rx.c 70 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532
  1. /*
  2. * Copyright 2002-2005, Instant802 Networks, Inc.
  3. * Copyright 2005-2006, Devicescape Software, Inc.
  4. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  5. * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License version 2 as
  9. * published by the Free Software Foundation.
  10. */
  11. #include <linux/jiffies.h>
  12. #include <linux/kernel.h>
  13. #include <linux/skbuff.h>
  14. #include <linux/netdevice.h>
  15. #include <linux/etherdevice.h>
  16. #include <linux/rcupdate.h>
  17. #include <net/mac80211.h>
  18. #include <net/ieee80211_radiotap.h>
  19. #include "ieee80211_i.h"
  20. #include "driver-ops.h"
  21. #include "led.h"
  22. #include "mesh.h"
  23. #include "wep.h"
  24. #include "wpa.h"
  25. #include "tkip.h"
  26. #include "wme.h"
  27. static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  28. struct tid_ampdu_rx *tid_agg_rx,
  29. struct sk_buff *skb,
  30. struct ieee80211_rx_status *status,
  31. u16 mpdu_seq_num,
  32. int bar_req);
  33. /*
  34. * monitor mode reception
  35. *
  36. * This function cleans up the SKB, i.e. it removes all the stuff
  37. * only useful for monitoring.
  38. */
  39. static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  40. struct sk_buff *skb,
  41. int rtap_len)
  42. {
  43. skb_pull(skb, rtap_len);
  44. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
  45. if (likely(skb->len > FCS_LEN))
  46. skb_trim(skb, skb->len - FCS_LEN);
  47. else {
  48. /* driver bug */
  49. WARN_ON(1);
  50. dev_kfree_skb(skb);
  51. skb = NULL;
  52. }
  53. }
  54. return skb;
  55. }
  56. static inline int should_drop_frame(struct ieee80211_rx_status *status,
  57. struct sk_buff *skb,
  58. int present_fcs_len,
  59. int radiotap_len)
  60. {
  61. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  62. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  63. return 1;
  64. if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
  65. return 1;
  66. if (ieee80211_is_ctl(hdr->frame_control) &&
  67. !ieee80211_is_pspoll(hdr->frame_control) &&
  68. !ieee80211_is_back_req(hdr->frame_control))
  69. return 1;
  70. return 0;
  71. }
  72. static int
  73. ieee80211_rx_radiotap_len(struct ieee80211_local *local,
  74. struct ieee80211_rx_status *status)
  75. {
  76. int len;
  77. /* always present fields */
  78. len = sizeof(struct ieee80211_radiotap_header) + 9;
  79. if (status->flag & RX_FLAG_TSFT)
  80. len += 8;
  81. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
  82. len += 1;
  83. if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
  84. len += 1;
  85. if (len & 1) /* padding for RX_FLAGS if necessary */
  86. len++;
  87. /* make sure radiotap starts at a naturally aligned address */
  88. if (len % 8)
  89. len = roundup(len, 8);
  90. return len;
  91. }
  92. /*
  93. * ieee80211_add_rx_radiotap_header - add radiotap header
  94. *
  95. * add a radiotap header containing all the fields which the hardware provided.
  96. */
  97. static void
  98. ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
  99. struct sk_buff *skb,
  100. struct ieee80211_rx_status *status,
  101. struct ieee80211_rate *rate,
  102. int rtap_len)
  103. {
  104. struct ieee80211_radiotap_header *rthdr;
  105. unsigned char *pos;
  106. rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
  107. memset(rthdr, 0, rtap_len);
  108. /* radiotap header, set always present flags */
  109. rthdr->it_present =
  110. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  111. (1 << IEEE80211_RADIOTAP_CHANNEL) |
  112. (1 << IEEE80211_RADIOTAP_ANTENNA) |
  113. (1 << IEEE80211_RADIOTAP_RX_FLAGS));
  114. rthdr->it_len = cpu_to_le16(rtap_len);
  115. pos = (unsigned char *)(rthdr+1);
  116. /* the order of the following fields is important */
  117. /* IEEE80211_RADIOTAP_TSFT */
  118. if (status->flag & RX_FLAG_TSFT) {
  119. *(__le64 *)pos = cpu_to_le64(status->mactime);
  120. rthdr->it_present |=
  121. cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
  122. pos += 8;
  123. }
  124. /* IEEE80211_RADIOTAP_FLAGS */
  125. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  126. *pos |= IEEE80211_RADIOTAP_F_FCS;
  127. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  128. *pos |= IEEE80211_RADIOTAP_F_BADFCS;
  129. if (status->flag & RX_FLAG_SHORTPRE)
  130. *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
  131. pos++;
  132. /* IEEE80211_RADIOTAP_RATE */
  133. if (status->flag & RX_FLAG_HT) {
  134. /*
  135. * TODO: add following information into radiotap header once
  136. * suitable fields are defined for it:
  137. * - MCS index (status->rate_idx)
  138. * - HT40 (status->flag & RX_FLAG_40MHZ)
  139. * - short-GI (status->flag & RX_FLAG_SHORT_GI)
  140. */
  141. *pos = 0;
  142. } else {
  143. rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
  144. *pos = rate->bitrate / 5;
  145. }
  146. pos++;
  147. /* IEEE80211_RADIOTAP_CHANNEL */
  148. *(__le16 *)pos = cpu_to_le16(status->freq);
  149. pos += 2;
  150. if (status->band == IEEE80211_BAND_5GHZ)
  151. *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
  152. IEEE80211_CHAN_5GHZ);
  153. else if (rate->flags & IEEE80211_RATE_ERP_G)
  154. *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
  155. IEEE80211_CHAN_2GHZ);
  156. else
  157. *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
  158. IEEE80211_CHAN_2GHZ);
  159. pos += 2;
  160. /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
  161. if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
  162. *pos = status->signal;
  163. rthdr->it_present |=
  164. cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
  165. pos++;
  166. }
  167. /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
  168. if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
  169. *pos = status->noise;
  170. rthdr->it_present |=
  171. cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
  172. pos++;
  173. }
  174. /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
  175. /* IEEE80211_RADIOTAP_ANTENNA */
  176. *pos = status->antenna;
  177. pos++;
  178. /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
  179. /* IEEE80211_RADIOTAP_RX_FLAGS */
  180. /* ensure 2 byte alignment for the 2 byte field as required */
  181. if ((pos - (unsigned char *)rthdr) & 1)
  182. pos++;
  183. if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
  184. *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADPLCP);
  185. pos += 2;
  186. }
  187. /*
  188. * This function copies a received frame to all monitor interfaces and
  189. * returns a cleaned-up SKB that no longer includes the FCS nor the
  190. * radiotap header the driver might have added.
  191. */
  192. static struct sk_buff *
  193. ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
  194. struct ieee80211_rx_status *status,
  195. struct ieee80211_rate *rate)
  196. {
  197. struct ieee80211_sub_if_data *sdata;
  198. int needed_headroom = 0;
  199. struct sk_buff *skb, *skb2;
  200. struct net_device *prev_dev = NULL;
  201. int present_fcs_len = 0;
  202. int rtap_len = 0;
  203. /*
  204. * First, we may need to make a copy of the skb because
  205. * (1) we need to modify it for radiotap (if not present), and
  206. * (2) the other RX handlers will modify the skb we got.
  207. *
  208. * We don't need to, of course, if we aren't going to return
  209. * the SKB because it has a bad FCS/PLCP checksum.
  210. */
  211. if (status->flag & RX_FLAG_RADIOTAP)
  212. rtap_len = ieee80211_get_radiotap_len(origskb->data);
  213. else
  214. /* room for the radiotap header based on driver features */
  215. needed_headroom = ieee80211_rx_radiotap_len(local, status);
  216. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  217. present_fcs_len = FCS_LEN;
  218. if (!local->monitors) {
  219. if (should_drop_frame(status, origskb, present_fcs_len,
  220. rtap_len)) {
  221. dev_kfree_skb(origskb);
  222. return NULL;
  223. }
  224. return remove_monitor_info(local, origskb, rtap_len);
  225. }
  226. if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
  227. /* only need to expand headroom if necessary */
  228. skb = origskb;
  229. origskb = NULL;
  230. /*
  231. * This shouldn't trigger often because most devices have an
  232. * RX header they pull before we get here, and that should
  233. * be big enough for our radiotap information. We should
  234. * probably export the length to drivers so that we can have
  235. * them allocate enough headroom to start with.
  236. */
  237. if (skb_headroom(skb) < needed_headroom &&
  238. pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
  239. dev_kfree_skb(skb);
  240. return NULL;
  241. }
  242. } else {
  243. /*
  244. * Need to make a copy and possibly remove radiotap header
  245. * and FCS from the original.
  246. */
  247. skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
  248. origskb = remove_monitor_info(local, origskb, rtap_len);
  249. if (!skb)
  250. return origskb;
  251. }
  252. /* if necessary, prepend radiotap information */
  253. if (!(status->flag & RX_FLAG_RADIOTAP))
  254. ieee80211_add_rx_radiotap_header(local, skb, status, rate,
  255. needed_headroom);
  256. skb_reset_mac_header(skb);
  257. skb->ip_summed = CHECKSUM_UNNECESSARY;
  258. skb->pkt_type = PACKET_OTHERHOST;
  259. skb->protocol = htons(ETH_P_802_2);
  260. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  261. if (!netif_running(sdata->dev))
  262. continue;
  263. if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
  264. continue;
  265. if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
  266. continue;
  267. if (prev_dev) {
  268. skb2 = skb_clone(skb, GFP_ATOMIC);
  269. if (skb2) {
  270. skb2->dev = prev_dev;
  271. netif_rx(skb2);
  272. }
  273. }
  274. prev_dev = sdata->dev;
  275. sdata->dev->stats.rx_packets++;
  276. sdata->dev->stats.rx_bytes += skb->len;
  277. }
  278. if (prev_dev) {
  279. skb->dev = prev_dev;
  280. netif_rx(skb);
  281. } else
  282. dev_kfree_skb(skb);
  283. return origskb;
  284. }
  285. static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  286. {
  287. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  288. int tid;
  289. /* does the frame have a qos control field? */
  290. if (ieee80211_is_data_qos(hdr->frame_control)) {
  291. u8 *qc = ieee80211_get_qos_ctl(hdr);
  292. /* frame has qos control */
  293. tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
  294. if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
  295. rx->flags |= IEEE80211_RX_AMSDU;
  296. else
  297. rx->flags &= ~IEEE80211_RX_AMSDU;
  298. } else {
  299. /*
  300. * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
  301. *
  302. * Sequence numbers for management frames, QoS data
  303. * frames with a broadcast/multicast address in the
  304. * Address 1 field, and all non-QoS data frames sent
  305. * by QoS STAs are assigned using an additional single
  306. * modulo-4096 counter, [...]
