Merge branch 'irq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip...
[linux-2.6] / net / mac80211 / rx.c
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2005-2006, Devicescape Software, Inc.
4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
5  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
20
21 #include "ieee80211_i.h"
22 #include "led.h"
23 #include "mesh.h"
24 #include "wep.h"
25 #include "wpa.h"
26 #include "tkip.h"
27 #include "wme.h"
28
29 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30                                            struct tid_ampdu_rx *tid_agg_rx,
31                                            struct sk_buff *skb,
32                                            u16 mpdu_seq_num,
33                                            int bar_req);
34 /*
35  * monitor mode reception
36  *
37  * This function cleans up the SKB, i.e. it removes all the stuff
38  * only useful for monitoring.
39  */
40 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
41                                            struct sk_buff *skb,
42                                            int rtap_len)
43 {
44         skb_pull(skb, rtap_len);
45
46         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
47                 if (likely(skb->len > FCS_LEN))
48                         skb_trim(skb, skb->len - FCS_LEN);
49                 else {
50                         /* driver bug */
51                         WARN_ON(1);
52                         dev_kfree_skb(skb);
53                         skb = NULL;
54                 }
55         }
56
57         return skb;
58 }
59
60 static inline int should_drop_frame(struct ieee80211_rx_status *status,
61                                     struct sk_buff *skb,
62                                     int present_fcs_len,
63                                     int radiotap_len)
64 {
65         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
66
67         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
68                 return 1;
69         if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
70                 return 1;
71         if (ieee80211_is_ctl(hdr->frame_control) &&
72             !ieee80211_is_pspoll(hdr->frame_control) &&
73             !ieee80211_is_back_req(hdr->frame_control))
74                 return 1;
75         return 0;
76 }
77
78 static int
79 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
80                           struct ieee80211_rx_status *status)
81 {
82         int len;
83
84         /* always present fields */
85         len = sizeof(struct ieee80211_radiotap_header) + 9;
86
87         if (status->flag & RX_FLAG_TSFT)
88                 len += 8;
89         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
90                 len += 1;
91         if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
92                 len += 1;
93
94         if (len & 1) /* padding for RX_FLAGS if necessary */
95                 len++;
96
97         /* make sure radiotap starts at a naturally aligned address */
98         if (len % 8)
99                 len = roundup(len, 8);
100
101         return len;
102 }
103
104 /*
105  * ieee80211_add_rx_radiotap_header - add radiotap header
106  *
107  * add a radiotap header containing all the fields which the hardware provided.
108  */
109 static void
110 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
111                                  struct sk_buff *skb,
112                                  struct ieee80211_rx_status *status,
113                                  struct ieee80211_rate *rate,
114                                  int rtap_len)
115 {
116         struct ieee80211_radiotap_header *rthdr;
117         unsigned char *pos;
118
119         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
120         memset(rthdr, 0, rtap_len);
121
122         /* radiotap header, set always present flags */
123         rthdr->it_present =
124                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
125                             (1 << IEEE80211_RADIOTAP_CHANNEL) |
126                             (1 << IEEE80211_RADIOTAP_ANTENNA) |
127                             (1 << IEEE80211_RADIOTAP_RX_FLAGS));
128         rthdr->it_len = cpu_to_le16(rtap_len);
129
130         pos = (unsigned char *)(rthdr+1);
131
132         /* the order of the following fields is important */
133
134         /* IEEE80211_RADIOTAP_TSFT */
135         if (status->flag & RX_FLAG_TSFT) {
136                 *(__le64 *)pos = cpu_to_le64(status->mactime);
137                 rthdr->it_present |=
138                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
139                 pos += 8;
140         }
141
142         /* IEEE80211_RADIOTAP_FLAGS */
143         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
144                 *pos |= IEEE80211_RADIOTAP_F_FCS;
145         if (status->flag & RX_FLAG_SHORTPRE)
146                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
147         pos++;
148
149         /* IEEE80211_RADIOTAP_RATE */
150         if (status->flag & RX_FLAG_HT) {
151                 /*
152                  * TODO: add following information into radiotap header once
153                  * suitable fields are defined for it:
154                  * - MCS index (status->rate_idx)
155                  * - HT40 (status->flag & RX_FLAG_40MHZ)
156                  * - short-GI (status->flag & RX_FLAG_SHORT_GI)
157                  */
158                 *pos = 0;
159         } else {
160                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
161                 *pos = rate->bitrate / 5;
162         }
163         pos++;
164
165         /* IEEE80211_RADIOTAP_CHANNEL */
166         *(__le16 *)pos = cpu_to_le16(status->freq);
167         pos += 2;
168         if (status->band == IEEE80211_BAND_5GHZ)
169                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
170                                              IEEE80211_CHAN_5GHZ);
171         else if (rate->flags & IEEE80211_RATE_ERP_G)
172                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
173                                              IEEE80211_CHAN_2GHZ);
174         else
175                 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
176                                              IEEE80211_CHAN_2GHZ);
177         pos += 2;
178
179         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
180         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
181                 *pos = status->signal;
182                 rthdr->it_present |=
183                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
184                 pos++;
185         }
186
187         /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
188         if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
189                 *pos = status->noise;
190                 rthdr->it_present |=
191                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
192                 pos++;
193         }
194
195         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
196
197         /* IEEE80211_RADIOTAP_ANTENNA */
198         *pos = status->antenna;
199         pos++;
200
201         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
202
203         /* IEEE80211_RADIOTAP_RX_FLAGS */
204         /* ensure 2 byte alignment for the 2 byte field as required */
205         if ((pos - (unsigned char *)rthdr) & 1)
206                 pos++;
207         /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
208         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
209                 *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
210         pos += 2;
211 }
212
213 /*
214  * This function copies a received frame to all monitor interfaces and
215  * returns a cleaned-up SKB that no longer includes the FCS nor the
216  * radiotap header the driver might have added.
217  */
218 static struct sk_buff *
219 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
220                      struct ieee80211_rx_status *status,
221                      struct ieee80211_rate *rate)
222 {
223         struct ieee80211_sub_if_data *sdata;
224         int needed_headroom = 0;
225         struct sk_buff *skb, *skb2;
226         struct net_device *prev_dev = NULL;
227         int present_fcs_len = 0;
228         int rtap_len = 0;
229
230         /*
231          * First, we may need to make a copy of the skb because
232          *  (1) we need to modify it for radiotap (if not present), and
233          *  (2) the other RX handlers will modify the skb we got.
234          *
235          * We don't need to, of course, if we aren't going to return
236          * the SKB because it has a bad FCS/PLCP checksum.
237          */
238         if (status->flag & RX_FLAG_RADIOTAP)
239                 rtap_len = ieee80211_get_radiotap_len(origskb->data);
240         else
241                 /* room for the radiotap header based on driver features */
242                 needed_headroom = ieee80211_rx_radiotap_len(local, status);
243
244         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
245                 present_fcs_len = FCS_LEN;
246
247         if (!local->monitors) {
248                 if (should_drop_frame(status, origskb, present_fcs_len,
249                                       rtap_len)) {
250                         dev_kfree_skb(origskb);
251                         return NULL;
252                 }
253
254                 return remove_monitor_info(local, origskb, rtap_len);
255         }
256
257         if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
258                 /* only need to expand headroom if necessary */
259                 skb = origskb;
260                 origskb = NULL;
261
262                 /*
263                  * This shouldn't trigger often because most devices have an
264                  * RX header they pull before we get here, and that should
265                  * be big enough for our radiotap information. We should
266                  * probably export the length to drivers so that we can have
267                  * them allocate enough headroom to start with.
268                  */
269                 if (skb_headroom(skb) < needed_headroom &&
270                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
271                         dev_kfree_skb(skb);
272                         return NULL;
273                 }
274         } else {
275                 /*
276                  * Need to make a copy and possibly remove radiotap header
277                  * and FCS from the original.
278                  */
279                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
280
281                 origskb = remove_monitor_info(local, origskb, rtap_len);
282
283                 if (!skb)
284                         return origskb;
285         }
286
287         /* if necessary, prepend radiotap information */
288         if (!(status->flag & RX_FLAG_RADIOTAP))
289                 ieee80211_add_rx_radiotap_header(local, skb, status, rate,
290                                                  needed_headroom);
291
292         skb_reset_mac_header(skb);
293         skb->ip_summed = CHECKSUM_UNNECESSARY;
294         skb->pkt_type = PACKET_OTHERHOST;
295         skb->protocol = htons(ETH_P_802_2);
296
297         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
298                 if (!netif_running(sdata->dev))
299                         continue;
300
301                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
302                         continue;
303
304                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
305                         continue;
306
307                 if (prev_dev) {
308                         skb2 = skb_clone(skb, GFP_ATOMIC);
309                         if (skb2) {
310                                 skb2->dev = prev_dev;
311                                 netif_rx(skb2);
312                         }
313                 }
314
315                 prev_dev = sdata->dev;
316                 sdata->dev->stats.rx_packets++;
317                 sdata->dev->stats.rx_bytes += skb->len;
318         }
319
320         if (prev_dev) {
321                 skb->dev = prev_dev;
322                 netif_rx(skb);
323         } else
324                 dev_kfree_skb(skb);
325
326         return origskb;
327 }
328
329
330 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
331 {
332         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
333         int tid;
334
335         /* does the frame have a qos control field? */
336         if (ieee80211_is_data_qos(hdr->frame_control)) {
337                 u8 *qc = ieee80211_get_qos_ctl(hdr);
338                 /* frame has qos control */
339                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
340                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
341                         rx->flags |= IEEE80211_RX_AMSDU;
342                 else
343                         rx->flags &= ~IEEE80211_RX_AMSDU;
344         } else {
345                 /*
346                  * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
347                  *
348                  *      Sequence numbers for management frames, QoS data
349                  *      frames with a broadcast/multicast address in the
350                  *      Address 1 field, and all non-QoS data frames sent
351                  *      by QoS STAs are assigned using an additional single
352                  *      modulo-4096 counter, [...]
