rtl8187: Fix crash on unload when using SLUB debug
[linux-2.6-block.git] / net / mac80211 / rx.c
CommitLineData
571ecf67
JB
1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
ab46623e 12#include <linux/jiffies.h>
571ecf67
JB
13#include <linux/kernel.h>
14#include <linux/skbuff.h>
15#include <linux/netdevice.h>
16#include <linux/etherdevice.h>
d4e46a3d 17#include <linux/rcupdate.h>
571ecf67
JB
18#include <net/mac80211.h>
19#include <net/ieee80211_radiotap.h>
20
21#include "ieee80211_i.h"
2c8dccc7 22#include "led.h"
33b64eb2 23#include "mesh.h"
571ecf67
JB
24#include "wep.h"
25#include "wpa.h"
26#include "tkip.h"
27#include "wme.h"
28
c6a1fa12
JB
29static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30 struct tid_ampdu_rx *tid_agg_rx,
31 struct sk_buff *skb,
32 u16 mpdu_seq_num,
33 int bar_req);
b2e7771e
JB
34/*
35 * monitor mode reception
36 *
37 * This function cleans up the SKB, i.e. it removes all the stuff
38 * only useful for monitoring.
39 */
40static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
41 struct sk_buff *skb,
42 int rtap_len)
43{
44 skb_pull(skb, rtap_len);
45
46 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
47 if (likely(skb->len > FCS_LEN))
48 skb_trim(skb, skb->len - FCS_LEN);
49 else {
50 /* driver bug */
51 WARN_ON(1);
52 dev_kfree_skb(skb);
53 skb = NULL;
54 }
55 }
56
57 return skb;
58}
59
60static inline int should_drop_frame(struct ieee80211_rx_status *status,
61 struct sk_buff *skb,
62 int present_fcs_len,
63 int radiotap_len)
64{
182503ab 65 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
b2e7771e
JB
66
67 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
68 return 1;
69 if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
70 return 1;
87228f57
HH
71 if (ieee80211_is_ctl(hdr->frame_control) &&
72 !ieee80211_is_pspoll(hdr->frame_control) &&
73 !ieee80211_is_back_req(hdr->frame_control))
b2e7771e
JB
74 return 1;
75 return 0;
76}
77
601ae7f2
BR
78static int
79ieee80211_rx_radiotap_len(struct ieee80211_local *local,
80 struct ieee80211_rx_status *status)
81{
82 int len;
83
84 /* always present fields */
85 len = sizeof(struct ieee80211_radiotap_header) + 9;
86
87 if (status->flag & RX_FLAG_TSFT)
88 len += 8;
89 if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
90 local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
91 len += 1;
92 if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
93 len += 1;
94
95 if (len & 1) /* padding for RX_FLAGS if necessary */
96 len++;
97
98 /* make sure radiotap starts at a naturally aligned address */
99 if (len % 8)
100 len = roundup(len, 8);
101
102 return len;
103}
104
105/**
106 * ieee80211_add_rx_radiotap_header - add radiotap header
107 *
108 * add a radiotap header containing all the fields which the hardware provided.
109 */
110static void
111ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
112 struct sk_buff *skb,
113 struct ieee80211_rx_status *status,
114 struct ieee80211_rate *rate,
115 int rtap_len)
116{
117 struct ieee80211_radiotap_header *rthdr;
118 unsigned char *pos;
119
120 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
121 memset(rthdr, 0, rtap_len);
122
123 /* radiotap header, set always present flags */
124 rthdr->it_present =
125 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
126 (1 << IEEE80211_RADIOTAP_RATE) |
127 (1 << IEEE80211_RADIOTAP_CHANNEL) |
128 (1 << IEEE80211_RADIOTAP_ANTENNA) |
129 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
130 rthdr->it_len = cpu_to_le16(rtap_len);
131
132 pos = (unsigned char *)(rthdr+1);
133
134 /* the order of the following fields is important */
135
136 /* IEEE80211_RADIOTAP_TSFT */
137 if (status->flag & RX_FLAG_TSFT) {
138 *(__le64 *)pos = cpu_to_le64(status->mactime);
139 rthdr->it_present |=
140 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
141 pos += 8;
142 }
143
144 /* IEEE80211_RADIOTAP_FLAGS */
145 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
146 *pos |= IEEE80211_RADIOTAP_F_FCS;
b4f28bbb
BR
147 if (status->flag & RX_FLAG_SHORTPRE)
148 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR
149 pos++;
150
151 /* IEEE80211_RADIOTAP_RATE */
0fb8ca45
JM
152 if (status->flag & RX_FLAG_HT) {
153 /*
154 * TODO: add following information into radiotap header once
155 * suitable fields are defined for it:
156 * - MCS index (status->rate_idx)
157 * - HT40 (status->flag & RX_FLAG_40MHZ)
158 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
159 */
160 *pos = 0;
161 } else
162 *pos = rate->bitrate / 5;
601ae7f2
BR
163 pos++;
164
165 /* IEEE80211_RADIOTAP_CHANNEL */
166 *(__le16 *)pos = cpu_to_le16(status->freq);
167 pos += 2;
168 if (status->band == IEEE80211_BAND_5GHZ)
169 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
170 IEEE80211_CHAN_5GHZ);
9deb1ae5
BR
171 else if (rate->flags & IEEE80211_RATE_ERP_G)
172 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
173 IEEE80211_CHAN_2GHZ);
601ae7f2 174 else
9deb1ae5 175 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
601ae7f2
BR
176 IEEE80211_CHAN_2GHZ);
177 pos += 2;
178
179 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
180 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
181 *pos = status->signal;
182 rthdr->it_present |=
183 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
184 pos++;
185 }
186
187 /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
188 if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
189 *pos = status->noise;
190 rthdr->it_present |=
191 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
192 pos++;
193 }
194
195 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
196
197 /* IEEE80211_RADIOTAP_ANTENNA */
198 *pos = status->antenna;
199 pos++;
200
201 /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
202 if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
203 *pos = status->signal;
204 rthdr->it_present |=
205 cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
206 pos++;
207 }
208
209 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
210
211 /* IEEE80211_RADIOTAP_RX_FLAGS */
212 /* ensure 2 byte alignment for the 2 byte field as required */
213 if ((pos - (unsigned char *)rthdr) & 1)
214 pos++;
215 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
216 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
217 *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
218 pos += 2;
219}
220
b2e7771e
JB
221/*
222 * This function copies a received frame to all monitor interfaces and
223 * returns a cleaned-up SKB that no longer includes the FCS nor the
224 * radiotap header the driver might have added.
225 */
226static struct sk_buff *
227ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a
JB
228 struct ieee80211_rx_status *status,
229 struct ieee80211_rate *rate)
b2e7771e
JB
230{
231 struct ieee80211_sub_if_data *sdata;
b2e7771e 232 int needed_headroom = 0;
b2e7771e
JB
233 struct sk_buff *skb, *skb2;
234 struct net_device *prev_dev = NULL;
235 int present_fcs_len = 0;
236 int rtap_len = 0;
237
238 /*
239 * First, we may need to make a copy of the skb because
240 * (1) we need to modify it for radiotap (if not present), and
241 * (2) the other RX handlers will modify the skb we got.
242 *
243 * We don't need to, of course, if we aren't going to return
244 * the SKB because it has a bad FCS/PLCP checksum.
245 */
246 if (status->flag & RX_FLAG_RADIOTAP)
247 rtap_len = ieee80211_get_radiotap_len(origskb->data);
248 else
601ae7f2
BR
249 /* room for the radiotap header based on driver features */
250 needed_headroom = ieee80211_rx_radiotap_len(local, status);
b2e7771e
JB
251
252 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
253 present_fcs_len = FCS_LEN;
254
255 if (!local->monitors) {
256 if (should_drop_frame(status, origskb, present_fcs_len,
257 rtap_len)) {
258 dev_kfree_skb(origskb);
259 return NULL;
260 }
261
262 return remove_monitor_info(local, origskb, rtap_len);
263 }
264
265 if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
266 /* only need to expand headroom if necessary */
267 skb = origskb;
268 origskb = NULL;
269
270 /*
271 * This shouldn't trigger often because most devices have an
272 * RX header they pull before we get here, and that should
273 * be big enough for our radiotap information. We should
274 * probably export the length to drivers so that we can have
275 * them allocate enough headroom to start with.
276 */
277 if (skb_headroom(skb) < needed_headroom &&
c49e5ea3 278 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
b2e7771e
JB
279 dev_kfree_skb(skb);
280 return NULL;
281 }
282 } else {
283 /*
284 * Need to make a copy and possibly remove radiotap header
285 * and FCS from the original.
286 */
287 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
288
289 origskb = remove_monitor_info(local, origskb, rtap_len);
290
291 if (!skb)
292 return origskb;
293 }
294
295 /* if necessary, prepend radiotap information */
601ae7f2
BR
296 if (!(status->flag & RX_FLAG_RADIOTAP))
297 ieee80211_add_rx_radiotap_header(local, skb, status, rate,
298 needed_headroom);
b2e7771e 299
ce3edf6d 300 skb_reset_mac_header(skb);
b2e7771e
JB
301 skb->ip_summed = CHECKSUM_UNNECESSARY;
302 skb->pkt_type = PACKET_OTHERHOST;
303 skb->protocol = htons(ETH_P_802_2);
304
305 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
306 if (!netif_running(sdata->dev))
307 continue;
308
05c914fe 309 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
b2e7771e
JB
310 continue;
311
3d30d949
MW
312 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
313 continue;
314
b2e7771e
JB
315 if (prev_dev) {
316 skb2 = skb_clone(skb, GFP_ATOMIC);
317 if (skb2) {
318 skb2->dev = prev_dev;
319 netif_rx(skb2);
320 }
321 }
322
323 prev_dev = sdata->dev;
324 sdata->dev->stats.rx_packets++;
325 sdata->dev->stats.rx_bytes += skb->len;
326 }
327
328 if (prev_dev) {
329 skb->dev = prev_dev;
330 netif_rx(skb);
331 } else
332 dev_kfree_skb(skb);
333
334 return origskb;
335}
336
337
5cf121c3 338static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 339{
238f74a2 340 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
6e0d114d
JB
341 int tid;
342
343 /* does the frame have a qos control field? */
238f74a2
HH
344 if (ieee80211_is_data_qos(hdr->frame_control)) {
345 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 346 /* frame has qos control */
238f74a2
HH
347 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
348 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
5cf121c3 349 rx->flags |= IEEE80211_RX_AMSDU;
fd4c7f2f 350 else
5cf121c3 351 rx->flags &= ~IEEE80211_RX_AMSDU;
6e0d114d 352 } else {
1411f9b5
JB
353 /*
354 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
355 *
356 * Sequence numbers for management frames, QoS data
357 * frames with a broadcast/multicast address in the
358 * Address 1 field, and all non-QoS data frames sent
359 * by QoS STAs are assigned using an additional single
360 * modulo-4096 counter, [...]
