73cf126cef499d9ed30a20b317ecf7dc8feb0302
[linux-2.6.git] / net / mac80211 / rx.c
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2005-2006, Devicescape Software, Inc.
4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
5  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
20
21 #include "ieee80211_i.h"
22 #include "led.h"
23 #include "mesh.h"
24 #include "wep.h"
25 #include "wpa.h"
26 #include "tkip.h"
27 #include "wme.h"
28
29 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30                                            struct tid_ampdu_rx *tid_agg_rx,
31                                            struct sk_buff *skb,
32                                            u16 mpdu_seq_num,
33                                            int bar_req);
34 /*
35  * monitor mode reception
36  *
37  * This function cleans up the SKB, i.e. it removes all the stuff
38  * only useful for monitoring.
39  */
40 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
41                                            struct sk_buff *skb,
42                                            int rtap_len)
43 {
44         skb_pull(skb, rtap_len);
45
46         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
47                 if (likely(skb->len > FCS_LEN))
48                         skb_trim(skb, skb->len - FCS_LEN);
49                 else {
50                         /* driver bug */
51                         WARN_ON(1);
52                         dev_kfree_skb(skb);
53                         skb = NULL;
54                 }
55         }
56
57         return skb;
58 }
59
60 static inline int should_drop_frame(struct ieee80211_rx_status *status,
61                                     struct sk_buff *skb,
62                                     int present_fcs_len,
63                                     int radiotap_len)
64 {
65         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
66
67         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
68                 return 1;
69         if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
70                 return 1;
71         if (ieee80211_is_ctl(hdr->frame_control) &&
72             !ieee80211_is_pspoll(hdr->frame_control) &&
73             !ieee80211_is_back_req(hdr->frame_control))
74                 return 1;
75         return 0;
76 }
77
78 static int
79 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
80                           struct ieee80211_rx_status *status)
81 {
82         int len;
83
84         /* always present fields */
85         len = sizeof(struct ieee80211_radiotap_header) + 9;
86
87         if (status->flag & RX_FLAG_TSFT)
88                 len += 8;
89         if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
90             local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
91                 len += 1;
92         if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
93                 len += 1;
94
95         if (len & 1) /* padding for RX_FLAGS if necessary */
96                 len++;
97
98         /* make sure radiotap starts at a naturally aligned address */
99         if (len % 8)
100                 len = roundup(len, 8);
101
102         return len;
103 }
104
105 /**
106  * ieee80211_add_rx_radiotap_header - add radiotap header
107  *
108  * add a radiotap header containing all the fields which the hardware provided.
109  */
110 static void
111 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
112                                  struct sk_buff *skb,
113                                  struct ieee80211_rx_status *status,
114                                  struct ieee80211_rate *rate,
115                                  int rtap_len)
116 {
117         struct ieee80211_radiotap_header *rthdr;
118         unsigned char *pos;
119
120         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
121         memset(rthdr, 0, rtap_len);
122
123         /* radiotap header, set always present flags */
124         rthdr->it_present =
125                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
126                             (1 << IEEE80211_RADIOTAP_RATE) |
127                             (1 << IEEE80211_RADIOTAP_CHANNEL) |
128                             (1 << IEEE80211_RADIOTAP_ANTENNA) |
129                             (1 << IEEE80211_RADIOTAP_RX_FLAGS));
130         rthdr->it_len = cpu_to_le16(rtap_len);
131
132         pos = (unsigned char *)(rthdr+1);
133
134         /* the order of the following fields is important */
135
136         /* IEEE80211_RADIOTAP_TSFT */
137         if (status->flag & RX_FLAG_TSFT) {
138                 *(__le64 *)pos = cpu_to_le64(status->mactime);
139                 rthdr->it_present |=
140                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
141                 pos += 8;
142         }
143
144         /* IEEE80211_RADIOTAP_FLAGS */
145         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
146                 *pos |= IEEE80211_RADIOTAP_F_FCS;
147         if (status->flag & RX_FLAG_SHORTPRE)
148                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
149         pos++;
150
151         /* IEEE80211_RADIOTAP_RATE */
152         *pos = rate->bitrate / 5;
153         pos++;
154
155         /* IEEE80211_RADIOTAP_CHANNEL */
156         *(__le16 *)pos = cpu_to_le16(status->freq);
157         pos += 2;
158         if (status->band == IEEE80211_BAND_5GHZ)
159                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
160                                              IEEE80211_CHAN_5GHZ);
161         else if (rate->flags & IEEE80211_RATE_ERP_G)
162                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
163                                              IEEE80211_CHAN_2GHZ);
164         else
165                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
166                                              IEEE80211_CHAN_2GHZ);
167         pos += 2;
168
169         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
170         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
171                 *pos = status->signal;
172                 rthdr->it_present |=
173                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
174                 pos++;
175         }
176
177         /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
178         if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
179                 *pos = status->noise;
180                 rthdr->it_present |=
181                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
182                 pos++;
183         }
184
185         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
186
187         /* IEEE80211_RADIOTAP_ANTENNA */
188         *pos = status->antenna;
189         pos++;
190
191         /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
192         if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
193                 *pos = status->signal;
194                 rthdr->it_present |=
195                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
196                 pos++;
197         }
198
199         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
200
201         /* IEEE80211_RADIOTAP_RX_FLAGS */
202         /* ensure 2 byte alignment for the 2 byte field as required */
203         if ((pos - (unsigned char *)rthdr) & 1)
204                 pos++;
205         /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
206         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
207                 *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
208         pos += 2;
209 }
210
211 /*
212  * This function copies a received frame to all monitor interfaces and
213  * returns a cleaned-up SKB that no longer includes the FCS nor the
214  * radiotap header the driver might have added.
215  */
216 static struct sk_buff *
217 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
218                      struct ieee80211_rx_status *status,
219                      struct ieee80211_rate *rate)
220 {
221         struct ieee80211_sub_if_data *sdata;
222         int needed_headroom = 0;
223         struct sk_buff *skb, *skb2;
224         struct net_device *prev_dev = NULL;
225         int present_fcs_len = 0;
226         int rtap_len = 0;
227
228         /*
229          * First, we may need to make a copy of the skb because
230          *  (1) we need to modify it for radiotap (if not present), and
231          *  (2) the other RX handlers will modify the skb we got.
232          *
233          * We don't need to, of course, if we aren't going to return
234          * the SKB because it has a bad FCS/PLCP checksum.
235          */
236         if (status->flag & RX_FLAG_RADIOTAP)
237                 rtap_len = ieee80211_get_radiotap_len(origskb->data);
238         else
239                 /* room for the radiotap header based on driver features */
240                 needed_headroom = ieee80211_rx_radiotap_len(local, status);
241
242         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
243                 present_fcs_len = FCS_LEN;
244
245         if (!local->monitors) {
246                 if (should_drop_frame(status, origskb, present_fcs_len,
247                                       rtap_len)) {
248                         dev_kfree_skb(origskb);
249                         return NULL;
250                 }
251
252                 return remove_monitor_info(local, origskb, rtap_len);
253         }
254
255         if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
256                 /* only need to expand headroom if necessary */
257                 skb = origskb;
258                 origskb = NULL;
259
260                 /*
261                  * This shouldn't trigger often because most devices have an
262                  * RX header they pull before we get here, and that should
263                  * be big enough for our radiotap information. We should
264                  * probably export the length to drivers so that we can have
265                  * them allocate enough headroom to start with.
266                  */
267                 if (skb_headroom(skb) < needed_headroom &&
268                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
269                         dev_kfree_skb(skb);
270                         return NULL;
271                 }
272         } else {
273                 /*
274                  * Need to make a copy and possibly remove radiotap header
275                  * and FCS from the original.
276                  */
277                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
278
279                 origskb = remove_monitor_info(local, origskb, rtap_len);
280
281                 if (!skb)
282                         return origskb;
283         }
284
285         /* if necessary, prepend radiotap information */
286         if (!(status->flag & RX_FLAG_RADIOTAP))
287                 ieee80211_add_rx_radiotap_header(local, skb, status, rate,
288                                                  needed_headroom);
289
290         skb_reset_mac_header(skb);
291         skb->ip_summed = CHECKSUM_UNNECESSARY;
292         skb->pkt_type = PACKET_OTHERHOST;
293         skb->protocol = htons(ETH_P_802_2);
294
295         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
296                 if (!netif_running(sdata->dev))
297                         continue;
298
299                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
300                         continue;
301
302                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
303                         continue;
304
305                 if (prev_dev) {
306                         skb2 = skb_clone(skb, GFP_ATOMIC);
307                         if (skb2) {
308                                 skb2->dev = prev_dev;
309                                 netif_rx(skb2);
310                         }
311                 }
312
313                 prev_dev = sdata->dev;
314                 sdata->dev->stats.rx_packets++;
315                 sdata->dev->stats.rx_bytes += skb->len;
316         }
317
318         if (prev_dev) {
319                 skb->dev = prev_dev;
320                 netif_rx(skb);
321         } else
322                 dev_kfree_skb(skb);
323
324         return origskb;
325 }
326
327
328 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
329 {
330         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
331         int tid;
332
333         /* does the frame have a qos control field? */
334         if (ieee80211_is_data_qos(hdr->frame_control)) {
335                 u8 *qc = ieee80211_get_qos_ctl(hdr);
336                 /* frame has qos control */
337                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
338                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
339                         rx->flags |= IEEE80211_RX_AMSDU;
340                 else
341                         rx->flags &= ~IEEE80211_RX_AMSDU;
342         } else {
343                 /*
344                  * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
345                  *
346                  *      Sequence numbers for management frames, QoS data
347                  *      frames with a broadcast/multicast address in the
348                  *      Address 1 field, and all non-QoS data frames sent
349                  *      by QoS STAs are assigned using an additional single
350                  *      modulo-4096 counter, [...]
