?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
mac80211: make rx radiotap header more flexible
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / mac80211 / rx.c
blob1159a43a3df6921a4f27eb37a87fb2ac74982d0d
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
20
21 #include "ieee80211_i.h"
22 #include "led.h"
23 #include "mesh.h"
24 #include "wep.h"
25 #include "wpa.h"
26 #include "tkip.h"
27 #include "wme.h"
28
29 u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30 struct tid_ampdu_rx *tid_agg_rx,
31 struct sk_buff *skb, u16 mpdu_seq_num,
32 int bar_req);
33 /*
34 * monitor mode reception
35 *
36 * This function cleans up the SKB, i.e. it removes all the stuff
37 * only useful for monitoring.
38 */
39 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
40 struct sk_buff *skb,
41 int rtap_len)
42 {
43 skb_pull(skb, rtap_len);
44
45 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
46 if (likely(skb->len > FCS_LEN))
47 skb_trim(skb, skb->len - FCS_LEN);
48 else {
49 /* driver bug */
50 WARN_ON(1);
51 dev_kfree_skb(skb);
52 skb = NULL;
53 }
54 }
55
56 return skb;
57 }
58
59 static inline int should_drop_frame(struct ieee80211_rx_status *status,
60 struct sk_buff *skb,
61 int present_fcs_len,
62 int radiotap_len)
63 {
64 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
65
66 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
67 return 1;
68 if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
69 return 1;
70 if (((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
71 cpu_to_le16(IEEE80211_FTYPE_CTL)) &&
72 ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
73 cpu_to_le16(IEEE80211_STYPE_PSPOLL)) &&
74 ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
75 cpu_to_le16(IEEE80211_STYPE_BACK_REQ)))
76 return 1;
77 return 0;
78 }
79
80 static int
81 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
82 struct ieee80211_rx_status *status)
83 {
84 int len;
85
86 /* always present fields */
87 len = sizeof(struct ieee80211_radiotap_header) + 9;
88
89 if (status->flag & RX_FLAG_TSFT)
90 len += 8;
91 if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
92 local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
93 len += 1;
94 if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
95 len += 1;
96
97 if (len & 1) /* padding for RX_FLAGS if necessary */
98 len++;
99
100 /* make sure radiotap starts at a naturally aligned address */
101 if (len % 8)
102 len = roundup(len, 8);
103
104 return len;
105 }
106
107 /**
108 * ieee80211_add_rx_radiotap_header - add radiotap header
109 *
110 * add a radiotap header containing all the fields which the hardware provided.
111 */
112 static void
113 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
114 struct sk_buff *skb,
115 struct ieee80211_rx_status *status,
116 struct ieee80211_rate *rate,
117 int rtap_len)
118 {
119 struct ieee80211_radiotap_header *rthdr;
120 unsigned char *pos;
121
122 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
123 memset(rthdr, 0, rtap_len);
124
125 /* radiotap header, set always present flags */
126 rthdr->it_present =
127 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
128 (1 << IEEE80211_RADIOTAP_RATE) |
129 (1 << IEEE80211_RADIOTAP_CHANNEL) |
130 (1 << IEEE80211_RADIOTAP_ANTENNA) |
131 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
132 rthdr->it_len = cpu_to_le16(rtap_len);
133
134 pos = (unsigned char *)(rthdr+1);
135
136 /* the order of the following fields is important */
137
138 /* IEEE80211_RADIOTAP_TSFT */
139 if (status->flag & RX_FLAG_TSFT) {
140 *(__le64 *)pos = cpu_to_le64(status->mactime);
141 rthdr->it_present |=
142 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
143 pos += 8;
144 }
145
146 /* IEEE80211_RADIOTAP_FLAGS */
147 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
148 *pos |= IEEE80211_RADIOTAP_F_FCS;
149 pos++;
150
151 /* IEEE80211_RADIOTAP_RATE */
152 *pos = rate->bitrate / 5;
153 pos++;
154
155 /* IEEE80211_RADIOTAP_CHANNEL */
156 *(__le16 *)pos = cpu_to_le16(status->freq);
157 pos += 2;
158 if (status->band == IEEE80211_BAND_5GHZ)
159 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
160 IEEE80211_CHAN_5GHZ);
161 else
162 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_DYN |
163 IEEE80211_CHAN_2GHZ);
164 pos += 2;
165
166 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
167 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
168 *pos = status->signal;
169 rthdr->it_present |=
170 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
171 pos++;
172 }
173
174 /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
175 if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
176 *pos = status->noise;
177 rthdr->it_present |=
178 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
179 pos++;
180 }
181
182 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
183
184 /* IEEE80211_RADIOTAP_ANTENNA */
185 *pos = status->antenna;
186 pos++;
187
188 /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
189 if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
190 *pos = status->signal;
191 rthdr->it_present |=
192 cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
193 pos++;
194 }
195
196 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
197
198 /* IEEE80211_RADIOTAP_RX_FLAGS */
199 /* ensure 2 byte alignment for the 2 byte field as required */
200 if ((pos - (unsigned char *)rthdr) & 1)
201 pos++;
202 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
203 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
204 *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
205 pos += 2;
206 }
207
208 /*
209 * This function copies a received frame to all monitor interfaces and
210 * returns a cleaned-up SKB that no longer includes the FCS nor the
211 * radiotap header the driver might have added.
212 */
213 static struct sk_buff *
214 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
215 struct ieee80211_rx_status *status,
216 struct ieee80211_rate *rate)
217 {
218 struct ieee80211_sub_if_data *sdata;
219 int needed_headroom = 0;
220 struct sk_buff *skb, *skb2;
221 struct net_device *prev_dev = NULL;
222 int present_fcs_len = 0;
223 int rtap_len = 0;
224
225 /*
226 * First, we may need to make a copy of the skb because
227 * (1) we need to modify it for radiotap (if not present), and
228 * (2) the other RX handlers will modify the skb we got.
229 *
230 * We don't need to, of course, if we aren't going to return
231 * the SKB because it has a bad FCS/PLCP checksum.
232 */
233 if (status->flag & RX_FLAG_RADIOTAP)
234 rtap_len = ieee80211_get_radiotap_len(origskb->data);
235 else
236 /* room for the radiotap header based on driver features */
237 needed_headroom = ieee80211_rx_radiotap_len(local, status);
238
239 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
240 present_fcs_len = FCS_LEN;
241
242 if (!local->monitors) {
243 if (should_drop_frame(status, origskb, present_fcs_len,
244 rtap_len)) {
245 dev_kfree_skb(origskb);
246 return NULL;
247 }
248
249 return remove_monitor_info(local, origskb, rtap_len);
250 }
251
252 if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
253 /* only need to expand headroom if necessary */
254 skb = origskb;
255 origskb = NULL;
256
257 /*
258 * This shouldn't trigger often because most devices have an
259 * RX header they pull before we get here, and that should
260 * be big enough for our radiotap information. We should
261 * probably export the length to drivers so that we can have
262 * them allocate enough headroom to start with.
263 */
264 if (skb_headroom(skb) < needed_headroom &&
265 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
266 dev_kfree_skb(skb);
267 return NULL;
268 }
269 } else {
270 /*
271 * Need to make a copy and possibly remove radiotap header
272 * and FCS from the original.
273 */
274 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
275
276 origskb = remove_monitor_info(local, origskb, rtap_len);
277
278 if (!skb)
279 return origskb;
280 }
281
282 /* if necessary, prepend radiotap information */
283 if (!(status->flag & RX_FLAG_RADIOTAP))
284 ieee80211_add_rx_radiotap_header(local, skb, status, rate,
285 needed_headroom);
286
287 skb_reset_mac_header(skb);
288 skb->ip_summed = CHECKSUM_UNNECESSARY;
289 skb->pkt_type = PACKET_OTHERHOST;
290 skb->protocol = htons(ETH_P_802_2);
291
292 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
293 if (!netif_running(sdata->dev))
294 continue;
295
296 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
297 continue;
298
299 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
300 continue;
301
302 if (prev_dev) {
303 skb2 = skb_clone(skb, GFP_ATOMIC);
304 if (skb2) {
305 skb2->dev = prev_dev;
306 netif_rx(skb2);
307 }
308 }
309
310 prev_dev = sdata->dev;
311 sdata->dev->stats.rx_packets++;
312 sdata->dev->stats.rx_bytes += skb->len;
313 }
314
315 if (prev_dev) {
316 skb->dev = prev_dev;
317 netif_rx(skb);
318 } else
319 dev_kfree_skb(skb);
320
321 return origskb;
322 }
323
324
325 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
326 {
327 u8 *data = rx->skb->data;
328 int tid;
329
330 /* does the frame have a qos control field? */
331 if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
332 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
333 /* frame has qos control */
334 tid = qc[0] & QOS_CONTROL_TID_MASK;
335 if (qc[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
336 rx->flags |= IEEE80211_RX_AMSDU;
337 else
338 rx->flags &= ~IEEE80211_RX_AMSDU;
339 } else {
340 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
341 /* Separate TID for management frames */
342 tid = NUM_RX_DATA_QUEUES - 1;
343 } else {
344 /* no qos control present */
345 tid = 0; /* 802.1d - Best Effort */
346 }
347 }
348
349 rx->queue = tid;
350 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
351 * For now, set skb->priority to 0 for other cases. */
352 rx->skb->priority = (tid > 7) ? 0 : tid;
353 }
354
355 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
356 {
357 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
358 int hdrlen;
359
360 if (!WLAN_FC_DATA_PRESENT(rx->fc))
361 return;
362
363 /*
364 * Drivers are required to align the payload data in a way that
365 * guarantees that the contained IP header is aligned to a four-
366 * byte boundary. In the case of regular frames, this simply means
367 * aligning the payload to a four-byte boundary (because either
368 * the IP header is directly contained, or IV/RFC1042 headers that
369 * have a length divisible by four are in front of it.
