rx.c 56 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041
  1. /*
  2. * Copyright 2002-2005, Instant802 Networks, Inc.
  3. * Copyright 2005-2006, Devicescape Software, Inc.
  4. * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
  5. * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License version 2 as
  9. * published by the Free Software Foundation.
  10. */
  11. #include <linux/kernel.h>
  12. #include <linux/skbuff.h>
  13. #include <linux/netdevice.h>
  14. #include <linux/etherdevice.h>
  15. #include <linux/rcupdate.h>
  16. #include <net/mac80211.h>
  17. #include <net/ieee80211_radiotap.h>
  18. #include "ieee80211_i.h"
  19. #include "ieee80211_led.h"
  20. #include "wep.h"
  21. #include "wpa.h"
  22. #include "tkip.h"
  23. #include "wme.h"
  24. u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  25. struct tid_ampdu_rx *tid_agg_rx,
  26. struct sk_buff *skb, u16 mpdu_seq_num,
  27. int bar_req);
  28. /*
  29. * monitor mode reception
  30. *
  31. * This function cleans up the SKB, i.e. it removes all the stuff
  32. * only useful for monitoring.
  33. */
  34. static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  35. struct sk_buff *skb,
  36. int rtap_len)
  37. {
  38. skb_pull(skb, rtap_len);
  39. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
  40. if (likely(skb->len > FCS_LEN))
  41. skb_trim(skb, skb->len - FCS_LEN);
  42. else {
  43. /* driver bug */
  44. WARN_ON(1);
  45. dev_kfree_skb(skb);
  46. skb = NULL;
  47. }
  48. }
  49. return skb;
  50. }
  51. static inline int should_drop_frame(struct ieee80211_rx_status *status,
  52. struct sk_buff *skb,
  53. int present_fcs_len,
  54. int radiotap_len)
  55. {
  56. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  57. if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  58. return 1;
  59. if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
  60. return 1;
  61. if (((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
  62. cpu_to_le16(IEEE80211_FTYPE_CTL)) &&
  63. ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
  64. cpu_to_le16(IEEE80211_STYPE_PSPOLL)) &&
  65. ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
  66. cpu_to_le16(IEEE80211_STYPE_BACK_REQ)))
  67. return 1;
  68. return 0;
  69. }
  70. /*
  71. * This function copies a received frame to all monitor interfaces and
  72. * returns a cleaned-up SKB that no longer includes the FCS nor the
  73. * radiotap header the driver might have added.
  74. */
  75. static struct sk_buff *
  76. ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
  77. struct ieee80211_rx_status *status)
  78. {
  79. struct ieee80211_sub_if_data *sdata;
  80. struct ieee80211_rate *rate;
  81. int needed_headroom = 0;
  82. struct ieee80211_radiotap_header *rthdr;
  83. __le64 *rttsft = NULL;
  84. struct ieee80211_rtap_fixed_data {
  85. u8 flags;
  86. u8 rate;
  87. __le16 chan_freq;
  88. __le16 chan_flags;
  89. u8 antsignal;
  90. u8 padding_for_rxflags;
  91. __le16 rx_flags;
  92. } __attribute__ ((packed)) *rtfixed;
  93. struct sk_buff *skb, *skb2;
  94. struct net_device *prev_dev = NULL;
  95. int present_fcs_len = 0;
  96. int rtap_len = 0;
  97. /*
  98. * First, we may need to make a copy of the skb because
  99. * (1) we need to modify it for radiotap (if not present), and
  100. * (2) the other RX handlers will modify the skb we got.
  101. *
  102. * We don't need to, of course, if we aren't going to return
  103. * the SKB because it has a bad FCS/PLCP checksum.
  104. */
  105. if (status->flag & RX_FLAG_RADIOTAP)
  106. rtap_len = ieee80211_get_radiotap_len(origskb->data);
  107. else
  108. /* room for radiotap header, always present fields and TSFT */
  109. needed_headroom = sizeof(*rthdr) + sizeof(*rtfixed) + 8;
  110. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  111. present_fcs_len = FCS_LEN;
  112. if (!local->monitors) {
  113. if (should_drop_frame(status, origskb, present_fcs_len,
  114. rtap_len)) {
  115. dev_kfree_skb(origskb);
  116. return NULL;
  117. }
  118. return remove_monitor_info(local, origskb, rtap_len);
  119. }
  120. if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
  121. /* only need to expand headroom if necessary */
  122. skb = origskb;
  123. origskb = NULL;
  124. /*
  125. * This shouldn't trigger often because most devices have an
  126. * RX header they pull before we get here, and that should
  127. * be big enough for our radiotap information. We should
  128. * probably export the length to drivers so that we can have
  129. * them allocate enough headroom to start with.
  130. */
  131. if (skb_headroom(skb) < needed_headroom &&
  132. pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
  133. dev_kfree_skb(skb);
  134. return NULL;
  135. }
  136. } else {
  137. /*
  138. * Need to make a copy and possibly remove radiotap header
  139. * and FCS from the original.
  140. */
  141. skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
  142. origskb = remove_monitor_info(local, origskb, rtap_len);
  143. if (!skb)
  144. return origskb;
  145. }
  146. /* if necessary, prepend radiotap information */
  147. if (!(status->flag & RX_FLAG_RADIOTAP)) {
  148. rtfixed = (void *) skb_push(skb, sizeof(*rtfixed));
  149. rtap_len = sizeof(*rthdr) + sizeof(*rtfixed);
  150. if (status->flag & RX_FLAG_TSFT) {
  151. rttsft = (void *) skb_push(skb, sizeof(*rttsft));
  152. rtap_len += 8;
  153. }
  154. rthdr = (void *) skb_push(skb, sizeof(*rthdr));
  155. memset(rthdr, 0, sizeof(*rthdr));
  156. memset(rtfixed, 0, sizeof(*rtfixed));
  157. rthdr->it_present =
  158. cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
  159. (1 << IEEE80211_RADIOTAP_RATE) |
  160. (1 << IEEE80211_RADIOTAP_CHANNEL) |
  161. (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |
  162. (1 << IEEE80211_RADIOTAP_RX_FLAGS));
  163. rtfixed->flags = 0;
  164. if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
  165. rtfixed->flags |= IEEE80211_RADIOTAP_F_FCS;
  166. if (rttsft) {
  167. *rttsft = cpu_to_le64(status->mactime);
  168. rthdr->it_present |=
  169. cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
  170. }
  171. /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
  172. rtfixed->rx_flags = 0;
  173. if (status->flag &
  174. (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  175. rtfixed->rx_flags |=
  176. cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
  177. rate = ieee80211_get_rate(local, status->phymode,
  178. status->rate);
  179. if (rate)
  180. rtfixed->rate = rate->rate / 5;
  181. rtfixed->chan_freq = cpu_to_le16(status->freq);
  182. if (status->phymode == MODE_IEEE80211A)
  183. rtfixed->chan_flags =
  184. cpu_to_le16(IEEE80211_CHAN_OFDM |
  185. IEEE80211_CHAN_5GHZ);
  186. else
  187. rtfixed->chan_flags =
  188. cpu_to_le16(IEEE80211_CHAN_DYN |
  189. IEEE80211_CHAN_2GHZ);
  190. rtfixed->antsignal = status->ssi;
  191. rthdr->it_len = cpu_to_le16(rtap_len);
  192. }
  193. skb_reset_mac_header(skb);
  194. skb->ip_summed = CHECKSUM_UNNECESSARY;
  195. skb->pkt_type = PACKET_OTHERHOST;
  196. skb->protocol = htons(ETH_P_802_2);
  197. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  198. if (!netif_running(sdata->dev))
  199. continue;
  200. if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
  201. continue;
  202. if (prev_dev) {
  203. skb2 = skb_clone(skb, GFP_ATOMIC);
  204. if (skb2) {
  205. skb2->dev = prev_dev;
  206. netif_rx(skb2);
  207. }
  208. }
  209. prev_dev = sdata->dev;
  210. sdata->dev->stats.rx_packets++;
  211. sdata->dev->stats.rx_bytes += skb->len;
  212. }
  213. if (prev_dev) {
  214. skb->dev = prev_dev;
  215. netif_rx(skb);
  216. } else
  217. dev_kfree_skb(skb);
  218. return origskb;
  219. }
  220. /* pre-rx handlers
  221. *
  222. * these don't have dev/sdata fields in the rx data
  223. * The sta value should also not be used because it may
  224. * be NULL even though a STA (in IBSS mode) will be added.