351                  *
352                  * We also use that counter for non-QoS STAs.
353                  */
354                 tid = NUM_RX_DATA_QUEUES - 1;
355         }
356
357         rx->queue = tid;
358         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
359          * For now, set skb->priority to 0 for other cases. */
360         rx->skb->priority = (tid > 7) ? 0 : tid;
361 }
362
363 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
364 {
365 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
366         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
367         int hdrlen;
368
369         if (!ieee80211_is_data_present(hdr->frame_control))
370                 return;
371
372         /*
373          * Drivers are required to align the payload data in a way that
374          * guarantees that the contained IP header is aligned to a four-
375          * byte boundary. In the case of regular frames, this simply means
376          * aligning the payload to a four-byte boundary (because either
377          * the IP header is directly contained, or IV/RFC1042 headers that
378          * have a length divisible by four are in front of it.
379          *
380          * With A-MSDU frames, however, the payload data address must
381          * yield two modulo four because there are 14-byte 802.3 headers
382          * within the A-MSDU frames that push the IP header further back
383          * to a multiple of four again. Thankfully, the specs were sane
384          * enough this time around to require padding each A-MSDU subframe
385          * to a length that is a multiple of four.
386          *
387          * Padding like atheros hardware adds which is inbetween the 802.11
388          * header and the payload is not supported, the driver is required
389          * to move the 802.11 header further back in that case.
390          */
391         hdrlen = ieee80211_hdrlen(hdr->frame_control);
392         if (rx->flags & IEEE80211_RX_AMSDU)
393                 hdrlen += ETH_HLEN;
394         WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
395 #endif
396 }
397
398
399 /* rx handlers */
400
401 static ieee80211_rx_result debug_noinline
402 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
403 {
404         struct ieee80211_local *local = rx->local;
405         struct sk_buff *skb = rx->skb;
406
407         if (unlikely(local->hw_scanning))
408                 return ieee80211_scan_rx(rx->sdata, skb, rx->status);
409
410         if (unlikely(local->sw_scanning)) {
411                 /* drop all the other packets during a software scan anyway */
412                 if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
413                     != RX_QUEUED)
414                         dev_kfree_skb(skb);
415                 return RX_QUEUED;
416         }
417
418         if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
419                 /* scanning finished during invoking of handlers */
420                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
421                 return RX_DROP_UNUSABLE;
422         }
423
424         return RX_CONTINUE;
425 }
426
427 static ieee80211_rx_result
428 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
429 {
430         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
431         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
432
433         if (ieee80211_is_data(hdr->frame_control)) {
434                 if (!ieee80211_has_a4(hdr->frame_control))
435                         return RX_DROP_MONITOR;
436                 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
437                         return RX_DROP_MONITOR;
438         }
439
440         /* If there is not an established peer link and this is not a peer link
441          * establisment frame, beacon or probe, drop the frame.
442          */
443
444         if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
445                 struct ieee80211_mgmt *mgmt;
446
447                 if (!ieee80211_is_mgmt(hdr->frame_control))
448                         return RX_DROP_MONITOR;
449
450                 if (ieee80211_is_action(hdr->frame_control)) {
451                         mgmt = (struct ieee80211_mgmt *)hdr;
452                         if (mgmt->u.action.category != PLINK_CATEGORY)
453                                 return RX_DROP_MONITOR;
454                         return RX_CONTINUE;
455                 }
456
457                 if (ieee80211_is_probe_req(hdr->frame_control) ||
458                     ieee80211_is_probe_resp(hdr->frame_control) ||
459                     ieee80211_is_beacon(hdr->frame_control))
460                         return RX_CONTINUE;
461
462                 return RX_DROP_MONITOR;
463
464         }
465
466 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
467
468         if (ieee80211_is_data(hdr->frame_control) &&
469             is_multicast_ether_addr(hdr->addr1) &&
470             mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
471                 return RX_DROP_MONITOR;
472 #undef msh_h_get
473
474         return RX_CONTINUE;
475 }
476
477
478 static ieee80211_rx_result debug_noinline
479 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
480 {
481         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
482
483         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
484         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
485                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
486                              rx->sta->last_seq_ctrl[rx->queue] ==
487                              hdr->seq_ctrl)) {
488                         if (rx->flags & IEEE80211_RX_RA_MATCH) {
489                                 rx->local->dot11FrameDuplicateCount++;
490                                 rx->sta->num_duplicates++;
491                         }
492                         return RX_DROP_MONITOR;
493                 } else
494                         rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
495         }
496
497         if (unlikely(rx->skb->len < 16)) {
498                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
499                 return RX_DROP_MONITOR;
500         }
501
502         /* Drop disallowed frame classes based on STA auth/assoc state;
503          * IEEE 802.11, Chap 5.5.
504          *
505          * mac80211 filters only based on association state, i.e. it drops
506          * Class 3 frames from not associated stations. hostapd sends
507          * deauth/disassoc frames when needed. In addition, hostapd is
508          * responsible for filtering on both auth and assoc states.
509          */
510
511         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
512                 return ieee80211_rx_mesh_check(rx);
513
514         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
515                       ieee80211_is_pspoll(hdr->frame_control)) &&
516                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
517                      (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
518                 if ((!ieee80211_has_fromds(hdr->frame_control) &&
519                      !ieee80211_has_tods(hdr->frame_control) &&
520                      ieee80211_is_data(hdr->frame_control)) ||
521                     !(rx->flags & IEEE80211_RX_RA_MATCH)) {
522                         /* Drop IBSS frames and frames for other hosts
523                          * silently. */
524                         return RX_DROP_MONITOR;
525                 }
526
527                 return RX_DROP_MONITOR;
528         }
529
530         return RX_CONTINUE;
531 }
532
533
534 static ieee80211_rx_result debug_noinline
535 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
536 {
537         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
538         int keyidx;
539         int hdrlen;
540         ieee80211_rx_result result = RX_DROP_UNUSABLE;
541         struct ieee80211_key *stakey = NULL;
542
543         /*
544          * Key selection 101
545          *
546          * There are three types of keys:
547          *  - GTK (group keys)
548          *  - PTK (pairwise keys)
549          *  - STK (station-to-station pairwise keys)
550          *
551          * When selecting a key, we have to distinguish between multicast
552          * (including broadcast) and unicast frames, the latter can only
553          * use PTKs and STKs while the former always use GTKs. Unless, of
554          * course, actual WEP keys ("pre-RSNA") are used, then unicast
555          * frames can also use key indizes like GTKs. Hence, if we don't
556          * have a PTK/STK we check the key index for a WEP key.
557          *
558          * Note that in a regular BSS, multicast frames are sent by the
559          * AP only, associated stations unicast the frame to the AP first
560          * which then multicasts it on their behalf.
561          *
562          * There is also a slight problem in IBSS mode: GTKs are negotiated
563          * with each station, that is something we don't currently handle.
564          * The spec seems to expect that one negotiates the same key with
565          * every station but there's no such requirement; VLANs could be
566          * possible.
567          */
568
569         if (!ieee80211_has_protected(hdr->frame_control))
570                 return RX_CONTINUE;
571
572         /*
573          * No point in finding a key and decrypting if the frame is neither
574          * addressed to us nor a multicast frame.
575          */
576         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
577                 return RX_CONTINUE;
578
579         if (rx->sta)
580                 stakey = rcu_dereference(rx->sta->key);
581
582         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
583                 rx->key = stakey;
584         } else {
585                 /*
586                  * The device doesn't give us the IV so we won't be
587                  * able to look up the key. That's ok though, we
588                  * don't need to decrypt the frame, we just won't
589                  * be able to keep statistics accurate.
590                  * Except for key threshold notifications, should
591                  * we somehow allow the driver to tell us which key
592                  * the hardware used if this flag is set?