353                  *
354                  * We also use that counter for non-QoS STAs.
355                  */
356                 tid = NUM_RX_DATA_QUEUES - 1;
357         }
358
359         rx->queue = tid;
360         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
361          * For now, set skb->priority to 0 for other cases. */
362         rx->skb->priority = (tid > 7) ? 0 : tid;
363 }
364
365 /**
366  * DOC: Packet alignment
367  *
368  * Drivers always need to pass packets that are aligned to two-byte boundaries
369  * to the stack.
370  *
371  * Additionally, should, if possible, align the payload data in a way that
372  * guarantees that the contained IP header is aligned to a four-byte
373  * boundary. In the case of regular frames, this simply means aligning the
374  * payload to a four-byte boundary (because either the IP header is directly
375  * contained, or IV/RFC1042 headers that have a length divisible by four are
376  * in front of it).
377  *
378  * With A-MSDU frames, however, the payload data address must yield two modulo
379  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
380  * push the IP header further back to a multiple of four again. Thankfully, the
381  * specs were sane enough this time around to require padding each A-MSDU
382  * subframe to a length that is a multiple of four.
383  *
384  * Padding like Atheros hardware adds which is inbetween the 802.11 header and
385  * the payload is not supported, the driver is required to move the 802.11
386  * header to be directly in front of the payload in that case.
387  */
388 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
389 {
390         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
391         int hdrlen;
392
393 #ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
394         return;
395 #endif
396
397         if (WARN_ONCE((unsigned long)rx->skb->data & 1,
398                       "unaligned packet at 0x%p\n", rx->skb->data))
399                 return;
400
401         if (!ieee80211_is_data_present(hdr->frame_control))
402                 return;
403
404         hdrlen = ieee80211_hdrlen(hdr->frame_control);
405         if (rx->flags & IEEE80211_RX_AMSDU)
406                 hdrlen += ETH_HLEN;
407         WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
408                   "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
409 }
410
411
412 /* rx handlers */
413
414 static ieee80211_rx_result debug_noinline
415 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
416 {
417         struct ieee80211_local *local = rx->local;
418         struct sk_buff *skb = rx->skb;
419
420         if (unlikely(local->hw_scanning))
421                 return ieee80211_scan_rx(rx->sdata, skb, rx->status);
422
423         if (unlikely(local->sw_scanning)) {
424                 /* drop all the other packets during a software scan anyway */
425                 if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
426                     != RX_QUEUED)
427                         dev_kfree_skb(skb);
428                 return RX_QUEUED;
429         }
430
431         if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
432                 /* scanning finished during invoking of handlers */
433                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
434                 return RX_DROP_UNUSABLE;
435         }
436
437         return RX_CONTINUE;
438 }
439
440
441 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
442 {
443         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
444
445         if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
446                 return 0;
447
448         return ieee80211_is_robust_mgmt_frame(hdr);
449 }
450
451
452 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
453 {
454         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
455
456         if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
457                 return 0;
458
459         return ieee80211_is_robust_mgmt_frame(hdr);
460 }
461
462
463 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
464 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
465 {
466         struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
467         struct ieee80211_mmie *mmie;
468
469         if (skb->len < 24 + sizeof(*mmie) ||
470             !is_multicast_ether_addr(hdr->da))
471                 return -1;
472
473         if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
474                 return -1; /* not a robust management frame */
475
476         mmie = (struct ieee80211_mmie *)
477                 (skb->data + skb->len - sizeof(*mmie));
478         if (mmie->element_id != WLAN_EID_MMIE ||
479             mmie->length != sizeof(*mmie) - 2)
480                 return -1;
481
482         return le16_to_cpu(mmie->key_id);
483 }
484
485
486 static ieee80211_rx_result
487 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
488 {
489         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
490         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
491
492         if (ieee80211_is_data(hdr->frame_control)) {
493                 if (!ieee80211_has_a4(hdr->frame_control))
494                         return RX_DROP_MONITOR;
495                 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
496                         return RX_DROP_MONITOR;
497         }
498
499         /* If there is not an established peer link and this is not a peer link
500          * establisment frame, beacon or probe, drop the frame.
501          */
502
503         if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
504                 struct ieee80211_mgmt *mgmt;
505
506                 if (!ieee80211_is_mgmt(hdr->frame_control))
507                         return RX_DROP_MONITOR;
508
509                 if (ieee80211_is_action(hdr->frame_control)) {
510                         mgmt = (struct ieee80211_mgmt *)hdr;
511                         if (mgmt->u.action.category != PLINK_CATEGORY)
512                                 return RX_DROP_MONITOR;
513                         return RX_CONTINUE;
514                 }
515
516                 if (ieee80211_is_probe_req(hdr->frame_control) ||
517                     ieee80211_is_probe_resp(hdr->frame_control) ||
518                     ieee80211_is_beacon(hdr->frame_control))
519                         return RX_CONTINUE;
520
521                 return RX_DROP_MONITOR;
522
523         }
524
525 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
526
527         if (ieee80211_is_data(hdr->frame_control) &&
528             is_multicast_ether_addr(hdr->addr1) &&
529             mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
530                 return RX_DROP_MONITOR;
531 #undef msh_h_get
532
533         return RX_CONTINUE;
534 }
535
536
537 static ieee80211_rx_result debug_noinline
538 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
539 {
540         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
541
542         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
543         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
544                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
545                              rx->sta->last_seq_ctrl[rx->queue] ==
546                              hdr->seq_ctrl)) {
547                         if (rx->flags & IEEE80211_RX_RA_MATCH) {
548                                 rx->local->dot11FrameDuplicateCount++;
549                                 rx->sta->num_duplicates++;
550                         }
551                         return RX_DROP_MONITOR;
552                 } else
553                         rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
554         }
555
556         if (unlikely(rx->skb->len < 16)) {
557                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
558                 return RX_DROP_MONITOR;
559         }
560
561         /* Drop disallowed frame classes based on STA auth/assoc state;
562          * IEEE 802.11, Chap 5.5.
563          *
564          * mac80211 filters only based on association state, i.e. it drops
565          * Class 3 frames from not associated stations. hostapd sends
566          * deauth/disassoc frames when needed. In addition, hostapd is
567          * responsible for filtering on both auth and assoc states.
568          */
569
570         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
571                 return ieee80211_rx_mesh_check(rx);
572
573         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
574                       ieee80211_is_pspoll(hdr->frame_control)) &&
575                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
576                      (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
577                 if ((!ieee80211_has_fromds(hdr->frame_control) &&
578                      !ieee80211_has_tods(hdr->frame_control) &&
579                      ieee80211_is_data(hdr->frame_control)) ||
580                     !(rx->flags & IEEE80211_RX_RA_MATCH)) {
581                         /* Drop IBSS frames and frames for other hosts
582                          * silently. */
583                         return RX_DROP_MONITOR;
584                 }
585
586                 return RX_DROP_MONITOR;
587         }
588
589         return RX_CONTINUE;
590 }
591
592
593 static ieee80211_rx_result debug_noinline
594 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
595 {
596         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
597         int keyidx;
598         int hdrlen;
599         ieee80211_rx_result result = RX_DROP_UNUSABLE;
600         struct ieee80211_key *stakey = NULL;
601         int mmie_keyidx = -1;
602
603         /*
604          * Key selection 101
605          *
606          * There are four types of keys:
607          *  - GTK (group keys)
608          *  - IGTK (group keys for management frames)
609          *  - PTK (pairwise keys)
610          *  - STK (station-to-station pairwise keys)
611          *
612          * When selecting a key, we have to distinguish between multicast
613          * (including broadcast) and unicast frames, the latter can only
614          * use PTKs and STKs while the former always use GTKs and IGTKs.
615          * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
616          * unicast frames can also use key indices like GTKs. Hence, if we
617          * don't have a PTK/STK we check the key index for a WEP key.
618          *
619          * Note that in a regular BSS, multicast frames are sent by the
620          * AP only, associated stations unicast the frame to the AP first
621          * which then multicasts it on their behalf.
622          *
623          * There is also a slight problem in IBSS mode: GTKs are negotiated
624          * with each station, that is something we don't currently handle.
625          * The spec seems to expect that one negotiates the same key with
626          * every station but there's no such requirement; VLANs could be
627          * possible.
628          */
629
630         if (!ieee80211_has_protected(hdr->frame_control)) {
631                 if (!ieee80211_is_mgmt(hdr->frame_control) ||
632                     rx->sta == NULL || !test_sta_flags(rx->sta, WLAN_STA_MFP))
633                         return RX_CONTINUE;
634                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
635                 if (mmie_keyidx < 0)
636                         return RX_CONTINUE;
637         }
638
639         /*
640          * No point in finding a key and decrypting if the frame is neither
641          * addressed to us nor a multicast frame.
642          */
643         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
644                 return RX_CONTINUE;
645
646         if (rx->sta)
647                 stakey = rcu_dereference(rx->sta->key);
648
649         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
650                 rx->key = stakey;
651         } else if (mmie_keyidx >= 0) {
652                 /* Broadcast/multicast robust management frame / BIP */
653                 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
654                     (rx->status->flag & RX_FLAG_IV_STRIPPED))
655                         return RX_CONTINUE;
656
657                 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
658                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
659                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
660                 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
661         } else {
662                 /*
663                  * The device doesn't give us the IV so we won't be
664                  * able to look up the key. That's ok though, we
665                  * don't need to decrypt the frame, we just won't
666                  * be able to keep statistics accurate.
667                  * Except for key threshold notifications, should
668                  * we somehow allow the driver to tell us which key
669                  * the hardware used if this flag is set?
670                  */
671                 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
672                     (rx->status->flag & RX_FLAG_IV_STRIPPED))
673                         return RX_CONTINUE;
674
675                 hdrlen = ieee80211_hdrlen(hdr->frame_control);
676
677                 if (rx->skb->len < 8 + hdrlen)
678                         return RX_DROP_UNUSABLE; /* TODO: count this? */
679
680                 /*
681                  * no need to call ieee80211_wep_get_keyidx,
682                  * it verifies a bunch of things we've done already
683                  */
684                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
685
686                 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
687
688                 /*
689                  * RSNA-protected unicast frames should always be sent with
690                  * pairwise or station-to-station keys, but for WEP we allow
691                  * using a key index as well.