  225. */
  226. static ieee80211_txrx_result
  227. ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
  228. {
  229. u8 *data = rx->skb->data;
  230. int tid;
  231. /* does the frame have a qos control field? */
  232. if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
  233. u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
  234. /* frame has qos control */
  235. tid = qc[0] & QOS_CONTROL_TID_MASK;
  236. if (qc[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
  237. rx->flags |= IEEE80211_TXRXD_RX_AMSDU;
  238. else
  239. rx->flags &= ~IEEE80211_TXRXD_RX_AMSDU;
  240. } else {
  241. if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
  242. /* Separate TID for management frames */
  243. tid = NUM_RX_DATA_QUEUES - 1;
  244. } else {
  245. /* no qos control present */
  246. tid = 0; /* 802.1d - Best Effort */
  247. }
  248. }
  249. I802_DEBUG_INC(rx->local->wme_rx_queue[tid]);
  250. /* only a debug counter, sta might not be assigned properly yet */
  251. if (rx->sta)
  252. I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]);
  253. rx->u.rx.queue = tid;
  254. /* Set skb->priority to 1d tag if highest order bit of TID is not set.
  255. * For now, set skb->priority to 0 for other cases. */
  256. rx->skb->priority = (tid > 7) ? 0 : tid;
  257. return TXRX_CONTINUE;
  258. }
  259. static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
  260. struct sk_buff *skb,
  261. struct ieee80211_rx_status *status)
  262. {
  263. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  264. u32 load = 0, hdrtime;
  265. struct ieee80211_rate *rate;
  266. struct ieee80211_hw_mode *mode = local->hw.conf.mode;
  267. int i;
  268. /* Estimate total channel use caused by this frame */
  269. if (unlikely(mode->num_rates < 0))
  270. return TXRX_CONTINUE;
  271. rate = &mode->rates[0];
  272. for (i = 0; i < mode->num_rates; i++) {
  273. if (mode->rates[i].val == status->rate) {
  274. rate = &mode->rates[i];
  275. break;
  276. }
  277. }
  278. /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
  279. * 1 usec = 1/8 * (1080 / 10) = 13.5 */
  280. if (mode->mode == MODE_IEEE80211A ||
  281. (mode->mode == MODE_IEEE80211G &&
  282. rate->flags & IEEE80211_RATE_ERP))
  283. hdrtime = CHAN_UTIL_HDR_SHORT;
  284. else
  285. hdrtime = CHAN_UTIL_HDR_LONG;
  286. load = hdrtime;
  287. if (!is_multicast_ether_addr(hdr->addr1))
  288. load += hdrtime;
  289. load += skb->len * rate->rate_inv;
  290. /* Divide channel_use by 8 to avoid wrapping around the counter */
  291. load >>= CHAN_UTIL_SHIFT;
  292. return load;
  293. }
  294. ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
  295. {
  296. ieee80211_rx_h_parse_qos,
  297. NULL
  298. };
  299. /* rx handlers */
  300. static ieee80211_txrx_result
  301. ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
  302. {
  303. if (rx->sta)
  304. rx->sta->channel_use_raw += rx->u.rx.load;
  305. rx->sdata->channel_use_raw += rx->u.rx.load;
  306. return TXRX_CONTINUE;
  307. }
  308. static ieee80211_txrx_result
  309. ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
  310. {
  311. struct ieee80211_local *local = rx->local;
  312. struct sk_buff *skb = rx->skb;
  313. if (unlikely(local->sta_hw_scanning))
  314. return ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status);
  315. if (unlikely(local->sta_sw_scanning)) {
  316. /* drop all the other packets during a software scan anyway */
  317. if (ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status)
  318. != TXRX_QUEUED)
  319. dev_kfree_skb(skb);
  320. return TXRX_QUEUED;
  321. }
  322. if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
  323. /* scanning finished during invoking of handlers */
  324. I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
  325. return TXRX_DROP;
  326. }
  327. return TXRX_CONTINUE;
  328. }
  329. static ieee80211_txrx_result
  330. ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
  331. {
  332. struct ieee80211_hdr *hdr;
  333. hdr = (struct ieee80211_hdr *) rx->skb->data;
  334. /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
  335. if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
  336. if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
  337. rx->sta->last_seq_ctrl[rx->u.rx.queue] ==
  338. hdr->seq_ctrl)) {
  339. if (rx->flags & IEEE80211_TXRXD_RXRA_MATCH) {
  340. rx->local->dot11FrameDuplicateCount++;
  341. rx->sta->num_duplicates++;
  342. }
  343. return TXRX_DROP;
  344. } else
  345. rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
  346. }
  347. if (unlikely(rx->skb->len < 16)) {
  348. I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
  349. return TXRX_DROP;
  350. }
  351. /* Drop disallowed frame classes based on STA auth/assoc state;
  352. * IEEE 802.11, Chap 5.5.
  353. *
  354. * 80211.o does filtering only based on association state, i.e., it
  355. * drops Class 3 frames from not associated stations. hostapd sends
  356. * deauth/disassoc frames when needed. In addition, hostapd is
  357. * responsible for filtering on both auth and assoc states.
  358. */
  359. if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
  360. ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
  361. (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
  362. rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
  363. (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
  364. if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
  365. !(rx->fc & IEEE80211_FCTL_TODS) &&
  366. (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
  367. || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
  368. /* Drop IBSS frames and frames for other hosts
  369. * silently. */
  370. return TXRX_DROP;
  371. }
  372. return TXRX_DROP;
  373. }
  374. return TXRX_CONTINUE;
  375. }
  376. static ieee80211_txrx_result
  377. ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
  378. {
  379. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
  380. int keyidx;
  381. int hdrlen;
  382. ieee80211_txrx_result result = TXRX_DROP;
  383. struct ieee80211_key *stakey = NULL;
  384. /*
  385. * Key selection 101
  386. *
  387. * There are three types of keys:
  388. * - GTK (group keys)
  389. * - PTK (pairwise keys)
  390. * - STK (station-to-station pairwise keys)
  391. *
  392. * When selecting a key, we have to distinguish between multicast
  393. * (including broadcast) and unicast frames, the latter can only
  394. * use PTKs and STKs while the former always use GTKs. Unless, of
  395. * course, actual WEP keys ("pre-RSNA") are used, then unicast
  396. * frames can also use key indizes like GTKs. Hence, if we don't
  397. * have a PTK/STK we check the key index for a WEP key.
  398. *
  399. * Note that in a regular BSS, multicast frames are sent by the
  400. * AP only, associated stations unicast the frame to the AP first
  401. * which then multicasts it on their behalf.
  402. *
  403. * There is also a slight problem in IBSS mode: GTKs are negotiated
  404. * with each station, that is something we don't currently handle.
  405. * The spec seems to expect that one negotiates the same key with
  406. * every station but there's no such requirement; VLANs could be
  407. * possible.
  408. */
  409. if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
  410. return TXRX_CONTINUE;
  411. /*
  412. * No point in finding a key and decrypting if the frame is neither
  413. * addressed to us nor a multicast frame.
  414. */
  415. if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
  416. return TXRX_CONTINUE;
  417. if (rx->sta)
  418. stakey = rcu_dereference(rx->sta->key);
  419. if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
  420. rx->key = stakey;
  421. } else {
  422. /*
  423. * The device doesn't give us the IV so we won't be
  424. * able to look up the key. That's ok though, we
  425. * don't need to decrypt the frame, we just won't
  426. * be able to keep statistics accurate.
  427. * Except for key threshold notifications, should
  428. * we somehow allow the driver to tell us which key
  429. * the hardware used if this flag is set?
  430. */
  431. if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
  432. (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
  433. return TXRX_CONTINUE;
  434. hdrlen = ieee80211_get_hdrlen(rx->fc);
  435. if (rx->skb->len < 8 + hdrlen)
  436. return TXRX_DROP; /* TODO: count this? */
  437. /*
  438. * no need to call ieee80211_wep_get_keyidx,
  439. * it verifies a bunch of things we've done already
  440. */
  441. keyidx = rx->skb->data[hdrlen + 3] >> 6;
  442. rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
  443. /*
  444. * RSNA-protected unicast frames should always be sent with
  445. * pairwise or station-to-station keys, but for WEP we allow
  446. * using a key index as well.
