mac80211: rx.c use new frame control helpers
[linux-2.6] / net / mac80211 / rx.c
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2005-2006, Devicescape Software, Inc.
4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
5  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
20
21 #include "ieee80211_i.h"
22 #include "led.h"
23 #include "mesh.h"
24 #include "wep.h"
25 #include "wpa.h"
26 #include "tkip.h"
27 #include "wme.h"
28
29 u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30                                 struct tid_ampdu_rx *tid_agg_rx,
31                                 struct sk_buff *skb, u16 mpdu_seq_num,
32                                 int bar_req);
33 /*
34  * monitor mode reception
35  *
36  * This function cleans up the SKB, i.e. it removes all the stuff
37  * only useful for monitoring.
38  */
39 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
40                                            struct sk_buff *skb,
41                                            int rtap_len)
42 {
43         skb_pull(skb, rtap_len);
44
45         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
46                 if (likely(skb->len > FCS_LEN))
47                         skb_trim(skb, skb->len - FCS_LEN);
48                 else {
49                         /* driver bug */
50                         WARN_ON(1);
51                         dev_kfree_skb(skb);
52                         skb = NULL;
53                 }
54         }
55
56         return skb;
57 }
58
59 static inline int should_drop_frame(struct ieee80211_rx_status *status,
60                                     struct sk_buff *skb,
61                                     int present_fcs_len,
62                                     int radiotap_len)
63 {
64         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
65
66         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
67                 return 1;
68         if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
69                 return 1;
70         if (ieee80211_is_ctl(hdr->frame_control) &&
71             !ieee80211_is_pspoll(hdr->frame_control) &&
72             !ieee80211_is_back_req(hdr->frame_control))
73                 return 1;
74         return 0;
75 }
76
77 static int
78 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
79                           struct ieee80211_rx_status *status)
80 {
81         int len;
82
83         /* always present fields */
84         len = sizeof(struct ieee80211_radiotap_header) + 9;
85
86         if (status->flag & RX_FLAG_TSFT)
87                 len += 8;
88         if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
89             local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
90                 len += 1;
91         if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
92                 len += 1;
93
94         if (len & 1) /* padding for RX_FLAGS if necessary */
95                 len++;
96
97         /* make sure radiotap starts at a naturally aligned address */
98         if (len % 8)
99                 len = roundup(len, 8);
100
101         return len;
102 }
103
104 /**
105  * ieee80211_add_rx_radiotap_header - add radiotap header
106  *
107  * add a radiotap header containing all the fields which the hardware provided.
108  */
109 static void
110 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
111                                  struct sk_buff *skb,
112                                  struct ieee80211_rx_status *status,
113                                  struct ieee80211_rate *rate,
114                                  int rtap_len)
115 {
116         struct ieee80211_radiotap_header *rthdr;
117         unsigned char *pos;
118
119         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
120         memset(rthdr, 0, rtap_len);
121
122         /* radiotap header, set always present flags */
123         rthdr->it_present =
124                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
125                             (1 << IEEE80211_RADIOTAP_RATE) |
126                             (1 << IEEE80211_RADIOTAP_CHANNEL) |
127                             (1 << IEEE80211_RADIOTAP_ANTENNA) |
128                             (1 << IEEE80211_RADIOTAP_RX_FLAGS));
129         rthdr->it_len = cpu_to_le16(rtap_len);
130
131         pos = (unsigned char *)(rthdr+1);
132
133         /* the order of the following fields is important */
134
135         /* IEEE80211_RADIOTAP_TSFT */
136         if (status->flag & RX_FLAG_TSFT) {
137                 *(__le64 *)pos = cpu_to_le64(status->mactime);
138                 rthdr->it_present |=
139                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
140                 pos += 8;
141         }
142
143         /* IEEE80211_RADIOTAP_FLAGS */
144         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
145                 *pos |= IEEE80211_RADIOTAP_F_FCS;
146         pos++;
147
148         /* IEEE80211_RADIOTAP_RATE */
149         *pos = rate->bitrate / 5;
150         pos++;
151
152         /* IEEE80211_RADIOTAP_CHANNEL */
153         *(__le16 *)pos = cpu_to_le16(status->freq);
154         pos += 2;
155         if (status->band == IEEE80211_BAND_5GHZ)
156                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
157                                              IEEE80211_CHAN_5GHZ);
158         else
159                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_DYN |
160                                              IEEE80211_CHAN_2GHZ);
161         pos += 2;
162
163         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
164         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
165                 *pos = status->signal;
166                 rthdr->it_present |=
167                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
168                 pos++;
169         }
170
171         /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
172         if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
173                 *pos = status->noise;
174                 rthdr->it_present |=
175                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
176                 pos++;
177         }
178
179         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
180
181         /* IEEE80211_RADIOTAP_ANTENNA */
182         *pos = status->antenna;
183         pos++;
184
185         /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
186         if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
187                 *pos = status->signal;
188                 rthdr->it_present |=
189                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
190                 pos++;
191         }
192
193         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
194
195         /* IEEE80211_RADIOTAP_RX_FLAGS */
196         /* ensure 2 byte alignment for the 2 byte field as required */
197         if ((pos - (unsigned char *)rthdr) & 1)
198                 pos++;
199         /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
200         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
201                 *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
202         pos += 2;
203 }
204
205 /*
206  * This function copies a received frame to all monitor interfaces and
207  * returns a cleaned-up SKB that no longer includes the FCS nor the
208  * radiotap header the driver might have added.
209  */
210 static struct sk_buff *
211 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
212                      struct ieee80211_rx_status *status,
213                      struct ieee80211_rate *rate)
214 {
215         struct ieee80211_sub_if_data *sdata;
216         int needed_headroom = 0;
217         struct sk_buff *skb, *skb2;
218         struct net_device *prev_dev = NULL;
219         int present_fcs_len = 0;
220         int rtap_len = 0;
221
222         /*
223          * First, we may need to make a copy of the skb because
224          *  (1) we need to modify it for radiotap (if not present), and
225          *  (2) the other RX handlers will modify the skb we got.
226          *
227          * We don't need to, of course, if we aren't going to return
228          * the SKB because it has a bad FCS/PLCP checksum.
229          */
230         if (status->flag & RX_FLAG_RADIOTAP)
231                 rtap_len = ieee80211_get_radiotap_len(origskb->data);
232         else
233                 /* room for the radiotap header based on driver features */
234                 needed_headroom = ieee80211_rx_radiotap_len(local, status);
235
236         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
237                 present_fcs_len = FCS_LEN;
238
239         if (!local->monitors) {
240                 if (should_drop_frame(status, origskb, present_fcs_len,
241                                       rtap_len)) {
242                         dev_kfree_skb(origskb);
243                         return NULL;
244                 }
245
246                 return remove_monitor_info(local, origskb, rtap_len);
247         }
248
249         if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
250                 /* only need to expand headroom if necessary */
251                 skb = origskb;
252                 origskb = NULL;
253
254                 /*
255                  * This shouldn't trigger often because most devices have an
256                  * RX header they pull before we get here, and that should
257                  * be big enough for our radiotap information. We should
258                  * probably export the length to drivers so that we can have
259                  * them allocate enough headroom to start with.
260                  */
261                 if (skb_headroom(skb) < needed_headroom &&
262                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
263                         dev_kfree_skb(skb);
264                         return NULL;
265                 }
266         } else {
267                 /*
268                  * Need to make a copy and possibly remove radiotap header
269                  * and FCS from the original.
270                  */
271                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
272
273                 origskb = remove_monitor_info(local, origskb, rtap_len);
274
275                 if (!skb)
276                         return origskb;
277         }
278
279         /* if necessary, prepend radiotap information */
280         if (!(status->flag & RX_FLAG_RADIOTAP))
281                 ieee80211_add_rx_radiotap_header(local, skb, status, rate,
282                                                  needed_headroom);
283
284         skb_reset_mac_header(skb);
285         skb->ip_summed = CHECKSUM_UNNECESSARY;
286         skb->pkt_type = PACKET_OTHERHOST;
287         skb->protocol = htons(ETH_P_802_2);
288
289         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
290                 if (!netif_running(sdata->dev))
291                         continue;
292
293                 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
294                         continue;
295
296                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
297                         continue;
298
299                 if (prev_dev) {
300                         skb2 = skb_clone(skb, GFP_ATOMIC);
301                         if (skb2) {
302                                 skb2->dev = prev_dev;
303                                 netif_rx(skb2);
304                         }
305                 }
306
307                 prev_dev = sdata->dev;
308                 sdata->dev->stats.rx_packets++;
309                 sdata->dev->stats.rx_bytes += skb->len;
310         }
311
312         if (prev_dev) {
313                 skb->dev = prev_dev;
314                 netif_rx(skb);
315         } else
316                 dev_kfree_skb(skb);
317
318         return origskb;
319 }
320
321
322 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
323 {
324         u8 *data = rx->skb->data;
325         int tid;
326
327         /* does the frame have a qos control field? */
328         if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
329                 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
330                 /* frame has qos control */
331                 tid = qc[0] & QOS_CONTROL_TID_MASK;
332                 if (qc[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
333                         rx->flags |= IEEE80211_RX_AMSDU;
334                 else
335                         rx->flags &= ~IEEE80211_RX_AMSDU;
336         } else {
337                 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
338                         /* Separate TID for management frames */
339                         tid = NUM_RX_DATA_QUEUES - 1;
340                 } else {
341                         /* no qos control present */
342                         tid = 0; /* 802.1d - Best Effort */
343                 }
344         }
345
346         rx->queue = tid;
347         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
348          * For now, set skb->priority to 0 for other cases. */
349         rx->skb->priority = (tid > 7) ? 0 : tid;
350 }
351
352 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
353 {
354 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
355         int hdrlen;
356
357         if (!WLAN_FC_DATA_PRESENT(rx->fc))
358                 return;
359
360         /*
361          * Drivers are required to align the payload data in a way that
362          * guarantees that the contained IP header is aligned to a four-
363          * byte boundary. In the case of regular frames, this simply means
364          * aligning the payload to a four-byte boundary (because either
365          * the IP header is directly contained, or IV/RFC1042 headers that
366          * have a length divisible by four are in front of it.
