]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blame - net/mac80211/rx.c
projects / mirror_ubuntu-hirsute-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
mac80211: fix comment regarding aggregation buf_size
[mirror_ubuntu-hirsute-kernel.git] / net / mac80211 / rx.c
CommitLineData
571ecf67
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
84040805 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
571ecf67
JB		 6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
ab46623e 12#include <linux/jiffies.h>
5a0e3ad6 13#include <linux/slab.h>
571ecf67
JB		 14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
d4e46a3d 18#include <linux/rcupdate.h>
571ecf67
JB		 19#include <net/mac80211.h>
20#include <net/ieee80211_radiotap.h>
21
22#include "ieee80211_i.h"
24487981 23#include "driver-ops.h"
2c8dccc7 24#include "led.h"
33b64eb2 25#include "mesh.h"
571ecf67
JB		 26#include "wep.h"
27#include "wpa.h"
28#include "tkip.h"
29#include "wme.h"
30
b2e7771e
JB		 31/*
32 * monitor mode reception
33 *
34 * This function cleans up the SKB, i.e. it removes all the stuff
35 * only useful for monitoring.
36 */
37static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
0869aea0 38 struct sk_buff *skb)
b2e7771e 39{
b2e7771e
JB		 40 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
41 if (likely(skb->len > FCS_LEN))
e3cf8b3f 42 __pskb_trim(skb, skb->len - FCS_LEN);
b2e7771e
JB		 43 else {
44 /* driver bug */
45 WARN_ON(1);
46 dev_kfree_skb(skb);
47 skb = NULL;
48 }
49 }
50
51 return skb;
52}
53
f1d58c25 54static inline int should_drop_frame(struct sk_buff *skb,
0869aea0 55 int present_fcs_len)
b2e7771e 56{
f1d58c25 57 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
182503ab 58 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
b2e7771e
JB		 59
60 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
61 return 1;
0869aea0 62 if (unlikely(skb->len < 16 + present_fcs_len))
b2e7771e 63 return 1;
87228f57
HH		 64 if (ieee80211_is_ctl(hdr->frame_control) &&
65 !ieee80211_is_pspoll(hdr->frame_control) &&
66 !ieee80211_is_back_req(hdr->frame_control))
b2e7771e
JB		 67 return 1;
68 return 0;
69}
70
601ae7f2
BR		 71static int
72ieee80211_rx_radiotap_len(struct ieee80211_local *local,
73 struct ieee80211_rx_status *status)
74{
75 int len;
76
77 /* always present fields */
78 len = sizeof(struct ieee80211_radiotap_header) + 9;
79
6ebacbb7 80 if (status->flag & RX_FLAG_MACTIME_MPDU)
601ae7f2 81 len += 8;
7fee5372 82 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
601ae7f2 83 len += 1;
601ae7f2
BR		 84
85 if (len & 1) /* padding for RX_FLAGS if necessary */
86 len++;
87
6d744bac
JB		 88 if (status->flag & RX_FLAG_HT) /* HT info */
89 len += 3;
90
601ae7f2
BR		 91 return len;
92}
93
d1c3a37c 94/*
601ae7f2
BR		 95 * ieee80211_add_rx_radiotap_header - add radiotap header
96 *
97 * add a radiotap header containing all the fields which the hardware provided.
98 */
99static void
100ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
101 struct sk_buff *skb,
601ae7f2
BR		 102 struct ieee80211_rate *rate,
103 int rtap_len)
104{
f1d58c25 105 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
601ae7f2
BR		 106 struct ieee80211_radiotap_header *rthdr;
107 unsigned char *pos;
6a86b9c7 108 u16 rx_flags = 0;
601ae7f2
BR		 109
110 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
111 memset(rthdr, 0, rtap_len);
112
113 /* radiotap header, set always present flags */
114 rthdr->it_present =
115 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
601ae7f2
BR		 116 (1 << IEEE80211_RADIOTAP_CHANNEL) |
117 (1 << IEEE80211_RADIOTAP_ANTENNA) |
118 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
119 rthdr->it_len = cpu_to_le16(rtap_len);
120
121 pos = (unsigned char *)(rthdr+1);
122
123 /* the order of the following fields is important */
124
125 /* IEEE80211_RADIOTAP_TSFT */
6ebacbb7 126 if (status->flag & RX_FLAG_MACTIME_MPDU) {
6a86b9c7 127 put_unaligned_le64(status->mactime, pos);
601ae7f2
BR		 128 rthdr->it_present |=
129 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
130 pos += 8;
131 }
132
133 /* IEEE80211_RADIOTAP_FLAGS */
134 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
135 *pos |= IEEE80211_RADIOTAP_F_FCS;
aae89831
JB		 136 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
137 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
b4f28bbb
BR		 138 if (status->flag & RX_FLAG_SHORTPRE)
139 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR		 140 pos++;
141
142 /* IEEE80211_RADIOTAP_RATE */
0fb8ca45
JM		 143 if (status->flag & RX_FLAG_HT) {
144 /*
38f37be2
MSS		 145 * MCS information is a separate field in radiotap,
146 * added below.
0fb8ca45
JM		 147 */
148 *pos = 0;
8d6f658e 149 } else {
ebe6c7ba 150 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
0fb8ca45 151 *pos = rate->bitrate / 5;
8d6f658e 152 }
601ae7f2
BR		 153 pos++;
154
155 /* IEEE80211_RADIOTAP_CHANNEL */
6a86b9c7 156 put_unaligned_le16(status->freq, pos);
601ae7f2
BR		 157 pos += 2;
158 if (status->band == IEEE80211_BAND_5GHZ)
6a86b9c7
JB		 159 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
160 pos);
5f0b7de5
JB		 161 else if (status->flag & RX_FLAG_HT)
162 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
163 pos);
9deb1ae5 164 else if (rate->flags & IEEE80211_RATE_ERP_G)
6a86b9c7
JB		 165 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
166 pos);
601ae7f2 167 else
6a86b9c7
JB		 168 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
169 pos);
601ae7f2
BR		 170 pos += 2;
171
172 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
173 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
174 *pos = status->signal;
175 rthdr->it_present |=
176 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
177 pos++;
178 }
179
601ae7f2
BR		 180 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
181
182 /* IEEE80211_RADIOTAP_ANTENNA */
183 *pos = status->antenna;
184 pos++;
185
601ae7f2
BR		 186 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
187
188 /* IEEE80211_RADIOTAP_RX_FLAGS */
189 /* ensure 2 byte alignment for the 2 byte field as required */
6a86b9c7 190 if ((pos - (u8 *)rthdr) & 1)
601ae7f2 191 pos++;
aae89831 192 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
6a86b9c7
JB		 193 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
194 put_unaligned_le16(rx_flags, pos);
601ae7f2 195 pos += 2;
6d744bac
JB		 196
197 if (status->flag & RX_FLAG_HT) {
198 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
199 *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
200 IEEE80211_RADIOTAP_MCS_HAVE_GI |
201 IEEE80211_RADIOTAP_MCS_HAVE_BW;
202 *pos = 0;
203 if (status->flag & RX_FLAG_SHORT_GI)
204 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
205 if (status->flag & RX_FLAG_40MHZ)
206 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
207 pos++;
208 *pos++ = status->rate_idx;
209 }
601ae7f2
BR		 210}
211
b2e7771e
JB		 212/*
213 * This function copies a received frame to all monitor interfaces and
214 * returns a cleaned-up SKB that no longer includes the FCS nor the
215 * radiotap header the driver might have added.
216 */
217static struct sk_buff *
218ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a 219 struct ieee80211_rate *rate)
b2e7771e 220{
f1d58c25 221 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
b2e7771e 222 struct ieee80211_sub_if_data *sdata;
b2e7771e 223 int needed_headroom = 0;
b2e7771e
JB		 224 struct sk_buff *skb, *skb2;
225 struct net_device *prev_dev = NULL;
226 int present_fcs_len = 0;
b2e7771e
JB		 227
228 /*
229 * First, we may need to make a copy of the skb because
230 * (1) we need to modify it for radiotap (if not present), and
231 * (2) the other RX handlers will modify the skb we got.
232 *
233 * We don't need to, of course, if we aren't going to return
234 * the SKB because it has a bad FCS/PLCP checksum.
235 */
0869aea0
JB		 236
237 /* room for the radiotap header based on driver features */
238 needed_headroom = ieee80211_rx_radiotap_len(local, status);
b2e7771e
JB		 239
240 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
241 present_fcs_len = FCS_LEN;
242
e3cf8b3f
ZY		 243 /* make sure hdr->frame_control is on the linear part */
244 if (!pskb_may_pull(origskb, 2)) {
245 dev_kfree_skb(origskb);
246 return NULL;
247 }
248
b2e7771e 249 if (!local->monitors) {
0869aea0 250 if (should_drop_frame(origskb, present_fcs_len)) {
b2e7771e
JB		 251 dev_kfree_skb(origskb);
252 return NULL;
253 }
254
0869aea0 255 return remove_monitor_info(local, origskb);
b2e7771e
JB		 256 }
257
0869aea0 258 if (should_drop_frame(origskb, present_fcs_len)) {
b2e7771e
JB		 259 /* only need to expand headroom if necessary */
260 skb = origskb;
261 origskb = NULL;
262
263 /*
264 * This shouldn't trigger often because most devices have an
265 * RX header they pull before we get here, and that should
266 * be big enough for our radiotap information. We should
267 * probably export the length to drivers so that we can have
268 * them allocate enough headroom to start with.
269 */
270 if (skb_headroom(skb) < needed_headroom &&
c49e5ea3 271 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
b2e7771e
JB		 272 dev_kfree_skb(skb);
273 return NULL;
274 }
275 } else {
276 /*
277 * Need to make a copy and possibly remove radiotap header
278 * and FCS from the original.
279 */
280 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
281
0869aea0 282 origskb = remove_monitor_info(local, origskb);
b2e7771e
JB		 283
284 if (!skb)
285 return origskb;
286 }
287
0869aea0
JB		 288 /* prepend radiotap information */
289 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
b2e7771e 290
ce3edf6d 291 skb_reset_mac_header(skb);
b2e7771e
JB		 292 skb->ip_summed = CHECKSUM_UNNECESSARY;
293 skb->pkt_type = PACKET_OTHERHOST;
294 skb->protocol = htons(ETH_P_802_2);
295
296 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
05c914fe 297 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
b2e7771e
JB		 298 continue;
299
3d30d949
MW		 300 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
301 continue;
302
9607e6b6 303 if (!ieee80211_sdata_running(sdata))
47846c9b
JB		 304 continue;
305
b2e7771e
JB		 306 if (prev_dev) {
307 skb2 = skb_clone(skb, GFP_ATOMIC);
308 if (skb2) {
309 skb2->dev = prev_dev;
5548a8a1 310 netif_receive_skb(skb2);
b2e7771e
JB		 311 }
312 }
313
314 prev_dev = sdata->dev;
315 sdata->dev->stats.rx_packets++;
316 sdata->dev->stats.rx_bytes += skb->len;
317 }
318
319 if (prev_dev) {
320 skb->dev = prev_dev;
5548a8a1 321 netif_receive_skb(skb);
b2e7771e
JB		 322 } else
323 dev_kfree_skb(skb);
324
325 return origskb;
326}
327
328
5cf121c3 329static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 330{
238f74a2 331 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 332 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
6e0d114d
JB		 333 int tid;
334
335 /* does the frame have a qos control field? */
238f74a2
HH		 336 if (ieee80211_is_data_qos(hdr->frame_control)) {
337 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 338 /* frame has qos control */
238f74a2
HH		 339 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
340 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
554891e6 341 status->rx_flags |= IEEE80211_RX_AMSDU;
6e0d114d 342 } else {
1411f9b5
JB		 343 /*
344 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
345 *
346 * Sequence numbers for management frames, QoS data
347 * frames with a broadcast/multicast address in the
348 * Address 1 field, and all non-QoS data frames sent
349 * by QoS STAs are assigned using an additional single
350 * modulo-4096 counter, [...]
351 *
352 * We also use that counter for non-QoS STAs.
353 */
354 tid = NUM_RX_DATA_QUEUES - 1;
6e0d114d 355 }
52865dfd 356
5cf121c3 357 rx->queue = tid;
6e0d114d
JB		 358 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
359 * For now, set skb->priority to 0 for other cases. */
360 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 361}
6e0d114d 362
d1c3a37c
JB		 363/**
364 * DOC: Packet alignment
365 *
366 * Drivers always need to pass packets that are aligned to two-byte boundaries
367 * to the stack.
368 *
369 * Additionally, should, if possible, align the payload data in a way that
370 * guarantees that the contained IP header is aligned to a four-byte
371 * boundary. In the case of regular frames, this simply means aligning the
372 * payload to a four-byte boundary (because either the IP header is directly
373 * contained, or IV/RFC1042 headers that have a length divisible by four are
59d9cb07
KV		 374 * in front of it). If the payload data is not properly aligned and the
375 * architecture doesn't support efficient unaligned operations, mac80211
376 * will align the data.
d1c3a37c
JB		 377 *
378 * With A-MSDU frames, however, the payload data address must yield two modulo
379 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
380 * push the IP header further back to a multiple of four again. Thankfully, the
381 * specs were sane enough this time around to require padding each A-MSDU
382 * subframe to a length that is a multiple of four.
383 *
384 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
385 * the payload is not supported, the driver is required to move the 802.11
386 * header to be directly in front of the payload in that case.
