[PATCH] mac80211: pass frames to monitor interfaces early
[linux-2.6] / net / mac80211 / rx.c
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2005-2006, Devicescape Software, Inc.
4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
5  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
19
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
22 #include "ieee80211_common.h"
23 #include "wep.h"
24 #include "wpa.h"
25 #include "tkip.h"
26 #include "wme.h"
27
28 /*
29  * monitor mode reception
30  *
31  * This function cleans up the SKB, i.e. it removes all the stuff
32  * only useful for monitoring.
33  */
34 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
35                                            struct sk_buff *skb,
36                                            int rtap_len)
37 {
38         skb_pull(skb, rtap_len);
39
40         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
41                 if (likely(skb->len > FCS_LEN))
42                         skb_trim(skb, skb->len - FCS_LEN);
43                 else {
44                         /* driver bug */
45                         WARN_ON(1);
46                         dev_kfree_skb(skb);
47                         skb = NULL;
48                 }
49         }
50
51         return skb;
52 }
53
54 static inline int should_drop_frame(struct ieee80211_rx_status *status,
55                                     struct sk_buff *skb,
56                                     int present_fcs_len,
57                                     int radiotap_len)
58 {
59         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
60
61         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
62                 return 1;
63         if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
64                 return 1;
65         if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
66                         cpu_to_le16(IEEE80211_FTYPE_CTL))
67                 return 1;
68         return 0;
69 }
70
71 /*
72  * This function copies a received frame to all monitor interfaces and
73  * returns a cleaned-up SKB that no longer includes the FCS nor the
74  * radiotap header the driver might have added.
75  */
76 static struct sk_buff *
77 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
78                      struct ieee80211_rx_status *status)
79 {
80         struct ieee80211_sub_if_data *sdata;
81         struct ieee80211_rate *rate;
82         int needed_headroom = 0;
83         struct ieee80211_rtap_hdr {
84                 struct ieee80211_radiotap_header hdr;
85                 u8 flags;
86                 u8 rate;
87                 __le16 chan_freq;
88                 __le16 chan_flags;
89                 u8 antsignal;
90                 u8 padding_for_rxflags;
91                 __le16 rx_flags;
92         } __attribute__ ((packed)) *rthdr;
93         struct sk_buff *skb, *skb2;
94         struct net_device *prev_dev = NULL;
95         int present_fcs_len = 0;
96         int rtap_len = 0;
97
98         /*
99          * First, we may need to make a copy of the skb because
100          *  (1) we need to modify it for radiotap (if not present), and
101          *  (2) the other RX handlers will modify the skb we got.
102          *
103          * We don't need to, of course, if we aren't going to return
104          * the SKB because it has a bad FCS/PLCP checksum.
105          */
106         if (status->flag & RX_FLAG_RADIOTAP)
107                 rtap_len = ieee80211_get_radiotap_len(origskb->data);
108         else
109                 needed_headroom = sizeof(*rthdr);
110
111         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
112                 present_fcs_len = FCS_LEN;
113
114         if (!local->monitors) {
115                 if (should_drop_frame(status, origskb, present_fcs_len,
116                                       rtap_len)) {
117                         dev_kfree_skb(origskb);
118                         return NULL;
119                 }
120
121                 return remove_monitor_info(local, origskb, rtap_len);
122         }
123
124         if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
125                 /* only need to expand headroom if necessary */
126                 skb = origskb;
127                 origskb = NULL;
128
129                 /*
130                  * This shouldn't trigger often because most devices have an
131                  * RX header they pull before we get here, and that should
132                  * be big enough for our radiotap information. We should
133                  * probably export the length to drivers so that we can have
134                  * them allocate enough headroom to start with.
135                  */
136                 if (skb_headroom(skb) < needed_headroom &&
137                     pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) {
138                         dev_kfree_skb(skb);
139                         return NULL;
140                 }
141         } else {
142                 /*
143                  * Need to make a copy and possibly remove radiotap header
144                  * and FCS from the original.
145                  */
146                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
147
148                 origskb = remove_monitor_info(local, origskb, rtap_len);
149
150                 if (!skb)
151                         return origskb;
152         }
153
154         /* if necessary, prepend radiotap information */
155         if (!(status->flag & RX_FLAG_RADIOTAP)) {
156                 rthdr = (void *) skb_push(skb, sizeof(*rthdr));
157                 memset(rthdr, 0, sizeof(*rthdr));
158                 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
159                 rthdr->hdr.it_present =
160                         cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
161                                     (1 << IEEE80211_RADIOTAP_RATE) |
162                                     (1 << IEEE80211_RADIOTAP_CHANNEL) |
163                                     (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |
164                                     (1 << IEEE80211_RADIOTAP_RX_FLAGS));
165                 rthdr->flags = local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS ?
166                                IEEE80211_RADIOTAP_F_FCS : 0;
167
168                 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
169                 rthdr->rx_flags = 0;
170                 if (status->flag &
171                     (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
172                         rthdr->rx_flags |=
173                                 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
174
175                 rate = ieee80211_get_rate(local, status->phymode,
176                                           status->rate);
177                 if (rate)
178                         rthdr->rate = rate->rate / 5;
179
180                 rthdr->chan_freq = cpu_to_le16(status->freq);
181
182                 if (status->phymode == MODE_IEEE80211A)
183                         rthdr->chan_flags =
184                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
185                                             IEEE80211_CHAN_5GHZ);
186                 else
187                         rthdr->chan_flags =
188                                 cpu_to_le16(IEEE80211_CHAN_DYN |
189                                             IEEE80211_CHAN_2GHZ);
190
191                 rthdr->antsignal = status->ssi;
192         }
193
194         skb_set_mac_header(skb, 0);
195         skb->ip_summed = CHECKSUM_UNNECESSARY;
196         skb->pkt_type = PACKET_OTHERHOST;
197         skb->protocol = htons(ETH_P_802_2);
198
199         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
200                 if (!netif_running(sdata->dev))
201                         continue;
202
203                 if (sdata->type != IEEE80211_IF_TYPE_MNTR)
204                         continue;
205
206                 if (prev_dev) {
207                         skb2 = skb_clone(skb, GFP_ATOMIC);
208                         if (skb2) {
209                                 skb2->dev = prev_dev;
210                                 netif_rx(skb2);
211                         }
212                 }
213
214                 prev_dev = sdata->dev;
215                 sdata->dev->stats.rx_packets++;
216                 sdata->dev->stats.rx_bytes += skb->len;
217         }
218
219         if (prev_dev) {
220                 skb->dev = prev_dev;
221                 netif_rx(skb);
222         } else
223                 dev_kfree_skb(skb);
224
225         return origskb;
226 }
227
228
229 /* pre-rx handlers
230  *
231  * these don't have dev/sdata fields in the rx data
232  * The sta value should also not be used because it may
233  * be NULL even though a STA (in IBSS mode) will be added.