367          *
368          * With A-MSDU frames, however, the payload data address must
369          * yield two modulo four because there are 14-byte 802.3 headers
370          * within the A-MSDU frames that push the IP header further back
371          * to a multiple of four again. Thankfully, the specs were sane
372          * enough this time around to require padding each A-MSDU subframe
373          * to a length that is a multiple of four.
374          *
375          * Padding like atheros hardware adds which is inbetween the 802.11
376          * header and the payload is not supported, the driver is required
377          * to move the 802.11 header further back in that case.
378          */
379         hdrlen = ieee80211_get_hdrlen(rx->fc);
380         if (rx->flags & IEEE80211_RX_AMSDU)
381                 hdrlen += ETH_HLEN;
382         WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
383 #endif
384 }
385
386
387 /* rx handlers */
388
389 static ieee80211_rx_result
390 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
391 {
392         struct ieee80211_local *local = rx->local;
393         struct sk_buff *skb = rx->skb;
394
395         if (unlikely(local->sta_hw_scanning))
396                 return ieee80211_sta_rx_scan(rx->dev, skb, rx->status);
397
398         if (unlikely(local->sta_sw_scanning)) {
399                 /* drop all the other packets during a software scan anyway */
400                 if (ieee80211_sta_rx_scan(rx->dev, skb, rx->status)
401                     != RX_QUEUED)
402                         dev_kfree_skb(skb);
403                 return RX_QUEUED;
404         }
405
406         if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
407                 /* scanning finished during invoking of handlers */
408                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
409                 return RX_DROP_UNUSABLE;
410         }
411
412         return RX_CONTINUE;
413 }
414
415 static ieee80211_rx_result
416 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
417 {
418         int hdrlen = ieee80211_get_hdrlen(rx->fc);
419         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
420
421 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
422
423         if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
424                 if (!((rx->fc & IEEE80211_FCTL_FROMDS) &&
425                       (rx->fc & IEEE80211_FCTL_TODS)))
426                         return RX_DROP_MONITOR;
427                 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
428                         return RX_DROP_MONITOR;
429         }
430
431         /* If there is not an established peer link and this is not a peer link
432          * establisment frame, beacon or probe, drop the frame.
433          */
434
435         if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
436                 struct ieee80211_mgmt *mgmt;
437
438                 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
439                         return RX_DROP_MONITOR;
440
441                 switch (rx->fc & IEEE80211_FCTL_STYPE) {
442                 case IEEE80211_STYPE_ACTION:
443                         mgmt = (struct ieee80211_mgmt *)hdr;
444                         if (mgmt->u.action.category != PLINK_CATEGORY)
445                                 return RX_DROP_MONITOR;
446                         /* fall through on else */
447                 case IEEE80211_STYPE_PROBE_REQ:
448                 case IEEE80211_STYPE_PROBE_RESP:
449                 case IEEE80211_STYPE_BEACON:
450                         return RX_CONTINUE;
451                         break;
452                 default:
453                         return RX_DROP_MONITOR;
454                 }
455
456          } else if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
457                     is_multicast_ether_addr(hdr->addr1) &&
458                     mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
459                 return RX_DROP_MONITOR;
460 #undef msh_h_get
461
462         return RX_CONTINUE;
463 }
464
465
466 static ieee80211_rx_result
467 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
468 {
469         struct ieee80211_hdr *hdr;
470
471         hdr = (struct ieee80211_hdr *) rx->skb->data;
472
473         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
474         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
475                 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
476                              rx->sta->last_seq_ctrl[rx->queue] ==
477                              hdr->seq_ctrl)) {
478                         if (rx->flags & IEEE80211_RX_RA_MATCH) {
479                                 rx->local->dot11FrameDuplicateCount++;
480                                 rx->sta->num_duplicates++;
481                         }
482                         return RX_DROP_MONITOR;
483                 } else
484                         rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
485         }
486
487         if (unlikely(rx->skb->len < 16)) {
488                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
489                 return RX_DROP_MONITOR;
490         }
491
492         /* Drop disallowed frame classes based on STA auth/assoc state;
493          * IEEE 802.11, Chap 5.5.
494          *
495          * 80211.o does filtering only based on association state, i.e., it
496          * drops Class 3 frames from not associated stations. hostapd sends
497          * deauth/disassoc frames when needed. In addition, hostapd is
498          * responsible for filtering on both auth and assoc states.
499          */
500
501         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
502                 return ieee80211_rx_mesh_check(rx);
503
504         if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
505                       ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
506                        (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
507                      rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
508                      (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
509                 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
510                      !(rx->fc & IEEE80211_FCTL_TODS) &&
511                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
512                     || !(rx->flags & IEEE80211_RX_RA_MATCH)) {
513                         /* Drop IBSS frames and frames for other hosts
514                          * silently. */
515                         return RX_DROP_MONITOR;
516                 }
517
518                 return RX_DROP_MONITOR;
519         }
520
521         return RX_CONTINUE;
522 }
523
524
525 static ieee80211_rx_result
526 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
527 {
528         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
529         int keyidx;
530         int hdrlen;
531         ieee80211_rx_result result = RX_DROP_UNUSABLE;
532         struct ieee80211_key *stakey = NULL;
533
534         /*
535          * Key selection 101
536          *
537          * There are three types of keys:
538          *  - GTK (group keys)
539          *  - PTK (pairwise keys)
540          *  - STK (station-to-station pairwise keys)
541          *
542          * When selecting a key, we have to distinguish between multicast
543          * (including broadcast) and unicast frames, the latter can only
544          * use PTKs and STKs while the former always use GTKs. Unless, of
545          * course, actual WEP keys ("pre-RSNA") are used, then unicast
546          * frames can also use key indizes like GTKs. Hence, if we don't
547          * have a PTK/STK we check the key index for a WEP key.
548          *
549          * Note that in a regular BSS, multicast frames are sent by the
550          * AP only, associated stations unicast the frame to the AP first
551          * which then multicasts it on their behalf.
552          *
553          * There is also a slight problem in IBSS mode: GTKs are negotiated
554          * with each station, that is something we don't currently handle.
555          * The spec seems to expect that one negotiates the same key with
556          * every station but there's no such requirement; VLANs could be
557          * possible.
558          */
559
560         if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
561                 return RX_CONTINUE;
562
563         /*
564          * No point in finding a key and decrypting if the frame is neither
565          * addressed to us nor a multicast frame.
566          */
567         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
568                 return RX_CONTINUE;
569
570         if (rx->sta)
571                 stakey = rcu_dereference(rx->sta->key);
572
573         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
574                 rx->key = stakey;
575         } else {
576                 /*
577                  * The device doesn't give us the IV so we won't be
578                  * able to look up the key. That's ok though, we
579                  * don't need to decrypt the frame, we just won't
580                  * be able to keep statistics accurate.
581                  * Except for key threshold notifications, should
582                  * we somehow allow the driver to tell us which key
583                  * the hardware used if this flag is set?
584                  */
585                 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
586                     (rx->status->flag & RX_FLAG_IV_STRIPPED))
587                         return RX_CONTINUE;
588
589                 hdrlen = ieee80211_get_hdrlen(rx->fc);
590
591                 if (rx->skb->len < 8 + hdrlen)
592                         return RX_DROP_UNUSABLE; /* TODO: count this? */
593
594                 /*
595                  * no need to call ieee80211_wep_get_keyidx,
596                  * it verifies a bunch of things we've done already
597                  */
598                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
599
600                 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
601
602                 /*
603                  * RSNA-protected unicast frames should always be sent with
604                  * pairwise or station-to-station keys, but for WEP we allow
605                  * using a key index as well.
