blob: 14366d4afbed6942d321993f5499c6e39182c77f [file] [log] [blame]
Johannes Berg571ecf62007-07-27 15:43:22 +02001/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
Johannes Berg84040802010-02-15 12:46:39 +02005 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
Johannes Berg571ecf62007-07-27 15:43:22 +02006 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
S.Çağlar Onurab466232008-02-14 17:36:47 +020012#include <linux/jiffies.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020013#include <linux/kernel.h>
14#include <linux/skbuff.h>
15#include <linux/netdevice.h>
16#include <linux/etherdevice.h>
Johannes Bergd4e46a32007-09-14 11:10:24 -040017#include <linux/rcupdate.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020018#include <net/mac80211.h>
19#include <net/ieee80211_radiotap.h>
20
21#include "ieee80211_i.h"
Johannes Berg24487982009-04-23 18:52:52 +020022#include "driver-ops.h"
Johannes Berg2c8dccc2008-04-08 15:14:40 -040023#include "led.h"
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +010024#include "mesh.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020025#include "wep.h"
26#include "wpa.h"
27#include "tkip.h"
28#include "wme.h"
29
Johannes Bergb2e77712007-09-26 15:19:39 +020030/*
31 * monitor mode reception
32 *
33 * This function cleans up the SKB, i.e. it removes all the stuff
34 * only useful for monitoring.
35 */
36static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
Johannes Berg0869aea2009-10-28 10:03:35 +010037 struct sk_buff *skb)
Johannes Bergb2e77712007-09-26 15:19:39 +020038{
Johannes Bergb2e77712007-09-26 15:19:39 +020039 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
40 if (likely(skb->len > FCS_LEN))
Zhu Yie3cf8b32010-03-29 17:35:07 +080041 __pskb_trim(skb, skb->len - FCS_LEN);
Johannes Bergb2e77712007-09-26 15:19:39 +020042 else {
43 /* driver bug */
44 WARN_ON(1);
45 dev_kfree_skb(skb);
46 skb = NULL;
47 }
48 }
49
50 return skb;
51}
52
Johannes Bergf1d58c22009-06-17 13:13:00 +020053static inline int should_drop_frame(struct sk_buff *skb,
Johannes Berg0869aea2009-10-28 10:03:35 +010054 int present_fcs_len)
Johannes Bergb2e77712007-09-26 15:19:39 +020055{
Johannes Bergf1d58c22009-06-17 13:13:00 +020056 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Harvey Harrison182503a2008-06-22 16:45:29 -070057 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Bergb2e77712007-09-26 15:19:39 +020058
59 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
60 return 1;
Johannes Berg0869aea2009-10-28 10:03:35 +010061 if (unlikely(skb->len < 16 + present_fcs_len))
Johannes Bergb2e77712007-09-26 15:19:39 +020062 return 1;
Harvey Harrison87228f52008-06-11 14:21:59 -070063 if (ieee80211_is_ctl(hdr->frame_control) &&
64 !ieee80211_is_pspoll(hdr->frame_control) &&
65 !ieee80211_is_back_req(hdr->frame_control))
Johannes Bergb2e77712007-09-26 15:19:39 +020066 return 1;
67 return 0;
68}
69
Bruno Randolf601ae7f2008-05-08 19:22:43 +020070static int
71ieee80211_rx_radiotap_len(struct ieee80211_local *local,
72 struct ieee80211_rx_status *status)
73{
74 int len;
75
76 /* always present fields */
77 len = sizeof(struct ieee80211_radiotap_header) + 9;
78
79 if (status->flag & RX_FLAG_TSFT)
80 len += 8;
Johannes Berg7fee5372009-01-30 11:13:06 +010081 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
Bruno Randolf601ae7f2008-05-08 19:22:43 +020082 len += 1;
83 if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
84 len += 1;
85
86 if (len & 1) /* padding for RX_FLAGS if necessary */
87 len++;
88
Bruno Randolf601ae7f2008-05-08 19:22:43 +020089 return len;
90}
91
Johannes Bergd1c3a372009-01-07 00:26:10 +010092/*
Bruno Randolf601ae7f2008-05-08 19:22:43 +020093 * ieee80211_add_rx_radiotap_header - add radiotap header
94 *
95 * add a radiotap header containing all the fields which the hardware provided.
96 */
97static void
98ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
99 struct sk_buff *skb,
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200100 struct ieee80211_rate *rate,
101 int rtap_len)
102{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200103 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200104 struct ieee80211_radiotap_header *rthdr;
105 unsigned char *pos;
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100106 u16 rx_flags = 0;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200107
108 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
109 memset(rthdr, 0, rtap_len);
110
111 /* radiotap header, set always present flags */
112 rthdr->it_present =
113 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200114 (1 << IEEE80211_RADIOTAP_CHANNEL) |
115 (1 << IEEE80211_RADIOTAP_ANTENNA) |
116 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
117 rthdr->it_len = cpu_to_le16(rtap_len);
118
119 pos = (unsigned char *)(rthdr+1);
120
121 /* the order of the following fields is important */
122
123 /* IEEE80211_RADIOTAP_TSFT */
124 if (status->flag & RX_FLAG_TSFT) {
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100125 put_unaligned_le64(status->mactime, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200126 rthdr->it_present |=
127 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
128 pos += 8;
129 }
130
131 /* IEEE80211_RADIOTAP_FLAGS */
132 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
133 *pos |= IEEE80211_RADIOTAP_F_FCS;
Johannes Bergaae89832009-03-13 12:52:10 +0100134 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
135 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
Bruno Randolfb4f28bb2008-07-30 17:19:55 +0200136 if (status->flag & RX_FLAG_SHORTPRE)
137 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200138 pos++;
139
140 /* IEEE80211_RADIOTAP_RATE */
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200141 if (status->flag & RX_FLAG_HT) {
142 /*
143 * TODO: add following information into radiotap header once
144 * suitable fields are defined for it:
145 * - MCS index (status->rate_idx)
146 * - HT40 (status->flag & RX_FLAG_40MHZ)
147 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
148 */
149 *pos = 0;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200150 } else {
Jouni Malinenebe6c7b2009-01-10 11:47:33 +0200151 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200152 *pos = rate->bitrate / 5;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200153 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200154 pos++;
155
156 /* IEEE80211_RADIOTAP_CHANNEL */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100157 put_unaligned_le16(status->freq, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200158 pos += 2;
159 if (status->band == IEEE80211_BAND_5GHZ)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100160 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
161 pos);
Johannes Berg5f0b7de2009-11-16 13:58:21 +0100162 else if (status->flag & RX_FLAG_HT)
163 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
164 pos);
Bruno Randolf9deb1ae2008-07-30 17:20:06 +0200165 else if (rate->flags & IEEE80211_RATE_ERP_G)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100166 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
167 pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200168 else
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100169 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
170 pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200171 pos += 2;
172
173 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
174 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
175 *pos = status->signal;
176 rthdr->it_present |=
177 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
178 pos++;
179 }
180
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200181 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
182
183 /* IEEE80211_RADIOTAP_ANTENNA */
184 *pos = status->antenna;
185 pos++;
186
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200187 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
188
189 /* IEEE80211_RADIOTAP_RX_FLAGS */
190 /* ensure 2 byte alignment for the 2 byte field as required */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100191 if ((pos - (u8 *)rthdr) & 1)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200192 pos++;
Johannes Bergaae89832009-03-13 12:52:10 +0100193 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100194 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
195 put_unaligned_le16(rx_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200196 pos += 2;
197}
198
Johannes Bergb2e77712007-09-26 15:19:39 +0200199/*
200 * This function copies a received frame to all monitor interfaces and
201 * returns a cleaned-up SKB that no longer includes the FCS nor the
202 * radiotap header the driver might have added.
203 */
204static struct sk_buff *
205ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
Johannes Berg8318d782008-01-24 19:38:38 +0100206 struct ieee80211_rate *rate)
Johannes Bergb2e77712007-09-26 15:19:39 +0200207{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200208 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200209 struct ieee80211_sub_if_data *sdata;
Johannes Bergb2e77712007-09-26 15:19:39 +0200210 int needed_headroom = 0;
Johannes Bergb2e77712007-09-26 15:19:39 +0200211 struct sk_buff *skb, *skb2;
212 struct net_device *prev_dev = NULL;
213 int present_fcs_len = 0;
Johannes Bergb2e77712007-09-26 15:19:39 +0200214
215 /*
216 * First, we may need to make a copy of the skb because
217 * (1) we need to modify it for radiotap (if not present), and
218 * (2) the other RX handlers will modify the skb we got.
219 *
220 * We don't need to, of course, if we aren't going to return
221 * the SKB because it has a bad FCS/PLCP checksum.
222 */
Johannes Berg0869aea2009-10-28 10:03:35 +0100223
224 /* room for the radiotap header based on driver features */
225 needed_headroom = ieee80211_rx_radiotap_len(local, status);
Johannes Bergb2e77712007-09-26 15:19:39 +0200226
227 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
228 present_fcs_len = FCS_LEN;
229
Zhu Yie3cf8b32010-03-29 17:35:07 +0800230 /* make sure hdr->frame_control is on the linear part */
231 if (!pskb_may_pull(origskb, 2)) {
232 dev_kfree_skb(origskb);
233 return NULL;
234 }
235
Johannes Bergb2e77712007-09-26 15:19:39 +0200236 if (!local->monitors) {
Johannes Berg0869aea2009-10-28 10:03:35 +0100237 if (should_drop_frame(origskb, present_fcs_len)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200238 dev_kfree_skb(origskb);
239 return NULL;
240 }
241
Johannes Berg0869aea2009-10-28 10:03:35 +0100242 return remove_monitor_info(local, origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200243 }
244
Johannes Berg0869aea2009-10-28 10:03:35 +0100245 if (should_drop_frame(origskb, present_fcs_len)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200246 /* only need to expand headroom if necessary */
247 skb = origskb;
248 origskb = NULL;
249
250 /*
251 * This shouldn't trigger often because most devices have an
252 * RX header they pull before we get here, and that should
253 * be big enough for our radiotap information. We should
254 * probably export the length to drivers so that we can have
255 * them allocate enough headroom to start with.
256 */
257 if (skb_headroom(skb) < needed_headroom &&
Johannes Bergc49e5ea2007-12-11 21:33:42 +0100258 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200259 dev_kfree_skb(skb);
260 return NULL;
261 }
262 } else {
263 /*
264 * Need to make a copy and possibly remove radiotap header
265 * and FCS from the original.
266 */
267 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
268
Johannes Berg0869aea2009-10-28 10:03:35 +0100269 origskb = remove_monitor_info(local, origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200270
271 if (!skb)
272 return origskb;
273 }
274
Johannes Berg0869aea2009-10-28 10:03:35 +0100275 /* prepend radiotap information */
276 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
Johannes Bergb2e77712007-09-26 15:19:39 +0200277
Johannes Bergce3edf6d02007-12-19 01:31:22 +0100278 skb_reset_mac_header(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200279 skb->ip_summed = CHECKSUM_UNNECESSARY;
280 skb->pkt_type = PACKET_OTHERHOST;
281 skb->protocol = htons(ETH_P_802_2);
282
283 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg05c914f2008-09-11 00:01:58 +0200284 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
Johannes Bergb2e77712007-09-26 15:19:39 +0200285 continue;
286
Michael Wu3d30d942008-01-31 19:48:27 +0100287 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
288 continue;
289
Johannes Berg9607e6b2009-12-23 13:15:31 +0100290 if (!ieee80211_sdata_running(sdata))
Johannes Berg47846c92009-11-25 17:46:19 +0100291 continue;
292
Johannes Bergb2e77712007-09-26 15:19:39 +0200293 if (prev_dev) {
294 skb2 = skb_clone(skb, GFP_ATOMIC);
295 if (skb2) {
296 skb2->dev = prev_dev;
297 netif_rx(skb2);
298 }
299 }
300
301 prev_dev = sdata->dev;
302 sdata->dev->stats.rx_packets++;
303 sdata->dev->stats.rx_bytes += skb->len;
304 }
305
306 if (prev_dev) {
307 skb->dev = prev_dev;
308 netif_rx(skb);
309 } else
310 dev_kfree_skb(skb);
311
312 return origskb;
313}
314
315
Johannes Berg5cf121c2008-02-25 16:27:43 +0100316static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +0200317{
Harvey Harrison238f74a2008-07-02 11:05:34 -0700318 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200319 int tid;
320
321 /* does the frame have a qos control field? */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700322 if (ieee80211_is_data_qos(hdr->frame_control)) {
323 u8 *qc = ieee80211_get_qos_ctl(hdr);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200324 /* frame has qos control */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700325 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
326 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
Johannes Berg5cf121c2008-02-25 16:27:43 +0100327 rx->flags |= IEEE80211_RX_AMSDU;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +0200328 else
Johannes Berg5cf121c2008-02-25 16:27:43 +0100329 rx->flags &= ~IEEE80211_RX_AMSDU;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200330 } else {
Johannes Berg1411f9b2008-07-10 10:11:02 +0200331 /*
332 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
333 *
334 * Sequence numbers for management frames, QoS data
335 * frames with a broadcast/multicast address in the
336 * Address 1 field, and all non-QoS data frames sent
337 * by QoS STAs are assigned using an additional single
338 * modulo-4096 counter, [...]
339 *
340 * We also use that counter for non-QoS STAs.
341 */
342 tid = NUM_RX_DATA_QUEUES - 1;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200343 }
Johannes Berg52865df2007-07-27 15:43:22 +0200344
Johannes Berg5cf121c2008-02-25 16:27:43 +0100345 rx->queue = tid;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200346 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
347 * For now, set skb->priority to 0 for other cases. */
348 rx->skb->priority = (tid > 7) ? 0 : tid;
Johannes Berg38f37142008-01-29 17:07:43 +0100349}
Johannes Berg6e0d1142007-07-27 15:43:22 +0200350
Johannes Bergd1c3a372009-01-07 00:26:10 +0100351/**
352 * DOC: Packet alignment
353 *
354 * Drivers always need to pass packets that are aligned to two-byte boundaries
355 * to the stack.
356 *
357 * Additionally, should, if possible, align the payload data in a way that
358 * guarantees that the contained IP header is aligned to a four-byte
359 * boundary. In the case of regular frames, this simply means aligning the
360 * payload to a four-byte boundary (because either the IP header is directly
361 * contained, or IV/RFC1042 headers that have a length divisible by four are
Kalle Valo59d9cb02009-12-17 13:54:57 +0100362 * in front of it). If the payload data is not properly aligned and the
363 * architecture doesn't support efficient unaligned operations, mac80211
364 * will align the data.
