blob: 2afeac9c645322cbb21e87183bd16ccb4fa2026e [file] [log] [blame]
Johannes Berg571ecf62007-07-27 15:43:22 +02001/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
Johannes Berg84040802010-02-15 12:46:39 +02005 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
Johannes Berg571ecf62007-07-27 15:43:22 +02006 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
S.Çağlar Onurab466232008-02-14 17:36:47 +020012#include <linux/jiffies.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090013#include <linux/slab.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020014#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
Johannes Bergd4e46a32007-09-14 11:10:24 -040018#include <linux/rcupdate.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020019#include <net/mac80211.h>
20#include <net/ieee80211_radiotap.h>
21
22#include "ieee80211_i.h"
Johannes Berg24487982009-04-23 18:52:52 +020023#include "driver-ops.h"
Johannes Berg2c8dccc2008-04-08 15:14:40 -040024#include "led.h"
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +010025#include "mesh.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020026#include "wep.h"
27#include "wpa.h"
28#include "tkip.h"
29#include "wme.h"
30
Johannes Bergb2e77712007-09-26 15:19:39 +020031/*
32 * monitor mode reception
33 *
34 * This function cleans up the SKB, i.e. it removes all the stuff
35 * only useful for monitoring.
36 */
37static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
Johannes Berg0869aea2009-10-28 10:03:35 +010038 struct sk_buff *skb)
Johannes Bergb2e77712007-09-26 15:19:39 +020039{
Johannes Bergb2e77712007-09-26 15:19:39 +020040 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
41 if (likely(skb->len > FCS_LEN))
Zhu Yie3cf8b32010-03-29 17:35:07 +080042 __pskb_trim(skb, skb->len - FCS_LEN);
Johannes Bergb2e77712007-09-26 15:19:39 +020043 else {
44 /* driver bug */
45 WARN_ON(1);
46 dev_kfree_skb(skb);
47 skb = NULL;
48 }
49 }
50
51 return skb;
52}
53
Johannes Bergf1d58c22009-06-17 13:13:00 +020054static inline int should_drop_frame(struct sk_buff *skb,
Johannes Berg0869aea2009-10-28 10:03:35 +010055 int present_fcs_len)
Johannes Bergb2e77712007-09-26 15:19:39 +020056{
Johannes Bergf1d58c22009-06-17 13:13:00 +020057 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Harvey Harrison182503a2008-06-22 16:45:29 -070058 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Bergb2e77712007-09-26 15:19:39 +020059
60 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
61 return 1;
Johannes Berg0869aea2009-10-28 10:03:35 +010062 if (unlikely(skb->len < 16 + present_fcs_len))
Johannes Bergb2e77712007-09-26 15:19:39 +020063 return 1;
Harvey Harrison87228f52008-06-11 14:21:59 -070064 if (ieee80211_is_ctl(hdr->frame_control) &&
65 !ieee80211_is_pspoll(hdr->frame_control) &&
66 !ieee80211_is_back_req(hdr->frame_control))
Johannes Bergb2e77712007-09-26 15:19:39 +020067 return 1;
68 return 0;
69}
70
Bruno Randolf601ae7f2008-05-08 19:22:43 +020071static int
72ieee80211_rx_radiotap_len(struct ieee80211_local *local,
73 struct ieee80211_rx_status *status)
74{
75 int len;
76
77 /* always present fields */
78 len = sizeof(struct ieee80211_radiotap_header) + 9;
79
Johannes Berg6ebacbb2011-02-23 15:06:08 +010080 if (status->flag & RX_FLAG_MACTIME_MPDU)
Bruno Randolf601ae7f2008-05-08 19:22:43 +020081 len += 8;
Johannes Berg7fee5372009-01-30 11:13:06 +010082 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
Bruno Randolf601ae7f2008-05-08 19:22:43 +020083 len += 1;
Bruno Randolf601ae7f2008-05-08 19:22:43 +020084
85 if (len & 1) /* padding for RX_FLAGS if necessary */
86 len++;
87
Johannes Berg6d744ba2011-01-27 14:13:17 +010088 if (status->flag & RX_FLAG_HT) /* HT info */
89 len += 3;
90
Bruno Randolf601ae7f2008-05-08 19:22:43 +020091 return len;
92}
93
Johannes Bergd1c3a372009-01-07 00:26:10 +010094/*
Bruno Randolf601ae7f2008-05-08 19:22:43 +020095 * ieee80211_add_rx_radiotap_header - add radiotap header
96 *
97 * add a radiotap header containing all the fields which the hardware provided.
98 */
99static void
100ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
101 struct sk_buff *skb,
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200102 struct ieee80211_rate *rate,
103 int rtap_len)
104{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200105 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200106 struct ieee80211_radiotap_header *rthdr;
107 unsigned char *pos;
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100108 u16 rx_flags = 0;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200109
110 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
111 memset(rthdr, 0, rtap_len);
112
113 /* radiotap header, set always present flags */
114 rthdr->it_present =
115 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200116 (1 << IEEE80211_RADIOTAP_CHANNEL) |
117 (1 << IEEE80211_RADIOTAP_ANTENNA) |
118 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
119 rthdr->it_len = cpu_to_le16(rtap_len);
120
121 pos = (unsigned char *)(rthdr+1);
122
123 /* the order of the following fields is important */
124
125 /* IEEE80211_RADIOTAP_TSFT */
Johannes Berg6ebacbb2011-02-23 15:06:08 +0100126 if (status->flag & RX_FLAG_MACTIME_MPDU) {
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100127 put_unaligned_le64(status->mactime, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200128 rthdr->it_present |=
129 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
130 pos += 8;
131 }
132
133 /* IEEE80211_RADIOTAP_FLAGS */
134 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
135 *pos |= IEEE80211_RADIOTAP_F_FCS;
Johannes Bergaae89832009-03-13 12:52:10 +0100136 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
137 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
Bruno Randolfb4f28bb2008-07-30 17:19:55 +0200138 if (status->flag & RX_FLAG_SHORTPRE)
139 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200140 pos++;
141
142 /* IEEE80211_RADIOTAP_RATE */
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200143 if (status->flag & RX_FLAG_HT) {
144 /*
Mohammed Shafi Shajakhan38f37be2011-02-07 10:10:04 +0530145 * MCS information is a separate field in radiotap,
146 * added below.
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200147 */
148 *pos = 0;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200149 } else {
Jouni Malinenebe6c7b2009-01-10 11:47:33 +0200150 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200151 *pos = rate->bitrate / 5;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200152 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200153 pos++;
154
155 /* IEEE80211_RADIOTAP_CHANNEL */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100156 put_unaligned_le16(status->freq, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200157 pos += 2;
158 if (status->band == IEEE80211_BAND_5GHZ)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100159 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
160 pos);
Johannes Berg5f0b7de2009-11-16 13:58:21 +0100161 else if (status->flag & RX_FLAG_HT)
162 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
163 pos);
Bruno Randolf9deb1ae2008-07-30 17:20:06 +0200164 else if (rate->flags & IEEE80211_RATE_ERP_G)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100165 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
166 pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200167 else
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100168 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
169 pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200170 pos += 2;
171
172 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
173 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
174 *pos = status->signal;
175 rthdr->it_present |=
176 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
177 pos++;
178 }
179
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200180 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
181
182 /* IEEE80211_RADIOTAP_ANTENNA */
183 *pos = status->antenna;
184 pos++;
185
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200186 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
187
188 /* IEEE80211_RADIOTAP_RX_FLAGS */
189 /* ensure 2 byte alignment for the 2 byte field as required */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100190 if ((pos - (u8 *)rthdr) & 1)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200191 pos++;
Johannes Bergaae89832009-03-13 12:52:10 +0100192 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100193 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
194 put_unaligned_le16(rx_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200195 pos += 2;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100196
197 if (status->flag & RX_FLAG_HT) {
198 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
199 *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
200 IEEE80211_RADIOTAP_MCS_HAVE_GI |
201 IEEE80211_RADIOTAP_MCS_HAVE_BW;
202 *pos = 0;
203 if (status->flag & RX_FLAG_SHORT_GI)
204 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
205 if (status->flag & RX_FLAG_40MHZ)
206 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
207 pos++;
208 *pos++ = status->rate_idx;
209 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200210}
211
Johannes Bergb2e77712007-09-26 15:19:39 +0200212/*
213 * This function copies a received frame to all monitor interfaces and
214 * returns a cleaned-up SKB that no longer includes the FCS nor the
215 * radiotap header the driver might have added.
216 */
217static struct sk_buff *
218ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
Johannes Berg8318d782008-01-24 19:38:38 +0100219 struct ieee80211_rate *rate)
Johannes Bergb2e77712007-09-26 15:19:39 +0200220{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200221 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200222 struct ieee80211_sub_if_data *sdata;
Johannes Bergb2e77712007-09-26 15:19:39 +0200223 int needed_headroom = 0;
Johannes Bergb2e77712007-09-26 15:19:39 +0200224 struct sk_buff *skb, *skb2;
225 struct net_device *prev_dev = NULL;
226 int present_fcs_len = 0;
Johannes Bergb2e77712007-09-26 15:19:39 +0200227
228 /*
229 * First, we may need to make a copy of the skb because
230 * (1) we need to modify it for radiotap (if not present), and
231 * (2) the other RX handlers will modify the skb we got.
232 *
233 * We don't need to, of course, if we aren't going to return
234 * the SKB because it has a bad FCS/PLCP checksum.
235 */
Johannes Berg0869aea2009-10-28 10:03:35 +0100236
237 /* room for the radiotap header based on driver features */
238 needed_headroom = ieee80211_rx_radiotap_len(local, status);
Johannes Bergb2e77712007-09-26 15:19:39 +0200239
240 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
241 present_fcs_len = FCS_LEN;
242
Zhu Yie3cf8b32010-03-29 17:35:07 +0800243 /* make sure hdr->frame_control is on the linear part */
244 if (!pskb_may_pull(origskb, 2)) {
245 dev_kfree_skb(origskb);
246 return NULL;
247 }
248
Johannes Bergb2e77712007-09-26 15:19:39 +0200249 if (!local->monitors) {
Johannes Berg0869aea2009-10-28 10:03:35 +0100250 if (should_drop_frame(origskb, present_fcs_len)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200251 dev_kfree_skb(origskb);
252 return NULL;
253 }
254
Johannes Berg0869aea2009-10-28 10:03:35 +0100255 return remove_monitor_info(local, origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200256 }
257
Johannes Berg0869aea2009-10-28 10:03:35 +0100258 if (should_drop_frame(origskb, present_fcs_len)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200259 /* only need to expand headroom if necessary */
260 skb = origskb;
261 origskb = NULL;
262
263 /*
264 * This shouldn't trigger often because most devices have an
265 * RX header they pull before we get here, and that should
266 * be big enough for our radiotap information. We should
267 * probably export the length to drivers so that we can have
268 * them allocate enough headroom to start with.
269 */
270 if (skb_headroom(skb) < needed_headroom &&
Johannes Bergc49e5ea2007-12-11 21:33:42 +0100271 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200272 dev_kfree_skb(skb);
273 return NULL;
274 }
275 } else {
276 /*
277 * Need to make a copy and possibly remove radiotap header
278 * and FCS from the original.
279 */
280 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
281
Johannes Berg0869aea2009-10-28 10:03:35 +0100282 origskb = remove_monitor_info(local, origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200283
284 if (!skb)
285 return origskb;
286 }
287
Johannes Berg0869aea2009-10-28 10:03:35 +0100288 /* prepend radiotap information */
289 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
Johannes Bergb2e77712007-09-26 15:19:39 +0200290
Johannes Bergce3edf6d02007-12-19 01:31:22 +0100291 skb_reset_mac_header(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200292 skb->ip_summed = CHECKSUM_UNNECESSARY;
293 skb->pkt_type = PACKET_OTHERHOST;
294 skb->protocol = htons(ETH_P_802_2);
295
296 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg05c914f2008-09-11 00:01:58 +0200297 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
Johannes Bergb2e77712007-09-26 15:19:39 +0200298 continue;
299
Michael Wu3d30d942008-01-31 19:48:27 +0100300 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
301 continue;
302
Johannes Berg9607e6b2009-12-23 13:15:31 +0100303 if (!ieee80211_sdata_running(sdata))
Johannes Berg47846c92009-11-25 17:46:19 +0100304 continue;
305
Johannes Bergb2e77712007-09-26 15:19:39 +0200306 if (prev_dev) {
307 skb2 = skb_clone(skb, GFP_ATOMIC);
308 if (skb2) {
309 skb2->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -0400310 netif_receive_skb(skb2);
Johannes Bergb2e77712007-09-26 15:19:39 +0200311 }
312 }
313
314 prev_dev = sdata->dev;
315 sdata->dev->stats.rx_packets++;
316 sdata->dev->stats.rx_bytes += skb->len;
317 }
318
319 if (prev_dev) {
320 skb->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -0400321 netif_receive_skb(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200322 } else
323 dev_kfree_skb(skb);
324
325 return origskb;
326}
327
328
Johannes Berg5cf121c2008-02-25 16:27:43 +0100329static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +0200330{
Harvey Harrison238f74a2008-07-02 11:05:34 -0700331 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +0200332 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200333 int tid;
334
335 /* does the frame have a qos control field? */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700336 if (ieee80211_is_data_qos(hdr->frame_control)) {
337 u8 *qc = ieee80211_get_qos_ctl(hdr);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200338 /* frame has qos control */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700339 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
340 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
Johannes Berg554891e2010-09-24 12:38:25 +0200341 status->rx_flags |= IEEE80211_RX_AMSDU;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200342 } else {
Johannes Berg1411f9b2008-07-10 10:11:02 +0200343 /*
344 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
345 *
346 * Sequence numbers for management frames, QoS data
347 * frames with a broadcast/multicast address in the
348 * Address 1 field, and all non-QoS data frames sent
349 * by QoS STAs are assigned using an additional single
350 * modulo-4096 counter, [...]
351 *
352 * We also use that counter for non-QoS STAs.
353 */
354 tid = NUM_RX_DATA_QUEUES - 1;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200355 }
Johannes Berg52865df2007-07-27 15:43:22 +0200356
Johannes Berg5cf121c2008-02-25 16:27:43 +0100357 rx->queue = tid;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200358 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
359 * For now, set skb->priority to 0 for other cases. */
360 rx->skb->priority = (tid > 7) ? 0 : tid;
Johannes Berg38f37142008-01-29 17:07:43 +0100361}
Johannes Berg6e0d1142007-07-27 15:43:22 +0200362
Johannes Bergd1c3a372009-01-07 00:26:10 +0100363/**
364 * DOC: Packet alignment
365 *
366 * Drivers always need to pass packets that are aligned to two-byte boundaries
367 * to the stack.
368 *
369 * Additionally, should, if possible, align the payload data in a way that
370 * guarantees that the contained IP header is aligned to a four-byte
371 * boundary. In the case of regular frames, this simply means aligning the
372 * payload to a four-byte boundary (because either the IP header is directly
373 * contained, or IV/RFC1042 headers that have a length divisible by four are
Kalle Valo59d9cb02009-12-17 13:54:57 +0100374 * in front of it). If the payload data is not properly aligned and the
375 * architecture doesn't support efficient unaligned operations, mac80211
376 * will align the data.
Johannes Bergd1c3a372009-01-07 00:26:10 +0100377 *
378 * With A-MSDU frames, however, the payload data address must yield two modulo
379 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
380 * push the IP header further back to a multiple of four again. Thankfully, the
381 * specs were sane enough this time around to require padding each A-MSDU
382 * subframe to a length that is a multiple of four.
383 *
384 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
385 * the payload is not supported, the driver is required to move the 802.11
386 * header to be directly in front of the payload in that case.