692                  */
693                 if (rx->key && rx->key->conf.alg != ALG_WEP &&
694                     !is_multicast_ether_addr(hdr->addr1))
695                         rx->key = NULL;
696         }
697
698         if (rx->key) {
699                 rx->key->tx_rx_count++;
700                 /* TODO: add threshold stuff again */
701         } else {
702                 return RX_DROP_MONITOR;
703         }
704
705         /* Check for weak IVs if possible */
706         if (rx->sta && rx->key->conf.alg == ALG_WEP &&
707             ieee80211_is_data(hdr->frame_control) &&
708             (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
709              !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
710             ieee80211_wep_is_weak_iv(rx->skb, rx->key))
711                 rx->sta->wep_weak_iv_count++;
712
713         switch (rx->key->conf.alg) {
714         case ALG_WEP:
715                 result = ieee80211_crypto_wep_decrypt(rx);
716                 break;
717         case ALG_TKIP:
718                 result = ieee80211_crypto_tkip_decrypt(rx);
719                 break;
720         case ALG_CCMP:
721                 result = ieee80211_crypto_ccmp_decrypt(rx);
722                 break;
723         case ALG_AES_CMAC:
724                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
725                 break;
726         }
727
728         /* either the frame has been decrypted or will be dropped */
729         rx->status->flag |= RX_FLAG_DECRYPTED;
730
731         return result;
732 }
733
734 static ieee80211_rx_result debug_noinline
735 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
736 {
737         struct ieee80211_local *local;
738         struct ieee80211_hdr *hdr;
739         struct sk_buff *skb;
740
741         local = rx->local;
742         skb = rx->skb;
743         hdr = (struct ieee80211_hdr *) skb->data;
744
745         if (!local->pspolling)
746                 return RX_CONTINUE;
747
748         if (!ieee80211_has_fromds(hdr->frame_control))
749                 /* this is not from AP */
750                 return RX_CONTINUE;
751
752         if (!ieee80211_is_data(hdr->frame_control))
753                 return RX_CONTINUE;
754
755         if (!ieee80211_has_moredata(hdr->frame_control)) {
756                 /* AP has no more frames buffered for us */
757                 local->pspolling = false;
758                 return RX_CONTINUE;
759         }
760
761         /* more data bit is set, let's request a new frame from the AP */
762         ieee80211_send_pspoll(local, rx->sdata);
763
764         return RX_CONTINUE;
765 }
766
767 static void ap_sta_ps_start(struct sta_info *sta)
768 {
769         struct ieee80211_sub_if_data *sdata = sta->sdata;
770         struct ieee80211_local *local = sdata->local;
771
772         atomic_inc(&sdata->bss->num_sta_ps);
773         set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
774         if (local->ops->sta_notify)
775                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
776                                         STA_NOTIFY_SLEEP, &sta->sta);
777 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
778         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
779                sdata->dev->name, sta->sta.addr, sta->sta.aid);
780 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
781 }
782
783 static int ap_sta_ps_end(struct sta_info *sta)
784 {
785         struct ieee80211_sub_if_data *sdata = sta->sdata;
786         struct ieee80211_local *local = sdata->local;
787         struct sk_buff *skb;
788         int sent = 0;
789
790         atomic_dec(&sdata->bss->num_sta_ps);
791
792         clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
793         if (local->ops->sta_notify)
794                 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
795                                         STA_NOTIFY_AWAKE, &sta->sta);
796
797         if (!skb_queue_empty(&sta->ps_tx_buf))
798                 sta_info_clear_tim_bit(sta);
799
800 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
801         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
802                sdata->dev->name, sta->sta.addr, sta->sta.aid);
803 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
804
805         /* Send all buffered frames to the station */
806         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
807                 sent++;
808                 skb->requeue = 1;
809                 dev_queue_xmit(skb);
810         }
811         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
812                 local->total_ps_buffered--;
813                 sent++;
814 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
815                 printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
816                        "since STA not sleeping anymore\n", sdata->dev->name,
817                        sta->sta.addr, sta->sta.aid);
818 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
819                 skb->requeue = 1;
820                 dev_queue_xmit(skb);
821         }
822
823         return sent;
824 }
825
826 static ieee80211_rx_result debug_noinline
827 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
828 {
829         struct sta_info *sta = rx->sta;
830         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
831
832         if (!sta)
833                 return RX_CONTINUE;
834
835         /* Update last_rx only for IBSS packets which are for the current
836          * BSSID to avoid keeping the current IBSS network alive in cases where
837          * other STAs are using different BSSID. */
838         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
839                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
840                                                 NL80211_IFTYPE_ADHOC);
841                 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
842                         sta->last_rx = jiffies;
843         } else
844         if (!is_multicast_ether_addr(hdr->addr1) ||
845             rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
846                 /* Update last_rx only for unicast frames in order to prevent
847                  * the Probe Request frames (the only broadcast frames from a
848                  * STA in infrastructure mode) from keeping a connection alive.
849                  * Mesh beacons will update last_rx when if they are found to
850                  * match the current local configuration when processed.
851                  */
852                 sta->last_rx = jiffies;
853         }
854
855         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
856                 return RX_CONTINUE;
857
858         sta->rx_fragments++;
859         sta->rx_bytes += rx->skb->len;
860         sta->last_signal = rx->status->signal;
861         sta->last_qual = rx->status->qual;
862         sta->last_noise = rx->status->noise;
863
864         /*
865          * Change STA power saving mode only at the end of a frame
866          * exchange sequence.
867          */
868         if (!ieee80211_has_morefrags(hdr->frame_control) &&
869             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
870              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
871                 if (test_sta_flags(sta, WLAN_STA_PS)) {
872                         /*
873                          * Ignore doze->wake transitions that are
874                          * indicated by non-data frames, the standard
875                          * is unclear here, but for example going to
876                          * PS mode and then scanning would cause a
877                          * doze->wake transition for the probe request,
878                          * and that is clearly undesirable.
879                          */
880                         if (ieee80211_is_data(hdr->frame_control) &&
881                             !ieee80211_has_pm(hdr->frame_control))
882                                 rx->sent_ps_buffered += ap_sta_ps_end(sta);
883                 } else {
884                         if (ieee80211_has_pm(hdr->frame_control))
885                                 ap_sta_ps_start(sta);
886                 }
887         }
888
889         /* Drop data::nullfunc frames silently, since they are used only to
890          * control station power saving mode. */
891         if (ieee80211_is_nullfunc(hdr->frame_control)) {
892                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
893                 /* Update counter and free packet here to avoid counting this
894                  * as a dropped packed. */
895                 sta->rx_packets++;
896                 dev_kfree_skb(rx->skb);
897                 return RX_QUEUED;
898         }
899
900         return RX_CONTINUE;
901 } /* ieee80211_rx_h_sta_process */
902
903 static inline struct ieee80211_fragment_entry *
904 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
905                          unsigned int frag, unsigned int seq, int rx_queue,
906                          struct sk_buff **skb)
907 {
908         struct ieee80211_fragment_entry *entry;
909         int idx;
910
911         idx = sdata->fragment_next;
912         entry = &sdata->fragments[sdata->fragment_next++];
913         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
914                 sdata->fragment_next = 0;
915
916         if (!skb_queue_empty(&entry->skb_list)) {
917 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
918                 struct ieee80211_hdr *hdr =
919                         (struct ieee80211_hdr *) entry->skb_list.next->data;
920                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
921                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
922                        "addr1=%pM addr2=%pM\n",
923                        sdata->dev->name, idx,
924                        jiffies - entry->first_frag_time, entry->seq,
925                        entry->last_frag, hdr->addr1, hdr->addr2);
926 #endif
927                 __skb_queue_purge(&entry->skb_list);
928         }
929
930         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
931         *skb = NULL;
932         entry->first_frag_time = jiffies;
933         entry->seq = seq;
934         entry->rx_queue = rx_queue;
935         entry->last_frag = frag;
936         entry->ccmp = 0;
937         entry->extra_len = 0;
938
939         return entry;
940 }
941
942 static inline struct ieee80211_fragment_entry *
943 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
944                           unsigned int frag, unsigned int seq,
945                           int rx_queue, struct ieee80211_hdr *hdr)
946 {
947         struct ieee80211_fragment_entry *entry;
948         int i, idx;
949
950         idx = sdata->fragment_next;
951         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
952                 struct ieee80211_hdr *f_hdr;
953
954                 idx--;
955                 if (idx < 0)
956                         idx = IEEE80211_FRAGMENT_MAX - 1;
957
958                 entry = &sdata->fragments[idx];
959                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
960                     entry->rx_queue != rx_queue ||
961                     entry->last_frag + 1 != frag)
962                         continue;
963
964                 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
965
966                 /*
967                  * Check ftype and addresses are equal, else check next fragment
968                  */
969                 if (((hdr->frame_control ^ f_hdr->frame_control) &
970                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
971                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
972                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
973                         continue;
974
975                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
976                         __skb_queue_purge(&entry->skb_list);
977                         continue;
978                 }
979                 return entry;
980         }
981
982         return NULL;
983 }
984
985 static ieee80211_rx_result debug_noinline
986 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
987 {
988         struct ieee80211_hdr *hdr;
989         u16 sc;
990         __le16 fc;
991         unsigned int frag, seq;
992         struct ieee80211_fragment_entry *entry;
993         struct sk_buff *skb;
994
995         hdr = (struct ieee80211_hdr *)rx->skb->data;
996         fc = hdr->frame_control;
997         sc = le16_to_cpu(hdr->seq_ctrl);
998         frag = sc & IEEE80211_SCTL_FRAG;
999
1000         if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1001                    (rx->skb)->len < 24 ||
1002                    is_multicast_ether_addr(hdr->addr1))) {
1003                 /* not fragmented */
1004                 goto out;
1005         }
1006         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1007
1008         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1009
1010         if (frag == 0) {
1011                 /* This is the first fragment of a new frame. */
1012                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1013                                                  rx->queue, &(rx->skb));
1014                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
1015                     ieee80211_has_protected(fc)) {
1016                         /* Store CCMP PN so that we can verify that the next
1017                          * fragment has a sequential PN value. */
1018                         entry->ccmp = 1;
1019                         memcpy(entry->last_pn,
1020                                rx->key->u.ccmp.rx_pn[rx->queue],
1021                                CCMP_PN_LEN);
1022                 }
1023                 return RX_QUEUED;
1024         }
1025
1026         /* This is a fragment for a frame that should already be pending in
1027          * fragment cache. Add this fragment to the end of the pending entry.
