]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/mac80211/rx.c
rtl8187: remove priv->mode
[mirror_ubuntu-bionic-kernel.git] / net / mac80211 / rx.c
CommitLineData
571ecf67
JB
1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
ab46623e 12#include <linux/jiffies.h>
571ecf67
JB
13#include <linux/kernel.h>
14#include <linux/skbuff.h>
15#include <linux/netdevice.h>
16#include <linux/etherdevice.h>
d4e46a3d 17#include <linux/rcupdate.h>
571ecf67
JB
18#include <net/mac80211.h>
19#include <net/ieee80211_radiotap.h>
20
21#include "ieee80211_i.h"
24487981 22#include "driver-ops.h"
2c8dccc7 23#include "led.h"
33b64eb2 24#include "mesh.h"
571ecf67
JB
25#include "wep.h"
26#include "wpa.h"
27#include "tkip.h"
28#include "wme.h"
29
b2e7771e
JB
30/*
31 * monitor mode reception
32 *
33 * This function cleans up the SKB, i.e. it removes all the stuff
34 * only useful for monitoring.
35 */
36static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
0869aea0 37 struct sk_buff *skb)
b2e7771e 38{
b2e7771e
JB
39 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
40 if (likely(skb->len > FCS_LEN))
41 skb_trim(skb, skb->len - FCS_LEN);
42 else {
43 /* driver bug */
44 WARN_ON(1);
45 dev_kfree_skb(skb);
46 skb = NULL;
47 }
48 }
49
50 return skb;
51}
52
f1d58c25 53static inline int should_drop_frame(struct sk_buff *skb,
0869aea0 54 int present_fcs_len)
b2e7771e 55{
f1d58c25 56 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
182503ab 57 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
b2e7771e
JB
58
59 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
60 return 1;
0869aea0 61 if (unlikely(skb->len < 16 + present_fcs_len))
b2e7771e 62 return 1;
87228f57
HH
63 if (ieee80211_is_ctl(hdr->frame_control) &&
64 !ieee80211_is_pspoll(hdr->frame_control) &&
65 !ieee80211_is_back_req(hdr->frame_control))
b2e7771e
JB
66 return 1;
67 return 0;
68}
69
601ae7f2
BR
70static int
71ieee80211_rx_radiotap_len(struct ieee80211_local *local,
72 struct ieee80211_rx_status *status)
73{
74 int len;
75
76 /* always present fields */
77 len = sizeof(struct ieee80211_radiotap_header) + 9;
78
79 if (status->flag & RX_FLAG_TSFT)
80 len += 8;
7fee5372 81 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
601ae7f2
BR
82 len += 1;
83 if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
84 len += 1;
85
86 if (len & 1) /* padding for RX_FLAGS if necessary */
87 len++;
88
601ae7f2
BR
89 return len;
90}
91
d1c3a37c 92/*
601ae7f2
BR
93 * ieee80211_add_rx_radiotap_header - add radiotap header
94 *
95 * add a radiotap header containing all the fields which the hardware provided.
96 */
97static void
98ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
99 struct sk_buff *skb,
601ae7f2
BR
100 struct ieee80211_rate *rate,
101 int rtap_len)
102{
f1d58c25 103 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
601ae7f2
BR
104 struct ieee80211_radiotap_header *rthdr;
105 unsigned char *pos;
6a86b9c7 106 u16 rx_flags = 0;
601ae7f2
BR
107
108 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
109 memset(rthdr, 0, rtap_len);
110
111 /* radiotap header, set always present flags */
112 rthdr->it_present =
113 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
601ae7f2
BR
114 (1 << IEEE80211_RADIOTAP_CHANNEL) |
115 (1 << IEEE80211_RADIOTAP_ANTENNA) |
116 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
117 rthdr->it_len = cpu_to_le16(rtap_len);
118
119 pos = (unsigned char *)(rthdr+1);
120
121 /* the order of the following fields is important */
122
123 /* IEEE80211_RADIOTAP_TSFT */
124 if (status->flag & RX_FLAG_TSFT) {
6a86b9c7 125 put_unaligned_le64(status->mactime, pos);
601ae7f2
BR
126 rthdr->it_present |=
127 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
128 pos += 8;
129 }
130
131 /* IEEE80211_RADIOTAP_FLAGS */
132 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
133 *pos |= IEEE80211_RADIOTAP_F_FCS;
aae89831
JB
134 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
135 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
b4f28bbb
BR
136 if (status->flag & RX_FLAG_SHORTPRE)
137 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR
138 pos++;
139
140 /* IEEE80211_RADIOTAP_RATE */
0fb8ca45
JM
141 if (status->flag & RX_FLAG_HT) {
142 /*
143 * TODO: add following information into radiotap header once
144 * suitable fields are defined for it:
145 * - MCS index (status->rate_idx)
146 * - HT40 (status->flag & RX_FLAG_40MHZ)
147 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
148 */
149 *pos = 0;
8d6f658e 150 } else {
ebe6c7ba 151 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
0fb8ca45 152 *pos = rate->bitrate / 5;
8d6f658e 153 }
601ae7f2
BR
154 pos++;
155
156 /* IEEE80211_RADIOTAP_CHANNEL */
6a86b9c7 157 put_unaligned_le16(status->freq, pos);
601ae7f2
BR
158 pos += 2;
159 if (status->band == IEEE80211_BAND_5GHZ)
6a86b9c7
JB
160 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
161 pos);
5f0b7de5
JB
162 else if (status->flag & RX_FLAG_HT)
163 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
164 pos);
9deb1ae5 165 else if (rate->flags & IEEE80211_RATE_ERP_G)
6a86b9c7
JB
166 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
167 pos);
601ae7f2 168 else
6a86b9c7
JB
169 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
170 pos);
601ae7f2
BR
171 pos += 2;
172
173 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
174 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
175 *pos = status->signal;
176 rthdr->it_present |=
177 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
178 pos++;
179 }
180
181 /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
182 if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
183 *pos = status->noise;
184 rthdr->it_present |=
185 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
186 pos++;
187 }
188
189 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
190
191 /* IEEE80211_RADIOTAP_ANTENNA */
192 *pos = status->antenna;
193 pos++;
194
601ae7f2
BR
195 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
196
197 /* IEEE80211_RADIOTAP_RX_FLAGS */
198 /* ensure 2 byte alignment for the 2 byte field as required */
6a86b9c7 199 if ((pos - (u8 *)rthdr) & 1)
601ae7f2 200 pos++;
aae89831 201 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
6a86b9c7
JB
202 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
203 put_unaligned_le16(rx_flags, pos);
601ae7f2
BR
204 pos += 2;
205}
206
b2e7771e
JB
207/*
208 * This function copies a received frame to all monitor interfaces and
209 * returns a cleaned-up SKB that no longer includes the FCS nor the
210 * radiotap header the driver might have added.
211 */
212static struct sk_buff *
213ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a 214 struct ieee80211_rate *rate)
b2e7771e 215{
f1d58c25 216 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
b2e7771e 217 struct ieee80211_sub_if_data *sdata;
b2e7771e 218 int needed_headroom = 0;
b2e7771e
JB
219 struct sk_buff *skb, *skb2;
220 struct net_device *prev_dev = NULL;
221 int present_fcs_len = 0;
b2e7771e
JB
222
223 /*
224 * First, we may need to make a copy of the skb because
225 * (1) we need to modify it for radiotap (if not present), and
226 * (2) the other RX handlers will modify the skb we got.
227 *
228 * We don't need to, of course, if we aren't going to return
229 * the SKB because it has a bad FCS/PLCP checksum.
230 */
0869aea0
JB
231
232 /* room for the radiotap header based on driver features */
233 needed_headroom = ieee80211_rx_radiotap_len(local, status);
b2e7771e
JB
234
235 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
236 present_fcs_len = FCS_LEN;
237
238 if (!local->monitors) {
0869aea0 239 if (should_drop_frame(origskb, present_fcs_len)) {
b2e7771e
JB
240 dev_kfree_skb(origskb);
241 return NULL;
242 }
243
0869aea0 244 return remove_monitor_info(local, origskb);
b2e7771e
JB
245 }
246
0869aea0 247 if (should_drop_frame(origskb, present_fcs_len)) {
b2e7771e
JB
248 /* only need to expand headroom if necessary */
249 skb = origskb;
250 origskb = NULL;
251
252 /*
253 * This shouldn't trigger often because most devices have an
254 * RX header they pull before we get here, and that should
255 * be big enough for our radiotap information. We should
256 * probably export the length to drivers so that we can have
257 * them allocate enough headroom to start with.
258 */
259 if (skb_headroom(skb) < needed_headroom &&
c49e5ea3 260 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
b2e7771e
JB
261 dev_kfree_skb(skb);
262 return NULL;
263 }
264 } else {
265 /*
266 * Need to make a copy and possibly remove radiotap header
267 * and FCS from the original.
268 */
269 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
270
0869aea0 271 origskb = remove_monitor_info(local, origskb);
b2e7771e
JB
272
273 if (!skb)
274 return origskb;
275 }
276
0869aea0
JB
277 /* prepend radiotap information */
278 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
b2e7771e 279
ce3edf6d 280 skb_reset_mac_header(skb);
b2e7771e
JB
281 skb->ip_summed = CHECKSUM_UNNECESSARY;
282 skb->pkt_type = PACKET_OTHERHOST;
283 skb->protocol = htons(ETH_P_802_2);
284
285 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
05c914fe 286 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
b2e7771e
JB
287 continue;
288
3d30d949
MW
289 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
290 continue;
291
47846c9b
JB
292 if (!netif_running(sdata->dev))
293 continue;
294
b2e7771e
JB
295 if (prev_dev) {
296 skb2 = skb_clone(skb, GFP_ATOMIC);
297 if (skb2) {
298 skb2->dev = prev_dev;
299 netif_rx(skb2);
300 }
301 }
302
303 prev_dev = sdata->dev;
304 sdata->dev->stats.rx_packets++;
305 sdata->dev->stats.rx_bytes += skb->len;
306 }
307
308 if (prev_dev) {
309 skb->dev = prev_dev;
310 netif_rx(skb);
311 } else
312 dev_kfree_skb(skb);
313
314 return origskb;
315}
316
317
5cf121c3 318static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 319{
238f74a2 320 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
6e0d114d
JB
321 int tid;
322
323 /* does the frame have a qos control field? */
238f74a2
HH
324 if (ieee80211_is_data_qos(hdr->frame_control)) {
325 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 326 /* frame has qos control */
238f74a2
HH
327 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
328 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
5cf121c3 329 rx->flags |= IEEE80211_RX_AMSDU;
fd4c7f2f 330 else
5cf121c3 331 rx->flags &= ~IEEE80211_RX_AMSDU;
6e0d114d 332 } else {
1411f9b5
JB
333 /*
334 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
335 *
336 * Sequence numbers for management frames, QoS data
337 * frames with a broadcast/multicast address in the
338 * Address 1 field, and all non-QoS data frames sent
339 * by QoS STAs are assigned using an additional single
340 * modulo-4096 counter, [...]
341 *
342 * We also use that counter for non-QoS STAs.
343 */
344 tid = NUM_RX_DATA_QUEUES - 1;
6e0d114d 345 }
52865dfd 346
5cf121c3 347 rx->queue = tid;
6e0d114d
JB
348 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
349 * For now, set skb->priority to 0 for other cases. */
350 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 351}
6e0d114d 352
d1c3a37c
JB
353/**
354 * DOC: Packet alignment
355 *
356 * Drivers always need to pass packets that are aligned to two-byte boundaries
357 * to the stack.