  447. */
  448. if (rx->key && rx->key->conf.alg != ALG_WEP &&
  449. !is_multicast_ether_addr(hdr->addr1))
  450. rx->key = NULL;
  451. }
  452. if (rx->key) {
  453. rx->key->tx_rx_count++;
  454. /* TODO: add threshold stuff again */
  455. } else {
  456. #ifdef CONFIG_MAC80211_DEBUG
  457. if (net_ratelimit())
  458. printk(KERN_DEBUG "%s: RX protected frame,"
  459. " but have no key\n", rx->dev->name);
  460. #endif /* CONFIG_MAC80211_DEBUG */
  461. return TXRX_DROP;
  462. }
  463. /* Check for weak IVs if possible */
  464. if (rx->sta && rx->key->conf.alg == ALG_WEP &&
  465. ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
  466. (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) ||
  467. !(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) &&
  468. ieee80211_wep_is_weak_iv(rx->skb, rx->key))
  469. rx->sta->wep_weak_iv_count++;
  470. switch (rx->key->conf.alg) {
  471. case ALG_WEP:
  472. result = ieee80211_crypto_wep_decrypt(rx);
  473. break;
  474. case ALG_TKIP:
  475. result = ieee80211_crypto_tkip_decrypt(rx);
  476. break;
  477. case ALG_CCMP:
  478. result = ieee80211_crypto_ccmp_decrypt(rx);
  479. break;
  480. }
  481. /* either the frame has been decrypted or will be dropped */
  482. rx->u.rx.status->flag |= RX_FLAG_DECRYPTED;
  483. return result;
  484. }
  485. static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
  486. {
  487. struct ieee80211_sub_if_data *sdata;
  488. DECLARE_MAC_BUF(mac);
  489. sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
  490. if (sdata->bss)
  491. atomic_inc(&sdata->bss->num_sta_ps);
  492. sta->flags |= WLAN_STA_PS;
  493. sta->pspoll = 0;
  494. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  495. printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
  496. dev->name, print_mac(mac, sta->addr), sta->aid);
  497. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  498. }
  499. static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
  500. {
  501. struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
  502. struct sk_buff *skb;
  503. int sent = 0;
  504. struct ieee80211_sub_if_data *sdata;
  505. struct ieee80211_tx_packet_data *pkt_data;
  506. DECLARE_MAC_BUF(mac);
  507. sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
  508. if (sdata->bss)
  509. atomic_dec(&sdata->bss->num_sta_ps);
  510. sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
  511. sta->pspoll = 0;
  512. if (!skb_queue_empty(&sta->ps_tx_buf)) {
  513. if (local->ops->set_tim)
  514. local->ops->set_tim(local_to_hw(local), sta->aid, 0);
  515. if (sdata->bss)
  516. bss_tim_clear(local, sdata->bss, sta->aid);
  517. }
  518. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  519. printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
  520. dev->name, print_mac(mac, sta->addr), sta->aid);
  521. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  522. /* Send all buffered frames to the station */
  523. while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
  524. pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
  525. sent++;
  526. pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
  527. dev_queue_xmit(skb);
  528. }
  529. while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
  530. pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
  531. local->total_ps_buffered--;
  532. sent++;
  533. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  534. printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
  535. "since STA not sleeping anymore\n", dev->name,
  536. print_mac(mac, sta->addr), sta->aid);
  537. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  538. pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
  539. dev_queue_xmit(skb);
  540. }
  541. return sent;
  542. }
  543. static ieee80211_txrx_result
  544. ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
  545. {
  546. struct sta_info *sta = rx->sta;
  547. struct net_device *dev = rx->dev;
  548. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
  549. if (!sta)
  550. return TXRX_CONTINUE;
  551. /* Update last_rx only for IBSS packets which are for the current
  552. * BSSID to avoid keeping the current IBSS network alive in cases where
  553. * other STAs are using different BSSID. */
  554. if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
  555. u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
  556. IEEE80211_IF_TYPE_IBSS);
  557. if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
  558. sta->last_rx = jiffies;
  559. } else
  560. if (!is_multicast_ether_addr(hdr->addr1) ||
  561. rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
  562. /* Update last_rx only for unicast frames in order to prevent
  563. * the Probe Request frames (the only broadcast frames from a
  564. * STA in infrastructure mode) from keeping a connection alive.
  565. */
  566. sta->last_rx = jiffies;
  567. }
  568. if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
  569. return TXRX_CONTINUE;
  570. sta->rx_fragments++;
  571. sta->rx_bytes += rx->skb->len;
  572. sta->last_rssi = rx->u.rx.status->ssi;
  573. sta->last_signal = rx->u.rx.status->signal;
  574. sta->last_noise = rx->u.rx.status->noise;
  575. if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
  576. /* Change STA power saving mode only in the end of a frame
  577. * exchange sequence */
  578. if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
  579. rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta);
  580. else if (!(sta->flags & WLAN_STA_PS) &&
  581. (rx->fc & IEEE80211_FCTL_PM))
  582. ap_sta_ps_start(dev, sta);
  583. }
  584. /* Drop data::nullfunc frames silently, since they are used only to
  585. * control station power saving mode. */
  586. if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
  587. (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
  588. I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
  589. /* Update counter and free packet here to avoid counting this
  590. * as a dropped packed. */
  591. sta->rx_packets++;
  592. dev_kfree_skb(rx->skb);
  593. return TXRX_QUEUED;
  594. }
  595. return TXRX_CONTINUE;
  596. } /* ieee80211_rx_h_sta_process */
  597. static inline struct ieee80211_fragment_entry *
  598. ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
  599. unsigned int frag, unsigned int seq, int rx_queue,
  600. struct sk_buff **skb)
  601. {
  602. struct ieee80211_fragment_entry *entry;
  603. int idx;
  604. idx = sdata->fragment_next;
  605. entry = &sdata->fragments[sdata->fragment_next++];
  606. if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
  607. sdata->fragment_next = 0;
  608. if (!skb_queue_empty(&entry->skb_list)) {
  609. #ifdef CONFIG_MAC80211_DEBUG
  610. struct ieee80211_hdr *hdr =
  611. (struct ieee80211_hdr *) entry->skb_list.next->data;
  612. DECLARE_MAC_BUF(mac);
  613. DECLARE_MAC_BUF(mac2);
  614. printk(KERN_DEBUG "%s: RX reassembly removed oldest "
  615. "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
  616. "addr1=%s addr2=%s\n",
  617. sdata->dev->name, idx,
  618. jiffies - entry->first_frag_time, entry->seq,
  619. entry->last_frag, print_mac(mac, hdr->addr1),
  620. print_mac(mac2, hdr->addr2));
  621. #endif /* CONFIG_MAC80211_DEBUG */
  622. __skb_queue_purge(&entry->skb_list);
  623. }
  624. __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
  625. *skb = NULL;
  626. entry->first_frag_time = jiffies;
  627. entry->seq = seq;
  628. entry->rx_queue = rx_queue;
  629. entry->last_frag = frag;
  630. entry->ccmp = 0;
  631. entry->extra_len = 0;
  632. return entry;
  633. }
  634. static inline struct ieee80211_fragment_entry *
  635. ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
  636. u16 fc, unsigned int frag, unsigned int seq,
  637. int rx_queue, struct ieee80211_hdr *hdr)
  638. {
  639. struct ieee80211_fragment_entry *entry;
  640. int i, idx;
  641. idx = sdata->fragment_next;
  642. for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
  643. struct ieee80211_hdr *f_hdr;
  644. u16 f_fc;
  645. idx--;
  646. if (idx < 0)
  647. idx = IEEE80211_FRAGMENT_MAX - 1;
  648. entry = &sdata->fragments[idx];
  649. if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
  650. entry->rx_queue != rx_queue ||
  651. entry->last_frag + 1 != frag)
  652. continue;
  653. f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
  654. f_fc = le16_to_cpu(f_hdr->frame_control);
  655. if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
  656. compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
  657. compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
  658. continue;
  659. if (entry->first_frag_time + 2 * HZ < jiffies) {
  660. __skb_queue_purge(&entry->skb_list);
  661. continue;
  662. }
  663. return entry;
  664. }
  665. return NULL;
  666. }
  667. static ieee80211_txrx_result
  668. ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
  669. {
  670. struct ieee80211_hdr *hdr;
  671. u16 sc;
  672. unsigned int frag, seq;
  673. struct ieee80211_fragment_entry *entry;
  674. struct sk_buff *skb;
  675. DECLARE_MAC_BUF(mac);
  676. hdr = (struct ieee80211_hdr *) rx->skb->data;
  677. sc = le16_to_cpu(hdr->seq_ctrl);
  678. frag = sc & IEEE80211_SCTL_FRAG;
  679. if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
  680. (rx->skb)->len < 24 ||
  681. is_multicast_ether_addr(hdr->addr1))) {
  682. /* not fragmented */
  683. goto out;
  684. }
  685. I802_DEBUG_INC(rx->local->rx_handlers_fragments);
  686. seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
  687. if (frag == 0) {
  688. /* This is the first fragment of a new frame. */
  689. entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
  690. rx->u.rx.queue, &(rx->skb));
  691. if (rx->key && rx->key->conf.alg == ALG_CCMP &&
  692. (rx->fc & IEEE80211_FCTL_PROTECTED)) {
  693. /* Store CCMP PN so that we can verify that the next
  694. * fragment has a sequential PN value. */
  695. entry->ccmp = 1;
  696. memcpy(entry->last_pn,
  697. rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
  698. CCMP_PN_LEN);
  699. }
  700. return TXRX_QUEUED;
  701. }
  702. /* This is a fragment for a frame that should already be pending in
  703. * fragment cache. Add this fragment to the end of the pending entry.