387 */
388static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
Johannes Berg38f37142008-01-29 17:07:43 +0100389{
Kalle Valo59d9cb02009-12-17 13:54:57 +0100390#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
391 WARN_ONCE((unsigned long)rx->skb->data & 1,
392 "unaligned packet at 0x%p\n", rx->skb->data);
Johannes Bergd1c3a372009-01-07 00:26:10 +0100393#endif
Johannes Berg6e0d1142007-07-27 15:43:22 +0200394}
395
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +0200396
Johannes Berg571ecf62007-07-27 15:43:22 +0200397/* rx handlers */
398
Johannes Berg49461622008-06-30 15:10:45 +0200399static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100400ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200401{
402 struct ieee80211_local *local = rx->local;
Johannes Berg554891e2010-09-24 12:38:25 +0200403 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +0200404 struct sk_buff *skb = rx->skb;
405
Johannes Berg554891e2010-09-24 12:38:25 +0200406 if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
Johannes Berg4080c7c2010-09-24 11:21:08 +0200407 return RX_CONTINUE;
408
Ben Greearb23b0252011-02-04 11:54:17 -0800409 if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
410 test_bit(SCAN_SW_SCANNING, &local->scanning))
Johannes Bergf1d58c22009-06-17 13:13:00 +0200411 return ieee80211_scan_rx(rx->sdata, skb);
Zhu Yiece8edd2007-11-22 10:53:21 +0800412
Johannes Berg4080c7c2010-09-24 11:21:08 +0200413 /* scanning finished during invoking of handlers */
414 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
415 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200416}
417
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200418
419static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
420{
421 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
422
423 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
424 return 0;
425
426 return ieee80211_is_robust_mgmt_frame(hdr);
427}
428
429
430static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
431{
432 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
433
434 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
435 return 0;
436
437 return ieee80211_is_robust_mgmt_frame(hdr);
438}
439
440
441/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
442static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
443{
444 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
445 struct ieee80211_mmie *mmie;
446
447 if (skb->len < 24 + sizeof(*mmie) ||
448 !is_multicast_ether_addr(hdr->da))
449 return -1;
450
451 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
452 return -1; /* not a robust management frame */
453
454 mmie = (struct ieee80211_mmie *)
455 (skb->data + skb->len - sizeof(*mmie));
456 if (mmie->element_id != WLAN_EID_MMIE ||
457 mmie->length != sizeof(*mmie) - 2)
458 return -1;
459
460 return le16_to_cpu(mmie->key_id);
461}
462
463
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100464static ieee80211_rx_result
Johannes Berg5cf121c2008-02-25 16:27:43 +0100465ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100466{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700467 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
468 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg47846c92009-11-25 17:46:19 +0100469 char *dev_addr = rx->sdata->vif.addr;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100470
Harvey Harrisona7767f92008-07-02 16:30:51 -0700471 if (ieee80211_is_data(hdr->frame_control)) {
Javier Cardona3c5772a2009-08-10 12:15:48 -0700472 if (is_multicast_ether_addr(hdr->addr1)) {
473 if (ieee80211_has_tods(hdr->frame_control) ||
474 !ieee80211_has_fromds(hdr->frame_control))
475 return RX_DROP_MONITOR;
476 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
477 return RX_DROP_MONITOR;
478 } else {
479 if (!ieee80211_has_a4(hdr->frame_control))
480 return RX_DROP_MONITOR;
481 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
482 return RX_DROP_MONITOR;
483 }
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100484 }
485
486 /* If there is not an established peer link and this is not a peer link
487 * establisment frame, beacon or probe, drop the frame.
488 */
489
Luis Carlos Cobob4e08ea2008-02-29 15:46:08 -0800490 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100491 struct ieee80211_mgmt *mgmt;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100492
Harvey Harrisona7767f92008-07-02 16:30:51 -0700493 if (!ieee80211_is_mgmt(hdr->frame_control))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100494 return RX_DROP_MONITOR;
495
Harvey Harrisona7767f92008-07-02 16:30:51 -0700496 if (ieee80211_is_action(hdr->frame_control)) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100497 mgmt = (struct ieee80211_mgmt *)hdr;
Javier Cardona97ad9132010-03-29 11:00:21 -0700498 if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100499 return RX_DROP_MONITOR;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100500 return RX_CONTINUE;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100501 }
502
Harvey Harrisona7767f92008-07-02 16:30:51 -0700503 if (ieee80211_is_probe_req(hdr->frame_control) ||
504 ieee80211_is_probe_resp(hdr->frame_control) ||
505 ieee80211_is_beacon(hdr->frame_control))
506 return RX_CONTINUE;
507
508 return RX_DROP_MONITOR;
509
510 }
511
512#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
513
514 if (ieee80211_is_data(hdr->frame_control) &&
515 is_multicast_ether_addr(hdr->addr1) &&
Javier Cardona3c5772a2009-08-10 12:15:48 -0700516 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100517 return RX_DROP_MONITOR;
Johannes Berg902acc72008-02-23 15:17:19 +0100518#undef msh_h_get
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100519
Johannes Berg902acc72008-02-23 15:17:19 +0100520 return RX_CONTINUE;
521}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100522
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100523#define SEQ_MODULO 0x1000
524#define SEQ_MASK 0xfff
525
526static inline int seq_less(u16 sq1, u16 sq2)
527{
528 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
529}
530
531static inline u16 seq_inc(u16 sq)
532{
533 return (sq + 1) & SEQ_MASK;
534}
535
536static inline u16 seq_sub(u16 sq1, u16 sq2)
537{
538 return (sq1 - sq2) & SEQ_MASK;
539}
540
541
542static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
543 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100544 int index)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100545{
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100546 struct ieee80211_local *local = hw_to_local(hw);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100547 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
Christian Lamparter4cfda472010-12-27 23:21:26 +0100548 struct ieee80211_rx_status *status;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100549
Johannes Bergdd318572010-11-29 11:09:16 +0100550 lockdep_assert_held(&tid_agg_rx->reorder_lock);
551
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100552 if (!skb)
553 goto no_frame;
554
Christian Lamparter071d9ac2010-08-05 01:36:36 +0200555 /* release the frame from the reorder ring buffer */
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100556 tid_agg_rx->stored_mpdu_num--;
557 tid_agg_rx->reorder_buf[index] = NULL;
Christian Lamparter4cfda472010-12-27 23:21:26 +0100558 status = IEEE80211_SKB_RXCB(skb);
559 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100560 skb_queue_tail(&local->rx_skb_queue, skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100561
562no_frame:
563 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
564}
565
566static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
567 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100568 u16 head_seq_num)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100569{
570 int index;
571
Johannes Bergdd318572010-11-29 11:09:16 +0100572 lockdep_assert_held(&tid_agg_rx->reorder_lock);
573
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100574 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
575 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
576 tid_agg_rx->buf_size;
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100577 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100578 }
579}
580
581/*
582 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
583 * the skb was added to the buffer longer than this time ago, the earlier
584 * frames that have not yet been received are assumed to be lost and the skb
585 * can be released for processing. This may also release other skb's from the
586 * reorder buffer if there are no additional gaps between the frames.
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200587 *
588 * Callers must hold tid_agg_rx->reorder_lock.
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100589 */
590#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
591
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200592static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100593 struct tid_ampdu_rx *tid_agg_rx)
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200594{
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200595 int index, j;
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200596
Johannes Bergdd318572010-11-29 11:09:16 +0100597 lockdep_assert_held(&tid_agg_rx->reorder_lock);
598
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200599 /* release the buffer until next missing frame */
600 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
601 tid_agg_rx->buf_size;
602 if (!tid_agg_rx->reorder_buf[index] &&
603 tid_agg_rx->stored_mpdu_num > 1) {
604 /*
605 * No buffers ready to be released, but check whether any
606 * frames in the reorder buffer have timed out.
607 */
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200608 int skipped = 1;
609 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
610 j = (j + 1) % tid_agg_rx->buf_size) {
611 if (!tid_agg_rx->reorder_buf[j]) {
612 skipped++;
613 continue;
614 }
Daniel Halperin499fe9a2011-03-24 16:01:48 -0700615 if (skipped &&
616 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200617 HT_RX_REORDER_BUF_TIMEOUT))
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200618 goto set_release_timer;
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200619
620#ifdef CONFIG_MAC80211_HT_DEBUG
621 if (net_ratelimit())
Joe Perches0fb9a9e2010-08-20 16:25:38 -0700622 wiphy_debug(hw->wiphy,
623 "release an RX reorder frame due to timeout on earlier frames\n");
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200624#endif
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100625 ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200626
627 /*
628 * Increment the head seq# also for the skipped slots.
629 */
630 tid_agg_rx->head_seq_num =
631 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
632 skipped = 0;
633 }
634 } else while (tid_agg_rx->reorder_buf[index]) {
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100635 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200636 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
637 tid_agg_rx->buf_size;
638 }
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200639
640 if (tid_agg_rx->stored_mpdu_num) {
641 j = index = seq_sub(tid_agg_rx->head_seq_num,
642 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
643
644 for (; j != (index - 1) % tid_agg_rx->buf_size;
645 j = (j + 1) % tid_agg_rx->buf_size) {
646 if (tid_agg_rx->reorder_buf[j])
647 break;
648 }
649
650 set_release_timer:
651
652 mod_timer(&tid_agg_rx->reorder_timer,
653 tid_agg_rx->reorder_time[j] +
654 HT_RX_REORDER_BUF_TIMEOUT);
655 } else {
656 del_timer(&tid_agg_rx->reorder_timer);
657 }
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200658}
659
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100660/*
661 * As this function belongs to the RX path it must be under
662 * rcu_read_lock protection. It returns false if the frame
663 * can be processed immediately, true if it was consumed.
664 */
665static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
666 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100667 struct sk_buff *skb)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100668{
669 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
670 u16 sc = le16_to_cpu(hdr->seq_ctrl);
671 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
672 u16 head_seq_num, buf_size;
673 int index;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200674 bool ret = true;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100675
Johannes Bergdd318572010-11-29 11:09:16 +0100676 spin_lock(&tid_agg_rx->reorder_lock);
677
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100678 buf_size = tid_agg_rx->buf_size;
679 head_seq_num = tid_agg_rx->head_seq_num;
680
681 /* frame with out of date sequence number */
682 if (seq_less(mpdu_seq_num, head_seq_num)) {
683 dev_kfree_skb(skb);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200684 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100685 }
686
687 /*
688 * If frame the sequence number exceeds our buffering window
689 * size release some previous frames to make room for this one.
690 */
691 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
692 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
693 /* release stored frames up to new head to stack */
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100694 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100695 }
696
697 /* Now the new frame is always in the range of the reordering buffer */
698
699 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
700
701 /* check if we already stored this frame */
702 if (tid_agg_rx->reorder_buf[index]) {
703 dev_kfree_skb(skb);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200704 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100705 }
706
707 /*
708 * If the current MPDU is in the right order and nothing else
709 * is stored we can process it directly, no need to buffer it.
710 */
711 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
712 tid_agg_rx->stored_mpdu_num == 0) {
713 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200714 ret = false;
715 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100716 }
717
718 /* put the frame in the reordering buffer */
719 tid_agg_rx->reorder_buf[index] = skb;
720 tid_agg_rx->reorder_time[index] = jiffies;
721 tid_agg_rx->stored_mpdu_num++;
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100722 ieee80211_sta_reorder_release(hw, tid_agg_rx);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100723
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200724 out:
725 spin_unlock(&tid_agg_rx->reorder_lock);
726 return ret;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100727}
728
729/*
730 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
731 * true if the MPDU was buffered, false if it should be processed.
732 */
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100733static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100734{
Johannes Berg2569a822009-11-25 17:46:17 +0100735 struct sk_buff *skb = rx->skb;
736 struct ieee80211_local *local = rx->local;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100737 struct ieee80211_hw *hw = &local->hw;
738 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
Johannes Berg2569a822009-11-25 17:46:17 +0100739 struct sta_info *sta = rx->sta;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100740 struct tid_ampdu_rx *tid_agg_rx;
741 u16 sc;
742 int tid;
743
744 if (!ieee80211_is_data_qos(hdr->frame_control))
Johannes Berg2569a822009-11-25 17:46:17 +0100745 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100746
747 /*
748 * filter the QoS data rx stream according to
749 * STA/TID and check if this STA/TID is on aggregation
750 */
751
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100752 if (!sta)
Johannes Berg2569a822009-11-25 17:46:17 +0100753 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100754
755 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
756
Johannes Berga87f7362010-06-10 10:21:38 +0200757 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
758 if (!tid_agg_rx)
759 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100760
761 /* qos null data frames are excluded */
762 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
Johannes Berga87f7362010-06-10 10:21:38 +0200763 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100764
765 /* new, potentially un-ordered, ampdu frame - process it */
766
767 /* reset session timer */
768 if (tid_agg_rx->timeout)
769 mod_timer(&tid_agg_rx->session_timer,
770 TU_TO_EXP_TIME(tid_agg_rx->timeout));
771
772 /* if this mpdu is fragmented - terminate rx aggregation session */
773 sc = le16_to_cpu(hdr->seq_ctrl);
774 if (sc & IEEE80211_SCTL_FRAG) {
Johannes Bergc1475ca2010-06-10 10:21:37 +0200775 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
Johannes Berg344eec62010-06-10 10:21:36 +0200776 skb_queue_tail(&rx->sdata->skb_queue, skb);
777 ieee80211_queue_work(&local->hw, &rx->sdata->work);
Johannes Berg2569a822009-11-25 17:46:17 +0100778 return;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100779 }
780
Johannes Berga87f7362010-06-10 10:21:38 +0200781 /*
782 * No locking needed -- we will only ever process one
783 * RX packet at a time, and thus own tid_agg_rx. All
784 * other code manipulating it needs to (and does) make
785 * sure that we cannot get to it any more before doing
786 * anything with it.
787 */
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100788 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
Johannes Berg2569a822009-11-25 17:46:17 +0100789 return;
790
791 dont_reorder:
Christian Lamparter24a8fda2010-12-30 17:25:29 +0100792 skb_queue_tail(&local->rx_skb_queue, skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100793}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100794
Johannes Berg49461622008-06-30 15:10:45 +0200795static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100796ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200797{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700798 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +0200799 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +0200800
801 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
802 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
Harvey Harrisona7767f92008-07-02 16:30:51 -0700803 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
Johannes Berg5cf121c2008-02-25 16:27:43 +0100804 rx->sta->last_seq_ctrl[rx->queue] ==
Johannes Berg571ecf62007-07-27 15:43:22 +0200805 hdr->seq_ctrl)) {
Johannes Berg554891e2010-09-24 12:38:25 +0200806 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200807 rx->local->dot11FrameDuplicateCount++;
808 rx->sta->num_duplicates++;
809 }
Felix Fietkaub1f93312011-02-04 19:20:08 +0100810 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200811 } else
Johannes Berg5cf121c2008-02-25 16:27:43 +0100812 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
Johannes Berg571ecf62007-07-27 15:43:22 +0200813 }
814
Johannes Berg571ecf62007-07-27 15:43:22 +0200815 if (unlikely(rx->skb->len < 16)) {
816 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
Johannes Berge4c26ad2008-01-31 19:48:21 +0100817 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200818 }
819
Johannes Berg571ecf62007-07-27 15:43:22 +0200820 /* Drop disallowed frame classes based on STA auth/assoc state;
821 * IEEE 802.11, Chap 5.5.
822 *
Johannes Bergccd7b362008-09-11 00:01:56 +0200823 * mac80211 filters only based on association state, i.e. it drops
824 * Class 3 frames from not associated stations. hostapd sends
Johannes Berg571ecf62007-07-27 15:43:22 +0200825 * deauth/disassoc frames when needed. In addition, hostapd is
826 * responsible for filtering on both auth and assoc states.
827 */
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100828
Johannes Berg902acc72008-02-23 15:17:19 +0100829 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100830 return ieee80211_rx_mesh_check(rx);
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100831
Harvey Harrisona7767f92008-07-02 16:30:51 -0700832 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
833 ieee80211_is_pspoll(hdr->frame_control)) &&
Johannes Berg05c914f2008-09-11 00:01:58 +0200834 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Bill Jordan1be7fe82010-10-01 11:20:41 -0400835 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
Helmut Schaa0c2530c2011-02-12 14:17:15 +0100836 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC))))
Johannes Berge4c26ad2008-01-31 19:48:21 +0100837 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200838
Johannes Berg9ae54c82008-01-31 19:48:20 +0100839 return RX_CONTINUE;
Johannes Berg570bd532007-07-27 15:43:22 +0200840}
841
842
Johannes Berg49461622008-06-30 15:10:45 +0200843static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100844ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
Johannes Berg570bd532007-07-27 15:43:22 +0200845{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100846 struct sk_buff *skb = rx->skb;
847 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
848 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg3017b802007-08-28 17:01:53 -0400849 int keyidx;
850 int hdrlen;
Johannes Berge4c26ad2008-01-31 19:48:21 +0100851 ieee80211_rx_result result = RX_DROP_UNUSABLE;
Johannes Berge31b8212010-10-05 19:39:30 +0200852 struct ieee80211_key *sta_ptk = NULL;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200853 int mmie_keyidx = -1;
Johannes Berg761ab472010-05-28 14:24:19 +0200854 __le16 fc;
Johannes Berg570bd532007-07-27 15:43:22 +0200855
Johannes Berg3017b802007-08-28 17:01:53 -0400856 /*
857 * Key selection 101
858 *
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200859 * There are four types of keys:
Johannes Berg3017b802007-08-28 17:01:53 -0400860 * - GTK (group keys)
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200861 * - IGTK (group keys for management frames)
Johannes Berg3017b802007-08-28 17:01:53 -0400862 * - PTK (pairwise keys)
863 * - STK (station-to-station pairwise keys)
864 *
865 * When selecting a key, we have to distinguish between multicast
866 * (including broadcast) and unicast frames, the latter can only
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200867 * use PTKs and STKs while the former always use GTKs and IGTKs.
