00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012 #include <linux/jiffies.h>
00013 #include <linux/slab.h>
00014 #include <linux/kernel.h>
00015 #include <linux/skbuff.h>
00016 #include <linux/netdevice.h>
00017 #include <linux/etherdevice.h>
00018 #include <linux/rcupdate.h>
00019 #include <linux/export.h>
00020 #include <net/mac80211.h>
00021 #include <net/ieee80211_radiotap.h>
00022
00023 #include "ieee80211_i.h"
00024 #include "driver-ops.h"
00025 #include "led.h"
00026 #include "mesh.h"
00027 #include "wep.h"
00028 #include "wpa.h"
00029 #include "tkip.h"
00030 #include "wme.h"
00031 #include "rt_wmp.h"
00032
00033
00034
00035
00036
00037
00038
00039 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
00040 struct sk_buff *skb)
00041 {
00042 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
00043 if (likely(skb->len > FCS_LEN))
00044 __pskb_trim(skb, skb->len - FCS_LEN);
00045 else {
00046
00047 WARN_ON(1);
00048 dev_kfree_skb(skb);
00049 skb = NULL;
00050 }
00051 }
00052
00053 return skb;
00054 }
00055
00056 static inline int should_drop_frame(struct sk_buff *skb,
00057 int present_fcs_len)
00058 {
00059 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
00060 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
00061
00062 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
00063 return 1;
00064 if (unlikely(skb->len < 16 + present_fcs_len))
00065 return 1;
00066 if (ieee80211_is_ctl(hdr->frame_control) &&
00067 !ieee80211_is_pspoll(hdr->frame_control) &&
00068 !ieee80211_is_back_req(hdr->frame_control))
00069 return 1;
00070 return 0;
00071 }
00072
00073 static int
00074 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
00075 struct ieee80211_rx_status *status)
00076 {
00077 int len;
00078
00079
00080 len = sizeof(struct ieee80211_radiotap_header) + 9;
00081
00082 if (status->flag & RX_FLAG_MACTIME_MPDU)
00083 len += 8;
00084 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
00085 len += 1;
00086
00087 if (len & 1)
00088 len++;
00089
00090 if (status->flag & RX_FLAG_HT)
00091 len += 3;
00092
00093 return len;
00094 }
00095
00096
00097
00098
00099
00100
00101 static void
00102 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
00103 struct sk_buff *skb,
00104 struct ieee80211_rate *rate,
00105 int rtap_len)
00106 {
00107 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
00108 struct ieee80211_radiotap_header *rthdr;
00109 unsigned char *pos;
00110 u16 rx_flags = 0;
00111
00112 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
00113 memset(rthdr, 0, rtap_len);
00114
00115
00116 rthdr->it_present =
00117 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
00118 (1 << IEEE80211_RADIOTAP_CHANNEL) |
00119 (1 << IEEE80211_RADIOTAP_ANTENNA) |
00120 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
00121 rthdr->it_len = cpu_to_le16(rtap_len);
00122
00123 pos = (unsigned char *)(rthdr+1);
00124
00125
00126
00127
00128 if (status->flag & RX_FLAG_MACTIME_MPDU) {
00129 put_unaligned_le64(status->mactime, pos);
00130 rthdr->it_present |=
00131 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
00132 pos += 8;
00133 }
00134
00135
00136 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
00137 *pos |= IEEE80211_RADIOTAP_F_FCS;
00138 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
00139 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
00140 if (status->flag & RX_FLAG_SHORTPRE)
00141 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
00142 pos++;
00143
00144
00145 if (!rate || status->flag & RX_FLAG_HT) {
00146
00147
00148
00149
00150
00151
00152 *pos = 0;
00153 } else {
00154 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
00155 *pos = rate->bitrate / 5;
00156 }
00157 pos++;
00158
00159
00160 put_unaligned_le16(status->freq, pos);
00161 pos += 2;
00162 if (status->band == IEEE80211_BAND_5GHZ)
00163 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
00164 pos);
00165 else if (status->flag & RX_FLAG_HT)
00166 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
00167 pos);
00168 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
00169 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
00170 pos);
00171 else if (rate)
00172 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
00173 pos);
00174 else
00175 put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
00176 pos += 2;
00177
00178
00179 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
00180 *pos = status->signal;
00181 rthdr->it_present |=
00182 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
00183 pos++;
00184 }
00185
00186
00187
00188
00189 *pos = status->antenna;
00190 pos++;
00191
00192
00193
00194
00195
00196 if ((pos - (u8 *)rthdr) & 1)
00197 pos++;
00198 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
00199 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
00200 put_unaligned_le16(rx_flags, pos);
00201 pos += 2;
00202
00203 if (status->flag & RX_FLAG_HT) {
00204 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
00205 *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
00206 IEEE80211_RADIOTAP_MCS_HAVE_GI |
00207 IEEE80211_RADIOTAP_MCS_HAVE_BW;
00208 *pos = 0;
00209 if (status->flag & RX_FLAG_SHORT_GI)
00210 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
00211 if (status->flag & RX_FLAG_40MHZ)
00212 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
00213 pos++;
00214 *pos++ = status->rate_idx;
00215 }
00216 }
00217
00218
00219
00220
00221
00222
00223 static struct sk_buff *
00224 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
00225 struct ieee80211_rate *rate)
00226 {
00227 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
00228 struct ieee80211_sub_if_data *sdata;
00229 int needed_headroom = 0;
00230 struct sk_buff *skb, *skb2;
00231 struct net_device *prev_dev = NULL;
00232 int present_fcs_len = 0;
00233
00234
00235
00236
00237
00238
00239
00240
00241
00242
00243
00244 needed_headroom = ieee80211_rx_radiotap_len(local, status);
00245
00246 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
00247 present_fcs_len = FCS_LEN;
00248
00249
00250 if (!pskb_may_pull(origskb, 2)) {
00251 dev_kfree_skb(origskb);
00252 return NULL;
00253 }
00254
00255
00256
00257 if (rt_wmp_is_active()){
00258 struct sk_buff * skb3;
00259 skb3 = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
00260 skb3 = remove_monitor_info(local, skb3);
00261 ieee80211_add_rx_radiotap_header(local, skb3, rate, needed_headroom);
00262
00263
00264 rt_wmp_netif_receive_skb(skb3,status->signal);
00265 }
00266
00267
00268 if (!local->monitors) {
00269 if (should_drop_frame(origskb, present_fcs_len)) {
00270 dev_kfree_skb(origskb);
00271 return NULL;
00272 }
00273
00274 return remove_monitor_info(local, origskb);
00275 }
00276
00277 if (should_drop_frame(origskb, present_fcs_len)) {
00278
00279 skb = origskb;
00280 origskb = NULL;
00281
00282
00283
00284
00285
00286
00287
00288
00289 if (skb_headroom(skb) < needed_headroom &&
00290 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
00291 dev_kfree_skb(skb);
00292 return NULL;
00293 }
00294 } else {
00295
00296
00297
00298
00299 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
00300
00301 origskb = remove_monitor_info(local, origskb);
00302
00303 if (!skb)
00304 return origskb;
00305 }
00306
00307
00308 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
00309
00310 skb_reset_mac_header(skb);
00311 skb->ip_summed = CHECKSUM_UNNECESSARY;
00312 skb->pkt_type = PACKET_OTHERHOST;
00313 skb->protocol = htons(ETH_P_802_2);
00314
00315 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
00316 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
00317 continue;
00318
00319 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
00320 continue;
00321
00322 if (!ieee80211_sdata_running(sdata))
00323 continue;
00324
00325 if (prev_dev) {
00326 skb2 = skb_clone(skb, GFP_ATOMIC);
00327 if (skb2) {
00328 skb2->dev = prev_dev;
00329 netif_receive_skb(skb2);
00330 }
00331 }
00332
00333 prev_dev = sdata->dev;
00334 sdata->dev->stats.rx_packets++;
00335 sdata->dev->stats.rx_bytes += skb->len;
00336 }
00337
00338 if (prev_dev) {
00339 skb->dev = prev_dev;
00340 netif_receive_skb(skb);
00341 } else
00342 dev_kfree_skb(skb);
00343
00344 return origskb;
00345 }
00346
00347
00348 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
00349 {
00350 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
00351 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
00352 int tid, seqno_idx, security_idx;
00353
00354
00355 if (ieee80211_is_data_qos(hdr->frame_control)) {
00356 u8 *qc = ieee80211_get_qos_ctl(hdr);
00357
00358 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
00359 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
00360 status->rx_flags |= IEEE80211_RX_AMSDU;
00361
00362 seqno_idx = tid;
00363 security_idx = tid;
00364 } else {
00365
00366
00367
00368
00369
00370
00371
00372
00373
00374
00375
00376 seqno_idx = NUM_RX_DATA_QUEUES;
00377 security_idx = 0;
00378 if (ieee80211_is_mgmt(hdr->frame_control))
00379 security_idx = NUM_RX_DATA_QUEUES;
00380 tid = 0;
00381 }
00382
00383 rx->seqno_idx = seqno_idx;
00384 rx->security_idx = security_idx;
00385
00386
00387 rx->skb->priority = (tid > 7) ? 0 : tid;
00388 }
00389
00415 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
00416 {
00417 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
00418 WARN_ONCE((unsigned long)rx->skb->data & 1,
00419 "unaligned packet at 0x%p\n", rx->skb->data);
00420 #endif
00421 }
00422
00423
00424
00425
00426 static ieee80211_rx_result debug_noinline
00427 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
00428 {
00429 struct ieee80211_local *local = rx->local;
00430 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
00431 struct sk_buff *skb = rx->skb;
00432
00433 if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
00434 !local->sched_scanning))
00435 return RX_CONTINUE;
00436
00437 if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
00438 local->sched_scanning)
00439 return ieee80211_scan_rx(rx->sdata, skb);
00440