606                  */
607                 if (rx->key && rx->key->conf.alg != ALG_WEP &&
608                     !is_multicast_ether_addr(hdr->addr1))
609                         rx->key = NULL;
610         }
611
612         if (rx->key) {
613                 rx->key->tx_rx_count++;
614                 /* TODO: add threshold stuff again */
615         } else {
616 #ifdef CONFIG_MAC80211_DEBUG
617                 if (net_ratelimit())
618                         printk(KERN_DEBUG "%s: RX protected frame,"
619                                " but have no key\n", rx->dev->name);
620 #endif /* CONFIG_MAC80211_DEBUG */
621                 return RX_DROP_MONITOR;
622         }
623
624         /* Check for weak IVs if possible */
625         if (rx->sta && rx->key->conf.alg == ALG_WEP &&
626             ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
627             (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
628              !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
629             ieee80211_wep_is_weak_iv(rx->skb, rx->key))
630                 rx->sta->wep_weak_iv_count++;
631
632         switch (rx->key->conf.alg) {
633         case ALG_WEP:
634                 result = ieee80211_crypto_wep_decrypt(rx);
635                 break;
636         case ALG_TKIP:
637                 result = ieee80211_crypto_tkip_decrypt(rx);
638                 break;
639         case ALG_CCMP:
640                 result = ieee80211_crypto_ccmp_decrypt(rx);
641                 break;
642         }
643
644         /* either the frame has been decrypted or will be dropped */
645         rx->status->flag |= RX_FLAG_DECRYPTED;
646
647         return result;
648 }
649
650 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
651 {
652         struct ieee80211_sub_if_data *sdata;
653         DECLARE_MAC_BUF(mac);
654
655         sdata = sta->sdata;
656
657         if (sdata->bss)
658                 atomic_inc(&sdata->bss->num_sta_ps);
659         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
660 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
661         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
662                dev->name, print_mac(mac, sta->addr), sta->aid);
663 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
664 }
665
666 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
667 {
668         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
669         struct sk_buff *skb;
670         int sent = 0;
671         struct ieee80211_sub_if_data *sdata;
672         struct ieee80211_tx_info *info;
673         DECLARE_MAC_BUF(mac);
674
675         sdata = sta->sdata;
676
677         if (sdata->bss)
678                 atomic_dec(&sdata->bss->num_sta_ps);
679
680         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
681
682         if (!skb_queue_empty(&sta->ps_tx_buf))
683                 sta_info_clear_tim_bit(sta);
684
685 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
686         printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
687                dev->name, print_mac(mac, sta->addr), sta->aid);
688 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
689
690         /* Send all buffered frames to the station */
691         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
692                 info = IEEE80211_SKB_CB(skb);
693                 sent++;
694                 info->flags |= IEEE80211_TX_CTL_REQUEUE;
695                 dev_queue_xmit(skb);
696         }
697         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
698                 info = IEEE80211_SKB_CB(skb);
699                 local->total_ps_buffered--;
700                 sent++;
701 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
702                 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
703                        "since STA not sleeping anymore\n", dev->name,
704                        print_mac(mac, sta->addr), sta->aid);
705 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
706                 info->flags |= IEEE80211_TX_CTL_REQUEUE;
707                 dev_queue_xmit(skb);
708         }
709
710         return sent;
711 }
712
713 static ieee80211_rx_result
714 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
715 {
716         struct sta_info *sta = rx->sta;
717         struct net_device *dev = rx->dev;
718         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
719
720         if (!sta)
721                 return RX_CONTINUE;
722
723         /* Update last_rx only for IBSS packets which are for the current
724          * BSSID to avoid keeping the current IBSS network alive in cases where
725          * other STAs are using different BSSID. */
726         if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
727                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
728                                                 IEEE80211_IF_TYPE_IBSS);
729                 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
730                         sta->last_rx = jiffies;
731         } else
732         if (!is_multicast_ether_addr(hdr->addr1) ||
733             rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
734                 /* Update last_rx only for unicast frames in order to prevent
735                  * the Probe Request frames (the only broadcast frames from a
736                  * STA in infrastructure mode) from keeping a connection alive.
737                  * Mesh beacons will update last_rx when if they are found to
738                  * match the current local configuration when processed.
739                  */
740                 sta->last_rx = jiffies;
741         }
742
743         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
744                 return RX_CONTINUE;
745
746         sta->rx_fragments++;
747         sta->rx_bytes += rx->skb->len;
748         sta->last_signal = rx->status->signal;
749         sta->last_qual = rx->status->qual;
750         sta->last_noise = rx->status->noise;
751
752         if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
753                 /* Change STA power saving mode only in the end of a frame
754                  * exchange sequence */
755                 if (test_sta_flags(sta, WLAN_STA_PS) &&
756                     !(rx->fc & IEEE80211_FCTL_PM))
757                         rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
758                 else if (!test_sta_flags(sta, WLAN_STA_PS) &&
759                          (rx->fc & IEEE80211_FCTL_PM))
760                         ap_sta_ps_start(dev, sta);
761         }
762
763         /* Drop data::nullfunc frames silently, since they are used only to
764          * control station power saving mode. */
765         if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
766             (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
767                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
768                 /* Update counter and free packet here to avoid counting this
769                  * as a dropped packed. */
770                 sta->rx_packets++;
771                 dev_kfree_skb(rx->skb);
772                 return RX_QUEUED;
773         }
774
775         return RX_CONTINUE;
776 } /* ieee80211_rx_h_sta_process */
777
778 static inline struct ieee80211_fragment_entry *
779 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
780                          unsigned int frag, unsigned int seq, int rx_queue,
781                          struct sk_buff **skb)
782 {
783         struct ieee80211_fragment_entry *entry;
784         int idx;
785
786         idx = sdata->fragment_next;
787         entry = &sdata->fragments[sdata->fragment_next++];
788         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
789                 sdata->fragment_next = 0;
790
791         if (!skb_queue_empty(&entry->skb_list)) {
792 #ifdef CONFIG_MAC80211_DEBUG
793                 struct ieee80211_hdr *hdr =
794                         (struct ieee80211_hdr *) entry->skb_list.next->data;
795                 DECLARE_MAC_BUF(mac);
796                 DECLARE_MAC_BUF(mac2);
797                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
798                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
799                        "addr1=%s addr2=%s\n",
800                        sdata->dev->name, idx,
801                        jiffies - entry->first_frag_time, entry->seq,
802                        entry->last_frag, print_mac(mac, hdr->addr1),
803                        print_mac(mac2, hdr->addr2));
804 #endif /* CONFIG_MAC80211_DEBUG */
805                 __skb_queue_purge(&entry->skb_list);
806         }
807
808         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
809         *skb = NULL;
810         entry->first_frag_time = jiffies;
811         entry->seq = seq;
812         entry->rx_queue = rx_queue;
813         entry->last_frag = frag;
814         entry->ccmp = 0;
815         entry->extra_len = 0;
816
817         return entry;
818 }
819
820 static inline struct ieee80211_fragment_entry *
821 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
822                           u16 fc, unsigned int frag, unsigned int seq,
823                           int rx_queue, struct ieee80211_hdr *hdr)
824 {
825         struct ieee80211_fragment_entry *entry;
826         int i, idx;
827
828         idx = sdata->fragment_next;
829         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
830                 struct ieee80211_hdr *f_hdr;
831                 u16 f_fc;
832
833                 idx--;
834                 if (idx < 0)
835                         idx = IEEE80211_FRAGMENT_MAX - 1;
836
837                 entry = &sdata->fragments[idx];
838                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
839                     entry->rx_queue != rx_queue ||
840                     entry->last_frag + 1 != frag)
841                         continue;
842
843                 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
844                 f_fc = le16_to_cpu(f_hdr->frame_control);
845
846                 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
847                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
848                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
849                         continue;
850
851                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
852                         __skb_queue_purge(&entry->skb_list);
853                         continue;
854                 }
855                 return entry;
856         }
857
858         return NULL;
859 }
860
861 static ieee80211_rx_result
862 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
863 {
864         struct ieee80211_hdr *hdr;
865         u16 sc;
866         unsigned int frag, seq;
867         struct ieee80211_fragment_entry *entry;
868         struct sk_buff *skb;
869         DECLARE_MAC_BUF(mac);
870
871         hdr = (struct ieee80211_hdr *) rx->skb->data;
872         sc = le16_to_cpu(hdr->seq_ctrl);
873         frag = sc & IEEE80211_SCTL_FRAG;
874
875         if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
876                    (rx->skb)->len < 24 ||
877                    is_multicast_ether_addr(hdr->addr1))) {
878                 /* not fragmented */
879                 goto out;
880         }
881         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
882
883         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
884
885         if (frag == 0) {
886                 /* This is the first fragment of a new frame. */
887                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
888                                                  rx->queue, &(rx->skb));
889                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
890                     (rx->fc & IEEE80211_FCTL_PROTECTED)) {
891                         /* Store CCMP PN so that we can verify that the next
892                          * fragment has a sequential PN value. */
893                         entry->ccmp = 1;
894                         memcpy(entry->last_pn,
895                                rx->key->u.ccmp.rx_pn[rx->queue],
896                                CCMP_PN_LEN);
897                 }
898                 return RX_QUEUED;
899         }
900
901         /* This is a fragment for a frame that should already be pending in
902          * fragment cache. Add this fragment to the end of the pending entry.
