blob: 28316b2a585f9128e5ac371caf3d3034aecce4e7 [file] [log] [blame]
Johannes Berg571ecf62007-07-27 15:43:22 +02001/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
S.Çağlar Onurab466232008-02-14 17:36:47 +020012#include <linux/jiffies.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020013#include <linux/kernel.h>
14#include <linux/skbuff.h>
15#include <linux/netdevice.h>
16#include <linux/etherdevice.h>
Johannes Bergd4e46a32007-09-14 11:10:24 -040017#include <linux/rcupdate.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020018#include <net/mac80211.h>
19#include <net/ieee80211_radiotap.h>
20
21#include "ieee80211_i.h"
Johannes Berg24487982009-04-23 18:52:52 +020022#include "driver-ops.h"
Johannes Berg2c8dccc2008-04-08 15:14:40 -040023#include "led.h"
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +010024#include "mesh.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020025#include "wep.h"
26#include "wpa.h"
27#include "tkip.h"
28#include "wme.h"
29
Johannes Bergc6a1fa12008-10-07 12:04:32 +020030static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
31 struct tid_ampdu_rx *tid_agg_rx,
32 struct sk_buff *skb,
33 u16 mpdu_seq_num,
34 int bar_req);
Johannes Bergb2e77712007-09-26 15:19:39 +020035/*
36 * monitor mode reception
37 *
38 * This function cleans up the SKB, i.e. it removes all the stuff
39 * only useful for monitoring.
40 */
41static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
Johannes Berg0869aea2009-10-28 10:03:35 +010042 struct sk_buff *skb)
Johannes Bergb2e77712007-09-26 15:19:39 +020043{
Johannes Bergb2e77712007-09-26 15:19:39 +020044 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
45 if (likely(skb->len > FCS_LEN))
46 skb_trim(skb, skb->len - FCS_LEN);
47 else {
48 /* driver bug */
49 WARN_ON(1);
50 dev_kfree_skb(skb);
51 skb = NULL;
52 }
53 }
54
55 return skb;
56}
57
Johannes Bergf1d58c22009-06-17 13:13:00 +020058static inline int should_drop_frame(struct sk_buff *skb,
Johannes Berg0869aea2009-10-28 10:03:35 +010059 int present_fcs_len)
Johannes Bergb2e77712007-09-26 15:19:39 +020060{
Johannes Bergf1d58c22009-06-17 13:13:00 +020061 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Harvey Harrison182503a2008-06-22 16:45:29 -070062 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Bergb2e77712007-09-26 15:19:39 +020063
64 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
65 return 1;
Johannes Berg0869aea2009-10-28 10:03:35 +010066 if (unlikely(skb->len < 16 + present_fcs_len))
Johannes Bergb2e77712007-09-26 15:19:39 +020067 return 1;
Harvey Harrison87228f52008-06-11 14:21:59 -070068 if (ieee80211_is_ctl(hdr->frame_control) &&
69 !ieee80211_is_pspoll(hdr->frame_control) &&
70 !ieee80211_is_back_req(hdr->frame_control))
Johannes Bergb2e77712007-09-26 15:19:39 +020071 return 1;
72 return 0;
73}
74
Bruno Randolf601ae7f2008-05-08 19:22:43 +020075static int
76ieee80211_rx_radiotap_len(struct ieee80211_local *local,
77 struct ieee80211_rx_status *status)
78{
79 int len;
80
81 /* always present fields */
82 len = sizeof(struct ieee80211_radiotap_header) + 9;
83
84 if (status->flag & RX_FLAG_TSFT)
85 len += 8;
Johannes Berg7fee5372009-01-30 11:13:06 +010086 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
Bruno Randolf601ae7f2008-05-08 19:22:43 +020087 len += 1;
88 if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
89 len += 1;
90
91 if (len & 1) /* padding for RX_FLAGS if necessary */
92 len++;
93
Bruno Randolf601ae7f2008-05-08 19:22:43 +020094 return len;
95}
96
Johannes Bergd1c3a372009-01-07 00:26:10 +010097/*
Bruno Randolf601ae7f2008-05-08 19:22:43 +020098 * ieee80211_add_rx_radiotap_header - add radiotap header
99 *
100 * add a radiotap header containing all the fields which the hardware provided.
101 */
102static void
103ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
104 struct sk_buff *skb,
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200105 struct ieee80211_rate *rate,
106 int rtap_len)
107{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200108 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200109 struct ieee80211_radiotap_header *rthdr;
110 unsigned char *pos;
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100111 u16 rx_flags = 0;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200112
113 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
114 memset(rthdr, 0, rtap_len);
115
116 /* radiotap header, set always present flags */
117 rthdr->it_present =
118 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200119 (1 << IEEE80211_RADIOTAP_CHANNEL) |
120 (1 << IEEE80211_RADIOTAP_ANTENNA) |
121 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
122 rthdr->it_len = cpu_to_le16(rtap_len);
123
124 pos = (unsigned char *)(rthdr+1);
125
126 /* the order of the following fields is important */
127
128 /* IEEE80211_RADIOTAP_TSFT */
129 if (status->flag & RX_FLAG_TSFT) {
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100130 put_unaligned_le64(status->mactime, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200131 rthdr->it_present |=
132 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
133 pos += 8;
134 }
135
136 /* IEEE80211_RADIOTAP_FLAGS */
137 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
138 *pos |= IEEE80211_RADIOTAP_F_FCS;
Johannes Bergaae89832009-03-13 12:52:10 +0100139 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
140 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
Bruno Randolfb4f28bb2008-07-30 17:19:55 +0200141 if (status->flag & RX_FLAG_SHORTPRE)
142 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200143 pos++;
144
145 /* IEEE80211_RADIOTAP_RATE */
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200146 if (status->flag & RX_FLAG_HT) {
147 /*
148 * TODO: add following information into radiotap header once
149 * suitable fields are defined for it:
150 * - MCS index (status->rate_idx)
151 * - HT40 (status->flag & RX_FLAG_40MHZ)
152 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
153 */
154 *pos = 0;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200155 } else {
Jouni Malinenebe6c7b2009-01-10 11:47:33 +0200156 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200157 *pos = rate->bitrate / 5;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200158 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200159 pos++;
160
161 /* IEEE80211_RADIOTAP_CHANNEL */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100162 put_unaligned_le16(status->freq, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200163 pos += 2;
164 if (status->band == IEEE80211_BAND_5GHZ)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100165 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
166 pos);
Bruno Randolf9deb1ae2008-07-30 17:20:06 +0200167 else if (rate->flags & IEEE80211_RATE_ERP_G)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100168 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
169 pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200170 else
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100171 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
172 pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200173 pos += 2;
174
175 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
176 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
177 *pos = status->signal;
178 rthdr->it_present |=
179 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
180 pos++;
181 }
182
183 /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
184 if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
185 *pos = status->noise;
186 rthdr->it_present |=
187 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
188 pos++;
189 }
190
191 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
192
193 /* IEEE80211_RADIOTAP_ANTENNA */
194 *pos = status->antenna;
195 pos++;
196
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200197 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
198
199 /* IEEE80211_RADIOTAP_RX_FLAGS */
200 /* ensure 2 byte alignment for the 2 byte field as required */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100201 if ((pos - (u8 *)rthdr) & 1)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200202 pos++;
Johannes Bergaae89832009-03-13 12:52:10 +0100203 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100204 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
205 put_unaligned_le16(rx_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200206 pos += 2;
207}
208
Johannes Bergb2e77712007-09-26 15:19:39 +0200209/*
210 * This function copies a received frame to all monitor interfaces and
211 * returns a cleaned-up SKB that no longer includes the FCS nor the
212 * radiotap header the driver might have added.
213 */
214static struct sk_buff *
215ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
Johannes Berg8318d782008-01-24 19:38:38 +0100216 struct ieee80211_rate *rate)
Johannes Bergb2e77712007-09-26 15:19:39 +0200217{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200218 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200219 struct ieee80211_sub_if_data *sdata;
Johannes Bergb2e77712007-09-26 15:19:39 +0200220 int needed_headroom = 0;
Johannes Bergb2e77712007-09-26 15:19:39 +0200221 struct sk_buff *skb, *skb2;
222 struct net_device *prev_dev = NULL;
223 int present_fcs_len = 0;
Johannes Bergb2e77712007-09-26 15:19:39 +0200224
225 /*
226 * First, we may need to make a copy of the skb because
227 * (1) we need to modify it for radiotap (if not present), and
228 * (2) the other RX handlers will modify the skb we got.
229 *
230 * We don't need to, of course, if we aren't going to return
231 * the SKB because it has a bad FCS/PLCP checksum.
232 */
Johannes Berg0869aea2009-10-28 10:03:35 +0100233
234 /* room for the radiotap header based on driver features */
235 needed_headroom = ieee80211_rx_radiotap_len(local, status);
Johannes Bergb2e77712007-09-26 15:19:39 +0200236
237 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
238 present_fcs_len = FCS_LEN;
239
240 if (!local->monitors) {
Johannes Berg0869aea2009-10-28 10:03:35 +0100241 if (should_drop_frame(origskb, present_fcs_len)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200242 dev_kfree_skb(origskb);
243 return NULL;
244 }
245
Johannes Berg0869aea2009-10-28 10:03:35 +0100246 return remove_monitor_info(local, origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200247 }
248
Johannes Berg0869aea2009-10-28 10:03:35 +0100249 if (should_drop_frame(origskb, present_fcs_len)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200250 /* only need to expand headroom if necessary */
251 skb = origskb;
252 origskb = NULL;
253
254 /*
255 * This shouldn't trigger often because most devices have an
256 * RX header they pull before we get here, and that should
257 * be big enough for our radiotap information. We should
258 * probably export the length to drivers so that we can have
259 * them allocate enough headroom to start with.
260 */
261 if (skb_headroom(skb) < needed_headroom &&
Johannes Bergc49e5ea2007-12-11 21:33:42 +0100262 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200263 dev_kfree_skb(skb);
264 return NULL;
265 }
266 } else {
267 /*
268 * Need to make a copy and possibly remove radiotap header
269 * and FCS from the original.
270 */
271 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
272
Johannes Berg0869aea2009-10-28 10:03:35 +0100273 origskb = remove_monitor_info(local, origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200274
275 if (!skb)
276 return origskb;
277 }
278
Johannes Berg0869aea2009-10-28 10:03:35 +0100279 /* prepend radiotap information */
280 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
Johannes Bergb2e77712007-09-26 15:19:39 +0200281
Johannes Bergce3edf6d02007-12-19 01:31:22 +0100282 skb_reset_mac_header(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200283 skb->ip_summed = CHECKSUM_UNNECESSARY;
284 skb->pkt_type = PACKET_OTHERHOST;
285 skb->protocol = htons(ETH_P_802_2);
286
287 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
288 if (!netif_running(sdata->dev))
289 continue;
290
Johannes Berg05c914f2008-09-11 00:01:58 +0200291 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
Johannes Bergb2e77712007-09-26 15:19:39 +0200292 continue;
293
Michael Wu3d30d942008-01-31 19:48:27 +0100294 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
295 continue;
296
Johannes Bergb2e77712007-09-26 15:19:39 +0200297 if (prev_dev) {
298 skb2 = skb_clone(skb, GFP_ATOMIC);
299 if (skb2) {
300 skb2->dev = prev_dev;
301 netif_rx(skb2);
302 }
303 }
304
305 prev_dev = sdata->dev;
306 sdata->dev->stats.rx_packets++;
307 sdata->dev->stats.rx_bytes += skb->len;
308 }
309
310 if (prev_dev) {
311 skb->dev = prev_dev;
312 netif_rx(skb);
313 } else
314 dev_kfree_skb(skb);
315
316 return origskb;
317}
318
319
Johannes Berg5cf121c2008-02-25 16:27:43 +0100320static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +0200321{
Harvey Harrison238f74a2008-07-02 11:05:34 -0700322 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200323 int tid;
324
325 /* does the frame have a qos control field? */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700326 if (ieee80211_is_data_qos(hdr->frame_control)) {
327 u8 *qc = ieee80211_get_qos_ctl(hdr);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200328 /* frame has qos control */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700329 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
330 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
Johannes Berg5cf121c2008-02-25 16:27:43 +0100331 rx->flags |= IEEE80211_RX_AMSDU;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +0200332 else
Johannes Berg5cf121c2008-02-25 16:27:43 +0100333 rx->flags &= ~IEEE80211_RX_AMSDU;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200334 } else {
Johannes Berg1411f9b2008-07-10 10:11:02 +0200335 /*
336 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
337 *
338 * Sequence numbers for management frames, QoS data
339 * frames with a broadcast/multicast address in the
340 * Address 1 field, and all non-QoS data frames sent
341 * by QoS STAs are assigned using an additional single
342 * modulo-4096 counter, [...]
343 *
344 * We also use that counter for non-QoS STAs.
345 */
346 tid = NUM_RX_DATA_QUEUES - 1;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200347 }
Johannes Berg52865df2007-07-27 15:43:22 +0200348
Johannes Berg5cf121c2008-02-25 16:27:43 +0100349 rx->queue = tid;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200350 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
351 * For now, set skb->priority to 0 for other cases. */
352 rx->skb->priority = (tid > 7) ? 0 : tid;
Johannes Berg38f37142008-01-29 17:07:43 +0100353}
Johannes Berg6e0d1142007-07-27 15:43:22 +0200354
Johannes Bergd1c3a372009-01-07 00:26:10 +0100355/**
356 * DOC: Packet alignment
357 *
358 * Drivers always need to pass packets that are aligned to two-byte boundaries
359 * to the stack.
360 *
361 * Additionally, should, if possible, align the payload data in a way that
362 * guarantees that the contained IP header is aligned to a four-byte
363 * boundary. In the case of regular frames, this simply means aligning the
364 * payload to a four-byte boundary (because either the IP header is directly
365 * contained, or IV/RFC1042 headers that have a length divisible by four are
366 * in front of it).
