rx.c 70.2 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

12
#include <linux/jiffies.h>
13 14 15 16
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
17
#include <linux/rcupdate.h>
18 19 20 21
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>

#include "ieee80211_i.h"
22
#include "driver-ops.h"
J
Johannes Berg 已提交
23
#include "led.h"
24
#include "mesh.h"
25 26 27 28 29
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"

J
Johannes Berg 已提交
30 31 32
static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
					   struct tid_ampdu_rx *tid_agg_rx,
					   struct sk_buff *skb,
33
					   struct ieee80211_rx_status *status,
J
Johannes Berg 已提交
34 35
					   u16 mpdu_seq_num,
					   int bar_req);
36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
					   struct sk_buff *skb,
					   int rtap_len)
{
	skb_pull(skb, rtap_len);

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
			skb_trim(skb, skb->len - FCS_LEN);
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
			skb = NULL;
		}
	}

	return skb;
}

static inline int should_drop_frame(struct ieee80211_rx_status *status,
				    struct sk_buff *skb,
				    int present_fcs_len,
				    int radiotap_len)
{
67
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
68 69 70 71 72

	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		return 1;
	if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
		return 1;
H
Harvey Harrison 已提交
73 74 75
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
76 77 78 79
		return 1;
	return 0;
}

80 81 82 83 84 85 86 87 88 89 90
static int
ieee80211_rx_radiotap_len(struct ieee80211_local *local,
			  struct ieee80211_rx_status *status)
{
	int len;

	/* always present fields */
	len = sizeof(struct ieee80211_radiotap_header) + 9;

	if (status->flag & RX_FLAG_TSFT)
		len += 8;
J
Johannes Berg 已提交
91
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
92 93 94 95 96 97 98 99 100 101 102 103 104 105
		len += 1;
	if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
		len += 1;

	if (len & 1) /* padding for RX_FLAGS if necessary */
		len++;

	/* make sure radiotap starts at a naturally aligned address */
	if (len % 8)
		len = roundup(len, 8);

	return len;
}

106
/*
107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rx_status *status,
				 struct ieee80211_rate *rate,
				 int rtap_len)
{
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
	memset(rthdr, 0, rtap_len);

	/* radiotap header, set always present flags */
	rthdr->it_present =
		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
			    (1 << IEEE80211_RADIOTAP_CHANNEL) |
			    (1 << IEEE80211_RADIOTAP_ANTENNA) |
			    (1 << IEEE80211_RADIOTAP_RX_FLAGS));
	rthdr->it_len = cpu_to_le16(rtap_len);

	pos = (unsigned char *)(rthdr+1);

	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
	if (status->flag & RX_FLAG_TSFT) {
		*(__le64 *)pos = cpu_to_le64(status->mactime);
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
147 148
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
149 150
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
151 152 153
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
154 155 156 157 158 159 160 161 162
	if (status->flag & RX_FLAG_HT) {
		/*
		 * TODO: add following information into radiotap header once
		 * suitable fields are defined for it:
		 * - MCS index (status->rate_idx)
		 * - HT40 (status->flag & RX_FLAG_40MHZ)
		 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
		 */
		*pos = 0;
163
	} else {
164
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
165
		*pos = rate->bitrate / 5;
166
	}
167 168 169 170 171 172 173 174
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
	*(__le16 *)pos = cpu_to_le16(status->freq);
	pos += 2;
	if (status->band == IEEE80211_BAND_5GHZ)
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
					     IEEE80211_CHAN_5GHZ);
175 176 177
	else if (rate->flags & IEEE80211_RATE_ERP_G)
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
					     IEEE80211_CHAN_2GHZ);
178
	else
179
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210
					     IEEE80211_CHAN_2GHZ);
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_DBM_ANTNOISE */
	if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
		*pos = status->noise;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

	/* IEEE80211_RADIOTAP_ANTENNA */
	*pos = status->antenna;
	pos++;

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
	if ((pos - (unsigned char *)rthdr) & 1)
		pos++;
J
Johannes Berg 已提交
211 212
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
		*(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADPLCP);
213 214 215
	pos += 2;
}

216 217 218 219 220 221 222
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
223 224
		     struct ieee80211_rx_status *status,
		     struct ieee80211_rate *rate)
225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243
{
	struct ieee80211_sub_if_data *sdata;
	int needed_headroom = 0;
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;
	int rtap_len = 0;

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
	if (status->flag & RX_FLAG_RADIOTAP)
		rtap_len = ieee80211_get_radiotap_len(origskb->data);
	else
244 245
		/* room for the radiotap header based on driver features */
		needed_headroom = ieee80211_rx_radiotap_len(local, status);
246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

	if (!local->monitors) {
		if (should_drop_frame(status, origskb, present_fcs_len,
				      rtap_len)) {
			dev_kfree_skb(origskb);
			return NULL;
		}

		return remove_monitor_info(local, origskb, rtap_len);
	}

	if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
273
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

		origskb = remove_monitor_info(local, origskb, rtap_len);

		if (!skb)
			return origskb;
	}

	/* if necessary, prepend radiotap information */
291 292 293
	if (!(status->flag & RX_FLAG_RADIOTAP))
		ieee80211_add_rx_radiotap_header(local, skb, status, rate,
						 needed_headroom);
294

295
	skb_reset_mac_header(skb);
296 297 298 299 300 301 302 303
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!netif_running(sdata->dev))
			continue;

304
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
305 306
			continue;

307 308 309
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
				netif_rx(skb2);
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
		netif_rx(skb);
	} else
		dev_kfree_skb(skb);

	return origskb;
}


333
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
334
{
335
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
336 337 338
	int tid;

	/* does the frame have a qos control field? */
339 340
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
341
		/* frame has qos control */
342 343
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
		if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
344
			rx->flags |= IEEE80211_RX_AMSDU;
345
		else
346
			rx->flags &= ~IEEE80211_RX_AMSDU;
347
	} else {
348 349 350 351 352 353 354 355 356 357 358 359
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
		tid = NUM_RX_DATA_QUEUES - 1;
360
	}
361

362
	rx->queue = tid;
363 364 365
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
366
}
367

368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
 * in front of it).
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
392
{
393
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
394 395
	int hdrlen;

396 397 398 399 400 401 402 403
#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
	return;
#endif

	if (WARN_ONCE((unsigned long)rx->skb->data & 1,
		      "unaligned packet at 0x%p\n", rx->skb->data))
		return;

404
	if (!ieee80211_is_data_present(hdr->frame_control))
405 406
		return;

407
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
408
	if (rx->flags & IEEE80211_RX_AMSDU)
409
		hdrlen += ETH_HLEN;
410 411
	WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
		  "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
412 413
}

414

415 416
/* rx handlers */

417
static ieee80211_rx_result debug_noinline
418
ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
419 420 421 422
{
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb;

423 424
	if (unlikely(local->hw_scanning))
		return ieee80211_scan_rx(rx->sdata, skb, rx->status);
Z
Zhu Yi 已提交
425

426
	if (unlikely(local->sw_scanning)) {
Z
Zhu Yi 已提交
427
		/* drop all the other packets during a software scan anyway */
428
		if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
429
		    != RX_QUEUED)
Z
Zhu Yi 已提交
430
			dev_kfree_skb(skb);
431
		return RX_QUEUED;
432 433
	}

434
	if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
435 436
		/* scanning finished during invoking of handlers */
		I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
J
Johannes Berg 已提交
437
		return RX_DROP_UNUSABLE;
438 439
	}

