rx.c 79.6 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

12
#include <linux/jiffies.h>
13
#include <linux/slab.h>
14 15 16 17
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
18
#include <linux/rcupdate.h>
19 20 21 22
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>

#include "ieee80211_i.h"
23
#include "driver-ops.h"
J
Johannes Berg 已提交
24
#include "led.h"
25
#include "mesh.h"
26 27 28 29 30
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"

31 32 33 34 35 36 37
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
J
Johannes Berg 已提交
38
					   struct sk_buff *skb)
39 40 41
{
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
Z
Zhu Yi 已提交
42
			__pskb_trim(skb, skb->len - FCS_LEN);
43 44 45 46 47 48 49 50 51 52 53
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
			skb = NULL;
		}
	}

	return skb;
}

54
static inline int should_drop_frame(struct sk_buff *skb,
J
Johannes Berg 已提交
55
				    int present_fcs_len)
56
{
57
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
58
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
59 60 61

	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		return 1;
J
Johannes Berg 已提交
62
	if (unlikely(skb->len < 16 + present_fcs_len))
63
		return 1;
H
Harvey Harrison 已提交
64 65 66
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
67 68 69 70
		return 1;
	return 0;
}

71 72 73 74 75 76 77 78 79 80 81
static int
ieee80211_rx_radiotap_len(struct ieee80211_local *local,
			  struct ieee80211_rx_status *status)
{
	int len;

	/* always present fields */
	len = sizeof(struct ieee80211_radiotap_header) + 9;

	if (status->flag & RX_FLAG_TSFT)
		len += 8;
J
Johannes Berg 已提交
82
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
83 84 85 86 87 88 89 90
		len += 1;

	if (len & 1) /* padding for RX_FLAGS if necessary */
		len++;

	return len;
}

91
/*
92 93 94 95 96 97 98 99 100 101
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
				 int rtap_len)
{
102
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
103 104
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
105
	u16 rx_flags = 0;
106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
	memset(rthdr, 0, rtap_len);

	/* radiotap header, set always present flags */
	rthdr->it_present =
		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
			    (1 << IEEE80211_RADIOTAP_CHANNEL) |
			    (1 << IEEE80211_RADIOTAP_ANTENNA) |
			    (1 << IEEE80211_RADIOTAP_RX_FLAGS));
	rthdr->it_len = cpu_to_le16(rtap_len);

	pos = (unsigned char *)(rthdr+1);

	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
	if (status->flag & RX_FLAG_TSFT) {
124
		put_unaligned_le64(status->mactime, pos);
125 126 127 128 129 130 131 132
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
133 134
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
135 136
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
137 138 139
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
140 141 142 143 144 145 146 147 148
	if (status->flag & RX_FLAG_HT) {
		/*
		 * TODO: add following information into radiotap header once
		 * suitable fields are defined for it:
		 * - MCS index (status->rate_idx)
		 * - HT40 (status->flag & RX_FLAG_40MHZ)
		 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
		 */
		*pos = 0;
149
	} else {
150
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
151
		*pos = rate->bitrate / 5;
152
	}
153 154 155
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
156
	put_unaligned_le16(status->freq, pos);
157 158
	pos += 2;
	if (status->band == IEEE80211_BAND_5GHZ)
159 160
		put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
				   pos);
J
Johannes Berg 已提交
161 162 163
	else if (status->flag & RX_FLAG_HT)
		put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
				   pos);
164
	else if (rate->flags & IEEE80211_RATE_ERP_G)
165 166
		put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
				   pos);
167
	else
168 169
		put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
				   pos);
170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

	/* IEEE80211_RADIOTAP_ANTENNA */
	*pos = status->antenna;
	pos++;

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
190
	if ((pos - (u8 *)rthdr) & 1)
191
		pos++;
J
Johannes Berg 已提交
192
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
193 194
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
195 196 197
	pos += 2;
}

198 199 200 201 202 203 204
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
205
		     struct ieee80211_rate *rate)
206
{
207
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
208 209 210 211 212 213 214 215 216 217 218 219 220 221
	struct ieee80211_sub_if_data *sdata;
	int needed_headroom = 0;
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
J
Johannes Berg 已提交
222 223 224

	/* room for the radiotap header based on driver features */
	needed_headroom = ieee80211_rx_radiotap_len(local, status);
225 226 227 228

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

Z
Zhu Yi 已提交
229 230 231 232 233 234
	/* make sure hdr->frame_control is on the linear part */
	if (!pskb_may_pull(origskb, 2)) {
		dev_kfree_skb(origskb);
		return NULL;
	}

235
	if (!local->monitors) {
J
Johannes Berg 已提交
236
		if (should_drop_frame(origskb, present_fcs_len)) {
237 238 239 240
			dev_kfree_skb(origskb);
			return NULL;
		}

J
Johannes Berg 已提交
241
		return remove_monitor_info(local, origskb);
242 243
	}

J
Johannes Berg 已提交
244
	if (should_drop_frame(origskb, present_fcs_len)) {
245 246 247 248 249 250 251 252 253 254 255 256
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
257
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
258 259 260 261 262 263 264 265 266 267
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

J
Johannes Berg 已提交
268
		origskb = remove_monitor_info(local, origskb);
269 270 271 272 273

		if (!skb)
			return origskb;
	}

J
Johannes Berg 已提交
274 275
	/* prepend radiotap information */
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
276

277
	skb_reset_mac_header(skb);
278 279 280 281 282
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
283
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
284 285
			continue;

286 287 288
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

289
		if (!ieee80211_sdata_running(sdata))
290 291
			continue;

292 293 294 295
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
296
				netif_receive_skb(skb2);
297 298 299 300 301 302 303 304 305 306
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
307
		netif_receive_skb(skb);
308 309 310 311 312 313 314
	} else
		dev_kfree_skb(skb);

	return origskb;
}


315
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
316
{
317
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
318
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
319 320 321
	int tid;

	/* does the frame have a qos control field? */
322 323
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
324
		/* frame has qos control */
325 326
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
		if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
327
			status->rx_flags |= IEEE80211_RX_AMSDU;
328
	} else {
329 330 331 332 333 334 335 336 337 338 339 340
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
		tid = NUM_RX_DATA_QUEUES - 1;
341
	}
342

343
	rx->queue = tid;
344 345 346
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
347
}
348

349 350 351 352 353 354 355 356 357 358 359
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
360 361 362
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
363 364 365 366 367 368 369 370 371 372 373 374
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
375
{
376 377 378
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
	WARN_ONCE((unsigned long)rx->skb->data & 1,
		  "unaligned packet at 0x%p\n", rx->skb->data);
379
#endif
380 381
}

382

383 384
/* rx handlers */

385
static ieee80211_rx_result debug_noinline
386
ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
387 388
{
	struct ieee80211_local *local = rx->local;
389
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
390 391
	struct sk_buff *skb = rx->skb;

392
	if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
393 394 395
		return RX_CONTINUE;

	if (test_bit(SCAN_HW_SCANNING, &local->scanning))
396
		return ieee80211_scan_rx(rx->sdata, skb);
Z
Zhu Yi 已提交
397

398
	if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
Z
Zhu Yi 已提交
399
		/* drop all the other packets during a software scan anyway */
400
		if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
Z
Zhu Yi 已提交
401
			dev_kfree_skb(skb);
402
		return RX_QUEUED;
403 404
	}

405 406 407
	/* scanning finished during invoking of handlers */
	I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
	return RX_DROP_UNUSABLE;
408 409
}

410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455

static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

	if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
		return 0;

	return ieee80211_is_robust_mgmt_frame(hdr);
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

	if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
		return 0;

	return ieee80211_is_robust_mgmt_frame(hdr);
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;

	if (skb->len < 24 + sizeof(*mmie) ||
	    !is_multicast_ether_addr(hdr->da))
		return -1;

	if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
	if (mmie->element_id != WLAN_EID_MMIE ||
	    mmie->length != sizeof(*mmie) - 2)
		return -1;

	return le16_to_cpu(mmie->key_id);
}


456
static ieee80211_rx_result
457
ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
458
{
459 460
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
461
	char *dev_addr = rx->sdata->vif.addr;
462

463
	if (ieee80211_is_data(hdr->frame_control)) {
464 465 466 467 468 469 470 471 472 473 474 475
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
				!ieee80211_has_fromds(hdr->frame_control))
				return RX_DROP_MONITOR;
			if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
			if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
				return RX_DROP_MONITOR;
		}
476 477 478 479 480 481
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

482
	if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
483
		struct ieee80211_mgmt *mgmt;
484

485
		if (!ieee80211_is_mgmt(hdr->frame_control))
486 487
			return RX_DROP_MONITOR;

488
		if (ieee80211_is_action(hdr->frame_control)) {
489
			mgmt = (struct ieee80211_mgmt *)hdr;
490
			if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
491 492 493 494
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