367 *
368 * With A-MSDU frames, however, the payload data address must yield two modulo
369 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
370 * push the IP header further back to a multiple of four again. Thankfully, the
371 * specs were sane enough this time around to require padding each A-MSDU
372 * subframe to a length that is a multiple of four.
373 *
374 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
375 * the payload is not supported, the driver is required to move the 802.11
376 * header to be directly in front of the payload in that case.
377 */
378static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
Johannes Berg38f37142008-01-29 17:07:43 +0100379{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700380 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg38f37142008-01-29 17:07:43 +0100381 int hdrlen;
382
Johannes Bergd1c3a372009-01-07 00:26:10 +0100383#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
384 return;
385#endif
386
387 if (WARN_ONCE((unsigned long)rx->skb->data & 1,
388 "unaligned packet at 0x%p\n", rx->skb->data))
389 return;
390
Harvey Harrisona7767f92008-07-02 16:30:51 -0700391 if (!ieee80211_is_data_present(hdr->frame_control))
Johannes Berg38f37142008-01-29 17:07:43 +0100392 return;
393
Harvey Harrisona7767f92008-07-02 16:30:51 -0700394 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg5cf121c2008-02-25 16:27:43 +0100395 if (rx->flags & IEEE80211_RX_AMSDU)
Johannes Berg38f37142008-01-29 17:07:43 +0100396 hdrlen += ETH_HLEN;
Johannes Bergd1c3a372009-01-07 00:26:10 +0100397 WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
398 "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200399}
400
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +0200401
Johannes Berg571ecf62007-07-27 15:43:22 +0200402/* rx handlers */
403
Johannes Berg49461622008-06-30 15:10:45 +0200404static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100405ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200406{
407 struct ieee80211_local *local = rx->local;
408 struct sk_buff *skb = rx->skb;
409
Helmut Schaafbe9c422009-07-23 12:14:04 +0200410 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning)))
Johannes Bergf1d58c22009-06-17 13:13:00 +0200411 return ieee80211_scan_rx(rx->sdata, skb);
Zhu Yiece8edd2007-11-22 10:53:21 +0800412
Helmut Schaa142b9f52009-07-23 13:18:01 +0200413 if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning) &&
414 (rx->flags & IEEE80211_RX_IN_SCAN))) {
Zhu Yiece8edd2007-11-22 10:53:21 +0800415 /* drop all the other packets during a software scan anyway */
Johannes Bergf1d58c22009-06-17 13:13:00 +0200416 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
Zhu Yiece8edd2007-11-22 10:53:21 +0800417 dev_kfree_skb(skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +0100418 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +0200419 }
420
Johannes Berg5cf121c2008-02-25 16:27:43 +0100421 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200422 /* scanning finished during invoking of handlers */
423 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
Johannes Berge4c26ad2008-01-31 19:48:21 +0100424 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200425 }
426
Johannes Berg9ae54c82008-01-31 19:48:20 +0100427 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200428}
429
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200430
431static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
432{
433 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
434
435 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
436 return 0;
437
438 return ieee80211_is_robust_mgmt_frame(hdr);
439}
440
441
442static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
443{
444 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
445
446 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
447 return 0;
448
449 return ieee80211_is_robust_mgmt_frame(hdr);
450}
451
452
453/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
454static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
455{
456 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
457 struct ieee80211_mmie *mmie;
458
459 if (skb->len < 24 + sizeof(*mmie) ||
460 !is_multicast_ether_addr(hdr->da))
461 return -1;
462
463 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
464 return -1; /* not a robust management frame */
465
466 mmie = (struct ieee80211_mmie *)
467 (skb->data + skb->len - sizeof(*mmie));
468 if (mmie->element_id != WLAN_EID_MMIE ||
469 mmie->length != sizeof(*mmie) - 2)
470 return -1;
471
472 return le16_to_cpu(mmie->key_id);
473}
474
475
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100476static ieee80211_rx_result
Johannes Berg5cf121c2008-02-25 16:27:43 +0100477ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100478{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700479 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
480 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
Javier Cardona3c5772a2009-08-10 12:15:48 -0700481 char *dev_addr = rx->dev->dev_addr;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100482
Harvey Harrisona7767f92008-07-02 16:30:51 -0700483 if (ieee80211_is_data(hdr->frame_control)) {
Javier Cardona3c5772a2009-08-10 12:15:48 -0700484 if (is_multicast_ether_addr(hdr->addr1)) {
485 if (ieee80211_has_tods(hdr->frame_control) ||
486 !ieee80211_has_fromds(hdr->frame_control))
487 return RX_DROP_MONITOR;
488 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
489 return RX_DROP_MONITOR;
490 } else {
491 if (!ieee80211_has_a4(hdr->frame_control))
492 return RX_DROP_MONITOR;
493 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
494 return RX_DROP_MONITOR;
495 }
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100496 }
497
498 /* If there is not an established peer link and this is not a peer link
499 * establisment frame, beacon or probe, drop the frame.
500 */
501
Luis Carlos Cobob4e08ea2008-02-29 15:46:08 -0800502 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100503 struct ieee80211_mgmt *mgmt;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100504
Harvey Harrisona7767f92008-07-02 16:30:51 -0700505 if (!ieee80211_is_mgmt(hdr->frame_control))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100506 return RX_DROP_MONITOR;
507
Harvey Harrisona7767f92008-07-02 16:30:51 -0700508 if (ieee80211_is_action(hdr->frame_control)) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100509 mgmt = (struct ieee80211_mgmt *)hdr;
510 if (mgmt->u.action.category != PLINK_CATEGORY)
511 return RX_DROP_MONITOR;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100512 return RX_CONTINUE;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100513 }
514
Harvey Harrisona7767f92008-07-02 16:30:51 -0700515 if (ieee80211_is_probe_req(hdr->frame_control) ||
516 ieee80211_is_probe_resp(hdr->frame_control) ||
517 ieee80211_is_beacon(hdr->frame_control))
518 return RX_CONTINUE;
519
520 return RX_DROP_MONITOR;
521
522 }
523
524#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
525
526 if (ieee80211_is_data(hdr->frame_control) &&
527 is_multicast_ether_addr(hdr->addr1) &&
Javier Cardona3c5772a2009-08-10 12:15:48 -0700528 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100529 return RX_DROP_MONITOR;
Johannes Berg902acc72008-02-23 15:17:19 +0100530#undef msh_h_get
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100531
Johannes Berg902acc72008-02-23 15:17:19 +0100532 return RX_CONTINUE;
533}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100534
535
Johannes Berg49461622008-06-30 15:10:45 +0200536static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100537ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200538{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700539 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +0200540
541 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
542 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
Harvey Harrisona7767f92008-07-02 16:30:51 -0700543 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
Johannes Berg5cf121c2008-02-25 16:27:43 +0100544 rx->sta->last_seq_ctrl[rx->queue] ==
Johannes Berg571ecf62007-07-27 15:43:22 +0200545 hdr->seq_ctrl)) {
Johannes Berg5cf121c2008-02-25 16:27:43 +0100546 if (rx->flags & IEEE80211_RX_RA_MATCH) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200547 rx->local->dot11FrameDuplicateCount++;
548 rx->sta->num_duplicates++;
549 }
Johannes Berge4c26ad2008-01-31 19:48:21 +0100550 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200551 } else
Johannes Berg5cf121c2008-02-25 16:27:43 +0100552 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
Johannes Berg571ecf62007-07-27 15:43:22 +0200553 }
554
Johannes Berg571ecf62007-07-27 15:43:22 +0200555 if (unlikely(rx->skb->len < 16)) {
556 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
Johannes Berge4c26ad2008-01-31 19:48:21 +0100557 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200558 }
559
Johannes Berg571ecf62007-07-27 15:43:22 +0200560 /* Drop disallowed frame classes based on STA auth/assoc state;
561 * IEEE 802.11, Chap 5.5.
562 *
Johannes Bergccd7b362008-09-11 00:01:56 +0200563 * mac80211 filters only based on association state, i.e. it drops
564 * Class 3 frames from not associated stations. hostapd sends
Johannes Berg571ecf62007-07-27 15:43:22 +0200565 * deauth/disassoc frames when needed. In addition, hostapd is
566 * responsible for filtering on both auth and assoc states.
567 */
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100568
Johannes Berg902acc72008-02-23 15:17:19 +0100569 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100570 return ieee80211_rx_mesh_check(rx);
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100571
Harvey Harrisona7767f92008-07-02 16:30:51 -0700572 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
573 ieee80211_is_pspoll(hdr->frame_control)) &&
Johannes Berg05c914f2008-09-11 00:01:58 +0200574 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Johannes Berg07346f812008-05-03 01:02:02 +0200575 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
Harvey Harrisona7767f92008-07-02 16:30:51 -0700576 if ((!ieee80211_has_fromds(hdr->frame_control) &&
577 !ieee80211_has_tods(hdr->frame_control) &&
578 ieee80211_is_data(hdr->frame_control)) ||
579 !(rx->flags & IEEE80211_RX_RA_MATCH)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200580 /* Drop IBSS frames and frames for other hosts
581 * silently. */
Johannes Berge4c26ad2008-01-31 19:48:21 +0100582 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200583 }
584
Johannes Berge4c26ad2008-01-31 19:48:21 +0100585 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200586 }
587
Johannes Berg9ae54c82008-01-31 19:48:20 +0100588 return RX_CONTINUE;
Johannes Berg570bd532007-07-27 15:43:22 +0200589}
590
591
Johannes Berg49461622008-06-30 15:10:45 +0200592static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100593ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
Johannes Berg570bd532007-07-27 15:43:22 +0200594{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700595 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg3017b802007-08-28 17:01:53 -0400596 int keyidx;
597 int hdrlen;
Johannes Berge4c26ad2008-01-31 19:48:21 +0100598 ieee80211_rx_result result = RX_DROP_UNUSABLE;
Johannes Bergd4e46a32007-09-14 11:10:24 -0400599 struct ieee80211_key *stakey = NULL;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200600 int mmie_keyidx = -1;
Johannes Berg570bd532007-07-27 15:43:22 +0200601
Johannes Berg3017b802007-08-28 17:01:53 -0400602 /*
603 * Key selection 101
604 *
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200605 * There are four types of keys:
Johannes Berg3017b802007-08-28 17:01:53 -0400606 * - GTK (group keys)
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200607 * - IGTK (group keys for management frames)
Johannes Berg3017b802007-08-28 17:01:53 -0400608 * - PTK (pairwise keys)
609 * - STK (station-to-station pairwise keys)
610 *
611 * When selecting a key, we have to distinguish between multicast
612 * (including broadcast) and unicast frames, the latter can only
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200613 * use PTKs and STKs while the former always use GTKs and IGTKs.
614 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
615 * unicast frames can also use key indices like GTKs. Hence, if we
616 * don't have a PTK/STK we check the key index for a WEP key.
Johannes Berg3017b802007-08-28 17:01:53 -0400617 *
Johannes Berg8dc06a12007-08-28 17:01:55 -0400618 * Note that in a regular BSS, multicast frames are sent by the
619 * AP only, associated stations unicast the frame to the AP first
620 * which then multicasts it on their behalf.
621 *
Johannes Berg3017b802007-08-28 17:01:53 -0400622 * There is also a slight problem in IBSS mode: GTKs are negotiated
623 * with each station, that is something we don't currently handle.
Johannes Berg8dc06a12007-08-28 17:01:55 -0400624 * The spec seems to expect that one negotiates the same key with
625 * every station but there's no such requirement; VLANs could be
626 * possible.
Johannes Berg3017b802007-08-28 17:01:53 -0400627 */
Johannes Berg571ecf62007-07-27 15:43:22 +0200628
Johannes Berg3017b802007-08-28 17:01:53 -0400629 /*
Johannes Berg1990af82007-09-26 17:53:15 +0200630 * No point in finding a key and decrypting if the frame is neither
Johannes Berg3017b802007-08-28 17:01:53 -0400631 * addressed to us nor a multicast frame.
632 */
Johannes Berg5cf121c2008-02-25 16:27:43 +0100633 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100634 return RX_CONTINUE;
Johannes Berg3017b802007-08-28 17:01:53 -0400635
Johannes Bergd4e46a32007-09-14 11:10:24 -0400636 if (rx->sta)
637 stakey = rcu_dereference(rx->sta->key);
638
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300639 if (!ieee80211_has_protected(hdr->frame_control))
640 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
641
Johannes Bergd4e46a32007-09-14 11:10:24 -0400642 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
643 rx->key = stakey;
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300644 /* Skip decryption if the frame is not protected. */
645 if (!ieee80211_has_protected(hdr->frame_control))
646 return RX_CONTINUE;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200647 } else if (mmie_keyidx >= 0) {
648 /* Broadcast/multicast robust management frame / BIP */
649 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
650 (rx->status->flag & RX_FLAG_IV_STRIPPED))
651 return RX_CONTINUE;
652
653 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
654 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
655 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
656 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300657 } else if (!ieee80211_has_protected(hdr->frame_control)) {
658 /*
659 * The frame was not protected, so skip decryption. However, we
660 * need to set rx->key if there is a key that could have been
661 * used so that the frame may be dropped if encryption would
662 * have been expected.
663 */
664 struct ieee80211_key *key = NULL;
665 if (ieee80211_is_mgmt(hdr->frame_control) &&
666 is_multicast_ether_addr(hdr->addr1) &&
667 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
668 rx->key = key;
669 else if ((key = rcu_dereference(rx->sdata->default_key)))
670 rx->key = key;
671 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200672 } else {
Johannes Berg3017b802007-08-28 17:01:53 -0400673 /*
674 * The device doesn't give us the IV so we won't be
675 * able to look up the key. That's ok though, we
676 * don't need to decrypt the frame, we just won't
677 * be able to keep statistics accurate.
678 * Except for key threshold notifications, should
679 * we somehow allow the driver to tell us which key
680 * the hardware used if this flag is set?