868 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
869 * unicast frames can also use key indices like GTKs. Hence, if we
870 * don't have a PTK/STK we check the key index for a WEP key.
Johannes Berg3017b802007-08-28 17:01:53 -0400871 *
Johannes Berg8dc06a12007-08-28 17:01:55 -0400872 * Note that in a regular BSS, multicast frames are sent by the
873 * AP only, associated stations unicast the frame to the AP first
874 * which then multicasts it on their behalf.
875 *
Johannes Berg3017b802007-08-28 17:01:53 -0400876 * There is also a slight problem in IBSS mode: GTKs are negotiated
877 * with each station, that is something we don't currently handle.
Johannes Berg8dc06a12007-08-28 17:01:55 -0400878 * The spec seems to expect that one negotiates the same key with
879 * every station but there's no such requirement; VLANs could be
880 * possible.
Johannes Berg3017b802007-08-28 17:01:53 -0400881 */
Johannes Berg571ecf62007-07-27 15:43:22 +0200882
Johannes Berg3017b802007-08-28 17:01:53 -0400883 /*
Johannes Berg1990af82007-09-26 17:53:15 +0200884 * No point in finding a key and decrypting if the frame is neither
Johannes Berg3017b802007-08-28 17:01:53 -0400885 * addressed to us nor a multicast frame.
886 */
Johannes Berg554891e2010-09-24 12:38:25 +0200887 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100888 return RX_CONTINUE;
Johannes Berg3017b802007-08-28 17:01:53 -0400889
Johannes Berg2569a822009-11-25 17:46:17 +0100890 /* start without a key */
891 rx->key = NULL;
892
Johannes Bergd4e46a32007-09-14 11:10:24 -0400893 if (rx->sta)
Johannes Berge31b8212010-10-05 19:39:30 +0200894 sta_ptk = rcu_dereference(rx->sta->ptk);
Johannes Bergd4e46a32007-09-14 11:10:24 -0400895
Johannes Berg761ab472010-05-28 14:24:19 +0200896 fc = hdr->frame_control;
897
898 if (!ieee80211_has_protected(fc))
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300899 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
900
Johannes Berge31b8212010-10-05 19:39:30 +0200901 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
902 rx->key = sta_ptk;
Johannes Bergdc1580d2010-08-10 09:46:40 +0200903 if ((status->flag & RX_FLAG_DECRYPTED) &&
904 (status->flag & RX_FLAG_IV_STRIPPED))
905 return RX_CONTINUE;
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300906 /* Skip decryption if the frame is not protected. */
Johannes Berg761ab472010-05-28 14:24:19 +0200907 if (!ieee80211_has_protected(fc))
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300908 return RX_CONTINUE;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200909 } else if (mmie_keyidx >= 0) {
910 /* Broadcast/multicast robust management frame / BIP */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100911 if ((status->flag & RX_FLAG_DECRYPTED) &&
912 (status->flag & RX_FLAG_IV_STRIPPED))
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200913 return RX_CONTINUE;
914
915 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
916 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
917 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
Johannes Berge31b8212010-10-05 19:39:30 +0200918 if (rx->sta)
919 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
920 if (!rx->key)
921 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
Johannes Berg761ab472010-05-28 14:24:19 +0200922 } else if (!ieee80211_has_protected(fc)) {
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300923 /*
924 * The frame was not protected, so skip decryption. However, we
925 * need to set rx->key if there is a key that could have been
926 * used so that the frame may be dropped if encryption would
927 * have been expected.
928 */
929 struct ieee80211_key *key = NULL;
Johannes Berg897bed82010-12-09 19:49:00 +0100930 struct ieee80211_sub_if_data *sdata = rx->sdata;
931 int i;
932
Johannes Berg761ab472010-05-28 14:24:19 +0200933 if (ieee80211_is_mgmt(fc) &&
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300934 is_multicast_ether_addr(hdr->addr1) &&
935 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
936 rx->key = key;
Johannes Berg897bed82010-12-09 19:49:00 +0100937 else {
938 if (rx->sta) {
939 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
940 key = rcu_dereference(rx->sta->gtk[i]);
941 if (key)
942 break;
943 }
944 }
945 if (!key) {
946 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
947 key = rcu_dereference(sdata->keys[i]);
948 if (key)
949 break;
950 }
951 }
952 if (key)
953 rx->key = key;
954 }
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300955 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200956 } else {
Zhu Yi39184b12010-04-08 15:35:10 +0800957 u8 keyid;
Johannes Berg3017b802007-08-28 17:01:53 -0400958 /*
959 * The device doesn't give us the IV so we won't be
960 * able to look up the key. That's ok though, we
961 * don't need to decrypt the frame, we just won't
962 * be able to keep statistics accurate.
963 * Except for key threshold notifications, should
964 * we somehow allow the driver to tell us which key
965 * the hardware used if this flag is set?
966 */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100967 if ((status->flag & RX_FLAG_DECRYPTED) &&
968 (status->flag & RX_FLAG_IV_STRIPPED))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100969 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200970
Johannes Berg761ab472010-05-28 14:24:19 +0200971 hdrlen = ieee80211_hdrlen(fc);
Johannes Berg571ecf62007-07-27 15:43:22 +0200972
Johannes Berg3017b802007-08-28 17:01:53 -0400973 if (rx->skb->len < 8 + hdrlen)
Johannes Berge4c26ad2008-01-31 19:48:21 +0100974 return RX_DROP_UNUSABLE; /* TODO: count this? */
Johannes Berg571ecf62007-07-27 15:43:22 +0200975
Johannes Berg3017b802007-08-28 17:01:53 -0400976 /*
977 * no need to call ieee80211_wep_get_keyidx,
978 * it verifies a bunch of things we've done already
979 */
Zhu Yi39184b12010-04-08 15:35:10 +0800980 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
981 keyidx = keyid >> 6;
Johannes Berg3017b802007-08-28 17:01:53 -0400982
Johannes Berge31b8212010-10-05 19:39:30 +0200983 /* check per-station GTK first, if multicast packet */
984 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
985 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
Johannes Berg3017b802007-08-28 17:01:53 -0400986
Johannes Berge31b8212010-10-05 19:39:30 +0200987 /* if not found, try default key */
988 if (!rx->key) {
989 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
990
991 /*
992 * RSNA-protected unicast frames should always be
993 * sent with pairwise or station-to-station keys,
994 * but for WEP we allow using a key index as well.
995 */
996 if (rx->key &&
997 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
998 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
999 !is_multicast_ether_addr(hdr->addr1))
1000 rx->key = NULL;
1001 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001002 }
1003
Johannes Berg3017b802007-08-28 17:01:53 -04001004 if (rx->key) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001005 rx->key->tx_rx_count++;
Johannes Berg011bfcc2007-09-17 01:29:25 -04001006 /* TODO: add threshold stuff again */
Johannes Berg1990af82007-09-26 17:53:15 +02001007 } else {
Johannes Berge4c26ad2008-01-31 19:48:21 +01001008 return RX_DROP_MONITOR;
Johannes Berg70f08762007-09-26 17:53:14 +02001009 }
1010
Zhu Yi39184b12010-04-08 15:35:10 +08001011 if (skb_linearize(rx->skb))
1012 return RX_DROP_UNUSABLE;
Johannes Berg761ab472010-05-28 14:24:19 +02001013 /* the hdr variable is invalid now! */
Johannes Berg1990af82007-09-26 17:53:15 +02001014
Johannes Berg97359d12010-08-10 09:46:38 +02001015 switch (rx->key->conf.cipher) {
1016 case WLAN_CIPHER_SUITE_WEP40:
1017 case WLAN_CIPHER_SUITE_WEP104:
Johannes Berg761ab472010-05-28 14:24:19 +02001018 /* Check for weak IVs if possible */
1019 if (rx->sta && ieee80211_is_data(fc) &&
1020 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
1021 !(status->flag & RX_FLAG_DECRYPTED)) &&
1022 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
1023 rx->sta->wep_weak_iv_count++;
1024
Mattias Nisslere2f036d2007-10-07 16:35:31 +02001025 result = ieee80211_crypto_wep_decrypt(rx);
1026 break;
Johannes Berg97359d12010-08-10 09:46:38 +02001027 case WLAN_CIPHER_SUITE_TKIP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +02001028 result = ieee80211_crypto_tkip_decrypt(rx);
1029 break;
Johannes Berg97359d12010-08-10 09:46:38 +02001030 case WLAN_CIPHER_SUITE_CCMP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +02001031 result = ieee80211_crypto_ccmp_decrypt(rx);
1032 break;
Johannes Berg97359d12010-08-10 09:46:38 +02001033 case WLAN_CIPHER_SUITE_AES_CMAC:
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +02001034 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1035 break;
Johannes Berg3ffc2a92010-08-27 14:26:52 +03001036 default:
1037 /*
1038 * We can reach here only with HW-only algorithms
1039 * but why didn't it decrypt the frame?!
1040 */
1041 return RX_DROP_UNUSABLE;
Johannes Berg70f08762007-09-26 17:53:14 +02001042 }
1043
Mattias Nisslere2f036d2007-10-07 16:35:31 +02001044 /* either the frame has been decrypted or will be dropped */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001045 status->flag |= RX_FLAG_DECRYPTED;
Mattias Nisslere2f036d2007-10-07 16:35:31 +02001046
1047 return result;
Johannes Berg70f08762007-09-26 17:53:14 +02001048}
1049
Kalle Valo572e0012009-02-10 17:09:31 +02001050static ieee80211_rx_result debug_noinline
1051ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1052{
1053 struct ieee80211_local *local;
1054 struct ieee80211_hdr *hdr;
1055 struct sk_buff *skb;
1056
1057 local = rx->local;
1058 skb = rx->skb;
1059 hdr = (struct ieee80211_hdr *) skb->data;
1060
1061 if (!local->pspolling)
1062 return RX_CONTINUE;
1063
1064 if (!ieee80211_has_fromds(hdr->frame_control))
1065 /* this is not from AP */
1066 return RX_CONTINUE;
1067
1068 if (!ieee80211_is_data(hdr->frame_control))
1069 return RX_CONTINUE;
1070
1071 if (!ieee80211_has_moredata(hdr->frame_control)) {
1072 /* AP has no more frames buffered for us */
1073 local->pspolling = false;
1074 return RX_CONTINUE;
1075 }
1076
1077 /* more data bit is set, let's request a new frame from the AP */
1078 ieee80211_send_pspoll(local, rx->sdata);
1079
1080 return RX_CONTINUE;
1081}
1082
Johannes Berg133b8222008-09-16 14:18:59 +02001083static void ap_sta_ps_start(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001084{
Johannes Berg133b8222008-09-16 14:18:59 +02001085 struct ieee80211_sub_if_data *sdata = sta->sdata;
Christian Lamparter4571d3b2008-11-30 00:48:41 +01001086 struct ieee80211_local *local = sdata->local;
Joe Perches0795af52007-10-03 17:59:30 -07001087
Johannes Berg3e122be2008-07-09 14:40:34 +02001088 atomic_inc(&sdata->bss->num_sta_ps);
Johannes Bergaf818582009-11-06 11:35:50 +01001089 set_sta_flags(sta, WLAN_STA_PS_STA);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001090 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1091 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
Johannes Berg571ecf62007-07-27 15:43:22 +02001092#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Berg0c68ae262008-10-27 15:56:10 -07001093 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001094 sdata->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +02001095#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1096}
1097
Johannes Bergff9458d2009-10-30 12:56:02 +01001098static void ap_sta_ps_end(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001099{
Johannes Berg133b8222008-09-16 14:18:59 +02001100 struct ieee80211_sub_if_data *sdata = sta->sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02001101
Johannes Berg3e122be2008-07-09 14:40:34 +02001102 atomic_dec(&sdata->bss->num_sta_ps);
Johannes Berg004c8722008-02-20 11:21:35 +01001103
Johannes Berg571ecf62007-07-27 15:43:22 +02001104#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Berg0c68ae262008-10-27 15:56:10 -07001105 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001106 sdata->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +02001107#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
Johannes Berg004c8722008-02-20 11:21:35 +01001108
Johannes Bergaf818582009-11-06 11:35:50 +01001109 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001110#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Bergaf818582009-11-06 11:35:50 +01001111 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001112 sdata->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +02001113#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
Johannes Bergaf818582009-11-06 11:35:50 +01001114 return;
1115 }
1116
1117 ieee80211_sta_ps_deliver_wakeup(sta);
Johannes Berg571ecf62007-07-27 15:43:22 +02001118}
1119
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001120int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
1121{
1122 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
1123 bool in_ps;
1124
1125 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
1126
1127 /* Don't let the same PS state be set twice */
1128 in_ps = test_sta_flags(sta_inf, WLAN_STA_PS_STA);
1129 if ((start && in_ps) || (!start && !in_ps))
1130 return -EINVAL;
1131
1132 if (start)
1133 ap_sta_ps_start(sta_inf);
1134 else
1135 ap_sta_ps_end(sta_inf);
1136
1137 return 0;
1138}
1139EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1140
Johannes Berg49461622008-06-30 15:10:45 +02001141static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001142ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001143{
1144 struct sta_info *sta = rx->sta;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001145 struct sk_buff *skb = rx->skb;
1146 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1147 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001148
1149 if (!sta)
Johannes Berg9ae54c82008-01-31 19:48:20 +01001150 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001151
Johannes Bergb291ba12009-07-10 15:29:03 +02001152 /*
1153 * Update last_rx only for IBSS packets which are for the current
1154 * BSSID to avoid keeping the current IBSS network alive in cases
1155 * where other STAs start using different BSSID.
1156 */
Johannes Berg05c914f2008-09-11 00:01:58 +02001157 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
Ron Rindjunsky71364712007-12-25 17:00:36 +02001158 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
Johannes Berg05c914f2008-09-11 00:01:58 +02001159 NL80211_IFTYPE_ADHOC);
Felix Fietkau3af63342011-02-27 22:08:01 +01001160 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001161 sta->last_rx = jiffies;
Felix Fietkau3af63342011-02-27 22:08:01 +01001162 if (ieee80211_is_data(hdr->frame_control)) {
1163 sta->last_rx_rate_idx = status->rate_idx;
1164 sta->last_rx_rate_flag = status->flag;
1165 }
1166 }
Johannes Bergb291ba12009-07-10 15:29:03 +02001167 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1168 /*
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001169 * Mesh beacons will update last_rx when if they are found to
1170 * match the current local configuration when processed.
Johannes Berg571ecf62007-07-27 15:43:22 +02001171 */
Johannes Bergb291ba12009-07-10 15:29:03 +02001172 sta->last_rx = jiffies;
Felix Fietkau3af63342011-02-27 22:08:01 +01001173 if (ieee80211_is_data(hdr->frame_control)) {
1174 sta->last_rx_rate_idx = status->rate_idx;
1175 sta->last_rx_rate_flag = status->flag;
1176 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001177 }
1178
Johannes Berg554891e2010-09-24 12:38:25 +02001179 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001180 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001181
Kalle Valo3cf335d2009-03-22 21:57:06 +02001182 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1183 ieee80211_sta_rx_notify(rx->sdata, hdr);
1184
Johannes Berg571ecf62007-07-27 15:43:22 +02001185 sta->rx_fragments++;
1186 sta->rx_bytes += rx->skb->len;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001187 sta->last_signal = status->signal;
Bruno Randolf541a45a2010-12-02 19:12:43 +09001188 ewma_add(&sta->avg_signal, -status->signal);
Johannes Berg571ecf62007-07-27 15:43:22 +02001189
Johannes Berg72eaa432008-11-26 15:02:58 +01001190 /*
1191 * Change STA power saving mode only at the end of a frame
1192 * exchange sequence.
1193 */
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001194 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
1195 !ieee80211_has_morefrags(hdr->frame_control) &&
Christian Lamparter4cfda472010-12-27 23:21:26 +01001196 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
Johannes Berg05c914f2008-09-11 00:01:58 +02001197 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1198 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
Johannes Bergaf818582009-11-06 11:35:50 +01001199 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
Johannes Berg72eaa432008-11-26 15:02:58 +01001200 /*
1201 * Ignore doze->wake transitions that are
1202 * indicated by non-data frames, the standard
1203 * is unclear here, but for example going to
1204 * PS mode and then scanning would cause a
1205 * doze->wake transition for the probe request,
1206 * and that is clearly undesirable.