Johannes Bergd1c3a372009-01-07 00:26:10 +0100365 *
366 * With A-MSDU frames, however, the payload data address must yield two modulo
367 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
368 * push the IP header further back to a multiple of four again. Thankfully, the
369 * specs were sane enough this time around to require padding each A-MSDU
370 * subframe to a length that is a multiple of four.
371 *
372 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
373 * the payload is not supported, the driver is required to move the 802.11
374 * header to be directly in front of the payload in that case.
375 */
376static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
Johannes Berg38f37142008-01-29 17:07:43 +0100377{
Kalle Valo59d9cb02009-12-17 13:54:57 +0100378#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
379 WARN_ONCE((unsigned long)rx->skb->data & 1,
380 "unaligned packet at 0x%p\n", rx->skb->data);
Johannes Bergd1c3a372009-01-07 00:26:10 +0100381#endif
Johannes Berg6e0d1142007-07-27 15:43:22 +0200382}
383
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +0200384
Johannes Berg571ecf62007-07-27 15:43:22 +0200385/* rx handlers */
386
Johannes Berg49461622008-06-30 15:10:45 +0200387static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100388ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200389{
390 struct ieee80211_local *local = rx->local;
391 struct sk_buff *skb = rx->skb;
392
Helmut Schaafbe9c422009-07-23 12:14:04 +0200393 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning)))
Johannes Bergf1d58c22009-06-17 13:13:00 +0200394 return ieee80211_scan_rx(rx->sdata, skb);
Zhu Yiece8edd2007-11-22 10:53:21 +0800395
Helmut Schaa142b9f52009-07-23 13:18:01 +0200396 if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning) &&
397 (rx->flags & IEEE80211_RX_IN_SCAN))) {
Zhu Yiece8edd2007-11-22 10:53:21 +0800398 /* drop all the other packets during a software scan anyway */
Johannes Bergf1d58c22009-06-17 13:13:00 +0200399 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
Zhu Yiece8edd2007-11-22 10:53:21 +0800400 dev_kfree_skb(skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +0100401 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +0200402 }
403
Johannes Berg5cf121c2008-02-25 16:27:43 +0100404 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200405 /* scanning finished during invoking of handlers */
406 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
Johannes Berge4c26ad2008-01-31 19:48:21 +0100407 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200408 }
409
Johannes Berg9ae54c82008-01-31 19:48:20 +0100410 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200411}
412
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200413
414static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
415{
416 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
417
418 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
419 return 0;
420
421 return ieee80211_is_robust_mgmt_frame(hdr);
422}
423
424
425static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
426{
427 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
428
429 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
430 return 0;
431
432 return ieee80211_is_robust_mgmt_frame(hdr);
433}
434
435
436/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
437static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
438{
439 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
440 struct ieee80211_mmie *mmie;
441
442 if (skb->len < 24 + sizeof(*mmie) ||
443 !is_multicast_ether_addr(hdr->da))
444 return -1;
445
446 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
447 return -1; /* not a robust management frame */
448
449 mmie = (struct ieee80211_mmie *)
450 (skb->data + skb->len - sizeof(*mmie));
451 if (mmie->element_id != WLAN_EID_MMIE ||
452 mmie->length != sizeof(*mmie) - 2)
453 return -1;
454
455 return le16_to_cpu(mmie->key_id);
456}
457
458
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100459static ieee80211_rx_result
Johannes Berg5cf121c2008-02-25 16:27:43 +0100460ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100461{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700462 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
463 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg47846c92009-11-25 17:46:19 +0100464 char *dev_addr = rx->sdata->vif.addr;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100465
Harvey Harrisona7767f92008-07-02 16:30:51 -0700466 if (ieee80211_is_data(hdr->frame_control)) {
Javier Cardona3c5772a2009-08-10 12:15:48 -0700467 if (is_multicast_ether_addr(hdr->addr1)) {
468 if (ieee80211_has_tods(hdr->frame_control) ||
469 !ieee80211_has_fromds(hdr->frame_control))
470 return RX_DROP_MONITOR;
471 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
472 return RX_DROP_MONITOR;
473 } else {
474 if (!ieee80211_has_a4(hdr->frame_control))
475 return RX_DROP_MONITOR;
476 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
477 return RX_DROP_MONITOR;
478 }
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100479 }
480
481 /* If there is not an established peer link and this is not a peer link
482 * establisment frame, beacon or probe, drop the frame.
483 */
484
Luis Carlos Cobob4e08ea2008-02-29 15:46:08 -0800485 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100486 struct ieee80211_mgmt *mgmt;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100487
Harvey Harrisona7767f92008-07-02 16:30:51 -0700488 if (!ieee80211_is_mgmt(hdr->frame_control))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100489 return RX_DROP_MONITOR;
490
Harvey Harrisona7767f92008-07-02 16:30:51 -0700491 if (ieee80211_is_action(hdr->frame_control)) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100492 mgmt = (struct ieee80211_mgmt *)hdr;
Rui Paulo09383932009-11-09 23:46:43 +0000493 if (mgmt->u.action.category != MESH_PLINK_CATEGORY)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100494 return RX_DROP_MONITOR;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100495 return RX_CONTINUE;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100496 }
497
Harvey Harrisona7767f92008-07-02 16:30:51 -0700498 if (ieee80211_is_probe_req(hdr->frame_control) ||
499 ieee80211_is_probe_resp(hdr->frame_control) ||
500 ieee80211_is_beacon(hdr->frame_control))
501 return RX_CONTINUE;
502
503 return RX_DROP_MONITOR;
504
505 }
506
507#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
508
509 if (ieee80211_is_data(hdr->frame_control) &&
510 is_multicast_ether_addr(hdr->addr1) &&
Javier Cardona3c5772a2009-08-10 12:15:48 -0700511 mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100512 return RX_DROP_MONITOR;
Johannes Berg902acc72008-02-23 15:17:19 +0100513#undef msh_h_get
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100514
Johannes Berg902acc72008-02-23 15:17:19 +0100515 return RX_CONTINUE;
516}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100517
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100518#define SEQ_MODULO 0x1000
519#define SEQ_MASK 0xfff
520
521static inline int seq_less(u16 sq1, u16 sq2)
522{
523 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
524}
525
526static inline u16 seq_inc(u16 sq)
527{
528 return (sq + 1) & SEQ_MASK;
529}
530
531static inline u16 seq_sub(u16 sq1, u16 sq2)
532{
533 return (sq1 - sq2) & SEQ_MASK;
534}
535
536
537static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
538 struct tid_ampdu_rx *tid_agg_rx,
Johannes Berg2569a822009-11-25 17:46:17 +0100539 int index,
540 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100541{
542 struct ieee80211_supported_band *sband;
543 struct ieee80211_rate *rate = NULL;
544 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
545 struct ieee80211_rx_status *status;
546
547 if (!skb)
548 goto no_frame;
549
550 status = IEEE80211_SKB_RXCB(skb);
551
552 /* release the reordered frames to stack */
553 sband = hw->wiphy->bands[status->band];
554 if (!(status->flag & RX_FLAG_HT))
555 rate = &sband->bitrates[status->rate_idx];
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100556 tid_agg_rx->stored_mpdu_num--;
557 tid_agg_rx->reorder_buf[index] = NULL;
Johannes Bergd29cecd2009-12-04 14:25:43 -0800558 __skb_queue_tail(frames, skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100559
560no_frame:
561 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
562}
563
564static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
565 struct tid_ampdu_rx *tid_agg_rx,
Johannes Berg2569a822009-11-25 17:46:17 +0100566 u16 head_seq_num,
567 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100568{
569 int index;
570
571 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
572 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
573 tid_agg_rx->buf_size;
Johannes Berg2569a822009-11-25 17:46:17 +0100574 ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100575 }
576}
577
578/*
579 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
580 * the skb was added to the buffer longer than this time ago, the earlier
581 * frames that have not yet been received are assumed to be lost and the skb
582 * can be released for processing. This may also release other skb's from the
583 * reorder buffer if there are no additional gaps between the frames.
584 */
585#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
586
587/*
588 * As this function belongs to the RX path it must be under
589 * rcu_read_lock protection. It returns false if the frame
590 * can be processed immediately, true if it was consumed.
591 */
592static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
593 struct tid_ampdu_rx *tid_agg_rx,
Johannes Berg2569a822009-11-25 17:46:17 +0100594 struct sk_buff *skb,
595 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100596{
597 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
598 u16 sc = le16_to_cpu(hdr->seq_ctrl);
599 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
600 u16 head_seq_num, buf_size;
601 int index;
602
603 buf_size = tid_agg_rx->buf_size;
604 head_seq_num = tid_agg_rx->head_seq_num;
605
606 /* frame with out of date sequence number */
607 if (seq_less(mpdu_seq_num, head_seq_num)) {
608 dev_kfree_skb(skb);
609 return true;
610 }
611
612 /*
613 * If frame the sequence number exceeds our buffering window
614 * size release some previous frames to make room for this one.
615 */
616 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
617 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
618 /* release stored frames up to new head to stack */
Johannes Berg2569a822009-11-25 17:46:17 +0100619 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num,
620 frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100621 }
622
623 /* Now the new frame is always in the range of the reordering buffer */
624
625 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
626
627 /* check if we already stored this frame */
628 if (tid_agg_rx->reorder_buf[index]) {
629 dev_kfree_skb(skb);
630 return true;
631 }
632
633 /*
634 * If the current MPDU is in the right order and nothing else
635 * is stored we can process it directly, no need to buffer it.
636 */
637 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
638 tid_agg_rx->stored_mpdu_num == 0) {
639 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
640 return false;
641 }
642
643 /* put the frame in the reordering buffer */
644 tid_agg_rx->reorder_buf[index] = skb;
645 tid_agg_rx->reorder_time[index] = jiffies;
646 tid_agg_rx->stored_mpdu_num++;
647 /* release the buffer until next missing frame */
648 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
649 tid_agg_rx->buf_size;
650 if (!tid_agg_rx->reorder_buf[index] &&
651 tid_agg_rx->stored_mpdu_num > 1) {
652 /*
653 * No buffers ready to be released, but check whether any
654 * frames in the reorder buffer have timed out.
655 */
656 int j;
657 int skipped = 1;
658 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
659 j = (j + 1) % tid_agg_rx->buf_size) {
660 if (!tid_agg_rx->reorder_buf[j]) {
661 skipped++;
662 continue;
663 }
664 if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
665 HT_RX_REORDER_BUF_TIMEOUT))
666 break;
667
668#ifdef CONFIG_MAC80211_HT_DEBUG
669 if (net_ratelimit())
670 printk(KERN_DEBUG "%s: release an RX reorder "
671 "frame due to timeout on earlier "
672 "frames\n",
673 wiphy_name(hw->wiphy));
674#endif
Johannes Berg2569a822009-11-25 17:46:17 +0100675 ieee80211_release_reorder_frame(hw, tid_agg_rx,
676 j, frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100677
678 /*
679 * Increment the head seq# also for the skipped slots.
680 */
681 tid_agg_rx->head_seq_num =
682 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
683 skipped = 0;
684 }
685 } else while (tid_agg_rx->reorder_buf[index]) {
Johannes Berg2569a822009-11-25 17:46:17 +0100686 ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100687 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
688 tid_agg_rx->buf_size;
689 }
690
691 return true;
692}
693
694/*
695 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
696 * true if the MPDU was buffered, false if it should be processed.
697 */
Johannes Berg2569a822009-11-25 17:46:17 +0100698static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
699 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100700{
Johannes Berg2569a822009-11-25 17:46:17 +0100701 struct sk_buff *skb = rx->skb;
702 struct ieee80211_local *local = rx->local;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100703 struct ieee80211_hw *hw = &local->hw;
704 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
Johannes Berg2569a822009-11-25 17:46:17 +0100705 struct sta_info *sta = rx->sta;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100706 struct tid_ampdu_rx *tid_agg_rx;
707 u16 sc;
708 int tid;
709
710 if (!ieee80211_is_data_qos(hdr->frame_control))
Johannes Berg2569a822009-11-25 17:46:17 +0100711 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100712
713 /*
714 * filter the QoS data rx stream according to
715 * STA/TID and check if this STA/TID is on aggregation
716 */
717
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100718 if (!sta)
Johannes Berg2569a822009-11-25 17:46:17 +0100719 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100720
721 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
722
723 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
Johannes Berg2569a822009-11-25 17:46:17 +0100724 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100725
726 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
727
728 /* qos null data frames are excluded */
729 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
Johannes Berg2569a822009-11-25 17:46:17 +0100730 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100731
732 /* new, potentially un-ordered, ampdu frame - process it */
733
734 /* reset session timer */
735 if (tid_agg_rx->timeout)
736 mod_timer(&tid_agg_rx->session_timer,
737 TU_TO_EXP_TIME(tid_agg_rx->timeout));
738
739 /* if this mpdu is fragmented - terminate rx aggregation session */
740 sc = le16_to_cpu(hdr->seq_ctrl);
741 if (sc & IEEE80211_SCTL_FRAG) {
742 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
743 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
744 dev_kfree_skb(skb);
Johannes Berg2569a822009-11-25 17:46:17 +0100745 return;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100746 }
747
Johannes Berg2569a822009-11-25 17:46:17 +0100748 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, frames))
749 return;
750
751 dont_reorder:
752 __skb_queue_tail(frames, skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100753}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100754
Johannes Berg49461622008-06-30 15:10:45 +0200755static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100756ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +0200757{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700758 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +0200759
760 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
761 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
Harvey Harrisona7767f92008-07-02 16:30:51 -0700762 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
Johannes Berg5cf121c2008-02-25 16:27:43 +0100763 rx->sta->last_seq_ctrl[rx->queue] ==
Johannes Berg571ecf62007-07-27 15:43:22 +0200764 hdr->seq_ctrl)) {
Johannes Berg5cf121c2008-02-25 16:27:43 +0100765 if (rx->flags & IEEE80211_RX_RA_MATCH) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200766 rx->local->dot11FrameDuplicateCount++;
767 rx->sta->num_duplicates++;
768 }
Johannes Berge4c26ad2008-01-31 19:48:21 +0100769 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200770 } else
Johannes Berg5cf121c2008-02-25 16:27:43 +0100771 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
Johannes Berg571ecf62007-07-27 15:43:22 +0200772 }
773
Johannes Berg571ecf62007-07-27 15:43:22 +0200774 if (unlikely(rx->skb->len < 16)) {
775 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
Johannes Berge4c26ad2008-01-31 19:48:21 +0100776 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200777 }
778
Johannes Berg571ecf62007-07-27 15:43:22 +0200779 /* Drop disallowed frame classes based on STA auth/assoc state;
780 * IEEE 802.11, Chap 5.5.