370 *
371 * With A-MSDU frames, however, the payload data address must
372 * yield two modulo four because there are 14-byte 802.3 headers
373 * within the A-MSDU frames that push the IP header further back
374 * to a multiple of four again. Thankfully, the specs were sane
375 * enough this time around to require padding each A-MSDU subframe
376 * to a length that is a multiple of four.
377 *
378 * Padding like atheros hardware adds which is inbetween the 802.11
379 * header and the payload is not supported, the driver is required
380 * to move the 802.11 header further back in that case.
381 */
382 hdrlen = ieee80211_get_hdrlen(rx->fc);
383 if (rx->flags & IEEE80211_RX_AMSDU)
384 hdrlen += ETH_HLEN;
385 WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
386 #endif
387 }
388
389
390 static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
391 struct sk_buff *skb,
392 struct ieee80211_rx_status *status,
393 struct ieee80211_rate *rate)
394 {
395 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
396 u32 load = 0, hdrtime;
397
398 /* Estimate total channel use caused by this frame */
399
400 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
401 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
402
403 if (status->band == IEEE80211_BAND_5GHZ ||
404 (status->band == IEEE80211_BAND_5GHZ &&
405 rate->flags & IEEE80211_RATE_ERP_G))
406 hdrtime = CHAN_UTIL_HDR_SHORT;
407 else
408 hdrtime = CHAN_UTIL_HDR_LONG;
409
410 load = hdrtime;
411 if (!is_multicast_ether_addr(hdr->addr1))
412 load += hdrtime;
413
414 /* TODO: optimise again */
415 load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
416
417 /* Divide channel_use by 8 to avoid wrapping around the counter */
418 load >>= CHAN_UTIL_SHIFT;
419
420 return load;
421 }
422
423 /* rx handlers */
424
425 static ieee80211_rx_result
426 ieee80211_rx_h_if_stats(struct ieee80211_rx_data *rx)
427 {
428 if (rx->sta)
429 rx->sta->channel_use_raw += rx->load;
430 rx->sdata->channel_use_raw += rx->load;
431 return RX_CONTINUE;
432 }
433
434 static ieee80211_rx_result
435 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
436 {
437 struct ieee80211_local *local = rx->local;
438 struct sk_buff *skb = rx->skb;
439
440 if (unlikely(local->sta_hw_scanning))
441 return ieee80211_sta_rx_scan(rx->dev, skb, rx->status);
442
443 if (unlikely(local->sta_sw_scanning)) {
444 /* drop all the other packets during a software scan anyway */
445 if (ieee80211_sta_rx_scan(rx->dev, skb, rx->status)
446 != RX_QUEUED)
447 dev_kfree_skb(skb);
448 return RX_QUEUED;
449 }
450
451 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
452 /* scanning finished during invoking of handlers */
453 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
454 return RX_DROP_UNUSABLE;
455 }
456
457 return RX_CONTINUE;
458 }
459
460 static ieee80211_rx_result
461 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
462 {
463 int hdrlen = ieee80211_get_hdrlen(rx->fc);
464 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
465
466 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
467
468 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
469 if (!((rx->fc & IEEE80211_FCTL_FROMDS) &&
470 (rx->fc & IEEE80211_FCTL_TODS)))
471 return RX_DROP_MONITOR;
472 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
473 return RX_DROP_MONITOR;
474 }
475
476 /* If there is not an established peer link and this is not a peer link
477 * establisment frame, beacon or probe, drop the frame.
478 */
479
480 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
481 struct ieee80211_mgmt *mgmt;
482
483 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
484 return RX_DROP_MONITOR;
485
486 switch (rx->fc & IEEE80211_FCTL_STYPE) {
487 case IEEE80211_STYPE_ACTION:
488 mgmt = (struct ieee80211_mgmt *)hdr;
489 if (mgmt->u.action.category != PLINK_CATEGORY)
490 return RX_DROP_MONITOR;
491 /* fall through on else */
492 case IEEE80211_STYPE_PROBE_REQ:
493 case IEEE80211_STYPE_PROBE_RESP:
494 case IEEE80211_STYPE_BEACON:
495 return RX_CONTINUE;
496 break;
497 default:
498 return RX_DROP_MONITOR;
499 }
500
501 } else if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
502 is_multicast_ether_addr(hdr->addr1) &&
503 mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
504 return RX_DROP_MONITOR;
505 #undef msh_h_get
506
507 return RX_CONTINUE;
508 }
509
510
511 static ieee80211_rx_result
512 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
513 {
514 struct ieee80211_hdr *hdr;
515
516 hdr = (struct ieee80211_hdr *) rx->skb->data;
517
518 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
519 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
520 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
521 rx->sta->last_seq_ctrl[rx->queue] ==
522 hdr->seq_ctrl)) {
523 if (rx->flags & IEEE80211_RX_RA_MATCH) {
524 rx->local->dot11FrameDuplicateCount++;
525 rx->sta->num_duplicates++;
526 }
527 return RX_DROP_MONITOR;
528 } else
529 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
530 }
531
532 if (unlikely(rx->skb->len < 16)) {
533 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
534 return RX_DROP_MONITOR;
535 }
536
537 /* Drop disallowed frame classes based on STA auth/assoc state;
538 * IEEE 802.11, Chap 5.5.
539 *
540 * 80211.o does filtering only based on association state, i.e., it
541 * drops Class 3 frames from not associated stations. hostapd sends
542 * deauth/disassoc frames when needed. In addition, hostapd is
543 * responsible for filtering on both auth and assoc states.
544 */
545
546 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
547 return ieee80211_rx_mesh_check(rx);
548
549 if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
550 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
551 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
552 rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
553 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
554 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
555 !(rx->fc & IEEE80211_FCTL_TODS) &&
556 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
557 || !(rx->flags & IEEE80211_RX_RA_MATCH)) {
558 /* Drop IBSS frames and frames for other hosts
559 * silently. */
560 return RX_DROP_MONITOR;
561 }
562
563 return RX_DROP_MONITOR;
564 }
565
566 return RX_CONTINUE;
567 }
568
569
570 static ieee80211_rx_result
571 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
572 {
573 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
574 int keyidx;
575 int hdrlen;
576 ieee80211_rx_result result = RX_DROP_UNUSABLE;
577 struct ieee80211_key *stakey = NULL;
578
579 /*
580 * Key selection 101
581 *
582 * There are three types of keys:
583 * - GTK (group keys)
584 * - PTK (pairwise keys)
585 * - STK (station-to-station pairwise keys)
586 *
587 * When selecting a key, we have to distinguish between multicast
588 * (including broadcast) and unicast frames, the latter can only
589 * use PTKs and STKs while the former always use GTKs. Unless, of
590 * course, actual WEP keys ("pre-RSNA") are used, then unicast
591 * frames can also use key indizes like GTKs. Hence, if we don't
592 * have a PTK/STK we check the key index for a WEP key.
593 *
594 * Note that in a regular BSS, multicast frames are sent by the
595 * AP only, associated stations unicast the frame to the AP first
596 * which then multicasts it on their behalf.
597 *
598 * There is also a slight problem in IBSS mode: GTKs are negotiated
599 * with each station, that is something we don't currently handle.
600 * The spec seems to expect that one negotiates the same key with
601 * every station but there's no such requirement; VLANs could be
602 * possible.
603 */
604
605 if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
606 return RX_CONTINUE;
607
608 /*
609 * No point in finding a key and decrypting if the frame is neither
610 * addressed to us nor a multicast frame.
611 */
612 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
613 return RX_CONTINUE;
614
615 if (rx->sta)
616 stakey = rcu_dereference(rx->sta->key);
617
618 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
619 rx->key = stakey;
620 } else {
621 /*
622 * The device doesn't give us the IV so we won't be
623 * able to look up the key. That's ok though, we
624 * don't need to decrypt the frame, we just won't
625 * be able to keep statistics accurate.