1207 */
1208 if (ieee80211_is_data(hdr->frame_control) &&
1209 !ieee80211_has_pm(hdr->frame_control))
Johannes Bergff9458d2009-10-30 12:56:02 +01001210 ap_sta_ps_end(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +01001211 } else {
1212 if (ieee80211_has_pm(hdr->frame_control))
1213 ap_sta_ps_start(sta);
1214 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001215 }
1216
Johannes Berg22403de2009-10-30 12:55:03 +01001217 /*
1218 * Drop (qos-)data::nullfunc frames silently, since they
1219 * are used only to control station power saving mode.
1220 */
1221 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1222 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001223 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
Felix Fietkaud5242152010-01-08 18:06:26 +01001224
1225 /*
1226 * If we receive a 4-addr nullfunc frame from a STA
1227 * that was not moved to a 4-addr STA vlan yet, drop
1228 * the frame to the monitor interface, to make sure
1229 * that hostapd sees it
1230 */
1231 if (ieee80211_has_a4(hdr->frame_control) &&
1232 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1233 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1234 !rx->sdata->u.vlan.sta)))
1235 return RX_DROP_MONITOR;
Johannes Berg22403de2009-10-30 12:55:03 +01001236 /*
1237 * Update counter and free packet here to avoid
1238 * counting this as a dropped packed.
1239 */
Johannes Berg571ecf62007-07-27 15:43:22 +02001240 sta->rx_packets++;
1241 dev_kfree_skb(rx->skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001242 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001243 }
1244
Johannes Berg9ae54c82008-01-31 19:48:20 +01001245 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001246} /* ieee80211_rx_h_sta_process */
1247
Johannes Berg571ecf62007-07-27 15:43:22 +02001248static inline struct ieee80211_fragment_entry *
1249ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1250 unsigned int frag, unsigned int seq, int rx_queue,
1251 struct sk_buff **skb)
1252{
1253 struct ieee80211_fragment_entry *entry;
1254 int idx;
1255
1256 idx = sdata->fragment_next;
1257 entry = &sdata->fragments[sdata->fragment_next++];
1258 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1259 sdata->fragment_next = 0;
1260
1261 if (!skb_queue_empty(&entry->skb_list)) {
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001262#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
Johannes Berg571ecf62007-07-27 15:43:22 +02001263 struct ieee80211_hdr *hdr =
1264 (struct ieee80211_hdr *) entry->skb_list.next->data;
1265 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1266 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
Johannes Berg0c68ae262008-10-27 15:56:10 -07001267 "addr1=%pM addr2=%pM\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001268 sdata->name, idx,
Johannes Berg571ecf62007-07-27 15:43:22 +02001269 jiffies - entry->first_frag_time, entry->seq,
Johannes Berg0c68ae262008-10-27 15:56:10 -07001270 entry->last_frag, hdr->addr1, hdr->addr2);
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001271#endif
Johannes Berg571ecf62007-07-27 15:43:22 +02001272 __skb_queue_purge(&entry->skb_list);
1273 }
1274
1275 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1276 *skb = NULL;
1277 entry->first_frag_time = jiffies;
1278 entry->seq = seq;
1279 entry->rx_queue = rx_queue;
1280 entry->last_frag = frag;
1281 entry->ccmp = 0;
1282 entry->extra_len = 0;
1283
1284 return entry;
1285}
1286
1287static inline struct ieee80211_fragment_entry *
1288ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001289 unsigned int frag, unsigned int seq,
Johannes Berg571ecf62007-07-27 15:43:22 +02001290 int rx_queue, struct ieee80211_hdr *hdr)
1291{
1292 struct ieee80211_fragment_entry *entry;
1293 int i, idx;
1294
1295 idx = sdata->fragment_next;
1296 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1297 struct ieee80211_hdr *f_hdr;
Johannes Berg571ecf62007-07-27 15:43:22 +02001298
1299 idx--;
1300 if (idx < 0)
1301 idx = IEEE80211_FRAGMENT_MAX - 1;
1302
1303 entry = &sdata->fragments[idx];
1304 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1305 entry->rx_queue != rx_queue ||
1306 entry->last_frag + 1 != frag)
1307 continue;
1308
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001309 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001310
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001311 /*
1312 * Check ftype and addresses are equal, else check next fragment
1313 */
1314 if (((hdr->frame_control ^ f_hdr->frame_control) &
1315 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
Johannes Berg571ecf62007-07-27 15:43:22 +02001316 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1317 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1318 continue;
1319
S.Çağlar Onurab466232008-02-14 17:36:47 +02001320 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001321 __skb_queue_purge(&entry->skb_list);
1322 continue;
1323 }
1324 return entry;
1325 }
1326
1327 return NULL;
1328}
1329
Johannes Berg49461622008-06-30 15:10:45 +02001330static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001331ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001332{
1333 struct ieee80211_hdr *hdr;
1334 u16 sc;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001335 __le16 fc;
Johannes Berg571ecf62007-07-27 15:43:22 +02001336 unsigned int frag, seq;
1337 struct ieee80211_fragment_entry *entry;
1338 struct sk_buff *skb;
Johannes Berg554891e2010-09-24 12:38:25 +02001339 struct ieee80211_rx_status *status;
Johannes Berg571ecf62007-07-27 15:43:22 +02001340
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001341 hdr = (struct ieee80211_hdr *)rx->skb->data;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001342 fc = hdr->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02001343 sc = le16_to_cpu(hdr->seq_ctrl);
1344 frag = sc & IEEE80211_SCTL_FRAG;
1345
Harvey Harrison358c8d92008-07-15 18:44:13 -07001346 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
Johannes Berg571ecf62007-07-27 15:43:22 +02001347 (rx->skb)->len < 24 ||
1348 is_multicast_ether_addr(hdr->addr1))) {
1349 /* not fragmented */
1350 goto out;
1351 }
1352 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1353
Zhu Yie3cf8b32010-03-29 17:35:07 +08001354 if (skb_linearize(rx->skb))
1355 return RX_DROP_UNUSABLE;
1356
Abhijeet Kolekar058897a2010-05-11 11:22:11 -07001357 /*
1358 * skb_linearize() might change the skb->data and
1359 * previously cached variables (in this case, hdr) need to
1360 * be refreshed with the new data.
1361 */
1362 hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001363 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1364
1365 if (frag == 0) {
1366 /* This is the first fragment of a new frame. */
1367 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001368 rx->queue, &(rx->skb));
Johannes Berg97359d12010-08-10 09:46:38 +02001369 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
Harvey Harrison358c8d92008-07-15 18:44:13 -07001370 ieee80211_has_protected(fc)) {
Jouni Malinen91902522010-06-11 10:27:33 -07001371 int queue = ieee80211_is_mgmt(fc) ?
1372 NUM_RX_DATA_QUEUES : rx->queue;
Johannes Berg571ecf62007-07-27 15:43:22 +02001373 /* Store CCMP PN so that we can verify that the next
1374 * fragment has a sequential PN value. */
1375 entry->ccmp = 1;
1376 memcpy(entry->last_pn,
Jouni Malinen91902522010-06-11 10:27:33 -07001377 rx->key->u.ccmp.rx_pn[queue],
Johannes Berg571ecf62007-07-27 15:43:22 +02001378 CCMP_PN_LEN);
1379 }
Johannes Berg9ae54c82008-01-31 19:48:20 +01001380 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001381 }
1382
1383 /* This is a fragment for a frame that should already be pending in
1384 * fragment cache. Add this fragment to the end of the pending entry.
1385 */
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001386 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
Johannes Berg571ecf62007-07-27 15:43:22 +02001387 if (!entry) {
1388 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001389 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02001390 }
1391
1392 /* Verify that MPDUs within one MSDU have sequential PN values.
1393 * (IEEE 802.11i, 8.3.3.4.5) */
1394 if (entry->ccmp) {
1395 int i;
1396 u8 pn[CCMP_PN_LEN], *rpn;
Jouni Malinen91902522010-06-11 10:27:33 -07001397 int queue;
Johannes Berg97359d12010-08-10 09:46:38 +02001398 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
Johannes Berge4c26ad2008-01-31 19:48:21 +01001399 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001400 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1401 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1402 pn[i]++;
1403 if (pn[i])
1404 break;
1405 }
Jouni Malinen91902522010-06-11 10:27:33 -07001406 queue = ieee80211_is_mgmt(fc) ?
1407 NUM_RX_DATA_QUEUES : rx->queue;
1408 rpn = rx->key->u.ccmp.rx_pn[queue];
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001409 if (memcmp(pn, rpn, CCMP_PN_LEN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001410 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001411 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1412 }
1413
Harvey Harrison358c8d92008-07-15 18:44:13 -07001414 skb_pull(rx->skb, ieee80211_hdrlen(fc));
Johannes Berg571ecf62007-07-27 15:43:22 +02001415 __skb_queue_tail(&entry->skb_list, rx->skb);
1416 entry->last_frag = frag;
1417 entry->extra_len += rx->skb->len;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001418 if (ieee80211_has_morefrags(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001419 rx->skb = NULL;
Johannes Berg9ae54c82008-01-31 19:48:20 +01001420 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001421 }
1422
1423 rx->skb = __skb_dequeue(&entry->skb_list);
1424 if (skb_tailroom(rx->skb) < entry->extra_len) {
1425 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1426 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1427 GFP_ATOMIC))) {
1428 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1429 __skb_queue_purge(&entry->skb_list);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001430 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001431 }
1432 }
1433 while ((skb = __skb_dequeue(&entry->skb_list))) {
1434 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1435 dev_kfree_skb(skb);
1436 }
1437
1438 /* Complete frame has been reassembled - process it now */
Johannes Berg554891e2010-09-24 12:38:25 +02001439 status = IEEE80211_SKB_RXCB(rx->skb);
1440 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001441
1442 out:
1443 if (rx->sta)
1444 rx->sta->rx_packets++;
1445 if (is_multicast_ether_addr(hdr->addr1))
1446 rx->local->dot11MulticastReceivedFrameCount++;
1447 else
1448 ieee80211_led_rx(rx->local);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001449 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001450}
1451
Johannes Berg49461622008-06-30 15:10:45 +02001452static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001453ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001454{
Johannes Bergaf818582009-11-06 11:35:50 +01001455 struct ieee80211_sub_if_data *sdata = rx->sdata;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001456 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
Johannes Berg554891e2010-09-24 12:38:25 +02001457 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001458
Harvey Harrison358c8d92008-07-15 18:44:13 -07001459 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
Johannes Berg554891e2010-09-24 12:38:25 +02001460 !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001461 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001462
Johannes Berg05c914f2008-09-11 00:01:58 +02001463 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1464 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001465 return RX_DROP_UNUSABLE;
Ron Rindjunsky98f0b0a2007-12-18 17:23:53 +02001466
Johannes Bergaf818582009-11-06 11:35:50 +01001467 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1468 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1469 else
1470 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
Johannes Berg571ecf62007-07-27 15:43:22 +02001471
Johannes Berg9ae54c82008-01-31 19:48:20 +01001472 /* Free PS Poll skb here instead of returning RX_DROP that would
Johannes Berg571ecf62007-07-27 15:43:22 +02001473 * count as an dropped frame. */
1474 dev_kfree_skb(rx->skb);
1475
Johannes Berg9ae54c82008-01-31 19:48:20 +01001476 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001477}
1478
Johannes Berg49461622008-06-30 15:10:45 +02001479static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001480ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +02001481{
Johannes Berg6e0d1142007-07-27 15:43:22 +02001482 u8 *data = rx->skb->data;
Harvey Harrison238f74a2008-07-02 11:05:34 -07001483 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001484
Harvey Harrison238f74a2008-07-02 11:05:34 -07001485 if (!ieee80211_is_data_qos(hdr->frame_control))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001486 return RX_CONTINUE;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001487
1488 /* remove the qos control field, update frame type and meta-data */
Harvey Harrison238f74a2008-07-02 11:05:34 -07001489 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1490 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1491 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
Johannes Berg6e0d1142007-07-27 15:43:22 +02001492 /* change frame type to non QOS */
Harvey Harrison238f74a2008-07-02 11:05:34 -07001493 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
Johannes Berg6e0d1142007-07-27 15:43:22 +02001494
Johannes Berg9ae54c82008-01-31 19:48:20 +01001495 return RX_CONTINUE;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001496}
1497
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001498static int
Johannes Berg5cf121c2008-02-25 16:27:43 +01001499ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001500{
Johannes Berg07346f812008-05-03 01:02:02 +02001501 if (unlikely(!rx->sta ||
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001502 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001503 return -EACCES;
Johannes Berg571ecf62007-07-27 15:43:22 +02001504
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001505 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001506}
1507
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001508static int
Harvey Harrison358c8d92008-07-15 18:44:13 -07001509ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Berg571ecf62007-07-27 15:43:22 +02001510{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001511 struct sk_buff *skb = rx->skb;
1512 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1513
Johannes Berg3017b802007-08-28 17:01:53 -04001514 /*
Johannes Berg7848ba72007-09-14 11:10:25 -04001515 * Pass through unencrypted frames if the hardware has
1516 * decrypted them already.
Johannes Berg3017b802007-08-28 17:01:53 -04001517 */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001518 if (status->flag & RX_FLAG_DECRYPTED)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001519 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001520
1521 /* Drop unencrypted frames if key is set. */
Harvey Harrison358c8d92008-07-15 18:44:13 -07001522 if (unlikely(!ieee80211_has_protected(fc) &&
1523 !ieee80211_is_nullfunc(fc) &&
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03001524 ieee80211_is_data(fc) &&
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +02001525 (rx->key || rx->sdata->drop_unencrypted)))
1526 return -EACCES;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001527
1528 return 0;
1529}
1530
1531static int
1532ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1533{
1534 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Jouni Malinene3efca02010-03-28 22:31:15 -07001535 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001536 __le16 fc = hdr->frame_control;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001537
Jouni Malinene3efca02010-03-28 22:31:15 -07001538 /*
1539 * Pass through unencrypted frames if the hardware has
1540 * decrypted them already.
1541 */
1542 if (status->flag & RX_FLAG_DECRYPTED)
1543 return 0;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001544
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03001545 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
Jouni Malinend211e902010-03-28 22:29:52 -07001546 if (unlikely(!ieee80211_has_protected(fc) &&
1547 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinencf4e5942010-12-16 00:52:40 +02001548 rx->key)) {
1549 if (ieee80211_is_deauth(fc))
1550 cfg80211_send_unprot_deauth(rx->sdata->dev,
1551 rx->skb->data,
1552 rx->skb->len);
1553 else if (ieee80211_is_disassoc(fc))
1554 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1555 rx->skb->data,
1556 rx->skb->len);
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03001557 return -EACCES;
Jouni Malinencf4e5942010-12-16 00:52:40 +02001558 }
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03001559 /* BIP does not use Protected field, so need to check MMIE */
Joe Perchesf64f9e72009-11-29 16:55:45 -08001560 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinencf4e5942010-12-16 00:52:40 +02001561 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1562 if (ieee80211_is_deauth(fc))
1563 cfg80211_send_unprot_deauth(rx->sdata->dev,
1564 rx->skb->data,
1565 rx->skb->len);
1566 else if (ieee80211_is_disassoc(fc))
1567 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1568 rx->skb->data,
1569 rx->skb->len);
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03001570 return -EACCES;
Jouni Malinencf4e5942010-12-16 00:52:40 +02001571 }
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03001572 /*
1573 * When using MFP, Action frames are not allowed prior to
1574 * having configured keys.