903          */
904         entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
905                                           rx->queue, hdr);
906         if (!entry) {
907                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
908                 return RX_DROP_MONITOR;
909         }
910
911         /* Verify that MPDUs within one MSDU have sequential PN values.
912          * (IEEE 802.11i, 8.3.3.4.5) */
913         if (entry->ccmp) {
914                 int i;
915                 u8 pn[CCMP_PN_LEN], *rpn;
916                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
917                         return RX_DROP_UNUSABLE;
918                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
919                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
920                         pn[i]++;
921                         if (pn[i])
922                                 break;
923                 }
924                 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
925                 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
926                         if (net_ratelimit())
927                                 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
928                                        "sequential A2=%s"
929                                        " PN=%02x%02x%02x%02x%02x%02x "
930                                        "(expected %02x%02x%02x%02x%02x%02x)\n",
931                                        rx->dev->name, print_mac(mac, hdr->addr2),
932                                        rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
933                                        rpn[5], pn[0], pn[1], pn[2], pn[3],
934                                        pn[4], pn[5]);
935                         return RX_DROP_UNUSABLE;
936                 }
937                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
938         }
939
940         skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
941         __skb_queue_tail(&entry->skb_list, rx->skb);
942         entry->last_frag = frag;
943         entry->extra_len += rx->skb->len;
944         if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
945                 rx->skb = NULL;
946                 return RX_QUEUED;
947         }
948
949         rx->skb = __skb_dequeue(&entry->skb_list);
950         if (skb_tailroom(rx->skb) < entry->extra_len) {
951                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
952                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
953                                               GFP_ATOMIC))) {
954                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
955                         __skb_queue_purge(&entry->skb_list);
956                         return RX_DROP_UNUSABLE;
957                 }
958         }
959         while ((skb = __skb_dequeue(&entry->skb_list))) {
960                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
961                 dev_kfree_skb(skb);
962         }
963
964         /* Complete frame has been reassembled - process it now */
965         rx->flags |= IEEE80211_RX_FRAGMENTED;
966
967  out:
968         if (rx->sta)
969                 rx->sta->rx_packets++;
970         if (is_multicast_ether_addr(hdr->addr1))
971                 rx->local->dot11MulticastReceivedFrameCount++;
972         else
973                 ieee80211_led_rx(rx->local);
974         return RX_CONTINUE;
975 }
976
977 static ieee80211_rx_result
978 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
979 {
980         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
981         struct sk_buff *skb;
982         int no_pending_pkts;
983         DECLARE_MAC_BUF(mac);
984
985         if (likely(!rx->sta ||
986                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
987                    (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
988                    !(rx->flags & IEEE80211_RX_RA_MATCH)))
989                 return RX_CONTINUE;
990
991         if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
992             (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
993                 return RX_DROP_UNUSABLE;
994
995         skb = skb_dequeue(&rx->sta->tx_filtered);
996         if (!skb) {
997                 skb = skb_dequeue(&rx->sta->ps_tx_buf);
998                 if (skb)
999                         rx->local->total_ps_buffered--;
1000         }
1001         no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
1002                 skb_queue_empty(&rx->sta->ps_tx_buf);
1003
1004         if (skb) {
1005                 struct ieee80211_hdr *hdr =
1006                         (struct ieee80211_hdr *) skb->data;
1007
1008                 /*
1009                  * Tell TX path to send one frame even though the STA may
1010                  * still remain is PS mode after this frame exchange.
1011                  */
1012                 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1013
1014 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1015                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
1016                        print_mac(mac, rx->sta->addr), rx->sta->aid,
1017                        skb_queue_len(&rx->sta->ps_tx_buf));
1018 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1019
1020                 /* Use MoreData flag to indicate whether there are more
1021                  * buffered frames for this STA */
1022                 if (no_pending_pkts)
1023                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1024                 else
1025                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1026
1027                 dev_queue_xmit(skb);
1028
1029                 if (no_pending_pkts)
1030                         sta_info_clear_tim_bit(rx->sta);
1031 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1032         } else if (!rx->sent_ps_buffered) {
1033                 /*
1034                  * FIXME: This can be the result of a race condition between
1035                  *        us expiring a frame and the station polling for it.
1036                  *        Should we send it a null-func frame indicating we
1037                  *        have nothing buffered for it?
1038                  */
1039                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
1040                        "though there is no buffered frames for it\n",
1041                        rx->dev->name, print_mac(mac, rx->sta->addr));
1042 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1043         }
1044
1045         /* Free PS Poll skb here instead of returning RX_DROP that would
1046          * count as an dropped frame. */
1047         dev_kfree_skb(rx->skb);
1048
1049         return RX_QUEUED;
1050 }
1051
1052 static ieee80211_rx_result
1053 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1054 {
1055         u16 fc = rx->fc;
1056         u8 *data = rx->skb->data;
1057         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
1058
1059         if (!WLAN_FC_IS_QOS_DATA(fc))
1060                 return RX_CONTINUE;
1061
1062         /* remove the qos control field, update frame type and meta-data */
1063         memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
1064         hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
1065         /* change frame type to non QOS */
1066         rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
1067         hdr->frame_control = cpu_to_le16(fc);
1068
1069         return RX_CONTINUE;
1070 }
1071
1072 static int
1073 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1074 {
1075         if (unlikely(!rx->sta ||
1076             !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED))) {
1077 #ifdef CONFIG_MAC80211_DEBUG
1078                 if (net_ratelimit())
1079                         printk(KERN_DEBUG "%s: dropped frame "
1080                                "(unauthorized port)\n", rx->dev->name);
1081 #endif /* CONFIG_MAC80211_DEBUG */
1082                 return -EACCES;
1083         }
1084
1085         return 0;
1086 }
1087
1088 static int
1089 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx)
1090 {
1091         /*
1092          * Pass through unencrypted frames if the hardware has
1093          * decrypted them already.
1094          */
1095         if (rx->status->flag & RX_FLAG_DECRYPTED)
1096                 return 0;
1097
1098         /* Drop unencrypted frames if key is set. */
1099         if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
1100                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
1101                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1102                      (rx->key || rx->sdata->drop_unencrypted)))
1103                 return -EACCES;
1104
1105         return 0;
1106 }
1107
1108 static int
1109 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1110 {
1111         struct net_device *dev = rx->dev;
1112         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1113         u16 fc, hdrlen, ethertype;
1114         u8 *payload;
1115         u8 dst[ETH_ALEN];
1116         u8 src[ETH_ALEN] __aligned(2);
1117         struct sk_buff *skb = rx->skb;
1118         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1119         DECLARE_MAC_BUF(mac);
1120         DECLARE_MAC_BUF(mac2);
1121         DECLARE_MAC_BUF(mac3);
1122         DECLARE_MAC_BUF(mac4);
1123
1124         fc = rx->fc;
1125
1126         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1127                 return -1;
1128
1129         hdrlen = ieee80211_get_hdrlen(fc);
1130
1131         if (ieee80211_vif_is_mesh(&sdata->vif)) {
1132                 int meshhdrlen = ieee80211_get_mesh_hdrlen(
1133                                 (struct ieee80211s_hdr *) (skb->data + hdrlen));
1134                 /* Copy on cb:
1135                  *  - mesh header: to be used for mesh forwarding
1136                  * decision. It will also be used as mesh header template at
1137                  * tx.c:ieee80211_subif_start_xmit() if interface
1138                  * type is mesh and skb->pkt_type == PACKET_OTHERHOST
1139                  *  - ta: to be used if a RERR needs to be sent.