681 */
Johannes Berg5cf121c2008-02-25 16:27:43 +0100682 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
683 (rx->status->flag & RX_FLAG_IV_STRIPPED))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100684 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200685
Harvey Harrisona7767f92008-07-02 16:30:51 -0700686 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg571ecf62007-07-27 15:43:22 +0200687
Johannes Berg3017b802007-08-28 17:01:53 -0400688 if (rx->skb->len < 8 + hdrlen)
Johannes Berge4c26ad2008-01-31 19:48:21 +0100689 return RX_DROP_UNUSABLE; /* TODO: count this? */
Johannes Berg571ecf62007-07-27 15:43:22 +0200690
Johannes Berg3017b802007-08-28 17:01:53 -0400691 /*
692 * no need to call ieee80211_wep_get_keyidx,
693 * it verifies a bunch of things we've done already
694 */
695 keyidx = rx->skb->data[hdrlen + 3] >> 6;
696
Johannes Bergd4e46a32007-09-14 11:10:24 -0400697 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
Johannes Berg3017b802007-08-28 17:01:53 -0400698
699 /*
700 * RSNA-protected unicast frames should always be sent with
701 * pairwise or station-to-station keys, but for WEP we allow
702 * using a key index as well.
703 */
Johannes Berg8f20fc22007-08-28 17:01:54 -0400704 if (rx->key && rx->key->conf.alg != ALG_WEP &&
Johannes Berg3017b802007-08-28 17:01:53 -0400705 !is_multicast_ether_addr(hdr->addr1))
706 rx->key = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +0200707 }
708
Johannes Berg3017b802007-08-28 17:01:53 -0400709 if (rx->key) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200710 rx->key->tx_rx_count++;
Johannes Berg011bfcc2007-09-17 01:29:25 -0400711 /* TODO: add threshold stuff again */
Johannes Berg1990af82007-09-26 17:53:15 +0200712 } else {
Johannes Berge4c26ad2008-01-31 19:48:21 +0100713 return RX_DROP_MONITOR;
Johannes Berg70f08762007-09-26 17:53:14 +0200714 }
715
Johannes Berg1990af82007-09-26 17:53:15 +0200716 /* Check for weak IVs if possible */
717 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
Harvey Harrisona7767f92008-07-02 16:30:51 -0700718 ieee80211_is_data(hdr->frame_control) &&
Johannes Berg5cf121c2008-02-25 16:27:43 +0100719 (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
720 !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
Johannes Berg1990af82007-09-26 17:53:15 +0200721 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
722 rx->sta->wep_weak_iv_count++;
723
Johannes Berg70f08762007-09-26 17:53:14 +0200724 switch (rx->key->conf.alg) {
725 case ALG_WEP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200726 result = ieee80211_crypto_wep_decrypt(rx);
727 break;
Johannes Berg70f08762007-09-26 17:53:14 +0200728 case ALG_TKIP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200729 result = ieee80211_crypto_tkip_decrypt(rx);
730 break;
Johannes Berg70f08762007-09-26 17:53:14 +0200731 case ALG_CCMP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200732 result = ieee80211_crypto_ccmp_decrypt(rx);
733 break;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200734 case ALG_AES_CMAC:
735 result = ieee80211_crypto_aes_cmac_decrypt(rx);
736 break;
Johannes Berg70f08762007-09-26 17:53:14 +0200737 }
738
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200739 /* either the frame has been decrypted or will be dropped */
Johannes Berg5cf121c2008-02-25 16:27:43 +0100740 rx->status->flag |= RX_FLAG_DECRYPTED;
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200741
742 return result;
Johannes Berg70f08762007-09-26 17:53:14 +0200743}
744
Kalle Valo572e0012009-02-10 17:09:31 +0200745static ieee80211_rx_result debug_noinline
746ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
747{
748 struct ieee80211_local *local;
749 struct ieee80211_hdr *hdr;
750 struct sk_buff *skb;
751
752 local = rx->local;
753 skb = rx->skb;
754 hdr = (struct ieee80211_hdr *) skb->data;
755
756 if (!local->pspolling)
757 return RX_CONTINUE;
758
759 if (!ieee80211_has_fromds(hdr->frame_control))
760 /* this is not from AP */
761 return RX_CONTINUE;
762
763 if (!ieee80211_is_data(hdr->frame_control))
764 return RX_CONTINUE;
765
766 if (!ieee80211_has_moredata(hdr->frame_control)) {
767 /* AP has no more frames buffered for us */
768 local->pspolling = false;
769 return RX_CONTINUE;
770 }
771
772 /* more data bit is set, let's request a new frame from the AP */
773 ieee80211_send_pspoll(local, rx->sdata);
774
775 return RX_CONTINUE;
776}
777
Johannes Berg133b8222008-09-16 14:18:59 +0200778static void ap_sta_ps_start(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +0200779{
Johannes Berg133b8222008-09-16 14:18:59 +0200780 struct ieee80211_sub_if_data *sdata = sta->sdata;
Christian Lamparter4571d3b2008-11-30 00:48:41 +0100781 struct ieee80211_local *local = sdata->local;
Joe Perches0795af52007-10-03 17:59:30 -0700782
Johannes Berg3e122be2008-07-09 14:40:34 +0200783 atomic_inc(&sdata->bss->num_sta_ps);
Johannes Bergaf818582009-11-06 11:35:50 +0100784 set_sta_flags(sta, WLAN_STA_PS_STA);
Johannes Berg24487982009-04-23 18:52:52 +0200785 drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
Johannes Berg571ecf62007-07-27 15:43:22 +0200786#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Berg0c68ae262008-10-27 15:56:10 -0700787 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
788 sdata->dev->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +0200789#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
790}
791
Johannes Bergff9458d2009-10-30 12:56:02 +0100792static void ap_sta_ps_end(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +0200793{
Johannes Berg133b8222008-09-16 14:18:59 +0200794 struct ieee80211_sub_if_data *sdata = sta->sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +0200795
Johannes Berg3e122be2008-07-09 14:40:34 +0200796 atomic_dec(&sdata->bss->num_sta_ps);
Johannes Berg004c8722008-02-20 11:21:35 +0100797
Johannes Bergaf818582009-11-06 11:35:50 +0100798 clear_sta_flags(sta, WLAN_STA_PS_STA);
Johannes Berg004c8722008-02-20 11:21:35 +0100799
Johannes Berg571ecf62007-07-27 15:43:22 +0200800#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Berg0c68ae262008-10-27 15:56:10 -0700801 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
802 sdata->dev->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +0200803#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
Johannes Berg004c8722008-02-20 11:21:35 +0100804
Johannes Bergaf818582009-11-06 11:35:50 +0100805 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200806#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Bergaf818582009-11-06 11:35:50 +0100807 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
808 sdata->dev->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +0200809#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
Johannes Bergaf818582009-11-06 11:35:50 +0100810 return;
811 }
812
813 ieee80211_sta_ps_deliver_wakeup(sta);
Johannes Berg571ecf62007-07-27 15:43:22 +0200814}
815
Johannes Berg49461622008-06-30 15:10:45 +0200816static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100817ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200818{
819 struct sta_info *sta = rx->sta;
Harvey Harrisona7767f92008-07-02 16:30:51 -0700820 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +0200821
822 if (!sta)
Johannes Berg9ae54c82008-01-31 19:48:20 +0100823 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200824
Johannes Bergb291ba12009-07-10 15:29:03 +0200825 /*
826 * Update last_rx only for IBSS packets which are for the current
827 * BSSID to avoid keeping the current IBSS network alive in cases
828 * where other STAs start using different BSSID.
829 */
Johannes Berg05c914f2008-09-11 00:01:58 +0200830 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
Ron Rindjunsky71364712007-12-25 17:00:36 +0200831 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
Johannes Berg05c914f2008-09-11 00:01:58 +0200832 NL80211_IFTYPE_ADHOC);
Johannes Berg46900292009-02-15 12:44:28 +0100833 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
Johannes Berg571ecf62007-07-27 15:43:22 +0200834 sta->last_rx = jiffies;
Johannes Bergb291ba12009-07-10 15:29:03 +0200835 } else if (!is_multicast_ether_addr(hdr->addr1)) {
836 /*
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100837 * Mesh beacons will update last_rx when if they are found to
838 * match the current local configuration when processed.
Johannes Berg571ecf62007-07-27 15:43:22 +0200839 */
Johannes Bergb291ba12009-07-10 15:29:03 +0200840 sta->last_rx = jiffies;
Johannes Berg571ecf62007-07-27 15:43:22 +0200841 }
842
Johannes Berg5cf121c2008-02-25 16:27:43 +0100843 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100844 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200845
Kalle Valo3cf335d2009-03-22 21:57:06 +0200846 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
847 ieee80211_sta_rx_notify(rx->sdata, hdr);
848
Johannes Berg571ecf62007-07-27 15:43:22 +0200849 sta->rx_fragments++;
850 sta->rx_bytes += rx->skb->len;
Johannes Berg5cf121c2008-02-25 16:27:43 +0100851 sta->last_signal = rx->status->signal;
852 sta->last_noise = rx->status->noise;
Johannes Berg571ecf62007-07-27 15:43:22 +0200853
Johannes Berg72eaa432008-11-26 15:02:58 +0100854 /*
855 * Change STA power saving mode only at the end of a frame
856 * exchange sequence.
857 */
Johannes Berg3e122be2008-07-09 14:40:34 +0200858 if (!ieee80211_has_morefrags(hdr->frame_control) &&
Johannes Berg05c914f2008-09-11 00:01:58 +0200859 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
860 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
Johannes Bergaf818582009-11-06 11:35:50 +0100861 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
Johannes Berg72eaa432008-11-26 15:02:58 +0100862 /*
863 * Ignore doze->wake transitions that are
864 * indicated by non-data frames, the standard
865 * is unclear here, but for example going to
866 * PS mode and then scanning would cause a
867 * doze->wake transition for the probe request,
868 * and that is clearly undesirable.
869 */
870 if (ieee80211_is_data(hdr->frame_control) &&
871 !ieee80211_has_pm(hdr->frame_control))
Johannes Bergff9458d2009-10-30 12:56:02 +0100872 ap_sta_ps_end(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +0100873 } else {
874 if (ieee80211_has_pm(hdr->frame_control))
875 ap_sta_ps_start(sta);
876 }
Johannes Berg571ecf62007-07-27 15:43:22 +0200877 }
878
Johannes Berg22403de2009-10-30 12:55:03 +0100879 /*
880 * Drop (qos-)data::nullfunc frames silently, since they
881 * are used only to control station power saving mode.
882 */
883 if (ieee80211_is_nullfunc(hdr->frame_control) ||
884 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200885 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
Johannes Berg22403de2009-10-30 12:55:03 +0100886 /*
887 * Update counter and free packet here to avoid
888 * counting this as a dropped packed.
889 */
Johannes Berg571ecf62007-07-27 15:43:22 +0200890 sta->rx_packets++;
891 dev_kfree_skb(rx->skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +0100892 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +0200893 }
894
Johannes Berg9ae54c82008-01-31 19:48:20 +0100895 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200896} /* ieee80211_rx_h_sta_process */
897
Johannes Berg571ecf62007-07-27 15:43:22 +0200898static inline struct ieee80211_fragment_entry *
899ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
900 unsigned int frag, unsigned int seq, int rx_queue,
901 struct sk_buff **skb)
902{
903 struct ieee80211_fragment_entry *entry;
904 int idx;
905
906 idx = sdata->fragment_next;
907 entry = &sdata->fragments[sdata->fragment_next++];
908 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
909 sdata->fragment_next = 0;
910
911 if (!skb_queue_empty(&entry->skb_list)) {
Johannes Bergf4ea83d2008-06-30 15:10:46 +0200912#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
Johannes Berg571ecf62007-07-27 15:43:22 +0200913 struct ieee80211_hdr *hdr =
914 (struct ieee80211_hdr *) entry->skb_list.next->data;
915 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
916 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
Johannes Berg0c68ae262008-10-27 15:56:10 -0700917 "addr1=%pM addr2=%pM\n",
Johannes Berg571ecf62007-07-27 15:43:22 +0200918 sdata->dev->name, idx,
919 jiffies - entry->first_frag_time, entry->seq,
Johannes Berg0c68ae262008-10-27 15:56:10 -0700920 entry->last_frag, hdr->addr1, hdr->addr2);
Johannes Bergf4ea83d2008-06-30 15:10:46 +0200921#endif
Johannes Berg571ecf62007-07-27 15:43:22 +0200922 __skb_queue_purge(&entry->skb_list);
923 }
924
925 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
926 *skb = NULL;
927 entry->first_frag_time = jiffies;
928 entry->seq = seq;
929 entry->rx_queue = rx_queue;
930 entry->last_frag = frag;
931 entry->ccmp = 0;
932 entry->extra_len = 0;
933
934 return entry;
935}
936
937static inline struct ieee80211_fragment_entry *
938ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
Harvey Harrisonb73d70a2008-07-15 18:44:12 -0700939 unsigned int frag, unsigned int seq,
Johannes Berg571ecf62007-07-27 15:43:22 +0200940 int rx_queue, struct ieee80211_hdr *hdr)
941{
942 struct ieee80211_fragment_entry *entry;
943 int i, idx;
944
945 idx = sdata->fragment_next;
946 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
947 struct ieee80211_hdr *f_hdr;
Johannes Berg571ecf62007-07-27 15:43:22 +0200948
949 idx--;
950 if (idx < 0)
951 idx = IEEE80211_FRAGMENT_MAX - 1;
952
953 entry = &sdata->fragments[idx];
954 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
955 entry->rx_queue != rx_queue ||
956 entry->last_frag + 1 != frag)
957 continue;
958
Harvey Harrisonb73d70a2008-07-15 18:44:12 -0700959 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
Johannes Berg571ecf62007-07-27 15:43:22 +0200960
Harvey Harrisonb73d70a2008-07-15 18:44:12 -0700961 /*
962 * Check ftype and addresses are equal, else check next fragment
963 */
964 if (((hdr->frame_control ^ f_hdr->frame_control) &
965 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
Johannes Berg571ecf62007-07-27 15:43:22 +0200966 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
967 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
968 continue;
969
S.Çağlar Onurab466232008-02-14 17:36:47 +0200970 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200971 __skb_queue_purge(&entry->skb_list);
972 continue;
973 }
974 return entry;
975 }
976
977 return NULL;
978}
979
Johannes Berg49461622008-06-30 15:10:45 +0200980static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100981ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200982{
983 struct ieee80211_hdr *hdr;
984 u16 sc;
Harvey Harrison358c8d92008-07-15 18:44:13 -0700985 __le16 fc;
Johannes Berg571ecf62007-07-27 15:43:22 +0200986 unsigned int frag, seq;
987 struct ieee80211_fragment_entry *entry;
988 struct sk_buff *skb;
989
Harvey Harrisonb73d70a2008-07-15 18:44:12 -0700990 hdr = (struct ieee80211_hdr *)rx->skb->data;
Harvey Harrison358c8d92008-07-15 18:44:13 -0700991 fc = hdr->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +0200992 sc = le16_to_cpu(hdr->seq_ctrl);
993 frag = sc & IEEE80211_SCTL_FRAG;
994
Harvey Harrison358c8d92008-07-15 18:44:13 -0700995 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
Johannes Berg571ecf62007-07-27 15:43:22 +0200996 (rx->skb)->len < 24 ||
997 is_multicast_ether_addr(hdr->addr1))) {
998 /* not fragmented */
999 goto out;
1000 }
1001 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1002
1003 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1004
1005 if (frag == 0) {
1006 /* This is the first fragment of a new frame. */
1007 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001008 rx->queue, &(rx->skb));
Johannes Berg8f20fc22007-08-28 17:01:54 -04001009 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
Harvey Harrison358c8d92008-07-15 18:44:13 -07001010 ieee80211_has_protected(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001011 /* Store CCMP PN so that we can verify that the next
1012 * fragment has a sequential PN value. */
1013 entry->ccmp = 1;
1014 memcpy(entry->last_pn,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001015 rx->key->u.ccmp.rx_pn[rx->queue],
Johannes Berg571ecf62007-07-27 15:43:22 +02001016 CCMP_PN_LEN);
1017 }
Johannes Berg9ae54c82008-01-31 19:48:20 +01001018 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001019 }
1020
1021 /* This is a fragment for a frame that should already be pending in
1022 * fragment cache. Add this fragment to the end of the pending entry.