234  */
235
236 static ieee80211_txrx_result
237 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
238 {
239         u8 *data = rx->skb->data;
240         int tid;
241
242         /* does the frame have a qos control field? */
243         if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
244                 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
245                 /* frame has qos control */
246                 tid = qc[0] & QOS_CONTROL_TID_MASK;
247         } else {
248                 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
249                         /* Separate TID for management frames */
250                         tid = NUM_RX_DATA_QUEUES - 1;
251                 } else {
252                         /* no qos control present */
253                         tid = 0; /* 802.1d - Best Effort */
254                 }
255         }
256
257         I802_DEBUG_INC(rx->local->wme_rx_queue[tid]);
258         /* only a debug counter, sta might not be assigned properly yet */
259         if (rx->sta)
260                 I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]);
261
262         rx->u.rx.queue = tid;
263         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
264          * For now, set skb->priority to 0 for other cases. */
265         rx->skb->priority = (tid > 7) ? 0 : tid;
266
267         return TXRX_CONTINUE;
268 }
269
270 static ieee80211_txrx_result
271 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data *rx)
272 {
273         struct ieee80211_local *local = rx->local;
274         struct sk_buff *skb = rx->skb;
275         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
276         u32 load = 0, hdrtime;
277         struct ieee80211_rate *rate;
278         struct ieee80211_hw_mode *mode = local->hw.conf.mode;
279         int i;
280
281         /* Estimate total channel use caused by this frame */
282
283         if (unlikely(mode->num_rates < 0))
284                 return TXRX_CONTINUE;
285
286         rate = &mode->rates[0];
287         for (i = 0; i < mode->num_rates; i++) {
288                 if (mode->rates[i].val == rx->u.rx.status->rate) {
289                         rate = &mode->rates[i];
290                         break;
291                 }
292         }
293
294         /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
295          * 1 usec = 1/8 * (1080 / 10) = 13.5 */
296
297         if (mode->mode == MODE_IEEE80211A ||
298             (mode->mode == MODE_IEEE80211G &&
299              rate->flags & IEEE80211_RATE_ERP))
300                 hdrtime = CHAN_UTIL_HDR_SHORT;
301         else
302                 hdrtime = CHAN_UTIL_HDR_LONG;
303
304         load = hdrtime;
305         if (!is_multicast_ether_addr(hdr->addr1))
306                 load += hdrtime;
307
308         load += skb->len * rate->rate_inv;
309
310         /* Divide channel_use by 8 to avoid wrapping around the counter */
311         load >>= CHAN_UTIL_SHIFT;
312         local->channel_use_raw += load;
313         rx->u.rx.load = load;
314
315         return TXRX_CONTINUE;
316 }
317
318 ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
319 {
320         ieee80211_rx_h_parse_qos,
321         ieee80211_rx_h_load_stats,
322         NULL
323 };
324
325 /* rx handlers */
326
327 static ieee80211_txrx_result
328 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
329 {
330         if (rx->sta)
331                 rx->sta->channel_use_raw += rx->u.rx.load;
332         rx->sdata->channel_use_raw += rx->u.rx.load;
333         return TXRX_CONTINUE;
334 }
335
336 static ieee80211_txrx_result
337 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
338 {
339         struct ieee80211_local *local = rx->local;
340         struct sk_buff *skb = rx->skb;
341
342         if (unlikely(local->sta_scanning != 0)) {
343                 ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status);
344                 return TXRX_QUEUED;
345         }
346
347         if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
348                 /* scanning finished during invoking of handlers */
349                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
350                 return TXRX_DROP;
351         }
352
353         return TXRX_CONTINUE;
354 }
355
356 static ieee80211_txrx_result
357 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
358 {
359         struct ieee80211_hdr *hdr;
360         hdr = (struct ieee80211_hdr *) rx->skb->data;
361
362         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
363         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
364                 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
365                              rx->sta->last_seq_ctrl[rx->u.rx.queue] ==
366                              hdr->seq_ctrl)) {
367                         if (rx->flags & IEEE80211_TXRXD_RXRA_MATCH) {
368                                 rx->local->dot11FrameDuplicateCount++;
369                                 rx->sta->num_duplicates++;
370                         }
371                         return TXRX_DROP;
372                 } else
373                         rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
374         }
375
376         if (unlikely(rx->skb->len < 16)) {
377                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
378                 return TXRX_DROP;
379         }
380
381         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
382                 rx->skb->pkt_type = PACKET_OTHERHOST;
383         else if (compare_ether_addr(rx->dev->dev_addr, hdr->addr1) == 0)
384                 rx->skb->pkt_type = PACKET_HOST;
385         else if (is_multicast_ether_addr(hdr->addr1)) {
386                 if (is_broadcast_ether_addr(hdr->addr1))
387                         rx->skb->pkt_type = PACKET_BROADCAST;
388                 else
389                         rx->skb->pkt_type = PACKET_MULTICAST;
390         } else
391                 rx->skb->pkt_type = PACKET_OTHERHOST;
392
393         /* Drop disallowed frame classes based on STA auth/assoc state;
394          * IEEE 802.11, Chap 5.5.
395          *
396          * 80211.o does filtering only based on association state, i.e., it
397          * drops Class 3 frames from not associated stations. hostapd sends
398          * deauth/disassoc frames when needed. In addition, hostapd is
399          * responsible for filtering on both auth and assoc states.
400          */
401         if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
402                       ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
403                        (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
404                      rx->sdata->type != IEEE80211_IF_TYPE_IBSS &&
405                      (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
406                 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
407                      !(rx->fc & IEEE80211_FCTL_TODS) &&
408                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
409                     || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
410                         /* Drop IBSS frames and frames for other hosts
411                          * silently. */
412                         return TXRX_DROP;
413                 }
414
415                 if (!rx->local->apdev)
416                         return TXRX_DROP;
417
418                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
419                                   ieee80211_msg_sta_not_assoc);
420                 return TXRX_QUEUED;
421         }
422
423         return TXRX_CONTINUE;
424 }
425
426
427 static ieee80211_txrx_result
428 ieee80211_rx_h_load_key(struct ieee80211_txrx_data *rx)
429 {
430         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
431         int keyidx;
432         int hdrlen;
433         struct ieee80211_key *stakey = NULL;
434
435         /*
436          * Key selection 101
437          *
438          * There are three types of keys:
439          *  - GTK (group keys)
440          *  - PTK (pairwise keys)
441          *  - STK (station-to-station pairwise keys)
442          *
443          * When selecting a key, we have to distinguish between multicast
444          * (including broadcast) and unicast frames, the latter can only
445          * use PTKs and STKs while the former always use GTKs. Unless, of
446          * course, actual WEP keys ("pre-RSNA") are used, then unicast
447          * frames can also use key indizes like GTKs. Hence, if we don't
448          * have a PTK/STK we check the key index for a WEP key.