495 496 497 498 499 500 501 502 503 504 505 506 507
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
		    ieee80211_is_beacon(hdr->frame_control))
			return RX_CONTINUE;

		return RX_DROP_MONITOR;

	}

#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))

	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
508
	    mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
509
		return RX_DROP_MONITOR;
J
Johannes Berg 已提交
510
#undef msh_h_get
511

J
Johannes Berg 已提交
512 513
	return RX_CONTINUE;
}
514

515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535
#define SEQ_MODULO 0x1000
#define SEQ_MASK   0xfff

static inline int seq_less(u16 sq1, u16 sq2)
{
	return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
}

static inline u16 seq_inc(u16 sq)
{
	return (sq + 1) & SEQ_MASK;
}

static inline u16 seq_sub(u16 sq1, u16 sq2)
{
	return (sq1 - sq2) & SEQ_MASK;
}


static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
					    struct tid_ampdu_rx *tid_agg_rx,
536 537
					    int index,
					    struct sk_buff_head *frames)
538 539 540 541 542 543
{
	struct sk_buff *skb = tid_agg_rx->reorder_buf[index];

	if (!skb)
		goto no_frame;

544
	/* release the frame from the reorder ring buffer */
545 546
	tid_agg_rx->stored_mpdu_num--;
	tid_agg_rx->reorder_buf[index] = NULL;
547
	__skb_queue_tail(frames, skb);
548 549 550 551 552 553 554

no_frame:
	tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
}

static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
					     struct tid_ampdu_rx *tid_agg_rx,
555 556
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
557 558 559 560 561 562
{
	int index;

	while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
		index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
							tid_agg_rx->buf_size;
563
		ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
564 565 566 567 568 569 570 571 572
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
573 574
 *
 * Callers must hold tid_agg_rx->reorder_lock.
575 576 577
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

578 579 580 581
static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
{
582
	int index, j;
583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601

	/* release the buffer until next missing frame */
	index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
						tid_agg_rx->buf_size;
	if (!tid_agg_rx->reorder_buf[index] &&
	    tid_agg_rx->stored_mpdu_num > 1) {
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (!tid_agg_rx->reorder_buf[j]) {
				skipped++;
				continue;
			}
			if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
					HT_RX_REORDER_BUF_TIMEOUT))
602
				goto set_release_timer;
603 604 605

#ifdef CONFIG_MAC80211_HT_DEBUG
			if (net_ratelimit())
J
Joe Perches 已提交
606 607
				wiphy_debug(hw->wiphy,
					    "release an RX reorder frame due to timeout on earlier frames\n");
608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623
#endif
			ieee80211_release_reorder_frame(hw, tid_agg_rx,
							j, frames);

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
				(tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
			skipped = 0;
		}
	} else while (tid_agg_rx->reorder_buf[index]) {
		ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
		index =	seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
							tid_agg_rx->buf_size;
	}
624

625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644
	/*
	 * Disable the reorder release timer for now.
	 *
	 * The current implementation lacks a proper locking scheme
	 * which would protect vital statistic and debug counters
	 * from being updated by two different but concurrent BHs.
	 *
	 * More information about the topic is available from:
	 * - thread: http://marc.info/?t=128635927000001
	 *
	 * What was wrong:
	 * =>  http://marc.info/?l=linux-wireless&m=128636170811964
	 * "Basically the thing is that until your patch, the data
	 *  in the struct didn't actually need locking because it
	 *  was accessed by the RX path only which is not concurrent."
	 *
	 * List of what needs to be fixed:
	 * => http://marc.info/?l=linux-wireless&m=128656352920957
	 *

645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662
	if (tid_agg_rx->stored_mpdu_num) {
		j = index = seq_sub(tid_agg_rx->head_seq_num,
				    tid_agg_rx->ssn) % tid_agg_rx->buf_size;

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (tid_agg_rx->reorder_buf[j])
				break;
		}

 set_release_timer:

		mod_timer(&tid_agg_rx->reorder_timer,
			  tid_agg_rx->reorder_time[j] +
			  HT_RX_REORDER_BUF_TIMEOUT);
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
663 664 665 666
	*/

set_release_timer:
	return;
667 668
}

669 670 671 672 673 674 675
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
					     struct tid_ampdu_rx *tid_agg_rx,
676 677
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
678 679 680 681 682 683
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
684
	bool ret = true;
685 686 687 688

	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

689
	spin_lock(&tid_agg_rx->reorder_lock);
690 691 692
	/* frame with out of date sequence number */
	if (seq_less(mpdu_seq_num, head_seq_num)) {
		dev_kfree_skb(skb);
693
		goto out;
694 695 696 697 698 699 700 701 702
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
	if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
		/* release stored frames up to new head to stack */
703 704
		ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num,
						 frames);
705 706 707 708 709 710 711 712 713
	}

	/* Now the new frame is always in the range of the reordering buffer */

	index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;

	/* check if we already stored this frame */
	if (tid_agg_rx->reorder_buf[index]) {
		dev_kfree_skb(skb);
714
		goto out;
715 716 717 718 719 720 721 722 723
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
		tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
724 725
		ret = false;
		goto out;
726 727 728 729 730 731
	}

	/* put the frame in the reordering buffer */
	tid_agg_rx->reorder_buf[index] = skb;
	tid_agg_rx->reorder_time[index] = jiffies;
	tid_agg_rx->stored_mpdu_num++;
732
	ieee80211_sta_reorder_release(hw, tid_agg_rx, frames);
733

734 735 736
 out:
	spin_unlock(&tid_agg_rx->reorder_lock);
	return ret;
737 738 739 740 741 742
}

/*
 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 * true if the MPDU was buffered, false if it should be processed.
 */
743 744
static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
				       struct sk_buff_head *frames)
745
{
746 747
	struct sk_buff *skb = rx->skb;
	struct ieee80211_local *local = rx->local;
748 749
	struct ieee80211_hw *hw = &local->hw;
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
750
	struct sta_info *sta = rx->sta;
751 752 753 754 755
	struct tid_ampdu_rx *tid_agg_rx;
	u16 sc;
	int tid;

	if (!ieee80211_is_data_qos(hdr->frame_control))
756
		goto dont_reorder;
757 758 759 760 761 762 763

	/*
	 * filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation
	 */

	if (!sta)
764
		goto dont_reorder;
765 766 767

	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;

768 769 770
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto dont_reorder;
771 772 773

	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
774
		goto dont_reorder;
775 776 777 778 779 780 781 782 783 784 785

	/* new, potentially un-ordered, ampdu frame - process it */

	/* reset session timer */
	if (tid_agg_rx->timeout)
		mod_timer(&tid_agg_rx->session_timer,
			  TU_TO_EXP_TIME(tid_agg_rx->timeout));

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
786
		skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
787 788
		skb_queue_tail(&rx->sdata->skb_queue, skb);
		ieee80211_queue_work(&local->hw, &rx->sdata->work);
789
		return;
790 791
	}

792 793 794 795 796 797 798 799
	/*
	 * No locking needed -- we will only ever process one
	 * RX packet at a time, and thus own tid_agg_rx. All
	 * other code manipulating it needs to (and does) make
	 * sure that we cannot get to it any more before doing
	 * anything with it.
	 */
	if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
800 801 802 803
		return;

 dont_reorder:
	__skb_queue_tail(frames, skb);
804
}
805

806
static ieee80211_rx_result debug_noinline
807
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
808
{
809
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
810
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
811 812 813

	/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
	if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
814
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
815
			     rx->sta->last_seq_ctrl[rx->queue] ==
816
			     hdr->seq_ctrl)) {
817
			if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
818 819 820
				rx->local->dot11FrameDuplicateCount++;
				rx->sta->num_duplicates++;
			}
J
Johannes Berg 已提交
821
			return RX_DROP_MONITOR;
822
		} else
823
			rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
824 825 826 827
	}

	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
J
Johannes Berg 已提交
828
		return RX_DROP_MONITOR;
829 830 831 832 833
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
834 835
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
836 837 838
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
839

J
Johannes Berg 已提交
840
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
841 842
		return ieee80211_rx_mesh_check(rx);

843 844
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
845
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
B
Bill Jordan 已提交
846
		     rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
847
		     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
848 849 850
		if ((!ieee80211_has_fromds(hdr->frame_control) &&
		     !ieee80211_has_tods(hdr->frame_control) &&
		     ieee80211_is_data(hdr->frame_control)) ||
851
		    !(status->rx_flags & IEEE80211_RX_RA_MATCH)) {
852 853
			/* Drop IBSS frames and frames for other hosts
			 * silently. */
J
Johannes Berg 已提交
854
			return RX_DROP_MONITOR;
855 856
		}