781 *
Johannes Bergccd7b362008-09-11 00:01:56 +0200782 * mac80211 filters only based on association state, i.e. it drops
783 * Class 3 frames from not associated stations. hostapd sends
Johannes Berg571ecf62007-07-27 15:43:22 +0200784 * deauth/disassoc frames when needed. In addition, hostapd is
785 * responsible for filtering on both auth and assoc states.
786 */
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100787
Johannes Berg902acc72008-02-23 15:17:19 +0100788 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100789 return ieee80211_rx_mesh_check(rx);
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100790
Harvey Harrisona7767f92008-07-02 16:30:51 -0700791 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
792 ieee80211_is_pspoll(hdr->frame_control)) &&
Johannes Berg05c914f2008-09-11 00:01:58 +0200793 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Johannes Berg07346f812008-05-03 01:02:02 +0200794 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
Harvey Harrisona7767f92008-07-02 16:30:51 -0700795 if ((!ieee80211_has_fromds(hdr->frame_control) &&
796 !ieee80211_has_tods(hdr->frame_control) &&
797 ieee80211_is_data(hdr->frame_control)) ||
798 !(rx->flags & IEEE80211_RX_RA_MATCH)) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200799 /* Drop IBSS frames and frames for other hosts
800 * silently. */
Johannes Berge4c26ad2008-01-31 19:48:21 +0100801 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200802 }
803
Johannes Berge4c26ad2008-01-31 19:48:21 +0100804 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +0200805 }
806
Johannes Berg9ae54c82008-01-31 19:48:20 +0100807 return RX_CONTINUE;
Johannes Berg570bd532007-07-27 15:43:22 +0200808}
809
810
Johannes Berg49461622008-06-30 15:10:45 +0200811static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +0100812ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
Johannes Berg570bd532007-07-27 15:43:22 +0200813{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100814 struct sk_buff *skb = rx->skb;
815 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
816 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg3017b802007-08-28 17:01:53 -0400817 int keyidx;
818 int hdrlen;
Johannes Berge4c26ad2008-01-31 19:48:21 +0100819 ieee80211_rx_result result = RX_DROP_UNUSABLE;
Johannes Bergd4e46a32007-09-14 11:10:24 -0400820 struct ieee80211_key *stakey = NULL;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200821 int mmie_keyidx = -1;
Johannes Berg570bd532007-07-27 15:43:22 +0200822
Johannes Berg3017b802007-08-28 17:01:53 -0400823 /*
824 * Key selection 101
825 *
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200826 * There are four types of keys:
Johannes Berg3017b802007-08-28 17:01:53 -0400827 * - GTK (group keys)
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200828 * - IGTK (group keys for management frames)
Johannes Berg3017b802007-08-28 17:01:53 -0400829 * - PTK (pairwise keys)
830 * - STK (station-to-station pairwise keys)
831 *
832 * When selecting a key, we have to distinguish between multicast
833 * (including broadcast) and unicast frames, the latter can only
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200834 * use PTKs and STKs while the former always use GTKs and IGTKs.
835 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
836 * unicast frames can also use key indices like GTKs. Hence, if we
837 * don't have a PTK/STK we check the key index for a WEP key.
Johannes Berg3017b802007-08-28 17:01:53 -0400838 *
Johannes Berg8dc06a12007-08-28 17:01:55 -0400839 * Note that in a regular BSS, multicast frames are sent by the
840 * AP only, associated stations unicast the frame to the AP first
841 * which then multicasts it on their behalf.
842 *
Johannes Berg3017b802007-08-28 17:01:53 -0400843 * There is also a slight problem in IBSS mode: GTKs are negotiated
844 * with each station, that is something we don't currently handle.
Johannes Berg8dc06a12007-08-28 17:01:55 -0400845 * The spec seems to expect that one negotiates the same key with
846 * every station but there's no such requirement; VLANs could be
847 * possible.
Johannes Berg3017b802007-08-28 17:01:53 -0400848 */
Johannes Berg571ecf62007-07-27 15:43:22 +0200849
Johannes Berg3017b802007-08-28 17:01:53 -0400850 /*
Johannes Berg1990af82007-09-26 17:53:15 +0200851 * No point in finding a key and decrypting if the frame is neither
Johannes Berg3017b802007-08-28 17:01:53 -0400852 * addressed to us nor a multicast frame.
853 */
Johannes Berg5cf121c2008-02-25 16:27:43 +0100854 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100855 return RX_CONTINUE;
Johannes Berg3017b802007-08-28 17:01:53 -0400856
Johannes Berg2569a822009-11-25 17:46:17 +0100857 /* start without a key */
858 rx->key = NULL;
859
Johannes Bergd4e46a32007-09-14 11:10:24 -0400860 if (rx->sta)
861 stakey = rcu_dereference(rx->sta->key);
862
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300863 if (!ieee80211_has_protected(hdr->frame_control))
864 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
865
Johannes Bergd4e46a32007-09-14 11:10:24 -0400866 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
867 rx->key = stakey;
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300868 /* Skip decryption if the frame is not protected. */
869 if (!ieee80211_has_protected(hdr->frame_control))
870 return RX_CONTINUE;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200871 } else if (mmie_keyidx >= 0) {
872 /* Broadcast/multicast robust management frame / BIP */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100873 if ((status->flag & RX_FLAG_DECRYPTED) &&
874 (status->flag & RX_FLAG_IV_STRIPPED))
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200875 return RX_CONTINUE;
876
877 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
878 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
879 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
880 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
Jouni Malinen0c7c10c2009-05-08 12:34:10 +0300881 } else if (!ieee80211_has_protected(hdr->frame_control)) {
882 /*
883 * The frame was not protected, so skip decryption. However, we
884 * need to set rx->key if there is a key that could have been
885 * used so that the frame may be dropped if encryption would
886 * have been expected.
887 */
888 struct ieee80211_key *key = NULL;
889 if (ieee80211_is_mgmt(hdr->frame_control) &&
890 is_multicast_ether_addr(hdr->addr1) &&
891 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
892 rx->key = key;
893 else if ((key = rcu_dereference(rx->sdata->default_key)))
894 rx->key = key;
895 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200896 } else {
Johannes Berg3017b802007-08-28 17:01:53 -0400897 /*
898 * The device doesn't give us the IV so we won't be
899 * able to look up the key. That's ok though, we
900 * don't need to decrypt the frame, we just won't
901 * be able to keep statistics accurate.
902 * Except for key threshold notifications, should
903 * we somehow allow the driver to tell us which key
904 * the hardware used if this flag is set?
905 */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100906 if ((status->flag & RX_FLAG_DECRYPTED) &&
907 (status->flag & RX_FLAG_IV_STRIPPED))
Johannes Berg9ae54c82008-01-31 19:48:20 +0100908 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +0200909
Harvey Harrisona7767f92008-07-02 16:30:51 -0700910 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg571ecf62007-07-27 15:43:22 +0200911
Johannes Berg3017b802007-08-28 17:01:53 -0400912 if (rx->skb->len < 8 + hdrlen)
Johannes Berge4c26ad2008-01-31 19:48:21 +0100913 return RX_DROP_UNUSABLE; /* TODO: count this? */
Johannes Berg571ecf62007-07-27 15:43:22 +0200914
Johannes Berg3017b802007-08-28 17:01:53 -0400915 /*
916 * no need to call ieee80211_wep_get_keyidx,
917 * it verifies a bunch of things we've done already
918 */
919 keyidx = rx->skb->data[hdrlen + 3] >> 6;
920
Johannes Bergd4e46a32007-09-14 11:10:24 -0400921 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
Johannes Berg3017b802007-08-28 17:01:53 -0400922
923 /*
924 * RSNA-protected unicast frames should always be sent with
925 * pairwise or station-to-station keys, but for WEP we allow
926 * using a key index as well.
927 */
Johannes Berg8f20fc22007-08-28 17:01:54 -0400928 if (rx->key && rx->key->conf.alg != ALG_WEP &&
Johannes Berg3017b802007-08-28 17:01:53 -0400929 !is_multicast_ether_addr(hdr->addr1))
930 rx->key = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +0200931 }
932
Johannes Berg3017b802007-08-28 17:01:53 -0400933 if (rx->key) {
Johannes Berg571ecf62007-07-27 15:43:22 +0200934 rx->key->tx_rx_count++;
Johannes Berg011bfcc2007-09-17 01:29:25 -0400935 /* TODO: add threshold stuff again */
Johannes Berg1990af82007-09-26 17:53:15 +0200936 } else {
Johannes Berge4c26ad2008-01-31 19:48:21 +0100937 return RX_DROP_MONITOR;
Johannes Berg70f08762007-09-26 17:53:14 +0200938 }
939
Zhu Yie3cf8b32010-03-29 17:35:07 +0800940 if (skb_linearize(rx->skb))
941 return RX_DROP_UNUSABLE;
942
Johannes Berg1990af82007-09-26 17:53:15 +0200943 /* Check for weak IVs if possible */
944 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
Harvey Harrisona7767f92008-07-02 16:30:51 -0700945 ieee80211_is_data(hdr->frame_control) &&
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100946 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
947 !(status->flag & RX_FLAG_DECRYPTED)) &&
Johannes Berg1990af82007-09-26 17:53:15 +0200948 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
949 rx->sta->wep_weak_iv_count++;
950
Johannes Berg70f08762007-09-26 17:53:14 +0200951 switch (rx->key->conf.alg) {
952 case ALG_WEP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200953 result = ieee80211_crypto_wep_decrypt(rx);
954 break;
Johannes Berg70f08762007-09-26 17:53:14 +0200955 case ALG_TKIP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200956 result = ieee80211_crypto_tkip_decrypt(rx);
957 break;
Johannes Berg70f08762007-09-26 17:53:14 +0200958 case ALG_CCMP:
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200959 result = ieee80211_crypto_ccmp_decrypt(rx);
960 break;
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +0200961 case ALG_AES_CMAC:
962 result = ieee80211_crypto_aes_cmac_decrypt(rx);
963 break;
Johannes Berg70f08762007-09-26 17:53:14 +0200964 }
965
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200966 /* either the frame has been decrypted or will be dropped */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +0100967 status->flag |= RX_FLAG_DECRYPTED;
Mattias Nisslere2f036d2007-10-07 16:35:31 +0200968
969 return result;
Johannes Berg70f08762007-09-26 17:53:14 +0200970}
971
Kalle Valo572e0012009-02-10 17:09:31 +0200972static ieee80211_rx_result debug_noinline
973ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
974{
975 struct ieee80211_local *local;
976 struct ieee80211_hdr *hdr;
977 struct sk_buff *skb;
978
979 local = rx->local;
980 skb = rx->skb;
981 hdr = (struct ieee80211_hdr *) skb->data;
982
983 if (!local->pspolling)
984 return RX_CONTINUE;
985
986 if (!ieee80211_has_fromds(hdr->frame_control))
987 /* this is not from AP */
988 return RX_CONTINUE;
989
990 if (!ieee80211_is_data(hdr->frame_control))
991 return RX_CONTINUE;
992
993 if (!ieee80211_has_moredata(hdr->frame_control)) {
994 /* AP has no more frames buffered for us */
995 local->pspolling = false;
996 return RX_CONTINUE;
997 }
998
999 /* more data bit is set, let's request a new frame from the AP */
1000 ieee80211_send_pspoll(local, rx->sdata);
1001
1002 return RX_CONTINUE;
1003}
1004
Johannes Berg133b8222008-09-16 14:18:59 +02001005static void ap_sta_ps_start(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001006{
Johannes Berg133b8222008-09-16 14:18:59 +02001007 struct ieee80211_sub_if_data *sdata = sta->sdata;
Christian Lamparter4571d3b2008-11-30 00:48:41 +01001008 struct ieee80211_local *local = sdata->local;
Joe Perches0795af52007-10-03 17:59:30 -07001009
Johannes Berg3e122be2008-07-09 14:40:34 +02001010 atomic_inc(&sdata->bss->num_sta_ps);
Johannes Bergaf818582009-11-06 11:35:50 +01001011 set_sta_flags(sta, WLAN_STA_PS_STA);
Johannes Berg12375ef2009-11-25 20:30:31 +01001012 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
Johannes Berg571ecf62007-07-27 15:43:22 +02001013#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Berg0c68ae262008-10-27 15:56:10 -07001014 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001015 sdata->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +02001016#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1017}
1018
Johannes Bergff9458d2009-10-30 12:56:02 +01001019static void ap_sta_ps_end(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001020{
Johannes Berg133b8222008-09-16 14:18:59 +02001021 struct ieee80211_sub_if_data *sdata = sta->sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02001022
Johannes Berg3e122be2008-07-09 14:40:34 +02001023 atomic_dec(&sdata->bss->num_sta_ps);
Johannes Berg004c8722008-02-20 11:21:35 +01001024
Johannes Bergaf818582009-11-06 11:35:50 +01001025 clear_sta_flags(sta, WLAN_STA_PS_STA);
Johannes Berg004c8722008-02-20 11:21:35 +01001026
Johannes Berg571ecf62007-07-27 15:43:22 +02001027#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Berg0c68ae262008-10-27 15:56:10 -07001028 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001029 sdata->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +02001030#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
Johannes Berg004c8722008-02-20 11:21:35 +01001031
Johannes Bergaf818582009-11-06 11:35:50 +01001032 if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001033#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
Johannes Bergaf818582009-11-06 11:35:50 +01001034 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001035 sdata->name, sta->sta.addr, sta->sta.aid);
Johannes Berg571ecf62007-07-27 15:43:22 +02001036#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
Johannes Bergaf818582009-11-06 11:35:50 +01001037 return;
1038 }
1039
1040 ieee80211_sta_ps_deliver_wakeup(sta);
Johannes Berg571ecf62007-07-27 15:43:22 +02001041}
1042
Johannes Berg49461622008-06-30 15:10:45 +02001043static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001044ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001045{
1046 struct sta_info *sta = rx->sta;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001047 struct sk_buff *skb = rx->skb;
1048 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1049 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001050
1051 if (!sta)
Johannes Berg9ae54c82008-01-31 19:48:20 +01001052 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001053
Johannes Bergb291ba12009-07-10 15:29:03 +02001054 /*
1055 * Update last_rx only for IBSS packets which are for the current
1056 * BSSID to avoid keeping the current IBSS network alive in cases
1057 * where other STAs start using different BSSID.
1058 */
Johannes Berg05c914f2008-09-11 00:01:58 +02001059 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
Ron Rindjunsky71364712007-12-25 17:00:36 +02001060 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
Johannes Berg05c914f2008-09-11 00:01:58 +02001061 NL80211_IFTYPE_ADHOC);
Johannes Berg46900292009-02-15 12:44:28 +01001062 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
Johannes Berg571ecf62007-07-27 15:43:22 +02001063 sta->last_rx = jiffies;
Johannes Bergb291ba12009-07-10 15:29:03 +02001064 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1065 /*
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001066 * Mesh beacons will update last_rx when if they are found to
1067 * match the current local configuration when processed.
