[PATCH] mac80211: fix vlan bug
[linux-2.6] / net / mac80211 / rx.c
1 /*
2  * Copyright 2002-2005, Instant802 Networks, Inc.
3  * Copyright 2005-2006, Devicescape Software, Inc.
4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
5  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
19
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
22 #include "ieee80211_common.h"
23 #include "wep.h"
24 #include "wpa.h"
25 #include "tkip.h"
26 #include "wme.h"
27
28 /*
29  * monitor mode reception
30  *
31  * This function cleans up the SKB, i.e. it removes all the stuff
32  * only useful for monitoring.
33  */
34 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
35                                            struct sk_buff *skb,
36                                            int rtap_len)
37 {
38         skb_pull(skb, rtap_len);
39
40         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
41                 if (likely(skb->len > FCS_LEN))
42                         skb_trim(skb, skb->len - FCS_LEN);
43                 else {
44                         /* driver bug */
45                         WARN_ON(1);
46                         dev_kfree_skb(skb);
47                         skb = NULL;
48                 }
49         }
50
51         return skb;
52 }
53
54 static inline int should_drop_frame(struct ieee80211_rx_status *status,
55                                     struct sk_buff *skb,
56                                     int present_fcs_len,
57                                     int radiotap_len)
58 {
59         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
60
61         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
62                 return 1;
63         if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
64                 return 1;
65         if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
66                         cpu_to_le16(IEEE80211_FTYPE_CTL))
67                 return 1;
68         return 0;
69 }
70
71 /*
72  * This function copies a received frame to all monitor interfaces and
73  * returns a cleaned-up SKB that no longer includes the FCS nor the
74  * radiotap header the driver might have added.
75  */
76 static struct sk_buff *
77 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
78                      struct ieee80211_rx_status *status)
79 {
80         struct ieee80211_sub_if_data *sdata;
81         struct ieee80211_rate *rate;
82         int needed_headroom = 0;
83         struct ieee80211_rtap_hdr {
84                 struct ieee80211_radiotap_header hdr;
85                 u8 flags;
86                 u8 rate;
87                 __le16 chan_freq;
88                 __le16 chan_flags;
89                 u8 antsignal;
90                 u8 padding_for_rxflags;
91                 __le16 rx_flags;
92         } __attribute__ ((packed)) *rthdr;
93         struct sk_buff *skb, *skb2;
94         struct net_device *prev_dev = NULL;
95         int present_fcs_len = 0;
96         int rtap_len = 0;
97
98         /*
99          * First, we may need to make a copy of the skb because
100          *  (1) we need to modify it for radiotap (if not present), and
101          *  (2) the other RX handlers will modify the skb we got.
102          *
103          * We don't need to, of course, if we aren't going to return
104          * the SKB because it has a bad FCS/PLCP checksum.
105          */
106         if (status->flag & RX_FLAG_RADIOTAP)
107                 rtap_len = ieee80211_get_radiotap_len(origskb->data);
108         else
109                 needed_headroom = sizeof(*rthdr);
110
111         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
112                 present_fcs_len = FCS_LEN;
113
114         if (!local->monitors) {
115                 if (should_drop_frame(status, origskb, present_fcs_len,
116                                       rtap_len)) {
117                         dev_kfree_skb(origskb);
118                         return NULL;
119                 }
120
121                 return remove_monitor_info(local, origskb, rtap_len);
122         }
123
124         if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
125                 /* only need to expand headroom if necessary */
126                 skb = origskb;
127                 origskb = NULL;
128
129                 /*
130                  * This shouldn't trigger often because most devices have an
131                  * RX header they pull before we get here, and that should
132                  * be big enough for our radiotap information. We should
133                  * probably export the length to drivers so that we can have
134                  * them allocate enough headroom to start with.
135                  */
136                 if (skb_headroom(skb) < needed_headroom &&
137                     pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) {
138                         dev_kfree_skb(skb);
139                         return NULL;
140                 }
141         } else {
142                 /*
143                  * Need to make a copy and possibly remove radiotap header
144                  * and FCS from the original.
145                  */
146                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
147
148                 origskb = remove_monitor_info(local, origskb, rtap_len);
149
150                 if (!skb)
151                         return origskb;
152         }
153
154         /* if necessary, prepend radiotap information */
155         if (!(status->flag & RX_FLAG_RADIOTAP)) {
156                 rthdr = (void *) skb_push(skb, sizeof(*rthdr));
157                 memset(rthdr, 0, sizeof(*rthdr));
158                 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
159                 rthdr->hdr.it_present =
160                         cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
161                                     (1 << IEEE80211_RADIOTAP_RATE) |
162                                     (1 << IEEE80211_RADIOTAP_CHANNEL) |
163                                     (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |
164                                     (1 << IEEE80211_RADIOTAP_RX_FLAGS));
165                 rthdr->flags = local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS ?
166                                IEEE80211_RADIOTAP_F_FCS : 0;
167
168                 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
169                 rthdr->rx_flags = 0;
170                 if (status->flag &
171                     (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
172                         rthdr->rx_flags |=
173                                 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
174
175                 rate = ieee80211_get_rate(local, status->phymode,
176                                           status->rate);
177                 if (rate)
178                         rthdr->rate = rate->rate / 5;
179
180                 rthdr->chan_freq = cpu_to_le16(status->freq);
181
182                 if (status->phymode == MODE_IEEE80211A)
183                         rthdr->chan_flags =
184                                 cpu_to_le16(IEEE80211_CHAN_OFDM |
185                                             IEEE80211_CHAN_5GHZ);
186                 else
187                         rthdr->chan_flags =
188                                 cpu_to_le16(IEEE80211_CHAN_DYN |
189                                             IEEE80211_CHAN_2GHZ);
190
191                 rthdr->antsignal = status->ssi;
192         }
193
194         skb_set_mac_header(skb, 0);
195         skb->ip_summed = CHECKSUM_UNNECESSARY;
196         skb->pkt_type = PACKET_OTHERHOST;
197         skb->protocol = htons(ETH_P_802_2);
198
199         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
200                 if (!netif_running(sdata->dev))
201                         continue;
202
203                 if (sdata->type != IEEE80211_IF_TYPE_MNTR)
204                         continue;
205
206                 if (prev_dev) {
207                         skb2 = skb_clone(skb, GFP_ATOMIC);
208                         if (skb2) {
209                                 skb2->dev = prev_dev;
210                                 netif_rx(skb2);
211                         }
212                 }
213
214                 prev_dev = sdata->dev;
215                 sdata->dev->stats.rx_packets++;
216                 sdata->dev->stats.rx_bytes += skb->len;
217         }
218
219         if (prev_dev) {
220                 skb->dev = prev_dev;
221                 netif_rx(skb);
222         } else
223                 dev_kfree_skb(skb);
224
225         return origskb;
226 }
227
228
229 /* pre-rx handlers
230  *
231  * these don't have dev/sdata fields in the rx data
232  * The sta value should also not be used because it may
233  * be NULL even though a STA (in IBSS mode) will be added.