J
Johannes Berg 已提交
857
		return RX_DROP_MONITOR;
858 859
	}

860
	return RX_CONTINUE;
861 862 863
}


864
static ieee80211_rx_result debug_noinline
865
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
866
{
J
Johannes Berg 已提交
867 868 869
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
870 871
	int keyidx;
	int hdrlen;
J
Johannes Berg 已提交
872
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
873
	struct ieee80211_key *sta_ptk = NULL;
874
	int mmie_keyidx = -1;
J
Johannes Berg 已提交
875
	__le16 fc;
876

877 878 879
	/*
	 * Key selection 101
	 *
880
	 * There are four types of keys:
881
	 *  - GTK (group keys)
882
	 *  - IGTK (group keys for management frames)
883 884 885 886 887
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
888 889 890 891
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
892
	 *
893 894 895 896
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
897 898
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
899 900 901
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
902 903 904
	 */

	/*
905
	 * No point in finding a key and decrypting if the frame is neither
906 907
	 * addressed to us nor a multicast frame.
	 */
908
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
909
		return RX_CONTINUE;
910

911 912 913
	/* start without a key */
	rx->key = NULL;

914
	if (rx->sta)
915
		sta_ptk = rcu_dereference(rx->sta->ptk);
916

J
Johannes Berg 已提交
917 918 919
	fc = hdr->frame_control;

	if (!ieee80211_has_protected(fc))
920 921
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

922 923
	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
		rx->key = sta_ptk;
924 925 926
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;
927
		/* Skip decryption if the frame is not protected. */
J
Johannes Berg 已提交
928
		if (!ieee80211_has_protected(fc))
929
			return RX_CONTINUE;
930 931
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
J
Johannes Berg 已提交
932 933
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
934 935 936 937 938
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
939 940 941 942
		if (rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
		if (!rx->key)
			rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
J
Johannes Berg 已提交
943
	} else if (!ieee80211_has_protected(fc)) {
944 945 946 947 948 949 950
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
J
Johannes Berg 已提交
951
		if (ieee80211_is_mgmt(fc) &&
952 953 954 955 956 957
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else if ((key = rcu_dereference(rx->sdata->default_key)))
			rx->key = key;
		return RX_CONTINUE;
958
	} else {
959
		u8 keyid;
960 961 962 963 964 965 966 967 968
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
J
Johannes Berg 已提交
969 970
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
971
			return RX_CONTINUE;
972

J
Johannes Berg 已提交
973
		hdrlen = ieee80211_hdrlen(fc);
974 975

		if (rx->skb->len < 8 + hdrlen)
J
Johannes Berg 已提交
976
			return RX_DROP_UNUSABLE; /* TODO: count this? */
977 978 979 980 981

		/*
		 * no need to call ieee80211_wep_get_keyidx,
		 * it verifies a bunch of things we've done already
		 */
982 983
		skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
		keyidx = keyid >> 6;
984

985 986 987
		/* check per-station GTK first, if multicast packet */
		if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
988

989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003
		/* if not found, try default key */
		if (!rx->key) {
			rx->key = rcu_dereference(rx->sdata->keys[keyidx]);

			/*
			 * RSNA-protected unicast frames should always be
			 * sent with pairwise or station-to-station keys,
			 * but for WEP we allow using a key index as well.
			 */
			if (rx->key &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
			    !is_multicast_ether_addr(hdr->addr1))
				rx->key = NULL;
		}
1004 1005
	}

1006
	if (rx->key) {
1007
		rx->key->tx_rx_count++;
1008
		/* TODO: add threshold stuff again */
1009
	} else {
J
Johannes Berg 已提交
1010
		return RX_DROP_MONITOR;
1011 1012
	}

1013 1014
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;
J
Johannes Berg 已提交
1015
	/* the hdr variable is invalid now! */
1016

1017 1018 1019
	switch (rx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
J
Johannes Berg 已提交
1020 1021 1022 1023 1024 1025 1026
		/* Check for weak IVs if possible */
		if (rx->sta && ieee80211_is_data(fc) &&
		    (!(status->flag & RX_FLAG_IV_STRIPPED) ||
		     !(status->flag & RX_FLAG_DECRYPTED)) &&
		    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
			rx->sta->wep_weak_iv_count++;

1027 1028
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
1029
	case WLAN_CIPHER_SUITE_TKIP:
1030 1031
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
1032
	case WLAN_CIPHER_SUITE_CCMP:
1033 1034
		result = ieee80211_crypto_ccmp_decrypt(rx);
		break;
1035
	case WLAN_CIPHER_SUITE_AES_CMAC:
1036 1037
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
1038 1039 1040 1041 1042 1043
	default:
		/*
		 * We can reach here only with HW-only algorithms
		 * but why didn't it decrypt the frame?!
		 */
		return RX_DROP_UNUSABLE;
1044 1045
	}

1046
	/* either the frame has been decrypted or will be dropped */
J
Johannes Berg 已提交
1047
	status->flag |= RX_FLAG_DECRYPTED;
1048 1049

	return result;
1050 1051
}

1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

1085
static void ap_sta_ps_start(struct sta_info *sta)
1086
{
1087
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1088
	struct ieee80211_local *local = sdata->local;
1089

1090
	atomic_inc(&sdata->bss->num_sta_ps);
1091
	set_sta_flags(sta, WLAN_STA_PS_STA);
J
Johannes Berg 已提交
1092
	drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1093
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1094
	printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
1095
	       sdata->name, sta->sta.addr, sta->sta.aid);
1096 1097 1098
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
}

J
Johannes Berg 已提交
1099
static void ap_sta_ps_end(struct sta_info *sta)
1100
{
1101
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1102

1103
	atomic_dec(&sdata->bss->num_sta_ps);
1104

1105
	clear_sta_flags(sta, WLAN_STA_PS_STA);
1106

1107
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1108
	printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
1109
	       sdata->name, sta->sta.addr, sta->sta.aid);
1110
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1111

1112
	if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
1113
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1114
		printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
1115
		       sdata->name, sta->sta.addr, sta->sta.aid);
1116
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1117 1118 1119 1120
		return;
	}

	ieee80211_sta_ps_deliver_wakeup(sta);
1121 1122
}

1123
static ieee80211_rx_result debug_noinline
1124
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1125 1126
{
	struct sta_info *sta = rx->sta;
J
Johannes Berg 已提交
1127 1128 1129
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1130 1131

	if (!sta)
1132
		return RX_CONTINUE;
1133

J
Johannes Berg 已提交
1134 1135 1136 1137 1138
	/*
	 * Update last_rx only for IBSS packets which are for the current
	 * BSSID to avoid keeping the current IBSS network alive in cases
	 * where other STAs start using different BSSID.
	 */
1139
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1140
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1141
						NL80211_IFTYPE_ADHOC);
1142
		if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
1143
			sta->last_rx = jiffies;
J
Johannes Berg 已提交
1144 1145
	} else if (!is_multicast_ether_addr(hdr->addr1)) {
		/*
1146 1147
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
1148
		 */
J
Johannes Berg 已提交
1149
		sta->last_rx = jiffies;
1150 1151
	}

1152
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1153
		return RX_CONTINUE;
1154

1155 1156 1157
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

1158 1159
	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
J
Johannes Berg 已提交
1160
	sta->last_signal = status->signal;
1161

1162 1163 1164 1165
	/*
	 * Change STA power saving mode only at the end of a frame
	 * exchange sequence.
	 */
1166
	if (!ieee80211_has_morefrags(hdr->frame_control) &&
1167 1168
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1169
		if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
1170 1171 1172 1173 1174 1175 1176 1177 1178 1179
			/*
			 * Ignore doze->wake transitions that are
			 * indicated by non-data frames, the standard
			 * is unclear here, but for example going to
			 * PS mode and then scanning would cause a
			 * doze->wake transition for the probe request,
			 * and that is clearly undesirable.
			 */
			if (ieee80211_is_data(hdr->frame_control) &&
			    !ieee80211_has_pm(hdr->frame_control))
J
Johannes Berg 已提交
1180
				ap_sta_ps_end(sta);
1181 1182 1183 1184
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
				ap_sta_ps_start(sta);
		}
1185 1186
	}

1187 1188 1189 1190 1191 1192
	/*
	 * Drop (qos-)data::nullfunc frames silently, since they
	 * are used only to control station power saving mode.
	 */
	if (ieee80211_is_nullfunc(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1193
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205

		/*
		 * If we receive a 4-addr nullfunc frame from a STA
		 * that was not moved to a 4-addr STA vlan yet, drop
		 * the frame to the monitor interface, to make sure
		 * that hostapd sees it
		 */
		if (ieee80211_has_a4(hdr->frame_control) &&
		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
		      !rx->sdata->u.vlan.sta)))
			return RX_DROP_MONITOR;
1206 1207 1208 1209
		/*
		 * Update counter and free packet here to avoid
		 * counting this as a dropped packed.
		 */
1210 1211
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
1212
		return RX_QUEUED;
1213 1214
	}