00441 if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
00442
00443 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
00444 dev_kfree_skb(skb);
00445 return RX_QUEUED;
00446 }
00447
00448
00449 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
00450 return RX_DROP_UNUSABLE;
00451 }
00452
00453
00454 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
00455 {
00456 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00457
00458 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
00459 return 0;
00460
00461 return ieee80211_is_robust_mgmt_frame(hdr);
00462 }
00463
00464
00465 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
00466 {
00467 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00468
00469 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
00470 return 0;
00471
00472 return ieee80211_is_robust_mgmt_frame(hdr);
00473 }
00474
00475
00476
00477 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
00478 {
00479 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
00480 struct ieee80211_mmie *mmie;
00481
00482 if (skb->len < 24 + sizeof(*mmie) ||
00483 !is_multicast_ether_addr(hdr->da))
00484 return -1;
00485
00486 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
00487 return -1;
00488
00489 mmie = (struct ieee80211_mmie *)
00490 (skb->data + skb->len - sizeof(*mmie));
00491 if (mmie->element_id != WLAN_EID_MMIE ||
00492 mmie->length != sizeof(*mmie) - 2)
00493 return -1;
00494
00495 return le16_to_cpu(mmie->key_id);
00496 }
00497
00498
00499 static ieee80211_rx_result
00500 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
00501 {
00502 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
00503 char *dev_addr = rx->sdata->vif.addr;
00504
00505 if (ieee80211_is_data(hdr->frame_control)) {
00506 if (is_multicast_ether_addr(hdr->addr1)) {
00507 if (ieee80211_has_tods(hdr->frame_control) ||
00508 !ieee80211_has_fromds(hdr->frame_control))
00509 return RX_DROP_MONITOR;
00510 if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
00511 return RX_DROP_MONITOR;
00512 } else {
00513 if (!ieee80211_has_a4(hdr->frame_control))
00514 return RX_DROP_MONITOR;
00515 if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
00516 return RX_DROP_MONITOR;
00517 }
00518 }
00519
00520
00521
00522
00523
00524 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
00525 struct ieee80211_mgmt *mgmt;
00526
00527 if (!ieee80211_is_mgmt(hdr->frame_control))
00528 return RX_DROP_MONITOR;
00529
00530 if (ieee80211_is_action(hdr->frame_control)) {
00531 u8 category;
00532 mgmt = (struct ieee80211_mgmt *)hdr;
00533 category = mgmt->u.action.category;
00534 if (category != WLAN_CATEGORY_MESH_ACTION &&
00535 category != WLAN_CATEGORY_SELF_PROTECTED)
00536 return RX_DROP_MONITOR;
00537 return RX_CONTINUE;
00538 }
00539
00540 if (ieee80211_is_probe_req(hdr->frame_control) ||
00541 ieee80211_is_probe_resp(hdr->frame_control) ||
00542 ieee80211_is_beacon(hdr->frame_control) ||
00543 ieee80211_is_auth(hdr->frame_control))
00544 return RX_CONTINUE;
00545
00546 return RX_DROP_MONITOR;
00547
00548 }
00549
00550 return RX_CONTINUE;
00551 }
00552
00553 #define SEQ_MODULO 0x1000
00554 #define SEQ_MASK 0xfff
00555
00556 static inline int seq_less(u16 sq1, u16 sq2)
00557 {
00558 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
00559 }
00560
00561 static inline u16 seq_inc(u16 sq)
00562 {
00563 return (sq + 1) & SEQ_MASK;
00564 }
00565
00566 static inline u16 seq_sub(u16 sq1, u16 sq2)
00567 {
00568 return (sq1 - sq2) & SEQ_MASK;
00569 }
00570
00571
00572 static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
00573 struct tid_ampdu_rx *tid_agg_rx,
00574 int index)
00575 {
00576 struct ieee80211_local *local = hw_to_local(hw);
00577 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
00578 struct ieee80211_rx_status *status;
00579
00580 lockdep_assert_held(&tid_agg_rx->reorder_lock);
00581
00582 if (!skb)
00583 goto no_frame;
00584
00585
00586 tid_agg_rx->stored_mpdu_num--;
00587 tid_agg_rx->reorder_buf[index] = NULL;
00588 status = IEEE80211_SKB_RXCB(skb);
00589 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
00590 skb_queue_tail(&local->rx_skb_queue, skb);
00591
00592 no_frame:
00593 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
00594 }
00595
00596 static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
00597 struct tid_ampdu_rx *tid_agg_rx,
00598 u16 head_seq_num)
00599 {
00600 int index;
00601
00602 lockdep_assert_held(&tid_agg_rx->reorder_lock);
00603
00604 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
00605 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
00606 tid_agg_rx->buf_size;
00607 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
00608 }
00609 }
00610
00611
00612
00613
00614
00615
00616
00617
00618
00619
00620 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
00621
00622 static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
00623 struct tid_ampdu_rx *tid_agg_rx)
00624 {
00625 int index, j;
00626
00627 lockdep_assert_held(&tid_agg_rx->reorder_lock);
00628
00629
00630 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
00631 tid_agg_rx->buf_size;
00632 if (!tid_agg_rx->reorder_buf[index] &&
00633 tid_agg_rx->stored_mpdu_num) {
00634
00635
00636
00637
00638 int skipped = 1;
00639 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
00640 j = (j + 1) % tid_agg_rx->buf_size) {
00641 if (!tid_agg_rx->reorder_buf[j]) {
00642 skipped++;
00643 continue;
00644 }
00645 if (skipped &&
00646 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
00647 HT_RX_REORDER_BUF_TIMEOUT))
00648 goto set_release_timer;
00649
00650 #ifdef CONFIG_MAC80211_HT_DEBUG
00651 if (net_ratelimit())
00652 wiphy_debug(hw->wiphy,
00653 "release an RX reorder frame due to timeout on earlier frames\n");
00654 #endif
00655 ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
00656
00657
00658
00659
00660 tid_agg_rx->head_seq_num =
00661 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
00662 skipped = 0;
00663 }
00664 } else while (tid_agg_rx->reorder_buf[index]) {
00665 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
00666 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
00667 tid_agg_rx->buf_size;
00668 }
00669
00670 if (tid_agg_rx->stored_mpdu_num) {
00671 j = index = seq_sub(tid_agg_rx->head_seq_num,
00672 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
00673
00674 for (; j != (index - 1) % tid_agg_rx->buf_size;
00675 j = (j + 1) % tid_agg_rx->buf_size) {
00676 if (tid_agg_rx->reorder_buf[j])
00677 break;
00678 }
00679
00680 set_release_timer:
00681
00682 mod_timer(&tid_agg_rx->reorder_timer,
00683 tid_agg_rx->reorder_time[j] + 1 +
00684 HT_RX_REORDER_BUF_TIMEOUT);
00685 } else {
00686 del_timer(&tid_agg_rx->reorder_timer);
00687 }
00688 }
00689
00690
00691
00692
00693
00694
00695 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
00696 struct tid_ampdu_rx *tid_agg_rx,
00697 struct sk_buff *skb)
00698 {
00699 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00700 u16 sc = le16_to_cpu(hdr->seq_ctrl);
00701 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
00702 u16 head_seq_num, buf_size;
00703 int index;
00704 bool ret = true;
00705
00706 spin_lock(&tid_agg_rx->reorder_lock);
00707
00708 buf_size = tid_agg_rx->buf_size;
00709 head_seq_num = tid_agg_rx->head_seq_num;
00710
00711
00712 if (seq_less(mpdu_seq_num, head_seq_num)) {
00713 dev_kfree_skb(skb);
00714 goto out;
00715 }
00716
00717
00718
00719
00720
00721 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
00722 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
00723
00724 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
00725 }
00726
00727
00728
00729 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
00730
00731
00732 if (tid_agg_rx->reorder_buf[index]) {
00733 dev_kfree_skb(skb);
00734 goto out;
00735 }
00736
00737
00738
00739
00740
00741
00742
00743 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
00744 tid_agg_rx->stored_mpdu_num == 0) {
00745 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
00746 ret = false;
00747 goto out;
00748 }
00749
00750
00751 tid_agg_rx->reorder_buf[index] = skb;
00752 tid_agg_rx->reorder_time[index] = jiffies;
00753 tid_agg_rx->stored_mpdu_num++;
00754 ieee80211_sta_reorder_release(hw, tid_agg_rx);
00755
00756 out:
00757 spin_unlock(&tid_agg_rx->reorder_lock);
00758 return ret;
00759 }
00760
00761
00762
00763
00764
00765 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
00766 {
00767 struct sk_buff *skb = rx->skb;
00768 struct ieee80211_local *local = rx->local;
00769 struct ieee80211_hw *hw = &local->hw;
00770 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00771 struct sta_info *sta = rx->sta;
00772 struct tid_ampdu_rx *tid_agg_rx;
00773 u16 sc;
00774 int tid;
00775
00776 if (!ieee80211_is_data_qos(hdr->frame_control))
00777 goto dont_reorder;
00778
00779
00780
00781
00782
00783
00784 if (!sta)
00785 goto dont_reorder;
00786
00787 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
00788
00789 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
00790 if (!tid_agg_rx)
00791 goto dont_reorder;
00792
00793
00794 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
00795 goto dont_reorder;
00796
00797
00798
00799
00800 if (tid_agg_rx->timeout)
00801 mod_timer(&tid_agg_rx->session_timer,
00802 TU_TO_EXP_TIME(tid_agg_rx->timeout));
00803
00804
00805 sc = le16_to_cpu(hdr->seq_ctrl);
00806 if (sc & IEEE80211_SCTL_FRAG) {
00807 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
00808 skb_queue_tail(&rx->sdata->skb_queue, skb);
00809 ieee80211_queue_work(&local->hw, &rx->sdata->work);
00810 return;
00811 }
00812
00813
00814
00815
00816
00817
00818
00819
00820 if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
00821 return;
00822
00823 dont_reorder:
00824 skb_queue_tail(&local->rx_skb_queue, skb);
00825 }
00826
00827 static ieee80211_rx_result debug_noinline
00828 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
00829 {
00830 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
00831 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