234  */
235
236 static ieee80211_txrx_result
237 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
238 {
239         u8 *data = rx->skb->data;
240         int tid;
241
242         /* does the frame have a qos control field? */
243         if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
244                 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
245                 /* frame has qos control */
246                 tid = qc[0] & QOS_CONTROL_TID_MASK;
247         } else {
248                 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
249                         /* Separate TID for management frames */
250                         tid = NUM_RX_DATA_QUEUES - 1;
251                 } else {
252                         /* no qos control present */
253                         tid = 0; /* 802.1d - Best Effort */
254                 }
255         }
256
257         I802_DEBUG_INC(rx->local->wme_rx_queue[tid]);
258         /* only a debug counter, sta might not be assigned properly yet */
259         if (rx->sta)
260                 I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]);
261
262         rx->u.rx.queue = tid;
263         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
264          * For now, set skb->priority to 0 for other cases. */
265         rx->skb->priority = (tid > 7) ? 0 : tid;
266
267         return TXRX_CONTINUE;
268 }
269
270 static ieee80211_txrx_result
271 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data *rx)
272 {
273         struct ieee80211_local *local = rx->local;
274         struct sk_buff *skb = rx->skb;
275         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
276         u32 load = 0, hdrtime;
277         struct ieee80211_rate *rate;
278         struct ieee80211_hw_mode *mode = local->hw.conf.mode;
279         int i;
280
281         /* Estimate total channel use caused by this frame */
282
283         if (unlikely(mode->num_rates < 0))
284                 return TXRX_CONTINUE;
285
286         rate = &mode->rates[0];
287         for (i = 0; i < mode->num_rates; i++) {
288                 if (mode->rates[i].val == rx->u.rx.status->rate) {
289                         rate = &mode->rates[i];
290                         break;
291                 }
292         }
293
294         /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
295          * 1 usec = 1/8 * (1080 / 10) = 13.5 */
296
297         if (mode->mode == MODE_IEEE80211A ||
298             (mode->mode == MODE_IEEE80211G &&
299              rate->flags & IEEE80211_RATE_ERP))
300                 hdrtime = CHAN_UTIL_HDR_SHORT;
301         else
302                 hdrtime = CHAN_UTIL_HDR_LONG;
303
304         load = hdrtime;
305         if (!is_multicast_ether_addr(hdr->addr1))
306                 load += hdrtime;
307
308         load += skb->len * rate->rate_inv;
309
310         /* Divide channel_use by 8 to avoid wrapping around the counter */
311         load >>= CHAN_UTIL_SHIFT;
312         local->channel_use_raw += load;
313         rx->u.rx.load = load;
314
315         return TXRX_CONTINUE;
316 }
317
318 ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
319 {
320         ieee80211_rx_h_parse_qos,
321         ieee80211_rx_h_load_stats,
322         NULL
323 };
324
325 /* rx handlers */
326
327 static ieee80211_txrx_result
328 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
329 {
330         if (rx->sta)
331                 rx->sta->channel_use_raw += rx->u.rx.load;
332         rx->sdata->channel_use_raw += rx->u.rx.load;
333         return TXRX_CONTINUE;
334 }
335
336 static ieee80211_txrx_result
337 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
338 {
339         struct ieee80211_local *local = rx->local;
340         struct sk_buff *skb = rx->skb;
341
342         if (unlikely(local->sta_scanning != 0)) {
343                 ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status);
344                 return TXRX_QUEUED;
345         }
346
347         if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
348                 /* scanning finished during invoking of handlers */
349                 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
350                 return TXRX_DROP;
351         }
352
353         return TXRX_CONTINUE;
354 }
355
356 static ieee80211_txrx_result
357 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
358 {
359         struct ieee80211_hdr *hdr;
360         hdr = (struct ieee80211_hdr *) rx->skb->data;
361
362         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
363         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
364                 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
365                              rx->sta->last_seq_ctrl[rx->u.rx.queue] ==
366                              hdr->seq_ctrl)) {
367                         if (rx->flags & IEEE80211_TXRXD_RXRA_MATCH) {
368                                 rx->local->dot11FrameDuplicateCount++;
369                                 rx->sta->num_duplicates++;
370                         }
371                         return TXRX_DROP;
372                 } else
373                         rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
374         }
375
376         if (unlikely(rx->skb->len < 16)) {
377                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
378                 return TXRX_DROP;
379         }
380
381         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
382                 rx->skb->pkt_type = PACKET_OTHERHOST;
383         else if (compare_ether_addr(rx->dev->dev_addr, hdr->addr1) == 0)
384                 rx->skb->pkt_type = PACKET_HOST;
385         else if (is_multicast_ether_addr(hdr->addr1)) {
386                 if (is_broadcast_ether_addr(hdr->addr1))
387                         rx->skb->pkt_type = PACKET_BROADCAST;
388                 else
389                         rx->skb->pkt_type = PACKET_MULTICAST;
390         } else
391                 rx->skb->pkt_type = PACKET_OTHERHOST;
392
393         /* Drop disallowed frame classes based on STA auth/assoc state;
394          * IEEE 802.11, Chap 5.5.
395          *
396          * 80211.o does filtering only based on association state, i.e., it
397          * drops Class 3 frames from not associated stations. hostapd sends
398          * deauth/disassoc frames when needed. In addition, hostapd is
399          * responsible for filtering on both auth and assoc states.
400          */
401         if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
402                       ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
403                        (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
404                      rx->sdata->type != IEEE80211_IF_TYPE_IBSS &&
405                      (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
406                 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
407                      !(rx->fc & IEEE80211_FCTL_TODS) &&
408                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
409                     || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
410                         /* Drop IBSS frames and frames for other hosts
411                          * silently. */
412                         return TXRX_DROP;
413                 }
414
415                 if (!rx->local->apdev)
416                         return TXRX_DROP;
417
418                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
419                                   ieee80211_msg_sta_not_assoc);
420                 return TXRX_QUEUED;
421         }
422
423         return TXRX_CONTINUE;
424 }
425
426
427 static ieee80211_txrx_result
428 ieee80211_rx_h_load_key(struct ieee80211_txrx_data *rx)
429 {
430         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
431         int keyidx;
432         int hdrlen;
433         struct ieee80211_key *stakey = NULL;
434
435         /*
436          * Key selection 101
437          *
438          * There are three types of keys:
439          *  - GTK (group keys)
440          *  - PTK (pairwise keys)
441          *  - STK (station-to-station pairwise keys)
442          *
443          * When selecting a key, we have to distinguish between multicast
444          * (including broadcast) and unicast frames, the latter can only
445          * use PTKs and STKs while the former always use GTKs. Unless, of
446          * course, actual WEP keys ("pre-RSNA") are used, then unicast
447          * frames can also use key indizes like GTKs. Hence, if we don't
448          * have a PTK/STK we check the key index for a WEP key.