Johannes Berg571ecf62007-07-27 15:43:22 +02001068 */
Johannes Bergb291ba12009-07-10 15:29:03 +02001069 sta->last_rx = jiffies;
Johannes Berg571ecf62007-07-27 15:43:22 +02001070 }
1071
Johannes Berg5cf121c2008-02-25 16:27:43 +01001072 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001073 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001074
Kalle Valo3cf335d2009-03-22 21:57:06 +02001075 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1076 ieee80211_sta_rx_notify(rx->sdata, hdr);
1077
Johannes Berg571ecf62007-07-27 15:43:22 +02001078 sta->rx_fragments++;
1079 sta->rx_bytes += rx->skb->len;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001080 sta->last_signal = status->signal;
Johannes Berg571ecf62007-07-27 15:43:22 +02001081
Johannes Berg72eaa432008-11-26 15:02:58 +01001082 /*
1083 * Change STA power saving mode only at the end of a frame
1084 * exchange sequence.
1085 */
Johannes Berg3e122be2008-07-09 14:40:34 +02001086 if (!ieee80211_has_morefrags(hdr->frame_control) &&
Johannes Berg05c914f2008-09-11 00:01:58 +02001087 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1088 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
Johannes Bergaf818582009-11-06 11:35:50 +01001089 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
Johannes Berg72eaa432008-11-26 15:02:58 +01001090 /*
1091 * Ignore doze->wake transitions that are
1092 * indicated by non-data frames, the standard
1093 * is unclear here, but for example going to
1094 * PS mode and then scanning would cause a
1095 * doze->wake transition for the probe request,
1096 * and that is clearly undesirable.
1097 */
1098 if (ieee80211_is_data(hdr->frame_control) &&
1099 !ieee80211_has_pm(hdr->frame_control))
Johannes Bergff9458d2009-10-30 12:56:02 +01001100 ap_sta_ps_end(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +01001101 } else {
1102 if (ieee80211_has_pm(hdr->frame_control))
1103 ap_sta_ps_start(sta);
1104 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001105 }
1106
Johannes Berg22403de2009-10-30 12:55:03 +01001107 /*
1108 * Drop (qos-)data::nullfunc frames silently, since they
1109 * are used only to control station power saving mode.
1110 */
1111 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1112 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001113 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
Felix Fietkaud5242152010-01-08 18:06:26 +01001114
1115 /*
1116 * If we receive a 4-addr nullfunc frame from a STA
1117 * that was not moved to a 4-addr STA vlan yet, drop
1118 * the frame to the monitor interface, to make sure
1119 * that hostapd sees it
1120 */
1121 if (ieee80211_has_a4(hdr->frame_control) &&
1122 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1123 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1124 !rx->sdata->u.vlan.sta)))
1125 return RX_DROP_MONITOR;
Johannes Berg22403de2009-10-30 12:55:03 +01001126 /*
1127 * Update counter and free packet here to avoid
1128 * counting this as a dropped packed.
1129 */
Johannes Berg571ecf62007-07-27 15:43:22 +02001130 sta->rx_packets++;
1131 dev_kfree_skb(rx->skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001132 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001133 }
1134
Johannes Berg9ae54c82008-01-31 19:48:20 +01001135 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001136} /* ieee80211_rx_h_sta_process */
1137
Johannes Berg571ecf62007-07-27 15:43:22 +02001138static inline struct ieee80211_fragment_entry *
1139ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1140 unsigned int frag, unsigned int seq, int rx_queue,
1141 struct sk_buff **skb)
1142{
1143 struct ieee80211_fragment_entry *entry;
1144 int idx;
1145
1146 idx = sdata->fragment_next;
1147 entry = &sdata->fragments[sdata->fragment_next++];
1148 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1149 sdata->fragment_next = 0;
1150
1151 if (!skb_queue_empty(&entry->skb_list)) {
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001152#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
Johannes Berg571ecf62007-07-27 15:43:22 +02001153 struct ieee80211_hdr *hdr =
1154 (struct ieee80211_hdr *) entry->skb_list.next->data;
1155 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1156 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
Johannes Berg0c68ae262008-10-27 15:56:10 -07001157 "addr1=%pM addr2=%pM\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001158 sdata->name, idx,
Johannes Berg571ecf62007-07-27 15:43:22 +02001159 jiffies - entry->first_frag_time, entry->seq,
Johannes Berg0c68ae262008-10-27 15:56:10 -07001160 entry->last_frag, hdr->addr1, hdr->addr2);
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001161#endif
Johannes Berg571ecf62007-07-27 15:43:22 +02001162 __skb_queue_purge(&entry->skb_list);
1163 }
1164
1165 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1166 *skb = NULL;
1167 entry->first_frag_time = jiffies;
1168 entry->seq = seq;
1169 entry->rx_queue = rx_queue;
1170 entry->last_frag = frag;
1171 entry->ccmp = 0;
1172 entry->extra_len = 0;
1173
1174 return entry;
1175}
1176
1177static inline struct ieee80211_fragment_entry *
1178ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001179 unsigned int frag, unsigned int seq,
Johannes Berg571ecf62007-07-27 15:43:22 +02001180 int rx_queue, struct ieee80211_hdr *hdr)
1181{
1182 struct ieee80211_fragment_entry *entry;
1183 int i, idx;
1184
1185 idx = sdata->fragment_next;
1186 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1187 struct ieee80211_hdr *f_hdr;
Johannes Berg571ecf62007-07-27 15:43:22 +02001188
1189 idx--;
1190 if (idx < 0)
1191 idx = IEEE80211_FRAGMENT_MAX - 1;
1192
1193 entry = &sdata->fragments[idx];
1194 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1195 entry->rx_queue != rx_queue ||
1196 entry->last_frag + 1 != frag)
1197 continue;
1198
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001199 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001200
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001201 /*
1202 * Check ftype and addresses are equal, else check next fragment
1203 */
1204 if (((hdr->frame_control ^ f_hdr->frame_control) &
1205 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
Johannes Berg571ecf62007-07-27 15:43:22 +02001206 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1207 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1208 continue;
1209
S.Çağlar Onurab466232008-02-14 17:36:47 +02001210 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001211 __skb_queue_purge(&entry->skb_list);
1212 continue;
1213 }
1214 return entry;
1215 }
1216
1217 return NULL;
1218}
1219
Johannes Berg49461622008-06-30 15:10:45 +02001220static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001221ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001222{
1223 struct ieee80211_hdr *hdr;
1224 u16 sc;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001225 __le16 fc;
Johannes Berg571ecf62007-07-27 15:43:22 +02001226 unsigned int frag, seq;
1227 struct ieee80211_fragment_entry *entry;
1228 struct sk_buff *skb;
1229
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001230 hdr = (struct ieee80211_hdr *)rx->skb->data;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001231 fc = hdr->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02001232 sc = le16_to_cpu(hdr->seq_ctrl);
1233 frag = sc & IEEE80211_SCTL_FRAG;
1234
Harvey Harrison358c8d92008-07-15 18:44:13 -07001235 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
Johannes Berg571ecf62007-07-27 15:43:22 +02001236 (rx->skb)->len < 24 ||
1237 is_multicast_ether_addr(hdr->addr1))) {
1238 /* not fragmented */
1239 goto out;
1240 }
1241 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1242
Zhu Yie3cf8b32010-03-29 17:35:07 +08001243 if (skb_linearize(rx->skb))
1244 return RX_DROP_UNUSABLE;
1245
Johannes Berg571ecf62007-07-27 15:43:22 +02001246 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1247
1248 if (frag == 0) {
1249 /* This is the first fragment of a new frame. */
1250 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001251 rx->queue, &(rx->skb));
Johannes Berg8f20fc22007-08-28 17:01:54 -04001252 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
Harvey Harrison358c8d92008-07-15 18:44:13 -07001253 ieee80211_has_protected(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001254 /* Store CCMP PN so that we can verify that the next
1255 * fragment has a sequential PN value. */
1256 entry->ccmp = 1;
1257 memcpy(entry->last_pn,
Johannes Berg5cf121c2008-02-25 16:27:43 +01001258 rx->key->u.ccmp.rx_pn[rx->queue],
Johannes Berg571ecf62007-07-27 15:43:22 +02001259 CCMP_PN_LEN);
1260 }
Johannes Berg9ae54c82008-01-31 19:48:20 +01001261 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001262 }
1263
1264 /* This is a fragment for a frame that should already be pending in
1265 * fragment cache. Add this fragment to the end of the pending entry.
1266 */
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001267 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
Johannes Berg571ecf62007-07-27 15:43:22 +02001268 if (!entry) {
1269 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001270 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02001271 }
1272
1273 /* Verify that MPDUs within one MSDU have sequential PN values.
1274 * (IEEE 802.11i, 8.3.3.4.5) */
1275 if (entry->ccmp) {
1276 int i;
1277 u8 pn[CCMP_PN_LEN], *rpn;
Johannes Berg8f20fc22007-08-28 17:01:54 -04001278 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
Johannes Berge4c26ad2008-01-31 19:48:21 +01001279 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001280 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1281 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1282 pn[i]++;
1283 if (pn[i])
1284 break;
1285 }
Johannes Berg5cf121c2008-02-25 16:27:43 +01001286 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001287 if (memcmp(pn, rpn, CCMP_PN_LEN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001288 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001289 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1290 }
1291
Harvey Harrison358c8d92008-07-15 18:44:13 -07001292 skb_pull(rx->skb, ieee80211_hdrlen(fc));
Johannes Berg571ecf62007-07-27 15:43:22 +02001293 __skb_queue_tail(&entry->skb_list, rx->skb);
1294 entry->last_frag = frag;
1295 entry->extra_len += rx->skb->len;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001296 if (ieee80211_has_morefrags(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001297 rx->skb = NULL;
Johannes Berg9ae54c82008-01-31 19:48:20 +01001298 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001299 }
1300
1301 rx->skb = __skb_dequeue(&entry->skb_list);
1302 if (skb_tailroom(rx->skb) < entry->extra_len) {
1303 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1304 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1305 GFP_ATOMIC))) {
1306 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1307 __skb_queue_purge(&entry->skb_list);
Johannes Berge4c26ad2008-01-31 19:48:21 +01001308 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001309 }
1310 }
1311 while ((skb = __skb_dequeue(&entry->skb_list))) {
1312 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1313 dev_kfree_skb(skb);
1314 }
1315
1316 /* Complete frame has been reassembled - process it now */
Johannes Berg5cf121c2008-02-25 16:27:43 +01001317 rx->flags |= IEEE80211_RX_FRAGMENTED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001318
1319 out:
1320 if (rx->sta)
1321 rx->sta->rx_packets++;
1322 if (is_multicast_ether_addr(hdr->addr1))
1323 rx->local->dot11MulticastReceivedFrameCount++;
1324 else
1325 ieee80211_led_rx(rx->local);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001326 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001327}
1328
Johannes Berg49461622008-06-30 15:10:45 +02001329static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001330ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001331{
Johannes Bergaf818582009-11-06 11:35:50 +01001332 struct ieee80211_sub_if_data *sdata = rx->sdata;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001333 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02001334
Harvey Harrison358c8d92008-07-15 18:44:13 -07001335 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
Johannes Berg5cf121c2008-02-25 16:27:43 +01001336 !(rx->flags & IEEE80211_RX_RA_MATCH)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001337 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001338
Johannes Berg05c914f2008-09-11 00:01:58 +02001339 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1340 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001341 return RX_DROP_UNUSABLE;
Ron Rindjunsky98f0b0a2007-12-18 17:23:53 +02001342
Johannes Bergaf818582009-11-06 11:35:50 +01001343 if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1344 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1345 else
1346 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
Johannes Berg571ecf62007-07-27 15:43:22 +02001347
Johannes Berg9ae54c82008-01-31 19:48:20 +01001348 /* Free PS Poll skb here instead of returning RX_DROP that would
Johannes Berg571ecf62007-07-27 15:43:22 +02001349 * count as an dropped frame. */
1350 dev_kfree_skb(rx->skb);
1351
Johannes Berg9ae54c82008-01-31 19:48:20 +01001352 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001353}
1354
Johannes Berg49461622008-06-30 15:10:45 +02001355static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001356ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +02001357{
Johannes Berg6e0d1142007-07-27 15:43:22 +02001358 u8 *data = rx->skb->data;
Harvey Harrison238f74a2008-07-02 11:05:34 -07001359 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001360
Harvey Harrison238f74a2008-07-02 11:05:34 -07001361 if (!ieee80211_is_data_qos(hdr->frame_control))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001362 return RX_CONTINUE;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001363
1364 /* remove the qos control field, update frame type and meta-data */
Harvey Harrison238f74a2008-07-02 11:05:34 -07001365 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1366 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1367 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
Johannes Berg6e0d1142007-07-27 15:43:22 +02001368 /* change frame type to non QOS */
Harvey Harrison238f74a2008-07-02 11:05:34 -07001369 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
Johannes Berg6e0d1142007-07-27 15:43:22 +02001370
Johannes Berg9ae54c82008-01-31 19:48:20 +01001371 return RX_CONTINUE;
Johannes Berg6e0d1142007-07-27 15:43:22 +02001372}
1373
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001374static int
Johannes Berg5cf121c2008-02-25 16:27:43 +01001375ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001376{
Johannes Berg07346f812008-05-03 01:02:02 +02001377 if (unlikely(!rx->sta ||
Johannes Bergf4ea83d2008-06-30 15:10:46 +02001378 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001379 return -EACCES;
Johannes Berg571ecf62007-07-27 15:43:22 +02001380
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001381 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001382}
1383
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001384static int
Harvey Harrison358c8d92008-07-15 18:44:13 -07001385ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Berg571ecf62007-07-27 15:43:22 +02001386{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001387 struct sk_buff *skb = rx->skb;
1388 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1389
Johannes Berg3017b802007-08-28 17:01:53 -04001390 /*
Johannes Berg7848ba72007-09-14 11:10:25 -04001391 * Pass through unencrypted frames if the hardware has
1392 * decrypted them already.
Johannes Berg3017b802007-08-28 17:01:53 -04001393 */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001394 if (status->flag & RX_FLAG_DECRYPTED)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001395 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001396
1397 /* Drop unencrypted frames if key is set. */
Harvey Harrison358c8d92008-07-15 18:44:13 -07001398 if (unlikely(!ieee80211_has_protected(fc) &&
1399 !ieee80211_is_nullfunc(fc) &&
Jouni Malinenf2ca3ea42009-05-08 12:36:03 +03001400 ieee80211_is_data(fc) &&
Jouni Malinen3cfcf6a2009-01-08 13:32:02 +02001401 (rx->key || rx->sdata->drop_unencrypted)))
1402 return -EACCES;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001403
1404 return 0;
1405}
1406
1407static int
1408ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1409{
1410 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Jouni Malinene3efca02010-03-28 22:31:15 -07001411 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001412 __le16 fc = hdr->frame_control;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001413
Jouni Malinene3efca02010-03-28 22:31:15 -07001414 /*
1415 * Pass through unencrypted frames if the hardware has
1416 * decrypted them already.