358 *
359 * Additionally, should, if possible, align the payload data in a way that
360 * guarantees that the contained IP header is aligned to a four-byte
361 * boundary. In the case of regular frames, this simply means aligning the
362 * payload to a four-byte boundary (because either the IP header is directly
363 * contained, or IV/RFC1042 headers that have a length divisible by four are
59d9cb07
KV
364 * in front of it). If the payload data is not properly aligned and the
365 * architecture doesn't support efficient unaligned operations, mac80211
366 * will align the data.
d1c3a37c
JB
367 *
368 * With A-MSDU frames, however, the payload data address must yield two modulo
369 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
370 * push the IP header further back to a multiple of four again. Thankfully, the
371 * specs were sane enough this time around to require padding each A-MSDU
372 * subframe to a length that is a multiple of four.
373 *
374 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
375 * the payload is not supported, the driver is required to move the 802.11
376 * header to be directly in front of the payload in that case.
377 */
378static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
38f3714d 379{
59d9cb07
KV
380#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
381 WARN_ONCE((unsigned long)rx->skb->data & 1,
382 "unaligned packet at 0x%p\n", rx->skb->data);
d1c3a37c 383#endif
6e0d114d
JB
384}
385
6368e4b1 386
571ecf67
JB
387/* rx handlers */
388
49461622 389static ieee80211_rx_result debug_noinline
5cf121c3 390ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
571ecf67
JB
391{
392 struct ieee80211_local *local = rx->local;
393 struct sk_buff *skb = rx->skb;
394
fbe9c429 395 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning)))
f1d58c25 396 return ieee80211_scan_rx(rx->sdata, skb);
ece8eddd 397
142b9f50
HS
398 if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning) &&
399 (rx->flags & IEEE80211_RX_IN_SCAN))) {
ece8eddd 400 /* drop all the other packets during a software scan anyway */
f1d58c25 401 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
ece8eddd 402 dev_kfree_skb(skb);
9ae54c84 403 return RX_QUEUED;
571ecf67
JB
404 }
405
5cf121c3 406 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
571ecf67
JB
407 /* scanning finished during invoking of handlers */
408 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
e4c26add 409 return RX_DROP_UNUSABLE;
571ecf67
JB
410 }
411
9ae54c84 412 return RX_CONTINUE;
571ecf67
JB
413}
414
3cfcf6ac
JM
415
416static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
417{
418 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
419
420 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
421 return 0;
422
423 return ieee80211_is_robust_mgmt_frame(hdr);
424}
425
426
427static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
428{
429 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
430
431 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
432 return 0;
433
434 return ieee80211_is_robust_mgmt_frame(hdr);
435}
436
437
438/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
439static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
440{
441 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
442 struct ieee80211_mmie *mmie;
443
444 if (skb->len < 24 + sizeof(*mmie) ||
445 !is_multicast_ether_addr(hdr->da))
446 return -1;
447
448 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
449 return -1; /* not a robust management frame */
450
451 mmie = (struct ieee80211_mmie *)
452 (skb->data + skb->len - sizeof(*mmie));
453 if (mmie->element_id != WLAN_EID_MMIE ||
454 mmie->length != sizeof(*mmie) - 2)
455 return -1;
456
457 return le16_to_cpu(mmie->key_id);
458}
459
460
33b64eb2 461static ieee80211_rx_result
5cf121c3 462ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 463{
a7767f95
HH
464 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
465 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
47846c9b 466 char *dev_addr = rx->sdata->vif.addr;
d6d1a5a7 467
a7767f95 468 if (ieee80211_is_data(hdr->frame_control)) {
3c5772a5
JC
469 if (is_multicast_ether_addr(hdr->addr1)) {
470 if (ieee80211_has_tods(hdr->frame_control) ||
471 !ieee80211_has_fromds(hdr->frame_control))
472 return RX_DROP_MONITOR;
473 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
474 return RX_DROP_MONITOR;
475 } else {
476 if (!ieee80211_has_a4(hdr->frame_control))
477 return RX_DROP_MONITOR;
478 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
479 return RX_DROP_MONITOR;
480 }
33b64eb2
LCC
481 }
482
483 /* If there is not an established peer link and this is not a peer link
484 * establisment frame, beacon or probe, drop the frame.
485 */
486
b4e08ea1 487 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
33b64eb2 488 struct ieee80211_mgmt *mgmt;
d6d1a5a7 489
a7767f95 490 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC
491 return RX_DROP_MONITOR;
492
a7767f95 493 if (ieee80211_is_action(hdr->frame_control)) {
33b64eb2 494 mgmt = (struct ieee80211_mgmt *)hdr;
0938393f 495 if (mgmt->u.action.category != MESH_PLINK_CATEGORY)
33b64eb2 496 return RX_DROP_MONITOR;
33b64eb2 497 return RX_CONTINUE;
33b64eb2
LCC
498 }
499
a7767f95
HH
500 if (ieee80211_is_probe_req(hdr->frame_control) ||
501 ieee80211_is_probe_resp(hdr->frame_control) ||
502 ieee80211_is_beacon(hdr->frame_control))
503 return RX_CONTINUE;
504
505 return RX_DROP_MONITOR;
506
507 }
508
509#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
510
511 if (ieee80211_is_data(hdr->frame_control) &&
512 is_multicast_ether_addr(hdr->addr1) &&
3c5772a5 513 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
33b64eb2 514 return RX_DROP_MONITOR;
902acc78 515#undef msh_h_get
d6d1a5a7 516
902acc78
JB
517 return RX_CONTINUE;
518}
33b64eb2 519
1edfb1af
JB
520#define SEQ_MODULO 0x1000
521#define SEQ_MASK 0xfff
522
523static inline int seq_less(u16 sq1, u16 sq2)
524{
525 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
526}
527
528static inline u16 seq_inc(u16 sq)
529{
530 return (sq + 1) & SEQ_MASK;
531}
532
533static inline u16 seq_sub(u16 sq1, u16 sq2)
534{
535 return (sq1 - sq2) & SEQ_MASK;
536}
537
538
539static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
540 struct tid_ampdu_rx *tid_agg_rx,
2569a826
JB
541 int index,
542 struct sk_buff_head *frames)
1edfb1af
JB
543{
544 struct ieee80211_supported_band *sband;
545 struct ieee80211_rate *rate = NULL;
546 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
547 struct ieee80211_rx_status *status;
548
549 if (!skb)
550 goto no_frame;
551
552 status = IEEE80211_SKB_RXCB(skb);
553
554 /* release the reordered frames to stack */
555 sband = hw->wiphy->bands[status->band];
556 if (!(status->flag & RX_FLAG_HT))
557 rate = &sband->bitrates[status->rate_idx];
1edfb1af
JB
558 tid_agg_rx->stored_mpdu_num--;
559 tid_agg_rx->reorder_buf[index] = NULL;
d29cecda 560 __skb_queue_tail(frames, skb);
1edfb1af
JB
561
562no_frame:
563 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
564}
565
566static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
567 struct tid_ampdu_rx *tid_agg_rx,
2569a826
JB
568 u16 head_seq_num,
569 struct sk_buff_head *frames)
1edfb1af
JB
570{
571 int index;
572
573 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
574 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
575 tid_agg_rx->buf_size;
2569a826 576 ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
1edfb1af
JB
577 }
578}
579
580/*
581 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
582 * the skb was added to the buffer longer than this time ago, the earlier
583 * frames that have not yet been received are assumed to be lost and the skb
584 * can be released for processing. This may also release other skb's from the
585 * reorder buffer if there are no additional gaps between the frames.
586 */
587#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
588
589/*
590 * As this function belongs to the RX path it must be under
591 * rcu_read_lock protection. It returns false if the frame
592 * can be processed immediately, true if it was consumed.
593 */
594static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
595 struct tid_ampdu_rx *tid_agg_rx,
2569a826
JB
596 struct sk_buff *skb,
597 struct sk_buff_head *frames)
1edfb1af
JB
598{
599 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
600 u16 sc = le16_to_cpu(hdr->seq_ctrl);
601 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
602 u16 head_seq_num, buf_size;
603 int index;
604
605 buf_size = tid_agg_rx->buf_size;
606 head_seq_num = tid_agg_rx->head_seq_num;
607
608 /* frame with out of date sequence number */
609 if (seq_less(mpdu_seq_num, head_seq_num)) {
610 dev_kfree_skb(skb);
611 return true;
612 }
613
614 /*
615 * If frame the sequence number exceeds our buffering window
616 * size release some previous frames to make room for this one.
617 */
618 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
619 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
620 /* release stored frames up to new head to stack */
2569a826
JB
621 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num,
622 frames);
1edfb1af
JB
623 }
624
625 /* Now the new frame is always in the range of the reordering buffer */
626
627 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
628
629 /* check if we already stored this frame */
630 if (tid_agg_rx->reorder_buf[index]) {
631 dev_kfree_skb(skb);
632 return true;
633 }
634
635 /*
636 * If the current MPDU is in the right order and nothing else
637 * is stored we can process it directly, no need to buffer it.
638 */
639 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
640 tid_agg_rx->stored_mpdu_num == 0) {
641 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
642 return false;
643 }
644
645 /* put the frame in the reordering buffer */
646 tid_agg_rx->reorder_buf[index] = skb;
647 tid_agg_rx->reorder_time[index] = jiffies;
648 tid_agg_rx->stored_mpdu_num++;
649 /* release the buffer until next missing frame */
650 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
651 tid_agg_rx->buf_size;
652 if (!tid_agg_rx->reorder_buf[index] &&
653 tid_agg_rx->stored_mpdu_num > 1) {
654 /*
655 * No buffers ready to be released, but check whether any
656 * frames in the reorder buffer have timed out.
657 */
658 int j;
659 int skipped = 1;
660 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
661 j = (j + 1) % tid_agg_rx->buf_size) {
662 if (!tid_agg_rx->reorder_buf[j]) {
663 skipped++;
664 continue;
665 }
666 if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
667 HT_RX_REORDER_BUF_TIMEOUT))
668 break;
669
670#ifdef CONFIG_MAC80211_HT_DEBUG
671 if (net_ratelimit())
672 printk(KERN_DEBUG "%s: release an RX reorder "
673 "frame due to timeout on earlier "
674 "frames\n",
675 wiphy_name(hw->wiphy));
676#endif
2569a826
JB
677 ieee80211_release_reorder_frame(hw, tid_agg_rx,
678 j, frames);
1edfb1af
JB
679
680 /*
681 * Increment the head seq# also for the skipped slots.
682 */
683 tid_agg_rx->head_seq_num =
684 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
685 skipped = 0;
686 }
687 } else while (tid_agg_rx->reorder_buf[index]) {
2569a826 688 ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
1edfb1af
JB
689 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
690 tid_agg_rx->buf_size;
691 }
692
693 return true;
694}
695
696/*
697 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
698 * true if the MPDU was buffered, false if it should be processed.