1028          */
1029         entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
1030         if (!entry) {
1031                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1032                 return RX_DROP_MONITOR;
1033         }
1034
1035         /* Verify that MPDUs within one MSDU have sequential PN values.
1036          * (IEEE 802.11i, 8.3.3.4.5) */
1037         if (entry->ccmp) {
1038                 int i;
1039                 u8 pn[CCMP_PN_LEN], *rpn;
1040                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
1041                         return RX_DROP_UNUSABLE;
1042                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1043                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1044                         pn[i]++;
1045                         if (pn[i])
1046                                 break;
1047                 }
1048                 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
1049                 if (memcmp(pn, rpn, CCMP_PN_LEN))
1050                         return RX_DROP_UNUSABLE;
1051                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1052         }
1053
1054         skb_pull(rx->skb, ieee80211_hdrlen(fc));
1055         __skb_queue_tail(&entry->skb_list, rx->skb);
1056         entry->last_frag = frag;
1057         entry->extra_len += rx->skb->len;
1058         if (ieee80211_has_morefrags(fc)) {
1059                 rx->skb = NULL;
1060                 return RX_QUEUED;
1061         }
1062
1063         rx->skb = __skb_dequeue(&entry->skb_list);
1064         if (skb_tailroom(rx->skb) < entry->extra_len) {
1065                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1066                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1067                                               GFP_ATOMIC))) {
1068                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1069                         __skb_queue_purge(&entry->skb_list);
1070                         return RX_DROP_UNUSABLE;
1071                 }
1072         }
1073         while ((skb = __skb_dequeue(&entry->skb_list))) {
1074                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1075                 dev_kfree_skb(skb);
1076         }
1077
1078         /* Complete frame has been reassembled - process it now */
1079         rx->flags |= IEEE80211_RX_FRAGMENTED;
1080
1081  out:
1082         if (rx->sta)
1083                 rx->sta->rx_packets++;
1084         if (is_multicast_ether_addr(hdr->addr1))
1085                 rx->local->dot11MulticastReceivedFrameCount++;
1086         else
1087                 ieee80211_led_rx(rx->local);
1088         return RX_CONTINUE;
1089 }
1090
1091 static ieee80211_rx_result debug_noinline
1092 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1093 {
1094         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1095         struct sk_buff *skb;
1096         int no_pending_pkts;
1097         __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1098
1099         if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1100                    !(rx->flags & IEEE80211_RX_RA_MATCH)))
1101                 return RX_CONTINUE;
1102
1103         if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1104             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1105                 return RX_DROP_UNUSABLE;
1106
1107         skb = skb_dequeue(&rx->sta->tx_filtered);
1108         if (!skb) {
1109                 skb = skb_dequeue(&rx->sta->ps_tx_buf);
1110                 if (skb)
1111                         rx->local->total_ps_buffered--;
1112         }
1113         no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
1114                 skb_queue_empty(&rx->sta->ps_tx_buf);
1115
1116         if (skb) {
1117                 struct ieee80211_hdr *hdr =
1118                         (struct ieee80211_hdr *) skb->data;
1119
1120                 /*
1121                  * Tell TX path to send one frame even though the STA may
1122                  * still remain is PS mode after this frame exchange.
1123                  */
1124                 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1125
1126 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1127                 printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
1128                        rx->sta->sta.addr, rx->sta->sta.aid,
1129                        skb_queue_len(&rx->sta->ps_tx_buf));
1130 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1131
1132                 /* Use MoreData flag to indicate whether there are more
1133                  * buffered frames for this STA */
1134                 if (no_pending_pkts)
1135                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1136                 else
1137                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1138
1139                 dev_queue_xmit(skb);
1140
1141                 if (no_pending_pkts)
1142                         sta_info_clear_tim_bit(rx->sta);
1143 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1144         } else if (!rx->sent_ps_buffered) {
1145                 /*
1146                  * FIXME: This can be the result of a race condition between
1147                  *        us expiring a frame and the station polling for it.
1148                  *        Should we send it a null-func frame indicating we
1149                  *        have nothing buffered for it?
1150                  */
1151                 printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
1152                        "though there are no buffered frames for it\n",
1153                        rx->dev->name, rx->sta->sta.addr);
1154 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1155         }
1156
1157         /* Free PS Poll skb here instead of returning RX_DROP that would
1158          * count as an dropped frame. */
1159         dev_kfree_skb(rx->skb);
1160
1161         return RX_QUEUED;
1162 }
1163
1164 static ieee80211_rx_result debug_noinline
1165 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1166 {
1167         u8 *data = rx->skb->data;
1168         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1169
1170         if (!ieee80211_is_data_qos(hdr->frame_control))
1171                 return RX_CONTINUE;
1172
1173         /* remove the qos control field, update frame type and meta-data */
1174         memmove(data + IEEE80211_QOS_CTL_LEN, data,
1175                 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1176         hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1177         /* change frame type to non QOS */
1178         hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1179
1180         return RX_CONTINUE;
1181 }
1182
1183 static int
1184 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1185 {
1186         if (unlikely(!rx->sta ||
1187             !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1188                 return -EACCES;
1189
1190         return 0;
1191 }
1192
1193 static int
1194 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1195 {
1196         /*
1197          * Pass through unencrypted frames if the hardware has
1198          * decrypted them already.
1199          */
1200         if (rx->status->flag & RX_FLAG_DECRYPTED)
1201                 return 0;
1202
1203         /* Drop unencrypted frames if key is set. */
1204         if (unlikely(!ieee80211_has_protected(fc) &&
1205                      !ieee80211_is_nullfunc(fc) &&
1206                      (!ieee80211_is_mgmt(fc) ||
1207                       (ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1208                        rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP))) &&
1209                      (rx->key || rx->sdata->drop_unencrypted)))
1210                 return -EACCES;
1211         /* BIP does not use Protected field, so need to check MMIE */
1212         if (unlikely(rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP) &&
1213                      ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1214                      ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
1215                      (rx->key || rx->sdata->drop_unencrypted)))
1216                 return -EACCES;
1217
1218         return 0;
1219 }
1220
1221 static int
1222 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1223 {
1224         struct net_device *dev = rx->dev;
1225         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1226         u16 hdrlen, ethertype;
1227         u8 *payload;
1228         u8 dst[ETH_ALEN];
1229         u8 src[ETH_ALEN] __aligned(2);
1230         struct sk_buff *skb = rx->skb;
1231         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1232
1233         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1234                 return -1;
1235
1236         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1237
1238         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1239          * header
1240          * IEEE 802.11 address fields:
1241          * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1242          *   0     0   DA    SA    BSSID n/a
1243          *   0     1   DA    BSSID SA    n/a
1244          *   1     0   BSSID SA    DA    n/a
1245          *   1     1   RA    TA    DA    SA
1246          */
1247         memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
1248         memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
1249
1250         switch (hdr->frame_control &
1251                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1252         case cpu_to_le16(IEEE80211_FCTL_TODS):
1253                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
1254                              sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1255                         return -1;
1256                 break;
1257         case cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1258                 if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
1259                              sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
1260                         return -1;
1261                 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1262                         struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
1263                                 (skb->data + hdrlen);
1264                         hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
1265                         if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
1266                                 memcpy(dst, meshdr->eaddr1, ETH_ALEN);
1267                                 memcpy(src, meshdr->eaddr2, ETH_ALEN);
1268                         }
1269                 }
1270                 break;
1271         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
1272                 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
1273                     (is_multicast_ether_addr(dst) &&
1274                      !compare_ether_addr(src, dev->dev_addr)))
1275                         return -1;
1276                 break;
1277         case cpu_to_le16(0):
1278                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1279                         return -1;
1280                 break;
1281         }
1282
1283         if (unlikely(skb->len - hdrlen < 8))
1284                 return -1;
1285
1286         payload = skb->data + hdrlen;
1287         ethertype = (payload[6] << 8) | payload[7];
1288
1289         if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1290                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1291                    compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1292                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1293                  * replace EtherType */
1294                 skb_pull(skb, hdrlen + 6);
1295                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1296                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1297         } else {
1298                 struct ethhdr *ehdr;
1299                 __be16 len;
1300
1301                 skb_pull(skb, hdrlen);
1302                 len = htons(skb->len);
1303                 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1304                 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1305                 memcpy(ehdr->h_source, src, ETH_ALEN);
1306                 ehdr->h_proto = len;
1307         }
1308         return 0;
1309 }
1310
1311 /*
1312  * requires that rx->skb is a frame with ethernet header
1313  */
1314 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1315 {
1316         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1317                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1318         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1319
1320         /*
1321          * Allow EAPOL frames to us/the PAE group address regardless
1322          * of whether the frame was encrypted or not.
