rx.c 116 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6
 * Copyright 2013-2014  Intel Mobile Communications GmbH
7
 * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
8 9 10 11 12 13
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

14
#include <linux/jiffies.h>
15
#include <linux/slab.h>
16 17 18 19
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
20
#include <linux/rcupdate.h>
21
#include <linux/export.h>
22
#include <linux/bitops.h>
23 24
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
25
#include <asm/unaligned.h>
26 27

#include "ieee80211_i.h"
28
#include "driver-ops.h"
Johannes Berg's avatar
Johannes Berg committed
29
#include "led.h"
30
#include "mesh.h"
31 32 33 34
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"
35
#include "rate.h"
36

37 38 39 40 41 42 43 44 45 46
static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
{
	struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);

	u64_stats_update_begin(&tstats->syncp);
	tstats->rx_packets++;
	tstats->rx_bytes += len;
	u64_stats_update_end(&tstats->syncp);
}

47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91
static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
			       enum nl80211_iftype type)
{
	__le16 fc = hdr->frame_control;

	if (ieee80211_is_data(fc)) {
		if (len < 24) /* drop incorrect hdr len (data) */
			return NULL;

		if (ieee80211_has_a4(fc))
			return NULL;
		if (ieee80211_has_tods(fc))
			return hdr->addr1;
		if (ieee80211_has_fromds(fc))
			return hdr->addr2;

		return hdr->addr3;
	}

	if (ieee80211_is_mgmt(fc)) {
		if (len < 24) /* drop incorrect hdr len (mgmt) */
			return NULL;
		return hdr->addr3;
	}

	if (ieee80211_is_ctl(fc)) {
		if (ieee80211_is_pspoll(fc))
			return hdr->addr1;

		if (ieee80211_is_back_req(fc)) {
			switch (type) {
			case NL80211_IFTYPE_STATION:
				return hdr->addr2;
			case NL80211_IFTYPE_AP:
			case NL80211_IFTYPE_AP_VLAN:
				return hdr->addr1;
			default:
				break; /* fall through to the return */
			}
		}
	}

	return NULL;
}

92 93 94 95 96 97 98
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
99 100
					   struct sk_buff *skb,
					   unsigned int rtap_vendor_space)
101
{
102
	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
103
		if (likely(skb->len > FCS_LEN))
Zhu Yi's avatar
Zhu Yi committed
104
			__pskb_trim(skb, skb->len - FCS_LEN);
105 106 107 108
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
109
			return NULL;
110 111 112
		}
	}

113 114
	__pskb_pull(skb, rtap_vendor_space);

115 116 117
	return skb;
}

118 119
static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
				     unsigned int rtap_vendor_space)
120
{
121
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
122 123 124
	struct ieee80211_hdr *hdr;

	hdr = (void *)(skb->data + rtap_vendor_space);
125

126
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
127 128
			    RX_FLAG_FAILED_PLCP_CRC |
			    RX_FLAG_ONLY_MONITOR))
129 130
		return true;

131
	if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
132 133
		return true;

134 135 136
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
137 138 139
		return true;

	return false;
140 141
}

142
static int
143 144 145
ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
			     struct ieee80211_rx_status *status,
			     struct sk_buff *skb)
146 147 148 149
{
	int len;

	/* always present fields */
150
	len = sizeof(struct ieee80211_radiotap_header) + 8;
151

152 153 154
	/* allocate extra bitmaps */
	if (status->chains)
		len += 4 * hweight8(status->chains);
155 156 157

	if (ieee80211_have_rx_timestamp(status)) {
		len = ALIGN(len, 8);
158
		len += 8;
159
	}
160
	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
161 162
		len += 1;

163 164 165 166
	/* antenna field, if we don't have per-chain info */
	if (!status->chains)
		len += 1;

167 168
	/* padding for RX_FLAGS if necessary */
	len = ALIGN(len, 2);
169

170 171 172
	if (status->flag & RX_FLAG_HT) /* HT info */
		len += 3;

173
	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
174
		len = ALIGN(len, 4);
175 176 177
		len += 8;
	}

178 179 180 181 182
	if (status->flag & RX_FLAG_VHT) {
		len = ALIGN(len, 2);
		len += 12;
	}

183 184 185 186 187
	if (status->chains) {
		/* antenna and antenna signal fields */
		len += 2 * hweight8(status->chains);
	}

188 189 190 191 192 193 194 195 196 197 198 199 200 201 202
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;