699 */
2569a826
JB
700static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
701 struct sk_buff_head *frames)
1edfb1af 702{
2569a826
JB
703 struct sk_buff *skb = rx->skb;
704 struct ieee80211_local *local = rx->local;
1edfb1af
JB
705 struct ieee80211_hw *hw = &local->hw;
706 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2569a826 707 struct sta_info *sta = rx->sta;
1edfb1af
JB
708 struct tid_ampdu_rx *tid_agg_rx;
709 u16 sc;
710 int tid;
711
712 if (!ieee80211_is_data_qos(hdr->frame_control))
2569a826 713 goto dont_reorder;
1edfb1af
JB
714
715 /*
716 * filter the QoS data rx stream according to
717 * STA/TID and check if this STA/TID is on aggregation
718 */
719
1edfb1af 720 if (!sta)
2569a826 721 goto dont_reorder;
1edfb1af
JB
722
723 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
724
725 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2569a826 726 goto dont_reorder;
1edfb1af
JB
727
728 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
729
730 /* qos null data frames are excluded */
731 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
2569a826 732 goto dont_reorder;
1edfb1af
JB
733
734 /* new, potentially un-ordered, ampdu frame - process it */
735
736 /* reset session timer */
737 if (tid_agg_rx->timeout)
738 mod_timer(&tid_agg_rx->session_timer,
739 TU_TO_EXP_TIME(tid_agg_rx->timeout));
740
741 /* if this mpdu is fragmented - terminate rx aggregation session */
742 sc = le16_to_cpu(hdr->seq_ctrl);
743 if (sc & IEEE80211_SCTL_FRAG) {
744 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
745 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
746 dev_kfree_skb(skb);
2569a826 747 return;
1edfb1af
JB
748 }
749
2569a826
JB
750 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
751 return;
752
753 dont_reorder:
754 __skb_queue_tail(frames, skb);
1edfb1af 755}
33b64eb2 756
49461622 757static ieee80211_rx_result debug_noinline
5cf121c3 758ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
571ecf67 759{
a7767f95 760 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB
761
762 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
763 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
a7767f95 764 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
5cf121c3 765 rx->sta->last_seq_ctrl[rx->queue] ==
571ecf67 766 hdr->seq_ctrl)) {
5cf121c3 767 if (rx->flags & IEEE80211_RX_RA_MATCH) {
571ecf67
JB
768 rx->local->dot11FrameDuplicateCount++;
769 rx->sta->num_duplicates++;
770 }
e4c26add 771 return RX_DROP_MONITOR;
571ecf67 772 } else
5cf121c3 773 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
571ecf67
JB
774 }
775
571ecf67
JB
776 if (unlikely(rx->skb->len < 16)) {
777 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
e4c26add 778 return RX_DROP_MONITOR;
571ecf67
JB
779 }
780
571ecf67
JB
781 /* Drop disallowed frame classes based on STA auth/assoc state;
782 * IEEE 802.11, Chap 5.5.
783 *
ccd7b362
JB
784 * mac80211 filters only based on association state, i.e. it drops
785 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB
786 * deauth/disassoc frames when needed. In addition, hostapd is
787 * responsible for filtering on both auth and assoc states.
788 */
33b64eb2 789
902acc78 790 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 791 return ieee80211_rx_mesh_check(rx);
33b64eb2 792
a7767f95
HH
793 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
794 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 795 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
07346f81 796 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
a7767f95
HH
797 if ((!ieee80211_has_fromds(hdr->frame_control) &&
798 !ieee80211_has_tods(hdr->frame_control) &&
799 ieee80211_is_data(hdr->frame_control)) ||
800 !(rx->flags & IEEE80211_RX_RA_MATCH)) {
571ecf67
JB
801 /* Drop IBSS frames and frames for other hosts
802 * silently. */
e4c26add 803 return RX_DROP_MONITOR;
571ecf67
JB
804 }
805
e4c26add 806 return RX_DROP_MONITOR;
571ecf67
JB
807 }
808
9ae54c84 809 return RX_CONTINUE;
570bd537
JB
810}
811
812
49461622 813static ieee80211_rx_result debug_noinline
5cf121c3 814ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
570bd537 815{
eb9fb5b8
JB
816 struct sk_buff *skb = rx->skb;
817 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
818 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3017b80b
JB
819 int keyidx;
820 int hdrlen;
e4c26add 821 ieee80211_rx_result result = RX_DROP_UNUSABLE;
d4e46a3d 822 struct ieee80211_key *stakey = NULL;
3cfcf6ac 823 int mmie_keyidx = -1;
570bd537 824
3017b80b
JB
825 /*
826 * Key selection 101
827 *
3cfcf6ac 828 * There are four types of keys:
3017b80b 829 * - GTK (group keys)
3cfcf6ac 830 * - IGTK (group keys for management frames)
3017b80b
JB
831 * - PTK (pairwise keys)
832 * - STK (station-to-station pairwise keys)
833 *
834 * When selecting a key, we have to distinguish between multicast
835 * (including broadcast) and unicast frames, the latter can only
3cfcf6ac
JM
836 * use PTKs and STKs while the former always use GTKs and IGTKs.
837 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
838 * unicast frames can also use key indices like GTKs. Hence, if we
839 * don't have a PTK/STK we check the key index for a WEP key.
3017b80b 840 *
8dc06a1c
JB
841 * Note that in a regular BSS, multicast frames are sent by the
842 * AP only, associated stations unicast the frame to the AP first
843 * which then multicasts it on their behalf.
844 *
3017b80b
JB
845 * There is also a slight problem in IBSS mode: GTKs are negotiated
846 * with each station, that is something we don't currently handle.
8dc06a1c
JB
847 * The spec seems to expect that one negotiates the same key with
848 * every station but there's no such requirement; VLANs could be
849 * possible.
3017b80b
JB
850 */
851
3017b80b 852 /*
1990af8d 853 * No point in finding a key and decrypting if the frame is neither
3017b80b
JB
854 * addressed to us nor a multicast frame.
855 */
5cf121c3 856 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
9ae54c84 857 return RX_CONTINUE;
3017b80b 858
2569a826
JB
859 /* start without a key */
860 rx->key = NULL;
861
d4e46a3d
JB
862 if (rx->sta)
863 stakey = rcu_dereference(rx->sta->key);
864
0c7c10c7
JM
865 if (!ieee80211_has_protected(hdr->frame_control))
866 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
867
d4e46a3d
JB
868 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
869 rx->key = stakey;
0c7c10c7
JM
870 /* Skip decryption if the frame is not protected. */
871 if (!ieee80211_has_protected(hdr->frame_control))
872 return RX_CONTINUE;
3cfcf6ac
JM
873 } else if (mmie_keyidx >= 0) {
874 /* Broadcast/multicast robust management frame / BIP */
eb9fb5b8
JB
875 if ((status->flag & RX_FLAG_DECRYPTED) &&
876 (status->flag & RX_FLAG_IV_STRIPPED))
3cfcf6ac
JM
877 return RX_CONTINUE;
878
879 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
880 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
881 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
882 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
0c7c10c7
JM
883 } else if (!ieee80211_has_protected(hdr->frame_control)) {
884 /*
885 * The frame was not protected, so skip decryption. However, we
886 * need to set rx->key if there is a key that could have been
887 * used so that the frame may be dropped if encryption would
888 * have been expected.
889 */
890 struct ieee80211_key *key = NULL;
891 if (ieee80211_is_mgmt(hdr->frame_control) &&
892 is_multicast_ether_addr(hdr->addr1) &&
893 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
894 rx->key = key;
895 else if ((key = rcu_dereference(rx->sdata->default_key)))
896 rx->key = key;
897 return RX_CONTINUE;
571ecf67 898 } else {
3017b80b
JB
899 /*
900 * The device doesn't give us the IV so we won't be
901 * able to look up the key. That's ok though, we
902 * don't need to decrypt the frame, we just won't
903 * be able to keep statistics accurate.
904 * Except for key threshold notifications, should
905 * we somehow allow the driver to tell us which key
906 * the hardware used if this flag is set?
907 */
eb9fb5b8
JB
908 if ((status->flag & RX_FLAG_DECRYPTED) &&
909 (status->flag & RX_FLAG_IV_STRIPPED))
9ae54c84 910 return RX_CONTINUE;
3017b80b 911
a7767f95 912 hdrlen = ieee80211_hdrlen(hdr->frame_control);
3017b80b
JB
913
914 if (rx->skb->len < 8 + hdrlen)
e4c26add 915 return RX_DROP_UNUSABLE; /* TODO: count this? */
3017b80b
JB
916
917 /*
918 * no need to call ieee80211_wep_get_keyidx,
919 * it verifies a bunch of things we've done already
920 */
921 keyidx = rx->skb->data[hdrlen + 3] >> 6;
922
d4e46a3d 923 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
3017b80b
JB
924
925 /*
926 * RSNA-protected unicast frames should always be sent with
927 * pairwise or station-to-station keys, but for WEP we allow
928 * using a key index as well.
929 */
8f20fc24 930 if (rx->key && rx->key->conf.alg != ALG_WEP &&
3017b80b
JB
931 !is_multicast_ether_addr(hdr->addr1))
932 rx->key = NULL;
571ecf67
JB
933 }
934
3017b80b 935 if (rx->key) {
571ecf67 936 rx->key->tx_rx_count++;
011bfcc4 937 /* TODO: add threshold stuff again */
1990af8d 938 } else {
e4c26add 939 return RX_DROP_MONITOR;
70f08765
JB
940 }
941
1990af8d
JB
942 /* Check for weak IVs if possible */
943 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
a7767f95 944 ieee80211_is_data(hdr->frame_control) &&
eb9fb5b8
JB
945 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
946 !(status->flag & RX_FLAG_DECRYPTED)) &&
1990af8d
JB
947 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
948 rx->sta->wep_weak_iv_count++;
949
70f08765
JB
950 switch (rx->key->conf.alg) {
951 case ALG_WEP:
e2f036da
MN
952 result = ieee80211_crypto_wep_decrypt(rx);
953 break;
70f08765 954 case ALG_TKIP:
e2f036da
MN
955 result = ieee80211_crypto_tkip_decrypt(rx);
956 break;
70f08765 957 case ALG_CCMP:
e2f036da
MN
958 result = ieee80211_crypto_ccmp_decrypt(rx);
959 break;
3cfcf6ac
JM
960 case ALG_AES_CMAC:
961 result = ieee80211_crypto_aes_cmac_decrypt(rx);
962 break;
70f08765
JB
963 }
964
e2f036da 965 /* either the frame has been decrypted or will be dropped */
eb9fb5b8 966 status->flag |= RX_FLAG_DECRYPTED;
e2f036da
MN
967
968 return result;
70f08765
JB
969}
970
572e0012
KV
971static ieee80211_rx_result debug_noinline
972ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
973{
974 struct ieee80211_local *local;
975 struct ieee80211_hdr *hdr;
976 struct sk_buff *skb;
977
978 local = rx->local;
979 skb = rx->skb;
980 hdr = (struct ieee80211_hdr *) skb->data;
981
982 if (!local->pspolling)
983 return RX_CONTINUE;
984
985 if (!ieee80211_has_fromds(hdr->frame_control))
986 /* this is not from AP */
987 return RX_CONTINUE;
988
989 if (!ieee80211_is_data(hdr->frame_control))
990 return RX_CONTINUE;
991
992 if (!ieee80211_has_moredata(hdr->frame_control)) {
993 /* AP has no more frames buffered for us */
994 local->pspolling = false;
995 return RX_CONTINUE;
996 }
997
998 /* more data bit is set, let's request a new frame from the AP */
999 ieee80211_send_pspoll(local, rx->sdata);
1000
1001 return RX_CONTINUE;
1002}
1003
133b8226 1004static void ap_sta_ps_start(struct sta_info *sta)
571ecf67 1005{
133b8226 1006 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 1007 struct ieee80211_local *local = sdata->local;
0795af57 1008
3e122be0 1009 atomic_inc(&sdata->bss->num_sta_ps);
af818581 1010 set_sta_flags(sta, WLAN_STA_PS_STA);
12375ef9 1011 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
571ecf67 1012#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26 1013 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
47846c9b 1014 sdata->name, sta->sta.addr, sta->sta.aid);
571ecf67
JB
1015#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1016}
1017
ff9458d3 1018static void ap_sta_ps_end(struct sta_info *sta)
571ecf67 1019{
133b8226 1020 struct ieee80211_sub_if_data *sdata = sta->sdata;
571ecf67 1021
3e122be0 1022 atomic_dec(&sdata->bss->num_sta_ps);
004c872e 1023
af818581 1024 clear_sta_flags(sta, WLAN_STA_PS_STA);
004c872e 1025
571ecf67 1026#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26 1027 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
47846c9b 1028 sdata->name, sta->sta.addr, sta->sta.aid);
571ecf67 1029#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
004c872e 1030
af818581 1031 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
571ecf67 1032#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
af818581 1033 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
47846c9b 1034 sdata->name, sta->sta.addr, sta->sta.aid);
571ecf67 1035#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
af818581
JB
1036 return;
1037 }
1038
1039 ieee80211_sta_ps_deliver_wakeup(sta);
571ecf67
JB
1040}
1041
49461622 1042static ieee80211_rx_result debug_noinline
5cf121c3 1043ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB
1044{
1045 struct sta_info *sta = rx->sta;
eb9fb5b8
JB
1046 struct sk_buff *skb = rx->skb;
1047 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1048 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
571ecf67
JB
1049
1050 if (!sta)
9ae54c84 1051 return RX_CONTINUE;
571ecf67 1052
b291ba11
JB
1053 /*
1054 * Update last_rx only for IBSS packets which are for the current
1055 * BSSID to avoid keeping the current IBSS network alive in cases
1056 * where other STAs start using different BSSID.