1323          */
1324         if (ehdr->h_proto == htons(ETH_P_PAE) &&
1325             (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1326              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1327                 return true;
1328
1329         if (ieee80211_802_1x_port_control(rx) ||
1330             ieee80211_drop_unencrypted(rx, fc))
1331                 return false;
1332
1333         return true;
1334 }
1335
1336 /*
1337  * requires that rx->skb is a frame with ethernet header
1338  */
1339 static void
1340 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1341 {
1342         struct net_device *dev = rx->dev;
1343         struct ieee80211_local *local = rx->local;
1344         struct sk_buff *skb, *xmit_skb;
1345         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1346         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1347         struct sta_info *dsta;
1348
1349         skb = rx->skb;
1350         xmit_skb = NULL;
1351
1352         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1353              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1354             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1355             (rx->flags & IEEE80211_RX_RA_MATCH)) {
1356                 if (is_multicast_ether_addr(ehdr->h_dest)) {
1357                         /*
1358                          * send multicast frames both to higher layers in
1359                          * local net stack and back to the wireless medium
1360                          */
1361                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
1362                         if (!xmit_skb && net_ratelimit())
1363                                 printk(KERN_DEBUG "%s: failed to clone "
1364                                        "multicast frame\n", dev->name);
1365                 } else {
1366                         dsta = sta_info_get(local, skb->data);
1367                         if (dsta && dsta->sdata->dev == dev) {
1368                                 /*
1369                                  * The destination station is associated to
1370                                  * this AP (in this VLAN), so send the frame
1371                                  * directly to it and do not pass it to local
1372                                  * net stack.
1373                                  */
1374                                 xmit_skb = skb;
1375                                 skb = NULL;
1376                         }
1377                 }
1378         }
1379
1380         if (skb) {
1381                 int align __maybe_unused;
1382
1383 #if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
1384                 /*
1385                  * 'align' will only take the values 0 or 2 here
1386                  * since all frames are required to be aligned
1387                  * to 2-byte boundaries when being passed to
1388                  * mac80211. That also explains the __skb_push()
1389                  * below.
1390                  */
1391                 align = (unsigned long)skb->data & 4;
1392                 if (align) {
1393                         if (WARN_ON(skb_headroom(skb) < 3)) {
1394                                 dev_kfree_skb(skb);
1395                                 skb = NULL;
1396                         } else {
1397                                 u8 *data = skb->data;
1398                                 size_t len = skb->len;
1399                                 u8 *new = __skb_push(skb, align);
1400                                 memmove(new, data, len);
1401                                 __skb_trim(skb, len);
1402                         }
1403                 }
1404 #endif
1405
1406                 if (skb) {
1407                         /* deliver to local stack */
1408                         skb->protocol = eth_type_trans(skb, dev);
1409                         memset(skb->cb, 0, sizeof(skb->cb));
1410                         netif_rx(skb);
1411                 }
1412         }
1413
1414         if (xmit_skb) {
1415                 /* send to wireless media */
1416                 xmit_skb->protocol = htons(ETH_P_802_3);
1417                 skb_reset_network_header(xmit_skb);
1418                 skb_reset_mac_header(xmit_skb);
1419                 dev_queue_xmit(xmit_skb);
1420         }
1421 }
1422
1423 static ieee80211_rx_result debug_noinline
1424 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1425 {
1426         struct net_device *dev = rx->dev;
1427         struct ieee80211_local *local = rx->local;
1428         u16 ethertype;
1429         u8 *payload;
1430         struct sk_buff *skb = rx->skb, *frame = NULL;
1431         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1432         __le16 fc = hdr->frame_control;
1433         const struct ethhdr *eth;
1434         int remaining, err;
1435         u8 dst[ETH_ALEN];
1436         u8 src[ETH_ALEN];
1437
1438         if (unlikely(!ieee80211_is_data(fc)))
1439                 return RX_CONTINUE;
1440
1441         if (unlikely(!ieee80211_is_data_present(fc)))
1442                 return RX_DROP_MONITOR;
1443
1444         if (!(rx->flags & IEEE80211_RX_AMSDU))
1445                 return RX_CONTINUE;
1446
1447         err = ieee80211_data_to_8023(rx);
1448         if (unlikely(err))
1449                 return RX_DROP_UNUSABLE;
1450
1451         skb->dev = dev;
1452
1453         dev->stats.rx_packets++;
1454         dev->stats.rx_bytes += skb->len;
1455
1456         /* skip the wrapping header */
1457         eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1458         if (!eth)
1459                 return RX_DROP_UNUSABLE;
1460
1461         while (skb != frame) {
1462                 u8 padding;
1463                 __be16 len = eth->h_proto;
1464                 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1465
1466                 remaining = skb->len;
1467                 memcpy(dst, eth->h_dest, ETH_ALEN);
1468                 memcpy(src, eth->h_source, ETH_ALEN);
1469
1470                 padding = ((4 - subframe_len) & 0x3);
1471                 /* the last MSDU has no padding */
1472                 if (subframe_len > remaining)
1473                         return RX_DROP_UNUSABLE;
1474
1475                 skb_pull(skb, sizeof(struct ethhdr));
1476                 /* if last subframe reuse skb */
1477                 if (remaining <= subframe_len + padding)
1478                         frame = skb;
1479                 else {
1480                         /*
1481                          * Allocate and reserve two bytes more for payload
1482                          * alignment since sizeof(struct ethhdr) is 14.
1483                          */
1484                         frame = dev_alloc_skb(
1485                                 ALIGN(local->hw.extra_tx_headroom, 4) +
1486                                 subframe_len + 2);
1487
1488                         if (frame == NULL)
1489                                 return RX_DROP_UNUSABLE;
1490
1491                         skb_reserve(frame,
1492                                     ALIGN(local->hw.extra_tx_headroom, 4) +
1493                                     sizeof(struct ethhdr) + 2);
1494                         memcpy(skb_put(frame, ntohs(len)), skb->data,
1495                                 ntohs(len));
1496
1497                         eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1498                                                         padding);
1499                         if (!eth) {
1500                                 dev_kfree_skb(frame);
1501                                 return RX_DROP_UNUSABLE;
1502                         }
1503                 }
1504
1505                 skb_reset_network_header(frame);
1506                 frame->dev = dev;
1507                 frame->priority = skb->priority;
1508                 rx->skb = frame;
1509
1510                 payload = frame->data;
1511                 ethertype = (payload[6] << 8) | payload[7];
1512
1513                 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1514                             ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1515                            compare_ether_addr(payload,
1516                                               bridge_tunnel_header) == 0)) {
1517                         /* remove RFC1042 or Bridge-Tunnel
1518                          * encapsulation and replace EtherType */
1519                         skb_pull(frame, 6);
1520                         memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1521                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1522                 } else {
1523                         memcpy(skb_push(frame, sizeof(__be16)),
1524                                &len, sizeof(__be16));
1525                         memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1526                         memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1527                 }
1528
1529                 if (!ieee80211_frame_allowed(rx, fc)) {
1530                         if (skb == frame) /* last frame */
1531                                 return RX_DROP_UNUSABLE;
1532                         dev_kfree_skb(frame);
1533                         continue;
1534                 }
1535
1536                 ieee80211_deliver_skb(rx);
1537         }
1538
1539         return RX_QUEUED;
1540 }
1541
1542 #ifdef CONFIG_MAC80211_MESH
1543 static ieee80211_rx_result
1544 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1545 {
1546         struct ieee80211_hdr *hdr;
1547         struct ieee80211s_hdr *mesh_hdr;
1548         unsigned int hdrlen;
1549         struct sk_buff *skb = rx->skb, *fwd_skb;
1550
1551         hdr = (struct ieee80211_hdr *) skb->data;
1552         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1553         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1554
1555         if (!ieee80211_is_data(hdr->frame_control))
1556                 return RX_CONTINUE;
1557
1558         if (!mesh_hdr->ttl)
1559                 /* illegal frame */
1560                 return RX_DROP_MONITOR;
1561
1562         if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
1563                 struct ieee80211_sub_if_data *sdata;
1564                 struct mesh_path *mppath;
1565
1566                 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1567                 rcu_read_lock();
1568                 mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
1569                 if (!mppath) {
1570                         mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
1571                 } else {
1572                         spin_lock_bh(&mppath->state_lock);
1573                         mppath->exp_time = jiffies;
1574                         if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
1575                                 memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
1576                         spin_unlock_bh(&mppath->state_lock);
1577                 }
1578                 rcu_read_unlock();
1579         }
1580
1581         if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
1582                 return RX_CONTINUE;
1583
1584         mesh_hdr->ttl--;
1585
1586         if (rx->flags & IEEE80211_RX_RA_MATCH) {
1587                 if (!mesh_hdr->ttl)
1588                         IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1589                                                      dropped_frames_ttl);
1590                 else {
1591                         struct ieee80211_hdr *fwd_hdr;
1592                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
1593
1594                         if (!fwd_skb && net_ratelimit())
1595                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1596                                                    rx->dev->name);
1597
1598                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
1599                         /*
1600                          * Save TA to addr1 to send TA a path error if a
1601                          * suitable next hop is not found
1602                          */
1603                         memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
1604                         memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
1605                         fwd_skb->dev = rx->local->mdev;
1606                         fwd_skb->iif = rx->dev->ifindex;
1607                         dev_queue_xmit(fwd_skb);
1608                 }
1609         }
1610
1611         if (is_multicast_ether_addr(hdr->addr3) ||
1612             rx->dev->flags & IFF_PROMISC)
1613                 return RX_CONTINUE;
1614         else
1615                 return RX_DROP_MONITOR;
1616 }
1617 #endif
1618
1619 static ieee80211_rx_result debug_noinline
1620 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1621 {
1622         struct net_device *dev = rx->dev;
1623         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1624         __le16 fc = hdr->frame_control;