		/* vendor presence bitmap */
		len += 4;
		/* alignment for fixed 6-byte vendor data header */
		len = ALIGN(len, 2);
		/* vendor data header */
		len += 6;
		if (WARN_ON(rtap->align == 0))
			rtap->align = 1;
		len = ALIGN(len, rtap->align);
		len += rtap->len + rtap->pad;
	}

203 204 205
	return len;
}

206
/*
207 208 209 210 211 212 213 214
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
215
				 int rtap_len, bool has_fcs)
216
{
217
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
218 219
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
220 221
	__le32 *it_present;
	u32 it_present_val;
222
	u16 rx_flags = 0;
223
	u16 channel_flags = 0;
224 225
	int mpdulen, chain;
	unsigned long chains = status->chains;
226 227 228 229 230 231 232
	struct ieee80211_vendor_radiotap rtap = {};

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
		/* rtap.len and rtap.pad are undone immediately */
		skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
	}
233 234

	mpdulen = skb->len;
235
	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
236
		mpdulen += FCS_LEN;
237 238

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
239
	memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
240
	it_present = &rthdr->it_present;
241 242

	/* radiotap header, set always present flags */
243
	rthdr->it_len = cpu_to_le16(rtap_len);
244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259
	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);

	if (!status->chains)
		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);

	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		it_present_val |=
			BIT(IEEE80211_RADIOTAP_EXT) |
			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
	}
260

261 262 263 264 265 266 267 268
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
				  BIT(IEEE80211_RADIOTAP_EXT);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = rtap.present;
	}

269 270 271 272
	put_unaligned_le32(it_present_val, it_present);

	pos = (void *)(it_present + 1);

273 274 275
	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
276
	if (ieee80211_have_rx_timestamp(status)) {
277 278 279
		/* padding */
		while ((pos - (u8 *)rthdr) & 7)
			*pos++ = 0;
280 281 282 283
		put_unaligned_le64(
			ieee80211_calculate_rx_timestamp(local, status,
							 mpdulen, 0),
			pos);
284
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
285 286 287 288
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
289
	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
290
		*pos |= IEEE80211_RADIOTAP_F_FCS;
Johannes Berg's avatar
Johannes Berg committed
291 292
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
293 294
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
295 296 297
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
298
	if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
299
		/*
300
		 * Without rate information don't add it. If we have,
301
		 * MCS information is a separate field in radiotap,
302 303
		 * added below. The byte here is needed as padding
		 * for the channel though, so initialise it to 0.
304 305
		 */
		*pos = 0;
306
	} else {
307
		int shift = 0;
308
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
309 310 311 312 313
		if (status->flag & RX_FLAG_10MHZ)
			shift = 1;
		else if (status->flag & RX_FLAG_5MHZ)
			shift = 2;
		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
314
	}
315 316 317
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
318
	put_unaligned_le16(status->freq, pos);
319
	pos += 2;
320 321 322 323 324
	if (status->flag & RX_FLAG_10MHZ)
		channel_flags |= IEEE80211_CHAN_HALF;
	else if (status->flag & RX_FLAG_5MHZ)
		channel_flags |= IEEE80211_CHAN_QUARTER;

325
	if (status->band == NL80211_BAND_5GHZ)
326
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
327
	else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
328
		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
329
	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
330
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
331
	else if (rate)
332
		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
333
	else
334 335
		channel_flags |= IEEE80211_CHAN_2GHZ;
	put_unaligned_le16(channel_flags, pos);
336 337 338
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
339
	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
340
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
341 342 343 344 345 346 347 348
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

349 350 351 352 353
	if (!status->chains) {
		/* IEEE80211_RADIOTAP_ANTENNA */
		*pos = status->antenna;
		pos++;
	}
354 355 356 357 358

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
359
	if ((pos - (u8 *)rthdr) & 1)
360
		*pos++ = 0;
Johannes Berg's avatar
Johannes Berg committed
361
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
362 363
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
364
	pos += 2;
365 366

	if (status->flag & RX_FLAG_HT) {
367 368
		unsigned int stbc;

369
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
370
		*pos++ = local->hw.radiotap_mcs_details;
371 372 373 374 375
		*pos = 0;
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
		if (status->flag & RX_FLAG_40MHZ)
			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
376 377
		if (status->flag & RX_FLAG_HT_GF)
			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
378 379
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
380 381
		stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
382 383 384
		pos++;
		*pos++ = status->rate_idx;
	}
385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411

	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
		u16 flags = 0;

		/* ensure 4 byte alignment */
		while ((pos - (u8 *)rthdr) & 3)
			pos++;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
		put_unaligned_le32(status->ampdu_reference, pos);
		pos += 4;
		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
		put_unaligned_le16(flags, pos);
		pos += 2;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			*pos++ = status->ampdu_delimiter_crc;
		else
			*pos++ = 0;
		*pos++ = 0;
	}
412