  307. *
  308. * We also use that counter for non-QoS STAs.
  309. */
  310. tid = NUM_RX_DATA_QUEUES - 1;
  311. }
  312. rx->queue = tid;
  313. /* Set skb->priority to 1d tag if highest order bit of TID is not set.
  314. * For now, set skb->priority to 0 for other cases. */
  315. rx->skb->priority = (tid > 7) ? 0 : tid;
  316. }
  317. /**
  318. * DOC: Packet alignment
  319. *
  320. * Drivers always need to pass packets that are aligned to two-byte boundaries
  321. * to the stack.
  322. *
  323. * Additionally, should, if possible, align the payload data in a way that
  324. * guarantees that the contained IP header is aligned to a four-byte
  325. * boundary. In the case of regular frames, this simply means aligning the
  326. * payload to a four-byte boundary (because either the IP header is directly
  327. * contained, or IV/RFC1042 headers that have a length divisible by four are
  328. * in front of it).
  329. *
  330. * With A-MSDU frames, however, the payload data address must yield two modulo
  331. * four because there are 14-byte 802.3 headers within the A-MSDU frames that
  332. * push the IP header further back to a multiple of four again. Thankfully, the
  333. * specs were sane enough this time around to require padding each A-MSDU
  334. * subframe to a length that is a multiple of four.
  335. *
  336. * Padding like Atheros hardware adds which is inbetween the 802.11 header and
  337. * the payload is not supported, the driver is required to move the 802.11
  338. * header to be directly in front of the payload in that case.
  339. */
  340. static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
  341. {
  342. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  343. int hdrlen;
  344. #ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
  345. return;
  346. #endif
  347. if (WARN_ONCE((unsigned long)rx->skb->data & 1,
  348. "unaligned packet at 0x%p\n", rx->skb->data))
  349. return;
  350. if (!ieee80211_is_data_present(hdr->frame_control))
  351. return;
  352. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  353. if (rx->flags & IEEE80211_RX_AMSDU)
  354. hdrlen += ETH_HLEN;
  355. WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
  356. "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
  357. }
  358. /* rx handlers */
  359. static ieee80211_rx_result debug_noinline
  360. ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
  361. {
  362. struct ieee80211_local *local = rx->local;
  363. struct sk_buff *skb = rx->skb;
  364. if (unlikely(local->hw_scanning))
  365. return ieee80211_scan_rx(rx->sdata, skb, rx->status);
  366. if (unlikely(local->sw_scanning)) {
  367. /* drop all the other packets during a software scan anyway */
  368. if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
  369. != RX_QUEUED)
  370. dev_kfree_skb(skb);
  371. return RX_QUEUED;
  372. }
  373. if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
  374. /* scanning finished during invoking of handlers */
  375. I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
  376. return RX_DROP_UNUSABLE;
  377. }
  378. return RX_CONTINUE;
  379. }
  380. static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
  381. {
  382. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  383. if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
  384. return 0;
  385. return ieee80211_is_robust_mgmt_frame(hdr);
  386. }
  387. static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
  388. {
  389. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  390. if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
  391. return 0;
  392. return ieee80211_is_robust_mgmt_frame(hdr);
  393. }
  394. /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
  395. static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
  396. {
  397. struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
  398. struct ieee80211_mmie *mmie;
  399. if (skb->len < 24 + sizeof(*mmie) ||
  400. !is_multicast_ether_addr(hdr->da))
  401. return -1;
  402. if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
  403. return -1; /* not a robust management frame */
  404. mmie = (struct ieee80211_mmie *)
  405. (skb->data + skb->len - sizeof(*mmie));
  406. if (mmie->element_id != WLAN_EID_MMIE ||
  407. mmie->length != sizeof(*mmie) - 2)
  408. return -1;
  409. return le16_to_cpu(mmie->key_id);
  410. }
  411. static ieee80211_rx_result
  412. ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
  413. {
  414. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  415. unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
  416. if (ieee80211_is_data(hdr->frame_control)) {
  417. if (!ieee80211_has_a4(hdr->frame_control))
  418. return RX_DROP_MONITOR;
  419. if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
  420. return RX_DROP_MONITOR;
  421. }
  422. /* If there is not an established peer link and this is not a peer link
  423. * establisment frame, beacon or probe, drop the frame.
  424. */
  425. if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
  426. struct ieee80211_mgmt *mgmt;
  427. if (!ieee80211_is_mgmt(hdr->frame_control))
  428. return RX_DROP_MONITOR;
  429. if (ieee80211_is_action(hdr->frame_control)) {
  430. mgmt = (struct ieee80211_mgmt *)hdr;
  431. if (mgmt->u.action.category != PLINK_CATEGORY)
  432. return RX_DROP_MONITOR;
  433. return RX_CONTINUE;
  434. }
  435. if (ieee80211_is_probe_req(hdr->frame_control) ||
  436. ieee80211_is_probe_resp(hdr->frame_control) ||
  437. ieee80211_is_beacon(hdr->frame_control))
  438. return RX_CONTINUE;
  439. return RX_DROP_MONITOR;
  440. }
  441. #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
  442. if (ieee80211_is_data(hdr->frame_control) &&
  443. is_multicast_ether_addr(hdr->addr1) &&
  444. mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
  445. return RX_DROP_MONITOR;
  446. #undef msh_h_get
  447. return RX_CONTINUE;
  448. }
  449. static ieee80211_rx_result debug_noinline
  450. ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
  451. {
  452. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  453. /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
  454. if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
  455. if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
  456. rx->sta->last_seq_ctrl[rx->queue] ==
  457. hdr->seq_ctrl)) {
  458. if (rx->flags & IEEE80211_RX_RA_MATCH) {
  459. rx->local->dot11FrameDuplicateCount++;
  460. rx->sta->num_duplicates++;
  461. }
  462. return RX_DROP_MONITOR;
  463. } else
  464. rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
  465. }
  466. if (unlikely(rx->skb->len < 16)) {
  467. I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
  468. return RX_DROP_MONITOR;
  469. }
  470. /* Drop disallowed frame classes based on STA auth/assoc state;
  471. * IEEE 802.11, Chap 5.5.
  472. *
  473. * mac80211 filters only based on association state, i.e. it drops
  474. * Class 3 frames from not associated stations. hostapd sends
  475. * deauth/disassoc frames when needed. In addition, hostapd is
  476. * responsible for filtering on both auth and assoc states.
  477. */
  478. if (ieee80211_vif_is_mesh(&rx->sdata->vif))
  479. return ieee80211_rx_mesh_check(rx);
  480. if (unlikely((ieee80211_is_data(hdr->frame_control) ||
  481. ieee80211_is_pspoll(hdr->frame_control)) &&
  482. rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
  483. (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
  484. if ((!ieee80211_has_fromds(hdr->frame_control) &&
  485. !ieee80211_has_tods(hdr->frame_control) &&
  486. ieee80211_is_data(hdr->frame_control)) ||
  487. !(rx->flags & IEEE80211_RX_RA_MATCH)) {
  488. /* Drop IBSS frames and frames for other hosts
  489. * silently. */
  490. return RX_DROP_MONITOR;
  491. }
  492. return RX_DROP_MONITOR;
  493. }
  494. return RX_CONTINUE;
  495. }
  496. static ieee80211_rx_result debug_noinline
  497. ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
  498. {
  499. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  500. int keyidx;
  501. int hdrlen;
  502. ieee80211_rx_result result = RX_DROP_UNUSABLE;
  503. struct ieee80211_key *stakey = NULL;
  504. int mmie_keyidx = -1;
  505. /*
  506. * Key selection 101
  507. *
  508. * There are four types of keys:
  509. * - GTK (group keys)
  510. * - IGTK (group keys for management frames)
  511. * - PTK (pairwise keys)
  512. * - STK (station-to-station pairwise keys)
  513. *
  514. * When selecting a key, we have to distinguish between multicast
  515. * (including broadcast) and unicast frames, the latter can only
  516. * use PTKs and STKs while the former always use GTKs and IGTKs.
  517. * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
  518. * unicast frames can also use key indices like GTKs. Hence, if we
  519. * don't have a PTK/STK we check the key index for a WEP key.
  520. *
  521. * Note that in a regular BSS, multicast frames are sent by the
  522. * AP only, associated stations unicast the frame to the AP first
  523. * which then multicasts it on their behalf.
  524. *
  525. * There is also a slight problem in IBSS mode: GTKs are negotiated
  526. * with each station, that is something we don't currently handle.
  527. * The spec seems to expect that one negotiates the same key with
  528. * every station but there's no such requirement; VLANs could be
  529. * possible.
  530. */
  531. if (!ieee80211_has_protected(hdr->frame_control)) {
  532. if (!ieee80211_is_mgmt(hdr->frame_control) ||
  533. rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
  534. return RX_CONTINUE;
  535. mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
  536. if (mmie_keyidx < 0)
  537. return RX_CONTINUE;
  538. }
  539. /*
  540. * No point in finding a key and decrypting if the frame is neither
  541. * addressed to us nor a multicast frame.
  542. */
  543. if (!(rx->flags & IEEE80211_RX_RA_MATCH))
  544. return RX_CONTINUE;
  545. if (rx->sta)
  546. stakey = rcu_dereference(rx->sta->key);
  547. if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
  548. rx->key = stakey;
  549. } else if (mmie_keyidx >= 0) {
  550. /* Broadcast/multicast robust management frame / BIP */
  551. if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
  552. (rx->status->flag & RX_FLAG_IV_STRIPPED))
  553. return RX_CONTINUE;
  554. if (mmie_keyidx < NUM_DEFAULT_KEYS ||
  555. mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
  556. return RX_DROP_MONITOR; /* unexpected BIP keyidx */
  557. rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
  558. } else {
  559. /*
  560. * The device doesn't give us the IV so we won't be
  561. * able to look up the key. That's ok though, we
  562. * don't need to decrypt the frame, we just won't
  563. * be able to keep statistics accurate.
  564. * Except for key threshold notifications, should
  565. * we somehow allow the driver to tell us which key
  566. * the hardware used if this flag is set?