361 *
362 * We also use that counter for non-QoS STAs.
363 */
364 tid = NUM_RX_DATA_QUEUES - 1;
6e0d114d 365 }
52865dfd 366
5cf121c3 367 rx->queue = tid;
6e0d114d
JB
368 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
369 * For now, set skb->priority to 0 for other cases. */
370 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 371}
6e0d114d 372
5cf121c3 373static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
38f3714d
JB
374{
375#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
a7767f95 376 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
38f3714d
JB
377 int hdrlen;
378
a7767f95 379 if (!ieee80211_is_data_present(hdr->frame_control))
38f3714d
JB
380 return;
381
382 /*
383 * Drivers are required to align the payload data in a way that
384 * guarantees that the contained IP header is aligned to a four-
385 * byte boundary. In the case of regular frames, this simply means
386 * aligning the payload to a four-byte boundary (because either
387 * the IP header is directly contained, or IV/RFC1042 headers that
388 * have a length divisible by four are in front of it.
389 *
390 * With A-MSDU frames, however, the payload data address must
391 * yield two modulo four because there are 14-byte 802.3 headers
392 * within the A-MSDU frames that push the IP header further back
393 * to a multiple of four again. Thankfully, the specs were sane
394 * enough this time around to require padding each A-MSDU subframe
395 * to a length that is a multiple of four.
396 *
397 * Padding like atheros hardware adds which is inbetween the 802.11
398 * header and the payload is not supported, the driver is required
399 * to move the 802.11 header further back in that case.
400 */
a7767f95 401 hdrlen = ieee80211_hdrlen(hdr->frame_control);
5cf121c3 402 if (rx->flags & IEEE80211_RX_AMSDU)
38f3714d
JB
403 hdrlen += ETH_HLEN;
404 WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
405#endif
6e0d114d
JB
406}
407
6368e4b1 408
571ecf67
JB
409/* rx handlers */
410
49461622 411static ieee80211_rx_result debug_noinline
5cf121c3 412ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
571ecf67
JB
413{
414 struct ieee80211_local *local = rx->local;
415 struct sk_buff *skb = rx->skb;
416
c2b13452
JB
417 if (unlikely(local->hw_scanning))
418 return ieee80211_scan_rx(rx->sdata, skb, rx->status);
ece8eddd 419
c2b13452 420 if (unlikely(local->sw_scanning)) {
ece8eddd 421 /* drop all the other packets during a software scan anyway */
c2b13452 422 if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
9ae54c84 423 != RX_QUEUED)
ece8eddd 424 dev_kfree_skb(skb);
9ae54c84 425 return RX_QUEUED;
571ecf67
JB
426 }
427
5cf121c3 428 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
571ecf67
JB
429 /* scanning finished during invoking of handlers */
430 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
e4c26add 431 return RX_DROP_UNUSABLE;
571ecf67
JB
432 }
433
9ae54c84 434 return RX_CONTINUE;
571ecf67
JB
435}
436
33b64eb2 437static ieee80211_rx_result
5cf121c3 438ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 439{
a7767f95
HH
440 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
441 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
d6d1a5a7 442
a7767f95
HH
443 if (ieee80211_is_data(hdr->frame_control)) {
444 if (!ieee80211_has_a4(hdr->frame_control))
33b64eb2
LCC
445 return RX_DROP_MONITOR;
446 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
447 return RX_DROP_MONITOR;
448 }
449
450 /* If there is not an established peer link and this is not a peer link
451 * establisment frame, beacon or probe, drop the frame.
452 */
453
b4e08ea1 454 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
33b64eb2 455 struct ieee80211_mgmt *mgmt;
d6d1a5a7 456
a7767f95 457 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC
458 return RX_DROP_MONITOR;
459
a7767f95 460 if (ieee80211_is_action(hdr->frame_control)) {
33b64eb2
LCC
461 mgmt = (struct ieee80211_mgmt *)hdr;
462 if (mgmt->u.action.category != PLINK_CATEGORY)
463 return RX_DROP_MONITOR;
33b64eb2 464 return RX_CONTINUE;
33b64eb2
LCC
465 }
466
a7767f95
HH
467 if (ieee80211_is_probe_req(hdr->frame_control) ||
468 ieee80211_is_probe_resp(hdr->frame_control) ||
469 ieee80211_is_beacon(hdr->frame_control))
470 return RX_CONTINUE;
471
472 return RX_DROP_MONITOR;
473
474 }
475
476#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
477
478 if (ieee80211_is_data(hdr->frame_control) &&
479 is_multicast_ether_addr(hdr->addr1) &&
f698d856 480 mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
33b64eb2 481 return RX_DROP_MONITOR;
902acc78 482#undef msh_h_get
d6d1a5a7 483
902acc78
JB
484 return RX_CONTINUE;
485}
33b64eb2
LCC
486
487
49461622 488static ieee80211_rx_result debug_noinline
5cf121c3 489ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
571ecf67 490{
a7767f95 491 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB
492
493 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
494 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
a7767f95 495 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
5cf121c3 496 rx->sta->last_seq_ctrl[rx->queue] ==
571ecf67 497 hdr->seq_ctrl)) {
5cf121c3 498 if (rx->flags & IEEE80211_RX_RA_MATCH) {
571ecf67
JB
499 rx->local->dot11FrameDuplicateCount++;
500 rx->sta->num_duplicates++;
501 }
e4c26add 502 return RX_DROP_MONITOR;
571ecf67 503 } else
5cf121c3 504 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
571ecf67
JB
505 }
506
571ecf67
JB
507 if (unlikely(rx->skb->len < 16)) {
508 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
e4c26add 509 return RX_DROP_MONITOR;
571ecf67
JB
510 }
511
571ecf67
JB
512 /* Drop disallowed frame classes based on STA auth/assoc state;
513 * IEEE 802.11, Chap 5.5.
514 *
ccd7b362
JB
515 * mac80211 filters only based on association state, i.e. it drops
516 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB
517 * deauth/disassoc frames when needed. In addition, hostapd is
518 * responsible for filtering on both auth and assoc states.
519 */
33b64eb2 520
902acc78 521 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 522 return ieee80211_rx_mesh_check(rx);
33b64eb2 523
a7767f95
HH
524 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
525 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 526 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
07346f81 527 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
a7767f95
HH
528 if ((!ieee80211_has_fromds(hdr->frame_control) &&
529 !ieee80211_has_tods(hdr->frame_control) &&
530 ieee80211_is_data(hdr->frame_control)) ||
531 !(rx->flags & IEEE80211_RX_RA_MATCH)) {
571ecf67
JB
532 /* Drop IBSS frames and frames for other hosts
533 * silently. */
e4c26add 534 return RX_DROP_MONITOR;
571ecf67
JB
535 }
536
e4c26add 537 return RX_DROP_MONITOR;
571ecf67
JB
538 }
539
9ae54c84 540 return RX_CONTINUE;
570bd537
JB
541}
542
543
49461622 544static ieee80211_rx_result debug_noinline
5cf121c3 545ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
570bd537 546{
a7767f95 547 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3017b80b
JB
548 int keyidx;
549 int hdrlen;
e4c26add 550 ieee80211_rx_result result = RX_DROP_UNUSABLE;
d4e46a3d 551 struct ieee80211_key *stakey = NULL;
570bd537 552
3017b80b
JB
553 /*
554 * Key selection 101
555 *
556 * There are three types of keys:
557 * - GTK (group keys)
558 * - PTK (pairwise keys)
559 * - STK (station-to-station pairwise keys)
560 *
561 * When selecting a key, we have to distinguish between multicast
562 * (including broadcast) and unicast frames, the latter can only
563 * use PTKs and STKs while the former always use GTKs. Unless, of
564 * course, actual WEP keys ("pre-RSNA") are used, then unicast
565 * frames can also use key indizes like GTKs. Hence, if we don't
566 * have a PTK/STK we check the key index for a WEP key.
567 *
8dc06a1c
JB
568 * Note that in a regular BSS, multicast frames are sent by the
569 * AP only, associated stations unicast the frame to the AP first
570 * which then multicasts it on their behalf.
571 *
3017b80b
JB
572 * There is also a slight problem in IBSS mode: GTKs are negotiated
573 * with each station, that is something we don't currently handle.
8dc06a1c
JB
574 * The spec seems to expect that one negotiates the same key with
575 * every station but there's no such requirement; VLANs could be
576 * possible.
3017b80b
JB
577 */
578
a7767f95 579 if (!ieee80211_has_protected(hdr->frame_control))
9ae54c84 580 return RX_CONTINUE;
571ecf67 581
3017b80b 582 /*
1990af8d 583 * No point in finding a key and decrypting if the frame is neither
3017b80b
JB
584 * addressed to us nor a multicast frame.
585 */
5cf121c3 586 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
9ae54c84 587 return RX_CONTINUE;
3017b80b 588
d4e46a3d
JB
589 if (rx->sta)
590 stakey = rcu_dereference(rx->sta->key);
591
592 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
593 rx->key = stakey;
571ecf67 594 } else {
3017b80b
JB
595 /*
596 * The device doesn't give us the IV so we won't be
597 * able to look up the key. That's ok though, we
598 * don't need to decrypt the frame, we just won't
599 * be able to keep statistics accurate.
600 * Except for key threshold notifications, should
601 * we somehow allow the driver to tell us which key
602 * the hardware used if this flag is set?
603 */
5cf121c3
JB
604 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
605 (rx->status->flag & RX_FLAG_IV_STRIPPED))
9ae54c84 606 return RX_CONTINUE;
3017b80b 607
a7767f95 608 hdrlen = ieee80211_hdrlen(hdr->frame_control);
3017b80b
JB
609
610 if (rx->skb->len < 8 + hdrlen)
e4c26add 611 return RX_DROP_UNUSABLE; /* TODO: count this? */
3017b80b
JB
612
613 /*
614 * no need to call ieee80211_wep_get_keyidx,
615 * it verifies a bunch of things we've done already
616 */
617 keyidx = rx->skb->data[hdrlen + 3] >> 6;
618
d4e46a3d 619 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
3017b80b
JB
620
621 /*
622 * RSNA-protected unicast frames should always be sent with
623 * pairwise or station-to-station keys, but for WEP we allow
624 * using a key index as well.