1215
	return RX_CONTINUE;
1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231
} /* ieee80211_rx_h_sta_process */

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;
	int idx;

	idx = sdata->fragment_next;
	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

	if (!skb_queue_empty(&entry->skb_list)) {
1232
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1233 1234 1235 1236
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) entry->skb_list.next->data;
		printk(KERN_DEBUG "%s: RX reassembly removed oldest "
		       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
1237
		       "addr1=%pM addr2=%pM\n",
1238
		       sdata->name, idx,
1239
		       jiffies - entry->first_frag_time, entry->seq,
1240
		       entry->last_frag, hdr->addr1, hdr->addr2);
1241
#endif
1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258
		__skb_queue_purge(&entry->skb_list);
	}

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1259
			  unsigned int frag, unsigned int seq,
1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

1279
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1280

1281 1282 1283 1284 1285
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1286 1287 1288 1289
		    compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
		    compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
			continue;

1290
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1291 1292 1293 1294 1295 1296 1297 1298 1299
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1300
static ieee80211_rx_result debug_noinline
1301
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1302 1303 1304
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1305
	__le16 fc;
1306 1307 1308
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
1309
	struct ieee80211_rx_status *status;
1310

1311
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1312
	fc = hdr->frame_control;
1313 1314 1315
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1316
	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1317 1318 1319 1320 1321 1322 1323
		   (rx->skb)->len < 24 ||
		   is_multicast_ether_addr(hdr->addr1))) {
		/* not fragmented */
		goto out;
	}
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

Z
Zhu Yi 已提交
1324 1325 1326
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;

1327 1328 1329 1330 1331 1332
	/*
	 *  skb_linearize() might change the skb->data and
	 *  previously cached variables (in this case, hdr) need to
	 *  be refreshed with the new data.
	 */
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1333 1334 1335 1336 1337
	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1338
						 rx->queue, &(rx->skb));
1339
		if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1340
		    ieee80211_has_protected(fc)) {
1341 1342
			int queue = ieee80211_is_mgmt(fc) ?
				NUM_RX_DATA_QUEUES : rx->queue;
1343 1344 1345 1346
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
1347
			       rx->key->u.ccmp.rx_pn[queue],
1348 1349
			       CCMP_PN_LEN);
		}
1350
		return RX_QUEUED;
1351 1352 1353 1354 1355
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
1356
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
1357 1358
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
1359
		return RX_DROP_MONITOR;
1360 1361 1362 1363 1364 1365 1366
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
		u8 pn[CCMP_PN_LEN], *rpn;
1367
		int queue;
1368
		if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
J
Johannes Berg 已提交
1369
			return RX_DROP_UNUSABLE;
1370 1371 1372 1373 1374 1375
		memcpy(pn, entry->last_pn, CCMP_PN_LEN);
		for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
			pn[i]++;
			if (pn[i])
				break;
		}
1376 1377 1378
		queue = ieee80211_is_mgmt(fc) ?
			NUM_RX_DATA_QUEUES : rx->queue;
		rpn = rx->key->u.ccmp.rx_pn[queue];
1379
		if (memcmp(pn, rpn, CCMP_PN_LEN))
J
Johannes Berg 已提交
1380
			return RX_DROP_UNUSABLE;
1381 1382 1383
		memcpy(entry->last_pn, pn, CCMP_PN_LEN);
	}

1384
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
1385 1386 1387
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
1388
	if (ieee80211_has_morefrags(fc)) {
1389
		rx->skb = NULL;
1390
		return RX_QUEUED;
1391 1392 1393 1394 1395 1396 1397 1398 1399
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
1400
			return RX_DROP_UNUSABLE;
1401 1402 1403 1404 1405 1406 1407 1408
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
1409 1410
	status = IEEE80211_SKB_RXCB(rx->skb);
	status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1411 1412 1413 1414 1415 1416 1417 1418

 out:
	if (rx->sta)
		rx->sta->rx_packets++;
	if (is_multicast_ether_addr(hdr->addr1))
		rx->local->dot11MulticastReceivedFrameCount++;
	else
		ieee80211_led_rx(rx->local);
1419
	return RX_CONTINUE;
1420 1421
}

1422
static ieee80211_rx_result debug_noinline
1423
ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1424
{
1425
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1426
	__le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1427
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1428

1429
	if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1430
		   !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
1431
		return RX_CONTINUE;
1432

1433 1434
	if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
J
Johannes Berg 已提交
1435
		return RX_DROP_UNUSABLE;
1436

1437 1438 1439 1440
	if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
		ieee80211_sta_ps_deliver_poll_response(rx->sta);
	else
		set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1441

1442
	/* Free PS Poll skb here instead of returning RX_DROP that would
1443 1444 1445
	 * count as an dropped frame. */
	dev_kfree_skb(rx->skb);

1446
	return RX_QUEUED;
1447 1448
}

1449
static ieee80211_rx_result debug_noinline
1450
ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1451 1452
{
	u8 *data = rx->skb->data;
1453
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1454

1455
	if (!ieee80211_is_data_qos(hdr->frame_control))
1456
		return RX_CONTINUE;
1457 1458

	/* remove the qos control field, update frame type and meta-data */
1459 1460 1461
	memmove(data + IEEE80211_QOS_CTL_LEN, data,
		ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
	hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1462
	/* change frame type to non QOS */
1463
	hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1464

1465
	return RX_CONTINUE;
1466 1467
}

1468
static int
1469
ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1470
{
1471
	if (unlikely(!rx->sta ||
1472
	    !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1473
		return -EACCES;
1474

1475
	return 0;
1476 1477
}

1478
static int
1479
ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1480
{
J
Johannes Berg 已提交
1481 1482 1483
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

1484
	/*
1485 1486
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
1487
	 */
J
Johannes Berg 已提交
1488
	if (status->flag & RX_FLAG_DECRYPTED)
1489
		return 0;
1490 1491

	/* Drop unencrypted frames if key is set. */
1492 1493
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
1494
		     ieee80211_is_data(fc) &&
1495
		     (rx->key || rx->sdata->drop_unencrypted)))
1496
		return -EACCES;
1497 1498 1499 1500 1501 1502 1503 1504

	return 0;
}

static int
ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1505
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1506 1507
	__le16 fc = hdr->frame_control;

1508 1509 1510 1511 1512 1513
	/*
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
	 */
	if (status->flag & RX_FLAG_DECRYPTED)
		return 0;
1514

1515
	if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1516 1517
		if (unlikely(!ieee80211_has_protected(fc) &&
			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1518 1519 1520
			     rx->key))
			return -EACCES;
		/* BIP does not use Protected field, so need to check MMIE */
1521
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1522
			     ieee80211_get_mmie_keyidx(rx->skb) < 0))
1523 1524 1525 1526 1527 1528 1529 1530 1531 1532
			return -EACCES;
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
			     ieee80211_is_robust_mgmt_frame(
				     (struct ieee80211_hdr *) rx->skb->data)))
			return -EACCES;
	}
1533

1534
	return 0;
1535 1536
}

1537
static int
1538
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1539
{
J
Johannes Berg 已提交
1540
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1541 1542
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;

1543 1544
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1545
		return -1;
1546 1547 1548 1549

	if (is_multicast_ether_addr(hdr->addr1) &&
	    ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) ||
	     (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
1550
		return -1;
1551

1552
	return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1553
}
1554

1555 1556 1557
/*
 * requires that rx->skb is a frame with ethernet header
 */
1558
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1559
{
1560
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1561 1562 1563 1564 1565 1566 1567
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
1568
	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1569
	    (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
1570 1571 1572 1573
	     compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
1574
	    ieee80211_drop_unencrypted(rx, fc))
1575 1576 1577 1578 1579 1580 1581 1582
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
1583
static void
1584
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1585
{
J
Johannes Berg 已提交
1586 1587
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct net_device *dev = sdata->dev;
1588
	struct sk_buff *skb, *xmit_skb;
1589 1590
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
1591
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1592

1593 1594
	skb = rx->skb;
	xmit_skb = NULL;
1595

1596 1597
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1598
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1599
	    (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1600
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1601 1602 1603 1604 1605
		if (is_multicast_ether_addr(ehdr->h_dest)) {
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
1606 1607
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
			if (!xmit_skb && net_ratelimit())
1608 1609 1610
				printk(KERN_DEBUG "%s: failed to clone "
				       "multicast frame\n", dev->name);
		} else {
1611 1612
			dsta = sta_info_get(sdata, skb->data);
			if (dsta) {
1613 1614 1615 1616 1617
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
1618
				 */
1619
				xmit_skb = skb;
1620 1621 1622 1623 1624 1625
				skb = NULL;
			}
		}
	}

	if (skb) {
1626 1627
		int align __maybe_unused;