593                  */
594                 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
595                     (rx->status->flag & RX_FLAG_IV_STRIPPED))
596                         return RX_CONTINUE;
597
598                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
599
600                 if (rx->skb->len < 8 + hdrlen)
601                         return RX_DROP_UNUSABLE; /* TODO: count this? */
602
603                 /*
604                  * no need to call ieee80211_wep_get_keyidx,
605                  * it verifies a bunch of things we've done already
606                  */
607                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
608
609                 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
610
611                 /*
612                  * RSNA-protected unicast frames should always be sent with
613                  * pairwise or station-to-station keys, but for WEP we allow
614                  * using a key index as well.
615                  */
616                 if (rx->key && rx->key->conf.alg != ALG_WEP &&
617                     !is_multicast_ether_addr(hdr->addr1))
618                         rx->key = NULL;
619         }
620
621         if (rx->key) {
622                 rx->key->tx_rx_count++;
623                 /* TODO: add threshold stuff again */
624         } else {
625                 return RX_DROP_MONITOR;
626         }
627
628         /* Check for weak IVs if possible */
629         if (rx->sta && rx->key->conf.alg == ALG_WEP &&
630             ieee80211_is_data(hdr->frame_control) &&
631             (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
632              !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
633             ieee80211_wep_is_weak_iv(rx->skb, rx->key))
634                 rx->sta->wep_weak_iv_count++;
635
636         switch (rx->key->conf.alg) {
637         case ALG_WEP:
638                 result = ieee80211_crypto_wep_decrypt(rx);
639                 break;
640         case ALG_TKIP:
641                 result = ieee80211_crypto_tkip_decrypt(rx);
642                 break;
643         case ALG_CCMP:
644                 result = ieee80211_crypto_ccmp_decrypt(rx);
645                 break;
646         }
647
648         /* either the frame has been decrypted or will be dropped */
649         rx->status->flag |= RX_FLAG_DECRYPTED;
650
651         return result;
652 }
653
654 static void ap_sta_ps_start(struct sta_info *sta)
655 {
656         struct ieee80211_sub_if_data *sdata = sta->sdata;
657         struct ieee80211_local *local = sdata->local;
658
659         atomic_inc(&sdata->bss->num_sta_ps);
660         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
661         if (local->ops->sta_notify)
662                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
663                                         STA_NOTIFY_SLEEP, &sta->sta);
664 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
665         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
666                sdata->dev->name, sta->sta.addr, sta->sta.aid);
667 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
668 }
669
670 static int ap_sta_ps_end(struct sta_info *sta)
671 {
672         struct ieee80211_sub_if_data *sdata = sta->sdata;
673         struct ieee80211_local *local = sdata->local;
674         struct sk_buff *skb;
675         int sent = 0;
676
677         atomic_dec(&sdata->bss->num_sta_ps);
678
679         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
680         if (local->ops->sta_notify)
681                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
682                                         STA_NOTIFY_AWAKE, &sta->sta);
683
684         if (!skb_queue_empty(&sta->ps_tx_buf))
685                 sta_info_clear_tim_bit(sta);
686
687 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
688         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
689                sdata->dev->name, sta->sta.addr, sta->sta.aid);
690 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
691
692         /* Send all buffered frames to the station */
693         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
694                 sent++;
695                 skb->requeue = 1;
696                 dev_queue_xmit(skb);
697         }
698         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
699                 local->total_ps_buffered--;
700                 sent++;
701 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
702                 printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
703                        "since STA not sleeping anymore\n", sdata->dev->name,
704                        sta->sta.addr, sta->sta.aid);
705 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
706                 skb->requeue = 1;
707                 dev_queue_xmit(skb);
708         }
709
710         return sent;
711 }
712
713 static ieee80211_rx_result debug_noinline
714 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
715 {
716         struct sta_info *sta = rx->sta;
717         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
718
719         if (!sta)
720                 return RX_CONTINUE;
721
722         /* Update last_rx only for IBSS packets which are for the current
723          * BSSID to avoid keeping the current IBSS network alive in cases where
724          * other STAs are using different BSSID. */
725         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
726                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
727                                                 NL80211_IFTYPE_ADHOC);
728                 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
729                         sta->last_rx = jiffies;
730         } else
731         if (!is_multicast_ether_addr(hdr->addr1) ||
732             rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
733                 /* Update last_rx only for unicast frames in order to prevent
734                  * the Probe Request frames (the only broadcast frames from a
735                  * STA in infrastructure mode) from keeping a connection alive.
736                  * Mesh beacons will update last_rx when if they are found to
737                  * match the current local configuration when processed.
738                  */
739                 sta->last_rx = jiffies;
740         }
741
742         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
743                 return RX_CONTINUE;
744
745         sta->rx_fragments++;
746         sta->rx_bytes += rx->skb->len;
747         sta->last_signal = rx->status->signal;
748         sta->last_qual = rx->status->qual;
749         sta->last_noise = rx->status->noise;
750
751         /*
752          * Change STA power saving mode only at the end of a frame
753          * exchange sequence.
754          */
755         if (!ieee80211_has_morefrags(hdr->frame_control) &&
756             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
757              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
758                 if (test_sta_flags(sta, WLAN_STA_PS)) {
759                         /*
760                          * Ignore doze->wake transitions that are
761                          * indicated by non-data frames, the standard
762                          * is unclear here, but for example going to
763                          * PS mode and then scanning would cause a
764                          * doze->wake transition for the probe request,
765                          * and that is clearly undesirable.
766                          */
767                         if (ieee80211_is_data(hdr->frame_control) &&
768                             !ieee80211_has_pm(hdr->frame_control))
769                                 rx->sent_ps_buffered += ap_sta_ps_end(sta);
770                 } else {
771                         if (ieee80211_has_pm(hdr->frame_control))
772                                 ap_sta_ps_start(sta);
773                 }
774         }
775
776         /* Drop data::nullfunc frames silently, since they are used only to
777          * control station power saving mode. */
778         if (ieee80211_is_nullfunc(hdr->frame_control)) {
779                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
780                 /* Update counter and free packet here to avoid counting this
781                  * as a dropped packed. */
782                 sta->rx_packets++;
783                 dev_kfree_skb(rx->skb);
784                 return RX_QUEUED;
785         }
786
787         return RX_CONTINUE;
788 } /* ieee80211_rx_h_sta_process */
789
790 static inline struct ieee80211_fragment_entry *
791 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
792                          unsigned int frag, unsigned int seq, int rx_queue,
793                          struct sk_buff **skb)
794 {
795         struct ieee80211_fragment_entry *entry;
796         int idx;
797
798         idx = sdata->fragment_next;
799         entry = &sdata->fragments[sdata->fragment_next++];
800         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
801                 sdata->fragment_next = 0;
802
803         if (!skb_queue_empty(&entry->skb_list)) {
804 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
805                 struct ieee80211_hdr *hdr =
806                         (struct ieee80211_hdr *) entry->skb_list.next->data;
807                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
808                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
809                        "addr1=%pM addr2=%pM\n",
810                        sdata->dev->name, idx,
811                        jiffies - entry->first_frag_time, entry->seq,
812                        entry->last_frag, hdr->addr1, hdr->addr2);
813 #endif
814                 __skb_queue_purge(&entry->skb_list);
815         }
816
817         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
818         *skb = NULL;
819         entry->first_frag_time = jiffies;
820         entry->seq = seq;
821         entry->rx_queue = rx_queue;
822         entry->last_frag = frag;
823         entry->ccmp = 0;
824         entry->extra_len = 0;
825
826         return entry;
827 }
828
829 static inline struct ieee80211_fragment_entry *
830 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
831                           unsigned int frag, unsigned int seq,
832                           int rx_queue, struct ieee80211_hdr *hdr)
833 {
834         struct ieee80211_fragment_entry *entry;
835         int i, idx;
836
837         idx = sdata->fragment_next;
838         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
839                 struct ieee80211_hdr *f_hdr;
840
841                 idx--;
842                 if (idx < 0)
843                         idx = IEEE80211_FRAGMENT_MAX - 1;
844
845                 entry = &sdata->fragments[idx];
846                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
847                     entry->rx_queue != rx_queue ||
848                     entry->last_frag + 1 != frag)
849                         continue;
850
851                 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
852
853                 /*
854                  * Check ftype and addresses are equal, else check next fragment
855                  */
856                 if (((hdr->frame_control ^ f_hdr->frame_control) &
857                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
858                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
859                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
860                         continue;
861
862                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
863                         __skb_queue_purge(&entry->skb_list);
864                         continue;
865                 }
866                 return entry;
867         }
868
869         return NULL;
870 }
871
872 static ieee80211_rx_result debug_noinline
873 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
874 {
875         struct ieee80211_hdr *hdr;
876         u16 sc;
877         __le16 fc;
878         unsigned int frag, seq;
879         struct ieee80211_fragment_entry *entry;
880         struct sk_buff *skb;
881
882         hdr = (struct ieee80211_hdr *)rx->skb->data;
883         fc = hdr->frame_control;
884         sc = le16_to_cpu(hdr->seq_ctrl);
885         frag = sc & IEEE80211_SCTL_FRAG;
886
887         if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
888                    (rx->skb)->len < 24 ||
889                    is_multicast_ether_addr(hdr->addr1))) {
890                 /* not fragmented */
891                 goto out;
892         }
893         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
894
895         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
896
897         if (frag == 0) {
898                 /* This is the first fragment of a new frame. */
899                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
900                                                  rx->queue, &(rx->skb));
901                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
902                     ieee80211_has_protected(fc)) {
903                         /* Store CCMP PN so that we can verify that the next
904                          * fragment has a sequential PN value. */
905                         entry->ccmp = 1;
906                         memcpy(entry->last_pn,
907                                rx->key->u.ccmp.rx_pn[rx->queue],
908                                CCMP_PN_LEN);
909                 }
910                 return RX_QUEUED;
911         }
912
913         /* This is a fragment for a frame that should already be pending in
914          * fragment cache. Add this fragment to the end of the pending entry.