1140                  */
1141                 memcpy(skb->cb, skb->data + hdrlen, meshhdrlen);
1142                 memcpy(MESH_PREQ(skb), hdr->addr2, ETH_ALEN);
1143                 hdrlen += meshhdrlen;
1144         }
1145
1146         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1147          * header
1148          * IEEE 802.11 address fields:
1149          * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1150          *   0     0   DA    SA    BSSID n/a
1151          *   0     1   DA    BSSID SA    n/a
1152          *   1     0   BSSID SA    DA    n/a
1153          *   1     1   RA    TA    DA    SA
1154          */
1155
1156         switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1157         case IEEE80211_FCTL_TODS:
1158                 /* BSSID SA DA */
1159                 memcpy(dst, hdr->addr3, ETH_ALEN);
1160                 memcpy(src, hdr->addr2, ETH_ALEN);
1161
1162                 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
1163                              sdata->vif.type != IEEE80211_IF_TYPE_VLAN)) {
1164                         if (net_ratelimit())
1165                                 printk(KERN_DEBUG "%s: dropped ToDS frame "
1166                                        "(BSSID=%s SA=%s DA=%s)\n",
1167                                        dev->name,
1168                                        print_mac(mac, hdr->addr1),
1169                                        print_mac(mac2, hdr->addr2),
1170                                        print_mac(mac3, hdr->addr3));
1171                         return -1;
1172                 }
1173                 break;
1174         case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1175                 /* RA TA DA SA */
1176                 memcpy(dst, hdr->addr3, ETH_ALEN);
1177                 memcpy(src, hdr->addr4, ETH_ALEN);
1178
1179                  if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS &&
1180                              sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)) {
1181                          if (net_ratelimit())
1182                                  printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
1183                                        "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1184                                        rx->dev->name,
1185                                        print_mac(mac, hdr->addr1),
1186                                        print_mac(mac2, hdr->addr2),
1187                                        print_mac(mac3, hdr->addr3),
1188                                        print_mac(mac4, hdr->addr4));
1189                         return -1;
1190                 }
1191                 break;
1192         case IEEE80211_FCTL_FROMDS:
1193                 /* DA BSSID SA */
1194                 memcpy(dst, hdr->addr1, ETH_ALEN);
1195                 memcpy(src, hdr->addr3, ETH_ALEN);
1196
1197                 if (sdata->vif.type != IEEE80211_IF_TYPE_STA ||
1198                     (is_multicast_ether_addr(dst) &&
1199                      !compare_ether_addr(src, dev->dev_addr)))
1200                         return -1;
1201                 break;
1202         case 0:
1203                 /* DA SA BSSID */
1204                 memcpy(dst, hdr->addr1, ETH_ALEN);
1205                 memcpy(src, hdr->addr2, ETH_ALEN);
1206
1207                 if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
1208                         if (net_ratelimit()) {
1209                                 printk(KERN_DEBUG "%s: dropped IBSS frame "
1210                                        "(DA=%s SA=%s BSSID=%s)\n",
1211                                        dev->name,
1212                                        print_mac(mac, hdr->addr1),
1213                                        print_mac(mac2, hdr->addr2),
1214                                        print_mac(mac3, hdr->addr3));
1215                         }
1216                         return -1;
1217                 }
1218                 break;
1219         }
1220
1221         if (unlikely(skb->len - hdrlen < 8)) {
1222                 if (net_ratelimit()) {
1223                         printk(KERN_DEBUG "%s: RX too short data frame "
1224                                "payload\n", dev->name);
1225                 }
1226                 return -1;
1227         }
1228
1229         payload = skb->data + hdrlen;
1230         ethertype = (payload[6] << 8) | payload[7];
1231
1232         if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1233                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1234                    compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1235                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1236                  * replace EtherType */
1237                 skb_pull(skb, hdrlen + 6);
1238                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1239                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1240         } else {
1241                 struct ethhdr *ehdr;
1242                 __be16 len;
1243
1244                 skb_pull(skb, hdrlen);
1245                 len = htons(skb->len);
1246                 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1247                 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1248                 memcpy(ehdr->h_source, src, ETH_ALEN);
1249                 ehdr->h_proto = len;
1250         }
1251         return 0;
1252 }
1253
1254 /*
1255  * requires that rx->skb is a frame with ethernet header
1256  */
1257 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
1258 {
1259         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1260                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1261         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1262
1263         /*
1264          * Allow EAPOL frames to us/the PAE group address regardless
1265          * of whether the frame was encrypted or not.
1266          */
1267         if (ehdr->h_proto == htons(ETH_P_PAE) &&
1268             (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1269              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1270                 return true;
1271
1272         if (ieee80211_802_1x_port_control(rx) ||
1273             ieee80211_drop_unencrypted(rx))
1274                 return false;
1275
1276         return true;
1277 }
1278
1279 /*
1280  * requires that rx->skb is a frame with ethernet header
1281  */
1282 static void
1283 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1284 {
1285         struct net_device *dev = rx->dev;
1286         struct ieee80211_local *local = rx->local;
1287         struct sk_buff *skb, *xmit_skb;
1288         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1289         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1290         struct sta_info *dsta;
1291
1292         skb = rx->skb;
1293         xmit_skb = NULL;
1294
1295         if (local->bridge_packets && (sdata->vif.type == IEEE80211_IF_TYPE_AP ||
1296                                       sdata->vif.type == IEEE80211_IF_TYPE_VLAN) &&
1297             (rx->flags & IEEE80211_RX_RA_MATCH)) {
1298                 if (is_multicast_ether_addr(ehdr->h_dest)) {
1299                         /*
1300                          * send multicast frames both to higher layers in
1301                          * local net stack and back to the wireless medium
1302                          */
1303                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
1304                         if (!xmit_skb && net_ratelimit())
1305                                 printk(KERN_DEBUG "%s: failed to clone "
1306                                        "multicast frame\n", dev->name);
1307                 } else {
1308                         dsta = sta_info_get(local, skb->data);
1309                         if (dsta && dsta->sdata->dev == dev) {
1310                                 /*
1311                                  * The destination station is associated to
1312                                  * this AP (in this VLAN), so send the frame
1313                                  * directly to it and do not pass it to local
1314                                  * net stack.
1315                                  */
1316                                 xmit_skb = skb;
1317                                 skb = NULL;
1318                         }
1319                 }
1320         }
1321
1322         /* Mesh forwarding */
1323         if (ieee80211_vif_is_mesh(&sdata->vif)) {
1324                 u8 *mesh_ttl = &((struct ieee80211s_hdr *)skb->cb)->ttl;
1325                 (*mesh_ttl)--;
1326
1327                 if (is_multicast_ether_addr(skb->data)) {
1328                         if (*mesh_ttl > 0) {
1329                                 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1330                                 if (xmit_skb)
1331                                         xmit_skb->pkt_type = PACKET_OTHERHOST;
1332                                 else if (net_ratelimit())
1333                                         printk(KERN_DEBUG "%s: failed to clone "
1334                                                "multicast frame\n", dev->name);
1335                         } else
1336                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
1337                                                              dropped_frames_ttl);
1338                 } else if (skb->pkt_type != PACKET_OTHERHOST &&
1339                         compare_ether_addr(dev->dev_addr, skb->data) != 0) {
1340                         if (*mesh_ttl == 0) {
1341                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
1342                                                              dropped_frames_ttl);
1343                                 dev_kfree_skb(skb);
1344                                 skb = NULL;
1345                         } else {
1346                                 xmit_skb = skb;
1347                                 xmit_skb->pkt_type = PACKET_OTHERHOST;
1348                                 if (!(dev->flags & IFF_PROMISC))
1349                                         skb  = NULL;
1350                         }
1351                 }
1352         }
1353
1354         if (skb) {
1355                 /* deliver to local stack */
1356                 skb->protocol = eth_type_trans(skb, dev);
1357                 memset(skb->cb, 0, sizeof(skb->cb));
1358                 netif_rx(skb);
1359         }
1360
1361         if (xmit_skb) {
1362                 /* send to wireless media */
1363                 xmit_skb->protocol = htons(ETH_P_802_3);
1364                 skb_reset_network_header(xmit_skb);
1365                 skb_reset_mac_header(xmit_skb);
1366                 dev_queue_xmit(xmit_skb);
1367         }
1368 }
1369
1370 static ieee80211_rx_result
1371 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1372 {
1373         struct net_device *dev = rx->dev;
1374         struct ieee80211_local *local = rx->local;
1375         u16 fc, ethertype;
1376         u8 *payload;
1377         struct sk_buff *skb = rx->skb, *frame = NULL;
1378         const struct ethhdr *eth;
1379         int remaining, err;
1380         u8 dst[ETH_ALEN];
1381         u8 src[ETH_ALEN];
1382         DECLARE_MAC_BUF(mac);
1383
1384         fc = rx->fc;
1385         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1386                 return RX_CONTINUE;
1387
1388         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1389                 return RX_DROP_MONITOR;
1390
1391         if (!(rx->flags & IEEE80211_RX_AMSDU))
1392                 return RX_CONTINUE;
1393
1394         err = ieee80211_data_to_8023(rx);
1395         if (unlikely(err))
1396                 return RX_DROP_UNUSABLE;
1397
1398         skb->dev = dev;
1399
1400         dev->stats.rx_packets++;
1401         dev->stats.rx_bytes += skb->len;
1402
1403         /* skip the wrapping header */
1404         eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1405         if (!eth)
1406                 return RX_DROP_UNUSABLE;
1407
1408         while (skb != frame) {
1409                 u8 padding;
1410                 __be16 len = eth->h_proto;
1411                 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1412
1413                 remaining = skb->len;
1414                 memcpy(dst, eth->h_dest, ETH_ALEN);
1415                 memcpy(src, eth->h_source, ETH_ALEN);
1416
1417                 padding = ((4 - subframe_len) & 0x3);
1418                 /* the last MSDU has no padding */