1628
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1629 1630 1631 1632 1633 1634 1635
		/*
		 * 'align' will only take the values 0 or 2 here
		 * since all frames are required to be aligned
		 * to 2-byte boundaries when being passed to
		 * mac80211. That also explains the __skb_push()
		 * below.
		 */
1636
		align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
1637 1638 1639 1640 1641 1642
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
1643 1644 1645 1646
				size_t len = skb_headlen(skb);
				skb->data -= align;
				memmove(skb->data, data, len);
				skb_set_tail_pointer(skb, len);
1647 1648 1649 1650 1651 1652 1653 1654
			}
		}
#endif

		if (skb) {
			/* deliver to local stack */
			skb->protocol = eth_type_trans(skb, dev);
			memset(skb->cb, 0, sizeof(skb->cb));
1655
			netif_receive_skb(skb);
1656
		}
1657 1658
	}

1659
	if (xmit_skb) {
1660
		/* send to wireless media */
1661
		xmit_skb->protocol = htons(ETH_P_802_3);
1662 1663
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
1664
		dev_queue_xmit(xmit_skb);
1665
	}
1666 1667
}

1668
static ieee80211_rx_result debug_noinline
1669
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1670
{
J
Johannes Berg 已提交
1671
	struct net_device *dev = rx->sdata->dev;
Z
Zhu Yi 已提交
1672
	struct sk_buff *skb = rx->skb;
1673 1674
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
Z
Zhu Yi 已提交
1675
	struct sk_buff_head frame_list;
1676
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1677

1678
	if (unlikely(!ieee80211_is_data(fc)))
1679
		return RX_CONTINUE;
1680

1681
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
1682
		return RX_DROP_MONITOR;
1683

1684
	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1685
		return RX_CONTINUE;
1686

Z
Zhu Yi 已提交
1687 1688 1689
	if (ieee80211_has_a4(hdr->frame_control) &&
	    rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    !rx->sdata->u.vlan.sta)
J
Johannes Berg 已提交
1690
		return RX_DROP_UNUSABLE;
1691

Z
Zhu Yi 已提交
1692 1693 1694 1695 1696
	if (is_multicast_ether_addr(hdr->addr1) &&
	    ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	      rx->sdata->u.vlan.sta) ||
	     (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
	      rx->sdata->u.mgd.use_4addr)))
J
Johannes Berg 已提交
1697
		return RX_DROP_UNUSABLE;
1698

Z
Zhu Yi 已提交
1699 1700
	skb->dev = dev;
	__skb_queue_head_init(&frame_list);
1701

Z
Zhu Yi 已提交
1702 1703 1704
	if (skb_linearize(skb))
		return RX_DROP_UNUSABLE;

Z
Zhu Yi 已提交
1705 1706 1707
	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
				 rx->sdata->vif.type,
				 rx->local->hw.extra_tx_headroom);
1708

Z
Zhu Yi 已提交
1709 1710
	while (!skb_queue_empty(&frame_list)) {
		rx->skb = __skb_dequeue(&frame_list);
1711

1712
		if (!ieee80211_frame_allowed(rx, fc)) {
Z
Zhu Yi 已提交
1713
			dev_kfree_skb(rx->skb);
1714 1715
			continue;
		}
Z
Zhu Yi 已提交
1716 1717
		dev->stats.rx_packets++;
		dev->stats.rx_bytes += rx->skb->len;
1718 1719 1720 1721

		ieee80211_deliver_skb(rx);
	}

1722
	return RX_QUEUED;
1723 1724
}

I
Ingo Molnar 已提交
1725
#ifdef CONFIG_MAC80211_MESH
1726
static ieee80211_rx_result
1727 1728 1729 1730 1731 1732
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
	struct ieee80211_hdr *hdr;
	struct ieee80211s_hdr *mesh_hdr;
	unsigned int hdrlen;
	struct sk_buff *skb = rx->skb, *fwd_skb;
J
Johannes Berg 已提交
1733
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
1734
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1735
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		/* illegal frame */
		return RX_DROP_MONITOR;

1748
	if (mesh_hdr->flags & MESH_FLAGS_AE) {
1749
		struct mesh_path *mppath;
1750 1751 1752 1753 1754 1755 1756 1757 1758 1759
		char *proxied_addr;
		char *mpp_addr;

		if (is_multicast_ether_addr(hdr->addr1)) {
			mpp_addr = hdr->addr3;
			proxied_addr = mesh_hdr->eaddr1;
		} else {
			mpp_addr = hdr->addr4;
			proxied_addr = mesh_hdr->eaddr2;
		}
1760 1761

		rcu_read_lock();
1762
		mppath = mpp_path_lookup(proxied_addr, sdata);
1763
		if (!mppath) {
1764
			mpp_path_add(proxied_addr, mpp_addr, sdata);
1765 1766
		} else {
			spin_lock_bh(&mppath->state_lock);
1767 1768
			if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
1769 1770 1771 1772 1773
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

1774 1775
	/* Frame has reached destination.  Don't forward */
	if (!is_multicast_ether_addr(hdr->addr1) &&
1776
	    compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
1777 1778 1779 1780
		return RX_CONTINUE;

	mesh_hdr->ttl--;

1781
	if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1782
		if (!mesh_hdr->ttl)
1783
			IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1784 1785 1786
						     dropped_frames_ttl);
		else {
			struct ieee80211_hdr *fwd_hdr;
J
Johannes Berg 已提交
1787 1788
			struct ieee80211_tx_info *info;

1789 1790 1791 1792
			fwd_skb = skb_copy(skb, GFP_ATOMIC);

			if (!fwd_skb && net_ratelimit())
				printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1793
						   sdata->name);
1794 1795

			fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
1796
			memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
J
Johannes Berg 已提交
1797 1798 1799
			info = IEEE80211_SKB_CB(fwd_skb);
			memset(info, 0, sizeof(*info));
			info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1800
			info->control.vif = &rx->sdata->vif;
1801 1802 1803
			skb_set_queue_mapping(skb,
				ieee80211_select_queue(rx->sdata, fwd_skb));
			ieee80211_set_qos_hdr(local, skb);
1804 1805 1806 1807
			if (is_multicast_ether_addr(fwd_hdr->addr1))
				IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
								fwded_mcast);
			else {
1808 1809 1810 1811 1812 1813
				int err;
				/*
				 * Save TA to addr1 to send TA a path error if a
				 * suitable next hop is not found
				 */
				memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
1814
						ETH_ALEN);
1815
				err = mesh_nexthop_lookup(fwd_skb, sdata);
1816 1817 1818 1819 1820
				/* Failed to immediately resolve next hop:
				 * fwded frame was dropped or will be added
				 * later to the pending skb queue.  */
				if (err)
					return RX_DROP_MONITOR;
1821 1822 1823

				IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
								fwded_unicast);
1824 1825 1826
			}
			IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
						     fwded_frames);
J
Johannes Berg 已提交
1827
			ieee80211_add_pending_skb(local, fwd_skb);
1828 1829 1830
		}
	}

1831
	if (is_multicast_ether_addr(hdr->addr1) ||
J
Johannes Berg 已提交
1832
	    sdata->dev->flags & IFF_PROMISC)
1833 1834 1835 1836
		return RX_CONTINUE;
	else
		return RX_DROP_MONITOR;
}
I
Ingo Molnar 已提交
1837
#endif
1838

1839
static ieee80211_rx_result debug_noinline
1840
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1841
{
J
Johannes Berg 已提交
1842
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1843
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
1844
	struct net_device *dev = sdata->dev;
1845 1846
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
1847
	int err;
1848

1849
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1850
		return RX_CONTINUE;
1851

1852
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
1853
		return RX_DROP_MONITOR;
1854

1855 1856 1857 1858 1859 1860 1861 1862
	/*
	 * Allow the cooked monitor interface of an AP to see 4-addr frames so
	 * that a 4-addr station can be detected and moved into a separate VLAN
	 */
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP)
		return RX_DROP_MONITOR;

1863
	err = __ieee80211_data_to_8023(rx);
1864
	if (unlikely(err))
J
Johannes Berg 已提交
1865
		return RX_DROP_UNUSABLE;
1866

1867
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
1868
		return RX_DROP_MONITOR;
1869

1870 1871 1872 1873 1874
	rx->skb->dev = dev;

	dev->stats.rx_packets++;
	dev->stats.rx_bytes += rx->skb->len;

1875 1876 1877 1878 1879 1880 1881
	if (ieee80211_is_data(hdr->frame_control) &&
	    !is_multicast_ether_addr(hdr->addr1) &&
	    local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
			mod_timer(&local->dynamic_ps_timer, jiffies +
			 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
	}