626 * Except for key threshold notifications, should
627 * we somehow allow the driver to tell us which key
628 * the hardware used if this flag is set?
629 */
630 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
631 (rx->status->flag & RX_FLAG_IV_STRIPPED))
632 return RX_CONTINUE;
633
634 hdrlen = ieee80211_get_hdrlen(rx->fc);
635
636 if (rx->skb->len < 8 + hdrlen)
637 return RX_DROP_UNUSABLE; /* TODO: count this? */
638
639 /*
640 * no need to call ieee80211_wep_get_keyidx,
641 * it verifies a bunch of things we've done already
642 */
643 keyidx = rx->skb->data[hdrlen + 3] >> 6;
644
645 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
646
647 /*
648 * RSNA-protected unicast frames should always be sent with
649 * pairwise or station-to-station keys, but for WEP we allow
650 * using a key index as well.
651 */
652 if (rx->key && rx->key->conf.alg != ALG_WEP &&
653 !is_multicast_ether_addr(hdr->addr1))
654 rx->key = NULL;
655 }
656
657 if (rx->key) {
658 rx->key->tx_rx_count++;
659 /* TODO: add threshold stuff again */
660 } else {
661 #ifdef CONFIG_MAC80211_DEBUG
662 if (net_ratelimit())
663 printk(KERN_DEBUG "%s: RX protected frame,"
664 " but have no key\n", rx->dev->name);
665 #endif /* CONFIG_MAC80211_DEBUG */
666 return RX_DROP_MONITOR;
667 }
668
669 /* Check for weak IVs if possible */
670 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
671 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
672 (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
673 !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
674 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
675 rx->sta->wep_weak_iv_count++;
676
677 switch (rx->key->conf.alg) {
678 case ALG_WEP:
679 result = ieee80211_crypto_wep_decrypt(rx);
680 break;
681 case ALG_TKIP:
682 result = ieee80211_crypto_tkip_decrypt(rx);
683 break;
684 case ALG_CCMP:
685 result = ieee80211_crypto_ccmp_decrypt(rx);
686 break;
687 }
688
689 /* either the frame has been decrypted or will be dropped */
690 rx->status->flag |= RX_FLAG_DECRYPTED;
691
692 return result;
693 }
694
695 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
696 {
697 struct ieee80211_sub_if_data *sdata;
698 DECLARE_MAC_BUF(mac);
699
700 sdata = sta->sdata;
701
702 if (sdata->bss)
703 atomic_inc(&sdata->bss->num_sta_ps);
704 set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
705 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
706 printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
707 dev->name, print_mac(mac, sta->addr), sta->aid);
708 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
709 }
710
711 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
712 {
713 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
714 struct sk_buff *skb;
715 int sent = 0;
716 struct ieee80211_sub_if_data *sdata;
717 struct ieee80211_tx_packet_data *pkt_data;
718 DECLARE_MAC_BUF(mac);
719
720 sdata = sta->sdata;
721
722 if (sdata->bss)
723 atomic_dec(&sdata->bss->num_sta_ps);
724
725 clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
726
727 if (!skb_queue_empty(&sta->ps_tx_buf))
728 sta_info_clear_tim_bit(sta);
729
730 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
731 printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
732 dev->name, print_mac(mac, sta->addr), sta->aid);
733 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
734
735 /* Send all buffered frames to the station */
736 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
737 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
738 sent++;
739 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
740 dev_queue_xmit(skb);
741 }
742 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
743 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
744 local->total_ps_buffered--;
745 sent++;
746 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
747 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
748 "since STA not sleeping anymore\n", dev->name,
749 print_mac(mac, sta->addr), sta->aid);
750 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
751 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
752 dev_queue_xmit(skb);
753 }
754
755 return sent;
756 }
757
758 static ieee80211_rx_result
759 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
760 {
761 struct sta_info *sta = rx->sta;
762 struct net_device *dev = rx->dev;
763 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
764
765 if (!sta)
766 return RX_CONTINUE;
767
768 /* Update last_rx only for IBSS packets which are for the current
769 * BSSID to avoid keeping the current IBSS network alive in cases where
770 * other STAs are using different BSSID. */
771 if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
772 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
773 IEEE80211_IF_TYPE_IBSS);
774 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
775 sta->last_rx = jiffies;
776 } else
777 if (!is_multicast_ether_addr(hdr->addr1) ||
778 rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
779 /* Update last_rx only for unicast frames in order to prevent
780 * the Probe Request frames (the only broadcast frames from a
781 * STA in infrastructure mode) from keeping a connection alive.
782 * Mesh beacons will update last_rx when if they are found to
783 * match the current local configuration when processed.
784 */
785 sta->last_rx = jiffies;
786 }
787
788 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
789 return RX_CONTINUE;
790
791 sta->rx_fragments++;
792 sta->rx_bytes += rx->skb->len;
793 sta->last_signal = rx->status->signal;
794 sta->last_qual = rx->status->qual;
795 sta->last_noise = rx->status->noise;
796
797 if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
798 /* Change STA power saving mode only in the end of a frame
799 * exchange sequence */
800 if (test_sta_flags(sta, WLAN_STA_PS) &&
801 !(rx->fc & IEEE80211_FCTL_PM))
802 rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
803 else if (!test_sta_flags(sta, WLAN_STA_PS) &&
804 (rx->fc & IEEE80211_FCTL_PM))
805 ap_sta_ps_start(dev, sta);
806 }
807
808 /* Drop data::nullfunc frames silently, since they are used only to
809 * control station power saving mode. */
810 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
811 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
812 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
813 /* Update counter and free packet here to avoid counting this
814 * as a dropped packed. */
815 sta->rx_packets++;
816 dev_kfree_skb(rx->skb);
817 return RX_QUEUED;
818 }
819
820 return RX_CONTINUE;
821 } /* ieee80211_rx_h_sta_process */
822
823 static inline struct ieee80211_fragment_entry *
824 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
825 unsigned int frag, unsigned int seq, int rx_queue,
826 struct sk_buff **skb)
827 {
828 struct ieee80211_fragment_entry *entry;
829 int idx;
830
831 idx = sdata->fragment_next;
832 entry = &sdata->fragments[sdata->fragment_next++];
833 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
834 sdata->fragment_next = 0;
835
836 if (!skb_queue_empty(&entry->skb_list)) {
837 #ifdef CONFIG_MAC80211_DEBUG
838 struct ieee80211_hdr *hdr =
839 (struct ieee80211_hdr *) entry->skb_list.next->data;
840 DECLARE_MAC_BUF(mac);
841 DECLARE_MAC_BUF(mac2);
842 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
843 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
844 "addr1=%s addr2=%s\n",
845 sdata->dev->name, idx,
846 jiffies - entry->first_frag_time, entry->seq,
847 entry->last_frag, print_mac(mac, hdr->addr1),
848 print_mac(mac2, hdr->addr2));
849 #endif /* CONFIG_MAC80211_DEBUG */
850 __skb_queue_purge(&entry->skb_list);
851 }
852
853 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
854 *skb = NULL;
855 entry->first_frag_time = jiffies;
856 entry->seq = seq;
857 entry->rx_queue = rx_queue;
858 entry->last_frag = frag;
859 entry->ccmp = 0;
860 entry->extra_len = 0;
861
862 return entry;
863 }
864
865 static inline struct ieee80211_fragment_entry *
866 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
867 u16 fc, unsigned int frag, unsigned int seq,
868 int rx_queue, struct ieee80211_hdr *hdr)
869 {
870 struct ieee80211_fragment_entry *entry;
871 int i, idx;
872
873 idx = sdata->fragment_next;
874 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
875 struct ieee80211_hdr *f_hdr;
876 u16 f_fc;
877
878 idx--;
879 if (idx < 0)
880 idx = IEEE80211_FRAGMENT_MAX - 1;
881
882 entry = &sdata->fragments[idx];
883 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
884 entry->rx_queue != rx_queue ||
885 entry->last_frag + 1 != frag)
886 continue;
887
888 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
889 f_fc = le16_to_cpu(f_hdr->frame_control);
890
891 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
892 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
893 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
894 continue;
895
896 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
897 __skb_queue_purge(&entry->skb_list);
898 continue;
899 }
900 return entry;
901 }
902
903 return NULL;
904 }
905
906 static ieee80211_rx_result
907 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
908 {
909 struct ieee80211_hdr *hdr;
910 u16 sc;
911 unsigned int frag, seq;
912 struct ieee80211_fragment_entry *entry;
913 struct sk_buff *skb;
914 DECLARE_MAC_BUF(mac);
915
916 hdr = (struct ieee80211_hdr *) rx->skb->data;
917 sc = le16_to_cpu(hdr->seq_ctrl);
918 frag = sc & IEEE80211_SCTL_FRAG;
919
920 if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
921 (rx->skb)->len < 24 ||
922 is_multicast_ether_addr(hdr->addr1))) {
923 /* not fragmented */
924 goto out;
925 }
926 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
927
928 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
929
930 if (frag == 0) {
931 /* This is the first fragment of a new frame. */
932 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
933 rx->queue, &(rx->skb));
934 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
935 (rx->fc & IEEE80211_FCTL_PROTECTED)) {
936 /* Store CCMP PN so that we can verify that the next
937 * fragment has a sequential PN value. */
938 entry->ccmp = 1;
939 memcpy(entry->last_pn,
940 rx->key->u.ccmp.rx_pn[rx->queue],
941 CCMP_PN_LEN);
942 }
943 return RX_QUEUED;
944 }
945
946 /* This is a fragment for a frame that should already be pending in
947 * fragment cache. Add this fragment to the end of the pending entry.