  567. */
  568. if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
  569. (rx->status->flag & RX_FLAG_IV_STRIPPED))
  570. return RX_CONTINUE;
  571. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  572. if (rx->skb->len < 8 + hdrlen)
  573. return RX_DROP_UNUSABLE; /* TODO: count this? */
  574. /*
  575. * no need to call ieee80211_wep_get_keyidx,
  576. * it verifies a bunch of things we've done already
  577. */
  578. keyidx = rx->skb->data[hdrlen + 3] >> 6;
  579. rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
  580. /*
  581. * RSNA-protected unicast frames should always be sent with
  582. * pairwise or station-to-station keys, but for WEP we allow
  583. * using a key index as well.
  584. */
  585. if (rx->key && rx->key->conf.alg != ALG_WEP &&
  586. !is_multicast_ether_addr(hdr->addr1))
  587. rx->key = NULL;
  588. }
  589. if (rx->key) {
  590. rx->key->tx_rx_count++;
  591. /* TODO: add threshold stuff again */
  592. } else {
  593. return RX_DROP_MONITOR;
  594. }
  595. /* Check for weak IVs if possible */
  596. if (rx->sta && rx->key->conf.alg == ALG_WEP &&
  597. ieee80211_is_data(hdr->frame_control) &&
  598. (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
  599. !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
  600. ieee80211_wep_is_weak_iv(rx->skb, rx->key))
  601. rx->sta->wep_weak_iv_count++;
  602. switch (rx->key->conf.alg) {
  603. case ALG_WEP:
  604. result = ieee80211_crypto_wep_decrypt(rx);
  605. break;
  606. case ALG_TKIP:
  607. result = ieee80211_crypto_tkip_decrypt(rx);
  608. break;
  609. case ALG_CCMP:
  610. result = ieee80211_crypto_ccmp_decrypt(rx);
  611. break;
  612. case ALG_AES_CMAC:
  613. result = ieee80211_crypto_aes_cmac_decrypt(rx);
  614. break;
  615. }
  616. /* either the frame has been decrypted or will be dropped */
  617. rx->status->flag |= RX_FLAG_DECRYPTED;
  618. return result;
  619. }
  620. static ieee80211_rx_result debug_noinline
  621. ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
  622. {
  623. struct ieee80211_local *local;
  624. struct ieee80211_hdr *hdr;
  625. struct sk_buff *skb;
  626. local = rx->local;
  627. skb = rx->skb;
  628. hdr = (struct ieee80211_hdr *) skb->data;
  629. if (!local->pspolling)
  630. return RX_CONTINUE;
  631. if (!ieee80211_has_fromds(hdr->frame_control))
  632. /* this is not from AP */
  633. return RX_CONTINUE;
  634. if (!ieee80211_is_data(hdr->frame_control))
  635. return RX_CONTINUE;
  636. if (!ieee80211_has_moredata(hdr->frame_control)) {
  637. /* AP has no more frames buffered for us */
  638. local->pspolling = false;
  639. return RX_CONTINUE;
  640. }
  641. /* more data bit is set, let's request a new frame from the AP */
  642. ieee80211_send_pspoll(local, rx->sdata);
  643. return RX_CONTINUE;
  644. }
  645. static void ap_sta_ps_start(struct sta_info *sta)
  646. {
  647. struct ieee80211_sub_if_data *sdata = sta->sdata;
  648. struct ieee80211_local *local = sdata->local;
  649. atomic_inc(&sdata->bss->num_sta_ps);
  650. set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
  651. drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
  652. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  653. printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
  654. sdata->dev->name, sta->sta.addr, sta->sta.aid);
  655. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  656. }
  657. static int ap_sta_ps_end(struct sta_info *sta)
  658. {
  659. struct ieee80211_sub_if_data *sdata = sta->sdata;
  660. struct ieee80211_local *local = sdata->local;
  661. struct sk_buff *skb;
  662. int sent = 0;
  663. atomic_dec(&sdata->bss->num_sta_ps);
  664. clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
  665. drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
  666. if (!skb_queue_empty(&sta->ps_tx_buf))
  667. sta_info_clear_tim_bit(sta);
  668. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  669. printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
  670. sdata->dev->name, sta->sta.addr, sta->sta.aid);
  671. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  672. /* Send all buffered frames to the station */
  673. while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
  674. sent++;
  675. skb->requeue = 1;
  676. dev_queue_xmit(skb);
  677. }
  678. while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
  679. local->total_ps_buffered--;
  680. sent++;
  681. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  682. printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
  683. "since STA not sleeping anymore\n", sdata->dev->name,
  684. sta->sta.addr, sta->sta.aid);
  685. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  686. skb->requeue = 1;
  687. dev_queue_xmit(skb);
  688. }
  689. return sent;
  690. }
  691. static ieee80211_rx_result debug_noinline
  692. ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
  693. {
  694. struct sta_info *sta = rx->sta;
  695. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  696. if (!sta)
  697. return RX_CONTINUE;
  698. /* Update last_rx only for IBSS packets which are for the current
  699. * BSSID to avoid keeping the current IBSS network alive in cases where
  700. * other STAs are using different BSSID. */
  701. if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
  702. u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
  703. NL80211_IFTYPE_ADHOC);
  704. if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
  705. sta->last_rx = jiffies;
  706. } else
  707. if (!is_multicast_ether_addr(hdr->addr1) ||
  708. rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
  709. /* Update last_rx only for unicast frames in order to prevent
  710. * the Probe Request frames (the only broadcast frames from a
  711. * STA in infrastructure mode) from keeping a connection alive.
  712. * Mesh beacons will update last_rx when if they are found to
  713. * match the current local configuration when processed.
  714. */
  715. if (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
  716. ieee80211_is_beacon(hdr->frame_control)) {
  717. rx->sdata->u.mgd.last_beacon = jiffies;
  718. } else
  719. sta->last_rx = jiffies;
  720. }
  721. if (!(rx->flags & IEEE80211_RX_RA_MATCH))
  722. return RX_CONTINUE;
  723. if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
  724. ieee80211_sta_rx_notify(rx->sdata, hdr);
  725. sta->rx_fragments++;
  726. sta->rx_bytes += rx->skb->len;
  727. sta->last_signal = rx->status->signal;
  728. sta->last_qual = rx->status->qual;
  729. sta->last_noise = rx->status->noise;
  730. /*
  731. * Change STA power saving mode only at the end of a frame
  732. * exchange sequence.
  733. */
  734. if (!ieee80211_has_morefrags(hdr->frame_control) &&
  735. (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
  736. rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
  737. if (test_sta_flags(sta, WLAN_STA_PS)) {
  738. /*
  739. * Ignore doze->wake transitions that are
  740. * indicated by non-data frames, the standard
  741. * is unclear here, but for example going to
  742. * PS mode and then scanning would cause a
  743. * doze->wake transition for the probe request,
  744. * and that is clearly undesirable.
  745. */
  746. if (ieee80211_is_data(hdr->frame_control) &&
  747. !ieee80211_has_pm(hdr->frame_control))
  748. rx->sent_ps_buffered += ap_sta_ps_end(sta);
  749. } else {
  750. if (ieee80211_has_pm(hdr->frame_control))
  751. ap_sta_ps_start(sta);
  752. }
  753. }
  754. /* Drop data::nullfunc frames silently, since they are used only to
  755. * control station power saving mode. */
  756. if (ieee80211_is_nullfunc(hdr->frame_control)) {
  757. I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
  758. /* Update counter and free packet here to avoid counting this
  759. * as a dropped packed. */
  760. sta->rx_packets++;
  761. dev_kfree_skb(rx->skb);
  762. return RX_QUEUED;
  763. }
  764. return RX_CONTINUE;
  765. } /* ieee80211_rx_h_sta_process */
  766. static inline struct ieee80211_fragment_entry *
  767. ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
  768. unsigned int frag, unsigned int seq, int rx_queue,
  769. struct sk_buff **skb)
  770. {
  771. struct ieee80211_fragment_entry *entry;
  772. int idx;
  773. idx = sdata->fragment_next;
  774. entry = &sdata->fragments[sdata->fragment_next++];
  775. if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
  776. sdata->fragment_next = 0;
  777. if (!skb_queue_empty(&entry->skb_list)) {
  778. #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
  779. struct ieee80211_hdr *hdr =
  780. (struct ieee80211_hdr *) entry->skb_list.next->data;
  781. printk(KERN_DEBUG "%s: RX reassembly removed oldest "
  782. "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
  783. "addr1=%pM addr2=%pM\n",
  784. sdata->dev->name, idx,
  785. jiffies - entry->first_frag_time, entry->seq,
  786. entry->last_frag, hdr->addr1, hdr->addr2);
  787. #endif
  788. __skb_queue_purge(&entry->skb_list);
  789. }
  790. __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
  791. *skb = NULL;
  792. entry->first_frag_time = jiffies;
  793. entry->seq = seq;
  794. entry->rx_queue = rx_queue;
  795. entry->last_frag = frag;
  796. entry->ccmp = 0;
  797. entry->extra_len = 0;
  798. return entry;
  799. }
  800. static inline struct ieee80211_fragment_entry *
  801. ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
  802. unsigned int frag, unsigned int seq,
  803. int rx_queue, struct ieee80211_hdr *hdr)
  804. {
  805. struct ieee80211_fragment_entry *entry;
  806. int i, idx;
  807. idx = sdata->fragment_next;
  808. for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
  809. struct ieee80211_hdr *f_hdr;
  810. idx--;
  811. if (idx < 0)
  812. idx = IEEE80211_FRAGMENT_MAX - 1;
  813. entry = &sdata->fragments[idx];
  814. if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
  815. entry->rx_queue != rx_queue ||
  816. entry->last_frag + 1 != frag)
  817. continue;
  818. f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
  819. /*
  820. * Check ftype and addresses are equal, else check next fragment
  821. */
  822. if (((hdr->frame_control ^ f_hdr->frame_control) &
  823. cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
  824. compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
  825. compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
  826. continue;
  827. if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
  828. __skb_queue_purge(&entry->skb_list);
  829. continue;
  830. }
  831. return entry;
  832. }
  833. return NULL;
  834. }
  835. static ieee80211_rx_result debug_noinline
  836. ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
  837. {
  838. struct ieee80211_hdr *hdr;
  839. u16 sc;
  840. __le16 fc;
  841. unsigned int frag, seq;
  842. struct ieee80211_fragment_entry *entry;
  843. struct sk_buff *skb;
  844. hdr = (struct ieee80211_hdr *)rx->skb->data;
  845. fc = hdr->frame_control;
  846. sc = le16_to_cpu(hdr->seq_ctrl);
  847. frag = sc & IEEE80211_SCTL_FRAG;
  848. if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
  849. (rx->skb)->len < 24 ||
  850. is_multicast_ether_addr(hdr->addr1))) {
  851. /* not fragmented */
  852. goto out;
  853. }
  854. I802_DEBUG_INC(rx->local->rx_handlers_fragments);
  855. seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
  856. if (frag == 0) {
  857. /* This is the first fragment of a new frame. */
  858. entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
  859. rx->queue, &(rx->skb));
  860. if (rx->key && rx->key->conf.alg == ALG_CCMP &&
  861. ieee80211_has_protected(fc)) {
  862. /* Store CCMP PN so that we can verify that the next
  863. * fragment has a sequential PN value. */
  864. entry->ccmp = 1;
  865. memcpy(entry->last_pn,
  866. rx->key->u.ccmp.rx_pn[rx->queue],
  867. CCMP_PN_LEN);
  868. }
  869. return RX_QUEUED;
  870. }
  871. /* This is a fragment for a frame that should already be pending in
  872. * fragment cache. Add this fragment to the end of the pending entry.