1419                 if (subframe_len > remaining) {
1420                         printk(KERN_DEBUG "%s: wrong buffer size\n", dev->name);
1421                         return RX_DROP_UNUSABLE;
1422                 }
1423
1424                 skb_pull(skb, sizeof(struct ethhdr));
1425                 /* if last subframe reuse skb */
1426                 if (remaining <= subframe_len + padding)
1427                         frame = skb;
1428                 else {
1429                         frame = dev_alloc_skb(local->hw.extra_tx_headroom +
1430                                               subframe_len);
1431
1432                         if (frame == NULL)
1433                                 return RX_DROP_UNUSABLE;
1434
1435                         skb_reserve(frame, local->hw.extra_tx_headroom +
1436                                     sizeof(struct ethhdr));
1437                         memcpy(skb_put(frame, ntohs(len)), skb->data,
1438                                 ntohs(len));
1439
1440                         eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1441                                                         padding);
1442                         if (!eth) {
1443                                 printk(KERN_DEBUG "%s: wrong buffer size\n",
1444                                        dev->name);
1445                                 dev_kfree_skb(frame);
1446                                 return RX_DROP_UNUSABLE;
1447                         }
1448                 }
1449
1450                 skb_reset_network_header(frame);
1451                 frame->dev = dev;
1452                 frame->priority = skb->priority;
1453                 rx->skb = frame;
1454
1455                 payload = frame->data;
1456                 ethertype = (payload[6] << 8) | payload[7];
1457
1458                 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1459                             ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1460                            compare_ether_addr(payload,
1461                                               bridge_tunnel_header) == 0)) {
1462                         /* remove RFC1042 or Bridge-Tunnel
1463                          * encapsulation and replace EtherType */
1464                         skb_pull(frame, 6);
1465                         memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1466                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1467                 } else {
1468                         memcpy(skb_push(frame, sizeof(__be16)),
1469                                &len, sizeof(__be16));
1470                         memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1471                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1472                 }
1473
1474                 if (!ieee80211_frame_allowed(rx)) {
1475                         if (skb == frame) /* last frame */
1476                                 return RX_DROP_UNUSABLE;
1477                         dev_kfree_skb(frame);
1478                         continue;
1479                 }
1480
1481                 ieee80211_deliver_skb(rx);
1482         }
1483
1484         return RX_QUEUED;
1485 }
1486
1487 static ieee80211_rx_result
1488 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1489 {
1490         struct net_device *dev = rx->dev;
1491         u16 fc;
1492         int err;
1493
1494         fc = rx->fc;
1495         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1496                 return RX_CONTINUE;
1497
1498         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1499                 return RX_DROP_MONITOR;
1500
1501         err = ieee80211_data_to_8023(rx);
1502         if (unlikely(err))
1503                 return RX_DROP_UNUSABLE;
1504
1505         if (!ieee80211_frame_allowed(rx))
1506                 return RX_DROP_MONITOR;
1507
1508         rx->skb->dev = dev;
1509
1510         dev->stats.rx_packets++;
1511         dev->stats.rx_bytes += rx->skb->len;
1512
1513         ieee80211_deliver_skb(rx);
1514
1515         return RX_QUEUED;
1516 }
1517
1518 static ieee80211_rx_result
1519 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1520 {
1521         struct ieee80211_local *local = rx->local;
1522         struct ieee80211_hw *hw = &local->hw;
1523         struct sk_buff *skb = rx->skb;
1524         struct ieee80211_bar *bar = (struct ieee80211_bar *) skb->data;
1525         struct tid_ampdu_rx *tid_agg_rx;
1526         u16 start_seq_num;
1527         u16 tid;
1528
1529         if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
1530                 return RX_CONTINUE;
1531
1532         if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
1533                 if (!rx->sta)
1534                         return RX_CONTINUE;
1535                 tid = le16_to_cpu(bar->control) >> 12;
1536                 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1537                                         != HT_AGG_STATE_OPERATIONAL)
1538                         return RX_CONTINUE;
1539                 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1540
1541                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1542
1543                 /* reset session timer */
1544                 if (tid_agg_rx->timeout) {
1545                         unsigned long expires =
1546                                 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
1547                         mod_timer(&tid_agg_rx->session_timer, expires);
1548                 }
1549
1550                 /* manage reordering buffer according to requested */
1551                 /* sequence number */
1552                 rcu_read_lock();
1553                 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1554                                                  start_seq_num, 1);
1555                 rcu_read_unlock();
1556                 return RX_DROP_UNUSABLE;
1557         }
1558
1559         return RX_CONTINUE;
1560 }
1561
1562 static ieee80211_rx_result
1563 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1564 {
1565         struct ieee80211_sub_if_data *sdata;
1566
1567         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1568                 return RX_DROP_MONITOR;
1569
1570         sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1571         if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
1572              sdata->vif.type == IEEE80211_IF_TYPE_IBSS ||
1573              sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) &&
1574             !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
1575                 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->status);
1576         else
1577                 return RX_DROP_MONITOR;
1578
1579         return RX_QUEUED;
1580 }
1581
1582 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1583                                             struct ieee80211_hdr *hdr,
1584                                             struct ieee80211_rx_data *rx)
1585 {
1586         int keyidx, hdrlen;
1587         DECLARE_MAC_BUF(mac);
1588         DECLARE_MAC_BUF(mac2);
1589
1590         hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1591         if (rx->skb->len >= hdrlen + 4)
1592                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1593         else
1594                 keyidx = -1;
1595
1596         if (net_ratelimit())
1597                 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1598                        "failure from %s to %s keyidx=%d\n",
1599                        dev->name, print_mac(mac, hdr->addr2),
1600                        print_mac(mac2, hdr->addr1), keyidx);
1601
1602         if (!rx->sta) {
1603                 /*
1604                  * Some hardware seem to generate incorrect Michael MIC
1605                  * reports; ignore them to avoid triggering countermeasures.
1606                  */
1607                 if (net_ratelimit())
1608                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1609                                "error for unknown address %s\n",
1610                                dev->name, print_mac(mac, hdr->addr2));
1611                 goto ignore;
1612         }
1613
1614         if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1615                 if (net_ratelimit())
1616                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1617                                "error for a frame with no PROTECTED flag (src "
1618                                "%s)\n", dev->name, print_mac(mac, hdr->addr2));
1619                 goto ignore;
1620         }
1621
1622         if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
1623                 /*
1624                  * APs with pairwise keys should never receive Michael MIC
1625                  * errors for non-zero keyidx because these are reserved for
1626                  * group keys and only the AP is sending real multicast
1627                  * frames in the BSS.
1628                  */
1629                 if (net_ratelimit())
1630                         printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1631                                "a frame with non-zero keyidx (%d)"
1632                                " (src %s)\n", dev->name, keyidx,
1633                                print_mac(mac, hdr->addr2));
1634                 goto ignore;
1635         }
1636
1637         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1638             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1639              (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1640                 if (net_ratelimit())
1641                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1642                                "error for a frame that cannot be encrypted "
1643                                "(fc=0x%04x) (src %s)\n",
1644                                dev->name, rx->fc, print_mac(mac, hdr->addr2));
1645                 goto ignore;
1646         }
1647
1648         mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1649  ignore:
1650         dev_kfree_skb(rx->skb);
1651         rx->skb = NULL;
1652 }
1653
1654 /* TODO: use IEEE80211_RX_FRAGMENTED */
1655 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1656 {
1657         struct ieee80211_sub_if_data *sdata;
1658         struct ieee80211_local *local = rx->local;
1659         struct ieee80211_rtap_hdr {
1660                 struct ieee80211_radiotap_header hdr;
1661                 u8 flags;
1662                 u8 rate;
1663                 __le16 chan_freq;
1664                 __le16 chan_flags;
1665         } __attribute__ ((packed)) *rthdr;
1666         struct sk_buff *skb = rx->skb, *skb2;
1667         struct net_device *prev_dev = NULL;
1668         struct ieee80211_rx_status *status = rx->status;
1669
1670         if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1671                 goto out_free_skb;
1672
1673         if (skb_headroom(skb) < sizeof(*rthdr) &&
1674             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1675                 goto out_free_skb;
1676
1677         rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1678         memset(rthdr, 0, sizeof(*rthdr));
1679         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1680         rthdr->hdr.it_present =
1681                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1682                             (1 << IEEE80211_RADIOTAP_RATE) |
1683                             (1 << IEEE80211_RADIOTAP_CHANNEL));
1684
1685         rthdr->rate = rx->rate->bitrate / 5;
1686         rthdr->chan_freq = cpu_to_le16(status->freq);
1687
1688         if (status->band == IEEE80211_BAND_5GHZ)
1689                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1690                                                 IEEE80211_CHAN_5GHZ);
1691         else
1692                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1693                                                 IEEE80211_CHAN_2GHZ);
1694
1695         skb_set_mac_header(skb, 0);
1696         skb->ip_summed = CHECKSUM_UNNECESSARY;
1697         skb->pkt_type = PACKET_OTHERHOST;
1698         skb->protocol = htons(ETH_P_802_2);
1699
1700         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1701                 if (!netif_running(sdata->dev))
1702                         continue;
1703
1704                 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
1705                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1706                         continue;