  704. */
  705. entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
  706. rx->u.rx.queue, hdr);
  707. if (!entry) {
  708. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  709. return TXRX_DROP;
  710. }
  711. /* Verify that MPDUs within one MSDU have sequential PN values.
  712. * (IEEE 802.11i, 8.3.3.4.5) */
  713. if (entry->ccmp) {
  714. int i;
  715. u8 pn[CCMP_PN_LEN], *rpn;
  716. if (!rx->key || rx->key->conf.alg != ALG_CCMP)
  717. return TXRX_DROP;
  718. memcpy(pn, entry->last_pn, CCMP_PN_LEN);
  719. for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
  720. pn[i]++;
  721. if (pn[i])
  722. break;
  723. }
  724. rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue];
  725. if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
  726. if (net_ratelimit())
  727. printk(KERN_DEBUG "%s: defrag: CCMP PN not "
  728. "sequential A2=%s"
  729. " PN=%02x%02x%02x%02x%02x%02x "
  730. "(expected %02x%02x%02x%02x%02x%02x)\n",
  731. rx->dev->name, print_mac(mac, hdr->addr2),
  732. rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
  733. rpn[5], pn[0], pn[1], pn[2], pn[3],
  734. pn[4], pn[5]);
  735. return TXRX_DROP;
  736. }
  737. memcpy(entry->last_pn, pn, CCMP_PN_LEN);
  738. }
  739. skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
  740. __skb_queue_tail(&entry->skb_list, rx->skb);
  741. entry->last_frag = frag;
  742. entry->extra_len += rx->skb->len;
  743. if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
  744. rx->skb = NULL;
  745. return TXRX_QUEUED;
  746. }
  747. rx->skb = __skb_dequeue(&entry->skb_list);
  748. if (skb_tailroom(rx->skb) < entry->extra_len) {
  749. I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
  750. if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
  751. GFP_ATOMIC))) {
  752. I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
  753. __skb_queue_purge(&entry->skb_list);
  754. return TXRX_DROP;
  755. }
  756. }
  757. while ((skb = __skb_dequeue(&entry->skb_list))) {
  758. memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
  759. dev_kfree_skb(skb);
  760. }
  761. /* Complete frame has been reassembled - process it now */
  762. rx->flags |= IEEE80211_TXRXD_FRAGMENTED;
  763. out:
  764. if (rx->sta)
  765. rx->sta->rx_packets++;
  766. if (is_multicast_ether_addr(hdr->addr1))
  767. rx->local->dot11MulticastReceivedFrameCount++;
  768. else
  769. ieee80211_led_rx(rx->local);
  770. return TXRX_CONTINUE;
  771. }
  772. static ieee80211_txrx_result
  773. ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
  774. {
  775. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
  776. struct sk_buff *skb;
  777. int no_pending_pkts;
  778. DECLARE_MAC_BUF(mac);
  779. if (likely(!rx->sta ||
  780. (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
  781. (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
  782. !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
  783. return TXRX_CONTINUE;
  784. if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
  785. (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
  786. return TXRX_DROP;
  787. skb = skb_dequeue(&rx->sta->tx_filtered);
  788. if (!skb) {
  789. skb = skb_dequeue(&rx->sta->ps_tx_buf);
  790. if (skb)
  791. rx->local->total_ps_buffered--;
  792. }
  793. no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
  794. skb_queue_empty(&rx->sta->ps_tx_buf);
  795. if (skb) {
  796. struct ieee80211_hdr *hdr =
  797. (struct ieee80211_hdr *) skb->data;
  798. /* tell TX path to send one frame even though the STA may
  799. * still remain is PS mode after this frame exchange */
  800. rx->sta->pspoll = 1;
  801. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  802. printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
  803. print_mac(mac, rx->sta->addr), rx->sta->aid,
  804. skb_queue_len(&rx->sta->ps_tx_buf));
  805. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  806. /* Use MoreData flag to indicate whether there are more
  807. * buffered frames for this STA */
  808. if (no_pending_pkts) {
  809. hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
  810. rx->sta->flags &= ~WLAN_STA_TIM;
  811. } else
  812. hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
  813. dev_queue_xmit(skb);
  814. if (no_pending_pkts) {
  815. if (rx->local->ops->set_tim)
  816. rx->local->ops->set_tim(local_to_hw(rx->local),
  817. rx->sta->aid, 0);
  818. if (rx->sdata->bss)
  819. bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
  820. }
  821. #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
  822. } else if (!rx->u.rx.sent_ps_buffered) {
  823. printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
  824. "though there is no buffered frames for it\n",
  825. rx->dev->name, print_mac(mac, rx->sta->addr));
  826. #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
  827. }
  828. /* Free PS Poll skb here instead of returning TXRX_DROP that would
  829. * count as an dropped frame. */
  830. dev_kfree_skb(rx->skb);
  831. return TXRX_QUEUED;
  832. }
  833. static ieee80211_txrx_result
  834. ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
  835. {
  836. u16 fc = rx->fc;
  837. u8 *data = rx->skb->data;
  838. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
  839. if (!WLAN_FC_IS_QOS_DATA(fc))
  840. return TXRX_CONTINUE;
  841. /* remove the qos control field, update frame type and meta-data */
  842. memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
  843. hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
  844. /* change frame type to non QOS */
  845. rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
  846. hdr->frame_control = cpu_to_le16(fc);
  847. return TXRX_CONTINUE;
  848. }
  849. static int
  850. ieee80211_802_1x_port_control(struct ieee80211_txrx_data *rx)
  851. {
  852. if (unlikely(rx->sdata->ieee802_1x_pac &&
  853. (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)))) {
  854. #ifdef CONFIG_MAC80211_DEBUG
  855. printk(KERN_DEBUG "%s: dropped frame "
  856. "(unauthorized port)\n", rx->dev->name);
  857. #endif /* CONFIG_MAC80211_DEBUG */
  858. return -EACCES;
  859. }
  860. return 0;
  861. }
  862. static int
  863. ieee80211_drop_unencrypted(struct ieee80211_txrx_data *rx)
  864. {
  865. /*
  866. * Pass through unencrypted frames if the hardware has
  867. * decrypted them already.