1417 */
1418 if (status->flag & RX_FLAG_DECRYPTED)
1419 return 0;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001420
Jouni Malinenf2ca3ea42009-05-08 12:36:03 +03001421 if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1422 if (unlikely(ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1423 rx->key))
1424 return -EACCES;
1425 /* BIP does not use Protected field, so need to check MMIE */
Joe Perchesf64f9e72009-11-29 16:55:45 -08001426 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinenfa83a212010-03-29 23:36:15 -07001427 ieee80211_get_mmie_keyidx(rx->skb) < 0))
Jouni Malinenf2ca3ea42009-05-08 12:36:03 +03001428 return -EACCES;
1429 /*
1430 * When using MFP, Action frames are not allowed prior to
1431 * having configured keys.
1432 */
1433 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1434 ieee80211_is_robust_mgmt_frame(
1435 (struct ieee80211_hdr *) rx->skb->data)))
1436 return -EACCES;
1437 }
Johannes Bergb3fc9c62008-04-13 10:12:47 +02001438
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001439 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02001440}
1441
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001442static int
Zhu Yie31a16d2009-05-21 21:47:03 +08001443__ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001444{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001445 struct ieee80211_sub_if_data *sdata = rx->sdata;
Felix Fietkauf14543e2009-11-10 20:10:05 +01001446 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1447
Johannes Berg9bc383d2009-11-19 11:55:19 +01001448 if (ieee80211_has_a4(hdr->frame_control) &&
1449 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
Felix Fietkauf14543e2009-11-10 20:10:05 +01001450 return -1;
Johannes Berg9bc383d2009-11-19 11:55:19 +01001451
1452 if (is_multicast_ether_addr(hdr->addr1) &&
1453 ((sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) ||
1454 (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
Felix Fietkauf14543e2009-11-10 20:10:05 +01001455 return -1;
Johannes Berg571ecf62007-07-27 15:43:22 +02001456
Johannes Berg47846c92009-11-25 17:46:19 +01001457 return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001458}
Johannes Berg571ecf62007-07-27 15:43:22 +02001459
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001460/*
1461 * requires that rx->skb is a frame with ethernet header
1462 */
Harvey Harrison358c8d92008-07-15 18:44:13 -07001463static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001464{
Senthil Balasubramanianc97c23e2008-05-28 23:15:32 +05301465 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001466 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1467 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1468
1469 /*
1470 * Allow EAPOL frames to us/the PAE group address regardless
1471 * of whether the frame was encrypted or not.
1472 */
1473 if (ehdr->h_proto == htons(ETH_P_PAE) &&
Johannes Berg47846c92009-11-25 17:46:19 +01001474 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001475 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1476 return true;
1477
1478 if (ieee80211_802_1x_port_control(rx) ||
Harvey Harrison358c8d92008-07-15 18:44:13 -07001479 ieee80211_drop_unencrypted(rx, fc))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001480 return false;
1481
1482 return true;
1483}
1484
1485/*
1486 * requires that rx->skb is a frame with ethernet header
1487 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001488static void
Johannes Berg5cf121c2008-02-25 16:27:43 +01001489ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001490{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001491 struct ieee80211_sub_if_data *sdata = rx->sdata;
1492 struct net_device *dev = sdata->dev;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001493 struct sk_buff *skb, *xmit_skb;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001494 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1495 struct sta_info *dsta;
Johannes Berg571ecf62007-07-27 15:43:22 +02001496
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001497 skb = rx->skb;
1498 xmit_skb = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +02001499
Johannes Berg05c914f2008-09-11 00:01:58 +02001500 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1501 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Johannes Berg213cd112008-09-11 00:01:54 +02001502 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
Johannes Berg9bc383d2009-11-19 11:55:19 +01001503 (rx->flags & IEEE80211_RX_RA_MATCH) &&
1504 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001505 if (is_multicast_ether_addr(ehdr->h_dest)) {
1506 /*
1507 * send multicast frames both to higher layers in
1508 * local net stack and back to the wireless medium
1509 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001510 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1511 if (!xmit_skb && net_ratelimit())
Johannes Berg571ecf62007-07-27 15:43:22 +02001512 printk(KERN_DEBUG "%s: failed to clone "
1513 "multicast frame\n", dev->name);
1514 } else {
Johannes Bergabe60632009-11-25 17:46:18 +01001515 dsta = sta_info_get(sdata, skb->data);
1516 if (dsta) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001517 /*
1518 * The destination station is associated to
1519 * this AP (in this VLAN), so send the frame
1520 * directly to it and do not pass it to local
1521 * net stack.
Johannes Berg571ecf62007-07-27 15:43:22 +02001522 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001523 xmit_skb = skb;
Johannes Berg571ecf62007-07-27 15:43:22 +02001524 skb = NULL;
1525 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001526 }
1527 }
1528
1529 if (skb) {
Johannes Bergd1c3a372009-01-07 00:26:10 +01001530 int align __maybe_unused;
1531
Kalle Valo59d9cb02009-12-17 13:54:57 +01001532#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
Johannes Bergd1c3a372009-01-07 00:26:10 +01001533 /*
1534 * 'align' will only take the values 0 or 2 here
1535 * since all frames are required to be aligned
1536 * to 2-byte boundaries when being passed to
1537 * mac80211. That also explains the __skb_push()
1538 * below.
1539 */
matthieu castetdacb6f12009-06-04 22:16:18 +02001540 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
Johannes Bergd1c3a372009-01-07 00:26:10 +01001541 if (align) {
1542 if (WARN_ON(skb_headroom(skb) < 3)) {
1543 dev_kfree_skb(skb);
1544 skb = NULL;
1545 } else {
1546 u8 *data = skb->data;
Zhu Yi8ce0b582009-10-28 13:13:52 -07001547 size_t len = skb_headlen(skb);
1548 skb->data -= align;
1549 memmove(skb->data, data, len);
1550 skb_set_tail_pointer(skb, len);
Johannes Bergd1c3a372009-01-07 00:26:10 +01001551 }
1552 }
1553#endif
1554
1555 if (skb) {
1556 /* deliver to local stack */
1557 skb->protocol = eth_type_trans(skb, dev);
1558 memset(skb->cb, 0, sizeof(skb->cb));
1559 netif_rx(skb);
1560 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001561 }
1562
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001563 if (xmit_skb) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001564 /* send to wireless media */
YOSHIFUJI Hideakif831e902007-12-12 03:54:23 +09001565 xmit_skb->protocol = htons(ETH_P_802_3);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001566 skb_reset_network_header(xmit_skb);
1567 skb_reset_mac_header(xmit_skb);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001568 dev_queue_xmit(xmit_skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001569 }
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001570}
1571
Johannes Berg49461622008-06-30 15:10:45 +02001572static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001573ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001574{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001575 struct net_device *dev = rx->sdata->dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08001576 struct sk_buff *skb = rx->skb;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001577 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1578 __le16 fc = hdr->frame_control;
Zhu Yieaf85ca2009-12-01 10:18:37 +08001579 struct sk_buff_head frame_list;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001580
Harvey Harrison358c8d92008-07-15 18:44:13 -07001581 if (unlikely(!ieee80211_is_data(fc)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001582 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001583
Harvey Harrison358c8d92008-07-15 18:44:13 -07001584 if (unlikely(!ieee80211_is_data_present(fc)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001585 return RX_DROP_MONITOR;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001586
Johannes Berg5cf121c2008-02-25 16:27:43 +01001587 if (!(rx->flags & IEEE80211_RX_AMSDU))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001588 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001589
Zhu Yieaf85ca2009-12-01 10:18:37 +08001590 if (ieee80211_has_a4(hdr->frame_control) &&
1591 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1592 !rx->sdata->u.vlan.sta)
1593 return RX_DROP_UNUSABLE;
1594
1595 if (is_multicast_ether_addr(hdr->addr1) &&
1596 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1597 rx->sdata->u.vlan.sta) ||
1598 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1599 rx->sdata->u.mgd.use_4addr)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001600 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001601
1602 skb->dev = dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08001603 __skb_queue_head_init(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001604
Zhu Yie3cf8b32010-03-29 17:35:07 +08001605 if (skb_linearize(skb))
1606 return RX_DROP_UNUSABLE;
1607
Zhu Yieaf85ca2009-12-01 10:18:37 +08001608 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1609 rx->sdata->vif.type,
1610 rx->local->hw.extra_tx_headroom);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001611
Zhu Yieaf85ca2009-12-01 10:18:37 +08001612 while (!skb_queue_empty(&frame_list)) {
1613 rx->skb = __skb_dequeue(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001614
Harvey Harrison358c8d92008-07-15 18:44:13 -07001615 if (!ieee80211_frame_allowed(rx, fc)) {
Zhu Yieaf85ca2009-12-01 10:18:37 +08001616 dev_kfree_skb(rx->skb);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001617 continue;
1618 }
Zhu Yieaf85ca2009-12-01 10:18:37 +08001619 dev->stats.rx_packets++;
1620 dev->stats.rx_bytes += rx->skb->len;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001621
1622 ieee80211_deliver_skb(rx);
1623 }
1624
Johannes Berg9ae54c82008-01-31 19:48:20 +01001625 return RX_QUEUED;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02001626}
1627
Ingo Molnarbf94e172008-10-12 23:51:38 -07001628#ifdef CONFIG_MAC80211_MESH
Davide Pesaventob0dee572008-09-27 17:29:12 +02001629static ieee80211_rx_result
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001630ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1631{
1632 struct ieee80211_hdr *hdr;
1633 struct ieee80211s_hdr *mesh_hdr;
1634 unsigned int hdrlen;
1635 struct sk_buff *skb = rx->skb, *fwd_skb;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001636 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001637 struct ieee80211_sub_if_data *sdata = rx->sdata;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001638
1639 hdr = (struct ieee80211_hdr *) skb->data;
1640 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1641 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1642
1643 if (!ieee80211_is_data(hdr->frame_control))
1644 return RX_CONTINUE;
1645
1646 if (!mesh_hdr->ttl)
1647 /* illegal frame */
1648 return RX_DROP_MONITOR;
1649
Javier Cardona43b7b312009-10-15 18:10:51 -07001650 if (mesh_hdr->flags & MESH_FLAGS_AE) {
YanBo79617de2008-09-22 13:30:32 +08001651 struct mesh_path *mppath;
Javier Cardona43b7b312009-10-15 18:10:51 -07001652 char *proxied_addr;
1653 char *mpp_addr;
1654
1655 if (is_multicast_ether_addr(hdr->addr1)) {
1656 mpp_addr = hdr->addr3;
1657 proxied_addr = mesh_hdr->eaddr1;
1658 } else {
1659 mpp_addr = hdr->addr4;
1660 proxied_addr = mesh_hdr->eaddr2;
1661 }
YanBo79617de2008-09-22 13:30:32 +08001662
YanBo79617de2008-09-22 13:30:32 +08001663 rcu_read_lock();
Javier Cardona43b7b312009-10-15 18:10:51 -07001664 mppath = mpp_path_lookup(proxied_addr, sdata);
YanBo79617de2008-09-22 13:30:32 +08001665 if (!mppath) {
Javier Cardona43b7b312009-10-15 18:10:51 -07001666 mpp_path_add(proxied_addr, mpp_addr, sdata);
YanBo79617de2008-09-22 13:30:32 +08001667 } else {
1668 spin_lock_bh(&mppath->state_lock);
Javier Cardona43b7b312009-10-15 18:10:51 -07001669 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1670 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
YanBo79617de2008-09-22 13:30:32 +08001671 spin_unlock_bh(&mppath->state_lock);
1672 }
1673 rcu_read_unlock();
1674 }
1675
Javier Cardona3c5772a2009-08-10 12:15:48 -07001676 /* Frame has reached destination. Don't forward */
1677 if (!is_multicast_ether_addr(hdr->addr1) &&
Johannes Berg47846c92009-11-25 17:46:19 +01001678 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001679 return RX_CONTINUE;
1680
1681 mesh_hdr->ttl--;
1682
1683 if (rx->flags & IEEE80211_RX_RA_MATCH) {
1684 if (!mesh_hdr->ttl)
Johannes Berg472dbc42008-09-11 00:01:49 +02001685 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001686 dropped_frames_ttl);
1687 else {
1688 struct ieee80211_hdr *fwd_hdr;
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001689 struct ieee80211_tx_info *info;
1690
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001691 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1692
1693 if (!fwd_skb && net_ratelimit())
1694 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
Johannes Berg47846c92009-11-25 17:46:19 +01001695 sdata->name);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001696
1697 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
Johannes Berg47846c92009-11-25 17:46:19 +01001698 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001699 info = IEEE80211_SKB_CB(fwd_skb);
1700 memset(info, 0, sizeof(*info));
1701 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
Johannes Berg5061b0c2009-07-14 00:33:34 +02001702 info->control.vif = &rx->sdata->vif;
Johannes Bergcf0277e2010-01-05 18:00:58 +01001703 skb_set_queue_mapping(skb,
1704 ieee80211_select_queue(rx->sdata, fwd_skb));
1705 ieee80211_set_qos_hdr(local, skb);
Daniel Walkerc8a61a72009-08-18 10:59:00 -07001706 if (is_multicast_ether_addr(fwd_hdr->addr1))
1707 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1708 fwded_mcast);
1709 else {
Javier Cardona3c5772a2009-08-10 12:15:48 -07001710 int err;
1711 /*
1712 * Save TA to addr1 to send TA a path error if a
1713 * suitable next hop is not found
1714 */
1715 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
Javier Cardona249b4052009-07-07 10:55:03 -07001716 ETH_ALEN);
Javier Cardona3c5772a2009-08-10 12:15:48 -07001717 err = mesh_nexthop_lookup(fwd_skb, sdata);