449          *
450          * Note that in a regular BSS, multicast frames are sent by the
451          * AP only, associated stations unicast the frame to the AP first
452          * which then multicasts it on their behalf.
453          *
454          * There is also a slight problem in IBSS mode: GTKs are negotiated
455          * with each station, that is something we don't currently handle.
456          * The spec seems to expect that one negotiates the same key with
457          * every station but there's no such requirement; VLANs could be
458          * possible.
459          */
460
461         if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
462                 return TXRX_CONTINUE;
463
464         /*
465          * No point in finding a key if the frame is neither
466          * addressed to us nor a multicast frame.
467          */
468         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
469                 return TXRX_CONTINUE;
470
471         if (rx->sta)
472                 stakey = rcu_dereference(rx->sta->key);
473
474         if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
475                 rx->key = stakey;
476         } else {
477                 /*
478                  * The device doesn't give us the IV so we won't be
479                  * able to look up the key. That's ok though, we
480                  * don't need to decrypt the frame, we just won't
481                  * be able to keep statistics accurate.
482                  * Except for key threshold notifications, should
483                  * we somehow allow the driver to tell us which key
484                  * the hardware used if this flag is set?
485                  */
486                 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
487                     (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
488                         return TXRX_CONTINUE;
489
490                 hdrlen = ieee80211_get_hdrlen(rx->fc);
491
492                 if (rx->skb->len < 8 + hdrlen)
493                         return TXRX_DROP; /* TODO: count this? */
494
495                 /*
496                  * no need to call ieee80211_wep_get_keyidx,
497                  * it verifies a bunch of things we've done already
498                  */
499                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
500
501                 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
502
503                 /*
504                  * RSNA-protected unicast frames should always be sent with
505                  * pairwise or station-to-station keys, but for WEP we allow
506                  * using a key index as well.
507                  */
508                 if (rx->key && rx->key->conf.alg != ALG_WEP &&
509                     !is_multicast_ether_addr(hdr->addr1))
510                         rx->key = NULL;
511         }
512
513         if (rx->key) {
514                 rx->key->tx_rx_count++;
515                 /* TODO: add threshold stuff again */
516         }
517
518         return TXRX_CONTINUE;
519 }
520
521 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
522 {
523         struct ieee80211_sub_if_data *sdata;
524         DECLARE_MAC_BUF(mac);
525
526         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
527
528         if (sdata->bss)
529                 atomic_inc(&sdata->bss->num_sta_ps);
530         sta->flags |= WLAN_STA_PS;
531         sta->pspoll = 0;
532 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
533         printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
534                dev->name, print_mac(mac, sta->addr), sta->aid);
535 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
536 }
537
538 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
539 {
540         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
541         struct sk_buff *skb;
542         int sent = 0;
543         struct ieee80211_sub_if_data *sdata;
544         struct ieee80211_tx_packet_data *pkt_data;
545         DECLARE_MAC_BUF(mac);
546
547         sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
548         if (sdata->bss)
549                 atomic_dec(&sdata->bss->num_sta_ps);
550         sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
551         sta->pspoll = 0;
552         if (!skb_queue_empty(&sta->ps_tx_buf)) {
553                 if (local->ops->set_tim)
554                         local->ops->set_tim(local_to_hw(local), sta->aid, 0);
555                 if (sdata->bss)
556                         bss_tim_clear(local, sdata->bss, sta->aid);
557         }
558 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
559         printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
560                dev->name, print_mac(mac, sta->addr), sta->aid);
561 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
562         /* Send all buffered frames to the station */
563         while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
564                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
565                 sent++;
566                 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
567                 dev_queue_xmit(skb);
568         }
569         while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
570                 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
571                 local->total_ps_buffered--;
572                 sent++;
573 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
574                 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
575                        "since STA not sleeping anymore\n", dev->name,
576                        print_mac(mac, sta->addr), sta->aid);
577 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
578                 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
579                 dev_queue_xmit(skb);
580         }
581
582         return sent;
583 }
584
585 static ieee80211_txrx_result
586 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
587 {
588         struct sta_info *sta = rx->sta;
589         struct net_device *dev = rx->dev;
590         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
591
592         if (!sta)
593                 return TXRX_CONTINUE;
594
595         /* Update last_rx only for IBSS packets which are for the current
596          * BSSID to avoid keeping the current IBSS network alive in cases where
597          * other STAs are using different BSSID. */
598         if (rx->sdata->type == IEEE80211_IF_TYPE_IBSS) {
599                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len);
600                 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
601                         sta->last_rx = jiffies;
602         } else
603         if (!is_multicast_ether_addr(hdr->addr1) ||
604             rx->sdata->type == IEEE80211_IF_TYPE_STA) {
605                 /* Update last_rx only for unicast frames in order to prevent
606                  * the Probe Request frames (the only broadcast frames from a
607                  * STA in infrastructure mode) from keeping a connection alive.