948 */
949 entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
950 rx->queue, hdr);
951 if (!entry) {
952 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
953 return RX_DROP_MONITOR;
954 }
955
956 /* Verify that MPDUs within one MSDU have sequential PN values.
957 * (IEEE 802.11i, 8.3.3.4.5) */
958 if (entry->ccmp) {
959 int i;
960 u8 pn[CCMP_PN_LEN], *rpn;
961 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
962 return RX_DROP_UNUSABLE;
963 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
964 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
965 pn[i]++;
966 if (pn[i])
967 break;
968 }
969 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
970 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
971 if (net_ratelimit())
972 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
973 "sequential A2=%s"
974 " PN=%02x%02x%02x%02x%02x%02x "
975 "(expected %02x%02x%02x%02x%02x%02x)\n",
976 rx->dev->name, print_mac(mac, hdr->addr2),
977 rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
978 rpn[5], pn[0], pn[1], pn[2], pn[3],
979 pn[4], pn[5]);
980 return RX_DROP_UNUSABLE;
981 }
982 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
983 }
984
985 skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
986 __skb_queue_tail(&entry->skb_list, rx->skb);
987 entry->last_frag = frag;
988 entry->extra_len += rx->skb->len;
989 if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
990 rx->skb = NULL;
991 return RX_QUEUED;
992 }
993
994 rx->skb = __skb_dequeue(&entry->skb_list);
995 if (skb_tailroom(rx->skb) < entry->extra_len) {
996 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
997 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
998 GFP_ATOMIC))) {
999 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1000 __skb_queue_purge(&entry->skb_list);
1001 return RX_DROP_UNUSABLE;
1002 }
1003 }
1004 while ((skb = __skb_dequeue(&entry->skb_list))) {
1005 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1006 dev_kfree_skb(skb);
1007 }
1008
1009 /* Complete frame has been reassembled - process it now */
1010 rx->flags |= IEEE80211_RX_FRAGMENTED;
1011
1012 out:
1013 if (rx->sta)
1014 rx->sta->rx_packets++;
1015 if (is_multicast_ether_addr(hdr->addr1))
1016 rx->local->dot11MulticastReceivedFrameCount++;
1017 else
1018 ieee80211_led_rx(rx->local);
1019 return RX_CONTINUE;
1020 }
1021
1022 static ieee80211_rx_result
1023 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1024 {
1025 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1026 struct sk_buff *skb;
1027 int no_pending_pkts;
1028 DECLARE_MAC_BUF(mac);
1029
1030 if (likely(!rx->sta ||
1031 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
1032 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
1033 !(rx->flags & IEEE80211_RX_RA_MATCH)))
1034 return RX_CONTINUE;
1035
1036 if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
1037 (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
1038 return RX_DROP_UNUSABLE;
1039
1040 skb = skb_dequeue(&rx->sta->tx_filtered);
1041 if (!skb) {
1042 skb = skb_dequeue(&rx->sta->ps_tx_buf);
1043 if (skb)
1044 rx->local->total_ps_buffered--;
1045 }
1046 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
1047 skb_queue_empty(&rx->sta->ps_tx_buf);
1048
1049 if (skb) {
1050 struct ieee80211_hdr *hdr =
1051 (struct ieee80211_hdr *) skb->data;
1052
1053 /*
1054 * Tell TX path to send one frame even though the STA may
1055 * still remain is PS mode after this frame exchange.
1056 */
1057 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1058
1059 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1060 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
1061 print_mac(mac, rx->sta->addr), rx->sta->aid,
1062 skb_queue_len(&rx->sta->ps_tx_buf));
1063 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1064
1065 /* Use MoreData flag to indicate whether there are more
1066 * buffered frames for this STA */
1067 if (no_pending_pkts)
1068 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1069 else
1070 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1071
1072 dev_queue_xmit(skb);
1073
1074 if (no_pending_pkts)
1075 sta_info_clear_tim_bit(rx->sta);
1076 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1077 } else if (!rx->sent_ps_buffered) {
1078 /*
1079 * FIXME: This can be the result of a race condition between
1080 * us expiring a frame and the station polling for it.
1081 * Should we send it a null-func frame indicating we
1082 * have nothing buffered for it?
1083 */
1084 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
1085 "though there is no buffered frames for it\n",
1086 rx->dev->name, print_mac(mac, rx->sta->addr));
1087 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1088 }
1089
1090 /* Free PS Poll skb here instead of returning RX_DROP that would
1091 * count as an dropped frame. */
1092 dev_kfree_skb(rx->skb);
1093
1094 return RX_QUEUED;
1095 }
1096
1097 static ieee80211_rx_result
1098 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1099 {
1100 u16 fc = rx->fc;
1101 u8 *data = rx->skb->data;
1102 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
1103
1104 if (!WLAN_FC_IS_QOS_DATA(fc))
1105 return RX_CONTINUE;
1106
1107 /* remove the qos control field, update frame type and meta-data */
1108 memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
1109 hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
1110 /* change frame type to non QOS */
1111 rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
1112 hdr->frame_control = cpu_to_le16(fc);
1113
1114 return RX_CONTINUE;
1115 }
1116
1117 static int
1118 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1119 {
1120 if (unlikely(!rx->sta ||
1121 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED))) {
1122 #ifdef CONFIG_MAC80211_DEBUG
1123 if (net_ratelimit())
1124 printk(KERN_DEBUG "%s: dropped frame "
1125 "(unauthorized port)\n", rx->dev->name);
1126 #endif /* CONFIG_MAC80211_DEBUG */
1127 return -EACCES;
1128 }
1129
1130 return 0;
1131 }
1132
1133 static int
1134 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx)
1135 {
1136 /*
1137 * Pass through unencrypted frames if the hardware has
1138 * decrypted them already.
1139 */
1140 if (rx->status->flag & RX_FLAG_DECRYPTED)
1141 return 0;
1142
1143 /* Drop unencrypted frames if key is set. */
1144 if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
1145 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
1146 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1147 (rx->key || rx->sdata->drop_unencrypted)))
1148 return -EACCES;
1149
1150 return 0;
1151 }
1152
1153 static int
1154 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1155 {
1156 struct net_device *dev = rx->dev;
1157 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1158 u16 fc, hdrlen, ethertype;
1159 u8 *payload;
1160 u8 dst[ETH_ALEN];
1161 u8 src[ETH_ALEN];
1162 struct sk_buff *skb = rx->skb;
1163 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1164 DECLARE_MAC_BUF(mac);
1165 DECLARE_MAC_BUF(mac2);
1166 DECLARE_MAC_BUF(mac3);
1167 DECLARE_MAC_BUF(mac4);
1168
1169 fc = rx->fc;
1170
1171 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1172 return -1;
1173
1174 hdrlen = ieee80211_get_hdrlen(fc);
1175
1176 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1177 int meshhdrlen = ieee80211_get_mesh_hdrlen(
1178 (struct ieee80211s_hdr *) (skb->data + hdrlen));
1179 /* Copy on cb:
1180 * - mesh header: to be used for mesh forwarding
1181 * decision. It will also be used as mesh header template at
1182 * tx.c:ieee80211_subif_start_xmit() if interface
1183 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
1184 * - ta: to be used if a RERR needs to be sent.