1707
1708                 if (prev_dev) {
1709                         skb2 = skb_clone(skb, GFP_ATOMIC);
1710                         if (skb2) {
1711                                 skb2->dev = prev_dev;
1712                                 netif_rx(skb2);
1713                         }
1714                 }
1715
1716                 prev_dev = sdata->dev;
1717                 sdata->dev->stats.rx_packets++;
1718                 sdata->dev->stats.rx_bytes += skb->len;
1719         }
1720
1721         if (prev_dev) {
1722                 skb->dev = prev_dev;
1723                 netif_rx(skb);
1724                 skb = NULL;
1725         } else
1726                 goto out_free_skb;
1727
1728         rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
1729         return;
1730
1731  out_free_skb:
1732         dev_kfree_skb(skb);
1733 }
1734
1735 typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_rx_data *);
1736 static ieee80211_rx_handler ieee80211_rx_handlers[] =
1737 {
1738         ieee80211_rx_h_passive_scan,
1739         ieee80211_rx_h_check,
1740         ieee80211_rx_h_decrypt,
1741         ieee80211_rx_h_sta_process,
1742         ieee80211_rx_h_defragment,
1743         ieee80211_rx_h_ps_poll,
1744         ieee80211_rx_h_michael_mic_verify,
1745         /* this must be after decryption - so header is counted in MPDU mic
1746          * must be before pae and data, so QOS_DATA format frames
1747          * are not passed to user space by these functions
1748          */
1749         ieee80211_rx_h_remove_qos_control,
1750         ieee80211_rx_h_amsdu,
1751         ieee80211_rx_h_data,
1752         ieee80211_rx_h_ctrl,
1753         ieee80211_rx_h_mgmt,
1754         NULL
1755 };
1756
1757 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
1758                                          struct ieee80211_rx_data *rx,
1759                                          struct sk_buff *skb)
1760 {
1761         ieee80211_rx_handler *handler;
1762         ieee80211_rx_result res = RX_DROP_MONITOR;
1763
1764         rx->skb = skb;
1765         rx->sdata = sdata;
1766         rx->dev = sdata->dev;
1767
1768         for (handler = ieee80211_rx_handlers; *handler != NULL; handler++) {
1769                 res = (*handler)(rx);
1770
1771                 switch (res) {
1772                 case RX_CONTINUE:
1773                         continue;
1774                 case RX_DROP_UNUSABLE:
1775                 case RX_DROP_MONITOR:
1776                         I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1777                         if (rx->sta)
1778                                 rx->sta->rx_dropped++;
1779                         break;
1780                 case RX_QUEUED:
1781                         I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1782                         break;
1783                 }
1784                 break;
1785         }
1786
1787         switch (res) {
1788         case RX_CONTINUE:
1789         case RX_DROP_MONITOR:
1790                 ieee80211_rx_cooked_monitor(rx);
1791                 break;
1792         case RX_DROP_UNUSABLE:
1793                 dev_kfree_skb(rx->skb);
1794                 break;
1795         }
1796 }
1797
1798 /* main receive path */
1799
1800 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1801                                 u8 *bssid, struct ieee80211_rx_data *rx,
1802                                 struct ieee80211_hdr *hdr)
1803 {
1804         int multicast = is_multicast_ether_addr(hdr->addr1);
1805
1806         switch (sdata->vif.type) {
1807         case IEEE80211_IF_TYPE_STA:
1808                 if (!bssid)
1809                         return 0;
1810                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1811                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1812                                 return 0;
1813                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1814                 } else if (!multicast &&
1815                            compare_ether_addr(sdata->dev->dev_addr,
1816                                               hdr->addr1) != 0) {
1817                         if (!(sdata->dev->flags & IFF_PROMISC))
1818                                 return 0;
1819                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1820                 }
1821                 break;
1822         case IEEE80211_IF_TYPE_IBSS:
1823                 if (!bssid)
1824                         return 0;
1825                 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
1826                     (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON) {
1827                         if (!rx->sta)
1828                                 rx->sta = ieee80211_ibss_add_sta(sdata->dev,
1829                                                 rx->skb, bssid, hdr->addr2,
1830                                                 BIT(rx->status->rate_idx));
1831                         return 1;
1832                 }
1833                 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1834                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1835                                 return 0;
1836                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1837                 } else if (!multicast &&
1838                            compare_ether_addr(sdata->dev->dev_addr,
1839                                               hdr->addr1) != 0) {
1840                         if (!(sdata->dev->flags & IFF_PROMISC))
1841                                 return 0;
1842                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1843                 } else if (!rx->sta)
1844                         rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1845                                                 bssid, hdr->addr2,
1846                                                 BIT(rx->status->rate_idx));
1847                 break;
1848         case IEEE80211_IF_TYPE_MESH_POINT:
1849                 if (!multicast &&
1850                     compare_ether_addr(sdata->dev->dev_addr,
1851                                        hdr->addr1) != 0) {
1852                         if (!(sdata->dev->flags & IFF_PROMISC))
1853                                 return 0;
1854
1855                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1856                 }
1857                 break;
1858         case IEEE80211_IF_TYPE_VLAN:
1859         case IEEE80211_IF_TYPE_AP:
1860                 if (!bssid) {
1861                         if (compare_ether_addr(sdata->dev->dev_addr,
1862                                                hdr->addr1))
1863                                 return 0;
1864                 } else if (!ieee80211_bssid_match(bssid,
1865                                         sdata->dev->dev_addr)) {
1866                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1867                                 return 0;
1868                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
1869                 }
1870                 if (sdata->dev == sdata->local->mdev &&
1871                     !(rx->flags & IEEE80211_RX_IN_SCAN))
1872                         /* do not receive anything via
1873                          * master device when not scanning */
1874                         return 0;
1875                 break;
1876         case IEEE80211_IF_TYPE_WDS:
1877                 if (bssid ||
1878                     (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1879                         return 0;
1880                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1881                         return 0;
1882                 break;
1883         case IEEE80211_IF_TYPE_MNTR:
1884                 /* take everything */
1885                 break;
1886         case IEEE80211_IF_TYPE_INVALID:
1887                 /* should never get here */
1888                 WARN_ON(1);
1889                 break;
1890         }
1891
1892         return 1;
1893 }
1894
1895 /*
1896  * This is the actual Rx frames handler. as it blongs to Rx path it must
1897  * be called with rcu_read_lock protection.
1898  */
1899 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
1900                                          struct sk_buff *skb,
1901                                          struct ieee80211_rx_status *status,
1902                                          struct ieee80211_rate *rate)
1903 {
1904         struct ieee80211_local *local = hw_to_local(hw);
1905         struct ieee80211_sub_if_data *sdata;
1906         struct ieee80211_hdr *hdr;
1907         struct ieee80211_rx_data rx;
1908         u16 type;
1909         int prepares;
1910         struct ieee80211_sub_if_data *prev = NULL;
1911         struct sk_buff *skb_new;
1912         u8 *bssid;
1913
1914         hdr = (struct ieee80211_hdr *) skb->data;
1915         memset(&rx, 0, sizeof(rx));
1916         rx.skb = skb;
1917         rx.local = local;
1918
1919         rx.status = status;
1920         rx.rate = rate;
1921         rx.fc = le16_to_cpu(hdr->frame_control);
1922         type = rx.fc & IEEE80211_FCTL_FTYPE;
1923
1924         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
1925                 local->dot11ReceivedFragmentCount++;
1926
1927         rx.sta = sta_info_get(local, hdr->addr2);
1928         if (rx.sta) {
1929                 rx.sdata = rx.sta->sdata;
1930                 rx.dev = rx.sta->sdata->dev;
1931         }
1932
1933         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1934                 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
1935                 return;
1936         }
1937
1938         if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
1939                 rx.flags |= IEEE80211_RX_IN_SCAN;
1940
1941         ieee80211_parse_qos(&rx);
1942         ieee80211_verify_ip_alignment(&rx);
1943
1944         skb = rx.skb;
1945
1946         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1947                 if (!netif_running(sdata->dev))
1948                         continue;
1949
1950                 if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR)
1951                         continue;
1952
1953                 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
1954                 rx.flags |= IEEE80211_RX_RA_MATCH;
1955                 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
1956
1957                 if (!prepares)
1958                         continue;
1959
1960                 /*
1961                  * frame is destined for this interface, but if it's not
1962                  * also for the previous one we handle that after the
1963                  * loop to avoid copying the SKB once too much
1964                  */
1965
1966                 if (!prev) {
1967                         prev = sdata;
1968                         continue;
1969                 }
1970
1971                 /*
1972                  * frame was destined for the previous interface
1973                  * so invoke RX handlers for it
1974                  */
1975
1976                 skb_new = skb_copy(skb, GFP_ATOMIC);
1977                 if (!skb_new) {
1978                         if (net_ratelimit())
1979                                 printk(KERN_DEBUG "%s: failed to copy "
1980                                        "multicast frame for %s\n",
1981                                        wiphy_name(local->hw.wiphy),
1982                                        prev->dev->name);
1983                         continue;
1984                 }
1985                 rx.fc = le16_to_cpu(hdr->frame_control);
1986                 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
1987                 prev = sdata;
1988         }
1989         if (prev) {
1990                 rx.fc = le16_to_cpu(hdr->frame_control);
1991                 ieee80211_invoke_rx_handlers(prev, &rx, skb);
1992         } else
1993                 dev_kfree_skb(skb);
1994 }
1995
1996 #define SEQ_MODULO 0x1000
1997 #define SEQ_MASK   0xfff
1998
1999 static inline int seq_less(u16 sq1, u16 sq2)
2000 {
2001         return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
2002 }
2003
2004 static inline u16 seq_inc(u16 sq)
2005 {
2006         return ((sq + 1) & SEQ_MASK);
2007 }
2008
2009 static inline u16 seq_sub(u16 sq1, u16 sq2)
2010 {
2011         return ((sq1 - sq2) & SEQ_MASK);
2012 }
2013
2014
2015 /*
2016  * As it function blongs to Rx path it must be called with
2017  * the proper rcu_read_lock protection for its flow.