00832
00833
00834 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
00835 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
00836 rx->sta->last_seq_ctrl[rx->seqno_idx] ==
00837 hdr->seq_ctrl)) {
00838 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
00839 rx->local->dot11FrameDuplicateCount++;
00840 rx->sta->num_duplicates++;
00841 }
00842 return RX_DROP_UNUSABLE;
00843 } else
00844 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
00845 }
00846
00847 if (unlikely(rx->skb->len < 16)) {
00848 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
00849 return RX_DROP_MONITOR;
00850 }
00851
00852
00853
00854
00855
00856
00857
00858
00859
00860
00861 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
00862 return ieee80211_rx_mesh_check(rx);
00863
00864 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
00865 ieee80211_is_pspoll(hdr->frame_control)) &&
00866 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
00867 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
00868 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
00869 if (rx->sta && rx->sta->dummy &&
00870 ieee80211_is_data_present(hdr->frame_control)) {
00871 u16 ethertype;
00872 u8 *payload;
00873
00874 payload = rx->skb->data +
00875 ieee80211_hdrlen(hdr->frame_control);
00876 ethertype = (payload[6] << 8) | payload[7];
00877 if (cpu_to_be16(ethertype) ==
00878 rx->sdata->control_port_protocol)
00879 return RX_CONTINUE;
00880 }
00881 return RX_DROP_MONITOR;
00882 }
00883
00884 return RX_CONTINUE;
00885 }
00886
00887
00888 static ieee80211_rx_result debug_noinline
00889 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
00890 {
00891 struct sk_buff *skb = rx->skb;
00892 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
00893 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
00894 int keyidx;
00895 int hdrlen;
00896 ieee80211_rx_result result = RX_DROP_UNUSABLE;
00897 struct ieee80211_key *sta_ptk = NULL;
00898 int mmie_keyidx = -1;
00899 __le16 fc;
00900
00901
00902
00903
00904
00905
00906
00907
00908
00909
00910
00911
00912
00913
00914
00915
00916
00917
00918
00919
00920
00921
00922
00923
00924
00925
00926
00927
00928
00929
00930
00931
00932 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
00933 return RX_CONTINUE;
00934
00935
00936 rx->key = NULL;
00937
00938 if (rx->sta)
00939 sta_ptk = rcu_dereference(rx->sta->ptk);
00940
00941 fc = hdr->frame_control;
00942
00943 if (!ieee80211_has_protected(fc))
00944 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
00945
00946 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
00947 rx->key = sta_ptk;
00948 if ((status->flag & RX_FLAG_DECRYPTED) &&
00949 (status->flag & RX_FLAG_IV_STRIPPED))
00950 return RX_CONTINUE;
00951
00952 if (!ieee80211_has_protected(fc))
00953 return RX_CONTINUE;
00954 } else if (mmie_keyidx >= 0) {
00955
00956 if ((status->flag & RX_FLAG_DECRYPTED) &&
00957 (status->flag & RX_FLAG_IV_STRIPPED))
00958 return RX_CONTINUE;
00959
00960 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
00961 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
00962 return RX_DROP_MONITOR;
00963 if (rx->sta)
00964 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
00965 if (!rx->key)
00966 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
00967 } else if (!ieee80211_has_protected(fc)) {
00968
00969
00970
00971
00972
00973
00974 struct ieee80211_key *key = NULL;
00975 struct ieee80211_sub_if_data *sdata = rx->sdata;
00976 int i;
00977
00978 if (ieee80211_is_mgmt(fc) &&
00979 is_multicast_ether_addr(hdr->addr1) &&
00980 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
00981 rx->key = key;
00982 else {
00983 if (rx->sta) {
00984 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
00985 key = rcu_dereference(rx->sta->gtk[i]);
00986 if (key)
00987 break;
00988 }
00989 }
00990 if (!key) {
00991 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
00992 key = rcu_dereference(sdata->keys[i]);
00993 if (key)
00994 break;
00995 }
00996 }
00997 if (key)
00998 rx->key = key;
00999 }
01000 return RX_CONTINUE;
01001 } else {
01002 u8 keyid;
01003
01004
01005
01006
01007
01008
01009
01010
01011
01012 if ((status->flag & RX_FLAG_DECRYPTED) &&
01013 (status->flag & RX_FLAG_IV_STRIPPED))
01014 return RX_CONTINUE;
01015
01016 hdrlen = ieee80211_hdrlen(fc);
01017
01018 if (rx->skb->len < 8 + hdrlen)
01019 return RX_DROP_UNUSABLE;
01020
01021
01022
01023
01024
01025 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
01026 keyidx = keyid >> 6;
01027
01028
01029 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
01030 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
01031
01032
01033 if (!rx->key) {
01034 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
01035
01036
01037
01038
01039
01040
01041 if (rx->key &&
01042 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
01043 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
01044 !is_multicast_ether_addr(hdr->addr1))
01045 rx->key = NULL;
01046 }
01047 }
01048
01049 if (rx->key) {
01050 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
01051 return RX_DROP_MONITOR;
01052
01053 rx->key->tx_rx_count++;
01054
01055 } else {
01056 return RX_DROP_MONITOR;
01057 }
01058
01059 if (skb_linearize(rx->skb))
01060 return RX_DROP_UNUSABLE;
01061
01062
01063 switch (rx->key->conf.cipher) {
01064 case WLAN_CIPHER_SUITE_WEP40:
01065 case WLAN_CIPHER_SUITE_WEP104:
01066
01067 if (rx->sta && ieee80211_is_data(fc) &&
01068 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
01069 !(status->flag & RX_FLAG_DECRYPTED)) &&
01070 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
01071 rx->sta->wep_weak_iv_count++;
01072
01073 result = ieee80211_crypto_wep_decrypt(rx);
01074 break;
01075 case WLAN_CIPHER_SUITE_TKIP:
01076 result = ieee80211_crypto_tkip_decrypt(rx);
01077 break;
01078 case WLAN_CIPHER_SUITE_CCMP:
01079 result = ieee80211_crypto_ccmp_decrypt(rx);
01080 break;
01081 case WLAN_CIPHER_SUITE_AES_CMAC:
01082 result = ieee80211_crypto_aes_cmac_decrypt(rx);
01083 break;
01084 default:
01085
01086
01087
01088
01089 return RX_DROP_UNUSABLE;
01090 }
01091
01092
01093 status->flag |= RX_FLAG_DECRYPTED;
01094
01095 return result;
01096 }
01097
01098 static ieee80211_rx_result debug_noinline
01099 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
01100 {
01101 struct ieee80211_local *local;
01102 struct ieee80211_hdr *hdr;
01103 struct sk_buff *skb;
01104
01105 local = rx->local;
01106 skb = rx->skb;
01107 hdr = (struct ieee80211_hdr *) skb->data;
01108
01109 if (!local->pspolling)
01110 return RX_CONTINUE;
01111
01112 if (!ieee80211_has_fromds(hdr->frame_control))
01113
01114 return RX_CONTINUE;
01115
01116 if (!ieee80211_is_data(hdr->frame_control))
01117 return RX_CONTINUE;
01118
01119 if (!ieee80211_has_moredata(hdr->frame_control)) {
01120
01121 local->pspolling = false;
01122 return RX_CONTINUE;
01123 }
01124
01125
01126 ieee80211_send_pspoll(local, rx->sdata);
01127
01128 return RX_CONTINUE;
01129 }
01130
01131 static void ap_sta_ps_start(struct sta_info *sta)
01132 {
01133 struct ieee80211_sub_if_data *sdata = sta->sdata;
01134 struct ieee80211_local *local = sdata->local;
01135
01136 atomic_inc(&sdata->bss->num_sta_ps);
01137 set_sta_flag(sta, WLAN_STA_PS_STA);
01138 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
01139 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
01140 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
01141 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
01142 sdata->name, sta->sta.addr, sta->sta.aid);
01143 #endif
01144 }
01145
01146 static void ap_sta_ps_end(struct sta_info *sta)
01147 {
01148 struct ieee80211_sub_if_data *sdata = sta->sdata;
01149
01150 atomic_dec(&sdata->bss->num_sta_ps);
01151
01152 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
01153 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
01154 sdata->name, sta->sta.addr, sta->sta.aid);
01155 #endif
01156
01157 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
01158 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
01159 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
01160 sdata->name, sta->sta.addr, sta->sta.aid);
01161 #endif
01162 return;
01163 }
01164
01165 ieee80211_sta_ps_deliver_wakeup(sta);
01166 }
01167
01168 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
01169 {
01170 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
01171 bool in_ps;
01172
01173 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
01174
01175
01176 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
01177 if ((start && in_ps) || (!start && !in_ps))
01178 return -EINVAL;
01179
01180 if (start)
01181 ap_sta_ps_start(sta_inf);
01182 else
01183 ap_sta_ps_end(sta_inf);
01184
01185 return 0;
01186 }
01187 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
01188
01189 static ieee80211_rx_result debug_noinline
01190 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
01191 {
01192 struct ieee80211_sub_if_data *sdata = rx->sdata;
01193 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
01194 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01195 int tid, ac;
01196
01197 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
01198 return RX_CONTINUE;
01199
01200 if (sdata->vif.type != NL80211_IFTYPE_AP &&
01201 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
01202 return RX_CONTINUE;
01203
01204
01205
01206
01207
01208
01209 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
01210 return RX_CONTINUE;
01211
01212
01213
01214
01215
01216
01217 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
01218 return RX_CONTINUE;
01219
01220 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
01221 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
01222 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
01223 ieee80211_sta_ps_deliver_poll_response(rx->sta);
01224 else
01225 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
01226 }
01227
01228
01229
01230 dev_kfree_skb(rx->skb);
01231
01232 return RX_QUEUED;
01233 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