413 414 415 416 417 418 419 420 421
	if (status->flag & RX_FLAG_VHT) {
		u16 known = local->hw.radiotap_vht_details;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
		put_unaligned_le16(known, pos);
		pos += 2;
		/* flags */
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
422 423 424
		/* in VHT, STBC is binary */
		if (status->flag & RX_FLAG_STBC_MASK)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
425 426
		if (status->vht_flag & RX_VHT_FLAG_BF)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
427 428
		pos++;
		/* bandwidth */
429
		if (status->vht_flag & RX_VHT_FLAG_80MHZ)
430
			*pos++ = 4;
431
		else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
432 433 434 435 436 437 438 439 440
			*pos++ = 11;
		else if (status->flag & RX_FLAG_40MHZ)
			*pos++ = 1;
		else /* 20 MHz */
			*pos++ = 0;
		/* MCS/NSS */
		*pos = (status->rate_idx << 4) | status->vht_nss;
		pos += 4;
		/* coding field */
441 442
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
443 444 445 446 447 448 449
		pos++;
		/* group ID */
		pos++;
		/* partial_aid */
		pos += 2;
	}

450 451 452 453
	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		*pos++ = status->chain_signal[chain];
		*pos++ = chain;
	}
454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		/* ensure 2 byte alignment for the vendor field as required */
		if ((pos - (u8 *)rthdr) & 1)
			*pos++ = 0;
		*pos++ = rtap.oui[0];
		*pos++ = rtap.oui[1];
		*pos++ = rtap.oui[2];
		*pos++ = rtap.subns;
		put_unaligned_le16(rtap.len, pos);
		pos += 2;
		/* align the actual payload as requested */
		while ((pos - (u8 *)rthdr) & (rtap.align - 1))
			*pos++ = 0;
		/* data (and possible padding) already follows */
	}
470 471
}

472 473 474 475 476 477 478
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
479
		     struct ieee80211_rate *rate)
480
{
481
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
482
	struct ieee80211_sub_if_data *sdata;
483
	int rt_hdrlen, needed_headroom;
484 485 486
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;
487 488 489 490 491 492 493
	unsigned int rtap_vendor_space = 0;

	if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
		struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;

		rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
	}
494 495 496 497 498 499 500 501 502

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
503

504
	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
505 506
		present_fcs_len = FCS_LEN;

507 508
	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
	if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
Zhu Yi's avatar
Zhu Yi committed
509 510 511 512
		dev_kfree_skb(origskb);
		return NULL;
	}

513
	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
514 515
		if (should_drop_frame(origskb, present_fcs_len,
				      rtap_vendor_space)) {
516 517 518 519
			dev_kfree_skb(origskb);
			return NULL;
		}

520
		return remove_monitor_info(local, origskb, rtap_vendor_space);
521 522
	}

523
	/* room for the radiotap header based on driver features */
524 525
	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
	needed_headroom = rt_hdrlen - rtap_vendor_space;
526

527
	if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
528 529 530 531 532 533 534 535 536 537 538 539
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
540
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
541 542 543 544 545 546 547 548 549 550
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

551 552
		origskb = remove_monitor_info(local, origskb,
					      rtap_vendor_space);
553 554 555 556 557

		if (!skb)
			return origskb;
	}

558
	/* prepend radiotap information */
559
	ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
560

561
	skb_reset_mac_header(skb);
562 563 564 565 566
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
567
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
568 569
			continue;

570 571 572
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

573
		if (!ieee80211_sdata_running(sdata))
574 575
			continue;

576 577 578 579
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
580
				netif_receive_skb(skb2);
581 582 583 584
			}
		}

		prev_dev = sdata->dev;
585
		ieee80211_rx_stats(sdata->dev, skb->len);
586 587 588 589
	}

	if (prev_dev) {
		skb->dev = prev_dev;
590
		netif_receive_skb(skb);
591 592 593 594 595 596
	} else
		dev_kfree_skb(skb);

	return origskb;
}

597
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
598
{
599
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
600
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
601
	int tid, seqno_idx, security_idx;
602 603

	/* does the frame have a qos control field? */
604 605
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
606
		/* frame has qos control */
607
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
608
		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
609
			status->rx_flags |= IEEE80211_RX_AMSDU;
610 611 612

		seqno_idx = tid;
		security_idx = tid;
613
	} else {
614 615 616 617 618 619 620 621 622 623 624
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
625
		seqno_idx = IEEE80211_NUM_TIDS;
626 627
		security_idx = 0;
		if (ieee80211_is_mgmt(hdr->frame_control))
628
			security_idx = IEEE80211_NUM_TIDS;
629
		tid = 0;
630
	}
631