915          */
916         entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
917         if (!entry) {
918                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
919                 return RX_DROP_MONITOR;
920         }
921
922         /* Verify that MPDUs within one MSDU have sequential PN values.
923          * (IEEE 802.11i, 8.3.3.4.5) */
924         if (entry->ccmp) {
925                 int i;
926                 u8 pn[CCMP_PN_LEN], *rpn;
927                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
928                         return RX_DROP_UNUSABLE;
929                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
930                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
931                         pn[i]++;
932                         if (pn[i])
933                                 break;
934                 }
935                 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
936                 if (memcmp(pn, rpn, CCMP_PN_LEN))
937                         return RX_DROP_UNUSABLE;
938                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
939         }
940
941         skb_pull(rx->skb, ieee80211_hdrlen(fc));
942         __skb_queue_tail(&entry->skb_list, rx->skb);
943         entry->last_frag = frag;
944         entry->extra_len += rx->skb->len;
945         if (ieee80211_has_morefrags(fc)) {
946                 rx->skb = NULL;
947                 return RX_QUEUED;
948         }
949
950         rx->skb = __skb_dequeue(&entry->skb_list);
951         if (skb_tailroom(rx->skb) < entry->extra_len) {
952                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
953                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
954                                               GFP_ATOMIC))) {
955                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
956                         __skb_queue_purge(&entry->skb_list);
957                         return RX_DROP_UNUSABLE;
958                 }
959         }
960         while ((skb = __skb_dequeue(&entry->skb_list))) {
961                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
962                 dev_kfree_skb(skb);
963         }
964
965         /* Complete frame has been reassembled - process it now */
966         rx->flags |= IEEE80211_RX_FRAGMENTED;
967
968  out:
969         if (rx->sta)
970                 rx->sta->rx_packets++;
971         if (is_multicast_ether_addr(hdr->addr1))
972                 rx->local->dot11MulticastReceivedFrameCount++;
973         else
974                 ieee80211_led_rx(rx->local);
975         return RX_CONTINUE;
976 }
977
978 static ieee80211_rx_result debug_noinline
979 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
980 {
981         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
982         struct sk_buff *skb;
983         int no_pending_pkts;
984         __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
985
986         if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
987                    !(rx->flags & IEEE80211_RX_RA_MATCH)))
988                 return RX_CONTINUE;
989
990         if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
991             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
992                 return RX_DROP_UNUSABLE;
993
994         skb = skb_dequeue(&rx->sta->tx_filtered);
995         if (!skb) {
996                 skb = skb_dequeue(&rx->sta->ps_tx_buf);
997                 if (skb)
998                         rx->local->total_ps_buffered--;
999         }
1000         no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
1001                 skb_queue_empty(&rx->sta->ps_tx_buf);
1002
1003         if (skb) {
1004                 struct ieee80211_hdr *hdr =
1005                         (struct ieee80211_hdr *) skb->data;
1006
1007                 /*
1008                  * Tell TX path to send one frame even though the STA may
1009                  * still remain is PS mode after this frame exchange.
1010                  */
1011                 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1012
1013 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1014                 printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
1015                        rx->sta->sta.addr, rx->sta->sta.aid,
1016                        skb_queue_len(&rx->sta->ps_tx_buf));
1017 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1018
1019                 /* Use MoreData flag to indicate whether there are more
1020                  * buffered frames for this STA */
1021                 if (no_pending_pkts)
1022                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1023                 else
1024                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1025
1026                 dev_queue_xmit(skb);
1027
1028                 if (no_pending_pkts)
1029                         sta_info_clear_tim_bit(rx->sta);
1030 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1031         } else if (!rx->sent_ps_buffered) {
1032                 /*
1033                  * FIXME: This can be the result of a race condition between
1034                  *        us expiring a frame and the station polling for it.
1035                  *        Should we send it a null-func frame indicating we
1036                  *        have nothing buffered for it?
1037                  */
1038                 printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
1039                        "though there are no buffered frames for it\n",
1040                        rx->dev->name, rx->sta->sta.addr);
1041 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1042         }
1043
1044         /* Free PS Poll skb here instead of returning RX_DROP that would
1045          * count as an dropped frame. */
1046         dev_kfree_skb(rx->skb);
1047
1048         return RX_QUEUED;
1049 }
1050
1051 static ieee80211_rx_result debug_noinline
1052 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1053 {
1054         u8 *data = rx->skb->data;
1055         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1056
1057         if (!ieee80211_is_data_qos(hdr->frame_control))
1058                 return RX_CONTINUE;
1059
1060         /* remove the qos control field, update frame type and meta-data */
1061         memmove(data + IEEE80211_QOS_CTL_LEN, data,
1062                 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1063         hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1064         /* change frame type to non QOS */
1065         hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1066
1067         return RX_CONTINUE;
1068 }
1069
1070 static int
1071 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1072 {
1073         if (unlikely(!rx->sta ||
1074             !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1075                 return -EACCES;
1076
1077         return 0;
1078 }
1079
1080 static int
1081 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1082 {
1083         /*
1084          * Pass through unencrypted frames if the hardware has
1085          * decrypted them already.
1086          */
1087         if (rx->status->flag & RX_FLAG_DECRYPTED)
1088                 return 0;
1089
1090         /* Drop unencrypted frames if key is set. */
1091         if (unlikely(!ieee80211_has_protected(fc) &&
1092                      !ieee80211_is_nullfunc(fc) &&
1093                      (rx->key || rx->sdata->drop_unencrypted)))
1094                 return -EACCES;
1095
1096         return 0;
1097 }
1098
1099 static int
1100 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1101 {
1102         struct net_device *dev = rx->dev;
1103         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1104         u16 hdrlen, ethertype;
1105         u8 *payload;
1106         u8 dst[ETH_ALEN];
1107         u8 src[ETH_ALEN] __aligned(2);
1108         struct sk_buff *skb = rx->skb;
1109         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1110
1111         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1112                 return -1;
1113
1114         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1115
1116         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1117          * header
1118          * IEEE 802.11 address fields:
1119          * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1120          *   0     0   DA    SA    BSSID n/a
1121          *   0     1   DA    BSSID SA    n/a
1122          *   1     0   BSSID SA    DA    n/a
1123          *   1     1   RA    TA    DA    SA
1124          */
1125         memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
1126         memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
1127
1128         switch (hdr->frame_control &
1129                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1130         case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
1131                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
1132                              sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1133                         return -1;
1134                 break;
1135         case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1136                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
1137                              sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
1138                         return -1;
1139                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1140                         struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
1141                                 (skb->data + hdrlen);
1142                         hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
1143                         if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
1144                                 memcpy(dst, meshdr->eaddr1, ETH_ALEN);
1145                                 memcpy(src, meshdr->eaddr2, ETH_ALEN);
1146                         }
1147                 }
1148                 break;
1149         case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
1150                 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
1151                     (is_multicast_ether_addr(dst) &&
1152                      !compare_ether_addr(src, dev->dev_addr)))
1153                         return -1;
1154                 break;
1155         case __constant_cpu_to_le16(0):
1156                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1157                         return -1;
1158                 break;
1159         }
1160
1161         if (unlikely(skb->len - hdrlen < 8))
1162                 return -1;
1163
1164         payload = skb->data + hdrlen;
1165         ethertype = (payload[6] << 8) | payload[7];
1166
1167         if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1168                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1169                    compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1170                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1171                  * replace EtherType */
1172                 skb_pull(skb, hdrlen + 6);
1173                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1174                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1175         } else {
1176                 struct ethhdr *ehdr;
1177                 __be16 len;
1178
1179                 skb_pull(skb, hdrlen);
1180                 len = htons(skb->len);
1181                 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1182                 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1183                 memcpy(ehdr->h_source, src, ETH_ALEN);
1184                 ehdr->h_proto = len;
1185         }
1186         return 0;
1187 }
1188
1189 /*
1190  * requires that rx->skb is a frame with ethernet header
1191  */
1192 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1193 {
1194         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1195                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1196         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1197
1198         /*
1199          * Allow EAPOL frames to us/the PAE group address regardless
1200          * of whether the frame was encrypted or not.