440
	return RX_CONTINUE;
441 442
}

443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488

static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

	if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
		return 0;

	return ieee80211_is_robust_mgmt_frame(hdr);
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

	if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
		return 0;

	return ieee80211_is_robust_mgmt_frame(hdr);
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;

	if (skb->len < 24 + sizeof(*mmie) ||
	    !is_multicast_ether_addr(hdr->da))
		return -1;

	if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
	if (mmie->element_id != WLAN_EID_MMIE ||
	    mmie->length != sizeof(*mmie) - 2)
		return -1;

	return le16_to_cpu(mmie->key_id);
}


489
static ieee80211_rx_result
490
ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
491
{
492 493
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
494

495 496
	if (ieee80211_is_data(hdr->frame_control)) {
		if (!ieee80211_has_a4(hdr->frame_control))
497 498 499 500 501 502 503 504 505
			return RX_DROP_MONITOR;
		if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
			return RX_DROP_MONITOR;
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

506
	if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
507
		struct ieee80211_mgmt *mgmt;
508

509
		if (!ieee80211_is_mgmt(hdr->frame_control))
510 511
			return RX_DROP_MONITOR;

512
		if (ieee80211_is_action(hdr->frame_control)) {
513 514 515 516 517 518
			mgmt = (struct ieee80211_mgmt *)hdr;
			if (mgmt->u.action.category != PLINK_CATEGORY)
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

519 520 521 522 523 524 525 526 527 528 529 530 531
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
		    ieee80211_is_beacon(hdr->frame_control))
			return RX_CONTINUE;

		return RX_DROP_MONITOR;

	}

#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))

	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
532
	    mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
533
		return RX_DROP_MONITOR;
J
Johannes Berg 已提交
534
#undef msh_h_get
535

J
Johannes Berg 已提交
536 537
	return RX_CONTINUE;
}
538 539


540
static ieee80211_rx_result debug_noinline
541
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
542
{
543
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
544 545 546

	/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
	if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
547
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
548
			     rx->sta->last_seq_ctrl[rx->queue] ==
549
			     hdr->seq_ctrl)) {
550
			if (rx->flags & IEEE80211_RX_RA_MATCH) {
551 552 553
				rx->local->dot11FrameDuplicateCount++;
				rx->sta->num_duplicates++;
			}
J
Johannes Berg 已提交
554
			return RX_DROP_MONITOR;
555
		} else
556
			rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
557 558 559 560
	}

	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
J
Johannes Berg 已提交
561
		return RX_DROP_MONITOR;
562 563 564 565 566
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
567 568
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
569 570 571
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
572

J
Johannes Berg 已提交
573
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
574 575
		return ieee80211_rx_mesh_check(rx);

576 577
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
578
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
579
		     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
580 581 582 583
		if ((!ieee80211_has_fromds(hdr->frame_control) &&
		     !ieee80211_has_tods(hdr->frame_control) &&
		     ieee80211_is_data(hdr->frame_control)) ||
		    !(rx->flags & IEEE80211_RX_RA_MATCH)) {
584 585
			/* Drop IBSS frames and frames for other hosts
			 * silently. */
J
Johannes Berg 已提交
586
			return RX_DROP_MONITOR;
587 588
		}

J
Johannes Berg 已提交
589
		return RX_DROP_MONITOR;
590 591
	}

592
	return RX_CONTINUE;
593 594 595
}


596
static ieee80211_rx_result debug_noinline
597
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
598
{
599
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
600 601
	int keyidx;
	int hdrlen;
J
Johannes Berg 已提交
602
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
603
	struct ieee80211_key *stakey = NULL;
604
	int mmie_keyidx = -1;
605

606 607 608
	/*
	 * Key selection 101
	 *
609
	 * There are four types of keys:
610
	 *  - GTK (group keys)
611
	 *  - IGTK (group keys for management frames)
612 613 614 615 616
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
617 618 619 620
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
621
	 *
622 623 624 625
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
626 627
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
628 629 630
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
631 632 633
	 */

	/*
634
	 * No point in finding a key and decrypting if the frame is neither
635 636
	 * addressed to us nor a multicast frame.
	 */
637
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
638
		return RX_CONTINUE;
639

640 641 642
	if (rx->sta)
		stakey = rcu_dereference(rx->sta->key);

643 644 645
	if (!ieee80211_has_protected(hdr->frame_control))
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

646 647
	if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
		rx->key = stakey;
648 649 650
		/* Skip decryption if the frame is not protected. */
		if (!ieee80211_has_protected(hdr->frame_control))
			return RX_CONTINUE;
651 652 653 654 655 656 657 658 659 660
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
		if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
		    (rx->status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
		rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
661 662 663 664 665 666 667 668 669 670 671 672 673 674 675
	} else if (!ieee80211_has_protected(hdr->frame_control)) {
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
		if (ieee80211_is_mgmt(hdr->frame_control) &&
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else if ((key = rcu_dereference(rx->sdata->default_key)))
			rx->key = key;
		return RX_CONTINUE;
676
	} else {
677 678 679 680 681 682 683 684 685
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
686 687
		if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
		    (rx->status->flag & RX_FLAG_IV_STRIPPED))
688
			return RX_CONTINUE;
689

690
		hdrlen = ieee80211_hdrlen(hdr->frame_control);
691 692

		if (rx->skb->len < 8 + hdrlen)
J
Johannes Berg 已提交
693
			return RX_DROP_UNUSABLE; /* TODO: count this? */
694 695 696 697 698 699 700

		/*
		 * no need to call ieee80211_wep_get_keyidx,
		 * it verifies a bunch of things we've done already
		 */
		keyidx = rx->skb->data[hdrlen + 3] >> 6;

701
		rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
702 703 704 705 706 707

		/*
		 * RSNA-protected unicast frames should always be sent with
		 * pairwise or station-to-station keys, but for WEP we allow
		 * using a key index as well.
		 */
708
		if (rx->key && rx->key->conf.alg != ALG_WEP &&
709 710
		    !is_multicast_ether_addr(hdr->addr1))
			rx->key = NULL;
711 712
	}

713
	if (rx->key) {
714
		rx->key->tx_rx_count++;
715
		/* TODO: add threshold stuff again */
716
	} else {
J
Johannes Berg 已提交
717
		return RX_DROP_MONITOR;
718 719
	}

720 721
	/* Check for weak IVs if possible */
	if (rx->sta && rx->key->conf.alg == ALG_WEP &&
722
	    ieee80211_is_data(hdr->frame_control) &&
723 724
	    (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
	     !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
725 726 727
	    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
		rx->sta->wep_weak_iv_count++;

728 729
	switch (rx->key->conf.alg) {
	case ALG_WEP:
730 731
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
732
	case ALG_TKIP:
733 734
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
735
	case ALG_CCMP:
736 737
		result = ieee80211_crypto_ccmp_decrypt(rx);
		break;
738 739 740
	case ALG_AES_CMAC:
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
741 742
	}

743
	/* either the frame has been decrypted or will be dropped */
744
	rx->status->flag |= RX_FLAG_DECRYPTED;
745 746

	return result;
747 748
}

749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

782
static void ap_sta_ps_start(struct sta_info *sta)
783
{
784
	struct ieee80211_sub_if_data *sdata = sta->sdata;
785
	struct ieee80211_local *local = sdata->local;
786

787
	atomic_inc(&sdata->bss->num_sta_ps);
788
	set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
789
	drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
790
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
791 792
	printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
	       sdata->dev->name, sta->sta.addr, sta->sta.aid);
793 794 795
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
}

796
static int ap_sta_ps_end(struct sta_info *sta)
797
{
798 799
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
800 801 802
	struct sk_buff *skb;
	int sent = 0;

803
	atomic_dec(&sdata->bss->num_sta_ps);
804

805
	clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
806
	drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
807 808 809 810

	if (!skb_queue_empty(&sta->ps_tx_buf))
		sta_info_clear_tim_bit(sta);

811
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
812 813
	printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
	       sdata->dev->name, sta->sta.addr, sta->sta.aid);
814
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
815