1057 */
05c914fe 1058 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 1059 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 1060 NL80211_IFTYPE_ADHOC);
46900298 1061 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
571ecf67 1062 sta->last_rx = jiffies;
b291ba11
JB
1063 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1064 /*
33b64eb2
LCC
1065 * Mesh beacons will update last_rx when if they are found to
1066 * match the current local configuration when processed.
571ecf67 1067 */
b291ba11 1068 sta->last_rx = jiffies;
571ecf67
JB
1069 }
1070
5cf121c3 1071 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
9ae54c84 1072 return RX_CONTINUE;
571ecf67 1073
3cf335d5
KV
1074 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1075 ieee80211_sta_rx_notify(rx->sdata, hdr);
1076
571ecf67
JB
1077 sta->rx_fragments++;
1078 sta->rx_bytes += rx->skb->len;
eb9fb5b8
JB
1079 sta->last_signal = status->signal;
1080 sta->last_noise = status->noise;
571ecf67 1081
72eaa43a
JB
1082 /*
1083 * Change STA power saving mode only at the end of a frame
1084 * exchange sequence.
1085 */
3e122be0 1086 if (!ieee80211_has_morefrags(hdr->frame_control) &&
05c914fe
JB
1087 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1088 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
af818581 1089 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
72eaa43a
JB
1090 /*
1091 * Ignore doze->wake transitions that are
1092 * indicated by non-data frames, the standard
1093 * is unclear here, but for example going to
1094 * PS mode and then scanning would cause a
1095 * doze->wake transition for the probe request,
1096 * and that is clearly undesirable.
1097 */
1098 if (ieee80211_is_data(hdr->frame_control) &&
1099 !ieee80211_has_pm(hdr->frame_control))
ff9458d3 1100 ap_sta_ps_end(sta);
72eaa43a
JB
1101 } else {
1102 if (ieee80211_has_pm(hdr->frame_control))
1103 ap_sta_ps_start(sta);
1104 }
571ecf67
JB
1105 }
1106
22403def
JB
1107 /*
1108 * Drop (qos-)data::nullfunc frames silently, since they
1109 * are used only to control station power saving mode.
1110 */
1111 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1112 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
571ecf67 1113 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
22403def
JB
1114 /*
1115 * Update counter and free packet here to avoid
1116 * counting this as a dropped packed.
1117 */
571ecf67
JB
1118 sta->rx_packets++;
1119 dev_kfree_skb(rx->skb);
9ae54c84 1120 return RX_QUEUED;
571ecf67
JB
1121 }
1122
9ae54c84 1123 return RX_CONTINUE;
571ecf67
JB
1124} /* ieee80211_rx_h_sta_process */
1125
571ecf67
JB
1126static inline struct ieee80211_fragment_entry *
1127ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1128 unsigned int frag, unsigned int seq, int rx_queue,
1129 struct sk_buff **skb)
1130{
1131 struct ieee80211_fragment_entry *entry;
1132 int idx;
1133
1134 idx = sdata->fragment_next;
1135 entry = &sdata->fragments[sdata->fragment_next++];
1136 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1137 sdata->fragment_next = 0;
1138
1139 if (!skb_queue_empty(&entry->skb_list)) {
f4ea83dd 1140#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
571ecf67
JB
1141 struct ieee80211_hdr *hdr =
1142 (struct ieee80211_hdr *) entry->skb_list.next->data;
1143 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1144 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
0c68ae26 1145 "addr1=%pM addr2=%pM\n",
47846c9b 1146 sdata->name, idx,
571ecf67 1147 jiffies - entry->first_frag_time, entry->seq,
0c68ae26 1148 entry->last_frag, hdr->addr1, hdr->addr2);
f4ea83dd 1149#endif
571ecf67
JB
1150 __skb_queue_purge(&entry->skb_list);
1151 }
1152
1153 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1154 *skb = NULL;
1155 entry->first_frag_time = jiffies;
1156 entry->seq = seq;
1157 entry->rx_queue = rx_queue;
1158 entry->last_frag = frag;
1159 entry->ccmp = 0;
1160 entry->extra_len = 0;
1161
1162 return entry;
1163}
1164
1165static inline struct ieee80211_fragment_entry *
1166ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
b73d70ad 1167 unsigned int frag, unsigned int seq,
571ecf67
JB
1168 int rx_queue, struct ieee80211_hdr *hdr)
1169{
1170 struct ieee80211_fragment_entry *entry;
1171 int i, idx;
1172
1173 idx = sdata->fragment_next;
1174 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1175 struct ieee80211_hdr *f_hdr;
571ecf67
JB
1176
1177 idx--;
1178 if (idx < 0)
1179 idx = IEEE80211_FRAGMENT_MAX - 1;
1180
1181 entry = &sdata->fragments[idx];
1182 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1183 entry->rx_queue != rx_queue ||
1184 entry->last_frag + 1 != frag)
1185 continue;
1186
b73d70ad 1187 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
571ecf67 1188
b73d70ad
HH
1189 /*
1190 * Check ftype and addresses are equal, else check next fragment
1191 */
1192 if (((hdr->frame_control ^ f_hdr->frame_control) &
1193 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
571ecf67
JB
1194 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1195 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1196 continue;
1197
ab46623e 1198 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB
1199 __skb_queue_purge(&entry->skb_list);
1200 continue;
1201 }
1202 return entry;
1203 }
1204
1205 return NULL;
1206}
1207
49461622 1208static ieee80211_rx_result debug_noinline
5cf121c3 1209ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67
JB
1210{
1211 struct ieee80211_hdr *hdr;
1212 u16 sc;
358c8d9d 1213 __le16 fc;
571ecf67
JB
1214 unsigned int frag, seq;
1215 struct ieee80211_fragment_entry *entry;
1216 struct sk_buff *skb;
1217
b73d70ad 1218 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 1219 fc = hdr->frame_control;
571ecf67
JB
1220 sc = le16_to_cpu(hdr->seq_ctrl);
1221 frag = sc & IEEE80211_SCTL_FRAG;
1222
358c8d9d 1223 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
571ecf67
JB
1224 (rx->skb)->len < 24 ||
1225 is_multicast_ether_addr(hdr->addr1))) {
1226 /* not fragmented */
1227 goto out;
1228 }
1229 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1230
1231 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1232
1233 if (frag == 0) {
1234 /* This is the first fragment of a new frame. */
1235 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
5cf121c3 1236 rx->queue, &(rx->skb));
8f20fc24 1237 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
358c8d9d 1238 ieee80211_has_protected(fc)) {
571ecf67
JB
1239 /* Store CCMP PN so that we can verify that the next
1240 * fragment has a sequential PN value. */
1241 entry->ccmp = 1;
1242 memcpy(entry->last_pn,
5cf121c3 1243 rx->key->u.ccmp.rx_pn[rx->queue],
571ecf67
JB
1244 CCMP_PN_LEN);
1245 }
9ae54c84 1246 return RX_QUEUED;
571ecf67
JB
1247 }
1248
1249 /* This is a fragment for a frame that should already be pending in
1250 * fragment cache. Add this fragment to the end of the pending entry.
1251 */
b73d70ad 1252 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
571ecf67
JB
1253 if (!entry) {
1254 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 1255 return RX_DROP_MONITOR;
571ecf67
JB
1256 }
1257
1258 /* Verify that MPDUs within one MSDU have sequential PN values.
1259 * (IEEE 802.11i, 8.3.3.4.5) */
1260 if (entry->ccmp) {
1261 int i;
1262 u8 pn[CCMP_PN_LEN], *rpn;
8f20fc24 1263 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
e4c26add 1264 return RX_DROP_UNUSABLE;
571ecf67
JB
1265 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1266 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1267 pn[i]++;
1268 if (pn[i])
1269 break;
1270 }
5cf121c3 1271 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
f4ea83dd 1272 if (memcmp(pn, rpn, CCMP_PN_LEN))
e4c26add 1273 return RX_DROP_UNUSABLE;
571ecf67
JB
1274 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1275 }
1276
358c8d9d 1277 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB
1278 __skb_queue_tail(&entry->skb_list, rx->skb);
1279 entry->last_frag = frag;
1280 entry->extra_len += rx->skb->len;
358c8d9d 1281 if (ieee80211_has_morefrags(fc)) {
571ecf67 1282 rx->skb = NULL;
9ae54c84 1283 return RX_QUEUED;
571ecf67
JB
1284 }
1285
1286 rx->skb = __skb_dequeue(&entry->skb_list);
1287 if (skb_tailroom(rx->skb) < entry->extra_len) {
1288 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1289 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1290 GFP_ATOMIC))) {
1291 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1292 __skb_queue_purge(&entry->skb_list);
e4c26add 1293 return RX_DROP_UNUSABLE;
571ecf67
JB
1294 }
1295 }
1296 while ((skb = __skb_dequeue(&entry->skb_list))) {
1297 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1298 dev_kfree_skb(skb);
1299 }
1300
1301 /* Complete frame has been reassembled - process it now */
5cf121c3 1302 rx->flags |= IEEE80211_RX_FRAGMENTED;
571ecf67
JB
1303
1304 out:
1305 if (rx->sta)
1306 rx->sta->rx_packets++;
1307 if (is_multicast_ether_addr(hdr->addr1))
1308 rx->local->dot11MulticastReceivedFrameCount++;
1309 else
1310 ieee80211_led_rx(rx->local);
9ae54c84 1311 return RX_CONTINUE;
571ecf67
JB
1312}
1313
49461622 1314static ieee80211_rx_result debug_noinline
5cf121c3 1315ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
571ecf67 1316{
af818581 1317 struct ieee80211_sub_if_data *sdata = rx->sdata;
358c8d9d 1318 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
571ecf67 1319
358c8d9d 1320 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
5cf121c3 1321 !(rx->flags & IEEE80211_RX_RA_MATCH)))
9ae54c84 1322 return RX_CONTINUE;
571ecf67 1323
05c914fe
JB
1324 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1325 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
e4c26add 1326 return RX_DROP_UNUSABLE;
98f0b0a3 1327
af818581
JB
1328 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1329 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1330 else
1331 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
571ecf67 1332
9ae54c84 1333 /* Free PS Poll skb here instead of returning RX_DROP that would
571ecf67
JB
1334 * count as an dropped frame. */
1335 dev_kfree_skb(rx->skb);
1336
9ae54c84 1337 return RX_QUEUED;
571ecf67
JB
1338}
1339
49461622 1340static ieee80211_rx_result debug_noinline
5cf121c3 1341ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
6e0d114d 1342{
6e0d114d 1343 u8 *data = rx->skb->data;
238f74a2 1344 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
6e0d114d 1345
238f74a2 1346 if (!ieee80211_is_data_qos(hdr->frame_control))
9ae54c84 1347 return RX_CONTINUE;
6e0d114d
JB
1348
1349 /* remove the qos control field, update frame type and meta-data */
238f74a2
HH
1350 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1351 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1352 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
6e0d114d 1353 /* change frame type to non QOS */
238f74a2 1354 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
6e0d114d 1355
9ae54c84 1356 return RX_CONTINUE;
6e0d114d
JB
1357}
1358
76ee65bf 1359static int
5cf121c3 1360ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 1361{
07346f81 1362 if (unlikely(!rx->sta ||
f4ea83dd 1363 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 1364 return -EACCES;
571ecf67 1365
76ee65bf 1366 return 0;
571ecf67
JB
1367}
1368
76ee65bf 1369static int
358c8d9d 1370ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 1371{
eb9fb5b8
JB
1372 struct sk_buff *skb = rx->skb;
1373 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1374
3017b80b 1375 /*
7848ba7d
JB
1376 * Pass through unencrypted frames if the hardware has
1377 * decrypted them already.