1185 */
1186 memcpy(skb->cb, skb->data + hdrlen, meshhdrlen);
1187 memcpy(MESH_PREQ(skb), hdr->addr2, ETH_ALEN);
1188 hdrlen += meshhdrlen;
1189 }
1190
1191 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1192 * header
1193 * IEEE 802.11 address fields:
1194 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1195 * 0 0 DA SA BSSID n/a
1196 * 0 1 DA BSSID SA n/a
1197 * 1 0 BSSID SA DA n/a
1198 * 1 1 RA TA DA SA
1199 */
1200
1201 switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1202 case IEEE80211_FCTL_TODS:
1203 /* BSSID SA DA */
1204 memcpy(dst, hdr->addr3, ETH_ALEN);
1205 memcpy(src, hdr->addr2, ETH_ALEN);
1206
1207 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
1208 sdata->vif.type != IEEE80211_IF_TYPE_VLAN)) {
1209 if (net_ratelimit())
1210 printk(KERN_DEBUG "%s: dropped ToDS frame "
1211 "(BSSID=%s SA=%s DA=%s)\n",
1212 dev->name,
1213 print_mac(mac, hdr->addr1),
1214 print_mac(mac2, hdr->addr2),
1215 print_mac(mac3, hdr->addr3));
1216 return -1;
1217 }
1218 break;
1219 case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1220 /* RA TA DA SA */
1221 memcpy(dst, hdr->addr3, ETH_ALEN);
1222 memcpy(src, hdr->addr4, ETH_ALEN);
1223
1224 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS &&
1225 sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)) {
1226 if (net_ratelimit())
1227 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
1228 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1229 rx->dev->name,
1230 print_mac(mac, hdr->addr1),
1231 print_mac(mac2, hdr->addr2),
1232 print_mac(mac3, hdr->addr3),
1233 print_mac(mac4, hdr->addr4));
1234 return -1;
1235 }
1236 break;
1237 case IEEE80211_FCTL_FROMDS:
1238 /* DA BSSID SA */
1239 memcpy(dst, hdr->addr1, ETH_ALEN);
1240 memcpy(src, hdr->addr3, ETH_ALEN);
1241
1242 if (sdata->vif.type != IEEE80211_IF_TYPE_STA ||
1243 (is_multicast_ether_addr(dst) &&
1244 !compare_ether_addr(src, dev->dev_addr)))
1245 return -1;
1246 break;
1247 case 0:
1248 /* DA SA BSSID */
1249 memcpy(dst, hdr->addr1, ETH_ALEN);
1250 memcpy(src, hdr->addr2, ETH_ALEN);
1251
1252 if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
1253 if (net_ratelimit()) {
1254 printk(KERN_DEBUG "%s: dropped IBSS frame "
1255 "(DA=%s SA=%s BSSID=%s)\n",
1256 dev->name,
1257 print_mac(mac, hdr->addr1),
1258 print_mac(mac2, hdr->addr2),
1259 print_mac(mac3, hdr->addr3));
1260 }
1261 return -1;
1262 }
1263 break;
1264 }
1265
1266 if (unlikely(skb->len - hdrlen < 8)) {
1267 if (net_ratelimit()) {
1268 printk(KERN_DEBUG "%s: RX too short data frame "
1269 "payload\n", dev->name);
1270 }
1271 return -1;
1272 }
1273
1274 payload = skb->data + hdrlen;
1275 ethertype = (payload[6] << 8) | payload[7];
1276
1277 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1278 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1279 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1280 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1281 * replace EtherType */
1282 skb_pull(skb, hdrlen + 6);
1283 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1284 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1285 } else {
1286 struct ethhdr *ehdr;
1287 __be16 len;
1288
1289 skb_pull(skb, hdrlen);
1290 len = htons(skb->len);
1291 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1292 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1293 memcpy(ehdr->h_source, src, ETH_ALEN);
1294 ehdr->h_proto = len;
1295 }
1296 return 0;
1297 }
1298
1299 /*
1300 * requires that rx->skb is a frame with ethernet header
1301 */
1302 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
1303 {
1304 static const u8 pae_group_addr[ETH_ALEN]
1305 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1306 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1307
1308 /*
1309 * Allow EAPOL frames to us/the PAE group address regardless
1310 * of whether the frame was encrypted or not.
1311 */
1312 if (ehdr->h_proto == htons(ETH_P_PAE) &&
1313 (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1314 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1315 return true;
1316
1317 if (ieee80211_802_1x_port_control(rx) ||
1318 ieee80211_drop_unencrypted(rx))
1319 return false;
1320
1321 return true;
1322 }
1323
1324 /*
1325 * requires that rx->skb is a frame with ethernet header
1326 */
1327 static void
1328 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1329 {
1330 struct net_device *dev = rx->dev;
1331 struct ieee80211_local *local = rx->local;
1332 struct sk_buff *skb, *xmit_skb;
1333 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1334 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1335 struct sta_info *dsta;
1336
1337 skb = rx->skb;
1338 xmit_skb = NULL;
1339
1340 if (local->bridge_packets && (sdata->vif.type == IEEE80211_IF_TYPE_AP ||
1341 sdata->vif.type == IEEE80211_IF_TYPE_VLAN) &&
1342 (rx->flags & IEEE80211_RX_RA_MATCH)) {
1343 if (is_multicast_ether_addr(ehdr->h_dest)) {
1344 /*
1345 * send multicast frames both to higher layers in
1346 * local net stack and back to the wireless medium
1347 */
1348 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1349 if (!xmit_skb && net_ratelimit())
1350 printk(KERN_DEBUG "%s: failed to clone "
1351 "multicast frame\n", dev->name);
1352 } else {
1353 dsta = sta_info_get(local, skb->data);
1354 if (dsta && dsta->sdata->dev == dev) {
1355 /*
1356 * The destination station is associated to
1357 * this AP (in this VLAN), so send the frame
1358 * directly to it and do not pass it to local
1359 * net stack.
1360 */
1361 xmit_skb = skb;
1362 skb = NULL;
1363 }
1364 }
1365 }
1366
1367 /* Mesh forwarding */
1368 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1369 u8 *mesh_ttl = &((struct ieee80211s_hdr *)skb->cb)->ttl;
1370 (*mesh_ttl)--;
1371
1372 if (is_multicast_ether_addr(skb->data)) {
1373 if (*mesh_ttl > 0) {
1374 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1375 if (!xmit_skb && net_ratelimit())
1376 printk(KERN_DEBUG "%s: failed to clone "
1377 "multicast frame\n", dev->name);
1378 else
1379 xmit_skb->pkt_type = PACKET_OTHERHOST;
1380 } else
1381 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
1382 dropped_frames_ttl);
1383 } else if (skb->pkt_type != PACKET_OTHERHOST &&
1384 compare_ether_addr(dev->dev_addr, skb->data) != 0) {
1385 if (*mesh_ttl == 0) {
1386 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
1387 dropped_frames_ttl);
1388 dev_kfree_skb(skb);
1389 skb = NULL;
1390 } else {
1391 xmit_skb = skb;
1392 xmit_skb->pkt_type = PACKET_OTHERHOST;
1393 if (!(dev->flags & IFF_PROMISC))
1394 skb = NULL;
1395 }
1396 }
1397 }
1398
1399 if (skb) {
1400 /* deliver to local stack */
1401 skb->protocol = eth_type_trans(skb, dev);
1402 memset(skb->cb, 0, sizeof(skb->cb));
1403 netif_rx(skb);
1404 }
1405
1406 if (xmit_skb) {
1407 /* send to wireless media */
1408 xmit_skb->protocol = htons(ETH_P_802_3);
1409 skb_reset_network_header(xmit_skb);
1410 skb_reset_mac_header(xmit_skb);
1411 dev_queue_xmit(xmit_skb);
1412 }
1413 }
1414
1415 static ieee80211_rx_result
1416 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1417 {
1418 struct net_device *dev = rx->dev;
1419 struct ieee80211_local *local = rx->local;
1420 u16 fc, ethertype;
1421 u8 *payload;
1422 struct sk_buff *skb = rx->skb, *frame = NULL;
1423 const struct ethhdr *eth;
1424 int remaining, err;
1425 u8 dst[ETH_ALEN];
1426 u8 src[ETH_ALEN];
1427 DECLARE_MAC_BUF(mac);
1428
1429 fc = rx->fc;
1430 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1431 return RX_CONTINUE;
1432
1433 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1434 return RX_DROP_MONITOR;
1435
1436 if (!(rx->flags & IEEE80211_RX_AMSDU))
1437 return RX_CONTINUE;
1438
1439 err = ieee80211_data_to_8023(rx);
1440 if (unlikely(err))
1441 return RX_DROP_UNUSABLE;
1442
1443 skb->dev = dev;
1444
1445 dev->stats.rx_packets++;
1446 dev->stats.rx_bytes += skb->len;
1447
1448 /* skip the wrapping header */
1449 eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1450 if (!eth)
1451 return RX_DROP_UNUSABLE;
1452
1453 while (skb != frame) {
1454 u8 padding;
1455 __be16 len = eth->h_proto;
1456 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1457
1458 remaining = skb->len;
1459 memcpy(dst, eth->h_dest, ETH_ALEN);
1460 memcpy(src, eth->h_source, ETH_ALEN);
1461
1462 padding = ((4 - subframe_len) & 0x3);
1463 /* the last MSDU has no padding */
1464 if (subframe_len > remaining) {
1465 printk(KERN_DEBUG "%s: wrong buffer size", dev->name);
1466 return RX_DROP_UNUSABLE;
1467 }
1468
1469 skb_pull(skb, sizeof(struct ethhdr));