608                  */
609                 sta->last_rx = jiffies;
610         }
611
612         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
613                 return TXRX_CONTINUE;
614
615         sta->rx_fragments++;
616         sta->rx_bytes += rx->skb->len;
617         sta->last_rssi = rx->u.rx.status->ssi;
618         sta->last_signal = rx->u.rx.status->signal;
619         sta->last_noise = rx->u.rx.status->noise;
620
621         if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
622                 /* Change STA power saving mode only in the end of a frame
623                  * exchange sequence */
624                 if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
625                         rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta);
626                 else if (!(sta->flags & WLAN_STA_PS) &&
627                          (rx->fc & IEEE80211_FCTL_PM))
628                         ap_sta_ps_start(dev, sta);
629         }
630
631         /* Drop data::nullfunc frames silently, since they are used only to
632          * control station power saving mode. */
633         if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
634             (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
635                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
636                 /* Update counter and free packet here to avoid counting this
637                  * as a dropped packed. */
638                 sta->rx_packets++;
639                 dev_kfree_skb(rx->skb);
640                 return TXRX_QUEUED;
641         }
642
643         return TXRX_CONTINUE;
644 } /* ieee80211_rx_h_sta_process */
645
646 static ieee80211_txrx_result
647 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data *rx)
648 {
649         if (!rx->sta || !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
650             (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
651             !rx->key || rx->key->conf.alg != ALG_WEP ||
652             !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
653                 return TXRX_CONTINUE;
654
655         /* Check for weak IVs, if hwaccel did not remove IV from the frame */
656         if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) ||
657             !(rx->u.rx.status->flag & RX_FLAG_DECRYPTED))
658                 if (ieee80211_wep_is_weak_iv(rx->skb, rx->key))
659                         rx->sta->wep_weak_iv_count++;
660
661         return TXRX_CONTINUE;
662 }
663
664 static ieee80211_txrx_result
665 ieee80211_rx_h_decrypt(struct ieee80211_txrx_data *rx)
666 {
667         if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
668                 return TXRX_CONTINUE;
669
670         if (!rx->key) {
671                 if (net_ratelimit())
672                         printk(KERN_DEBUG "%s: RX protected frame,"
673                                " but have no key\n", rx->dev->name);
674                 return TXRX_DROP;
675         }
676
677         switch (rx->key->conf.alg) {
678         case ALG_WEP:
679                 return ieee80211_crypto_wep_decrypt(rx);
680         case ALG_TKIP:
681                 return ieee80211_crypto_tkip_decrypt(rx);
682         case ALG_CCMP:
683                 return ieee80211_crypto_ccmp_decrypt(rx);
684         case ALG_NONE:
685                 return TXRX_CONTINUE;
686         }
687
688         /* not reached */
689         WARN_ON(1);
690         return TXRX_DROP;
691 }
692
693 static inline struct ieee80211_fragment_entry *
694 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
695                          unsigned int frag, unsigned int seq, int rx_queue,
696                          struct sk_buff **skb)
697 {
698         struct ieee80211_fragment_entry *entry;
699         int idx;
700
701         idx = sdata->fragment_next;
702         entry = &sdata->fragments[sdata->fragment_next++];
703         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
704                 sdata->fragment_next = 0;
705
706         if (!skb_queue_empty(&entry->skb_list)) {
707 #ifdef CONFIG_MAC80211_DEBUG
708                 struct ieee80211_hdr *hdr =
709                         (struct ieee80211_hdr *) entry->skb_list.next->data;
710                 DECLARE_MAC_BUF(mac);
711                 DECLARE_MAC_BUF(mac2);
712                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
713                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
714                        "addr1=%s addr2=%s\n",
715                        sdata->dev->name, idx,
716                        jiffies - entry->first_frag_time, entry->seq,
717                        entry->last_frag, print_mac(mac, hdr->addr1),
718                        print_mac(mac2, hdr->addr2));
719 #endif /* CONFIG_MAC80211_DEBUG */
720                 __skb_queue_purge(&entry->skb_list);
721         }
722
723         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
724         *skb = NULL;
725         entry->first_frag_time = jiffies;
726         entry->seq = seq;
727         entry->rx_queue = rx_queue;
728         entry->last_frag = frag;
729         entry->ccmp = 0;
730         entry->extra_len = 0;
731
732         return entry;
733 }
734
735 static inline struct ieee80211_fragment_entry *
736 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
737                           u16 fc, unsigned int frag, unsigned int seq,
738                           int rx_queue, struct ieee80211_hdr *hdr)
739 {
740         struct ieee80211_fragment_entry *entry;
741         int i, idx;
742
743         idx = sdata->fragment_next;
744         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
745                 struct ieee80211_hdr *f_hdr;
746                 u16 f_fc;
747
748                 idx--;
749                 if (idx < 0)
750                         idx = IEEE80211_FRAGMENT_MAX - 1;
751
752                 entry = &sdata->fragments[idx];
753                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
754                     entry->rx_queue != rx_queue ||
755                     entry->last_frag + 1 != frag)
756                         continue;
757
758                 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
759                 f_fc = le16_to_cpu(f_hdr->frame_control);
760
761                 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
762                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
763                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
764                         continue;
765
766                 if (entry->first_frag_time + 2 * HZ < jiffies) {
767                         __skb_queue_purge(&entry->skb_list);
768                         continue;
769                 }
770                 return entry;
771         }
772
773         return NULL;
774 }
775
776 static ieee80211_txrx_result
777 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
778 {
779         struct ieee80211_hdr *hdr;
780         u16 sc;
781         unsigned int frag, seq;
782         struct ieee80211_fragment_entry *entry;
783         struct sk_buff *skb;
784         DECLARE_MAC_BUF(mac);
785
786         hdr = (struct ieee80211_hdr *) rx->skb->data;
787         sc = le16_to_cpu(hdr->seq_ctrl);
788         frag = sc & IEEE80211_SCTL_FRAG;
789
790         if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
791                    (rx->skb)->len < 24 ||
792                    is_multicast_ether_addr(hdr->addr1))) {
793                 /* not fragmented */
794                 goto out;
795         }
796         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
797
798         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
799
800         if (frag == 0) {
801                 /* This is the first fragment of a new frame. */
802                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
803                                                  rx->u.rx.queue, &(rx->skb));
804                 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
805                     (rx->fc & IEEE80211_FCTL_PROTECTED)) {
806                         /* Store CCMP PN so that we can verify that the next
807                          * fragment has a sequential PN value. */
808                         entry->ccmp = 1;
809                         memcpy(entry->last_pn,
810                                rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
811                                CCMP_PN_LEN);
812                 }
813                 return TXRX_QUEUED;
814         }
815
816         /* This is a fragment for a frame that should already be pending in
817          * fragment cache. Add this fragment to the end of the pending entry.
818          */
819         entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
820                                           rx->u.rx.queue, hdr);
821         if (!entry) {
822                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
823                 return TXRX_DROP;
824         }
825
826         /* Verify that MPDUs within one MSDU have sequential PN values.