1575 */
1576 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1577 ieee80211_is_robust_mgmt_frame(
1578 (struct ieee80211_hdr *) rx->skb->data)))
1579 return -EACCES;
1580 }
Johannes Bergb3fc9c62008-04-13 10:12:47 +02001581
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001582 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001583}
1584
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001585static int
Zhu Yie31a16d2009-05-21 21:47:03 +08001586__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001587{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001588 struct ieee80211_sub_if_data *sdata = rx->sdata;
Felix Fietkauf14543ee2009-11-10 20:10:05 +01001589 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Felix Fietkaufbb327c2011-01-18 15:48:48 +01001590 bool check_port_control = false;
1591 struct ethhdr *ehdr;
1592 int ret;
Felix Fietkauf14543ee2009-11-10 20:10:05 +01001593
Johannes Berg9bc383d2009-11-19 11:55:19 +01001594 if (ieee80211_has_a4(hdr->frame_control) &&
1595 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
Felix Fietkauf14543ee2009-11-10 20:10:05 +01001596 return -1;
Johannes Berg9bc383d2009-11-19 11:55:19 +01001597
Felix Fietkaufbb327c2011-01-18 15:48:48 +01001598 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1599 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1600
1601 if (!sdata->u.mgd.use_4addr)
1602 return -1;
1603 else
1604 check_port_control = true;
1605 }
1606
Johannes Berg9bc383d2009-11-19 11:55:19 +01001607 if (is_multicast_ether_addr(hdr->addr1) &&
Felix Fietkaufbb327c2011-01-18 15:48:48 +01001608 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
Felix Fietkauf14543ee2009-11-10 20:10:05 +01001609 return -1;
Johannes Berg571ecf62007-07-27 15:43:22 +02001610
Felix Fietkaufbb327c2011-01-18 15:48:48 +01001611 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1612 if (ret < 0 || !check_port_control)
1613 return ret;
1614
1615 ehdr = (struct ethhdr *) rx->skb->data;
1616 if (ehdr->h_proto != rx->sdata->control_port_protocol)
1617 return -1;
1618
1619 return 0;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001620}
Johannes Berg571ecf62007-07-27 15:43:22 +02001621
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001622/*
1623 * requires that rx->skb is a frame with ethernet header
1624 */
Harvey Harrison358c8d92008-07-15 18:44:13 -07001625static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001626{
Senthil Balasubramanianc97c23e2008-05-28 23:15:32 +05301627 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001628 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1629 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1630
1631 /*
1632 * Allow EAPOL frames to us/the PAE group address regardless
1633 * of whether the frame was encrypted or not.
1634 */
Johannes Berga621fa42010-08-27 14:26:54 +03001635 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
Johannes Berg47846c92009-11-25 17:46:19 +01001636 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001637 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1638 return true;
1639
1640 if (ieee80211_802_1x_port_control(rx) ||
Harvey Harrison358c8d92008-07-15 18:44:13 -07001641 ieee80211_drop_unencrypted(rx, fc))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001642 return false;
1643
1644 return true;
1645}
1646
1647/*
1648 * requires that rx->skb is a frame with ethernet header
1649 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001650static void
Johannes Berg5cf121c2008-02-25 16:27:43 +01001651ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001652{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001653 struct ieee80211_sub_if_data *sdata = rx->sdata;
1654 struct net_device *dev = sdata->dev;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001655 struct sk_buff *skb, *xmit_skb;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001656 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1657 struct sta_info *dsta;
Johannes Berg554891e2010-09-24 12:38:25 +02001658 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001659
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001660 skb = rx->skb;
1661 xmit_skb = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +02001662
Johannes Berg05c914f2008-09-11 00:01:58 +02001663 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1664 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Johannes Berg213cd112008-09-11 00:01:54 +02001665 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
Johannes Berg554891e2010-09-24 12:38:25 +02001666 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
Johannes Berg9bc383d2009-11-19 11:55:19 +01001667 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001668 if (is_multicast_ether_addr(ehdr->h_dest)) {
1669 /*
1670 * send multicast frames both to higher layers in
1671 * local net stack and back to the wireless medium
1672 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001673 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1674 if (!xmit_skb && net_ratelimit())
Johannes Berg571ecf62007-07-27 15:43:22 +02001675 printk(KERN_DEBUG "%s: failed to clone "
1676 "multicast frame\n", dev->name);
1677 } else {
Johannes Bergabe60632009-11-25 17:46:18 +01001678 dsta = sta_info_get(sdata, skb->data);
1679 if (dsta) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001680 /*
1681 * The destination station is associated to
1682 * this AP (in this VLAN), so send the frame
1683 * directly to it and do not pass it to local
1684 * net stack.
Johannes Berg571ecf62007-07-27 15:43:22 +02001685 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001686 xmit_skb = skb;
Johannes Berg571ecf62007-07-27 15:43:22 +02001687 skb = NULL;
1688 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001689 }
1690 }
1691
1692 if (skb) {
Johannes Bergd1c3a372009-01-07 00:26:10 +01001693 int align __maybe_unused;
1694
Kalle Valo59d9cb02009-12-17 13:54:57 +01001695#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
Johannes Bergd1c3a372009-01-07 00:26:10 +01001696 /*
1697 * 'align' will only take the values 0 or 2 here
1698 * since all frames are required to be aligned
1699 * to 2-byte boundaries when being passed to
1700 * mac80211. That also explains the __skb_push()
1701 * below.
1702 */
matthieu castetdacb6f12009-06-04 22:16:18 +02001703 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
Johannes Bergd1c3a372009-01-07 00:26:10 +01001704 if (align) {
1705 if (WARN_ON(skb_headroom(skb) < 3)) {
1706 dev_kfree_skb(skb);
1707 skb = NULL;
1708 } else {
1709 u8 *data = skb->data;
Zhu Yi8ce0b582009-10-28 13:13:52 -07001710 size_t len = skb_headlen(skb);
1711 skb->data -= align;
1712 memmove(skb->data, data, len);
1713 skb_set_tail_pointer(skb, len);
Johannes Bergd1c3a372009-01-07 00:26:10 +01001714 }
1715 }
1716#endif
1717
1718 if (skb) {
1719 /* deliver to local stack */
1720 skb->protocol = eth_type_trans(skb, dev);
1721 memset(skb->cb, 0, sizeof(skb->cb));
John W. Linville5548a8a2010-06-24 14:25:56 -04001722 netif_receive_skb(skb);
Johannes Bergd1c3a372009-01-07 00:26:10 +01001723 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001724 }
1725
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001726 if (xmit_skb) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001727 /* send to wireless media */
YOSHIFUJI Hideakif831e902007-12-12 03:54:23 +09001728 xmit_skb->protocol = htons(ETH_P_802_3);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001729 skb_reset_network_header(xmit_skb);
1730 skb_reset_mac_header(xmit_skb);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001731 dev_queue_xmit(xmit_skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001732 }
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001733}
1734
Johannes Berg49461622008-06-30 15:10:45 +02001735static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001736ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001737{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001738 struct net_device *dev = rx->sdata->dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08001739 struct sk_buff *skb = rx->skb;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001740 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1741 __le16 fc = hdr->frame_control;
Zhu Yieaf85ca2009-12-01 10:18:37 +08001742 struct sk_buff_head frame_list;
Johannes Berg554891e2010-09-24 12:38:25 +02001743 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001744
Harvey Harrison358c8d92008-07-15 18:44:13 -07001745 if (unlikely(!ieee80211_is_data(fc)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001746 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001747
Harvey Harrison358c8d92008-07-15 18:44:13 -07001748 if (unlikely(!ieee80211_is_data_present(fc)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001749 return RX_DROP_MONITOR;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001750
Johannes Berg554891e2010-09-24 12:38:25 +02001751 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001752 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001753
Zhu Yieaf85ca2009-12-01 10:18:37 +08001754 if (ieee80211_has_a4(hdr->frame_control) &&
1755 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1756 !rx->sdata->u.vlan.sta)
1757 return RX_DROP_UNUSABLE;
1758
1759 if (is_multicast_ether_addr(hdr->addr1) &&
1760 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1761 rx->sdata->u.vlan.sta) ||
1762 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1763 rx->sdata->u.mgd.use_4addr)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001764 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001765
1766 skb->dev = dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08001767 __skb_queue_head_init(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001768
Zhu Yie3cf8b32010-03-29 17:35:07 +08001769 if (skb_linearize(skb))
1770 return RX_DROP_UNUSABLE;
1771
Zhu Yieaf85ca2009-12-01 10:18:37 +08001772 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1773 rx->sdata->vif.type,
1774 rx->local->hw.extra_tx_headroom);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001775
Zhu Yieaf85ca2009-12-01 10:18:37 +08001776 while (!skb_queue_empty(&frame_list)) {
1777 rx->skb = __skb_dequeue(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001778
Harvey Harrison358c8d92008-07-15 18:44:13 -07001779 if (!ieee80211_frame_allowed(rx, fc)) {
Zhu Yieaf85ca2009-12-01 10:18:37 +08001780 dev_kfree_skb(rx->skb);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001781 continue;
1782 }
Zhu Yieaf85ca2009-12-01 10:18:37 +08001783 dev->stats.rx_packets++;
1784 dev->stats.rx_bytes += rx->skb->len;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001785
1786 ieee80211_deliver_skb(rx);
1787 }
1788
Johannes Berg9ae54c82008-01-31 19:48:20 +01001789 return RX_QUEUED;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001790}
1791
Ingo Molnarbf94e172008-10-12 23:51:38 -07001792#ifdef CONFIG_MAC80211_MESH
Davide Pesaventob0dee572008-09-27 17:29:12 +02001793static ieee80211_rx_result
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001794ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1795{
1796 struct ieee80211_hdr *hdr;
1797 struct ieee80211s_hdr *mesh_hdr;
1798 unsigned int hdrlen;
1799 struct sk_buff *skb = rx->skb, *fwd_skb;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001800 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001801 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg554891e2010-09-24 12:38:25 +02001802 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001803
1804 hdr = (struct ieee80211_hdr *) skb->data;
1805 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1806 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1807
1808 if (!ieee80211_is_data(hdr->frame_control))
1809 return RX_CONTINUE;
1810
1811 if (!mesh_hdr->ttl)
1812 /* illegal frame */
1813 return RX_DROP_MONITOR;
1814
Javier Cardona43b7b312009-10-15 18:10:51 -07001815 if (mesh_hdr->flags & MESH_FLAGS_AE) {
YanBo79617de2008-09-22 13:30:32 +08001816 struct mesh_path *mppath;
Javier Cardona43b7b312009-10-15 18:10:51 -07001817 char *proxied_addr;
1818 char *mpp_addr;
1819
1820 if (is_multicast_ether_addr(hdr->addr1)) {
1821 mpp_addr = hdr->addr3;
1822 proxied_addr = mesh_hdr->eaddr1;
1823 } else {
1824 mpp_addr = hdr->addr4;
1825 proxied_addr = mesh_hdr->eaddr2;
1826 }
YanBo79617de2008-09-22 13:30:32 +08001827
YanBo79617de2008-09-22 13:30:32 +08001828 rcu_read_lock();
Javier Cardona43b7b312009-10-15 18:10:51 -07001829 mppath = mpp_path_lookup(proxied_addr, sdata);
YanBo79617de2008-09-22 13:30:32 +08001830 if (!mppath) {
Javier Cardona43b7b312009-10-15 18:10:51 -07001831 mpp_path_add(proxied_addr, mpp_addr, sdata);
YanBo79617de2008-09-22 13:30:32 +08001832 } else {
1833 spin_lock_bh(&mppath->state_lock);
Javier Cardona43b7b312009-10-15 18:10:51 -07001834 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1835 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
YanBo79617de2008-09-22 13:30:32 +08001836 spin_unlock_bh(&mppath->state_lock);
1837 }
1838 rcu_read_unlock();
1839 }
1840
Javier Cardona3c5772a2009-08-10 12:15:48 -07001841 /* Frame has reached destination. Don't forward */
1842 if (!is_multicast_ether_addr(hdr->addr1) &&
Johannes Berg47846c92009-11-25 17:46:19 +01001843 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001844 return RX_CONTINUE;
1845
1846 mesh_hdr->ttl--;
1847
Johannes Berg554891e2010-09-24 12:38:25 +02001848 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001849 if (!mesh_hdr->ttl)
Johannes Berg472dbc42008-09-11 00:01:49 +02001850 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001851 dropped_frames_ttl);
1852 else {
1853 struct ieee80211_hdr *fwd_hdr;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001854 struct ieee80211_tx_info *info;
1855
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001856 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1857
1858 if (!fwd_skb && net_ratelimit())
1859 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001860 sdata->name);
Milton Miller919bbad2010-12-30 02:01:03 -06001861 if (!fwd_skb)
Johannes Bergb51aff02010-12-22 10:15:07 +01001862 goto out;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001863
1864 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
Johannes Berg47846c92009-11-25 17:46:19 +01001865 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001866 info = IEEE80211_SKB_CB(fwd_skb);
1867 memset(info, 0, sizeof(*info));
1868 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
Johannes Berg5061b0c2009-07-14 00:33:34 +02001869 info->control.vif = &rx->sdata->vif;
Johannes Bergcf0277e2010-01-05 18:00:58 +01001870 skb_set_queue_mapping(skb,
1871 ieee80211_select_queue(rx->sdata, fwd_skb));
1872 ieee80211_set_qos_hdr(local, skb);
Daniel Walkerc8a61a72009-08-18 10:59:00 -07001873 if (is_multicast_ether_addr(fwd_hdr->addr1))
1874 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1875 fwded_mcast);
1876 else {
Javier Cardona3c5772a2009-08-10 12:15:48 -07001877 int err;
1878 /*
1879 * Save TA to addr1 to send TA a path error if a
1880 * suitable next hop is not found
1881 */
1882 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
Javier Cardona249b4052009-07-07 10:55:03 -07001883 ETH_ALEN);
Javier Cardona3c5772a2009-08-10 12:15:48 -07001884 err = mesh_nexthop_lookup(fwd_skb, sdata);
Javier Cardona249b4052009-07-07 10:55:03 -07001885 /* Failed to immediately resolve next hop:
1886 * fwded frame was dropped or will be added
1887 * later to the pending skb queue. */
1888 if (err)
1889 return RX_DROP_MONITOR;
Daniel Walkerc8a61a72009-08-18 10:59:00 -07001890
1891 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1892 fwded_unicast);
Javier Cardona249b4052009-07-07 10:55:03 -07001893 }
1894 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1895 fwded_frames);
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001896 ieee80211_add_pending_skb(local, fwd_skb);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001897 }
1898 }
1899
Johannes Bergb51aff02010-12-22 10:15:07 +01001900 out:
Javier Cardona3c5772a2009-08-10 12:15:48 -07001901 if (is_multicast_ether_addr(hdr->addr1) ||
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001902 sdata->dev->flags & IFF_PROMISC)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001903 return RX_CONTINUE;
1904 else
1905 return RX_DROP_MONITOR;
1906}
Ingo Molnarbf94e172008-10-12 23:51:38 -07001907#endif
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001908
1909static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001910ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001911{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001912 struct ieee80211_sub_if_data *sdata = rx->sdata;
Vivek Natarajane15276a2010-02-08 17:47:01 +05301913 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001914 struct net_device *dev = sdata->dev;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001915 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1916 __le16 fc = hdr->frame_control;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001917 int err;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001918
Harvey Harrison358c8d92008-07-15 18:44:13 -07001919 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001920 return RX_CONTINUE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001921
Harvey Harrison358c8d92008-07-15 18:44:13 -07001922 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001923 return RX_DROP_MONITOR;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001924
Felix Fietkauf14543ee2009-11-10 20:10:05 +01001925 /*
1926 * Allow the cooked monitor interface of an AP to see 4-addr frames so
1927 * that a 4-addr station can be detected and moved into a separate VLAN
1928 */
1929 if (ieee80211_has_a4(hdr->frame_control) &&
1930 sdata->vif.type == NL80211_IFTYPE_AP)
1931 return RX_DROP_MONITOR;
1932
Zhu Yie31a16d2009-05-21 21:47:03 +08001933 err = __ieee80211_data_to_8023(rx);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001934 if (unlikely(err))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001935 return RX_DROP_UNUSABLE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001936
Harvey Harrison358c8d92008-07-15 18:44:13 -07001937 if (!ieee80211_frame_allowed(rx, fc))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001938 return RX_DROP_MONITOR;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001939
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001940 rx->skb->dev = dev;
1941
1942 dev->stats.rx_packets++;
1943 dev->stats.rx_bytes += rx->skb->len;
1944
Helmut Schaa08ca9442010-11-30 12:19:34 +01001945 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
Rajkumar Manoharan8c99f692011-02-02 22:57:53 +05301946 !is_multicast_ether_addr(
1947 ((struct ethhdr *)rx->skb->data)->h_dest) &&
1948 (!local->scanning &&
1949 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
Vivek Natarajane15276a2010-02-08 17:47:01 +05301950 mod_timer(&local->dynamic_ps_timer, jiffies +
1951 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1952 }
1953
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001954 ieee80211_deliver_skb(rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02001955
Johannes Berg9ae54c82008-01-31 19:48:20 +01001956 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001957}
1958
Johannes Berg49461622008-06-30 15:10:45 +02001959static ieee80211_rx_result debug_noinline
Christian Lamparter24a8fda2010-12-30 17:25:29 +01001960ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
Ron Rindjunsky71364712007-12-25 17:00:36 +02001961{
1962 struct ieee80211_local *local = rx->local;
1963 struct ieee80211_hw *hw = &local->hw;
1964 struct sk_buff *skb = rx->skb;
Harvey Harrisona7767f92008-07-02 16:30:51 -07001965 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001966 struct tid_ampdu_rx *tid_agg_rx;
1967 u16 start_seq_num;
1968 u16 tid;
1969
Harvey Harrisona7767f92008-07-02 16:30:51 -07001970 if (likely(!ieee80211_is_ctl(bar->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001971 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001972
Harvey Harrisona7767f92008-07-02 16:30:51 -07001973 if (ieee80211_is_back_req(bar->frame_control)) {
Johannes Berg8ae59772010-05-30 14:52:58 +02001974 struct {
1975 __le16 control, start_seq_num;
1976 } __packed bar_data;
1977
Ron Rindjunsky71364712007-12-25 17:00:36 +02001978 if (!rx->sta)
Johannes Berga02ae752009-11-16 12:00:40 +01001979 return RX_DROP_MONITOR;
Johannes Berg8ae59772010-05-30 14:52:58 +02001980
1981 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
1982 &bar_data, sizeof(bar_data)))
1983 return RX_DROP_MONITOR;
1984
Johannes Berg8ae59772010-05-30 14:52:58 +02001985 tid = le16_to_cpu(bar_data.control) >> 12;
Johannes Berga87f7362010-06-10 10:21:38 +02001986
1987 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
1988 if (!tid_agg_rx)
Johannes Berga02ae752009-11-16 12:00:40 +01001989 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001990
Johannes Berg8ae59772010-05-30 14:52:58 +02001991 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001992
1993 /* reset session timer */
Johannes Berg20ad19d2009-02-10 21:25:45 +01001994 if (tid_agg_rx->timeout)
1995 mod_timer(&tid_agg_rx->session_timer,
1996 TU_TO_EXP_TIME(tid_agg_rx->timeout));
Ron Rindjunsky71364712007-12-25 17:00:36 +02001997
Johannes Bergdd318572010-11-29 11:09:16 +01001998 spin_lock(&tid_agg_rx->reorder_lock);
Johannes Berga02ae752009-11-16 12:00:40 +01001999 /* release stored frames up to start of BAR */
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002000 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
Johannes Bergdd318572010-11-29 11:09:16 +01002001 spin_unlock(&tid_agg_rx->reorder_lock);
2002
Johannes Berga02ae752009-11-16 12:00:40 +01002003 kfree_skb(skb);
2004 return RX_QUEUED;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002005 }
2006
Johannes Berg08daeca2010-05-30 14:53:43 +02002007 /*
2008 * After this point, we only want management frames,
2009 * so we can drop all remaining control frames to
2010 * cooked monitor interfaces.