1023 */
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001024 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
Johannes Berg571ecf62007-07-27 15:43:22 +02001025 if (!entry) {
1026 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001027 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02001028 }
1029
1030 /* Verify that MPDUs within one MSDU have sequential PN values.
1031 * (IEEE 802.11i, 8.3.3.4.5) */
1032 if (entry->ccmp) {
1033 int i;
1034 u8 pn[CCMP_PN_LEN], *rpn;
Johannes Berg8f20fc22007-08-28 17:01:54 -04001035 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
Johannes Berge4c26ad2008-01-31 19:48:21 +01001036 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001037 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1038 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1039 pn[i]++;
1040 if (pn[i])
1041 break;
1042 }
Johannes Berg5cf121c2008-02-25 16:27:43 +01001043 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001044 if (memcmp(pn, rpn, CCMP_PN_LEN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001045 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001046 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1047 }
1048
Harvey Harrison358c8d92008-07-15 18:44:13 -07001049 skb_pull(rx->skb, ieee80211_hdrlen(fc));
Johannes Berg571ecf62007-07-27 15:43:22 +02001050 __skb_queue_tail(&entry->skb_list, rx->skb);
1051 entry->last_frag = frag;
1052 entry->extra_len += rx->skb->len;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001053 if (ieee80211_has_morefrags(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001054 rx->skb = NULL;
Johannes Berg9ae54c82008-01-31 19:48:20 +01001055 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001056 }
1057
1058 rx->skb = __skb_dequeue(&entry->skb_list);
1059 if (skb_tailroom(rx->skb) < entry->extra_len) {
1060 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1061 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1062 GFP_ATOMIC))) {
1063 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1064 __skb_queue_purge(&entry->skb_list);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001065 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001066 }
1067 }
1068 while ((skb = __skb_dequeue(&entry->skb_list))) {
1069 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1070 dev_kfree_skb(skb);
1071 }
1072
1073 /* Complete frame has been reassembled - process it now */
Johannes Berg5cf121c2008-02-25 16:27:43 +01001074 rx->flags |= IEEE80211_RX_FRAGMENTED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001075
1076 out:
1077 if (rx->sta)
1078 rx->sta->rx_packets++;
1079 if (is_multicast_ether_addr(hdr->addr1))
1080 rx->local->dot11MulticastReceivedFrameCount++;
1081 else
1082 ieee80211_led_rx(rx->local);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001083 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001084}
1085
Johannes Berg49461622008-06-30 15:10:45 +02001086static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001087ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001088{
Johannes Bergaf818582009-11-06 11:35:50 +01001089 struct ieee80211_sub_if_data *sdata = rx->sdata;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001090 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02001091
Harvey Harrison358c8d92008-07-15 18:44:13 -07001092 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
Johannes Berg5cf121c2008-02-25 16:27:43 +01001093 !(rx->flags & IEEE80211_RX_RA_MATCH)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001094 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001095
Johannes Berg05c914f2008-09-11 00:01:58 +02001096 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1097 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001098 return RX_DROP_UNUSABLE;
Ron Rindjunsky98f0b0a2007-12-18 17:23:53 +02001099
Johannes Bergaf818582009-11-06 11:35:50 +01001100 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1101 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1102 else
1103 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
Johannes Berg571ecf62007-07-27 15:43:22 +02001104
Johannes Berg9ae54c82008-01-31 19:48:20 +01001105 /* Free PS Poll skb here instead of returning RX_DROP that would
Johannes Berg571ecf62007-07-27 15:43:22 +02001106 * count as an dropped frame. */
1107 dev_kfree_skb(rx->skb);
1108
Johannes Berg9ae54c82008-01-31 19:48:20 +01001109 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001110}
1111
Johannes Berg49461622008-06-30 15:10:45 +02001112static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001113ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +02001114{
Johannes Berg6e0d1142007-07-27 15:43:22 +02001115 u8 *data = rx->skb->data;
Harvey Harrison238f74a2008-07-02 11:05:34 -07001116 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001117
Harvey Harrison238f74a2008-07-02 11:05:34 -07001118 if (!ieee80211_is_data_qos(hdr->frame_control))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001119 return RX_CONTINUE;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001120
1121 /* remove the qos control field, update frame type and meta-data */
Harvey Harrison238f74a2008-07-02 11:05:34 -07001122 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1123 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1124 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
Johannes Berg6e0d1142007-07-27 15:43:22 +02001125 /* change frame type to non QOS */
Harvey Harrison238f74a2008-07-02 11:05:34 -07001126 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
Johannes Berg6e0d1142007-07-27 15:43:22 +02001127
Johannes Berg9ae54c82008-01-31 19:48:20 +01001128 return RX_CONTINUE;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001129}
1130
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001131static int
Johannes Berg5cf121c2008-02-25 16:27:43 +01001132ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001133{
Johannes Berg07346f812008-05-03 01:02:02 +02001134 if (unlikely(!rx->sta ||
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001135 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001136 return -EACCES;
Johannes Berg571ecf62007-07-27 15:43:22 +02001137
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001138 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001139}
1140
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001141static int
Harvey Harrison358c8d92008-07-15 18:44:13 -07001142ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Berg571ecf62007-07-27 15:43:22 +02001143{
Johannes Berg3017b802007-08-28 17:01:53 -04001144 /*
Johannes Berg7848ba72007-09-14 11:10:25 -04001145 * Pass through unencrypted frames if the hardware has
1146 * decrypted them already.
Johannes Berg3017b802007-08-28 17:01:53 -04001147 */
Johannes Berg5cf121c2008-02-25 16:27:43 +01001148 if (rx->status->flag & RX_FLAG_DECRYPTED)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001149 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001150
1151 /* Drop unencrypted frames if key is set. */
Harvey Harrison358c8d92008-07-15 18:44:13 -07001152 if (unlikely(!ieee80211_has_protected(fc) &&
1153 !ieee80211_is_nullfunc(fc) &&
Jouni Malinenf2ca3ea42009-05-08 12:36:03 +03001154 ieee80211_is_data(fc) &&
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +02001155 (rx->key || rx->sdata->drop_unencrypted)))
1156 return -EACCES;
Jouni Malinenf2ca3ea42009-05-08 12:36:03 +03001157 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1158 if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1159 rx->key))
1160 return -EACCES;
1161 /* BIP does not use Protected field, so need to check MMIE */
1162 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb)
1163 && ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
1164 rx->key))
1165 return -EACCES;
1166 /*
1167 * When using MFP, Action frames are not allowed prior to
1168 * having configured keys.
1169 */
1170 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1171 ieee80211_is_robust_mgmt_frame(
1172 (struct ieee80211_hdr *) rx->skb->data)))
1173 return -EACCES;
1174 }
Johannes Bergb3fc9c62008-04-13 10:12:47 +02001175
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001176 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001177}
1178
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001179static int
Zhu Yie31a16d2009-05-21 21:47:03 +08001180__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001181{
1182 struct net_device *dev = rx->dev;
Johannes Berg571ecf62007-07-27 15:43:22 +02001183 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1184
Zhu Yie31a16d2009-05-21 21:47:03 +08001185 return ieee80211_data_to_8023(rx->skb, dev->dev_addr, sdata->vif.type);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001186}
Johannes Berg571ecf62007-07-27 15:43:22 +02001187
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001188/*
1189 * requires that rx->skb is a frame with ethernet header
1190 */
Harvey Harrison358c8d92008-07-15 18:44:13 -07001191static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001192{
Senthil Balasubramanianc97c23e2008-05-28 23:15:32 +05301193 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001194 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1195 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1196
1197 /*
1198 * Allow EAPOL frames to us/the PAE group address regardless
1199 * of whether the frame was encrypted or not.
1200 */
1201 if (ehdr->h_proto == htons(ETH_P_PAE) &&
1202 (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1203 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1204 return true;
1205
1206 if (ieee80211_802_1x_port_control(rx) ||
Harvey Harrison358c8d92008-07-15 18:44:13 -07001207 ieee80211_drop_unencrypted(rx, fc))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001208 return false;
1209
1210 return true;
1211}
1212
1213/*
1214 * requires that rx->skb is a frame with ethernet header
1215 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001216static void
Johannes Berg5cf121c2008-02-25 16:27:43 +01001217ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001218{
1219 struct net_device *dev = rx->dev;
1220 struct ieee80211_local *local = rx->local;
1221 struct sk_buff *skb, *xmit_skb;
1222 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001223 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1224 struct sta_info *dsta;
Johannes Berg571ecf62007-07-27 15:43:22 +02001225
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001226 skb = rx->skb;
1227 xmit_skb = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +02001228
Johannes Berg05c914f2008-09-11 00:01:58 +02001229 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1230 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Johannes Berg213cd112008-09-11 00:01:54 +02001231 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
Johannes Berg5cf121c2008-02-25 16:27:43 +01001232 (rx->flags & IEEE80211_RX_RA_MATCH)) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001233 if (is_multicast_ether_addr(ehdr->h_dest)) {
1234 /*
1235 * send multicast frames both to higher layers in
1236 * local net stack and back to the wireless medium
1237 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001238 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1239 if (!xmit_skb && net_ratelimit())
Johannes Berg571ecf62007-07-27 15:43:22 +02001240 printk(KERN_DEBUG "%s: failed to clone "
1241 "multicast frame\n", dev->name);
1242 } else {
Johannes Berg571ecf62007-07-27 15:43:22 +02001243 dsta = sta_info_get(local, skb->data);
Johannes Bergd0709a62008-02-25 16:27:46 +01001244 if (dsta && dsta->sdata->dev == dev) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001245 /*
1246 * The destination station is associated to
1247 * this AP (in this VLAN), so send the frame
1248 * directly to it and do not pass it to local
1249 * net stack.
Johannes Berg571ecf62007-07-27 15:43:22 +02001250 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001251 xmit_skb = skb;
Johannes Berg571ecf62007-07-27 15:43:22 +02001252 skb = NULL;
1253 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001254 }
1255 }
1256
1257 if (skb) {
Johannes Bergd1c3a372009-01-07 00:26:10 +01001258 int align __maybe_unused;
1259
1260#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
1261 /*
1262 * 'align' will only take the values 0 or 2 here
1263 * since all frames are required to be aligned
1264 * to 2-byte boundaries when being passed to
1265 * mac80211. That also explains the __skb_push()
1266 * below.