01234 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
01235 ieee80211_has_pm(hdr->frame_control) &&
01236 (ieee80211_is_data_qos(hdr->frame_control) ||
01237 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
01238 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
01239 ac = ieee802_1d_to_ac[tid & 7];
01240
01241
01242
01243
01244
01245
01246
01247
01248 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
01249 return RX_CONTINUE;
01250
01251
01252 if (test_sta_flag(rx->sta, WLAN_STA_SP))
01253 return RX_CONTINUE;
01254
01255 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
01256 ieee80211_sta_ps_deliver_uapsd(rx->sta);
01257 else
01258 set_sta_flag(rx->sta, WLAN_STA_UAPSD);
01259 }
01260
01261 return RX_CONTINUE;
01262 }
01263
01264 static ieee80211_rx_result debug_noinline
01265 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
01266 {
01267 struct sta_info *sta = rx->sta;
01268 struct sk_buff *skb = rx->skb;
01269 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
01270 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
01271
01272 if (!sta)
01273 return RX_CONTINUE;
01274
01275
01276
01277
01278
01279
01280 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
01281 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
01282 NL80211_IFTYPE_ADHOC);
01283 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
01284 sta->last_rx = jiffies;
01285 if (ieee80211_is_data(hdr->frame_control)) {
01286 sta->last_rx_rate_idx = status->rate_idx;
01287 sta->last_rx_rate_flag = status->flag;
01288 }
01289 }
01290 } else if (!is_multicast_ether_addr(hdr->addr1)) {
01291
01292
01293
01294
01295 sta->last_rx = jiffies;
01296 if (ieee80211_is_data(hdr->frame_control)) {
01297 sta->last_rx_rate_idx = status->rate_idx;
01298 sta->last_rx_rate_flag = status->flag;
01299 }
01300 }
01301
01302 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
01303 return RX_CONTINUE;
01304
01305 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
01306 ieee80211_sta_rx_notify(rx->sdata, hdr);
01307
01308 sta->rx_fragments++;
01309 sta->rx_bytes += rx->skb->len;
01310 sta->last_signal = status->signal;
01311 ewma_add(&sta->avg_signal, -status->signal);
01312
01313
01314
01315
01316
01317 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
01318 !ieee80211_has_morefrags(hdr->frame_control) &&
01319 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
01320 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
01321 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
01322 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
01323
01324
01325
01326
01327
01328
01329
01330
01331 if (ieee80211_is_data(hdr->frame_control) &&
01332 !ieee80211_has_pm(hdr->frame_control))
01333 ap_sta_ps_end(sta);
01334 } else {
01335 if (ieee80211_has_pm(hdr->frame_control))
01336 ap_sta_ps_start(sta);
01337 }
01338 }
01339
01340
01341
01342
01343
01344 if (ieee80211_is_nullfunc(hdr->frame_control) ||
01345 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
01346 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
01347
01348
01349
01350
01351
01352
01353
01354 if (ieee80211_has_a4(hdr->frame_control) &&
01355 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
01356 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
01357 !rx->sdata->u.vlan.sta)))
01358 return RX_DROP_MONITOR;
01359
01360
01361
01362
01363 sta->rx_packets++;
01364 dev_kfree_skb(rx->skb);
01365 return RX_QUEUED;
01366 }
01367
01368 return RX_CONTINUE;
01369 }
01370
01371 static inline struct ieee80211_fragment_entry *
01372 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
01373 unsigned int frag, unsigned int seq, int rx_queue,
01374 struct sk_buff **skb)
01375 {
01376 struct ieee80211_fragment_entry *entry;
01377 int idx;
01378
01379 idx = sdata->fragment_next;
01380 entry = &sdata->fragments[sdata->fragment_next++];
01381 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
01382 sdata->fragment_next = 0;
01383
01384 if (!skb_queue_empty(&entry->skb_list)) {
01385 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
01386 struct ieee80211_hdr *hdr =
01387 (struct ieee80211_hdr *) entry->skb_list.next->data;
01388 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
01389 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
01390 "addr1=%pM addr2=%pM\n",
01391 sdata->name, idx,
01392 jiffies - entry->first_frag_time, entry->seq,
01393 entry->last_frag, hdr->addr1, hdr->addr2);
01394 #endif
01395 __skb_queue_purge(&entry->skb_list);
01396 }
01397
01398 __skb_queue_tail(&entry->skb_list, *skb);
01399 *skb = NULL;
01400 entry->first_frag_time = jiffies;
01401 entry->seq = seq;
01402 entry->rx_queue = rx_queue;
01403 entry->last_frag = frag;
01404 entry->ccmp = 0;
01405 entry->extra_len = 0;
01406
01407 return entry;
01408 }
01409
01410 static inline struct ieee80211_fragment_entry *
01411 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
01412 unsigned int frag, unsigned int seq,
01413 int rx_queue, struct ieee80211_hdr *hdr)
01414 {
01415 struct ieee80211_fragment_entry *entry;
01416 int i, idx;
01417
01418 idx = sdata->fragment_next;
01419 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
01420 struct ieee80211_hdr *f_hdr;
01421
01422 idx--;
01423 if (idx < 0)
01424 idx = IEEE80211_FRAGMENT_MAX - 1;
01425
01426 entry = &sdata->fragments[idx];
01427 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
01428 entry->rx_queue != rx_queue ||
01429 entry->last_frag + 1 != frag)
01430 continue;
01431
01432 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
01433
01434
01435
01436
01437 if (((hdr->frame_control ^ f_hdr->frame_control) &
01438 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
01439 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
01440 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
01441 continue;
01442
01443 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
01444 __skb_queue_purge(&entry->skb_list);
01445 continue;
01446 }
01447 return entry;
01448 }
01449
01450 return NULL;
01451 }
01452
01453 static ieee80211_rx_result debug_noinline
01454 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
01455 {
01456 struct ieee80211_hdr *hdr;
01457 u16 sc;
01458 __le16 fc;
01459 unsigned int frag, seq;
01460 struct ieee80211_fragment_entry *entry;
01461 struct sk_buff *skb;
01462 struct ieee80211_rx_status *status;
01463
01464 hdr = (struct ieee80211_hdr *)rx->skb->data;
01465 fc = hdr->frame_control;
01466 sc = le16_to_cpu(hdr->seq_ctrl);
01467 frag = sc & IEEE80211_SCTL_FRAG;
01468
01469 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
01470 (rx->skb)->len < 24 ||
01471 is_multicast_ether_addr(hdr->addr1))) {
01472
01473 goto out;
01474 }
01475 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
01476
01477 if (skb_linearize(rx->skb))
01478 return RX_DROP_UNUSABLE;
01479
01480
01481
01482
01483
01484
01485 hdr = (struct ieee80211_hdr *)rx->skb->data;
01486 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
01487
01488 if (frag == 0) {
01489
01490 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
01491 rx->seqno_idx, &(rx->skb));
01492 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
01493 ieee80211_has_protected(fc)) {
01494 int queue = rx->security_idx;
01495
01496
01497 entry->ccmp = 1;
01498 memcpy(entry->last_pn,
01499 rx->key->u.ccmp.rx_pn[queue],
01500 CCMP_PN_LEN);
01501 }
01502 return RX_QUEUED;
01503 }
01504
01505
01506
01507
01508 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
01509 rx->seqno_idx, hdr);
01510 if (!entry) {
01511 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
01512 return RX_DROP_MONITOR;
01513 }
01514
01515
01516
01517 if (entry->ccmp) {
01518 int i;
01519 u8 pn[CCMP_PN_LEN], *rpn;
01520 int queue;
01521 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
01522 return RX_DROP_UNUSABLE;
01523 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
01524 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
01525 pn[i]++;
01526 if (pn[i])
01527 break;
01528 }
01529 queue = rx->security_idx;
01530 rpn = rx->key->u.ccmp.rx_pn[queue];
01531 if (memcmp(pn, rpn, CCMP_PN_LEN))
01532 return RX_DROP_UNUSABLE;
01533 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
01534 }
01535
01536 skb_pull(rx->skb, ieee80211_hdrlen(fc));
01537 __skb_queue_tail(&entry->skb_list, rx->skb);
01538 entry->last_frag = frag;
01539 entry->extra_len += rx->skb->len;
01540 if (ieee80211_has_morefrags(fc)) {
01541 rx->skb = NULL;
01542 return RX_QUEUED;
01543 }
01544
01545 rx->skb = __skb_dequeue(&entry->skb_list);
01546 if (skb_tailroom(rx->skb) < entry->extra_len) {
01547 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
01548 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
01549 GFP_ATOMIC))) {
01550 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
01551 __skb_queue_purge(&entry->skb_list);
01552 return RX_DROP_UNUSABLE;
01553 }
01554 }
01555 while ((skb = __skb_dequeue(&entry->skb_list))) {
01556 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
01557 dev_kfree_skb(skb);
01558 }
01559
01560
01561 status = IEEE80211_SKB_RXCB(rx->skb);
01562 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
01563
01564 out:
01565 if (rx->sta)
01566 rx->sta->rx_packets++;
01567 if (is_multicast_ether_addr(hdr->addr1))
01568 rx->local->dot11MulticastReceivedFrameCount++;
01569 else
01570 ieee80211_led_rx(rx->local);
01571 return RX_CONTINUE;
01572 }
01573
01574 static ieee80211_rx_result debug_noinline
01575 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
01576 {
01577 u8 *data = rx->skb->data;
01578 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
01579
01580 if (!ieee80211_is_data_qos(hdr->frame_control))
01581 return RX_CONTINUE;
01582
01583
01584 memmove(data + IEEE80211_QOS_CTL_LEN, data,
01585 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
01586 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
01587
01588 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
01589
01590 return RX_CONTINUE;
01591 }
01592
01593 static int