387 */
388static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
38f3714d 389{
59d9cb07
KV		 390#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
391 WARN_ONCE((unsigned long)rx->skb->data & 1,
392 "unaligned packet at 0x%p\n", rx->skb->data);
d1c3a37c 393#endif
6e0d114d
JB		 394}
395
6368e4b1 396
571ecf67
JB		 397/* rx handlers */
398
49461622 399static ieee80211_rx_result debug_noinline
5cf121c3 400ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
571ecf67
JB		 401{
402 struct ieee80211_local *local = rx->local;
554891e6 403 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67
JB		 404 struct sk_buff *skb = rx->skb;
405
554891e6 406 if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
4080c7cd
JB		 407 return RX_CONTINUE;
408
b23b025f
BG		 409 if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
410 test_bit(SCAN_SW_SCANNING, &local->scanning))
f1d58c25 411 return ieee80211_scan_rx(rx->sdata, skb);
ece8eddd 412
4080c7cd
JB		 413 /* scanning finished during invoking of handlers */
414 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
415 return RX_DROP_UNUSABLE;
571ecf67
JB		 416}
417
3cfcf6ac
JM		 418
419static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
420{
421 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
422
423 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
424 return 0;
425
426 return ieee80211_is_robust_mgmt_frame(hdr);
427}
428
429
430static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
431{
432 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
433
434 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
435 return 0;
436
437 return ieee80211_is_robust_mgmt_frame(hdr);
438}
439
440
441/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
442static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
443{
444 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
445 struct ieee80211_mmie *mmie;
446
447 if (skb->len < 24 + sizeof(*mmie) ||
448 !is_multicast_ether_addr(hdr->da))
449 return -1;
450
451 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
452 return -1; /* not a robust management frame */
453
454 mmie = (struct ieee80211_mmie *)
455 (skb->data + skb->len - sizeof(*mmie));
456 if (mmie->element_id != WLAN_EID_MMIE ||
457 mmie->length != sizeof(*mmie) - 2)
458 return -1;
459
460 return le16_to_cpu(mmie->key_id);
461}
462
463
33b64eb2 464static ieee80211_rx_result
5cf121c3 465ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 466{
a7767f95
HH		 467 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
468 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
47846c9b 469 char *dev_addr = rx->sdata->vif.addr;
d6d1a5a7 470
a7767f95 471 if (ieee80211_is_data(hdr->frame_control)) {
3c5772a5
JC		 472 if (is_multicast_ether_addr(hdr->addr1)) {
473 if (ieee80211_has_tods(hdr->frame_control) ||
474 !ieee80211_has_fromds(hdr->frame_control))
475 return RX_DROP_MONITOR;
476 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
477 return RX_DROP_MONITOR;
478 } else {
479 if (!ieee80211_has_a4(hdr->frame_control))
480 return RX_DROP_MONITOR;
481 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
482 return RX_DROP_MONITOR;
483 }
33b64eb2
LCC		 484 }
485
486 /* If there is not an established peer link and this is not a peer link
487 * establisment frame, beacon or probe, drop the frame.
488 */
489
b4e08ea1 490 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
33b64eb2 491 struct ieee80211_mgmt *mgmt;
d6d1a5a7 492
a7767f95 493 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC		 494 return RX_DROP_MONITOR;
495
a7767f95 496 if (ieee80211_is_action(hdr->frame_control)) {
33b64eb2 497 mgmt = (struct ieee80211_mgmt *)hdr;
97ad9139 498 if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
33b64eb2 499 return RX_DROP_MONITOR;
33b64eb2 500 return RX_CONTINUE;
33b64eb2
LCC		 501 }
502
a7767f95
HH		 503 if (ieee80211_is_probe_req(hdr->frame_control) ||
504 ieee80211_is_probe_resp(hdr->frame_control) ||
505 ieee80211_is_beacon(hdr->frame_control))
506 return RX_CONTINUE;
507
508 return RX_DROP_MONITOR;
509
510 }
511
512#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
513
514 if (ieee80211_is_data(hdr->frame_control) &&
515 is_multicast_ether_addr(hdr->addr1) &&
3c5772a5 516 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
33b64eb2 517 return RX_DROP_MONITOR;
902acc78 518#undef msh_h_get
d6d1a5a7 519
902acc78
JB		 520 return RX_CONTINUE;
521}
33b64eb2 522
1edfb1af
JB		 523#define SEQ_MODULO 0x1000
524#define SEQ_MASK 0xfff
525
526static inline int seq_less(u16 sq1, u16 sq2)
527{
528 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
529}
530
531static inline u16 seq_inc(u16 sq)
532{
533 return (sq + 1) & SEQ_MASK;
534}
535
536static inline u16 seq_sub(u16 sq1, u16 sq2)
537{
538 return (sq1 - sq2) & SEQ_MASK;
539}
540
541
542static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
543 struct tid_ampdu_rx *tid_agg_rx,
24a8fdad 544 int index)
1edfb1af 545{
24a8fdad 546 struct ieee80211_local *local = hw_to_local(hw);
1edfb1af 547 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
4cfda47b 548 struct ieee80211_rx_status *status;
1edfb1af 549
dd318575
JB		 550 lockdep_assert_held(&tid_agg_rx->reorder_lock);
551
1edfb1af
JB		 552 if (!skb)
553 goto no_frame;
554
071d9ac2 555 /* release the frame from the reorder ring buffer */
1edfb1af
JB		 556 tid_agg_rx->stored_mpdu_num--;
557 tid_agg_rx->reorder_buf[index] = NULL;
4cfda47b
CL		 558 status = IEEE80211_SKB_RXCB(skb);
559 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
24a8fdad 560 skb_queue_tail(&local->rx_skb_queue, skb);
1edfb1af
JB		 561
562no_frame:
563 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
564}
565
566static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
567 struct tid_ampdu_rx *tid_agg_rx,
24a8fdad 568 u16 head_seq_num)
1edfb1af
JB		 569{
570 int index;
571
dd318575
JB		 572 lockdep_assert_held(&tid_agg_rx->reorder_lock);
573
1edfb1af
JB		 574 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
575 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
576 tid_agg_rx->buf_size;
24a8fdad 577 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
1edfb1af
JB		 578 }
579}
580
581/*
582 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
583 * the skb was added to the buffer longer than this time ago, the earlier
584 * frames that have not yet been received are assumed to be lost and the skb
585 * can be released for processing. This may also release other skb's from the
586 * reorder buffer if there are no additional gaps between the frames.
2bff8ebf
CL		 587 *
588 * Callers must hold tid_agg_rx->reorder_lock.
1edfb1af
JB		 589 */
590#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
591
aa0c8636 592static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
24a8fdad 593 struct tid_ampdu_rx *tid_agg_rx)
aa0c8636 594{
2bff8ebf 595 int index, j;
aa0c8636 596
dd318575
JB		 597 lockdep_assert_held(&tid_agg_rx->reorder_lock);
598
aa0c8636
CL		 599 /* release the buffer until next missing frame */
600 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
601 tid_agg_rx->buf_size;
602 if (!tid_agg_rx->reorder_buf[index] &&
603 tid_agg_rx->stored_mpdu_num > 1) {
604 /*
605 * No buffers ready to be released, but check whether any
606 * frames in the reorder buffer have timed out.
607 */
aa0c8636
CL		 608 int skipped = 1;
609 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
610 j = (j + 1) % tid_agg_rx->buf_size) {
611 if (!tid_agg_rx->reorder_buf[j]) {
612 skipped++;
613 continue;
614 }
499fe9a4
DH		 615 if (skipped &&
616 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
aa0c8636 617 HT_RX_REORDER_BUF_TIMEOUT))
2bff8ebf 618 goto set_release_timer;
aa0c8636
CL		 619
620#ifdef CONFIG_MAC80211_HT_DEBUG
621 if (net_ratelimit())
0fb9a9ec
JP		 622 wiphy_debug(hw->wiphy,
623 "release an RX reorder frame due to timeout on earlier frames\n");
aa0c8636 624#endif
24a8fdad 625 ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
aa0c8636
CL		 626
627 /*
628 * Increment the head seq# also for the skipped slots.
629 */
630 tid_agg_rx->head_seq_num =
631 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
632 skipped = 0;
633 }
634 } else while (tid_agg_rx->reorder_buf[index]) {
24a8fdad 635 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
aa0c8636
CL		 636 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
637 tid_agg_rx->buf_size;
638 }
2bff8ebf
CL		 639
640 if (tid_agg_rx->stored_mpdu_num) {
641 j = index = seq_sub(tid_agg_rx->head_seq_num,
642 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
643
644 for (; j != (index - 1) % tid_agg_rx->buf_size;
645 j = (j + 1) % tid_agg_rx->buf_size) {
646 if (tid_agg_rx->reorder_buf[j])
647 break;
648 }
649
650 set_release_timer:
651
652 mod_timer(&tid_agg_rx->reorder_timer,
653 tid_agg_rx->reorder_time[j] +
654 HT_RX_REORDER_BUF_TIMEOUT);
655 } else {
656 del_timer(&tid_agg_rx->reorder_timer);
657 }
aa0c8636
CL		 658}
659
1edfb1af
JB		 660/*
661 * As this function belongs to the RX path it must be under
662 * rcu_read_lock protection. It returns false if the frame
663 * can be processed immediately, true if it was consumed.
664 */
665static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
666 struct tid_ampdu_rx *tid_agg_rx,
24a8fdad 667 struct sk_buff *skb)
1edfb1af
JB		 668{
669 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
670 u16 sc = le16_to_cpu(hdr->seq_ctrl);
671 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
672 u16 head_seq_num, buf_size;
673 int index;
2bff8ebf 674 bool ret = true;
1edfb1af 675
dd318575
JB		 676 spin_lock(&tid_agg_rx->reorder_lock);
677
1edfb1af
JB		 678 buf_size = tid_agg_rx->buf_size;
679 head_seq_num = tid_agg_rx->head_seq_num;
680
681 /* frame with out of date sequence number */
682 if (seq_less(mpdu_seq_num, head_seq_num)) {
683 dev_kfree_skb(skb);
2bff8ebf 684 goto out;
1edfb1af
JB		 685 }
686
687 /*
688 * If frame the sequence number exceeds our buffering window
689 * size release some previous frames to make room for this one.
690 */
691 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
692 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
693 /* release stored frames up to new head to stack */
24a8fdad 694 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
1edfb1af
JB		 695 }
696
697 /* Now the new frame is always in the range of the reordering buffer */
698
699 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
700
701 /* check if we already stored this frame */
702 if (tid_agg_rx->reorder_buf[index]) {
703 dev_kfree_skb(skb);
2bff8ebf 704 goto out;
1edfb1af
JB		 705 }
706
707 /*
708 * If the current MPDU is in the right order and nothing else
709 * is stored we can process it directly, no need to buffer it.
710 */
711 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
712 tid_agg_rx->stored_mpdu_num == 0) {
713 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2bff8ebf
CL		 714 ret = false;
715 goto out;
1edfb1af
JB		 716 }
717
718 /* put the frame in the reordering buffer */
719 tid_agg_rx->reorder_buf[index] = skb;
720 tid_agg_rx->reorder_time[index] = jiffies;
721 tid_agg_rx->stored_mpdu_num++;
24a8fdad 722 ieee80211_sta_reorder_release(hw, tid_agg_rx);
1edfb1af 723
2bff8ebf
CL		 724 out:
725 spin_unlock(&tid_agg_rx->reorder_lock);
726 return ret;
1edfb1af
JB		 727}
728
729/*
730 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
731 * true if the MPDU was buffered, false if it should be processed.
732 */
24a8fdad 733static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
1edfb1af 734{
2569a826
JB		 735 struct sk_buff *skb = rx->skb;
736 struct ieee80211_local *local = rx->local;
1edfb1af
JB		 737 struct ieee80211_hw *hw = &local->hw;
738 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2569a826 739 struct sta_info *sta = rx->sta;
1edfb1af
JB		 740 struct tid_ampdu_rx *tid_agg_rx;
741 u16 sc;
742 int tid;
743
744 if (!ieee80211_is_data_qos(hdr->frame_control))
2569a826 745 goto dont_reorder;
1edfb1af
JB		 746
747 /*
748 * filter the QoS data rx stream according to
749 * STA/TID and check if this STA/TID is on aggregation
750 */
751
1edfb1af 752 if (!sta)
2569a826 753 goto dont_reorder;
1edfb1af
JB		 754
755 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
756
a87f736d
JB		 757 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
758 if (!tid_agg_rx)
759 goto dont_reorder;
1edfb1af
JB		 760
761 /* qos null data frames are excluded */
762 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
a87f736d 763 goto dont_reorder;
1edfb1af
JB		 764
765 /* new, potentially un-ordered, ampdu frame - process it */
766
767 /* reset session timer */
768 if (tid_agg_rx->timeout)
769 mod_timer(&tid_agg_rx->session_timer,
770 TU_TO_EXP_TIME(tid_agg_rx->timeout));
771
772 /* if this mpdu is fragmented - terminate rx aggregation session */
773 sc = le16_to_cpu(hdr->seq_ctrl);
774 if (sc & IEEE80211_SCTL_FRAG) {
c1475ca9 775 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
344eec67
JB		 776 skb_queue_tail(&rx->sdata->skb_queue, skb);
777 ieee80211_queue_work(&local->hw, &rx->sdata->work);
2569a826 778 return;
1edfb1af
JB		 779 }
780
a87f736d
JB		 781 /*
782 * No locking needed -- we will only ever process one
783 * RX packet at a time, and thus own tid_agg_rx. All
784 * other code manipulating it needs to (and does) make
785 * sure that we cannot get to it any more before doing
786 * anything with it.
787 */
24a8fdad 788 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
2569a826
JB		 789 return;
790
791 dont_reorder:
24a8fdad 792 skb_queue_tail(&local->rx_skb_queue, skb);
1edfb1af 793}
33b64eb2 794
49461622 795static ieee80211_rx_result debug_noinline
5cf121c3 796ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
571ecf67 797{
a7767f95 798 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 799 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67
JB		 800
801 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
802 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
a7767f95 803 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
5cf121c3 804 rx->sta->last_seq_ctrl[rx->queue] ==
571ecf67 805 hdr->seq_ctrl)) {
554891e6 806 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
571ecf67
JB		 807 rx->local->dot11FrameDuplicateCount++;
808 rx->sta->num_duplicates++;
809 }
b1f93314 810 return RX_DROP_UNUSABLE;
571ecf67 811 } else
5cf121c3 812 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
571ecf67
JB		 813 }
814
571ecf67
JB		 815 if (unlikely(rx->skb->len < 16)) {
816 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
e4c26add 817 return RX_DROP_MONITOR;
571ecf67
JB		 818 }
819
571ecf67
JB		 820 /* Drop disallowed frame classes based on STA auth/assoc state;
821 * IEEE 802.11, Chap 5.5.
