the values 0 or 2 here since all
2858 * frames are required to be aligned to 2-byte boundaries
2859 * when being passed to mac80211; the code here works just
2860 * as well if that isn't true, but mac80211 assumes it can
2861 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2862 */
2863 int align;
2864
2865 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2866 if (align) {
2867 if (WARN_ON(skb_headroom(skb) < 3)) {
2868 dev_kfree_skb(skb);
2869 skb = NULL;
2870 } else {
2871 u8 *data = skb->data;
2872 size_t len = skb_headlen(skb);
2873 skb->data -= align;
2874 memmove(skb->data, data, len);
2875 skb_set_tail_pointer(skb, len);
2876 }
2877 }
2878 }
2879#endif
2880
2881 if (skb) {
2882 skb->protocol = eth_type_trans(skb, dev);
2883 ieee80211_deliver_skb_to_local_stack(skb, rx);
2884 }
2885
2886 if (xmit_skb) {
2887 /*
2888 * Send to wireless media and increase priority by 256 to
2889 * keep the received priority instead of reclassifying
2890 * the frame (see cfg80211_classify8021d).
2891 */
2892 xmit_skb->priority += 256;
2893 xmit_skb->protocol = htons(ETH_P_802_3);
2894 skb_reset_network_header(xmit_skb);
2895 skb_reset_mac_header(xmit_skb);
2896 dev_queue_xmit(xmit_skb);
2897 }
2898}
2899
2900#ifdef CONFIG_MAC80211_MESH
2901static bool
2902ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
2903 struct sk_buff *skb, int hdrlen)
2904{
2905 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2906 struct ieee80211_mesh_fast_tx_key key = {
2907 .type = MESH_FAST_TX_TYPE_FORWARDED
2908 };
2909 struct ieee80211_mesh_fast_tx *entry;
2910 struct ieee80211s_hdr *mesh_hdr;
2911 struct tid_ampdu_tx *tid_tx;
2912 struct sta_info *sta;
2913 struct ethhdr eth;
2914 u8 tid;
2915
2916 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
2917 if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2918 ether_addr_copy(key.addr, mesh_hdr->eaddr1);
2919 else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
2920 ether_addr_copy(key.addr, skb->data);
2921 else
2922 return false;
2923
2924 entry = mesh_fast_tx_get(sdata, &key);
2925 if (!entry)
2926 return false;
2927
2928 sta = rcu_dereference(entry->mpath->next_hop);
2929 if (!sta)
2930 return false;
2931
2932 if (skb_linearize(skb))
2933 return false;
2934
2935 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2936 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2937 if (tid_tx) {
2938 if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2939 return false;
2940
2941 if (tid_tx->timeout)
2942 tid_tx->last_tx = jiffies;
2943 }
2944
2945 ieee80211_aggr_check(sdata, sta, skb);
2946
2947 if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
2948 &skb->protocol))
2949 hdrlen += ETH_ALEN;
2950 else
2951 skb->protocol = htons(skb->len - hdrlen);
2952 skb_set_network_header(skb, hdrlen + 2);
2953
2954 skb->dev = sdata->dev;
2955 memcpy(&eth, skb->data, ETH_HLEN - 2);
2956 skb_pull(skb, 2);
2957 __ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
2958 eth.h_dest, eth.h_source);
2959 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2960 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2961
2962 return true;
2963}
2964#endif
2965
2966static ieee80211_rx_result
2967ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
2968 struct sk_buff *skb)
2969{
2970#ifdef CONFIG_MAC80211_MESH
2971 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2972 struct ieee80211_local *local = sdata->local;
2973 uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
2974 struct ieee80211_hdr hdr = {
2975 .frame_control = cpu_to_le16(fc)
2976 };
2977 struct ieee80211_hdr *fwd_hdr;
2978 struct ieee80211s_hdr *mesh_hdr;
2979 struct ieee80211_tx_info *info;
2980 struct sk_buff *fwd_skb;
2981 struct ethhdr *eth;
2982 bool multicast;
2983 int tailroom = 0;
2984 int hdrlen, mesh_hdrlen;
2985 u8 *qos;
2986
2987 if (!ieee80211_vif_is_mesh(&sdata->vif))
2988 return RX_CONTINUE;
2989
2990 if (!pskb_may_pull(skb, sizeof(*eth) + 6))
2991 return RX_DROP_U_RUNT_MESH_DATA;
2992
2993 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
2994 mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
2995
2996 if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
2997 return RX_DROP_U_RUNT_MESH_DATA;
2998
2999 eth = (struct ethhdr *)skb->data;
3000 multicast = is_multicast_ether_addr(eth->h_dest);
3001
3002 mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
3003 if (!mesh_hdr->ttl)
3004 return RX_DROP_U_MESH_NO_TTL;
3005
3006 /* frame is in RMC, don't forward */
3007 if (is_multicast_ether_addr(eth->h_dest) &&
3008 mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
3009 return RX_DROP_U_MESH_RMC;
3010
3011 /* forward packet */
3012 if (sdata->crypto_tx_tailroom_needed_cnt)
3013 tailroom = IEEE80211_ENCRYPT_TAILROOM;
3014
3015 if (mesh_hdr->flags & MESH_FLAGS_AE) {
3016 struct mesh_path *mppath;
3017 char *proxied_addr;
3018 bool update = false;
3019
3020 if (multicast)
3021 proxied_addr = mesh_hdr->eaddr1;
3022 else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
3023 /* has_a4 already checked in ieee80211_rx_mesh_check */
3024 proxied_addr = mesh_hdr->eaddr2;
3025 else
3026 return RX_DROP_U_MESH_BAD_AE;
3027
3028 rcu_read_lock();
3029 mppath = mpp_path_lookup(sdata, proxied_addr);
3030 if (!mppath) {
3031 mpp_path_add(sdata, proxied_addr, eth->h_source);
3032 } else {
3033 spin_lock_bh(&mppath->state_lock);
3034 if (!ether_addr_equal(mppath->mpp, eth->h_source)) {
3035 memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
3036 update = true;
3037 }
3038 mppath->exp_time = jiffies;
3039 spin_unlock_bh(&mppath->state_lock);
3040 }
3041
3042 /* flush fast xmit cache if the address path changed */
3043 if (update)
3044 mesh_fast_tx_flush_addr(sdata, proxied_addr);
3045
3046 rcu_read_unlock();
3047 }
3048
3049 /* Frame has reached destination. Don't forward */
3050 if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
3051 goto rx_accept;
3052
3053 if (!--mesh_hdr->ttl) {
3054 if (multicast)
3055 goto rx_accept;
3056
3057 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
3058 return RX_DROP_U_MESH_TTL_EXPIRED;
3059 }
3060
3061 if (!ifmsh->mshcfg.dot11MeshForwarding) {
3062 if (is_multicast_ether_addr(eth->h_dest))
3063 goto rx_accept;
3064
3065 return RX_DROP_U_MESH_NOT_FORWARDING;
3066 }
3067
3068 skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
3069
3070 if (!multicast &&
3071 ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
3072 return RX_QUEUED;
3073
3074 ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
3075 eth->h_dest, eth->h_source);
3076 hdrlen = ieee80211_hdrlen(hdr.frame_control);
3077 if (multicast) {
3078 int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
3079
3080 fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
3081 IEEE80211_ENCRYPT_HEADROOM,
3082 tailroom, GFP_ATOMIC);
3083 if (!fwd_skb)
3084 goto rx_accept;
3085 } else {
3086 fwd_skb = skb;
3087 skb = NULL;
3088
3089 if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
3090 return RX_DROP_U_OOM;
3091
3092 if (skb_linearize(fwd_skb))
3093 return RX_DROP_U_OOM;
3094 }
3095
3096 fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
3097 memcpy(fwd_hdr, &hdr, hdrlen - 2);
3098 qos = ieee80211_get_qos_ctl(fwd_hdr);
3099 qos[0] = qos[1] = 0;
3100
3101 skb_reset_mac_header(fwd_skb);
3102 hdrlen += mesh_hdrlen;
3103 if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
3104 &fwd_skb->protocol))
3105 hdrlen += ETH_ALEN;
3106 else
3107 fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
3108 skb_set_network_header(fwd_skb, hdrlen + 2);
3109
3110 info = IEEE80211_SKB_CB(fwd_skb);
3111 memset(info, 0, sizeof(*info));
3112 info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
3113 info->control.vif = &sdata->vif;
3114 info->control.jiffies = jiffies;
3115 fwd_skb->dev = sdata->dev;
3116 if (multicast) {
3117 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
3118 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3119 /* update power mode indication when forwarding */
3120 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
3121 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
3122 /* mesh power mode flags updated in mesh_nexthop_lookup */
3123 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
3124 } else {
3125 /* unable to resolve next hop */
3126 if (sta)
3127 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
3128 hdr.addr3, 0,
3129 WLAN_REASON_MESH_PATH_NOFORWARD,
3130 sta->sta.addr);
3131 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
3132 kfree_skb(fwd_skb);
3133 goto rx_accept;
3134 }
3135
3136 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
3137 ieee80211_set_qos_hdr(sdata, fwd_skb);
3138 ieee80211_add_pending_skb(local, fwd_skb);
3139
3140rx_accept:
3141 if (!skb)
3142 return RX_QUEUED;
3143
3144 ieee80211_strip_8023_mesh_hdr(skb);
3145#endif
3146
3147 return RX_CONTINUE;
3148}
3149
3150static ieee80211_rx_result debug_noinline
3151__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
3152{
3153 struct net_device *dev = rx->sdata->dev;
3154 struct sk_buff *skb = rx->skb;
3155 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3156 __le16 fc = hdr->frame_control;
3157 struct sk_buff_head frame_list;
3158 struct ethhdr ethhdr;
3159 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
3160
3161 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3162 check_da = NULL;
3163 check_sa = NULL;
3164 } else switch (rx->sdata->vif.type) {
3165 case NL80211_IFTYPE_AP:
3166 case NL80211_IFTYPE_AP_VLAN:
3167 check_da = NULL;
3168 break;
3169 case NL80211_IFTYPE_STATION:
3170 if (!test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
3171 check_sa = NULL;
3172 break;
3173 case NL80211_IFTYPE_MESH_POINT:
3174 check_sa = NULL;
3175 check_da = NULL;
3176 break;
3177 default:
3178 break;
3179 }
3180
3181 skb->dev = dev;
3182 __skb_queue_head_init(&frame_list);
3183
3184 if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
3185 rx->sdata->vif.addr,
3186 rx->sdata->vif.type,
3187 data_offset, true))
3188 return RX_DROP_U_BAD_AMSDU;
3189
3190 if (rx->sta->amsdu_mesh_control < 0) {
3191 s8 valid = -1;
3192 int i;
3193
3194 for (i = 0; i <= 2; i++) {
3195 if (!ieee80211_is_valid_amsdu(skb, i))
3196 continue;
3197
3198 if (valid >= 0) {
3199 /* ambiguous */
3200 valid = -1;
3201 break;
3202 }
3203
3204 valid = i;
3205 }
3206
3207 rx->sta->amsdu_mesh_control = valid;
3208 }
3209
3210 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
3211 rx->sdata->vif.type,
3212 rx->local->hw.extra_tx_headroom,
3213 check_da, check_sa,
3214 rx->sta->amsdu_mesh_control);
3215
3216 while (!skb_queue_empty(&frame_list)) {
3217 rx->skb = __skb_dequeue(&frame_list);
3218
3219 switch (ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb)) {
3220 case RX_QUEUED:
3221 break;
3222 case RX_CONTINUE:
3223 if (ieee80211_frame_allowed(rx, fc)) {
3224 ieee80211_deliver_skb(rx);
3225 break;
3226 }
3227 fallthrough;
3228 default:
3229 dev_kfree_skb(rx->skb);
3230 }
3231 }
3232
3233 return RX_QUEUED;
3234}
3235
3236static ieee80211_rx_result debug_noinline
3237ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
3238{
3239 struct sk_buff *skb = rx->skb;
3240 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3241 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3242 __le16 fc = hdr->frame_control;
3243
3244 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
3245 return RX_CONTINUE;
3246
3247 if (unlikely(!ieee80211_is_data(fc)))
3248 return RX_CONTINUE;
3249
3250 if (unlikely(!ieee80211_is_data_present(fc)))
3251 return RX_DROP_U_AMSDU_WITHOUT_DATA;
3252
3253 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3254 switch (rx->sdata->vif.type) {
3255 case NL80211_IFTYPE_AP_VLAN:
3256 if (!rx->sdata->u.vlan.sta)
3257 return RX_DROP_U_BAD_4ADDR;
3258 break;
3259 case NL80211_IFTYPE_STATION:
3260 if (!rx->sdata->u.mgd.use_4addr)
3261 return RX_DROP_U_BAD_4ADDR;
3262 break;
3263 case NL80211_IFTYPE_MESH_POINT:
3264 break;
3265 default:
3266 return RX_DROP_U_BAD_4ADDR;
3267 }
3268 }
3269
3270 if (is_multicast_ether_addr(hdr->addr1) || !rx->sta)
3271 return RX_DROP_U_BAD_AMSDU;
3272
3273 if (rx->key) {
3274 /*
3275 * We should not receive A-MSDUs on pre-HT connections,
3276 * and HT connections cannot use old ciphers. Thus drop
3277 * them, as in those cases we couldn't even have SPP
3278 * A-MSDUs or such.