2011 */
2012 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002013}
2014
Jouni Malinenf4f727a2009-01-10 11:46:53 +02002015static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2016 struct ieee80211_mgmt *mgmt,
2017 size_t len)
Jouni Malinenfea14732009-01-08 13:32:06 +02002018{
2019 struct ieee80211_local *local = sdata->local;
2020 struct sk_buff *skb;
2021 struct ieee80211_mgmt *resp;
2022
Johannes Berg47846c92009-11-25 17:46:19 +01002023 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
Jouni Malinenfea14732009-01-08 13:32:06 +02002024 /* Not to own unicast address */
2025 return;
2026 }
2027
Johannes Berg46900292009-02-15 12:44:28 +01002028 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
2029 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
Johannes Berg77fdaa12009-07-07 03:45:17 +02002030 /* Not from the current AP or not associated yet. */
Jouni Malinenfea14732009-01-08 13:32:06 +02002031 return;
2032 }
2033
2034 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2035 /* Too short SA Query request frame */
2036 return;
2037 }
2038
2039 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2040 if (skb == NULL)
2041 return;
2042
2043 skb_reserve(skb, local->hw.extra_tx_headroom);
2044 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2045 memset(resp, 0, 24);
2046 memcpy(resp->da, mgmt->sa, ETH_ALEN);
Johannes Berg47846c92009-11-25 17:46:19 +01002047 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
Johannes Berg46900292009-02-15 12:44:28 +01002048 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
Jouni Malinenfea14732009-01-08 13:32:06 +02002049 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2050 IEEE80211_STYPE_ACTION);
2051 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2052 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2053 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2054 memcpy(resp->u.action.u.sa_query.trans_id,
2055 mgmt->u.action.u.sa_query.trans_id,
2056 WLAN_SA_QUERY_TR_ID_LEN);
2057
Johannes Berg62ae67b2009-11-18 18:42:05 +01002058 ieee80211_tx_skb(sdata, skb);
Jouni Malinenfea14732009-01-08 13:32:06 +02002059}
2060
Johannes Berg49461622008-06-30 15:10:45 +02002061static ieee80211_rx_result debug_noinline
Johannes Berg2e161f72010-08-12 15:38:38 +02002062ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2063{
2064 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02002065 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02002066
2067 /*
2068 * From here on, look only at management frames.
2069 * Data and control frames are already handled,
2070 * and unknown (reserved) frames are useless.
2071 */
2072 if (rx->skb->len < 24)
2073 return RX_DROP_MONITOR;
2074
2075 if (!ieee80211_is_mgmt(mgmt->frame_control))
2076 return RX_DROP_MONITOR;
2077
Johannes Berg554891e2010-09-24 12:38:25 +02002078 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
Johannes Berg2e161f72010-08-12 15:38:38 +02002079 return RX_DROP_MONITOR;
2080
2081 if (ieee80211_drop_unencrypted_mgmt(rx))
2082 return RX_DROP_UNUSABLE;
2083
2084 return RX_CONTINUE;
2085}
2086
2087static ieee80211_rx_result debug_noinline
Johannes Bergde1ede72008-09-09 14:42:50 +02002088ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2089{
2090 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002091 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergde1ede72008-09-09 14:42:50 +02002092 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02002093 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergde1ede72008-09-09 14:42:50 +02002094 int len = rx->skb->len;
2095
2096 if (!ieee80211_is_action(mgmt->frame_control))
2097 return RX_CONTINUE;
2098
Jouni Malinen026331c2010-02-15 12:53:10 +02002099 /* drop too small frames */
2100 if (len < IEEE80211_MIN_ACTION_SIZE)
2101 return RX_DROP_UNUSABLE;
2102
2103 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
Johannes Berg84040802010-02-15 12:46:39 +02002104 return RX_DROP_UNUSABLE;
Johannes Bergde1ede72008-09-09 14:42:50 +02002105
Johannes Berg554891e2010-09-24 12:38:25 +02002106 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
Johannes Berg84040802010-02-15 12:46:39 +02002107 return RX_DROP_UNUSABLE;
Johannes Bergde1ede72008-09-09 14:42:50 +02002108
Johannes Bergde1ede72008-09-09 14:42:50 +02002109 switch (mgmt->u.action.category) {
2110 case WLAN_CATEGORY_BACK:
Johannes Berg8abd3f92009-02-10 21:25:47 +01002111 /*
2112 * The aggregation code is not prepared to handle
2113 * anything but STA/AP due to the BSSID handling;
2114 * IBSS could work in the code but isn't supported
2115 * by drivers or the standard.
2116 */
2117 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2118 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2119 sdata->vif.type != NL80211_IFTYPE_AP)
Johannes Berg84040802010-02-15 12:46:39 +02002120 break;
Johannes Berg8abd3f92009-02-10 21:25:47 +01002121
Jouni Malinen026331c2010-02-15 12:53:10 +02002122 /* verify action_code is present */
2123 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2124 break;
2125
Johannes Bergde1ede72008-09-09 14:42:50 +02002126 switch (mgmt->u.action.u.addba_req.action_code) {
2127 case WLAN_ACTION_ADDBA_REQ:
2128 if (len < (IEEE80211_MIN_ACTION_SIZE +
2129 sizeof(mgmt->u.action.u.addba_req)))
Johannes Bergbed7ee62010-06-10 10:21:35 +02002130 goto invalid;
2131 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002132 case WLAN_ACTION_ADDBA_RESP:
2133 if (len < (IEEE80211_MIN_ACTION_SIZE +
2134 sizeof(mgmt->u.action.u.addba_resp)))
Johannes Bergbed7ee62010-06-10 10:21:35 +02002135 goto invalid;
2136 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002137 case WLAN_ACTION_DELBA:
2138 if (len < (IEEE80211_MIN_ACTION_SIZE +
2139 sizeof(mgmt->u.action.u.delba)))
Johannes Bergbed7ee62010-06-10 10:21:35 +02002140 goto invalid;
2141 break;
2142 default:
2143 goto invalid;
Johannes Bergde1ede72008-09-09 14:42:50 +02002144 }
Johannes Bergbed7ee62010-06-10 10:21:35 +02002145
Johannes Berg8b58ff82010-06-10 10:21:51 +02002146 goto queue;
Johannes Berg39192c02008-09-09 14:49:03 +02002147 case WLAN_CATEGORY_SPECTRUM_MGMT:
2148 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
Johannes Berg84040802010-02-15 12:46:39 +02002149 break;
Johannes Berg46900292009-02-15 12:44:28 +01002150
2151 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02002152 break;
Johannes Berg46900292009-02-15 12:44:28 +01002153
Jouni Malinen026331c2010-02-15 12:53:10 +02002154 /* verify action_code is present */
2155 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2156 break;
2157
Johannes Berg39192c02008-09-09 14:49:03 +02002158 switch (mgmt->u.action.u.measurement.action_code) {
2159 case WLAN_ACTION_SPCT_MSR_REQ:
2160 if (len < (IEEE80211_MIN_ACTION_SIZE +
2161 sizeof(mgmt->u.action.u.measurement)))
Johannes Berg84040802010-02-15 12:46:39 +02002162 break;
Johannes Berg39192c02008-09-09 14:49:03 +02002163 ieee80211_process_measurement_req(sdata, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02002164 goto handled;
Sujithc481ec92009-01-06 09:28:37 +05302165 case WLAN_ACTION_SPCT_CHL_SWITCH:
2166 if (len < (IEEE80211_MIN_ACTION_SIZE +
2167 sizeof(mgmt->u.action.u.chan_switch)))
Johannes Berg84040802010-02-15 12:46:39 +02002168 break;
Sujithc481ec92009-01-06 09:28:37 +05302169
Johannes Bergcc32abd2009-05-15 11:52:31 +02002170 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02002171 break;
Johannes Bergcc32abd2009-05-15 11:52:31 +02002172
Johannes Berg46900292009-02-15 12:44:28 +01002173 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
Johannes Berg84040802010-02-15 12:46:39 +02002174 break;
Sujithc481ec92009-01-06 09:28:37 +05302175
Johannes Berg8b58ff82010-06-10 10:21:51 +02002176 goto queue;
Johannes Berg39192c02008-09-09 14:49:03 +02002177 }
2178 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02002179 case WLAN_CATEGORY_SA_QUERY:
2180 if (len < (IEEE80211_MIN_ACTION_SIZE +
2181 sizeof(mgmt->u.action.u.sa_query)))
Johannes Berg84040802010-02-15 12:46:39 +02002182 break;
2183
Jouni Malinenfea14732009-01-08 13:32:06 +02002184 switch (mgmt->u.action.u.sa_query.action) {
2185 case WLAN_ACTION_SA_QUERY_REQUEST:
2186 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02002187 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02002188 ieee80211_process_sa_query_req(sdata, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02002189 goto handled;
Jouni Malinenfea14732009-01-08 13:32:06 +02002190 }
2191 break;
Javier Cardona97ad9132010-03-29 11:00:21 -07002192 case WLAN_CATEGORY_MESH_PLINK:
Johannes Berg77a121c2010-06-10 10:21:34 +02002193 if (!ieee80211_vif_is_mesh(&sdata->vif))
2194 break;
Johannes Berg8b58ff82010-06-10 10:21:51 +02002195 goto queue;
Javier Cardonac7108a72010-12-16 17:37:50 -08002196 case WLAN_CATEGORY_MESH_PATH_SEL:
2197 if (!mesh_path_sel_is_hwmp(sdata))
2198 break;
2199 goto queue;
Johannes Berg84040802010-02-15 12:46:39 +02002200 }
Jouni Malinen026331c2010-02-15 12:53:10 +02002201
Johannes Berg2e161f72010-08-12 15:38:38 +02002202 return RX_CONTINUE;
2203
Johannes Bergbed7ee62010-06-10 10:21:35 +02002204 invalid:
Johannes Berg554891e2010-09-24 12:38:25 +02002205 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
Johannes Berg2e161f72010-08-12 15:38:38 +02002206 /* will return in the next handlers */
2207 return RX_CONTINUE;
2208
2209 handled:
2210 if (rx->sta)
2211 rx->sta->rx_packets++;
2212 dev_kfree_skb(rx->skb);
2213 return RX_QUEUED;
2214
2215 queue:
2216 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2217 skb_queue_tail(&sdata->skb_queue, rx->skb);
2218 ieee80211_queue_work(&local->hw, &sdata->work);
2219 if (rx->sta)
2220 rx->sta->rx_packets++;
2221 return RX_QUEUED;
2222}
2223
2224static ieee80211_rx_result debug_noinline
2225ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2226{
Johannes Berg554891e2010-09-24 12:38:25 +02002227 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02002228
2229 /* skip known-bad action frames and return them in the next handler */
Johannes Berg554891e2010-09-24 12:38:25 +02002230 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
Johannes Berg2e161f72010-08-12 15:38:38 +02002231 return RX_CONTINUE;
Felix Fietkaud7907442010-01-07 20:23:53 +01002232
Jouni Malinen026331c2010-02-15 12:53:10 +02002233 /*
2234 * Getting here means the kernel doesn't know how to handle
2235 * it, but maybe userspace does ... include returned frames
2236 * so userspace can register for those to know whether ones
2237 * it transmitted were processed or returned.
2238 */
Jouni Malinen026331c2010-02-15 12:53:10 +02002239
Johannes Berg2e161f72010-08-12 15:38:38 +02002240 if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
2241 rx->skb->data, rx->skb->len,
2242 GFP_ATOMIC)) {
2243 if (rx->sta)
2244 rx->sta->rx_packets++;
2245 dev_kfree_skb(rx->skb);
2246 return RX_QUEUED;
2247 }
2248
2249
2250 return RX_CONTINUE;
2251}
2252
2253static ieee80211_rx_result debug_noinline
2254ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2255{
2256 struct ieee80211_local *local = rx->local;
2257 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2258 struct sk_buff *nskb;
2259 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg554891e2010-09-24 12:38:25 +02002260 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02002261
2262 if (!ieee80211_is_action(mgmt->frame_control))
2263 return RX_CONTINUE;
2264
2265 /*
2266 * For AP mode, hostapd is responsible for handling any action
2267 * frames that we didn't handle, including returning unknown
2268 * ones. For all other modes we will return them to the sender,
2269 * setting the 0x80 bit in the action category, as required by
2270 * 802.11-2007 7.3.1.11.
2271 * Newer versions of hostapd shall also use the management frame
2272 * registration mechanisms, but older ones still use cooked
2273 * monitor interfaces so push all frames there.