632 633
	rx->seqno_idx = seqno_idx;
	rx->security_idx = security_idx;
634 635 636
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
637
}
638

639 640 641 642 643 644 645 646 647 648 649
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
650 651 652
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
653 654 655 656 657 658 659
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
Lucas De Marchi's avatar
Lucas De Marchi committed
660
 * Padding like Atheros hardware adds which is between the 802.11 header and
661 662 663 664
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
665
{
666
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
667
	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
668
#endif
669 670
}

671

672 673
/* rx handlers */

674 675 676 677
static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

678
	if (is_multicast_ether_addr(hdr->addr1))
679 680
		return 0;

681
	return ieee80211_is_robust_mgmt_frame(skb);
682 683 684 685 686 687 688
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

689
	if (!is_multicast_ether_addr(hdr->addr1))
690 691
		return 0;

692
	return ieee80211_is_robust_mgmt_frame(skb);
693 694 695 696 697 698 699 700
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;
701
	struct ieee80211_mmie_16 *mmie16;
702

703
	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
704 705
		return -1;

706
	if (!ieee80211_is_robust_mgmt_frame(skb))
707 708 709 710
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
711 712 713 714 715 716 717 718 719 720 721 722
	if (mmie->element_id == WLAN_EID_MMIE &&
	    mmie->length == sizeof(*mmie) - 2)
		return le16_to_cpu(mmie->key_id);

	mmie16 = (struct ieee80211_mmie_16 *)
		(skb->data + skb->len - sizeof(*mmie16));
	if (skb->len >= 24 + sizeof(*mmie16) &&
	    mmie16->element_id == WLAN_EID_MMIE &&
	    mmie16->length == sizeof(*mmie16) - 2)
		return le16_to_cpu(mmie16->key_id);

	return -1;
723 724
}

725 726
static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
				  struct sk_buff *skb)
727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc;
	int hdrlen;
	u8 keyid;

	fc = hdr->frame_control;
	hdrlen = ieee80211_hdrlen(fc);

	if (skb->len < hdrlen + cs->hdr_len)
		return -EINVAL;

	skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
	keyid &= cs->key_idx_mask;
	keyid >>= cs->key_idx_shift;

	return keyid;
}

746
static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
747
{
748
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
749
	char *dev_addr = rx->sdata->vif.addr;
750

751
	if (ieee80211_is_data(hdr->frame_control)) {
752 753
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
754
			    !ieee80211_has_fromds(hdr->frame_control))
755
				return RX_DROP_MONITOR;
756
			if (ether_addr_equal(hdr->addr3, dev_addr))
757 758 759 760
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
761
			if (ether_addr_equal(hdr->addr4, dev_addr))
762 763
				return RX_DROP_MONITOR;
		}
764 765 766 767 768 769
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

770
	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
771
		struct ieee80211_mgmt *mgmt;
772

773
		if (!ieee80211_is_mgmt(hdr->frame_control))
774 775
			return RX_DROP_MONITOR;

776
		if (ieee80211_is_action(hdr->frame_control)) {
777
			u8 category;
778 779 780 781 782

			/* make sure category field is present */
			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
				return RX_DROP_MONITOR;

783
			mgmt = (struct ieee80211_mgmt *)hdr;
784 785
			category = mgmt->u.action.category;
			if (category != WLAN_CATEGORY_MESH_ACTION &&
786
			    category != WLAN_CATEGORY_SELF_PROTECTED)
787 788 789 790
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

791 792
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
793 794
		    ieee80211_is_beacon(hdr->frame_control) ||
		    ieee80211_is_auth(hdr->frame_control))
795 796 797 798 799
			return RX_CONTINUE;

		return RX_DROP_MONITOR;
	}

Johannes Berg's avatar
Johannes Berg committed
800 801
	return RX_CONTINUE;
}
802

803 804 805 806 807 808 809
static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
					      int index)
{
	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *tail = skb_peek_tail(frames);
	struct ieee80211_rx_status *status;

810 811 812
	if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
		return true;

813 814 815 816 817 818 819 820 821 822
	if (!tail)
		return false;

	status = IEEE80211_SKB_RXCB(tail);
	if (status->flag & RX_FLAG_AMSDU_MORE)
		return false;

	return true;
}

823
static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
824
					    struct tid_ampdu_rx *tid_agg_rx,
825 826
					    int index,
					    struct sk_buff_head *frames)
827
{
828 829
	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *skb;
830
	struct ieee80211_rx_status *status;
831