01594 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
01595 {
01596 if (unlikely(!rx->sta ||
01597 !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
01598 return -EACCES;
01599
01600 return 0;
01601 }
01602
01603 static int
01604 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
01605 {
01606 struct sk_buff *skb = rx->skb;
01607 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
01608
01609
01610
01611
01612
01613 if (status->flag & RX_FLAG_DECRYPTED)
01614 return 0;
01615
01616
01617 if (unlikely(!ieee80211_has_protected(fc) &&
01618 !ieee80211_is_nullfunc(fc) &&
01619 ieee80211_is_data(fc) &&
01620 (rx->key || rx->sdata->drop_unencrypted)))
01621 return -EACCES;
01622
01623 return 0;
01624 }
01625
01626 static int
01627 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
01628 {
01629 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
01630 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01631 __le16 fc = hdr->frame_control;
01632
01633
01634
01635
01636
01637 if (status->flag & RX_FLAG_DECRYPTED)
01638 return 0;
01639
01640 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
01641 if (unlikely(!ieee80211_has_protected(fc) &&
01642 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
01643 rx->key)) {
01644 if (ieee80211_is_deauth(fc))
01645 cfg80211_send_unprot_deauth(rx->sdata->dev,
01646 rx->skb->data,
01647 rx->skb->len);
01648 else if (ieee80211_is_disassoc(fc))
01649 cfg80211_send_unprot_disassoc(rx->sdata->dev,
01650 rx->skb->data,
01651 rx->skb->len);
01652 return -EACCES;
01653 }
01654
01655 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
01656 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
01657 if (ieee80211_is_deauth(fc))
01658 cfg80211_send_unprot_deauth(rx->sdata->dev,
01659 rx->skb->data,
01660 rx->skb->len);
01661 else if (ieee80211_is_disassoc(fc))
01662 cfg80211_send_unprot_disassoc(rx->sdata->dev,
01663 rx->skb->data,
01664 rx->skb->len);
01665 return -EACCES;
01666 }
01667
01668
01669
01670
01671 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
01672 ieee80211_is_robust_mgmt_frame(
01673 (struct ieee80211_hdr *) rx->skb->data)))
01674 return -EACCES;
01675 }
01676
01677 return 0;
01678 }
01679
01680 static int
01681 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
01682 {
01683 struct ieee80211_sub_if_data *sdata = rx->sdata;
01684 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
01685 bool check_port_control = false;
01686 struct ethhdr *ehdr;
01687 int ret;
01688
01689 *port_control = false;
01690 if (ieee80211_has_a4(hdr->frame_control) &&
01691 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
01692 return -1;
01693
01694 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
01695 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
01696
01697 if (!sdata->u.mgd.use_4addr)
01698 return -1;
01699 else
01700 check_port_control = true;
01701 }
01702
01703 if (is_multicast_ether_addr(hdr->addr1) &&
01704 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
01705 return -1;
01706
01707 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
01708 if (ret < 0)
01709 return ret;
01710
01711 ehdr = (struct ethhdr *) rx->skb->data;
01712 if (ehdr->h_proto == rx->sdata->control_port_protocol)
01713 *port_control = true;
01714 else if (check_port_control)
01715 return -1;
01716
01717 return 0;
01718 }
01719
01720
01721
01722
01723 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
01724 {
01725 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
01726 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
01727 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
01728
01729
01730
01731
01732
01733 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
01734 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
01735 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
01736 return true;
01737
01738 if (ieee80211_802_1x_port_control(rx) ||
01739 ieee80211_drop_unencrypted(rx, fc))
01740 return false;
01741
01742 return true;
01743 }
01744
01745
01746
01747
01748
01749 static void
01750 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
01751 {
01752 struct ieee80211_sub_if_data *sdata = rx->sdata;
01753 struct net_device *dev = sdata->dev;
01754 struct sk_buff *skb, *xmit_skb;
01755 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
01756 struct sta_info *dsta;
01757
01758 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01759
01760 skb = rx->skb;
01761 xmit_skb = NULL;
01762
01763
01764 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
01765 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
01766 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
01767 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
01768 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
01769 if (is_multicast_ether_addr(ehdr->h_dest)) {
01770
01771
01772
01773
01774 xmit_skb = skb_copy(skb, GFP_ATOMIC);
01775 if (!xmit_skb && net_ratelimit())
01776 printk(KERN_DEBUG "%s: failed to clone "
01777 "multicast frame\n", dev->name);
01778 } else {
01779 dsta = sta_info_get(sdata, skb->data);
01780 if (dsta) {
01781
01782
01783
01784
01785
01786
01787 xmit_skb = skb;
01788 skb = NULL;
01789 }
01790 }
01791 }
01792
01793 if (skb) {
01794 int align __maybe_unused;
01795
01796 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
01797
01798
01799
01800
01801
01802
01803
01804 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
01805 if (align) {
01806 if (WARN_ON(skb_headroom(skb) < 3)) {
01807 dev_kfree_skb(skb);
01808 skb = NULL;
01809 } else {
01810 u8 *data = skb->data;
01811 size_t len = skb_headlen(skb);
01812 skb->data -= align;
01813 memmove(skb->data, data, len);
01814 skb_set_tail_pointer(skb, len);
01815 }
01816 }
01817 #endif
01818
01819 if (skb) {
01820 skb->protocol = eth_type_trans(skb, dev);
01821 memset(skb->cb, 0, sizeof(skb->cb));
01822 netif_receive_skb(skb);
01823 }
01824 }
01825
01826 if (xmit_skb) {
01827
01828 xmit_skb->protocol = htons(ETH_P_802_3);
01829 skb_reset_network_header(xmit_skb);
01830 skb_reset_mac_header(xmit_skb);
01831 dev_queue_xmit(xmit_skb);
01832 }
01833 }
01834
01835
01836
01837
01838 static ieee80211_rx_result debug_noinline
01839 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
01840 {
01841 struct net_device *dev = rx->sdata->dev;
01842 struct sk_buff *skb = rx->skb;
01843 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
01844 __le16 fc = hdr->frame_control;
01845 struct sk_buff_head frame_list;
01846 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01847
01848 if (unlikely(!ieee80211_is_data(fc)))
01849 return RX_CONTINUE;
01850
01851 if (unlikely(!ieee80211_is_data_present(fc)))
01852 return RX_DROP_MONITOR;
01853
01854 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
01855 return RX_CONTINUE;
01856
01857 if (ieee80211_has_a4(hdr->frame_control) &&
01858 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
01859 !rx->sdata->u.vlan.sta)
01860 return RX_DROP_UNUSABLE;
01861
01862 if (is_multicast_ether_addr(hdr->addr1) &&
01863 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
01864 rx->sdata->u.vlan.sta) ||
01865 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
01866 rx->sdata->u.mgd.use_4addr)))
01867 return RX_DROP_UNUSABLE;
01868
01869 skb->dev = dev;
01870 __skb_queue_head_init(&frame_list);
01871
01872 if (skb_linearize(skb))
01873 return RX_DROP_UNUSABLE;
01874
01875 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
01876 rx->sdata->vif.type,
01877 rx->local->hw.extra_tx_headroom, true);
01878
01879 while (!skb_queue_empty(&frame_list)) {
01880 rx->skb = __skb_dequeue(&frame_list);
01881
01882 if (!ieee80211_frame_allowed(rx, fc)) {
01883 dev_kfree_skb(rx->skb);
01884 continue;
01885 }
01886 dev->stats.rx_packets++;
01887 dev->stats.rx_bytes += rx->skb->len;
01888
01889 ieee80211_deliver_skb(rx);
01890 }
01891
01892 return RX_QUEUED;
01893 }
01894
01895 #ifdef CONFIG_MAC80211_MESH
01896 static ieee80211_rx_result
01897 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
01898 {
01899 struct ieee80211_hdr *hdr;
01900 struct ieee80211s_hdr *mesh_hdr;
01901 unsigned int hdrlen;
01902 struct sk_buff *skb = rx->skb, *fwd_skb;
01903 struct ieee80211_local *local = rx->local;
01904 struct ieee80211_sub_if_data *sdata = rx->sdata;
01905 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
01906
01907 hdr = (struct ieee80211_hdr *) skb->data;
01908 hdrlen = ieee80211_hdrlen(hdr->frame_control);
01909 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
01910
01911
01912 if (ieee80211_is_data(hdr->frame_control) &&
01913 is_multicast_ether_addr(hdr->addr1) &&
01914 mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
01915 return RX_DROP_MONITOR;
01916
01917 if (!ieee80211_is_data(hdr->frame_control))
01918 return RX_CONTINUE;
01919
01920 if (!mesh_hdr->ttl)
01921
01922 return RX_DROP_MONITOR;
01923
01924 if (ieee80211_queue_stopped(&local->hw, skb_get_queue_mapping(skb))) {
01925 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
01926 dropped_frames_congestion);
01927 return RX_DROP_MONITOR;
01928 }
01929
01930 if (mesh_hdr->flags & MESH_FLAGS_AE) {
01931 struct mesh_path *mppath;
01932 char *proxied_addr;
01933 char *mpp_addr;
01934
01935 if (is_multicast_ether_addr(hdr->addr1)) {
01936 mpp_addr = hdr->addr3;
01937 proxied_addr = mesh_hdr->eaddr1;
01938 } else {
01939 mpp_addr = hdr->addr4;
01940 proxied_addr = mesh_hdr->eaddr2;
01941 }
01942
01943 rcu_read_lock();
01944 mppath = mpp_path_lookup(proxied_addr, sdata);
01945 if (!mppath) {
01946 mpp_path_add(proxied_addr, mpp_addr, sdata);
01947 } else {
01948 spin_lock_bh(&mppath->state_lock);
01949 if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
01950 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
01951 spin_unlock_bh(&mppath->state_lock);
01952 }
01953 rcu_read_unlock();
01954 }
01955
01956
01957 if (!is_multicast_ether_addr(hdr->addr1) &&
01958 compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
01959 return RX_CONTINUE;
01960
01961 mesh_hdr->ttl--;
01962
01963 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