2274 */
Johannes Berg554891e2010-09-24 12:38:25 +02002275 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
Johannes Berg2e161f72010-08-12 15:38:38 +02002276 (sdata->vif.type == NL80211_IFTYPE_AP ||
2277 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2278 return RX_DROP_MONITOR;
Jouni Malinen026331c2010-02-15 12:53:10 +02002279
Johannes Berg84040802010-02-15 12:46:39 +02002280 /* do not return rejected action frames */
2281 if (mgmt->u.action.category & 0x80)
2282 return RX_DROP_UNUSABLE;
2283
2284 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2285 GFP_ATOMIC);
2286 if (nskb) {
John W. Linville292b4df2010-06-24 11:13:56 -04002287 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
Johannes Berg84040802010-02-15 12:46:39 +02002288
John W. Linville292b4df2010-06-24 11:13:56 -04002289 nmgmt->u.action.category |= 0x80;
2290 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2291 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
Johannes Berg84040802010-02-15 12:46:39 +02002292
2293 memset(nskb->cb, 0, sizeof(nskb->cb));
2294
2295 ieee80211_tx_skb(rx->sdata, nskb);
Johannes Bergde1ede72008-09-09 14:42:50 +02002296 }
Johannes Berg39192c02008-09-09 14:49:03 +02002297 dev_kfree_skb(rx->skb);
2298 return RX_QUEUED;
Johannes Bergde1ede72008-09-09 14:42:50 +02002299}
2300
2301static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01002302ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02002303{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002304 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergaf6b6372009-12-23 13:15:35 +01002305 ieee80211_rx_result rxs;
Johannes Berg77a121c2010-06-10 10:21:34 +02002306 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2307 __le16 stype;
Johannes Berg571ecf62007-07-27 15:43:22 +02002308
Johannes Bergaf6b6372009-12-23 13:15:35 +01002309 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2310 if (rxs != RX_CONTINUE)
2311 return rxs;
2312
Johannes Berg77a121c2010-06-10 10:21:34 +02002313 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
Johannes Berg472dbc42008-09-11 00:01:49 +02002314
Johannes Berg77a121c2010-06-10 10:21:34 +02002315 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2316 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2317 sdata->vif.type != NL80211_IFTYPE_STATION)
2318 return RX_DROP_MONITOR;
Johannes Bergf9d540e2007-09-28 14:02:09 +02002319
Johannes Berg77a121c2010-06-10 10:21:34 +02002320 switch (stype) {
2321 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2322 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2323 /* process for all: mesh, mlme, ibss */
2324 break;
2325 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2326 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
Christian Lamparter2c313332010-11-29 20:53:23 +01002327 if (is_multicast_ether_addr(mgmt->da) &&
2328 !is_broadcast_ether_addr(mgmt->da))
2329 return RX_DROP_MONITOR;
2330
Johannes Berg77a121c2010-06-10 10:21:34 +02002331 /* process only for station */
2332 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2333 return RX_DROP_MONITOR;
2334 break;
2335 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2336 case cpu_to_le16(IEEE80211_STYPE_AUTH):
2337 /* process only for ibss */
2338 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
2339 return RX_DROP_MONITOR;
2340 break;
2341 default:
2342 return RX_DROP_MONITOR;
2343 }
Johannes Berg46900292009-02-15 12:44:28 +01002344
Johannes Berg77a121c2010-06-10 10:21:34 +02002345 /* queue up frame and kick off work to process it */
Johannes Bergc1475ca2010-06-10 10:21:37 +02002346 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
Johannes Berg77a121c2010-06-10 10:21:34 +02002347 skb_queue_tail(&sdata->skb_queue, rx->skb);
2348 ieee80211_queue_work(&rx->local->hw, &sdata->work);
Johannes Berg8b58ff82010-06-10 10:21:51 +02002349 if (rx->sta)
2350 rx->sta->rx_packets++;
Johannes Berg77a121c2010-06-10 10:21:34 +02002351
2352 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002353}
2354
Johannes Berg3b8d81e2009-06-17 17:43:56 +02002355static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
Johannes Berg5cf121c2008-02-25 16:27:43 +01002356 struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02002357{
Harvey Harrisona7767f92008-07-02 16:30:51 -07002358 int keyidx;
2359 unsigned int hdrlen;
Johannes Berg571ecf62007-07-27 15:43:22 +02002360
Harvey Harrisona7767f92008-07-02 16:30:51 -07002361 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg571ecf62007-07-27 15:43:22 +02002362 if (rx->skb->len >= hdrlen + 4)
2363 keyidx = rx->skb->data[hdrlen + 3] >> 6;
2364 else
2365 keyidx = -1;
2366
Johannes Berg8944b792008-01-31 19:48:26 +01002367 if (!rx->sta) {
Johannes Bergaa0daf02007-09-10 14:15:25 +02002368 /*
2369 * Some hardware seem to generate incorrect Michael MIC
2370 * reports; ignore them to avoid triggering countermeasures.
2371 */
Johannes Bergaf2ced62009-11-16 12:00:39 +01002372 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002373 }
2374
Harvey Harrisona7767f92008-07-02 16:30:51 -07002375 if (!ieee80211_has_protected(hdr->frame_control))
Johannes Bergaf2ced62009-11-16 12:00:39 +01002376 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002377
Johannes Berg05c914f2008-09-11 00:01:58 +02002378 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
Johannes Bergaa0daf02007-09-10 14:15:25 +02002379 /*
2380 * APs with pairwise keys should never receive Michael MIC
2381 * errors for non-zero keyidx because these are reserved for
2382 * group keys and only the AP is sending real multicast
2383 * frames in the BSS.
2384 */
Johannes Bergaf2ced62009-11-16 12:00:39 +01002385 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002386 }
2387
Harvey Harrisona7767f92008-07-02 16:30:51 -07002388 if (!ieee80211_is_data(hdr->frame_control) &&
2389 !ieee80211_is_auth(hdr->frame_control))
Johannes Bergaf2ced62009-11-16 12:00:39 +01002390 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002391
Johannes Berge6d6e342009-07-01 21:26:47 +02002392 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2393 GFP_ATOMIC);
Johannes Berg571ecf62007-07-27 15:43:22 +02002394}
2395
Johannes Berg5cf121c2008-02-25 16:27:43 +01002396/* TODO: use IEEE80211_RX_FRAGMENTED */
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002397static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2398 struct ieee80211_rate *rate)
Michael Wu3d30d942008-01-31 19:48:27 +01002399{
2400 struct ieee80211_sub_if_data *sdata;
2401 struct ieee80211_local *local = rx->local;
2402 struct ieee80211_rtap_hdr {
2403 struct ieee80211_radiotap_header hdr;
2404 u8 flags;
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002405 u8 rate_or_pad;
Michael Wu3d30d942008-01-31 19:48:27 +01002406 __le16 chan_freq;
2407 __le16 chan_flags;
Eric Dumazetbc105022010-06-03 03:21:52 -07002408 } __packed *rthdr;
Michael Wu3d30d942008-01-31 19:48:27 +01002409 struct sk_buff *skb = rx->skb, *skb2;
2410 struct net_device *prev_dev = NULL;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002411 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Michael Wu3d30d942008-01-31 19:48:27 +01002412
Johannes Berg554891e2010-09-24 12:38:25 +02002413 /*
2414 * If cooked monitor has been processed already, then
2415 * don't do it again. If not, set the flag.
2416 */
2417 if (rx->flags & IEEE80211_RX_CMNTR)
John W. Linville7c1e1832010-09-24 15:52:49 -04002418 goto out_free_skb;
Johannes Berg554891e2010-09-24 12:38:25 +02002419 rx->flags |= IEEE80211_RX_CMNTR;
John W. Linville7c1e1832010-09-24 15:52:49 -04002420
Michael Wu3d30d942008-01-31 19:48:27 +01002421 if (skb_headroom(skb) < sizeof(*rthdr) &&
2422 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2423 goto out_free_skb;
2424
2425 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2426 memset(rthdr, 0, sizeof(*rthdr));
2427 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2428 rthdr->hdr.it_present =
2429 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
Michael Wu3d30d942008-01-31 19:48:27 +01002430 (1 << IEEE80211_RADIOTAP_CHANNEL));
2431
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002432 if (rate) {
2433 rthdr->rate_or_pad = rate->bitrate / 5;
2434 rthdr->hdr.it_present |=
2435 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2436 }
Michael Wu3d30d942008-01-31 19:48:27 +01002437 rthdr->chan_freq = cpu_to_le16(status->freq);
2438
2439 if (status->band == IEEE80211_BAND_5GHZ)
2440 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2441 IEEE80211_CHAN_5GHZ);
2442 else
2443 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2444 IEEE80211_CHAN_2GHZ);
2445
2446 skb_set_mac_header(skb, 0);
2447 skb->ip_summed = CHECKSUM_UNNECESSARY;
2448 skb->pkt_type = PACKET_OTHERHOST;
2449 skb->protocol = htons(ETH_P_802_2);
2450
2451 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg9607e6b2009-12-23 13:15:31 +01002452 if (!ieee80211_sdata_running(sdata))
Michael Wu3d30d942008-01-31 19:48:27 +01002453 continue;
2454
Johannes Berg05c914f2008-09-11 00:01:58 +02002455 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
Michael Wu3d30d942008-01-31 19:48:27 +01002456 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2457 continue;
2458
2459 if (prev_dev) {
2460 skb2 = skb_clone(skb, GFP_ATOMIC);
2461 if (skb2) {
2462 skb2->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -04002463 netif_receive_skb(skb2);
Michael Wu3d30d942008-01-31 19:48:27 +01002464 }
2465 }
2466
2467 prev_dev = sdata->dev;
2468 sdata->dev->stats.rx_packets++;
2469 sdata->dev->stats.rx_bytes += skb->len;
2470 }
2471
2472 if (prev_dev) {
2473 skb->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -04002474 netif_receive_skb(skb);
Johannes Berg554891e2010-09-24 12:38:25 +02002475 return;
2476 }
Michael Wu3d30d942008-01-31 19:48:27 +01002477
2478 out_free_skb:
2479 dev_kfree_skb(skb);
2480}
2481
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002482static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2483 ieee80211_rx_result res)
2484{
2485 switch (res) {
2486 case RX_DROP_MONITOR:
2487 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2488 if (rx->sta)
2489 rx->sta->rx_dropped++;
2490 /* fall through */
2491 case RX_CONTINUE: {
2492 struct ieee80211_rate *rate = NULL;
2493 struct ieee80211_supported_band *sband;
2494 struct ieee80211_rx_status *status;
2495
2496 status = IEEE80211_SKB_RXCB((rx->skb));
2497
2498 sband = rx->local->hw.wiphy->bands[status->band];
2499 if (!(status->flag & RX_FLAG_HT))
2500 rate = &sband->bitrates[status->rate_idx];
2501
2502 ieee80211_rx_cooked_monitor(rx, rate);
2503 break;
2504 }
2505 case RX_DROP_UNUSABLE:
2506 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2507 if (rx->sta)
2508 rx->sta->rx_dropped++;
2509 dev_kfree_skb(rx->skb);
2510 break;
2511 case RX_QUEUED:
2512 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2513 break;
2514 }
2515}
2516
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002517static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002518{
2519 ieee80211_rx_result res = RX_DROP_MONITOR;
2520 struct sk_buff *skb;
2521
2522#define CALL_RXH(rxh) \
2523 do { \
2524 res = rxh(rx); \
2525 if (res != RX_CONTINUE) \
2526 goto rxh_next; \
2527 } while (0);
2528
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002529 spin_lock(&rx->local->rx_skb_queue.lock);
2530 if (rx->local->running_rx_handler)
2531 goto unlock;
2532
2533 rx->local->running_rx_handler = true;
2534
2535 while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
2536 spin_unlock(&rx->local->rx_skb_queue.lock);
2537
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002538 /*
2539 * all the other fields are valid across frames
2540 * that belong to an aMPDU since they are on the
2541 * same TID from the same station
2542 */
2543 rx->skb = skb;
2544
2545 CALL_RXH(ieee80211_rx_h_decrypt)
2546 CALL_RXH(ieee80211_rx_h_check_more_data)
2547 CALL_RXH(ieee80211_rx_h_sta_process)
2548 CALL_RXH(ieee80211_rx_h_defragment)
2549 CALL_RXH(ieee80211_rx_h_ps_poll)
2550 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2551 /* must be after MMIC verify so header is counted in MPDU mic */
2552 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2553 CALL_RXH(ieee80211_rx_h_amsdu)
2554#ifdef CONFIG_MAC80211_MESH
2555 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2556 CALL_RXH(ieee80211_rx_h_mesh_fwding);
2557#endif
2558 CALL_RXH(ieee80211_rx_h_data)
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002559 CALL_RXH(ieee80211_rx_h_ctrl);
Johannes Berg2e161f72010-08-12 15:38:38 +02002560 CALL_RXH(ieee80211_rx_h_mgmt_check)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002561 CALL_RXH(ieee80211_rx_h_action)
Johannes Berg2e161f72010-08-12 15:38:38 +02002562 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2563 CALL_RXH(ieee80211_rx_h_action_return)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002564 CALL_RXH(ieee80211_rx_h_mgmt)
2565
2566 rxh_next:
2567 ieee80211_rx_handlers_result(rx, res);
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002568 spin_lock(&rx->local->rx_skb_queue.lock);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002569#undef CALL_RXH
2570 }
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002571
2572 rx->local->running_rx_handler = false;
2573
2574 unlock:
2575 spin_unlock(&rx->local->rx_skb_queue.lock);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002576}
Johannes Berg571ecf62007-07-27 15:43:22 +02002577
Johannes Berg4406c372010-09-24 11:21:06 +02002578static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
Johannes Berg58905292008-01-31 19:48:25 +01002579{
Johannes Berg58905292008-01-31 19:48:25 +01002580 ieee80211_rx_result res = RX_DROP_MONITOR;
2581
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002582#define CALL_RXH(rxh) \
2583 do { \
2584 res = rxh(rx); \
2585 if (res != RX_CONTINUE) \
Johannes Berg2569a822009-11-25 17:46:17 +01002586 goto rxh_next; \
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002587 } while (0);
Johannes Berg58905292008-01-31 19:48:25 +01002588
Johannes Berg49461622008-06-30 15:10:45 +02002589 CALL_RXH(ieee80211_rx_h_passive_scan)
2590 CALL_RXH(ieee80211_rx_h_check)
Johannes Berg2569a822009-11-25 17:46:17 +01002591
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002592 ieee80211_rx_reorder_ampdu(rx);
Johannes Berg2569a822009-11-25 17:46:17 +01002593
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002594 ieee80211_rx_handlers(rx);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002595 return;
Johannes Berg49461622008-06-30 15:10:45 +02002596
Johannes Berg2569a822009-11-25 17:46:17 +01002597 rxh_next:
Christian Lamparteraa0c8632010-08-05 01:36:04 +02002598 ieee80211_rx_handlers_result(rx, res);
2599
2600#undef CALL_RXH
Johannes Berg58905292008-01-31 19:48:25 +01002601}
2602
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02002603/*
Johannes Bergdd318572010-11-29 11:09:16 +01002604 * This function makes calls into the RX path, therefore
2605 * it has to be invoked under RCU read lock.