816 817 818
	/* Send all buffered frames to the station */
	while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
		sent++;
S
Sujith 已提交
819
		skb->requeue = 1;
820 821 822 823 824 825
		dev_queue_xmit(skb);
	}
	while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
		local->total_ps_buffered--;
		sent++;
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
826
		printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
827
		       "since STA not sleeping anymore\n", sdata->dev->name,
828
		       sta->sta.addr, sta->sta.aid);
829
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
S
Sujith 已提交
830
		skb->requeue = 1;
831 832 833 834 835 836
		dev_queue_xmit(skb);
	}

	return sent;
}

837
static ieee80211_rx_result debug_noinline
838
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
839 840
{
	struct sta_info *sta = rx->sta;
841
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
842 843

	if (!sta)
844
		return RX_CONTINUE;
845 846 847 848

	/* Update last_rx only for IBSS packets which are for the current
	 * BSSID to avoid keeping the current IBSS network alive in cases where
	 * other STAs are using different BSSID. */
849
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
850
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
851
						NL80211_IFTYPE_ADHOC);
852
		if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
853 854 855
			sta->last_rx = jiffies;
	} else
	if (!is_multicast_ether_addr(hdr->addr1) ||
856
	    rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
857 858 859
		/* Update last_rx only for unicast frames in order to prevent
		 * the Probe Request frames (the only broadcast frames from a
		 * STA in infrastructure mode) from keeping a connection alive.
860 861
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
862
		 */
863 864 865 866 867
		if (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
		    ieee80211_is_beacon(hdr->frame_control)) {
			rx->sdata->u.mgd.last_beacon = jiffies;
		} else
			sta->last_rx = jiffies;
868 869
	}

870
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
871
		return RX_CONTINUE;
872

873 874 875
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

876 877
	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
878
	sta->last_signal = rx->status->signal;
879
	sta->last_qual = rx->status->qual;
880
	sta->last_noise = rx->status->noise;
881

882 883 884 885
	/*
	 * Change STA power saving mode only at the end of a frame
	 * exchange sequence.
	 */
886
	if (!ieee80211_has_morefrags(hdr->frame_control) &&
887 888
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904
		if (test_sta_flags(sta, WLAN_STA_PS)) {
			/*
			 * Ignore doze->wake transitions that are
			 * indicated by non-data frames, the standard
			 * is unclear here, but for example going to
			 * PS mode and then scanning would cause a
			 * doze->wake transition for the probe request,
			 * and that is clearly undesirable.
			 */
			if (ieee80211_is_data(hdr->frame_control) &&
			    !ieee80211_has_pm(hdr->frame_control))
				rx->sent_ps_buffered += ap_sta_ps_end(sta);
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
				ap_sta_ps_start(sta);
		}
905 906 907 908
	}

	/* Drop data::nullfunc frames silently, since they are used only to
	 * control station power saving mode. */
909
	if (ieee80211_is_nullfunc(hdr->frame_control)) {
910 911 912 913 914
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
		/* Update counter and free packet here to avoid counting this
		 * as a dropped packed. */
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
915
		return RX_QUEUED;
916 917
	}

918
	return RX_CONTINUE;
919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934
} /* ieee80211_rx_h_sta_process */

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;
	int idx;

	idx = sdata->fragment_next;
	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

	if (!skb_queue_empty(&entry->skb_list)) {
935
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
936 937 938 939
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) entry->skb_list.next->data;
		printk(KERN_DEBUG "%s: RX reassembly removed oldest "
		       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
940
		       "addr1=%pM addr2=%pM\n",
941 942
		       sdata->dev->name, idx,
		       jiffies - entry->first_frag_time, entry->seq,
943
		       entry->last_frag, hdr->addr1, hdr->addr2);
944
#endif
945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961
		__skb_queue_purge(&entry->skb_list);
	}

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
962
			  unsigned int frag, unsigned int seq,
963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

982
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
983

984 985 986 987 988
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
989 990 991 992
		    compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
		    compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
			continue;

993
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
994 995 996 997 998 999 1000 1001 1002
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1003
static ieee80211_rx_result debug_noinline
1004
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1005 1006 1007
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1008
	__le16 fc;
1009 1010 1011 1012
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;

1013
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1014
	fc = hdr->frame_control;
1015 1016 1017
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1018
	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030
		   (rx->skb)->len < 24 ||
		   is_multicast_ether_addr(hdr->addr1))) {
		/* not fragmented */
		goto out;
	}
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1031
						 rx->queue, &(rx->skb));
1032
		if (rx->key && rx->key->conf.alg == ALG_CCMP &&
1033
		    ieee80211_has_protected(fc)) {
1034 1035 1036 1037
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
1038
			       rx->key->u.ccmp.rx_pn[rx->queue],
1039 1040
			       CCMP_PN_LEN);
		}
1041
		return RX_QUEUED;
1042 1043 1044 1045 1046
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
1047
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
1048 1049
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
1050
		return RX_DROP_MONITOR;
1051 1052 1053 1054 1055 1056 1057
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
		u8 pn[CCMP_PN_LEN], *rpn;
1058
		if (!rx->key || rx->key->conf.alg != ALG_CCMP)
J
Johannes Berg 已提交
1059
			return RX_DROP_UNUSABLE;
1060 1061 1062 1063 1064 1065
		memcpy(pn, entry->last_pn, CCMP_PN_LEN);
		for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
			pn[i]++;
			if (pn[i])
				break;
		}
1066
		rpn = rx->key->u.ccmp.rx_pn[rx->queue];
1067
		if (memcmp(pn, rpn, CCMP_PN_LEN))
J
Johannes Berg 已提交
1068
			return RX_DROP_UNUSABLE;
1069 1070 1071
		memcpy(entry->last_pn, pn, CCMP_PN_LEN);
	}

1072
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
1073 1074 1075
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
1076
	if (ieee80211_has_morefrags(fc)) {
1077
		rx->skb = NULL;
1078
		return RX_QUEUED;
1079 1080 1081 1082 1083 1084 1085 1086 1087
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
1088
			return RX_DROP_UNUSABLE;
1089 1090 1091 1092 1093 1094 1095 1096
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
1097
	rx->flags |= IEEE80211_RX_FRAGMENTED;
1098 1099 1100 1101 1102 1103 1104 1105

 out:
	if (rx->sta)
		rx->sta->rx_packets++;
	if (is_multicast_ether_addr(hdr->addr1))
		rx->local->dot11MulticastReceivedFrameCount++;
	else
		ieee80211_led_rx(rx->local);
1106
	return RX_CONTINUE;
1107 1108
}

1109
static ieee80211_rx_result debug_noinline
1110
ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1111
{
1112
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1113 1114
	struct sk_buff *skb;
	int no_pending_pkts;
1115
	__le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1116

1117
	if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1118
		   !(rx->flags & IEEE80211_RX_RA_MATCH)))
1119
		return RX_CONTINUE;
1120

1121 1122
	if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
J
Johannes Berg 已提交
1123
		return RX_DROP_UNUSABLE;
1124

1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137
	skb = skb_dequeue(&rx->sta->tx_filtered);
	if (!skb) {
		skb = skb_dequeue(&rx->sta->ps_tx_buf);
		if (skb)
			rx->local->total_ps_buffered--;
	}
	no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
		skb_queue_empty(&rx->sta->ps_tx_buf);

	if (skb) {
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) skb->data;

1138 1139 1140 1141
		/*
		 * Tell TX path to send one frame even though the STA may
		 * still remain is PS mode after this frame exchange.
		 */
1142
		set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1143 1144

#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1145 1146
		printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
		       rx->sta->sta.addr, rx->sta->sta.aid,
1147 1148 1149 1150 1151
		       skb_queue_len(&rx->sta->ps_tx_buf));
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */

		/* Use MoreData flag to indicate whether there are more
		 * buffered frames for this STA */
1152
		if (no_pending_pkts)
1153
			hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1154
		else
1155 1156 1157 1158
			hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);

		dev_queue_xmit(skb);

1159 1160
		if (no_pending_pkts)
			sta_info_clear_tim_bit(rx->sta);
1161
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1162
	} else if (!rx->sent_ps_buffered) {
1163 1164 1165 1166 1167 1168
		/*
		 * FIXME: This can be the result of a race condition between
		 *	  us expiring a frame and the station polling for it.
		 *	  Should we send it a null-func frame indicating we
		 *	  have nothing buffered for it?
		 */
1169
		printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
1170
		       "though there are no buffered frames for it\n",
1171
		       rx->dev->name, rx->sta->sta.addr);
1172 1173 1174
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
	}

1175
	/* Free PS Poll skb here instead of returning RX_DROP that would
1176 1177 1178
	 * count as an dropped frame. */
	dev_kfree_skb(rx->skb);

1179
	return RX_QUEUED;
1180 1181
}

1182
static ieee80211_rx_result debug_noinline
1183
ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1184 1185
{
	u8 *data = rx->skb->data;
1186
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1187

1188
	if (!ieee80211_is_data_qos(hdr->frame_control))
1189
		return RX_CONTINUE;
1190 1191

	/* remove the qos control field, update frame type and meta-data */
1192 1193 1194
	memmove(data + IEEE80211_QOS_CTL_LEN, data,
		ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
	hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1195
	/* change frame type to non QOS */
1196
	hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1197

1198
	return RX_CONTINUE;
1199 1200
}

1201
static int
1202
ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1203
{
1204
	if (unlikely(!rx->sta ||
1205
	    !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1206
		return -EACCES;
1207

1208
	return 0;
1209 1210
}

1211
static int
1212
ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1213
{
1214
	/*
1215 1216
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
1217
	 */
1218
	if (rx->status->flag & RX_FLAG_DECRYPTED)
1219
		return 0;
1220 1221

	/* Drop unencrypted frames if key is set. */
1222 1223
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
1224
		     ieee80211_is_data(fc) &&
1225
		     (rx->key || rx->sdata->drop_unencrypted)))
1226
		return -EACCES;
1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244
	if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
		if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
			     rx->key))
			return -EACCES;
		/* BIP does not use Protected field, so need to check MMIE */
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb)
			     && ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
			     rx->key))
			return -EACCES;
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
			     ieee80211_is_robust_mgmt_frame(
				     (struct ieee80211_hdr *) rx->skb->data)))
			return -EACCES;
	}
1245

1246
	return 0;
1247 1248
}

1249
static int
1250
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1251 1252 1253 1254
{
	struct net_device *dev = rx->dev;
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);

1255
	return ieee80211_data_to_8023(rx->skb, dev->dev_addr, sdata->vif.type);
1256
}
1257

1258 1259 1260
/*
 * requires that rx->skb is a frame with ethernet header
 */
1261
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1262
{
1263
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
	if (ehdr->h_proto == htons(ETH_P_PAE) &&
	    (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
	     compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
1277
	    ieee80211_drop_unencrypted(rx, fc))
1278 1279 1280 1281 1282 1283 1284 1285
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
1286
static void
1287
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1288 1289 1290 1291 1292
{
	struct net_device *dev = rx->dev;
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb, *xmit_skb;
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1293 1294
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
1295

1296 1297
	skb = rx->skb;
	xmit_skb = NULL;
1298

1299 1300
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1301
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1302
	    (rx->flags & IEEE80211_RX_RA_MATCH)) {
1303 1304 1305 1306 1307
		if (is_multicast_ether_addr(ehdr->h_dest)) {
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
1308 1309
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
			if (!xmit_skb && net_ratelimit())
1310 1311 1312 1313
				printk(KERN_DEBUG "%s: failed to clone "
				       "multicast frame\n", dev->name);
		} else {
			dsta = sta_info_get(local, skb->data);
1314
			if (dsta && dsta->sdata->dev == dev) {
1315 1316 1317 1318 1319
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
1320
				 */
1321
				xmit_skb = skb;
1322 1323 1324 1325 1326 1327
				skb = NULL;
			}
		}
	}

	if (skb) {
1328 1329 1330 1331 1332 1333 1334 1335 1336 1337
		int align __maybe_unused;

#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
		/*
		 * 'align' will only take the values 0 or 2 here
		 * since all frames are required to be aligned
		 * to 2-byte boundaries when being passed to
		 * mac80211. That also explains the __skb_push()
		 * below.
		 */
1338
		align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
				size_t len = skb->len;
				u8 *new = __skb_push(skb, align);
				memmove(new, data, len);
				__skb_trim(skb, len);
			}
		}
#endif

		if (skb) {
			/* deliver to local stack */
			skb->protocol = eth_type_trans(skb, dev);
			memset(skb->cb, 0, sizeof(skb->cb));
			netif_rx(skb);
		}
1359 1360
	}

1361
	if (xmit_skb) {
1362
		/* send to wireless media */
1363
		xmit_skb->protocol = htons(ETH_P_802_3);
1364 1365
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
1366
		dev_queue_xmit(xmit_skb);
1367
	}
1368 1369
}

1370
static ieee80211_rx_result debug_noinline
1371
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1372 1373 1374
{
	struct net_device *dev = rx->dev;
	struct ieee80211_local *local = rx->local;
1375
	u16 ethertype;
1376 1377
	u8 *payload;
	struct sk_buff *skb = rx->skb, *frame = NULL;
1378 1379
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
1380 1381 1382 1383 1384
	const struct ethhdr *eth;
	int remaining, err;
	u8 dst[ETH_ALEN];
	u8 src[ETH_ALEN];

1385
	if (unlikely(!ieee80211_is_data(fc)))
1386
		return RX_CONTINUE;
1387

1388
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
1389
		return RX_DROP_MONITOR;
1390

1391
	if (!(rx->flags & IEEE80211_RX_AMSDU))
1392
		return RX_CONTINUE;
1393

1394
	err = __ieee80211_data_to_8023(rx);
1395
	if (unlikely(err))
J
Johannes Berg 已提交
1396
		return RX_DROP_UNUSABLE;
1397 1398 1399 1400 1401 1402 1403 1404 1405

	skb->dev = dev;

	dev->stats.rx_packets++;
	dev->stats.rx_bytes += skb->len;

	/* skip the wrapping header */
	eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
	if (!eth)
J
Johannes Berg 已提交
1406
		return RX_DROP_UNUSABLE;
1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418

	while (skb != frame) {
		u8 padding;
		__be16 len = eth->h_proto;
		unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);

		remaining = skb->len;
		memcpy(dst, eth->h_dest, ETH_ALEN);
		memcpy(src, eth->h_source, ETH_ALEN);

		padding = ((4 - subframe_len) & 0x3);
		/* the last MSDU has no padding */
1419
		if (subframe_len > remaining)
J
Johannes Berg 已提交
1420
			return RX_DROP_UNUSABLE;
1421 1422 1423 1424 1425 1426

		skb_pull(skb, sizeof(struct ethhdr));
		/* if last subframe reuse skb */
		if (remaining <= subframe_len + padding)
			frame = skb;
		else {
1427 1428 1429 1430 1431 1432 1433
			/*
			 * Allocate and reserve two bytes more for payload
			 * alignment since sizeof(struct ethhdr) is 14.
			 */
			frame = dev_alloc_skb(
				ALIGN(local->hw.extra_tx_headroom, 4) +
				subframe_len + 2);
1434 1435

			if (frame == NULL)
J
Johannes Berg 已提交
1436
				return RX_DROP_UNUSABLE;
1437

1438 1439 1440
			skb_reserve(frame,
				    ALIGN(local->hw.extra_tx_headroom, 4) +
				    sizeof(struct ethhdr) + 2);
1441 1442 1443 1444 1445 1446 1447
			memcpy(skb_put(frame, ntohs(len)), skb->data,
				ntohs(len));

			eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
							padding);
			if (!eth) {
				dev_kfree_skb(frame);
J
Johannes Berg 已提交
1448
				return RX_DROP_UNUSABLE;
1449 1450 1451
			}
		}