822 *
ccd7b362
JB		 823 * mac80211 filters only based on association state, i.e. it drops
824 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB		 825 * deauth/disassoc frames when needed. In addition, hostapd is
826 * responsible for filtering on both auth and assoc states.
827 */
33b64eb2 828
902acc78 829 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 830 return ieee80211_rx_mesh_check(rx);
33b64eb2 831
a7767f95
HH		 832 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
833 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 834 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1be7fe8d 835 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
0c2530ce 836 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC))))
e4c26add 837 return RX_DROP_MONITOR;
571ecf67 838
9ae54c84 839 return RX_CONTINUE;
570bd537
JB		 840}
841
842
49461622 843static ieee80211_rx_result debug_noinline
5cf121c3 844ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
570bd537 845{
eb9fb5b8
JB		 846 struct sk_buff *skb = rx->skb;
847 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
848 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3017b80b
JB		 849 int keyidx;
850 int hdrlen;
e4c26add 851 ieee80211_rx_result result = RX_DROP_UNUSABLE;
e31b8213 852 struct ieee80211_key *sta_ptk = NULL;
3cfcf6ac 853 int mmie_keyidx = -1;
761ab470 854 __le16 fc;
570bd537 855
3017b80b
JB		 856 /*
857 * Key selection 101
858 *
3cfcf6ac 859 * There are four types of keys:
3017b80b 860 * - GTK (group keys)
3cfcf6ac 861 * - IGTK (group keys for management frames)
3017b80b
JB		 862 * - PTK (pairwise keys)
863 * - STK (station-to-station pairwise keys)
864 *
865 * When selecting a key, we have to distinguish between multicast
866 * (including broadcast) and unicast frames, the latter can only
3cfcf6ac
JM		 867 * use PTKs and STKs while the former always use GTKs and IGTKs.
868 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
869 * unicast frames can also use key indices like GTKs. Hence, if we
870 * don't have a PTK/STK we check the key index for a WEP key.
3017b80b 871 *
8dc06a1c
JB		 872 * Note that in a regular BSS, multicast frames are sent by the
873 * AP only, associated stations unicast the frame to the AP first
874 * which then multicasts it on their behalf.
875 *
3017b80b
JB		 876 * There is also a slight problem in IBSS mode: GTKs are negotiated
877 * with each station, that is something we don't currently handle.
8dc06a1c
JB		 878 * The spec seems to expect that one negotiates the same key with
879 * every station but there's no such requirement; VLANs could be
880 * possible.
3017b80b
JB		 881 */
882
3017b80b 883 /*
1990af8d 884 * No point in finding a key and decrypting if the frame is neither
3017b80b
JB		 885 * addressed to us nor a multicast frame.
886 */
554891e6 887 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
9ae54c84 888 return RX_CONTINUE;
3017b80b 889
2569a826
JB		 890 /* start without a key */
891 rx->key = NULL;
892
d4e46a3d 893 if (rx->sta)
e31b8213 894 sta_ptk = rcu_dereference(rx->sta->ptk);
d4e46a3d 895
761ab470
JB		 896 fc = hdr->frame_control;
897
898 if (!ieee80211_has_protected(fc))
0c7c10c7
JM		 899 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
900
e31b8213
JB		 901 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
902 rx->key = sta_ptk;
dc1580dd
JB		 903 if ((status->flag & RX_FLAG_DECRYPTED) &&
904 (status->flag & RX_FLAG_IV_STRIPPED))
905 return RX_CONTINUE;
0c7c10c7 906 /* Skip decryption if the frame is not protected. */
761ab470 907 if (!ieee80211_has_protected(fc))
0c7c10c7 908 return RX_CONTINUE;
3cfcf6ac
JM		 909 } else if (mmie_keyidx >= 0) {
910 /* Broadcast/multicast robust management frame / BIP */
eb9fb5b8
JB		 911 if ((status->flag & RX_FLAG_DECRYPTED) &&
912 (status->flag & RX_FLAG_IV_STRIPPED))
3cfcf6ac
JM		 913 return RX_CONTINUE;
914
915 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
916 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
917 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
e31b8213
JB		 918 if (rx->sta)
919 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
920 if (!rx->key)
921 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
761ab470 922 } else if (!ieee80211_has_protected(fc)) {
0c7c10c7
JM		 923 /*
924 * The frame was not protected, so skip decryption. However, we
925 * need to set rx->key if there is a key that could have been
926 * used so that the frame may be dropped if encryption would
927 * have been expected.
928 */
929 struct ieee80211_key *key = NULL;
897bed8b
JB		 930 struct ieee80211_sub_if_data *sdata = rx->sdata;
931 int i;
932
761ab470 933 if (ieee80211_is_mgmt(fc) &&
0c7c10c7
JM		 934 is_multicast_ether_addr(hdr->addr1) &&
935 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
936 rx->key = key;
897bed8b
JB		 937 else {
938 if (rx->sta) {
939 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
940 key = rcu_dereference(rx->sta->gtk[i]);
941 if (key)
942 break;
943 }
944 }
945 if (!key) {
946 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
947 key = rcu_dereference(sdata->keys[i]);
948 if (key)
949 break;
950 }
951 }
952 if (key)
953 rx->key = key;
954 }
0c7c10c7 955 return RX_CONTINUE;
571ecf67 956 } else {
39184b15 957 u8 keyid;
3017b80b
JB		 958 /*
959 * The device doesn't give us the IV so we won't be
960 * able to look up the key. That's ok though, we
961 * don't need to decrypt the frame, we just won't
962 * be able to keep statistics accurate.
963 * Except for key threshold notifications, should
964 * we somehow allow the driver to tell us which key
965 * the hardware used if this flag is set?
966 */
eb9fb5b8
JB		 967 if ((status->flag & RX_FLAG_DECRYPTED) &&
968 (status->flag & RX_FLAG_IV_STRIPPED))
9ae54c84 969 return RX_CONTINUE;
3017b80b 970
761ab470 971 hdrlen = ieee80211_hdrlen(fc);
3017b80b
JB		 972
973 if (rx->skb->len < 8 + hdrlen)
e4c26add 974 return RX_DROP_UNUSABLE; /* TODO: count this? */
3017b80b
JB		 975
976 /*
977 * no need to call ieee80211_wep_get_keyidx,
978 * it verifies a bunch of things we've done already
979 */
39184b15
ZY		 980 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
981 keyidx = keyid >> 6;
3017b80b 982
e31b8213
JB		 983 /* check per-station GTK first, if multicast packet */
984 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
985 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
3017b80b 986
e31b8213
JB		 987 /* if not found, try default key */
988 if (!rx->key) {
989 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
990
991 /*
992 * RSNA-protected unicast frames should always be
993 * sent with pairwise or station-to-station keys,
994 * but for WEP we allow using a key index as well.
995 */
996 if (rx->key &&
997 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
998 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
999 !is_multicast_ether_addr(hdr->addr1))
1000 rx->key = NULL;
1001 }
571ecf67
JB		 1002 }
1003
3017b80b 1004 if (rx->key) {
571ecf67 1005 rx->key->tx_rx_count++;
011bfcc4 1006 /* TODO: add threshold stuff again */
1990af8d 1007 } else {
e4c26add 1008 return RX_DROP_MONITOR;
70f08765
JB		 1009 }
1010
39184b15
ZY		 1011 if (skb_linearize(rx->skb))
1012 return RX_DROP_UNUSABLE;
761ab470 1013 /* the hdr variable is invalid now! */
1990af8d 1014
97359d12
JB		 1015 switch (rx->key->conf.cipher) {
1016 case WLAN_CIPHER_SUITE_WEP40:
1017 case WLAN_CIPHER_SUITE_WEP104:
761ab470
JB		 1018 /* Check for weak IVs if possible */
1019 if (rx->sta && ieee80211_is_data(fc) &&
1020 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
1021 !(status->flag & RX_FLAG_DECRYPTED)) &&
1022 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
1023 rx->sta->wep_weak_iv_count++;
1024
e2f036da
MN		 1025 result = ieee80211_crypto_wep_decrypt(rx);
1026 break;
97359d12 1027 case WLAN_CIPHER_SUITE_TKIP:
e2f036da
MN		 1028 result = ieee80211_crypto_tkip_decrypt(rx);
1029 break;
97359d12 1030 case WLAN_CIPHER_SUITE_CCMP:
e2f036da
MN		 1031 result = ieee80211_crypto_ccmp_decrypt(rx);
1032 break;
97359d12 1033 case WLAN_CIPHER_SUITE_AES_CMAC:
3cfcf6ac
JM		 1034 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1035 break;
3ffc2a90
JB		 1036 default:
1037 /*
1038 * We can reach here only with HW-only algorithms
1039 * but why didn't it decrypt the frame?!
1040 */
1041 return RX_DROP_UNUSABLE;
70f08765
JB		 1042 }
1043
e2f036da 1044 /* either the frame has been decrypted or will be dropped */
eb9fb5b8 1045 status->flag |= RX_FLAG_DECRYPTED;
e2f036da
MN		 1046
1047 return result;
70f08765
JB		 1048}
1049
572e0012
KV		 1050static ieee80211_rx_result debug_noinline
1051ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1052{
1053 struct ieee80211_local *local;
1054 struct ieee80211_hdr *hdr;
1055 struct sk_buff *skb;
1056
1057 local = rx->local;
1058 skb = rx->skb;
1059 hdr = (struct ieee80211_hdr *) skb->data;
1060
1061 if (!local->pspolling)
1062 return RX_CONTINUE;
1063
1064 if (!ieee80211_has_fromds(hdr->frame_control))
1065 /* this is not from AP */
1066 return RX_CONTINUE;
1067
1068 if (!ieee80211_is_data(hdr->frame_control))
1069 return RX_CONTINUE;
1070
1071 if (!ieee80211_has_moredata(hdr->frame_control)) {
1072 /* AP has no more frames buffered for us */
1073 local->pspolling = false;
1074 return RX_CONTINUE;
1075 }
1076
1077 /* more data bit is set, let's request a new frame from the AP */
1078 ieee80211_send_pspoll(local, rx->sdata);
1079
1080 return RX_CONTINUE;
1081}
1082
133b8226 1083static void ap_sta_ps_start(struct sta_info *sta)
571ecf67 1084{
133b8226 1085 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 1086 struct ieee80211_local *local = sdata->local;
0795af57 1087
3e122be0 1088 atomic_inc(&sdata->bss->num_sta_ps);
af818581 1089 set_sta_flags(sta, WLAN_STA_PS_STA);
d057e5a3
AN		 1090 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1091 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
571ecf67 1092#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26 1093 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
47846c9b 1094 sdata->name, sta->sta.addr, sta->sta.aid);
571ecf67
JB		 1095#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1096}
1097
ff9458d3 1098static void ap_sta_ps_end(struct sta_info *sta)
571ecf67 1099{
133b8226 1100 struct ieee80211_sub_if_data *sdata = sta->sdata;
571ecf67 1101
3e122be0 1102 atomic_dec(&sdata->bss->num_sta_ps);
004c872e 1103
571ecf67 1104#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26 1105 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
47846c9b 1106 sdata->name, sta->sta.addr, sta->sta.aid);
571ecf67 1107#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
004c872e 1108
af818581 1109 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
571ecf67 1110#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
af818581 1111 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
47846c9b 1112 sdata->name, sta->sta.addr, sta->sta.aid);
571ecf67 1113#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
af818581
JB		 1114 return;
1115 }
1116
1117 ieee80211_sta_ps_deliver_wakeup(sta);
571ecf67
JB		 1118}
1119
d057e5a3
AN		 1120int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
1121{
1122 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
1123 bool in_ps;
1124
1125 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
1126
1127 /* Don't let the same PS state be set twice */
1128 in_ps = test_sta_flags(sta_inf, WLAN_STA_PS_STA);
1129 if ((start && in_ps) || (!start && !in_ps))
1130 return -EINVAL;
1131
1132 if (start)
1133 ap_sta_ps_start(sta_inf);
1134 else
1135 ap_sta_ps_end(sta_inf);
1136
1137 return 0;
1138}
1139EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1140
49461622 1141static ieee80211_rx_result debug_noinline
5cf121c3 1142ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB		 1143{
1144 struct sta_info *sta = rx->sta;
eb9fb5b8
JB		 1145 struct sk_buff *skb = rx->skb;
1146 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1147 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
571ecf67
JB		 1148
1149 if (!sta)
9ae54c84 1150 return RX_CONTINUE;
571ecf67 1151
b291ba11
JB		 1152 /*
1153 * Update last_rx only for IBSS packets which are for the current
1154 * BSSID to avoid keeping the current IBSS network alive in cases
1155 * where other STAs start using different BSSID.
1156 */
05c914fe 1157 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 1158 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 1159 NL80211_IFTYPE_ADHOC);
3af6334c 1160 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
571ecf67 1161 sta->last_rx = jiffies;
3af6334c
FF		 1162 if (ieee80211_is_data(hdr->frame_control)) {
1163 sta->last_rx_rate_idx = status->rate_idx;
1164 sta->last_rx_rate_flag = status->flag;
1165 }
1166 }
b291ba11
JB		 1167 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1168 /*
33b64eb2
LCC		 1169 * Mesh beacons will update last_rx when if they are found to
1170 * match the current local configuration when processed.