1625         int err;
1626
1627         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1628                 return RX_CONTINUE;
1629
1630         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1631                 return RX_DROP_MONITOR;
1632
1633         err = ieee80211_data_to_8023(rx);
1634         if (unlikely(err))
1635                 return RX_DROP_UNUSABLE;
1636
1637         if (!ieee80211_frame_allowed(rx, fc))
1638                 return RX_DROP_MONITOR;
1639
1640         rx->skb->dev = dev;
1641
1642         dev->stats.rx_packets++;
1643         dev->stats.rx_bytes += rx->skb->len;
1644
1645         ieee80211_deliver_skb(rx);
1646
1647         return RX_QUEUED;
1648 }
1649
1650 static ieee80211_rx_result debug_noinline
1651 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1652 {
1653         struct ieee80211_local *local = rx->local;
1654         struct ieee80211_hw *hw = &local->hw;
1655         struct sk_buff *skb = rx->skb;
1656         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1657         struct tid_ampdu_rx *tid_agg_rx;
1658         u16 start_seq_num;
1659         u16 tid;
1660
1661         if (likely(!ieee80211_is_ctl(bar->frame_control)))
1662                 return RX_CONTINUE;
1663
1664         if (ieee80211_is_back_req(bar->frame_control)) {
1665                 if (!rx->sta)
1666                         return RX_CONTINUE;
1667                 tid = le16_to_cpu(bar->control) >> 12;
1668                 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1669                                         != HT_AGG_STATE_OPERATIONAL)
1670                         return RX_CONTINUE;
1671                 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1672
1673                 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1674
1675                 /* reset session timer */
1676                 if (tid_agg_rx->timeout)
1677                         mod_timer(&tid_agg_rx->session_timer,
1678                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
1679
1680                 /* manage reordering buffer according to requested */
1681                 /* sequence number */
1682                 rcu_read_lock();
1683                 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1684                                                  start_seq_num, 1);
1685                 rcu_read_unlock();
1686                 return RX_DROP_UNUSABLE;
1687         }
1688
1689         return RX_CONTINUE;
1690 }
1691
1692 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1693                                            struct ieee80211_mgmt *mgmt,
1694                                            size_t len)
1695 {
1696         struct ieee80211_local *local = sdata->local;
1697         struct sk_buff *skb;
1698         struct ieee80211_mgmt *resp;
1699
1700         if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
1701                 /* Not to own unicast address */
1702                 return;
1703         }
1704
1705         if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
1706             compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
1707                 /* Not from the current AP. */
1708                 return;
1709         }
1710
1711         if (sdata->u.mgd.state == IEEE80211_STA_MLME_ASSOCIATE) {
1712                 /* Association in progress; ignore SA Query */
1713                 return;
1714         }
1715
1716         if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
1717                 /* Too short SA Query request frame */
1718                 return;
1719         }
1720
1721         skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
1722         if (skb == NULL)
1723                 return;
1724
1725         skb_reserve(skb, local->hw.extra_tx_headroom);
1726         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
1727         memset(resp, 0, 24);
1728         memcpy(resp->da, mgmt->sa, ETH_ALEN);
1729         memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
1730         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
1731         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
1732                                           IEEE80211_STYPE_ACTION);
1733         skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
1734         resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
1735         resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
1736         memcpy(resp->u.action.u.sa_query.trans_id,
1737                mgmt->u.action.u.sa_query.trans_id,
1738                WLAN_SA_QUERY_TR_ID_LEN);
1739
1740         ieee80211_tx_skb(sdata, skb, 1);
1741 }
1742
1743 static ieee80211_rx_result debug_noinline
1744 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1745 {
1746         struct ieee80211_local *local = rx->local;
1747         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1748         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1749         struct ieee80211_bss *bss;
1750         int len = rx->skb->len;
1751
1752         if (!ieee80211_is_action(mgmt->frame_control))
1753                 return RX_CONTINUE;
1754
1755         if (!rx->sta)
1756                 return RX_DROP_MONITOR;
1757
1758         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1759                 return RX_DROP_MONITOR;
1760
1761         if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
1762                 return RX_DROP_MONITOR;
1763
1764         /* all categories we currently handle have action_code */
1765         if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1766                 return RX_DROP_MONITOR;
1767
1768         switch (mgmt->u.action.category) {
1769         case WLAN_CATEGORY_BACK:
1770                 /*
1771                  * The aggregation code is not prepared to handle
1772                  * anything but STA/AP due to the BSSID handling;
1773                  * IBSS could work in the code but isn't supported
1774                  * by drivers or the standard.
1775                  */
1776                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1777                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
1778                     sdata->vif.type != NL80211_IFTYPE_AP)
1779                         return RX_DROP_MONITOR;
1780
1781                 switch (mgmt->u.action.u.addba_req.action_code) {
1782                 case WLAN_ACTION_ADDBA_REQ:
1783                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1784                                    sizeof(mgmt->u.action.u.addba_req)))
1785                                 return RX_DROP_MONITOR;
1786                         ieee80211_process_addba_request(local, rx->sta, mgmt, len);
1787                         break;
1788                 case WLAN_ACTION_ADDBA_RESP:
1789                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1790                                    sizeof(mgmt->u.action.u.addba_resp)))
1791                                 return RX_DROP_MONITOR;
1792                         ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
1793                         break;
1794                 case WLAN_ACTION_DELBA:
1795                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1796                                    sizeof(mgmt->u.action.u.delba)))
1797                                 return RX_DROP_MONITOR;
1798                         ieee80211_process_delba(sdata, rx->sta, mgmt, len);
1799                         break;
1800                 }
1801                 break;
1802         case WLAN_CATEGORY_SPECTRUM_MGMT:
1803                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
1804                         return RX_DROP_MONITOR;
1805
1806                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
1807                         return RX_DROP_MONITOR;
1808
1809                 switch (mgmt->u.action.u.measurement.action_code) {
1810                 case WLAN_ACTION_SPCT_MSR_REQ:
1811                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1812                                    sizeof(mgmt->u.action.u.measurement)))
1813                                 return RX_DROP_MONITOR;
1814                         ieee80211_process_measurement_req(sdata, mgmt, len);
1815                         break;
1816                 case WLAN_ACTION_SPCT_CHL_SWITCH:
1817                         if (len < (IEEE80211_MIN_ACTION_SIZE +
1818                                    sizeof(mgmt->u.action.u.chan_switch)))
1819                                 return RX_DROP_MONITOR;
1820
1821                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
1822                                 return RX_DROP_MONITOR;
1823
1824                         bss = ieee80211_rx_bss_get(local, sdata->u.mgd.bssid,
1825                                            local->hw.conf.channel->center_freq,
1826                                            sdata->u.mgd.ssid,
1827                                            sdata->u.mgd.ssid_len);
1828                         if (!bss)
1829                                 return RX_DROP_MONITOR;
1830
1831                         ieee80211_process_chanswitch(sdata,
1832                                      &mgmt->u.action.u.chan_switch.sw_elem, bss);
1833                         ieee80211_rx_bss_put(local, bss);
1834                         break;
1835                 }
1836                 break;
1837         case WLAN_CATEGORY_SA_QUERY:
1838                 if (len < (IEEE80211_MIN_ACTION_SIZE +
1839                            sizeof(mgmt->u.action.u.sa_query)))
1840                         return RX_DROP_MONITOR;
1841                 switch (mgmt->u.action.u.sa_query.action) {
1842                 case WLAN_ACTION_SA_QUERY_REQUEST:
1843                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
1844                                 return RX_DROP_MONITOR;
1845                         ieee80211_process_sa_query_req(sdata, mgmt, len);
1846                         break;
1847                 case WLAN_ACTION_SA_QUERY_RESPONSE:
1848                         /*
1849                          * SA Query response is currently only used in AP mode
1850                          * and it is processed in user space.
1851                          */
1852                         return RX_CONTINUE;
1853                 }
1854                 break;
1855         default:
1856                 return RX_CONTINUE;
1857         }
1858
1859         rx->sta->rx_packets++;
1860         dev_kfree_skb(rx->skb);
1861         return RX_QUEUED;
1862 }
1863
1864 static ieee80211_rx_result debug_noinline
1865 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1866 {
1867         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1868         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1869
1870         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1871                 return RX_DROP_MONITOR;
1872
1873         if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
1874                 return RX_DROP_MONITOR;
1875
1876         if (ieee80211_vif_is_mesh(&sdata->vif))
1877                 return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
1878
1879         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1880             sdata->vif.type != NL80211_IFTYPE_ADHOC)
1881                 return RX_DROP_MONITOR;
1882
1883
1884         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1885                 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
1886                         return RX_DROP_MONITOR;
1887                 return ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
1888         }
1889
1890         return ieee80211_ibss_rx_mgmt(sdata, rx->skb, rx->status);
1891 }
1892
1893 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1894                                             struct ieee80211_hdr *hdr,
1895                                             struct ieee80211_rx_data *rx)
1896 {
1897         int keyidx;
1898         unsigned int hdrlen;
1899
1900         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1901         if (rx->skb->len >= hdrlen + 4)
1902                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1903         else
1904                 keyidx = -1;
1905
1906         if (!rx->sta) {
1907                 /*
1908                  * Some hardware seem to generate incorrect Michael MIC
1909                  * reports; ignore them to avoid triggering countermeasures.
1910                  */
1911                 goto ignore;
1912         }
1913
1914         if (!ieee80211_has_protected(hdr->frame_control))
1915                 goto ignore;
1916
1917         if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
1918                 /*
1919                  * APs with pairwise keys should never receive Michael MIC
1920                  * errors for non-zero keyidx because these are reserved for
1921                  * group keys and only the AP is sending real multicast
1922                  * frames in the BSS.