1201          */
1202         if (ehdr->h_proto == htons(ETH_P_PAE) &&
1203             (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1204              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1205                 return true;
1206
1207         if (ieee80211_802_1x_port_control(rx) ||
1208             ieee80211_drop_unencrypted(rx, fc))
1209                 return false;
1210
1211         return true;
1212 }
1213
1214 /*
1215  * requires that rx->skb is a frame with ethernet header
1216  */
1217 static void
1218 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1219 {
1220         struct net_device *dev = rx->dev;
1221         struct ieee80211_local *local = rx->local;
1222         struct sk_buff *skb, *xmit_skb;
1223         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1224         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1225         struct sta_info *dsta;
1226
1227         skb = rx->skb;
1228         xmit_skb = NULL;
1229
1230         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1231              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1232             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1233             (rx->flags & IEEE80211_RX_RA_MATCH)) {
1234                 if (is_multicast_ether_addr(ehdr->h_dest)) {
1235                         /*
1236                          * send multicast frames both to higher layers in
1237                          * local net stack and back to the wireless medium
1238                          */
1239                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
1240                         if (!xmit_skb && net_ratelimit())
1241                                 printk(KERN_DEBUG "%s: failed to clone "
1242                                        "multicast frame\n", dev->name);
1243                 } else {
1244                         dsta = sta_info_get(local, skb->data);
1245                         if (dsta && dsta->sdata->dev == dev) {
1246                                 /*
1247                                  * The destination station is associated to
1248                                  * this AP (in this VLAN), so send the frame
1249                                  * directly to it and do not pass it to local
1250                                  * net stack.
1251                                  */
1252                                 xmit_skb = skb;
1253                                 skb = NULL;
1254                         }
1255                 }
1256         }
1257
1258         if (skb) {
1259                 /* deliver to local stack */
1260                 skb->protocol = eth_type_trans(skb, dev);
1261                 memset(skb->cb, 0, sizeof(skb->cb));
1262                 netif_rx(skb);
1263         }
1264
1265         if (xmit_skb) {
1266                 /* send to wireless media */
1267                 xmit_skb->protocol = htons(ETH_P_802_3);
1268                 skb_reset_network_header(xmit_skb);
1269                 skb_reset_mac_header(xmit_skb);
1270                 dev_queue_xmit(xmit_skb);
1271         }
1272 }
1273
1274 static ieee80211_rx_result debug_noinline
1275 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1276 {
1277         struct net_device *dev = rx->dev;
1278         struct ieee80211_local *local = rx->local;
1279         u16 ethertype;
1280         u8 *payload;
1281         struct sk_buff *skb = rx->skb, *frame = NULL;
1282         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1283         __le16 fc = hdr->frame_control;
1284         const struct ethhdr *eth;
1285         int remaining, err;
1286         u8 dst[ETH_ALEN];
1287         u8 src[ETH_ALEN];
1288
1289         if (unlikely(!ieee80211_is_data(fc)))
1290                 return RX_CONTINUE;
1291
1292         if (unlikely(!ieee80211_is_data_present(fc)))
1293                 return RX_DROP_MONITOR;
1294
1295         if (!(rx->flags & IEEE80211_RX_AMSDU))
1296                 return RX_CONTINUE;
1297
1298         err = ieee80211_data_to_8023(rx);
1299         if (unlikely(err))
1300                 return RX_DROP_UNUSABLE;
1301
1302         skb->dev = dev;
1303
1304         dev->stats.rx_packets++;
1305         dev->stats.rx_bytes += skb->len;
1306
1307         /* skip the wrapping header */
1308         eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1309         if (!eth)
1310                 return RX_DROP_UNUSABLE;
1311
1312         while (skb != frame) {
1313                 u8 padding;
1314                 __be16 len = eth->h_proto;
1315                 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1316
1317                 remaining = skb->len;
1318                 memcpy(dst, eth->h_dest, ETH_ALEN);
1319                 memcpy(src, eth->h_source, ETH_ALEN);
1320
1321                 padding = ((4 - subframe_len) & 0x3);
1322                 /* the last MSDU has no padding */
1323                 if (subframe_len > remaining)
1324                         return RX_DROP_UNUSABLE;
1325
1326                 skb_pull(skb, sizeof(struct ethhdr));
1327                 /* if last subframe reuse skb */
1328                 if (remaining <= subframe_len + padding)
1329                         frame = skb;
1330                 else {
1331                         frame = dev_alloc_skb(local->hw.extra_tx_headroom +
1332                                               subframe_len);
1333
1334                         if (frame == NULL)
1335                                 return RX_DROP_UNUSABLE;
1336
1337                         skb_reserve(frame, local->hw.extra_tx_headroom +
1338                                     sizeof(struct ethhdr));
1339                         memcpy(skb_put(frame, ntohs(len)), skb->data,
1340                                 ntohs(len));
1341
1342                         eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1343                                                         padding);
1344                         if (!eth) {
1345                                 dev_kfree_skb(frame);
1346                                 return RX_DROP_UNUSABLE;
1347                         }
1348                 }
1349
1350                 skb_reset_network_header(frame);
1351                 frame->dev = dev;
1352                 frame->priority = skb->priority;
1353                 rx->skb = frame;
1354
1355                 payload = frame->data;
1356                 ethertype = (payload[6] << 8) | payload[7];
1357
1358                 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1359                             ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1360                            compare_ether_addr(payload,
1361                                               bridge_tunnel_header) == 0)) {
1362                         /* remove RFC1042 or Bridge-Tunnel
1363                          * encapsulation and replace EtherType */
1364                         skb_pull(frame, 6);
1365                         memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1366                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1367                 } else {
1368                         memcpy(skb_push(frame, sizeof(__be16)),
1369                                &len, sizeof(__be16));
1370                         memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1371                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1372                 }
1373
1374                 if (!ieee80211_frame_allowed(rx, fc)) {
1375                         if (skb == frame) /* last frame */
1376                                 return RX_DROP_UNUSABLE;
1377                         dev_kfree_skb(frame);
1378                         continue;
1379                 }
1380
1381                 ieee80211_deliver_skb(rx);
1382         }
1383
1384         return RX_QUEUED;
1385 }
1386
1387 #ifdef CONFIG_MAC80211_MESH
1388 static ieee80211_rx_result
1389 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1390 {
1391         struct ieee80211_hdr *hdr;
1392         struct ieee80211s_hdr *mesh_hdr;
1393         unsigned int hdrlen;
1394         struct sk_buff *skb = rx->skb, *fwd_skb;
1395
1396         hdr = (struct ieee80211_hdr *) skb->data;
1397         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1398         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1399
1400         if (!ieee80211_is_data(hdr->frame_control))
1401                 return RX_CONTINUE;
1402
1403         if (!mesh_hdr->ttl)
1404                 /* illegal frame */
1405                 return RX_DROP_MONITOR;
1406
1407         if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
1408                 struct ieee80211_sub_if_data *sdata;
1409                 struct mesh_path *mppath;
1410
1411                 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1412                 rcu_read_lock();
1413                 mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
1414                 if (!mppath) {
1415                         mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
1416                 } else {
1417                         spin_lock_bh(&mppath->state_lock);
1418                         mppath->exp_time = jiffies;
1419                         if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
1420                                 memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
1421                         spin_unlock_bh(&mppath->state_lock);
1422                 }
1423                 rcu_read_unlock();
1424         }
1425
1426         if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