571ecf67 1171 */
b291ba11 1172 sta->last_rx = jiffies;
3af6334c
FF		 1173 if (ieee80211_is_data(hdr->frame_control)) {
1174 sta->last_rx_rate_idx = status->rate_idx;
1175 sta->last_rx_rate_flag = status->flag;
1176 }
571ecf67
JB		 1177 }
1178
554891e6 1179 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
9ae54c84 1180 return RX_CONTINUE;
571ecf67 1181
3cf335d5
KV		 1182 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1183 ieee80211_sta_rx_notify(rx->sdata, hdr);
1184
571ecf67
JB		 1185 sta->rx_fragments++;
1186 sta->rx_bytes += rx->skb->len;
eb9fb5b8 1187 sta->last_signal = status->signal;
541a45a1 1188 ewma_add(&sta->avg_signal, -status->signal);
571ecf67 1189
72eaa43a
JB		 1190 /*
1191 * Change STA power saving mode only at the end of a frame
1192 * exchange sequence.
1193 */
d057e5a3
AN		 1194 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
1195 !ieee80211_has_morefrags(hdr->frame_control) &&
4cfda47b 1196 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
05c914fe
JB		 1197 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1198 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
af818581 1199 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
72eaa43a
JB		 1200 /*
1201 * Ignore doze->wake transitions that are
1202 * indicated by non-data frames, the standard
1203 * is unclear here, but for example going to
1204 * PS mode and then scanning would cause a
1205 * doze->wake transition for the probe request,
1206 * and that is clearly undesirable.
1207 */
1208 if (ieee80211_is_data(hdr->frame_control) &&
1209 !ieee80211_has_pm(hdr->frame_control))
ff9458d3 1210 ap_sta_ps_end(sta);
72eaa43a
JB		 1211 } else {
1212 if (ieee80211_has_pm(hdr->frame_control))
1213 ap_sta_ps_start(sta);
1214 }
571ecf67
JB		 1215 }
1216
22403def
JB		 1217 /*
1218 * Drop (qos-)data::nullfunc frames silently, since they
1219 * are used only to control station power saving mode.
1220 */
1221 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1222 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
571ecf67 1223 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
d524215f
FF		 1224
1225 /*
1226 * If we receive a 4-addr nullfunc frame from a STA
1227 * that was not moved to a 4-addr STA vlan yet, drop
1228 * the frame to the monitor interface, to make sure
1229 * that hostapd sees it
1230 */
1231 if (ieee80211_has_a4(hdr->frame_control) &&
1232 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1233 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1234 !rx->sdata->u.vlan.sta)))
1235 return RX_DROP_MONITOR;
22403def
JB		 1236 /*
1237 * Update counter and free packet here to avoid
1238 * counting this as a dropped packed.
1239 */
571ecf67
JB		 1240 sta->rx_packets++;
1241 dev_kfree_skb(rx->skb);
9ae54c84 1242 return RX_QUEUED;
571ecf67
JB		 1243 }
1244
9ae54c84 1245 return RX_CONTINUE;
571ecf67
JB		 1246} /* ieee80211_rx_h_sta_process */
1247
571ecf67
JB		 1248static inline struct ieee80211_fragment_entry *
1249ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1250 unsigned int frag, unsigned int seq, int rx_queue,
1251 struct sk_buff **skb)
1252{
1253 struct ieee80211_fragment_entry *entry;
1254 int idx;
1255
1256 idx = sdata->fragment_next;
1257 entry = &sdata->fragments[sdata->fragment_next++];
1258 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1259 sdata->fragment_next = 0;
1260
1261 if (!skb_queue_empty(&entry->skb_list)) {
f4ea83dd 1262#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
571ecf67
JB		 1263 struct ieee80211_hdr *hdr =
1264 (struct ieee80211_hdr *) entry->skb_list.next->data;
1265 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1266 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
0c68ae26 1267 "addr1=%pM addr2=%pM\n",
47846c9b 1268 sdata->name, idx,
571ecf67 1269 jiffies - entry->first_frag_time, entry->seq,
0c68ae26 1270 entry->last_frag, hdr->addr1, hdr->addr2);
f4ea83dd 1271#endif
571ecf67
JB		 1272 __skb_queue_purge(&entry->skb_list);
1273 }
1274
1275 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1276 *skb = NULL;
1277 entry->first_frag_time = jiffies;
1278 entry->seq = seq;
1279 entry->rx_queue = rx_queue;
1280 entry->last_frag = frag;
1281 entry->ccmp = 0;
1282 entry->extra_len = 0;
1283
1284 return entry;
1285}
1286
1287static inline struct ieee80211_fragment_entry *
1288ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
b73d70ad 1289 unsigned int frag, unsigned int seq,
571ecf67
JB		 1290 int rx_queue, struct ieee80211_hdr *hdr)
1291{
1292 struct ieee80211_fragment_entry *entry;
1293 int i, idx;
1294
1295 idx = sdata->fragment_next;
1296 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1297 struct ieee80211_hdr *f_hdr;
571ecf67
JB		 1298
1299 idx--;
1300 if (idx < 0)
1301 idx = IEEE80211_FRAGMENT_MAX - 1;
1302
1303 entry = &sdata->fragments[idx];
1304 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1305 entry->rx_queue != rx_queue ||
1306 entry->last_frag + 1 != frag)
1307 continue;
1308
b73d70ad 1309 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
571ecf67 1310
b73d70ad
HH		 1311 /*
1312 * Check ftype and addresses are equal, else check next fragment
1313 */
1314 if (((hdr->frame_control ^ f_hdr->frame_control) &
1315 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
571ecf67
JB		 1316 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1317 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1318 continue;
1319
ab46623e 1320 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB		 1321 __skb_queue_purge(&entry->skb_list);
1322 continue;
1323 }
1324 return entry;
1325 }
1326
1327 return NULL;
1328}
1329
49461622 1330static ieee80211_rx_result debug_noinline
5cf121c3 1331ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67
JB		 1332{
1333 struct ieee80211_hdr *hdr;
1334 u16 sc;
358c8d9d 1335 __le16 fc;
571ecf67
JB		 1336 unsigned int frag, seq;
1337 struct ieee80211_fragment_entry *entry;
1338 struct sk_buff *skb;
554891e6 1339 struct ieee80211_rx_status *status;
571ecf67 1340
b73d70ad 1341 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 1342 fc = hdr->frame_control;
571ecf67
JB		 1343 sc = le16_to_cpu(hdr->seq_ctrl);
1344 frag = sc & IEEE80211_SCTL_FRAG;
1345
358c8d9d 1346 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
571ecf67
JB		 1347 (rx->skb)->len < 24 ||
1348 is_multicast_ether_addr(hdr->addr1))) {
1349 /* not fragmented */
1350 goto out;
1351 }
1352 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1353
e3cf8b3f
ZY		 1354 if (skb_linearize(rx->skb))
1355 return RX_DROP_UNUSABLE;
1356
058897a4
AK		 1357 /*
1358 * skb_linearize() might change the skb->data and
1359 * previously cached variables (in this case, hdr) need to
1360 * be refreshed with the new data.
1361 */
1362 hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB		 1363 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1364
1365 if (frag == 0) {
1366 /* This is the first fragment of a new frame. */
1367 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
5cf121c3 1368 rx->queue, &(rx->skb));
97359d12 1369 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
358c8d9d 1370 ieee80211_has_protected(fc)) {
9190252c
JM		 1371 int queue = ieee80211_is_mgmt(fc) ?
1372 NUM_RX_DATA_QUEUES : rx->queue;
571ecf67
JB		 1373 /* Store CCMP PN so that we can verify that the next
1374 * fragment has a sequential PN value. */
1375 entry->ccmp = 1;
1376 memcpy(entry->last_pn,
9190252c 1377 rx->key->u.ccmp.rx_pn[queue],
571ecf67
JB		 1378 CCMP_PN_LEN);
1379 }
9ae54c84 1380 return RX_QUEUED;
571ecf67
JB		 1381 }
1382
1383 /* This is a fragment for a frame that should already be pending in
1384 * fragment cache. Add this fragment to the end of the pending entry.
1385 */
b73d70ad 1386 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
571ecf67
JB		 1387 if (!entry) {
1388 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 1389 return RX_DROP_MONITOR;
571ecf67
JB		 1390 }
1391
1392 /* Verify that MPDUs within one MSDU have sequential PN values.
1393 * (IEEE 802.11i, 8.3.3.4.5) */
1394 if (entry->ccmp) {
1395 int i;
1396 u8 pn[CCMP_PN_LEN], *rpn;
9190252c 1397 int queue;
97359d12 1398 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
e4c26add 1399 return RX_DROP_UNUSABLE;
571ecf67
JB		 1400 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1401 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1402 pn[i]++;
1403 if (pn[i])
1404 break;
1405 }
9190252c
JM		 1406 queue = ieee80211_is_mgmt(fc) ?
1407 NUM_RX_DATA_QUEUES : rx->queue;
1408 rpn = rx->key->u.ccmp.rx_pn[queue];
f4ea83dd 1409 if (memcmp(pn, rpn, CCMP_PN_LEN))
e4c26add 1410 return RX_DROP_UNUSABLE;
571ecf67
JB		 1411 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1412 }
1413
358c8d9d 1414 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB		 1415 __skb_queue_tail(&entry->skb_list, rx->skb);
1416 entry->last_frag = frag;
1417 entry->extra_len += rx->skb->len;
358c8d9d 1418 if (ieee80211_has_morefrags(fc)) {
571ecf67 1419 rx->skb = NULL;
9ae54c84 1420 return RX_QUEUED;
571ecf67
JB		 1421 }
1422
1423 rx->skb = __skb_dequeue(&entry->skb_list);
1424 if (skb_tailroom(rx->skb) < entry->extra_len) {
1425 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1426 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1427 GFP_ATOMIC))) {
1428 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1429 __skb_queue_purge(&entry->skb_list);
e4c26add 1430 return RX_DROP_UNUSABLE;
571ecf67
JB		 1431 }
1432 }
1433 while ((skb = __skb_dequeue(&entry->skb_list))) {
1434 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1435 dev_kfree_skb(skb);
1436 }
1437
1438 /* Complete frame has been reassembled - process it now */
554891e6
JB		 1439 status = IEEE80211_SKB_RXCB(rx->skb);
1440 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
571ecf67
JB		 1441
1442 out:
1443 if (rx->sta)
1444 rx->sta->rx_packets++;
1445 if (is_multicast_ether_addr(hdr->addr1))
1446 rx->local->dot11MulticastReceivedFrameCount++;
1447 else
1448 ieee80211_led_rx(rx->local);
9ae54c84 1449 return RX_CONTINUE;
571ecf67
JB		 1450}
1451
49461622 1452static ieee80211_rx_result debug_noinline
5cf121c3 1453ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
571ecf67 1454{
af818581 1455 struct ieee80211_sub_if_data *sdata = rx->sdata;
358c8d9d 1456 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
554891e6 1457 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 1458
358c8d9d 1459 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
554891e6 1460 !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
9ae54c84 1461 return RX_CONTINUE;
571ecf67 1462
05c914fe
JB		 1463 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1464 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
e4c26add 1465 return RX_DROP_UNUSABLE;
98f0b0a3 1466
af818581
JB		 1467 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1468 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1469 else
1470 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
571ecf67 1471
9ae54c84 1472 /* Free PS Poll skb here instead of returning RX_DROP that would
571ecf67
JB		 1473 * count as an dropped frame. */
1474 dev_kfree_skb(rx->skb);
1475
9ae54c84 1476 return RX_QUEUED;
571ecf67
JB		 1477}
1478
49461622 1479static ieee80211_rx_result debug_noinline
5cf121c3 1480ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
6e0d114d 1481{
6e0d114d 1482 u8 *data = rx->skb->data;
238f74a2 1483 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
6e0d114d 1484
238f74a2 1485 if (!ieee80211_is_data_qos(hdr->frame_control))
9ae54c84 1486 return RX_CONTINUE;
6e0d114d
JB		 1487
1488 /* remove the qos control field, update frame type and meta-data */
238f74a2
HH		 1489 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1490 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1491 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
6e0d114d 1492 /* change frame type to non QOS */
238f74a2 1493 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
6e0d114d 1494
9ae54c84 1495 return RX_CONTINUE;
6e0d114d
JB		 1496}
1497
76ee65bf 1498static int
5cf121c3 1499ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 1500{
07346f81 1501 if (unlikely(!rx->sta ||
f4ea83dd 1502 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 1503 return -EACCES;
571ecf67 1504
76ee65bf 1505 return 0;
571ecf67
JB		 1506}
1507
76ee65bf 1508static int
358c8d9d 1509ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 1510{
eb9fb5b8
JB		 1511 struct sk_buff *skb = rx->skb;
1512 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1513
3017b80b 1514 /*
7848ba7d
JB		 1515 * Pass through unencrypted frames if the hardware has
1516 * decrypted them already.
3017b80b 1517 */
eb9fb5b8 1518 if (status->flag & RX_FLAG_DECRYPTED)
76ee65bf 1519 return 0;
571ecf67
JB		 1520
1521 /* Drop unencrypted frames if key is set. */
358c8d9d
HH		 1522 if (unlikely(!ieee80211_has_protected(fc) &&
1523 !ieee80211_is_nullfunc(fc) &&
f2ca3ea4 1524 ieee80211_is_data(fc) &&
b3fc9c6c 1525 (rx->key || rx->sdata->drop_unencrypted)))
76ee65bf 1526 return -EACCES;
bef5d1c7
JB		 1527
1528 return 0;
1529}
1530
1531static int
1532ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1533{
1534 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
e3efca0a 1535 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
bef5d1c7 1536 __le16 fc = hdr->frame_control;
bef5d1c7 1537
e3efca0a
JM		 1538 /*
1539 * Pass through unencrypted frames if the hardware has
1540 * decrypted them already.