1452
		skb_reset_network_header(frame);
1453 1454 1455 1456 1457 1458 1459 1460
		frame->dev = dev;
		frame->priority = skb->priority;
		rx->skb = frame;

		payload = frame->data;
		ethertype = (payload[6] << 8) | payload[7];

		if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1461 1462 1463
			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
			   compare_ether_addr(payload,
					      bridge_tunnel_header) == 0)) {
1464 1465 1466 1467 1468 1469
			/* remove RFC1042 or Bridge-Tunnel
			 * encapsulation and replace EtherType */
			skb_pull(frame, 6);
			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
		} else {
1470 1471
			memcpy(skb_push(frame, sizeof(__be16)),
			       &len, sizeof(__be16));
1472 1473 1474 1475
			memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
			memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
		}

1476
		if (!ieee80211_frame_allowed(rx, fc)) {
1477
			if (skb == frame) /* last frame */
J
Johannes Berg 已提交
1478
				return RX_DROP_UNUSABLE;
1479 1480 1481
			dev_kfree_skb(frame);
			continue;
		}
1482 1483 1484 1485

		ieee80211_deliver_skb(rx);
	}

1486
	return RX_QUEUED;
1487 1488
}

I
Ingo Molnar 已提交
1489
#ifdef CONFIG_MAC80211_MESH
1490
static ieee80211_rx_result
1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
	struct ieee80211_hdr *hdr;
	struct ieee80211s_hdr *mesh_hdr;
	unsigned int hdrlen;
	struct sk_buff *skb = rx->skb, *fwd_skb;

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		/* illegal frame */
		return RX_DROP_MONITOR;

1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527
	if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
		struct ieee80211_sub_if_data *sdata;
		struct mesh_path *mppath;

		sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
		rcu_read_lock();
		mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
		if (!mppath) {
			mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
		} else {
			spin_lock_bh(&mppath->state_lock);
			mppath->exp_time = jiffies;
			if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
				memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

1528 1529 1530 1531 1532 1533 1534
	if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
		return RX_CONTINUE;

	mesh_hdr->ttl--;

	if (rx->flags & IEEE80211_RX_RA_MATCH) {
		if (!mesh_hdr->ttl)
1535
			IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563
						     dropped_frames_ttl);
		else {
			struct ieee80211_hdr *fwd_hdr;
			fwd_skb = skb_copy(skb, GFP_ATOMIC);

			if (!fwd_skb && net_ratelimit())
				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
						   rx->dev->name);

			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
			/*
			 * Save TA to addr1 to send TA a path error if a
			 * suitable next hop is not found
			 */
			memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
			memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
			fwd_skb->dev = rx->local->mdev;
			fwd_skb->iif = rx->dev->ifindex;
			dev_queue_xmit(fwd_skb);
		}
	}

	if (is_multicast_ether_addr(hdr->addr3) ||
	    rx->dev->flags & IFF_PROMISC)
		return RX_CONTINUE;
	else
		return RX_DROP_MONITOR;
}
I
Ingo Molnar 已提交
1564
#endif
1565

1566
static ieee80211_rx_result debug_noinline
1567
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1568 1569
{
	struct net_device *dev = rx->dev;
1570 1571
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
1572
	int err;
1573

1574
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1575
		return RX_CONTINUE;
1576

1577
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
1578
		return RX_DROP_MONITOR;
1579

1580
	err = __ieee80211_data_to_8023(rx);
1581
	if (unlikely(err))
J
Johannes Berg 已提交
1582
		return RX_DROP_UNUSABLE;
1583

1584
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
1585
		return RX_DROP_MONITOR;
1586

1587 1588 1589 1590 1591 1592
	rx->skb->dev = dev;

	dev->stats.rx_packets++;
	dev->stats.rx_bytes += rx->skb->len;

	ieee80211_deliver_skb(rx);
1593

1594
	return RX_QUEUED;
1595 1596
}

1597
static ieee80211_rx_result debug_noinline
1598
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1599 1600 1601 1602
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_hw *hw = &local->hw;
	struct sk_buff *skb = rx->skb;
1603
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1604 1605 1606 1607
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

1608
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
1609
		return RX_CONTINUE;
1610

1611
	if (ieee80211_is_back_req(bar->frame_control)) {
1612
		if (!rx->sta)
1613
			return RX_CONTINUE;
1614
		tid = le16_to_cpu(bar->control) >> 12;
1615 1616
		if (rx->sta->ampdu_mlme.tid_state_rx[tid]
					!= HT_AGG_STATE_OPERATIONAL)
1617
			return RX_CONTINUE;
1618
		tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1619 1620 1621 1622

		start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;

		/* reset session timer */
1623 1624 1625
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
1626 1627 1628 1629

		/* manage reordering buffer according to requested */
		/* sequence number */
		rcu_read_lock();
1630
		ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL, NULL,
1631 1632
						 start_seq_num, 1);
		rcu_read_unlock();
J
Johannes Berg 已提交
1633
		return RX_DROP_UNUSABLE;
1634 1635
	}

1636
	return RX_CONTINUE;
1637 1638
}

1639 1640 1641
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
1642 1643 1644 1645 1646 1647 1648 1649 1650 1651
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

	if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
		/* Not to own unicast address */
		return;
	}

1652 1653
	if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
	    compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
1654 1655 1656 1657
		/* Not from the current AP. */
		return;
	}

1658
	if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676
		/* Association in progress; ignore SA Query */
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(resp, 0, 24);
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
	memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
1677
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

	ieee80211_tx_skb(sdata, skb, 1);
}

1690 1691 1692 1693 1694 1695
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
S
Sujith 已提交
1696
	struct ieee80211_bss *bss;
1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	if (!rx->sta)
		return RX_DROP_MONITOR;

	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
		return RX_DROP_MONITOR;

1708 1709 1710
	if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
		return RX_DROP_MONITOR;

1711 1712 1713 1714 1715 1716
	/* all categories we currently handle have action_code */
	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
		return RX_DROP_MONITOR;

	switch (mgmt->u.action.category) {
	case WLAN_CATEGORY_BACK:
1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727
		/*
		 * The aggregation code is not prepared to handle
		 * anything but STA/AP due to the BSSID handling;
		 * IBSS could work in the code but isn't supported
		 * by drivers or the standard.
		 */
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP)
			return RX_DROP_MONITOR;

1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
				return RX_DROP_MONITOR;
			ieee80211_process_addba_request(local, rx->sta, mgmt, len);
			break;
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
				return RX_DROP_MONITOR;
			ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
			break;
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
				return RX_DROP_MONITOR;
			ieee80211_process_delba(sdata, rx->sta, mgmt, len);
			break;
		}
1748 1749 1750 1751
		break;
	case WLAN_CATEGORY_SPECTRUM_MGMT:
		if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
			return RX_DROP_MONITOR;
1752 1753 1754 1755

		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;

1756 1757 1758 1759 1760 1761 1762
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
				return RX_DROP_MONITOR;
			ieee80211_process_measurement_req(sdata, mgmt, len);
			break;
S
Sujith 已提交
1763 1764 1765 1766 1767
		case WLAN_ACTION_SPCT_CHL_SWITCH:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
				return RX_DROP_MONITOR;

1768 1769 1770
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				return RX_DROP_MONITOR;

1771
			if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
S
Sujith 已提交
1772 1773
				return RX_DROP_MONITOR;