3017b80b 1378 */
eb9fb5b8 1379 if (status->flag & RX_FLAG_DECRYPTED)
76ee65bf 1380 return 0;
571ecf67
JB
1381
1382 /* Drop unencrypted frames if key is set. */
358c8d9d
HH
1383 if (unlikely(!ieee80211_has_protected(fc) &&
1384 !ieee80211_is_nullfunc(fc) &&
f2ca3ea4 1385 ieee80211_is_data(fc) &&
b3fc9c6c 1386 (rx->key || rx->sdata->drop_unencrypted)))
76ee65bf 1387 return -EACCES;
f2ca3ea4
JM
1388 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1389 if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1390 rx->key))
1391 return -EACCES;
1392 /* BIP does not use Protected field, so need to check MMIE */
f64f9e71
JP
1393 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1394 ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
f2ca3ea4
JM
1395 rx->key))
1396 return -EACCES;
1397 /*
1398 * When using MFP, Action frames are not allowed prior to
1399 * having configured keys.
1400 */
1401 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1402 ieee80211_is_robust_mgmt_frame(
1403 (struct ieee80211_hdr *) rx->skb->data)))
1404 return -EACCES;
1405 }
b3fc9c6c 1406
76ee65bf 1407 return 0;
571ecf67
JB
1408}
1409
76ee65bf 1410static int
e31a16d6 1411__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
571ecf67 1412{
eb9fb5b8 1413 struct ieee80211_sub_if_data *sdata = rx->sdata;
f14543ee
FF
1414 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1415
9bc383de
JB
1416 if (ieee80211_has_a4(hdr->frame_control) &&
1417 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
f14543ee 1418 return -1;
9bc383de
JB
1419
1420 if (is_multicast_ether_addr(hdr->addr1) &&
1421 ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) ||
1422 (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
f14543ee 1423 return -1;
571ecf67 1424
47846c9b 1425 return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
76ee65bf 1426}
571ecf67 1427
ce3edf6d
JB
1428/*
1429 * requires that rx->skb is a frame with ethernet header
1430 */
358c8d9d 1431static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 1432{
c97c23e3 1433 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB
1434 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1435 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1436
1437 /*
1438 * Allow EAPOL frames to us/the PAE group address regardless
1439 * of whether the frame was encrypted or not.
1440 */
1441 if (ehdr->h_proto == htons(ETH_P_PAE) &&
47846c9b 1442 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
ce3edf6d
JB
1443 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1444 return true;
1445
1446 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 1447 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB
1448 return false;
1449
1450 return true;
1451}
1452
1453/*
1454 * requires that rx->skb is a frame with ethernet header
1455 */
76ee65bf 1456static void
5cf121c3 1457ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf 1458{
eb9fb5b8
JB
1459 struct ieee80211_sub_if_data *sdata = rx->sdata;
1460 struct net_device *dev = sdata->dev;
76ee65bf 1461 struct sk_buff *skb, *xmit_skb;
ce3edf6d
JB
1462 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1463 struct sta_info *dsta;
571ecf67 1464
76ee65bf
RR
1465 skb = rx->skb;
1466 xmit_skb = NULL;
571ecf67 1467
05c914fe
JB
1468 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1469 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 1470 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
9bc383de
JB
1471 (rx->flags & IEEE80211_RX_RA_MATCH) &&
1472 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
ce3edf6d
JB
1473 if (is_multicast_ether_addr(ehdr->h_dest)) {
1474 /*
1475 * send multicast frames both to higher layers in
1476 * local net stack and back to the wireless medium
1477 */
76ee65bf
RR
1478 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1479 if (!xmit_skb && net_ratelimit())
571ecf67
JB
1480 printk(KERN_DEBUG "%s: failed to clone "
1481 "multicast frame\n", dev->name);
1482 } else {
abe60632
JB
1483 dsta = sta_info_get(sdata, skb->data);
1484 if (dsta) {
ce3edf6d
JB
1485 /*
1486 * The destination station is associated to
1487 * this AP (in this VLAN), so send the frame
1488 * directly to it and do not pass it to local
1489 * net stack.
571ecf67 1490 */
76ee65bf 1491 xmit_skb = skb;
571ecf67
JB
1492 skb = NULL;
1493 }
571ecf67
JB
1494 }
1495 }
1496
1497 if (skb) {
d1c3a37c
JB
1498 int align __maybe_unused;
1499
59d9cb07 1500#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
d1c3a37c
JB
1501 /*
1502 * 'align' will only take the values 0 or 2 here
1503 * since all frames are required to be aligned
1504 * to 2-byte boundaries when being passed to
1505 * mac80211. That also explains the __skb_push()
1506 * below.
1507 */
dacb6f1d 1508 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
d1c3a37c
JB
1509 if (align) {
1510 if (WARN_ON(skb_headroom(skb) < 3)) {
1511 dev_kfree_skb(skb);
1512 skb = NULL;
1513 } else {
1514 u8 *data = skb->data;
8ce0b589
ZY
1515 size_t len = skb_headlen(skb);
1516 skb->data -= align;
1517 memmove(skb->data, data, len);
1518 skb_set_tail_pointer(skb, len);
d1c3a37c
JB
1519 }
1520 }
1521#endif
1522
1523 if (skb) {
1524 /* deliver to local stack */
1525 skb->protocol = eth_type_trans(skb, dev);
1526 memset(skb->cb, 0, sizeof(skb->cb));
1527 netif_rx(skb);
1528 }
571ecf67
JB
1529 }
1530
76ee65bf 1531 if (xmit_skb) {
571ecf67 1532 /* send to wireless media */
f831e909 1533 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB
1534 skb_reset_network_header(xmit_skb);
1535 skb_reset_mac_header(xmit_skb);
76ee65bf 1536 dev_queue_xmit(xmit_skb);
571ecf67 1537 }
76ee65bf
RR
1538}
1539
49461622 1540static ieee80211_rx_result debug_noinline
5cf121c3 1541ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
fd4c7f2f 1542{
eb9fb5b8 1543 struct net_device *dev = rx->sdata->dev;
eaf85ca7 1544 struct sk_buff *skb = rx->skb;
358c8d9d
HH
1545 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1546 __le16 fc = hdr->frame_control;
eaf85ca7 1547 struct sk_buff_head frame_list;
fd4c7f2f 1548
358c8d9d 1549 if (unlikely(!ieee80211_is_data(fc)))
9ae54c84 1550 return RX_CONTINUE;
fd4c7f2f 1551
358c8d9d 1552 if (unlikely(!ieee80211_is_data_present(fc)))
e4c26add 1553 return RX_DROP_MONITOR;
fd4c7f2f 1554
5cf121c3 1555 if (!(rx->flags & IEEE80211_RX_AMSDU))
9ae54c84 1556 return RX_CONTINUE;
fd4c7f2f 1557
eaf85ca7
ZY
1558 if (ieee80211_has_a4(hdr->frame_control) &&
1559 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1560 !rx->sdata->u.vlan.sta)
e4c26add 1561 return RX_DROP_UNUSABLE;
fd4c7f2f 1562
eaf85ca7
ZY
1563 if (is_multicast_ether_addr(hdr->addr1) &&
1564 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1565 rx->sdata->u.vlan.sta) ||
1566 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1567 rx->sdata->u.mgd.use_4addr)))
e4c26add 1568 return RX_DROP_UNUSABLE;
fd4c7f2f 1569
eaf85ca7
ZY
1570 skb->dev = dev;
1571 __skb_queue_head_init(&frame_list);
fd4c7f2f 1572
eaf85ca7
ZY
1573 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1574 rx->sdata->vif.type,
1575 rx->local->hw.extra_tx_headroom);
fd4c7f2f 1576
eaf85ca7
ZY
1577 while (!skb_queue_empty(&frame_list)) {
1578 rx->skb = __skb_dequeue(&frame_list);
fd4c7f2f 1579
358c8d9d 1580 if (!ieee80211_frame_allowed(rx, fc)) {
eaf85ca7 1581 dev_kfree_skb(rx->skb);
ce3edf6d
JB
1582 continue;
1583 }
eaf85ca7
ZY
1584 dev->stats.rx_packets++;
1585 dev->stats.rx_bytes += rx->skb->len;
fd4c7f2f
RR
1586
1587 ieee80211_deliver_skb(rx);
1588 }
1589
9ae54c84 1590 return RX_QUEUED;
fd4c7f2f
RR
1591}
1592
bf94e17b 1593#ifdef CONFIG_MAC80211_MESH
b0dee578 1594static ieee80211_rx_result
e32f85f7
LCC
1595ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1596{
1597 struct ieee80211_hdr *hdr;
1598 struct ieee80211s_hdr *mesh_hdr;
1599 unsigned int hdrlen;
1600 struct sk_buff *skb = rx->skb, *fwd_skb;
3b8d81e0 1601 struct ieee80211_local *local = rx->local;
eb9fb5b8 1602 struct ieee80211_sub_if_data *sdata = rx->sdata;
e32f85f7
LCC
1603
1604 hdr = (struct ieee80211_hdr *) skb->data;
1605 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1606 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1607
1608 if (!ieee80211_is_data(hdr->frame_control))
1609 return RX_CONTINUE;
1610
1611 if (!mesh_hdr->ttl)
1612 /* illegal frame */
1613 return RX_DROP_MONITOR;
1614
43b7b314 1615 if (mesh_hdr->flags & MESH_FLAGS_AE) {
79617dee 1616 struct mesh_path *mppath;
43b7b314
JC
1617 char *proxied_addr;
1618 char *mpp_addr;
1619
1620 if (is_multicast_ether_addr(hdr->addr1)) {
1621 mpp_addr = hdr->addr3;
1622 proxied_addr = mesh_hdr->eaddr1;
1623 } else {
1624 mpp_addr = hdr->addr4;
1625 proxied_addr = mesh_hdr->eaddr2;
1626 }
79617dee 1627
79617dee 1628 rcu_read_lock();
43b7b314 1629 mppath = mpp_path_lookup(proxied_addr, sdata);
79617dee 1630 if (!mppath) {
43b7b314 1631 mpp_path_add(proxied_addr, mpp_addr, sdata);
79617dee
Y
1632 } else {
1633 spin_lock_bh(&mppath->state_lock);
43b7b314
JC
1634 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1635 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
79617dee
Y
1636 spin_unlock_bh(&mppath->state_lock);
1637 }
1638 rcu_read_unlock();
1639 }
1640
3c5772a5
JC
1641 /* Frame has reached destination. Don't forward */
1642 if (!is_multicast_ether_addr(hdr->addr1) &&
47846c9b 1643 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
e32f85f7
LCC
1644 return RX_CONTINUE;
1645
1646 mesh_hdr->ttl--;
1647
1648 if (rx->flags & IEEE80211_RX_RA_MATCH) {
1649 if (!mesh_hdr->ttl)
472dbc45 1650 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
e32f85f7
LCC
1651 dropped_frames_ttl);
1652 else {
1653 struct ieee80211_hdr *fwd_hdr;
3b8d81e0
JB
1654 struct ieee80211_tx_info *info;
1655
e32f85f7
LCC
1656 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1657
1658 if (!fwd_skb && net_ratelimit())