625 */
8f20fc24 626 if (rx->key && rx->key->conf.alg != ALG_WEP &&
3017b80b
JB
627 !is_multicast_ether_addr(hdr->addr1))
628 rx->key = NULL;
571ecf67
JB
629 }
630
3017b80b 631 if (rx->key) {
571ecf67 632 rx->key->tx_rx_count++;
011bfcc4 633 /* TODO: add threshold stuff again */
1990af8d 634 } else {
e4c26add 635 return RX_DROP_MONITOR;
70f08765
JB
636 }
637
1990af8d
JB
638 /* Check for weak IVs if possible */
639 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
a7767f95 640 ieee80211_is_data(hdr->frame_control) &&
5cf121c3
JB
641 (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
642 !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
1990af8d
JB
643 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
644 rx->sta->wep_weak_iv_count++;
645
70f08765
JB
646 switch (rx->key->conf.alg) {
647 case ALG_WEP:
e2f036da
MN
648 result = ieee80211_crypto_wep_decrypt(rx);
649 break;
70f08765 650 case ALG_TKIP:
e2f036da
MN
651 result = ieee80211_crypto_tkip_decrypt(rx);
652 break;
70f08765 653 case ALG_CCMP:
e2f036da
MN
654 result = ieee80211_crypto_ccmp_decrypt(rx);
655 break;
70f08765
JB
656 }
657
e2f036da 658 /* either the frame has been decrypted or will be dropped */
5cf121c3 659 rx->status->flag |= RX_FLAG_DECRYPTED;
e2f036da
MN
660
661 return result;
70f08765
JB
662}
663
133b8226 664static void ap_sta_ps_start(struct sta_info *sta)
571ecf67 665{
133b8226 666 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 667 struct ieee80211_local *local = sdata->local;
0795af57 668
3e122be0 669 atomic_inc(&sdata->bss->num_sta_ps);
07346f81 670 set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
89fad578
CL
671 if (local->ops->sta_notify)
672 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
673 STA_NOTIFY_SLEEP, &sta->sta);
571ecf67 674#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26
JB
675 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
676 sdata->dev->name, sta->sta.addr, sta->sta.aid);
571ecf67
JB
677#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
678}
679
133b8226 680static int ap_sta_ps_end(struct sta_info *sta)
571ecf67 681{
133b8226
JB
682 struct ieee80211_sub_if_data *sdata = sta->sdata;
683 struct ieee80211_local *local = sdata->local;
571ecf67
JB
684 struct sk_buff *skb;
685 int sent = 0;
571ecf67 686
3e122be0 687 atomic_dec(&sdata->bss->num_sta_ps);
004c872e 688
07346f81 689 clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
89fad578
CL
690 if (local->ops->sta_notify)
691 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
692 STA_NOTIFY_AWAKE, &sta->sta);
004c872e
JB
693
694 if (!skb_queue_empty(&sta->ps_tx_buf))
695 sta_info_clear_tim_bit(sta);
696
571ecf67 697#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26
JB
698 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
699 sdata->dev->name, sta->sta.addr, sta->sta.aid);
571ecf67 700#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
004c872e 701
571ecf67
JB
702 /* Send all buffered frames to the station */
703 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
571ecf67 704 sent++;
8b30b1fe 705 skb->requeue = 1;
571ecf67
JB
706 dev_queue_xmit(skb);
707 }
708 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
571ecf67
JB
709 local->total_ps_buffered--;
710 sent++;
711#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26 712 printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
133b8226 713 "since STA not sleeping anymore\n", sdata->dev->name,
0c68ae26 714 sta->sta.addr, sta->sta.aid);
571ecf67 715#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
8b30b1fe 716 skb->requeue = 1;
571ecf67
JB
717 dev_queue_xmit(skb);
718 }
719
720 return sent;
721}
722
49461622 723static ieee80211_rx_result debug_noinline
5cf121c3 724ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB
725{
726 struct sta_info *sta = rx->sta;
a7767f95 727 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB
728
729 if (!sta)
9ae54c84 730 return RX_CONTINUE;
571ecf67
JB
731
732 /* Update last_rx only for IBSS packets which are for the current
733 * BSSID to avoid keeping the current IBSS network alive in cases where
734 * other STAs are using different BSSID. */
05c914fe 735 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 736 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 737 NL80211_IFTYPE_ADHOC);
571ecf67
JB
738 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
739 sta->last_rx = jiffies;
740 } else
741 if (!is_multicast_ether_addr(hdr->addr1) ||
05c914fe 742 rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
571ecf67
JB
743 /* Update last_rx only for unicast frames in order to prevent
744 * the Probe Request frames (the only broadcast frames from a
745 * STA in infrastructure mode) from keeping a connection alive.
33b64eb2
LCC
746 * Mesh beacons will update last_rx when if they are found to
747 * match the current local configuration when processed.
571ecf67
JB
748 */
749 sta->last_rx = jiffies;
750 }
751
5cf121c3 752 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
9ae54c84 753 return RX_CONTINUE;
571ecf67
JB
754
755 sta->rx_fragments++;
756 sta->rx_bytes += rx->skb->len;
5cf121c3 757 sta->last_signal = rx->status->signal;
566bfe5a 758 sta->last_qual = rx->status->qual;
5cf121c3 759 sta->last_noise = rx->status->noise;
571ecf67 760
72eaa43a
JB
761 /*
762 * Change STA power saving mode only at the end of a frame
763 * exchange sequence.
764 */
3e122be0 765 if (!ieee80211_has_morefrags(hdr->frame_control) &&
05c914fe
JB
766 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
767 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
72eaa43a
JB
768 if (test_sta_flags(sta, WLAN_STA_PS)) {
769 /*
770 * Ignore doze->wake transitions that are
771 * indicated by non-data frames, the standard
772 * is unclear here, but for example going to
773 * PS mode and then scanning would cause a
774 * doze->wake transition for the probe request,
775 * and that is clearly undesirable.
776 */
777 if (ieee80211_is_data(hdr->frame_control) &&
778 !ieee80211_has_pm(hdr->frame_control))
779 rx->sent_ps_buffered += ap_sta_ps_end(sta);
780 } else {
781 if (ieee80211_has_pm(hdr->frame_control))
782 ap_sta_ps_start(sta);
783 }
571ecf67
JB
784 }
785
786 /* Drop data::nullfunc frames silently, since they are used only to
787 * control station power saving mode. */
a7767f95 788 if (ieee80211_is_nullfunc(hdr->frame_control)) {
571ecf67
JB
789 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
790 /* Update counter and free packet here to avoid counting this
791 * as a dropped packed. */
792 sta->rx_packets++;
793 dev_kfree_skb(rx->skb);
9ae54c84 794 return RX_QUEUED;
571ecf67
JB
795 }
796
9ae54c84 797 return RX_CONTINUE;
571ecf67
JB
798} /* ieee80211_rx_h_sta_process */
799
571ecf67
JB
800static inline struct ieee80211_fragment_entry *
801ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
802 unsigned int frag, unsigned int seq, int rx_queue,
803 struct sk_buff **skb)
804{
805 struct ieee80211_fragment_entry *entry;
806 int idx;
807
808 idx = sdata->fragment_next;
809 entry = &sdata->fragments[sdata->fragment_next++];
810 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
811 sdata->fragment_next = 0;
812
813 if (!skb_queue_empty(&entry->skb_list)) {
f4ea83dd 814#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
571ecf67
JB
815 struct ieee80211_hdr *hdr =
816 (struct ieee80211_hdr *) entry->skb_list.next->data;
817 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
818 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
0c68ae26 819 "addr1=%pM addr2=%pM\n",
571ecf67
JB
820 sdata->dev->name, idx,
821 jiffies - entry->first_frag_time, entry->seq,
0c68ae26 822 entry->last_frag, hdr->addr1, hdr->addr2);
f4ea83dd 823#endif
571ecf67
JB
824 __skb_queue_purge(&entry->skb_list);
825 }
826
827 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
828 *skb = NULL;
829 entry->first_frag_time = jiffies;
830 entry->seq = seq;
831 entry->rx_queue = rx_queue;
832 entry->last_frag = frag;
833 entry->ccmp = 0;
834 entry->extra_len = 0;
835
836 return entry;
837}
838
839static inline struct ieee80211_fragment_entry *
840ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
b73d70ad 841 unsigned int frag, unsigned int seq,
571ecf67
JB
842 int rx_queue, struct ieee80211_hdr *hdr)
843{
844 struct ieee80211_fragment_entry *entry;
845 int i, idx;
846
847 idx = sdata->fragment_next;
848 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
849 struct ieee80211_hdr *f_hdr;
571ecf67
JB
850
851 idx--;
852 if (idx < 0)
853 idx = IEEE80211_FRAGMENT_MAX - 1;
854
855 entry = &sdata->fragments[idx];
856 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
857 entry->rx_queue != rx_queue ||
858 entry->last_frag + 1 != frag)
859 continue;
860
b73d70ad 861 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
571ecf67 862
b73d70ad
HH
863 /*
864 * Check ftype and addresses are equal, else check next fragment
865 */
866 if (((hdr->frame_control ^ f_hdr->frame_control) &
867 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
571ecf67
JB
868 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
869 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
870 continue;
871
ab46623e 872 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB
873 __skb_queue_purge(&entry->skb_list);
874 continue;
875 }
876 return entry;
877 }
878
879 return NULL;
880}
881
49461622 882static ieee80211_rx_result debug_noinline
5cf121c3 883ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67
JB
884{
885 struct ieee80211_hdr *hdr;
886 u16 sc;
358c8d9d 887 __le16 fc;
571ecf67
JB
888 unsigned int frag, seq;
889 struct ieee80211_fragment_entry *entry;
890 struct sk_buff *skb;
891
b73d70ad 892 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 893 fc = hdr->frame_control;
571ecf67
JB
894 sc = le16_to_cpu(hdr->seq_ctrl);
895 frag = sc & IEEE80211_SCTL_FRAG;
896
358c8d9d 897 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
571ecf67
JB
898 (rx->skb)->len < 24 ||
899 is_multicast_ether_addr(hdr->addr1))) {
900 /* not fragmented */
901 goto out;
902 }
903 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
904
905 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
906
907 if (frag == 0) {
908 /* This is the first fragment of a new frame. */
909 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
5cf121c3 910 rx->queue, &(rx->skb));
8f20fc24 911 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
358c8d9d 912 ieee80211_has_protected(fc)) {
571ecf67
JB
913 /* Store CCMP PN so that we can verify that the next
914 * fragment has a sequential PN value. */
915 entry->ccmp = 1;
916 memcpy(entry->last_pn,
5cf121c3 917 rx->key->u.ccmp.rx_pn[rx->queue],
571ecf67
JB
918 CCMP_PN_LEN);
919 }
9ae54c84 920 return RX_QUEUED;
571ecf67
JB
921 }
922
923 /* This is a fragment for a frame that should already be pending in
924 * fragment cache. Add this fragment to the end of the pending entry.