1774
			bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
S
Sujith 已提交
1775
					   local->hw.conf.channel->center_freq,
1776 1777
					   sdata->u.mgd.ssid,
					   sdata->u.mgd.ssid_len);
S
Sujith 已提交
1778 1779 1780
			if (!bss)
				return RX_DROP_MONITOR;

1781
			ieee80211_sta_process_chanswitch(sdata,
S
Sujith 已提交
1782 1783 1784
				     &mgmt->u.action.u.chan_switch.sw_elem, bss);
			ieee80211_rx_bss_put(local, bss);
			break;
1785 1786
		}
		break;
1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
			return RX_DROP_MONITOR;
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				return RX_DROP_MONITOR;
			ieee80211_process_sa_query_req(sdata, mgmt, len);
			break;
		case WLAN_ACTION_SA_QUERY_RESPONSE:
			/*
			 * SA Query response is currently only used in AP mode
			 * and it is processed in user space.
			 */
			return RX_CONTINUE;
		}
		break;
1805 1806
	default:
		return RX_CONTINUE;
1807 1808
	}

1809 1810 1811
	rx->sta->rx_packets++;
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
1812 1813
}

1814
static ieee80211_rx_result debug_noinline
1815
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1816
{
1817
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1818
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1819

1820
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
J
Johannes Berg 已提交
1821
		return RX_DROP_MONITOR;
1822

1823 1824 1825
	if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
		return RX_DROP_MONITOR;

1826 1827 1828
	if (ieee80211_vif_is_mesh(&sdata->vif))
		return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);

J
Johannes Berg 已提交
1829
	if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
1830
		return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
1831

1832
	if (sdata->vif.type == NL80211_IFTYPE_STATION)
1833 1834
		return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);

1835
	return RX_DROP_MONITOR;
1836 1837 1838 1839
}

static void ieee80211_rx_michael_mic_report(struct net_device *dev,
					    struct ieee80211_hdr *hdr,
1840
					    struct ieee80211_rx_data *rx)
1841
{
1842 1843
	int keyidx;
	unsigned int hdrlen;
1844

1845
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
1846 1847 1848 1849 1850
	if (rx->skb->len >= hdrlen + 4)
		keyidx = rx->skb->data[hdrlen + 3] >> 6;
	else
		keyidx = -1;

1851
	if (!rx->sta) {
1852 1853 1854 1855
		/*
		 * Some hardware seem to generate incorrect Michael MIC
		 * reports; ignore them to avoid triggering countermeasures.
		 */
1856 1857 1858
		goto ignore;
	}

1859
	if (!ieee80211_has_protected(hdr->frame_control))
1860 1861
		goto ignore;

1862
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
1863 1864 1865 1866 1867 1868
		/*
		 * APs with pairwise keys should never receive Michael MIC
		 * errors for non-zero keyidx because these are reserved for
		 * group keys and only the AP is sending real multicast
		 * frames in the BSS.
		 */
J
Johannes Berg 已提交
1869
		goto ignore;
1870 1871
	}

1872 1873
	if (!ieee80211_is_data(hdr->frame_control) &&
	    !ieee80211_is_auth(hdr->frame_control))
1874 1875
		goto ignore;

1876
	mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL);
1877 1878 1879 1880 1881
 ignore:
	dev_kfree_skb(rx->skb);
	rx->skb = NULL;
}

1882 1883
/* TODO: use IEEE80211_RX_FRAGMENTED */
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct ieee80211_rtap_hdr {
		struct ieee80211_radiotap_header hdr;
		u8 flags;
		u8 rate;
		__le16 chan_freq;
		__le16 chan_flags;
	} __attribute__ ((packed)) *rthdr;
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
1896
	struct ieee80211_rx_status *status = rx->status;
1897

1898
	if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912
		goto out_free_skb;

	if (skb_headroom(skb) < sizeof(*rthdr) &&
	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
		goto out_free_skb;

	rthdr = (void *)skb_push(skb, sizeof(*rthdr));
	memset(rthdr, 0, sizeof(*rthdr));
	rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
	rthdr->hdr.it_present =
		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
			    (1 << IEEE80211_RADIOTAP_RATE) |
			    (1 << IEEE80211_RADIOTAP_CHANNEL));

1913
	rthdr->rate = rx->rate->bitrate / 5;
1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931
	rthdr->chan_freq = cpu_to_le16(status->freq);

	if (status->band == IEEE80211_BAND_5GHZ)
		rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
						IEEE80211_CHAN_5GHZ);
	else
		rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
						IEEE80211_CHAN_2GHZ);

	skb_set_mac_header(skb, 0);
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!netif_running(sdata->dev))
			continue;

1932
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955
		    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
				netif_rx(skb2);
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
		netif_rx(skb);
		skb = NULL;
	} else
		goto out_free_skb;

1956
	rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
1957 1958 1959 1960 1961 1962
	return;

 out_free_skb:
	dev_kfree_skb(skb);
}

1963

1964
static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
1965
					 struct ieee80211_rx_data *rx,
1966
					 struct sk_buff *skb)
1967 1968 1969
{
	ieee80211_rx_result res = RX_DROP_MONITOR;

1970 1971 1972 1973
	rx->skb = skb;
	rx->sdata = sdata;
	rx->dev = sdata->dev;

1974 1975 1976 1977 1978 1979
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_done;  \
	} while (0);
1980 1981 1982 1983

	CALL_RXH(ieee80211_rx_h_passive_scan)
	CALL_RXH(ieee80211_rx_h_check)
	CALL_RXH(ieee80211_rx_h_decrypt)
1984
	CALL_RXH(ieee80211_rx_h_check_more_data)
1985 1986 1987 1988 1989 1990 1991
	CALL_RXH(ieee80211_rx_h_sta_process)
	CALL_RXH(ieee80211_rx_h_defragment)
	CALL_RXH(ieee80211_rx_h_ps_poll)
	CALL_RXH(ieee80211_rx_h_michael_mic_verify)
	/* must be after MMIC verify so header is counted in MPDU mic */
	CALL_RXH(ieee80211_rx_h_remove_qos_control)
	CALL_RXH(ieee80211_rx_h_amsdu)
I
Ingo Molnar 已提交
1992
#ifdef CONFIG_MAC80211_MESH
1993 1994
	if (ieee80211_vif_is_mesh(&sdata->vif))
		CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
1995
#endif
1996 1997
	CALL_RXH(ieee80211_rx_h_data)
	CALL_RXH(ieee80211_rx_h_ctrl)
1998
	CALL_RXH(ieee80211_rx_h_action)
1999 2000 2001 2002 2003
	CALL_RXH(ieee80211_rx_h_mgmt)

#undef CALL_RXH

 rxh_done:
2004 2005
	switch (res) {
	case RX_DROP_MONITOR:
2006 2007 2008 2009 2010
		I802_DEBUG_INC(sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		/* fall through */
	case RX_CONTINUE:
2011 2012
		ieee80211_rx_cooked_monitor(rx);
		break;
2013
	case RX_DROP_UNUSABLE:
2014 2015 2016
		I802_DEBUG_INC(sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
2017 2018
		dev_kfree_skb(rx->skb);
		break;
2019 2020 2021
	case RX_QUEUED:
		I802_DEBUG_INC(sdata->local->rx_handlers_queued);
		break;
2022 2023 2024
	}
}

2025 2026
/* main receive path */

2027
static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2028
				struct ieee80211_rx_data *rx,
2029 2030
				struct ieee80211_hdr *hdr)
{
2031
	u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
2032 2033
	int multicast = is_multicast_ether_addr(hdr->addr1);