1923                  */
1924                 goto ignore;
1925         }
1926
1927         if (!ieee80211_is_data(hdr->frame_control) &&
1928             !ieee80211_is_auth(hdr->frame_control))
1929                 goto ignore;
1930
1931         mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
1932  ignore:
1933         dev_kfree_skb(rx->skb);
1934         rx->skb = NULL;
1935 }
1936
1937 /* TODO: use IEEE80211_RX_FRAGMENTED */
1938 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1939 {
1940         struct ieee80211_sub_if_data *sdata;
1941         struct ieee80211_local *local = rx->local;
1942         struct ieee80211_rtap_hdr {
1943                 struct ieee80211_radiotap_header hdr;
1944                 u8 flags;
1945                 u8 rate;
1946                 __le16 chan_freq;
1947                 __le16 chan_flags;
1948         } __attribute__ ((packed)) *rthdr;
1949         struct sk_buff *skb = rx->skb, *skb2;
1950         struct net_device *prev_dev = NULL;
1951         struct ieee80211_rx_status *status = rx->status;
1952
1953         if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1954                 goto out_free_skb;
1955
1956         if (skb_headroom(skb) < sizeof(*rthdr) &&
1957             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1958                 goto out_free_skb;
1959
1960         rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1961         memset(rthdr, 0, sizeof(*rthdr));
1962         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1963         rthdr->hdr.it_present =
1964                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1965                             (1 << IEEE80211_RADIOTAP_RATE) |
1966                             (1 << IEEE80211_RADIOTAP_CHANNEL));
1967
1968         rthdr->rate = rx->rate->bitrate / 5;
1969         rthdr->chan_freq = cpu_to_le16(status->freq);
1970
1971         if (status->band == IEEE80211_BAND_5GHZ)
1972                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1973                                                 IEEE80211_CHAN_5GHZ);
1974         else
1975                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1976                                                 IEEE80211_CHAN_2GHZ);
1977
1978         skb_set_mac_header(skb, 0);
1979         skb->ip_summed = CHECKSUM_UNNECESSARY;
1980         skb->pkt_type = PACKET_OTHERHOST;
1981         skb->protocol = htons(ETH_P_802_2);
1982
1983         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1984                 if (!netif_running(sdata->dev))
1985                         continue;
1986
1987                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
1988                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1989                         continue;
1990
1991                 if (prev_dev) {
1992                         skb2 = skb_clone(skb, GFP_ATOMIC);
1993                         if (skb2) {
1994                                 skb2->dev = prev_dev;
1995                                 netif_rx(skb2);
1996                         }
1997                 }
1998
1999                 prev_dev = sdata->dev;
2000                 sdata->dev->stats.rx_packets++;
2001                 sdata->dev->stats.rx_bytes += skb->len;
2002         }
2003
2004         if (prev_dev) {
2005                 skb->dev = prev_dev;
2006                 netif_rx(skb);
2007                 skb = NULL;
2008         } else
2009                 goto out_free_skb;
2010
2011         rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
2012         return;
2013
2014  out_free_skb:
2015         dev_kfree_skb(skb);
2016 }
2017
2018
2019 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
2020                                          struct ieee80211_rx_data *rx,
2021                                          struct sk_buff *skb)
2022 {
2023         ieee80211_rx_result res = RX_DROP_MONITOR;
2024
2025         rx->skb = skb;
2026         rx->sdata = sdata;
2027         rx->dev = sdata->dev;
2028
2029 #define CALL_RXH(rxh)                   \
2030         do {                            \
2031                 res = rxh(rx);          \
2032                 if (res != RX_CONTINUE) \
2033                         goto rxh_done;  \
2034         } while (0);
2035
2036         CALL_RXH(ieee80211_rx_h_passive_scan)
2037         CALL_RXH(ieee80211_rx_h_check)
2038         CALL_RXH(ieee80211_rx_h_decrypt)
2039         CALL_RXH(ieee80211_rx_h_check_more_data)
2040         CALL_RXH(ieee80211_rx_h_sta_process)
2041         CALL_RXH(ieee80211_rx_h_defragment)
2042         CALL_RXH(ieee80211_rx_h_ps_poll)
2043         CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2044         /* must be after MMIC verify so header is counted in MPDU mic */
2045         CALL_RXH(ieee80211_rx_h_remove_qos_control)
2046         CALL_RXH(ieee80211_rx_h_amsdu)
2047 #ifdef CONFIG_MAC80211_MESH
2048         if (ieee80211_vif_is_mesh(&sdata->vif))
2049                 CALL_RXH(ieee80211_rx_h_mesh_fwding);
2050 #endif
2051         CALL_RXH(ieee80211_rx_h_data)
2052         CALL_RXH(ieee80211_rx_h_ctrl)
2053         CALL_RXH(ieee80211_rx_h_action)
2054         CALL_RXH(ieee80211_rx_h_mgmt)
2055
2056 #undef CALL_RXH
2057
2058  rxh_done:
2059         switch (res) {
2060         case RX_DROP_MONITOR:
2061                 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
2062                 if (rx->sta)
2063                         rx->sta->rx_dropped++;
2064                 /* fall through */
2065         case RX_CONTINUE:
2066                 ieee80211_rx_cooked_monitor(rx);
2067                 break;
2068         case RX_DROP_UNUSABLE:
2069                 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
2070                 if (rx->sta)
2071                         rx->sta->rx_dropped++;
2072                 dev_kfree_skb(rx->skb);
2073                 break;
2074         case RX_QUEUED:
2075                 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
2076                 break;
2077         }
2078 }
2079
2080 /* main receive path */
2081
2082 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2083                                 struct ieee80211_rx_data *rx,
2084                                 struct ieee80211_hdr *hdr)
2085 {
2086         u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, sdata->vif.type);
2087         int multicast = is_multicast_ether_addr(hdr->addr1);
2088
2089         switch (sdata->vif.type) {
2090         case NL80211_IFTYPE_STATION:
2091                 if (!bssid)
2092                         return 0;
2093                 if (!ieee80211_bssid_match(bssid, sdata->u.mgd.bssid)) {
2094                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
2095                                 return 0;
2096                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
2097                 } else if (!multicast &&
2098                            compare_ether_addr(sdata->dev->dev_addr,
2099                                               hdr->addr1) != 0) {
2100                         if (!(sdata->dev->flags & IFF_PROMISC))
2101                                 return 0;
2102                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
2103                 }
2104                 break;
2105         case NL80211_IFTYPE_ADHOC:
2106                 if (!bssid)
2107                         return 0;
2108                 if (ieee80211_is_beacon(hdr->frame_control)) {
2109                         return 1;
2110                 }
2111                 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2112                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
2113                                 return 0;
2114                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
2115                 } else if (!multicast &&
2116                            compare_ether_addr(sdata->dev->dev_addr,
2117                                               hdr->addr1) != 0) {
2118                         if (!(sdata->dev->flags & IFF_PROMISC))
2119                                 return 0;
2120                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
2121                 } else if (!rx->sta) {
2122                         int rate_idx;
2123                         if (rx->status->flag & RX_FLAG_HT)
2124                                 rate_idx = 0; /* TODO: HT rates */
2125                         else
2126                                 rate_idx = rx->status->rate_idx;
2127                         rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
2128                                 BIT(rate_idx));
2129                 }
2130                 break;
2131         case NL80211_IFTYPE_MESH_POINT:
2132                 if (!multicast &&
2133                     compare_ether_addr(sdata->dev->dev_addr,
2134                                        hdr->addr1) != 0) {
2135                         if (!(sdata->dev->flags & IFF_PROMISC))
2136                                 return 0;
2137
2138                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
2139                 }
2140                 break;
2141         case NL80211_IFTYPE_AP_VLAN:
2142         case NL80211_IFTYPE_AP:
2143                 if (!bssid) {
2144                         if (compare_ether_addr(sdata->dev->dev_addr,
2145                                                hdr->addr1))
2146                                 return 0;
2147                 } else if (!ieee80211_bssid_match(bssid,
2148                                         sdata->dev->dev_addr)) {
2149                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
2150                                 return 0;
2151                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
2152                 }
2153                 break;
2154         case NL80211_IFTYPE_WDS:
2155                 if (bssid || !ieee80211_is_data(hdr->frame_control))
2156                         return 0;
2157                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2158                         return 0;
2159                 break;
2160         case NL80211_IFTYPE_MONITOR:
2161                 /* take everything */
2162                 break;
2163         case NL80211_IFTYPE_UNSPECIFIED:
2164         case __NL80211_IFTYPE_AFTER_LAST:
2165                 /* should never get here */
2166                 WARN_ON(1);
2167                 break;
2168         }
2169
2170         return 1;
2171 }
2172
2173 /*
2174  * This is the actual Rx frames handler. as it blongs to Rx path it must
2175  * be called with rcu_read_lock protection.
2176  */
2177 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2178                                          struct sk_buff *skb,
2179                                          struct ieee80211_rx_status *status,
2180                                          struct ieee80211_rate *rate)
2181 {
2182         struct ieee80211_local *local = hw_to_local(hw);
2183         struct ieee80211_sub_if_data *sdata;
2184         struct ieee80211_hdr *hdr;
2185         struct ieee80211_rx_data rx;
2186         int prepares;
2187         struct ieee80211_sub_if_data *prev = NULL;
2188         struct sk_buff *skb_new;
2189
2190         hdr = (struct ieee80211_hdr *)skb->data;
2191         memset(&rx, 0, sizeof(rx));
2192         rx.skb = skb;
2193         rx.local = local;
2194
2195         rx.status = status;
2196         rx.rate = rate;
2197
2198         if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
2199                 local->dot11ReceivedFragmentCount++;
2200
2201         rx.sta = sta_info_get(local, hdr->addr2);
2202         if (rx.sta) {
2203                 rx.sdata = rx.sta->sdata;
2204                 rx.dev = rx.sta->sdata->dev;
2205         }
2206
2207         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
2208                 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
2209                 return;
2210         }
2211
2212         if (unlikely(local->sw_scanning || local->hw_scanning))
2213                 rx.flags |= IEEE80211_RX_IN_SCAN;
2214
2215         ieee80211_parse_qos(&rx);
2216         ieee80211_verify_alignment(&rx);
2217
2218         skb = rx.skb;
2219
2220         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2221                 if (!netif_running(sdata->dev))
2222                         continue;
2223
2224                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
2225                         continue;
2226
2227                 rx.flags |= IEEE80211_RX_RA_MATCH;
2228                 prepares = prepare_for_handlers(sdata, &rx, hdr);
2229
2230                 if (!prepares)
2231                         continue;
2232
2233                 /*
2234                  * frame is destined for this interface, but if it's not
2235                  * also for the previous one we handle that after the
2236                  * loop to avoid copying the SKB once too much
2237                  */
2238
2239                 if (!prev) {
2240                         prev = sdata;
2241                         continue;
2242                 }
2243
2244                 /*
2245                  * frame was destined for the previous interface
2246                  * so invoke RX handlers for it
2247                  */
2248
2249                 skb_new = skb_copy(skb, GFP_ATOMIC);
2250                 if (!skb_new) {
2251                         if (net_ratelimit())
2252                                 printk(KERN_DEBUG "%s: failed to copy "
2253                                        "multicast frame for %s\n",
2254                                        wiphy_name(local->hw.wiphy),
2255                                        prev->dev->name);
2256                         continue;
2257                 }
2258                 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
2259                 prev = sdata;
2260         }
2261         if (prev)
2262                 ieee80211_invoke_rx_handlers(prev, &rx, skb);
2263         else
2264                 dev_kfree_skb(skb);
2265 }
2266
2267 #define SEQ_MODULO 0x1000
2268 #define SEQ_MASK   0xfff
2269
2270 static inline int seq_less(u16 sq1, u16 sq2)
2271 {
2272         return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
2273 }
2274
2275 static inline u16 seq_inc(u16 sq)
2276 {
2277         return (sq + 1) & SEQ_MASK;
2278 }
2279
2280 static inline u16 seq_sub(u16 sq1, u16 sq2)
2281 {
2282         return (sq1 - sq2) & SEQ_MASK;
2283 }
2284
2285
2286 /*
2287  * As it function blongs to Rx path it must be called with
2288  * the proper rcu_read_lock protection for its flow.