  868. */
  869. if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED)
  870. return 0;
  871. /* Drop unencrypted frames if key is set. */
  872. if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
  873. (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
  874. (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
  875. (rx->key || rx->sdata->drop_unencrypted))) {
  876. if (net_ratelimit())
  877. printk(KERN_DEBUG "%s: RX non-WEP frame, but expected "
  878. "encryption\n", rx->dev->name);
  879. return -EACCES;
  880. }
  881. return 0;
  882. }
  883. static int
  884. ieee80211_data_to_8023(struct ieee80211_txrx_data *rx)
  885. {
  886. struct net_device *dev = rx->dev;
  887. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
  888. u16 fc, hdrlen, ethertype;
  889. u8 *payload;
  890. u8 dst[ETH_ALEN];
  891. u8 src[ETH_ALEN];
  892. struct sk_buff *skb = rx->skb;
  893. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  894. DECLARE_MAC_BUF(mac);
  895. DECLARE_MAC_BUF(mac2);
  896. DECLARE_MAC_BUF(mac3);
  897. DECLARE_MAC_BUF(mac4);
  898. fc = rx->fc;
  899. if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
  900. return -1;
  901. hdrlen = ieee80211_get_hdrlen(fc);
  902. /* convert IEEE 802.11 header + possible LLC headers into Ethernet
  903. * header
  904. * IEEE 802.11 address fields:
  905. * ToDS FromDS Addr1 Addr2 Addr3 Addr4
  906. * 0 0 DA SA BSSID n/a
  907. * 0 1 DA BSSID SA n/a
  908. * 1 0 BSSID SA DA n/a
  909. * 1 1 RA TA DA SA
  910. */
  911. switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
  912. case IEEE80211_FCTL_TODS:
  913. /* BSSID SA DA */
  914. memcpy(dst, hdr->addr3, ETH_ALEN);
  915. memcpy(src, hdr->addr2, ETH_ALEN);
  916. if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
  917. sdata->vif.type != IEEE80211_IF_TYPE_VLAN)) {
  918. if (net_ratelimit())
  919. printk(KERN_DEBUG "%s: dropped ToDS frame "
  920. "(BSSID=%s SA=%s DA=%s)\n",
  921. dev->name,
  922. print_mac(mac, hdr->addr1),
  923. print_mac(mac2, hdr->addr2),
  924. print_mac(mac3, hdr->addr3));
  925. return -1;
  926. }
  927. break;
  928. case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
  929. /* RA TA DA SA */
  930. memcpy(dst, hdr->addr3, ETH_ALEN);
  931. memcpy(src, hdr->addr4, ETH_ALEN);
  932. if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS)) {
  933. if (net_ratelimit())
  934. printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
  935. "frame (RA=%s TA=%s DA=%s SA=%s)\n",
  936. rx->dev->name,
  937. print_mac(mac, hdr->addr1),
  938. print_mac(mac2, hdr->addr2),
  939. print_mac(mac3, hdr->addr3),
  940. print_mac(mac4, hdr->addr4));
  941. return -1;
  942. }
  943. break;
  944. case IEEE80211_FCTL_FROMDS:
  945. /* DA BSSID SA */
  946. memcpy(dst, hdr->addr1, ETH_ALEN);
  947. memcpy(src, hdr->addr3, ETH_ALEN);
  948. if (sdata->vif.type != IEEE80211_IF_TYPE_STA ||
  949. (is_multicast_ether_addr(dst) &&
  950. !compare_ether_addr(src, dev->dev_addr)))
  951. return -1;
  952. break;
  953. case 0:
  954. /* DA SA BSSID */
  955. memcpy(dst, hdr->addr1, ETH_ALEN);
  956. memcpy(src, hdr->addr2, ETH_ALEN);
  957. if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
  958. if (net_ratelimit()) {
  959. printk(KERN_DEBUG "%s: dropped IBSS frame "
  960. "(DA=%s SA=%s BSSID=%s)\n",
  961. dev->name,
  962. print_mac(mac, hdr->addr1),
  963. print_mac(mac2, hdr->addr2),
  964. print_mac(mac3, hdr->addr3));
  965. }
  966. return -1;
  967. }
  968. break;
  969. }
  970. if (unlikely(skb->len - hdrlen < 8)) {
  971. if (net_ratelimit()) {
  972. printk(KERN_DEBUG "%s: RX too short data frame "
  973. "payload\n", dev->name);
  974. }
  975. return -1;
  976. }
  977. payload = skb->data + hdrlen;
  978. ethertype = (payload[6] << 8) | payload[7];
  979. if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
  980. ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
  981. compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
  982. /* remove RFC1042 or Bridge-Tunnel encapsulation and
  983. * replace EtherType */
  984. skb_pull(skb, hdrlen + 6);
  985. memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
  986. memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
  987. } else {
  988. struct ethhdr *ehdr;
  989. __be16 len;
  990. skb_pull(skb, hdrlen);
  991. len = htons(skb->len);
  992. ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
  993. memcpy(ehdr->h_dest, dst, ETH_ALEN);
  994. memcpy(ehdr->h_source, src, ETH_ALEN);
  995. ehdr->h_proto = len;
  996. }
  997. return 0;
  998. }
  999. /*
  1000. * requires that rx->skb is a frame with ethernet header
  1001. */
  1002. static bool ieee80211_frame_allowed(struct ieee80211_txrx_data *rx)
  1003. {
  1004. static const u8 pae_group_addr[ETH_ALEN]
  1005. = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
  1006. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1007. /*
  1008. * Allow EAPOL frames to us/the PAE group address regardless
  1009. * of whether the frame was encrypted or not.
  1010. */
  1011. if (ehdr->h_proto == htons(ETH_P_PAE) &&
  1012. (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
  1013. compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
  1014. return true;
  1015. if (ieee80211_802_1x_port_control(rx) ||
  1016. ieee80211_drop_unencrypted(rx))
  1017. return false;
  1018. return true;
  1019. }
  1020. /*
  1021. * requires that rx->skb is a frame with ethernet header
  1022. */
  1023. static void
  1024. ieee80211_deliver_skb(struct ieee80211_txrx_data *rx)
  1025. {
  1026. struct net_device *dev = rx->dev;
  1027. struct ieee80211_local *local = rx->local;
  1028. struct sk_buff *skb, *xmit_skb;
  1029. struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
  1030. struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
  1031. struct sta_info *dsta;
  1032. skb = rx->skb;
  1033. xmit_skb = NULL;
  1034. if (local->bridge_packets && (sdata->vif.type == IEEE80211_IF_TYPE_AP ||
  1035. sdata->vif.type == IEEE80211_IF_TYPE_VLAN) &&
  1036. (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
  1037. if (is_multicast_ether_addr(ehdr->h_dest)) {
  1038. /*
  1039. * send multicast frames both to higher layers in
  1040. * local net stack and back to the wireless medium
  1041. */
  1042. xmit_skb = skb_copy(skb, GFP_ATOMIC);
  1043. if (!xmit_skb && net_ratelimit())
  1044. printk(KERN_DEBUG "%s: failed to clone "
  1045. "multicast frame\n", dev->name);
  1046. } else {
  1047. dsta = sta_info_get(local, skb->data);
  1048. if (dsta && dsta->dev == dev) {
  1049. /*
  1050. * The destination station is associated to
  1051. * this AP (in this VLAN), so send the frame
  1052. * directly to it and do not pass it to local
  1053. * net stack.
  1054. */
  1055. xmit_skb = skb;
  1056. skb = NULL;
  1057. }
  1058. if (dsta)
  1059. sta_info_put(dsta);
  1060. }
  1061. }
  1062. if (skb) {
  1063. /* deliver to local stack */
  1064. skb->protocol = eth_type_trans(skb, dev);
  1065. memset(skb->cb, 0, sizeof(skb->cb));
  1066. netif_rx(skb);
  1067. }
  1068. if (xmit_skb) {
  1069. /* send to wireless media */
  1070. xmit_skb->protocol = htons(ETH_P_802_3);
  1071. skb_reset_network_header(xmit_skb);
  1072. skb_reset_mac_header(xmit_skb);
  1073. dev_queue_xmit(xmit_skb);
  1074. }
  1075. }
  1076. static ieee80211_txrx_result
  1077. ieee80211_rx_h_amsdu(struct ieee80211_txrx_data *rx)
  1078. {
  1079. struct net_device *dev = rx->dev;
  1080. struct ieee80211_local *local = rx->local;
  1081. u16 fc, ethertype;
  1082. u8 *payload;
  1083. struct sk_buff *skb = rx->skb, *frame = NULL;
  1084. const struct ethhdr *eth;
  1085. int remaining, err;
  1086. u8 dst[ETH_ALEN];
  1087. u8 src[ETH_ALEN];
  1088. DECLARE_MAC_BUF(mac);
  1089. fc = rx->fc;
  1090. if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
  1091. return TXRX_CONTINUE;
  1092. if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
  1093. return TXRX_DROP;
  1094. if (!(rx->flags & IEEE80211_TXRXD_RX_AMSDU))
  1095. return TXRX_CONTINUE;
  1096. err = ieee80211_data_to_8023(rx);
  1097. if (unlikely(err))
  1098. return TXRX_DROP;
  1099. skb->dev = dev;