1659 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
47846c9b 1660 sdata->name);
e32f85f7
LCC
1661
1662 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
47846c9b 1663 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
3b8d81e0
JB
1664 info = IEEE80211_SKB_CB(fwd_skb);
1665 memset(info, 0, sizeof(*info));
1666 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
5061b0c2 1667 info->control.vif = &rx->sdata->vif;
3b8d81e0 1668 ieee80211_select_queue(local, fwd_skb);
c8a61a7d
DW
1669 if (is_multicast_ether_addr(fwd_hdr->addr1))
1670 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1671 fwded_mcast);
1672 else {
3c5772a5
JC
1673 int err;
1674 /*
1675 * Save TA to addr1 to send TA a path error if a
1676 * suitable next hop is not found
1677 */
1678 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
249b405c 1679 ETH_ALEN);
3c5772a5 1680 err = mesh_nexthop_lookup(fwd_skb, sdata);
249b405c
JC
1681 /* Failed to immediately resolve next hop:
1682 * fwded frame was dropped or will be added
1683 * later to the pending skb queue. */
1684 if (err)
1685 return RX_DROP_MONITOR;
c8a61a7d
DW
1686
1687 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1688 fwded_unicast);
249b405c
JC
1689 }
1690 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1691 fwded_frames);
3b8d81e0 1692 ieee80211_add_pending_skb(local, fwd_skb);
e32f85f7
LCC
1693 }
1694 }
1695
3c5772a5 1696 if (is_multicast_ether_addr(hdr->addr1) ||
eb9fb5b8 1697 sdata->dev->flags & IFF_PROMISC)
e32f85f7
LCC
1698 return RX_CONTINUE;
1699 else
1700 return RX_DROP_MONITOR;
1701}
bf94e17b 1702#endif
e32f85f7 1703
49461622 1704static ieee80211_rx_result debug_noinline
5cf121c3 1705ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf 1706{
eb9fb5b8
JB
1707 struct ieee80211_sub_if_data *sdata = rx->sdata;
1708 struct net_device *dev = sdata->dev;
358c8d9d
HH
1709 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1710 __le16 fc = hdr->frame_control;
ce3edf6d 1711 int err;
76ee65bf 1712
358c8d9d 1713 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 1714 return RX_CONTINUE;
76ee65bf 1715
358c8d9d 1716 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 1717 return RX_DROP_MONITOR;
76ee65bf 1718
f14543ee
FF
1719 /*
1720 * Allow the cooked monitor interface of an AP to see 4-addr frames so
1721 * that a 4-addr station can be detected and moved into a separate VLAN
1722 */
1723 if (ieee80211_has_a4(hdr->frame_control) &&
1724 sdata->vif.type == NL80211_IFTYPE_AP)
1725 return RX_DROP_MONITOR;
1726
e31a16d6 1727 err = __ieee80211_data_to_8023(rx);
76ee65bf 1728 if (unlikely(err))
e4c26add 1729 return RX_DROP_UNUSABLE;
76ee65bf 1730
358c8d9d 1731 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 1732 return RX_DROP_MONITOR;
ce3edf6d 1733
76ee65bf
RR
1734 rx->skb->dev = dev;
1735
1736 dev->stats.rx_packets++;
1737 dev->stats.rx_bytes += rx->skb->len;
1738
1739 ieee80211_deliver_skb(rx);
571ecf67 1740
9ae54c84 1741 return RX_QUEUED;
571ecf67
JB
1742}
1743
49461622 1744static ieee80211_rx_result debug_noinline
2569a826 1745ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
71364716
RR
1746{
1747 struct ieee80211_local *local = rx->local;
1748 struct ieee80211_hw *hw = &local->hw;
1749 struct sk_buff *skb = rx->skb;
a7767f95 1750 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR
1751 struct tid_ampdu_rx *tid_agg_rx;
1752 u16 start_seq_num;
1753 u16 tid;
1754
a7767f95 1755 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 1756 return RX_CONTINUE;
71364716 1757
a7767f95 1758 if (ieee80211_is_back_req(bar->frame_control)) {
71364716 1759 if (!rx->sta)
a02ae758 1760 return RX_DROP_MONITOR;
71364716 1761 tid = le16_to_cpu(bar->control) >> 12;
cee24a3e
RR
1762 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1763 != HT_AGG_STATE_OPERATIONAL)
a02ae758 1764 return RX_DROP_MONITOR;
cee24a3e 1765 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
71364716
RR
1766
1767 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1768
1769 /* reset session timer */
20ad19d0
JB
1770 if (tid_agg_rx->timeout)
1771 mod_timer(&tid_agg_rx->session_timer,
1772 TU_TO_EXP_TIME(tid_agg_rx->timeout));
71364716 1773
a02ae758 1774 /* release stored frames up to start of BAR */
2569a826
JB
1775 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
1776 frames);
a02ae758
JB
1777 kfree_skb(skb);
1778 return RX_QUEUED;
71364716
RR
1779 }
1780
9ae54c84 1781 return RX_CONTINUE;
71364716
RR
1782}
1783
f4f727a6
JM
1784static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1785 struct ieee80211_mgmt *mgmt,
1786 size_t len)
fea14732
JM
1787{
1788 struct ieee80211_local *local = sdata->local;
1789 struct sk_buff *skb;
1790 struct ieee80211_mgmt *resp;
1791
47846c9b 1792 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
fea14732
JM
1793 /* Not to own unicast address */
1794 return;
1795 }
1796
46900298
JB
1797 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
1798 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
77fdaa12 1799 /* Not from the current AP or not associated yet. */
fea14732
JM
1800 return;
1801 }
1802
1803 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
1804 /* Too short SA Query request frame */
1805 return;
1806 }
1807
1808 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
1809 if (skb == NULL)
1810 return;
1811
1812 skb_reserve(skb, local->hw.extra_tx_headroom);
1813 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
1814 memset(resp, 0, 24);
1815 memcpy(resp->da, mgmt->sa, ETH_ALEN);
47846c9b 1816 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
46900298 1817 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
fea14732
JM
1818 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1819 IEEE80211_STYPE_ACTION);
1820 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
1821 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
1822 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
1823 memcpy(resp->u.action.u.sa_query.trans_id,
1824 mgmt->u.action.u.sa_query.trans_id,
1825 WLAN_SA_QUERY_TR_ID_LEN);
1826
62ae67be 1827 ieee80211_tx_skb(sdata, skb);
fea14732
JM
1828}
1829
de1ede7a
JB
1830static ieee80211_rx_result debug_noinline
1831ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1832{
1833 struct ieee80211_local *local = rx->local;
eb9fb5b8 1834 struct ieee80211_sub_if_data *sdata = rx->sdata;
de1ede7a
JB
1835 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1836 int len = rx->skb->len;
1837
1838 if (!ieee80211_is_action(mgmt->frame_control))
1839 return RX_CONTINUE;
1840
1841 if (!rx->sta)
1842 return RX_DROP_MONITOR;
1843
1844 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1845 return RX_DROP_MONITOR;
1846
97ebe12a
JM
1847 if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
1848 return RX_DROP_MONITOR;
1849
de1ede7a
JB
1850 /* all categories we currently handle have action_code */
1851 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1852 return RX_DROP_MONITOR;
1853
de1ede7a
JB
1854 switch (mgmt->u.action.category) {
1855 case WLAN_CATEGORY_BACK:
8abd3f9b
JB
1856 /*
1857 * The aggregation code is not prepared to handle
1858 * anything but STA/AP due to the BSSID handling;
1859 * IBSS could work in the code but isn't supported
1860 * by drivers or the standard.
1861 */
1862 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1863 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
1864 sdata->vif.type != NL80211_IFTYPE_AP)
1865 return RX_DROP_MONITOR;
1866
de1ede7a
JB
1867 switch (mgmt->u.action.u.addba_req.action_code) {
1868 case WLAN_ACTION_ADDBA_REQ:
1869 if (len < (IEEE80211_MIN_ACTION_SIZE +
1870 sizeof(mgmt->u.action.u.addba_req)))
1871 return RX_DROP_MONITOR;
1872 ieee80211_process_addba_request(local, rx->sta, mgmt, len);
1873 break;
1874 case WLAN_ACTION_ADDBA_RESP:
1875 if (len < (IEEE80211_MIN_ACTION_SIZE +
1876 sizeof(mgmt->u.action.u.addba_resp)))
1877 return RX_DROP_MONITOR;
1878 ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
1879 break;
1880 case WLAN_ACTION_DELBA:
1881 if (len < (IEEE80211_MIN_ACTION_SIZE +
1882 sizeof(mgmt->u.action.u.delba)))
1883 return RX_DROP_MONITOR;
1884 ieee80211_process_delba(sdata, rx->sta, mgmt, len);
1885 break;
1886 }
39192c0b
JB
1887 break;
1888 case WLAN_CATEGORY_SPECTRUM_MGMT:
1889 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
1890 return RX_DROP_MONITOR;
46900298
JB
1891
1892 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1893 return RX_DROP_MONITOR;
1894
39192c0b
JB
1895 switch (mgmt->u.action.u.measurement.action_code) {
1896 case WLAN_ACTION_SPCT_MSR_REQ:
1897 if (len < (IEEE80211_MIN_ACTION_SIZE +
1898 sizeof(mgmt->u.action.u.measurement)))
1899 return RX_DROP_MONITOR;
1900 ieee80211_process_measurement_req(sdata, mgmt, len);
1901 break;
c481ec97
S
1902 case WLAN_ACTION_SPCT_CHL_SWITCH:
1903 if (len < (IEEE80211_MIN_ACTION_SIZE +
1904 sizeof(mgmt->u.action.u.chan_switch)))
1905 return RX_DROP_MONITOR;
1906
cc32abd4
JB
1907 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1908 return RX_DROP_MONITOR;
1909
46900298 1910 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
c481ec97
S
1911 return RX_DROP_MONITOR;
1912
77fdaa12 1913 return ieee80211_sta_rx_mgmt(sdata, rx->skb);
39192c0b
JB
1914 }
1915 break;
fea14732
JM
1916 case WLAN_CATEGORY_SA_QUERY:
1917 if (len < (IEEE80211_MIN_ACTION_SIZE +
1918 sizeof(mgmt->u.action.u.sa_query)))
1919 return RX_DROP_MONITOR;
1920 switch (mgmt->u.action.u.sa_query.action) {
1921 case WLAN_ACTION_SA_QUERY_REQUEST:
1922 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1923 return RX_DROP_MONITOR;
1924 ieee80211_process_sa_query_req(sdata, mgmt, len);
1925 break;
1926 case WLAN_ACTION_SA_QUERY_RESPONSE:
1927 /*
1928 * SA Query response is currently only used in AP mode
1929 * and it is processed in user space.