3279 */
3280 switch (rx->key->conf.cipher) {
3281 case WLAN_CIPHER_SUITE_WEP40:
3282 case WLAN_CIPHER_SUITE_WEP104:
3283 case WLAN_CIPHER_SUITE_TKIP:
3284 return RX_DROP_U_BAD_AMSDU_CIPHER;
3285 default:
3286 break;
3287 }
3288 }
3289
3290 return __ieee80211_rx_h_amsdu(rx, 0);
3291}
3292
3293static ieee80211_rx_result debug_noinline
3294ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
3295{
3296 struct ieee80211_sub_if_data *sdata = rx->sdata;
3297 struct ieee80211_local *local = rx->local;
3298 struct net_device *dev = sdata->dev;
3299 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3300 __le16 fc = hdr->frame_control;
3301 ieee80211_rx_result res;
3302 bool port_control;
3303
3304 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
3305 return RX_CONTINUE;
3306
3307 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3308 return RX_DROP_U_NULL_DATA;
3309
3310 /* Send unexpected-4addr-frame event to hostapd */
3311 if (ieee80211_has_a4(hdr->frame_control) &&
3312 sdata->vif.type == NL80211_IFTYPE_AP) {
3313 if (rx->sta &&
3314 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
3315 cfg80211_rx_unexpected_4addr_frame(
3316 rx->sdata->dev, rx->sta->sta.addr, rx->link_id,
3317 GFP_ATOMIC);
3318 return RX_DROP_U_UNEXPECTED_4ADDR;
3319 }
3320
3321 res = __ieee80211_data_to_8023(rx, &port_control);
3322 if (unlikely(res != RX_CONTINUE))
3323 return res;
3324
3325 res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
3326 if (res != RX_CONTINUE)
3327 return res;
3328
3329 if (!ieee80211_frame_allowed(rx, fc))
3330 return RX_DROP_U_PORT_CONTROL;
3331
3332 /* directly handle TDLS channel switch requests/responses */
3333 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3334 cpu_to_be16(ETH_P_TDLS))) {
3335 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3336
3337 if (pskb_may_pull(rx->skb,
3338 offsetof(struct ieee80211_tdls_data, u)) &&
3339 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3340 tf->category == WLAN_CATEGORY_TDLS &&
3341 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3342 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
3343 rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3344 __ieee80211_queue_skb_to_iface(sdata, rx->link_id,
3345 rx->sta, rx->skb);
3346 return RX_QUEUED;
3347 }
3348 }
3349
3350 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3351 unlikely(port_control) && sdata->bss) {
3352 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3353 u.ap);
3354 dev = sdata->dev;
3355 rx->sdata = sdata;
3356 }
3357
3358 rx->skb->dev = dev;
3359
3360 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3361 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3362 !is_multicast_ether_addr(
3363 ((struct ethhdr *)rx->skb->data)->h_dest) &&
3364 (!local->scanning &&
3365 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3366 mod_timer(&local->dynamic_ps_timer, jiffies +
3367 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
3368
3369 ieee80211_deliver_skb(rx);
3370
3371 return RX_QUEUED;
3372}
3373
3374static ieee80211_rx_result debug_noinline
3375ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3376{
3377 struct sk_buff *skb = rx->skb;
3378 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3379 struct tid_ampdu_rx *tid_agg_rx;
3380 u16 start_seq_num;
3381 u16 tid;
3382
3383 if (likely(!ieee80211_is_ctl(bar->frame_control)))
3384 return RX_CONTINUE;
3385
3386 if (ieee80211_is_back_req(bar->frame_control)) {
3387 struct {
3388 __le16 control, start_seq_num;
3389 } __packed bar_data;
3390 struct ieee80211_event event = {
3391 .type = BAR_RX_EVENT,
3392 };
3393
3394 if (!rx->sta)
3395 return RX_DROP_U_UNKNOWN_STA;
3396
3397 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3398 &bar_data, sizeof(bar_data)))
3399 return RX_DROP_U_RUNT_BAR;
3400
3401 tid = le16_to_cpu(bar_data.control) >> 12;
3402
3403 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3404 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
3405 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
3406 WLAN_BACK_RECIPIENT,
3407 WLAN_REASON_QSTA_REQUIRE_SETUP,
3408 ieee80211_s1g_use_ndp_ba(rx->sdata,
3409 rx->sta));
3410
3411 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3412 if (!tid_agg_rx)
3413 return RX_DROP_U_BAR_OUTSIDE_SESSION;
3414
3415 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3416 event.u.ba.tid = tid;
3417 event.u.ba.ssn = start_seq_num;
3418 event.u.ba.sta = &rx->sta->sta;
3419
3420 /* reset session timer */
3421 if (tid_agg_rx->timeout)
3422 mod_timer(&tid_agg_rx->session_timer,
3423 TU_TO_EXP_TIME(tid_agg_rx->timeout));
3424
3425 spin_lock(&tid_agg_rx->reorder_lock);
3426 /* release stored frames up to start of BAR */
3427 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
3428 start_seq_num, frames);
3429 spin_unlock(&tid_agg_rx->reorder_lock);
3430
3431 drv_event_callback(rx->local, rx->sdata, &event);
3432
3433 kfree_skb(skb);
3434 return RX_QUEUED;
3435 }
3436
3437 return RX_DROP_U_CTRL_FRAME;
3438}
3439
3440static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3441 struct ieee80211_mgmt *mgmt,
3442 size_t len)
3443{
3444 struct ieee80211_local *local = sdata->local;
3445 struct sk_buff *skb;
3446 struct ieee80211_mgmt *resp;
3447
3448 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
3449 /* Not to own unicast address */
3450 return;
3451 }
3452
3453 if (!ether_addr_equal(mgmt->sa, sdata->vif.cfg.ap_addr) ||
3454 !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {
3455 /* Not from the current AP or not associated yet. */
3456 return;
3457 }
3458
3459 if (len < IEEE80211_MIN_ACTION_SIZE(sa_query)) {
3460 /* Too short SA Query request frame */
3461 return;
3462 }
3463
3464 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
3465 if (skb == NULL)
3466 return;
3467
3468 skb_reserve(skb, local->hw.extra_tx_headroom);
3469 resp = skb_put_zero(skb, IEEE80211_MIN_ACTION_SIZE(sa_query));
3470 memcpy(resp->da, sdata->vif.cfg.ap_addr, ETH_ALEN);
3471 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3472 memcpy(resp->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);
3473 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3474 IEEE80211_STYPE_ACTION);
3475 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3476 resp->u.action.action_code = WLAN_ACTION_SA_QUERY_RESPONSE;
3477 memcpy(resp->u.action.sa_query.trans_id,
3478 mgmt->u.action.sa_query.trans_id,
3479 WLAN_SA_QUERY_TR_ID_LEN);
3480
3481 ieee80211_tx_skb(sdata, skb);
3482}
3483
3484static void
3485ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3486{
3487 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3488 struct ieee80211_bss_conf *bss_conf;
3489 const struct element *ie;
3490 size_t baselen;
3491
3492 if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
3493 NL80211_EXT_FEATURE_BSS_COLOR))
3494 return;
3495
3496 if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3497 return;
3498
3499 bss_conf = rx->link->conf;
3500 if (bss_conf->csa_active || bss_conf->color_change_active ||
3501 !bss_conf->he_bss_color.enabled)
3502 return;
3503
3504 baselen = mgmt->u.beacon.variable - rx->skb->data;
3505 if (baselen > rx->skb->len)
3506 return;
3507
3508 ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
3509 mgmt->u.beacon.variable,
3510 rx->skb->len - baselen);
3511 if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3512 ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
3513 const struct ieee80211_he_operation *he_oper;
3514 u8 color;
3515
3516 he_oper = (void *)(ie->data + 1);
3517 if (le32_get_bits(he_oper->he_oper_params,
3518 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3519 return;
3520
3521 color = le32_get_bits(he_oper->he_oper_params,
3522 IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3523 if (color == bss_conf->he_bss_color.color)
3524 ieee80211_obss_color_collision_notify(&rx->sdata->vif,
3525 BIT_ULL(color),
3526 bss_conf->link_id);
3527 }
3528}
3529
3530static ieee80211_rx_result debug_noinline
3531ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3532{
3533 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3534 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3535
3536 if (ieee80211_is_s1g_beacon(mgmt->frame_control))
3537 return RX_CONTINUE;
3538
3539 /*
3540 * From here on, look only at management frames.
3541 * Data and control frames are already handled,
3542 * and unknown (reserved) frames are useless.