1541 */
1542 if (status->flag & RX_FLAG_DECRYPTED)
1543 return 0;
bef5d1c7 1544
f2ca3ea4 1545 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
d211e90e
JM		 1546 if (unlikely(!ieee80211_has_protected(fc) &&
1547 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
cf4e594e
JM		 1548 rx->key)) {
1549 if (ieee80211_is_deauth(fc))
1550 cfg80211_send_unprot_deauth(rx->sdata->dev,
1551 rx->skb->data,
1552 rx->skb->len);
1553 else if (ieee80211_is_disassoc(fc))
1554 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1555 rx->skb->data,
1556 rx->skb->len);
f2ca3ea4 1557 return -EACCES;
cf4e594e 1558 }
f2ca3ea4 1559 /* BIP does not use Protected field, so need to check MMIE */
f64f9e71 1560 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
cf4e594e
JM		 1561 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1562 if (ieee80211_is_deauth(fc))
1563 cfg80211_send_unprot_deauth(rx->sdata->dev,
1564 rx->skb->data,
1565 rx->skb->len);
1566 else if (ieee80211_is_disassoc(fc))
1567 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1568 rx->skb->data,
1569 rx->skb->len);
f2ca3ea4 1570 return -EACCES;
cf4e594e 1571 }
f2ca3ea4
JM		 1572 /*
1573 * When using MFP, Action frames are not allowed prior to
1574 * having configured keys.
1575 */
1576 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1577 ieee80211_is_robust_mgmt_frame(
1578 (struct ieee80211_hdr *) rx->skb->data)))
1579 return -EACCES;
1580 }
b3fc9c6c 1581
76ee65bf 1582 return 0;
571ecf67
JB		 1583}
1584
76ee65bf 1585static int
e31a16d6 1586__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
571ecf67 1587{
eb9fb5b8 1588 struct ieee80211_sub_if_data *sdata = rx->sdata;
f14543ee 1589 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
fbb327c5
FF		 1590 bool check_port_control = false;
1591 struct ethhdr *ehdr;
1592 int ret;
f14543ee 1593
9bc383de
JB		 1594 if (ieee80211_has_a4(hdr->frame_control) &&
1595 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
f14543ee 1596 return -1;
9bc383de 1597
fbb327c5
FF		 1598 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1599 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1600
1601 if (!sdata->u.mgd.use_4addr)
1602 return -1;
1603 else
1604 check_port_control = true;
1605 }
1606
9bc383de 1607 if (is_multicast_ether_addr(hdr->addr1) &&
fbb327c5 1608 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
f14543ee 1609 return -1;
571ecf67 1610
fbb327c5
FF		 1611 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1612 if (ret < 0 || !check_port_control)
1613 return ret;
1614
1615 ehdr = (struct ethhdr *) rx->skb->data;
1616 if (ehdr->h_proto != rx->sdata->control_port_protocol)
1617 return -1;
1618
1619 return 0;
76ee65bf 1620}
571ecf67 1621
ce3edf6d
JB		 1622/*
1623 * requires that rx->skb is a frame with ethernet header
1624 */
358c8d9d 1625static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 1626{
c97c23e3 1627 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB		 1628 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1629 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1630
1631 /*
1632 * Allow EAPOL frames to us/the PAE group address regardless
1633 * of whether the frame was encrypted or not.
1634 */
a621fa4d 1635 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
47846c9b 1636 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
ce3edf6d
JB		 1637 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1638 return true;
1639
1640 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 1641 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB		 1642 return false;
1643
1644 return true;
1645}
1646
1647/*
1648 * requires that rx->skb is a frame with ethernet header
1649 */
76ee65bf 1650static void
5cf121c3 1651ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf 1652{
eb9fb5b8
JB		 1653 struct ieee80211_sub_if_data *sdata = rx->sdata;
1654 struct net_device *dev = sdata->dev;
76ee65bf 1655 struct sk_buff *skb, *xmit_skb;
ce3edf6d
JB		 1656 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1657 struct sta_info *dsta;
554891e6 1658 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 1659
76ee65bf
RR		 1660 skb = rx->skb;
1661 xmit_skb = NULL;
571ecf67 1662
05c914fe
JB		 1663 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1664 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 1665 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
554891e6 1666 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
9bc383de 1667 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
ce3edf6d
JB		 1668 if (is_multicast_ether_addr(ehdr->h_dest)) {
1669 /*
1670 * send multicast frames both to higher layers in
1671 * local net stack and back to the wireless medium
1672 */
76ee65bf
RR		 1673 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1674 if (!xmit_skb && net_ratelimit())
571ecf67
JB		 1675 printk(KERN_DEBUG "%s: failed to clone "
1676 "multicast frame\n", dev->name);
1677 } else {
abe60632
JB		 1678 dsta = sta_info_get(sdata, skb->data);
1679 if (dsta) {
ce3edf6d
JB		 1680 /*
1681 * The destination station is associated to
1682 * this AP (in this VLAN), so send the frame
1683 * directly to it and do not pass it to local
1684 * net stack.
571ecf67 1685 */
76ee65bf 1686 xmit_skb = skb;
571ecf67
JB		 1687 skb = NULL;
1688 }
571ecf67
JB		 1689 }
1690 }
1691
1692 if (skb) {
d1c3a37c
JB		 1693 int align __maybe_unused;
1694
59d9cb07 1695#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
d1c3a37c
JB		 1696 /*
1697 * 'align' will only take the values 0 or 2 here
1698 * since all frames are required to be aligned
1699 * to 2-byte boundaries when being passed to
1700 * mac80211. That also explains the __skb_push()
1701 * below.
1702 */
dacb6f1d 1703 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
d1c3a37c
JB		 1704 if (align) {
1705 if (WARN_ON(skb_headroom(skb) < 3)) {
1706 dev_kfree_skb(skb);
1707 skb = NULL;
1708 } else {
1709 u8 *data = skb->data;
8ce0b589
ZY		 1710 size_t len = skb_headlen(skb);
1711 skb->data -= align;
1712 memmove(skb->data, data, len);
1713 skb_set_tail_pointer(skb, len);
d1c3a37c
JB		 1714 }
1715 }
1716#endif
1717
1718 if (skb) {
1719 /* deliver to local stack */
1720 skb->protocol = eth_type_trans(skb, dev);
1721 memset(skb->cb, 0, sizeof(skb->cb));
5548a8a1 1722 netif_receive_skb(skb);
d1c3a37c 1723 }
571ecf67
JB		 1724 }
1725
76ee65bf 1726 if (xmit_skb) {
571ecf67 1727 /* send to wireless media */
f831e909 1728 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB		 1729 skb_reset_network_header(xmit_skb);
1730 skb_reset_mac_header(xmit_skb);
76ee65bf 1731 dev_queue_xmit(xmit_skb);
571ecf67 1732 }
76ee65bf
RR		 1733}
1734
49461622 1735static ieee80211_rx_result debug_noinline
5cf121c3 1736ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
fd4c7f2f 1737{
eb9fb5b8 1738 struct net_device *dev = rx->sdata->dev;
eaf85ca7 1739 struct sk_buff *skb = rx->skb;
358c8d9d
HH		 1740 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1741 __le16 fc = hdr->frame_control;
eaf85ca7 1742 struct sk_buff_head frame_list;
554891e6 1743 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
fd4c7f2f 1744
358c8d9d 1745 if (unlikely(!ieee80211_is_data(fc)))
9ae54c84 1746 return RX_CONTINUE;
fd4c7f2f 1747
358c8d9d 1748 if (unlikely(!ieee80211_is_data_present(fc)))
e4c26add 1749 return RX_DROP_MONITOR;
fd4c7f2f 1750
554891e6 1751 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
9ae54c84 1752 return RX_CONTINUE;
fd4c7f2f 1753
eaf85ca7
ZY		 1754 if (ieee80211_has_a4(hdr->frame_control) &&
1755 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1756 !rx->sdata->u.vlan.sta)
e4c26add 1757 return RX_DROP_UNUSABLE;
fd4c7f2f 1758
eaf85ca7
ZY		 1759 if (is_multicast_ether_addr(hdr->addr1) &&
1760 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1761 rx->sdata->u.vlan.sta) ||
1762 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1763 rx->sdata->u.mgd.use_4addr)))
e4c26add 1764 return RX_DROP_UNUSABLE;
fd4c7f2f 1765
eaf85ca7
ZY		 1766 skb->dev = dev;
1767 __skb_queue_head_init(&frame_list);
fd4c7f2f 1768
e3cf8b3f
ZY		 1769 if (skb_linearize(skb))
1770 return RX_DROP_UNUSABLE;
1771
eaf85ca7
ZY		 1772 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1773 rx->sdata->vif.type,
1774 rx->local->hw.extra_tx_headroom);
fd4c7f2f 1775
eaf85ca7
ZY		 1776 while (!skb_queue_empty(&frame_list)) {
1777 rx->skb = __skb_dequeue(&frame_list);
fd4c7f2f 1778
358c8d9d 1779 if (!ieee80211_frame_allowed(rx, fc)) {
eaf85ca7 1780 dev_kfree_skb(rx->skb);
ce3edf6d
JB		 1781 continue;
1782 }
eaf85ca7
ZY		 1783 dev->stats.rx_packets++;
1784 dev->stats.rx_bytes += rx->skb->len;
fd4c7f2f
RR		 1785
1786 ieee80211_deliver_skb(rx);
1787 }
1788
9ae54c84 1789 return RX_QUEUED;
fd4c7f2f
RR		 1790}
1791
bf94e17b 1792#ifdef CONFIG_MAC80211_MESH
b0dee578 1793static ieee80211_rx_result
e32f85f7
LCC		 1794ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1795{
1796 struct ieee80211_hdr *hdr;
1797 struct ieee80211s_hdr *mesh_hdr;
1798 unsigned int hdrlen;
1799 struct sk_buff *skb = rx->skb, *fwd_skb;
3b8d81e0 1800 struct ieee80211_local *local = rx->local;
eb9fb5b8 1801 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 1802 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
e32f85f7
LCC		 1803
1804 hdr = (struct ieee80211_hdr *) skb->data;
1805 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1806 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1807
1808 if (!ieee80211_is_data(hdr->frame_control))
1809 return RX_CONTINUE;
1810
1811 if (!mesh_hdr->ttl)
1812 /* illegal frame */
1813 return RX_DROP_MONITOR;
1814
43b7b314 1815 if (mesh_hdr->flags & MESH_FLAGS_AE) {
79617dee 1816 struct mesh_path *mppath;
43b7b314
JC		 1817 char *proxied_addr;
1818 char *mpp_addr;
1819
1820 if (is_multicast_ether_addr(hdr->addr1)) {
1821 mpp_addr = hdr->addr3;
1822 proxied_addr = mesh_hdr->eaddr1;
1823 } else {
1824 mpp_addr = hdr->addr4;
1825 proxied_addr = mesh_hdr->eaddr2;
1826 }
79617dee 1827
79617dee 1828 rcu_read_lock();
43b7b314 1829 mppath = mpp_path_lookup(proxied_addr, sdata);
79617dee 1830 if (!mppath) {
43b7b314 1831 mpp_path_add(proxied_addr, mpp_addr, sdata);
79617dee
Y		 1832 } else {
1833 spin_lock_bh(&mppath->state_lock);
43b7b314
JC		 1834 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1835 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
79617dee
Y		 1836 spin_unlock_bh(&mppath->state_lock);
1837 }
1838 rcu_read_unlock();
1839 }
1840
3c5772a5
JC		 1841 /* Frame has reached destination. Don't forward */
1842 if (!is_multicast_ether_addr(hdr->addr1) &&
47846c9b 1843 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
e32f85f7
LCC		 1844 return RX_CONTINUE;
1845
1846 mesh_hdr->ttl--;
1847
554891e6 1848 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
e32f85f7 1849 if (!mesh_hdr->ttl)
472dbc45 1850 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
e32f85f7
LCC		 1851 dropped_frames_ttl);
1852 else {
1853 struct ieee80211_hdr *fwd_hdr;
3b8d81e0
JB		 1854 struct ieee80211_tx_info *info;
1855
e32f85f7
LCC		 1856 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1857
1858 if (!fwd_skb && net_ratelimit())
1859 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
47846c9b 1860 sdata->name);
919bbad5 1861 if (!fwd_skb)
b51aff05 1862 goto out;
e32f85f7
LCC		 1863
1864 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
47846c9b 1865 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3b8d81e0
JB		 1866 info = IEEE80211_SKB_CB(fwd_skb);
1867 memset(info, 0, sizeof(*info));
1868 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
5061b0c2 1869 info->control.vif = &rx->sdata->vif;
cf0277e7
JB		 1870 skb_set_queue_mapping(skb,
1871 ieee80211_select_queue(rx->sdata, fwd_skb));
1872 ieee80211_set_qos_hdr(local, skb);
c8a61a7d
DW		 1873 if (is_multicast_ether_addr(fwd_hdr->addr1))
1874 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1875 fwded_mcast);
1876 else {
3c5772a5
JC		 1877 int err;
1878 /*
1879 * Save TA to addr1 to send TA a path error if a
1880 * suitable next hop is not found
1881 */
1882 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
249b405c 1883 ETH_ALEN);
3c5772a5 1884 err = mesh_nexthop_lookup(fwd_skb, sdata);
249b405c
JC		 1885 /* Failed to immediately resolve next hop:
1886 * fwded frame was dropped or will be added
1887 * later to the pending skb queue. */
1888 if (err)
1889 return RX_DROP_MONITOR;
c8a61a7d
DW		 1890
1891 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1892 fwded_unicast);
249b405c
JC		 1893 }
1894 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1895 fwded_frames);
3b8d81e0 1896 ieee80211_add_pending_skb(local, fwd_skb);
e32f85f7
LCC		 1897 }
1898 }
1899
b51aff05 1900 out:
3c5772a5 1901 if (is_multicast_ether_addr(hdr->addr1) ||