Javier Cardona249b4052009-07-07 10:55:03 -07001718 /* Failed to immediately resolve next hop:
1719 * fwded frame was dropped or will be added
1720 * later to the pending skb queue. */
1721 if (err)
1722 return RX_DROP_MONITOR;
Daniel Walkerc8a61a72009-08-18 10:59:00 -07001723
1724 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1725 fwded_unicast);
Javier Cardona249b4052009-07-07 10:55:03 -07001726 }
1727 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1728 fwded_frames);
Johannes Berg3b8d81e2009-06-17 17:43:56 +02001729 ieee80211_add_pending_skb(local, fwd_skb);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001730 }
1731 }
1732
Javier Cardona3c5772a2009-08-10 12:15:48 -07001733 if (is_multicast_ether_addr(hdr->addr1) ||
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001734 sdata->dev->flags & IFF_PROMISC)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001735 return RX_CONTINUE;
1736 else
1737 return RX_DROP_MONITOR;
1738}
Ingo Molnarbf94e172008-10-12 23:51:38 -07001739#endif
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02001740
1741static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001742ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001743{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001744 struct ieee80211_sub_if_data *sdata = rx->sdata;
Vivek Natarajane15276a2010-02-08 17:47:01 +05301745 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001746 struct net_device *dev = sdata->dev;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001747 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1748 __le16 fc = hdr->frame_control;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001749 int err;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001750
Harvey Harrison358c8d92008-07-15 18:44:13 -07001751 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001752 return RX_CONTINUE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001753
Harvey Harrison358c8d92008-07-15 18:44:13 -07001754 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001755 return RX_DROP_MONITOR;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001756
Felix Fietkauf14543e2009-11-10 20:10:05 +01001757 /*
1758 * Allow the cooked monitor interface of an AP to see 4-addr frames so
1759 * that a 4-addr station can be detected and moved into a separate VLAN
1760 */
1761 if (ieee80211_has_a4(hdr->frame_control) &&
1762 sdata->vif.type == NL80211_IFTYPE_AP)
1763 return RX_DROP_MONITOR;
1764
Zhu Yie31a16d2009-05-21 21:47:03 +08001765 err = __ieee80211_data_to_8023(rx);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001766 if (unlikely(err))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001767 return RX_DROP_UNUSABLE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001768
Harvey Harrison358c8d92008-07-15 18:44:13 -07001769 if (!ieee80211_frame_allowed(rx, fc))
Johannes Berge4c26ad2008-01-31 19:48:21 +01001770 return RX_DROP_MONITOR;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01001771
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001772 rx->skb->dev = dev;
1773
1774 dev->stats.rx_packets++;
1775 dev->stats.rx_bytes += rx->skb->len;
1776
Vivek Natarajane15276a2010-02-08 17:47:01 +05301777 if (ieee80211_is_data(hdr->frame_control) &&
1778 !is_multicast_ether_addr(hdr->addr1) &&
1779 local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
1780 mod_timer(&local->dynamic_ps_timer, jiffies +
1781 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1782 }
1783
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02001784 ieee80211_deliver_skb(rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02001785
Johannes Berg9ae54c82008-01-31 19:48:20 +01001786 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001787}
1788
Johannes Berg49461622008-06-30 15:10:45 +02001789static ieee80211_rx_result debug_noinline
Johannes Berg2569a822009-11-25 17:46:17 +01001790ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
Ron Rindjunsky71364712007-12-25 17:00:36 +02001791{
1792 struct ieee80211_local *local = rx->local;
1793 struct ieee80211_hw *hw = &local->hw;
1794 struct sk_buff *skb = rx->skb;
Harvey Harrisona7767f92008-07-02 16:30:51 -07001795 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001796 struct tid_ampdu_rx *tid_agg_rx;
1797 u16 start_seq_num;
1798 u16 tid;
1799
Harvey Harrisona7767f92008-07-02 16:30:51 -07001800 if (likely(!ieee80211_is_ctl(bar->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01001801 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001802
Harvey Harrisona7767f92008-07-02 16:30:51 -07001803 if (ieee80211_is_back_req(bar->frame_control)) {
Ron Rindjunsky71364712007-12-25 17:00:36 +02001804 if (!rx->sta)
Johannes Berga02ae752009-11-16 12:00:40 +01001805 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001806 tid = le16_to_cpu(bar->control) >> 12;
Ron Rindjunskycee24a32008-03-26 20:36:03 +02001807 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1808 != HT_AGG_STATE_OPERATIONAL)
Johannes Berga02ae752009-11-16 12:00:40 +01001809 return RX_DROP_MONITOR;
Ron Rindjunskycee24a32008-03-26 20:36:03 +02001810 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
Ron Rindjunsky71364712007-12-25 17:00:36 +02001811
1812 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1813
1814 /* reset session timer */
Johannes Berg20ad19d2009-02-10 21:25:45 +01001815 if (tid_agg_rx->timeout)
1816 mod_timer(&tid_agg_rx->session_timer,
1817 TU_TO_EXP_TIME(tid_agg_rx->timeout));
Ron Rindjunsky71364712007-12-25 17:00:36 +02001818
Johannes Berga02ae752009-11-16 12:00:40 +01001819 /* release stored frames up to start of BAR */
Johannes Berg2569a822009-11-25 17:46:17 +01001820 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num,
1821 frames);
Johannes Berga02ae752009-11-16 12:00:40 +01001822 kfree_skb(skb);
1823 return RX_QUEUED;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001824 }
1825
Johannes Berg9ae54c82008-01-31 19:48:20 +01001826 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02001827}
1828
Jouni Malinenf4f727a2009-01-10 11:46:53 +02001829static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1830 struct ieee80211_mgmt *mgmt,
1831 size_t len)
Jouni Malinenfea14732009-01-08 13:32:06 +02001832{
1833 struct ieee80211_local *local = sdata->local;
1834 struct sk_buff *skb;
1835 struct ieee80211_mgmt *resp;
1836
Johannes Berg47846c92009-11-25 17:46:19 +01001837 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
Jouni Malinenfea14732009-01-08 13:32:06 +02001838 /* Not to own unicast address */
1839 return;
1840 }
1841
Johannes Berg46900292009-02-15 12:44:28 +01001842 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
1843 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
Johannes Berg77fdaa12009-07-07 03:45:17 +02001844 /* Not from the current AP or not associated yet. */
Jouni Malinenfea14732009-01-08 13:32:06 +02001845 return;
1846 }
1847
1848 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
1849 /* Too short SA Query request frame */
1850 return;
1851 }
1852
1853 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
1854 if (skb == NULL)
1855 return;
1856
1857 skb_reserve(skb, local->hw.extra_tx_headroom);
1858 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
1859 memset(resp, 0, 24);
1860 memcpy(resp->da, mgmt->sa, ETH_ALEN);
Johannes Berg47846c92009-11-25 17:46:19 +01001861 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
Johannes Berg46900292009-02-15 12:44:28 +01001862 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
Jouni Malinenfea14732009-01-08 13:32:06 +02001863 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1864 IEEE80211_STYPE_ACTION);
1865 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
1866 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
1867 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
1868 memcpy(resp->u.action.u.sa_query.trans_id,
1869 mgmt->u.action.u.sa_query.trans_id,
1870 WLAN_SA_QUERY_TR_ID_LEN);
1871
Johannes Berg62ae67b2009-11-18 18:42:05 +01001872 ieee80211_tx_skb(sdata, skb);
Jouni Malinenfea14732009-01-08 13:32:06 +02001873}
1874
Johannes Berg49461622008-06-30 15:10:45 +02001875static ieee80211_rx_result debug_noinline
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001876ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1877{
1878 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001879 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001880 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg84040802010-02-15 12:46:39 +02001881 struct sk_buff *nskb;
Jouni Malinen026331c2010-02-15 12:53:10 +02001882 struct ieee80211_rx_status *status;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001883 int len = rx->skb->len;
1884
1885 if (!ieee80211_is_action(mgmt->frame_control))
1886 return RX_CONTINUE;
1887
Jouni Malinen026331c2010-02-15 12:53:10 +02001888 /* drop too small frames */
1889 if (len < IEEE80211_MIN_ACTION_SIZE)
1890 return RX_DROP_UNUSABLE;
1891
1892 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
Johannes Berg84040802010-02-15 12:46:39 +02001893 return RX_DROP_UNUSABLE;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001894
1895 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berg84040802010-02-15 12:46:39 +02001896 return RX_DROP_UNUSABLE;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001897
Johannes Bergbef5d1c2010-02-16 11:05:00 +01001898 if (ieee80211_drop_unencrypted_mgmt(rx))
Johannes Berg84040802010-02-15 12:46:39 +02001899 return RX_DROP_UNUSABLE;
Jouni Malinen97ebe122009-01-08 13:32:08 +02001900
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001901 switch (mgmt->u.action.category) {
1902 case WLAN_CATEGORY_BACK:
Johannes Berg8abd3f92009-02-10 21:25:47 +01001903 /*
1904 * The aggregation code is not prepared to handle
1905 * anything but STA/AP due to the BSSID handling;
1906 * IBSS could work in the code but isn't supported
1907 * by drivers or the standard.
1908 */
1909 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1910 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
1911 sdata->vif.type != NL80211_IFTYPE_AP)
Johannes Berg84040802010-02-15 12:46:39 +02001912 break;
Johannes Berg8abd3f92009-02-10 21:25:47 +01001913
Jouni Malinen026331c2010-02-15 12:53:10 +02001914 /* verify action_code is present */
1915 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1916 break;
1917
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001918 switch (mgmt->u.action.u.addba_req.action_code) {
1919 case WLAN_ACTION_ADDBA_REQ:
1920 if (len < (IEEE80211_MIN_ACTION_SIZE +
1921 sizeof(mgmt->u.action.u.addba_req)))
1922 return RX_DROP_MONITOR;
1923 ieee80211_process_addba_request(local, rx->sta, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02001924 goto handled;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001925 case WLAN_ACTION_ADDBA_RESP:
1926 if (len < (IEEE80211_MIN_ACTION_SIZE +
1927 sizeof(mgmt->u.action.u.addba_resp)))
Johannes Berg84040802010-02-15 12:46:39 +02001928 break;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001929 ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02001930 goto handled;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001931 case WLAN_ACTION_DELBA:
1932 if (len < (IEEE80211_MIN_ACTION_SIZE +
1933 sizeof(mgmt->u.action.u.delba)))
Johannes Berg84040802010-02-15 12:46:39 +02001934 break;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001935 ieee80211_process_delba(sdata, rx->sta, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02001936 goto handled;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02001937 }
Johannes Berg39192c02008-09-09 14:49:03 +02001938 break;
1939 case WLAN_CATEGORY_SPECTRUM_MGMT:
1940 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
Johannes Berg84040802010-02-15 12:46:39 +02001941 break;
Johannes Berg46900292009-02-15 12:44:28 +01001942
1943 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02001944 break;
Johannes Berg46900292009-02-15 12:44:28 +01001945
Jouni Malinen026331c2010-02-15 12:53:10 +02001946 /* verify action_code is present */
1947 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1948 break;
1949
Johannes Berg39192c02008-09-09 14:49:03 +02001950 switch (mgmt->u.action.u.measurement.action_code) {
1951 case WLAN_ACTION_SPCT_MSR_REQ:
1952 if (len < (IEEE80211_MIN_ACTION_SIZE +
1953 sizeof(mgmt->u.action.u.measurement)))
Johannes Berg84040802010-02-15 12:46:39 +02001954 break;
Johannes Berg39192c02008-09-09 14:49:03 +02001955 ieee80211_process_measurement_req(sdata, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02001956 goto handled;
Sujithc481ec92009-01-06 09:28:37 +05301957 case WLAN_ACTION_SPCT_CHL_SWITCH:
1958 if (len < (IEEE80211_MIN_ACTION_SIZE +
1959 sizeof(mgmt->u.action.u.chan_switch)))
Johannes Berg84040802010-02-15 12:46:39 +02001960 break;
Sujithc481ec92009-01-06 09:28:37 +05301961
Johannes Bergcc32abd2009-05-15 11:52:31 +02001962 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02001963 break;
Johannes Bergcc32abd2009-05-15 11:52:31 +02001964
Johannes Berg46900292009-02-15 12:44:28 +01001965 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
Johannes Berg84040802010-02-15 12:46:39 +02001966 break;
Sujithc481ec92009-01-06 09:28:37 +05301967
Johannes Berg77fdaa12009-07-07 03:45:17 +02001968 return ieee80211_sta_rx_mgmt(sdata, rx->skb);
Johannes Berg39192c02008-09-09 14:49:03 +02001969 }
1970 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02001971 case WLAN_CATEGORY_SA_QUERY:
1972 if (len < (IEEE80211_MIN_ACTION_SIZE +
1973 sizeof(mgmt->u.action.u.sa_query)))
Johannes Berg84040802010-02-15 12:46:39 +02001974 break;
1975
Jouni Malinenfea14732009-01-08 13:32:06 +02001976 switch (mgmt->u.action.u.sa_query.action) {
1977 case WLAN_ACTION_SA_QUERY_REQUEST:
1978 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02001979 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02001980 ieee80211_process_sa_query_req(sdata, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02001981 goto handled;
Jouni Malinenfea14732009-01-08 13:32:06 +02001982 }
1983 break;
Johannes Berg84040802010-02-15 12:46:39 +02001984 }
Jouni Malinen026331c2010-02-15 12:53:10 +02001985
Johannes Berg84040802010-02-15 12:46:39 +02001986 /*
1987 * For AP mode, hostapd is responsible for handling any action
1988 * frames that we didn't handle, including returning unknown
1989 * ones. For all other modes we will return them to the sender,
1990 * setting the 0x80 bit in the action category, as required by
1991 * 802.11-2007 7.3.1.11.
1992 */
1993 if (sdata->vif.type == NL80211_IFTYPE_AP ||
1994 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1995 return RX_DROP_MONITOR;
Felix Fietkaud7907442010-01-07 20:23:53 +01001996
Jouni Malinen026331c2010-02-15 12:53:10 +02001997 /*
1998 * Getting here means the kernel doesn't know how to handle
1999 * it, but maybe userspace does ... include returned frames
2000 * so userspace can register for those to know whether ones
2001 * it transmitted were processed or returned.