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02002606 */
2607void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2608{
Johannes Berg554891e2010-09-24 12:38:25 +02002609 struct ieee80211_rx_data rx = {
2610 .sta = sta,
2611 .sdata = sta->sdata,
2612 .local = sta->local,
2613 .queue = tid,
Helmut Schaafcf8bd32011-04-01 15:46:05 +02002614 .flags = 0,
Johannes Berg554891e2010-09-24 12:38:25 +02002615 };
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02002616 struct tid_ampdu_rx *tid_agg_rx;
2617
2618 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2619 if (!tid_agg_rx)
2620 return;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02002621
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02002622 spin_lock(&tid_agg_rx->reorder_lock);
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002623 ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02002624 spin_unlock(&tid_agg_rx->reorder_lock);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02002625
Christian Lamparter24a8fda2010-12-30 17:25:29 +01002626 ieee80211_rx_handlers(&rx);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02002627}
2628
Johannes Berg571ecf62007-07-27 15:43:22 +02002629/* main receive path */
2630
Johannes Berg20b01f82010-09-24 11:21:05 +02002631static int prepare_for_handlers(struct ieee80211_rx_data *rx,
Johannes Berg23a24de2007-07-27 15:43:22 +02002632 struct ieee80211_hdr *hdr)
2633{
Johannes Berg20b01f82010-09-24 11:21:05 +02002634 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002635 struct sk_buff *skb = rx->skb;
2636 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2637 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
Johannes Berg23a24de2007-07-27 15:43:22 +02002638 int multicast = is_multicast_ether_addr(hdr->addr1);
2639
Johannes Berg51fb61e2007-12-19 01:31:27 +01002640 switch (sdata->vif.type) {
Johannes Berg05c914f2008-09-11 00:01:58 +02002641 case NL80211_IFTYPE_STATION:
Johannes Berg9bc383d2009-11-19 11:55:19 +01002642 if (!bssid && !sdata->u.mgd.use_4addr)
Johannes Berg23a24de2007-07-27 15:43:22 +02002643 return 0;
Johannes Berg77fdaa12009-07-07 03:45:17 +02002644 if (!multicast &&
Johannes Berg47846c92009-11-25 17:46:19 +01002645 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
Felix Fietkau4f312332011-02-05 23:48:37 +01002646 if (!(sdata->dev->flags & IFF_PROMISC) ||
2647 sdata->u.mgd.use_4addr)
Johannes Berg23a24de2007-07-27 15:43:22 +02002648 return 0;
Johannes Berg554891e2010-09-24 12:38:25 +02002649 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002650 }
2651 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002652 case NL80211_IFTYPE_ADHOC:
Johannes Berg23a24de2007-07-27 15:43:22 +02002653 if (!bssid)
2654 return 0;
Harvey Harrisona7767f92008-07-02 16:30:51 -07002655 if (ieee80211_is_beacon(hdr->frame_control)) {
Bruno Randolf9d9bf772008-02-18 11:21:36 +09002656 return 1;
Vladimir Koutny87291c02008-06-13 16:50:44 +02002657 }
Johannes Berg46900292009-02-15 12:44:28 +01002658 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
Johannes Berg554891e2010-09-24 12:38:25 +02002659 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
Johannes Berg23a24de2007-07-27 15:43:22 +02002660 return 0;
Johannes Berg554891e2010-09-24 12:38:25 +02002661 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002662 } else if (!multicast &&
Johannes Berg47846c92009-11-25 17:46:19 +01002663 compare_ether_addr(sdata->vif.addr,
Johannes Berg23a24de2007-07-27 15:43:22 +02002664 hdr->addr1) != 0) {
Johannes Berg4150c572007-09-17 01:29:23 -04002665 if (!(sdata->dev->flags & IFF_PROMISC))
Johannes Berg23a24de2007-07-27 15:43:22 +02002666 return 0;
Johannes Berg554891e2010-09-24 12:38:25 +02002667 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002668 } else if (!rx->sta) {
2669 int rate_idx;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002670 if (status->flag & RX_FLAG_HT)
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002671 rate_idx = 0; /* TODO: HT rates */
2672 else
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002673 rate_idx = status->rate_idx;
Johannes Berg34e89502010-02-03 13:59:58 +01002674 rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
2675 hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002676 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002677 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002678 case NL80211_IFTYPE_MESH_POINT:
Johannes Berg6032f932008-02-23 15:17:07 +01002679 if (!multicast &&
Johannes Berg47846c92009-11-25 17:46:19 +01002680 compare_ether_addr(sdata->vif.addr,
Johannes Berg6032f932008-02-23 15:17:07 +01002681 hdr->addr1) != 0) {
2682 if (!(sdata->dev->flags & IFF_PROMISC))
2683 return 0;
2684
Johannes Berg554891e2010-09-24 12:38:25 +02002685 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg6032f932008-02-23 15:17:07 +01002686 }
2687 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002688 case NL80211_IFTYPE_AP_VLAN:
2689 case NL80211_IFTYPE_AP:
Johannes Berg23a24de2007-07-27 15:43:22 +02002690 if (!bssid) {
Johannes Berg47846c92009-11-25 17:46:19 +01002691 if (compare_ether_addr(sdata->vif.addr,
Johannes Berg23a24de2007-07-27 15:43:22 +02002692 hdr->addr1))
2693 return 0;
2694 } else if (!ieee80211_bssid_match(bssid,
Johannes Berg47846c92009-11-25 17:46:19 +01002695 sdata->vif.addr)) {
Arik Nemtsov771bbd02011-02-01 13:23:05 +02002696 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
2697 !ieee80211_is_beacon(hdr->frame_control))
Johannes Berg23a24de2007-07-27 15:43:22 +02002698 return 0;
Johannes Berg554891e2010-09-24 12:38:25 +02002699 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002700 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002701 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002702 case NL80211_IFTYPE_WDS:
Harvey Harrisona7767f92008-07-02 16:30:51 -07002703 if (bssid || !ieee80211_is_data(hdr->frame_control))
Johannes Berg23a24de2007-07-27 15:43:22 +02002704 return 0;
2705 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2706 return 0;
2707 break;
Johannes Berg2ca27bc2010-09-16 14:58:23 +02002708 default:
Johannes Bergfb1c1cd2007-09-26 15:19:43 +02002709 /* should never get here */
2710 WARN_ON(1);
2711 break;
Johannes Berg23a24de2007-07-27 15:43:22 +02002712 }
2713
2714 return 1;
2715}
2716
Johannes Berg571ecf62007-07-27 15:43:22 +02002717/*
Johannes Berg4406c372010-09-24 11:21:06 +02002718 * This function returns whether or not the SKB
2719 * was destined for RX processing or not, which,
2720 * if consume is true, is equivalent to whether
2721 * or not the skb was consumed.
2722 */
2723static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2724 struct sk_buff *skb, bool consume)
2725{
2726 struct ieee80211_local *local = rx->local;
2727 struct ieee80211_sub_if_data *sdata = rx->sdata;
2728 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2729 struct ieee80211_hdr *hdr = (void *)skb->data;
2730 int prepares;
2731
2732 rx->skb = skb;
Johannes Berg554891e2010-09-24 12:38:25 +02002733 status->rx_flags |= IEEE80211_RX_RA_MATCH;
Johannes Berg4406c372010-09-24 11:21:06 +02002734 prepares = prepare_for_handlers(rx, hdr);
2735
2736 if (!prepares)
2737 return false;
2738
2739 if (status->flag & RX_FLAG_MMIC_ERROR) {
Johannes Berg554891e2010-09-24 12:38:25 +02002740 if (status->rx_flags & IEEE80211_RX_RA_MATCH)
Johannes Berg4406c372010-09-24 11:21:06 +02002741 ieee80211_rx_michael_mic_report(hdr, rx);
2742 return false;
2743 }
2744
2745 if (!consume) {
2746 skb = skb_copy(skb, GFP_ATOMIC);
2747 if (!skb) {
2748 if (net_ratelimit())
2749 wiphy_debug(local->hw.wiphy,
Ben Greearb305dae2011-01-08 10:30:54 -08002750 "failed to copy skb for %s\n",
Johannes Berg4406c372010-09-24 11:21:06 +02002751 sdata->name);
2752 return true;
2753 }
2754
2755 rx->skb = skb;
2756 }
2757
2758 ieee80211_invoke_rx_handlers(rx);
2759 return true;
2760}
2761
2762/*
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002763 * This is the actual Rx frames handler. as it blongs to Rx path it must
2764 * be called with rcu_read_lock protection.
Johannes Berg571ecf62007-07-27 15:43:22 +02002765 */
Ron Rindjunsky71ebb4a2008-01-21 12:39:12 +02002766static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
Christian Lamparter071d9ac2010-08-05 01:36:36 +02002767 struct sk_buff *skb)
Johannes Berg571ecf62007-07-27 15:43:22 +02002768{
Johannes Berg554891e2010-09-24 12:38:25 +02002769 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002770 struct ieee80211_local *local = hw_to_local(hw);
2771 struct ieee80211_sub_if_data *sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02002772 struct ieee80211_hdr *hdr;
Zhu Yie3cf8b32010-03-29 17:35:07 +08002773 __le16 fc;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002774 struct ieee80211_rx_data rx;
Johannes Berg4406c372010-09-24 11:21:06 +02002775 struct ieee80211_sub_if_data *prev;
Ben Greear56af3262010-09-23 10:22:24 -07002776 struct sta_info *sta, *tmp, *prev_sta;
Zhu Yie3cf8b32010-03-29 17:35:07 +08002777 int err = 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002778
Zhu Yie3cf8b32010-03-29 17:35:07 +08002779 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02002780 memset(&rx, 0, sizeof(rx));
2781 rx.skb = skb;
2782 rx.local = local;
Johannes Berg72abd812007-09-17 01:29:22 -04002783
Zhu Yie3cf8b32010-03-29 17:35:07 +08002784 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
Johannes Berg571ecf62007-07-27 15:43:22 +02002785 local->dot11ReceivedFragmentCount++;
Johannes Berg571ecf62007-07-27 15:43:22 +02002786
Helmut Schaa142b9f52009-07-23 13:18:01 +02002787 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
Ben Greearb23b0252011-02-04 11:54:17 -08002788 test_bit(SCAN_SW_SCANNING, &local->scanning)))
Johannes Berg554891e2010-09-24 12:38:25 +02002789 status->rx_flags |= IEEE80211_RX_IN_SCAN;
Johannes Berg571ecf62007-07-27 15:43:22 +02002790
Zhu Yie3cf8b32010-03-29 17:35:07 +08002791 if (ieee80211_is_mgmt(fc))
2792 err = skb_linearize(skb);
2793 else
2794 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
2795
2796 if (err) {
2797 dev_kfree_skb(skb);
2798 return;
2799 }
2800
2801 hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg38f37142008-01-29 17:07:43 +01002802 ieee80211_parse_qos(&rx);
Johannes Bergd1c3a372009-01-07 00:26:10 +01002803 ieee80211_verify_alignment(&rx);
Johannes Berg38f37142008-01-29 17:07:43 +01002804
Zhu Yie3cf8b32010-03-29 17:35:07 +08002805 if (ieee80211_is_data(fc)) {
Ben Greear56af3262010-09-23 10:22:24 -07002806 prev_sta = NULL;
Johannes Berg4406c372010-09-24 11:21:06 +02002807
Johannes Bergabe60632009-11-25 17:46:18 +01002808 for_each_sta_info(local, hdr->addr2, sta, tmp) {
Ben Greear56af3262010-09-23 10:22:24 -07002809 if (!prev_sta) {
2810 prev_sta = sta;
2811 continue;
2812 }
2813
2814 rx.sta = prev_sta;
2815 rx.sdata = prev_sta->sdata;
Johannes Berg4406c372010-09-24 11:21:06 +02002816 ieee80211_prepare_and_rx_handle(&rx, skb, false);
Johannes Berg571ecf62007-07-27 15:43:22 +02002817
Ben Greear56af3262010-09-23 10:22:24 -07002818 prev_sta = sta;
Johannes Berg4406c372010-09-24 11:21:06 +02002819 }
Ben Greear56af3262010-09-23 10:22:24 -07002820
2821 if (prev_sta) {
2822 rx.sta = prev_sta;
2823 rx.sdata = prev_sta->sdata;
2824
Johannes Berg4406c372010-09-24 11:21:06 +02002825 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
Ben Greear56af3262010-09-23 10:22:24 -07002826 return;
Senthil Balasubramanian8e26d5a2010-11-30 20:15:38 +05302827 goto out;
Ben Greear56af3262010-09-23 10:22:24 -07002828 }
Johannes Berg4406c372010-09-24 11:21:06 +02002829 }
2830
Johannes Berg4b0dd982010-09-24 11:21:07 +02002831 prev = NULL;
Johannes Berg4406c372010-09-24 11:21:06 +02002832
Johannes Berg4b0dd982010-09-24 11:21:07 +02002833 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2834 if (!ieee80211_sdata_running(sdata))
2835 continue;
Johannes Bergabe60632009-11-25 17:46:18 +01002836
Johannes Berg4b0dd982010-09-24 11:21:07 +02002837 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2838 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2839 continue;
Johannes Bergabe60632009-11-25 17:46:18 +01002840
Johannes Berg4b0dd982010-09-24 11:21:07 +02002841 /*
2842 * frame is destined for this interface, but if it's
2843 * not also for the previous one we handle that after
2844 * the loop to avoid copying the SKB once too much
2845 */
Johannes Bergb2e77712007-09-26 15:19:39 +02002846
Johannes Berg4b0dd982010-09-24 11:21:07 +02002847 if (!prev) {
Johannes Berg340e11f2007-07-27 15:43:22 +02002848 prev = sdata;
Johannes Berg4b0dd982010-09-24 11:21:07 +02002849 continue;
Johannes Berg8e6f00322007-07-27 15:43:22 +02002850 }
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002851
Johannes Berg4b0dd982010-09-24 11:21:07 +02002852 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2853 rx.sdata = prev;
2854 ieee80211_prepare_and_rx_handle(&rx, skb, false);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002855
Johannes Berg4b0dd982010-09-24 11:21:07 +02002856 prev = sdata;
2857 }
Johannes Berg4406c372010-09-24 11:21:06 +02002858
Johannes Berg4b0dd982010-09-24 11:21:07 +02002859 if (prev) {
2860 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2861 rx.sdata = prev;
2862
2863 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2864 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002865 }
Johannes Berg4406c372010-09-24 11:21:06 +02002866
Senthil Balasubramanian8e26d5a2010-11-30 20:15:38 +05302867 out:
Johannes Berg4406c372010-09-24 11:21:06 +02002868 dev_kfree_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002869}
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002870
2871/*
2872 * This is the receive path handler. It is called by a low level driver when an
2873 * 802.11 MPDU is received from the hardware.
2874 */
John W. Linville103bf9f2009-08-20 16:34:15 -04002875void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002876{
2877 struct ieee80211_local *local = hw_to_local(hw);
Johannes Berg8318d782008-01-24 19:38:38 +01002878 struct ieee80211_rate *rate = NULL;
2879 struct ieee80211_supported_band *sband;
Johannes Bergf1d58c22009-06-17 13:13:00 +02002880 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg8318d782008-01-24 19:38:38 +01002881
Johannes Bergd20ef632009-10-11 15:10:40 +02002882 WARN_ON_ONCE(softirq_count() == 0);
2883
Johannes Berg77a980d2009-08-24 11:46:30 +02002884 if (WARN_ON(status->band < 0 ||
2885 status->band >= IEEE80211_NUM_BANDS))
2886 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01002887
2888 sband = local->hw.wiphy->bands[status->band];
Johannes Berg77a980d2009-08-24 11:46:30 +02002889 if (WARN_ON(!sband))
2890 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01002891
Johannes Berg89c3a8a2009-07-28 18:10:17 +02002892 /*
2893 * If we're suspending, it is possible although not too likely
2894 * that we'd be receiving frames after having already partially
2895 * quiesced the stack. We can't process such frames then since
2896 * that might, for example, cause stations to be added or other
2897 * driver callbacks be invoked.
2898 */
Johannes Berg77a980d2009-08-24 11:46:30 +02002899 if (unlikely(local->quiescing || local->suspended))
2900 goto drop;
Johannes Berg89c3a8a2009-07-28 18:10:17 +02002901
Johannes Bergea77f122009-08-21 14:44:45 +02002902 /*
2903 * The same happens when we're not even started,
2904 * but that's worth a warning.
2905 */
Johannes Berg77a980d2009-08-24 11:46:30 +02002906 if (WARN_ON(!local->started))
2907 goto drop;
Johannes Bergea77f122009-08-21 14:44:45 +02002908
Johannes Bergfc885182010-07-30 13:23:12 +02002909 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05002910 /*
Johannes Bergfc885182010-07-30 13:23:12 +02002911 * Validate the rate, unless a PLCP error means that
2912 * we probably can't have a valid rate here anyway.
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05002913 */
Johannes Bergfc885182010-07-30 13:23:12 +02002914
2915 if (status->flag & RX_FLAG_HT) {
2916 /*
2917 * rate_idx is MCS index, which can be [0-76]
2918 * as documented on:
2919 *
2920 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2921 *
2922 * Anything else would be some sort of driver or
2923 * hardware error. The driver should catch hardware
2924 * errors.
2925 */
2926 if (WARN((status->rate_idx < 0 ||
2927 status->rate_idx > 76),
2928 "Rate marked as an HT rate but passed "
2929 "status->rate_idx is not "
2930 "an MCS index [0-76]: %d (0x%02x)\n",
2931 status->rate_idx,
2932 status->rate_idx))
2933 goto drop;
2934 } else {
2935 if (WARN_ON(status->rate_idx < 0 ||
2936 status->rate_idx >= sband->n_bitrates))
2937 goto drop;
2938 rate = &sband->bitrates[status->rate_idx];
2939 }
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002940 }
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002941
Johannes Berg554891e2010-09-24 12:38:25 +02002942 status->rx_flags = 0;
2943
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002944 /*
2945 * key references and virtual interfaces are protected using RCU
2946 * and this requires that we are in a read-side RCU section during
2947 * receive processing
2948 */
2949 rcu_read_lock();
2950
2951 /*
2952 * Frames with failed FCS/PLCP checksum are not returned,
2953 * all other frames are returned without radiotap header
2954 * if it was previously present.
2955 * Also, frames with less than 16 bytes are dropped.
2956 */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002957 skb = ieee80211_rx_monitor(local, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002958 if (!skb) {
2959 rcu_read_unlock();
2960 return;
2961 }
2962
Johannes Berge1e54062010-11-30 08:58:45 +01002963 ieee80211_tpt_led_trig_rx(local,
2964 ((struct ieee80211_hdr *)skb->data)->frame_control,
2965 skb->len);
Christian Lamparter071d9ac2010-08-05 01:36:36 +02002966 __ieee80211_rx_handle_packet(hw, skb);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002967
2968 rcu_read_unlock();
Johannes Berg77a980d2009-08-24 11:46:30 +02002969
2970 return;
2971 drop:
2972 kfree_skb(skb);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002973}
John W. Linville103bf9f2009-08-20 16:34:15 -04002974EXPORT_SYMBOL(ieee80211_rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02002975
2976/* This is a version of the rx handler that can be called from hard irq
2977 * context. Post the skb on the queue and schedule the tasklet */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002978void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
Johannes Berg571ecf62007-07-27 15:43:22 +02002979{
2980 struct ieee80211_local *local = hw_to_local(hw);
2981
2982 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2983
Johannes Berg571ecf62007-07-27 15:43:22 +02002984 skb->pkt_type = IEEE80211_RX_MSG;
2985 skb_queue_tail(&local->skb_queue, skb);
2986 tasklet_schedule(&local->tasklet);
2987}
2988EXPORT_SYMBOL(ieee80211_rx_irqsafe);