  873. */
  874. entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
  875. if (!entry) {
  876. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  877. return RX_DROP_MONITOR;
  878. }
  879. /* Verify that MPDUs within one MSDU have sequential PN values.
  880. * (IEEE 802.11i, 8.3.3.4.5) */
  881. if (entry->ccmp) {
  882. int i;
  883. u8 pn[CCMP_PN_LEN], *rpn;
  884. if (!rx->key || rx->key->conf.alg != ALG_CCMP)
  885. return RX_DROP_UNUSABLE;
  886. memcpy(pn, entry->last_pn, CCMP_PN_LEN);
  887. for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
  888. pn[i]++;
  889. if (pn[i])
  890. break;
  891. }
  892. rpn = rx->key->u.ccmp.rx_pn[rx->queue];
  893. if (memcmp(pn, rpn, CCMP_PN_LEN))
  894. return RX_DROP_UNUSABLE;
  895. memcpy(entry->last_pn, pn, CCMP_PN_LEN);
  896. }
  897. skb_pull(rx->skb, ieee80211_hdrlen(fc));
  898. __skb_queue_tail(&entry->skb_list, rx->skb);
  899. entry->last_frag = frag;
  900. entry->extra_len += rx->skb->len;
  901. if (ieee80211_has_morefrags(fc)) {
  902. rx->skb = NULL;
  903. return RX_QUEUED;
  904. }
  905. rx->skb = __skb_dequeue(&entry->skb_list);
  906. if (skb_tailroom(rx->skb) < entry->extra_len) {
  907. I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
  908. if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
  909. GFP_ATOMIC))) {
  910. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  911. __skb_queue_purge(&entry->skb_list);
  912. return RX_DROP_UNUSABLE;
  913. }
  914. }
  915. while ((skb = __skb_dequeue(&entry->skb_list))) {
  916. memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
  917. dev_kfree_skb(skb);
  918. }
  919. /* Complete frame has been reassembled - process it now */
  920. rx->flags |= IEEE80211_RX_FRAGMENTED;
  921. out:
  922. if (rx->sta)
  923. rx->sta->rx_packets++;
  924. if (is_multicast_ether_addr(hdr->addr1))
  925. rx->local->dot11MulticastReceivedFrameCount++;
  926. else
  927. ieee80211_led_rx(rx->local);
  928. return RX_CONTINUE;
  929. }
  930. static ieee80211_rx_result debug_noinline
  931. ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
  932. {
  933. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
  934. struct sk_buff *skb;
  935. int no_pending_pkts;
  936. __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
  937. if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
  938. !(rx->flags & IEEE80211_RX_RA_MATCH)))
  939. return RX_CONTINUE;
  940. if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
  941. (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
  942. return RX_DROP_UNUSABLE;
  943. skb = skb_dequeue(&rx->sta->tx_filtered);
  944. if (!skb) {
  945. skb = skb_dequeue(&rx->sta->ps_tx_buf);
  946. if (skb)
  947. rx->local->total_ps_buffered--;
  948. }
  949. no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
  950. skb_queue_empty(&rx->sta->ps_tx_buf);
  951. if (skb) {
  952. struct ieee80211_hdr *hdr =
  953. (struct ieee80211_hdr *) skb->data;
  954. /*
  955. * Tell TX path to send one frame even though the STA may
  956. * still remain is PS mode after this frame exchange.
  957. */
  958. set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
  959. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  960. printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
  961. rx->sta->sta.addr, rx->sta->sta.aid,
  962. skb_queue_len(&rx->sta->ps_tx_buf));
  963. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  964. /* Use MoreData flag to indicate whether there are more
  965. * buffered frames for this STA */
  966. if (no_pending_pkts)
  967. hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
  968. else
  969. hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
  970. dev_queue_xmit(skb);
  971. if (no_pending_pkts)
  972. sta_info_clear_tim_bit(rx->sta);
  973. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  974. } else if (!rx->sent_ps_buffered) {
  975. /*
  976. * FIXME: This can be the result of a race condition between
  977. * us expiring a frame and the station polling for it.
  978. * Should we send it a null-func frame indicating we
  979. * have nothing buffered for it?
  980. */
  981. printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
  982. "though there are no buffered frames for it\n",
  983. rx->dev->name, rx->sta->sta.addr);
  984. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  985. }
  986. /* Free PS Poll skb here instead of returning RX_DROP that would
  987. * count as an dropped frame. */
  988. dev_kfree_skb(rx->skb);
  989. return RX_QUEUED;
  990. }
  991. static ieee80211_rx_result debug_noinline
  992. ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
  993. {
  994. u8 *data = rx->skb->data;
  995. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
  996. if (!ieee80211_is_data_qos(hdr->frame_control))
  997. return RX_CONTINUE;
  998. /* remove the qos control field, update frame type and meta-data */
  999. memmove(data + IEEE80211_QOS_CTL_LEN, data,
  1000. ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
  1001. hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
  1002. /* change frame type to non QOS */
  1003. hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
  1004. return RX_CONTINUE;
  1005. }
  1006. static int
  1007. ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
  1008. {
  1009. if (unlikely(!rx->sta ||
  1010. !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
  1011. return -EACCES;
  1012. return 0;
  1013. }
  1014. static int
  1015. ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
  1016. {
  1017. /*
  1018. * Pass through unencrypted frames if the hardware has
  1019. * decrypted them already.
  1020. */
  1021. if (rx->status->flag & RX_FLAG_DECRYPTED)
  1022. return 0;
  1023. /* Drop unencrypted frames if key is set. */
  1024. if (unlikely(!ieee80211_has_protected(fc) &&
  1025. !ieee80211_is_nullfunc(fc) &&
  1026. (!ieee80211_is_mgmt(fc) ||
  1027. (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
  1028. rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
  1029. (rx->key || rx->sdata->drop_unencrypted)))
  1030. return -EACCES;
  1031. /* BIP does not use Protected field, so need to check MMIE */
  1032. if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
  1033. ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
  1034. ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
  1035. (rx->key || rx->sdata->drop_unencrypted)))
  1036. return -EACCES;
  1037. return 0;
  1038. }
  1039. static int
  1040. ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
  1041. {
  1042. struct net_device *dev = rx->dev;
  1043. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
  1044. u16 hdrlen, ethertype;
  1045. u8 *payload;
  1046. u8 dst[ETH_ALEN];
  1047. u8 src[ETH_ALEN] __aligned(2);
  1048. struct sk_buff *skb = rx->skb;
  1049. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1050. if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
  1051. return -1;
  1052. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  1053. /* convert IEEE 802.11 header + possible LLC headers into Ethernet
  1054. * header
  1055. * IEEE 802.11 address fields:
  1056. * ToDS FromDS Addr1 Addr2 Addr3 Addr4
  1057. * 0 0 DA SA BSSID n/a
  1058. * 0 1 DA BSSID SA n/a
  1059. * 1 0 BSSID SA DA n/a
  1060. * 1 1 RA TA DA SA
  1061. */
  1062. memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
  1063. memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
  1064. switch (hdr->frame_control &
  1065. cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
  1066. case cpu_to_le16(IEEE80211_FCTL_TODS):
  1067. if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
  1068. sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
  1069. return -1;
  1070. break;
  1071. case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
  1072. if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
  1073. sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
  1074. return -1;
  1075. if (ieee80211_vif_is_mesh(&sdata->vif)) {
  1076. struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
  1077. (skb->data + hdrlen);
  1078. hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
  1079. if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
  1080. memcpy(dst, meshdr->eaddr1, ETH_ALEN);
  1081. memcpy(src, meshdr->eaddr2, ETH_ALEN);
  1082. }
  1083. }
  1084. break;
  1085. case cpu_to_le16(IEEE80211_FCTL_FROMDS):
  1086. if (sdata->vif.type != NL80211_IFTYPE_STATION ||
  1087. (is_multicast_ether_addr(dst) &&
  1088. !compare_ether_addr(src, dev->dev_addr)))
  1089. return -1;
  1090. break;
  1091. case cpu_to_le16(0):
  1092. if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
  1093. return -1;
  1094. break;
  1095. }
  1096. if (unlikely(skb->len - hdrlen < 8))
  1097. return -1;
  1098. payload = skb->data + hdrlen;
  1099. ethertype = (payload[6] << 8) | payload[7];
  1100. if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
  1101. ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
  1102. compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
  1103. /* remove RFC1042 or Bridge-Tunnel encapsulation and
  1104. * replace EtherType */
  1105. skb_pull(skb, hdrlen + 6);
  1106. memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
  1107. memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
  1108. } else {
  1109. struct ethhdr *ehdr;
  1110. __be16 len;
  1111. skb_pull(skb, hdrlen);
  1112. len = htons(skb->len);
  1113. ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
  1114. memcpy(ehdr->h_dest, dst, ETH_ALEN);
  1115. memcpy(ehdr->h_source, src, ETH_ALEN);
  1116. ehdr->h_proto = len;
  1117. }
  1118. return 0;
  1119. }
  1120. /*
  1121. * requires that rx->skb is a frame with ethernet header
  1122. */
  1123. static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
  1124. {
  1125. static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
  1126. = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
  1127. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1128. /*
  1129. * Allow EAPOL frames to us/the PAE group address regardless
  1130. * of whether the frame was encrypted or not.