832 833
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

834
	if (skb_queue_empty(skb_list))
835 836
		goto no_frame;

837
	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
838 839 840 841 842
		__skb_queue_purge(skb_list);
		goto no_frame;
	}

	/* release frames from the reorder ring buffer */
843
	tid_agg_rx->stored_mpdu_num--;
844 845 846 847 848
	while ((skb = __skb_dequeue(skb_list))) {
		status = IEEE80211_SKB_RXCB(skb);
		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
		__skb_queue_tail(frames, skb);
	}
849 850

no_frame:
851
	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
852
	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
853 854
}

855
static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
856
					     struct tid_ampdu_rx *tid_agg_rx,
857 858
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
859 860 861
{
	int index;

862 863
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

864
	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
865
		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
866 867
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
868 869 870 871 872 873 874 875 876
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
877 878
 *
 * Callers must hold tid_agg_rx->reorder_lock.
879 880 881
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

882
static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
883 884
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
885
{
886
	int index, i, j;
887

888 889
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

890
	/* release the buffer until next missing frame */
891
	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
892
	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
893
	    tid_agg_rx->stored_mpdu_num) {
894 895 896 897 898 899 900
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
901
			if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
902 903 904
				skipped++;
				continue;
			}
905 906
			if (skipped &&
			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
907
					HT_RX_REORDER_BUF_TIMEOUT))
908
				goto set_release_timer;
909

910 911 912 913 914
			/* don't leave incomplete A-MSDUs around */
			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
			     i = (i + 1) % tid_agg_rx->buf_size)
				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);

Johannes Berg's avatar
Johannes Berg committed
915 916
			ht_dbg_ratelimited(sdata,
					   "release an RX reorder frame due to timeout on earlier frames\n");
917 918
			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
							frames);
919 920 921 922 923

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
924 925
				(tid_agg_rx->head_seq_num +
				 skipped) & IEEE80211_SN_MASK;
926 927
			skipped = 0;
		}
928
	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
929 930
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
931
		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
932
	}
933 934

	if (tid_agg_rx->stored_mpdu_num) {
935
		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
936 937 938

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
939
			if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
940 941 942 943 944
				break;
		}

 set_release_timer:

945 946 947 948
		if (!tid_agg_rx->removed)
			mod_timer(&tid_agg_rx->reorder_timer,
				  tid_agg_rx->reorder_time[j] + 1 +
				  HT_RX_REORDER_BUF_TIMEOUT);
949 950 951
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
952 953
}

954 955 956 957 958
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
959
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
960
					     struct tid_ampdu_rx *tid_agg_rx,
961 962
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
963 964
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
965
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
966 967 968 969
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
970
	bool ret = true;
971

972 973
	spin_lock(&tid_agg_rx->reorder_lock);

974 975 976 977 978 979 980 981 982 983
	/*
	 * Offloaded BA sessions have no known starting sequence number so pick
	 * one from first Rxed frame for this tid after BA was started.
	 */
	if (unlikely(tid_agg_rx->auto_seq)) {
		tid_agg_rx->auto_seq = false;
		tid_agg_rx->ssn = mpdu_seq_num;
		tid_agg_rx->head_seq_num = mpdu_seq_num;
	}

984 985 986 987
	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

	/* frame with out of date sequence number */
988
	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
989
		dev_kfree_skb(skb);
990
		goto out;
991 992 993 994 995 996
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
997 998 999
	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = ieee80211_sn_inc(
				ieee80211_sn_sub(mpdu_seq_num, buf_size));
1000
		/* release stored frames up to new head to stack */
1001
		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1002
						 head_seq_num, frames);
1003 1004 1005 1006
	}

	/* Now the new frame is always in the range of the reordering buffer */

1007
	index = mpdu_seq_num % tid_agg_rx->buf_size;
1008 1009

	/* check if we already stored this frame */
1010
	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1011
		dev_kfree_skb(skb);
1012
		goto out;
1013 1014 1015 1016 1017
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
1018 1019
	 * If it is first but there's something stored, we may be able
	 * to release frames after this one.
1020 1021 1022
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
1023 1024 1025
		if (!(status->flag & RX_FLAG_AMSDU_MORE))
			tid_agg_rx->head_seq_num =
				ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1026 1027
		ret = false;
		goto out;
1028 1029 1030
	}

	/* put the frame in the reordering buffer */
1031 1032 1033 1034 1035 1036
	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
		tid_agg_rx->reorder_time[index] = jiffies;
		tid_agg_rx->stored_mpdu_num++;
		ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
	}