3543 */
3544 if (rx->skb->len < 24)
3545 return RX_DROP_U_RUNT_MGMT;
3546
3547 if (!ieee80211_is_mgmt(mgmt->frame_control))
3548 return RX_DROP_U_EXPECTED_MGMT;
3549
3550 /* drop too small action frames */
3551 if (ieee80211_is_action(mgmt->frame_control) &&
3552 rx->skb->len < IEEE80211_MIN_ACTION_SIZE(category))
3553 return RX_DROP_U_RUNT_ACTION;
3554
3555 /* Drop non-broadcast Beacon frames */
3556 if (ieee80211_is_beacon(mgmt->frame_control) &&
3557 !is_broadcast_ether_addr(mgmt->da))
3558 return RX_DROP_U_NONBCAST_BEACON;
3559
3560 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3561 ieee80211_is_beacon(mgmt->frame_control) &&
3562 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3563 int sig = 0;
3564
3565 /* sw bss color collision detection */
3566 ieee80211_rx_check_bss_color_collision(rx);
3567
3568 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3569 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3570 sig = status->signal;
3571
3572 cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,
3573 rx->skb->data, rx->skb->len,
3574 ieee80211_rx_status_to_khz(status),
3575 sig);
3576 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3577 }
3578
3579 return ieee80211_drop_unencrypted_mgmt(rx);
3580}
3581
3582static bool
3583ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3584{
3585 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
3586 struct ieee80211_sub_if_data *sdata = rx->sdata;
3587
3588 /* TWT actions are only supported in AP for the moment */
3589 if (sdata->vif.type != NL80211_IFTYPE_AP)
3590 return false;
3591
3592 if (!rx->local->ops->add_twt_setup)
3593 return false;
3594
3595 if (!sdata->vif.bss_conf.twt_responder)
3596 return false;
3597
3598 if (!rx->sta)
3599 return false;
3600
3601 switch (mgmt->u.action.action_code) {
3602 case WLAN_S1G_TWT_SETUP: {
3603 struct ieee80211_twt_setup *twt;
3604
3605 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) +
3606 sizeof(struct ieee80211_twt_setup) +
3607 2 /* TWT req_type agrt */)
3608 break;
3609
3610 twt = (void *)mgmt->u.action.s1g.variable;
3611 if (twt->element_id != WLAN_EID_S1G_TWT)
3612 break;
3613
3614 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) +
3615 3 + /* token + tlv */
3616 twt->length)
3617 break;
3618
3619 return true; /* queue the frame */
3620 }
3621 case WLAN_S1G_TWT_TEARDOWN:
3622 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE(action_code) + 1)
3623 break;
3624
3625 return true; /* queue the frame */
3626 default:
3627 break;
3628 }
3629
3630 return false;
3631}
3632
3633static ieee80211_rx_result debug_noinline
3634ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3635{
3636 struct ieee80211_local *local = rx->local;
3637 struct ieee80211_sub_if_data *sdata = rx->sdata;
3638 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3639 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3640 int len = rx->skb->len;
3641
3642 if (!ieee80211_is_action(mgmt->frame_control))
3643 return RX_CONTINUE;
3644
3645 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3646 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3647 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3648 return RX_DROP_U_ACTION_UNKNOWN_SRC;
3649
3650 switch (mgmt->u.action.category) {
3651 case WLAN_CATEGORY_HT:
3652 /* reject HT action frames from stations not supporting HT
3653 * or not HE Capable
3654 */
3655 if (!rx->link_sta->pub->ht_cap.ht_supported &&
3656 !rx->link_sta->pub->he_cap.has_he)
3657 goto invalid;
3658
3659 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3660 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3661 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3662 sdata->vif.type != NL80211_IFTYPE_AP &&
3663 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3664 break;
3665
3666 /* verify action & smps_control/chanwidth are present */
3667 if (len < IEEE80211_MIN_ACTION_SIZE(ht_smps))
3668 goto invalid;
3669
3670 switch (mgmt->u.action.action_code) {
3671 case WLAN_HT_ACTION_SMPS: {
3672 struct ieee80211_supported_band *sband;
3673 enum ieee80211_smps_mode smps_mode;
3674 struct sta_opmode_info sta_opmode = {};
3675
3676 if (sdata->vif.type != NL80211_IFTYPE_AP &&
3677 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3678 goto handled;
3679
3680 /* convert to HT capability */
3681 switch (mgmt->u.action.ht_smps.smps_control) {
3682 case WLAN_HT_SMPS_CONTROL_DISABLED:
3683 smps_mode = IEEE80211_SMPS_OFF;
3684 break;
3685 case WLAN_HT_SMPS_CONTROL_STATIC:
3686 smps_mode = IEEE80211_SMPS_STATIC;
3687 break;
3688 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3689 smps_mode = IEEE80211_SMPS_DYNAMIC;
3690 break;
3691 default:
3692 goto invalid;
3693 }
3694
3695 /* if no change do nothing */
3696 if (rx->link_sta->pub->smps_mode == smps_mode)
3697 goto handled;
3698 rx->link_sta->pub->smps_mode = smps_mode;
3699 sta_opmode.smps_mode =
3700 ieee80211_smps_mode_to_smps_mode(smps_mode);
3701 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3702
3703 sband = rx->local->hw.wiphy->bands[status->band];
3704
3705 rate_control_rate_update(local, sband, rx->link_sta,
3706 IEEE80211_RC_SMPS_CHANGED);
3707 cfg80211_sta_opmode_change_notify(sdata->dev,
3708 rx->sta->addr,
3709 &sta_opmode,
3710 GFP_ATOMIC);
3711 goto handled;
3712 }
3713 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3714 u8 chanwidth = mgmt->u.action.ht_notify_cw.chanwidth;
3715
3716 if (chanwidth != IEEE80211_HT_CHANWIDTH_20MHZ &&
3717 chanwidth != IEEE80211_HT_CHANWIDTH_ANY)
3718 goto invalid;
3719
3720 /* If it doesn't support 40 MHz it can't change ... */
3721 if (!(rx->link_sta->pub->ht_cap.cap &
3722 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3723 goto handled;
3724
3725 goto queue;
3726 }
3727 default:
3728 goto invalid;
3729 }
3730
3731 break;
3732 case WLAN_CATEGORY_PUBLIC:
3733 case WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION:
3734 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3735 goto invalid;
3736 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3737 break;
3738 if (!rx->sta)
3739 break;
3740 if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))
3741 break;
3742 if (mgmt->u.action.action_code !=
3743 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3744 break;
3745 if (len < IEEE80211_MIN_ACTION_SIZE(ext_chan_switch))
3746 goto invalid;
3747 goto queue;
3748 case WLAN_CATEGORY_VHT:
3749 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3750 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3751 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3752 sdata->vif.type != NL80211_IFTYPE_AP &&
3753 sdata->vif.type != NL80211_IFTYPE_ADHOC)
3754 break;
3755
3756 /* verify action code is present */
3757 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3758 goto invalid;
3759
3760 switch (mgmt->u.action.action_code) {
3761 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3762 /* verify opmode is present */
3763 if (len < IEEE80211_MIN_ACTION_SIZE(vht_opmode_notif))
3764 goto invalid;
3765 goto queue;
3766 }
3767 case WLAN_VHT_ACTION_GROUPID_MGMT: {
3768 if (len < IEEE80211_MIN_ACTION_SIZE(vht_group_notif))
3769 goto invalid;
3770 goto queue;
3771 }
3772 default:
3773 break;
3774 }
3775 break;
3776 case WLAN_CATEGORY_BACK:
3777 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3778 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3779 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3780 sdata->vif.type != NL80211_IFTYPE_AP &&
3781 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3782 sdata->vif.type != NL80211_IFTYPE_NAN_DATA)
3783 break;
3784
3785 /* verify action_code is present */
3786 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3787 break;
3788
3789 switch (mgmt->u.action.action_code) {
3790 case WLAN_ACTION_ADDBA_REQ:
3791 case WLAN_ACTION_NDP_ADDBA_REQ:
3792 if (len < IEEE80211_MIN_ACTION_SIZE(addba_req))
3793 goto invalid;
3794 break;
3795 case WLAN_ACTION_ADDBA_RESP:
3796 case WLAN_ACTION_NDP_ADDBA_RESP:
3797 if (len < IEEE80211_MIN_ACTION_SIZE(addba_resp))
3798 goto invalid;
3799 break;
3800 case WLAN_ACTION_DELBA:
3801 case WLAN_ACTION_NDP_DELBA:
3802 if (len < IEEE80211_MIN_ACTION_SIZE(delba))
3803 goto invalid;
3804 break;
3805 default:
3806 goto invalid;
3807 }
3808
3809 goto queue;
3810 case WLAN_CATEGORY_SPECTRUM_MGMT:
3811 /* verify action_code is present */
3812 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3813 break;
3814
3815 switch (mgmt->u.action.action_code) {
3816 case WLAN_ACTION_SPCT_MSR_REQ:
3817 if (status->band != NL80211_BAND_5GHZ)
3818 break;
3819
3820 if (len < IEEE80211_MIN_ACTION_SIZE(measurement))
3821 break;
3822
3823 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3824 break;
3825
3826 ieee80211_process_measurement_req(sdata, mgmt, len);
3827 goto handled;
3828 case WLAN_ACTION_SPCT_CHL_SWITCH: {
3829 u8 *bssid;
3830 if (len < IEEE80211_MIN_ACTION_SIZE(chan_switch))
3831 break;
3832
3833 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3834 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3835 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3836 break;
3837
3838 if (sdata->vif.type == NL80211_IFTYPE_STATION)
3839 bssid = sdata->deflink.u.mgd.bssid;
3840 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3841 bssid = sdata->u.ibss.bssid;
3842 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3843 bssid = mgmt->sa;
3844 else
3845 break;
3846
3847 if (!ether_addr_equal(mgmt->bssid, bssid))
3848 break;
3849
3850 goto queue;
3851 }
3852 }
3853 break;
3854 case WLAN_CATEGORY_SELF_PROTECTED:
3855 if (len < IEEE80211_MIN_ACTION_SIZE(self_prot))
3856 break;
3857
3858 switch (mgmt->u.action.action_code) {
3859 case WLAN_SP_MESH_PEERING_OPEN:
3860 case WLAN_SP_MESH_PEERING_CLOSE:
3861 case WLAN_SP_MESH_PEERING_CONFIRM:
3862 if (!ieee80211_vif_is_mesh(&sdata->vif))
3863 goto invalid;
3864 if (sdata->u.mesh.user_mpm)
3865 /* userspace handles this frame */
3866 break;
3867 goto queue;
3868 case WLAN_SP_MGK_INFORM:
3869 case WLAN_SP_MGK_ACK:
3870 if (!ieee80211_vif_is_mesh(&sdata->vif))
3871 goto invalid;
3872 break;
3873 }
3874 break;
3875 case WLAN_CATEGORY_MESH_ACTION:
3876 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3877 break;
3878
3879 if (!ieee80211_vif_is_mesh(&sdata->vif))
3880 break;
3881 if (mesh_action_is_path_sel(mgmt) &&
3882 !mesh_path_sel_is_hwmp(sdata))
3883 break;
3884 goto queue;
3885 case WLAN_CATEGORY_S1G:
3886 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3887 break;
3888
3889 switch (mgmt->u.action.action_code) {
3890 case WLAN_S1G_TWT_SETUP:
3891 case WLAN_S1G_TWT_TEARDOWN:
3892 if (ieee80211_process_rx_twt_action(rx))
3893 goto queue;
3894 break;
3895 default:
3896 break;
3897 }
3898 break;
3899 case WLAN_CATEGORY_PROTECTED_EHT:
3900 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3901 break;
3902
3903 switch (mgmt->u.action.action_code) {
3904 case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
3905 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3906 break;
3907
3908 if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_req))
3909 goto invalid;
3910 goto queue;
3911 case WLAN_PROTECTED_EHT_ACTION_TTLM_RES:
3912 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3913 break;
3914
3915 if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_res))
3916 goto invalid;
3917 goto queue;
3918 case WLAN_PROTECTED_EHT_ACTION_TTLM_TEARDOWN:
3919 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3920 break;
3921
3922 if (len < IEEE80211_MIN_ACTION_SIZE(ttlm_tear_down))
3923 goto invalid;
3924 goto queue;
3925 case WLAN_PROTECTED_EHT_ACTION_LINK_RECONFIG_RESP:
3926 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3927 break;
3928
3929 /* The reconfiguration response action frame must
3930 * least one 'Status Duple' entry (3 octets)
3931 */
3932 if (len < IEEE80211_MIN_ACTION_SIZE(ml_reconf_resp) + 3)
3933 goto invalid;
3934 goto queue;
3935 case WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_RESP:
3936 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3937 break;
3938
3939 if (len < IEEE80211_MIN_ACTION_SIZE(epcs) +
3940 IEEE80211_EPCS_ENA_RESP_BODY_LEN)
3941 goto invalid;
3942 goto queue;
3943 case WLAN_PROTECTED_EHT_ACTION_EPCS_ENABLE_TEARDOWN:
3944 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3945 break;
3946
3947 if (len < IEEE80211_MIN_ACTION_SIZE(epcs))
3948 goto invalid;
3949 goto queue;
3950 case WLAN_PROTECTED_EHT_ACTION_EML_OP_MODE_NOTIF:
3951 if (sdata->vif.type != NL80211_IFTYPE_AP)
3952 break;
3953
3954 if (len < IEEE80211_MIN_ACTION_SIZE(eml_omn))
3955 goto invalid;
3956 goto queue;
3957 default:
3958 break;
3959 }
3960 break;
3961 case WLAN_CATEGORY_PROTECTED_UHR:
3962 if (len < IEEE80211_MIN_ACTION_SIZE(action_code))
3963 break;
3964
3965 switch (mgmt->u.action.action_code) {
3966 case IEEE80211_PROTECTED_UHR_ACTION_LINK_RECONFIG_REQUEST:
3967 if (sdata->vif.type != NL80211_IFTYPE_AP)
3968 break;
3969 if (len < IEEE80211_MIN_ACTION_SIZE(uhr_link_reconf_req))
3970 goto invalid;
3971 if (mgmt->u.action.uhr_link_reconf_req.type !=
3972 IEEE80211_UHR_LINK_RECONFIG_REQUEST_OMP_REQUEST)
3973 break;
3974 goto queue;
3975 case IEEE80211_PROTECTED_UHR_ACTION_LINK_RECONFIG_NOTIFY:
3976 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3977 break;
3978
3979 if (len < IEEE80211_MIN_ACTION_SIZE(uhr_link_reconf_notif))
3980 goto invalid;
3981 goto queue;
3982 }
3983 break;
3984 }
3985
3986 return RX_CONTINUE;
3987
3988 invalid:
3989 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3990 /* will return in the next handlers */
3991 return RX_CONTINUE;
3992
3993 handled:
3994 if (rx->sta)
3995 rx->link_sta->rx_stats.packets++;
3996 dev_kfree_skb(rx->skb);
3997 return RX_QUEUED;
3998
3999 queue:
4000 ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4001 return RX_QUEUED;
4002}
4003
4004static ieee80211_rx_result debug_noinline
4005ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
4006{
4007 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4008 struct cfg80211_rx_info info = {
4009 .freq = ieee80211_rx_status_to_khz(status),
4010 .buf = rx->skb->data,
4011 .len = rx->skb->len,
4012 .link_id = rx->link_id,
4013 .have_link_id = rx->link_id >= 0,
4014 };
4015
4016 /* skip known-bad action frames and return them in the next handler */
4017 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
4018 return RX_CONTINUE;
4019
4020 /*
4021 * Getting here means the kernel doesn't know how to handle
4022 * it, but maybe userspace does ... include returned frames
4023 * so userspace can register for those to know whether ones
4024 * it transmitted were processed or returned.