2018  */
2019 u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2020                                 struct tid_ampdu_rx *tid_agg_rx,
2021                                 struct sk_buff *skb, u16 mpdu_seq_num,
2022                                 int bar_req)
2023 {
2024         struct ieee80211_local *local = hw_to_local(hw);
2025         struct ieee80211_rx_status status;
2026         u16 head_seq_num, buf_size;
2027         int index;
2028         struct ieee80211_supported_band *sband;
2029         struct ieee80211_rate *rate;
2030
2031         buf_size = tid_agg_rx->buf_size;
2032         head_seq_num = tid_agg_rx->head_seq_num;
2033
2034         /* frame with out of date sequence number */
2035         if (seq_less(mpdu_seq_num, head_seq_num)) {
2036                 dev_kfree_skb(skb);
2037                 return 1;
2038         }
2039
2040         /* if frame sequence number exceeds our buffering window size or
2041          * block Ack Request arrived - release stored frames */
2042         if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2043                 /* new head to the ordering buffer */
2044                 if (bar_req)
2045                         head_seq_num = mpdu_seq_num;
2046                 else
2047                         head_seq_num =
2048                                 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2049                 /* release stored frames up to new head to stack */
2050                 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2051                         index = seq_sub(tid_agg_rx->head_seq_num,
2052                                 tid_agg_rx->ssn)
2053                                 % tid_agg_rx->buf_size;
2054
2055                         if (tid_agg_rx->reorder_buf[index]) {
2056                                 /* release the reordered frames to stack */
2057                                 memcpy(&status,
2058                                         tid_agg_rx->reorder_buf[index]->cb,
2059                                         sizeof(status));
2060                                 sband = local->hw.wiphy->bands[status.band];
2061                                 rate = &sband->bitrates[status.rate_idx];
2062                                 __ieee80211_rx_handle_packet(hw,
2063                                         tid_agg_rx->reorder_buf[index],
2064                                         &status, rate);
2065                                 tid_agg_rx->stored_mpdu_num--;
2066                                 tid_agg_rx->reorder_buf[index] = NULL;
2067                         }
2068                         tid_agg_rx->head_seq_num =
2069                                 seq_inc(tid_agg_rx->head_seq_num);
2070                 }
2071                 if (bar_req)
2072                         return 1;
2073         }
2074
2075         /* now the new frame is always in the range of the reordering */
2076         /* buffer window */
2077         index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2078                                 % tid_agg_rx->buf_size;
2079         /* check if we already stored this frame */
2080         if (tid_agg_rx->reorder_buf[index]) {
2081                 dev_kfree_skb(skb);
2082                 return 1;
2083         }
2084
2085         /* if arrived mpdu is in the right order and nothing else stored */
2086         /* release it immediately */
2087         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2088                         tid_agg_rx->stored_mpdu_num == 0) {
2089                 tid_agg_rx->head_seq_num =
2090                         seq_inc(tid_agg_rx->head_seq_num);
2091                 return 0;
2092         }
2093
2094         /* put the frame in the reordering buffer */
2095         tid_agg_rx->reorder_buf[index] = skb;
2096         tid_agg_rx->stored_mpdu_num++;
2097         /* release the buffer until next missing frame */
2098         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2099                                                 % tid_agg_rx->buf_size;
2100         while (tid_agg_rx->reorder_buf[index]) {
2101                 /* release the reordered frame back to stack */
2102                 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2103                         sizeof(status));
2104                 sband = local->hw.wiphy->bands[status.band];
2105                 rate = &sband->bitrates[status.rate_idx];
2106                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
2107                                              &status, rate);
2108                 tid_agg_rx->stored_mpdu_num--;
2109                 tid_agg_rx->reorder_buf[index] = NULL;
2110                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2111                 index = seq_sub(tid_agg_rx->head_seq_num,
2112                         tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2113         }
2114         return 1;
2115 }
2116
2117 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2118                                      struct sk_buff *skb)
2119 {
2120         struct ieee80211_hw *hw = &local->hw;
2121         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2122         struct sta_info *sta;
2123         struct tid_ampdu_rx *tid_agg_rx;
2124         u16 sc;
2125         u16 mpdu_seq_num;
2126         u8 ret = 0;
2127         int tid;
2128
2129         sta = sta_info_get(local, hdr->addr2);
2130         if (!sta)
2131                 return ret;
2132
2133         /* filter the QoS data rx stream according to
2134          * STA/TID and check if this STA/TID is on aggregation */
2135         if (!ieee80211_is_data_qos(hdr->frame_control))
2136                 goto end_reorder;
2137
2138         tid = *ieee80211_get_qos_ctl(hdr) & QOS_CONTROL_TID_MASK;
2139
2140         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2141                 goto end_reorder;
2142
2143         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2144
2145         /* null data frames are excluded */
2146         if (unlikely(ieee80211_is_nullfunc(hdr->frame_control)))
2147                 goto end_reorder;
2148
2149         /* new un-ordered ampdu frame - process it */
2150
2151         /* reset session timer */
2152         if (tid_agg_rx->timeout) {
2153                 unsigned long expires =
2154                         jiffies + (tid_agg_rx->timeout / 1000) * HZ;
2155                 mod_timer(&tid_agg_rx->session_timer, expires);
2156         }
2157
2158         /* if this mpdu is fragmented - terminate rx aggregation session */
2159         sc = le16_to_cpu(hdr->seq_ctrl);
2160         if (sc & IEEE80211_SCTL_FRAG) {
2161                 ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
2162                         tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2163                 ret = 1;
2164                 goto end_reorder;
2165         }
2166
2167         /* according to mpdu sequence number deal with reordering buffer */
2168         mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2169         ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2170                                                 mpdu_seq_num, 0);
2171  end_reorder:
2172         return ret;
2173 }
2174
2175 /*
2176  * This is the receive path handler. It is called by a low level driver when an
2177  * 802.11 MPDU is received from the hardware.
2178  */
2179 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2180                     struct ieee80211_rx_status *status)
2181 {
2182         struct ieee80211_local *local = hw_to_local(hw);
2183         struct ieee80211_rate *rate = NULL;
2184         struct ieee80211_supported_band *sband;
2185
2186         if (status->band < 0 ||
2187             status->band >= IEEE80211_NUM_BANDS) {
2188                 WARN_ON(1);
2189                 return;
2190         }
2191
2192         sband = local->hw.wiphy->bands[status->band];
2193
2194         if (!sband ||
2195             status->rate_idx < 0 ||
2196             status->rate_idx >= sband->n_bitrates) {
2197                 WARN_ON(1);
2198                 return;
2199         }
2200
2201         rate = &sband->bitrates[status->rate_idx];
2202
2203         /*
2204          * key references and virtual interfaces are protected using RCU
2205          * and this requires that we are in a read-side RCU section during
2206          * receive processing
2207          */
2208         rcu_read_lock();
2209
2210         /*
2211          * Frames with failed FCS/PLCP checksum are not returned,
2212          * all other frames are returned without radiotap header
2213          * if it was previously present.
2214          * Also, frames with less than 16 bytes are dropped.
2215          */
2216         skb = ieee80211_rx_monitor(local, skb, status, rate);
2217         if (!skb) {
2218                 rcu_read_unlock();
2219                 return;
2220         }
2221
2222         if (!ieee80211_rx_reorder_ampdu(local, skb))
2223                 __ieee80211_rx_handle_packet(hw, skb, status, rate);
2224
2225         rcu_read_unlock();
2226 }
2227 EXPORT_SYMBOL(__ieee80211_rx);
2228
2229 /* This is a version of the rx handler that can be called from hard irq
2230  * context. Post the skb on the queue and schedule the tasklet */
2231 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2232                           struct ieee80211_rx_status *status)
2233 {
2234         struct ieee80211_local *local = hw_to_local(hw);
2235
2236         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2237
2238         skb->dev = local->mdev;
2239         /* copy status into skb->cb for use by tasklet */
2240         memcpy(skb->cb, status, sizeof(*status));
2241         skb->pkt_type = IEEE80211_RX_MSG;
2242         skb_queue_tail(&local->skb_queue, skb);
2243         tasklet_schedule(&local->tasklet);
2244 }
2245 EXPORT_SYMBOL(ieee80211_rx_irqsafe);