2289  */
2290 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2291                                            struct tid_ampdu_rx *tid_agg_rx,
2292                                            struct sk_buff *skb,
2293                                            u16 mpdu_seq_num,
2294                                            int bar_req)
2295 {
2296         struct ieee80211_local *local = hw_to_local(hw);
2297         struct ieee80211_rx_status status;
2298         u16 head_seq_num, buf_size;
2299         int index;
2300         struct ieee80211_supported_band *sband;
2301         struct ieee80211_rate *rate;
2302
2303         buf_size = tid_agg_rx->buf_size;
2304         head_seq_num = tid_agg_rx->head_seq_num;
2305
2306         /* frame with out of date sequence number */
2307         if (seq_less(mpdu_seq_num, head_seq_num)) {
2308                 dev_kfree_skb(skb);
2309                 return 1;
2310         }
2311
2312         /* if frame sequence number exceeds our buffering window size or
2313          * block Ack Request arrived - release stored frames */
2314         if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2315                 /* new head to the ordering buffer */
2316                 if (bar_req)
2317                         head_seq_num = mpdu_seq_num;
2318                 else
2319                         head_seq_num =
2320                                 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2321                 /* release stored frames up to new head to stack */
2322                 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2323                         index = seq_sub(tid_agg_rx->head_seq_num,
2324                                 tid_agg_rx->ssn)
2325                                 % tid_agg_rx->buf_size;
2326
2327                         if (tid_agg_rx->reorder_buf[index]) {
2328                                 /* release the reordered frames to stack */
2329                                 memcpy(&status,
2330                                         tid_agg_rx->reorder_buf[index]->cb,
2331                                         sizeof(status));
2332                                 sband = local->hw.wiphy->bands[status.band];
2333                                 if (status.flag & RX_FLAG_HT) {
2334                                         /* TODO: HT rates */
2335                                         rate = sband->bitrates;
2336                                 } else {
2337                                         rate = &sband->bitrates
2338                                                 [status.rate_idx];
2339                                 }
2340                                 __ieee80211_rx_handle_packet(hw,
2341                                         tid_agg_rx->reorder_buf[index],
2342                                         &status, rate);
2343                                 tid_agg_rx->stored_mpdu_num--;
2344                                 tid_agg_rx->reorder_buf[index] = NULL;
2345                         }
2346                         tid_agg_rx->head_seq_num =
2347                                 seq_inc(tid_agg_rx->head_seq_num);
2348                 }
2349                 if (bar_req)
2350                         return 1;
2351         }
2352
2353         /* now the new frame is always in the range of the reordering */
2354         /* buffer window */
2355         index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2356                                 % tid_agg_rx->buf_size;
2357         /* check if we already stored this frame */
2358         if (tid_agg_rx->reorder_buf[index]) {
2359                 dev_kfree_skb(skb);
2360                 return 1;
2361         }
2362
2363         /* if arrived mpdu is in the right order and nothing else stored */
2364         /* release it immediately */
2365         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2366                         tid_agg_rx->stored_mpdu_num == 0) {
2367                 tid_agg_rx->head_seq_num =
2368                         seq_inc(tid_agg_rx->head_seq_num);
2369                 return 0;
2370         }
2371
2372         /* put the frame in the reordering buffer */
2373         tid_agg_rx->reorder_buf[index] = skb;
2374         tid_agg_rx->stored_mpdu_num++;
2375         /* release the buffer until next missing frame */
2376         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2377                                                 % tid_agg_rx->buf_size;
2378         while (tid_agg_rx->reorder_buf[index]) {
2379                 /* release the reordered frame back to stack */
2380                 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2381                         sizeof(status));
2382                 sband = local->hw.wiphy->bands[status.band];
2383                 if (status.flag & RX_FLAG_HT)
2384                         rate = sband->bitrates; /* TODO: HT rates */
2385                 else
2386                         rate = &sband->bitrates[status.rate_idx];
2387                 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
2388                                              &status, rate);
2389                 tid_agg_rx->stored_mpdu_num--;
2390                 tid_agg_rx->reorder_buf[index] = NULL;
2391                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2392                 index = seq_sub(tid_agg_rx->head_seq_num,
2393                         tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2394         }
2395         return 1;
2396 }
2397
2398 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2399                                      struct sk_buff *skb)
2400 {
2401         struct ieee80211_hw *hw = &local->hw;
2402         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2403         struct sta_info *sta;
2404         struct tid_ampdu_rx *tid_agg_rx;
2405         u16 sc;
2406         u16 mpdu_seq_num;
2407         u8 ret = 0;
2408         int tid;
2409
2410         sta = sta_info_get(local, hdr->addr2);
2411         if (!sta)
2412                 return ret;
2413
2414         /* filter the QoS data rx stream according to
2415          * STA/TID and check if this STA/TID is on aggregation */
2416         if (!ieee80211_is_data_qos(hdr->frame_control))
2417                 goto end_reorder;
2418
2419         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
2420
2421         if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2422                 goto end_reorder;
2423
2424         tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2425
2426         /* qos null data frames are excluded */
2427         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
2428                 goto end_reorder;
2429
2430         /* new un-ordered ampdu frame - process it */
2431
2432         /* reset session timer */
2433         if (tid_agg_rx->timeout)
2434                 mod_timer(&tid_agg_rx->session_timer,
2435                           TU_TO_EXP_TIME(tid_agg_rx->timeout));
2436
2437         /* if this mpdu is fragmented - terminate rx aggregation session */
2438         sc = le16_to_cpu(hdr->seq_ctrl);
2439         if (sc & IEEE80211_SCTL_FRAG) {
2440                 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
2441                         tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2442                 ret = 1;
2443                 goto end_reorder;
2444         }
2445
2446         /* according to mpdu sequence number deal with reordering buffer */
2447         mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2448         ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2449                                                 mpdu_seq_num, 0);
2450  end_reorder:
2451         return ret;
2452 }
2453
2454 /*
2455  * This is the receive path handler. It is called by a low level driver when an
2456  * 802.11 MPDU is received from the hardware.
2457  */
2458 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2459                     struct ieee80211_rx_status *status)
2460 {
2461         struct ieee80211_local *local = hw_to_local(hw);
2462         struct ieee80211_rate *rate = NULL;
2463         struct ieee80211_supported_band *sband;
2464
2465         if (status->band < 0 ||
2466             status->band >= IEEE80211_NUM_BANDS) {
2467                 WARN_ON(1);
2468                 return;
2469         }
2470
2471         sband = local->hw.wiphy->bands[status->band];
2472         if (!sband) {
2473                 WARN_ON(1);
2474                 return;
2475         }
2476
2477         if (status->flag & RX_FLAG_HT) {
2478                 /* rate_idx is MCS index */
2479                 if (WARN_ON(status->rate_idx < 0 ||
2480                             status->rate_idx >= 76))
2481                         return;
2482                 /* HT rates are not in the table - use the highest legacy rate
2483                  * for now since other parts of mac80211 may not yet be fully
2484                  * MCS aware. */
2485                 rate = &sband->bitrates[sband->n_bitrates - 1];
2486         } else {
2487                 if (WARN_ON(status->rate_idx < 0 ||
2488                             status->rate_idx >= sband->n_bitrates))
2489                         return;
2490                 rate = &sband->bitrates[status->rate_idx];
2491         }
2492
2493         /*
2494          * key references and virtual interfaces are protected using RCU
2495          * and this requires that we are in a read-side RCU section during
2496          * receive processing
2497          */
2498         rcu_read_lock();
2499
2500         /*
2501          * Frames with failed FCS/PLCP checksum are not returned,
2502          * all other frames are returned without radiotap header
2503          * if it was previously present.
2504          * Also, frames with less than 16 bytes are dropped.
2505          */
2506         skb = ieee80211_rx_monitor(local, skb, status, rate);
2507         if (!skb) {
2508                 rcu_read_unlock();
2509                 return;
2510         }
2511
2512         if (!ieee80211_rx_reorder_ampdu(local, skb))
2513                 __ieee80211_rx_handle_packet(hw, skb, status, rate);
2514
2515         rcu_read_unlock();
2516 }
2517 EXPORT_SYMBOL(__ieee80211_rx);
2518
2519 /* This is a version of the rx handler that can be called from hard irq
2520  * context. Post the skb on the queue and schedule the tasklet */
2521 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2522                           struct ieee80211_rx_status *status)
2523 {
2524         struct ieee80211_local *local = hw_to_local(hw);
2525
2526         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2527
2528         skb->dev = local->mdev;
2529         /* copy status into skb->cb for use by tasklet */
2530         memcpy(skb->cb, status, sizeof(*status));
2531         skb->pkt_type = IEEE80211_RX_MSG;
2532         skb_queue_tail(&local->skb_queue, skb);
2533         tasklet_schedule(&local->tasklet);
2534 }
2535 EXPORT_SYMBOL(ieee80211_rx_irqsafe);