  1100. dev->stats.rx_packets++;
  1101. dev->stats.rx_bytes += skb->len;
  1102. /* skip the wrapping header */
  1103. eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
  1104. if (!eth)
  1105. return TXRX_DROP;
  1106. while (skb != frame) {
  1107. u8 padding;
  1108. __be16 len = eth->h_proto;
  1109. unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
  1110. remaining = skb->len;
  1111. memcpy(dst, eth->h_dest, ETH_ALEN);
  1112. memcpy(src, eth->h_source, ETH_ALEN);
  1113. padding = ((4 - subframe_len) & 0x3);
  1114. /* the last MSDU has no padding */
  1115. if (subframe_len > remaining) {
  1116. printk(KERN_DEBUG "%s: wrong buffer size", dev->name);
  1117. return TXRX_DROP;
  1118. }
  1119. skb_pull(skb, sizeof(struct ethhdr));
  1120. /* if last subframe reuse skb */
  1121. if (remaining <= subframe_len + padding)
  1122. frame = skb;
  1123. else {
  1124. frame = dev_alloc_skb(local->hw.extra_tx_headroom +
  1125. subframe_len);
  1126. if (frame == NULL)
  1127. return TXRX_DROP;
  1128. skb_reserve(frame, local->hw.extra_tx_headroom +
  1129. sizeof(struct ethhdr));
  1130. memcpy(skb_put(frame, ntohs(len)), skb->data,
  1131. ntohs(len));
  1132. eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
  1133. padding);
  1134. if (!eth) {
  1135. printk(KERN_DEBUG "%s: wrong buffer size ",
  1136. dev->name);
  1137. dev_kfree_skb(frame);
  1138. return TXRX_DROP;
  1139. }
  1140. }
  1141. skb_reset_network_header(frame);
  1142. frame->dev = dev;
  1143. frame->priority = skb->priority;
  1144. rx->skb = frame;
  1145. payload = frame->data;
  1146. ethertype = (payload[6] << 8) | payload[7];
  1147. if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
  1148. ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
  1149. compare_ether_addr(payload,
  1150. bridge_tunnel_header) == 0)) {
  1151. /* remove RFC1042 or Bridge-Tunnel
  1152. * encapsulation and replace EtherType */
  1153. skb_pull(frame, 6);
  1154. memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
  1155. memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
  1156. } else {
  1157. memcpy(skb_push(frame, sizeof(__be16)),
  1158. &len, sizeof(__be16));
  1159. memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
  1160. memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
  1161. }
  1162. if (!ieee80211_frame_allowed(rx)) {
  1163. if (skb == frame) /* last frame */
  1164. return TXRX_DROP;
  1165. dev_kfree_skb(frame);
  1166. continue;
  1167. }
  1168. ieee80211_deliver_skb(rx);
  1169. }
  1170. return TXRX_QUEUED;
  1171. }
  1172. static ieee80211_txrx_result
  1173. ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
  1174. {
  1175. struct net_device *dev = rx->dev;
  1176. u16 fc;
  1177. int err;
  1178. fc = rx->fc;
  1179. if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
  1180. return TXRX_CONTINUE;
  1181. if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
  1182. return TXRX_DROP;
  1183. err = ieee80211_data_to_8023(rx);
  1184. if (unlikely(err))
  1185. return TXRX_DROP;
  1186. if (!ieee80211_frame_allowed(rx))
  1187. return TXRX_DROP;
  1188. rx->skb->dev = dev;
  1189. dev->stats.rx_packets++;
  1190. dev->stats.rx_bytes += rx->skb->len;
  1191. ieee80211_deliver_skb(rx);
  1192. return TXRX_QUEUED;
  1193. }
  1194. static ieee80211_txrx_result
  1195. ieee80211_rx_h_ctrl(struct ieee80211_txrx_data *rx)
  1196. {
  1197. struct ieee80211_local *local = rx->local;
  1198. struct ieee80211_hw *hw = &local->hw;
  1199. struct sk_buff *skb = rx->skb;
  1200. struct ieee80211_bar *bar = (struct ieee80211_bar *) skb->data;
  1201. struct tid_ampdu_rx *tid_agg_rx;
  1202. u16 start_seq_num;
  1203. u16 tid;
  1204. if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
  1205. return TXRX_CONTINUE;
  1206. if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
  1207. if (!rx->sta)
  1208. return TXRX_CONTINUE;
  1209. tid = le16_to_cpu(bar->control) >> 12;
  1210. tid_agg_rx = &(rx->sta->ampdu_mlme.tid_rx[tid]);
  1211. if (tid_agg_rx->state != HT_AGG_STATE_OPERATIONAL)
  1212. return TXRX_CONTINUE;
  1213. start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
  1214. /* reset session timer */
  1215. if (tid_agg_rx->timeout) {
  1216. unsigned long expires =
  1217. jiffies + (tid_agg_rx->timeout / 1000) * HZ;
  1218. mod_timer(&tid_agg_rx->session_timer, expires);
  1219. }
  1220. /* manage reordering buffer according to requested */
  1221. /* sequence number */
  1222. rcu_read_lock();
  1223. ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
  1224. start_seq_num, 1);
  1225. rcu_read_unlock();
  1226. return TXRX_DROP;
  1227. }
  1228. return TXRX_CONTINUE;
  1229. }
  1230. static ieee80211_txrx_result
  1231. ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
  1232. {
  1233. struct ieee80211_sub_if_data *sdata;
  1234. if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
  1235. return TXRX_DROP;
  1236. sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
  1237. if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
  1238. sdata->vif.type == IEEE80211_IF_TYPE_IBSS) &&
  1239. !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
  1240. ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
  1241. else
  1242. return TXRX_DROP;
  1243. return TXRX_QUEUED;
  1244. }
  1245. static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
  1246. struct ieee80211_local *local,
  1247. ieee80211_rx_handler *handlers,
  1248. struct ieee80211_txrx_data *rx,
  1249. struct sta_info *sta)
  1250. {
  1251. ieee80211_rx_handler *handler;
  1252. ieee80211_txrx_result res = TXRX_DROP;
  1253. for (handler = handlers; *handler != NULL; handler++) {
  1254. res = (*handler)(rx);
  1255. switch (res) {
  1256. case TXRX_CONTINUE:
  1257. continue;
  1258. case TXRX_DROP:
  1259. I802_DEBUG_INC(local->rx_handlers_drop);
  1260. if (sta)
  1261. sta->rx_dropped++;
  1262. break;
  1263. case TXRX_QUEUED:
  1264. I802_DEBUG_INC(local->rx_handlers_queued);
  1265. break;
  1266. }
  1267. break;
  1268. }
  1269. if (res == TXRX_DROP)
  1270. dev_kfree_skb(rx->skb);
  1271. return res;
  1272. }
  1273. static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
  1274. ieee80211_rx_handler *handlers,
  1275. struct ieee80211_txrx_data *rx,
  1276. struct sta_info *sta)
  1277. {
  1278. if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
  1279. TXRX_CONTINUE)
  1280. dev_kfree_skb(rx->skb);
  1281. }
  1282. static void ieee80211_rx_michael_mic_report(struct net_device *dev,
  1283. struct ieee80211_hdr *hdr,
  1284. struct sta_info *sta,
  1285. struct ieee80211_txrx_data *rx)
  1286. {
  1287. int keyidx, hdrlen;
  1288. DECLARE_MAC_BUF(mac);
  1289. DECLARE_MAC_BUF(mac2);
  1290. hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
  1291. if (rx->skb->len >= hdrlen + 4)
  1292. keyidx = rx->skb->data[hdrlen + 3] >> 6;
  1293. else
  1294. keyidx = -1;
  1295. if (net_ratelimit())
  1296. printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
  1297. "failure from %s to %s keyidx=%d\n",
  1298. dev->name, print_mac(mac, hdr->addr2),
  1299. print_mac(mac2, hdr->addr1), keyidx);
  1300. if (!sta) {
  1301. /*
  1302. * Some hardware seem to generate incorrect Michael MIC
  1303. * reports; ignore them to avoid triggering countermeasures.
  1304. */
  1305. if (net_ratelimit())
  1306. printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
  1307. "error for unknown address %s\n",
  1308. dev->name, print_mac(mac, hdr->addr2));
  1309. goto ignore;
  1310. }
  1311. if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
  1312. if (net_ratelimit())
  1313. printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
  1314. "error for a frame with no PROTECTED flag (src "
  1315. "%s)\n", dev->name, print_mac(mac, hdr->addr2));
  1316. goto ignore;
  1317. }
  1318. if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
  1319. /*
  1320. * APs with pairwise keys should never receive Michael MIC
  1321. * errors for non-zero keyidx because these are reserved for
  1322. * group keys and only the AP is sending real multicast
  1323. * frames in the BSS.