2002 */
2003 status = IEEE80211_SKB_RXCB(rx->skb);
2004
2005 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2006 cfg80211_rx_action(rx->sdata->dev, status->freq,
2007 rx->skb->data, rx->skb->len,
2008 GFP_ATOMIC))
2009 goto handled;
2010
Johannes Berg84040802010-02-15 12:46:39 +02002011 /* do not return rejected action frames */
2012 if (mgmt->u.action.category & 0x80)
2013 return RX_DROP_UNUSABLE;
2014
2015 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2016 GFP_ATOMIC);
2017 if (nskb) {
2018 struct ieee80211_mgmt *mgmt = (void *)nskb->data;
2019
2020 mgmt->u.action.category |= 0x80;
2021 memcpy(mgmt->da, mgmt->sa, ETH_ALEN);
2022 memcpy(mgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2023
2024 memset(nskb->cb, 0, sizeof(nskb->cb));
2025
2026 ieee80211_tx_skb(rx->sdata, nskb);
Johannes Bergde1ede7a2008-09-09 14:42:50 +02002027 }
2028
Johannes Berg84040802010-02-15 12:46:39 +02002029 handled:
Jouni Malinen026331c2010-02-15 12:53:10 +02002030 if (rx->sta)
2031 rx->sta->rx_packets++;
Johannes Berg39192c02008-09-09 14:49:03 +02002032 dev_kfree_skb(rx->skb);
2033 return RX_QUEUED;
Johannes Bergde1ede7a2008-09-09 14:42:50 +02002034}
2035
2036static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01002037ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02002038{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002039 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergaf6b6372009-12-23 13:15:35 +01002040 ieee80211_rx_result rxs;
Johannes Berg571ecf62007-07-27 15:43:22 +02002041
Johannes Berg5cf121c2008-02-25 16:27:43 +01002042 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002043 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02002044
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002045 if (ieee80211_drop_unencrypted_mgmt(rx))
2046 return RX_DROP_UNUSABLE;
Jouni Malinen97ebe122009-01-08 13:32:08 +02002047
Johannes Bergaf6b6372009-12-23 13:15:35 +01002048 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2049 if (rxs != RX_CONTINUE)
2050 return rxs;
2051
Johannes Berg472dbc42008-09-11 00:01:49 +02002052 if (ieee80211_vif_is_mesh(&sdata->vif))
Johannes Bergf1d58c22009-06-17 13:13:00 +02002053 return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
Johannes Berg472dbc42008-09-11 00:01:49 +02002054
Johannes Berg3832c282009-03-24 08:46:57 +01002055 if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
Johannes Bergf1d58c22009-06-17 13:13:00 +02002056 return ieee80211_ibss_rx_mgmt(sdata, rx->skb);
Johannes Bergf9d540e2007-09-28 14:02:09 +02002057
Johannes Berg7986cf92009-03-21 17:08:43 +01002058 if (sdata->vif.type == NL80211_IFTYPE_STATION)
Johannes Bergf1d58c22009-06-17 13:13:00 +02002059 return ieee80211_sta_rx_mgmt(sdata, rx->skb);
Johannes Berg46900292009-02-15 12:44:28 +01002060
Johannes Berg7986cf92009-03-21 17:08:43 +01002061 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02002062}
2063
Johannes Berg3b8d81e2009-06-17 17:43:56 +02002064static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
Johannes Berg5cf121c2008-02-25 16:27:43 +01002065 struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02002066{
Harvey Harrisona7767f92008-07-02 16:30:51 -07002067 int keyidx;
2068 unsigned int hdrlen;
Johannes Berg571ecf62007-07-27 15:43:22 +02002069
Harvey Harrisona7767f92008-07-02 16:30:51 -07002070 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg571ecf62007-07-27 15:43:22 +02002071 if (rx->skb->len >= hdrlen + 4)
2072 keyidx = rx->skb->data[hdrlen + 3] >> 6;
2073 else
2074 keyidx = -1;
2075
Johannes Berg8944b792008-01-31 19:48:26 +01002076 if (!rx->sta) {
Johannes Bergaa0daf02007-09-10 14:15:25 +02002077 /*
2078 * Some hardware seem to generate incorrect Michael MIC
2079 * reports; ignore them to avoid triggering countermeasures.
2080 */
Johannes Bergaf2ced62009-11-16 12:00:39 +01002081 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002082 }
2083
Harvey Harrisona7767f92008-07-02 16:30:51 -07002084 if (!ieee80211_has_protected(hdr->frame_control))
Johannes Bergaf2ced62009-11-16 12:00:39 +01002085 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002086
Johannes Berg05c914f2008-09-11 00:01:58 +02002087 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
Johannes Bergaa0daf02007-09-10 14:15:25 +02002088 /*
2089 * APs with pairwise keys should never receive Michael MIC
2090 * errors for non-zero keyidx because these are reserved for
2091 * group keys and only the AP is sending real multicast
2092 * frames in the BSS.
2093 */
Johannes Bergaf2ced62009-11-16 12:00:39 +01002094 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002095 }
2096
Harvey Harrisona7767f92008-07-02 16:30:51 -07002097 if (!ieee80211_is_data(hdr->frame_control) &&
2098 !ieee80211_is_auth(hdr->frame_control))
Johannes Bergaf2ced62009-11-16 12:00:39 +01002099 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02002100
Johannes Berge6d6e342009-07-01 21:26:47 +02002101 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2102 GFP_ATOMIC);
Johannes Berg571ecf62007-07-27 15:43:22 +02002103}
2104
Johannes Berg5cf121c2008-02-25 16:27:43 +01002105/* TODO: use IEEE80211_RX_FRAGMENTED */
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002106static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2107 struct ieee80211_rate *rate)
Michael Wu3d30d942008-01-31 19:48:27 +01002108{
2109 struct ieee80211_sub_if_data *sdata;
2110 struct ieee80211_local *local = rx->local;
2111 struct ieee80211_rtap_hdr {
2112 struct ieee80211_radiotap_header hdr;
2113 u8 flags;
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002114 u8 rate_or_pad;
Michael Wu3d30d942008-01-31 19:48:27 +01002115 __le16 chan_freq;
2116 __le16 chan_flags;
2117 } __attribute__ ((packed)) *rthdr;
2118 struct sk_buff *skb = rx->skb, *skb2;
2119 struct net_device *prev_dev = NULL;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002120 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Michael Wu3d30d942008-01-31 19:48:27 +01002121
Johannes Berg8c0c7092009-11-25 17:46:15 +01002122 if (status->flag & RX_FLAG_INTERNAL_CMTR)
Michael Wu3d30d942008-01-31 19:48:27 +01002123 goto out_free_skb;
2124
2125 if (skb_headroom(skb) < sizeof(*rthdr) &&
2126 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2127 goto out_free_skb;
2128
2129 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2130 memset(rthdr, 0, sizeof(*rthdr));
2131 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2132 rthdr->hdr.it_present =
2133 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
Michael Wu3d30d942008-01-31 19:48:27 +01002134 (1 << IEEE80211_RADIOTAP_CHANNEL));
2135
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002136 if (rate) {
2137 rthdr->rate_or_pad = rate->bitrate / 5;
2138 rthdr->hdr.it_present |=
2139 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2140 }
Michael Wu3d30d942008-01-31 19:48:27 +01002141 rthdr->chan_freq = cpu_to_le16(status->freq);
2142
2143 if (status->band == IEEE80211_BAND_5GHZ)
2144 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2145 IEEE80211_CHAN_5GHZ);
2146 else
2147 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2148 IEEE80211_CHAN_2GHZ);
2149
2150 skb_set_mac_header(skb, 0);
2151 skb->ip_summed = CHECKSUM_UNNECESSARY;
2152 skb->pkt_type = PACKET_OTHERHOST;
2153 skb->protocol = htons(ETH_P_802_2);
2154
2155 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg9607e6b2009-12-23 13:15:31 +01002156 if (!ieee80211_sdata_running(sdata))
Michael Wu3d30d942008-01-31 19:48:27 +01002157 continue;
2158
Johannes Berg05c914f2008-09-11 00:01:58 +02002159 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
Michael Wu3d30d942008-01-31 19:48:27 +01002160 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2161 continue;
2162
2163 if (prev_dev) {
2164 skb2 = skb_clone(skb, GFP_ATOMIC);
2165 if (skb2) {
2166 skb2->dev = prev_dev;
2167 netif_rx(skb2);
2168 }
2169 }
2170
2171 prev_dev = sdata->dev;
2172 sdata->dev->stats.rx_packets++;
2173 sdata->dev->stats.rx_bytes += skb->len;
2174 }
2175
2176 if (prev_dev) {
2177 skb->dev = prev_dev;
2178 netif_rx(skb);
2179 skb = NULL;
2180 } else
2181 goto out_free_skb;
2182
Johannes Berg8c0c7092009-11-25 17:46:15 +01002183 status->flag |= RX_FLAG_INTERNAL_CMTR;
Michael Wu3d30d942008-01-31 19:48:27 +01002184 return;
2185
2186 out_free_skb:
2187 dev_kfree_skb(skb);
2188}
2189
Johannes Berg571ecf62007-07-27 15:43:22 +02002190
Johannes Berg8944b792008-01-31 19:48:26 +01002191static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
Johannes Berg5cf121c2008-02-25 16:27:43 +01002192 struct ieee80211_rx_data *rx,
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002193 struct sk_buff *skb,
2194 struct ieee80211_rate *rate)
Johannes Berg58905292008-01-31 19:48:25 +01002195{
Johannes Berg2569a822009-11-25 17:46:17 +01002196 struct sk_buff_head reorder_release;
Johannes Berg58905292008-01-31 19:48:25 +01002197 ieee80211_rx_result res = RX_DROP_MONITOR;
2198
Johannes Berg2569a822009-11-25 17:46:17 +01002199 __skb_queue_head_init(&reorder_release);
2200
Johannes Berg8944b792008-01-31 19:48:26 +01002201 rx->skb = skb;
2202 rx->sdata = sdata;
Johannes Berg8944b792008-01-31 19:48:26 +01002203
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002204#define CALL_RXH(rxh) \
2205 do { \
2206 res = rxh(rx); \
2207 if (res != RX_CONTINUE) \
Johannes Berg2569a822009-11-25 17:46:17 +01002208 goto rxh_next; \
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002209 } while (0);
Johannes Berg58905292008-01-31 19:48:25 +01002210
Johannes Berg2569a822009-11-25 17:46:17 +01002211 /*
2212 * NB: the rxh_next label works even if we jump
2213 * to it from here because then the list will
2214 * be empty, which is a trivial check
2215 */
Johannes Berg49461622008-06-30 15:10:45 +02002216 CALL_RXH(ieee80211_rx_h_passive_scan)
2217 CALL_RXH(ieee80211_rx_h_check)
Johannes Berg2569a822009-11-25 17:46:17 +01002218
2219 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
2220
2221 while ((skb = __skb_dequeue(&reorder_release))) {
2222 /*
2223 * all the other fields are valid across frames
2224 * that belong to an aMPDU since they are on the
2225 * same TID from the same station
2226 */
2227 rx->skb = skb;
2228
2229 CALL_RXH(ieee80211_rx_h_decrypt)
2230 CALL_RXH(ieee80211_rx_h_check_more_data)
2231 CALL_RXH(ieee80211_rx_h_sta_process)
2232 CALL_RXH(ieee80211_rx_h_defragment)
2233 CALL_RXH(ieee80211_rx_h_ps_poll)
2234 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2235 /* must be after MMIC verify so header is counted in MPDU mic */
2236 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2237 CALL_RXH(ieee80211_rx_h_amsdu)
Ingo Molnarbf94e172008-10-12 23:51:38 -07002238#ifdef CONFIG_MAC80211_MESH
Johannes Berg2569a822009-11-25 17:46:17 +01002239 if (ieee80211_vif_is_mesh(&sdata->vif))
2240 CALL_RXH(ieee80211_rx_h_mesh_fwding);
Ingo Molnarbf94e172008-10-12 23:51:38 -07002241#endif
Johannes Berg2569a822009-11-25 17:46:17 +01002242 CALL_RXH(ieee80211_rx_h_data)
2243
2244 /* special treatment -- needs the queue */
2245 res = ieee80211_rx_h_ctrl(rx, &reorder_release);
2246 if (res != RX_CONTINUE)
2247 goto rxh_next;
2248
2249 CALL_RXH(ieee80211_rx_h_action)
2250 CALL_RXH(ieee80211_rx_h_mgmt)
Johannes Berg58905292008-01-31 19:48:25 +01002251
Johannes Berg49461622008-06-30 15:10:45 +02002252#undef CALL_RXH
2253
Johannes Berg2569a822009-11-25 17:46:17 +01002254 rxh_next:
2255 switch (res) {
2256 case RX_DROP_MONITOR:
2257 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
2258 if (rx->sta)
2259 rx->sta->rx_dropped++;
2260 /* fall through */
2261 case RX_CONTINUE:
2262 ieee80211_rx_cooked_monitor(rx, rate);
2263 break;
2264 case RX_DROP_UNUSABLE:
2265 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
2266 if (rx->sta)
2267 rx->sta->rx_dropped++;
2268 dev_kfree_skb(rx->skb);
2269 break;
2270 case RX_QUEUED:
2271 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
2272 break;
2273 }
Johannes Berg58905292008-01-31 19:48:25 +01002274 }
2275}
2276
Johannes Berg571ecf62007-07-27 15:43:22 +02002277/* main receive path */
2278
Johannes Berg23a24de2007-07-27 15:43:22 +02002279static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
Johannes Berg7ab17c42009-02-10 21:25:43 +01002280 struct ieee80211_rx_data *rx,
Johannes Berg23a24de2007-07-27 15:43:22 +02002281 struct ieee80211_hdr *hdr)
2282{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002283 struct sk_buff *skb = rx->skb;
2284 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2285 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
Johannes Berg23a24de2007-07-27 15:43:22 +02002286 int multicast = is_multicast_ether_addr(hdr->addr1);
2287
Johannes Berg51fb61e2007-12-19 01:31:27 +01002288 switch (sdata->vif.type) {
Johannes Berg05c914f2008-09-11 00:01:58 +02002289 case NL80211_IFTYPE_STATION:
Johannes Berg9bc383d2009-11-19 11:55:19 +01002290 if (!bssid && !sdata->u.mgd.use_4addr)
Johannes Berg23a24de2007-07-27 15:43:22 +02002291 return 0;
Johannes Berg77fdaa12009-07-07 03:45:17 +02002292 if (!multicast &&
Johannes Berg47846c92009-11-25 17:46:19 +01002293 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
Johannes Berg4150c572007-09-17 01:29:23 -04002294 if (!(sdata->dev->flags & IFF_PROMISC))
Johannes Berg23a24de2007-07-27 15:43:22 +02002295 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002296 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002297 }
2298 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002299 case NL80211_IFTYPE_ADHOC:
Johannes Berg23a24de2007-07-27 15:43:22 +02002300 if (!bssid)
2301 return 0;
Harvey Harrisona7767f92008-07-02 16:30:51 -07002302 if (ieee80211_is_beacon(hdr->frame_control)) {
Bruno Randolf9d9bf772008-02-18 11:21:36 +09002303 return 1;
Vladimir Koutny87291c02008-06-13 16:50:44 +02002304 }
Johannes Berg46900292009-02-15 12:44:28 +01002305 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
Johannes Berg5cf121c2008-02-25 16:27:43 +01002306 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
Johannes Berg23a24de2007-07-27 15:43:22 +02002307 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002308 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002309 } else if (!multicast &&
Johannes Berg47846c92009-11-25 17:46:19 +01002310 compare_ether_addr(sdata->vif.addr,
Johannes Berg23a24de2007-07-27 15:43:22 +02002311 hdr->addr1) != 0) {
Johannes Berg4150c572007-09-17 01:29:23 -04002312 if (!(sdata->dev->flags & IFF_PROMISC))
Johannes Berg23a24de2007-07-27 15:43:22 +02002313 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002314 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002315 } else if (!rx->sta) {
2316 int rate_idx;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002317 if (status->flag & RX_FLAG_HT)
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002318 rate_idx = 0; /* TODO: HT rates */
2319 else
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002320 rate_idx = status->rate_idx;
Johannes Berg34e89502010-02-03 13:59:58 +01002321 rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
2322 hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002323 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002324 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002325 case NL80211_IFTYPE_MESH_POINT:
Johannes Berg6032f932008-02-23 15:17:07 +01002326 if (!multicast &&
Johannes Berg47846c92009-11-25 17:46:19 +01002327 compare_ether_addr(sdata->vif.addr,
Johannes Berg6032f932008-02-23 15:17:07 +01002328 hdr->addr1) != 0) {
2329 if (!(sdata->dev->flags & IFF_PROMISC))
2330 return 0;
2331
Johannes Berg5cf121c2008-02-25 16:27:43 +01002332 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg6032f932008-02-23 15:17:07 +01002333 }
2334 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002335 case NL80211_IFTYPE_AP_VLAN:
2336 case NL80211_IFTYPE_AP:
Johannes Berg23a24de2007-07-27 15:43:22 +02002337 if (!bssid) {
Johannes Berg47846c92009-11-25 17:46:19 +01002338 if (compare_ether_addr(sdata->vif.addr,
Johannes Berg23a24de2007-07-27 15:43:22 +02002339 hdr->addr1))
2340 return 0;
2341 } else if (!ieee80211_bssid_match(bssid,
Johannes Berg47846c92009-11-25 17:46:19 +01002342 sdata->vif.addr)) {
Johannes Berg5cf121c2008-02-25 16:27:43 +01002343 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
Johannes Berg23a24de2007-07-27 15:43:22 +02002344 return 0;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002345 rx->flags &= ~IEEE80211_RX_RA_MATCH;
Johannes Berg23a24de2007-07-27 15:43:22 +02002346 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002347 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002348 case NL80211_IFTYPE_WDS:
Harvey Harrisona7767f92008-07-02 16:30:51 -07002349 if (bssid || !ieee80211_is_data(hdr->frame_control))
Johannes Berg23a24de2007-07-27 15:43:22 +02002350 return 0;
2351 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2352 return 0;
2353 break;
Johannes Berg05c914f2008-09-11 00:01:58 +02002354 case NL80211_IFTYPE_MONITOR:
Johannes Berg05c914f2008-09-11 00:01:58 +02002355 case NL80211_IFTYPE_UNSPECIFIED:
2356 case __NL80211_IFTYPE_AFTER_LAST:
Johannes Bergfb1c1cd2007-09-26 15:19:43 +02002357 /* should never get here */
2358 WARN_ON(1);
2359 break;
Johannes Berg23a24de2007-07-27 15:43:22 +02002360 }
2361
2362 return 1;
2363}
2364
Johannes Berg571ecf62007-07-27 15:43:22 +02002365/*
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002366 * This is the actual Rx frames handler. as it blongs to Rx path it must
2367 * be called with rcu_read_lock protection.