827          * (IEEE 802.11i, 8.3.3.4.5) */
828         if (entry->ccmp) {
829                 int i;
830                 u8 pn[CCMP_PN_LEN], *rpn;
831                 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
832                         return TXRX_DROP;
833                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
834                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
835                         pn[i]++;
836                         if (pn[i])
837                                 break;
838                 }
839                 rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue];
840                 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
841                         if (net_ratelimit())
842                                 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
843                                        "sequential A2=%s"
844                                        " PN=%02x%02x%02x%02x%02x%02x "
845                                        "(expected %02x%02x%02x%02x%02x%02x)\n",
846                                        rx->dev->name, print_mac(mac, hdr->addr2),
847                                        rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
848                                        rpn[5], pn[0], pn[1], pn[2], pn[3],
849                                        pn[4], pn[5]);
850                         return TXRX_DROP;
851                 }
852                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
853         }
854
855         skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
856         __skb_queue_tail(&entry->skb_list, rx->skb);
857         entry->last_frag = frag;
858         entry->extra_len += rx->skb->len;
859         if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
860                 rx->skb = NULL;
861                 return TXRX_QUEUED;
862         }
863
864         rx->skb = __skb_dequeue(&entry->skb_list);
865         if (skb_tailroom(rx->skb) < entry->extra_len) {
866                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
867                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
868                                               GFP_ATOMIC))) {
869                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
870                         __skb_queue_purge(&entry->skb_list);
871                         return TXRX_DROP;
872                 }
873         }
874         while ((skb = __skb_dequeue(&entry->skb_list))) {
875                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
876                 dev_kfree_skb(skb);
877         }
878
879         /* Complete frame has been reassembled - process it now */
880         rx->flags |= IEEE80211_TXRXD_FRAGMENTED;
881
882  out:
883         if (rx->sta)
884                 rx->sta->rx_packets++;
885         if (is_multicast_ether_addr(hdr->addr1))
886                 rx->local->dot11MulticastReceivedFrameCount++;
887         else
888                 ieee80211_led_rx(rx->local);
889         return TXRX_CONTINUE;
890 }
891
892 static ieee80211_txrx_result
893 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
894 {
895         struct sk_buff *skb;
896         int no_pending_pkts;
897         DECLARE_MAC_BUF(mac);
898
899         if (likely(!rx->sta ||
900                    (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
901                    (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
902                    !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
903                 return TXRX_CONTINUE;
904
905         skb = skb_dequeue(&rx->sta->tx_filtered);
906         if (!skb) {
907                 skb = skb_dequeue(&rx->sta->ps_tx_buf);
908                 if (skb)
909                         rx->local->total_ps_buffered--;
910         }
911         no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
912                 skb_queue_empty(&rx->sta->ps_tx_buf);
913
914         if (skb) {
915                 struct ieee80211_hdr *hdr =
916                         (struct ieee80211_hdr *) skb->data;
917
918                 /* tell TX path to send one frame even though the STA may
919                  * still remain is PS mode after this frame exchange */
920                 rx->sta->pspoll = 1;
921
922 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
923                 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
924                        print_mac(mac, rx->sta->addr), rx->sta->aid,
925                        skb_queue_len(&rx->sta->ps_tx_buf));
926 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
927
928                 /* Use MoreData flag to indicate whether there are more
929                  * buffered frames for this STA */
930                 if (no_pending_pkts) {
931                         hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
932                         rx->sta->flags &= ~WLAN_STA_TIM;
933                 } else
934                         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
935
936                 dev_queue_xmit(skb);
937
938                 if (no_pending_pkts) {
939                         if (rx->local->ops->set_tim)
940                                 rx->local->ops->set_tim(local_to_hw(rx->local),
941                                                        rx->sta->aid, 0);
942                         if (rx->sdata->bss)
943                                 bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
944                 }
945 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
946         } else if (!rx->u.rx.sent_ps_buffered) {
947                 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
948                        "though there is no buffered frames for it\n",
949                        rx->dev->name, print_mac(mac, rx->sta->addr));
950 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
951
952         }
953
954         /* Free PS Poll skb here instead of returning TXRX_DROP that would
955          * count as an dropped frame. */
956         dev_kfree_skb(rx->skb);
957
958         return TXRX_QUEUED;
959 }
960
961 static ieee80211_txrx_result
962 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
963 {
964         u16 fc = rx->fc;
965         u8 *data = rx->skb->data;
966         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
967
968         if (!WLAN_FC_IS_QOS_DATA(fc))
969                 return TXRX_CONTINUE;
970
971         /* remove the qos control field, update frame type and meta-data */
972         memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
973         hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
974         /* change frame type to non QOS */
975         rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
976         hdr->frame_control = cpu_to_le16(fc);
977
978         return TXRX_CONTINUE;
979 }
980
981 static ieee80211_txrx_result
982 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data *rx)
983 {
984         if (rx->sdata->eapol && ieee80211_is_eapol(rx->skb) &&
985             rx->sdata->type != IEEE80211_IF_TYPE_STA &&
986             (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
987                 /* Pass both encrypted and unencrypted EAPOL frames to user
988                  * space for processing. */
989                 if (!rx->local->apdev)
990                         return TXRX_DROP;
991                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
992                                   ieee80211_msg_normal);
993                 return TXRX_QUEUED;
994         }
995
996         if (unlikely(rx->sdata->ieee802_1x &&
997                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
998                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
999                      (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)) &&
1000                      !ieee80211_is_eapol(rx->skb))) {
1001 #ifdef CONFIG_MAC80211_DEBUG
1002                 struct ieee80211_hdr *hdr =
1003                         (struct ieee80211_hdr *) rx->skb->data;
1004                 DECLARE_MAC_BUF(mac);
1005                 printk(KERN_DEBUG "%s: dropped frame from %s"
1006                        " (unauthorized port)\n", rx->dev->name,
1007                        print_mac(mac, hdr->addr2));
1008 #endif /* CONFIG_MAC80211_DEBUG */
1009                 return TXRX_DROP;
1010         }
1011
1012         return TXRX_CONTINUE;
1013 }
1014
1015 static ieee80211_txrx_result
1016 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data *rx)
1017 {
1018         /*
1019          * Pass through unencrypted frames if the hardware has
1020          * decrypted them already.