01964 if (!mesh_hdr->ttl)
01965 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
01966 dropped_frames_ttl);
01967 else {
01968 struct ieee80211_hdr *fwd_hdr;
01969 struct ieee80211_tx_info *info;
01970
01971 fwd_skb = skb_copy(skb, GFP_ATOMIC);
01972
01973 if (!fwd_skb && net_ratelimit())
01974 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
01975 sdata->name);
01976 if (!fwd_skb)
01977 goto out;
01978
01979 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
01980 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
01981 info = IEEE80211_SKB_CB(fwd_skb);
01982 memset(info, 0, sizeof(*info));
01983 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
01984 info->control.vif = &rx->sdata->vif;
01985 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
01986 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
01987 fwded_mcast);
01988 skb_set_queue_mapping(fwd_skb,
01989 ieee80211_select_queue(sdata, fwd_skb));
01990 ieee80211_set_qos_hdr(sdata, fwd_skb);
01991 } else {
01992 int err;
01993
01994
01995
01996
01997 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
01998 ETH_ALEN);
01999 err = mesh_nexthop_lookup(fwd_skb, sdata);
02000
02001
02002
02003 if (err)
02004 return RX_DROP_MONITOR;
02005
02006 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
02007 fwded_unicast);
02008 }
02009 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
02010 fwded_frames);
02011 ieee80211_add_pending_skb(local, fwd_skb);
02012 }
02013 }
02014
02015 out:
02016 if (is_multicast_ether_addr(hdr->addr1) ||
02017 sdata->dev->flags & IFF_PROMISC)
02018 return RX_CONTINUE;
02019 else
02020 return RX_DROP_MONITOR;
02021 }
02022 #endif
02023
02024 static ieee80211_rx_result debug_noinline
02025 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
02026 {
02027 struct ieee80211_sub_if_data *sdata = rx->sdata;
02028 struct ieee80211_local *local = rx->local;
02029 struct net_device *dev = sdata->dev;
02030 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
02031 __le16 fc = hdr->frame_control;
02032 bool port_control;
02033 int err;
02034
02035 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
02036 return RX_CONTINUE;
02037
02038 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
02039 return RX_DROP_MONITOR;
02040
02041
02042
02043
02044
02045 if (ieee80211_has_a4(hdr->frame_control) &&
02046 sdata->vif.type == NL80211_IFTYPE_AP)
02047 return RX_DROP_MONITOR;
02048
02049 err = __ieee80211_data_to_8023(rx, &port_control);
02050 if (unlikely(err))
02051 return RX_DROP_UNUSABLE;
02052
02053 if (!ieee80211_frame_allowed(rx, fc))
02054 return RX_DROP_MONITOR;
02055
02056 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
02057 unlikely(port_control) && sdata->bss) {
02058 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
02059 u.ap);
02060 dev = sdata->dev;
02061 rx->sdata = sdata;
02062 }
02063
02064 rx->skb->dev = dev;
02065
02066 dev->stats.rx_packets++;
02067 dev->stats.rx_bytes += rx->skb->len;
02068
02069 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
02070 !is_multicast_ether_addr(
02071 ((struct ethhdr *)rx->skb->data)->h_dest) &&
02072 (!local->scanning &&
02073 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
02074 mod_timer(&local->dynamic_ps_timer, jiffies +
02075 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
02076 }
02077
02078 ieee80211_deliver_skb(rx);
02079
02080 return RX_QUEUED;
02081 }
02082
02083 static ieee80211_rx_result debug_noinline
02084 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
02085 {
02086 struct ieee80211_local *local = rx->local;
02087 struct ieee80211_hw *hw = &local->hw;
02088 struct sk_buff *skb = rx->skb;
02089 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
02090 struct tid_ampdu_rx *tid_agg_rx;
02091 u16 start_seq_num;
02092 u16 tid;
02093
02094 if (likely(!ieee80211_is_ctl(bar->frame_control)))
02095 return RX_CONTINUE;
02096
02097 if (ieee80211_is_back_req(bar->frame_control)) {
02098 struct {
02099 __le16 control, start_seq_num;
02100 } __packed bar_data;
02101
02102 if (!rx->sta)
02103 return RX_DROP_MONITOR;
02104
02105 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
02106 &bar_data, sizeof(bar_data)))
02107 return RX_DROP_MONITOR;
02108
02109 tid = le16_to_cpu(bar_data.control) >> 12;
02110
02111 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
02112 if (!tid_agg_rx)
02113 return RX_DROP_MONITOR;
02114
02115 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
02116
02117
02118 if (tid_agg_rx->timeout)
02119 mod_timer(&tid_agg_rx->session_timer,
02120 TU_TO_EXP_TIME(tid_agg_rx->timeout));
02121
02122 spin_lock(&tid_agg_rx->reorder_lock);
02123
02124 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
02125 spin_unlock(&tid_agg_rx->reorder_lock);
02126
02127 kfree_skb(skb);
02128 return RX_QUEUED;
02129 }
02130
02131
02132
02133
02134
02135
02136 return RX_DROP_MONITOR;
02137 }
02138
02139 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
02140 struct ieee80211_mgmt *mgmt,
02141 size_t len)
02142 {
02143 struct ieee80211_local *local = sdata->local;
02144 struct sk_buff *skb;
02145 struct ieee80211_mgmt *resp;
02146
02147 if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
02148
02149 return;
02150 }
02151
02152 if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
02153 compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
02154
02155 return;
02156 }
02157
02158 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
02159
02160 return;
02161 }
02162
02163 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
02164 if (skb == NULL)
02165 return;
02166
02167 skb_reserve(skb, local->hw.extra_tx_headroom);
02168 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
02169 memset(resp, 0, 24);
02170 memcpy(resp->da, mgmt->sa, ETH_ALEN);
02171 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
02172 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
02173 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
02174 IEEE80211_STYPE_ACTION);
02175 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
02176 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
02177 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
02178 memcpy(resp->u.action.u.sa_query.trans_id,
02179 mgmt->u.action.u.sa_query.trans_id,
02180 WLAN_SA_QUERY_TR_ID_LEN);
02181
02182 ieee80211_tx_skb(sdata, skb);
02183 }
02184
02185 static ieee80211_rx_result debug_noinline
02186 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
02187 {
02188 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
02189 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02190
02191
02192
02193
02194
02195
02196 if (rx->skb->len < 24)
02197 return RX_DROP_MONITOR;
02198
02199 if (!ieee80211_is_mgmt(mgmt->frame_control))
02200 return RX_DROP_MONITOR;
02201
02202 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
02203 return RX_DROP_MONITOR;
02204
02205 if (ieee80211_drop_unencrypted_mgmt(rx))
02206 return RX_DROP_UNUSABLE;
02207
02208 return RX_CONTINUE;
02209 }
02210
02211 static ieee80211_rx_result debug_noinline
02212 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
02213 {
02214 struct ieee80211_local *local = rx->local;
02215 struct ieee80211_sub_if_data *sdata = rx->sdata;
02216 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
02217 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02218 int len = rx->skb->len;
02219
02220 if (!ieee80211_is_action(mgmt->frame_control))
02221 return RX_CONTINUE;
02222
02223
02224 if (len < IEEE80211_MIN_ACTION_SIZE)
02225 return RX_DROP_UNUSABLE;
02226
02227 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
02228 return RX_DROP_UNUSABLE;
02229
02230 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
02231 return RX_DROP_UNUSABLE;
02232
02233 switch (mgmt->u.action.category) {
02234 case WLAN_CATEGORY_BACK:
02235
02236
02237
02238
02239
02240
02241 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
02242 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
02243 sdata->vif.type != NL80211_IFTYPE_AP)
02244 break;
02245
02246
02247 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
02248 break;
02249
02250 switch (mgmt->u.action.u.addba_req.action_code) {
02251 case WLAN_ACTION_ADDBA_REQ:
02252 if (len < (IEEE80211_MIN_ACTION_SIZE +
02253 sizeof(mgmt->u.action.u.addba_req)))
02254 goto invalid;
02255 break;
02256 case WLAN_ACTION_ADDBA_RESP:
02257 if (len < (IEEE80211_MIN_ACTION_SIZE +
02258 sizeof(mgmt->u.action.u.addba_resp)))
02259 goto invalid;
02260 break;
02261 case WLAN_ACTION_DELBA:
02262 if (len < (IEEE80211_MIN_ACTION_SIZE +
02263 sizeof(mgmt->u.action.u.delba)))
02264 goto invalid;
02265 break;
02266 default:
02267 goto invalid;
02268 }
02269
02270 goto queue;
02271 case WLAN_CATEGORY_SPECTRUM_MGMT:
02272 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
02273 break;
02274
02275 if (sdata->vif.type != NL80211_IFTYPE_STATION)
02276 break;
02277
02278
02279 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
02280 break;
02281
02282 switch (mgmt->u.action.u.measurement.action_code) {
02283 case WLAN_ACTION_SPCT_MSR_REQ:
02284 if (len < (IEEE80211_MIN_ACTION_SIZE +
02285 sizeof(mgmt->u.action.u.measurement)))
02286 break;
02287 ieee80211_process_measurement_req(sdata, mgmt, len);
02288 goto handled;
02289 case WLAN_ACTION_SPCT_CHL_SWITCH:
02290 if (len < (IEEE80211_MIN_ACTION_SIZE +
02291 sizeof(mgmt->u.action.u.chan_switch)))
02292 break;
02293
02294 if (sdata->vif.type != NL80211_IFTYPE_STATION)
02295 break;
02296
02297 if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
02298 break;
02299
02300 goto queue;
02301 }
02302 break;
02303 case WLAN_CATEGORY_SA_QUERY:
02304 if (len < (IEEE80211_MIN_ACTION_SIZE +
02305 sizeof(mgmt->u.action.u.sa_query)))
02306 break;
02307
02308 switch (mgmt->u.action.u.sa_query.action) {
02309 case WLAN_ACTION_SA_QUERY_REQUEST:
02310 if (sdata->vif.type != NL80211_IFTYPE_STATION)
02311 break;
02312 ieee80211_process_sa_query_req(sdata, mgmt, len);
02313 goto handled;
02314 }
02315 break;
02316 case WLAN_CATEGORY_SELF_PROTECTED:
02317 switch (mgmt->u.action.u.self_prot.action_code) {
02318 case WLAN_SP_MESH_PEERING_OPEN:
02319 case WLAN_SP_MESH_PEERING_CLOSE:
02320 case WLAN_SP_MESH_PEERING_CONFIRM:
02321 if (!ieee80211_vif_is_mesh(&sdata->vif))
02322 goto invalid;
02323 if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
02324
02325 break;
02326 goto queue;
02327 case WLAN_SP_MGK_INFORM:
02328 case WLAN_SP_MGK_ACK:
02329 if (!ieee80211_vif_is_mesh(&sdata->vif))
02330 goto invalid;
02331 break;
02332 }
02333 break;
02334 case WLAN_CATEGORY_MESH_ACTION:
02335 if (!ieee80211_vif_is_mesh(&sdata->vif))
02336 break;
02337 if (mesh_action_is_path_sel(mgmt) &&
02338 (!mesh_path_sel_is_hwmp(sdata)))
02339 break;
02340 goto queue;
02341 }
02342
02343 return RX_CONTINUE;
02344
02345 invalid:
02346 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
02347
02348 return RX_CONTINUE;
02349
02350 handled:
02351 if (rx->sta)
02352 rx->sta->rx_packets++;
02353 dev_kfree_skb(rx->skb);
02354 return RX_QUEUED;
02355
02356 queue:
02357 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
02358 skb_queue_tail(&sdata->skb_queue, rx->skb);
02359 ieee80211_queue_work(&local->hw, &sdata->work);
02360 if (rx->sta)
02361 rx->sta->rx_packets++;
02362 return RX_QUEUED;
02363 }
02364
02365 static ieee80211_rx_result debug_noinline
02366 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
02367 {
02368 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02369
02370
02371 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
02372 return RX_CONTINUE;
02373
02374
02375
02376
02377
02378
02379
02380
02381 if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
02382 rx->skb->data, rx->skb->len,
02383 GFP_ATOMIC)) {
02384 if (rx->sta)
02385 rx->sta->rx_packets++;
02386 dev_kfree_skb(rx->skb);
02387 return RX_QUEUED;
02388 }
02389
02390
02391 return RX_CONTINUE;
02392 }
02393
02394 static ieee80211_rx_result debug_noinline
02395 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
02396 {
02397 struct ieee80211_local *local = rx->local;
02398 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
02399 struct sk_buff *nskb;
02400 struct ieee80211_sub_if_data *sdata = rx->sdata;
02401 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02402
02403 if (!ieee80211_is_action(mgmt->frame_control))
02404 return RX_CONTINUE;
02405
02406
02407
02408
02409
02410
02411
02412
02413
02414
02415
02416 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
02417 (sdata->vif.type == NL80211_IFTYPE_AP ||
02418 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
02419 return RX_DROP_MONITOR;
02420
02421 if (is_multicast_ether_addr(mgmt->da))
02422 return RX_DROP_MONITOR;
02423
02424
02425 if (mgmt->u.action.category & 0x80)
02426 return RX_DROP_UNUSABLE;
02427
02428 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
02429 GFP_ATOMIC);
02430 if (nskb) {
02431 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
02432
02433 nmgmt->u.action.category |= 0x80;
02434 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
02435 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
02436
02437 memset(nskb->cb, 0, sizeof(nskb->cb));
02438
02439 ieee80211_tx_skb(rx->sdata, nskb);
02440 }
02441 dev_kfree_skb(rx->skb);
02442 return RX_QUEUED;
02443 }
02444
02445 static ieee80211_rx_result debug_noinline
02446 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
02447 {
02448 struct ieee80211_sub_if_data *sdata = rx->sdata;
02449 ieee80211_rx_result rxs;
02450 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
02451 __le16 stype;
02452
02453 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
02454 if (rxs != RX_CONTINUE)
02455 return rxs;
02456
02457 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
02458
02459 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
02460 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
02461 sdata->vif.type != NL80211_IFTYPE_STATION)
02462 return RX_DROP_MONITOR;
02463
02464 switch (stype) {
02465 case cpu_to_le16(IEEE80211_STYPE_BEACON):
02466 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
02467
02468 break;
02469 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
02470 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
02471 if (is_multicast_ether_addr(mgmt->da) &&
02472 !is_broadcast_ether_addr(mgmt->da))
02473 return RX_DROP_MONITOR;
02474
02475
02476 if (sdata->vif.type != NL80211_IFTYPE_STATION)
02477 return RX_DROP_MONITOR;
02478 break;
02479 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
02480 case cpu_to_le16(IEEE80211_STYPE_AUTH):
02481
02482 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
02483 return RX_DROP_MONITOR;
02484 break;
02485 default:
02486 return RX_DROP_MONITOR;
02487 }
02488
02489
02490 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
02491 skb_queue_tail(&sdata->skb_queue, rx->skb);
02492 ieee80211_queue_work(&rx->local->hw, &sdata->work);
02493 if (rx->sta)
02494 rx->sta->rx_packets++;
02495
02496 return RX_QUEUED;
02497 }
02498
02499
02500 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
02501 struct ieee80211_rate *rate)
02502 {
02503 struct ieee80211_sub_if_data *sdata;
02504 struct ieee80211_local *local = rx->local;
02505 struct ieee80211_rtap_hdr {
02506 struct ieee80211_radiotap_header hdr;
02507 u8 flags;
02508 u8 rate_or_pad;
02509 __le16 chan_freq;
02510 __le16 chan_flags;
02511 } __packed *rthdr;
02512 struct sk_buff *skb = rx->skb, *skb2;
02513 struct net_device *prev_dev = NULL;
02514 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02515
02516
02517
02518
02519
02520 if (rx->flags & IEEE80211_RX_CMNTR)
02521 goto out_free_skb;
02522 rx->flags |= IEEE80211_RX_CMNTR;
02523
02524 if (skb_headroom(skb) < sizeof(*rthdr) &&
02525 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
02526 goto out_free_skb;
02527
02528 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
02529 memset(rthdr, 0, sizeof(*rthdr));
02530 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
02531 rthdr->hdr.it_present =
02532 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
02533 (1 << IEEE80211_RADIOTAP_CHANNEL));
02534
02535 if (rate) {
02536 rthdr->rate_or_pad = rate->bitrate / 5;
02537 rthdr->hdr.it_present |=
02538 cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
02539 }
02540 rthdr->chan_freq = cpu_to_le16(status->freq);
02541
02542 if (status->band == IEEE80211_BAND_5GHZ)
02543 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
02544 IEEE80211_CHAN_5GHZ);
02545 else
02546 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
02547 IEEE80211_CHAN_2GHZ);
02548
02549 skb_set_mac_header(skb, 0);
02550 skb->ip_summed = CHECKSUM_UNNECESSARY;
02551 skb->pkt_type = PACKET_OTHERHOST;
02552 skb->protocol = htons(ETH_P_802_2);
02553
02554 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
02555 if (!ieee80211_sdata_running(sdata))
02556 continue;
02557
02558 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
02559 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
02560 continue;
02561
02562 if (prev_dev) {
02563 skb2 = skb_clone(skb, GFP_ATOMIC);
02564 if (skb2) {
02565 skb2->dev = prev_dev;
02566 netif_receive_skb(skb2);
02567 }
02568 }
02569
02570 prev_dev = sdata->dev;
02571 sdata->dev->stats.rx_packets++;
02572 sdata->dev->stats.rx_bytes += skb->len;
02573 }
02574
02575 if (prev_dev) {
02576 skb->dev = prev_dev;
02577 netif_receive_skb(skb);
02578 return;
02579 }
02580
02581 out_free_skb:
02582 dev_kfree_skb(skb);
02583 }
02584
02585 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
02586 ieee80211_rx_result res)
02587 {
02588 switch (res) {
02589 case RX_DROP_MONITOR:
02590 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
02591 if (rx->sta)
02592 rx->sta->rx_dropped++;
02593
02594 case RX_CONTINUE: {
02595 struct ieee80211_rate *rate = NULL;
02596 struct ieee80211_supported_band *sband;
02597 struct ieee80211_rx_status *status;
02598
02599 status = IEEE80211_SKB_RXCB((rx->skb));
02600
02601 sband = rx->local->hw.wiphy->bands[status->band];
02602 if (!(status->flag & RX_FLAG_HT))
02603 rate = &sband->bitrates[status->rate_idx];
02604
02605 ieee80211_rx_cooked_monitor(rx, rate);
02606 break;
02607 }
02608 case RX_DROP_UNUSABLE:
02609 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
02610 if (rx->sta)
02611 rx->sta->rx_dropped++;
02612 dev_kfree_skb(rx->skb);
02613 break;
02614 case RX_QUEUED:
02615 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
02616 break;
02617 }
02618 }
02619
02620 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
02621 {
02622 ieee80211_rx_result res = RX_DROP_MONITOR;
02623 struct sk_buff *skb;
02624
02625 #define CALL_RXH(rxh) \
02626 do { \
02627 res = rxh(rx); \
02628 if (res != RX_CONTINUE) \
02629 goto rxh_next; \
02630 } while (0);
02631
02632 spin_lock(&rx->local->rx_skb_queue.lock);
02633 if (rx->local->running_rx_handler)
02634 goto unlock;
02635
02636 rx->local->running_rx_handler = true;
02637
02638 while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
02639 spin_unlock(&rx->local->rx_skb_queue.lock);
02640
02641
02642
02643
02644
02645
02646 rx->skb = skb;
02647
02648 CALL_RXH(ieee80211_rx_h_decrypt)
02649 CALL_RXH(ieee80211_rx_h_check_more_data)
02650 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
02651 CALL_RXH(ieee80211_rx_h_sta_process)
02652 CALL_RXH(ieee80211_rx_h_defragment)
02653 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
02654
02655 #ifdef CONFIG_MAC80211_MESH
02656 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
02657 CALL_RXH(ieee80211_rx_h_mesh_fwding);
02658 #endif
02659 CALL_RXH(ieee80211_rx_h_remove_qos_control)
02660 CALL_RXH(ieee80211_rx_h_amsdu)
02661 CALL_RXH(ieee80211_rx_h_data)
02662 CALL_RXH(ieee80211_rx_h_ctrl);
02663 CALL_RXH(ieee80211_rx_h_mgmt_check)
02664 CALL_RXH(ieee80211_rx_h_action)
02665 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
02666 CALL_RXH(ieee80211_rx_h_action_return)
02667 CALL_RXH(ieee80211_rx_h_mgmt)
02668
02669 rxh_next:
02670 ieee80211_rx_handlers_result(rx, res);
02671 spin_lock(&rx->local->rx_skb_queue.lock);
02672 #undef CALL_RXH