1882
	ieee80211_deliver_skb(rx);
1883

1884
	return RX_QUEUED;
1885 1886
}

1887
static ieee80211_rx_result debug_noinline
1888
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
1889 1890 1891 1892
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_hw *hw = &local->hw;
	struct sk_buff *skb = rx->skb;
1893
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1894 1895 1896 1897
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

1898
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
1899
		return RX_CONTINUE;
1900

1901
	if (ieee80211_is_back_req(bar->frame_control)) {
1902 1903 1904 1905
		struct {
			__le16 control, start_seq_num;
		} __packed bar_data;

1906
		if (!rx->sta)
1907
			return RX_DROP_MONITOR;
1908 1909 1910 1911 1912 1913

		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
				  &bar_data, sizeof(bar_data)))
			return RX_DROP_MONITOR;

		tid = le16_to_cpu(bar_data.control) >> 12;
1914 1915 1916

		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
		if (!tid_agg_rx)
1917
			return RX_DROP_MONITOR;
1918

1919
		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
1920 1921

		/* reset session timer */
1922 1923 1924
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
1925

1926
		/* release stored frames up to start of BAR */
1927 1928
		ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
						 frames);
1929 1930
		kfree_skb(skb);
		return RX_QUEUED;
1931 1932
	}

1933 1934 1935 1936 1937 1938
	/*
	 * After this point, we only want management frames,
	 * so we can drop all remaining control frames to
	 * cooked monitor interfaces.
	 */
	return RX_DROP_MONITOR;
1939 1940
}

1941 1942 1943
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
1944 1945 1946 1947 1948
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

1949
	if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
1950 1951 1952 1953
		/* Not to own unicast address */
		return;
	}

1954 1955
	if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
	    compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
1956
		/* Not from the current AP or not associated yet. */
1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(resp, 0, 24);
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
1973
	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
1974
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
1975 1976 1977 1978 1979 1980 1981 1982 1983
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

1984
	ieee80211_tx_skb(sdata, skb);
1985 1986
}

1987 1988 1989 1990
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1991
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003

	/*
	 * From here on, look only at management frames.
	 * Data and control frames are already handled,
	 * and unknown (reserved) frames are useless.
	 */
	if (rx->skb->len < 24)
		return RX_DROP_MONITOR;

	if (!ieee80211_is_mgmt(mgmt->frame_control))
		return RX_DROP_MONITOR;

2004
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2005 2006 2007 2008 2009 2010 2011 2012
		return RX_DROP_MONITOR;

	if (ieee80211_drop_unencrypted_mgmt(rx))
		return RX_DROP_UNUSABLE;

	return RX_CONTINUE;
}

2013 2014 2015 2016
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2017
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2018
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2019
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2020 2021 2022 2023 2024
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

2025 2026
	/* drop too small frames */
	if (len < IEEE80211_MIN_ACTION_SIZE)
2027
		return RX_DROP_UNUSABLE;
2028

2029
	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
2030
		return RX_DROP_UNUSABLE;
2031

2032
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2033
		return RX_DROP_UNUSABLE;
2034

2035 2036
	switch (mgmt->u.action.category) {
	case WLAN_CATEGORY_BACK:
2037 2038 2039 2040 2041 2042 2043 2044 2045
		/*
		 * The aggregation code is not prepared to handle
		 * anything but STA/AP due to the BSSID handling;
		 * IBSS could work in the code but isn't supported
		 * by drivers or the standard.
		 */
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP)
2046
			break;
2047

2048 2049 2050 2051
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2052 2053 2054 2055
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
2056 2057
				goto invalid;
			break;
2058 2059 2060
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
2061 2062
				goto invalid;
			break;
2063 2064 2065
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
2066 2067 2068 2069
				goto invalid;
			break;
		default:
			goto invalid;
2070
		}
2071

2072
		goto queue;
2073 2074
	case WLAN_CATEGORY_SPECTRUM_MGMT:
		if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2075
			break;
2076 2077

		if (sdata->vif.type != NL80211_IFTYPE_STATION)
2078
			break;
2079

2080 2081 2082 2083
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2084 2085 2086 2087
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
2088
				break;
2089
			ieee80211_process_measurement_req(sdata, mgmt, len);
2090
			goto handled;
S
Sujith 已提交
2091 2092 2093
		case WLAN_ACTION_SPCT_CHL_SWITCH:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
2094
				break;
S
Sujith 已提交
2095

2096
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2097
				break;
2098

2099
			if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
2100
				break;
S
Sujith 已提交
2101

2102
			goto queue;
2103 2104
		}
		break;
2105 2106 2107
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
2108 2109
			break;

2110 2111 2112
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2113
				break;
2114
			ieee80211_process_sa_query_req(sdata, mgmt, len);
2115
			goto handled;
2116 2117
		}
		break;
2118 2119
	case WLAN_CATEGORY_MESH_PLINK:
	case WLAN_CATEGORY_MESH_PATH_SEL:
2120 2121
		if (!ieee80211_vif_is_mesh(&sdata->vif))
			break;
2122
		goto queue;
2123
	}
2124

2125 2126
	return RX_CONTINUE;

2127
 invalid:
2128
	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149
	/* will return in the next handlers */
	return RX_CONTINUE;

 handled:
	if (rx->sta)
		rx->sta->rx_packets++;
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;

 queue:
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
	if (rx->sta)
		rx->sta->rx_packets++;
	return RX_QUEUED;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
{
2150
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2151 2152

	/* skip known-bad action frames and return them in the next handler */
2153
	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2154
		return RX_CONTINUE;
2155

2156 2157 2158 2159 2160 2161 2162
	/*
	 * Getting here means the kernel doesn't know how to handle
	 * it, but maybe userspace does ... include returned frames
	 * so userspace can register for those to know whether ones
	 * it transmitted were processed or returned.
	 */

2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182
	if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
			     rx->skb->data, rx->skb->len,
			     GFP_ATOMIC)) {
		if (rx->sta)
			rx->sta->rx_packets++;
		dev_kfree_skb(rx->skb);
		return RX_QUEUED;
	}


	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
	struct sk_buff *nskb;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2183
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	/*
	 * For AP mode, hostapd is responsible for handling any action
	 * frames that we didn't handle, including returning unknown
	 * ones. For all other modes we will return them to the sender,
	 * setting the 0x80 bit in the action category, as required by
	 * 802.11-2007 7.3.1.11.
	 * Newer versions of hostapd shall also use the management frame
	 * registration mechanisms, but older ones still use cooked
	 * monitor interfaces so push all frames there.
	 */
2198
	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2199 2200 2201
	    (sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
		return RX_DROP_MONITOR;
2202

2203 2204 2205 2206 2207 2208 2209
	/* do not return rejected action frames */
	if (mgmt->u.action.category & 0x80)
		return RX_DROP_UNUSABLE;

	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
			       GFP_ATOMIC);
	if (nskb) {
2210
		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2211

2212 2213 2214
		nmgmt->u.action.category |= 0x80;
		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2215 2216 2217 2218

		memset(nskb->cb, 0, sizeof(nskb->cb));

		ieee80211_tx_skb(rx->sdata, nskb);
2219
	}
2220 2221
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
2222 2223
}

2224
static ieee80211_rx_result debug_noinline
2225
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2226
{
J
Johannes Berg 已提交
2227
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
2228
	ieee80211_rx_result rxs;
2229 2230
	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
	__le16 stype;
2231

J
Johannes Berg 已提交
2232 2233 2234 2235
	rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
	if (rxs != RX_CONTINUE)
		return rxs;

2236
	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2237

2238 2239 2240 2241
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
	    sdata->vif.type != NL80211_IFTYPE_STATION)
		return RX_DROP_MONITOR;
2242

2243 2244 2245 2246 2247 2248 2249
	switch (stype) {
	case cpu_to_le16(IEEE80211_STYPE_BEACON):
	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
		/* process for all: mesh, mlme, ibss */
		break;
	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2250 2251 2252 2253
		if (is_multicast_ether_addr(mgmt->da) &&
		    !is_broadcast_ether_addr(mgmt->da))
			return RX_DROP_MONITOR;

2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266
		/* process only for station */
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;
		break;
	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
	case cpu_to_le16(IEEE80211_STYPE_AUTH):
		/* process only for ibss */
		if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
			return RX_DROP_MONITOR;
		break;
	default:
		return RX_DROP_MONITOR;
	}
2267

2268
	/* queue up frame and kick off work to process it */
2269
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2270 2271
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&rx->local->hw, &sdata->work);
2272 2273
	if (rx->sta)
		rx->sta->rx_packets++;
2274

2275
	return RX_QUEUED;
2276 2277
}

J
Johannes Berg 已提交
2278
static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
2279
					    struct ieee80211_rx_data *rx)
2280
{
2281 2282
	int keyidx;
	unsigned int hdrlen;
2283