4025 */
4026
4027 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
4028 !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
4029 info.sig_dbm = status->signal;
4030
4031 if (ieee80211_is_timing_measurement(rx->skb) ||
4032 ieee80211_is_ftm(rx->skb)) {
4033 info.rx_tstamp = ktime_to_ns(skb_hwtstamps(rx->skb)->hwtstamp);
4034 info.ack_tstamp = ktime_to_ns(status->ack_tx_hwtstamp);
4035 }
4036
4037 if (cfg80211_rx_mgmt_ext(&rx->sdata->wdev, &info)) {
4038 if (rx->sta)
4039 rx->link_sta->rx_stats.packets++;
4040 dev_kfree_skb(rx->skb);
4041 return RX_QUEUED;
4042 }
4043
4044 return RX_CONTINUE;
4045}
4046
4047static ieee80211_rx_result debug_noinline
4048ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
4049{
4050 struct ieee80211_sub_if_data *sdata = rx->sdata;
4051 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
4052 int len = rx->skb->len;
4053
4054 if (!ieee80211_is_action(mgmt->frame_control))
4055 return RX_CONTINUE;
4056
4057 switch (mgmt->u.action.category) {
4058 case WLAN_CATEGORY_SA_QUERY:
4059 if (len < IEEE80211_MIN_ACTION_SIZE(sa_query))
4060 break;
4061
4062 switch (mgmt->u.action.action_code) {
4063 case WLAN_ACTION_SA_QUERY_REQUEST:
4064 if (sdata->vif.type != NL80211_IFTYPE_STATION)
4065 break;
4066 ieee80211_process_sa_query_req(sdata, mgmt, len);
4067 goto handled;
4068 }
4069 break;
4070 }
4071
4072 return RX_CONTINUE;
4073
4074 handled:
4075 if (rx->sta)
4076 rx->link_sta->rx_stats.packets++;
4077 dev_kfree_skb(rx->skb);
4078 return RX_QUEUED;
4079}
4080
4081static ieee80211_rx_result debug_noinline
4082ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
4083{
4084 struct ieee80211_local *local = rx->local;
4085 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
4086 struct sk_buff *nskb;
4087 struct ieee80211_sub_if_data *sdata = rx->sdata;
4088 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4089
4090 if (!ieee80211_is_action(mgmt->frame_control))
4091 return RX_CONTINUE;
4092
4093 /*
4094 * For AP mode, hostapd is responsible for handling any action
4095 * frames that we didn't handle, including returning unknown
4096 * ones. For all other modes we will return them to the sender,
4097 * setting the 0x80 bit in the action category, as required by
4098 * 802.11-2012 9.24.4.
4099 * Newer versions of hostapd use the management frame registration
4100 * mechanisms and old cooked monitor interface is no longer supported.
4101 */
4102 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
4103 (sdata->vif.type == NL80211_IFTYPE_AP ||
4104 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
4105 return RX_DROP_U_MALFORMED_ACTION;
4106
4107 if (is_multicast_ether_addr(mgmt->da))
4108 return RX_DROP_U_UNKNOWN_MCAST_ACTION;
4109
4110 /* do not return rejected action frames */
4111 if (mgmt->u.action.category & 0x80)
4112 return RX_DROP_U_REJECTED_ACTION_RESPONSE;
4113
4114 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
4115 GFP_ATOMIC);
4116 if (nskb) {
4117 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
4118
4119 nmgmt->u.action.category |= 0x80;
4120 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
4121 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
4122
4123 memset(nskb->cb, 0, sizeof(nskb->cb));
4124
4125 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
4126 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
4127
4128 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
4129 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
4130 IEEE80211_TX_CTL_NO_CCK_RATE;
4131 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
4132 info->hw_queue =
4133 local->hw.offchannel_tx_hw_queue;
4134 }
4135
4136 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, -1,
4137 status->band);
4138 }
4139
4140 return RX_DROP_U_UNKNOWN_ACTION_REJECTED;
4141}
4142
4143static ieee80211_rx_result debug_noinline
4144ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
4145{
4146 struct ieee80211_sub_if_data *sdata = rx->sdata;
4147 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
4148
4149 if (!ieee80211_is_ext(hdr->frame_control))
4150 return RX_CONTINUE;
4151
4152 if (sdata->vif.type != NL80211_IFTYPE_STATION)
4153 return RX_DROP_U_UNEXPECTED_EXT_FRAME;
4154
4155 /* for now only beacons are ext, so queue them */
4156 ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4157
4158 return RX_QUEUED;
4159}
4160
4161static ieee80211_rx_result debug_noinline
4162ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
4163{
4164 struct ieee80211_sub_if_data *sdata = rx->sdata;
4165 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
4166 __le16 stype;
4167
4168 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
4169
4170 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
4171 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4172 sdata->vif.type != NL80211_IFTYPE_OCB &&
4173 sdata->vif.type != NL80211_IFTYPE_STATION)
4174 return RX_DROP_U_UNHANDLED_MGMT;
4175
4176 switch (stype) {
4177 case cpu_to_le16(IEEE80211_STYPE_AUTH):
4178 case cpu_to_le16(IEEE80211_STYPE_BEACON):
4179 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
4180 /* process for all: mesh, mlme, ibss */
4181 break;
4182 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
4183 if (is_multicast_ether_addr(mgmt->da) &&
4184 !is_broadcast_ether_addr(mgmt->da))
4185 return RX_DROP_U_MCAST_DEAUTH;
4186
4187 /* process only for station/IBSS */
4188 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
4189 sdata->vif.type != NL80211_IFTYPE_ADHOC)
4190 return RX_DROP_U_UNHANDLED_DEAUTH;
4191 break;
4192 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
4193 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
4194 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
4195 if (is_multicast_ether_addr(mgmt->da) &&
4196 !is_broadcast_ether_addr(mgmt->da))
4197 return RX_DROP_U_MCAST_DISASSOC;
4198
4199 /* process only for station */
4200 if (sdata->vif.type != NL80211_IFTYPE_STATION)
4201 return RX_DROP_U_UNHANDLED_DISASSOC;
4202 break;
4203 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
4204 /* process only for ibss and mesh */
4205 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4206 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
4207 return RX_DROP_U_UNHANDLED_PREQ;
4208 break;
4209 default:
4210 return RX_DROP_U_UNHANDLED_MGMT_STYPE;
4211 }
4212
4213 ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4214
4215 return RX_QUEUED;
4216}
4217
4218static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
4219 ieee80211_rx_result res)
4220{
4221 if (res == RX_QUEUED) {
4222 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
4223 return;
4224 }
4225
4226 if (res != RX_CONTINUE) {
4227 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
4228 if (rx->sta)
4229 rx->link_sta->rx_stats.dropped++;
4230 }
4231
4232 kfree_skb_reason(rx->skb, (__force u32)res);
4233}
4234
4235static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
4236 struct sk_buff_head *frames)
4237{
4238 ieee80211_rx_result res;
4239 struct sk_buff *skb;
4240
4241#define CALL_RXH(rxh) \
4242 do { \
4243 res = rxh(rx); \
4244 if (res != RX_CONTINUE) \
4245 goto rxh_next; \
4246 } while (0)
4247
4248 /* Lock here to avoid hitting all of the data used in the RX
4249 * path (e.g. key data, station data, ...) concurrently when
4250 * a frame is released from the reorder buffer due to timeout
4251 * from the timer, potentially concurrently with RX from the
4252 * driver.