1267 */
matthieu castetdacb6f12009-06-04 22:16:18 +02001268 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
Johannes Bergd1c3a372009-01-07 00:26:10 +01001269 if (align) {
1270 if (WARN_ON(skb_headroom(skb) < 3)) {
1271 dev_kfree_skb(skb);
1272 skb = NULL;
1273 } else {
1274 u8 *data = skb->data;
Zhu Yi8ce0b582009-10-28 13:13:52 -07001275 size_t len = skb_headlen(skb);
1276 skb->data -= align;
1277 memmove(skb->data, data, len);
1278 skb_set_tail_pointer(skb, len);
Johannes Bergd1c3a372009-01-07 00:26:10 +01001279 }
1280 }
1281#endif
1282
1283 if (skb) {
1284 /* deliver to local stack */
1285 skb->protocol = eth_type_trans(skb, dev);
1286 memset(skb->cb, 0, sizeof(skb->cb));
1287 netif_rx(skb);
1288 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001289 }
1290
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001291 if (xmit_skb) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001292 /* send to wireless media */
YOSHIFUJI Hideakif831e902007-12-12 03:54:23 +09001293 xmit_skb->protocol = htons(ETH_P_802_3);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001294 skb_reset_network_header(xmit_skb);
1295 skb_reset_mac_header(xmit_skb);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001296 dev_queue_xmit(xmit_skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001297 }
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001298}
1299
Johannes Berg49461622008-06-30 15:10:45 +02001300static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001301ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001302{
1303 struct net_device *dev = rx->dev;
1304 struct ieee80211_local *local = rx->local;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001305 u16 ethertype;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001306 u8 *payload;
1307 struct sk_buff *skb = rx->skb, *frame = NULL;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001308 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1309 __le16 fc = hdr->frame_control;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001310 const struct ethhdr *eth;
1311 int remaining, err;
1312 u8 dst[ETH_ALEN];
1313 u8 src[ETH_ALEN];
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001314
Harvey Harrison358c8d92008-07-15 18:44:13 -07001315 if (unlikely(!ieee80211_is_data(fc)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001316 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001317
Harvey Harrison358c8d92008-07-15 18:44:13 -07001318 if (unlikely(!ieee80211_is_data_present(fc)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001319 return RX_DROP_MONITOR;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001320
Johannes Berg5cf121c2008-02-25 16:27:43 +01001321 if (!(rx->flags & IEEE80211_RX_AMSDU))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001322 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001323
Zhu Yie31a16d2009-05-21 21:47:03 +08001324 err = __ieee80211_data_to_8023(rx);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001325 if (unlikely(err))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001326 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001327
1328 skb->dev = dev;
1329
1330 dev->stats.rx_packets++;
1331 dev->stats.rx_bytes += skb->len;
1332
1333 /* skip the wrapping header */
1334 eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1335 if (!eth)
Johannes Berge4c26ad2008-01-31 19:48:21 +01001336 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001337
1338 while (skb != frame) {
1339 u8 padding;
1340 __be16 len = eth->h_proto;
1341 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1342
1343 remaining = skb->len;
1344 memcpy(dst, eth->h_dest, ETH_ALEN);
1345 memcpy(src, eth->h_source, ETH_ALEN);
1346
1347 padding = ((4 - subframe_len) & 0x3);
1348 /* the last MSDU has no padding */
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001349 if (subframe_len > remaining)
Johannes Berge4c26ad2008-01-31 19:48:21 +01001350 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001351
1352 skb_pull(skb, sizeof(struct ethhdr));
1353 /* if last subframe reuse skb */
1354 if (remaining <= subframe_len + padding)
1355 frame = skb;
1356 else {
Johannes Bergd1c3a372009-01-07 00:26:10 +01001357 /*
1358 * Allocate and reserve two bytes more for payload
1359 * alignment since sizeof(struct ethhdr) is 14.
1360 */
1361 frame = dev_alloc_skb(
1362 ALIGN(local->hw.extra_tx_headroom, 4) +
1363 subframe_len + 2);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001364
1365 if (frame == NULL)
Johannes Berge4c26ad2008-01-31 19:48:21 +01001366 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001367
Johannes Bergd1c3a372009-01-07 00:26:10 +01001368 skb_reserve(frame,
1369 ALIGN(local->hw.extra_tx_headroom, 4) +
1370 sizeof(struct ethhdr) + 2);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001371 memcpy(skb_put(frame, ntohs(len)), skb->data,
1372 ntohs(len));
1373
1374 eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1375 padding);
1376 if (!eth) {
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001377 dev_kfree_skb(frame);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001378 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001379 }
1380 }
1381
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001382 skb_reset_network_header(frame);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001383 frame->dev = dev;
1384 frame->priority = skb->priority;
1385 rx->skb = frame;
1386
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001387 payload = frame->data;
1388 ethertype = (payload[6] << 8) | payload[7];
1389
1390 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001391 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1392 compare_ether_addr(payload,
1393 bridge_tunnel_header) == 0)) {
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001394 /* remove RFC1042 or Bridge-Tunnel
1395 * encapsulation and replace EtherType */
1396 skb_pull(frame, 6);
1397 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1398 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1399 } else {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001400 memcpy(skb_push(frame, sizeof(__be16)),
1401 &len, sizeof(__be16));
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001402 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1403 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1404 }
1405
Harvey Harrison358c8d92008-07-15 18:44:13 -07001406 if (!ieee80211_frame_allowed(rx, fc)) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001407 if (skb == frame) /* last frame */
Johannes Berge4c26ad2008-01-31 19:48:21 +01001408 return RX_DROP_UNUSABLE;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001409 dev_kfree_skb(frame);
1410 continue;
1411 }
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001412
1413 ieee80211_deliver_skb(rx);
1414 }
1415
Johannes Berg9ae54c82008-01-31 19:48:20 +01001416 return RX_QUEUED;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001417}
1418
Ingo Molnarbf94e172008-10-12 23:51:38 -07001419#ifdef CONFIG_MAC80211_MESH
Davide Pesaventob0dee572008-09-27 17:29:12 +02001420static ieee80211_rx_result
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001421ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1422{
1423 struct ieee80211_hdr *hdr;
1424 struct ieee80211s_hdr *mesh_hdr;
1425 unsigned int hdrlen;
1426 struct sk_buff *skb = rx->skb, *fwd_skb;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001427 struct ieee80211_local *local = rx->local;
Javier Cardona249b4052009-07-07 10:55:03 -07001428 struct ieee80211_sub_if_data *sdata;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001429
1430 hdr = (struct ieee80211_hdr *) skb->data;
1431 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1432 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
Javier Cardona249b4052009-07-07 10:55:03 -07001433 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001434
1435 if (!ieee80211_is_data(hdr->frame_control))
1436 return RX_CONTINUE;
1437
1438 if (!mesh_hdr->ttl)
1439 /* illegal frame */
1440 return RX_DROP_MONITOR;
1441
Javier Cardona43b7b312009-10-15 18:10:51 -07001442 if (mesh_hdr->flags & MESH_FLAGS_AE) {
YanBo79617de2008-09-22 13:30:32 +08001443 struct mesh_path *mppath;
Javier Cardona43b7b312009-10-15 18:10:51 -07001444 char *proxied_addr;
1445 char *mpp_addr;
1446
1447 if (is_multicast_ether_addr(hdr->addr1)) {
1448 mpp_addr = hdr->addr3;
1449 proxied_addr = mesh_hdr->eaddr1;
1450 } else {
1451 mpp_addr = hdr->addr4;
1452 proxied_addr = mesh_hdr->eaddr2;
1453 }
YanBo79617de2008-09-22 13:30:32 +08001454
YanBo79617de2008-09-22 13:30:32 +08001455 rcu_read_lock();
Javier Cardona43b7b312009-10-15 18:10:51 -07001456 mppath = mpp_path_lookup(proxied_addr, sdata);
YanBo79617de2008-09-22 13:30:32 +08001457 if (!mppath) {
Javier Cardona43b7b312009-10-15 18:10:51 -07001458 mpp_path_add(proxied_addr, mpp_addr, sdata);
YanBo79617de2008-09-22 13:30:32 +08001459 } else {
1460 spin_lock_bh(&mppath->state_lock);
1461 mppath->exp_time = jiffies;
Javier Cardona43b7b312009-10-15 18:10:51 -07001462 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1463 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
YanBo79617de2008-09-22 13:30:32 +08001464 spin_unlock_bh(&mppath->state_lock);
1465 }
1466 rcu_read_unlock();
1467 }
1468
Javier Cardona3c5772a2009-08-10 12:15:48 -07001469 /* Frame has reached destination. Don't forward */
1470 if (!is_multicast_ether_addr(hdr->addr1) &&
1471 compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001472 return RX_CONTINUE;
1473
1474 mesh_hdr->ttl--;
1475
1476 if (rx->flags & IEEE80211_RX_RA_MATCH) {
1477 if (!mesh_hdr->ttl)
Johannes Berg472dbc42008-09-11 00:01:49 +02001478 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001479 dropped_frames_ttl);
1480 else {
1481 struct ieee80211_hdr *fwd_hdr;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001482 struct ieee80211_tx_info *info;
1483
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001484 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1485
1486 if (!fwd_skb && net_ratelimit())
1487 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1488 rx->dev->name);
1489
1490 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001491 memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001492 info = IEEE80211_SKB_CB(fwd_skb);
1493 memset(info, 0, sizeof(*info));
1494 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
Johannes Berg5061b0c2009-07-14 00:33:34 +02001495 info->control.vif = &rx->sdata->vif;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001496 ieee80211_select_queue(local, fwd_skb);
Daniel Walkerc8a61a72009-08-18 10:59:00 -07001497 if (is_multicast_ether_addr(fwd_hdr->addr1))
1498 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1499 fwded_mcast);
1500 else {
Javier Cardona3c5772a2009-08-10 12:15:48 -07001501 int err;
1502 /*
1503 * Save TA to addr1 to send TA a path error if a
1504 * suitable next hop is not found
1505 */
1506 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
Javier Cardona249b4052009-07-07 10:55:03 -07001507 ETH_ALEN);
Javier Cardona3c5772a2009-08-10 12:15:48 -07001508 err = mesh_nexthop_lookup(fwd_skb, sdata);
Javier Cardona249b4052009-07-07 10:55:03 -07001509 /* Failed to immediately resolve next hop:
1510 * fwded frame was dropped or will be added
1511 * later to the pending skb queue. */
1512 if (err)
1513 return RX_DROP_MONITOR;
Daniel Walkerc8a61a72009-08-18 10:59:00 -07001514
1515 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1516 fwded_unicast);
Javier Cardona249b4052009-07-07 10:55:03 -07001517 }
1518 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1519 fwded_frames);
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001520 ieee80211_add_pending_skb(local, fwd_skb);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001521 }
1522 }
1523
Javier Cardona3c5772a2009-08-10 12:15:48 -07001524 if (is_multicast_ether_addr(hdr->addr1) ||
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001525 rx->dev->flags & IFF_PROMISC)
1526 return RX_CONTINUE;
1527 else
1528 return RX_DROP_MONITOR;
1529}
Ingo Molnarbf94e172008-10-12 23:51:38 -07001530#endif
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001531
1532static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001533ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001534{
1535 struct net_device *dev = rx->dev;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001536 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1537 __le16 fc = hdr->frame_control;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001538 int err;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001539
Harvey Harrison358c8d92008-07-15 18:44:13 -07001540 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001541 return RX_CONTINUE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001542
Harvey Harrison358c8d92008-07-15 18:44:13 -07001543 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001544 return RX_DROP_MONITOR;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001545
Zhu Yie31a16d2009-05-21 21:47:03 +08001546 err = __ieee80211_data_to_8023(rx);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001547 if (unlikely(err))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001548 return RX_DROP_UNUSABLE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001549
Harvey Harrison358c8d92008-07-15 18:44:13 -07001550 if (!ieee80211_frame_allowed(rx, fc))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001551 return RX_DROP_MONITOR;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001552
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001553 rx->skb->dev = dev;
1554
1555 dev->stats.rx_packets++;
1556 dev->stats.rx_bytes += rx->skb->len;
1557
1558 ieee80211_deliver_skb(rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02001559
Johannes Berg9ae54c82008-01-31 19:48:20 +01001560 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001561}
1562
Johannes Berg49461622008-06-30 15:10:45 +02001563static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001564ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
Ron Rindjunsky71364712007-12-25 17:00:36 +02001565{
1566 struct ieee80211_local *local = rx->local;
1567 struct ieee80211_hw *hw = &local->hw;
1568 struct sk_buff *skb = rx->skb;
Harvey Harrisona7767f92008-07-02 16:30:51 -07001569 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001570 struct tid_ampdu_rx *tid_agg_rx;
1571 u16 start_seq_num;
1572 u16 tid;
1573
Harvey Harrisona7767f92008-07-02 16:30:51 -07001574 if (likely(!ieee80211_is_ctl(bar->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001575 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001576
Harvey Harrisona7767f92008-07-02 16:30:51 -07001577 if (ieee80211_is_back_req(bar->frame_control)) {
Ron Rindjunsky71364712007-12-25 17:00:36 +02001578 if (!rx->sta)
Johannes Berg9ae54c82008-01-31 19:48:20 +01001579 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001580 tid = le16_to_cpu(bar->control) >> 12;
Ron Rindjunskycee24a32008-03-26 20:36:03 +02001581 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1582 != HT_AGG_STATE_OPERATIONAL)
Johannes Berg9ae54c82008-01-31 19:48:20 +01001583 return RX_CONTINUE;
Ron Rindjunskycee24a32008-03-26 20:36:03 +02001584 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
Ron Rindjunsky71364712007-12-25 17:00:36 +02001585
1586 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1587
1588 /* reset session timer */
Johannes Berg20ad19d2009-02-10 21:25:45 +01001589 if (tid_agg_rx->timeout)
1590 mod_timer(&tid_agg_rx->session_timer,
1591 TU_TO_EXP_TIME(tid_agg_rx->timeout));
Ron Rindjunsky71364712007-12-25 17:00:36 +02001592
1593 /* manage reordering buffer according to requested */
1594 /* sequence number */
1595 rcu_read_lock();
Johannes Bergf1d58c22009-06-17 13:13:00 +02001596 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
Ron Rindjunsky71364712007-12-25 17:00:36 +02001597 start_seq_num, 1);
1598 rcu_read_unlock();
Johannes Berge4c26ad2008-01-31 19:48:21 +01001599 return RX_DROP_UNUSABLE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001600 }
1601
Johannes Berg9ae54c82008-01-31 19:48:20 +01001602 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001603}
1604
Jouni Malinenf4f727a2009-01-10 11:46:53 +02001605static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1606 struct ieee80211_mgmt *mgmt,
1607 size_t len)
Jouni Malinenfea14732009-01-08 13:32:06 +02001608{
1609 struct ieee80211_local *local = sdata->local;
1610 struct sk_buff *skb;
1611 struct ieee80211_mgmt *resp;
1612
1613 if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
1614 /* Not to own unicast address */
1615 return;
1616 }
1617
Johannes Berg46900292009-02-15 12:44:28 +01001618 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
1619 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
Johannes Berg77fdaa12009-07-07 03:45:17 +02001620 /* Not from the current AP or not associated yet. */
Jouni Malinenfea14732009-01-08 13:32:06 +02001621 return;
1622 }
1623
1624 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
1625 /* Too short SA Query request frame */
1626 return;
1627 }
1628
1629 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
1630 if (skb == NULL)
1631 return;
1632
1633 skb_reserve(skb, local->hw.extra_tx_headroom);
1634 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
1635 memset(resp, 0, 24);
1636 memcpy(resp->da, mgmt->sa, ETH_ALEN);
1637 memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
Johannes Berg46900292009-02-15 12:44:28 +01001638 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
Jouni Malinenfea14732009-01-08 13:32:06 +02001639 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1640 IEEE80211_STYPE_ACTION);
1641 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
1642 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
1643 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
1644 memcpy(resp->u.action.u.sa_query.trans_id,
1645 mgmt->u.action.u.sa_query.trans_id,
1646 WLAN_SA_QUERY_TR_ID_LEN);
1647
1648 ieee80211_tx_skb(sdata, skb, 1);
1649}
1650
Johannes Berg49461622008-06-30 15:10:45 +02001651static ieee80211_rx_result debug_noinline
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001652ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1653{
1654 struct ieee80211_local *local = rx->local;
1655 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1656 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1657 int len = rx->skb->len;
1658
1659 if (!ieee80211_is_action(mgmt->frame_control))
1660 return RX_CONTINUE;
1661
1662 if (!rx->sta)
1663 return RX_DROP_MONITOR;
1664
1665 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1666 return RX_DROP_MONITOR;
1667
Jouni Malinen97ebe122009-01-08 13:32:08 +02001668 if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
1669 return RX_DROP_MONITOR;
1670
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001671 /* all categories we currently handle have action_code */
1672 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1673 return RX_DROP_MONITOR;
1674
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001675 switch (mgmt->u.action.category) {
1676 case WLAN_CATEGORY_BACK:
Johannes Berg8abd3f92009-02-10 21:25:47 +01001677 /*
1678 * The aggregation code is not prepared to handle
1679 * anything but STA/AP due to the BSSID handling;
1680 * IBSS could work in the code but isn't supported
1681 * by drivers or the standard.
1682 */
1683 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1684 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
1685 sdata->vif.type != NL80211_IFTYPE_AP)
1686 return RX_DROP_MONITOR;
1687
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001688 switch (mgmt->u.action.u.addba_req.action_code) {
1689 case WLAN_ACTION_ADDBA_REQ:
1690 if (len < (IEEE80211_MIN_ACTION_SIZE +
1691 sizeof(mgmt->u.action.u.addba_req)))
1692 return RX_DROP_MONITOR;
1693 ieee80211_process_addba_request(local, rx->sta, mgmt, len);
1694 break;
1695 case WLAN_ACTION_ADDBA_RESP:
1696 if (len < (IEEE80211_MIN_ACTION_SIZE +
1697 sizeof(mgmt->u.action.u.addba_resp)))
1698 return RX_DROP_MONITOR;
1699 ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
1700 break;
1701 case WLAN_ACTION_DELBA:
1702 if (len < (IEEE80211_MIN_ACTION_SIZE +
1703 sizeof(mgmt->u.action.u.delba)))
1704 return RX_DROP_MONITOR;
1705 ieee80211_process_delba(sdata, rx->sta, mgmt, len);
1706 break;
1707 }
Johannes Berg39192c02008-09-09 14:49:03 +02001708 break;
1709 case WLAN_CATEGORY_SPECTRUM_MGMT:
1710 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
1711 return RX_DROP_MONITOR;
Johannes Berg46900292009-02-15 12:44:28 +01001712
1713 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1714 return RX_DROP_MONITOR;
1715
Johannes Berg39192c02008-09-09 14:49:03 +02001716 switch (mgmt->u.action.u.measurement.action_code) {
1717 case WLAN_ACTION_SPCT_MSR_REQ:
1718 if (len < (IEEE80211_MIN_ACTION_SIZE +
1719 sizeof(mgmt->u.action.u.measurement)))
1720 return RX_DROP_MONITOR;
1721 ieee80211_process_measurement_req(sdata, mgmt, len);
1722 break;
Sujithc481ec92009-01-06 09:28:37 +05301723 case WLAN_ACTION_SPCT_CHL_SWITCH:
1724 if (len < (IEEE80211_MIN_ACTION_SIZE +
1725 sizeof(mgmt->u.action.u.chan_switch)))
1726 return RX_DROP_MONITOR;
1727
Johannes Bergcc32abd2009-05-15 11:52:31 +02001728 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1729 return RX_DROP_MONITOR;
1730
Johannes Berg46900292009-02-15 12:44:28 +01001731 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
Sujithc481ec92009-01-06 09:28:37 +05301732 return RX_DROP_MONITOR;
1733
Johannes Berg77fdaa12009-07-07 03:45:17 +02001734 return ieee80211_sta_rx_mgmt(sdata, rx->skb);
Johannes Berg39192c02008-09-09 14:49:03 +02001735 }
1736 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02001737 case WLAN_CATEGORY_SA_QUERY:
1738 if (len < (IEEE80211_MIN_ACTION_SIZE +
1739 sizeof(mgmt->u.action.u.sa_query)))
1740 return RX_DROP_MONITOR;
1741 switch (mgmt->u.action.u.sa_query.action) {
1742 case WLAN_ACTION_SA_QUERY_REQUEST:
1743 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1744 return RX_DROP_MONITOR;
1745 ieee80211_process_sa_query_req(sdata, mgmt, len);
1746 break;
1747 case WLAN_ACTION_SA_QUERY_RESPONSE:
1748 /*
1749 * SA Query response is currently only used in AP mode
1750 * and it is processed in user space.
1751 */
1752 return RX_CONTINUE;
1753 }
1754 break;
Johannes Berg39192c02008-09-09 14:49:03 +02001755 default:
1756 return RX_CONTINUE;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001757 }
1758
Johannes Berg39192c02008-09-09 14:49:03 +02001759 rx->sta->rx_packets++;
1760 dev_kfree_skb(rx->skb);
1761 return RX_QUEUED;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001762}
1763
1764static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001765ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001766{
Johannes Berg759ef3e2008-09-09 14:55:09 +02001767 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
Jouni Malinen97ebe122009-01-08 13:32:08 +02001768 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001769
Johannes Berg5cf121c2008-02-25 16:27:43 +01001770 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001771 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02001772
Jouni Malinen97ebe122009-01-08 13:32:08 +02001773 if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
1774 return RX_DROP_MONITOR;
1775
Johannes Berg472dbc42008-09-11 00:01:49 +02001776 if (ieee80211_vif_is_mesh(&sdata->vif))
Johannes Bergf1d58c22009-06-17 13:13:00 +02001777 return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
Johannes Berg472dbc42008-09-11 00:01:49 +02001778
Johannes Berg3832c282009-03-24 08:46:57 +01001779 if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
Johannes Bergf1d58c22009-06-17 13:13:00 +02001780 return ieee80211_ibss_rx_mgmt(sdata, rx->skb);
Johannes Bergf9d540e2007-09-28 14:02:09 +02001781
Johannes Berg7986cf92009-03-21 17:08:43 +01001782 if (sdata->vif.type == NL80211_IFTYPE_STATION)
Johannes Bergf1d58c22009-06-17 13:13:00 +02001783 return ieee80211_sta_rx_mgmt(sdata, rx->skb);
Johannes Berg46900292009-02-15 12:44:28 +01001784
Johannes Berg7986cf92009-03-21 17:08:43 +01001785 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02001786}
1787
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001788static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001789 struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001790{
Harvey Harrisona7767f92008-07-02 16:30:51 -07001791 int keyidx;
1792 unsigned int hdrlen;
Johannes Berg571ecf62007-07-27 15:43:22 +02001793
Harvey Harrisona7767f92008-07-02 16:30:51 -07001794 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg571ecf62007-07-27 15:43:22 +02001795 if (rx->skb->len >= hdrlen + 4)
1796 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1797 else
1798 keyidx = -1;
1799
Johannes Berg8944b792008-01-31 19:48:26 +01001800 if (!rx->sta) {
Johannes Bergaa0daf02007-09-10 14:15:25 +02001801 /*
1802 * Some hardware seem to generate incorrect Michael MIC
1803 * reports; ignore them to avoid triggering countermeasures.
1804 */
Johannes Berg571ecf62007-07-27 15:43:22 +02001805 goto ignore;
1806 }
1807
Harvey Harrisona7767f92008-07-02 16:30:51 -07001808 if (!ieee80211_has_protected(hdr->frame_control))
Johannes Berg571ecf62007-07-27 15:43:22 +02001809 goto ignore;
Johannes Berg571ecf62007-07-27 15:43:22 +02001810
Johannes Berg05c914f2008-09-11 00:01:58 +02001811 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
Johannes Bergaa0daf02007-09-10 14:15:25 +02001812 /*
1813 * APs with pairwise keys should never receive Michael MIC
1814 * errors for non-zero keyidx because these are reserved for
1815 * group keys and only the AP is sending real multicast
1816 * frames in the BSS.
1817 */
Johannes Bergeb063c12007-08-28 17:01:53 -04001818 goto ignore;
Johannes Berg571ecf62007-07-27 15:43:22 +02001819 }
1820
Harvey Harrisona7767f92008-07-02 16:30:51 -07001821 if (!ieee80211_is_data(hdr->frame_control) &&
1822 !ieee80211_is_auth(hdr->frame_control))
Johannes Berg571ecf62007-07-27 15:43:22 +02001823 goto ignore;
Johannes Berg571ecf62007-07-27 15:43:22 +02001824
Johannes Berge6d6e342009-07-01 21:26:47 +02001825 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
1826 GFP_ATOMIC);
Johannes Berg571ecf62007-07-27 15:43:22 +02001827 ignore:
1828 dev_kfree_skb(rx->skb);
1829 rx->skb = NULL;
1830}
1831
Johannes Berg5cf121c2008-02-25 16:27:43 +01001832/* TODO: use IEEE80211_RX_FRAGMENTED */
1833static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
Michael Wu3d30d942008-01-31 19:48:27 +01001834{
1835 struct ieee80211_sub_if_data *sdata;
1836 struct ieee80211_local *local = rx->local;
1837 struct ieee80211_rtap_hdr {
1838 struct ieee80211_radiotap_header hdr;
1839 u8 flags;
1840 u8 rate;
1841 __le16 chan_freq;
1842 __le16 chan_flags;
1843 } __attribute__ ((packed)) *rthdr;
1844 struct sk_buff *skb = rx->skb, *skb2;
1845 struct net_device *prev_dev = NULL;
Johannes Berg5cf121c2008-02-25 16:27:43 +01001846 struct ieee80211_rx_status *status = rx->status;
Michael Wu3d30d942008-01-31 19:48:27 +01001847
Johannes Berg5cf121c2008-02-25 16:27:43 +01001848 if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
Michael Wu3d30d942008-01-31 19:48:27 +01001849 goto out_free_skb;
1850
1851 if (skb_headroom(skb) < sizeof(*rthdr) &&
1852 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1853 goto out_free_skb;
1854
1855 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1856 memset(rthdr, 0, sizeof(*rthdr));
1857 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1858 rthdr->hdr.it_present =
1859 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1860 (1 << IEEE80211_RADIOTAP_RATE) |
1861 (1 << IEEE80211_RADIOTAP_CHANNEL));
1862
Johannes Berg5cf121c2008-02-25 16:27:43 +01001863 rthdr->rate = rx->rate->bitrate / 5;
Michael Wu3d30d942008-01-31 19:48:27 +01001864 rthdr->chan_freq = cpu_to_le16(status->freq);
1865
1866 if (status->band == IEEE80211_BAND_5GHZ)
1867 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1868 IEEE80211_CHAN_5GHZ);
1869 else
1870 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1871 IEEE80211_CHAN_2GHZ);
1872
1873 skb_set_mac_header(skb, 0);
1874 skb->ip_summed = CHECKSUM_UNNECESSARY;
1875 skb->pkt_type = PACKET_OTHERHOST;
1876 skb->protocol = htons(ETH_P_802_2);
1877
1878 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1879 if (!netif_running(sdata->dev))
1880 continue;
1881
Johannes Berg05c914f2008-09-11 00:01:58 +02001882 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
Michael Wu3d30d942008-01-31 19:48:27 +01001883 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1884 continue;
1885
1886 if (prev_dev) {
1887 skb2 = skb_clone(skb, GFP_ATOMIC);
1888 if (skb2) {
1889 skb2->dev = prev_dev;
1890 netif_rx(skb2);
1891 }
1892 }
1893
1894 prev_dev = sdata->dev;
1895 sdata->dev->stats.rx_packets++;
1896 sdata->dev->stats.rx_bytes += skb->len;
1897 }
1898
1899 if (prev_dev) {
1900 skb->dev = prev_dev;
1901 netif_rx(skb);
1902 skb = NULL;
1903 } else
1904 goto out_free_skb;
1905
Johannes Berg5cf121c2008-02-25 16:27:43 +01001906 rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
Michael Wu3d30d942008-01-31 19:48:27 +01001907 return;
1908
1909 out_free_skb:
1910 dev_kfree_skb(skb);
1911}
1912
Johannes Berg571ecf62007-07-27 15:43:22 +02001913
Johannes Berg8944b792008-01-31 19:48:26 +01001914static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001915 struct ieee80211_rx_data *rx,
Johannes Berg8944b792008-01-31 19:48:26 +01001916 struct sk_buff *skb)
Johannes Berg58905292008-01-31 19:48:25 +01001917{
Johannes Berg58905292008-01-31 19:48:25 +01001918 ieee80211_rx_result res = RX_DROP_MONITOR;
1919
Johannes Berg8944b792008-01-31 19:48:26 +01001920 rx->skb = skb;
1921 rx->sdata = sdata;
1922 rx->dev = sdata->dev;
1923
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001924#define CALL_RXH(rxh) \
1925 do { \
1926 res = rxh(rx); \
1927 if (res != RX_CONTINUE) \
1928 goto rxh_done; \
1929 } while (0);
Johannes Berg58905292008-01-31 19:48:25 +01001930
Johannes Berg49461622008-06-30 15:10:45 +02001931 CALL_RXH(ieee80211_rx_h_passive_scan)
1932 CALL_RXH(ieee80211_rx_h_check)
1933 CALL_RXH(ieee80211_rx_h_decrypt)
Kalle Valo572e0012009-02-10 17:09:31 +02001934 CALL_RXH(ieee80211_rx_h_check_more_data)
Johannes Berg49461622008-06-30 15:10:45 +02001935 CALL_RXH(ieee80211_rx_h_sta_process)
1936 CALL_RXH(ieee80211_rx_h_defragment)
1937 CALL_RXH(ieee80211_rx_h_ps_poll)
1938 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
1939 /* must be after MMIC verify so header is counted in MPDU mic */
1940 CALL_RXH(ieee80211_rx_h_remove_qos_control)
1941 CALL_RXH(ieee80211_rx_h_amsdu)
Ingo Molnarbf94e172008-10-12 23:51:38 -07001942#ifdef CONFIG_MAC80211_MESH
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001943 if (ieee80211_vif_is_mesh(&sdata->vif))
1944 CALL_RXH(ieee80211_rx_h_mesh_fwding);
Ingo Molnarbf94e172008-10-12 23:51:38 -07001945#endif
Johannes Berg49461622008-06-30 15:10:45 +02001946 CALL_RXH(ieee80211_rx_h_data)
1947 CALL_RXH(ieee80211_rx_h_ctrl)
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001948 CALL_RXH(ieee80211_rx_h_action)
Johannes Berg49461622008-06-30 15:10:45 +02001949 CALL_RXH(ieee80211_rx_h_mgmt)
Johannes Berg58905292008-01-31 19:48:25 +01001950
Johannes Berg49461622008-06-30 15:10:45 +02001951#undef CALL_RXH
1952
1953 rxh_done:
Johannes Berg58905292008-01-31 19:48:25 +01001954 switch (res) {
Michael Wu3d30d942008-01-31 19:48:27 +01001955 case RX_DROP_MONITOR:
Johannes Berg49461622008-06-30 15:10:45 +02001956 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1957 if (rx->sta)
1958 rx->sta->rx_dropped++;
1959 /* fall through */
1960 case RX_CONTINUE:
Michael Wu3d30d942008-01-31 19:48:27 +01001961 ieee80211_rx_cooked_monitor(rx);
1962 break;
1963 case RX_DROP_UNUSABLE:
Johannes Berg49461622008-06-30 15:10:45 +02001964 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1965 if (rx->sta)
1966 rx->sta->rx_dropped++;
Johannes Berg58905292008-01-31 19:48:25 +01001967 dev_kfree_skb(rx->skb);
1968 break;
Johannes Berg49461622008-06-30 15:10:45 +02001969 case RX_QUEUED:
1970 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1971 break;
Johannes Berg58905292008-01-31 19:48:25 +01001972 }
1973}
1974
Johannes Berg571ecf62007-07-27 15:43:22 +02001975/* main receive path */
1976
Johannes Berg23a24de2007-07-27 15:43:22 +02001977static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
Johannes Berg7ab17c42009-02-10 21:25:43 +01001978 struct ieee80211_rx_data *rx,
Johannes Berg23a24de2007-07-27 15:43:22 +02001979 struct ieee80211_hdr *hdr)
1980{
Johannes Berg7ab17c42009-02-10 21:25:43 +01001981 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
Johannes Berg23a24de2007-07-27 15:43:22 +02001982 int multicast = is_multicast_ether_addr(hdr->addr1);
1983
Johannes Berg51fb61e2007-12-19 01:31:27 +01001984 switch (sdata->vif.type) {
Johannes Berg05c914f2008-09-11 00:01:58 +02001985 case NL80211_IFTYPE_STATION:
Johannes Berg23a24de2007-07-27 15:43:22 +02001986 if (!bssid)
1987 return 0;
Johannes Berg77fdaa12009-07-07 03:45:17 +02001988 if (!multicast &&
1989 compare_ether_addr(sdata->dev->dev_addr, hdr->addr1) != 0) {
Johannes Berg4150c572007-09-17 01:29:23 -04001990 if (!(sdata->dev->flags & IFF_PROMISC))
Johannes Berg23a24de2007-07-27 15:43:22 +02001991 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01001992 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02001993 }
1994 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02001995 case NL80211_IFTYPE_ADHOC:
Johannes Berg23a24de2007-07-27 15:43:22 +02001996 if (!bssid)
1997 return 0;
Harvey Harrisona7767f92008-07-02 16:30:51 -07001998 if (ieee80211_is_beacon(hdr->frame_control)) {
Bruno Randolf9d9bf772008-02-18 11:21:36 +09001999 return 1;
Vladimir Koutny87291c02008-06-13 16:50:44 +02002000 }
Johannes Berg46900292009-02-15 12:44:28 +01002001 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
Johannes Berg5cf121c2008-02-25 16:27:43 +01002002 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
Johannes Berg23a24de2007-07-27 15:43:22 +02002003 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002004 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002005 } else if (!multicast &&
2006 compare_ether_addr(sdata->dev->dev_addr,
2007 hdr->addr1) != 0) {
Johannes Berg4150c572007-09-17 01:29:23 -04002008 if (!(sdata->dev->flags & IFF_PROMISC))
Johannes Berg23a24de2007-07-27 15:43:22 +02002009 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002010 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002011 } else if (!rx->sta) {
2012 int rate_idx;
2013 if (rx->status->flag & RX_FLAG_HT)
2014 rate_idx = 0; /* TODO: HT rates */
2015 else
2016 rate_idx = rx->status->rate_idx;
Rami Rosenab1f5c02008-12-11 14:00:25 +02002017 rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002018 BIT(rate_idx));
2019 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002020 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002021 case NL80211_IFTYPE_MESH_POINT:
Johannes Berg6032f932008-02-23 15:17:07 +01002022 if (!multicast &&
2023 compare_ether_addr(sdata->dev->dev_addr,
2024 hdr->addr1) != 0) {
2025 if (!(sdata->dev->flags & IFF_PROMISC))
2026 return 0;
2027
Johannes Berg5cf121c2008-02-25 16:27:43 +01002028 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg6032f932008-02-23 15:17:07 +01002029 }
2030 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002031 case NL80211_IFTYPE_AP_VLAN:
2032 case NL80211_IFTYPE_AP:
Johannes Berg23a24de2007-07-27 15:43:22 +02002033 if (!bssid) {
2034 if (compare_ether_addr(sdata->dev->dev_addr,
2035 hdr->addr1))
2036 return 0;
2037 } else if (!ieee80211_bssid_match(bssid,
2038 sdata->dev->dev_addr)) {
Johannes Berg5cf121c2008-02-25 16:27:43 +01002039 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
Johannes Berg23a24de2007-07-27 15:43:22 +02002040 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002041 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002042 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002043 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002044 case NL80211_IFTYPE_WDS:
Harvey Harrisona7767f92008-07-02 16:30:51 -07002045 if (bssid || !ieee80211_is_data(hdr->frame_control))
Johannes Berg23a24de2007-07-27 15:43:22 +02002046 return 0;
2047 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2048 return 0;
2049 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002050 case NL80211_IFTYPE_MONITOR:
Johannes Bergfb1c1cd2007-09-26 15:19:43 +02002051 /* take everything */
2052 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002053 case NL80211_IFTYPE_UNSPECIFIED:
2054 case __NL80211_IFTYPE_AFTER_LAST:
Johannes Bergfb1c1cd2007-09-26 15:19:43 +02002055 /* should never get here */
2056 WARN_ON(1);
2057 break;
Johannes Berg23a24de2007-07-27 15:43:22 +02002058 }
2059
2060 return 1;
2061}
2062
Johannes Berg571ecf62007-07-27 15:43:22 +02002063/*
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002064 * This is the actual Rx frames handler. as it blongs to Rx path it must
2065 * be called with rcu_read_lock protection.
Johannes Berg571ecf62007-07-27 15:43:22 +02002066 */
Ron Rindjunsky71ebb4a2008-01-21 12:39:12 +02002067static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2068 struct sk_buff *skb,
Johannes Berg8318d782008-01-24 19:38:38 +01002069 struct ieee80211_rate *rate)
Johannes Berg571ecf62007-07-27 15:43:22 +02002070{
Johannes Bergf1d58c22009-06-17 13:13:00 +02002071 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002072 struct ieee80211_local *local = hw_to_local(hw);
2073 struct ieee80211_sub_if_data *sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02002074 struct ieee80211_hdr *hdr;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002075 struct ieee80211_rx_data rx;
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002076 int prepares;
Johannes Berg8e6f0032007-07-27 15:43:22 +02002077 struct ieee80211_sub_if_data *prev = NULL;
2078 struct sk_buff *skb_new;
Johannes Berg571ecf62007-07-27 15:43:22 +02002079
Harvey Harrison358c8d92008-07-15 18:44:13 -07002080 hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02002081 memset(&rx, 0, sizeof(rx));
2082 rx.skb = skb;
2083 rx.local = local;
2084
Johannes Berg5cf121c2008-02-25 16:27:43 +01002085 rx.status = status;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002086 rx.rate = rate;
Johannes Berg72abd812007-09-17 01:29:22 -04002087
Harvey Harrison358c8d92008-07-15 18:44:13 -07002088 if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
Johannes Berg571ecf62007-07-27 15:43:22 +02002089 local->dot11ReceivedFragmentCount++;
Johannes Berg571ecf62007-07-27 15:43:22 +02002090
Johannes Berg8944b792008-01-31 19:48:26 +01002091 rx.sta = sta_info_get(local, hdr->addr2);
2092 if (rx.sta) {
Johannes Bergd0709a62008-02-25 16:27:46 +01002093 rx.sdata = rx.sta->sdata;
2094 rx.dev = rx.sta->sdata->dev;
Johannes Bergb2e77712007-09-26 15:19:39 +02002095 }
Johannes Berg571ecf62007-07-27 15:43:22 +02002096
Johannes Berg571ecf62007-07-27 15:43:22 +02002097 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
Johannes Berg3b8d81e2009-06-17 17:43:56 +02002098 ieee80211_rx_michael_mic_report(hdr, &rx);
Johannes Bergd0709a62008-02-25 16:27:46 +01002099 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002100 }
2101
Helmut Schaa142b9f52009-07-23 13:18:01 +02002102 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2103 test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
Johannes Berg5cf121c2008-02-25 16:27:43 +01002104 rx.flags |= IEEE80211_RX_IN_SCAN;
Johannes Berg571ecf62007-07-27 15:43:22 +02002105
Johannes Berg38f37142008-01-29 17:07:43 +01002106 ieee80211_parse_qos(&rx);
Johannes Bergd1c3a372009-01-07 00:26:10 +01002107 ieee80211_verify_alignment(&rx);
Johannes Berg38f37142008-01-29 17:07:43 +01002108
Johannes Berg571ecf62007-07-27 15:43:22 +02002109 skb = rx.skb;
2110
Johannes Bergfbc44bf2009-10-01 22:06:29 +02002111 if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
2112 rx.flags |= IEEE80211_RX_RA_MATCH;
2113 prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
2114 if (prepares)
2115 prev = rx.sdata;
2116 } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg2a8a9a82007-08-28 17:01:52 -04002117 if (!netif_running(sdata->dev))
2118 continue;
2119
Johannes Bergfbc44bf2009-10-01 22:06:29 +02002120 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2121 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
Johannes Bergb2e77712007-09-26 15:19:39 +02002122 continue;
2123
Johannes Berg5cf121c2008-02-25 16:27:43 +01002124 rx.flags |= IEEE80211_RX_RA_MATCH;
Johannes Berg7ab17c42009-02-10 21:25:43 +01002125 prepares = prepare_for_handlers(sdata, &rx, hdr);
Johannes Berg23a24de2007-07-27 15:43:22 +02002126
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002127 if (!prepares)
Johannes Berg23a24de2007-07-27 15:43:22 +02002128 continue;
Johannes Berg8e6f0032007-07-27 15:43:22 +02002129
Johannes Berg340e11f2007-07-27 15:43:22 +02002130 /*
2131 * frame is destined for this interface, but if it's not
2132 * also for the previous one we handle that after the
2133 * loop to avoid copying the SKB once too much
2134 */
2135
2136 if (!prev) {
2137 prev = sdata;
2138 continue;
Johannes Berg8e6f0032007-07-27 15:43:22 +02002139 }
Johannes Berg340e11f2007-07-27 15:43:22 +02002140
2141 /*
2142 * frame was destined for the previous interface
2143 * so invoke RX handlers for it
2144 */
2145
2146 skb_new = skb_copy(skb, GFP_ATOMIC);
2147 if (!skb_new) {
2148 if (net_ratelimit())
2149 printk(KERN_DEBUG "%s: failed to copy "
Pavel Roskina4278e12008-05-12 09:02:24 -04002150 "multicast frame for %s\n",
Johannes Bergdd1cd4c2007-09-18 17:29:20 -04002151 wiphy_name(local->hw.wiphy),
2152 prev->dev->name);
Johannes Berg340e11f2007-07-27 15:43:22 +02002153 continue;
2154 }
Johannes Berg8944b792008-01-31 19:48:26 +01002155 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
Johannes Berg8e6f0032007-07-27 15:43:22 +02002156 prev = sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02002157 }
Harvey Harrisona4b7d7b2008-07-15 18:44:14 -07002158 if (prev)
Johannes Berg8944b792008-01-31 19:48:26 +01002159 ieee80211_invoke_rx_handlers(prev, &rx, skb);
Harvey Harrisona4b7d7b2008-07-15 18:44:14 -07002160 else
Johannes Berg8e6f0032007-07-27 15:43:22 +02002161 dev_kfree_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002162}
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002163
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002164#define SEQ_MODULO 0x1000
2165#define SEQ_MASK 0xfff
2166
2167static inline int seq_less(u16 sq1, u16 sq2)
2168{
Johannes Bergc6a1fa12008-10-07 12:04:32 +02002169 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002170}
2171
2172static inline u16 seq_inc(u16 sq)
2173{
Johannes Bergc6a1fa12008-10-07 12:04:32 +02002174 return (sq + 1) & SEQ_MASK;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002175}
2176
2177static inline u16 seq_sub(u16 sq1, u16 sq2)
2178{
Johannes Bergc6a1fa12008-10-07 12:04:32 +02002179 return (sq1 - sq2) & SEQ_MASK;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002180}
2181
2182
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002183static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
2184 struct tid_ampdu_rx *tid_agg_rx,
2185 int index)
2186{
2187 struct ieee80211_supported_band *sband;
2188 struct ieee80211_rate *rate;
Johannes Bergf1d58c22009-06-17 13:13:00 +02002189 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
2190 struct ieee80211_rx_status *status;
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002191
Johannes Bergf1d58c22009-06-17 13:13:00 +02002192 if (!skb)
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002193 goto no_frame;
2194
Johannes Bergf1d58c22009-06-17 13:13:00 +02002195 status = IEEE80211_SKB_RXCB(skb);
2196
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002197 /* release the reordered frames to stack */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002198 sband = hw->wiphy->bands[status->band];
2199 if (status->flag & RX_FLAG_HT)
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002200 rate = sband->bitrates; /* TODO: HT rates */
2201 else
Johannes Bergf1d58c22009-06-17 13:13:00 +02002202 rate = &sband->bitrates[status->rate_idx];
2203 __ieee80211_rx_handle_packet(hw, skb, rate);
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002204 tid_agg_rx->stored_mpdu_num--;
2205 tid_agg_rx->reorder_buf[index] = NULL;
2206
2207no_frame:
2208 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2209}
2210
2211
Ron Rindjunsky71364712007-12-25 17:00:36 +02002212/*
Jouni Malinen4d050f12009-05-05 20:35:14 +03002213 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
2214 * the skb was added to the buffer longer than this time ago, the earlier
2215 * frames that have not yet been received are assumed to be lost and the skb
2216 * can be released for processing. This may also release other skb's from the
2217 * reorder buffer if there are no additional gaps between the frames.
2218 */
2219#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
2220
2221/*
Ron Rindjunsky71364712007-12-25 17:00:36 +02002222 * As it function blongs to Rx path it must be called with
2223 * the proper rcu_read_lock protection for its flow.
2224 */
Johannes Bergc6a1fa12008-10-07 12:04:32 +02002225static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2226 struct tid_ampdu_rx *tid_agg_rx,
2227 struct sk_buff *skb,
2228 u16 mpdu_seq_num,
2229 int bar_req)
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002230{
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002231 u16 head_seq_num, buf_size;
2232 int index;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002233
2234 buf_size = tid_agg_rx->buf_size;
2235 head_seq_num = tid_agg_rx->head_seq_num;
2236
2237 /* frame with out of date sequence number */
2238 if (seq_less(mpdu_seq_num, head_seq_num)) {
2239 dev_kfree_skb(skb);
2240 return 1;
2241 }
2242
2243 /* if frame sequence number exceeds our buffering window size or
2244 * block Ack Request arrived - release stored frames */
2245 if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2246 /* new head to the ordering buffer */
2247 if (bar_req)
2248 head_seq_num = mpdu_seq_num;
2249 else
2250 head_seq_num =
2251 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2252 /* release stored frames up to new head to stack */
2253 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2254 index = seq_sub(tid_agg_rx->head_seq_num,
2255 tid_agg_rx->ssn)
2256 % tid_agg_rx->buf_size;
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002257 ieee80211_release_reorder_frame(hw, tid_agg_rx,
2258 index);
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002259 }
2260 if (bar_req)
2261 return 1;
2262 }
2263
2264 /* now the new frame is always in the range of the reordering */
2265 /* buffer window */
2266 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2267 % tid_agg_rx->buf_size;
2268 /* check if we already stored this frame */
2269 if (tid_agg_rx->reorder_buf[index]) {
2270 dev_kfree_skb(skb);
2271 return 1;
2272 }
2273
2274 /* if arrived mpdu is in the right order and nothing else stored */
2275 /* release it immediately */
2276 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2277 tid_agg_rx->stored_mpdu_num == 0) {
2278 tid_agg_rx->head_seq_num =
2279 seq_inc(tid_agg_rx->head_seq_num);
2280 return 0;
2281 }
2282
2283 /* put the frame in the reordering buffer */
2284 tid_agg_rx->reorder_buf[index] = skb;
Jouni Malinen4d050f12009-05-05 20:35:14 +03002285 tid_agg_rx->reorder_time[index] = jiffies;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002286 tid_agg_rx->stored_mpdu_num++;
2287 /* release the buffer until next missing frame */
2288 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2289 % tid_agg_rx->buf_size;
Jouni Malinen4d050f12009-05-05 20:35:14 +03002290 if (!tid_agg_rx->reorder_buf[index] &&
2291 tid_agg_rx->stored_mpdu_num > 1) {
2292 /*
2293 * No buffers ready to be released, but check whether any
2294 * frames in the reorder buffer have timed out.
2295 */
2296 int j;
2297 int skipped = 1;
2298 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
2299 j = (j + 1) % tid_agg_rx->buf_size) {
2300 if (tid_agg_rx->reorder_buf[j] == NULL) {
2301 skipped++;
2302 continue;
2303 }
2304 if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
2305 HZ / 10))
2306 break;
2307
2308#ifdef CONFIG_MAC80211_HT_DEBUG
2309 if (net_ratelimit())
2310 printk(KERN_DEBUG "%s: release an RX reorder "
2311 "frame due to timeout on earlier "
2312 "frames\n",
2313 wiphy_name(hw->wiphy));
2314#endif
2315 ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
2316
2317 /*
2318 * Increment the head seq# also for the skipped slots.
2319 */
2320 tid_agg_rx->head_seq_num =
2321 (tid_agg_rx->head_seq_num + skipped) &
2322 SEQ_MASK;
2323 skipped = 0;
2324 }
2325 } else while (tid_agg_rx->reorder_buf[index]) {
Jouni Malinen2d3babd2009-05-05 20:35:13 +03002326 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002327 index = seq_sub(tid_agg_rx->head_seq_num,
2328 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2329 }
2330 return 1;
2331}
2332
Ron Rindjunsky71ebb4a2008-01-21 12:39:12 +02002333static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
Johannes Bergf1d58c22009-06-17 13:13:00 +02002334 struct sk_buff *skb)
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002335{
2336 struct ieee80211_hw *hw = &local->hw;
2337 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2338 struct sta_info *sta;
2339 struct tid_ampdu_rx *tid_agg_rx;
Harvey Harrison87228f52008-06-11 14:21:59 -07002340 u16 sc;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002341 u16 mpdu_seq_num;
Harvey Harrison182503a2008-06-22 16:45:29 -07002342 u8 ret = 0;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002343 int tid;
2344
2345 sta = sta_info_get(local, hdr->addr2);
2346 if (!sta)
2347 return ret;
2348
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002349 /* filter the QoS data rx stream according to
2350 * STA/TID and check if this STA/TID is on aggregation */
Harvey Harrison87228f52008-06-11 14:21:59 -07002351 if (!ieee80211_is_data_qos(hdr->frame_control))
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002352 goto end_reorder;
2353
Harvey Harrison238f74a2008-07-02 11:05:34 -07002354 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002355
Ron Rindjunskycee24a32008-03-26 20:36:03 +02002356 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002357 goto end_reorder;
2358
Ron Rindjunskycee24a32008-03-26 20:36:03 +02002359 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2360
Emmanuel Grumbach2560b6e2008-07-10 00:47:19 +03002361 /* qos null data frames are excluded */
2362 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002363 goto end_reorder;
2364
2365 /* new un-ordered ampdu frame - process it */
2366
2367 /* reset session timer */
Johannes Berg20ad19d2009-02-10 21:25:45 +01002368 if (tid_agg_rx->timeout)
2369 mod_timer(&tid_agg_rx->session_timer,
2370 TU_TO_EXP_TIME(tid_agg_rx->timeout));
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002371
2372 /* if this mpdu is fragmented - terminate rx aggregation session */
2373 sc = le16_to_cpu(hdr->seq_ctrl);
2374 if (sc & IEEE80211_SCTL_FRAG) {
Johannes Berg17741cd2008-09-11 00:02:02 +02002375 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002376 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2377 ret = 1;
2378 goto end_reorder;
2379 }
2380
2381 /* according to mpdu sequence number deal with reordering buffer */
2382 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
Johannes Bergf1d58c22009-06-17 13:13:00 +02002383 ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002384 mpdu_seq_num, 0);
Johannes Bergd0709a62008-02-25 16:27:46 +01002385 end_reorder:
Ron Rindjunskyb5807812007-12-25 17:00:35 +02002386 return ret;
2387}
2388
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002389/*
2390 * This is the receive path handler. It is called by a low level driver when an
2391 * 802.11 MPDU is received from the hardware.
2392 */
John W. Linville103bf9f2009-08-20 16:34:15 -04002393void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002394{
2395 struct ieee80211_local *local = hw_to_local(hw);
Johannes Berg8318d782008-01-24 19:38:38 +01002396 struct ieee80211_rate *rate = NULL;
2397 struct ieee80211_supported_band *sband;
Johannes Bergf1d58c22009-06-17 13:13:00 +02002398 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg8318d782008-01-24 19:38:38 +01002399
Johannes Bergd20ef632009-10-11 15:10:40 +02002400 WARN_ON_ONCE(softirq_count() == 0);
2401
Johannes Berg77a980d2009-08-24 11:46:30 +02002402 if (WARN_ON(status->band < 0 ||
2403 status->band >= IEEE80211_NUM_BANDS))
2404 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01002405
2406 sband = local->hw.wiphy->bands[status->band];
Johannes Berg77a980d2009-08-24 11:46:30 +02002407 if (WARN_ON(!sband))
2408 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01002409
Johannes Berg89c3a8a2009-07-28 18:10:17 +02002410 /*
2411 * If we're suspending, it is possible although not too likely
2412 * that we'd be receiving frames after having already partially
2413 * quiesced the stack. We can't process such frames then since
2414 * that might, for example, cause stations to be added or other
2415 * driver callbacks be invoked.
2416 */
Johannes Berg77a980d2009-08-24 11:46:30 +02002417 if (unlikely(local->quiescing || local->suspended))
2418 goto drop;
Johannes Berg89c3a8a2009-07-28 18:10:17 +02002419
Johannes Bergea77f122009-08-21 14:44:45 +02002420 /*
2421 * The same happens when we're not even started,
2422 * but that's worth a warning.
2423 */
Johannes Berg77a980d2009-08-24 11:46:30 +02002424 if (WARN_ON(!local->started))
2425 goto drop;
Johannes Bergea77f122009-08-21 14:44:45 +02002426
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002427 if (status->flag & RX_FLAG_HT) {
2428 /* rate_idx is MCS index */
2429 if (WARN_ON(status->rate_idx < 0 ||
2430 status->rate_idx >= 76))
Johannes Berg77a980d2009-08-24 11:46:30 +02002431 goto drop;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002432 /* HT rates are not in the table - use the highest legacy rate
2433 * for now since other parts of mac80211 may not yet be fully
2434 * MCS aware. */
2435 rate = &sband->bitrates[sband->n_bitrates - 1];
2436 } else {
2437 if (WARN_ON(status->rate_idx < 0 ||
2438 status->rate_idx >= sband->n_bitrates))
Johannes Berg77a980d2009-08-24 11:46:30 +02002439 goto drop;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002440 rate = &sband->bitrates[status->rate_idx];
2441 }
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002442
2443 /*
2444 * key references and virtual interfaces are protected using RCU
2445 * and this requires that we are in a read-side RCU section during
2446 * receive processing
2447 */
2448 rcu_read_lock();
2449
2450 /*
2451 * Frames with failed FCS/PLCP checksum are not returned,
2452 * all other frames are returned without radiotap header
2453 * if it was previously present.
2454 * Also, frames with less than 16 bytes are dropped.
2455 */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002456 skb = ieee80211_rx_monitor(local, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002457 if (!skb) {
2458 rcu_read_unlock();
2459 return;
2460 }
2461
Jouni Malinenaec67952009-05-05 20:35:15 +03002462 /*
2463 * In theory, the block ack reordering should happen after duplicate
2464 * removal (ieee80211_rx_h_check(), which is an RX handler). As such,
2465 * the call to ieee80211_rx_reorder_ampdu() should really be moved to
2466 * happen as a new RX handler between ieee80211_rx_h_check and
2467 * ieee80211_rx_h_decrypt. This cleanup may eventually happen, but for
2468 * the time being, the call can be here since RX reorder buf processing
2469 * will implicitly skip duplicates. We could, in theory at least,
2470 * process frames that ieee80211_rx_h_passive_scan would drop (e.g.,
2471 * frames from other than operational channel), but that should not
2472 * happen in normal networks.
2473 */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002474 if (!ieee80211_rx_reorder_ampdu(local, skb))
2475 __ieee80211_rx_handle_packet(hw, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002476
2477 rcu_read_unlock();
Johannes Berg77a980d2009-08-24 11:46:30 +02002478
2479 return;
2480 drop:
2481 kfree_skb(skb);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002482}
John W. Linville103bf9f2009-08-20 16:34:15 -04002483EXPORT_SYMBOL(ieee80211_rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02002484
2485/* This is a version of the rx handler that can be called from hard irq
2486 * context. Post the skb on the queue and schedule the tasklet */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002487void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
Johannes Berg571ecf62007-07-27 15:43:22 +02002488{
2489 struct ieee80211_local *local = hw_to_local(hw);
2490
2491 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2492
Johannes Berg571ecf62007-07-27 15:43:22 +02002493 skb->pkt_type = IEEE80211_RX_MSG;
2494 skb_queue_tail(&local->skb_queue, skb);
2495 tasklet_schedule(&local->tasklet);
2496}
2497EXPORT_SYMBOL(ieee80211_rx_irqsafe);