2034
	switch (sdata->vif.type) {
2035
	case NL80211_IFTYPE_STATION:
2036 2037
		if (!bssid)
			return 0;
2038
		if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
2039
			if (!(rx->flags & IEEE80211_RX_IN_SCAN))
2040
				return 0;
2041
			rx->flags &= ~IEEE80211_RX_RA_MATCH;
2042 2043 2044
		} else if (!multicast &&
			   compare_ether_addr(sdata->dev->dev_addr,
					      hdr->addr1) != 0) {
2045
			if (!(sdata->dev->flags & IFF_PROMISC))
2046
				return 0;
2047
			rx->flags &= ~IEEE80211_RX_RA_MATCH;
2048 2049
		}
		break;
2050
	case NL80211_IFTYPE_ADHOC:
2051 2052
		if (!bssid)
			return 0;
2053
		if (ieee80211_is_beacon(hdr->frame_control)) {
B
Bruno Randolf 已提交
2054
			return 1;
2055
		}
2056
		else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2057
			if (!(rx->flags & IEEE80211_RX_IN_SCAN))
2058
				return 0;
2059
			rx->flags &= ~IEEE80211_RX_RA_MATCH;
2060 2061 2062
		} else if (!multicast &&
			   compare_ether_addr(sdata->dev->dev_addr,
					      hdr->addr1) != 0) {
2063
			if (!(sdata->dev->flags & IFF_PROMISC))
2064
				return 0;
2065
			rx->flags &= ~IEEE80211_RX_RA_MATCH;
2066 2067 2068 2069 2070 2071
		} else if (!rx->sta) {
			int rate_idx;
			if (rx->status->flag & RX_FLAG_HT)
				rate_idx = 0; /* TODO: HT rates */
			else
				rate_idx = rx->status->rate_idx;
R
Rami Rosen 已提交
2072
			rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
2073 2074
				BIT(rate_idx));
		}
2075
		break;
2076
	case NL80211_IFTYPE_MESH_POINT:
2077 2078 2079 2080 2081 2082
		if (!multicast &&
		    compare_ether_addr(sdata->dev->dev_addr,
				       hdr->addr1) != 0) {
			if (!(sdata->dev->flags & IFF_PROMISC))
				return 0;

2083
			rx->flags &= ~IEEE80211_RX_RA_MATCH;
2084 2085
		}
		break;
2086 2087
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
2088 2089 2090 2091 2092 2093
		if (!bssid) {
			if (compare_ether_addr(sdata->dev->dev_addr,
					       hdr->addr1))
				return 0;
		} else if (!ieee80211_bssid_match(bssid,
					sdata->dev->dev_addr)) {
2094
			if (!(rx->flags & IEEE80211_RX_IN_SCAN))
2095
				return 0;
2096
			rx->flags &= ~IEEE80211_RX_RA_MATCH;
2097 2098
		}
		break;
2099
	case NL80211_IFTYPE_WDS:
2100
		if (bssid || !ieee80211_is_data(hdr->frame_control))
2101 2102 2103 2104
			return 0;
		if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
			return 0;
		break;
2105
	case NL80211_IFTYPE_MONITOR:
J
Johannes Berg 已提交
2106 2107
		/* take everything */
		break;
2108 2109
	case NL80211_IFTYPE_UNSPECIFIED:
	case __NL80211_IFTYPE_AFTER_LAST:
J
Johannes Berg 已提交
2110 2111 2112
		/* should never get here */
		WARN_ON(1);
		break;
2113 2114 2115 2116 2117
	}

	return 1;
}

2118
/*
2119 2120
 * This is the actual Rx frames handler. as it blongs to Rx path it must
 * be called with rcu_read_lock protection.
2121
 */
2122 2123 2124
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
					 struct sk_buff *skb,
					 struct ieee80211_rx_status *status,
2125
					 struct ieee80211_rate *rate)
2126 2127 2128 2129
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
2130
	struct ieee80211_rx_data rx;
2131
	int prepares;
J
Johannes Berg 已提交
2132 2133
	struct ieee80211_sub_if_data *prev = NULL;
	struct sk_buff *skb_new;
2134

2135
	hdr = (struct ieee80211_hdr *)skb->data;
2136 2137 2138 2139
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;

2140 2141
	rx.status = status;
	rx.rate = rate;
2142

2143
	if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
2144 2145
		local->dot11ReceivedFragmentCount++;

2146 2147
	rx.sta = sta_info_get(local, hdr->addr2);
	if (rx.sta) {
2148 2149
		rx.sdata = rx.sta->sdata;
		rx.dev = rx.sta->sdata->dev;
2150
	}
2151 2152

	if ((status->flag & RX_FLAG_MMIC_ERROR)) {
2153
		ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
2154
		return;
2155 2156
	}

2157
	if (unlikely(local->sw_scanning || local->hw_scanning))
2158
		rx.flags |= IEEE80211_RX_IN_SCAN;
2159

2160
	ieee80211_parse_qos(&rx);
2161
	ieee80211_verify_alignment(&rx);
2162

2163 2164
	skb = rx.skb;

2165
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2166 2167 2168
		if (!netif_running(sdata->dev))
			continue;

2169
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
2170 2171
			continue;

2172
		rx.flags |= IEEE80211_RX_RA_MATCH;
2173
		prepares = prepare_for_handlers(sdata, &rx, hdr);
2174

2175
		if (!prepares)
2176
			continue;
J
Johannes Berg 已提交
2177

J
Johannes Berg 已提交
2178 2179 2180 2181 2182 2183 2184 2185 2186
		/*
		 * frame is destined for this interface, but if it's not
		 * also for the previous one we handle that after the
		 * loop to avoid copying the SKB once too much
		 */

		if (!prev) {
			prev = sdata;
			continue;
J
Johannes Berg 已提交
2187
		}
J
Johannes Berg 已提交
2188 2189 2190 2191 2192 2193 2194 2195 2196 2197

		/*
		 * frame was destined for the previous interface
		 * so invoke RX handlers for it
		 */

		skb_new = skb_copy(skb, GFP_ATOMIC);
		if (!skb_new) {
			if (net_ratelimit())
				printk(KERN_DEBUG "%s: failed to copy "
2198
				       "multicast frame for %s\n",
2199 2200
				       wiphy_name(local->hw.wiphy),
				       prev->dev->name);
J
Johannes Berg 已提交
2201 2202
			continue;
		}
2203
		ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
J
Johannes Berg 已提交
2204
		prev = sdata;
2205
	}
2206
	if (prev)
2207
		ieee80211_invoke_rx_handlers(prev, &rx, skb);
2208
	else
J
Johannes Berg 已提交
2209
		dev_kfree_skb(skb);
2210
}
2211

2212 2213 2214 2215 2216
#define SEQ_MODULO 0x1000
#define SEQ_MASK   0xfff

static inline int seq_less(u16 sq1, u16 sq2)
{
J
Johannes Berg 已提交
2217
	return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
2218 2219 2220 2221
}

static inline u16 seq_inc(u16 sq)
{
J
Johannes Berg 已提交
2222
	return (sq + 1) & SEQ_MASK;
2223 2224 2225 2226
}

static inline u16 seq_sub(u16 sq1, u16 sq2)
{
J
Johannes Berg 已提交
2227
	return (sq1 - sq2) & SEQ_MASK;
2228 2229 2230
}


2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258
static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
					    struct tid_ampdu_rx *tid_agg_rx,
					    int index)
{
	struct ieee80211_supported_band *sband;
	struct ieee80211_rate *rate;
	struct ieee80211_rx_status status;

	if (!tid_agg_rx->reorder_buf[index])
		goto no_frame;

	/* release the reordered frames to stack */
	memcpy(&status, tid_agg_rx->reorder_buf[index]->cb, sizeof(status));
	sband = hw->wiphy->bands[status.band];
	if (status.flag & RX_FLAG_HT)
		rate = sband->bitrates; /* TODO: HT rates */
	else
		rate = &sband->bitrates[status.rate_idx];
	__ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
				     &status, rate);
	tid_agg_rx->stored_mpdu_num--;
	tid_agg_rx->reorder_buf[index] = NULL;

no_frame:
	tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
}


2259 2260 2261 2262 2263 2264 2265 2266 2267
/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