4253 */
4254 spin_lock_bh(&rx->local->rx_path_lock);
4255
4256 while ((skb = __skb_dequeue(frames))) {
4257 /*
4258 * all the other fields are valid across frames
4259 * that belong to an aMPDU since they are on the
4260 * same TID from the same station
4261 */
4262 rx->skb = skb;
4263
4264 if (WARN_ON_ONCE(!rx->link)) {
4265 res = RX_DROP_U_NO_LINK;
4266 goto rxh_next;
4267 }
4268
4269 CALL_RXH(ieee80211_rx_h_check_more_data);
4270 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
4271 CALL_RXH(ieee80211_rx_h_sta_process);
4272 CALL_RXH(ieee80211_rx_h_decrypt);
4273 CALL_RXH(ieee80211_rx_h_defragment);
4274 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
4275 /* must be after MMIC verify so header is counted in MPDU mic */
4276 CALL_RXH(ieee80211_rx_h_amsdu);
4277 CALL_RXH(ieee80211_rx_h_data);
4278
4279 /* special treatment -- needs the queue */
4280 res = ieee80211_rx_h_ctrl(rx, frames);
4281 if (res != RX_CONTINUE)
4282 goto rxh_next;
4283
4284 CALL_RXH(ieee80211_rx_h_mgmt_check);
4285 CALL_RXH(ieee80211_rx_h_action);
4286 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
4287 CALL_RXH(ieee80211_rx_h_action_post_userspace);
4288 CALL_RXH(ieee80211_rx_h_action_return);
4289 CALL_RXH(ieee80211_rx_h_ext);
4290 CALL_RXH(ieee80211_rx_h_mgmt);
4291
4292 rxh_next:
4293 ieee80211_rx_handlers_result(rx, res);
4294
4295#undef CALL_RXH
4296 }
4297
4298 spin_unlock_bh(&rx->local->rx_path_lock);
4299}
4300
4301static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
4302{
4303 struct sk_buff_head reorder_release;
4304 ieee80211_rx_result res;
4305
4306 __skb_queue_head_init(&reorder_release);
4307
4308#define CALL_RXH(rxh) \
4309 do { \
4310 res = rxh(rx); \
4311 if (res != RX_CONTINUE) \
4312 goto rxh_next; \
4313 } while (0)
4314
4315 CALL_RXH(ieee80211_rx_h_check_dup);
4316 CALL_RXH(ieee80211_rx_h_check);
4317
4318 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
4319
4320 ieee80211_rx_handlers(rx, &reorder_release);
4321 return;
4322
4323 rxh_next:
4324 ieee80211_rx_handlers_result(rx, res);
4325
4326#undef CALL_RXH
4327}
4328
4329static bool
4330ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
4331{
4332 return !!(sta->valid_links & BIT(link_id));
4333}
4334
4335static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
4336 u8 link_id)
4337{
4338 rx->link_id = link_id;
4339 rx->link = rcu_dereference(rx->sdata->link[link_id]);
4340
4341 if (!rx->sta)
4342 return rx->link;
4343
4344 if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
4345 return false;
4346
4347 rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
4348
4349 return rx->link && rx->link_sta;
4350}
4351
4352static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
4353 struct sta_info *sta, int link_id)
4354{
4355 rx->link_id = link_id;
4356 rx->sta = sta;
4357
4358 if (sta) {
4359 rx->local = sta->sdata->local;
4360 if (!rx->sdata)
4361 rx->sdata = sta->sdata;
4362 rx->link_sta = &sta->deflink;
4363 } else {
4364 rx->link_sta = NULL;
4365 }
4366
4367 if (link_id < 0) {
4368 if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
4369 sta && !sta->sta.valid_links)
4370 rx->link =
4371 rcu_dereference(rx->sdata->link[sta->deflink.link_id]);
4372 else
4373 rx->link = &rx->sdata->deflink;
4374 } else if (!ieee80211_rx_data_set_link(rx, link_id)) {
4375 return false;
4376 }
4377
4378 return true;
4379}
4380
4381/*
4382 * This function makes calls into the RX path, therefore
4383 * it has to be invoked under RCU read lock.
4384 */
4385void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4386{
4387 struct sk_buff_head frames;
4388 struct ieee80211_rx_data rx = {
4389 /* This is OK -- must be QoS data frame */
4390 .security_idx = tid,
4391 .seqno_idx = tid,
4392 };
4393 struct tid_ampdu_rx *tid_agg_rx;
4394 int link_id = -1;
4395
4396 /* FIXME: statistics won't be right with this */
4397 if (sta->sta.valid_links)
4398 link_id = ffs(sta->sta.valid_links) - 1;
4399
4400 if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
4401 return;
4402
4403 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4404 if (!tid_agg_rx)
4405 return;
4406
4407 __skb_queue_head_init(&frames);
4408
4409 spin_lock(&tid_agg_rx->reorder_lock);
4410 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4411 spin_unlock(&tid_agg_rx->reorder_lock);
4412
4413 if (!skb_queue_empty(&frames)) {
4414 struct ieee80211_event event = {
4415 .type = BA_FRAME_TIMEOUT,
4416 .u.ba.tid = tid,
4417 .u.ba.sta = &sta->sta,
4418 };
4419 drv_event_callback(rx.local, rx.sdata, &event);
4420 }
4421
4422 ieee80211_rx_handlers(&rx, &frames);
4423}
4424
4425void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4426 u16 ssn, u64 filtered,
4427 u16 received_mpdus)
4428{
4429 struct ieee80211_local *local;
4430 struct sta_info *sta;
4431 struct tid_ampdu_rx *tid_agg_rx;
4432 struct sk_buff_head frames;
4433 struct ieee80211_rx_data rx = {
4434 /* This is OK -- must be QoS data frame */
4435 .security_idx = tid,
4436 .seqno_idx = tid,
4437 };
4438 int i, diff;
4439
4440 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4441 return;
4442
4443 __skb_queue_head_init(&frames);
4444
4445 sta = container_of(pubsta, struct sta_info, sta);
4446
4447 local = sta->sdata->local;
4448 WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,
4449 "RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",
4450 local->hw.max_rx_aggregation_subframes);
4451
4452 if (!ieee80211_rx_data_set_sta(&rx, sta, -1))
4453 return;
4454
4455 rcu_read_lock();
4456 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4457 if (!tid_agg_rx)
4458 goto out;
4459
4460 spin_lock_bh(&tid_agg_rx->reorder_lock);
4461
4462 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4463 int release;
4464
4465 /* release all frames in the reorder buffer */
4466 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4467 IEEE80211_SN_MODULO;
4468 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
4469 release, &frames);
4470 /* update ssn to match received ssn */
4471 tid_agg_rx->head_seq_num = ssn;
4472 } else {
4473 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
4474 &frames);
4475 }
4476
4477 /* handle the case that received ssn is behind the mac ssn.
4478 * it can be tid_agg_rx->buf_size behind and still be valid */
4479 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4480 if (diff >= tid_agg_rx->buf_size) {
4481 tid_agg_rx->reorder_buf_filtered = 0;
4482 goto release;
4483 }
4484 filtered = filtered >> diff;
4485 ssn += diff;
4486
4487 /* update bitmap */
4488 for (i = 0; i < tid_agg_rx->buf_size; i++) {
4489 int index = (ssn + i) % tid_agg_rx->buf_size;
4490
4491 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4492 if (filtered & BIT_ULL(i))
4493 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4494 }
4495
4496 /* now process also frames that the filter marking released */
4497 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4498
4499release:
4500 spin_unlock_bh(&tid_agg_rx->reorder_lock);
4501
4502 ieee80211_rx_handlers(&rx, &frames);
4503
4504 out:
4505 rcu_read_unlock();
4506}
4507EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4508
4509/* main receive path */
4510
4511static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4512{
4513 return ether_addr_equal(raddr, addr) ||
4514 is_broadcast_ether_addr(raddr);
4515}
4516
4517static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
4518{
4519 struct ieee80211_sub_if_data *sdata = rx->sdata;
4520 struct sk_buff *skb = rx->skb;
4521 struct ieee80211_hdr *hdr = (void *)skb->data;
4522 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4523 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
4524 bool multicast;
4525 static const u8 nan_network_id[ETH_ALEN] __aligned(2) = {
4526 0x51, 0x6F, 0x9A, 0x01, 0x00, 0x00
4527 };
4528
4529 if (ieee80211_is_s1g_beacon(hdr->frame_control))
4530 return sdata->vif.type == NL80211_IFTYPE_STATION && bssid;
4531
4532 multicast = is_multicast_ether_addr(hdr->addr1);
4533
4534 switch (sdata->vif.type) {
4535 case NL80211_IFTYPE_STATION:
4536 if (!bssid && !sdata->u.mgd.use_4addr)
4537 return false;
4538 if (ieee80211_is_first_frag(hdr->seq_ctrl) &&
4539 ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4540 return false;
4541 if (multicast)
4542 return true;
4543 return ieee80211_is_our_addr(sdata, hdr->addr1, &rx->link_id);
4544 case NL80211_IFTYPE_ADHOC:
4545 if (!bssid)
4546 return false;
4547 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
4548 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
4549 !is_valid_ether_addr(hdr->addr2))
4550 return false;
4551 if (ieee80211_is_beacon(hdr->frame_control))
4552 return true;
4553 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
4554 return false;
4555 if (!multicast &&
4556 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
4557 return false;
4558 if (!rx->sta) {
4559 int rate_idx;
4560 if (status->encoding != RX_ENC_LEGACY)
4561 rate_idx = 0; /* TODO: HT/VHT rates */
4562 else
4563 rate_idx = status->rate_idx;
4564 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
4565 BIT(rate_idx));
4566 }
4567 return true;
4568 case NL80211_IFTYPE_OCB:
4569 if (!bssid)
4570 return false;
4571 if (!ieee80211_is_data_present(hdr->frame_control))
4572 return false;
4573 if (!is_broadcast_ether_addr(bssid))
4574 return false;
4575 if (!multicast &&
4576 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
4577 return false;
4578 /* reject invalid/our STA address */
4579 if (!is_valid_ether_addr(hdr->addr2) ||
4580 ether_addr_equal(sdata->dev->dev_addr, hdr->addr2))
4581 return false;
4582 if (!rx->sta) {
4583 int rate_idx;
4584 if (status->encoding != RX_ENC_LEGACY)
4585 rate_idx = 0; /* TODO: HT rates */
4586 else
4587 rate_idx = status->rate_idx;
4588 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
4589 BIT(rate_idx));
4590 }
4591 return true;
4592 case NL80211_IFTYPE_MESH_POINT:
4593 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
4594 return false;
4595 if (multicast)
4596 return true;
4597 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
4598 case NL80211_IFTYPE_AP_VLAN:
4599 case NL80211_IFTYPE_AP:
4600 if (!bssid)
4601 return ieee80211_is_our_addr(sdata, hdr->addr1,
4602 &rx->link_id);
4603
4604 if (!is_broadcast_ether_addr(bssid) &&
4605 !ieee80211_is_our_addr(sdata, bssid, NULL)) {
4606 /*
4607 * Accept public action frames even when the
4608 * BSSID doesn't match, this is used for P2P
4609 * and location updates. Note that mac80211
4610 * itself never looks at these frames.
4611 */
4612 if (!multicast &&
4613 !ieee80211_is_our_addr(sdata, hdr->addr1,
4614 &rx->link_id))
4615 return false;
4616 if (ieee80211_is_public_action(hdr, skb->len))
4617 return true;
4618 return ieee80211_is_beacon(hdr->frame_control);
4619 }
4620
4621 if (!ieee80211_has_tods(hdr->frame_control)) {
4622 /* ignore data frames to TDLS-peers */
4623 if (ieee80211_is_data(hdr->frame_control))
4624 return false;
4625 /* ignore action frames to TDLS-peers */
4626 if (ieee80211_is_action(hdr->frame_control) &&
4627 !is_broadcast_ether_addr(bssid) &&
4628 !ether_addr_equal(bssid, hdr->addr1))
4629 return false;
4630 }
4631
4632 /*
4633 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
4634 * the BSSID - we've checked that already but may have accepted
4635 * the wildcard (ff:ff:ff:ff:ff:ff).
4636 *
4637 * It also says:
4638 * The BSSID of the Data frame is determined as follows:
4639 * a) If the STA is contained within an AP or is associated
4640 * with an AP, the BSSID is the address currently in use
4641 * by the STA contained in the AP.
4642 *
4643 * So we should not accept data frames with an address that's
4644 * multicast.
4645 *
4646 * Accepting it also opens a security problem because stations
4647 * could encrypt it with the GTK and inject traffic that way.
4648 */
4649 if (ieee80211_is_data(hdr->frame_control) && multicast)
4650 return false;
4651
4652 return true;
4653 case NL80211_IFTYPE_P2P_DEVICE:
4654 return ieee80211_is_public_action(hdr, skb->len) ||
4655 ieee80211_is_probe_req(hdr->frame_control) ||
4656 ieee80211_is_probe_resp(hdr->frame_control) ||
4657 ieee80211_is_beacon(hdr->frame_control) ||
4658 (ieee80211_is_auth(hdr->frame_control) &&
4659 ether_addr_equal(sdata->vif.addr, hdr->addr1));
4660 case NL80211_IFTYPE_NAN:
4661 if (ieee80211_has_tods(hdr->frame_control) ||
4662 ieee80211_has_fromds(hdr->frame_control))
4663 return false;
4664
4665 /*
4666 * Accept only frames that are addressed to the NAN cluster
4667 * (based on the Cluster ID). From these frames, accept only
4668 * - public action frames,
4669 * - authentication frames to the local address, and
4670 * - robust management frames except disassoc.