925 */
b73d70ad 926 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
571ecf67
JB
927 if (!entry) {
928 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 929 return RX_DROP_MONITOR;
571ecf67
JB
930 }
931
932 /* Verify that MPDUs within one MSDU have sequential PN values.
933 * (IEEE 802.11i, 8.3.3.4.5) */
934 if (entry->ccmp) {
935 int i;
936 u8 pn[CCMP_PN_LEN], *rpn;
8f20fc24 937 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
e4c26add 938 return RX_DROP_UNUSABLE;
571ecf67
JB
939 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
940 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
941 pn[i]++;
942 if (pn[i])
943 break;
944 }
5cf121c3 945 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
f4ea83dd 946 if (memcmp(pn, rpn, CCMP_PN_LEN))
e4c26add 947 return RX_DROP_UNUSABLE;
571ecf67
JB
948 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
949 }
950
358c8d9d 951 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB
952 __skb_queue_tail(&entry->skb_list, rx->skb);
953 entry->last_frag = frag;
954 entry->extra_len += rx->skb->len;
358c8d9d 955 if (ieee80211_has_morefrags(fc)) {
571ecf67 956 rx->skb = NULL;
9ae54c84 957 return RX_QUEUED;
571ecf67
JB
958 }
959
960 rx->skb = __skb_dequeue(&entry->skb_list);
961 if (skb_tailroom(rx->skb) < entry->extra_len) {
962 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
963 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
964 GFP_ATOMIC))) {
965 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
966 __skb_queue_purge(&entry->skb_list);
e4c26add 967 return RX_DROP_UNUSABLE;
571ecf67
JB
968 }
969 }
970 while ((skb = __skb_dequeue(&entry->skb_list))) {
971 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
972 dev_kfree_skb(skb);
973 }
974
975 /* Complete frame has been reassembled - process it now */
5cf121c3 976 rx->flags |= IEEE80211_RX_FRAGMENTED;
571ecf67
JB
977
978 out:
979 if (rx->sta)
980 rx->sta->rx_packets++;
981 if (is_multicast_ether_addr(hdr->addr1))
982 rx->local->dot11MulticastReceivedFrameCount++;
983 else
984 ieee80211_led_rx(rx->local);
9ae54c84 985 return RX_CONTINUE;
571ecf67
JB
986}
987
49461622 988static ieee80211_rx_result debug_noinline
5cf121c3 989ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
571ecf67 990{
98f0b0a3 991 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
571ecf67
JB
992 struct sk_buff *skb;
993 int no_pending_pkts;
358c8d9d 994 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
571ecf67 995
358c8d9d 996 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
5cf121c3 997 !(rx->flags & IEEE80211_RX_RA_MATCH)))
9ae54c84 998 return RX_CONTINUE;
571ecf67 999
05c914fe
JB
1000 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1001 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
e4c26add 1002 return RX_DROP_UNUSABLE;
98f0b0a3 1003
571ecf67
JB
1004 skb = skb_dequeue(&rx->sta->tx_filtered);
1005 if (!skb) {
1006 skb = skb_dequeue(&rx->sta->ps_tx_buf);
1007 if (skb)
1008 rx->local->total_ps_buffered--;
1009 }
1010 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
1011 skb_queue_empty(&rx->sta->ps_tx_buf);
1012
1013 if (skb) {
1014 struct ieee80211_hdr *hdr =
1015 (struct ieee80211_hdr *) skb->data;
1016
4a9a66e9
JB
1017 /*
1018 * Tell TX path to send one frame even though the STA may
1019 * still remain is PS mode after this frame exchange.
1020 */
07346f81 1021 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
571ecf67
JB
1022
1023#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26
JB
1024 printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
1025 rx->sta->sta.addr, rx->sta->sta.aid,
571ecf67
JB
1026 skb_queue_len(&rx->sta->ps_tx_buf));
1027#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1028
1029 /* Use MoreData flag to indicate whether there are more
1030 * buffered frames for this STA */
836341a7 1031 if (no_pending_pkts)
571ecf67 1032 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
836341a7 1033 else
571ecf67
JB
1034 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1035
1036 dev_queue_xmit(skb);
1037
004c872e
JB
1038 if (no_pending_pkts)
1039 sta_info_clear_tim_bit(rx->sta);
571ecf67 1040#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
5cf121c3 1041 } else if (!rx->sent_ps_buffered) {
004c872e
JB
1042 /*
1043 * FIXME: This can be the result of a race condition between
1044 * us expiring a frame and the station polling for it.
1045 * Should we send it a null-func frame indicating we
1046 * have nothing buffered for it?
1047 */
0c68ae26 1048 printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
f4ea83dd 1049 "though there are no buffered frames for it\n",
0c68ae26 1050 rx->dev->name, rx->sta->sta.addr);
571ecf67 1051#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
571ecf67
JB
1052 }
1053
9ae54c84 1054 /* Free PS Poll skb here instead of returning RX_DROP that would
571ecf67
JB
1055 * count as an dropped frame. */
1056 dev_kfree_skb(rx->skb);
1057
9ae54c84 1058 return RX_QUEUED;
571ecf67
JB
1059}
1060
49461622 1061static ieee80211_rx_result debug_noinline
5cf121c3 1062ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
6e0d114d 1063{
6e0d114d 1064 u8 *data = rx->skb->data;
238f74a2 1065 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
6e0d114d 1066
238f74a2 1067 if (!ieee80211_is_data_qos(hdr->frame_control))
9ae54c84 1068 return RX_CONTINUE;
6e0d114d
JB
1069
1070 /* remove the qos control field, update frame type and meta-data */
238f74a2
HH
1071 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1072 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1073 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
6e0d114d 1074 /* change frame type to non QOS */
238f74a2 1075 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
6e0d114d 1076
9ae54c84 1077 return RX_CONTINUE;
6e0d114d
JB
1078}
1079
76ee65bf 1080static int
5cf121c3 1081ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 1082{
07346f81 1083 if (unlikely(!rx->sta ||
f4ea83dd 1084 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 1085 return -EACCES;
571ecf67 1086
76ee65bf 1087 return 0;
571ecf67
JB
1088}
1089
76ee65bf 1090static int
358c8d9d 1091ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 1092{
3017b80b 1093 /*
7848ba7d
JB
1094 * Pass through unencrypted frames if the hardware has
1095 * decrypted them already.
3017b80b 1096 */
5cf121c3 1097 if (rx->status->flag & RX_FLAG_DECRYPTED)
76ee65bf 1098 return 0;
571ecf67
JB
1099
1100 /* Drop unencrypted frames if key is set. */
358c8d9d
HH
1101 if (unlikely(!ieee80211_has_protected(fc) &&
1102 !ieee80211_is_nullfunc(fc) &&
b3fc9c6c 1103 (rx->key || rx->sdata->drop_unencrypted)))
76ee65bf 1104 return -EACCES;
b3fc9c6c 1105
76ee65bf 1106 return 0;
571ecf67
JB
1107}
1108
76ee65bf 1109static int
5cf121c3 1110ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
571ecf67
JB
1111{
1112 struct net_device *dev = rx->dev;
571ecf67 1113 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
b73d70ad 1114 u16 hdrlen, ethertype;
571ecf67
JB
1115 u8 *payload;
1116 u8 dst[ETH_ALEN];
c97c23e3 1117 u8 src[ETH_ALEN] __aligned(2);
76ee65bf 1118 struct sk_buff *skb = rx->skb;
571ecf67
JB
1119 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1120
b73d70ad 1121 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
76ee65bf 1122 return -1;
571ecf67 1123
b73d70ad 1124 hdrlen = ieee80211_hdrlen(hdr->frame_control);
571ecf67
JB
1125
1126 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1127 * header
1128 * IEEE 802.11 address fields:
1129 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1130 * 0 0 DA SA BSSID n/a
1131 * 0 1 DA BSSID SA n/a
1132 * 1 0 BSSID SA DA n/a
1133 * 1 1 RA TA DA SA
1134 */
b73d70ad
HH
1135 memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
1136 memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
571ecf67 1137
b73d70ad
HH
1138 switch (hdr->frame_control &
1139 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1140 case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
05c914fe
JB
1141 if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
1142 sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
76ee65bf 1143 return -1;
571ecf67 1144 break;
b73d70ad 1145 case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
05c914fe
JB
1146 if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
1147 sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
76ee65bf 1148 return -1;
79617dee
Y
1149 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1150 struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
1151 (skb->data + hdrlen);
1152 hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
1153 if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
1154 memcpy(dst, meshdr->eaddr1, ETH_ALEN);
1155 memcpy(src, meshdr->eaddr2, ETH_ALEN);
1156 }
1157 }
571ecf67 1158 break;
b73d70ad 1159 case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
05c914fe 1160 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
b3316157
JL
1161 (is_multicast_ether_addr(dst) &&
1162 !compare_ether_addr(src, dev->dev_addr)))
76ee65bf 1163 return -1;
571ecf67 1164 break;
b73d70ad 1165 case __constant_cpu_to_le16(0):
05c914fe 1166 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
76ee65bf 1167 return -1;
571ecf67
JB
1168 break;
1169 }
1170
f4ea83dd 1171 if (unlikely(skb->len - hdrlen < 8))
76ee65bf 1172 return -1;
571ecf67 1173
76ee65bf 1174 payload = skb->data + hdrlen;
571ecf67
JB
1175 ethertype = (payload[6] << 8) | payload[7];
1176
1177 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1178 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1179 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1180 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1181 * replace EtherType */
1182 skb_pull(skb, hdrlen + 6);
1183 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1184 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1185 } else {
1186 struct ethhdr *ehdr;
1187 __be16 len;
ce3edf6d 1188
571ecf67
JB
1189 skb_pull(skb, hdrlen);
1190 len = htons(skb->len);
1191 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1192 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1193 memcpy(ehdr->h_source, src, ETH_ALEN);
1194 ehdr->h_proto = len;
1195 }
76ee65bf
RR
1196 return 0;
1197}
571ecf67 1198
ce3edf6d
JB
1199/*
1200 * requires that rx->skb is a frame with ethernet header
1201 */
358c8d9d 1202static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 1203{
c97c23e3 1204 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB
1205 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1206 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1207
1208 /*
1209 * Allow EAPOL frames to us/the PAE group address regardless
1210 * of whether the frame was encrypted or not.