  1131. */
  1132. if (ehdr->h_proto == htons(ETH_P_PAE) &&
  1133. (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
  1134. compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
  1135. return true;
  1136. if (ieee80211_802_1x_port_control(rx) ||
  1137. ieee80211_drop_unencrypted(rx, fc))
  1138. return false;
  1139. return true;
  1140. }
  1141. /*
  1142. * requires that rx->skb is a frame with ethernet header
  1143. */
  1144. static void
  1145. ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
  1146. {
  1147. struct net_device *dev = rx->dev;
  1148. struct ieee80211_local *local = rx->local;
  1149. struct sk_buff *skb, *xmit_skb;
  1150. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1151. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1152. struct sta_info *dsta;
  1153. skb = rx->skb;
  1154. xmit_skb = NULL;
  1155. if ((sdata->vif.type == NL80211_IFTYPE_AP ||
  1156. sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
  1157. !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
  1158. (rx->flags & IEEE80211_RX_RA_MATCH)) {
  1159. if (is_multicast_ether_addr(ehdr->h_dest)) {
  1160. /*
  1161. * send multicast frames both to higher layers in
  1162. * local net stack and back to the wireless medium
  1163. */
  1164. xmit_skb = skb_copy(skb, GFP_ATOMIC);
  1165. if (!xmit_skb && net_ratelimit())
  1166. printk(KERN_DEBUG "%s: failed to clone "
  1167. "multicast frame\n", dev->name);
  1168. } else {
  1169. dsta = sta_info_get(local, skb->data);
  1170. if (dsta && dsta->sdata->dev == dev) {
  1171. /*
  1172. * The destination station is associated to
  1173. * this AP (in this VLAN), so send the frame
  1174. * directly to it and do not pass it to local
  1175. * net stack.
  1176. */
  1177. xmit_skb = skb;
  1178. skb = NULL;
  1179. }
  1180. }
  1181. }
  1182. if (skb) {
  1183. int align __maybe_unused;
  1184. #if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
  1185. /*
  1186. * 'align' will only take the values 0 or 2 here
  1187. * since all frames are required to be aligned
  1188. * to 2-byte boundaries when being passed to
  1189. * mac80211. That also explains the __skb_push()
  1190. * below.
  1191. */
  1192. align = (unsigned long)skb->data & 3;
  1193. if (align) {
  1194. if (WARN_ON(skb_headroom(skb) < 3)) {
  1195. dev_kfree_skb(skb);
  1196. skb = NULL;
  1197. } else {
  1198. u8 *data = skb->data;
  1199. size_t len = skb->len;
  1200. u8 *new = __skb_push(skb, align);
  1201. memmove(new, data, len);
  1202. __skb_trim(skb, len);
  1203. }
  1204. }
  1205. #endif
  1206. if (skb) {
  1207. /* deliver to local stack */
  1208. skb->protocol = eth_type_trans(skb, dev);
  1209. memset(skb->cb, 0, sizeof(skb->cb));
  1210. netif_rx(skb);
  1211. }
  1212. }
  1213. if (xmit_skb) {
  1214. /* send to wireless media */
  1215. xmit_skb->protocol = htons(ETH_P_802_3);
  1216. skb_reset_network_header(xmit_skb);
  1217. skb_reset_mac_header(xmit_skb);
  1218. dev_queue_xmit(xmit_skb);
  1219. }
  1220. }
  1221. static ieee80211_rx_result debug_noinline
  1222. ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
  1223. {
  1224. struct net_device *dev = rx->dev;
  1225. struct ieee80211_local *local = rx->local;
  1226. u16 ethertype;
  1227. u8 *payload;
  1228. struct sk_buff *skb = rx->skb, *frame = NULL;
  1229. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  1230. __le16 fc = hdr->frame_control;
  1231. const struct ethhdr *eth;
  1232. int remaining, err;
  1233. u8 dst[ETH_ALEN];
  1234. u8 src[ETH_ALEN];
  1235. if (unlikely(!ieee80211_is_data(fc)))
  1236. return RX_CONTINUE;
  1237. if (unlikely(!ieee80211_is_data_present(fc)))
  1238. return RX_DROP_MONITOR;
  1239. if (!(rx->flags & IEEE80211_RX_AMSDU))
  1240. return RX_CONTINUE;
  1241. err = ieee80211_data_to_8023(rx);
  1242. if (unlikely(err))
  1243. return RX_DROP_UNUSABLE;
  1244. skb->dev = dev;
  1245. dev->stats.rx_packets++;
  1246. dev->stats.rx_bytes += skb->len;
  1247. /* skip the wrapping header */
  1248. eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
  1249. if (!eth)
  1250. return RX_DROP_UNUSABLE;
  1251. while (skb != frame) {
  1252. u8 padding;
  1253. __be16 len = eth->h_proto;
  1254. unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
  1255. remaining = skb->len;
  1256. memcpy(dst, eth->h_dest, ETH_ALEN);
  1257. memcpy(src, eth->h_source, ETH_ALEN);
  1258. padding = ((4 - subframe_len) & 0x3);
  1259. /* the last MSDU has no padding */
  1260. if (subframe_len > remaining)
  1261. return RX_DROP_UNUSABLE;
  1262. skb_pull(skb, sizeof(struct ethhdr));
  1263. /* if last subframe reuse skb */
  1264. if (remaining <= subframe_len + padding)
  1265. frame = skb;
  1266. else {
  1267. /*
  1268. * Allocate and reserve two bytes more for payload
  1269. * alignment since sizeof(struct ethhdr) is 14.
  1270. */
  1271. frame = dev_alloc_skb(
  1272. ALIGN(local->hw.extra_tx_headroom, 4) +
  1273. subframe_len + 2);
  1274. if (frame == NULL)
  1275. return RX_DROP_UNUSABLE;
  1276. skb_reserve(frame,
  1277. ALIGN(local->hw.extra_tx_headroom, 4) +
  1278. sizeof(struct ethhdr) + 2);
  1279. memcpy(skb_put(frame, ntohs(len)), skb->data,
  1280. ntohs(len));
  1281. eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
  1282. padding);
  1283. if (!eth) {
  1284. dev_kfree_skb(frame);
  1285. return RX_DROP_UNUSABLE;
  1286. }
  1287. }
  1288. skb_reset_network_header(frame);
  1289. frame->dev = dev;
  1290. frame->priority = skb->priority;
  1291. rx->skb = frame;
  1292. payload = frame->data;
  1293. ethertype = (payload[6] << 8) | payload[7];
  1294. if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
  1295. ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
  1296. compare_ether_addr(payload,
  1297. bridge_tunnel_header) == 0)) {
  1298. /* remove RFC1042 or Bridge-Tunnel
  1299. * encapsulation and replace EtherType */
  1300. skb_pull(frame, 6);
  1301. memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
  1302. memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
  1303. } else {
  1304. memcpy(skb_push(frame, sizeof(__be16)),
  1305. &len, sizeof(__be16));
  1306. memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
  1307. memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
  1308. }
  1309. if (!ieee80211_frame_allowed(rx, fc)) {
  1310. if (skb == frame) /* last frame */
  1311. return RX_DROP_UNUSABLE;
  1312. dev_kfree_skb(frame);
  1313. continue;
  1314. }
  1315. ieee80211_deliver_skb(rx);
  1316. }
  1317. return RX_QUEUED;
  1318. }
  1319. #ifdef CONFIG_MAC80211_MESH
  1320. static ieee80211_rx_result
  1321. ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
  1322. {
  1323. struct ieee80211_hdr *hdr;
  1324. struct ieee80211s_hdr *mesh_hdr;
  1325. unsigned int hdrlen;
  1326. struct sk_buff *skb = rx->skb, *fwd_skb;
  1327. hdr = (struct ieee80211_hdr *) skb->data;
  1328. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  1329. mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
  1330. if (!ieee80211_is_data(hdr->frame_control))
  1331. return RX_CONTINUE;
  1332. if (!mesh_hdr->ttl)
  1333. /* illegal frame */
  1334. return RX_DROP_MONITOR;
  1335. if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
  1336. struct ieee80211_sub_if_data *sdata;
  1337. struct mesh_path *mppath;
  1338. sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
  1339. rcu_read_lock();
  1340. mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
  1341. if (!mppath) {
  1342. mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
  1343. } else {
  1344. spin_lock_bh(&mppath->state_lock);
  1345. mppath->exp_time = jiffies;
  1346. if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
  1347. memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
  1348. spin_unlock_bh(&mppath->state_lock);
  1349. }
  1350. rcu_read_unlock();
  1351. }
  1352. if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
  1353. return RX_CONTINUE;
  1354. mesh_hdr->ttl--;
  1355. if (rx->flags & IEEE80211_RX_RA_MATCH) {
  1356. if (!mesh_hdr->ttl)
  1357. IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
  1358. dropped_frames_ttl);
  1359. else {
  1360. struct ieee80211_hdr *fwd_hdr;
  1361. fwd_skb = skb_copy(skb, GFP_ATOMIC);
  1362. if (!fwd_skb && net_ratelimit())
  1363. printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
  1364. rx->dev->name);
  1365. fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
  1366. /*
  1367. * Save TA to addr1 to send TA a path error if a
  1368. * suitable next hop is not found
  1369. */
  1370. memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
  1371. memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
  1372. fwd_skb->dev = rx->local->mdev;
  1373. fwd_skb->iif = rx->dev->ifindex;
  1374. dev_queue_xmit(fwd_skb);
  1375. }
  1376. }
  1377. if (is_multicast_ether_addr(hdr->addr3) ||
  1378. rx->dev->flags & IFF_PROMISC)
  1379. return RX_CONTINUE;
  1380. else
  1381. return RX_DROP_MONITOR;
  1382. }
  1383. #endif
  1384. static ieee80211_rx_result debug_noinline
  1385. ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
  1386. {
  1387. struct net_device *dev = rx->dev;
  1388. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
  1389. __le16 fc = hdr->frame_control;
  1390. int err;
  1391. if (unlikely(!ieee80211_is_data(hdr->frame_control)))
  1392. return RX_CONTINUE;
  1393. if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