4671 */
4672 if (!ether_addr_equal(sdata->u.nan.conf.cluster_id, hdr->addr3))
4673 return false;
4674 if (ieee80211_is_public_action(hdr, skb->len))
4675 return true;
4676 if (ieee80211_is_auth(hdr->frame_control) &&
4677 ether_addr_equal(sdata->vif.addr, hdr->addr1))
4678 return true;
4679 if (!ieee80211_is_disassoc(hdr->frame_control) &&
4680 ieee80211_is_robust_mgmt_frame(skb))
4681 return true;
4682 return false;
4683 case NL80211_IFTYPE_NAN_DATA:
4684 if (ieee80211_has_tods(hdr->frame_control) ||
4685 ieee80211_has_fromds(hdr->frame_control))
4686 return false;
4687
4688 if (ieee80211_is_data(hdr->frame_control)) {
4689 struct ieee80211_sub_if_data *nmi;
4690
4691 nmi = rcu_dereference(sdata->u.nan_data.nmi);
4692 if (!nmi)
4693 return false;
4694
4695 if (!ether_addr_equal(nmi->u.nan.conf.cluster_id,
4696 hdr->addr3))
4697 return false;
4698
4699 return multicast ||
4700 ether_addr_equal(sdata->vif.addr, hdr->addr1);
4701 }
4702
4703 /* Non-public action frames (unicast or multicast) */
4704 if (ieee80211_is_action(hdr->frame_control) &&
4705 !ieee80211_is_public_action(hdr, skb->len) &&
4706 (ether_addr_equal(nan_network_id, hdr->addr1) ||
4707 ether_addr_equal(sdata->vif.addr, hdr->addr1)))
4708 return true;
4709
4710 /* Unicast secure management frames */
4711 return ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
4712 ieee80211_is_unicast_robust_mgmt_frame(skb);
4713 case NL80211_IFTYPE_PD:
4714 /*
4715 * Accept only authentication frames (PASN) addressed to
4716 * this interface.
4717 */
4718 return ieee80211_is_auth(hdr->frame_control) &&
4719 ether_addr_equal(sdata->vif.addr, hdr->addr1);
4720 default:
4721 break;
4722 }
4723
4724 WARN_ON_ONCE(1);
4725 return false;
4726}
4727
4728void ieee80211_check_fast_rx(struct sta_info *sta)
4729{
4730 struct ieee80211_sub_if_data *sdata = sta->sdata;
4731 struct ieee80211_local *local = sdata->local;
4732 struct ieee80211_key *key;
4733 struct ieee80211_fast_rx fastrx = {
4734 .dev = sdata->dev,
4735 .vif_type = sdata->vif.type,
4736 .control_port_protocol = sdata->control_port_protocol,
4737 }, *old, *new = NULL;
4738 u32 offload_flags;
4739 bool set_offload = false;
4740 bool assign = false;
4741 bool offload;
4742
4743 /* use sparse to check that we don't return without updating */
4744 __acquire(check_fast_rx);
4745
4746 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4747 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4748 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
4749 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
4750
4751 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4752
4753 /* fast-rx doesn't do reordering */
4754 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4755 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4756 goto clear;
4757
4758 switch (sdata->vif.type) {
4759 case NL80211_IFTYPE_STATION:
4760 if (sta->sta.tdls) {
4761 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4762 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4763 fastrx.expected_ds_bits = 0;
4764 } else {
4765 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4766 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4767 fastrx.expected_ds_bits =
4768 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4769 }
4770
4771 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4772 fastrx.expected_ds_bits |=
4773 cpu_to_le16(IEEE80211_FCTL_TODS);
4774 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4775 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4776 }
4777
4778 if (!sdata->u.mgd.powersave)
4779 break;
4780
4781 /* software powersave is a huge mess, avoid all of it */
4782 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4783 goto clear;
4784 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4785 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4786 goto clear;
4787 break;
4788 case NL80211_IFTYPE_AP_VLAN:
4789 case NL80211_IFTYPE_AP:
4790 /* parallel-rx requires this, at least with calls to
4791 * ieee80211_sta_ps_transition()
4792 */
4793 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4794 goto clear;
4795 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4796 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4797 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4798
4799 fastrx.internal_forward =
4800 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4801 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4802 !sdata->u.vlan.sta);
4803
4804 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4805 sdata->u.vlan.sta) {
4806 fastrx.expected_ds_bits |=
4807 cpu_to_le16(IEEE80211_FCTL_FROMDS);
4808 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4809 fastrx.internal_forward = 0;
4810 }
4811
4812 break;
4813 case NL80211_IFTYPE_MESH_POINT:
4814 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
4815 IEEE80211_FCTL_TODS);
4816 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4817 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4818 break;
4819 default:
4820 goto clear;
4821 }
4822
4823 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
4824 goto clear;
4825
4826 rcu_read_lock();
4827 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4828 if (!key)
4829 key = rcu_dereference(sdata->default_unicast_key);
4830 if (key) {
4831 switch (key->conf.cipher) {
4832 case WLAN_CIPHER_SUITE_TKIP:
4833 /* we don't want to deal with MMIC in fast-rx */
4834 goto clear_rcu;
4835 case WLAN_CIPHER_SUITE_CCMP:
4836 case WLAN_CIPHER_SUITE_CCMP_256:
4837 case WLAN_CIPHER_SUITE_GCMP:
4838 case WLAN_CIPHER_SUITE_GCMP_256:
4839 break;
4840 default:
4841 /* We also don't want to deal with
4842 * WEP or cipher scheme.
4843 */
4844 goto clear_rcu;
4845 }
4846
4847 fastrx.key = true;
4848 fastrx.icv_len = key->conf.icv_len;
4849 }
4850
4851 assign = true;
4852 clear_rcu:
4853 rcu_read_unlock();
4854 clear:
4855 __release(check_fast_rx);
4856
4857 if (assign)
4858 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
4859
4860 offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
4861 offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
4862
4863 if (assign && offload)
4864 set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4865 else
4866 set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4867
4868 if (set_offload)
4869 drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
4870
4871 spin_lock_bh(&sta->lock);
4872 old = rcu_dereference_protected(sta->fast_rx, true);
4873 rcu_assign_pointer(sta->fast_rx, new);
4874 spin_unlock_bh(&sta->lock);
4875
4876 if (old)
4877 kfree_rcu(old, rcu_head);
4878}
4879
4880void ieee80211_clear_fast_rx(struct sta_info *sta)
4881{
4882 struct ieee80211_fast_rx *old;
4883
4884 spin_lock_bh(&sta->lock);
4885 old = rcu_dereference_protected(sta->fast_rx, true);
4886 RCU_INIT_POINTER(sta->fast_rx, NULL);
4887 spin_unlock_bh(&sta->lock);
4888
4889 if (old)
4890 kfree_rcu(old, rcu_head);
4891}
4892
4893void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4894{
4895 struct ieee80211_local *local = sdata->local;
4896 struct sta_info *sta;
4897
4898 lockdep_assert_wiphy(local->hw.wiphy);
4899
4900 list_for_each_entry(sta, &local->sta_list, list) {
4901 if (sdata != sta->sdata &&
4902 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4903 continue;
4904 ieee80211_check_fast_rx(sta);
4905 }
4906}
4907
4908void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4909{
4910 struct ieee80211_local *local = sdata->local;
4911
4912 lockdep_assert_wiphy(local->hw.wiphy);
4913
4914 __ieee80211_check_fast_rx_iface(sdata);
4915}
4916
4917static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4918 struct ieee80211_fast_rx *fast_rx,
4919 int orig_len)
4920{
4921 struct ieee80211_sta_rx_stats *stats;
4922 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4923 struct sta_info *sta = rx->sta;
4924 struct link_sta_info *link_sta;
4925 struct sk_buff *skb = rx->skb;
4926 void *sa = skb->data + ETH_ALEN;
4927 void *da = skb->data;
4928
4929 if (rx->link_id >= 0) {
4930 link_sta = rcu_dereference(sta->link[rx->link_id]);
4931 if (WARN_ON_ONCE(!link_sta)) {
4932 dev_kfree_skb(rx->skb);
4933 return;
4934 }
4935 } else {
4936 link_sta = &sta->deflink;
4937 }
4938
4939 stats = &link_sta->rx_stats;
4940 if (fast_rx->uses_rss)
4941 stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
4942
4943 /* statistics part of ieee80211_rx_h_sta_process() */
4944 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4945 stats->last_signal = status->signal;
4946 if (!fast_rx->uses_rss)
4947 ewma_signal_add(&link_sta->rx_stats_avg.signal,
4948 -status->signal);
4949 }
4950
4951 if (status->chains) {
4952 int i;
4953
4954 stats->chains = status->chains;
4955 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4956 int signal = status->chain_signal[i];
4957
4958 if (!(status->chains & BIT(i)))
4959 continue;
4960
4961 stats->chain_signal_last[i] = signal;
4962 if (!fast_rx->uses_rss)
4963 ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
4964 -signal);
4965 }
4966 }
4967 /* end of statistics */
4968
4969 stats->last_rx = jiffies;
4970 stats->last_rate = sta_stats_encode_rate(status);
4971
4972 stats->fragments++;
4973 stats->packets++;
4974
4975 skb->dev = fast_rx->dev;
4976
4977 dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
4978
4979 /* The seqno index has the same property as needed
4980 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4981 * for non-QoS-data frames. Here we know it's a data
4982 * frame, so count MSDUs.
4983 */
4984 u64_stats_update_begin(&stats->syncp);
4985 u64_stats_inc(&stats->msdu[rx->seqno_idx]);
4986 u64_stats_add(&stats->bytes, orig_len);
4987 u64_stats_update_end(&stats->syncp);
4988
4989 if (fast_rx->internal_forward) {
4990 struct sk_buff *xmit_skb = NULL;
4991 if (is_multicast_ether_addr(da)) {
4992 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4993 } else if (!ether_addr_equal(da, sa) &&
4994 sta_info_get(rx->sdata, da)) {
4995 xmit_skb = skb;
4996 skb = NULL;
4997 }
4998
4999 if (xmit_skb) {
5000 /*
5001 * Send to wireless media and increase priority by 256
5002 * to keep the received priority instead of
5003 * reclassifying the frame (see cfg80211_classify8021d).
5004 */
5005 xmit_skb->priority += 256;
5006 xmit_skb->protocol = htons(ETH_P_802_3);
5007 skb_reset_network_header(xmit_skb);
5008 skb_reset_mac_header(xmit_skb);
5009 dev_queue_xmit(xmit_skb);
5010 }
5011
5012 if (!skb)
5013 return;
5014 }
5015
5016 /* deliver to local stack */
5017 skb->protocol = eth_type_trans(skb, fast_rx->dev);
5018 ieee80211_deliver_skb_to_local_stack(skb, rx);
5019}
5020
5021static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
5022 struct ieee80211_fast_rx *fast_rx)
5023{
5024 struct sk_buff *skb = rx->skb;
5025 struct ieee80211_hdr *hdr = (void *)skb->data;
5026 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5027 ieee80211_rx_result res;
5028 int orig_len = skb->len;
5029 int hdrlen = ieee80211_hdrlen(hdr->frame_control);
5030 int snap_offs = hdrlen;
5031 struct {
5032 u8 snap[sizeof(rfc1042_header)];
5033 __be16 proto;
5034 } *payload __aligned(2);
5035 struct {
5036 u8 da[ETH_ALEN];
5037 u8 sa[ETH_ALEN];
5038 } addrs __aligned(2);
5039 struct ieee80211_sta_rx_stats *stats;
5040 u32 encoded_rate;
5041
5042 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
5043 * to a common data structure; drivers can implement that per queue
5044 * but we don't have that information in mac80211
5045 */
5046 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
5047 return false;
5048
5049#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
5050
5051 /* If using encryption, we also need to have:
5052 * - PN_VALIDATED: similar, but the implementation is tricky
5053 * - DECRYPTED: necessary for PN_VALIDATED
5054 */
5055 if (fast_rx->key &&
5056 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
5057 return false;
5058
5059 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
5060 return false;
5061
5062 if (unlikely(ieee80211_is_frag(hdr)))
5063 return false;
5064
5065 /* Since our interface address cannot be multicast, this
5066 * implicitly also rejects multicast frames without the
5067 * explicit check.