  1324. */
  1325. if (net_ratelimit())
  1326. printk(KERN_DEBUG "%s: ignored Michael MIC error for "
  1327. "a frame with non-zero keyidx (%d)"
  1328. " (src %s)\n", dev->name, keyidx,
  1329. print_mac(mac, hdr->addr2));
  1330. goto ignore;
  1331. }
  1332. if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
  1333. ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
  1334. (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
  1335. if (net_ratelimit())
  1336. printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
  1337. "error for a frame that cannot be encrypted "
  1338. "(fc=0x%04x) (src %s)\n",
  1339. dev->name, rx->fc, print_mac(mac, hdr->addr2));
  1340. goto ignore;
  1341. }
  1342. mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
  1343. ignore:
  1344. dev_kfree_skb(rx->skb);
  1345. rx->skb = NULL;
  1346. }
  1347. ieee80211_rx_handler ieee80211_rx_handlers[] =
  1348. {
  1349. ieee80211_rx_h_if_stats,
  1350. ieee80211_rx_h_passive_scan,
  1351. ieee80211_rx_h_check,
  1352. ieee80211_rx_h_decrypt,
  1353. ieee80211_rx_h_sta_process,
  1354. ieee80211_rx_h_defragment,
  1355. ieee80211_rx_h_ps_poll,
  1356. ieee80211_rx_h_michael_mic_verify,
  1357. /* this must be after decryption - so header is counted in MPDU mic
  1358. * must be before pae and data, so QOS_DATA format frames
  1359. * are not passed to user space by these functions
  1360. */
  1361. ieee80211_rx_h_remove_qos_control,
  1362. ieee80211_rx_h_amsdu,
  1363. ieee80211_rx_h_data,
  1364. ieee80211_rx_h_ctrl,
  1365. ieee80211_rx_h_mgmt,
  1366. NULL
  1367. };
  1368. /* main receive path */
  1369. static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
  1370. u8 *bssid, struct ieee80211_txrx_data *rx,
  1371. struct ieee80211_hdr *hdr)
  1372. {
  1373. int multicast = is_multicast_ether_addr(hdr->addr1);
  1374. switch (sdata->vif.type) {
  1375. case IEEE80211_IF_TYPE_STA:
  1376. if (!bssid)
  1377. return 0;
  1378. if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
  1379. if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
  1380. return 0;
  1381. rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
  1382. } else if (!multicast &&
  1383. compare_ether_addr(sdata->dev->dev_addr,
  1384. hdr->addr1) != 0) {
  1385. if (!(sdata->dev->flags & IFF_PROMISC))
  1386. return 0;
  1387. rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
  1388. }
  1389. break;
  1390. case IEEE80211_IF_TYPE_IBSS:
  1391. if (!bssid)
  1392. return 0;
  1393. if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
  1394. if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
  1395. return 0;
  1396. rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
  1397. } else if (!multicast &&
  1398. compare_ether_addr(sdata->dev->dev_addr,
  1399. hdr->addr1) != 0) {
  1400. if (!(sdata->dev->flags & IFF_PROMISC))
  1401. return 0;
  1402. rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
  1403. } else if (!rx->sta)
  1404. rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
  1405. bssid, hdr->addr2);
  1406. break;
  1407. case IEEE80211_IF_TYPE_VLAN:
  1408. case IEEE80211_IF_TYPE_AP:
  1409. if (!bssid) {
  1410. if (compare_ether_addr(sdata->dev->dev_addr,
  1411. hdr->addr1))
  1412. return 0;
  1413. } else if (!ieee80211_bssid_match(bssid,
  1414. sdata->dev->dev_addr)) {
  1415. if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
  1416. return 0;
  1417. rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
  1418. }
  1419. if (sdata->dev == sdata->local->mdev &&
  1420. !(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
  1421. /* do not receive anything via
  1422. * master device when not scanning */
  1423. return 0;
  1424. break;
  1425. case IEEE80211_IF_TYPE_WDS:
  1426. if (bssid ||
  1427. (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
  1428. return 0;
  1429. if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
  1430. return 0;
  1431. break;
  1432. case IEEE80211_IF_TYPE_MNTR:
  1433. /* take everything */
  1434. break;
  1435. case IEEE80211_IF_TYPE_INVALID:
  1436. /* should never get here */
  1437. WARN_ON(1);
  1438. break;
  1439. }
  1440. return 1;
  1441. }
  1442. /*
  1443. * This is the actual Rx frames handler. as it blongs to Rx path it must
  1444. * be called with rcu_read_lock protection.
  1445. */
  1446. static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
  1447. struct sk_buff *skb,
  1448. struct ieee80211_rx_status *status,
  1449. u32 load)
  1450. {
  1451. struct ieee80211_local *local = hw_to_local(hw);
  1452. struct ieee80211_sub_if_data *sdata;
  1453. struct sta_info *sta;
  1454. struct ieee80211_hdr *hdr;
  1455. struct ieee80211_txrx_data rx;
  1456. u16 type;
  1457. int prepares;
  1458. struct ieee80211_sub_if_data *prev = NULL;
  1459. struct sk_buff *skb_new;
  1460. u8 *bssid;
  1461. int hdrlen;
  1462. hdr = (struct ieee80211_hdr *) skb->data;
  1463. memset(&rx, 0, sizeof(rx));
  1464. rx.skb = skb;
  1465. rx.local = local;
  1466. rx.u.rx.status = status;
  1467. rx.u.rx.load = load;
  1468. rx.fc = le16_to_cpu(hdr->frame_control);
  1469. type = rx.fc & IEEE80211_FCTL_FTYPE;
  1470. /*
  1471. * Drivers are required to align the payload data to a four-byte
  1472. * boundary, so the last two bits of the address where it starts
  1473. * may not be set. The header is required to be directly before
  1474. * the payload data, padding like atheros hardware adds which is
  1475. * inbetween the 802.11 header and the payload is not supported,
  1476. * the driver is required to move the 802.11 header further back
  1477. * in that case.
  1478. */
  1479. hdrlen = ieee80211_get_hdrlen(rx.fc);
  1480. WARN_ON_ONCE(((unsigned long)(skb->data + hdrlen)) & 3);
  1481. if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
  1482. local->dot11ReceivedFragmentCount++;
  1483. sta = rx.sta = sta_info_get(local, hdr->addr2);
  1484. if (sta) {
  1485. rx.dev = rx.sta->dev;
  1486. rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
  1487. }
  1488. if ((status->flag & RX_FLAG_MMIC_ERROR)) {
  1489. ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
  1490. goto end;
  1491. }
  1492. if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
  1493. rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
  1494. if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
  1495. sta) != TXRX_CONTINUE)
  1496. goto end;
  1497. skb = rx.skb;
  1498. if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
  1499. !atomic_read(&local->iff_promiscs) &&
  1500. !is_multicast_ether_addr(hdr->addr1)) {
  1501. rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
  1502. ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
  1503. rx.sta);
  1504. sta_info_put(sta);
  1505. return;
  1506. }
  1507. list_for_each_entry_rcu(sdata, &local->interfaces, list) {
  1508. if (!netif_running(sdata->dev))
  1509. continue;
  1510. if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR)
  1511. continue;
  1512. bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
  1513. rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
  1514. prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
  1515. /* prepare_for_handlers can change sta */
  1516. sta = rx.sta;
  1517. if (!prepares)
  1518. continue;
  1519. /*
  1520. * frame is destined for this interface, but if it's not
  1521. * also for the previous one we handle that after the
  1522. * loop to avoid copying the SKB once too much
  1523. */
  1524. if (!prev) {
  1525. prev = sdata;
  1526. continue;
  1527. }
  1528. /*
  1529. * frame was destined for the previous interface
  1530. * so invoke RX handlers for it
  1531. */
  1532. skb_new = skb_copy(skb, GFP_ATOMIC);
  1533. if (!skb_new) {
  1534. if (net_ratelimit())
  1535. printk(KERN_DEBUG "%s: failed to copy "
  1536. "multicast frame for %s",
  1537. wiphy_name(local->hw.wiphy),
  1538. prev->dev->name);
  1539. continue;
  1540. }
  1541. rx.fc = le16_to_cpu(hdr->frame_control);
  1542. rx.skb = skb_new;
  1543. rx.dev = prev->dev;
  1544. rx.sdata = prev;
  1545. ieee80211_invoke_rx_handlers(local, local->rx_handlers,
  1546. &rx, sta);
  1547. prev = sdata;
  1548. }
  1549. if (prev) {
  1550. rx.fc = le16_to_cpu(hdr->frame_control);
  1551. rx.skb = skb;
  1552. rx.dev = prev->dev;
  1553. rx.sdata = prev;
  1554. ieee80211_invoke_rx_handlers(local, local->rx_handlers,
  1555. &rx, sta);
  1556. } else
  1557. dev_kfree_skb(skb);
  1558. end:
  1559. if (sta)
  1560. sta_info_put(sta);
  1561. }
  1562. #define SEQ_MODULO 0x1000
  1563. #define SEQ_MASK 0xfff
  1564. static inline int seq_less(u16 sq1, u16 sq2)
  1565. {
  1566. return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
  1567. }
  1568. static inline u16 seq_inc(u16 sq)
  1569. {
  1570. return ((sq + 1) & SEQ_MASK);
  1571. }
  1572. static inline u16 seq_sub(u16 sq1, u16 sq2)
  1573. {
  1574. return ((sq1 - sq2) & SEQ_MASK);
  1575. }
  1576. /*
  1577. * As it function blongs to Rx path it must be called with
  1578. * the proper rcu_read_lock protection for its flow.