  1394. return RX_DROP_MONITOR;
  1395. err = ieee80211_data_to_8023(rx);
  1396. if (unlikely(err))
  1397. return RX_DROP_UNUSABLE;
  1398. if (!ieee80211_frame_allowed(rx, fc))
  1399. return RX_DROP_MONITOR;
  1400. rx->skb->dev = dev;
  1401. dev->stats.rx_packets++;
  1402. dev->stats.rx_bytes += rx->skb->len;
  1403. ieee80211_deliver_skb(rx);
  1404. return RX_QUEUED;
  1405. }
  1406. static ieee80211_rx_result debug_noinline
  1407. ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
  1408. {
  1409. struct ieee80211_local *local = rx->local;
  1410. struct ieee80211_hw *hw = &local->hw;
  1411. struct sk_buff *skb = rx->skb;
  1412. struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
  1413. struct tid_ampdu_rx *tid_agg_rx;
  1414. u16 start_seq_num;
  1415. u16 tid;
  1416. if (likely(!ieee80211_is_ctl(bar->frame_control)))
  1417. return RX_CONTINUE;
  1418. if (ieee80211_is_back_req(bar->frame_control)) {
  1419. if (!rx->sta)
  1420. return RX_CONTINUE;
  1421. tid = le16_to_cpu(bar->control) >> 12;
  1422. if (rx->sta->ampdu_mlme.tid_state_rx[tid]
  1423. != HT_AGG_STATE_OPERATIONAL)
  1424. return RX_CONTINUE;
  1425. tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
  1426. start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
  1427. /* reset session timer */
  1428. if (tid_agg_rx->timeout)
  1429. mod_timer(&tid_agg_rx->session_timer,
  1430. TU_TO_EXP_TIME(tid_agg_rx->timeout));
  1431. /* manage reordering buffer according to requested */
  1432. /* sequence number */
  1433. rcu_read_lock();
  1434. ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL, NULL,
  1435. start_seq_num, 1);
  1436. rcu_read_unlock();
  1437. return RX_DROP_UNUSABLE;
  1438. }
  1439. return RX_CONTINUE;
  1440. }
  1441. static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
  1442. struct ieee80211_mgmt *mgmt,
  1443. size_t len)
  1444. {
  1445. struct ieee80211_local *local = sdata->local;
  1446. struct sk_buff *skb;
  1447. struct ieee80211_mgmt *resp;
  1448. if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
  1449. /* Not to own unicast address */
  1450. return;
  1451. }
  1452. if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
  1453. compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
  1454. /* Not from the current AP. */
  1455. return;
  1456. }
  1457. if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
  1458. /* Association in progress; ignore SA Query */
  1459. return;
  1460. }
  1461. if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
  1462. /* Too short SA Query request frame */
  1463. return;
  1464. }
  1465. skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
  1466. if (skb == NULL)
  1467. return;
  1468. skb_reserve(skb, local->hw.extra_tx_headroom);
  1469. resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
  1470. memset(resp, 0, 24);
  1471. memcpy(resp->da, mgmt->sa, ETH_ALEN);
  1472. memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
  1473. memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  1474. resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
  1475. IEEE80211_STYPE_ACTION);
  1476. skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
  1477. resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
  1478. resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
  1479. memcpy(resp->u.action.u.sa_query.trans_id,
  1480. mgmt->u.action.u.sa_query.trans_id,
  1481. WLAN_SA_QUERY_TR_ID_LEN);
  1482. ieee80211_tx_skb(sdata, skb, 1);
  1483. }
  1484. static ieee80211_rx_result debug_noinline
  1485. ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
  1486. {
  1487. struct ieee80211_local *local = rx->local;
  1488. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
  1489. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  1490. struct ieee80211_bss *bss;
  1491. int len = rx->skb->len;
  1492. if (!ieee80211_is_action(mgmt->frame_control))
  1493. return RX_CONTINUE;
  1494. if (!rx->sta)
  1495. return RX_DROP_MONITOR;
  1496. if (!(rx->flags & IEEE80211_RX_RA_MATCH))
  1497. return RX_DROP_MONITOR;
  1498. if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
  1499. return RX_DROP_MONITOR;
  1500. /* all categories we currently handle have action_code */
  1501. if (len < IEEE80211_MIN_ACTION_SIZE + 1)
  1502. return RX_DROP_MONITOR;
  1503. switch (mgmt->u.action.category) {
  1504. case WLAN_CATEGORY_BACK:
  1505. /*
  1506. * The aggregation code is not prepared to handle
  1507. * anything but STA/AP due to the BSSID handling;
  1508. * IBSS could work in the code but isn't supported
  1509. * by drivers or the standard.
  1510. */
  1511. if (sdata->vif.type != NL80211_IFTYPE_STATION &&
  1512. sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
  1513. sdata->vif.type != NL80211_IFTYPE_AP)
  1514. return RX_DROP_MONITOR;
  1515. switch (mgmt->u.action.u.addba_req.action_code) {
  1516. case WLAN_ACTION_ADDBA_REQ:
  1517. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1518. sizeof(mgmt->u.action.u.addba_req)))
  1519. return RX_DROP_MONITOR;
  1520. ieee80211_process_addba_request(local, rx->sta, mgmt, len);
  1521. break;
  1522. case WLAN_ACTION_ADDBA_RESP:
  1523. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1524. sizeof(mgmt->u.action.u.addba_resp)))
  1525. return RX_DROP_MONITOR;
  1526. ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
  1527. break;
  1528. case WLAN_ACTION_DELBA:
  1529. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1530. sizeof(mgmt->u.action.u.delba)))
  1531. return RX_DROP_MONITOR;
  1532. ieee80211_process_delba(sdata, rx->sta, mgmt, len);
  1533. break;
  1534. }
  1535. break;
  1536. case WLAN_CATEGORY_SPECTRUM_MGMT:
  1537. if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
  1538. return RX_DROP_MONITOR;
  1539. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1540. return RX_DROP_MONITOR;
  1541. switch (mgmt->u.action.u.measurement.action_code) {
  1542. case WLAN_ACTION_SPCT_MSR_REQ:
  1543. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1544. sizeof(mgmt->u.action.u.measurement)))
  1545. return RX_DROP_MONITOR;
  1546. ieee80211_process_measurement_req(sdata, mgmt, len);
  1547. break;
  1548. case WLAN_ACTION_SPCT_CHL_SWITCH:
  1549. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1550. sizeof(mgmt->u.action.u.chan_switch)))
  1551. return RX_DROP_MONITOR;
  1552. if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
  1553. return RX_DROP_MONITOR;
  1554. bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
  1555. local->hw.conf.channel->center_freq,
  1556. sdata->u.mgd.ssid,
  1557. sdata->u.mgd.ssid_len);
  1558. if (!bss)
  1559. return RX_DROP_MONITOR;
  1560. ieee80211_process_chanswitch(sdata,
  1561. &mgmt->u.action.u.chan_switch.sw_elem, bss);
  1562. ieee80211_rx_bss_put(local, bss);
  1563. break;
  1564. }
  1565. break;
  1566. case WLAN_CATEGORY_SA_QUERY:
  1567. if (len < (IEEE80211_MIN_ACTION_SIZE +
  1568. sizeof(mgmt->u.action.u.sa_query)))
  1569. return RX_DROP_MONITOR;
  1570. switch (mgmt->u.action.u.sa_query.action) {
  1571. case WLAN_ACTION_SA_QUERY_REQUEST:
  1572. if (sdata->vif.type != NL80211_IFTYPE_STATION)
  1573. return RX_DROP_MONITOR;
  1574. ieee80211_process_sa_query_req(sdata, mgmt, len);
  1575. break;
  1576. case WLAN_ACTION_SA_QUERY_RESPONSE:
  1577. /*
  1578. * SA Query response is currently only used in AP mode
  1579. * and it is processed in user space.
  1580. */
  1581. return RX_CONTINUE;
  1582. }
  1583. break;
  1584. default:
  1585. return RX_CONTINUE;
  1586. }
  1587. rx->sta->rx_packets++;
  1588. dev_kfree_skb(rx->skb);
  1589. return RX_QUEUED;
  1590. }
  1591. static ieee80211_rx_result debug_noinline
  1592. ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
  1593. {
  1594. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
  1595. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
  1596. if (!(rx->flags & IEEE80211_RX_RA_MATCH))
  1597. return RX_DROP_MONITOR;
  1598. if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
  1599. return RX_DROP_MONITOR;
  1600. if (ieee80211_vif_is_mesh(&sdata->vif))
  1601. return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
  1602. if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
  1603. return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
  1604. if (sdata->vif.type == NL80211_IFTYPE_STATION)
  1605. return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
  1606. return RX_DROP_MONITOR;
  1607. }
  1608. static void ieee80211_rx_michael_mic_report(struct net_device *dev,
  1609. struct ieee80211_hdr *hdr,
  1610. struct ieee80211_rx_data *rx)
  1611. {
  1612. int keyidx;
  1613. unsigned int hdrlen;
  1614. hdrlen = ieee80211_hdrlen(hdr->frame_control);
  1615. if (rx->skb->len >= hdrlen + 4)
  1616. keyidx = rx->skb->data[hdrlen + 3] >> 6;
  1617. else
  1618. keyidx = -1;
  1619. if (!rx->sta) {
  1620. /*
  1621. * Some hardware seem to generate incorrect Michael MIC
  1622. * reports; ignore them to avoid triggering countermeasures.
  1623. */
  1624. goto ignore;
  1625. }
  1626. if (!ieee80211_has_protected(hdr->frame_control))
  1627. goto ignore;
  1628. if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
  1629. /*
  1630. * APs with pairwise keys should never receive Michael MIC
  1631. * errors for non-zero keyidx because these are reserved for
  1632. * group keys and only the AP is sending real multicast
  1633. * frames in the BSS.