eb9fb5b8 1902 sdata->dev->flags & IFF_PROMISC)
e32f85f7
LCC		 1903 return RX_CONTINUE;
1904 else
1905 return RX_DROP_MONITOR;
1906}
bf94e17b 1907#endif
e32f85f7 1908
49461622 1909static ieee80211_rx_result debug_noinline
5cf121c3 1910ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf 1911{
eb9fb5b8 1912 struct ieee80211_sub_if_data *sdata = rx->sdata;
e15276a4 1913 struct ieee80211_local *local = rx->local;
eb9fb5b8 1914 struct net_device *dev = sdata->dev;
358c8d9d
HH		 1915 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1916 __le16 fc = hdr->frame_control;
ce3edf6d 1917 int err;
76ee65bf 1918
358c8d9d 1919 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 1920 return RX_CONTINUE;
76ee65bf 1921
358c8d9d 1922 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 1923 return RX_DROP_MONITOR;
76ee65bf 1924
f14543ee
FF		 1925 /*
1926 * Allow the cooked monitor interface of an AP to see 4-addr frames so
1927 * that a 4-addr station can be detected and moved into a separate VLAN
1928 */
1929 if (ieee80211_has_a4(hdr->frame_control) &&
1930 sdata->vif.type == NL80211_IFTYPE_AP)
1931 return RX_DROP_MONITOR;
1932
e31a16d6 1933 err = __ieee80211_data_to_8023(rx);
76ee65bf 1934 if (unlikely(err))
e4c26add 1935 return RX_DROP_UNUSABLE;
76ee65bf 1936
358c8d9d 1937 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 1938 return RX_DROP_MONITOR;
ce3edf6d 1939
76ee65bf
RR		 1940 rx->skb->dev = dev;
1941
1942 dev->stats.rx_packets++;
1943 dev->stats.rx_bytes += rx->skb->len;
1944
08ca944e 1945 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
8c99f691
RM		 1946 !is_multicast_ether_addr(
1947 ((struct ethhdr *)rx->skb->data)->h_dest) &&
1948 (!local->scanning &&
1949 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
e15276a4
VN		 1950 mod_timer(&local->dynamic_ps_timer, jiffies +
1951 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1952 }
1953
76ee65bf 1954 ieee80211_deliver_skb(rx);
571ecf67 1955
9ae54c84 1956 return RX_QUEUED;
571ecf67
JB		 1957}
1958
49461622 1959static ieee80211_rx_result debug_noinline
24a8fdad 1960ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
71364716
RR		 1961{
1962 struct ieee80211_local *local = rx->local;
1963 struct ieee80211_hw *hw = &local->hw;
1964 struct sk_buff *skb = rx->skb;
a7767f95 1965 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR		 1966 struct tid_ampdu_rx *tid_agg_rx;
1967 u16 start_seq_num;
1968 u16 tid;
1969
a7767f95 1970 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 1971 return RX_CONTINUE;
71364716 1972
a7767f95 1973 if (ieee80211_is_back_req(bar->frame_control)) {
8ae5977f
JB		 1974 struct {
1975 __le16 control, start_seq_num;
1976 } __packed bar_data;
1977
71364716 1978 if (!rx->sta)
a02ae758 1979 return RX_DROP_MONITOR;
8ae5977f
JB		 1980
1981 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
1982 &bar_data, sizeof(bar_data)))
1983 return RX_DROP_MONITOR;
1984
8ae5977f 1985 tid = le16_to_cpu(bar_data.control) >> 12;
a87f736d
JB		 1986
1987 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
1988 if (!tid_agg_rx)
a02ae758 1989 return RX_DROP_MONITOR;
71364716 1990
8ae5977f 1991 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
71364716
RR		 1992
1993 /* reset session timer */
20ad19d0
JB		 1994 if (tid_agg_rx->timeout)
1995 mod_timer(&tid_agg_rx->session_timer,
1996 TU_TO_EXP_TIME(tid_agg_rx->timeout));
71364716 1997
dd318575 1998 spin_lock(&tid_agg_rx->reorder_lock);
a02ae758 1999 /* release stored frames up to start of BAR */
24a8fdad 2000 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
dd318575
JB		 2001 spin_unlock(&tid_agg_rx->reorder_lock);
2002
a02ae758
JB		 2003 kfree_skb(skb);
2004 return RX_QUEUED;
71364716
RR		 2005 }
2006
08daecae
JB		 2007 /*
2008 * After this point, we only want management frames,
2009 * so we can drop all remaining control frames to
2010 * cooked monitor interfaces.
2011 */
2012 return RX_DROP_MONITOR;
71364716
RR		 2013}
2014
f4f727a6
JM		 2015static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2016 struct ieee80211_mgmt *mgmt,
2017 size_t len)
fea14732
JM		 2018{
2019 struct ieee80211_local *local = sdata->local;
2020 struct sk_buff *skb;
2021 struct ieee80211_mgmt *resp;
2022
47846c9b 2023 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
fea14732
JM		 2024 /* Not to own unicast address */
2025 return;
2026 }
2027
46900298
JB		 2028 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
2029 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
77fdaa12 2030 /* Not from the current AP or not associated yet. */
fea14732
JM		 2031 return;
2032 }
2033
2034 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2035 /* Too short SA Query request frame */
2036 return;
2037 }
2038
2039 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2040 if (skb == NULL)
2041 return;
2042
2043 skb_reserve(skb, local->hw.extra_tx_headroom);
2044 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2045 memset(resp, 0, 24);
2046 memcpy(resp->da, mgmt->sa, ETH_ALEN);
47846c9b 2047 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
46900298 2048 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
fea14732
JM		 2049 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2050 IEEE80211_STYPE_ACTION);
2051 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2052 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2053 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2054 memcpy(resp->u.action.u.sa_query.trans_id,
2055 mgmt->u.action.u.sa_query.trans_id,
2056 WLAN_SA_QUERY_TR_ID_LEN);
2057
62ae67be 2058 ieee80211_tx_skb(sdata, skb);
fea14732
JM		 2059}
2060
2e161f78
JB		 2061static ieee80211_rx_result debug_noinline
2062ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2063{
2064 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2065 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2066
2067 /*
2068 * From here on, look only at management frames.
2069 * Data and control frames are already handled,
2070 * and unknown (reserved) frames are useless.
2071 */
2072 if (rx->skb->len < 24)
2073 return RX_DROP_MONITOR;
2074
2075 if (!ieee80211_is_mgmt(mgmt->frame_control))
2076 return RX_DROP_MONITOR;
2077
554891e6 2078 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2e161f78
JB		 2079 return RX_DROP_MONITOR;
2080
2081 if (ieee80211_drop_unencrypted_mgmt(rx))
2082 return RX_DROP_UNUSABLE;
2083
2084 return RX_CONTINUE;
2085}
2086
de1ede7a
JB		 2087static ieee80211_rx_result debug_noinline
2088ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2089{
2090 struct ieee80211_local *local = rx->local;
eb9fb5b8 2091 struct ieee80211_sub_if_data *sdata = rx->sdata;
de1ede7a 2092 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2093 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
de1ede7a
JB		 2094 int len = rx->skb->len;
2095
2096 if (!ieee80211_is_action(mgmt->frame_control))
2097 return RX_CONTINUE;
2098
026331c4
JM		 2099 /* drop too small frames */
2100 if (len < IEEE80211_MIN_ACTION_SIZE)
84040805 2101 return RX_DROP_UNUSABLE;
de1ede7a 2102
026331c4 2103 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
84040805 2104 return RX_DROP_UNUSABLE;
de1ede7a 2105
554891e6 2106 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
84040805 2107 return RX_DROP_UNUSABLE;
97ebe12a 2108
de1ede7a
JB		 2109 switch (mgmt->u.action.category) {
2110 case WLAN_CATEGORY_BACK:
8abd3f9b
JB		 2111 /*
2112 * The aggregation code is not prepared to handle
2113 * anything but STA/AP due to the BSSID handling;
2114 * IBSS could work in the code but isn't supported
2115 * by drivers or the standard.
2116 */
2117 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2118 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2119 sdata->vif.type != NL80211_IFTYPE_AP)
84040805 2120 break;
8abd3f9b 2121
026331c4
JM		 2122 /* verify action_code is present */
2123 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2124 break;
2125
de1ede7a
JB		 2126 switch (mgmt->u.action.u.addba_req.action_code) {
2127 case WLAN_ACTION_ADDBA_REQ:
2128 if (len < (IEEE80211_MIN_ACTION_SIZE +
2129 sizeof(mgmt->u.action.u.addba_req)))
bed7ee6e
JB		 2130 goto invalid;
2131 break;
de1ede7a
JB		 2132 case WLAN_ACTION_ADDBA_RESP:
2133 if (len < (IEEE80211_MIN_ACTION_SIZE +
2134 sizeof(mgmt->u.action.u.addba_resp)))
bed7ee6e
JB		 2135 goto invalid;
2136 break;
de1ede7a
JB		 2137 case WLAN_ACTION_DELBA:
2138 if (len < (IEEE80211_MIN_ACTION_SIZE +
2139 sizeof(mgmt->u.action.u.delba)))
bed7ee6e
JB		 2140 goto invalid;
2141 break;
2142 default:
2143 goto invalid;
de1ede7a 2144 }
bed7ee6e 2145
8b58ff83 2146 goto queue;
39192c0b
JB		 2147 case WLAN_CATEGORY_SPECTRUM_MGMT:
2148 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
84040805 2149 break;
46900298
JB		 2150
2151 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2152 break;
46900298 2153
026331c4
JM		 2154 /* verify action_code is present */
2155 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2156 break;
2157
39192c0b
JB		 2158 switch (mgmt->u.action.u.measurement.action_code) {
2159 case WLAN_ACTION_SPCT_MSR_REQ:
2160 if (len < (IEEE80211_MIN_ACTION_SIZE +
2161 sizeof(mgmt->u.action.u.measurement)))
84040805 2162 break;
39192c0b 2163 ieee80211_process_measurement_req(sdata, mgmt, len);
84040805 2164 goto handled;
c481ec97
S		 2165 case WLAN_ACTION_SPCT_CHL_SWITCH:
2166 if (len < (IEEE80211_MIN_ACTION_SIZE +
2167 sizeof(mgmt->u.action.u.chan_switch)))
84040805 2168 break;
c481ec97 2169
cc32abd4 2170 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2171 break;
cc32abd4 2172
46900298 2173 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
84040805 2174 break;
c481ec97 2175
8b58ff83 2176 goto queue;
39192c0b
JB		 2177 }
2178 break;
fea14732
JM		 2179 case WLAN_CATEGORY_SA_QUERY:
2180 if (len < (IEEE80211_MIN_ACTION_SIZE +
2181 sizeof(mgmt->u.action.u.sa_query)))
84040805
JB		 2182 break;
2183
fea14732
JM		 2184 switch (mgmt->u.action.u.sa_query.action) {
2185 case WLAN_ACTION_SA_QUERY_REQUEST:
2186 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2187 break;
fea14732 2188 ieee80211_process_sa_query_req(sdata, mgmt, len);
84040805 2189 goto handled;
fea14732
JM		 2190 }
2191 break;
97ad9139 2192 case WLAN_CATEGORY_MESH_PLINK:
77a121c3
JB		 2193 if (!ieee80211_vif_is_mesh(&sdata->vif))
2194 break;
8b58ff83 2195 goto queue;
c7108a71
JC		 2196 case WLAN_CATEGORY_MESH_PATH_SEL:
2197 if (!mesh_path_sel_is_hwmp(sdata))
2198 break;
2199 goto queue;
84040805 2200 }
026331c4 2201
2e161f78
JB		 2202 return RX_CONTINUE;
2203
bed7ee6e 2204 invalid:
554891e6 2205 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2e161f78
JB		 2206 /* will return in the next handlers */
2207 return RX_CONTINUE;
2208
2209 handled:
2210 if (rx->sta)
2211 rx->sta->rx_packets++;
2212 dev_kfree_skb(rx->skb);
2213 return RX_QUEUED;
2214
2215 queue:
2216 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2217 skb_queue_tail(&sdata->skb_queue, rx->skb);
2218 ieee80211_queue_work(&local->hw, &sdata->work);
2219 if (rx->sta)
2220 rx->sta->rx_packets++;
2221 return RX_QUEUED;
2222}
2223
2224static ieee80211_rx_result debug_noinline
2225ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2226{
554891e6 2227 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2228
2229 /* skip known-bad action frames and return them in the next handler */
554891e6 2230 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2e161f78 2231 return RX_CONTINUE;
d7907448 2232
026331c4
JM		 2233 /*
2234 * Getting here means the kernel doesn't know how to handle
2235 * it, but maybe userspace does ... include returned frames
2236 * so userspace can register for those to know whether ones
2237 * it transmitted were processed or returned.
2238 */
026331c4 2239
2e161f78
JB		 2240 if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
2241 rx->skb->data, rx->skb->len,
2242 GFP_ATOMIC)) {
2243 if (rx->sta)
2244 rx->sta->rx_packets++;
2245 dev_kfree_skb(rx->skb);
2246 return RX_QUEUED;
2247 }
2248
2249
2250 return RX_CONTINUE;
2251}
2252
2253static ieee80211_rx_result debug_noinline
2254ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2255{
2256 struct ieee80211_local *local = rx->local;
2257 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2258 struct sk_buff *nskb;
2259 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 2260 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2261
2262 if (!ieee80211_is_action(mgmt->frame_control))
2263 return RX_CONTINUE;
2264
2265 /*
2266 * For AP mode, hostapd is responsible for handling any action
2267 * frames that we didn't handle, including returning unknown
2268 * ones. For all other modes we will return them to the sender,
2269 * setting the 0x80 bit in the action category, as required by
2270 * 802.11-2007 7.3.1.11.