1930 */
1931 return RX_CONTINUE;
1932 }
1933 break;
39192c0b
JB
1934 default:
1935 return RX_CONTINUE;
de1ede7a
JB
1936 }
1937
39192c0b
JB
1938 rx->sta->rx_packets++;
1939 dev_kfree_skb(rx->skb);
1940 return RX_QUEUED;
de1ede7a
JB
1941}
1942
49461622 1943static ieee80211_rx_result debug_noinline
5cf121c3 1944ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 1945{
eb9fb5b8 1946 struct ieee80211_sub_if_data *sdata = rx->sdata;
97ebe12a 1947 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
571ecf67 1948
5cf121c3 1949 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
e4c26add 1950 return RX_DROP_MONITOR;
571ecf67 1951
97ebe12a
JM
1952 if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
1953 return RX_DROP_MONITOR;
1954
472dbc45 1955 if (ieee80211_vif_is_mesh(&sdata->vif))
f1d58c25 1956 return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
472dbc45 1957
3832c287 1958 if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
f1d58c25 1959 return ieee80211_ibss_rx_mgmt(sdata, rx->skb);
f9d540ee 1960
7986cf95 1961 if (sdata->vif.type == NL80211_IFTYPE_STATION)
f1d58c25 1962 return ieee80211_sta_rx_mgmt(sdata, rx->skb);
46900298 1963
7986cf95 1964 return RX_DROP_MONITOR;
571ecf67
JB
1965}
1966
3b8d81e0 1967static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
5cf121c3 1968 struct ieee80211_rx_data *rx)
571ecf67 1969{
a7767f95
HH
1970 int keyidx;
1971 unsigned int hdrlen;
571ecf67 1972
a7767f95 1973 hdrlen = ieee80211_hdrlen(hdr->frame_control);
571ecf67
JB
1974 if (rx->skb->len >= hdrlen + 4)
1975 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1976 else
1977 keyidx = -1;
1978
8944b79f 1979 if (!rx->sta) {
aa0daf0e
JB
1980 /*
1981 * Some hardware seem to generate incorrect Michael MIC
1982 * reports; ignore them to avoid triggering countermeasures.
1983 */
af2ced6a 1984 return;
571ecf67
JB
1985 }
1986
a7767f95 1987 if (!ieee80211_has_protected(hdr->frame_control))
af2ced6a 1988 return;
571ecf67 1989
05c914fe 1990 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
aa0daf0e
JB
1991 /*
1992 * APs with pairwise keys should never receive Michael MIC
1993 * errors for non-zero keyidx because these are reserved for
1994 * group keys and only the AP is sending real multicast
1995 * frames in the BSS.
1996 */
af2ced6a 1997 return;
571ecf67
JB
1998 }
1999
a7767f95
HH
2000 if (!ieee80211_is_data(hdr->frame_control) &&
2001 !ieee80211_is_auth(hdr->frame_control))
af2ced6a 2002 return;
571ecf67 2003
e6d6e342
JB
2004 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2005 GFP_ATOMIC);
571ecf67
JB
2006}
2007
5cf121c3 2008/* TODO: use IEEE80211_RX_FRAGMENTED */
5f0b7de5
JB
2009static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2010 struct ieee80211_rate *rate)
3d30d949
MW
2011{
2012 struct ieee80211_sub_if_data *sdata;
2013 struct ieee80211_local *local = rx->local;
2014 struct ieee80211_rtap_hdr {
2015 struct ieee80211_radiotap_header hdr;
2016 u8 flags;
5f0b7de5 2017 u8 rate_or_pad;
3d30d949
MW
2018 __le16 chan_freq;
2019 __le16 chan_flags;
2020 } __attribute__ ((packed)) *rthdr;
2021 struct sk_buff *skb = rx->skb, *skb2;
2022 struct net_device *prev_dev = NULL;
eb9fb5b8 2023 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3d30d949 2024
8c0c709e 2025 if (status->flag & RX_FLAG_INTERNAL_CMTR)
3d30d949
MW
2026 goto out_free_skb;
2027
2028 if (skb_headroom(skb) < sizeof(*rthdr) &&
2029 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2030 goto out_free_skb;
2031
2032 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2033 memset(rthdr, 0, sizeof(*rthdr));
2034 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2035 rthdr->hdr.it_present =
2036 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
3d30d949
MW
2037 (1 << IEEE80211_RADIOTAP_CHANNEL));
2038
5f0b7de5
JB
2039 if (rate) {
2040 rthdr->rate_or_pad = rate->bitrate / 5;
2041 rthdr->hdr.it_present |=
2042 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2043 }
3d30d949
MW
2044 rthdr->chan_freq = cpu_to_le16(status->freq);
2045
2046 if (status->band == IEEE80211_BAND_5GHZ)
2047 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2048 IEEE80211_CHAN_5GHZ);
2049 else
2050 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2051 IEEE80211_CHAN_2GHZ);
2052
2053 skb_set_mac_header(skb, 0);
2054 skb->ip_summed = CHECKSUM_UNNECESSARY;
2055 skb->pkt_type = PACKET_OTHERHOST;
2056 skb->protocol = htons(ETH_P_802_2);
2057
2058 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2059 if (!netif_running(sdata->dev))
2060 continue;
2061
05c914fe 2062 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3d30d949
MW
2063 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2064 continue;
2065
2066 if (prev_dev) {
2067 skb2 = skb_clone(skb, GFP_ATOMIC);
2068 if (skb2) {
2069 skb2->dev = prev_dev;
2070 netif_rx(skb2);
2071 }
2072 }
2073
2074 prev_dev = sdata->dev;
2075 sdata->dev->stats.rx_packets++;
2076 sdata->dev->stats.rx_bytes += skb->len;
2077 }
2078
2079 if (prev_dev) {
2080 skb->dev = prev_dev;
2081 netif_rx(skb);
2082 skb = NULL;
2083 } else
2084 goto out_free_skb;
2085
8c0c709e 2086 status->flag |= RX_FLAG_INTERNAL_CMTR;
3d30d949
MW
2087 return;
2088
2089 out_free_skb:
2090 dev_kfree_skb(skb);
2091}
2092
571ecf67 2093
8944b79f 2094static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
5cf121c3 2095 struct ieee80211_rx_data *rx,
5f0b7de5
JB
2096 struct sk_buff *skb,
2097 struct ieee80211_rate *rate)
58905290 2098{
2569a826 2099 struct sk_buff_head reorder_release;
58905290
JB
2100 ieee80211_rx_result res = RX_DROP_MONITOR;
2101
2569a826
JB
2102 __skb_queue_head_init(&reorder_release);
2103
8944b79f
JB
2104 rx->skb = skb;
2105 rx->sdata = sdata;
8944b79f 2106
e32f85f7
LCC
2107#define CALL_RXH(rxh) \
2108 do { \
2109 res = rxh(rx); \
2110 if (res != RX_CONTINUE) \
2569a826 2111 goto rxh_next; \
e32f85f7 2112 } while (0);
49461622 2113
2569a826
JB
2114 /*
2115 * NB: the rxh_next label works even if we jump
2116 * to it from here because then the list will
2117 * be empty, which is a trivial check
2118 */
49461622
JB
2119 CALL_RXH(ieee80211_rx_h_passive_scan)
2120 CALL_RXH(ieee80211_rx_h_check)
2569a826
JB
2121
2122 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
2123
2124 while ((skb = __skb_dequeue(&reorder_release))) {
2125 /*
2126 * all the other fields are valid across frames
2127 * that belong to an aMPDU since they are on the
2128 * same TID from the same station
2129 */
2130 rx->skb = skb;
2131
2132 CALL_RXH(ieee80211_rx_h_decrypt)
2133 CALL_RXH(ieee80211_rx_h_check_more_data)
2134 CALL_RXH(ieee80211_rx_h_sta_process)
2135 CALL_RXH(ieee80211_rx_h_defragment)
2136 CALL_RXH(ieee80211_rx_h_ps_poll)
2137 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2138 /* must be after MMIC verify so header is counted in MPDU mic */
2139 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2140 CALL_RXH(ieee80211_rx_h_amsdu)
bf94e17b 2141#ifdef CONFIG_MAC80211_MESH
2569a826
JB
2142 if (ieee80211_vif_is_mesh(&sdata->vif))
2143 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 2144#endif
2569a826
JB
2145 CALL_RXH(ieee80211_rx_h_data)
2146
2147 /* special treatment -- needs the queue */
2148 res = ieee80211_rx_h_ctrl(rx, &reorder_release);
2149 if (res != RX_CONTINUE)
2150 goto rxh_next;
2151
2152 CALL_RXH(ieee80211_rx_h_action)
2153 CALL_RXH(ieee80211_rx_h_mgmt)
49461622
JB
2154
2155#undef CALL_RXH
2156
2569a826
JB
2157 rxh_next:
2158 switch (res) {
2159 case RX_DROP_MONITOR:
2160 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
2161 if (rx->sta)
2162 rx->sta->rx_dropped++;
2163 /* fall through */
2164 case RX_CONTINUE:
2165 ieee80211_rx_cooked_monitor(rx, rate);
2166 break;
2167 case RX_DROP_UNUSABLE:
2168 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
2169 if (rx->sta)
2170 rx->sta->rx_dropped++;
2171 dev_kfree_skb(rx->skb);
2172 break;
2173 case RX_QUEUED:
2174 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
2175 break;
2176 }
58905290
JB
2177 }
2178}
2179
571ecf67
JB
2180/* main receive path */
2181
23a24def 2182static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
7ab17c45 2183 struct ieee80211_rx_data *rx,
23a24def
JB
2184 struct ieee80211_hdr *hdr)
2185{
eb9fb5b8
JB
2186 struct sk_buff *skb = rx->skb;
2187 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2188 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
23a24def
JB
2189 int multicast = is_multicast_ether_addr(hdr->addr1);
2190
51fb61e7 2191 switch (sdata->vif.type) {
05c914fe 2192 case NL80211_IFTYPE_STATION:
9bc383de 2193 if (!bssid && !sdata->u.mgd.use_4addr)
23a24def 2194 return 0;
77fdaa12 2195 if (!multicast &&
47846c9b 2196 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
4150c572 2197 if (!(sdata->dev->flags & IFF_PROMISC))
23a24def 2198 return 0;
5cf121c3 2199 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def
JB
2200 }
2201 break;
05c914fe 2202 case NL80211_IFTYPE_ADHOC:
23a24def
JB
2203 if (!bssid)
2204 return 0;
a7767f95 2205 if (ieee80211_is_beacon(hdr->frame_control)) {
9d9bf77d 2206 return 1;
87291c02 2207 }
46900298 2208 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
5cf121c3 2209 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
23a24def 2210 return 0;
5cf121c3 2211 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def 2212 } else if (!multicast &&
47846c9b 2213 compare_ether_addr(sdata->vif.addr,
23a24def 2214 hdr->addr1) != 0) {
4150c572 2215 if (!(sdata->dev->flags & IFF_PROMISC))
23a24def 2216 return 0;
5cf121c3 2217 rx->flags &= ~IEEE80211_RX_RA_MATCH;
0fb8ca45
JM
2218 } else if (!rx->sta) {
2219 int rate_idx;
eb9fb5b8 2220 if (status->flag & RX_FLAG_HT)
0fb8ca45
JM
2221 rate_idx = 0; /* TODO: HT rates */
2222 else
eb9fb5b8 2223 rate_idx = status->rate_idx;
ab1f5c0b 2224 rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
0fb8ca45
JM
2225 BIT(rate_idx));
2226 }
23a24def 2227 break;
05c914fe 2228 case NL80211_IFTYPE_MESH_POINT:
6032f934 2229 if (!multicast &&
47846c9b 2230 compare_ether_addr(sdata->vif.addr,
6032f934
JB
2231 hdr->addr1) != 0) {
2232 if (!(sdata->dev->flags & IFF_PROMISC))
2233 return 0;
2234
5cf121c3 2235 rx->flags &= ~IEEE80211_RX_RA_MATCH;
6032f934
JB
2236 }
2237 break;
05c914fe
JB
2238 case NL80211_IFTYPE_AP_VLAN:
2239 case NL80211_IFTYPE_AP:
23a24def 2240 if (!bssid) {
47846c9b 2241 if (compare_ether_addr(sdata->vif.addr,
23a24def
JB
2242 hdr->addr1))
2243 return 0;
2244 } else if (!ieee80211_bssid_match(bssid,
47846c9b 2245 sdata->vif.addr)) {
5cf121c3 2246 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
23a24def 2247 return 0;
5cf121c3 2248 rx->flags &= ~IEEE80211_RX_RA_MATCH;
23a24def 2249 }
23a24def 2250 break;
05c914fe 2251 case NL80211_IFTYPE_WDS:
a7767f95 2252 if (bssid || !ieee80211_is_data(hdr->frame_control))
23a24def
JB
2253 return 0;
2254 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2255 return 0;
2256 break;
05c914fe 2257 case NL80211_IFTYPE_MONITOR:
05c914fe
JB
2258 case NL80211_IFTYPE_UNSPECIFIED:
2259 case __NL80211_IFTYPE_AFTER_LAST:
fb1c1cd6
JB
2260 /* should never get here */
2261 WARN_ON(1);
2262 break;
23a24def
JB
2263 }
2264
2265 return 1;
2266}
2267
571ecf67 2268/*
6368e4b1
RR
2269 * This is the actual Rx frames handler. as it blongs to Rx path it must
2270 * be called with rcu_read_lock protection.