02673 }
02674
02675 rx->local->running_rx_handler = false;
02676
02677 unlock:
02678 spin_unlock(&rx->local->rx_skb_queue.lock);
02679 }
02680
02681 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
02682 {
02683 ieee80211_rx_result res = RX_DROP_MONITOR;
02684
02685 #define CALL_RXH(rxh) \
02686 do { \
02687 res = rxh(rx); \
02688 if (res != RX_CONTINUE) \
02689 goto rxh_next; \
02690 } while (0);
02691
02692 CALL_RXH(ieee80211_rx_h_passive_scan)
02693 CALL_RXH(ieee80211_rx_h_check)
02694
02695 ieee80211_rx_reorder_ampdu(rx);
02696
02697 ieee80211_rx_handlers(rx);
02698 return;
02699
02700 rxh_next:
02701 ieee80211_rx_handlers_result(rx, res);
02702
02703 #undef CALL_RXH
02704 }
02705
02706
02707
02708
02709
02710 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
02711 {
02712 struct ieee80211_rx_data rx = {
02713 .sta = sta,
02714 .sdata = sta->sdata,
02715 .local = sta->local,
02716
02717 .security_idx = tid,
02718 .seqno_idx = tid,
02719 .flags = 0,
02720 };
02721 struct tid_ampdu_rx *tid_agg_rx;
02722
02723 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
02724 if (!tid_agg_rx)
02725 return;
02726
02727 spin_lock(&tid_agg_rx->reorder_lock);
02728 ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
02729 spin_unlock(&tid_agg_rx->reorder_lock);
02730
02731 ieee80211_rx_handlers(&rx);
02732 }
02733
02734
02735
02736 static int prepare_for_handlers(struct ieee80211_rx_data *rx,
02737 struct ieee80211_hdr *hdr)
02738 {
02739 struct ieee80211_sub_if_data *sdata = rx->sdata;
02740 struct sk_buff *skb = rx->skb;
02741 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02742 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
02743 int multicast = is_multicast_ether_addr(hdr->addr1);
02744
02745 switch (sdata->vif.type) {
02746 case NL80211_IFTYPE_STATION:
02747 if (!bssid && !sdata->u.mgd.use_4addr)
02748 return 0;
02749 if (!multicast &&
02750 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
02751 if (!(sdata->dev->flags & IFF_PROMISC) ||
02752 sdata->u.mgd.use_4addr)
02753 return 0;
02754 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02755 }
02756 break;
02757 case NL80211_IFTYPE_ADHOC:
02758 if (!bssid)
02759 return 0;
02760 if (ieee80211_is_beacon(hdr->frame_control)) {
02761 return 1;
02762 }
02763 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
02764 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
02765 return 0;
02766 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02767 } else if (!multicast &&
02768 compare_ether_addr(sdata->vif.addr,
02769 hdr->addr1) != 0) {
02770 if (!(sdata->dev->flags & IFF_PROMISC))
02771 return 0;
02772 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02773 } else if (!rx->sta) {
02774 int rate_idx;
02775 if (status->flag & RX_FLAG_HT)
02776 rate_idx = 0;
02777 else
02778 rate_idx = status->rate_idx;
02779 rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
02780 hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
02781 }
02782 break;
02783 case NL80211_IFTYPE_MESH_POINT:
02784 if (!multicast &&
02785 compare_ether_addr(sdata->vif.addr,
02786 hdr->addr1) != 0) {
02787 if (!(sdata->dev->flags & IFF_PROMISC))
02788 return 0;
02789
02790 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02791 }
02792 break;
02793 case NL80211_IFTYPE_AP_VLAN:
02794 case NL80211_IFTYPE_AP:
02795 if (!bssid) {
02796 if (compare_ether_addr(sdata->vif.addr,
02797 hdr->addr1))
02798 return 0;
02799 } else if (!ieee80211_bssid_match(bssid,
02800 sdata->vif.addr)) {
02801 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
02802 !ieee80211_is_beacon(hdr->frame_control) &&
02803 !(ieee80211_is_action(hdr->frame_control) &&
02804 sdata->vif.p2p))
02805 return 0;
02806 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02807 }
02808 break;
02809 case NL80211_IFTYPE_WDS:
02810 if (bssid || !ieee80211_is_data(hdr->frame_control))
02811 return 0;
02812 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
02813 return 0;
02814 break;
02815 default:
02816
02817 WARN_ON(1);
02818 break;
02819 }
02820
02821 return 1;
02822 }
02823
02824
02825
02826
02827
02828
02829
02830 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
02831 struct sk_buff *skb, bool consume)
02832 {
02833 struct ieee80211_local *local = rx->local;
02834 struct ieee80211_sub_if_data *sdata = rx->sdata;
02835 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02836 struct ieee80211_hdr *hdr = (void *)skb->data;
02837 int prepares;
02838
02839 rx->skb = skb;
02840 status->rx_flags |= IEEE80211_RX_RA_MATCH;
02841 prepares = prepare_for_handlers(rx, hdr);
02842
02843 if (!prepares)
02844 return false;
02845
02846 if (!consume) {
02847 skb = skb_copy(skb, GFP_ATOMIC);
02848 if (!skb) {
02849 if (net_ratelimit())
02850 wiphy_debug(local->hw.wiphy,
02851 "failed to copy skb for %s\n",
02852 sdata->name);
02853 return true;
02854 }
02855
02856 rx->skb = skb;
02857 }
02858
02859 ieee80211_invoke_rx_handlers(rx);
02860 return true;
02861 }
02862
02863
02864
02865
02866
02867 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
02868 struct sk_buff *skb)
02869 {
02870 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02871 struct ieee80211_local *local = hw_to_local(hw);
02872 struct ieee80211_sub_if_data *sdata;
02873 struct ieee80211_hdr *hdr;
02874 __le16 fc;
02875 struct ieee80211_rx_data rx;
02876 struct ieee80211_sub_if_data *prev;
02877 struct sta_info *sta, *tmp, *prev_sta;
02878 int err = 0;
02879
02880 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
02881 memset(&rx, 0, sizeof(rx));
02882 rx.skb = skb;
02883 rx.local = local;
02884
02885 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
02886 local->dot11ReceivedFragmentCount++;
02887
02888 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
02889 test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
02890 status->rx_flags |= IEEE80211_RX_IN_SCAN;
02891
02892 if (ieee80211_is_mgmt(fc))
02893 err = skb_linearize(skb);
02894 else
02895 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
02896
02897 if (err) {
02898 dev_kfree_skb(skb);
02899 return;
02900 }
02901
02902 hdr = (struct ieee80211_hdr *)skb->data;
02903 ieee80211_parse_qos(&rx);
02904 ieee80211_verify_alignment(&rx);
02905
02906 if (ieee80211_is_data(fc)) {
02907 prev_sta = NULL;
02908
02909 for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
02910 if (!prev_sta) {
02911 prev_sta = sta;
02912 continue;
02913 }
02914
02915 rx.sta = prev_sta;
02916 rx.sdata = prev_sta->sdata;
02917 ieee80211_prepare_and_rx_handle(&rx, skb, false);
02918
02919 prev_sta = sta;
02920 }
02921
02922 if (prev_sta) {
02923 rx.sta = prev_sta;
02924 rx.sdata = prev_sta->sdata;
02925
02926 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
02927 return;
02928 goto out;
02929 }
02930 }
02931
02932 prev = NULL;
02933
02934 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
02935 if (!ieee80211_sdata_running(sdata))
02936 continue;
02937
02938 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
02939 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
02940 continue;
02941
02942
02943
02944
02945
02946
02947
02948 if (!prev) {
02949 prev = sdata;
02950 continue;
02951 }
02952
02953 rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
02954 rx.sdata = prev;
02955 ieee80211_prepare_and_rx_handle(&rx, skb, false);
02956
02957 prev = sdata;
02958 }
02959
02960 if (prev) {
02961 rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
02962 rx.sdata = prev;
02963
02964 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
02965 return;
02966 }
02967
02968 out:
02969 dev_kfree_skb(skb);
02970 }
02971
02972
02973
02974
02975
02976 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
02977 {
02978 struct ieee80211_local *local = hw_to_local(hw);
02979 struct ieee80211_rate *rate = NULL;
02980 struct ieee80211_supported_band *sband;
02981 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02982
02983
02984
02985 WARN_ON_ONCE(softirq_count() == 0);
02986
02987
02988 if (WARN_ON(status->band < 0 ||
02989 status->band >= IEEE80211_NUM_BANDS))
02990 goto drop;
02991
02992
02993 sband = local->hw.wiphy->bands[status->band];
02994 if (WARN_ON(!sband))
02995 goto drop;
02996
02997
02998
02999
03000
03001
03002
03003
03004
03005
03006
03007 if (unlikely(local->quiescing || local->suspended))
03008 goto drop;
03009
03010
03011
03012
03013
03014
03015
03016
03017
03018 if (WARN_ON(!local->started))
03019 goto drop;
03020
03021
03022
03023
03024 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
03025
03026
03027
03028
03029
03030
03031 if (status->flag & RX_FLAG_HT) {
03032
03033
03034
03035
03036
03037
03038
03039
03040
03041
03042 if (WARN((status->rate_idx < 0 ||
03043 status->rate_idx > 76),
03044 "Rate marked as an HT rate but passed "
03045 "status->rate_idx is not "
03046 "an MCS index [0-76]: %d (0x%02x)\n",
03047 status->rate_idx,
03048 status->rate_idx))
03049 goto drop;
03050 } else {
03051 if (WARN_ON(status->rate_idx < 0 ||
03052 status->rate_idx >= sband->n_bitrates))
03053 goto drop;
03054 rate = &sband->bitrates[status->rate_idx];
03055 }
03056 }
03057
03058
03059 status->rx_flags = 0;
03060
03061
03062
03063
03064
03065
03066 rcu_read_lock();
03067
03068
03069
03070
03071
03072
03073
03074 skb = ieee80211_rx_monitor(local, skb, rate);
03075 if (!skb) {
03076 rcu_read_unlock();
03077 return;
03078 }
03079
03080 ieee80211_tpt_led_trig_rx(local,
03081 ((struct ieee80211_hdr *)skb->data)->frame_control,
03082 skb->len);
03083 __ieee80211_rx_handle_packet(hw, skb);
03084
03085 rcu_read_unlock();
03086
03087 return;
03088 drop:
03089 kfree_skb(skb);
03090 }
03091 EXPORT_SYMBOL(ieee80211_rx);
03092
03093
03094
03095 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
03096 {
03097 struct ieee80211_local *local = hw_to_local(hw);
03098
03099 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
03100
03101 skb->pkt_type = IEEE80211_RX_MSG;
03102 skb_queue_tail(&local->skb_queue, skb);
03103 tasklet_schedule(&local->tasklet);
03104 }
03105 EXPORT_SYMBOL(ieee80211_rx_irqsafe);