2271 * Newer versions of hostapd shall also use the management frame
2272 * registration mechanisms, but older ones still use cooked
2273 * monitor interfaces so push all frames there.
2274 */
554891e6 2275 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2e161f78
JB		 2276 (sdata->vif.type == NL80211_IFTYPE_AP ||
2277 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2278 return RX_DROP_MONITOR;
026331c4 2279
84040805
JB		 2280 /* do not return rejected action frames */
2281 if (mgmt->u.action.category & 0x80)
2282 return RX_DROP_UNUSABLE;
2283
2284 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2285 GFP_ATOMIC);
2286 if (nskb) {
292b4df6 2287 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
84040805 2288
292b4df6
JL		 2289 nmgmt->u.action.category |= 0x80;
2290 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2291 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
84040805
JB		 2292
2293 memset(nskb->cb, 0, sizeof(nskb->cb));
2294
2295 ieee80211_tx_skb(rx->sdata, nskb);
de1ede7a 2296 }
39192c0b
JB		 2297 dev_kfree_skb(rx->skb);
2298 return RX_QUEUED;
de1ede7a
JB		 2299}
2300
49461622 2301static ieee80211_rx_result debug_noinline
5cf121c3 2302ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 2303{
eb9fb5b8 2304 struct ieee80211_sub_if_data *sdata = rx->sdata;
af6b6374 2305 ieee80211_rx_result rxs;
77a121c3
JB		 2306 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2307 __le16 stype;
571ecf67 2308
af6b6374
JB		 2309 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2310 if (rxs != RX_CONTINUE)
2311 return rxs;
2312
77a121c3 2313 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
472dbc45 2314
77a121c3
JB		 2315 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2316 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2317 sdata->vif.type != NL80211_IFTYPE_STATION)
2318 return RX_DROP_MONITOR;
472dbc45 2319
77a121c3
JB		 2320 switch (stype) {
2321 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2322 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2323 /* process for all: mesh, mlme, ibss */
2324 break;
2325 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2326 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2c31333a
CL		 2327 if (is_multicast_ether_addr(mgmt->da) &&
2328 !is_broadcast_ether_addr(mgmt->da))
2329 return RX_DROP_MONITOR;
2330
77a121c3
JB		 2331 /* process only for station */
2332 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2333 return RX_DROP_MONITOR;
2334 break;
2335 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2336 case cpu_to_le16(IEEE80211_STYPE_AUTH):
2337 /* process only for ibss */
2338 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
2339 return RX_DROP_MONITOR;
2340 break;
2341 default:
2342 return RX_DROP_MONITOR;
2343 }
f9d540ee 2344
77a121c3 2345 /* queue up frame and kick off work to process it */
c1475ca9 2346 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
77a121c3
JB		 2347 skb_queue_tail(&sdata->skb_queue, rx->skb);
2348 ieee80211_queue_work(&rx->local->hw, &sdata->work);
8b58ff83
JB		 2349 if (rx->sta)
2350 rx->sta->rx_packets++;
46900298 2351
77a121c3 2352 return RX_QUEUED;
571ecf67
JB		 2353}
2354
3b8d81e0 2355static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
5cf121c3 2356 struct ieee80211_rx_data *rx)
571ecf67 2357{
a7767f95
HH		 2358 int keyidx;
2359 unsigned int hdrlen;
571ecf67 2360
a7767f95 2361 hdrlen = ieee80211_hdrlen(hdr->frame_control);
571ecf67
JB		 2362 if (rx->skb->len >= hdrlen + 4)
2363 keyidx = rx->skb->data[hdrlen + 3] >> 6;
2364 else
2365 keyidx = -1;
2366
8944b79f 2367 if (!rx->sta) {
aa0daf0e
JB		 2368 /*
2369 * Some hardware seem to generate incorrect Michael MIC
2370 * reports; ignore them to avoid triggering countermeasures.
2371 */
af2ced6a 2372 return;
571ecf67
JB		 2373 }
2374
a7767f95 2375 if (!ieee80211_has_protected(hdr->frame_control))
af2ced6a 2376 return;
571ecf67 2377
05c914fe 2378 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
aa0daf0e
JB		 2379 /*
2380 * APs with pairwise keys should never receive Michael MIC
2381 * errors for non-zero keyidx because these are reserved for
2382 * group keys and only the AP is sending real multicast
2383 * frames in the BSS.
2384 */
af2ced6a 2385 return;
571ecf67
JB		 2386 }
2387
a7767f95
HH		 2388 if (!ieee80211_is_data(hdr->frame_control) &&
2389 !ieee80211_is_auth(hdr->frame_control))
af2ced6a 2390 return;
571ecf67 2391
e6d6e342
JB		 2392 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2393 GFP_ATOMIC);
571ecf67
JB		 2394}
2395
5cf121c3 2396/* TODO: use IEEE80211_RX_FRAGMENTED */
5f0b7de5
JB		 2397static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2398 struct ieee80211_rate *rate)
3d30d949
MW		 2399{
2400 struct ieee80211_sub_if_data *sdata;
2401 struct ieee80211_local *local = rx->local;
2402 struct ieee80211_rtap_hdr {
2403 struct ieee80211_radiotap_header hdr;
2404 u8 flags;
5f0b7de5 2405 u8 rate_or_pad;
3d30d949
MW		 2406 __le16 chan_freq;
2407 __le16 chan_flags;
bc10502d 2408 } __packed *rthdr;
3d30d949
MW		 2409 struct sk_buff *skb = rx->skb, *skb2;
2410 struct net_device *prev_dev = NULL;
eb9fb5b8 2411 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3d30d949 2412
554891e6
JB		 2413 /*
2414 * If cooked monitor has been processed already, then
2415 * don't do it again. If not, set the flag.
2416 */
2417 if (rx->flags & IEEE80211_RX_CMNTR)
7c1e1831 2418 goto out_free_skb;
554891e6 2419 rx->flags |= IEEE80211_RX_CMNTR;
7c1e1831 2420
3d30d949
MW		 2421 if (skb_headroom(skb) < sizeof(*rthdr) &&
2422 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2423 goto out_free_skb;
2424
2425 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2426 memset(rthdr, 0, sizeof(*rthdr));
2427 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2428 rthdr->hdr.it_present =
2429 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
3d30d949
MW		 2430 (1 << IEEE80211_RADIOTAP_CHANNEL));
2431
5f0b7de5
JB		 2432 if (rate) {
2433 rthdr->rate_or_pad = rate->bitrate / 5;
2434 rthdr->hdr.it_present |=
2435 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2436 }
3d30d949
MW		 2437 rthdr->chan_freq = cpu_to_le16(status->freq);
2438
2439 if (status->band == IEEE80211_BAND_5GHZ)
2440 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2441 IEEE80211_CHAN_5GHZ);
2442 else
2443 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2444 IEEE80211_CHAN_2GHZ);
2445
2446 skb_set_mac_header(skb, 0);
2447 skb->ip_summed = CHECKSUM_UNNECESSARY;
2448 skb->pkt_type = PACKET_OTHERHOST;
2449 skb->protocol = htons(ETH_P_802_2);
2450
2451 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
9607e6b6 2452 if (!ieee80211_sdata_running(sdata))
3d30d949
MW		 2453 continue;
2454
05c914fe 2455 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3d30d949
MW		 2456 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2457 continue;
2458
2459 if (prev_dev) {
2460 skb2 = skb_clone(skb, GFP_ATOMIC);
2461 if (skb2) {
2462 skb2->dev = prev_dev;
5548a8a1 2463 netif_receive_skb(skb2);
3d30d949
MW		 2464 }
2465 }
2466
2467 prev_dev = sdata->dev;
2468 sdata->dev->stats.rx_packets++;
2469 sdata->dev->stats.rx_bytes += skb->len;
2470 }
2471
2472 if (prev_dev) {
2473 skb->dev = prev_dev;
5548a8a1 2474 netif_receive_skb(skb);
554891e6
JB		 2475 return;
2476 }
3d30d949
MW		 2477
2478 out_free_skb:
2479 dev_kfree_skb(skb);
2480}
2481
aa0c8636
CL		 2482static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2483 ieee80211_rx_result res)
2484{
2485 switch (res) {
2486 case RX_DROP_MONITOR:
2487 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2488 if (rx->sta)
2489 rx->sta->rx_dropped++;
2490 /* fall through */
2491 case RX_CONTINUE: {
2492 struct ieee80211_rate *rate = NULL;
2493 struct ieee80211_supported_band *sband;
2494 struct ieee80211_rx_status *status;
2495
2496 status = IEEE80211_SKB_RXCB((rx->skb));
2497
2498 sband = rx->local->hw.wiphy->bands[status->band];
2499 if (!(status->flag & RX_FLAG_HT))
2500 rate = &sband->bitrates[status->rate_idx];
2501
2502 ieee80211_rx_cooked_monitor(rx, rate);
2503 break;
2504 }
2505 case RX_DROP_UNUSABLE:
2506 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2507 if (rx->sta)
2508 rx->sta->rx_dropped++;
2509 dev_kfree_skb(rx->skb);
2510 break;
2511 case RX_QUEUED:
2512 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2513 break;
2514 }
2515}
571ecf67 2516
24a8fdad 2517static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
58905290 2518{
58905290 2519 ieee80211_rx_result res = RX_DROP_MONITOR;
aa0c8636 2520 struct sk_buff *skb;
8944b79f 2521
e32f85f7
LCC		 2522#define CALL_RXH(rxh) \
2523 do { \
2524 res = rxh(rx); \
2525 if (res != RX_CONTINUE) \
2569a826 2526 goto rxh_next; \
e32f85f7 2527 } while (0);
49461622 2528
24a8fdad
CL		 2529 spin_lock(&rx->local->rx_skb_queue.lock);
2530 if (rx->local->running_rx_handler)
2531 goto unlock;
2532
2533 rx->local->running_rx_handler = true;
2534
2535 while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
2536 spin_unlock(&rx->local->rx_skb_queue.lock);
2537
2569a826
JB		 2538 /*
2539 * all the other fields are valid across frames
2540 * that belong to an aMPDU since they are on the
2541 * same TID from the same station
2542 */
2543 rx->skb = skb;
554891e6 2544 rx->flags = 0;
2569a826
JB		 2545
2546 CALL_RXH(ieee80211_rx_h_decrypt)
2547 CALL_RXH(ieee80211_rx_h_check_more_data)
2548 CALL_RXH(ieee80211_rx_h_sta_process)
2549 CALL_RXH(ieee80211_rx_h_defragment)
2550 CALL_RXH(ieee80211_rx_h_ps_poll)
2551 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2552 /* must be after MMIC verify so header is counted in MPDU mic */
2553 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2554 CALL_RXH(ieee80211_rx_h_amsdu)
bf94e17b 2555#ifdef CONFIG_MAC80211_MESH
aa0c8636 2556 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2569a826 2557 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 2558#endif
2569a826 2559 CALL_RXH(ieee80211_rx_h_data)
24a8fdad 2560 CALL_RXH(ieee80211_rx_h_ctrl);
2e161f78 2561 CALL_RXH(ieee80211_rx_h_mgmt_check)
2569a826 2562 CALL_RXH(ieee80211_rx_h_action)
2e161f78
JB		 2563 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2564 CALL_RXH(ieee80211_rx_h_action_return)
2569a826 2565 CALL_RXH(ieee80211_rx_h_mgmt)
49461622 2566
aa0c8636
CL		 2567 rxh_next:
2568 ieee80211_rx_handlers_result(rx, res);
24a8fdad 2569 spin_lock(&rx->local->rx_skb_queue.lock);
49461622 2570#undef CALL_RXH
aa0c8636 2571 }
24a8fdad
CL		 2572
2573 rx->local->running_rx_handler = false;
2574
2575 unlock:
2576 spin_unlock(&rx->local->rx_skb_queue.lock);
aa0c8636
CL		 2577}
2578
4406c376 2579static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
aa0c8636 2580{
aa0c8636
CL		 2581 ieee80211_rx_result res = RX_DROP_MONITOR;
2582
aa0c8636
CL		 2583#define CALL_RXH(rxh) \
2584 do { \
2585 res = rxh(rx); \
2586 if (res != RX_CONTINUE) \
2587 goto rxh_next; \
2588 } while (0);
2589
2590 CALL_RXH(ieee80211_rx_h_passive_scan)
2591 CALL_RXH(ieee80211_rx_h_check)
2592
24a8fdad 2593 ieee80211_rx_reorder_ampdu(rx);
aa0c8636 2594
24a8fdad 2595 ieee80211_rx_handlers(rx);
aa0c8636 2596 return;
49461622 2597
2569a826 2598 rxh_next:
aa0c8636
CL		 2599 ieee80211_rx_handlers_result(rx, res);
2600
2601#undef CALL_RXH
58905290
JB		 2602}
2603
2bff8ebf 2604/*
dd318575
JB		 2605 * This function makes calls into the RX path, therefore
2606 * it has to be invoked under RCU read lock.