1427                 return RX_CONTINUE;
1428
1429         mesh_hdr->ttl--;
1430
1431         if (rx->flags & IEEE80211_RX_RA_MATCH) {
1432                 if (!mesh_hdr->ttl)
1433                         IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1434                                                      dropped_frames_ttl);
1435                 else {
1436                         struct ieee80211_hdr *fwd_hdr;
1437                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
1438
1439                         if (!fwd_skb && net_ratelimit())
1440                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1441                                                    rx->dev->name);
1442
1443                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
1444                         /*
1445                          * Save TA to addr1 to send TA a path error if a
1446                          * suitable next hop is not found
1447                          */
1448                         memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
1449                         memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
1450                         fwd_skb->dev = rx->local->mdev;
1451                         fwd_skb->iif = rx->dev->ifindex;
1452                         dev_queue_xmit(fwd_skb);
1453                 }
1454         }
1455
1456         if (is_multicast_ether_addr(hdr->addr3) ||
1457             rx->dev->flags & IFF_PROMISC)
1458                 return RX_CONTINUE;
1459         else
1460                 return RX_DROP_MONITOR;
1461 }
1462 #endif
1463
1464 static ieee80211_rx_result debug_noinline
1465 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1466 {
1467         struct net_device *dev = rx->dev;
1468         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1469         __le16 fc = hdr->frame_control;
1470         int err;
1471
1472         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1473                 return RX_CONTINUE;
1474
1475         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1476                 return RX_DROP_MONITOR;
1477
1478         err = ieee80211_data_to_8023(rx);
1479         if (unlikely(err))
1480                 return RX_DROP_UNUSABLE;
1481
1482         if (!ieee80211_frame_allowed(rx, fc))
1483                 return RX_DROP_MONITOR;
1484
1485         rx->skb->dev = dev;
1486
1487         dev->stats.rx_packets++;
1488         dev->stats.rx_bytes += rx->skb->len;
1489
1490         ieee80211_deliver_skb(rx);
1491
1492         return RX_QUEUED;
1493 }
1494
1495 static ieee80211_rx_result debug_noinline
1496 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1497 {
1498         struct ieee80211_local *local = rx->local;
1499         struct ieee80211_hw *hw = &local->hw;
1500         struct sk_buff *skb = rx->skb;
1501         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1502         struct tid_ampdu_rx *tid_agg_rx;
1503         u16 start_seq_num;
1504         u16 tid;
1505
1506         if (likely(!ieee80211_is_ctl(bar->frame_control)))
1507                 return RX_CONTINUE;
1508
1509         if (ieee80211_is_back_req(bar->frame_control)) {
1510                 if (!rx->sta)
1511                         return RX_CONTINUE;
1512                 tid = le16_to_cpu(bar->control) >> 12;
1513                 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1514                                         != HT_AGG_STATE_OPERATIONAL)
1515                         return RX_CONTINUE;
1516                 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1517
1518                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1519
1520                 /* reset session timer */
1521                 if (tid_agg_rx->timeout) {
1522                         unsigned long expires =
1523                                 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
1524                         mod_timer(&tid_agg_rx->session_timer, expires);
1525                 }
1526
1527                 /* manage reordering buffer according to requested */
1528                 /* sequence number */
1529                 rcu_read_lock();
1530                 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1531                                                  start_seq_num, 1);
1532                 rcu_read_unlock();
1533                 return RX_DROP_UNUSABLE;
1534         }
1535
1536         return RX_CONTINUE;
1537 }
1538
1539 static ieee80211_rx_result debug_noinline
1540 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1541 {
1542         struct ieee80211_local *local = rx->local;
1543         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1544         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1545         int len = rx->skb->len;
1546
1547         if (!ieee80211_is_action(mgmt->frame_control))
1548                 return RX_CONTINUE;
1549
1550         if (!rx->sta)
1551                 return RX_DROP_MONITOR;
1552
1553         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1554                 return RX_DROP_MONITOR;
1555
1556         /* all categories we currently handle have action_code */
1557         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1558                 return RX_DROP_MONITOR;
1559
1560         switch (mgmt->u.action.category) {
1561         case WLAN_CATEGORY_BACK:
1562                 switch (mgmt->u.action.u.addba_req.action_code) {
1563                 case WLAN_ACTION_ADDBA_REQ:
1564                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1565                                    sizeof(mgmt->u.action.u.addba_req)))
1566                                 return RX_DROP_MONITOR;
1567                         ieee80211_process_addba_request(local, rx->sta, mgmt, len);
1568                         break;
1569                 case WLAN_ACTION_ADDBA_RESP:
1570                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1571                                    sizeof(mgmt->u.action.u.addba_resp)))
1572                                 return RX_DROP_MONITOR;
1573                         ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
1574                         break;
1575                 case WLAN_ACTION_DELBA:
1576                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1577                                    sizeof(mgmt->u.action.u.delba)))
1578                                 return RX_DROP_MONITOR;
1579                         ieee80211_process_delba(sdata, rx->sta, mgmt, len);
1580                         break;
1581                 }
1582                 break;
1583         case WLAN_CATEGORY_SPECTRUM_MGMT:
1584                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
1585                         return RX_DROP_MONITOR;
1586                 switch (mgmt->u.action.u.measurement.action_code) {
1587                 case WLAN_ACTION_SPCT_MSR_REQ:
1588                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1589                                    sizeof(mgmt->u.action.u.measurement)))
1590                                 return RX_DROP_MONITOR;
1591                         ieee80211_process_measurement_req(sdata, mgmt, len);
1592                         break;
1593                 }
1594                 break;
1595         default:
1596                 return RX_CONTINUE;
1597         }
1598
1599         rx->sta->rx_packets++;
1600         dev_kfree_skb(rx->skb);
1601         return RX_QUEUED;
1602 }
1603
1604 static ieee80211_rx_result debug_noinline
1605 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1606 {
1607         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1608
1609         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1610                 return RX_DROP_MONITOR;
1611
1612         if (ieee80211_vif_is_mesh(&sdata->vif))
1613                 return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
1614
1615         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1616             sdata->vif.type != NL80211_IFTYPE_ADHOC)
1617                 return RX_DROP_MONITOR;
1618
1619         if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
1620                 return RX_DROP_MONITOR;
1621
1622         ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
1623         return RX_QUEUED;
1624 }
1625
1626 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1627                                             struct ieee80211_hdr *hdr,
1628                                             struct ieee80211_rx_data *rx)
1629 {
1630         int keyidx;
1631         unsigned int hdrlen;
1632
1633         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1634         if (rx->skb->len >= hdrlen + 4)
1635                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1636         else
1637                 keyidx = -1;
1638
1639         if (!rx->sta) {
1640                 /*
1641                  * Some hardware seem to generate incorrect Michael MIC
1642                  * reports; ignore them to avoid triggering countermeasures.
1643                  */
1644                 goto ignore;
1645         }
1646
1647         if (!ieee80211_has_protected(hdr->frame_control))
1648                 goto ignore;
1649
1650         if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
1651                 /*
1652                  * APs with pairwise keys should never receive Michael MIC
1653                  * errors for non-zero keyidx because these are reserved for
1654                  * group keys and only the AP is sending real multicast
1655                  * frames in the BSS.