  1634. */
  1635. goto ignore;
  1636. }
  1637. if (!ieee80211_is_data(hdr->frame_control) &&
  1638. !ieee80211_is_auth(hdr->frame_control))
  1639. goto ignore;
  1640. mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL);
  1641. ignore:
  1642. dev_kfree_skb(rx->skb);
  1643. rx->skb = NULL;
  1644. }
  1645. /* TODO: use IEEE80211_RX_FRAGMENTED */
  1646. static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
  1647. {
  1648. struct ieee80211_sub_if_data *sdata;
  1649. struct ieee80211_local *local = rx->local;
  1650. struct ieee80211_rtap_hdr {
  1651. struct ieee80211_radiotap_header hdr;
  1652. u8 flags;
  1653. u8 rate;
  1654. __le16 chan_freq;
  1655. __le16 chan_flags;
  1656. } __attribute__ ((packed)) *rthdr;
  1657. struct sk_buff *skb = rx->skb, *skb2;
  1658. struct net_device *prev_dev = NULL;
  1659. struct ieee80211_rx_status *status = rx->status;
  1660. if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
  1661. goto out_free_skb;
  1662. if (skb_headroom(skb) < sizeof(*rthdr) &&
  1663. pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
  1664. goto out_free_skb;
  1665. rthdr = (void *)skb_push(skb, sizeof(*rthdr));
  1666. memset(rthdr, 0, sizeof(*rthdr));
  1667. rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
  1668. rthdr->hdr.it_present =
  1669. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  1670. (1 << IEEE80211_RADIOTAP_RATE) |
  1671. (1 << IEEE80211_RADIOTAP_CHANNEL));
  1672. rthdr->rate = rx->rate->bitrate / 5;
  1673. rthdr->chan_freq = cpu_to_le16(status->freq);
  1674. if (status->band == IEEE80211_BAND_5GHZ)
  1675. rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
  1676. IEEE80211_CHAN_5GHZ);
  1677. else
  1678. rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
  1679. IEEE80211_CHAN_2GHZ);
  1680. skb_set_mac_header(skb, 0);
  1681. skb->ip_summed = CHECKSUM_UNNECESSARY;
  1682. skb->pkt_type = PACKET_OTHERHOST;
  1683. skb->protocol = htons(ETH_P_802_2);
  1684. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  1685. if (!netif_running(sdata->dev))
  1686. continue;
  1687. if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
  1688. !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
  1689. continue;
  1690. if (prev_dev) {
  1691. skb2 = skb_clone(skb, GFP_ATOMIC);
  1692. if (skb2) {
  1693. skb2->dev = prev_dev;
  1694. netif_rx(skb2);
  1695. }
  1696. }
  1697. prev_dev = sdata->dev;
  1698. sdata->dev->stats.rx_packets++;
  1699. sdata->dev->stats.rx_bytes += skb->len;
  1700. }
  1701. if (prev_dev) {
  1702. skb->dev = prev_dev;
  1703. netif_rx(skb);
  1704. skb = NULL;
  1705. } else
  1706. goto out_free_skb;
  1707. rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
  1708. return;
  1709. out_free_skb:
  1710. dev_kfree_skb(skb);
  1711. }
  1712. static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
  1713. struct ieee80211_rx_data *rx,
  1714. struct sk_buff *skb)
  1715. {
  1716. ieee80211_rx_result res = RX_DROP_MONITOR;
  1717. rx->skb = skb;
  1718. rx->sdata = sdata;
  1719. rx->dev = sdata->dev;
  1720. #define CALL_RXH(rxh) \
  1721. do { \
  1722. res = rxh(rx); \
  1723. if (res != RX_CONTINUE) \
  1724. goto rxh_done; \
  1725. } while (0);
  1726. CALL_RXH(ieee80211_rx_h_passive_scan)
  1727. CALL_RXH(ieee80211_rx_h_check)
  1728. CALL_RXH(ieee80211_rx_h_decrypt)
  1729. CALL_RXH(ieee80211_rx_h_check_more_data)
  1730. CALL_RXH(ieee80211_rx_h_sta_process)
  1731. CALL_RXH(ieee80211_rx_h_defragment)
  1732. CALL_RXH(ieee80211_rx_h_ps_poll)
  1733. CALL_RXH(ieee80211_rx_h_michael_mic_verify)
  1734. /* must be after MMIC verify so header is counted in MPDU mic */
  1735. CALL_RXH(ieee80211_rx_h_remove_qos_control)
  1736. CALL_RXH(ieee80211_rx_h_amsdu)
  1737. #ifdef CONFIG_MAC80211_MESH
  1738. if (ieee80211_vif_is_mesh(&sdata->vif))
  1739. CALL_RXH(ieee80211_rx_h_mesh_fwding);
  1740. #endif
  1741. CALL_RXH(ieee80211_rx_h_data)
  1742. CALL_RXH(ieee80211_rx_h_ctrl)
  1743. CALL_RXH(ieee80211_rx_h_action)
  1744. CALL_RXH(ieee80211_rx_h_mgmt)
  1745. #undef CALL_RXH
  1746. rxh_done:
  1747. switch (res) {
  1748. case RX_DROP_MONITOR:
  1749. I802_DEBUG_INC(sdata->local->rx_handlers_drop);
  1750. if (rx->sta)
  1751. rx->sta->rx_dropped++;
  1752. /* fall through */
  1753. case RX_CONTINUE:
  1754. ieee80211_rx_cooked_monitor(rx);
  1755. break;
  1756. case RX_DROP_UNUSABLE:
  1757. I802_DEBUG_INC(sdata->local->rx_handlers_drop);
  1758. if (rx->sta)
  1759. rx->sta->rx_dropped++;
  1760. dev_kfree_skb(rx->skb);
  1761. break;
  1762. case RX_QUEUED:
  1763. I802_DEBUG_INC(sdata->local->rx_handlers_queued);
  1764. break;
  1765. }
  1766. }
  1767. /* main receive path */
  1768. static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
  1769. struct ieee80211_rx_data *rx,
  1770. struct ieee80211_hdr *hdr)
  1771. {
  1772. u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
  1773. int multicast = is_multicast_ether_addr(hdr->addr1);
  1774. switch (sdata->vif.type) {
  1775. case NL80211_IFTYPE_STATION:
  1776. if (!bssid)
  1777. return 0;
  1778. if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
  1779. if (!(rx->flags & IEEE80211_RX_IN_SCAN))
  1780. return 0;
  1781. rx->flags &= ~IEEE80211_RX_RA_MATCH;
  1782. } else if (!multicast &&
  1783. compare_ether_addr(sdata->dev->dev_addr,
  1784. hdr->addr1) != 0) {
  1785. if (!(sdata->dev->flags & IFF_PROMISC))
  1786. return 0;
  1787. rx->flags &= ~IEEE80211_RX_RA_MATCH;
  1788. }
  1789. break;
  1790. case NL80211_IFTYPE_ADHOC:
  1791. if (!bssid)
  1792. return 0;
  1793. if (ieee80211_is_beacon(hdr->frame_control)) {
  1794. return 1;
  1795. }
  1796. else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
  1797. if (!(rx->flags & IEEE80211_RX_IN_SCAN))
  1798. return 0;
  1799. rx->flags &= ~IEEE80211_RX_RA_MATCH;
  1800. } else if (!multicast &&
  1801. compare_ether_addr(sdata->dev->dev_addr,
  1802. hdr->addr1) != 0) {
  1803. if (!(sdata->dev->flags & IFF_PROMISC))
  1804. return 0;
  1805. rx->flags &= ~IEEE80211_RX_RA_MATCH;
  1806. } else if (!rx->sta) {
  1807. int rate_idx;
  1808. if (rx->status->flag & RX_FLAG_HT)
  1809. rate_idx = 0; /* TODO: HT rates */
  1810. else
  1811. rate_idx = rx->status->rate_idx;
  1812. rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
  1813. BIT(rate_idx));
  1814. }
  1815. break;
  1816. case NL80211_IFTYPE_MESH_POINT:
  1817. if (!multicast &&
  1818. compare_ether_addr(sdata->dev->dev_addr,
  1819. hdr->addr1) != 0) {
  1820. if (!(sdata->dev->flags & IFF_PROMISC))
  1821. return 0;
  1822. rx->flags &= ~IEEE80211_RX_RA_MATCH;
  1823. }
  1824. break;
  1825. case NL80211_IFTYPE_AP_VLAN:
  1826. case NL80211_IFTYPE_AP:
  1827. if (!bssid) {
  1828. if (compare_ether_addr(sdata->dev->dev_addr,
  1829. hdr->addr1))
  1830. return 0;
  1831. } else if (!ieee80211_bssid_match(bssid,
  1832. sdata->dev->dev_addr)) {
  1833. if (!(rx->flags & IEEE80211_RX_IN_SCAN))
  1834. return 0;
  1835. rx->flags &= ~IEEE80211_RX_RA_MATCH;
  1836. }
  1837. break;
  1838. case NL80211_IFTYPE_WDS:
  1839. if (bssid || !ieee80211_is_data(hdr->frame_control))
  1840. return 0;
  1841. if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
  1842. return 0;
  1843. break;
  1844. case NL80211_IFTYPE_MONITOR:
  1845. /* take everything */
  1846. break;
  1847. case NL80211_IFTYPE_UNSPECIFIED:
  1848. case __NL80211_IFTYPE_AFTER_LAST:
  1849. /* should never get here */
  1850. WARN_ON(1);
  1851. break;
  1852. }
  1853. return 1;
  1854. }
  1855. /*
  1856. * This is the actual Rx frames handler. as it blongs to Rx path it must
  1857. * be called with rcu_read_lock protection.