571ecf67 2271 */
71ebb4aa
RR
2272static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2273 struct sk_buff *skb,
8318d78a 2274 struct ieee80211_rate *rate)
571ecf67 2275{
f1d58c25 2276 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
571ecf67
JB
2277 struct ieee80211_local *local = hw_to_local(hw);
2278 struct ieee80211_sub_if_data *sdata;
571ecf67 2279 struct ieee80211_hdr *hdr;
5cf121c3 2280 struct ieee80211_rx_data rx;
6368e4b1 2281 int prepares;
8e6f0032
JB
2282 struct ieee80211_sub_if_data *prev = NULL;
2283 struct sk_buff *skb_new;
abe60632
JB
2284 struct sta_info *sta, *tmp;
2285 bool found_sta = false;
571ecf67 2286
358c8d9d 2287 hdr = (struct ieee80211_hdr *)skb->data;
571ecf67
JB
2288 memset(&rx, 0, sizeof(rx));
2289 rx.skb = skb;
2290 rx.local = local;
72abd81b 2291
358c8d9d 2292 if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
571ecf67 2293 local->dot11ReceivedFragmentCount++;
571ecf67 2294
142b9f50
HS
2295 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2296 test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
5cf121c3 2297 rx.flags |= IEEE80211_RX_IN_SCAN;
571ecf67 2298
38f3714d 2299 ieee80211_parse_qos(&rx);
d1c3a37c 2300 ieee80211_verify_alignment(&rx);
38f3714d 2301
abe60632
JB
2302 if (ieee80211_is_data(hdr->frame_control)) {
2303 for_each_sta_info(local, hdr->addr2, sta, tmp) {
2304 rx.sta = sta;
2305 found_sta = true;
2306 rx.sdata = sta->sdata;
2307
2308 rx.flags |= IEEE80211_RX_RA_MATCH;
2309 prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
2310 if (prepares) {
2311 if (status->flag & RX_FLAG_MMIC_ERROR) {
2312 if (rx.flags & IEEE80211_RX_RA_MATCH)
2313 ieee80211_rx_michael_mic_report(hdr, &rx);
2314 } else
2315 prev = rx.sdata;
2316 }
af2ced6a 2317 }
abe60632
JB
2318 }
2319 if (!found_sta) {
2320 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2321 if (!netif_running(sdata->dev))
2322 continue;
2a8a9a88 2323
abe60632
JB
2324 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2325 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2326 continue;
b2e7771e 2327
abe60632 2328 rx.sta = sta_info_get(sdata, hdr->addr2);
23a24def 2329
abe60632
JB
2330 rx.flags |= IEEE80211_RX_RA_MATCH;
2331 prepares = prepare_for_handlers(sdata, &rx, hdr);
8e6f0032 2332
abe60632
JB
2333 if (!prepares)
2334 continue;
af2ced6a 2335
abe60632
JB
2336 if (status->flag & RX_FLAG_MMIC_ERROR) {
2337 rx.sdata = sdata;
2338 if (rx.flags & IEEE80211_RX_RA_MATCH)
2339 ieee80211_rx_michael_mic_report(hdr,
2340 &rx);
2341 continue;
2342 }
340e11f3 2343
abe60632
JB
2344 /*
2345 * frame is destined for this interface, but if it's
2346 * not also for the previous one we handle that after
2347 * the loop to avoid copying the SKB once too much
2348 */
340e11f3 2349
abe60632
JB
2350 if (!prev) {
2351 prev = sdata;
2352 continue;
2353 }
340e11f3 2354
abe60632
JB
2355 /*
2356 * frame was destined for the previous interface
2357 * so invoke RX handlers for it
2358 */
2359
2360 skb_new = skb_copy(skb, GFP_ATOMIC);
2361 if (!skb_new) {
2362 if (net_ratelimit())
2363 printk(KERN_DEBUG "%s: failed to copy "
2364 "multicast frame for %s\n",
2365 wiphy_name(local->hw.wiphy),
47846c9b 2366 prev->name);
abe60632
JB
2367 continue;
2368 }
2369 ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
2370 prev = sdata;
340e11f3 2371 }
571ecf67 2372 }
a4b7d7bd 2373 if (prev)
5f0b7de5 2374 ieee80211_invoke_rx_handlers(prev, &rx, skb, rate);
a4b7d7bd 2375 else
8e6f0032 2376 dev_kfree_skb(skb);
571ecf67 2377}
6368e4b1
RR
2378
2379/*
2380 * This is the receive path handler. It is called by a low level driver when an
2381 * 802.11 MPDU is received from the hardware.
2382 */
103bf9f7 2383void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
6368e4b1
RR
2384{
2385 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB
2386 struct ieee80211_rate *rate = NULL;
2387 struct ieee80211_supported_band *sband;
f1d58c25 2388 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
8318d78a 2389
d20ef63d
JB
2390 WARN_ON_ONCE(softirq_count() == 0);
2391
77a980dc
JB
2392 if (WARN_ON(status->band < 0 ||
2393 status->band >= IEEE80211_NUM_BANDS))
2394 goto drop;
8318d78a
JB
2395
2396 sband = local->hw.wiphy->bands[status->band];
77a980dc
JB
2397 if (WARN_ON(!sband))
2398 goto drop;
8318d78a 2399
89c3a8ac
JB
2400 /*
2401 * If we're suspending, it is possible although not too likely
2402 * that we'd be receiving frames after having already partially
2403 * quiesced the stack. We can't process such frames then since
2404 * that might, for example, cause stations to be added or other
2405 * driver callbacks be invoked.
2406 */
77a980dc
JB
2407 if (unlikely(local->quiescing || local->suspended))
2408 goto drop;
89c3a8ac 2409
ea77f12f
JB
2410 /*
2411 * The same happens when we're not even started,
2412 * but that's worth a warning.
2413 */
77a980dc
JB
2414 if (WARN_ON(!local->started))
2415 goto drop;
ea77f12f 2416
0fb8ca45 2417 if (status->flag & RX_FLAG_HT) {
e5d6eb83
LR
2418 /*
2419 * rate_idx is MCS index, which can be [0-76] as documented on:
2420 *
2421 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2422 *
2423 * Anything else would be some sort of driver or hardware error.
2424 * The driver should catch hardware errors.
2425 */
2426 if (WARN((status->rate_idx < 0 ||
2427 status->rate_idx > 76),
2428 "Rate marked as an HT rate but passed "
2429 "status->rate_idx is not "
2430 "an MCS index [0-76]: %d (0x%02x)\n",
2431 status->rate_idx,
2432 status->rate_idx))
77a980dc 2433 goto drop;
0fb8ca45
JM
2434 } else {
2435 if (WARN_ON(status->rate_idx < 0 ||
2436 status->rate_idx >= sband->n_bitrates))
77a980dc 2437 goto drop;
0fb8ca45
JM
2438 rate = &sband->bitrates[status->rate_idx];
2439 }
6368e4b1
RR
2440
2441 /*
2442 * key references and virtual interfaces are protected using RCU
2443 * and this requires that we are in a read-side RCU section during
2444 * receive processing
2445 */
2446 rcu_read_lock();
2447
2448 /*
2449 * Frames with failed FCS/PLCP checksum are not returned,
2450 * all other frames are returned without radiotap header
2451 * if it was previously present.
2452 * Also, frames with less than 16 bytes are dropped.
2453 */
f1d58c25 2454 skb = ieee80211_rx_monitor(local, skb, rate);
6368e4b1
RR
2455 if (!skb) {
2456 rcu_read_unlock();
2457 return;
2458 }
2459
2569a826 2460 __ieee80211_rx_handle_packet(hw, skb, rate);
6368e4b1
RR
2461
2462 rcu_read_unlock();
77a980dc
JB
2463
2464 return;
2465 drop:
2466 kfree_skb(skb);
6368e4b1 2467}
103bf9f7 2468EXPORT_SYMBOL(ieee80211_rx);
571ecf67
JB
2469
2470/* This is a version of the rx handler that can be called from hard irq
2471 * context. Post the skb on the queue and schedule the tasklet */
f1d58c25 2472void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
571ecf67
JB
2473{
2474 struct ieee80211_local *local = hw_to_local(hw);
2475
2476 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2477
571ecf67
JB
2478 skb->pkt_type = IEEE80211_RX_MSG;
2479 skb_queue_tail(&local->skb_queue, skb);
2480 tasklet_schedule(&local->tasklet);
2481}
2482EXPORT_SYMBOL(ieee80211_rx_irqsafe);