1656                  */
1657                 goto ignore;
1658         }
1659
1660         if (!ieee80211_is_data(hdr->frame_control) &&
1661             !ieee80211_is_auth(hdr->frame_control))
1662                 goto ignore;
1663
1664         mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
1665  ignore:
1666         dev_kfree_skb(rx->skb);
1667         rx->skb = NULL;
1668 }
1669
1670 /* TODO: use IEEE80211_RX_FRAGMENTED */
1671 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1672 {
1673         struct ieee80211_sub_if_data *sdata;
1674         struct ieee80211_local *local = rx->local;
1675         struct ieee80211_rtap_hdr {
1676                 struct ieee80211_radiotap_header hdr;
1677                 u8 flags;
1678                 u8 rate;
1679                 __le16 chan_freq;
1680                 __le16 chan_flags;
1681         } __attribute__ ((packed)) *rthdr;
1682         struct sk_buff *skb = rx->skb, *skb2;
1683         struct net_device *prev_dev = NULL;
1684         struct ieee80211_rx_status *status = rx->status;
1685
1686         if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1687                 goto out_free_skb;
1688
1689         if (skb_headroom(skb) < sizeof(*rthdr) &&
1690             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1691                 goto out_free_skb;
1692
1693         rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1694         memset(rthdr, 0, sizeof(*rthdr));
1695         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1696         rthdr->hdr.it_present =
1697                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1698                             (1 << IEEE80211_RADIOTAP_RATE) |
1699                             (1 << IEEE80211_RADIOTAP_CHANNEL));
1700
1701         rthdr->rate = rx->rate->bitrate / 5;
1702         rthdr->chan_freq = cpu_to_le16(status->freq);
1703
1704         if (status->band == IEEE80211_BAND_5GHZ)
1705                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1706                                                 IEEE80211_CHAN_5GHZ);
1707         else
1708                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1709                                                 IEEE80211_CHAN_2GHZ);
1710
1711         skb_set_mac_header(skb, 0);
1712         skb->ip_summed = CHECKSUM_UNNECESSARY;
1713         skb->pkt_type = PACKET_OTHERHOST;
1714         skb->protocol = htons(ETH_P_802_2);
1715
1716         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1717                 if (!netif_running(sdata->dev))
1718                         continue;
1719
1720                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
1721                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1722                         continue;
1723
1724                 if (prev_dev) {
1725                         skb2 = skb_clone(skb, GFP_ATOMIC);
1726                         if (skb2) {
1727                                 skb2->dev = prev_dev;
1728                                 netif_rx(skb2);
1729                         }
1730                 }
1731
1732                 prev_dev = sdata->dev;
1733                 sdata->dev->stats.rx_packets++;
1734                 sdata->dev->stats.rx_bytes += skb->len;
1735         }
1736
1737         if (prev_dev) {
1738                 skb->dev = prev_dev;
1739                 netif_rx(skb);
1740                 skb = NULL;
1741         } else
1742                 goto out_free_skb;
1743
1744         rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
1745         return;
1746
1747  out_free_skb:
1748         dev_kfree_skb(skb);
1749 }
1750
1751
1752 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
1753                                          struct ieee80211_rx_data *rx,
1754                                          struct sk_buff *skb)
1755 {
1756         ieee80211_rx_result res = RX_DROP_MONITOR;
1757
1758         rx->skb = skb;
1759         rx->sdata = sdata;
1760         rx->dev = sdata->dev;
1761
1762 #define CALL_RXH(rxh)                   \
1763         do {                            \
1764                 res = rxh(rx);          \
1765                 if (res != RX_CONTINUE) \
1766                         goto rxh_done;  \
1767         } while (0);
1768
1769         CALL_RXH(ieee80211_rx_h_passive_scan)
1770         CALL_RXH(ieee80211_rx_h_check)
1771         CALL_RXH(ieee80211_rx_h_decrypt)
1772         CALL_RXH(ieee80211_rx_h_sta_process)
1773         CALL_RXH(ieee80211_rx_h_defragment)
1774         CALL_RXH(ieee80211_rx_h_ps_poll)
1775         CALL_RXH(ieee80211_rx_h_michael_mic_verify)
1776         /* must be after MMIC verify so header is counted in MPDU mic */
1777         CALL_RXH(ieee80211_rx_h_remove_qos_control)
1778         CALL_RXH(ieee80211_rx_h_amsdu)
1779 #ifdef CONFIG_MAC80211_MESH
1780         if (ieee80211_vif_is_mesh(&sdata->vif))
1781                 CALL_RXH(ieee80211_rx_h_mesh_fwding);
1782 #endif
1783         CALL_RXH(ieee80211_rx_h_data)
1784         CALL_RXH(ieee80211_rx_h_ctrl)
1785         CALL_RXH(ieee80211_rx_h_action)
1786         CALL_RXH(ieee80211_rx_h_mgmt)
1787
1788 #undef CALL_RXH
1789
1790  rxh_done:
1791         switch (res) {
1792         case RX_DROP_MONITOR:
1793                 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1794                 if (rx->sta)
1795                         rx->sta->rx_dropped++;
1796                 /* fall through */
1797         case RX_CONTINUE:
1798                 ieee80211_rx_cooked_monitor(rx);
1799                 break;
1800         case RX_DROP_UNUSABLE:
1801                 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1802                 if (rx->sta)
1803                         rx->sta->rx_dropped++;
1804                 dev_kfree_skb(rx->skb);
1805                 break;
1806         case RX_QUEUED:
1807                 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1808                 break;
1809         }
1810 }
1811
1812 /* main receive path */
1813
1814 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1815                                 u8 *bssid, struct ieee80211_rx_data *rx,
1816                                 struct ieee80211_hdr *hdr)
1817 {
1818         int multicast = is_multicast_ether_addr(hdr->addr1);
1819
1820         switch (sdata->vif.type) {
1821         case NL80211_IFTYPE_STATION:
1822                 if (!bssid)
1823                         return 0;
1824                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1825                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1826                                 return 0;
1827                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1828                 } else if (!multicast &&
1829                            compare_ether_addr(sdata->dev->dev_addr,
1830                                               hdr->addr1) != 0) {
1831                         if (!(sdata->dev->flags & IFF_PROMISC))
1832                                 return 0;
1833                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1834                 }
1835                 break;
1836         case NL80211_IFTYPE_ADHOC:
1837                 if (!bssid)
1838                         return 0;
1839                 if (ieee80211_is_beacon(hdr->frame_control)) {
1840                         return 1;
1841                 }
1842                 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1843                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1844                                 return 0;
1845                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1846                 } else if (!multicast &&
1847                            compare_ether_addr(sdata->dev->dev_addr,
1848                                               hdr->addr1) != 0) {
1849                         if (!(sdata->dev->flags & IFF_PROMISC))
1850                                 return 0;
1851                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1852                 } else if (!rx->sta)
1853                         rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
1854                                 BIT(rx->status->rate_idx));
1855                 break;
1856         case NL80211_IFTYPE_MESH_POINT:
1857                 if (!multicast &&
1858                     compare_ether_addr(sdata->dev->dev_addr,
1859                                        hdr->addr1) != 0) {
1860                         if (!(sdata->dev->flags & IFF_PROMISC))
1861                                 return 0;
1862
1863                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1864                 }
1865                 break;
1866         case NL80211_IFTYPE_AP_VLAN:
1867         case NL80211_IFTYPE_AP:
1868                 if (!bssid) {
1869                         if (compare_ether_addr(sdata->dev->dev_addr,
1870                                                hdr->addr1))
1871                                 return 0;
1872                 } else if (!ieee80211_bssid_match(bssid,
1873                                         sdata->dev->dev_addr)) {
1874                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1875                                 return 0;
1876                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1877                 }
1878                 break;
1879         case NL80211_IFTYPE_WDS:
1880                 if (bssid || !ieee80211_is_data(hdr->frame_control))
1881                         return 0;
1882                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1883                         return 0;
1884                 break;
1885         case NL80211_IFTYPE_MONITOR:
1886                 /* take everything */
1887                 break;
1888         case NL80211_IFTYPE_UNSPECIFIED:
1889         case __NL80211_IFTYPE_AFTER_LAST:
1890                 /* should never get here */
1891                 WARN_ON(1);
1892                 break;
1893         }
1894
1895         return 1;
1896 }
1897
1898 /*
1899  * This is the actual Rx frames handler. as it blongs to Rx path it must
1900  * be called with rcu_read_lock protection.
1901  */
1902 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
1903                                          struct sk_buff *skb,
1904                                          struct ieee80211_rx_status *status,
1905                                          struct ieee80211_rate *rate)
1906 {
1907         struct ieee80211_local *local = hw_to_local(hw);
1908         struct ieee80211_sub_if_data *sdata;
1909         struct ieee80211_hdr *hdr;
1910         struct ieee80211_rx_data rx;
1911         int prepares;
1912         struct ieee80211_sub_if_data *prev = NULL;
1913         struct sk_buff *skb_new;
1914         u8 *bssid;
1915
1916         hdr = (struct ieee80211_hdr *)skb->data;
1917         memset(&rx, 0, sizeof(rx));
1918         rx.skb = skb;
1919         rx.local = local;
1920
1921         rx.status = status;
1922         rx.rate = rate;
1923
1924         if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
1925                 local->dot11ReceivedFragmentCount++;
1926
1927         rx.sta = sta_info_get(local, hdr->addr2);
1928         if (rx.sta) {
1929                 rx.sdata = rx.sta->sdata;
1930                 rx.dev = rx.sta->sdata->dev;
1931         }
1932
1933         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1934                 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
1935                 return;
1936         }
1937
1938         if (unlikely(local->sw_scanning || local->hw_scanning))
1939                 rx.flags |= IEEE80211_RX_IN_SCAN;
1940
1941         ieee80211_parse_qos(&rx);
1942         ieee80211_verify_ip_alignment(&rx);
1943
1944         skb = rx.skb;
1945
1946         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1947                 if (!netif_running(sdata->dev))
1948                         continue;
1949
1950                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
1951                         continue;
1952
1953                 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
1954                 rx.flags |= IEEE80211_RX_RA_MATCH;
1955                 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
1956
1957                 if (!prepares)
1958                         continue;
1959
1960                 /*
1961                  * frame is destined for this interface, but if it's not
1962                  * also for the previous one we handle that after the
1963                  * loop to avoid copying the SKB once too much
1964                  */
1965
1966                 if (!prev) {
1967                         prev = sdata;
1968                         continue;
1969                 }
1970
1971                 /*
1972                  * frame was destined for the previous interface
1973                  * so invoke RX handlers for it
1974                  */
1975
1976                 skb_new = skb_copy(skb, GFP_ATOMIC);
1977                 if (!skb_new) {
1978                         if (net_ratelimit())
1979                                 printk(KERN_DEBUG "%s: failed to copy "
1980                                        "multicast frame for %s\n",
1981                                        wiphy_name(local->hw.wiphy),
1982                                        prev->dev->name);
1983                         continue;
1984                 }
1985                 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
1986                 prev = sdata;
1987         }
1988         if (prev)
1989                 ieee80211_invoke_rx_handlers(prev, &rx, skb);
1990         else
1991                 dev_kfree_skb(skb);
1992 }
1993
1994 #define SEQ_MODULO 0x1000
1995 #define SEQ_MASK   0xfff
1996
1997 static inline int seq_less(u16 sq1, u16 sq2)
1998 {
1999         return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
2000 }
2001
2002 static inline u16 seq_inc(u16 sq)
2003 {
2004         return (sq + 1) & SEQ_MASK;
2005 }
2006
2007 static inline u16 seq_sub(u16 sq1, u16 sq2)
2008 {
2009         return (sq1 - sq2) & SEQ_MASK;
2010 }
2011
2012
2013 /*
2014  * As it function blongs to Rx path it must be called with
2015  * the proper rcu_read_lock protection for its flow.