2268 2269 2270 2271
/*
 * As it function blongs to Rx path it must be called with
 * the proper rcu_read_lock protection for its flow.
 */
J
Johannes Berg 已提交
2272 2273 2274
static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
					   struct tid_ampdu_rx *tid_agg_rx,
					   struct sk_buff *skb,
2275
					   struct ieee80211_rx_status *rxstatus,
J
Johannes Berg 已提交
2276 2277
					   u16 mpdu_seq_num,
					   int bar_req)
2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304
{
	u16 head_seq_num, buf_size;
	int index;

	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

	/* frame with out of date sequence number */
	if (seq_less(mpdu_seq_num, head_seq_num)) {
		dev_kfree_skb(skb);
		return 1;
	}

	/* if frame sequence number exceeds our buffering window size or
	 * block Ack Request arrived - release stored frames */
	if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
		/* new head to the ordering buffer */
		if (bar_req)
			head_seq_num = mpdu_seq_num;
		else
			head_seq_num =
				seq_inc(seq_sub(mpdu_seq_num, buf_size));
		/* release stored frames up to new head to stack */
		while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
			index = seq_sub(tid_agg_rx->head_seq_num,
				tid_agg_rx->ssn)
				% tid_agg_rx->buf_size;
2305 2306
			ieee80211_release_reorder_frame(hw, tid_agg_rx,
							index);
2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332
		}
		if (bar_req)
			return 1;
	}

	/* now the new frame is always in the range of the reordering */
	/* buffer window */
	index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
				% tid_agg_rx->buf_size;
	/* check if we already stored this frame */
	if (tid_agg_rx->reorder_buf[index]) {
		dev_kfree_skb(skb);
		return 1;
	}

	/* if arrived mpdu is in the right order and nothing else stored */
	/* release it immediately */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
			tid_agg_rx->stored_mpdu_num == 0) {
		tid_agg_rx->head_seq_num =
			seq_inc(tid_agg_rx->head_seq_num);
		return 0;
	}

	/* put the frame in the reordering buffer */
	tid_agg_rx->reorder_buf[index] = skb;
2333
	tid_agg_rx->reorder_time[index] = jiffies;
2334 2335
	memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
	       sizeof(*rxstatus));
2336 2337 2338 2339
	tid_agg_rx->stored_mpdu_num++;
	/* release the buffer until next missing frame */
	index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
						% tid_agg_rx->buf_size;
2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375
	if (!tid_agg_rx->reorder_buf[index] &&
	    tid_agg_rx->stored_mpdu_num > 1) {
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int j;
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (tid_agg_rx->reorder_buf[j] == NULL) {
				skipped++;
				continue;
			}
			if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
					HZ / 10))
				break;

#ifdef CONFIG_MAC80211_HT_DEBUG
			if (net_ratelimit())
				printk(KERN_DEBUG "%s: release an RX reorder "
				       "frame due to timeout on earlier "
				       "frames\n",
				       wiphy_name(hw->wiphy));
#endif
			ieee80211_release_reorder_frame(hw, tid_agg_rx, j);

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
				(tid_agg_rx->head_seq_num + skipped) &
				SEQ_MASK;
			skipped = 0;
		}
	} else while (tid_agg_rx->reorder_buf[index]) {
2376
		ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
2377 2378 2379 2380 2381 2382
		index =	seq_sub(tid_agg_rx->head_seq_num,
			tid_agg_rx->ssn) % tid_agg_rx->buf_size;
	}
	return 1;
}

2383
static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2384 2385
				     struct sk_buff *skb,
				     struct ieee80211_rx_status *status)
2386 2387 2388 2389 2390
{
	struct ieee80211_hw *hw = &local->hw;
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
	struct sta_info *sta;
	struct tid_ampdu_rx *tid_agg_rx;
H
Harvey Harrison 已提交
2391
	u16 sc;
2392
	u16 mpdu_seq_num;
2393
	u8 ret = 0;
2394 2395 2396 2397 2398 2399 2400 2401
	int tid;

	sta = sta_info_get(local, hdr->addr2);
	if (!sta)
		return ret;

	/* filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation */
H
Harvey Harrison 已提交
2402
	if (!ieee80211_is_data_qos(hdr->frame_control))
2403 2404
		goto end_reorder;

2405
	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
2406

2407
	if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2408 2409
		goto end_reorder;

2410 2411
	tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];

2412 2413
	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
2414 2415 2416 2417 2418
		goto end_reorder;

	/* new un-ordered ampdu frame - process it */

	/* reset session timer */
2419 2420 2421
	if (tid_agg_rx->timeout)
		mod_timer(&tid_agg_rx->session_timer,
			  TU_TO_EXP_TIME(tid_agg_rx->timeout));
2422 2423 2424 2425

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
2426
		ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
2427 2428 2429 2430 2431 2432 2433
			tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
		ret = 1;
		goto end_reorder;
	}

	/* according to mpdu sequence number deal with reordering buffer */
	mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2434
	ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, status,
2435
						mpdu_seq_num, 0);
2436
 end_reorder:
2437 2438 2439
	return ret;
}

2440 2441 2442 2443 2444 2445 2446 2447
/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
		    struct ieee80211_rx_status *status)
{
	struct ieee80211_local *local = hw_to_local(hw);
2448 2449 2450 2451
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;

	if (status->band < 0 ||
A
Adrian Bunk 已提交
2452
	    status->band >= IEEE80211_NUM_BANDS) {
2453 2454 2455 2456 2457
		WARN_ON(1);
		return;
	}

	sband = local->hw.wiphy->bands[status->band];
2458
	if (!sband) {
2459 2460 2461 2462
		WARN_ON(1);
		return;
	}

2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477
	if (status->flag & RX_FLAG_HT) {
		/* rate_idx is MCS index */
		if (WARN_ON(status->rate_idx < 0 ||
			    status->rate_idx >= 76))
			return;
		/* HT rates are not in the table - use the highest legacy rate
		 * for now since other parts of mac80211 may not yet be fully
		 * MCS aware. */
		rate = &sband->bitrates[sband->n_bitrates - 1];
	} else {
		if (WARN_ON(status->rate_idx < 0 ||
			    status->rate_idx >= sband->n_bitrates))
			return;
		rate = &sband->bitrates[status->rate_idx];
	}
2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491

	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
2492
	skb = ieee80211_rx_monitor(local, skb, status, rate);
2493 2494 2495 2496 2497
	if (!skb) {
		rcu_read_unlock();
		return;
	}

2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509
	/*
	 * In theory, the block ack reordering should happen after duplicate
	 * removal (ieee80211_rx_h_check(), which is an RX handler). As such,
	 * the call to ieee80211_rx_reorder_ampdu() should really be moved to
	 * happen as a new RX handler between ieee80211_rx_h_check and
	 * ieee80211_rx_h_decrypt. This cleanup may eventually happen, but for
	 * the time being, the call can be here since RX reorder buf processing
	 * will implicitly skip duplicates. We could, in theory at least,
	 * process frames that ieee80211_rx_h_passive_scan would drop (e.g.,
	 * frames from other than operational channel), but that should not
	 * happen in normal networks.
	 */
2510
	if (!ieee80211_rx_reorder_ampdu(local, skb, status))
2511
		__ieee80211_rx_handle_packet(hw, skb, status, rate);
2512 2513 2514

	rcu_read_unlock();
}
2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533
EXPORT_SYMBOL(__ieee80211_rx);

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
			  struct ieee80211_rx_status *status)
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->dev = local->mdev;
	/* copy status into skb->cb for use by tasklet */
	memcpy(skb->cb, status, sizeof(*status));
	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);