1211 */
1212 if (ehdr->h_proto == htons(ETH_P_PAE) &&
1213 (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1214 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1215 return true;
1216
1217 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 1218 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB
1219 return false;
1220
1221 return true;
1222}
1223
1224/*
1225 * requires that rx->skb is a frame with ethernet header
1226 */
76ee65bf 1227static void
5cf121c3 1228ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf
RR
1229{
1230 struct net_device *dev = rx->dev;
1231 struct ieee80211_local *local = rx->local;
1232 struct sk_buff *skb, *xmit_skb;
1233 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
ce3edf6d
JB
1234 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1235 struct sta_info *dsta;
571ecf67 1236
76ee65bf
RR
1237 skb = rx->skb;
1238 xmit_skb = NULL;
571ecf67 1239
05c914fe
JB
1240 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1241 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 1242 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
5cf121c3 1243 (rx->flags & IEEE80211_RX_RA_MATCH)) {
ce3edf6d
JB
1244 if (is_multicast_ether_addr(ehdr->h_dest)) {
1245 /*
1246 * send multicast frames both to higher layers in
1247 * local net stack and back to the wireless medium
1248 */
76ee65bf
RR
1249 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1250 if (!xmit_skb && net_ratelimit())
571ecf67
JB
1251 printk(KERN_DEBUG "%s: failed to clone "
1252 "multicast frame\n", dev->name);
1253 } else {
571ecf67 1254 dsta = sta_info_get(local, skb->data);
d0709a65 1255 if (dsta && dsta->sdata->dev == dev) {
ce3edf6d
JB
1256 /*
1257 * The destination station is associated to
1258 * this AP (in this VLAN), so send the frame
1259 * directly to it and do not pass it to local
1260 * net stack.
571ecf67 1261 */
76ee65bf 1262 xmit_skb = skb;
571ecf67
JB
1263 skb = NULL;
1264 }
571ecf67
JB
1265 }
1266 }
1267
1268 if (skb) {
1269 /* deliver to local stack */
1270 skb->protocol = eth_type_trans(skb, dev);
1271 memset(skb->cb, 0, sizeof(skb->cb));
1272 netif_rx(skb);
1273 }
1274
76ee65bf 1275 if (xmit_skb) {
571ecf67 1276 /* send to wireless media */
f831e909 1277 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB
1278 skb_reset_network_header(xmit_skb);
1279 skb_reset_mac_header(xmit_skb);
76ee65bf 1280 dev_queue_xmit(xmit_skb);
571ecf67 1281 }
76ee65bf
RR
1282}
1283
49461622 1284static ieee80211_rx_result debug_noinline
5cf121c3 1285ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
fd4c7f2f
RR
1286{
1287 struct net_device *dev = rx->dev;
1288 struct ieee80211_local *local = rx->local;
358c8d9d 1289 u16 ethertype;
fd4c7f2f
RR
1290 u8 *payload;
1291 struct sk_buff *skb = rx->skb, *frame = NULL;
358c8d9d
HH
1292 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1293 __le16 fc = hdr->frame_control;
fd4c7f2f
RR
1294 const struct ethhdr *eth;
1295 int remaining, err;
1296 u8 dst[ETH_ALEN];
1297 u8 src[ETH_ALEN];
fd4c7f2f 1298
358c8d9d 1299 if (unlikely(!ieee80211_is_data(fc)))
9ae54c84 1300 return RX_CONTINUE;
fd4c7f2f 1301
358c8d9d 1302 if (unlikely(!ieee80211_is_data_present(fc)))
e4c26add 1303 return RX_DROP_MONITOR;
fd4c7f2f 1304
5cf121c3 1305 if (!(rx->flags & IEEE80211_RX_AMSDU))
9ae54c84 1306 return RX_CONTINUE;
fd4c7f2f
RR
1307
1308 err = ieee80211_data_to_8023(rx);
1309 if (unlikely(err))
e4c26add 1310 return RX_DROP_UNUSABLE;
fd4c7f2f
RR
1311
1312 skb->dev = dev;
1313
1314 dev->stats.rx_packets++;
1315 dev->stats.rx_bytes += skb->len;
1316
1317 /* skip the wrapping header */
1318 eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1319 if (!eth)
e4c26add 1320 return RX_DROP_UNUSABLE;
fd4c7f2f
RR
1321
1322 while (skb != frame) {
1323 u8 padding;
1324 __be16 len = eth->h_proto;
1325 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1326
1327 remaining = skb->len;
1328 memcpy(dst, eth->h_dest, ETH_ALEN);
1329 memcpy(src, eth->h_source, ETH_ALEN);
1330
1331 padding = ((4 - subframe_len) & 0x3);
1332 /* the last MSDU has no padding */
f4ea83dd 1333 if (subframe_len > remaining)
e4c26add 1334 return RX_DROP_UNUSABLE;
fd4c7f2f
RR
1335
1336 skb_pull(skb, sizeof(struct ethhdr));
1337 /* if last subframe reuse skb */
1338 if (remaining <= subframe_len + padding)
1339 frame = skb;
1340 else {
1341 frame = dev_alloc_skb(local->hw.extra_tx_headroom +
1342 subframe_len);
1343
1344 if (frame == NULL)
e4c26add 1345 return RX_DROP_UNUSABLE;
fd4c7f2f
RR
1346
1347 skb_reserve(frame, local->hw.extra_tx_headroom +
1348 sizeof(struct ethhdr));
1349 memcpy(skb_put(frame, ntohs(len)), skb->data,
1350 ntohs(len));
1351
1352 eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1353 padding);
1354 if (!eth) {
fd4c7f2f 1355 dev_kfree_skb(frame);
e4c26add 1356 return RX_DROP_UNUSABLE;
fd4c7f2f
RR
1357 }
1358 }
1359
ce3edf6d 1360 skb_reset_network_header(frame);
fd4c7f2f
RR
1361 frame->dev = dev;
1362 frame->priority = skb->priority;
1363 rx->skb = frame;
1364
fd4c7f2f
RR
1365 payload = frame->data;
1366 ethertype = (payload[6] << 8) | payload[7];
1367
1368 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
ce3edf6d
JB
1369 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1370 compare_ether_addr(payload,
1371 bridge_tunnel_header) == 0)) {
fd4c7f2f
RR
1372 /* remove RFC1042 or Bridge-Tunnel
1373 * encapsulation and replace EtherType */
1374 skb_pull(frame, 6);
1375 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1376 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1377 } else {
ce3edf6d
JB
1378 memcpy(skb_push(frame, sizeof(__be16)),
1379 &len, sizeof(__be16));
fd4c7f2f
RR
1380 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1381 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1382 }
1383
358c8d9d 1384 if (!ieee80211_frame_allowed(rx, fc)) {
ce3edf6d 1385 if (skb == frame) /* last frame */
e4c26add 1386 return RX_DROP_UNUSABLE;
ce3edf6d
JB
1387 dev_kfree_skb(frame);
1388 continue;
1389 }
fd4c7f2f
RR
1390
1391 ieee80211_deliver_skb(rx);
1392 }
1393
9ae54c84 1394 return RX_QUEUED;
fd4c7f2f
RR
1395}
1396
bf94e17b 1397#ifdef CONFIG_MAC80211_MESH
b0dee578 1398static ieee80211_rx_result
e32f85f7
LCC
1399ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1400{
1401 struct ieee80211_hdr *hdr;
1402 struct ieee80211s_hdr *mesh_hdr;
1403 unsigned int hdrlen;
1404 struct sk_buff *skb = rx->skb, *fwd_skb;
1405
1406 hdr = (struct ieee80211_hdr *) skb->data;
1407 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1408 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1409
1410 if (!ieee80211_is_data(hdr->frame_control))
1411 return RX_CONTINUE;
1412
1413 if (!mesh_hdr->ttl)
1414 /* illegal frame */
1415 return RX_DROP_MONITOR;
1416
79617dee
Y
1417 if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
1418 struct ieee80211_sub_if_data *sdata;
1419 struct mesh_path *mppath;
1420
1421 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1422 rcu_read_lock();
1423 mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
1424 if (!mppath) {
1425 mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
1426 } else {
1427 spin_lock_bh(&mppath->state_lock);
1428 mppath->exp_time = jiffies;
1429 if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
1430 memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
1431 spin_unlock_bh(&mppath->state_lock);
1432 }
1433 rcu_read_unlock();
1434 }
1435
e32f85f7
LCC
1436 if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
1437 return RX_CONTINUE;
1438
1439 mesh_hdr->ttl--;
1440
1441 if (rx->flags & IEEE80211_RX_RA_MATCH) {