2284
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
2285 2286 2287 2288 2289
	if (rx->skb->len >= hdrlen + 4)
		keyidx = rx->skb->data[hdrlen + 3] >> 6;
	else
		keyidx = -1;

2290
	if (!rx->sta) {
2291 2292 2293 2294
		/*
		 * Some hardware seem to generate incorrect Michael MIC
		 * reports; ignore them to avoid triggering countermeasures.
		 */
2295
		return;
2296 2297
	}

2298
	if (!ieee80211_has_protected(hdr->frame_control))
2299
		return;
2300

2301
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
2302 2303 2304 2305 2306 2307
		/*
		 * APs with pairwise keys should never receive Michael MIC
		 * errors for non-zero keyidx because these are reserved for
		 * group keys and only the AP is sending real multicast
		 * frames in the BSS.
		 */
2308
		return;
2309 2310
	}

2311 2312
	if (!ieee80211_is_data(hdr->frame_control) &&
	    !ieee80211_is_auth(hdr->frame_control))
2313
		return;
2314

2315 2316
	mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
					GFP_ATOMIC);
2317 2318
}

2319
/* TODO: use IEEE80211_RX_FRAGMENTED */
J
Johannes Berg 已提交
2320 2321
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
					struct ieee80211_rate *rate)
2322 2323 2324 2325 2326 2327
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct ieee80211_rtap_hdr {
		struct ieee80211_radiotap_header hdr;
		u8 flags;
J
Johannes Berg 已提交
2328
		u8 rate_or_pad;
2329 2330
		__le16 chan_freq;
		__le16 chan_flags;
E
Eric Dumazet 已提交
2331
	} __packed *rthdr;
2332 2333
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
J
Johannes Berg 已提交
2334
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2335

2336 2337 2338 2339 2340
	/*
	 * If cooked monitor has been processed already, then
	 * don't do it again. If not, set the flag.
	 */
	if (rx->flags & IEEE80211_RX_CMNTR)
2341
		goto out_free_skb;
2342
	rx->flags |= IEEE80211_RX_CMNTR;
2343

2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354
	if (skb_headroom(skb) < sizeof(*rthdr) &&
	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
		goto out_free_skb;

	rthdr = (void *)skb_push(skb, sizeof(*rthdr));
	memset(rthdr, 0, sizeof(*rthdr));
	rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
	rthdr->hdr.it_present =
		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
			    (1 << IEEE80211_RADIOTAP_CHANNEL));

J
Johannes Berg 已提交
2355 2356 2357 2358 2359
	if (rate) {
		rthdr->rate_or_pad = rate->bitrate / 5;
		rthdr->hdr.it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
	}
2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374
	rthdr->chan_freq = cpu_to_le16(status->freq);

	if (status->band == IEEE80211_BAND_5GHZ)
		rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
						IEEE80211_CHAN_5GHZ);
	else
		rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
						IEEE80211_CHAN_2GHZ);

	skb_set_mac_header(skb, 0);
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2375
		if (!ieee80211_sdata_running(sdata))
2376 2377
			continue;

2378
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2379 2380 2381 2382 2383 2384 2385
		    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
2386
				netif_receive_skb(skb2);
2387 2388 2389 2390 2391 2392 2393 2394 2395 2396
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
2397
		netif_receive_skb(skb);
2398 2399
		return;
	}
2400 2401 2402 2403 2404

 out_free_skb:
	dev_kfree_skb(skb);
}

2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438
static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
					 ieee80211_rx_result res)
{
	switch (res) {
	case RX_DROP_MONITOR:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		/* fall through */
	case RX_CONTINUE: {
		struct ieee80211_rate *rate = NULL;
		struct ieee80211_supported_band *sband;
		struct ieee80211_rx_status *status;

		status = IEEE80211_SKB_RXCB((rx->skb));

		sband = rx->local->hw.wiphy->bands[status->band];
		if (!(status->flag & RX_FLAG_HT))
			rate = &sband->bitrates[status->rate_idx];

		ieee80211_rx_cooked_monitor(rx, rate);
		break;
		}
	case RX_DROP_UNUSABLE:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		dev_kfree_skb(rx->skb);
		break;
	case RX_QUEUED:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
		break;
	}
}
2439

2440 2441
static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
				  struct sk_buff_head *frames)
2442 2443
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
2444
	struct sk_buff *skb;
2445

2446 2447 2448 2449
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
2450
			goto rxh_next;  \
2451
	} while (0);
2452

2453
	while ((skb = __skb_dequeue(frames))) {
2454 2455 2456 2457 2458 2459
		/*
		 * all the other fields are valid across frames
		 * that belong to an aMPDU since they are on the
		 * same TID from the same station
		 */
		rx->skb = skb;
2460
		rx->flags = 0;
2461 2462 2463 2464 2465 2466 2467 2468 2469 2470

		CALL_RXH(ieee80211_rx_h_decrypt)
		CALL_RXH(ieee80211_rx_h_check_more_data)
		CALL_RXH(ieee80211_rx_h_sta_process)
		CALL_RXH(ieee80211_rx_h_defragment)
		CALL_RXH(ieee80211_rx_h_ps_poll)
		CALL_RXH(ieee80211_rx_h_michael_mic_verify)
		/* must be after MMIC verify so header is counted in MPDU mic */
		CALL_RXH(ieee80211_rx_h_remove_qos_control)
		CALL_RXH(ieee80211_rx_h_amsdu)
I
Ingo Molnar 已提交
2471
#ifdef CONFIG_MAC80211_MESH
2472
		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2473
			CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
2474
#endif
2475 2476 2477
		CALL_RXH(ieee80211_rx_h_data)

		/* special treatment -- needs the queue */
2478
		res = ieee80211_rx_h_ctrl(rx, frames);
2479 2480 2481
		if (res != RX_CONTINUE)
			goto rxh_next;

2482
		CALL_RXH(ieee80211_rx_h_mgmt_check)
2483
		CALL_RXH(ieee80211_rx_h_action)
2484 2485
		CALL_RXH(ieee80211_rx_h_userspace_mgmt)
		CALL_RXH(ieee80211_rx_h_action_return)
2486
		CALL_RXH(ieee80211_rx_h_mgmt)
2487

2488 2489 2490
 rxh_next:
		ieee80211_rx_handlers_result(rx, res);

2491
#undef CALL_RXH
2492 2493 2494
	}
}

2495
static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515
{
	struct sk_buff_head reorder_release;
	ieee80211_rx_result res = RX_DROP_MONITOR;

	__skb_queue_head_init(&reorder_release);

#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
	} while (0);

	CALL_RXH(ieee80211_rx_h_passive_scan)
	CALL_RXH(ieee80211_rx_h_check)

	ieee80211_rx_reorder_ampdu(rx, &reorder_release);

	ieee80211_rx_handlers(rx, &reorder_release);
	return;
2516

2517
 rxh_next:
2518 2519 2520
	ieee80211_rx_handlers_result(rx, res);

#undef CALL_RXH
2521 2522
}

2523 2524 2525 2526 2527 2528 2529 2530
/*
 * This function makes calls into the RX path. Therefore the
 * caller must hold the sta_info->lock and everything has to
 * be under rcu_read_lock protection as well.
 */
void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
{
	struct sk_buff_head frames;
2531 2532 2533 2534 2535 2536
	struct ieee80211_rx_data rx = {
		.sta = sta,
		.sdata = sta->sdata,
		.local = sta->local,
		.queue = tid,
	};
2537 2538 2539 2540 2541
	struct tid_ampdu_rx *tid_agg_rx;

	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		return;
2542 2543 2544

	__skb_queue_head_init(&frames);

2545 2546 2547
	spin_lock(&tid_agg_rx->reorder_lock);
	ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx, &frames);
	spin_unlock(&tid_agg_rx->reorder_lock);
2548 2549 2550 2551

	ieee80211_rx_handlers(&rx, &frames);
}

2552 2553
/* main receive path */

2554
static int prepare_for_handlers(struct ieee80211_rx_data *rx,
2555 2556
				struct ieee80211_hdr *hdr)
{
2557
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
2558 2559 2560
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
2561 2562
	int multicast = is_multicast_ether_addr(hdr->addr1);