2bff8ebf
CL		 2607 */
2608void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2609{
554891e6
JB		 2610 struct ieee80211_rx_data rx = {
2611 .sta = sta,
2612 .sdata = sta->sdata,
2613 .local = sta->local,
2614 .queue = tid,
2615 };
2c15a0cf
CL		 2616 struct tid_ampdu_rx *tid_agg_rx;
2617
2618 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2619 if (!tid_agg_rx)
2620 return;
2bff8ebf 2621
2c15a0cf 2622 spin_lock(&tid_agg_rx->reorder_lock);
24a8fdad 2623 ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
2c15a0cf 2624 spin_unlock(&tid_agg_rx->reorder_lock);
2bff8ebf 2625
24a8fdad 2626 ieee80211_rx_handlers(&rx);
2bff8ebf
CL		 2627}
2628
571ecf67
JB		 2629/* main receive path */
2630
20b01f80 2631static int prepare_for_handlers(struct ieee80211_rx_data *rx,
23a24def
JB		 2632 struct ieee80211_hdr *hdr)
2633{
20b01f80 2634 struct ieee80211_sub_if_data *sdata = rx->sdata;
eb9fb5b8
JB		 2635 struct sk_buff *skb = rx->skb;
2636 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2637 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
23a24def
JB		 2638 int multicast = is_multicast_ether_addr(hdr->addr1);
2639
51fb61e7 2640 switch (sdata->vif.type) {
05c914fe 2641 case NL80211_IFTYPE_STATION:
9bc383de 2642 if (!bssid && !sdata->u.mgd.use_4addr)
23a24def 2643 return 0;
77fdaa12 2644 if (!multicast &&
47846c9b 2645 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
4f312336
FF		 2646 if (!(sdata->dev->flags & IFF_PROMISC) ||
2647 sdata->u.mgd.use_4addr)
23a24def 2648 return 0;
554891e6 2649 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
23a24def
JB		 2650 }
2651 break;
05c914fe 2652 case NL80211_IFTYPE_ADHOC:
23a24def
JB		 2653 if (!bssid)
2654 return 0;
a7767f95 2655 if (ieee80211_is_beacon(hdr->frame_control)) {
9d9bf77d 2656 return 1;
87291c02 2657 }
46900298 2658 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
554891e6 2659 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
23a24def 2660 return 0;
554891e6 2661 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
23a24def 2662 } else if (!multicast &&
47846c9b 2663 compare_ether_addr(sdata->vif.addr,
23a24def 2664 hdr->addr1) != 0) {
4150c572 2665 if (!(sdata->dev->flags & IFF_PROMISC))
23a24def 2666 return 0;
554891e6 2667 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
0fb8ca45
JM		 2668 } else if (!rx->sta) {
2669 int rate_idx;
eb9fb5b8 2670 if (status->flag & RX_FLAG_HT)
0fb8ca45
JM		 2671 rate_idx = 0; /* TODO: HT rates */
2672 else
eb9fb5b8 2673 rate_idx = status->rate_idx;
34e89507
JB		 2674 rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
2675 hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
0fb8ca45 2676 }
23a24def 2677 break;
05c914fe 2678 case NL80211_IFTYPE_MESH_POINT:
6032f934 2679 if (!multicast &&
47846c9b 2680 compare_ether_addr(sdata->vif.addr,
6032f934
JB		 2681 hdr->addr1) != 0) {
2682 if (!(sdata->dev->flags & IFF_PROMISC))
2683 return 0;
2684
554891e6 2685 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
6032f934
JB		 2686 }
2687 break;
05c914fe
JB		 2688 case NL80211_IFTYPE_AP_VLAN:
2689 case NL80211_IFTYPE_AP:
23a24def 2690 if (!bssid) {
47846c9b 2691 if (compare_ether_addr(sdata->vif.addr,
23a24def
JB		 2692 hdr->addr1))
2693 return 0;
2694 } else if (!ieee80211_bssid_match(bssid,
47846c9b 2695 sdata->vif.addr)) {
771bbd09
AN		 2696 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
2697 !ieee80211_is_beacon(hdr->frame_control))
23a24def 2698 return 0;
554891e6 2699 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
23a24def 2700 }
23a24def 2701 break;
05c914fe 2702 case NL80211_IFTYPE_WDS:
a7767f95 2703 if (bssid || !ieee80211_is_data(hdr->frame_control))
23a24def
JB		 2704 return 0;
2705 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2706 return 0;
2707 break;
2ca27bcf 2708 default:
fb1c1cd6
JB		 2709 /* should never get here */
2710 WARN_ON(1);
2711 break;
23a24def
JB		 2712 }
2713
2714 return 1;
2715}
2716
4406c376
JB		 2717/*
2718 * This function returns whether or not the SKB
2719 * was destined for RX processing or not, which,
2720 * if consume is true, is equivalent to whether
2721 * or not the skb was consumed.
2722 */
2723static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2724 struct sk_buff *skb, bool consume)
2725{
2726 struct ieee80211_local *local = rx->local;
2727 struct ieee80211_sub_if_data *sdata = rx->sdata;
2728 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2729 struct ieee80211_hdr *hdr = (void *)skb->data;
2730 int prepares;
2731
2732 rx->skb = skb;
554891e6 2733 status->rx_flags |= IEEE80211_RX_RA_MATCH;
4406c376
JB		 2734 prepares = prepare_for_handlers(rx, hdr);
2735
2736 if (!prepares)
2737 return false;
2738
2739 if (status->flag & RX_FLAG_MMIC_ERROR) {
554891e6 2740 if (status->rx_flags & IEEE80211_RX_RA_MATCH)
4406c376
JB		 2741 ieee80211_rx_michael_mic_report(hdr, rx);
2742 return false;
2743 }
2744
2745 if (!consume) {
2746 skb = skb_copy(skb, GFP_ATOMIC);
2747 if (!skb) {
2748 if (net_ratelimit())
2749 wiphy_debug(local->hw.wiphy,
b305dae4 2750 "failed to copy skb for %s\n",
4406c376
JB		 2751 sdata->name);
2752 return true;
2753 }
2754
2755 rx->skb = skb;
2756 }
2757
2758 ieee80211_invoke_rx_handlers(rx);
2759 return true;
2760}
2761
571ecf67 2762/*
6368e4b1
RR		 2763 * This is the actual Rx frames handler. as it blongs to Rx path it must
2764 * be called with rcu_read_lock protection.
571ecf67 2765 */
71ebb4aa 2766static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
071d9ac2 2767 struct sk_buff *skb)
571ecf67 2768{
554891e6 2769 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
571ecf67
JB		 2770 struct ieee80211_local *local = hw_to_local(hw);
2771 struct ieee80211_sub_if_data *sdata;
571ecf67 2772 struct ieee80211_hdr *hdr;
e3cf8b3f 2773 __le16 fc;
5cf121c3 2774 struct ieee80211_rx_data rx;
4406c376 2775 struct ieee80211_sub_if_data *prev;
56af3268 2776 struct sta_info *sta, *tmp, *prev_sta;
e3cf8b3f 2777 int err = 0;
571ecf67 2778
e3cf8b3f 2779 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
571ecf67
JB		 2780 memset(&rx, 0, sizeof(rx));
2781 rx.skb = skb;
2782 rx.local = local;
72abd81b 2783
e3cf8b3f 2784 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
571ecf67 2785 local->dot11ReceivedFragmentCount++;
571ecf67 2786
142b9f50 2787 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
b23b025f 2788 test_bit(SCAN_SW_SCANNING, &local->scanning)))
554891e6 2789 status->rx_flags |= IEEE80211_RX_IN_SCAN;
571ecf67 2790
e3cf8b3f
ZY		 2791 if (ieee80211_is_mgmt(fc))
2792 err = skb_linearize(skb);
2793 else
2794 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
2795
2796 if (err) {
2797 dev_kfree_skb(skb);
2798 return;
2799 }
2800
2801 hdr = (struct ieee80211_hdr *)skb->data;
38f3714d 2802 ieee80211_parse_qos(&rx);
d1c3a37c 2803 ieee80211_verify_alignment(&rx);
38f3714d 2804
e3cf8b3f 2805 if (ieee80211_is_data(fc)) {
56af3268 2806 prev_sta = NULL;
4406c376 2807
abe60632 2808 for_each_sta_info(local, hdr->addr2, sta, tmp) {
56af3268
BG		 2809 if (!prev_sta) {
2810 prev_sta = sta;
2811 continue;
2812 }
2813
2814 rx.sta = prev_sta;
2815 rx.sdata = prev_sta->sdata;
4406c376 2816 ieee80211_prepare_and_rx_handle(&rx, skb, false);
abe60632 2817
56af3268 2818 prev_sta = sta;
4406c376 2819 }
56af3268
BG		 2820
2821 if (prev_sta) {
2822 rx.sta = prev_sta;
2823 rx.sdata = prev_sta->sdata;
2824
4406c376 2825 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
56af3268 2826 return;
8e26d5ad 2827 goto out;
56af3268 2828 }
4406c376
JB		 2829 }
2830
4b0dd98e 2831 prev = NULL;
b2e7771e 2832
4b0dd98e
JB		 2833 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2834 if (!ieee80211_sdata_running(sdata))
2835 continue;
340e11f3 2836
4b0dd98e
JB		 2837 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2838 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2839 continue;
340e11f3 2840
4b0dd98e
JB		 2841 /*
2842 * frame is destined for this interface, but if it's
2843 * not also for the previous one we handle that after
2844 * the loop to avoid copying the SKB once too much
2845 */
4bb29f8c 2846
4b0dd98e 2847 if (!prev) {
abe60632 2848 prev = sdata;
4b0dd98e 2849 continue;
340e11f3 2850 }
4bb29f8c 2851
4b0dd98e
JB		 2852 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2853 rx.sdata = prev;
2854 ieee80211_prepare_and_rx_handle(&rx, skb, false);
4bb29f8c 2855
4b0dd98e
JB		 2856 prev = sdata;
2857 }
2858
2859 if (prev) {
2860 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2861 rx.sdata = prev;
4406c376 2862
4b0dd98e
JB		 2863 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2864 return;
571ecf67 2865 }
4406c376 2866
8e26d5ad 2867 out:
4406c376 2868 dev_kfree_skb(skb);
571ecf67 2869}
6368e4b1
RR		 2870
2871/*
2872 * This is the receive path handler. It is called by a low level driver when an
2873 * 802.11 MPDU is received from the hardware.
2874 */
103bf9f7 2875void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
6368e4b1
RR		 2876{
2877 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB		 2878 struct ieee80211_rate *rate = NULL;
2879 struct ieee80211_supported_band *sband;
f1d58c25 2880 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
8318d78a 2881
d20ef63d
JB		 2882 WARN_ON_ONCE(softirq_count() == 0);
2883
77a980dc
JB		 2884 if (WARN_ON(status->band < 0 ||
2885 status->band >= IEEE80211_NUM_BANDS))
2886 goto drop;
8318d78a
JB		 2887
2888 sband = local->hw.wiphy->bands[status->band];
77a980dc
JB		 2889 if (WARN_ON(!sband))
2890 goto drop;
8318d78a 2891
89c3a8ac
JB		 2892 /*
2893 * If we're suspending, it is possible although not too likely
2894 * that we'd be receiving frames after having already partially
2895 * quiesced the stack. We can't process such frames then since
2896 * that might, for example, cause stations to be added or other
2897 * driver callbacks be invoked.
2898 */
77a980dc
JB		 2899 if (unlikely(local->quiescing || local->suspended))
2900 goto drop;
89c3a8ac 2901
ea77f12f
JB		 2902 /*
2903 * The same happens when we're not even started,
2904 * but that's worth a warning.
2905 */
77a980dc
JB		 2906 if (WARN_ON(!local->started))
2907 goto drop;
ea77f12f 2908
fc885189 2909 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
e5d6eb83 2910 /*
fc885189
JB		 2911 * Validate the rate, unless a PLCP error means that
2912 * we probably can't have a valid rate here anyway.
e5d6eb83 2913 */
fc885189
JB		 2914
2915 if (status->flag & RX_FLAG_HT) {
2916 /*
2917 * rate_idx is MCS index, which can be [0-76]
2918 * as documented on:
2919 *
2920 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2921 *
2922 * Anything else would be some sort of driver or
2923 * hardware error. The driver should catch hardware
2924 * errors.
2925 */
2926 if (WARN((status->rate_idx < 0 ||
2927 status->rate_idx > 76),
2928 "Rate marked as an HT rate but passed "
2929 "status->rate_idx is not "
2930 "an MCS index [0-76]: %d (0x%02x)\n",
2931 status->rate_idx,
2932 status->rate_idx))
2933 goto drop;
2934 } else {
2935 if (WARN_ON(status->rate_idx < 0 ||
2936 status->rate_idx >= sband->n_bitrates))
2937 goto drop;
2938 rate = &sband->bitrates[status->rate_idx];
2939 }
0fb8ca45 2940 }
6368e4b1 2941
554891e6
JB		 2942 status->rx_flags = 0;
2943
6368e4b1
RR		 2944 /*
2945 * key references and virtual interfaces are protected using RCU
2946 * and this requires that we are in a read-side RCU section during
2947 * receive processing
2948 */
2949 rcu_read_lock();
2950
2951 /*
2952 * Frames with failed FCS/PLCP checksum are not returned,
2953 * all other frames are returned without radiotap header
2954 * if it was previously present.
2955 * Also, frames with less than 16 bytes are dropped.
2956 */
f1d58c25 2957 skb = ieee80211_rx_monitor(local, skb, rate);
6368e4b1
RR		 2958 if (!skb) {
2959 rcu_read_unlock();
2960 return;
2961 }
2962
e1e54068
JB		 2963 ieee80211_tpt_led_trig_rx(local,
2964 ((struct ieee80211_hdr *)skb->data)->frame_control,
2965 skb->len);
071d9ac2 2966 __ieee80211_rx_handle_packet(hw, skb);
6368e4b1
RR		 2967
2968 rcu_read_unlock();
77a980dc
JB		 2969
2970 return;
2971 drop:
2972 kfree_skb(skb);
6368e4b1 2973}
103bf9f7 2974EXPORT_SYMBOL(ieee80211_rx);
571ecf67
JB		 2975
2976/* This is a version of the rx handler that can be called from hard irq
2977 * context. Post the skb on the queue and schedule the tasklet */
f1d58c25 2978void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
571ecf67
JB		 2979{
2980 struct ieee80211_local *local = hw_to_local(hw);
2981
2982 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2983
571ecf67
JB		 2984 skb->pkt_type = IEEE80211_RX_MSG;
2985 skb_queue_tail(&local->skb_queue, skb);
2986 tasklet_schedule(&local->tasklet);
2987}
2988EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Ubuntu Hirsute Linux kernel mirror