5068 *
5069 * We shouldn't get any *data* frames not addressed to us
5070 * (AP mode will accept multicast *management* frames), but
5071 * punting here will make it go through the full checks in
5072 * ieee80211_accept_frame().
5073 */
5074 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
5075 return false;
5076
5077 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
5078 IEEE80211_FCTL_TODS)) !=
5079 fast_rx->expected_ds_bits)
5080 return false;
5081
5082 /* assign the key to drop unencrypted frames (later)
5083 * and strip the IV/MIC if necessary
5084 */
5085 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
5086 /* GCMP header length is the same */
5087 snap_offs += IEEE80211_CCMP_HDR_LEN;
5088 }
5089
5090 if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
5091 !(status->rx_flags & IEEE80211_RX_AMSDU)) {
5092 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
5093 return false;
5094
5095 payload = (void *)(skb->data + snap_offs);
5096
5097 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
5098 return false;
5099
5100 /* Don't handle these here since they require special code.
5101 * Accept AARP and IPX even though they should come with a
5102 * bridge-tunnel header - but if we get them this way then
5103 * there's little point in discarding them.
5104 */
5105 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
5106 payload->proto == fast_rx->control_port_protocol))
5107 return false;
5108 }
5109
5110 /* after this point, don't punt to the slowpath! */
5111
5112 if (fast_rx->uses_rss)
5113 stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
5114 else
5115 stats = &rx->link_sta->rx_stats;
5116
5117 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
5118 pskb_trim(skb, skb->len - fast_rx->icv_len))
5119 goto drop;
5120
5121 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
5122 goto drop;
5123
5124 if (status->rx_flags & IEEE80211_RX_AMSDU) {
5125 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
5126 RX_QUEUED)
5127 goto drop;
5128
5129 return true;
5130 }
5131
5132 /* do the header conversion - first grab the addresses */
5133 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
5134 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
5135 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
5136 skb_pull(skb, snap_offs - 2);
5137 put_unaligned_be16(skb->len - 2, skb->data);
5138 } else {
5139 skb_postpull_rcsum(skb, skb->data + snap_offs,
5140 sizeof(rfc1042_header) + 2);
5141
5142 /* remove the SNAP but leave the ethertype */
5143 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
5144 }
5145 /* push the addresses in front */
5146 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
5147
5148 /* capture before mesh forward may memset or free skb->cb */
5149 encoded_rate = sta_stats_encode_rate(status);
5150
5151 res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
5152 switch (res) {
5153 case RX_QUEUED:
5154 stats->last_rx = jiffies;
5155 stats->last_rate = encoded_rate;
5156 return true;
5157 case RX_CONTINUE:
5158 break;
5159 default:
5160 goto drop;
5161 }
5162
5163 ieee80211_rx_8023(rx, fast_rx, orig_len);
5164
5165 return true;
5166 drop:
5167 dev_kfree_skb(skb);
5168
5169 stats->dropped++;
5170 return true;
5171}
5172
5173/*
5174 * This function returns whether or not the SKB
5175 * was destined for RX processing or not, which,
5176 * if consume is true, is equivalent to whether
5177 * or not the skb was consumed.
5178 */
5179static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
5180 struct sk_buff *skb, bool consume)
5181{
5182 struct ieee80211_local *local = rx->local;
5183 struct ieee80211_sub_if_data *sdata = rx->sdata;
5184 struct ieee80211_hdr *hdr = (void *)skb->data;
5185 struct link_sta_info *link_sta = rx->link_sta;
5186 struct ieee80211_link_data *link = rx->link;
5187
5188 rx->skb = skb;
5189
5190 /* See if we can do fast-rx; if we have to copy we already lost,
5191 * so punt in that case. We should never have to deliver a data
5192 * frame to multiple interfaces anyway.
5193 *
5194 * We skip the ieee80211_accept_frame() call and do the necessary
5195 * checking inside ieee80211_invoke_fast_rx().
5196 */
5197 if (consume && rx->sta) {
5198 struct ieee80211_fast_rx *fast_rx;
5199
5200 fast_rx = rcu_dereference(rx->sta->fast_rx);
5201 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
5202 return true;
5203 }
5204
5205 if (!ieee80211_accept_frame(rx))
5206 return false;
5207
5208 if (!consume) {
5209 struct skb_shared_hwtstamps *shwt;
5210
5211 rx->skb = skb_copy(skb, GFP_ATOMIC);
5212 if (!rx->skb) {
5213 if (net_ratelimit())
5214 wiphy_debug(local->hw.wiphy,
5215 "failed to copy skb for %s\n",
5216 sdata->name);
5217 return true;
5218 }
5219
5220 /* skb_copy() does not copy the hw timestamps, so copy it
5221 * explicitly
5222 */
5223 shwt = skb_hwtstamps(rx->skb);
5224 shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
5225
5226 /* Update the hdr pointer to the new skb for translation below */
5227 hdr = (struct ieee80211_hdr *)rx->skb->data;
5228 }
5229
5230 if (ieee80211_is_s1g_beacon(hdr->frame_control)) {
5231 ieee80211_invoke_rx_handlers(rx);
5232 return true;
5233 }
5234
5235 /* Store a copy of the pre-translated link addresses for SW crypto */
5236 if (unlikely(is_unicast_ether_addr(hdr->addr1) &&
5237 !ieee80211_is_data(hdr->frame_control)))
5238 memcpy(rx->link_addrs, &hdr->addrs, 3 * ETH_ALEN);
5239
5240 if (unlikely(rx->sta && rx->sta->sta.mlo) &&
5241 is_unicast_ether_addr(hdr->addr1) &&
5242 !ieee80211_is_probe_resp(hdr->frame_control) &&
5243 !ieee80211_is_beacon(hdr->frame_control)) {
5244 /* translate to MLD addresses */
5245 if (ether_addr_equal(link->conf->addr, hdr->addr1))
5246 ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
5247 if (ether_addr_equal(link_sta->addr, hdr->addr2))
5248 ether_addr_copy(hdr->addr2, rx->sta->addr);
5249 /* translate A3 only if it's the BSSID */
5250 if (!ieee80211_has_tods(hdr->frame_control) &&
5251 !ieee80211_has_fromds(hdr->frame_control)) {
5252 if (ether_addr_equal(link_sta->addr, hdr->addr3))
5253 ether_addr_copy(hdr->addr3, rx->sta->addr);
5254 else if (ether_addr_equal(link->conf->addr, hdr->addr3))
5255 ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);
5256 }
5257 /* not needed for A4 since it can only carry the SA */
5258 }
5259
5260 ieee80211_invoke_rx_handlers(rx);
5261 return true;
5262}
5263
5264static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
5265 struct ieee80211_sta *pubsta,
5266 struct sk_buff *skb,
5267 struct list_head *list)
5268{
5269 struct ieee80211_local *local = hw_to_local(hw);
5270 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5271 struct ieee80211_fast_rx *fast_rx;
5272 struct ieee80211_rx_data rx;
5273 struct sta_info *sta;
5274 int link_id = -1;
5275
5276 memset(&rx, 0, sizeof(rx));
5277 rx.skb = skb;
5278 rx.local = local;
5279 rx.list = list;
5280 rx.link_id = -1;
5281
5282 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5283
5284 /* drop frame if too short for header */
5285 if (skb->len < sizeof(struct ethhdr))
5286 goto drop;
5287
5288 if (!pubsta)
5289 goto drop;
5290
5291 if (status->link_valid)
5292 link_id = status->link_id;
5293
5294 /*
5295 * TODO: Should the frame be dropped if the right link_id is not
5296 * available? Or may be it is fine in the current form to proceed with
5297 * the frame processing because with frame being in 802.3 format,
5298 * link_id is used only for stats purpose and updating the stats on
5299 * the deflink is fine?
5300 */
5301 sta = container_of(pubsta, struct sta_info, sta);
5302 if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5303 goto drop;
5304
5305 fast_rx = rcu_dereference(rx.sta->fast_rx);
5306 if (!fast_rx)
5307 goto drop;
5308
5309 ieee80211_rx_8023(&rx, fast_rx, skb->len);
5310 return;
5311
5312drop:
5313 dev_kfree_skb(skb);
5314}
5315
5316static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
5317 struct sk_buff *skb, bool consume)
5318{
5319 struct link_sta_info *link_sta;
5320 struct ieee80211_hdr *hdr = (void *)skb->data;
5321 struct sta_info *sta;
5322 int link_id = -1;
5323
5324 if (ieee80211_is_s1g_beacon(hdr->frame_control)) {
5325 if (!ieee80211_rx_data_set_sta(rx, NULL, -1))
5326 return false;
5327
5328 return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5329 }
5330
5331 /*
5332 * Look up link station first, in case there's a
5333 * chance that they might have a link address that
5334 * is identical to the MLD address, that way we'll
5335 * have the link information if needed.
5336 */
5337 link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
5338 if (link_sta) {
5339 sta = link_sta->sta;
5340 link_id = link_sta->link_id;
5341 } else {
5342 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5343
5344 sta = sta_info_get_bss(rx->sdata, hdr->addr2);
5345 if (status->link_valid) {
5346 link_id = status->link_id;
5347 } else if (ieee80211_vif_is_mld(&rx->sdata->vif) &&
5348 status->freq) {
5349 struct ieee80211_link_data *link;
5350 struct ieee80211_chanctx_conf *conf;
5351
5352 for_each_link_data_rcu(rx->sdata, link) {
5353 conf = rcu_dereference(link->conf->chanctx_conf);
5354 if (!conf || !conf->def.chan)
5355 continue;
5356
5357 if (status->freq == conf->def.chan->center_freq) {
5358 link_id = link->link_id;
5359 break;
5360 }
5361 }
5362 }
5363 }
5364
5365 if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
5366 return false;
5367
5368 return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5369}
5370
5371/*
5372 * This is the actual Rx frames handler. as it belongs to Rx path it must
5373 * be called with rcu_read_lock protection.