2016  */
2017 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2018                                            struct tid_ampdu_rx *tid_agg_rx,
2019                                            struct sk_buff *skb,
2020                                            u16 mpdu_seq_num,
2021                                            int bar_req)
2022 {
2023         struct ieee80211_local *local = hw_to_local(hw);
2024         struct ieee80211_rx_status status;
2025         u16 head_seq_num, buf_size;
2026         int index;
2027         struct ieee80211_supported_band *sband;
2028         struct ieee80211_rate *rate;
2029
2030         buf_size = tid_agg_rx->buf_size;
2031         head_seq_num = tid_agg_rx->head_seq_num;
2032
2033         /* frame with out of date sequence number */
2034         if (seq_less(mpdu_seq_num, head_seq_num)) {
2035                 dev_kfree_skb(skb);
2036                 return 1;
2037         }
2038
2039         /* if frame sequence number exceeds our buffering window size or
2040          * block Ack Request arrived - release stored frames */
2041         if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2042                 /* new head to the ordering buffer */
2043                 if (bar_req)
2044                         head_seq_num = mpdu_seq_num;
2045                 else
2046                         head_seq_num =
2047                                 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2048                 /* release stored frames up to new head to stack */
2049                 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2050                         index = seq_sub(tid_agg_rx->head_seq_num,
2051                                 tid_agg_rx->ssn)
2052                                 % tid_agg_rx->buf_size;
2053
2054                         if (tid_agg_rx->reorder_buf[index]) {
2055                                 /* release the reordered frames to stack */
2056                                 memcpy(&status,
2057                                         tid_agg_rx->reorder_buf[index]->cb,
2058                                         sizeof(status));
2059                                 sband = local->hw.wiphy->bands[status.band];
2060                                 rate = &sband->bitrates[status.rate_idx];
2061                                 __ieee80211_rx_handle_packet(hw,
2062                                         tid_agg_rx->reorder_buf[index],
2063                                         &status, rate);
2064                                 tid_agg_rx->stored_mpdu_num--;
2065                                 tid_agg_rx->reorder_buf[index] = NULL;
2066                         }
2067                         tid_agg_rx->head_seq_num =
2068                                 seq_inc(tid_agg_rx->head_seq_num);
2069                 }
2070                 if (bar_req)
2071                         return 1;
2072         }
2073
2074         /* now the new frame is always in the range of the reordering */
2075         /* buffer window */
2076         index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2077                                 % tid_agg_rx->buf_size;
2078         /* check if we already stored this frame */
2079         if (tid_agg_rx->reorder_buf[index]) {
2080                 dev_kfree_skb(skb);
2081                 return 1;
2082         }
2083
2084         /* if arrived mpdu is in the right order and nothing else stored */
2085         /* release it immediately */
2086         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2087                         tid_agg_rx->stored_mpdu_num == 0) {
2088                 tid_agg_rx->head_seq_num =
2089                         seq_inc(tid_agg_rx->head_seq_num);
2090                 return 0;
2091         }
2092
2093         /* put the frame in the reordering buffer */
2094         tid_agg_rx->reorder_buf[index] = skb;
2095         tid_agg_rx->stored_mpdu_num++;
2096         /* release the buffer until next missing frame */
2097         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2098                                                 % tid_agg_rx->buf_size;
2099         while (tid_agg_rx->reorder_buf[index]) {
2100                 /* release the reordered frame back to stack */
2101                 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2102                         sizeof(status));
2103                 sband = local->hw.wiphy->bands[status.band];
2104                 rate = &sband->bitrates[status.rate_idx];
2105                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
2106                                              &status, rate);
2107                 tid_agg_rx->stored_mpdu_num--;
2108                 tid_agg_rx->reorder_buf[index] = NULL;
2109                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2110                 index = seq_sub(tid_agg_rx->head_seq_num,
2111                         tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2112         }
2113         return 1;
2114 }
2115
2116 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2117                                      struct sk_buff *skb)
2118 {
2119         struct ieee80211_hw *hw = &local->hw;
2120         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2121         struct sta_info *sta;
2122         struct tid_ampdu_rx *tid_agg_rx;
2123         u16 sc;
2124         u16 mpdu_seq_num;
2125         u8 ret = 0;
2126         int tid;
2127
2128         sta = sta_info_get(local, hdr->addr2);
2129         if (!sta)
2130                 return ret;
2131
2132         /* filter the QoS data rx stream according to
2133          * STA/TID and check if this STA/TID is on aggregation */
2134         if (!ieee80211_is_data_qos(hdr->frame_control))
2135                 goto end_reorder;
2136
2137         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
2138
2139         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2140                 goto end_reorder;
2141
2142         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2143
2144         /* qos null data frames are excluded */
2145         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
2146                 goto end_reorder;
2147
2148         /* new un-ordered ampdu frame - process it */
2149
2150         /* reset session timer */
2151         if (tid_agg_rx->timeout) {
2152                 unsigned long expires =
2153                         jiffies + (tid_agg_rx->timeout / 1000) * HZ;
2154                 mod_timer(&tid_agg_rx->session_timer, expires);
2155         }
2156
2157         /* if this mpdu is fragmented - terminate rx aggregation session */
2158         sc = le16_to_cpu(hdr->seq_ctrl);
2159         if (sc & IEEE80211_SCTL_FRAG) {
2160                 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
2161                         tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2162                 ret = 1;
2163                 goto end_reorder;
2164         }
2165
2166         /* according to mpdu sequence number deal with reordering buffer */
2167         mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2168         ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2169                                                 mpdu_seq_num, 0);
2170  end_reorder:
2171         return ret;
2172 }
2173
2174 /*
2175  * This is the receive path handler. It is called by a low level driver when an
2176  * 802.11 MPDU is received from the hardware.
2177  */
2178 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2179                     struct ieee80211_rx_status *status)
2180 {
2181         struct ieee80211_local *local = hw_to_local(hw);
2182         struct ieee80211_rate *rate = NULL;
2183         struct ieee80211_supported_band *sband;
2184
2185         if (status->band < 0 ||
2186             status->band >= IEEE80211_NUM_BANDS) {
2187                 WARN_ON(1);
2188                 return;
2189         }
2190
2191         sband = local->hw.wiphy->bands[status->band];
2192
2193         if (!sband ||
2194             status->rate_idx < 0 ||
2195             status->rate_idx >= sband->n_bitrates) {
2196                 WARN_ON(1);
2197                 return;
2198         }
2199
2200         rate = &sband->bitrates[status->rate_idx];
2201
2202         /*
2203          * key references and virtual interfaces are protected using RCU
2204          * and this requires that we are in a read-side RCU section during
2205          * receive processing
2206          */
2207         rcu_read_lock();
2208
2209         /*
2210          * Frames with failed FCS/PLCP checksum are not returned,
2211          * all other frames are returned without radiotap header
2212          * if it was previously present.
2213          * Also, frames with less than 16 bytes are dropped.
2214          */
2215         skb = ieee80211_rx_monitor(local, skb, status, rate);
2216         if (!skb) {
2217                 rcu_read_unlock();
2218                 return;
2219         }
2220
2221         if (!ieee80211_rx_reorder_ampdu(local, skb))
2222                 __ieee80211_rx_handle_packet(hw, skb, status, rate);
2223
2224         rcu_read_unlock();
2225 }
2226 EXPORT_SYMBOL(__ieee80211_rx);
2227
2228 /* This is a version of the rx handler that can be called from hard irq
2229  * context. Post the skb on the queue and schedule the tasklet */
2230 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2231                           struct ieee80211_rx_status *status)
2232 {
2233         struct ieee80211_local *local = hw_to_local(hw);
2234
2235         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2236
2237         skb->dev = local->mdev;
2238         /* copy status into skb->cb for use by tasklet */
2239         memcpy(skb->cb, status, sizeof(*status));
2240         skb->pkt_type = IEEE80211_RX_MSG;
2241         skb_queue_tail(&local->skb_queue, skb);
2242         tasklet_schedule(&local->tasklet);
2243 }
2244 EXPORT_SYMBOL(ieee80211_rx_irqsafe);