449          *
450          * Note that in a regular BSS, multicast frames are sent by the
451          * AP only, associated stations unicast the frame to the AP first
452          * which then multicasts it on their behalf.
453          *
454          * There is also a slight problem in IBSS mode: GTKs are negotiated
455          * with each station, that is something we don't currently handle.
456          * The spec seems to expect that one negotiates the same key with
457          * every station but there's no such requirement; VLANs could be
458          * possible.
459          */
460
461         if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
462                 return TXRX_CONTINUE;
463
464         /*
465          * No point in finding a key if the frame is neither
466          * addressed to us nor a multicast frame.
467          */
468         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
469                 return TXRX_CONTINUE;
470
471         if (rx->sta)
472                 stakey = rcu_dereference(rx->sta->key);
473
474         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
475                 rx->key = stakey;
476         } else {
477                 /*
478                  * The device doesn't give us the IV so we won't be
479                  * able to look up the key. That's ok though, we
480                  * don't need to decrypt the frame, we just won't
481                  * be able to keep statistics accurate.
482                  * Except for key threshold notifications, should
483                  * we somehow allow the driver to tell us which key
484                  * the hardware used if this flag is set?
485                  */
486                 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
487                     (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
488                         return TXRX_CONTINUE;
489
490                 hdrlen = ieee80211_get_hdrlen(rx->fc);
491
492                 if (rx->skb->len < 8 + hdrlen)
493                         return TXRX_DROP; /* TODO: count this? */
494
495                 /*
496                  * no need to call ieee80211_wep_get_keyidx,
497                  * it verifies a bunch of things we've done already
498                  */
499                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
500
501                 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
502
503                 /*
504                  * RSNA-protected unicast frames should always be sent with
505                  * pairwise or station-to-station keys, but for WEP we allow
506                  * using a key index as well.
507                  */
508                 if (rx->key && rx->key->conf.alg != ALG_WEP &&
509                     !is_multicast_ether_addr(hdr->addr1))
510                         rx->key = NULL;
511         }
512
513         if (rx->key) {
514                 rx->key->tx_rx_count++;
515                 /* TODO: add threshold stuff again */
516         }
517
518         return TXRX_CONTINUE;
519 }
520
521 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
522 {
523         struct ieee80211_sub_if_data *sdata;
524         DECLARE_MAC_BUF(mac);
525
526         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
527
528         if (sdata->bss)
529                 atomic_inc(&sdata->bss->num_sta_ps);
530         sta->flags |= WLAN_STA_PS;
531         sta->pspoll = 0;
532 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
533         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
534                dev->name, print_mac(mac, sta->addr), sta->aid);
535 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
536 }
537
538 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
539 {
540         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
541         struct sk_buff *skb;
542         int sent = 0;
543         struct ieee80211_sub_if_data *sdata;
544         struct ieee80211_tx_packet_data *pkt_data;
545         DECLARE_MAC_BUF(mac);
546
547         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
548         if (sdata->bss)
549                 atomic_dec(&sdata->bss->num_sta_ps);
550         sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
551         sta->pspoll = 0;
552         if (!skb_queue_empty(&sta->ps_tx_buf)) {
553                 if (local->ops->set_tim)
554                         local->ops->set_tim(local_to_hw(local), sta->aid, 0);
555                 if (sdata->bss)
556                         bss_tim_clear(local, sdata->bss, sta->aid);
557         }
558 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
559         printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
560                dev->name, print_mac(mac, sta->addr), sta->aid);
561 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
562         /* Send all buffered frames to the station */
563         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
564                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
565                 sent++;
566                 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
567                 dev_queue_xmit(skb);
568         }
569         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
570                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
571                 local->total_ps_buffered--;
572                 sent++;
573 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
574                 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
575                        "since STA not sleeping anymore\n", dev->name,
576                        print_mac(mac, sta->addr), sta->aid);
577 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
578                 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
579                 dev_queue_xmit(skb);
580         }
581
582         return sent;
583 }
584
585 static ieee80211_txrx_result
586 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
587 {
588         struct sta_info *sta = rx->sta;
589         struct net_device *dev = rx->dev;
590         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
591
592         if (!sta)
593                 return TXRX_CONTINUE;
594
595         /* Update last_rx only for IBSS packets which are for the current
596          * BSSID to avoid keeping the current IBSS network alive in cases where
597          * other STAs are using different BSSID. */
598         if (rx->sdata->type == IEEE80211_IF_TYPE_IBSS) {
599                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len);
600                 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
601                         sta->last_rx = jiffies;
602         } else
603         if (!is_multicast_ether_addr(hdr->addr1) ||
604             rx->sdata->type == IEEE80211_IF_TYPE_STA) {
605                 /* Update last_rx only for unicast frames in order to prevent
606                  * the Probe Request frames (the only broadcast frames from a
607                  * STA in infrastructure mode) from keeping a connection alive.
608                  */
609                 sta->last_rx = jiffies;
610         }
611
612         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
613                 return TXRX_CONTINUE;
614
615         sta->rx_fragments++;
616         sta->rx_bytes += rx->skb->len;
617         sta->last_rssi = rx->u.rx.status->ssi;
618         sta->last_signal = rx->u.rx.status->signal;
619         sta->last_noise = rx->u.rx.status->noise;
620
621         if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
622                 /* Change STA power saving mode only in the end of a frame
623                  * exchange sequence */
624                 if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
625                         rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta);
626                 else if (!(sta->flags & WLAN_STA_PS) &&
627                          (rx->fc & IEEE80211_FCTL_PM))
628                         ap_sta_ps_start(dev, sta);
629         }
630
631         /* Drop data::nullfunc frames silently, since they are used only to
632          * control station power saving mode. */
633         if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
634             (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
635                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
636                 /* Update counter and free packet here to avoid counting this
637                  * as a dropped packed. */
638                 sta->rx_packets++;
639                 dev_kfree_skb(rx->skb);
640                 return TXRX_QUEUED;
641         }
642
643         return TXRX_CONTINUE;
644 } /* ieee80211_rx_h_sta_process */
645
646 static ieee80211_txrx_result
647 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data *rx)
648 {
649         if (!rx->sta || !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
650             (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
651             !rx->key || rx->key->conf.alg != ALG_WEP ||
652             !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
653                 return TXRX_CONTINUE;
654
655         /* Check for weak IVs, if hwaccel did not remove IV from the frame */
656         if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) ||
657             !(rx->u.rx.status->flag & RX_FLAG_DECRYPTED))
658                 if (ieee80211_wep_is_weak_iv(rx->skb, rx->key))
659                         rx->sta->wep_weak_iv_count++;
660
661         return TXRX_CONTINUE;
662 }
663
664 static ieee80211_txrx_result
665 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data *rx)
666 {
667         if ((rx->key && rx->key->conf.alg != ALG_WEP) ||
668             !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
669             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
670              ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
671               (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)))
672                 return TXRX_CONTINUE;
673
674         if (!rx->key) {
675                 if (net_ratelimit())
676                         printk(KERN_DEBUG "%s: RX WEP frame, but no key set\n",
677                                rx->dev->name);
678                 return TXRX_DROP;
679         }
680
681         if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
682                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
683                         if (net_ratelimit())
684                                 printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
685                                        "failed\n", rx->dev->name);
686                         return TXRX_DROP;
687                 }
688         } else if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) {
689                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
690                 /* remove ICV */
691                 skb_trim(rx->skb, rx->skb->len - 4);
692         }
693
694         return TXRX_CONTINUE;
695 }
696
697 static inline struct ieee80211_fragment_entry *
698 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
699                          unsigned int frag, unsigned int seq, int rx_queue,
700                          struct sk_buff **skb)
701 {
702         struct ieee80211_fragment_entry *entry;
703         int idx;
704
705         idx = sdata->fragment_next;
706         entry = &sdata->fragments[sdata->fragment_next++];
707         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
708                 sdata->fragment_next = 0;
709
710         if (!skb_queue_empty(&entry->skb_list)) {
711 #ifdef CONFIG_MAC80211_DEBUG
712                 struct ieee80211_hdr *hdr =
713                         (struct ieee80211_hdr *) entry->skb_list.next->data;
714                 DECLARE_MAC_BUF(mac);
715                 DECLARE_MAC_BUF(mac2);
716                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
717                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
718                        "addr1=%s addr2=%s\n",
719                        sdata->dev->name, idx,
720                        jiffies - entry->first_frag_time, entry->seq,
721                        entry->last_frag, print_mac(mac, hdr->addr1),
722                        print_mac(mac2, hdr->addr2));
723 #endif /* CONFIG_MAC80211_DEBUG */
724                 __skb_queue_purge(&entry->skb_list);
725         }
726
727         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
728         *skb = NULL;
729         entry->first_frag_time = jiffies;
730         entry->seq = seq;
731         entry->rx_queue = rx_queue;
732         entry->last_frag = frag;
733         entry->ccmp = 0;
734         entry->extra_len = 0;
735
736         return entry;
737 }
738
739 static inline struct ieee80211_fragment_entry *
740 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
741                           u16 fc, unsigned int frag, unsigned int seq,
742                           int rx_queue, struct ieee80211_hdr *hdr)
743 {
744         struct ieee80211_fragment_entry *entry;
745         int i, idx;
746
747         idx = sdata->fragment_next;
748         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
749                 struct ieee80211_hdr *f_hdr;
750                 u16 f_fc;
751
752                 idx--;
753                 if (idx < 0)
754                         idx = IEEE80211_FRAGMENT_MAX - 1;
755
756                 entry = &sdata->fragments[idx];
757                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
758                     entry->rx_queue != rx_queue ||
759                     entry->last_frag + 1 != frag)
760                         continue;
761
762                 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
763                 f_fc = le16_to_cpu(f_hdr->frame_control);
764
765                 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
766                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
767                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
768                         continue;
769
770                 if (entry->first_frag_time + 2 * HZ < jiffies) {
771                         __skb_queue_purge(&entry->skb_list);
772                         continue;
773                 }
774                 return entry;
775         }
776
777         return NULL;
778 }
779
780 static ieee80211_txrx_result
781 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
782 {
783         struct ieee80211_hdr *hdr;
784         u16 sc;
785         unsigned int frag, seq;
786         struct ieee80211_fragment_entry *entry;
787         struct sk_buff *skb;
788         DECLARE_MAC_BUF(mac);
789
790         hdr = (struct ieee80211_hdr *) rx->skb->data;
791         sc = le16_to_cpu(hdr->seq_ctrl);
792         frag = sc & IEEE80211_SCTL_FRAG;
793
794         if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
795                    (rx->skb)->len < 24 ||
796                    is_multicast_ether_addr(hdr->addr1))) {
797                 /* not fragmented */
798                 goto out;
799         }
800         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
801
802         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
803
804         if (frag == 0) {
805                 /* This is the first fragment of a new frame. */
806                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
807                                                  rx->u.rx.queue, &(rx->skb));
808                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
809                     (rx->fc & IEEE80211_FCTL_PROTECTED)) {
810                         /* Store CCMP PN so that we can verify that the next
811                          * fragment has a sequential PN value. */
812                         entry->ccmp = 1;
813                         memcpy(entry->last_pn,
814                                rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
815                                CCMP_PN_LEN);
816                 }
817                 return TXRX_QUEUED;
818         }
819
820         /* This is a fragment for a frame that should already be pending in
821          * fragment cache. Add this fragment to the end of the pending entry.
822          */
823         entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
824                                           rx->u.rx.queue, hdr);
825         if (!entry) {
826                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
827                 return TXRX_DROP;
828         }
829
830         /* Verify that MPDUs within one MSDU have sequential PN values.
831          * (IEEE 802.11i, 8.3.3.4.5) */
832         if (entry->ccmp) {
833                 int i;
834                 u8 pn[CCMP_PN_LEN], *rpn;
835                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
836                         return TXRX_DROP;
837                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
838                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
839                         pn[i]++;
840                         if (pn[i])
841                                 break;
842                 }
843                 rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue];
844                 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
845                         if (net_ratelimit())
846                                 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
847                                        "sequential A2=%s"
848                                        " PN=%02x%02x%02x%02x%02x%02x "
849                                        "(expected %02x%02x%02x%02x%02x%02x)\n",
850                                        rx->dev->name, print_mac(mac, hdr->addr2),
851                                        rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
852                                        rpn[5], pn[0], pn[1], pn[2], pn[3],
853                                        pn[4], pn[5]);
854                         return TXRX_DROP;
855                 }
856                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
857         }
858
859         skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
860         __skb_queue_tail(&entry->skb_list, rx->skb);
861         entry->last_frag = frag;
862         entry->extra_len += rx->skb->len;
863         if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
864                 rx->skb = NULL;
865                 return TXRX_QUEUED;
866         }
867
868         rx->skb = __skb_dequeue(&entry->skb_list);
869         if (skb_tailroom(rx->skb) < entry->extra_len) {
870                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
871                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
872                                               GFP_ATOMIC))) {
873                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
874                         __skb_queue_purge(&entry->skb_list);
875                         return TXRX_DROP;
876                 }
877         }
878         while ((skb = __skb_dequeue(&entry->skb_list))) {
879                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
880                 dev_kfree_skb(skb);
881         }
882
883         /* Complete frame has been reassembled - process it now */
884         rx->flags |= IEEE80211_TXRXD_FRAGMENTED;
885
886  out:
887         if (rx->sta)
888                 rx->sta->rx_packets++;
889         if (is_multicast_ether_addr(hdr->addr1))
890                 rx->local->dot11MulticastReceivedFrameCount++;
891         else
892                 ieee80211_led_rx(rx->local);
893         return TXRX_CONTINUE;
894 }
895
896 static ieee80211_txrx_result
897 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
898 {
899         struct sk_buff *skb;
900         int no_pending_pkts;
901         DECLARE_MAC_BUF(mac);
902
903         if (likely(!rx->sta ||
904                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
905                    (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
906                    !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
907                 return TXRX_CONTINUE;
908
909         skb = skb_dequeue(&rx->sta->tx_filtered);
910         if (!skb) {
911                 skb = skb_dequeue(&rx->sta->ps_tx_buf);
912                 if (skb)
913                         rx->local->total_ps_buffered--;
914         }
915         no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
916                 skb_queue_empty(&rx->sta->ps_tx_buf);
917
918         if (skb) {
919                 struct ieee80211_hdr *hdr =
920                         (struct ieee80211_hdr *) skb->data;
921
922                 /* tell TX path to send one frame even though the STA may
923                  * still remain is PS mode after this frame exchange */
924                 rx->sta->pspoll = 1;
925
926 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
927                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
928                        print_mac(mac, rx->sta->addr), rx->sta->aid,
929                        skb_queue_len(&rx->sta->ps_tx_buf));
930 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
931
932                 /* Use MoreData flag to indicate whether there are more
933                  * buffered frames for this STA */
934                 if (no_pending_pkts) {
935                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
936                         rx->sta->flags &= ~WLAN_STA_TIM;
937                 } else
938                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
939
940                 dev_queue_xmit(skb);
941
942                 if (no_pending_pkts) {
943                         if (rx->local->ops->set_tim)
944                                 rx->local->ops->set_tim(local_to_hw(rx->local),
945                                                        rx->sta->aid, 0);
946                         if (rx->sdata->bss)
947                                 bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
948                 }
949 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
950         } else if (!rx->u.rx.sent_ps_buffered) {
951                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
952                        "though there is no buffered frames for it\n",
953                        rx->dev->name, print_mac(mac, rx->sta->addr));
954 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
955
956         }
957
958         /* Free PS Poll skb here instead of returning TXRX_DROP that would
959          * count as an dropped frame. */
960         dev_kfree_skb(rx->skb);
961
962         return TXRX_QUEUED;
963 }
964
965 static ieee80211_txrx_result
966 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
967 {
968         u16 fc = rx->fc;
969         u8 *data = rx->skb->data;
970         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
971
972         if (!WLAN_FC_IS_QOS_DATA(fc))
973                 return TXRX_CONTINUE;
974
975         /* remove the qos control field, update frame type and meta-data */
976         memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
977         hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
978         /* change frame type to non QOS */
979         rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
980         hdr->frame_control = cpu_to_le16(fc);
981
982         return TXRX_CONTINUE;
983 }
984
985 static ieee80211_txrx_result
986 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data *rx)
987 {
988         if (rx->sdata->eapol && ieee80211_is_eapol(rx->skb) &&
989             rx->sdata->type != IEEE80211_IF_TYPE_STA &&
990             (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
991                 /* Pass both encrypted and unencrypted EAPOL frames to user
992                  * space for processing. */
993                 if (!rx->local->apdev)
994                         return TXRX_DROP;
995                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
996                                   ieee80211_msg_normal);
997                 return TXRX_QUEUED;
998         }
999
1000         if (unlikely(rx->sdata->ieee802_1x &&
1001                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
1002                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1003                      (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)) &&
1004                      !ieee80211_is_eapol(rx->skb))) {
1005 #ifdef CONFIG_MAC80211_DEBUG
1006                 struct ieee80211_hdr *hdr =
1007                         (struct ieee80211_hdr *) rx->skb->data;
1008                 DECLARE_MAC_BUF(mac);
1009                 printk(KERN_DEBUG "%s: dropped frame from %s"
1010                        " (unauthorized port)\n", rx->dev->name,
1011                        print_mac(mac, hdr->addr2));
1012 #endif /* CONFIG_MAC80211_DEBUG */
1013                 return TXRX_DROP;
1014         }
1015
1016         return TXRX_CONTINUE;
1017 }
1018
1019 static ieee80211_txrx_result
1020 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data *rx)
1021 {
1022         /*
1023          * Pass through unencrypted frames if the hardware has
1024          * decrypted them already.
1025          */
1026         if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED)
1027                 return TXRX_CONTINUE;
1028
1029         /* Drop unencrypted frames if key is set. */
1030         if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
1031                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
1032                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1033                      (rx->key || rx->sdata->drop_unencrypted) &&
1034                      (rx->sdata->eapol == 0 ||
1035                       !ieee80211_is_eapol(rx->skb)))) {
1036                 if (net_ratelimit())
1037                         printk(KERN_DEBUG "%s: RX non-WEP frame, but expected "
1038                                "encryption\n", rx->dev->name);
1039                 return TXRX_DROP;
1040         }
1041         return TXRX_CONTINUE;
1042 }
1043
1044 static ieee80211_txrx_result
1045 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
1046 {
1047         struct net_device *dev = rx->dev;
1048         struct ieee80211_local *local = rx->local;
1049         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1050         u16 fc, hdrlen, ethertype;
1051         u8 *payload;
1052         u8 dst[ETH_ALEN];
1053         u8 src[ETH_ALEN];
1054         struct sk_buff *skb = rx->skb, *skb2;
1055         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1056         DECLARE_MAC_BUF(mac);
1057         DECLARE_MAC_BUF(mac2);
1058         DECLARE_MAC_BUF(mac3);
1059         DECLARE_MAC_BUF(mac4);
1060
1061         fc = rx->fc;
1062         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1063                 return TXRX_CONTINUE;
1064
1065         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1066                 return TXRX_DROP;
1067
1068         hdrlen = ieee80211_get_hdrlen(fc);
1069
1070         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1071          * header
1072          * IEEE 802.11 address fields:
1073          * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1074          *   0     0   DA    SA    BSSID n/a
1075          *   0     1   DA    BSSID SA    n/a
1076          *   1     0   BSSID SA    DA    n/a
1077          *   1     1   RA    TA    DA    SA
1078          */
1079
1080         switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1081         case IEEE80211_FCTL_TODS:
1082                 /* BSSID SA DA */
1083                 memcpy(dst, hdr->addr3, ETH_ALEN);
1084                 memcpy(src, hdr->addr2, ETH_ALEN);
1085
1086                 if (unlikely(sdata->type != IEEE80211_IF_TYPE_AP &&
1087                              sdata->type != IEEE80211_IF_TYPE_VLAN)) {
1088                         if (net_ratelimit())
1089                                 printk(KERN_DEBUG "%s: dropped ToDS frame "
1090                                        "(BSSID=%s SA=%s DA=%s)\n",
1091                                        dev->name,
1092                                        print_mac(mac, hdr->addr1),
1093                                        print_mac(mac2, hdr->addr2),
1094                                        print_mac(mac3, hdr->addr3));
1095                         return TXRX_DROP;
1096                 }
1097                 break;
1098         case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1099                 /* RA TA DA SA */
1100                 memcpy(dst, hdr->addr3, ETH_ALEN);
1101                 memcpy(src, hdr->addr4, ETH_ALEN);
1102
1103                 if (unlikely(sdata->type != IEEE80211_IF_TYPE_WDS)) {
1104                         if (net_ratelimit())
1105                                 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
1106                                        "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1107                                        rx->dev->name,
1108                                        print_mac(mac, hdr->addr1),
1109                                        print_mac(mac2, hdr->addr2),
1110                                        print_mac(mac3, hdr->addr3),
1111                                        print_mac(mac4, hdr->addr4));
1112                         return TXRX_DROP;
1113                 }
1114                 break;
1115         case IEEE80211_FCTL_FROMDS:
1116                 /* DA BSSID SA */
1117                 memcpy(dst, hdr->addr1, ETH_ALEN);
1118                 memcpy(src, hdr->addr3, ETH_ALEN);
1119
1120                 if (sdata->type != IEEE80211_IF_TYPE_STA ||
1121                     (is_multicast_ether_addr(dst) &&
1122                      !compare_ether_addr(src, dev->dev_addr)))
1123                         return TXRX_DROP;
1124                 break;
1125         case 0:
1126                 /* DA SA BSSID */
1127                 memcpy(dst, hdr->addr1, ETH_ALEN);
1128                 memcpy(src, hdr->addr2, ETH_ALEN);
1129
1130                 if (sdata->type != IEEE80211_IF_TYPE_IBSS) {
1131                         if (net_ratelimit()) {
1132                                 printk(KERN_DEBUG "%s: dropped IBSS frame "
1133                                        "(DA=%s SA=%s BSSID=%s)\n",
1134                                        dev->name,
1135                                        print_mac(mac, hdr->addr1),
1136                                        print_mac(mac2, hdr->addr2),
1137                                        print_mac(mac3, hdr->addr3));
1138                         }
1139                         return TXRX_DROP;
1140                 }
1141                 break;
1142         }
1143
1144         payload = skb->data + hdrlen;
1145
1146         if (unlikely(skb->len - hdrlen < 8)) {
1147                 if (net_ratelimit()) {
1148                         printk(KERN_DEBUG "%s: RX too short data frame "
1149                                "payload\n", dev->name);
1150                 }
1151                 return TXRX_DROP;
1152         }
1153
1154         ethertype = (payload[6] << 8) | payload[7];
1155
1156         if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1157                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1158                    compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1159                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1160                  * replace EtherType */
1161                 skb_pull(skb, hdrlen + 6);
1162                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1163                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1164         } else {
1165                 struct ethhdr *ehdr;
1166                 __be16 len;
1167                 skb_pull(skb, hdrlen);
1168                 len = htons(skb->len);
1169                 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1170                 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1171                 memcpy(ehdr->h_source, src, ETH_ALEN);
1172                 ehdr->h_proto = len;
1173         }
1174         skb->dev = dev;
1175
1176         skb2 = NULL;
1177
1178         dev->stats.rx_packets++;
1179         dev->stats.rx_bytes += skb->len;
1180
1181         if (local->bridge_packets && (sdata->type == IEEE80211_IF_TYPE_AP
1182             || sdata->type == IEEE80211_IF_TYPE_VLAN) &&
1183             (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
1184                 if (is_multicast_ether_addr(skb->data)) {
1185                         /* send multicast frames both to higher layers in
1186                          * local net stack and back to the wireless media */
1187                         skb2 = skb_copy(skb, GFP_ATOMIC);
1188                         if (!skb2 && net_ratelimit())
1189                                 printk(KERN_DEBUG "%s: failed to clone "
1190                                        "multicast frame\n", dev->name);
1191                 } else {
1192                         struct sta_info *dsta;
1193                         dsta = sta_info_get(local, skb->data);
1194                         if (dsta && !dsta->dev) {
1195                                 if (net_ratelimit())
1196                                         printk(KERN_DEBUG "Station with null "
1197                                                "dev structure!\n");
1198                         } else if (dsta && dsta->dev == dev) {
1199                                 /* Destination station is associated to this
1200                                  * AP, so send the frame directly to it and
1201                                  * do not pass the frame to local net stack.
1202                                  */
1203                                 skb2 = skb;
1204                                 skb = NULL;
1205                         }
1206                         if (dsta)
1207                                 sta_info_put(dsta);
1208                 }
1209         }
1210
1211         if (skb) {
1212                 /* deliver to local stack */
1213                 skb->protocol = eth_type_trans(skb, dev);
1214                 memset(skb->cb, 0, sizeof(skb->cb));
1215                 netif_rx(skb);
1216         }
1217
1218         if (skb2) {
1219                 /* send to wireless media */
1220                 skb2->protocol = __constant_htons(ETH_P_802_3);
1221                 skb_set_network_header(skb2, 0);
1222                 skb_set_mac_header(skb2, 0);
1223                 dev_queue_xmit(skb2);
1224         }
1225
1226         return TXRX_QUEUED;
1227 }
1228
1229 static ieee80211_txrx_result
1230 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
1231 {
1232         struct ieee80211_sub_if_data *sdata;
1233
1234         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
1235                 return TXRX_DROP;
1236
1237         sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1238         if ((sdata->type == IEEE80211_IF_TYPE_STA ||
1239              sdata->type == IEEE80211_IF_TYPE_IBSS) &&
1240             !rx->local->user_space_mlme) {
1241                 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
1242         } else {
1243                 /* Management frames are sent to hostapd for processing */
1244                 if (!rx->local->apdev)
1245                         return TXRX_DROP;
1246                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
1247                                   ieee80211_msg_normal);
1248         }
1249         return TXRX_QUEUED;
1250 }
1251
1252 static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
1253                                 struct ieee80211_local *local,
1254                                 ieee80211_rx_handler *handlers,
1255                                 struct ieee80211_txrx_data *rx,
1256                                 struct sta_info *sta)
1257 {
1258         ieee80211_rx_handler *handler;
1259         ieee80211_txrx_result res = TXRX_DROP;
1260
1261         for (handler = handlers; *handler != NULL; handler++) {
1262                 res = (*handler)(rx);
1263
1264                 switch (res) {
1265                 case TXRX_CONTINUE:
1266                         continue;
1267                 case TXRX_DROP:
1268                         I802_DEBUG_INC(local->rx_handlers_drop);
1269                         if (sta)
1270                                 sta->rx_dropped++;
1271                         break;
1272                 case TXRX_QUEUED:
1273                         I802_DEBUG_INC(local->rx_handlers_queued);
1274                         break;
1275                 }
1276                 break;
1277         }
1278
1279         if (res == TXRX_DROP)
1280                 dev_kfree_skb(rx->skb);
1281         return res;
1282 }
1283
1284 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
1285                                                 ieee80211_rx_handler *handlers,
1286                                                 struct ieee80211_txrx_data *rx,
1287                                                 struct sta_info *sta)
1288 {
1289         if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
1290             TXRX_CONTINUE)
1291                 dev_kfree_skb(rx->skb);
1292 }
1293
1294 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1295                                             struct ieee80211_hdr *hdr,
1296                                             struct sta_info *sta,
1297                                             struct ieee80211_txrx_data *rx)
1298 {
1299         int keyidx, hdrlen;
1300         DECLARE_MAC_BUF(mac);
1301         DECLARE_MAC_BUF(mac2);
1302
1303         hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1304         if (rx->skb->len >= hdrlen + 4)
1305                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1306         else
1307                 keyidx = -1;
1308
1309         if (net_ratelimit())
1310                 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1311                        "failure from %s to %s keyidx=%d\n",
1312                        dev->name, print_mac(mac, hdr->addr2),
1313                        print_mac(mac2, hdr->addr1), keyidx);
1314
1315         if (!sta) {
1316                 /*
1317                  * Some hardware seem to generate incorrect Michael MIC
1318                  * reports; ignore them to avoid triggering countermeasures.
1319                  */
1320                 if (net_ratelimit())
1321                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1322                                "error for unknown address %s\n",
1323                                dev->name, print_mac(mac, hdr->addr2));
1324                 goto ignore;
1325         }
1326
1327         if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1328                 if (net_ratelimit())
1329                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1330                                "error for a frame with no PROTECTED flag (src "
1331                                "%s)\n", dev->name, print_mac(mac, hdr->addr2));
1332                 goto ignore;
1333         }
1334
1335         if (rx->sdata->type == IEEE80211_IF_TYPE_AP && keyidx) {
1336                 /*
1337                  * APs with pairwise keys should never receive Michael MIC
1338                  * errors for non-zero keyidx because these are reserved for
1339                  * group keys and only the AP is sending real multicast
1340                  * frames in the BSS.
1341                  */
1342                 if (net_ratelimit())
1343                         printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1344                                "a frame with non-zero keyidx (%d)"
1345                                " (src %s)\n", dev->name, keyidx,
1346                                print_mac(mac, hdr->addr2));
1347                 goto ignore;
1348         }
1349
1350         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1351             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1352              (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1353                 if (net_ratelimit())
1354                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1355                                "error for a frame that cannot be encrypted "
1356                                "(fc=0x%04x) (src %s)\n",
1357                                dev->name, rx->fc, print_mac(mac, hdr->addr2));
1358                 goto ignore;
1359         }
1360
1361         mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1362  ignore:
1363         dev_kfree_skb(rx->skb);
1364         rx->skb = NULL;
1365 }
1366
1367 ieee80211_rx_handler ieee80211_rx_handlers[] =
1368 {
1369         ieee80211_rx_h_if_stats,
1370         ieee80211_rx_h_passive_scan,
1371         ieee80211_rx_h_check,
1372         ieee80211_rx_h_load_key,
1373         ieee80211_rx_h_sta_process,
1374         ieee80211_rx_h_ccmp_decrypt,
1375         ieee80211_rx_h_tkip_decrypt,
1376         ieee80211_rx_h_wep_weak_iv_detection,
1377         ieee80211_rx_h_wep_decrypt,
1378         ieee80211_rx_h_defragment,
1379         ieee80211_rx_h_ps_poll,
1380         ieee80211_rx_h_michael_mic_verify,
1381         /* this must be after decryption - so header is counted in MPDU mic
1382          * must be before pae and data, so QOS_DATA format frames
1383          * are not passed to user space by these functions
1384          */
1385         ieee80211_rx_h_remove_qos_control,
1386         ieee80211_rx_h_802_1x_pae,
1387         ieee80211_rx_h_drop_unencrypted,
1388         ieee80211_rx_h_data,
1389         ieee80211_rx_h_mgmt,
1390         NULL
1391 };
1392
1393 /* main receive path */
1394
1395 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1396                                 u8 *bssid, struct ieee80211_txrx_data *rx,
1397                                 struct ieee80211_hdr *hdr)
1398 {
1399         int multicast = is_multicast_ether_addr(hdr->addr1);
1400
1401         switch (sdata->type) {
1402         case IEEE80211_IF_TYPE_STA:
1403                 if (!bssid)
1404                         return 0;
1405                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1406                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1407                                 return 0;
1408                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1409                 } else if (!multicast &&
1410                            compare_ether_addr(sdata->dev->dev_addr,
1411                                               hdr->addr1) != 0) {
1412                         if (!(sdata->dev->flags & IFF_PROMISC))
1413                                 return 0;
1414                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1415                 }
1416                 break;
1417         case IEEE80211_IF_TYPE_IBSS:
1418                 if (!bssid)
1419                         return 0;
1420                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1421                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1422                                 return 0;
1423                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1424                 } else if (!multicast &&
1425                            compare_ether_addr(sdata->dev->dev_addr,
1426                                               hdr->addr1) != 0) {
1427                         if (!(sdata->dev->flags & IFF_PROMISC))
1428                                 return 0;
1429                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1430                 } else if (!rx->sta)
1431                         rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1432                                                          bssid, hdr->addr2);
1433                 break;
1434         case IEEE80211_IF_TYPE_AP:
1435                 if (!bssid) {
1436                         if (compare_ether_addr(sdata->dev->dev_addr,
1437                                                hdr->addr1))
1438                                 return 0;
1439                 } else if (!ieee80211_bssid_match(bssid,
1440                                         sdata->dev->dev_addr)) {
1441                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1442                                 return 0;
1443                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1444                 }
1445                 if (sdata->dev == sdata->local->mdev &&
1446                     !(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1447                         /* do not receive anything via
1448                          * master device when not scanning */
1449                         return 0;
1450                 break;
1451         case IEEE80211_IF_TYPE_WDS:
1452                 if (bssid ||
1453                     (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1454                         return 0;
1455                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1456                         return 0;
1457                 break;
1458         }
1459
1460         return 1;
1461 }
1462
1463 /*
1464  * This is the receive path handler. It is called by a low level driver when an
1465  * 802.11 MPDU is received from the hardware.
1466  */
1467 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
1468                     struct ieee80211_rx_status *status)
1469 {
1470         struct ieee80211_local *local = hw_to_local(hw);
1471         struct ieee80211_sub_if_data *sdata;
1472         struct sta_info *sta;
1473         struct ieee80211_hdr *hdr;
1474         struct ieee80211_txrx_data rx;
1475         u16 type;
1476         int prepres;
1477         struct ieee80211_sub_if_data *prev = NULL;
1478         struct sk_buff *skb_new;
1479         u8 *bssid;
1480
1481         /*
1482          * key references and virtual interfaces are protected using RCU
1483          * and this requires that we are in a read-side RCU section during
1484          * receive processing
1485          */
1486         rcu_read_lock();
1487
1488         /*
1489          * Frames with failed FCS/PLCP checksum are not returned,
1490          * all other frames are returned without radiotap header
1491          * if it was previously present.
1492          * Also, frames with less than 16 bytes are dropped.
1493          */
1494         skb = ieee80211_rx_monitor(local, skb, status);
1495         if (!skb) {
1496                 rcu_read_unlock();
1497                 return;
1498         }
1499
1500         hdr = (struct ieee80211_hdr *) skb->data;
1501         memset(&rx, 0, sizeof(rx));
1502         rx.skb = skb;
1503         rx.local = local;
1504
1505         rx.u.rx.status = status;
1506         rx.fc = le16_to_cpu(hdr->frame_control);
1507         type = rx.fc & IEEE80211_FCTL_FTYPE;
1508
1509         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
1510                 local->dot11ReceivedFragmentCount++;
1511
1512         sta = rx.sta = sta_info_get(local, hdr->addr2);
1513         if (sta) {
1514                 rx.dev = rx.sta->dev;
1515                 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
1516         }
1517
1518         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1519                 ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
1520                 goto end;
1521         }
1522
1523         if (unlikely(local->sta_scanning))
1524                 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
1525
1526         if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
1527                                            sta) != TXRX_CONTINUE)
1528                 goto end;
1529         skb = rx.skb;
1530
1531         if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
1532             !local->iff_promiscs && !is_multicast_ether_addr(hdr->addr1)) {
1533                 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1534                 ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
1535                                              rx.sta);
1536                 sta_info_put(sta);
1537                 rcu_read_unlock();
1538                 return;
1539         }
1540
1541         bssid = ieee80211_get_bssid(hdr, skb->len);
1542
1543         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1544                 if (!netif_running(sdata->dev))
1545                         continue;
1546
1547                 if (sdata->type == IEEE80211_IF_TYPE_MNTR)
1548                         continue;
1549
1550                 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1551                 prepres = prepare_for_handlers(sdata, bssid, &rx, hdr);
1552                 /* prepare_for_handlers can change sta */
1553                 sta = rx.sta;
1554
1555                 if (!prepres)
1556                         continue;
1557
1558                 /*
1559                  * frame is destined for this interface, but if it's not
1560                  * also for the previous one we handle that after the
1561                  * loop to avoid copying the SKB once too much
1562                  */
1563
1564                 if (!prev) {
1565                         prev = sdata;
1566                         continue;
1567                 }
1568
1569                 /*
1570                  * frame was destined for the previous interface
1571                  * so invoke RX handlers for it
1572                  */
1573
1574                 skb_new = skb_copy(skb, GFP_ATOMIC);
1575                 if (!skb_new) {
1576                         if (net_ratelimit())
1577                                 printk(KERN_DEBUG "%s: failed to copy "
1578                                        "multicast frame for %s",
1579                                        wiphy_name(local->hw.wiphy),
1580                                        prev->dev->name);
1581                         continue;
1582                 }
1583                 rx.skb = skb_new;
1584                 rx.dev = prev->dev;
1585                 rx.sdata = prev;
1586                 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1587                                              &rx, sta);
1588                 prev = sdata;
1589         }
1590         if (prev) {
1591                 rx.skb = skb;
1592                 rx.dev = prev->dev;
1593                 rx.sdata = prev;
1594                 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1595                                              &rx, sta);
1596         } else
1597                 dev_kfree_skb(skb);
1598
1599  end:
1600         rcu_read_unlock();
1601
1602         if (sta)
1603                 sta_info_put(sta);
1604 }
1605 EXPORT_SYMBOL(__ieee80211_rx);
1606
1607 /* This is a version of the rx handler that can be called from hard irq
1608  * context. Post the skb on the queue and schedule the tasklet */
1609 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
1610                           struct ieee80211_rx_status *status)
1611 {
1612         struct ieee80211_local *local = hw_to_local(hw);
1613
1614         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
1615
1616         skb->dev = local->mdev;
1617         /* copy status into skb->cb for use by tasklet */
1618         memcpy(skb->cb, status, sizeof(*status));
1619         skb->pkt_type = IEEE80211_RX_MSG;
1620         skb_queue_tail(&local->skb_queue, skb);
1621         tasklet_schedule(&local->tasklet);
1622 }
1623 EXPORT_SYMBOL(ieee80211_rx_irqsafe);