  1579. */
  1580. u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
  1581. struct tid_ampdu_rx *tid_agg_rx,
  1582. struct sk_buff *skb, u16 mpdu_seq_num,
  1583. int bar_req)
  1584. {
  1585. struct ieee80211_local *local = hw_to_local(hw);
  1586. struct ieee80211_rx_status status;
  1587. u16 head_seq_num, buf_size;
  1588. int index;
  1589. u32 pkt_load;
  1590. buf_size = tid_agg_rx->buf_size;
  1591. head_seq_num = tid_agg_rx->head_seq_num;
  1592. /* frame with out of date sequence number */
  1593. if (seq_less(mpdu_seq_num, head_seq_num)) {
  1594. dev_kfree_skb(skb);
  1595. return 1;
  1596. }
  1597. /* if frame sequence number exceeds our buffering window size or
  1598. * block Ack Request arrived - release stored frames */
  1599. if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
  1600. /* new head to the ordering buffer */
  1601. if (bar_req)
  1602. head_seq_num = mpdu_seq_num;
  1603. else
  1604. head_seq_num =
  1605. seq_inc(seq_sub(mpdu_seq_num, buf_size));
  1606. /* release stored frames up to new head to stack */
  1607. while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
  1608. index = seq_sub(tid_agg_rx->head_seq_num,
  1609. tid_agg_rx->ssn)
  1610. % tid_agg_rx->buf_size;
  1611. if (tid_agg_rx->reorder_buf[index]) {
  1612. /* release the reordered frames to stack */
  1613. memcpy(&status,
  1614. tid_agg_rx->reorder_buf[index]->cb,
  1615. sizeof(status));
  1616. pkt_load = ieee80211_rx_load_stats(local,
  1617. tid_agg_rx->reorder_buf[index],
  1618. &status);
  1619. __ieee80211_rx_handle_packet(hw,
  1620. tid_agg_rx->reorder_buf[index],
  1621. &status, pkt_load);
  1622. tid_agg_rx->stored_mpdu_num--;
  1623. tid_agg_rx->reorder_buf[index] = NULL;
  1624. }
  1625. tid_agg_rx->head_seq_num =
  1626. seq_inc(tid_agg_rx->head_seq_num);
  1627. }
  1628. if (bar_req)
  1629. return 1;
  1630. }
  1631. /* now the new frame is always in the range of the reordering */
  1632. /* buffer window */
  1633. index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
  1634. % tid_agg_rx->buf_size;
  1635. /* check if we already stored this frame */
  1636. if (tid_agg_rx->reorder_buf[index]) {
  1637. dev_kfree_skb(skb);
  1638. return 1;
  1639. }
  1640. /* if arrived mpdu is in the right order and nothing else stored */
  1641. /* release it immediately */
  1642. if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
  1643. tid_agg_rx->stored_mpdu_num == 0) {
  1644. tid_agg_rx->head_seq_num =
  1645. seq_inc(tid_agg_rx->head_seq_num);
  1646. return 0;
  1647. }
  1648. /* put the frame in the reordering buffer */
  1649. tid_agg_rx->reorder_buf[index] = skb;
  1650. tid_agg_rx->stored_mpdu_num++;
  1651. /* release the buffer until next missing frame */
  1652. index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
  1653. % tid_agg_rx->buf_size;
  1654. while (tid_agg_rx->reorder_buf[index]) {
  1655. /* release the reordered frame back to stack */
  1656. memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
  1657. sizeof(status));
  1658. pkt_load = ieee80211_rx_load_stats(local,
  1659. tid_agg_rx->reorder_buf[index],
  1660. &status);
  1661. __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
  1662. &status, pkt_load);
  1663. tid_agg_rx->stored_mpdu_num--;
  1664. tid_agg_rx->reorder_buf[index] = NULL;
  1665. tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
  1666. index = seq_sub(tid_agg_rx->head_seq_num,
  1667. tid_agg_rx->ssn) % tid_agg_rx->buf_size;
  1668. }
  1669. return 1;
  1670. }
  1671. static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
  1672. struct sk_buff *skb)
  1673. {
  1674. struct ieee80211_hw *hw = &local->hw;
  1675. struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
  1676. struct sta_info *sta;
  1677. struct tid_ampdu_rx *tid_agg_rx;
  1678. u16 fc, sc;
  1679. u16 mpdu_seq_num;
  1680. u8 ret = 0, *qc;
  1681. int tid;
  1682. sta = sta_info_get(local, hdr->addr2);
  1683. if (!sta)
  1684. return ret;
  1685. fc = le16_to_cpu(hdr->frame_control);
  1686. /* filter the QoS data rx stream according to
  1687. * STA/TID and check if this STA/TID is on aggregation */
  1688. if (!WLAN_FC_IS_QOS_DATA(fc))
  1689. goto end_reorder;
  1690. qc = skb->data + ieee80211_get_hdrlen(fc) - QOS_CONTROL_LEN;
  1691. tid = qc[0] & QOS_CONTROL_TID_MASK;
  1692. tid_agg_rx = &(sta->ampdu_mlme.tid_rx[tid]);
  1693. if (tid_agg_rx->state != HT_AGG_STATE_OPERATIONAL)
  1694. goto end_reorder;
  1695. /* null data frames are excluded */
  1696. if (unlikely(fc & IEEE80211_STYPE_QOS_NULLFUNC))
  1697. goto end_reorder;
  1698. /* new un-ordered ampdu frame - process it */
  1699. /* reset session timer */
  1700. if (tid_agg_rx->timeout) {
  1701. unsigned long expires =
  1702. jiffies + (tid_agg_rx->timeout / 1000) * HZ;
  1703. mod_timer(&tid_agg_rx->session_timer, expires);
  1704. }
  1705. /* if this mpdu is fragmented - terminate rx aggregation session */
  1706. sc = le16_to_cpu(hdr->seq_ctrl);
  1707. if (sc & IEEE80211_SCTL_FRAG) {
  1708. ieee80211_sta_stop_rx_ba_session(sta->dev, sta->addr,
  1709. tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
  1710. ret = 1;
  1711. goto end_reorder;
  1712. }
  1713. /* according to mpdu sequence number deal with reordering buffer */
  1714. mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
  1715. ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
  1716. mpdu_seq_num, 0);
  1717. end_reorder:
  1718. if (sta)
  1719. sta_info_put(sta);
  1720. return ret;
  1721. }
  1722. /*
  1723. * This is the receive path handler. It is called by a low level driver when an
  1724. * 802.11 MPDU is received from the hardware.
  1725. */
  1726. void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
  1727. struct ieee80211_rx_status *status)
  1728. {
  1729. struct ieee80211_local *local = hw_to_local(hw);
  1730. u32 pkt_load;
  1731. /*
  1732. * key references and virtual interfaces are protected using RCU
  1733. * and this requires that we are in a read-side RCU section during
  1734. * receive processing
  1735. */
  1736. rcu_read_lock();
  1737. /*
  1738. * Frames with failed FCS/PLCP checksum are not returned,
  1739. * all other frames are returned without radiotap header
  1740. * if it was previously present.
  1741. * Also, frames with less than 16 bytes are dropped.
  1742. */
  1743. skb = ieee80211_rx_monitor(local, skb, status);
  1744. if (!skb) {
  1745. rcu_read_unlock();
  1746. return;
  1747. }
  1748. pkt_load = ieee80211_rx_load_stats(local, skb, status);
  1749. local->channel_use_raw += pkt_load;
  1750. if (!ieee80211_rx_reorder_ampdu(local, skb))
  1751. __ieee80211_rx_handle_packet(hw, skb, status, pkt_load);
  1752. rcu_read_unlock();
  1753. }
  1754. EXPORT_SYMBOL(__ieee80211_rx);
  1755. /* This is a version of the rx handler that can be called from hard irq
  1756. * context. Post the skb on the queue and schedule the tasklet */
  1757. void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
  1758. struct ieee80211_rx_status *status)
  1759. {
  1760. struct ieee80211_local *local = hw_to_local(hw);
  1761. BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
  1762. skb->dev = local->mdev;
  1763. /* copy status into skb->cb for use by tasklet */
  1764. memcpy(skb->cb, status, sizeof(*status));
  1765. skb->pkt_type = IEEE80211_RX_MSG;
  1766. skb_queue_tail(&local->skb_queue, skb);
  1767. tasklet_schedule(&local->tasklet);
  1768. }
  1769. EXPORT_SYMBOL(ieee80211_rx_irqsafe);