iwlwifi: mvm: always tell the firmware to accept MCAST frames in BSS

Make the firmware's life easier and always accept MCAST frames. If
needed, drop them in the driver. We need to filter out MCAST frames
in order not to have false positives in the decryption check. If we
accept MCAST frames before we have the GKT installed, we'll end up
complaining that we can't decrypt the frame.
Implement the same filtering, but in the driver.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20220517120045.479956a46317.I21fac7ede9eca85a662671d694872898df884f0b@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
index e7f18f549ca9bded54a45c3f44c43fc70cc9ef41..56fa20596f1680a14cbab41153089bdf9316c73a 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
@@ -552,6 +552,12 @@ static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
        /* Fill the common data for all mac context types */
        iwl_mvm_mac_ctxt_cmd_common(mvm, vif, &cmd, bssid_override, action);
 
+       /*
+        * We always want to hear MCAST frames, if we're not authorized yet,
+        * we'll drop them.
+        */
+       cmd.filter_flags |= cpu_to_le32(MAC_FILTER_ACCEPT_GRP);
+
        if (vif->p2p) {
                struct ieee80211_p2p_noa_attr *noa =
                        &vif->bss_conf.p2p_noa_attr;
@@ -608,13 +614,6 @@ static int iwl_mvm_mac_ctxt_cmd_sta(struct iwl_mvm *mvm,
                                IWL_UCODE_TLV_CAPA_COEX_HIGH_PRIO))
                        ctxt_sta->data_policy |=
                                cpu_to_le32(COEX_HIGH_PRIORITY_ENABLE);
-
-               /*
-                * allow multicast data frames only as long as the station is
-                * authorized, i.e., GTK keys are already installed (if needed)
-                */
-               if (mvmvif->authorized)
-                       cmd.filter_flags |= cpu_to_le32(MAC_FILTER_ACCEPT_GRP);
        } else {
                ctxt_sta->is_assoc = cpu_to_le32(0);
 

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 78198da7e55b447995cee0c511a91b45b7d73b6c..49ca1e168fc5bc10d50c2360921e88f0f5ace07b 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2012-2014, 2018-2021 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2022 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -326,17 +326,6 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
 
        rx_status = IEEE80211_SKB_RXCB(skb);
 
-       /*
-        * drop the packet if it has failed being decrypted by HW
-        */
-       if (iwl_mvm_set_mac80211_rx_flag(mvm, hdr, rx_status, rx_pkt_status,
-                                        &crypt_len)) {
-               IWL_DEBUG_DROP(mvm, "Bad decryption results 0x%08x\n",
-                              rx_pkt_status);
-               kfree_skb(skb);
-               return;
-       }
-
        /*
         * Keep packets with CRC errors (and with overrun) for monitor mode
         * (otherwise the firmware discards them) but mark them as bad.
@@ -386,6 +375,37 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
                sta = ieee80211_find_sta_by_ifaddr(mvm->hw, hdr->addr2, NULL);
        }
 
+       if (sta) {
+               struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+               struct ieee80211_vif *vif = mvmsta->vif;
+               struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+               /*
+                * Don't even try to decrypt a MCAST frame that was received
+                * before the managed vif is authorized, we'd fail anyway.
+                */
+               if (vif->type == NL80211_IFTYPE_STATION &&
+                   !mvmvif->authorized &&
+                   is_multicast_ether_addr(hdr->addr1)) {
+                       IWL_DEBUG_DROP(mvm, "MCAST before the vif is authorized\n");
+                       kfree_skb(skb);
+                       rcu_read_unlock();
+                       return;
+               }
+       }
+
+       /*
+        * drop the packet if it has failed being decrypted by HW
+        */
+       if (iwl_mvm_set_mac80211_rx_flag(mvm, hdr, rx_status, rx_pkt_status,
+                                        &crypt_len)) {
+               IWL_DEBUG_DROP(mvm, "Bad decryption results 0x%08x\n",
+                              rx_pkt_status);
+               kfree_skb(skb);
+               rcu_read_unlock();
+               return;
+       }
+
        if (sta) {
                struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
                struct ieee80211_vif *tx_blocked_vif =