1470 /* if last subframe reuse skb */
1471 if (remaining <= subframe_len + padding)
1472 frame = skb;
1473 else {
1474 frame = dev_alloc_skb(local->hw.extra_tx_headroom +
1475 subframe_len);
1476
1477 if (frame == NULL)
1478 return RX_DROP_UNUSABLE;
1479
1480 skb_reserve(frame, local->hw.extra_tx_headroom +
1481 sizeof(struct ethhdr));
1482 memcpy(skb_put(frame, ntohs(len)), skb->data,
1483 ntohs(len));
1484
1485 eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1486 padding);
1487 if (!eth) {
1488 printk(KERN_DEBUG "%s: wrong buffer size ",
1489 dev->name);
1490 dev_kfree_skb(frame);
1491 return RX_DROP_UNUSABLE;
1492 }
1493 }
1494
1495 skb_reset_network_header(frame);
1496 frame->dev = dev;
1497 frame->priority = skb->priority;
1498 rx->skb = frame;
1499
1500 payload = frame->data;
1501 ethertype = (payload[6] << 8) | payload[7];
1502
1503 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1504 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1505 compare_ether_addr(payload,
1506 bridge_tunnel_header) == 0)) {
1507 /* remove RFC1042 or Bridge-Tunnel
1508 * encapsulation and replace EtherType */
1509 skb_pull(frame, 6);
1510 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1511 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1512 } else {
1513 memcpy(skb_push(frame, sizeof(__be16)),
1514 &len, sizeof(__be16));
1515 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1516 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1517 }
1518
1519 if (!ieee80211_frame_allowed(rx)) {
1520 if (skb == frame) /* last frame */
1521 return RX_DROP_UNUSABLE;
1522 dev_kfree_skb(frame);
1523 continue;
1524 }
1525
1526 ieee80211_deliver_skb(rx);
1527 }
1528
1529 return RX_QUEUED;
1530 }
1531
1532 static ieee80211_rx_result
1533 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1534 {
1535 struct net_device *dev = rx->dev;
1536 u16 fc;
1537 int err;
1538
1539 fc = rx->fc;
1540 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1541 return RX_CONTINUE;
1542
1543 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1544 return RX_DROP_MONITOR;
1545
1546 err = ieee80211_data_to_8023(rx);
1547 if (unlikely(err))
1548 return RX_DROP_UNUSABLE;
1549
1550 if (!ieee80211_frame_allowed(rx))
1551 return RX_DROP_MONITOR;
1552
1553 rx->skb->dev = dev;
1554
1555 dev->stats.rx_packets++;
1556 dev->stats.rx_bytes += rx->skb->len;
1557
1558 ieee80211_deliver_skb(rx);
1559
1560 return RX_QUEUED;
1561 }
1562
1563 static ieee80211_rx_result
1564 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1565 {
1566 struct ieee80211_local *local = rx->local;
1567 struct ieee80211_hw *hw = &local->hw;
1568 struct sk_buff *skb = rx->skb;
1569 struct ieee80211_bar *bar = (struct ieee80211_bar *) skb->data;
1570 struct tid_ampdu_rx *tid_agg_rx;
1571 u16 start_seq_num;
1572 u16 tid;
1573
1574 if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
1575 return RX_CONTINUE;
1576
1577 if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
1578 if (!rx->sta)
1579 return RX_CONTINUE;
1580 tid = le16_to_cpu(bar->control) >> 12;
1581 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1582 != HT_AGG_STATE_OPERATIONAL)
1583 return RX_CONTINUE;
1584 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1585
1586 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1587
1588 /* reset session timer */
1589 if (tid_agg_rx->timeout) {
1590 unsigned long expires =
1591 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
1592 mod_timer(&tid_agg_rx->session_timer, expires);
1593 }
1594
1595 /* manage reordering buffer according to requested */
1596 /* sequence number */
1597 rcu_read_lock();
1598 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1599 start_seq_num, 1);
1600 rcu_read_unlock();
1601 return RX_DROP_UNUSABLE;
1602 }
1603
1604 return RX_CONTINUE;
1605 }
1606
1607 static ieee80211_rx_result
1608 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1609 {
1610 struct ieee80211_sub_if_data *sdata;
1611
1612 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1613 return RX_DROP_MONITOR;
1614
1615 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1616 if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
1617 sdata->vif.type == IEEE80211_IF_TYPE_IBSS ||
1618 sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) &&
1619 !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
1620 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->status);
1621 else
1622 return RX_DROP_MONITOR;
1623
1624 return RX_QUEUED;
1625 }
1626
1627 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1628 struct ieee80211_hdr *hdr,
1629 struct ieee80211_rx_data *rx)
1630 {
1631 int keyidx, hdrlen;
1632 DECLARE_MAC_BUF(mac);
1633 DECLARE_MAC_BUF(mac2);
1634
1635 hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1636 if (rx->skb->len >= hdrlen + 4)
1637 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1638 else
1639 keyidx = -1;
1640
1641 if (net_ratelimit())
1642 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1643 "failure from %s to %s keyidx=%d\n",
1644 dev->name, print_mac(mac, hdr->addr2),
1645 print_mac(mac2, hdr->addr1), keyidx);
1646
1647 if (!rx->sta) {
1648 /*
1649 * Some hardware seem to generate incorrect Michael MIC
1650 * reports; ignore them to avoid triggering countermeasures.
1651 */
1652 if (net_ratelimit())
1653 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1654 "error for unknown address %s\n",
1655 dev->name, print_mac(mac, hdr->addr2));
1656 goto ignore;
1657 }
1658
1659 if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1660 if (net_ratelimit())
1661 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1662 "error for a frame with no PROTECTED flag (src "
1663 "%s)\n", dev->name, print_mac(mac, hdr->addr2));
1664 goto ignore;
1665 }
1666
1667 if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
1668 /*
1669 * APs with pairwise keys should never receive Michael MIC
1670 * errors for non-zero keyidx because these are reserved for
1671 * group keys and only the AP is sending real multicast
1672 * frames in the BSS.
1673 */
1674 if (net_ratelimit())
1675 printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1676 "a frame with non-zero keyidx (%d)"
1677 " (src %s)\n", dev->name, keyidx,
1678 print_mac(mac, hdr->addr2));
1679 goto ignore;
1680 }
1681
1682 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1683 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1684 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1685 if (net_ratelimit())
1686 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1687 "error for a frame that cannot be encrypted "
1688 "(fc=0x%04x) (src %s)\n",
1689 dev->name, rx->fc, print_mac(mac, hdr->addr2));
1690 goto ignore;
1691 }
1692
1693 mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1694 ignore:
1695 dev_kfree_skb(rx->skb);
1696 rx->skb = NULL;
1697 }
1698
1699 /* TODO: use IEEE80211_RX_FRAGMENTED */
1700 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1701 {
1702 struct ieee80211_sub_if_data *sdata;
1703 struct ieee80211_local *local = rx->local;
1704 struct ieee80211_rtap_hdr {
1705 struct ieee80211_radiotap_header hdr;
1706 u8 flags;
1707 u8 rate;
1708 __le16 chan_freq;
1709 __le16 chan_flags;
1710 } __attribute__ ((packed)) *rthdr;
1711 struct sk_buff *skb = rx->skb, *skb2;
1712 struct net_device *prev_dev = NULL;
1713 struct ieee80211_rx_status *status = rx->status;
1714
1715 if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1716 goto out_free_skb;
1717
1718 if (skb_headroom(skb) < sizeof(*rthdr) &&
1719 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1720 goto out_free_skb;
1721
1722 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1723 memset(rthdr, 0, sizeof(*rthdr));
1724 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1725 rthdr->hdr.it_present =
1726 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1727 (1 << IEEE80211_RADIOTAP_RATE) |
1728 (1 << IEEE80211_RADIOTAP_CHANNEL));
1729
1730 rthdr->rate = rx->rate->bitrate / 5;
1731 rthdr->chan_freq = cpu_to_le16(status->freq);
1732
1733 if (status->band == IEEE80211_BAND_5GHZ)
1734 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1735 IEEE80211_CHAN_5GHZ);
1736 else
1737 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1738 IEEE80211_CHAN_2GHZ);
1739
1740 skb_set_mac_header(skb, 0);
1741 skb->ip_summed = CHECKSUM_UNNECESSARY;
1742 skb->pkt_type = PACKET_OTHERHOST;
1743 skb->protocol = htons(ETH_P_802_2);
1744
1745 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1746 if (!netif_running(sdata->dev))