5374 */
5375static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
5376 struct ieee80211_sta *pubsta,
5377 struct sk_buff *skb,
5378 struct list_head *list)
5379{
5380 struct ieee80211_local *local = hw_to_local(hw);
5381 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5382 struct ieee80211_sub_if_data *sdata;
5383 struct ieee80211_hdr *hdr;
5384 __le16 fc;
5385 struct ieee80211_rx_data rx;
5386 struct ieee80211_sub_if_data *prev;
5387 struct rhlist_head *tmp;
5388 int err = 0;
5389
5390 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
5391 memset(&rx, 0, sizeof(rx));
5392 rx.skb = skb;
5393 rx.local = local;
5394 rx.list = list;
5395 rx.link_id = -1;
5396
5397 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
5398 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5399
5400 if (ieee80211_is_mgmt(fc)) {
5401 /* drop frame if too short for header */
5402 if (skb->len < ieee80211_hdrlen(fc))
5403 err = -ENOBUFS;
5404 else
5405 err = skb_linearize(skb);
5406 } else if (ieee80211_is_s1g_beacon(fc)) {
5407 size_t s1g_hdr_len = offsetof(struct ieee80211_ext,
5408 u.s1g_beacon.variable) +
5409 ieee80211_s1g_optional_len(fc);
5410
5411 if (skb->len < s1g_hdr_len)
5412 err = -ENOBUFS;
5413 else
5414 err = skb_linearize(skb);
5415 } else if (ieee80211_is_ext(fc)) {
5416 err = -EINVAL;
5417 } else {
5418 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
5419 }
5420
5421 if (err) {
5422 dev_kfree_skb(skb);
5423 return;
5424 }
5425
5426 hdr = (struct ieee80211_hdr *)skb->data;
5427 ieee80211_parse_qos(&rx);
5428 ieee80211_verify_alignment(&rx);
5429
5430 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
5431 ieee80211_is_beacon(hdr->frame_control) ||
5432 ieee80211_is_s1g_beacon(hdr->frame_control)))
5433 ieee80211_scan_rx(local, skb);
5434
5435 if (ieee80211_is_data(fc)) {
5436 struct sta_info *sta, *prev_sta;
5437 int link_id = -1;
5438
5439 if (status->link_valid)
5440 link_id = status->link_id;
5441
5442 if (pubsta) {
5443 sta = container_of(pubsta, struct sta_info, sta);
5444 if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5445 goto out;
5446
5447 /*
5448 * In MLO connection, fetch the link_id using addr2
5449 * when the driver does not pass link_id in status.
5450 * When the address translation is already performed by
5451 * driver/hw, the valid link_id must be passed in
5452 * status.
5453 */
5454
5455 if (!status->link_valid && pubsta->mlo) {
5456 struct link_sta_info *link_sta;
5457
5458 link_sta = link_sta_info_get_bss(rx.sdata,
5459 hdr->addr2);
5460 if (!link_sta)
5461 goto out;
5462
5463 if (!ieee80211_rx_data_set_link(&rx,
5464 link_sta->link_id))
5465 goto out;
5466 }
5467
5468 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5469 return;
5470 goto out;
5471 }
5472
5473 prev_sta = NULL;
5474
5475 for_each_sta_info(local, hdr->addr2, sta, tmp) {
5476 if (!prev_sta) {
5477 prev_sta = sta;
5478 continue;
5479 }
5480
5481 rx.sdata = prev_sta->sdata;
5482 if (!status->link_valid && prev_sta->sta.mlo) {
5483 struct link_sta_info *link_sta;
5484
5485 link_sta = link_sta_info_get_bss(rx.sdata,
5486 hdr->addr2);
5487 if (!link_sta)
5488 continue;
5489
5490 link_id = link_sta->link_id;
5491 }
5492
5493 if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5494 goto out;
5495
5496 ieee80211_prepare_and_rx_handle(&rx, skb, false);
5497
5498 prev_sta = sta;
5499 }
5500
5501 if (prev_sta) {
5502 rx.sdata = prev_sta->sdata;
5503 if (!status->link_valid && prev_sta->sta.mlo) {
5504 struct link_sta_info *link_sta;
5505
5506 link_sta = link_sta_info_get_bss(rx.sdata,
5507 hdr->addr2);
5508 if (!link_sta)
5509 goto out;
5510
5511 link_id = link_sta->link_id;
5512 }
5513
5514 if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5515 goto out;
5516
5517 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5518 return;
5519 goto out;
5520 }
5521 }
5522
5523 prev = NULL;
5524
5525 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
5526 if (!ieee80211_sdata_running(sdata))
5527 continue;
5528
5529 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
5530 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
5531 continue;
5532
5533 /*
5534 * frame is destined for this interface, but if it's
5535 * not also for the previous one we handle that after
5536 * the loop to avoid copying the SKB once too much
5537 */
5538
5539 if (!prev) {
5540 prev = sdata;
5541 continue;
5542 }
5543
5544 rx.sdata = prev;
5545 ieee80211_rx_for_interface(&rx, skb, false);
5546
5547 prev = sdata;
5548 }
5549
5550 if (prev) {
5551 rx.sdata = prev;
5552
5553 if (ieee80211_rx_for_interface(&rx, skb, true))
5554 return;
5555 }
5556
5557 out:
5558 dev_kfree_skb(skb);
5559}
5560
5561/*
5562 * This is the receive path handler. It is called by a low level driver when an
5563 * 802.11 MPDU is received from the hardware.
5564 */
5565void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5566 struct sk_buff *skb, struct list_head *list)
5567{
5568 struct ieee80211_local *local = hw_to_local(hw);
5569 struct ieee80211_rate *rate = NULL;
5570 struct ieee80211_supported_band *sband;
5571 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5572 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
5573
5574 WARN_ON_ONCE(softirq_count() == 0);
5575
5576 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
5577 goto drop;
5578
5579 sband = local->hw.wiphy->bands[status->band];
5580 if (WARN_ON(!sband))
5581 goto drop;
5582
5583 /*
5584 * If we're suspending, it is possible although not too likely
5585 * that we'd be receiving frames after having already partially
5586 * quiesced the stack. We can't process such frames then since
5587 * that might, for example, cause stations to be added or other
5588 * driver callbacks be invoked.
5589 */
5590 if (unlikely(local->quiescing || local->suspended))
5591 goto drop;
5592
5593 /* We might be during a HW reconfig, prevent Rx for the same reason */
5594 if (unlikely(local->in_reconfig))
5595 goto drop;
5596
5597 /*
5598 * The same happens when we're not even started,
5599 * but that's worth a warning.
5600 */
5601 if (WARN_ON(!local->started))
5602 goto drop;
5603
5604 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC) &&
5605 !(status->flag & RX_FLAG_NO_PSDU &&
5606 status->zero_length_psdu_type ==
5607 IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED))) {
5608 /*
5609 * Validate the rate, unless there was a PLCP error which may
5610 * have an invalid rate or the PSDU was not capture and may be
5611 * missing rate information.
5612 */
5613
5614 switch (status->encoding) {
5615 case RX_ENC_HT:
5616 /*
5617 * rate_idx is MCS index, which can be [0-76]
5618 * as documented on:
5619 *
5620 * https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
5621 *
5622 * Anything else would be some sort of driver or
5623 * hardware error. The driver should catch hardware
5624 * errors.
5625 */
5626 if (WARN(status->rate_idx > 76,
5627 "Rate marked as an HT rate but passed "
5628 "status->rate_idx is not "
5629 "an MCS index [0-76]: %d (0x%02x)\n",
5630 status->rate_idx,
5631 status->rate_idx))
5632 goto drop;
5633 break;
5634 case RX_ENC_VHT:
5635 if (WARN_ONCE(status->rate_idx > 11 ||
5636 !status->nss ||
5637 status->nss > 8,
5638 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
5639 status->rate_idx, status->nss))
5640 goto drop;
5641 break;
5642 case RX_ENC_HE:
5643 if (WARN_ONCE(status->rate_idx > 11 ||
5644 !status->nss ||
5645 status->nss > 8,
5646 "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5647 status->rate_idx, status->nss))
5648 goto drop;
5649 break;
5650 case RX_ENC_EHT:
5651 if (WARN_ONCE(status->rate_idx > 15 ||
5652 !status->nss ||
5653 status->nss > 8 ||
5654 status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5655 "Rate marked as an EHT rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5656 status->rate_idx, status->nss, status->eht.gi))
5657 goto drop;
5658 break;
5659 case RX_ENC_UHR:
5660 if (WARN_ONCE(!(status->rate_idx <= 15 ||
5661 status->rate_idx == 17 ||
5662 status->rate_idx == 19 ||
5663 status->rate_idx == 20 ||
5664 status->rate_idx == 23) ||
5665 !status->nss ||
5666 status->nss > 8 ||
5667 status->uhr.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5668 "Rate marked as a UHR rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5669 status->rate_idx, status->nss, status->uhr.gi))
5670 goto drop;
5671 if (WARN_ONCE(status->uhr.elr &&
5672 (status->nss != 1 || status->rate_idx > 1 ||
5673 status->uhr.gi != NL80211_RATE_INFO_EHT_GI_1_6 ||
5674 status->bw != RATE_INFO_BW_20 || status->uhr.im),
5675 "bad UHR ELR MCS MCS:%d, NSS:%d, GI:%d, BW:%d, IM:%d\n",
5676 status->rate_idx, status->nss, status->uhr.gi,
5677 status->bw, status->uhr.im))
5678 goto drop;
5679 if (WARN_ONCE(status->uhr.im &&
5680 (status->nss != 1 || status->rate_idx == 15),
5681 "bad UHR IM MCS MCS:%d, NSS:%d\n",
5682 status->rate_idx, status->nss))
5683 goto drop;
5684 break;
5685 case RX_ENC_S1G:
5686 if (WARN_ONCE(status->rate_idx > 12 ||
5687 !status->nss ||
5688 status->nss > 4,
5689 "Rate marked as an S1G rate but data is invalid: MCS: %d, NSS: %d\n",
5690 status->rate_idx, status->nss))
5691 goto drop;
5692 break;
5693 default:
5694 WARN_ON_ONCE(1);
5695 fallthrough;
5696 case RX_ENC_LEGACY:
5697 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
5698 goto drop;
5699 rate = &sband->bitrates[status->rate_idx];
5700 }
5701 }
5702
5703 if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
5704 goto drop;
5705
5706 status->rx_flags = 0;
5707
5708 kcov_remote_start_common(skb_get_kcov_handle(skb));
5709
5710 /*
5711 * Frames with failed FCS/PLCP checksum are not returned,
5712 * all other frames are returned without radiotap header
5713 * if it was previously present.
5714 * Also, frames with less than 16 bytes are dropped.
5715 */
5716 if (!(status->flag & RX_FLAG_8023))
5717 skb = ieee80211_rx_monitor(local, skb, rate);
5718 if (skb) {
5719 if ((status->flag & RX_FLAG_8023) ||
5720 ieee80211_is_data_present(hdr->frame_control))
5721 ieee80211_tpt_led_trig_rx(local, skb->len);
5722
5723 if (status->flag & RX_FLAG_8023)
5724 __ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5725 else
5726 __ieee80211_rx_handle_packet(hw, pubsta, skb, list);
5727 }
5728
5729 kcov_remote_stop();
5730 return;
5731 drop:
5732 kfree_skb(skb);
5733}
5734EXPORT_SYMBOL(ieee80211_rx_list);
5735
5736void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5737 struct sk_buff *skb, struct napi_struct *napi)
5738{
5739 struct sk_buff *tmp;
5740 LIST_HEAD(list);
5741
5742
5743 /*
5744 * key references and virtual interfaces are protected using RCU
5745 * and this requires that we are in a read-side RCU section during
5746 * receive processing
5747 */
5748 rcu_read_lock();
5749 ieee80211_rx_list(hw, pubsta, skb, &list);
5750 rcu_read_unlock();
5751
5752 if (!napi) {
5753 netif_receive_skb_list(&list);
5754 return;
5755 }
5756
5757 list_for_each_entry_safe(skb, tmp, &list, list) {
5758 skb_list_del_init(skb);
5759 napi_gro_receive(napi, skb);
5760 }
5761}
5762EXPORT_SYMBOL(ieee80211_rx_napi);
5763
5764/* This is a version of the rx handler that can be called from hard irq
5765 * context. Post the skb on the queue and schedule the tasklet */
5766void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
5767{
5768 struct ieee80211_local *local = hw_to_local(hw);
5769
5770 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5771
5772 skb->pkt_type = IEEE80211_RX_MSG;
5773 skb_queue_tail(&local->skb_queue, skb);
5774 tasklet_schedule(&local->tasklet);
5775}
5776EXPORT_SYMBOL(ieee80211_rx_irqsafe);