1021          */
1022         if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED)
1023                 return TXRX_CONTINUE;
1024
1025         /* Drop unencrypted frames if key is set. */
1026         if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
1027                      (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
1028                      (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1029                      (rx->key || rx->sdata->drop_unencrypted) &&
1030                      (rx->sdata->eapol == 0 ||
1031                       !ieee80211_is_eapol(rx->skb)))) {
1032                 if (net_ratelimit())
1033                         printk(KERN_DEBUG "%s: RX non-WEP frame, but expected "
1034                                "encryption\n", rx->dev->name);
1035                 return TXRX_DROP;
1036         }
1037         return TXRX_CONTINUE;
1038 }
1039
1040 static ieee80211_txrx_result
1041 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
1042 {
1043         struct net_device *dev = rx->dev;
1044         struct ieee80211_local *local = rx->local;
1045         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1046         u16 fc, hdrlen, ethertype;
1047         u8 *payload;
1048         u8 dst[ETH_ALEN];
1049         u8 src[ETH_ALEN];
1050         struct sk_buff *skb = rx->skb, *skb2;
1051         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1052         DECLARE_MAC_BUF(mac);
1053         DECLARE_MAC_BUF(mac2);
1054         DECLARE_MAC_BUF(mac3);
1055         DECLARE_MAC_BUF(mac4);
1056
1057         fc = rx->fc;
1058         if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1059                 return TXRX_CONTINUE;
1060
1061         if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1062                 return TXRX_DROP;
1063
1064         hdrlen = ieee80211_get_hdrlen(fc);
1065
1066         /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1067          * header
1068          * IEEE 802.11 address fields:
1069          * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1070          *   0     0   DA    SA    BSSID n/a
1071          *   0     1   DA    BSSID SA    n/a
1072          *   1     0   BSSID SA    DA    n/a
1073          *   1     1   RA    TA    DA    SA
1074          */
1075
1076         switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1077         case IEEE80211_FCTL_TODS:
1078                 /* BSSID SA DA */
1079                 memcpy(dst, hdr->addr3, ETH_ALEN);
1080                 memcpy(src, hdr->addr2, ETH_ALEN);
1081
1082                 if (unlikely(sdata->type != IEEE80211_IF_TYPE_AP &&
1083                              sdata->type != IEEE80211_IF_TYPE_VLAN)) {
1084                         if (net_ratelimit())
1085                                 printk(KERN_DEBUG "%s: dropped ToDS frame "
1086                                        "(BSSID=%s SA=%s DA=%s)\n",
1087                                        dev->name,
1088                                        print_mac(mac, hdr->addr1),
1089                                        print_mac(mac2, hdr->addr2),
1090                                        print_mac(mac3, hdr->addr3));
1091                         return TXRX_DROP;
1092                 }
1093                 break;
1094         case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1095                 /* RA TA DA SA */
1096                 memcpy(dst, hdr->addr3, ETH_ALEN);
1097                 memcpy(src, hdr->addr4, ETH_ALEN);
1098
1099                 if (unlikely(sdata->type != IEEE80211_IF_TYPE_WDS)) {
1100                         if (net_ratelimit())
1101                                 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
1102                                        "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1103                                        rx->dev->name,
1104                                        print_mac(mac, hdr->addr1),
1105                                        print_mac(mac2, hdr->addr2),
1106                                        print_mac(mac3, hdr->addr3),
1107                                        print_mac(mac4, hdr->addr4));
1108                         return TXRX_DROP;
1109                 }
1110                 break;
1111         case IEEE80211_FCTL_FROMDS:
1112                 /* DA BSSID SA */
1113                 memcpy(dst, hdr->addr1, ETH_ALEN);
1114                 memcpy(src, hdr->addr3, ETH_ALEN);
1115
1116                 if (sdata->type != IEEE80211_IF_TYPE_STA ||
1117                     (is_multicast_ether_addr(dst) &&
1118                      !compare_ether_addr(src, dev->dev_addr)))
1119                         return TXRX_DROP;
1120                 break;
1121         case 0:
1122                 /* DA SA BSSID */
1123                 memcpy(dst, hdr->addr1, ETH_ALEN);
1124                 memcpy(src, hdr->addr2, ETH_ALEN);
1125
1126                 if (sdata->type != IEEE80211_IF_TYPE_IBSS) {
1127                         if (net_ratelimit()) {
1128                                 printk(KERN_DEBUG "%s: dropped IBSS frame "
1129                                        "(DA=%s SA=%s BSSID=%s)\n",
1130                                        dev->name,
1131                                        print_mac(mac, hdr->addr1),
1132                                        print_mac(mac2, hdr->addr2),
1133                                        print_mac(mac3, hdr->addr3));
1134                         }
1135                         return TXRX_DROP;
1136                 }
1137                 break;
1138         }
1139
1140         payload = skb->data + hdrlen;
1141
1142         if (unlikely(skb->len - hdrlen < 8)) {
1143                 if (net_ratelimit()) {
1144                         printk(KERN_DEBUG "%s: RX too short data frame "
1145                                "payload\n", dev->name);
1146                 }
1147                 return TXRX_DROP;
1148         }
1149
1150         ethertype = (payload[6] << 8) | payload[7];
1151
1152         if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1153                     ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1154                    compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1155                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1156                  * replace EtherType */
1157                 skb_pull(skb, hdrlen + 6);
1158                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1159                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1160         } else {
1161                 struct ethhdr *ehdr;
1162                 __be16 len;
1163                 skb_pull(skb, hdrlen);
1164                 len = htons(skb->len);
1165                 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1166                 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1167                 memcpy(ehdr->h_source, src, ETH_ALEN);
1168                 ehdr->h_proto = len;
1169         }
1170         skb->dev = dev;
1171
1172         skb2 = NULL;
1173
1174         dev->stats.rx_packets++;
1175         dev->stats.rx_bytes += skb->len;
1176
1177         if (local->bridge_packets && (sdata->type == IEEE80211_IF_TYPE_AP
1178             || sdata->type == IEEE80211_IF_TYPE_VLAN) &&
1179             (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
1180                 if (is_multicast_ether_addr(skb->data)) {
1181                         /* send multicast frames both to higher layers in
1182                          * local net stack and back to the wireless media */
1183                         skb2 = skb_copy(skb, GFP_ATOMIC);
1184                         if (!skb2 && net_ratelimit())
1185                                 printk(KERN_DEBUG "%s: failed to clone "
1186                                        "multicast frame\n", dev->name);
1187                 } else {
1188                         struct sta_info *dsta;
1189                         dsta = sta_info_get(local, skb->data);
1190                         if (dsta && !dsta->dev) {
1191                                 if (net_ratelimit())
1192                                         printk(KERN_DEBUG "Station with null "
1193                                                "dev structure!\n");
1194                         } else if (dsta && dsta->dev == dev) {
1195                                 /* Destination station is associated to this
1196                                  * AP, so send the frame directly to it and
1197                                  * do not pass the frame to local net stack.
1198                                  */
1199                                 skb2 = skb;
1200                                 skb = NULL;
1201                         }
1202                         if (dsta)
1203                                 sta_info_put(dsta);
1204                 }
1205         }
1206
1207         if (skb) {
1208                 /* deliver to local stack */
1209                 skb->protocol = eth_type_trans(skb, dev);
1210                 memset(skb->cb, 0, sizeof(skb->cb));
1211                 netif_rx(skb);
1212         }
1213
1214         if (skb2) {
1215                 /* send to wireless media */
1216                 skb2->protocol = __constant_htons(ETH_P_802_3);
1217                 skb_set_network_header(skb2, 0);
1218                 skb_set_mac_header(skb2, 0);
1219                 dev_queue_xmit(skb2);
1220         }
1221
1222         return TXRX_QUEUED;
1223 }
1224
1225 static ieee80211_txrx_result
1226 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
1227 {
1228         struct ieee80211_sub_if_data *sdata;
1229
1230         if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
1231                 return TXRX_DROP;
1232
1233         sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1234         if ((sdata->type == IEEE80211_IF_TYPE_STA ||
1235              sdata->type == IEEE80211_IF_TYPE_IBSS) &&
1236             !rx->local->user_space_mlme) {
1237                 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
1238         } else {
1239                 /* Management frames are sent to hostapd for processing */
1240                 if (!rx->local->apdev)
1241                         return TXRX_DROP;
1242                 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
1243                                   ieee80211_msg_normal);
1244         }
1245         return TXRX_QUEUED;
1246 }
1247
1248 static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
1249                                 struct ieee80211_local *local,
1250                                 ieee80211_rx_handler *handlers,
1251                                 struct ieee80211_txrx_data *rx,
1252                                 struct sta_info *sta)
1253 {
1254         ieee80211_rx_handler *handler;
1255         ieee80211_txrx_result res = TXRX_DROP;
1256
1257         for (handler = handlers; *handler != NULL; handler++) {
1258                 res = (*handler)(rx);
1259
1260                 switch (res) {
1261                 case TXRX_CONTINUE:
1262                         continue;
1263                 case TXRX_DROP:
1264                         I802_DEBUG_INC(local->rx_handlers_drop);
1265                         if (sta)
1266                                 sta->rx_dropped++;
1267                         break;
1268                 case TXRX_QUEUED:
1269                         I802_DEBUG_INC(local->rx_handlers_queued);
1270                         break;
1271                 }
1272                 break;
1273         }
1274
1275         if (res == TXRX_DROP)
1276                 dev_kfree_skb(rx->skb);
1277         return res;
1278 }
1279
1280 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
1281                                                 ieee80211_rx_handler *handlers,
1282                                                 struct ieee80211_txrx_data *rx,
1283                                                 struct sta_info *sta)
1284 {
1285         if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
1286             TXRX_CONTINUE)
1287                 dev_kfree_skb(rx->skb);
1288 }
1289
1290 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1291                                             struct ieee80211_hdr *hdr,
1292                                             struct sta_info *sta,
1293                                             struct ieee80211_txrx_data *rx)
1294 {
1295         int keyidx, hdrlen;
1296         DECLARE_MAC_BUF(mac);
1297         DECLARE_MAC_BUF(mac2);
1298
1299         hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1300         if (rx->skb->len >= hdrlen + 4)
1301                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1302         else
1303                 keyidx = -1;
1304
1305         if (net_ratelimit())
1306                 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1307                        "failure from %s to %s keyidx=%d\n",
1308                        dev->name, print_mac(mac, hdr->addr2),
1309                        print_mac(mac2, hdr->addr1), keyidx);
1310
1311         if (!sta) {
1312                 /*
1313                  * Some hardware seem to generate incorrect Michael MIC
1314                  * reports; ignore them to avoid triggering countermeasures.
1315                  */
1316                 if (net_ratelimit())
1317                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1318                                "error for unknown address %s\n",
1319                                dev->name, print_mac(mac, hdr->addr2));
1320                 goto ignore;
1321         }
1322
1323         if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1324                 if (net_ratelimit())
1325                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1326                                "error for a frame with no PROTECTED flag (src "
1327                                "%s)\n", dev->name, print_mac(mac, hdr->addr2));
1328                 goto ignore;
1329         }
1330
1331         if (rx->sdata->type == IEEE80211_IF_TYPE_AP && keyidx) {
1332                 /*
1333                  * APs with pairwise keys should never receive Michael MIC
1334                  * errors for non-zero keyidx because these are reserved for
1335                  * group keys and only the AP is sending real multicast
1336                  * frames in the BSS.
1337                  */
1338                 if (net_ratelimit())
1339                         printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1340                                "a frame with non-zero keyidx (%d)"
1341                                " (src %s)\n", dev->name, keyidx,
1342                                print_mac(mac, hdr->addr2));
1343                 goto ignore;
1344         }
1345
1346         if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1347             ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1348              (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1349                 if (net_ratelimit())
1350                         printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1351                                "error for a frame that cannot be encrypted "
1352                                "(fc=0x%04x) (src %s)\n",
1353                                dev->name, rx->fc, print_mac(mac, hdr->addr2));
1354                 goto ignore;
1355         }
1356
1357         mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1358  ignore:
1359         dev_kfree_skb(rx->skb);
1360         rx->skb = NULL;
1361 }
1362
1363 ieee80211_rx_handler ieee80211_rx_handlers[] =
1364 {
1365         ieee80211_rx_h_if_stats,
1366         ieee80211_rx_h_passive_scan,
1367         ieee80211_rx_h_check,
1368         ieee80211_rx_h_load_key,
1369         ieee80211_rx_h_sta_process,
1370         ieee80211_rx_h_wep_weak_iv_detection,
1371         ieee80211_rx_h_decrypt,
1372         ieee80211_rx_h_defragment,
1373         ieee80211_rx_h_ps_poll,
1374         ieee80211_rx_h_michael_mic_verify,
1375         /* this must be after decryption - so header is counted in MPDU mic
1376          * must be before pae and data, so QOS_DATA format frames
1377          * are not passed to user space by these functions
1378          */
1379         ieee80211_rx_h_remove_qos_control,
1380         ieee80211_rx_h_802_1x_pae,
1381         ieee80211_rx_h_drop_unencrypted,
1382         ieee80211_rx_h_data,
1383         ieee80211_rx_h_mgmt,
1384         NULL
1385 };
1386
1387 /* main receive path */
1388
1389 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1390                                 u8 *bssid, struct ieee80211_txrx_data *rx,
1391                                 struct ieee80211_hdr *hdr)
1392 {
1393         int multicast = is_multicast_ether_addr(hdr->addr1);
1394
1395         switch (sdata->type) {
1396         case IEEE80211_IF_TYPE_STA:
1397                 if (!bssid)
1398                         return 0;
1399                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1400                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1401                                 return 0;
1402                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1403                 } else if (!multicast &&
1404                            compare_ether_addr(sdata->dev->dev_addr,
1405                                               hdr->addr1) != 0) {
1406                         if (!(sdata->dev->flags & IFF_PROMISC))
1407                                 return 0;
1408                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1409                 }
1410                 break;
1411         case IEEE80211_IF_TYPE_IBSS:
1412                 if (!bssid)
1413                         return 0;
1414                 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1415                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1416                                 return 0;
1417                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1418                 } else if (!multicast &&
1419                            compare_ether_addr(sdata->dev->dev_addr,
1420                                               hdr->addr1) != 0) {
1421                         if (!(sdata->dev->flags & IFF_PROMISC))
1422                                 return 0;
1423                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1424                 } else if (!rx->sta)
1425                         rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1426                                                          bssid, hdr->addr2);
1427                 break;
1428         case IEEE80211_IF_TYPE_VLAN:
1429         case IEEE80211_IF_TYPE_AP:
1430                 if (!bssid) {
1431                         if (compare_ether_addr(sdata->dev->dev_addr,
1432                                                hdr->addr1))
1433                                 return 0;
1434                 } else if (!ieee80211_bssid_match(bssid,
1435                                         sdata->dev->dev_addr)) {
1436                         if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1437                                 return 0;
1438                         rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1439                 }
1440                 if (sdata->dev == sdata->local->mdev &&
1441                     !(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1442                         /* do not receive anything via
1443                          * master device when not scanning */
1444                         return 0;
1445                 break;
1446         case IEEE80211_IF_TYPE_WDS:
1447                 if (bssid ||
1448                     (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1449                         return 0;
1450                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1451                         return 0;
1452                 break;
1453         case IEEE80211_IF_TYPE_MNTR:
1454                 /* take everything */
1455                 break;
1456         case IEEE80211_IF_TYPE_MGMT:
1457                 /* should never get here */
1458                 WARN_ON(1);
1459                 break;
1460         }
1461
1462         return 1;
1463 }
1464
1465 /*
1466  * This is the receive path handler. It is called by a low level driver when an
1467  * 802.11 MPDU is received from the hardware.
1468  */
1469 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
1470                     struct ieee80211_rx_status *status)
1471 {
1472         struct ieee80211_local *local = hw_to_local(hw);
1473         struct ieee80211_sub_if_data *sdata;
1474         struct sta_info *sta;
1475         struct ieee80211_hdr *hdr;
1476         struct ieee80211_txrx_data rx;
1477         u16 type;
1478         int prepres;
1479         struct ieee80211_sub_if_data *prev = NULL;
1480         struct sk_buff *skb_new;
1481         u8 *bssid;
1482
1483         /*
1484          * key references and virtual interfaces are protected using RCU
1485          * and this requires that we are in a read-side RCU section during
1486          * receive processing
1487          */
1488         rcu_read_lock();
1489
1490         /*
1491          * Frames with failed FCS/PLCP checksum are not returned,
1492          * all other frames are returned without radiotap header
1493          * if it was previously present.
1494          * Also, frames with less than 16 bytes are dropped.
1495          */
1496         skb = ieee80211_rx_monitor(local, skb, status);
1497         if (!skb) {
1498                 rcu_read_unlock();
1499                 return;
1500         }
1501
1502         hdr = (struct ieee80211_hdr *) skb->data;
1503         memset(&rx, 0, sizeof(rx));
1504         rx.skb = skb;
1505         rx.local = local;
1506
1507         rx.u.rx.status = status;
1508         rx.fc = le16_to_cpu(hdr->frame_control);
1509         type = rx.fc & IEEE80211_FCTL_FTYPE;
1510
1511         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
1512                 local->dot11ReceivedFragmentCount++;
1513
1514         sta = rx.sta = sta_info_get(local, hdr->addr2);
1515         if (sta) {
1516                 rx.dev = rx.sta->dev;
1517                 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
1518         }
1519
1520         if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1521                 ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
1522                 goto end;
1523         }
1524
1525         if (unlikely(local->sta_scanning))
1526                 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
1527
1528         if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
1529                                            sta) != TXRX_CONTINUE)
1530                 goto end;
1531         skb = rx.skb;
1532
1533         if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
1534             !local->iff_promiscs && !is_multicast_ether_addr(hdr->addr1)) {
1535                 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1536                 ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
1537                                              rx.sta);
1538                 sta_info_put(sta);
1539                 rcu_read_unlock();
1540                 return;
1541         }
1542
1543         bssid = ieee80211_get_bssid(hdr, skb->len);
1544
1545         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1546                 if (!netif_running(sdata->dev))
1547                         continue;
1548
1549                 if (sdata->type == IEEE80211_IF_TYPE_MNTR)
1550                         continue;
1551
1552                 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1553                 prepres = prepare_for_handlers(sdata, bssid, &rx, hdr);
1554                 /* prepare_for_handlers can change sta */
1555                 sta = rx.sta;
1556
1557                 if (!prepres)
1558                         continue;
1559
1560                 /*
1561                  * frame is destined for this interface, but if it's not
1562                  * also for the previous one we handle that after the
1563                  * loop to avoid copying the SKB once too much
1564                  */
1565
1566                 if (!prev) {
1567                         prev = sdata;
1568                         continue;
1569                 }
1570
1571                 /*
1572                  * frame was destined for the previous interface
1573                  * so invoke RX handlers for it
1574                  */
1575
1576                 skb_new = skb_copy(skb, GFP_ATOMIC);
1577                 if (!skb_new) {
1578                         if (net_ratelimit())
1579                                 printk(KERN_DEBUG "%s: failed to copy "
1580                                        "multicast frame for %s",
1581                                        wiphy_name(local->hw.wiphy),
1582                                        prev->dev->name);
1583                         continue;
1584                 }
1585                 rx.skb = skb_new;
1586                 rx.dev = prev->dev;
1587                 rx.sdata = prev;
1588                 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1589                                              &rx, sta);
1590                 prev = sdata;
1591         }
1592         if (prev) {
1593                 rx.skb = skb;
1594                 rx.dev = prev->dev;
1595                 rx.sdata = prev;
1596                 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1597                                              &rx, sta);
1598         } else
1599                 dev_kfree_skb(skb);
1600
1601  end:
1602         rcu_read_unlock();
1603
1604         if (sta)
1605                 sta_info_put(sta);
1606 }
1607 EXPORT_SYMBOL(__ieee80211_rx);
1608
1609 /* This is a version of the rx handler that can be called from hard irq
1610  * context. Post the skb on the queue and schedule the tasklet */
1611 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
1612                           struct ieee80211_rx_status *status)
1613 {
1614         struct ieee80211_local *local = hw_to_local(hw);
1615
1616         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
1617
1618         skb->dev = local->mdev;
1619         /* copy status into skb->cb for use by tasklet */
1620         memcpy(skb->cb, status, sizeof(*status));
1621         skb->pkt_type = IEEE80211_RX_MSG;
1622         skb_queue_tail(&local->skb_queue, skb);
1623         tasklet_schedule(&local->tasklet);
1624 }
1625 EXPORT_SYMBOL(ieee80211_rx_irqsafe);