1747 continue;
1748
1749 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
1750 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1751 continue;
1752
1753 if (prev_dev) {
1754 skb2 = skb_clone(skb, GFP_ATOMIC);
1755 if (skb2) {
1756 skb2->dev = prev_dev;
1757 netif_rx(skb2);
1758 }
1759 }
1760
1761 prev_dev = sdata->dev;
1762 sdata->dev->stats.rx_packets++;
1763 sdata->dev->stats.rx_bytes += skb->len;
1764 }
1765
1766 if (prev_dev) {
1767 skb->dev = prev_dev;
1768 netif_rx(skb);
1769 skb = NULL;
1770 } else
1771 goto out_free_skb;
1772
1773 rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
1774 return;
1775
1776 out_free_skb:
1777 dev_kfree_skb(skb);
1778 }
1779
1780 typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_rx_data *);
1781 static ieee80211_rx_handler ieee80211_rx_handlers[] =
1782 {
1783 ieee80211_rx_h_if_stats,
1784 ieee80211_rx_h_passive_scan,
1785 ieee80211_rx_h_check,
1786 ieee80211_rx_h_decrypt,
1787 ieee80211_rx_h_sta_process,
1788 ieee80211_rx_h_defragment,
1789 ieee80211_rx_h_ps_poll,
1790 ieee80211_rx_h_michael_mic_verify,
1791 /* this must be after decryption - so header is counted in MPDU mic
1792 * must be before pae and data, so QOS_DATA format frames
1793 * are not passed to user space by these functions
1794 */
1795 ieee80211_rx_h_remove_qos_control,
1796 ieee80211_rx_h_amsdu,
1797 ieee80211_rx_h_data,
1798 ieee80211_rx_h_ctrl,
1799 ieee80211_rx_h_mgmt,
1800 NULL
1801 };
1802
1803 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
1804 struct ieee80211_rx_data *rx,
1805 struct sk_buff *skb)
1806 {
1807 ieee80211_rx_handler *handler;
1808 ieee80211_rx_result res = RX_DROP_MONITOR;
1809
1810 rx->skb = skb;
1811 rx->sdata = sdata;
1812 rx->dev = sdata->dev;
1813
1814 for (handler = ieee80211_rx_handlers; *handler != NULL; handler++) {
1815 res = (*handler)(rx);
1816
1817 switch (res) {
1818 case RX_CONTINUE:
1819 continue;
1820 case RX_DROP_UNUSABLE:
1821 case RX_DROP_MONITOR:
1822 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1823 if (rx->sta)
1824 rx->sta->rx_dropped++;
1825 break;
1826 case RX_QUEUED:
1827 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1828 break;
1829 }
1830 break;
1831 }
1832
1833 switch (res) {
1834 case RX_CONTINUE:
1835 case RX_DROP_MONITOR:
1836 ieee80211_rx_cooked_monitor(rx);
1837 break;
1838 case RX_DROP_UNUSABLE:
1839 dev_kfree_skb(rx->skb);
1840 break;
1841 }
1842 }
1843
1844 /* main receive path */
1845
1846 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1847 u8 *bssid, struct ieee80211_rx_data *rx,
1848 struct ieee80211_hdr *hdr)
1849 {
1850 int multicast = is_multicast_ether_addr(hdr->addr1);
1851
1852 switch (sdata->vif.type) {
1853 case IEEE80211_IF_TYPE_STA:
1854 if (!bssid)
1855 return 0;
1856 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1857 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1858 return 0;
1859 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1860 } else if (!multicast &&
1861 compare_ether_addr(sdata->dev->dev_addr,
1862 hdr->addr1) != 0) {
1863 if (!(sdata->dev->flags & IFF_PROMISC))
1864 return 0;
1865 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1866 }
1867 break;
1868 case IEEE80211_IF_TYPE_IBSS:
1869 if (!bssid)
1870 return 0;
1871 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
1872 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
1873 return 1;
1874 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1875 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1876 return 0;
1877 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1878 } else if (!multicast &&
1879 compare_ether_addr(sdata->dev->dev_addr,
1880 hdr->addr1) != 0) {
1881 if (!(sdata->dev->flags & IFF_PROMISC))
1882 return 0;
1883 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1884 } else if (!rx->sta)
1885 rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1886 bssid, hdr->addr2);
1887 break;
1888 case IEEE80211_IF_TYPE_MESH_POINT:
1889 if (!multicast &&
1890 compare_ether_addr(sdata->dev->dev_addr,
1891 hdr->addr1) != 0) {
1892 if (!(sdata->dev->flags & IFF_PROMISC))
1893 return 0;
1894
1895 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1896 }
1897 break;
1898 case IEEE80211_IF_TYPE_VLAN:
1899 case IEEE80211_IF_TYPE_AP:
1900 if (!bssid) {
1901 if (compare_ether_addr(sdata->dev->dev_addr,
1902 hdr->addr1))
1903 return 0;
1904 } else if (!ieee80211_bssid_match(bssid,
1905 sdata->dev->dev_addr)) {
1906 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1907 return 0;
1908 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1909 }
1910 if (sdata->dev == sdata->local->mdev &&
1911 !(rx->flags & IEEE80211_RX_IN_SCAN))
1912 /* do not receive anything via
1913 * master device when not scanning */
1914 return 0;
1915 break;
1916 case IEEE80211_IF_TYPE_WDS:
1917 if (bssid ||
1918 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1919 return 0;
1920 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1921 return 0;
1922 break;
1923 case IEEE80211_IF_TYPE_MNTR:
1924 /* take everything */
1925 break;
1926 case IEEE80211_IF_TYPE_INVALID:
1927 /* should never get here */
1928 WARN_ON(1);
1929 break;
1930 }
1931
1932 return 1;
1933 }
1934
1935 /*
1936 * This is the actual Rx frames handler. as it blongs to Rx path it must
1937 * be called with rcu_read_lock protection.
1938 */
1939 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
1940 struct sk_buff *skb,
1941 struct ieee80211_rx_status *status,
1942 u32 load,
1943 struct ieee80211_rate *rate)
1944 {
1945 struct ieee80211_local *local = hw_to_local(hw);
1946 struct ieee80211_sub_if_data *sdata;
1947 struct ieee80211_hdr *hdr;
1948 struct ieee80211_rx_data rx;
1949 u16 type;
1950 int prepares;
1951 struct ieee80211_sub_if_data *prev = NULL;
1952 struct sk_buff *skb_new;
1953 u8 *bssid;
1954
1955 hdr = (struct ieee80211_hdr *) skb->data;
1956 memset(&rx, 0, sizeof(rx));
1957 rx.skb = skb;
1958 rx.local = local;
1959
1960 rx.status = status;
1961 rx.load = load;
1962 rx.rate = rate;
1963 rx.fc = le16_to_cpu(hdr->frame_control);
1964 type = rx.fc & IEEE80211_FCTL_FTYPE;
1965
1966 if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
1967 local->dot11ReceivedFragmentCount++;
1968
1969 rx.sta = sta_info_get(local, hdr->addr2);
1970 if (rx.sta) {
1971 rx.sdata = rx.sta->sdata;
1972 rx.dev = rx.sta->sdata->dev;
1973 }
1974
1975 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1976 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
1977 return;
1978 }
1979
1980 if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
1981 rx.flags |= IEEE80211_RX_IN_SCAN;
1982
1983 ieee80211_parse_qos(&rx);
1984 ieee80211_verify_ip_alignment(&rx);
1985
1986 skb = rx.skb;
1987
1988 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1989 if (!netif_running(sdata->dev))
1990 continue;
1991
1992 if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR)
1993 continue;
1994
1995 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
1996 rx.flags |= IEEE80211_RX_RA_MATCH;
1997 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
1998
1999 if (!prepares)
2000 continue;
2001
2002 /*
2003 * frame is destined for this interface, but if it's not
2004 * also for the previous one we handle that after the
2005 * loop to avoid copying the SKB once too much
2006 */
2007
2008 if (!prev) {
2009 prev = sdata;
2010 continue;
2011 }
2012
2013 /*
2014 * frame was destined for the previous interface
2015 * so invoke RX handlers for it
2016 */
2017
2018 skb_new = skb_copy(skb, GFP_ATOMIC);
2019 if (!skb_new) {
2020 if (net_ratelimit())
2021 printk(KERN_DEBUG "%s: failed to copy "
2022 "multicast frame for %s",
2023 wiphy_name(local->hw.wiphy),
2024 prev->dev->name);
2025 continue;
2026 }
2027 rx.fc = le16_to_cpu(hdr->frame_control);
2028 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
2029 prev = sdata;
2030 }
2031 if (prev) {
2032 rx.fc = le16_to_cpu(hdr->frame_control);
2033 ieee80211_invoke_rx_handlers(prev, &rx, skb);
2034 } else
2035 dev_kfree_skb(skb);
2036 }
2037
2038 #define SEQ_MODULO 0x1000
2039 #define SEQ_MASK 0xfff
2040
2041 static inline int seq_less(u16 sq1, u16 sq2)
2042 {
2043 return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
2044 }
2045
2046 static inline u16 seq_inc(u16 sq)
2047 {
2048 return ((sq + 1) & SEQ_MASK);
2049 }
2050
2051 static inline u16 seq_sub(u16 sq1, u16 sq2)
2052 {
2053 return ((sq1 - sq2) & SEQ_MASK);
2054 }
2055
2056
2057 /*
2058 * As it function blongs to Rx path it must be called with
2059 * the proper rcu_read_lock protection for its flow.