2563
	switch (sdata->vif.type) {
2564
	case NL80211_IFTYPE_STATION:
2565
		if (!bssid && !sdata->u.mgd.use_4addr)
2566
			return 0;
2567
		if (!multicast &&
2568
		    compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
2569
			if (!(sdata->dev->flags & IFF_PROMISC))
2570
				return 0;
2571
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2572 2573
		}
		break;
2574
	case NL80211_IFTYPE_ADHOC:
2575 2576
		if (!bssid)
			return 0;
2577
		if (ieee80211_is_beacon(hdr->frame_control)) {
B
Bruno Randolf 已提交
2578
			return 1;
2579
		}
2580
		else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2581
			if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2582
				return 0;
2583
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2584
		} else if (!multicast &&
2585
			   compare_ether_addr(sdata->vif.addr,
2586
					      hdr->addr1) != 0) {
2587
			if (!(sdata->dev->flags & IFF_PROMISC))
2588
				return 0;
2589
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2590 2591
		} else if (!rx->sta) {
			int rate_idx;
J
Johannes Berg 已提交
2592
			if (status->flag & RX_FLAG_HT)
2593 2594
				rate_idx = 0; /* TODO: HT rates */
			else
J
Johannes Berg 已提交
2595
				rate_idx = status->rate_idx;
2596 2597
			rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
					hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
2598
		}
2599
		break;
2600
	case NL80211_IFTYPE_MESH_POINT:
2601
		if (!multicast &&
2602
		    compare_ether_addr(sdata->vif.addr,
2603 2604 2605 2606
				       hdr->addr1) != 0) {
			if (!(sdata->dev->flags & IFF_PROMISC))
				return 0;

2607
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2608 2609
		}
		break;
2610 2611
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
2612
		if (!bssid) {
2613
			if (compare_ether_addr(sdata->vif.addr,
2614 2615 2616
					       hdr->addr1))
				return 0;
		} else if (!ieee80211_bssid_match(bssid,
2617
					sdata->vif.addr)) {
2618
			if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2619
				return 0;
2620
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2621 2622
		}
		break;
2623
	case NL80211_IFTYPE_WDS:
2624
		if (bssid || !ieee80211_is_data(hdr->frame_control))
2625 2626 2627 2628
			return 0;
		if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
			return 0;
		break;
2629
	default:
J
Johannes Berg 已提交
2630 2631 2632
		/* should never get here */
		WARN_ON(1);
		break;
2633 2634 2635 2636 2637
	}

	return 1;
}

2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653
/*
 * This function returns whether or not the SKB
 * was destined for RX processing or not, which,
 * if consume is true, is equivalent to whether
 * or not the skb was consumed.
 */
static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
					    struct sk_buff *skb, bool consume)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (void *)skb->data;
	int prepares;

	rx->skb = skb;
2654
	status->rx_flags |= IEEE80211_RX_RA_MATCH;
2655 2656 2657 2658 2659 2660
	prepares = prepare_for_handlers(rx, hdr);

	if (!prepares)
		return false;

	if (status->flag & RX_FLAG_MMIC_ERROR) {
2661
		if (status->rx_flags & IEEE80211_RX_RA_MATCH)
2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682
			ieee80211_rx_michael_mic_report(hdr, rx);
		return false;
	}

	if (!consume) {
		skb = skb_copy(skb, GFP_ATOMIC);
		if (!skb) {
			if (net_ratelimit())
				wiphy_debug(local->hw.wiphy,
					"failed to copy multicast frame for %s\n",
					sdata->name);
			return true;
		}

		rx->skb = skb;
	}

	ieee80211_invoke_rx_handlers(rx);
	return true;
}

2683
/*
2684 2685
 * This is the actual Rx frames handler. as it blongs to Rx path it must
 * be called with rcu_read_lock protection.
2686
 */
2687
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2688
					 struct sk_buff *skb)
2689
{
2690
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2691 2692 2693
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
Z
Zhu Yi 已提交
2694
	__le16 fc;
2695
	struct ieee80211_rx_data rx;
2696
	struct ieee80211_sub_if_data *prev;
2697
	struct sta_info *sta, *tmp, *prev_sta;
Z
Zhu Yi 已提交
2698
	int err = 0;
2699

Z
Zhu Yi 已提交
2700
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
2701 2702 2703
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;
2704

Z
Zhu Yi 已提交
2705
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
2706 2707
		local->dot11ReceivedFragmentCount++;

2708 2709
	if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
		     test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
2710
		status->rx_flags |= IEEE80211_RX_IN_SCAN;
2711

Z
Zhu Yi 已提交
2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722
	if (ieee80211_is_mgmt(fc))
		err = skb_linearize(skb);
	else
		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));

	if (err) {
		dev_kfree_skb(skb);
		return;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
2723
	ieee80211_parse_qos(&rx);
2724
	ieee80211_verify_alignment(&rx);
2725

Z
Zhu Yi 已提交
2726
	if (ieee80211_is_data(fc)) {
2727
		prev_sta = NULL;
2728

2729
		for_each_sta_info(local, hdr->addr2, sta, tmp) {
2730 2731 2732 2733 2734 2735 2736
			if (!prev_sta) {
				prev_sta = sta;
				continue;
			}

			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;
2737
			ieee80211_prepare_and_rx_handle(&rx, skb, false);
2738

2739
			prev_sta = sta;
2740
		}
2741 2742 2743 2744 2745

		if (prev_sta) {
			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;

2746
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2747
				return;
2748
			goto out;
2749
		}
2750 2751
	}

2752
	prev = NULL;
2753

2754 2755 2756
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(sdata))
			continue;
J
Johannes Berg 已提交
2757

2758 2759 2760
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
			continue;
J
Johannes Berg 已提交
2761

2762 2763 2764 2765 2766
		/*
		 * frame is destined for this interface, but if it's
		 * not also for the previous one we handle that after
		 * the loop to avoid copying the SKB once too much
		 */
2767

2768
		if (!prev) {
2769
			prev = sdata;
2770
			continue;
J
Johannes Berg 已提交
2771
		}
2772

2773 2774 2775
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
		rx.sdata = prev;
		ieee80211_prepare_and_rx_handle(&rx, skb, false);
2776

2777 2778 2779 2780 2781 2782
		prev = sdata;
	}

	if (prev) {
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
		rx.sdata = prev;
2783

2784 2785
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
2786
	}
2787

2788
 out:
2789
	dev_kfree_skb(skb);
2790
}
2791 2792 2793 2794 2795

/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
2796
void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
2797 2798
{
	struct ieee80211_local *local = hw_to_local(hw);
2799 2800
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;
2801
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2802

2803 2804
	WARN_ON_ONCE(softirq_count() == 0);

J
Johannes Berg 已提交
2805 2806 2807
	if (WARN_ON(status->band < 0 ||
		    status->band >= IEEE80211_NUM_BANDS))
		goto drop;
2808 2809

	sband = local->hw.wiphy->bands[status->band];
J
Johannes Berg 已提交
2810 2811
	if (WARN_ON(!sband))
		goto drop;
2812

J
Johannes Berg 已提交
2813 2814 2815 2816 2817 2818 2819
	/*
	 * If we're suspending, it is possible although not too likely
	 * that we'd be receiving frames after having already partially
	 * quiesced the stack. We can't process such frames then since
	 * that might, for example, cause stations to be added or other
	 * driver callbacks be invoked.
	 */
J
Johannes Berg 已提交
2820 2821
	if (unlikely(local->quiescing || local->suspended))
		goto drop;
J
Johannes Berg 已提交
2822

2823 2824 2825 2826
	/*
	 * The same happens when we're not even started,
	 * but that's worth a warning.
	 */
J
Johannes Berg 已提交
2827 2828
	if (WARN_ON(!local->started))
		goto drop;
2829

2830
	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
2831
		/*
2832 2833
		 * Validate the rate, unless a PLCP error means that
		 * we probably can't have a valid rate here anyway.
2834
		 */
2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860

		if (status->flag & RX_FLAG_HT) {
			/*
			 * rate_idx is MCS index, which can be [0-76]
			 * as documented on:
			 *
			 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
			 *
			 * Anything else would be some sort of driver or
			 * hardware error. The driver should catch hardware
			 * errors.
			 */
			if (WARN((status->rate_idx < 0 ||
				 status->rate_idx > 76),
				 "Rate marked as an HT rate but passed "
				 "status->rate_idx is not "
				 "an MCS index [0-76]: %d (0x%02x)\n",
				 status->rate_idx,
				 status->rate_idx))
				goto drop;
		} else {
			if (WARN_ON(status->rate_idx < 0 ||
				    status->rate_idx >= sband->n_bitrates))
				goto drop;
			rate = &sband->bitrates[status->rate_idx];
		}
2861
	}
2862

2863 2864
	status->rx_flags = 0;

2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875 2876 2877
	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
2878
	skb = ieee80211_rx_monitor(local, skb, rate);
2879 2880 2881 2882 2883
	if (!skb) {
		rcu_read_unlock();
		return;
	}

2884
	__ieee80211_rx_handle_packet(hw, skb);
2885 2886

	rcu_read_unlock();
J
Johannes Berg 已提交
2887 2888 2889 2890

	return;
 drop:
	kfree_skb(skb);
2891
}
2892
EXPORT_SYMBOL(ieee80211_rx);
2893 2894 2895

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
2896
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
2897 2898 2899 2900 2901 2902 2903 2904 2905 2906
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);