1442 if (!mesh_hdr->ttl)
472dbc45 1443 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
e32f85f7
LCC
1444 dropped_frames_ttl);
1445 else {
1446 struct ieee80211_hdr *fwd_hdr;
1447 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1448
1449 if (!fwd_skb && net_ratelimit())
1450 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1451 rx->dev->name);
1452
1453 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
1454 /*
1455 * Save TA to addr1 to send TA a path error if a
1456 * suitable next hop is not found
1457 */
1458 memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
1459 memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
1460 fwd_skb->dev = rx->local->mdev;
1461 fwd_skb->iif = rx->dev->ifindex;
1462 dev_queue_xmit(fwd_skb);
1463 }
1464 }
1465
1466 if (is_multicast_ether_addr(hdr->addr3) ||
1467 rx->dev->flags & IFF_PROMISC)
1468 return RX_CONTINUE;
1469 else
1470 return RX_DROP_MONITOR;
1471}
bf94e17b 1472#endif
e32f85f7 1473
49461622 1474static ieee80211_rx_result debug_noinline
5cf121c3 1475ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf
RR
1476{
1477 struct net_device *dev = rx->dev;
358c8d9d
HH
1478 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1479 __le16 fc = hdr->frame_control;
ce3edf6d 1480 int err;
76ee65bf 1481
358c8d9d 1482 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 1483 return RX_CONTINUE;
76ee65bf 1484
358c8d9d 1485 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 1486 return RX_DROP_MONITOR;
76ee65bf 1487
76ee65bf
RR
1488 err = ieee80211_data_to_8023(rx);
1489 if (unlikely(err))
e4c26add 1490 return RX_DROP_UNUSABLE;
76ee65bf 1491
358c8d9d 1492 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 1493 return RX_DROP_MONITOR;
ce3edf6d 1494
76ee65bf
RR
1495 rx->skb->dev = dev;
1496
1497 dev->stats.rx_packets++;
1498 dev->stats.rx_bytes += rx->skb->len;
1499
1500 ieee80211_deliver_skb(rx);
571ecf67 1501
9ae54c84 1502 return RX_QUEUED;
571ecf67
JB
1503}
1504
49461622 1505static ieee80211_rx_result debug_noinline
5cf121c3 1506ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
71364716
RR
1507{
1508 struct ieee80211_local *local = rx->local;
1509 struct ieee80211_hw *hw = &local->hw;
1510 struct sk_buff *skb = rx->skb;
a7767f95 1511 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR
1512 struct tid_ampdu_rx *tid_agg_rx;
1513 u16 start_seq_num;
1514 u16 tid;
1515
a7767f95 1516 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 1517 return RX_CONTINUE;
71364716 1518
a7767f95 1519 if (ieee80211_is_back_req(bar->frame_control)) {
71364716 1520 if (!rx->sta)
9ae54c84 1521 return RX_CONTINUE;
71364716 1522 tid = le16_to_cpu(bar->control) >> 12;
cee24a3e
RR
1523 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1524 != HT_AGG_STATE_OPERATIONAL)
9ae54c84 1525 return RX_CONTINUE;
cee24a3e 1526 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
71364716
RR
1527
1528 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1529
1530 /* reset session timer */
1531 if (tid_agg_rx->timeout) {
1532 unsigned long expires =
1533 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
1534 mod_timer(&tid_agg_rx->session_timer, expires);
1535 }
1536
1537 /* manage reordering buffer according to requested */
1538 /* sequence number */
1539 rcu_read_lock();
1540 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1541 start_seq_num, 1);
1542 rcu_read_unlock();
e4c26add 1543 return RX_DROP_UNUSABLE;
71364716
RR
1544 }
1545
9ae54c84 1546 return RX_CONTINUE;
71364716
RR
1547}
1548
de1ede7a
JB
1549static ieee80211_rx_result debug_noinline
1550ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1551{
1552 struct ieee80211_local *local = rx->local;
1553 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1554 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1555 int len = rx->skb->len;
1556
1557 if (!ieee80211_is_action(mgmt->frame_control))
1558 return RX_CONTINUE;
1559
1560 if (!rx->sta)
1561 return RX_DROP_MONITOR;
1562
1563 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1564 return RX_DROP_MONITOR;
1565
1566 /* all categories we currently handle have action_code */
1567 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1568 return RX_DROP_MONITOR;
1569
de1ede7a
JB
1570 switch (mgmt->u.action.category) {
1571 case WLAN_CATEGORY_BACK:
1572 switch (mgmt->u.action.u.addba_req.action_code) {
1573 case WLAN_ACTION_ADDBA_REQ:
1574 if (len < (IEEE80211_MIN_ACTION_SIZE +
1575 sizeof(mgmt->u.action.u.addba_req)))
1576 return RX_DROP_MONITOR;
1577 ieee80211_process_addba_request(local, rx->sta, mgmt, len);
1578 break;
1579 case WLAN_ACTION_ADDBA_RESP:
1580 if (len < (IEEE80211_MIN_ACTION_SIZE +
1581 sizeof(mgmt->u.action.u.addba_resp)))
1582 return RX_DROP_MONITOR;
1583 ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
1584 break;
1585 case WLAN_ACTION_DELBA:
1586 if (len < (IEEE80211_MIN_ACTION_SIZE +
1587 sizeof(mgmt->u.action.u.delba)))
1588 return RX_DROP_MONITOR;
1589 ieee80211_process_delba(sdata, rx->sta, mgmt, len);
1590 break;
1591 }
39192c0b
JB
1592 break;
1593 case WLAN_CATEGORY_SPECTRUM_MGMT:
1594 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
1595 return RX_DROP_MONITOR;
1596 switch (mgmt->u.action.u.measurement.action_code) {
1597 case WLAN_ACTION_SPCT_MSR_REQ:
1598 if (len < (IEEE80211_MIN_ACTION_SIZE +
1599 sizeof(mgmt->u.action.u.measurement)))
1600 return RX_DROP_MONITOR;
1601 ieee80211_process_measurement_req(sdata, mgmt, len);
1602 break;
1603 }
1604 break;
1605 default:
1606 return RX_CONTINUE;
de1ede7a
JB
1607 }
1608
39192c0b
JB
1609 rx->sta->rx_packets++;
1610 dev_kfree_skb(rx->skb);
1611 return RX_QUEUED;
de1ede7a
JB
1612}
1613
49461622 1614static ieee80211_rx_result debug_noinline
5cf121c3 1615ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 1616{
759ef3eb 1617 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
571ecf67 1618
5cf121c3 1619 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
e4c26add 1620 return RX_DROP_MONITOR;
571ecf67 1621
472dbc45
JB
1622 if (ieee80211_vif_is_mesh(&sdata->vif))
1623 return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
1624
05c914fe
JB
1625 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1626 sdata->vif.type != NL80211_IFTYPE_ADHOC)
759ef3eb
JB
1627 return RX_DROP_MONITOR;
1628
1629 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
e4c26add 1630 return RX_DROP_MONITOR;
f9d540ee 1631
759ef3eb 1632 ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
9ae54c84 1633 return RX_QUEUED;
571ecf67
JB
1634}
1635
571ecf67
JB
1636static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1637 struct ieee80211_hdr *hdr,
5cf121c3 1638 struct ieee80211_rx_data *rx)
571ecf67 1639{
a7767f95
HH
1640 int keyidx;
1641 unsigned int hdrlen;
571ecf67 1642
a7767f95 1643 hdrlen = ieee80211_hdrlen(hdr->frame_control);
571ecf67
JB
1644 if (rx->skb->len >= hdrlen + 4)
1645 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1646 else
1647 keyidx = -1;
1648
8944b79f 1649 if (!rx->sta) {
aa0daf0e
JB
1650 /*
1651 * Some hardware seem to generate incorrect Michael MIC
1652 * reports; ignore them to avoid triggering countermeasures.
1653 */
571ecf67
JB
1654 goto ignore;
1655 }
1656
a7767f95 1657 if (!ieee80211_has_protected(hdr->frame_control))
571ecf67 1658 goto ignore;
571ecf67 1659
05c914fe 1660 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
aa0daf0e
JB
1661 /*
1662 * APs with pairwise keys should never receive Michael MIC
1663 * errors for non-zero keyidx because these are reserved for
1664 * group keys and only the AP is sending real multicast
1665 * frames in the BSS.