2060 */
2061 u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2062 struct tid_ampdu_rx *tid_agg_rx,
2063 struct sk_buff *skb, u16 mpdu_seq_num,
2064 int bar_req)
2065 {
2066 struct ieee80211_local *local = hw_to_local(hw);
2067 struct ieee80211_rx_status status;
2068 u16 head_seq_num, buf_size;
2069 int index;
2070 u32 pkt_load;
2071 struct ieee80211_supported_band *sband;
2072 struct ieee80211_rate *rate;
2073
2074 buf_size = tid_agg_rx->buf_size;
2075 head_seq_num = tid_agg_rx->head_seq_num;
2076
2077 /* frame with out of date sequence number */
2078 if (seq_less(mpdu_seq_num, head_seq_num)) {
2079 dev_kfree_skb(skb);
2080 return 1;
2081 }
2082
2083 /* if frame sequence number exceeds our buffering window size or
2084 * block Ack Request arrived - release stored frames */
2085 if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2086 /* new head to the ordering buffer */
2087 if (bar_req)
2088 head_seq_num = mpdu_seq_num;
2089 else
2090 head_seq_num =
2091 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2092 /* release stored frames up to new head to stack */
2093 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2094 index = seq_sub(tid_agg_rx->head_seq_num,
2095 tid_agg_rx->ssn)
2096 % tid_agg_rx->buf_size;
2097
2098 if (tid_agg_rx->reorder_buf[index]) {
2099 /* release the reordered frames to stack */
2100 memcpy(&status,
2101 tid_agg_rx->reorder_buf[index]->cb,
2102 sizeof(status));
2103 sband = local->hw.wiphy->bands[status.band];
2104 rate = &sband->bitrates[status.rate_idx];
2105 pkt_load = ieee80211_rx_load_stats(local,
2106 tid_agg_rx->reorder_buf[index],
2107 &status, rate);
2108 __ieee80211_rx_handle_packet(hw,
2109 tid_agg_rx->reorder_buf[index],
2110 &status, pkt_load, rate);
2111 tid_agg_rx->stored_mpdu_num--;
2112 tid_agg_rx->reorder_buf[index] = NULL;
2113 }
2114 tid_agg_rx->head_seq_num =
2115 seq_inc(tid_agg_rx->head_seq_num);
2116 }
2117 if (bar_req)
2118 return 1;
2119 }
2120
2121 /* now the new frame is always in the range of the reordering */
2122 /* buffer window */
2123 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2124 % tid_agg_rx->buf_size;
2125 /* check if we already stored this frame */
2126 if (tid_agg_rx->reorder_buf[index]) {
2127 dev_kfree_skb(skb);
2128 return 1;
2129 }
2130
2131 /* if arrived mpdu is in the right order and nothing else stored */
2132 /* release it immediately */
2133 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2134 tid_agg_rx->stored_mpdu_num == 0) {
2135 tid_agg_rx->head_seq_num =
2136 seq_inc(tid_agg_rx->head_seq_num);
2137 return 0;
2138 }
2139
2140 /* put the frame in the reordering buffer */
2141 tid_agg_rx->reorder_buf[index] = skb;
2142 tid_agg_rx->stored_mpdu_num++;
2143 /* release the buffer until next missing frame */
2144 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2145 % tid_agg_rx->buf_size;
2146 while (tid_agg_rx->reorder_buf[index]) {
2147 /* release the reordered frame back to stack */
2148 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2149 sizeof(status));
2150 sband = local->hw.wiphy->bands[status.band];
2151 rate = &sband->bitrates[status.rate_idx];
2152 pkt_load = ieee80211_rx_load_stats(local,
2153 tid_agg_rx->reorder_buf[index],
2154 &status, rate);
2155 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
2156 &status, pkt_load, rate);
2157 tid_agg_rx->stored_mpdu_num--;
2158 tid_agg_rx->reorder_buf[index] = NULL;
2159 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2160 index = seq_sub(tid_agg_rx->head_seq_num,
2161 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2162 }
2163 return 1;
2164 }
2165
2166 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2167 struct sk_buff *skb)
2168 {
2169 struct ieee80211_hw *hw = &local->hw;
2170 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2171 struct sta_info *sta;
2172 struct tid_ampdu_rx *tid_agg_rx;
2173 u16 fc, sc;
2174 u16 mpdu_seq_num;
2175 u8 ret = 0, *qc;
2176 int tid;
2177
2178 sta = sta_info_get(local, hdr->addr2);
2179 if (!sta)
2180 return ret;
2181
2182 fc = le16_to_cpu(hdr->frame_control);
2183
2184 /* filter the QoS data rx stream according to
2185 * STA/TID and check if this STA/TID is on aggregation */
2186 if (!WLAN_FC_IS_QOS_DATA(fc))
2187 goto end_reorder;
2188
2189 qc = skb->data + ieee80211_get_hdrlen(fc) - QOS_CONTROL_LEN;
2190 tid = qc[0] & QOS_CONTROL_TID_MASK;
2191
2192 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2193 goto end_reorder;
2194
2195 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2196
2197 /* null data frames are excluded */
2198 if (unlikely(fc & IEEE80211_STYPE_NULLFUNC))
2199 goto end_reorder;
2200
2201 /* new un-ordered ampdu frame - process it */
2202
2203 /* reset session timer */
2204 if (tid_agg_rx->timeout) {
2205 unsigned long expires =
2206 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
2207 mod_timer(&tid_agg_rx->session_timer, expires);
2208 }
2209
2210 /* if this mpdu is fragmented - terminate rx aggregation session */
2211 sc = le16_to_cpu(hdr->seq_ctrl);
2212 if (sc & IEEE80211_SCTL_FRAG) {
2213 ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
2214 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2215 ret = 1;
2216 goto end_reorder;
2217 }
2218
2219 /* according to mpdu sequence number deal with reordering buffer */
2220 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2221 ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2222 mpdu_seq_num, 0);
2223 end_reorder:
2224 return ret;
2225 }
2226
2227 /*
2228 * This is the receive path handler. It is called by a low level driver when an
2229 * 802.11 MPDU is received from the hardware.
2230 */
2231 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2232 struct ieee80211_rx_status *status)
2233 {
2234 struct ieee80211_local *local = hw_to_local(hw);
2235 u32 pkt_load;
2236 struct ieee80211_rate *rate = NULL;
2237 struct ieee80211_supported_band *sband;
2238
2239 if (status->band < 0 ||
2240 status->band >= IEEE80211_NUM_BANDS) {
2241 WARN_ON(1);
2242 return;
2243 }
2244
2245 sband = local->hw.wiphy->bands[status->band];
2246
2247 if (!sband ||
2248 status->rate_idx < 0 ||
2249 status->rate_idx >= sband->n_bitrates) {
2250 WARN_ON(1);
2251 return;
2252 }
2253
2254 rate = &sband->bitrates[status->rate_idx];
2255
2256 /*
2257 * key references and virtual interfaces are protected using RCU
2258 * and this requires that we are in a read-side RCU section during
2259 * receive processing
2260 */
2261 rcu_read_lock();
2262
2263 /*
2264 * Frames with failed FCS/PLCP checksum are not returned,
2265 * all other frames are returned without radiotap header
2266 * if it was previously present.
2267 * Also, frames with less than 16 bytes are dropped.
2268 */
2269 skb = ieee80211_rx_monitor(local, skb, status, rate);
2270 if (!skb) {
2271 rcu_read_unlock();
2272 return;
2273 }
2274
2275 pkt_load = ieee80211_rx_load_stats(local, skb, status, rate);
2276 local->channel_use_raw += pkt_load;
2277
2278 if (!ieee80211_rx_reorder_ampdu(local, skb))
2279 __ieee80211_rx_handle_packet(hw, skb, status, pkt_load, rate);
2280
2281 rcu_read_unlock();
2282 }
2283 EXPORT_SYMBOL(__ieee80211_rx);
2284
2285 /* This is a version of the rx handler that can be called from hard irq
2286 * context. Post the skb on the queue and schedule the tasklet */
2287 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2288 struct ieee80211_rx_status *status)
2289 {
2290 struct ieee80211_local *local = hw_to_local(hw);
2291
2292 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2293
2294 skb->dev = local->mdev;
2295 /* copy status into skb->cb for use by tasklet */
2296 memcpy(skb->cb, status, sizeof(*status));
2297 skb->pkt_type = IEEE80211_RX_MSG;
2298 skb_queue_tail(&local->skb_queue, skb);
2299 tasklet_schedule(&local->tasklet);
2300 }
2301 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree