?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
gpio-charger: Fix checking return value of request_any_context_irq
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / net / mac80211 / rx.c
blobc5d4530d8284e59f07b44af1ce904fea5fc26018
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/jiffies.h>
13 #include <linux/slab.h>
14 #include <linux/kernel.h>
15 #include <linux/skbuff.h>
16 #include <linux/netdevice.h>
17 #include <linux/etherdevice.h>
18 #include <linux/rcupdate.h>
19 #include <net/mac80211.h>
20 #include <net/ieee80211_radiotap.h>
21
22 #include "ieee80211_i.h"
23 #include "driver-ops.h"
24 #include "led.h"
25 #include "mesh.h"
26 #include "wep.h"
27 #include "wpa.h"
28 #include "tkip.h"
29 #include "wme.h"
30
31 /*
32 * monitor mode reception
33 *
34 * This function cleans up the SKB, i.e. it removes all the stuff
35 * only useful for monitoring.
36 */
37 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
38 struct sk_buff *skb)
39 {
40 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
41 if (likely(skb->len > FCS_LEN))
42 __pskb_trim(skb, skb->len - FCS_LEN);
43 else {
44 /* driver bug */
45 WARN_ON(1);
46 dev_kfree_skb(skb);
47 skb = NULL;
48 }
49 }
50
51 return skb;
52 }
53
54 static inline int should_drop_frame(struct sk_buff *skb,
55 int present_fcs_len)
56 {
57 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
58 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
59
60 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
61 return 1;
62 if (unlikely(skb->len < 16 + present_fcs_len))
63 return 1;
64 if (ieee80211_is_ctl(hdr->frame_control) &&
65 !ieee80211_is_pspoll(hdr->frame_control) &&
66 !ieee80211_is_back_req(hdr->frame_control))
67 return 1;
68 return 0;
69 }
70
71 static int
72 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
73 struct ieee80211_rx_status *status)
74 {
75 int len;
76
77 /* always present fields */
78 len = sizeof(struct ieee80211_radiotap_header) + 9;
79
80 if (status->flag & RX_FLAG_MACTIME_MPDU)
81 len += 8;
82 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
83 len += 1;
84
85 if (len & 1) /* padding for RX_FLAGS if necessary */
86 len++;
87
88 if (status->flag & RX_FLAG_HT) /* HT info */
89 len += 3;
90
91 return len;
92 }
93
94 /*
95 * ieee80211_add_rx_radiotap_header - add radiotap header
96 *
97 * add a radiotap header containing all the fields which the hardware provided.
98 */
99 static void
100 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
101 struct sk_buff *skb,
102 struct ieee80211_rate *rate,
103 int rtap_len)
104 {
105 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
106 struct ieee80211_radiotap_header *rthdr;
107 unsigned char *pos;
108 u16 rx_flags = 0;
109
110 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
111 memset(rthdr, 0, rtap_len);
112
113 /* radiotap header, set always present flags */
114 rthdr->it_present =
115 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
116 (1 << IEEE80211_RADIOTAP_CHANNEL) |
117 (1 << IEEE80211_RADIOTAP_ANTENNA) |
118 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
119 rthdr->it_len = cpu_to_le16(rtap_len);
120
121 pos = (unsigned char *)(rthdr+1);
122
123 /* the order of the following fields is important */
124
125 /* IEEE80211_RADIOTAP_TSFT */
126 if (status->flag & RX_FLAG_MACTIME_MPDU) {
127 put_unaligned_le64(status->mactime, pos);
128 rthdr->it_present |=
129 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
130 pos += 8;
131 }
132
133 /* IEEE80211_RADIOTAP_FLAGS */
134 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
135 *pos |= IEEE80211_RADIOTAP_F_FCS;
136 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
137 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
138 if (status->flag & RX_FLAG_SHORTPRE)
139 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
140 pos++;
141
142 /* IEEE80211_RADIOTAP_RATE */
143 if (status->flag & RX_FLAG_HT) {
144 /*
145 * MCS information is a separate field in radiotap,
146 * added below.
147 */
148 *pos = 0;
149 } else {
150 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
151 *pos = rate->bitrate / 5;
152 }
153 pos++;
154
155 /* IEEE80211_RADIOTAP_CHANNEL */
156 put_unaligned_le16(status->freq, pos);
157 pos += 2;
158 if (status->band == IEEE80211_BAND_5GHZ)
159 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
160 pos);
161 else if (status->flag & RX_FLAG_HT)
162 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
163 pos);
164 else if (rate->flags & IEEE80211_RATE_ERP_G)
165 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
166 pos);
167 else
168 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
169 pos);
170 pos += 2;
171
172 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
173 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
174 *pos = status->signal;
175 rthdr->it_present |=
176 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
177 pos++;
178 }
179
180 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
181
182 /* IEEE80211_RADIOTAP_ANTENNA */
183 *pos = status->antenna;
184 pos++;
185
186 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
187
188 /* IEEE80211_RADIOTAP_RX_FLAGS */
189 /* ensure 2 byte alignment for the 2 byte field as required */
190 if ((pos - (u8 *)rthdr) & 1)
191 pos++;
192 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
193 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
194 put_unaligned_le16(rx_flags, pos);
195 pos += 2;
196
197 if (status->flag & RX_FLAG_HT) {
198 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
199 *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
200 IEEE80211_RADIOTAP_MCS_HAVE_GI |
201 IEEE80211_RADIOTAP_MCS_HAVE_BW;
202 *pos = 0;
203 if (status->flag & RX_FLAG_SHORT_GI)
204 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
205 if (status->flag & RX_FLAG_40MHZ)
206 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
207 pos++;
208 *pos++ = status->rate_idx;
209 }
210 }
211
212 /*
213 * This function copies a received frame to all monitor interfaces and
214 * returns a cleaned-up SKB that no longer includes the FCS nor the
215 * radiotap header the driver might have added.
216 */
217 static struct sk_buff *
218 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
219 struct ieee80211_rate *rate)
220 {
221 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
222 struct ieee80211_sub_if_data *sdata;
223 int needed_headroom = 0;
224 struct sk_buff *skb, *skb2;
225 struct net_device *prev_dev = NULL;
226 int present_fcs_len = 0;
227
228 /*
229 * First, we may need to make a copy of the skb because
230 * (1) we need to modify it for radiotap (if not present), and
231 * (2) the other RX handlers will modify the skb we got.
232 *
233 * We don't need to, of course, if we aren't going to return
234 * the SKB because it has a bad FCS/PLCP checksum.
235 */
236
237 /* room for the radiotap header based on driver features */
238 needed_headroom = ieee80211_rx_radiotap_len(local, status);
239
240 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
241 present_fcs_len = FCS_LEN;
242
243 /* make sure hdr->frame_control is on the linear part */
244 if (!pskb_may_pull(origskb, 2)) {
245 dev_kfree_skb(origskb);
246 return NULL;
247 }
248
249 if (!local->monitors) {
250 if (should_drop_frame(origskb, present_fcs_len)) {
251 dev_kfree_skb(origskb);
252 return NULL;
253 }
254
255 return remove_monitor_info(local, origskb);
256 }
257
258 if (should_drop_frame(origskb, present_fcs_len)) {
259 /* only need to expand headroom if necessary */
260 skb = origskb;
261 origskb = NULL;
262
263 /*
264 * This shouldn't trigger often because most devices have an
265 * RX header they pull before we get here, and that should
266 * be big enough for our radiotap information. We should
267 * probably export the length to drivers so that we can have
268 * them allocate enough headroom to start with.
269 */
270 if (skb_headroom(skb) < needed_headroom &&
271 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
272 dev_kfree_skb(skb);
273 return NULL;
274 }
275 } else {
276 /*
277 * Need to make a copy and possibly remove radiotap header
278 * and FCS from the original.
279 */
280 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
281
282 origskb = remove_monitor_info(local, origskb);
283
284 if (!skb)
285 return origskb;
286 }
287
288 /* prepend radiotap information */
289 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
290
291 skb_reset_mac_header(skb);
292 skb->ip_summed = CHECKSUM_UNNECESSARY;
293 skb->pkt_type = PACKET_OTHERHOST;
294 skb->protocol = htons(ETH_P_802_2);
295
296 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
297 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
298 continue;
299
300 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
301 continue;
302
303 if (!ieee80211_sdata_running(sdata))
304 continue;
305
306 if (prev_dev) {
307 skb2 = skb_clone(skb, GFP_ATOMIC);
308 if (skb2) {
309 skb2->dev = prev_dev;
310 netif_receive_skb(skb2);
311 }
312 }
313
314 prev_dev = sdata->dev;
315 sdata->dev->stats.rx_packets++;
316 sdata->dev->stats.rx_bytes += skb->len;
317 }
318
319 if (prev_dev) {
320 skb->dev = prev_dev;
321 netif_receive_skb(skb);
322 } else
323 dev_kfree_skb(skb);
324
325 return origskb;
326 }
327
328
329 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
330 {
331 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
332 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
333 int tid;
334
335 /* does the frame have a qos control field? */
336 if (ieee80211_is_data_qos(hdr->frame_control)) {
337 u8 *qc = ieee80211_get_qos_ctl(hdr);
338 /* frame has qos control */
339 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
340 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
341 status->rx_flags |= IEEE80211_RX_AMSDU;
342 } else {
343 /*
344 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
345 *
346 * Sequence numbers for management frames, QoS data
347 * frames with a broadcast/multicast address in the
348 * Address 1 field, and all non-QoS data frames sent
349 * by QoS STAs are assigned using an additional single
350 * modulo-4096 counter, [...]
351 *
352 * We also use that counter for non-QoS STAs.
353 */
354 tid = NUM_RX_DATA_QUEUES - 1;
355 }
356
357 rx->queue = tid;
358 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
359 * For now, set skb->priority to 0 for other cases. */
360 rx->skb->priority = (tid > 7) ? 0 : tid;
361 }
362
363 /**
364 * DOC: Packet alignment
365 *
366 * Drivers always need to pass packets that are aligned to two-byte boundaries
367 * to the stack.
368 *
369 * Additionally, should, if possible, align the payload data in a way that
370 * guarantees that the contained IP header is aligned to a four-byte
371 * boundary. In the case of regular frames, this simply means aligning the
372 * payload to a four-byte boundary (because either the IP header is directly
373 * contained, or IV/RFC1042 headers that have a length divisible by four are
374 * in front of it). If the payload data is not properly aligned and the
375 * architecture doesn't support efficient unaligned operations, mac80211
376 * will align the data.
377 *
378 * With A-MSDU frames, however, the payload data address must yield two modulo
379 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
380 * push the IP header further back to a multiple of four again. Thankfully, the
381 * specs were sane enough this time around to require padding each A-MSDU
382 * subframe to a length that is a multiple of four.
383 *
384 * Padding like Atheros hardware adds which is between the 802.11 header and
385 * the payload is not supported, the driver is required to move the 802.11
386 * header to be directly in front of the payload in that case.
387 */
388 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
389 {
390 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
391 WARN_ONCE((unsigned long)rx->skb->data & 1,
392 "unaligned packet at 0x%p\n", rx->skb->data);
393 #endif
394 }
395
396
397 /* rx handlers */
398
399 static ieee80211_rx_result debug_noinline
400 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
401 {
402 struct ieee80211_local *local = rx->local;
403 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
404 struct sk_buff *skb = rx->skb;
405
406 if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
407 return RX_CONTINUE;
408
409 if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
410 test_bit(SCAN_SW_SCANNING, &local->scanning))
411 return ieee80211_scan_rx(rx->sdata, skb);
412
413 /* scanning finished during invoking of handlers */
414 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
415 return RX_DROP_UNUSABLE;
416 }
417
418
419 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
420 {
421 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
422
423 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
424 return 0;
425
426 return ieee80211_is_robust_mgmt_frame(hdr);
427 }
428
429
430 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
431 {
432 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
433
434 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
435 return 0;
436
437 return ieee80211_is_robust_mgmt_frame(hdr);
438 }
439
440
441 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
442 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
443 {
444 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
445 struct ieee80211_mmie *mmie;
446
447 if (skb->len < 24 + sizeof(*mmie) ||
448 !is_multicast_ether_addr(hdr->da))
449 return -1;
450
451 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
452 return -1; /* not a robust management frame */
453
454 mmie = (struct ieee80211_mmie *)
455 (skb->data + skb->len - sizeof(*mmie));
456 if (mmie->element_id != WLAN_EID_MMIE ||
457 mmie->length != sizeof(*mmie) - 2)
458 return -1;
459
460 return le16_to_cpu(mmie->key_id);
461 }
462
463
464 static ieee80211_rx_result
465 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
466 {
467 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
468 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
469 char *dev_addr = rx->sdata->vif.addr;
470
471 if (ieee80211_is_data(hdr->frame_control)) {
472 if (is_multicast_ether_addr(hdr->addr1)) {
473 if (ieee80211_has_tods(hdr->frame_control) ||
474 !ieee80211_has_fromds(hdr->frame_control))
475 return RX_DROP_MONITOR;
476 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
477 return RX_DROP_MONITOR;
478 } else {
479 if (!ieee80211_has_a4(hdr->frame_control))
480 return RX_DROP_MONITOR;
481 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
482 return RX_DROP_MONITOR;
483 }
484 }
485
486 /* If there is not an established peer link and this is not a peer link
487 * establisment frame, beacon or probe, drop the frame.
488 */
489
490 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
491 struct ieee80211_mgmt *mgmt;
492
493 if (!ieee80211_is_mgmt(hdr->frame_control))
494 return RX_DROP_MONITOR;
495
496 if (ieee80211_is_action(hdr->frame_control)) {
497 mgmt = (struct ieee80211_mgmt *)hdr;
498 if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
499 return RX_DROP_MONITOR;
500 return RX_CONTINUE;
501 }
502
503 if (ieee80211_is_probe_req(hdr->frame_control) ||
504 ieee80211_is_probe_resp(hdr->frame_control) ||
505 ieee80211_is_beacon(hdr->frame_control))
506 return RX_CONTINUE;
507
508 return RX_DROP_MONITOR;
509
510 }
511
512 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
513
514 if (ieee80211_is_data(hdr->frame_control) &&
515 is_multicast_ether_addr(hdr->addr1) &&
516 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
517 return RX_DROP_MONITOR;
518 #undef msh_h_get
519
520 return RX_CONTINUE;
521 }
522
523 #define SEQ_MODULO 0x1000
524 #define SEQ_MASK 0xfff
525
526 static inline int seq_less(u16 sq1, u16 sq2)
527 {
528 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
529 }
530
531 static inline u16 seq_inc(u16 sq)
532 {
533 return (sq + 1) & SEQ_MASK;
534 }
535
536 static inline u16 seq_sub(u16 sq1, u16 sq2)
537 {
538 return (sq1 - sq2) & SEQ_MASK;
539 }
540
541
542 static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
543 struct tid_ampdu_rx *tid_agg_rx,
544 int index)
545 {
546 struct ieee80211_local *local = hw_to_local(hw);
547 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
548 struct ieee80211_rx_status *status;
549
550 lockdep_assert_held(&tid_agg_rx->reorder_lock);
551
552 if (!skb)
553 goto no_frame;
554
555 /* release the frame from the reorder ring buffer */
556 tid_agg_rx->stored_mpdu_num--;
557 tid_agg_rx->reorder_buf[index] = NULL;
558 status = IEEE80211_SKB_RXCB(skb);
559 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
560 skb_queue_tail(&local->rx_skb_queue, skb);
561
562 no_frame:
563 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
564 }
565
566 static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
567 struct tid_ampdu_rx *tid_agg_rx,
568 u16 head_seq_num)
569 {
570 int index;
571
572 lockdep_assert_held(&tid_agg_rx->reorder_lock);
573
574 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
575 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
576 tid_agg_rx->buf_size;
577 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
578 }
579 }
580
581 /*
582 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
583 * the skb was added to the buffer longer than this time ago, the earlier
584 * frames that have not yet been received are assumed to be lost and the skb
585 * can be released for processing. This may also release other skb's from the
586 * reorder buffer if there are no additional gaps between the frames.
587 *
588 * Callers must hold tid_agg_rx->reorder_lock.
589 */
590 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
591
592 static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
593 struct tid_ampdu_rx *tid_agg_rx)
594 {
595 int index, j;
596
597 lockdep_assert_held(&tid_agg_rx->reorder_lock);
598
599 /* release the buffer until next missing frame */
600 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
601 tid_agg_rx->buf_size;
602 if (!tid_agg_rx->reorder_buf[index] &&
603 tid_agg_rx->stored_mpdu_num > 1) {
604 /*
605 * No buffers ready to be released, but check whether any
606 * frames in the reorder buffer have timed out.
607 */
608 int skipped = 1;
609 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
610 j = (j + 1) % tid_agg_rx->buf_size) {
611 if (!tid_agg_rx->reorder_buf[j]) {
612 skipped++;
613 continue;
614 }
615 if (skipped &&
616 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
617 HT_RX_REORDER_BUF_TIMEOUT))
618 goto set_release_timer;
619
620 #ifdef CONFIG_MAC80211_HT_DEBUG
621 if (net_ratelimit())
622 wiphy_debug(hw->wiphy,
623 "release an RX reorder frame due to timeout on earlier frames\n");
624 #endif
625 ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
626
627 /*
628 * Increment the head seq# also for the skipped slots.
629 */
630 tid_agg_rx->head_seq_num =
631 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
632 skipped = 0;
633 }
634 } else while (tid_agg_rx->reorder_buf[index]) {
635 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
636 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
637 tid_agg_rx->buf_size;
638 }
639
640 if (tid_agg_rx->stored_mpdu_num) {
641 j = index = seq_sub(tid_agg_rx->head_seq_num,
642 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
643
644 for (; j != (index - 1) % tid_agg_rx->buf_size;
645 j = (j + 1) % tid_agg_rx->buf_size) {
646 if (tid_agg_rx->reorder_buf[j])
647 break;
648 }
649
650 set_release_timer:
651
652 mod_timer(&tid_agg_rx->reorder_timer,
653 tid_agg_rx->reorder_time[j] +
654 HT_RX_REORDER_BUF_TIMEOUT);
655 } else {
656 del_timer(&tid_agg_rx->reorder_timer);
657 }
658 }
659
660 /*
661 * As this function belongs to the RX path it must be under
662 * rcu_read_lock protection. It returns false if the frame
663 * can be processed immediately, true if it was consumed.
664 */
665 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
666 struct tid_ampdu_rx *tid_agg_rx,
667 struct sk_buff *skb)
668 {
669 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
670 u16 sc = le16_to_cpu(hdr->seq_ctrl);
671 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
672 u16 head_seq_num, buf_size;
673 int index;
674 bool ret = true;
675
676 spin_lock(&tid_agg_rx->reorder_lock);
677
678 buf_size = tid_agg_rx->buf_size;
679 head_seq_num = tid_agg_rx->head_seq_num;
680
681 /* frame with out of date sequence number */
682 if (seq_less(mpdu_seq_num, head_seq_num)) {
683 dev_kfree_skb(skb);
684 goto out;
685 }
686
687 /*
688 * If frame the sequence number exceeds our buffering window
689 * size release some previous frames to make room for this one.
690 */
691 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
692 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
693 /* release stored frames up to new head to stack */
694 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
695 }
696
697 /* Now the new frame is always in the range of the reordering buffer */
698
699 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
700
701 /* check if we already stored this frame */
702 if (tid_agg_rx->reorder_buf[index]) {
703 dev_kfree_skb(skb);
704 goto out;
705 }
706
707 /*
708 * If the current MPDU is in the right order and nothing else
709 * is stored we can process it directly, no need to buffer it.
710 */
711 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
712 tid_agg_rx->stored_mpdu_num == 0) {
713 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
714 ret = false;
715 goto out;
716 }
717
718 /* put the frame in the reordering buffer */
719 tid_agg_rx->reorder_buf[index] = skb;
720 tid_agg_rx->reorder_time[index] = jiffies;
721 tid_agg_rx->stored_mpdu_num++;
722 ieee80211_sta_reorder_release(hw, tid_agg_rx);
723
724 out:
725 spin_unlock(&tid_agg_rx->reorder_lock);
726 return ret;
727 }
728
729 /*
730 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
731 * true if the MPDU was buffered, false if it should be processed.
732 */
733 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
734 {
735 struct sk_buff *skb = rx->skb;
736 struct ieee80211_local *local = rx->local;
737 struct ieee80211_hw *hw = &local->hw;
738 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
739 struct sta_info *sta = rx->sta;
740 struct tid_ampdu_rx *tid_agg_rx;
741 u16 sc;
742 int tid;
743
744 if (!ieee80211_is_data_qos(hdr->frame_control))
745 goto dont_reorder;
746
747 /*
748 * filter the QoS data rx stream according to
749 * STA/TID and check if this STA/TID is on aggregation
750 */
751
752 if (!sta)
753 goto dont_reorder;
754
755 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
756
757 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
758 if (!tid_agg_rx)
759 goto dont_reorder;
760
761 /* qos null data frames are excluded */
762 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
763 goto dont_reorder;
764
765 /* new, potentially un-ordered, ampdu frame - process it */
766
767 /* reset session timer */
768 if (tid_agg_rx->timeout)
769 mod_timer(&tid_agg_rx->session_timer,
770 TU_TO_EXP_TIME(tid_agg_rx->timeout));
771
772 /* if this mpdu is fragmented - terminate rx aggregation session */
773 sc = le16_to_cpu(hdr->seq_ctrl);
774 if (sc & IEEE80211_SCTL_FRAG) {
775 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
776 skb_queue_tail(&rx->sdata->skb_queue, skb);
777 ieee80211_queue_work(&local->hw, &rx->sdata->work);
778 return;
779 }
780
781 /*
782 * No locking needed -- we will only ever process one
783 * RX packet at a time, and thus own tid_agg_rx. All
784 * other code manipulating it needs to (and does) make
785 * sure that we cannot get to it any more before doing
786 * anything with it.
787 */
788 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
789 return;
790
791 dont_reorder:
792 skb_queue_tail(&local->rx_skb_queue, skb);
793 }
794
795 static ieee80211_rx_result debug_noinline
796 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
797 {
798 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
799 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
800
801 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
802 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
803 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
804 rx->sta->last_seq_ctrl[rx->queue] ==
805 hdr->seq_ctrl)) {
806 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
807 rx->local->dot11FrameDuplicateCount++;
808 rx->sta->num_duplicates++;
809 }
810 return RX_DROP_UNUSABLE;
811 } else
812 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
813 }
814
815 if (unlikely(rx->skb->len < 16)) {
816 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
817 return RX_DROP_MONITOR;
818 }
819
820 /* Drop disallowed frame classes based on STA auth/assoc state;
821 * IEEE 802.11, Chap 5.5.
822 *
823 * mac80211 filters only based on association state, i.e. it drops
824 * Class 3 frames from not associated stations. hostapd sends
825 * deauth/disassoc frames when needed. In addition, hostapd is
826 * responsible for filtering on both auth and assoc states.
827 */
828
829 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
830 return ieee80211_rx_mesh_check(rx);
831
832 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
833 ieee80211_is_pspoll(hdr->frame_control)) &&
834 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
835 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
836 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC))))
837 return RX_DROP_MONITOR;
838
839 return RX_CONTINUE;
840 }
841
842
843 static ieee80211_rx_result debug_noinline
844 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
845 {
846 struct sk_buff *skb = rx->skb;
847 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
848 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
849 int keyidx;
850 int hdrlen;
851 ieee80211_rx_result result = RX_DROP_UNUSABLE;
852 struct ieee80211_key *sta_ptk = NULL;
853 int mmie_keyidx = -1;
854 __le16 fc;
855
856 /*
857 * Key selection 101
858 *
859 * There are four types of keys:
860 * - GTK (group keys)
861 * - IGTK (group keys for management frames)
862 * - PTK (pairwise keys)
863 * - STK (station-to-station pairwise keys)
864 *
865 * When selecting a key, we have to distinguish between multicast
866 * (including broadcast) and unicast frames, the latter can only
867 * use PTKs and STKs while the former always use GTKs and IGTKs.
868 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
869 * unicast frames can also use key indices like GTKs. Hence, if we
870 * don't have a PTK/STK we check the key index for a WEP key.
871 *
872 * Note that in a regular BSS, multicast frames are sent by the
873 * AP only, associated stations unicast the frame to the AP first
874 * which then multicasts it on their behalf.
875 *
876 * There is also a slight problem in IBSS mode: GTKs are negotiated
877 * with each station, that is something we don't currently handle.
878 * The spec seems to expect that one negotiates the same key with
879 * every station but there's no such requirement; VLANs could be
880 * possible.
881 */
882
883 /*
884 * No point in finding a key and decrypting if the frame is neither
885 * addressed to us nor a multicast frame.
886 */
887 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
888 return RX_CONTINUE;
889
890 /* start without a key */
891 rx->key = NULL;
892
893 if (rx->sta)
894 sta_ptk = rcu_dereference(rx->sta->ptk);
895
896 fc = hdr->frame_control;
897
898 if (!ieee80211_has_protected(fc))
899 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
900
901 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
902 rx->key = sta_ptk;
903 if ((status->flag & RX_FLAG_DECRYPTED) &&
904 (status->flag & RX_FLAG_IV_STRIPPED))
905 return RX_CONTINUE;
906 /* Skip decryption if the frame is not protected. */
907 if (!ieee80211_has_protected(fc))
908 return RX_CONTINUE;
909 } else if (mmie_keyidx >= 0) {
910 /* Broadcast/multicast robust management frame / BIP */
911 if ((status->flag & RX_FLAG_DECRYPTED) &&
912 (status->flag & RX_FLAG_IV_STRIPPED))
913 return RX_CONTINUE;
914
915 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
916 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
917 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
918 if (rx->sta)
919 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
920 if (!rx->key)
921 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
922 } else if (!ieee80211_has_protected(fc)) {
923 /*
924 * The frame was not protected, so skip decryption. However, we
925 * need to set rx->key if there is a key that could have been
926 * used so that the frame may be dropped if encryption would
927 * have been expected.
928 */
929 struct ieee80211_key *key = NULL;
930 struct ieee80211_sub_if_data *sdata = rx->sdata;
931 int i;
932
933 if (ieee80211_is_mgmt(fc) &&
934 is_multicast_ether_addr(hdr->addr1) &&
935 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
936 rx->key = key;
937 else {
938 if (rx->sta) {
939 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
940 key = rcu_dereference(rx->sta->gtk[i]);
941 if (key)
942 break;
943 }
944 }
945 if (!key) {
946 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
947 key = rcu_dereference(sdata->keys[i]);
948 if (key)
949 break;
950 }
951 }
952 if (key)
953 rx->key = key;
954 }
955 return RX_CONTINUE;
956 } else {
957 u8 keyid;
958 /*
959 * The device doesn't give us the IV so we won't be
960 * able to look up the key. That's ok though, we
961 * don't need to decrypt the frame, we just won't
962 * be able to keep statistics accurate.
963 * Except for key threshold notifications, should
964 * we somehow allow the driver to tell us which key
965 * the hardware used if this flag is set?
966 */
967 if ((status->flag & RX_FLAG_DECRYPTED) &&
968 (status->flag & RX_FLAG_IV_STRIPPED))
969 return RX_CONTINUE;
970
971 hdrlen = ieee80211_hdrlen(fc);
972
973 if (rx->skb->len < 8 + hdrlen)
974 return RX_DROP_UNUSABLE; /* TODO: count this? */
975
976 /*
977 * no need to call ieee80211_wep_get_keyidx,
978 * it verifies a bunch of things we've done already
979 */
980 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
981 keyidx = keyid >> 6;
982
983 /* check per-station GTK first, if multicast packet */
984 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
985 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
986
987 /* if not found, try default key */
988 if (!rx->key) {
989 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
990
991 /*
992 * RSNA-protected unicast frames should always be
993 * sent with pairwise or station-to-station keys,
994 * but for WEP we allow using a key index as well.
995 */
996 if (rx->key &&
997 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
998 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
999 !is_multicast_ether_addr(hdr->addr1))
1000 rx->key = NULL;
1001 }
1002 }
1003
1004 if (rx->key) {
1005 rx->key->tx_rx_count++;
1006 /* TODO: add threshold stuff again */
1007 } else {
1008 return RX_DROP_MONITOR;
1009 }
1010
1011 if (skb_linearize(rx->skb))
1012 return RX_DROP_UNUSABLE;
1013 /* the hdr variable is invalid now! */
1014
1015 switch (rx->key->conf.cipher) {
1016 case WLAN_CIPHER_SUITE_WEP40:
1017 case WLAN_CIPHER_SUITE_WEP104:
1018 /* Check for weak IVs if possible */
1019 if (rx->sta && ieee80211_is_data(fc) &&
1020 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
1021 !(status->flag & RX_FLAG_DECRYPTED)) &&
1022 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
1023 rx->sta->wep_weak_iv_count++;
1024
1025 result = ieee80211_crypto_wep_decrypt(rx);
1026 break;
1027 case WLAN_CIPHER_SUITE_TKIP:
1028 result = ieee80211_crypto_tkip_decrypt(rx);
1029 break;
1030 case WLAN_CIPHER_SUITE_CCMP:
1031 result = ieee80211_crypto_ccmp_decrypt(rx);
1032 break;
1033 case WLAN_CIPHER_SUITE_AES_CMAC:
1034 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1035 break;
1036 default:
1037 /*
1038 * We can reach here only with HW-only algorithms
1039 * but why didn't it decrypt the frame?!
1040 */
1041 return RX_DROP_UNUSABLE;
1042 }
1043
1044 /* either the frame has been decrypted or will be dropped */
1045 status->flag |= RX_FLAG_DECRYPTED;
1046
1047 return result;
1048 }
1049
1050 static ieee80211_rx_result debug_noinline
1051 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1052 {
1053 struct ieee80211_local *local;
1054 struct ieee80211_hdr *hdr;
1055 struct sk_buff *skb;
1056
1057 local = rx->local;
1058 skb = rx->skb;
1059 hdr = (struct ieee80211_hdr *) skb->data;
1060
1061 if (!local->pspolling)
1062 return RX_CONTINUE;
1063
1064 if (!ieee80211_has_fromds(hdr->frame_control))
1065 /* this is not from AP */
1066 return RX_CONTINUE;
1067
1068 if (!ieee80211_is_data(hdr->frame_control))
1069 return RX_CONTINUE;
1070
1071 if (!ieee80211_has_moredata(hdr->frame_control)) {
1072 /* AP has no more frames buffered for us */
1073 local->pspolling = false;
1074 return RX_CONTINUE;
1075 }
1076
1077 /* more data bit is set, let's request a new frame from the AP */
1078 ieee80211_send_pspoll(local, rx->sdata);
1079
1080 return RX_CONTINUE;
1081 }
1082
1083 static void ap_sta_ps_start(struct sta_info *sta)
1084 {
1085 struct ieee80211_sub_if_data *sdata = sta->sdata;
1086 struct ieee80211_local *local = sdata->local;
1087
1088 atomic_inc(&sdata->bss->num_sta_ps);
1089 set_sta_flags(sta, WLAN_STA_PS_STA);
1090 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1091 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1092 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1093 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
1094 sdata->name, sta->sta.addr, sta->sta.aid);
1095 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1096 }
1097
1098 static void ap_sta_ps_end(struct sta_info *sta)
1099 {
1100 struct ieee80211_sub_if_data *sdata = sta->sdata;
1101
1102 atomic_dec(&sdata->bss->num_sta_ps);
1103
1104 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1105 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
1106 sdata->name, sta->sta.addr, sta->sta.aid);
1107 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1108
1109 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
1110 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1111 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
1112 sdata->name, sta->sta.addr, sta->sta.aid);
1113 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1114 return;
1115 }
1116
1117 ieee80211_sta_ps_deliver_wakeup(sta);
1118 }
1119
1120 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
1121 {
1122 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
1123 bool in_ps;
1124
1125 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
1126
1127 /* Don't let the same PS state be set twice */
1128 in_ps = test_sta_flags(sta_inf, WLAN_STA_PS_STA);
1129 if ((start && in_ps) || (!start && !in_ps))
1130 return -EINVAL;
1131
1132 if (start)
1133 ap_sta_ps_start(sta_inf);
1134 else
1135 ap_sta_ps_end(sta_inf);
1136
1137 return 0;
1138 }
1139 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1140
1141 static ieee80211_rx_result debug_noinline
1142 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1143 {
1144 struct sta_info *sta = rx->sta;
1145 struct sk_buff *skb = rx->skb;
1146 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1147 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1148
1149 if (!sta)
1150 return RX_CONTINUE;
1151
1152 /*
1153 * Update last_rx only for IBSS packets which are for the current
1154 * BSSID to avoid keeping the current IBSS network alive in cases
1155 * where other STAs start using different BSSID.
1156 */
1157 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1158 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1159 NL80211_IFTYPE_ADHOC);
1160 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
1161 sta->last_rx = jiffies;
1162 if (ieee80211_is_data(hdr->frame_control)) {
1163 sta->last_rx_rate_idx = status->rate_idx;
1164 sta->last_rx_rate_flag = status->flag;
1165 }
1166 }
1167 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1168 /*
1169 * Mesh beacons will update last_rx when if they are found to
1170 * match the current local configuration when processed.
1171 */
1172 sta->last_rx = jiffies;
1173 if (ieee80211_is_data(hdr->frame_control)) {
1174 sta->last_rx_rate_idx = status->rate_idx;
1175 sta->last_rx_rate_flag = status->flag;
1176 }
1177 }
1178
1179 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1180 return RX_CONTINUE;
1181
1182 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1183 ieee80211_sta_rx_notify(rx->sdata, hdr);
1184
1185 sta->rx_fragments++;
1186 sta->rx_bytes += rx->skb->len;
1187 sta->last_signal = status->signal;
1188 ewma_add(&sta->avg_signal, -status->signal);
1189
1190 /*
1191 * Change STA power saving mode only at the end of a frame
1192 * exchange sequence.
1193 */
1194 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
1195 !ieee80211_has_morefrags(hdr->frame_control) &&
1196 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1197 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1198 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1199 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
1200 /*
1201 * Ignore doze->wake transitions that are
1202 * indicated by non-data frames, the standard
1203 * is unclear here, but for example going to
1204 * PS mode and then scanning would cause a
1205 * doze->wake transition for the probe request,
1206 * and that is clearly undesirable.
1207 */
1208 if (ieee80211_is_data(hdr->frame_control) &&
1209 !ieee80211_has_pm(hdr->frame_control))
1210 ap_sta_ps_end(sta);
1211 } else {
1212 if (ieee80211_has_pm(hdr->frame_control))
1213 ap_sta_ps_start(sta);
1214 }
1215 }
1216
1217 /*
1218 * Drop (qos-)data::nullfunc frames silently, since they
1219 * are used only to control station power saving mode.
1220 */
1221 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1222 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1223 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1224
1225 /*
1226 * If we receive a 4-addr nullfunc frame from a STA
1227 * that was not moved to a 4-addr STA vlan yet, drop
1228 * the frame to the monitor interface, to make sure
1229 * that hostapd sees it
1230 */
1231 if (ieee80211_has_a4(hdr->frame_control) &&
1232 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1233 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1234 !rx->sdata->u.vlan.sta)))
1235 return RX_DROP_MONITOR;
1236 /*
1237 * Update counter and free packet here to avoid
1238 * counting this as a dropped packed.
1239 */
1240 sta->rx_packets++;
1241 dev_kfree_skb(rx->skb);
1242 return RX_QUEUED;
1243 }
1244
1245 return RX_CONTINUE;
1246 } /* ieee80211_rx_h_sta_process */
1247
1248 static inline struct ieee80211_fragment_entry *
1249 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1250 unsigned int frag, unsigned int seq, int rx_queue,
1251 struct sk_buff **skb)
1252 {
1253 struct ieee80211_fragment_entry *entry;
1254 int idx;
1255
1256 idx = sdata->fragment_next;
1257 entry = &sdata->fragments[sdata->fragment_next++];
1258 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1259 sdata->fragment_next = 0;
1260
1261 if (!skb_queue_empty(&entry->skb_list)) {
1262 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1263 struct ieee80211_hdr *hdr =
1264 (struct ieee80211_hdr *) entry->skb_list.next->data;
1265 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1266 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
1267 "addr1=%pM addr2=%pM\n",
1268 sdata->name, idx,
1269 jiffies - entry->first_frag_time, entry->seq,
1270 entry->last_frag, hdr->addr1, hdr->addr2);
1271 #endif
1272 __skb_queue_purge(&entry->skb_list);
1273 }
1274
1275 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1276 *skb = NULL;
1277 entry->first_frag_time = jiffies;
1278 entry->seq = seq;
1279 entry->rx_queue = rx_queue;
1280 entry->last_frag = frag;
1281 entry->ccmp = 0;
1282 entry->extra_len = 0;
1283
1284 return entry;
1285 }
1286
1287 static inline struct ieee80211_fragment_entry *
1288 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1289 unsigned int frag, unsigned int seq,
1290 int rx_queue, struct ieee80211_hdr *hdr)
1291 {
1292 struct ieee80211_fragment_entry *entry;
1293 int i, idx;
1294
1295 idx = sdata->fragment_next;
1296 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1297 struct ieee80211_hdr *f_hdr;
1298
1299 idx--;
1300 if (idx < 0)
1301 idx = IEEE80211_FRAGMENT_MAX - 1;
1302
1303 entry = &sdata->fragments[idx];
1304 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1305 entry->rx_queue != rx_queue ||
1306 entry->last_frag + 1 != frag)
1307 continue;
1308
1309 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1310
1311 /*
1312 * Check ftype and addresses are equal, else check next fragment
1313 */
1314 if (((hdr->frame_control ^ f_hdr->frame_control) &
1315 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1316 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1317 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1318 continue;
1319
1320 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1321 __skb_queue_purge(&entry->skb_list);
1322 continue;
1323 }
1324 return entry;
1325 }
1326
1327 return NULL;
1328 }
1329
1330 static ieee80211_rx_result debug_noinline
1331 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1332 {
1333 struct ieee80211_hdr *hdr;
1334 u16 sc;
1335 __le16 fc;
1336 unsigned int frag, seq;
1337 struct ieee80211_fragment_entry *entry;
1338 struct sk_buff *skb;
1339 struct ieee80211_rx_status *status;
1340
1341 hdr = (struct ieee80211_hdr *)rx->skb->data;
1342 fc = hdr->frame_control;
1343 sc = le16_to_cpu(hdr->seq_ctrl);
1344 frag = sc & IEEE80211_SCTL_FRAG;
1345
1346 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1347 (rx->skb)->len < 24 ||
1348 is_multicast_ether_addr(hdr->addr1))) {
1349 /* not fragmented */
1350 goto out;
1351 }
1352 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1353
1354 if (skb_linearize(rx->skb))
1355 return RX_DROP_UNUSABLE;
1356
1357 /*
1358 * skb_linearize() might change the skb->data and
1359 * previously cached variables (in this case, hdr) need to
1360 * be refreshed with the new data.
1361 */
1362 hdr = (struct ieee80211_hdr *)rx->skb->data;
1363 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1364
1365 if (frag == 0) {
1366 /* This is the first fragment of a new frame. */
1367 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1368 rx->queue, &(rx->skb));
1369 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1370 ieee80211_has_protected(fc)) {
1371 int queue = ieee80211_is_mgmt(fc) ?
1372 NUM_RX_DATA_QUEUES : rx->queue;
1373 /* Store CCMP PN so that we can verify that the next
1374 * fragment has a sequential PN value. */
1375 entry->ccmp = 1;
1376 memcpy(entry->last_pn,
1377 rx->key->u.ccmp.rx_pn[queue],
1378 CCMP_PN_LEN);
1379 }
1380 return RX_QUEUED;
1381 }
1382
1383 /* This is a fragment for a frame that should already be pending in
1384 * fragment cache. Add this fragment to the end of the pending entry.
1385 */
1386 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
1387 if (!entry) {
1388 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1389 return RX_DROP_MONITOR;
1390 }
1391
1392 /* Verify that MPDUs within one MSDU have sequential PN values.
1393 * (IEEE 802.11i, 8.3.3.4.5) */
1394 if (entry->ccmp) {
1395 int i;
1396 u8 pn[CCMP_PN_LEN], *rpn;
1397 int queue;
1398 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
1399 return RX_DROP_UNUSABLE;
1400 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1401 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1402 pn[i]++;
1403 if (pn[i])
1404 break;
1405 }
1406 queue = ieee80211_is_mgmt(fc) ?
1407 NUM_RX_DATA_QUEUES : rx->queue;
1408 rpn = rx->key->u.ccmp.rx_pn[queue];
1409 if (memcmp(pn, rpn, CCMP_PN_LEN))
1410 return RX_DROP_UNUSABLE;
1411 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1412 }
1413
1414 skb_pull(rx->skb, ieee80211_hdrlen(fc));
1415 __skb_queue_tail(&entry->skb_list, rx->skb);
1416 entry->last_frag = frag;
1417 entry->extra_len += rx->skb->len;
1418 if (ieee80211_has_morefrags(fc)) {
1419 rx->skb = NULL;
1420 return RX_QUEUED;
1421 }
1422
1423 rx->skb = __skb_dequeue(&entry->skb_list);
1424 if (skb_tailroom(rx->skb) < entry->extra_len) {
1425 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1426 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1427 GFP_ATOMIC))) {
1428 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1429 __skb_queue_purge(&entry->skb_list);
1430 return RX_DROP_UNUSABLE;
1431 }
1432 }
1433 while ((skb = __skb_dequeue(&entry->skb_list))) {
1434 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1435 dev_kfree_skb(skb);
1436 }
1437
1438 /* Complete frame has been reassembled - process it now */
1439 status = IEEE80211_SKB_RXCB(rx->skb);
1440 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1441
1442 out:
1443 if (rx->sta)
1444 rx->sta->rx_packets++;
1445 if (is_multicast_ether_addr(hdr->addr1))
1446 rx->local->dot11MulticastReceivedFrameCount++;
1447 else
1448 ieee80211_led_rx(rx->local);
1449 return RX_CONTINUE;
1450 }
1451
1452 static ieee80211_rx_result debug_noinline
1453 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1454 {
1455 struct ieee80211_sub_if_data *sdata = rx->sdata;
1456 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1457 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1458
1459 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1460 !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
1461 return RX_CONTINUE;
1462
1463 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1464 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1465 return RX_DROP_UNUSABLE;
1466
1467 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1468 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1469 else
1470 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1471
1472 /* Free PS Poll skb here instead of returning RX_DROP that would
1473 * count as an dropped frame. */
1474 dev_kfree_skb(rx->skb);
1475
1476 return RX_QUEUED;
1477 }
1478
1479 static ieee80211_rx_result debug_noinline
1480 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1481 {
1482 u8 *data = rx->skb->data;
1483 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1484
1485 if (!ieee80211_is_data_qos(hdr->frame_control))
1486 return RX_CONTINUE;
1487
1488 /* remove the qos control field, update frame type and meta-data */
1489 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1490 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1491 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1492 /* change frame type to non QOS */
1493 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1494
1495 return RX_CONTINUE;
1496 }
1497
1498 static int
1499 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1500 {
1501 if (unlikely(!rx->sta ||
1502 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1503 return -EACCES;
1504
1505 return 0;
1506 }
1507
1508 static int
1509 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1510 {
1511 struct sk_buff *skb = rx->skb;
1512 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1513
1514 /*
1515 * Pass through unencrypted frames if the hardware has
1516 * decrypted them already.
1517 */
1518 if (status->flag & RX_FLAG_DECRYPTED)
1519 return 0;
1520
1521 /* Drop unencrypted frames if key is set. */
1522 if (unlikely(!ieee80211_has_protected(fc) &&
1523 !ieee80211_is_nullfunc(fc) &&
1524 ieee80211_is_data(fc) &&
1525 (rx->key || rx->sdata->drop_unencrypted)))
1526 return -EACCES;
1527
1528 return 0;
1529 }
1530
1531 static int
1532 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1533 {
1534 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1535 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1536 __le16 fc = hdr->frame_control;
1537
1538 /*
1539 * Pass through unencrypted frames if the hardware has
1540 * decrypted them already.
1541 */
1542 if (status->flag & RX_FLAG_DECRYPTED)
1543 return 0;
1544
1545 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1546 if (unlikely(!ieee80211_has_protected(fc) &&
1547 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1548 rx->key)) {
1549 if (ieee80211_is_deauth(fc))
1550 cfg80211_send_unprot_deauth(rx->sdata->dev,
1551 rx->skb->data,
1552 rx->skb->len);
1553 else if (ieee80211_is_disassoc(fc))
1554 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1555 rx->skb->data,
1556 rx->skb->len);
1557 return -EACCES;
1558 }
1559 /* BIP does not use Protected field, so need to check MMIE */
1560 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1561 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1562 if (ieee80211_is_deauth(fc))
1563 cfg80211_send_unprot_deauth(rx->sdata->dev,
1564 rx->skb->data,
1565 rx->skb->len);
1566 else if (ieee80211_is_disassoc(fc))
1567 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1568 rx->skb->data,
1569 rx->skb->len);
1570 return -EACCES;
1571 }
1572 /*
1573 * When using MFP, Action frames are not allowed prior to
1574 * having configured keys.
1575 */
1576 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1577 ieee80211_is_robust_mgmt_frame(
1578 (struct ieee80211_hdr *) rx->skb->data)))
1579 return -EACCES;
1580 }
1581
1582 return 0;
1583 }
1584
1585 static int
1586 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1587 {
1588 struct ieee80211_sub_if_data *sdata = rx->sdata;
1589 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1590 bool check_port_control = false;
1591 struct ethhdr *ehdr;
1592 int ret;
1593
1594 if (ieee80211_has_a4(hdr->frame_control) &&
1595 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1596 return -1;
1597
1598 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1599 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1600
1601 if (!sdata->u.mgd.use_4addr)
1602 return -1;
1603 else
1604 check_port_control = true;
1605 }
1606
1607 if (is_multicast_ether_addr(hdr->addr1) &&
1608 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1609 return -1;
1610
1611 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1612 if (ret < 0 || !check_port_control)
1613 return ret;
1614
1615 ehdr = (struct ethhdr *) rx->skb->data;
1616 if (ehdr->h_proto != rx->sdata->control_port_protocol)
1617 return -1;
1618
1619 return 0;
1620 }
1621
1622 /*
1623 * requires that rx->skb is a frame with ethernet header
1624 */
1625 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1626 {
1627 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1628 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1629 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1630
1631 /*
1632 * Allow EAPOL frames to us/the PAE group address regardless
1633 * of whether the frame was encrypted or not.
1634 */
1635 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1636 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
1637 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1638 return true;
1639
1640 if (ieee80211_802_1x_port_control(rx) ||
1641 ieee80211_drop_unencrypted(rx, fc))
1642 return false;
1643
1644 return true;
1645 }
1646
1647 /*
1648 * requires that rx->skb is a frame with ethernet header
1649 */
1650 static void
1651 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1652 {
1653 struct ieee80211_sub_if_data *sdata = rx->sdata;
1654 struct net_device *dev = sdata->dev;
1655 struct sk_buff *skb, *xmit_skb;
1656 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1657 struct sta_info *dsta;
1658 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1659
1660 skb = rx->skb;
1661 xmit_skb = NULL;
1662
1663 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1664 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1665 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1666 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1667 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1668 if (is_multicast_ether_addr(ehdr->h_dest)) {
1669 /*
1670 * send multicast frames both to higher layers in
1671 * local net stack and back to the wireless medium
1672 */
1673 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1674 if (!xmit_skb && net_ratelimit())
1675 printk(KERN_DEBUG "%s: failed to clone "
1676 "multicast frame\n", dev->name);
1677 } else {
1678 dsta = sta_info_get(sdata, skb->data);
1679 if (dsta) {
1680 /*
1681 * The destination station is associated to
1682 * this AP (in this VLAN), so send the frame
1683 * directly to it and do not pass it to local
1684 * net stack.
1685 */
1686 xmit_skb = skb;
1687 skb = NULL;
1688 }
1689 }
1690 }
1691
1692 if (skb) {
1693 int align __maybe_unused;
1694
1695 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1696 /*
1697 * 'align' will only take the values 0 or 2 here
1698 * since all frames are required to be aligned
1699 * to 2-byte boundaries when being passed to
1700 * mac80211. That also explains the __skb_push()
1701 * below.
1702 */
1703 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
1704 if (align) {
1705 if (WARN_ON(skb_headroom(skb) < 3)) {
1706 dev_kfree_skb(skb);
1707 skb = NULL;
1708 } else {
1709 u8 *data = skb->data;
1710 size_t len = skb_headlen(skb);
1711 skb->data -= align;
1712 memmove(skb->data, data, len);
1713 skb_set_tail_pointer(skb, len);
1714 }
1715 }
1716 #endif
1717
1718 if (skb) {
1719 /* deliver to local stack */
1720 skb->protocol = eth_type_trans(skb, dev);
1721 memset(skb->cb, 0, sizeof(skb->cb));
1722 netif_receive_skb(skb);
1723 }
1724 }
1725
1726 if (xmit_skb) {
1727 /* send to wireless media */
1728 xmit_skb->protocol = htons(ETH_P_802_3);
1729 skb_reset_network_header(xmit_skb);
1730 skb_reset_mac_header(xmit_skb);
1731 dev_queue_xmit(xmit_skb);
1732 }
1733 }
1734
1735 static ieee80211_rx_result debug_noinline
1736 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1737 {
1738 struct net_device *dev = rx->sdata->dev;
1739 struct sk_buff *skb = rx->skb;
1740 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1741 __le16 fc = hdr->frame_control;
1742 struct sk_buff_head frame_list;
1743 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1744
1745 if (unlikely(!ieee80211_is_data(fc)))
1746 return RX_CONTINUE;
1747
1748 if (unlikely(!ieee80211_is_data_present(fc)))
1749 return RX_DROP_MONITOR;
1750
1751 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1752 return RX_CONTINUE;
1753
1754 if (ieee80211_has_a4(hdr->frame_control) &&
1755 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1756 !rx->sdata->u.vlan.sta)
1757 return RX_DROP_UNUSABLE;
1758
1759 if (is_multicast_ether_addr(hdr->addr1) &&
1760 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1761 rx->sdata->u.vlan.sta) ||
1762 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1763 rx->sdata->u.mgd.use_4addr)))
1764 return RX_DROP_UNUSABLE;
1765
1766 skb->dev = dev;
1767 __skb_queue_head_init(&frame_list);
1768
1769 if (skb_linearize(skb))
1770 return RX_DROP_UNUSABLE;
1771
1772 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1773 rx->sdata->vif.type,
1774 rx->local->hw.extra_tx_headroom);
1775
1776 while (!skb_queue_empty(&frame_list)) {
1777 rx->skb = __skb_dequeue(&frame_list);
1778
1779 if (!ieee80211_frame_allowed(rx, fc)) {
1780 dev_kfree_skb(rx->skb);
1781 continue;
1782 }
1783 dev->stats.rx_packets++;
1784 dev->stats.rx_bytes += rx->skb->len;
1785
1786 ieee80211_deliver_skb(rx);
1787 }
1788
1789 return RX_QUEUED;
1790 }
1791
1792 #ifdef CONFIG_MAC80211_MESH
1793 static ieee80211_rx_result
1794 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1795 {
1796 struct ieee80211_hdr *hdr;
1797 struct ieee80211s_hdr *mesh_hdr;
1798 unsigned int hdrlen;
1799 struct sk_buff *skb = rx->skb, *fwd_skb;
1800 struct ieee80211_local *local = rx->local;
1801 struct ieee80211_sub_if_data *sdata = rx->sdata;
1802 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1803
1804 hdr = (struct ieee80211_hdr *) skb->data;
1805 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1806 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1807
1808 if (!ieee80211_is_data(hdr->frame_control))
1809 return RX_CONTINUE;
1810
1811 if (!mesh_hdr->ttl)
1812 /* illegal frame */
1813 return RX_DROP_MONITOR;
1814
1815 if (mesh_hdr->flags & MESH_FLAGS_AE) {
1816 struct mesh_path *mppath;
1817 char *proxied_addr;
1818 char *mpp_addr;
1819
1820 if (is_multicast_ether_addr(hdr->addr1)) {
1821 mpp_addr = hdr->addr3;
1822 proxied_addr = mesh_hdr->eaddr1;
1823 } else {
1824 mpp_addr = hdr->addr4;
1825 proxied_addr = mesh_hdr->eaddr2;
1826 }
1827
1828 rcu_read_lock();
1829 mppath = mpp_path_lookup(proxied_addr, sdata);
1830 if (!mppath) {
1831 mpp_path_add(proxied_addr, mpp_addr, sdata);
1832 } else {
1833 spin_lock_bh(&mppath->state_lock);
1834 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1835 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
1836 spin_unlock_bh(&mppath->state_lock);
1837 }
1838 rcu_read_unlock();
1839 }
1840
1841 /* Frame has reached destination. Don't forward */
1842 if (!is_multicast_ether_addr(hdr->addr1) &&
1843 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
1844 return RX_CONTINUE;
1845
1846 mesh_hdr->ttl--;
1847
1848 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1849 if (!mesh_hdr->ttl)
1850 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1851 dropped_frames_ttl);
1852 else {
1853 struct ieee80211_hdr *fwd_hdr;
1854 struct ieee80211_tx_info *info;
1855
1856 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1857
1858 if (!fwd_skb && net_ratelimit())
1859 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1860 sdata->name);
1861 if (!fwd_skb)
1862 goto out;
1863
1864 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
1865 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
1866 info = IEEE80211_SKB_CB(fwd_skb);
1867 memset(info, 0, sizeof(*info));
1868 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1869 info->control.vif = &rx->sdata->vif;
1870 skb_set_queue_mapping(skb,
1871 ieee80211_select_queue(rx->sdata, fwd_skb));
1872 ieee80211_set_qos_hdr(local, skb);
1873 if (is_multicast_ether_addr(fwd_hdr->addr1))
1874 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1875 fwded_mcast);
1876 else {
1877 int err;
1878 /*
1879 * Save TA to addr1 to send TA a path error if a
1880 * suitable next hop is not found
1881 */
1882 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
1883 ETH_ALEN);
1884 err = mesh_nexthop_lookup(fwd_skb, sdata);
1885 /* Failed to immediately resolve next hop:
1886 * fwded frame was dropped or will be added
1887 * later to the pending skb queue. */
1888 if (err)
1889 return RX_DROP_MONITOR;
1890
1891 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1892 fwded_unicast);
1893 }
1894 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1895 fwded_frames);
1896 ieee80211_add_pending_skb(local, fwd_skb);
1897 }
1898 }
1899
1900 out:
1901 if (is_multicast_ether_addr(hdr->addr1) ||
1902 sdata->dev->flags & IFF_PROMISC)
1903 return RX_CONTINUE;
1904 else
1905 return RX_DROP_MONITOR;
1906 }
1907 #endif
1908
1909 static ieee80211_rx_result debug_noinline
1910 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1911 {
1912 struct ieee80211_sub_if_data *sdata = rx->sdata;
1913 struct ieee80211_local *local = rx->local;
1914 struct net_device *dev = sdata->dev;
1915 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1916 __le16 fc = hdr->frame_control;
1917 int err;
1918
1919 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1920 return RX_CONTINUE;
1921
1922 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1923 return RX_DROP_MONITOR;
1924
1925 /*
1926 * Allow the cooked monitor interface of an AP to see 4-addr frames so
1927 * that a 4-addr station can be detected and moved into a separate VLAN
1928 */
1929 if (ieee80211_has_a4(hdr->frame_control) &&
1930 sdata->vif.type == NL80211_IFTYPE_AP)
1931 return RX_DROP_MONITOR;
1932
1933 err = __ieee80211_data_to_8023(rx);
1934 if (unlikely(err))
1935 return RX_DROP_UNUSABLE;
1936
1937 if (!ieee80211_frame_allowed(rx, fc))
1938 return RX_DROP_MONITOR;
1939
1940 rx->skb->dev = dev;
1941
1942 dev->stats.rx_packets++;
1943 dev->stats.rx_bytes += rx->skb->len;
1944
1945 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
1946 !is_multicast_ether_addr(
1947 ((struct ethhdr *)rx->skb->data)->h_dest) &&
1948 (!local->scanning &&
1949 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
1950 mod_timer(&local->dynamic_ps_timer, jiffies +
1951 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1952 }
1953
1954 ieee80211_deliver_skb(rx);
1955
1956 return RX_QUEUED;
1957 }
1958
1959 static ieee80211_rx_result debug_noinline
1960 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1961 {
1962 struct ieee80211_local *local = rx->local;
1963 struct ieee80211_hw *hw = &local->hw;
1964 struct sk_buff *skb = rx->skb;
1965 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1966 struct tid_ampdu_rx *tid_agg_rx;
1967 u16 start_seq_num;
1968 u16 tid;
1969
1970 if (likely(!ieee80211_is_ctl(bar->frame_control)))
1971 return RX_CONTINUE;
1972
1973 if (ieee80211_is_back_req(bar->frame_control)) {
1974 struct {
1975 __le16 control, start_seq_num;
1976 } __packed bar_data;
1977
1978 if (!rx->sta)
1979 return RX_DROP_MONITOR;
1980
1981 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
1982 &bar_data, sizeof(bar_data)))
1983 return RX_DROP_MONITOR;
1984
1985 tid = le16_to_cpu(bar_data.control) >> 12;
1986
1987 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
1988 if (!tid_agg_rx)
1989 return RX_DROP_MONITOR;
1990
1991 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
1992
1993 /* reset session timer */
1994 if (tid_agg_rx->timeout)
1995 mod_timer(&tid_agg_rx->session_timer,
1996 TU_TO_EXP_TIME(tid_agg_rx->timeout));
1997
1998 spin_lock(&tid_agg_rx->reorder_lock);
1999 /* release stored frames up to start of BAR */
2000 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
2001 spin_unlock(&tid_agg_rx->reorder_lock);
2002
2003 kfree_skb(skb);
2004 return RX_QUEUED;
2005 }
2006
2007 /*
2008 * After this point, we only want management frames,
2009 * so we can drop all remaining control frames to
2010 * cooked monitor interfaces.
2011 */
2012 return RX_DROP_MONITOR;
2013 }
2014
2015 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2016 struct ieee80211_mgmt *mgmt,
2017 size_t len)
2018 {
2019 struct ieee80211_local *local = sdata->local;
2020 struct sk_buff *skb;
2021 struct ieee80211_mgmt *resp;
2022
2023 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
2024 /* Not to own unicast address */
2025 return;
2026 }
2027
2028 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
2029 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
2030 /* Not from the current AP or not associated yet. */
2031 return;
2032 }
2033
2034 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2035 /* Too short SA Query request frame */
2036 return;
2037 }
2038
2039 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2040 if (skb == NULL)
2041 return;
2042
2043 skb_reserve(skb, local->hw.extra_tx_headroom);
2044 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2045 memset(resp, 0, 24);
2046 memcpy(resp->da, mgmt->sa, ETH_ALEN);
2047 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2048 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2049 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2050 IEEE80211_STYPE_ACTION);
2051 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2052 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2053 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2054 memcpy(resp->u.action.u.sa_query.trans_id,
2055 mgmt->u.action.u.sa_query.trans_id,
2056 WLAN_SA_QUERY_TR_ID_LEN);
2057
2058 ieee80211_tx_skb(sdata, skb);
2059 }
2060
2061 static ieee80211_rx_result debug_noinline
2062 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2063 {
2064 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2065 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2066
2067 /*
2068 * From here on, look only at management frames.
2069 * Data and control frames are already handled,
2070 * and unknown (reserved) frames are useless.
2071 */
2072 if (rx->skb->len < 24)
2073 return RX_DROP_MONITOR;
2074
2075 if (!ieee80211_is_mgmt(mgmt->frame_control))
2076 return RX_DROP_MONITOR;
2077
2078 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2079 return RX_DROP_MONITOR;
2080
2081 if (ieee80211_drop_unencrypted_mgmt(rx))
2082 return RX_DROP_UNUSABLE;
2083
2084 return RX_CONTINUE;
2085 }
2086
2087 static ieee80211_rx_result debug_noinline
2088 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2089 {
2090 struct ieee80211_local *local = rx->local;
2091 struct ieee80211_sub_if_data *sdata = rx->sdata;
2092 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2093 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2094 int len = rx->skb->len;
2095
2096 if (!ieee80211_is_action(mgmt->frame_control))
2097 return RX_CONTINUE;
2098
2099 /* drop too small frames */
2100 if (len < IEEE80211_MIN_ACTION_SIZE)
2101 return RX_DROP_UNUSABLE;
2102
2103 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
2104 return RX_DROP_UNUSABLE;
2105
2106 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2107 return RX_DROP_UNUSABLE;
2108
2109 switch (mgmt->u.action.category) {
2110 case WLAN_CATEGORY_BACK:
2111 /*
2112 * The aggregation code is not prepared to handle
2113 * anything but STA/AP due to the BSSID handling;
2114 * IBSS could work in the code but isn't supported
2115 * by drivers or the standard.
2116 */
2117 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2118 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2119 sdata->vif.type != NL80211_IFTYPE_AP)
2120 break;
2121
2122 /* verify action_code is present */
2123 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2124 break;
2125
2126 switch (mgmt->u.action.u.addba_req.action_code) {
2127 case WLAN_ACTION_ADDBA_REQ:
2128 if (len < (IEEE80211_MIN_ACTION_SIZE +
2129 sizeof(mgmt->u.action.u.addba_req)))
2130 goto invalid;
2131 break;
2132 case WLAN_ACTION_ADDBA_RESP:
2133 if (len < (IEEE80211_MIN_ACTION_SIZE +
2134 sizeof(mgmt->u.action.u.addba_resp)))
2135 goto invalid;
2136 break;
2137 case WLAN_ACTION_DELBA:
2138 if (len < (IEEE80211_MIN_ACTION_SIZE +
2139 sizeof(mgmt->u.action.u.delba)))
2140 goto invalid;
2141 break;
2142 default:
2143 goto invalid;
2144 }
2145
2146 goto queue;
2147 case WLAN_CATEGORY_SPECTRUM_MGMT:
2148 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2149 break;
2150
2151 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2152 break;
2153
2154 /* verify action_code is present */
2155 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2156 break;
2157
2158 switch (mgmt->u.action.u.measurement.action_code) {
2159 case WLAN_ACTION_SPCT_MSR_REQ:
2160 if (len < (IEEE80211_MIN_ACTION_SIZE +
2161 sizeof(mgmt->u.action.u.measurement)))
2162 break;
2163 ieee80211_process_measurement_req(sdata, mgmt, len);
2164 goto handled;
2165 case WLAN_ACTION_SPCT_CHL_SWITCH:
2166 if (len < (IEEE80211_MIN_ACTION_SIZE +
2167 sizeof(mgmt->u.action.u.chan_switch)))
2168 break;
2169
2170 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2171 break;
2172
2173 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
2174 break;
2175
2176 goto queue;
2177 }
2178 break;
2179 case WLAN_CATEGORY_SA_QUERY:
2180 if (len < (IEEE80211_MIN_ACTION_SIZE +
2181 sizeof(mgmt->u.action.u.sa_query)))
2182 break;
2183
2184 switch (mgmt->u.action.u.sa_query.action) {
2185 case WLAN_ACTION_SA_QUERY_REQUEST:
2186 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2187 break;
2188 ieee80211_process_sa_query_req(sdata, mgmt, len);
2189 goto handled;
2190 }
2191 break;
2192 case WLAN_CATEGORY_MESH_PLINK:
2193 if (!ieee80211_vif_is_mesh(&sdata->vif))
2194 break;
2195 goto queue;
2196 case WLAN_CATEGORY_MESH_PATH_SEL:
2197 if (!mesh_path_sel_is_hwmp(sdata))
2198 break;
2199 goto queue;
2200 }
2201
2202 return RX_CONTINUE;
2203
2204 invalid:
2205 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2206 /* will return in the next handlers */
2207 return RX_CONTINUE;
2208
2209 handled:
2210 if (rx->sta)
2211 rx->sta->rx_packets++;
2212 dev_kfree_skb(rx->skb);
2213 return RX_QUEUED;
2214
2215 queue:
2216 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2217 skb_queue_tail(&sdata->skb_queue, rx->skb);
2218 ieee80211_queue_work(&local->hw, &sdata->work);
2219 if (rx->sta)
2220 rx->sta->rx_packets++;
2221 return RX_QUEUED;
2222 }
2223
2224 static ieee80211_rx_result debug_noinline
2225 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2226 {
2227 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2228
2229 /* skip known-bad action frames and return them in the next handler */
2230 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2231 return RX_CONTINUE;
2232
2233 /*
2234 * Getting here means the kernel doesn't know how to handle
2235 * it, but maybe userspace does ... include returned frames
2236 * so userspace can register for those to know whether ones
2237 * it transmitted were processed or returned.
2238 */
2239
2240 if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
2241 rx->skb->data, rx->skb->len,
2242 GFP_ATOMIC)) {
2243 if (rx->sta)
2244 rx->sta->rx_packets++;
2245 dev_kfree_skb(rx->skb);
2246 return RX_QUEUED;
2247 }
2248
2249
2250 return RX_CONTINUE;
2251 }
2252
2253 static ieee80211_rx_result debug_noinline
2254 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2255 {
2256 struct ieee80211_local *local = rx->local;
2257 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2258 struct sk_buff *nskb;
2259 struct ieee80211_sub_if_data *sdata = rx->sdata;
2260 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2261
2262 if (!ieee80211_is_action(mgmt->frame_control))
2263 return RX_CONTINUE;
2264
2265 /*
2266 * For AP mode, hostapd is responsible for handling any action
2267 * frames that we didn't handle, including returning unknown
2268 * ones. For all other modes we will return them to the sender,
2269 * setting the 0x80 bit in the action category, as required by
2270 * 802.11-2007 7.3.1.11.
2271 * Newer versions of hostapd shall also use the management frame
2272 * registration mechanisms, but older ones still use cooked
2273 * monitor interfaces so push all frames there.
2274 */
2275 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2276 (sdata->vif.type == NL80211_IFTYPE_AP ||
2277 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2278 return RX_DROP_MONITOR;
2279
2280 /* do not return rejected action frames */
2281 if (mgmt->u.action.category & 0x80)
2282 return RX_DROP_UNUSABLE;
2283
2284 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2285 GFP_ATOMIC);
2286 if (nskb) {
2287 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2288
2289 nmgmt->u.action.category |= 0x80;
2290 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2291 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2292
2293 memset(nskb->cb, 0, sizeof(nskb->cb));
2294
2295 ieee80211_tx_skb(rx->sdata, nskb);
2296 }
2297 dev_kfree_skb(rx->skb);
2298 return RX_QUEUED;
2299 }
2300
2301 static ieee80211_rx_result debug_noinline
2302 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2303 {
2304 struct ieee80211_sub_if_data *sdata = rx->sdata;
2305 ieee80211_rx_result rxs;
2306 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2307 __le16 stype;
2308
2309 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2310 if (rxs != RX_CONTINUE)
2311 return rxs;
2312
2313 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2314
2315 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2316 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2317 sdata->vif.type != NL80211_IFTYPE_STATION)
2318 return RX_DROP_MONITOR;
2319
2320 switch (stype) {
2321 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2322 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2323 /* process for all: mesh, mlme, ibss */
2324 break;
2325 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2326 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2327 if (is_multicast_ether_addr(mgmt->da) &&
2328 !is_broadcast_ether_addr(mgmt->da))
2329 return RX_DROP_MONITOR;
2330
2331 /* process only for station */
2332 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2333 return RX_DROP_MONITOR;
2334 break;
2335 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2336 case cpu_to_le16(IEEE80211_STYPE_AUTH):
2337 /* process only for ibss */
2338 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
2339 return RX_DROP_MONITOR;
2340 break;
2341 default:
2342 return RX_DROP_MONITOR;
2343 }
2344
2345 /* queue up frame and kick off work to process it */
2346 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2347 skb_queue_tail(&sdata->skb_queue, rx->skb);
2348 ieee80211_queue_work(&rx->local->hw, &sdata->work);
2349 if (rx->sta)
2350 rx->sta->rx_packets++;
2351
2352 return RX_QUEUED;
2353 }
2354
2355 static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
2356 struct ieee80211_rx_data *rx)
2357 {
2358 int keyidx;
2359 unsigned int hdrlen;
2360
2361 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2362 if (rx->skb->len >= hdrlen + 4)
2363 keyidx = rx->skb->data[hdrlen + 3] >> 6;
2364 else
2365 keyidx = -1;
2366
2367 if (!rx->sta) {
2368 /*
2369 * Some hardware seem to generate incorrect Michael MIC
2370 * reports; ignore them to avoid triggering countermeasures.
2371 */
2372 return;
2373 }
2374
2375 if (!ieee80211_has_protected(hdr->frame_control))
2376 return;
2377
2378 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
2379 /*
2380 * APs with pairwise keys should never receive Michael MIC
2381 * errors for non-zero keyidx because these are reserved for
2382 * group keys and only the AP is sending real multicast
2383 * frames in the BSS.
2384 */
2385 return;
2386 }
2387
2388 if (!ieee80211_is_data(hdr->frame_control) &&
2389 !ieee80211_is_auth(hdr->frame_control))
2390 return;
2391
2392 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2393 GFP_ATOMIC);
2394 }
2395
2396 /* TODO: use IEEE80211_RX_FRAGMENTED */
2397 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2398 struct ieee80211_rate *rate)
2399 {
2400 struct ieee80211_sub_if_data *sdata;
2401 struct ieee80211_local *local = rx->local;
2402 struct ieee80211_rtap_hdr {
2403 struct ieee80211_radiotap_header hdr;
2404 u8 flags;
2405 u8 rate_or_pad;
2406 __le16 chan_freq;
2407 __le16 chan_flags;
2408 } __packed *rthdr;
2409 struct sk_buff *skb = rx->skb, *skb2;
2410 struct net_device *prev_dev = NULL;
2411 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2412
2413 /*
2414 * If cooked monitor has been processed already, then
2415 * don't do it again. If not, set the flag.
2416 */
2417 if (rx->flags & IEEE80211_RX_CMNTR)
2418 goto out_free_skb;
2419 rx->flags |= IEEE80211_RX_CMNTR;
2420
2421 if (skb_headroom(skb) < sizeof(*rthdr) &&
2422 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2423 goto out_free_skb;
2424
2425 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2426 memset(rthdr, 0, sizeof(*rthdr));
2427 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2428 rthdr->hdr.it_present =
2429 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
2430 (1 << IEEE80211_RADIOTAP_CHANNEL));
2431
2432 if (rate) {
2433 rthdr->rate_or_pad = rate->bitrate / 5;
2434 rthdr->hdr.it_present |=
2435 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2436 }
2437 rthdr->chan_freq = cpu_to_le16(status->freq);
2438
2439 if (status->band == IEEE80211_BAND_5GHZ)
2440 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2441 IEEE80211_CHAN_5GHZ);
2442 else
2443 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2444 IEEE80211_CHAN_2GHZ);
2445
2446 skb_set_mac_header(skb, 0);
2447 skb->ip_summed = CHECKSUM_UNNECESSARY;
2448 skb->pkt_type = PACKET_OTHERHOST;
2449 skb->protocol = htons(ETH_P_802_2);
2450
2451 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2452 if (!ieee80211_sdata_running(sdata))
2453 continue;
2454
2455 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2456 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2457 continue;
2458
2459 if (prev_dev) {
2460 skb2 = skb_clone(skb, GFP_ATOMIC);
2461 if (skb2) {
2462 skb2->dev = prev_dev;
2463 netif_receive_skb(skb2);
2464 }
2465 }
2466
2467 prev_dev = sdata->dev;
2468 sdata->dev->stats.rx_packets++;
2469 sdata->dev->stats.rx_bytes += skb->len;
2470 }
2471
2472 if (prev_dev) {
2473 skb->dev = prev_dev;
2474 netif_receive_skb(skb);
2475 return;
2476 }
2477
2478 out_free_skb:
2479 dev_kfree_skb(skb);
2480 }
2481
2482 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2483 ieee80211_rx_result res)
2484 {
2485 switch (res) {
2486 case RX_DROP_MONITOR:
2487 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2488 if (rx->sta)
2489 rx->sta->rx_dropped++;
2490 /* fall through */
2491 case RX_CONTINUE: {
2492 struct ieee80211_rate *rate = NULL;
2493 struct ieee80211_supported_band *sband;
2494 struct ieee80211_rx_status *status;
2495
2496 status = IEEE80211_SKB_RXCB((rx->skb));
2497
2498 sband = rx->local->hw.wiphy->bands[status->band];
2499 if (!(status->flag & RX_FLAG_HT))
2500 rate = &sband->bitrates[status->rate_idx];
2501
2502 ieee80211_rx_cooked_monitor(rx, rate);
2503 break;
2504 }
2505 case RX_DROP_UNUSABLE:
2506 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2507 if (rx->sta)
2508 rx->sta->rx_dropped++;
2509 dev_kfree_skb(rx->skb);
2510 break;
2511 case RX_QUEUED:
2512 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2513 break;
2514 }
2515 }
2516
2517 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
2518 {
2519 ieee80211_rx_result res = RX_DROP_MONITOR;
2520 struct sk_buff *skb;
2521
2522 #define CALL_RXH(rxh) \
2523 do { \
2524 res = rxh(rx); \
2525 if (res != RX_CONTINUE) \
2526 goto rxh_next; \
2527 } while (0);
2528
2529 spin_lock(&rx->local->rx_skb_queue.lock);
2530 if (rx->local->running_rx_handler)
2531 goto unlock;
2532
2533 rx->local->running_rx_handler = true;
2534
2535 while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
2536 spin_unlock(&rx->local->rx_skb_queue.lock);
2537
2538 /*
2539 * all the other fields are valid across frames
2540 * that belong to an aMPDU since they are on the
2541 * same TID from the same station
2542 */
2543 rx->skb = skb;
2544
2545 CALL_RXH(ieee80211_rx_h_decrypt)
2546 CALL_RXH(ieee80211_rx_h_check_more_data)
2547 CALL_RXH(ieee80211_rx_h_sta_process)
2548 CALL_RXH(ieee80211_rx_h_defragment)
2549 CALL_RXH(ieee80211_rx_h_ps_poll)
2550 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2551 /* must be after MMIC verify so header is counted in MPDU mic */
2552 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2553 CALL_RXH(ieee80211_rx_h_amsdu)
2554 #ifdef CONFIG_MAC80211_MESH
2555 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2556 CALL_RXH(ieee80211_rx_h_mesh_fwding);
2557 #endif
2558 CALL_RXH(ieee80211_rx_h_data)
2559 CALL_RXH(ieee80211_rx_h_ctrl);
2560 CALL_RXH(ieee80211_rx_h_mgmt_check)
2561 CALL_RXH(ieee80211_rx_h_action)
2562 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2563 CALL_RXH(ieee80211_rx_h_action_return)
2564 CALL_RXH(ieee80211_rx_h_mgmt)
2565
2566 rxh_next:
2567 ieee80211_rx_handlers_result(rx, res);
2568 spin_lock(&rx->local->rx_skb_queue.lock);
2569 #undef CALL_RXH
2570 }
2571
2572 rx->local->running_rx_handler = false;
2573
2574 unlock:
2575 spin_unlock(&rx->local->rx_skb_queue.lock);
2576 }
2577
2578 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2579 {
2580 ieee80211_rx_result res = RX_DROP_MONITOR;
2581
2582 #define CALL_RXH(rxh) \
2583 do { \
2584 res = rxh(rx); \
2585 if (res != RX_CONTINUE) \
2586 goto rxh_next; \
2587 } while (0);
2588
2589 CALL_RXH(ieee80211_rx_h_passive_scan)
2590 CALL_RXH(ieee80211_rx_h_check)
2591
2592 ieee80211_rx_reorder_ampdu(rx);
2593
2594 ieee80211_rx_handlers(rx);
2595 return;
2596
2597 rxh_next:
2598 ieee80211_rx_handlers_result(rx, res);
2599
2600 #undef CALL_RXH
2601 }
2602
2603 /*
2604 * This function makes calls into the RX path, therefore
2605 * it has to be invoked under RCU read lock.
2606 */
2607 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2608 {
2609 struct ieee80211_rx_data rx = {
2610 .sta = sta,
2611 .sdata = sta->sdata,
2612 .local = sta->local,
2613 .queue = tid,
2614 .flags = 0,
2615 };
2616 struct tid_ampdu_rx *tid_agg_rx;
2617
2618 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2619 if (!tid_agg_rx)
2620 return;
2621
2622 spin_lock(&tid_agg_rx->reorder_lock);
2623 ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
2624 spin_unlock(&tid_agg_rx->reorder_lock);
2625
2626 ieee80211_rx_handlers(&rx);
2627 }
2628
2629 /* main receive path */
2630
2631 static int prepare_for_handlers(struct ieee80211_rx_data *rx,
2632 struct ieee80211_hdr *hdr)
2633 {
2634 struct ieee80211_sub_if_data *sdata = rx->sdata;
2635 struct sk_buff *skb = rx->skb;
2636 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2637 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
2638 int multicast = is_multicast_ether_addr(hdr->addr1);
2639
2640 switch (sdata->vif.type) {
2641 case NL80211_IFTYPE_STATION:
2642 if (!bssid && !sdata->u.mgd.use_4addr)
2643 return 0;
2644 if (!multicast &&
2645 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
2646 if (!(sdata->dev->flags & IFF_PROMISC) ||
2647 sdata->u.mgd.use_4addr)
2648 return 0;
2649 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2650 }
2651 break;
2652 case NL80211_IFTYPE_ADHOC:
2653 if (!bssid)
2654 return 0;
2655 if (ieee80211_is_beacon(hdr->frame_control)) {
2656 return 1;
2657 }
2658 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2659 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2660 return 0;
2661 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2662 } else if (!multicast &&
2663 compare_ether_addr(sdata->vif.addr,
2664 hdr->addr1) != 0) {
2665 if (!(sdata->dev->flags & IFF_PROMISC))
2666 return 0;
2667 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2668 } else if (!rx->sta) {
2669 int rate_idx;
2670 if (status->flag & RX_FLAG_HT)
2671 rate_idx = 0; /* TODO: HT rates */
2672 else
2673 rate_idx = status->rate_idx;
2674 rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
2675 hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
2676 }
2677 break;
2678 case NL80211_IFTYPE_MESH_POINT:
2679 if (!multicast &&
2680 compare_ether_addr(sdata->vif.addr,
2681 hdr->addr1) != 0) {
2682 if (!(sdata->dev->flags & IFF_PROMISC))
2683 return 0;
2684
2685 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2686 }
2687 break;
2688 case NL80211_IFTYPE_AP_VLAN:
2689 case NL80211_IFTYPE_AP:
2690 if (!bssid) {
2691 if (compare_ether_addr(sdata->vif.addr,
2692 hdr->addr1))
2693 return 0;
2694 } else if (!ieee80211_bssid_match(bssid,
2695 sdata->vif.addr)) {
2696 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
2697 !ieee80211_is_beacon(hdr->frame_control))
2698 return 0;
2699 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2700 }
2701 break;
2702 case NL80211_IFTYPE_WDS:
2703 if (bssid || !ieee80211_is_data(hdr->frame_control))
2704 return 0;
2705 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2706 return 0;
2707 break;
2708 default:
2709 /* should never get here */
2710 WARN_ON(1);
2711 break;
2712 }
2713
2714 return 1;
2715 }
2716
2717 /*
2718 * This function returns whether or not the SKB
2719 * was destined for RX processing or not, which,
2720 * if consume is true, is equivalent to whether
2721 * or not the skb was consumed.
2722 */
2723 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2724 struct sk_buff *skb, bool consume)
2725 {
2726 struct ieee80211_local *local = rx->local;
2727 struct ieee80211_sub_if_data *sdata = rx->sdata;
2728 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2729 struct ieee80211_hdr *hdr = (void *)skb->data;
2730 int prepares;
2731
2732 rx->skb = skb;
2733 status->rx_flags |= IEEE80211_RX_RA_MATCH;
2734 prepares = prepare_for_handlers(rx, hdr);
2735
2736 if (!prepares)
2737 return false;
2738
2739 if (status->flag & RX_FLAG_MMIC_ERROR) {
2740 if (status->rx_flags & IEEE80211_RX_RA_MATCH)
2741 ieee80211_rx_michael_mic_report(hdr, rx);
2742 return false;
2743 }
2744
2745 if (!consume) {
2746 skb = skb_copy(skb, GFP_ATOMIC);
2747 if (!skb) {
2748 if (net_ratelimit())
2749 wiphy_debug(local->hw.wiphy,
2750 "failed to copy skb for %s\n",
2751 sdata->name);
2752 return true;
2753 }
2754
2755 rx->skb = skb;
2756 }
2757
2758 ieee80211_invoke_rx_handlers(rx);
2759 return true;
2760 }
2761
2762 /*
2763 * This is the actual Rx frames handler. as it blongs to Rx path it must
2764 * be called with rcu_read_lock protection.
2765 */
2766 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2767 struct sk_buff *skb)
2768 {
2769 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2770 struct ieee80211_local *local = hw_to_local(hw);
2771 struct ieee80211_sub_if_data *sdata;
2772 struct ieee80211_hdr *hdr;
2773 __le16 fc;
2774 struct ieee80211_rx_data rx;
2775 struct ieee80211_sub_if_data *prev;
2776 struct sta_info *sta, *tmp, *prev_sta;
2777 int err = 0;
2778
2779 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
2780 memset(&rx, 0, sizeof(rx));
2781 rx.skb = skb;
2782 rx.local = local;
2783
2784 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
2785 local->dot11ReceivedFragmentCount++;
2786
2787 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2788 test_bit(SCAN_SW_SCANNING, &local->scanning)))
2789 status->rx_flags |= IEEE80211_RX_IN_SCAN;
2790
2791 if (ieee80211_is_mgmt(fc))
2792 err = skb_linearize(skb);
2793 else
2794 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
2795
2796 if (err) {
2797 dev_kfree_skb(skb);
2798 return;
2799 }
2800
2801 hdr = (struct ieee80211_hdr *)skb->data;
2802 ieee80211_parse_qos(&rx);
2803 ieee80211_verify_alignment(&rx);
2804
2805 if (ieee80211_is_data(fc)) {
2806 prev_sta = NULL;
2807
2808 for_each_sta_info(local, hdr->addr2, sta, tmp) {
2809 if (!prev_sta) {
2810 prev_sta = sta;
2811 continue;
2812 }
2813
2814 rx.sta = prev_sta;
2815 rx.sdata = prev_sta->sdata;
2816 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2817
2818 prev_sta = sta;
2819 }
2820
2821 if (prev_sta) {
2822 rx.sta = prev_sta;
2823 rx.sdata = prev_sta->sdata;
2824
2825 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2826 return;
2827 goto out;
2828 }
2829 }
2830
2831 prev = NULL;
2832
2833 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2834 if (!ieee80211_sdata_running(sdata))
2835 continue;
2836
2837 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2838 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2839 continue;
2840
2841 /*
2842 * frame is destined for this interface, but if it's
2843 * not also for the previous one we handle that after
2844 * the loop to avoid copying the SKB once too much
2845 */
2846
2847 if (!prev) {
2848 prev = sdata;
2849 continue;
2850 }
2851
2852 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2853 rx.sdata = prev;
2854 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2855
2856 prev = sdata;
2857 }
2858
2859 if (prev) {
2860 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2861 rx.sdata = prev;
2862
2863 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2864 return;
2865 }
2866
2867 out:
2868 dev_kfree_skb(skb);
2869 }
2870
2871 /*
2872 * This is the receive path handler. It is called by a low level driver when an
2873 * 802.11 MPDU is received from the hardware.
2874 */
2875 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
2876 {
2877 struct ieee80211_local *local = hw_to_local(hw);
2878 struct ieee80211_rate *rate = NULL;
2879 struct ieee80211_supported_band *sband;
2880 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2881
2882 WARN_ON_ONCE(softirq_count() == 0);
2883
2884 if (WARN_ON(status->band < 0 ||
2885 status->band >= IEEE80211_NUM_BANDS))
2886 goto drop;
2887
2888 sband = local->hw.wiphy->bands[status->band];
2889 if (WARN_ON(!sband))
2890 goto drop;
2891
2892 /*
2893 * If we're suspending, it is possible although not too likely
2894 * that we'd be receiving frames after having already partially
2895 * quiesced the stack. We can't process such frames then since
2896 * that might, for example, cause stations to be added or other
2897 * driver callbacks be invoked.
2898 */
2899 if (unlikely(local->quiescing || local->suspended))
2900 goto drop;
2901
2902 /*
2903 * The same happens when we're not even started,
2904 * but that's worth a warning.
2905 */
2906 if (WARN_ON(!local->started))
2907 goto drop;
2908
2909 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
2910 /*
2911 * Validate the rate, unless a PLCP error means that
2912 * we probably can't have a valid rate here anyway.
2913 */
2914
2915 if (status->flag & RX_FLAG_HT) {
2916 /*
2917 * rate_idx is MCS index, which can be [0-76]
2918 * as documented on:
2919 *
2920 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2921 *
2922 * Anything else would be some sort of driver or
2923 * hardware error. The driver should catch hardware
2924 * errors.
2925 */
2926 if (WARN((status->rate_idx < 0 ||
2927 status->rate_idx > 76),
2928 "Rate marked as an HT rate but passed "
2929 "status->rate_idx is not "
2930 "an MCS index [0-76]: %d (0x%02x)\n",
2931 status->rate_idx,
2932 status->rate_idx))
2933 goto drop;
2934 } else {
2935 if (WARN_ON(status->rate_idx < 0 ||
2936 status->rate_idx >= sband->n_bitrates))
2937 goto drop;
2938 rate = &sband->bitrates[status->rate_idx];
2939 }
2940 }
2941
2942 status->rx_flags = 0;
2943
2944 /*
2945 * key references and virtual interfaces are protected using RCU
2946 * and this requires that we are in a read-side RCU section during
2947 * receive processing
2948 */
2949 rcu_read_lock();
2950
2951 /*
2952 * Frames with failed FCS/PLCP checksum are not returned,
2953 * all other frames are returned without radiotap header
2954 * if it was previously present.
2955 * Also, frames with less than 16 bytes are dropped.
2956 */
2957 skb = ieee80211_rx_monitor(local, skb, rate);
2958 if (!skb) {
2959 rcu_read_unlock();
2960 return;
2961 }
2962
2963 ieee80211_tpt_led_trig_rx(local,
2964 ((struct ieee80211_hdr *)skb->data)->frame_control,
2965 skb->len);
2966 __ieee80211_rx_handle_packet(hw, skb);
2967
2968 rcu_read_unlock();
2969
2970 return;
2971 drop:
2972 kfree_skb(skb);
2973 }
2974 EXPORT_SYMBOL(ieee80211_rx);
2975
2976 /* This is a version of the rx handler that can be called from hard irq
2977 * context. Post the skb on the queue and schedule the tasklet */
2978 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
2979 {
2980 struct ieee80211_local *local = hw_to_local(hw);
2981
2982 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2983
2984 skb->pkt_type = IEEE80211_RX_MSG;
2985 skb_queue_tail(&local->skb_queue, skb);
2986 tasklet_schedule(&local->tasklet);
2987 }
2988 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Linux 2.6 ibm-acpi/thinkpad-acpi driver git tree