Johannes Berg571ecf62007-07-27 15:43:22 +02002368 */
Ron Rindjunsky71ebb4a2008-01-21 12:39:12 +02002369static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2370 struct sk_buff *skb,
Johannes Berg8318d782008-01-24 19:38:38 +01002371 struct ieee80211_rate *rate)
Johannes Berg571ecf62007-07-27 15:43:22 +02002372{
Johannes Bergf1d58c22009-06-17 13:13:00 +02002373 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002374 struct ieee80211_local *local = hw_to_local(hw);
2375 struct ieee80211_sub_if_data *sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02002376 struct ieee80211_hdr *hdr;
Zhu Yie3cf8b32010-03-29 17:35:07 +08002377 __le16 fc;
Johannes Berg5cf121c2008-02-25 16:27:43 +01002378 struct ieee80211_rx_data rx;
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002379 int prepares;
Johannes Berg8e6f0032007-07-27 15:43:22 +02002380 struct ieee80211_sub_if_data *prev = NULL;
2381 struct sk_buff *skb_new;
Johannes Bergabe60632009-11-25 17:46:18 +01002382 struct sta_info *sta, *tmp;
2383 bool found_sta = false;
Zhu Yie3cf8b32010-03-29 17:35:07 +08002384 int err = 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002385
Zhu Yie3cf8b32010-03-29 17:35:07 +08002386 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02002387 memset(&rx, 0, sizeof(rx));
2388 rx.skb = skb;
2389 rx.local = local;
Johannes Berg72abd812007-09-17 01:29:22 -04002390
Zhu Yie3cf8b32010-03-29 17:35:07 +08002391 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
Johannes Berg571ecf62007-07-27 15:43:22 +02002392 local->dot11ReceivedFragmentCount++;
Johannes Berg571ecf62007-07-27 15:43:22 +02002393
Helmut Schaa142b9f52009-07-23 13:18:01 +02002394 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2395 test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
Johannes Berg5cf121c2008-02-25 16:27:43 +01002396 rx.flags |= IEEE80211_RX_IN_SCAN;
Johannes Berg571ecf62007-07-27 15:43:22 +02002397
Zhu Yie3cf8b32010-03-29 17:35:07 +08002398 if (ieee80211_is_mgmt(fc))
2399 err = skb_linearize(skb);
2400 else
2401 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
2402
2403 if (err) {
2404 dev_kfree_skb(skb);
2405 return;
2406 }
2407
2408 hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg38f37142008-01-29 17:07:43 +01002409 ieee80211_parse_qos(&rx);
Johannes Bergd1c3a372009-01-07 00:26:10 +01002410 ieee80211_verify_alignment(&rx);
Johannes Berg38f37142008-01-29 17:07:43 +01002411
Zhu Yie3cf8b32010-03-29 17:35:07 +08002412 if (ieee80211_is_data(fc)) {
Johannes Bergabe60632009-11-25 17:46:18 +01002413 for_each_sta_info(local, hdr->addr2, sta, tmp) {
2414 rx.sta = sta;
2415 found_sta = true;
2416 rx.sdata = sta->sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02002417
Johannes Bergabe60632009-11-25 17:46:18 +01002418 rx.flags |= IEEE80211_RX_RA_MATCH;
2419 prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
2420 if (prepares) {
2421 if (status->flag & RX_FLAG_MMIC_ERROR) {
2422 if (rx.flags & IEEE80211_RX_RA_MATCH)
2423 ieee80211_rx_michael_mic_report(hdr, &rx);
2424 } else
2425 prev = rx.sdata;
2426 }
2427 }
2428 }
2429 if (!found_sta) {
2430 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg9607e6b2009-12-23 13:15:31 +01002431 if (!ieee80211_sdata_running(sdata))
Johannes Bergabe60632009-11-25 17:46:18 +01002432 continue;
2433
2434 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2435 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2436 continue;
2437
Johannes Bergabe60632009-11-25 17:46:18 +01002438 /*
2439 * frame is destined for this interface, but if it's
2440 * not also for the previous one we handle that after
2441 * the loop to avoid copying the SKB once too much
2442 */
Johannes Bergb2e77712007-09-26 15:19:39 +02002443
Johannes Bergabe60632009-11-25 17:46:18 +01002444 if (!prev) {
2445 prev = sdata;
2446 continue;
2447 }
Johannes Berg23a24de2007-07-27 15:43:22 +02002448
Felix Fietkau4754ffd2010-01-31 21:50:12 +01002449 rx.sta = sta_info_get_bss(prev, hdr->addr2);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002450
2451 rx.flags |= IEEE80211_RX_RA_MATCH;
2452 prepares = prepare_for_handlers(prev, &rx, hdr);
2453
2454 if (!prepares)
2455 goto next;
2456
2457 if (status->flag & RX_FLAG_MMIC_ERROR) {
2458 rx.sdata = prev;
2459 if (rx.flags & IEEE80211_RX_RA_MATCH)
2460 ieee80211_rx_michael_mic_report(hdr,
2461 &rx);
2462 goto next;
2463 }
2464
Johannes Bergabe60632009-11-25 17:46:18 +01002465 /*
2466 * frame was destined for the previous interface
2467 * so invoke RX handlers for it
2468 */
Johannes Berg8e6f0032007-07-27 15:43:22 +02002469
Johannes Bergabe60632009-11-25 17:46:18 +01002470 skb_new = skb_copy(skb, GFP_ATOMIC);
2471 if (!skb_new) {
2472 if (net_ratelimit())
2473 printk(KERN_DEBUG "%s: failed to copy "
2474 "multicast frame for %s\n",
2475 wiphy_name(local->hw.wiphy),
Johannes Berg47846c92009-11-25 17:46:19 +01002476 prev->name);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002477 goto next;
Johannes Bergabe60632009-11-25 17:46:18 +01002478 }
2479 ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002480next:
Johannes Berg340e11f2007-07-27 15:43:22 +02002481 prev = sdata;
Johannes Berg8e6f0032007-07-27 15:43:22 +02002482 }
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002483
2484 if (prev) {
Felix Fietkau4754ffd2010-01-31 21:50:12 +01002485 rx.sta = sta_info_get_bss(prev, hdr->addr2);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01002486
2487 rx.flags |= IEEE80211_RX_RA_MATCH;
2488 prepares = prepare_for_handlers(prev, &rx, hdr);
2489
2490 if (!prepares)
2491 prev = NULL;
2492 }
Johannes Berg571ecf62007-07-27 15:43:22 +02002493 }
Harvey Harrisona4b7d7b2008-07-15 18:44:14 -07002494 if (prev)
Johannes Berg5f0b7de2009-11-16 13:58:21 +01002495 ieee80211_invoke_rx_handlers(prev, &rx, skb, rate);
Harvey Harrisona4b7d7b2008-07-15 18:44:14 -07002496 else
Johannes Berg8e6f0032007-07-27 15:43:22 +02002497 dev_kfree_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002498}
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002499
2500/*
2501 * This is the receive path handler. It is called by a low level driver when an
2502 * 802.11 MPDU is received from the hardware.
2503 */
John W. Linville103bf9f2009-08-20 16:34:15 -04002504void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002505{
2506 struct ieee80211_local *local = hw_to_local(hw);
Johannes Berg8318d782008-01-24 19:38:38 +01002507 struct ieee80211_rate *rate = NULL;
2508 struct ieee80211_supported_band *sband;
Johannes Bergf1d58c22009-06-17 13:13:00 +02002509 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg8318d782008-01-24 19:38:38 +01002510
Johannes Bergd20ef632009-10-11 15:10:40 +02002511 WARN_ON_ONCE(softirq_count() == 0);
2512
Johannes Berg77a980d2009-08-24 11:46:30 +02002513 if (WARN_ON(status->band < 0 ||
2514 status->band >= IEEE80211_NUM_BANDS))
2515 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01002516
2517 sband = local->hw.wiphy->bands[status->band];
Johannes Berg77a980d2009-08-24 11:46:30 +02002518 if (WARN_ON(!sband))
2519 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01002520
Johannes Berg89c3a8a2009-07-28 18:10:17 +02002521 /*
2522 * If we're suspending, it is possible although not too likely
2523 * that we'd be receiving frames after having already partially
2524 * quiesced the stack. We can't process such frames then since
2525 * that might, for example, cause stations to be added or other
2526 * driver callbacks be invoked.
2527 */
Johannes Berg77a980d2009-08-24 11:46:30 +02002528 if (unlikely(local->quiescing || local->suspended))
2529 goto drop;
Johannes Berg89c3a8a2009-07-28 18:10:17 +02002530
Johannes Bergea77f122009-08-21 14:44:45 +02002531 /*
2532 * The same happens when we're not even started,
2533 * but that's worth a warning.
2534 */
Johannes Berg77a980d2009-08-24 11:46:30 +02002535 if (WARN_ON(!local->started))
2536 goto drop;
Johannes Bergea77f122009-08-21 14:44:45 +02002537
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002538 if (status->flag & RX_FLAG_HT) {
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05002539 /*
2540 * rate_idx is MCS index, which can be [0-76] as documented on:
2541 *
2542 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2543 *
2544 * Anything else would be some sort of driver or hardware error.
2545 * The driver should catch hardware errors.
2546 */
2547 if (WARN((status->rate_idx < 0 ||
2548 status->rate_idx > 76),
2549 "Rate marked as an HT rate but passed "
2550 "status->rate_idx is not "
2551 "an MCS index [0-76]: %d (0x%02x)\n",
2552 status->rate_idx,
2553 status->rate_idx))
Johannes Berg77a980d2009-08-24 11:46:30 +02002554 goto drop;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002555 } else {
2556 if (WARN_ON(status->rate_idx < 0 ||
2557 status->rate_idx >= sband->n_bitrates))
Johannes Berg77a980d2009-08-24 11:46:30 +02002558 goto drop;
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02002559 rate = &sband->bitrates[status->rate_idx];
2560 }
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002561
2562 /*
2563 * key references and virtual interfaces are protected using RCU
2564 * and this requires that we are in a read-side RCU section during
2565 * receive processing
2566 */
2567 rcu_read_lock();
2568
2569 /*
2570 * Frames with failed FCS/PLCP checksum are not returned,
2571 * all other frames are returned without radiotap header
2572 * if it was previously present.
2573 * Also, frames with less than 16 bytes are dropped.
2574 */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002575 skb = ieee80211_rx_monitor(local, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002576 if (!skb) {
2577 rcu_read_unlock();
2578 return;
2579 }
2580
Johannes Berg2569a822009-11-25 17:46:17 +01002581 __ieee80211_rx_handle_packet(hw, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002582
2583 rcu_read_unlock();
Johannes Berg77a980d2009-08-24 11:46:30 +02002584
2585 return;
2586 drop:
2587 kfree_skb(skb);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02002588}
John W. Linville103bf9f2009-08-20 16:34:15 -04002589EXPORT_SYMBOL(ieee80211_rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02002590
2591/* This is a version of the rx handler that can be called from hard irq
2592 * context. Post the skb on the queue and schedule the tasklet */
Johannes Bergf1d58c22009-06-17 13:13:00 +02002593void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
Johannes Berg571ecf62007-07-27 15:43:22 +02002594{
2595 struct ieee80211_local *local = hw_to_local(hw);
2596
2597 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2598
Johannes Berg571ecf62007-07-27 15:43:22 +02002599 skb->pkt_type = IEEE80211_RX_MSG;
2600 skb_queue_tail(&local->skb_queue, skb);
2601 tasklet_schedule(&local->tasklet);
2602}
2603EXPORT_SYMBOL(ieee80211_rx_irqsafe);