1666 */
eb063c17 1667 goto ignore;
571ecf67
JB
1668 }
1669
a7767f95
HH
1670 if (!ieee80211_is_data(hdr->frame_control) &&
1671 !ieee80211_is_auth(hdr->frame_control))
571ecf67 1672 goto ignore;
571ecf67 1673
f698d856 1674 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
571ecf67
JB
1675 ignore:
1676 dev_kfree_skb(rx->skb);
1677 rx->skb = NULL;
1678}
1679
5cf121c3
JB
1680/* TODO: use IEEE80211_RX_FRAGMENTED */
1681static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
3d30d949
MW
1682{
1683 struct ieee80211_sub_if_data *sdata;
1684 struct ieee80211_local *local = rx->local;
1685 struct ieee80211_rtap_hdr {
1686 struct ieee80211_radiotap_header hdr;
1687 u8 flags;
1688 u8 rate;
1689 __le16 chan_freq;
1690 __le16 chan_flags;
1691 } __attribute__ ((packed)) *rthdr;
1692 struct sk_buff *skb = rx->skb, *skb2;
1693 struct net_device *prev_dev = NULL;
5cf121c3 1694 struct ieee80211_rx_status *status = rx->status;
3d30d949 1695
5cf121c3 1696 if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
3d30d949
MW
1697 goto out_free_skb;
1698
1699 if (skb_headroom(skb) < sizeof(*rthdr) &&
1700 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1701 goto out_free_skb;
1702
1703 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1704 memset(rthdr, 0, sizeof(*rthdr));
1705 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1706 rthdr->hdr.it_present =
1707 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1708 (1 << IEEE80211_RADIOTAP_RATE) |
1709 (1 << IEEE80211_RADIOTAP_CHANNEL));
1710
5cf121c3 1711 rthdr->rate = rx->rate->bitrate / 5;
3d30d949
MW
1712 rthdr->chan_freq = cpu_to_le16(status->freq);
1713
1714 if (status->band == IEEE80211_BAND_5GHZ)
1715 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1716 IEEE80211_CHAN_5GHZ);
1717 else
1718 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1719 IEEE80211_CHAN_2GHZ);
1720
1721 skb_set_mac_header(skb, 0);
1722 skb->ip_summed = CHECKSUM_UNNECESSARY;
1723 skb->pkt_type = PACKET_OTHERHOST;
1724 skb->protocol = htons(ETH_P_802_2);
1725
1726 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1727 if (!netif_running(sdata->dev))
1728 continue;
1729
05c914fe 1730 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3d30d949
MW
1731 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1732 continue;
1733
1734 if (prev_dev) {
1735 skb2 = skb_clone(skb, GFP_ATOMIC);
1736 if (skb2) {
1737 skb2->dev = prev_dev;
1738 netif_rx(skb2);
1739 }
1740 }
1741
1742 prev_dev = sdata->dev;
1743 sdata->dev->stats.rx_packets++;
1744 sdata->dev->stats.rx_bytes += skb->len;
1745 }
1746
1747 if (prev_dev) {
1748 skb->dev = prev_dev;
1749 netif_rx(skb);
1750 skb = NULL;
1751 } else
1752 goto out_free_skb;
1753
5cf121c3 1754 rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
3d30d949
MW
1755 return;
1756
1757 out_free_skb:
1758 dev_kfree_skb(skb);
1759}
1760
571ecf67 1761
8944b79f 1762static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
5cf121c3 1763 struct ieee80211_rx_data *rx,
8944b79f 1764 struct sk_buff *skb)
58905290 1765{
58905290
JB
1766 ieee80211_rx_result res = RX_DROP_MONITOR;
1767
8944b79f
JB
1768 rx->skb = skb;
1769 rx->sdata = sdata;
1770 rx->dev = sdata->dev;
1771
e32f85f7
LCC
1772#define CALL_RXH(rxh) \
1773 do { \
1774 res = rxh(rx); \
1775 if (res != RX_CONTINUE) \
1776 goto rxh_done; \
1777 } while (0);
49461622
JB
1778
1779 CALL_RXH(ieee80211_rx_h_passive_scan)
1780 CALL_RXH(ieee80211_rx_h_check)
1781 CALL_RXH(ieee80211_rx_h_decrypt)
1782 CALL_RXH(ieee80211_rx_h_sta_process)
1783 CALL_RXH(ieee80211_rx_h_defragment)
1784 CALL_RXH(ieee80211_rx_h_ps_poll)
1785 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
1786 /* must be after MMIC verify so header is counted in MPDU mic */
1787 CALL_RXH(ieee80211_rx_h_remove_qos_control)
1788 CALL_RXH(ieee80211_rx_h_amsdu)
bf94e17b 1789#ifdef CONFIG_MAC80211_MESH
e32f85f7
LCC
1790 if (ieee80211_vif_is_mesh(&sdata->vif))
1791 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 1792#endif
49461622
JB
1793 CALL_RXH(ieee80211_rx_h_data)
1794 CALL_RXH(ieee80211_rx_h_ctrl)
de1ede7a 1795 CALL_RXH(ieee80211_rx_h_action)
49461622
JB
1796 CALL_RXH(ieee80211_rx_h_mgmt)
1797
1798#undef CALL_RXH
1799
1800 rxh_done:
58905290
JB
1801 switch (res) {
1802 case RX_DROP_MONITOR:
49461622
JB
1803 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1804 if (rx->sta)
1805 rx->sta->rx_dropped++;
1806 /* fall through */
1807 case RX_CONTINUE:
3d30d949
MW
1808 ieee80211_rx_cooked_monitor(rx);
1809 break;
58905290 1810 case RX_DROP_UNUSABLE:
49461622
JB
1811 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1812 if (rx->sta)
1813 rx->sta->rx_dropped++;
58905290
JB
1814 dev_kfree_skb(rx->skb);
1815 break;
49461622
JB
1816 case RX_QUEUED:
1817 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1818 break;
58905290
JB
1819 }
1820}
1821
571ecf67
JB
1822/* main receive path */
1823
23a24def 1824static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
5cf121c3 1825 u8 *bssid, struct ieee80211_rx_data *rx,
23a24def
JB
1826 struct ieee80211_hdr *hdr)
1827{
1828 int multicast = is_multicast_ether_addr(hdr->addr1);
1829
51fb61e7 1830 switch (sdata->vif.type) {
05c914fe 1831 case NL80211_IFTYPE_STATION:
23a24def
JB
1832 if (!bssid)
1833 return 0;
1834 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
5cf121c3 1835 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
23a24def 1836 return 0;
5cf121c3 1837 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def
JB
1838 } else if (!multicast &&
1839 compare_ether_addr(sdata->dev->dev_addr,
1840 hdr->addr1) != 0) {
4150c572 1841 if (!(sdata->dev->flags & IFF_PROMISC))
23a24def 1842 return 0;
5cf121c3 1843 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def
JB
1844 }
1845 break;
05c914fe 1846 case NL80211_IFTYPE_ADHOC:
23a24def
JB
1847 if (!bssid)
1848 return 0;
a7767f95 1849 if (ieee80211_is_beacon(hdr->frame_control)) {
9d9bf77d 1850 return 1;
87291c02 1851 }
9d9bf77d 1852 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
5cf121c3 1853 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
23a24def 1854 return 0;
5cf121c3 1855 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def
JB
1856 } else if (!multicast &&
1857 compare_ether_addr(sdata->dev->dev_addr,
1858 hdr->addr1) != 0) {
4150c572 1859 if (!(sdata->dev->flags & IFF_PROMISC))
23a24def 1860 return 0;
5cf121c3 1861 rx->flags &= ~IEEE80211_RX_RA_MATCH;
0fb8ca45
JM
1862 } else if (!rx->sta) {
1863 int rate_idx;
1864 if (rx->status->flag & RX_FLAG_HT)
1865 rate_idx = 0; /* TODO: HT rates */
1866 else
1867 rate_idx = rx->status->rate_idx;
ab1f5c0b 1868 rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
0fb8ca45
JM
1869 BIT(rate_idx));
1870 }
23a24def 1871 break;
05c914fe 1872 case NL80211_IFTYPE_MESH_POINT:
6032f934
JB
1873 if (!multicast &&
1874 compare_ether_addr(sdata->dev->dev_addr,
1875 hdr->addr1) != 0) {
1876 if (!(sdata->dev->flags & IFF_PROMISC))
1877 return 0;
1878
5cf121c3 1879 rx->flags &= ~IEEE80211_RX_RA_MATCH;
6032f934
JB
1880 }
1881 break;
05c914fe
JB
1882 case NL80211_IFTYPE_AP_VLAN:
1883 case NL80211_IFTYPE_AP:
23a24def
JB
1884 if (!bssid) {
1885 if (compare_ether_addr(sdata->dev->dev_addr,
1886 hdr->addr1))
1887 return 0;
1888 } else if (!ieee80211_bssid_match(bssid,
1889 sdata->dev->dev_addr)) {
5cf121c3 1890 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
23a24def 1891 return 0;
5cf121c3 1892 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def 1893 }
23a24def 1894 break;
05c914fe 1895 case NL80211_IFTYPE_WDS:
a7767f95 1896 if (bssid || !ieee80211_is_data(hdr->frame_control))
23a24def
JB
1897 return 0;
1898 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1899 return 0;
1900 break;
05c914fe 1901 case NL80211_IFTYPE_MONITOR:
fb1c1cd6
JB
1902 /* take everything */
1903 break;
05c914fe
JB
1904 case NL80211_IFTYPE_UNSPECIFIED:
1905 case __NL80211_IFTYPE_AFTER_LAST:
fb1c1cd6
JB
1906 /* should never get here */
1907 WARN_ON(1);
1908 break;
23a24def
JB
1909 }
1910
1911 return 1;
1912}
1913
571ecf67 1914/*
6368e4b1
RR
1915 * This is the actual Rx frames handler. as it blongs to Rx path it must
1916 * be called with rcu_read_lock protection.
571ecf67 1917 */
71ebb4aa
RR
1918static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
1919 struct sk_buff *skb,
1920 struct ieee80211_rx_status *status,
8318d78a 1921 struct ieee80211_rate *rate)
571ecf67
JB
1922{
1923 struct ieee80211_local *local = hw_to_local(hw);
1924 struct ieee80211_sub_if_data *sdata;
571ecf67 1925 struct ieee80211_hdr *hdr;
5cf121c3 1926 struct ieee80211_rx_data rx;
6368e4b1 1927 int prepares;
8e6f0032
JB
1928 struct ieee80211_sub_if_data *prev = NULL;
1929 struct sk_buff *skb_new;
1930 u8 *bssid;
571ecf67 1931
358c8d9d 1932 hdr = (struct ieee80211_hdr *)skb->data;
571ecf67
JB
1933 memset(&rx, 0, sizeof(rx));
1934 rx.skb = skb;
1935 rx.local = local;
1936
5cf121c3 1937 rx.status = status;
5cf121c3 1938 rx.rate = rate;
72abd81b 1939
358c8d9d 1940 if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
571ecf67 1941 local->dot11ReceivedFragmentCount++;
571ecf67 1942
8944b79f
JB
1943 rx.sta = sta_info_get(local, hdr->addr2);
1944 if (rx.sta) {
d0709a65
JB
1945 rx.sdata = rx.sta->sdata;
1946 rx.dev = rx.sta->sdata->dev;
b2e7771e 1947 }
571ecf67 1948
571ecf67 1949 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
8944b79f 1950 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
d0709a65 1951 return;
571ecf67
JB
1952 }
1953
c2b13452 1954 if (unlikely(local->sw_scanning || local->hw_scanning))
5cf121c3 1955 rx.flags |= IEEE80211_RX_IN_SCAN;
571ecf67 1956
38f3714d
JB
1957 ieee80211_parse_qos(&rx);
1958 ieee80211_verify_ip_alignment(&rx);
1959
571ecf67
JB
1960 skb = rx.skb;
1961
79010420 1962 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2a8a9a88
JB
1963 if (!netif_running(sdata->dev))
1964 continue;
1965
05c914fe 1966 if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
b2e7771e
JB
1967 continue;
1968
51fb61e7 1969 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
5cf121c3 1970 rx.flags |= IEEE80211_RX_RA_MATCH;
6368e4b1 1971 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
23a24def 1972
6368e4b1 1973 if (!prepares)
23a24def 1974 continue;
8e6f0032 1975
340e11f3
JB
1976 /*
1977 * frame is destined for this interface, but if it's not
1978 * also for the previous one we handle that after the
1979 * loop to avoid copying the SKB once too much
1980 */
1981
1982 if (!prev) {
1983 prev = sdata;
1984 continue;
8e6f0032 1985 }
340e11f3
JB
1986
1987 /*
1988 * frame was destined for the previous interface
1989 * so invoke RX handlers for it
1990 */
1991
1992 skb_new = skb_copy(skb, GFP_ATOMIC);
1993 if (!skb_new) {
1994 if (net_ratelimit())
1995 printk(KERN_DEBUG "%s: failed to copy "
a4278e18 1996 "multicast frame for %s\n",
dd1cd4c6
JB
1997 wiphy_name(local->hw.wiphy),
1998 prev->dev->name);
340e11f3
JB
1999 continue;
2000 }
8944b79f 2001 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
8e6f0032 2002 prev = sdata;
571ecf67 2003 }
a4b7d7bd 2004 if (prev)
8944b79f 2005 ieee80211_invoke_rx_handlers(prev, &rx, skb);
a4b7d7bd 2006 else
8e6f0032 2007 dev_kfree_skb(skb);
571ecf67 2008}
6368e4b1 2009
b580781e
RR
2010#define SEQ_MODULO 0x1000
2011#define SEQ_MASK 0xfff
2012
2013static inline int seq_less(u16 sq1, u16 sq2)
2014{
c6a1fa12 2015 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
b580781e
RR
2016}
2017
2018static inline u16 seq_inc(u16 sq)
2019{
c6a1fa12 2020 return (sq + 1) & SEQ_MASK;
b580781e
RR
2021}
2022
2023static inline u16 seq_sub(u16 sq1, u16 sq2)
2024{
c6a1fa12 2025 return (sq1 - sq2) & SEQ_MASK;
b580781e
RR
2026}
2027
2028
71364716
RR
2029/*
2030 * As it function blongs to Rx path it must be called with
2031 * the proper rcu_read_lock protection for its flow.
2032 */
c6a1fa12
JB
2033static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2034 struct tid_ampdu_rx *tid_agg_rx,
2035 struct sk_buff *skb,
2036 u16 mpdu_seq_num,
2037 int bar_req)
b580781e
RR
2038{
2039 struct ieee80211_local *local = hw_to_local(hw);
2040 struct ieee80211_rx_status status;
2041 u16 head_seq_num, buf_size;
2042 int index;
8318d78a
JB
2043 struct ieee80211_supported_band *sband;
2044 struct ieee80211_rate *rate;
b580781e
RR
2045
2046 buf_size = tid_agg_rx->buf_size;
2047 head_seq_num = tid_agg_rx->head_seq_num;
2048
2049 /* frame with out of date sequence number */
2050 if (seq_less(mpdu_seq_num, head_seq_num)) {
2051 dev_kfree_skb(skb);
2052 return 1;
2053 }
2054
2055 /* if frame sequence number exceeds our buffering window size or
2056 * block Ack Request arrived - release stored frames */
2057 if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2058 /* new head to the ordering buffer */
2059 if (bar_req)
2060 head_seq_num = mpdu_seq_num;
2061 else
2062 head_seq_num =
2063 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2064 /* release stored frames up to new head to stack */
2065 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2066 index = seq_sub(tid_agg_rx->head_seq_num,
2067 tid_agg_rx->ssn)
2068 % tid_agg_rx->buf_size;
2069
2070 if (tid_agg_rx->reorder_buf[index]) {
2071 /* release the reordered frames to stack */
2072 memcpy(&status,
2073 tid_agg_rx->reorder_buf[index]->cb,
2074 sizeof(status));
8318d78a 2075 sband = local->hw.wiphy->bands[status.band];
0fb8ca45
JM
2076 if (status.flag & RX_FLAG_HT) {
2077 /* TODO: HT rates */
2078 rate = sband->bitrates;
2079 } else {
2080 rate = &sband->bitrates
2081 [status.rate_idx];
2082 }
b580781e
RR
2083 __ieee80211_rx_handle_packet(hw,
2084 tid_agg_rx->reorder_buf[index],
9e72ebd6 2085 &status, rate);
b580781e
RR
2086 tid_agg_rx->stored_mpdu_num--;
2087 tid_agg_rx->reorder_buf[index] = NULL;
2088 }
2089 tid_agg_rx->head_seq_num =
2090 seq_inc(tid_agg_rx->head_seq_num);
2091 }
2092 if (bar_req)
2093 return 1;
2094 }
2095
2096 /* now the new frame is always in the range of the reordering */
2097 /* buffer window */
2098 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2099 % tid_agg_rx->buf_size;
2100 /* check if we already stored this frame */
2101 if (tid_agg_rx->reorder_buf[index]) {
2102 dev_kfree_skb(skb);
2103 return 1;
2104 }
2105
2106 /* if arrived mpdu is in the right order and nothing else stored */
2107 /* release it immediately */
2108 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2109 tid_agg_rx->stored_mpdu_num == 0) {
2110 tid_agg_rx->head_seq_num =
2111 seq_inc(tid_agg_rx->head_seq_num);
2112 return 0;
2113 }
2114
2115 /* put the frame in the reordering buffer */
2116 tid_agg_rx->reorder_buf[index] = skb;
2117 tid_agg_rx->stored_mpdu_num++;
2118 /* release the buffer until next missing frame */
2119 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2120 % tid_agg_rx->buf_size;
2121 while (tid_agg_rx->reorder_buf[index]) {
2122 /* release the reordered frame back to stack */
2123 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2124 sizeof(status));
8318d78a 2125 sband = local->hw.wiphy->bands[status.band];
0fb8ca45
JM
2126 if (status.flag & RX_FLAG_HT)
2127 rate = sband->bitrates; /* TODO: HT rates */
2128 else
2129 rate = &sband->bitrates[status.rate_idx];
b580781e 2130 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
9e72ebd6 2131 &status, rate);
b580781e
RR
2132 tid_agg_rx->stored_mpdu_num--;
2133 tid_agg_rx->reorder_buf[index] = NULL;
2134 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2135 index = seq_sub(tid_agg_rx->head_seq_num,
2136 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2137 }
2138 return 1;
2139}
2140
71ebb4aa
RR
2141static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2142 struct sk_buff *skb)
b580781e
RR
2143{
2144 struct ieee80211_hw *hw = &local->hw;
2145 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2146 struct sta_info *sta;
2147 struct tid_ampdu_rx *tid_agg_rx;
87228f57 2148 u16 sc;
b580781e 2149 u16 mpdu_seq_num;
182503ab 2150 u8 ret = 0;
b580781e
RR
2151 int tid;
2152
2153 sta = sta_info_get(local, hdr->addr2);
2154 if (!sta)
2155 return ret;
2156
b580781e
RR
2157 /* filter the QoS data rx stream according to
2158 * STA/TID and check if this STA/TID is on aggregation */
87228f57 2159 if (!ieee80211_is_data_qos(hdr->frame_control))
b580781e
RR
2160 goto end_reorder;
2161
238f74a2 2162 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
b580781e 2163
cee24a3e 2164 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
b580781e
RR
2165 goto end_reorder;
2166
cee24a3e
RR
2167 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2168
2560b6e2
EG
2169 /* qos null data frames are excluded */
2170 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
b580781e
RR
2171 goto end_reorder;
2172
2173 /* new un-ordered ampdu frame - process it */
2174
2175 /* reset session timer */
2176 if (tid_agg_rx->timeout) {
2177 unsigned long expires =
2178 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
2179 mod_timer(&tid_agg_rx->session_timer, expires);
2180 }
2181
2182 /* if this mpdu is fragmented - terminate rx aggregation session */
2183 sc = le16_to_cpu(hdr->seq_ctrl);
2184 if (sc & IEEE80211_SCTL_FRAG) {
17741cdc 2185 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
b580781e
RR
2186 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2187 ret = 1;
2188 goto end_reorder;
2189 }
2190
2191 /* according to mpdu sequence number deal with reordering buffer */
2192 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2193 ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2194 mpdu_seq_num, 0);
d0709a65 2195 end_reorder:
b580781e
RR
2196 return ret;
2197}
2198
6368e4b1
RR
2199/*
2200 * This is the receive path handler. It is called by a low level driver when an
2201 * 802.11 MPDU is received from the hardware.
2202 */
2203void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2204 struct ieee80211_rx_status *status)
2205{
2206 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB
2207 struct ieee80211_rate *rate = NULL;
2208 struct ieee80211_supported_band *sband;
2209
2210 if (status->band < 0 ||
13d8fd2d 2211 status->band >= IEEE80211_NUM_BANDS) {
8318d78a
JB
2212 WARN_ON(1);
2213 return;
2214 }
2215
2216 sband = local->hw.wiphy->bands[status->band];
0fb8ca45 2217 if (!sband) {
8318d78a
JB
2218 WARN_ON(1);
2219 return;
2220 }
2221
0fb8ca45
JM
2222 if (status->flag & RX_FLAG_HT) {
2223 /* rate_idx is MCS index */
2224 if (WARN_ON(status->rate_idx < 0 ||
2225 status->rate_idx >= 76))
2226 return;
2227 /* HT rates are not in the table - use the highest legacy rate
2228 * for now since other parts of mac80211 may not yet be fully
2229 * MCS aware. */
2230 rate = &sband->bitrates[sband->n_bitrates - 1];
2231 } else {
2232 if (WARN_ON(status->rate_idx < 0 ||
2233 status->rate_idx >= sband->n_bitrates))
2234 return;
2235 rate = &sband->bitrates[status->rate_idx];
2236 }
6368e4b1
RR
2237
2238 /*
2239 * key references and virtual interfaces are protected using RCU
2240 * and this requires that we are in a read-side RCU section during
2241 * receive processing
2242 */
2243 rcu_read_lock();
2244
2245 /*
2246 * Frames with failed FCS/PLCP checksum are not returned,
2247 * all other frames are returned without radiotap header
2248 * if it was previously present.
2249 * Also, frames with less than 16 bytes are dropped.
2250 */
8318d78a 2251 skb = ieee80211_rx_monitor(local, skb, status, rate);
6368e4b1
RR
2252 if (!skb) {
2253 rcu_read_unlock();
2254 return;
2255 }
2256
b580781e 2257 if (!ieee80211_rx_reorder_ampdu(local, skb))
9e72ebd6 2258 __ieee80211_rx_handle_packet(hw, skb, status, rate);
6368e4b1
RR
2259
2260 rcu_read_unlock();
2261}
571ecf67
JB
2262EXPORT_SYMBOL(__ieee80211_rx);
2263
2264/* This is a version of the rx handler that can be called from hard irq
2265 * context. Post the skb on the queue and schedule the tasklet */
2266void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2267 struct ieee80211_rx_status *status)
2268{
2269 struct ieee80211_local *local = hw_to_local(hw);
2270
2271 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2272
2273 skb->dev = local->mdev;
2274 /* copy status into skb->cb for use by tasklet */
2275 memcpy(skb->cb, status, sizeof(*status));
2276 skb->pkt_type = IEEE80211_RX_MSG;
2277 skb_queue_tail(&local->skb_queue, skb);
2278 tasklet_schedule(&local->tasklet);
2279}
2280EXPORT_SYMBOL(ieee80211_rx_irqsafe);