  1858. */
  1859. static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
  1860. struct sk_buff *skb,
  1861. struct ieee80211_rx_status *status,
  1862. struct ieee80211_rate *rate)
  1863. {
  1864. struct ieee80211_local *local = hw_to_local(hw);
  1865. struct ieee80211_sub_if_data *sdata;
  1866. struct ieee80211_hdr *hdr;
  1867. struct ieee80211_rx_data rx;
  1868. int prepares;
  1869. struct ieee80211_sub_if_data *prev = NULL;
  1870. struct sk_buff *skb_new;
  1871. hdr = (struct ieee80211_hdr *)skb->data;
  1872. memset(&rx, 0, sizeof(rx));
  1873. rx.skb = skb;
  1874. rx.local = local;
  1875. rx.status = status;
  1876. rx.rate = rate;
  1877. if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
  1878. local->dot11ReceivedFragmentCount++;
  1879. rx.sta = sta_info_get(local, hdr->addr2);
  1880. if (rx.sta) {
  1881. rx.sdata = rx.sta->sdata;
  1882. rx.dev = rx.sta->sdata->dev;
  1883. }
  1884. if ((status->flag & RX_FLAG_MMIC_ERROR)) {
  1885. ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
  1886. return;
  1887. }
  1888. if (unlikely(local->sw_scanning || local->hw_scanning))
  1889. rx.flags |= IEEE80211_RX_IN_SCAN;
  1890. ieee80211_parse_qos(&rx);
  1891. ieee80211_verify_alignment(&rx);
  1892. skb = rx.skb;
  1893. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  1894. if (!netif_running(sdata->dev))
  1895. continue;
  1896. if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
  1897. continue;
  1898. rx.flags |= IEEE80211_RX_RA_MATCH;
  1899. prepares = prepare_for_handlers(sdata, &rx, hdr);
  1900. if (!prepares)
  1901. continue;
  1902. /*
  1903. * frame is destined for this interface, but if it's not
  1904. * also for the previous one we handle that after the
  1905. * loop to avoid copying the SKB once too much
  1906. */
  1907. if (!prev) {
  1908. prev = sdata;
  1909. continue;
  1910. }
  1911. /*
  1912. * frame was destined for the previous interface
  1913. * so invoke RX handlers for it
  1914. */
  1915. skb_new = skb_copy(skb, GFP_ATOMIC);
  1916. if (!skb_new) {
  1917. if (net_ratelimit())
  1918. printk(KERN_DEBUG "%s: failed to copy "
  1919. "multicast frame for %s\n",
  1920. wiphy_name(local->hw.wiphy),
  1921. prev->dev->name);
  1922. continue;
  1923. }
  1924. ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
  1925. prev = sdata;
  1926. }
  1927. if (prev)
  1928. ieee80211_invoke_rx_handlers(prev, &rx, skb);
  1929. else
  1930. dev_kfree_skb(skb);
  1931. }
  1932. #define SEQ_MODULO 0x1000
  1933. #define SEQ_MASK 0xfff
  1934. static inline int seq_less(u16 sq1, u16 sq2)
  1935. {
  1936. return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
  1937. }
  1938. static inline u16 seq_inc(u16 sq)
  1939. {
  1940. return (sq + 1) & SEQ_MASK;
  1941. }
  1942. static inline u16 seq_sub(u16 sq1, u16 sq2)
  1943. {
  1944. return (sq1 - sq2) & SEQ_MASK;
  1945. }
  1946. static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
  1947. struct tid_ampdu_rx *tid_agg_rx,
  1948. int index)
  1949. {
  1950. struct ieee80211_supported_band *sband;
  1951. struct ieee80211_rate *rate;
  1952. struct ieee80211_rx_status status;
  1953. if (!tid_agg_rx->reorder_buf[index])
  1954. goto no_frame;
  1955. /* release the reordered frames to stack */
  1956. memcpy(&status, tid_agg_rx->reorder_buf[index]->cb, sizeof(status));
  1957. sband = hw->wiphy->bands[status.band];
  1958. if (status.flag & RX_FLAG_HT)
  1959. rate = sband->bitrates; /* TODO: HT rates */
  1960. else
  1961. rate = &sband->bitrates[status.rate_idx];
  1962. __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
  1963. &status, rate);
  1964. tid_agg_rx->stored_mpdu_num--;
  1965. tid_agg_rx->reorder_buf[index] = NULL;
  1966. no_frame:
  1967. tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
  1968. }
  1969. /*
  1970. * As it function blongs to Rx path it must be called with
  1971. * the proper rcu_read_lock protection for its flow.
  1972. */
  1973. static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  1974. struct tid_ampdu_rx *tid_agg_rx,
  1975. struct sk_buff *skb,
  1976. struct ieee80211_rx_status *rxstatus,
  1977. u16 mpdu_seq_num,
  1978. int bar_req)
  1979. {
  1980. u16 head_seq_num, buf_size;
  1981. int index;
  1982. buf_size = tid_agg_rx->buf_size;
  1983. head_seq_num = tid_agg_rx->head_seq_num;
  1984. /* frame with out of date sequence number */
  1985. if (seq_less(mpdu_seq_num, head_seq_num)) {
  1986. dev_kfree_skb(skb);
  1987. return 1;
  1988. }
  1989. /* if frame sequence number exceeds our buffering window size or
  1990. * block Ack Request arrived - release stored frames */
  1991. if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
  1992. /* new head to the ordering buffer */
  1993. if (bar_req)
  1994. head_seq_num = mpdu_seq_num;
  1995. else
  1996. head_seq_num =
  1997. seq_inc(seq_sub(mpdu_seq_num, buf_size));
  1998. /* release stored frames up to new head to stack */
  1999. while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
  2000. index = seq_sub(tid_agg_rx->head_seq_num,
  2001. tid_agg_rx->ssn)
  2002. % tid_agg_rx->buf_size;
  2003. ieee80211_release_reorder_frame(hw, tid_agg_rx,
  2004. index);
  2005. }
  2006. if (bar_req)
  2007. return 1;
  2008. }
  2009. /* now the new frame is always in the range of the reordering */
  2010. /* buffer window */
  2011. index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
  2012. % tid_agg_rx->buf_size;
  2013. /* check if we already stored this frame */
  2014. if (tid_agg_rx->reorder_buf[index]) {
  2015. dev_kfree_skb(skb);
  2016. return 1;
  2017. }
  2018. /* if arrived mpdu is in the right order and nothing else stored */
  2019. /* release it immediately */
  2020. if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
  2021. tid_agg_rx->stored_mpdu_num == 0) {
  2022. tid_agg_rx->head_seq_num =
  2023. seq_inc(tid_agg_rx->head_seq_num);
  2024. return 0;
  2025. }
  2026. /* put the frame in the reordering buffer */
  2027. tid_agg_rx->reorder_buf[index] = skb;
  2028. memcpy(tid_agg_rx->reorder_buf[index]->cb, rxstatus,
  2029. sizeof(*rxstatus));
  2030. tid_agg_rx->stored_mpdu_num++;
  2031. /* release the buffer until next missing frame */
  2032. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
  2033. % tid_agg_rx->buf_size;
  2034. while (tid_agg_rx->reorder_buf[index]) {
  2035. ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
  2036. index = seq_sub(tid_agg_rx->head_seq_num,
  2037. tid_agg_rx->ssn) % tid_agg_rx->buf_size;
  2038. }
  2039. return 1;
  2040. }
  2041. static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
  2042. struct sk_buff *skb,
  2043. struct ieee80211_rx_status *status)
  2044. {
  2045. struct ieee80211_hw *hw = &local->hw;
  2046. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  2047. struct sta_info *sta;
  2048. struct tid_ampdu_rx *tid_agg_rx;
  2049. u16 sc;
  2050. u16 mpdu_seq_num;
  2051. u8 ret = 0;
  2052. int tid;
  2053. sta = sta_info_get(local, hdr->addr2);
  2054. if (!sta)
  2055. return ret;
  2056. /* filter the QoS data rx stream according to
  2057. * STA/TID and check if this STA/TID is on aggregation */
  2058. if (!ieee80211_is_data_qos(hdr->frame_control))
  2059. goto end_reorder;
  2060. tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
  2061. if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
  2062. goto end_reorder;
  2063. tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
  2064. /* qos null data frames are excluded */
  2065. if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
  2066. goto end_reorder;
  2067. /* new un-ordered ampdu frame - process it */
  2068. /* reset session timer */
  2069. if (tid_agg_rx->timeout)
  2070. mod_timer(&tid_agg_rx->session_timer,
  2071. TU_TO_EXP_TIME(tid_agg_rx->timeout));
  2072. /* if this mpdu is fragmented - terminate rx aggregation session */
  2073. sc = le16_to_cpu(hdr->seq_ctrl);
  2074. if (sc & IEEE80211_SCTL_FRAG) {
  2075. ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
  2076. tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
  2077. ret = 1;
  2078. goto end_reorder;
  2079. }
  2080. /* according to mpdu sequence number deal with reordering buffer */
  2081. mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
  2082. ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb, status,
  2083. mpdu_seq_num, 0);
  2084. end_reorder:
  2085. return ret;
  2086. }
  2087. /*
  2088. * This is the receive path handler. It is called by a low level driver when an
  2089. * 802.11 MPDU is received from the hardware.
  2090. */
  2091. void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
  2092. struct ieee80211_rx_status *status)
  2093. {
  2094. struct ieee80211_local *local = hw_to_local(hw);
  2095. struct ieee80211_rate *rate = NULL;
  2096. struct ieee80211_supported_band *sband;
  2097. if (status->band < 0 ||
  2098. status->band >= IEEE80211_NUM_BANDS) {
  2099. WARN_ON(1);
  2100. return;
  2101. }
  2102. sband = local->hw.wiphy->bands[status->band];
  2103. if (!sband) {
  2104. WARN_ON(1);
  2105. return;
  2106. }
  2107. if (status->flag & RX_FLAG_HT) {
  2108. /* rate_idx is MCS index */
  2109. if (WARN_ON(status->rate_idx < 0 ||
  2110. status->rate_idx >= 76))
  2111. return;
  2112. /* HT rates are not in the table - use the highest legacy rate
  2113. * for now since other parts of mac80211 may not yet be fully
  2114. * MCS aware. */
  2115. rate = &sband->bitrates[sband->n_bitrates - 1];
  2116. } else {
  2117. if (WARN_ON(status->rate_idx < 0 ||
  2118. status->rate_idx >= sband->n_bitrates))
  2119. return;
  2120. rate = &sband->bitrates[status->rate_idx];
  2121. }
  2122. /*
  2123. * key references and virtual interfaces are protected using RCU
  2124. * and this requires that we are in a read-side RCU section during
  2125. * receive processing
  2126. */
  2127. rcu_read_lock();
  2128. /*
  2129. * Frames with failed FCS/PLCP checksum are not returned,
  2130. * all other frames are returned without radiotap header
  2131. * if it was previously present.
  2132. * Also, frames with less than 16 bytes are dropped.
  2133. */
  2134. skb = ieee80211_rx_monitor(local, skb, status, rate);
  2135. if (!skb) {
  2136. rcu_read_unlock();
  2137. return;
  2138. }
  2139. if (!ieee80211_rx_reorder_ampdu(local, skb, status))
  2140. __ieee80211_rx_handle_packet(hw, skb, status, rate);
  2141. rcu_read_unlock();
  2142. }
  2143. EXPORT_SYMBOL(__ieee80211_rx);
  2144. /* This is a version of the rx handler that can be called from hard irq
  2145. * context. Post the skb on the queue and schedule the tasklet */
  2146. void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
  2147. struct ieee80211_rx_status *status)
  2148. {
  2149. struct ieee80211_local *local = hw_to_local(hw);
  2150. BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
  2151. skb->dev = local->mdev;
  2152. /* copy status into skb->cb for use by tasklet */
  2153. memcpy(skb->cb, status, sizeof(*status));
  2154. skb->pkt_type = IEEE80211_RX_MSG;
  2155. skb_queue_tail(&local->skb_queue, skb);
  2156. tasklet_schedule(&local->tasklet);
  2157. }
  2158. EXPORT_SYMBOL(ieee80211_rx_irqsafe);