rx.c
Go to the documentation of this file.
00001 /*
00002  * Copyright 2002-2005, Instant802 Networks, Inc.
00003  * Copyright 2005-2006, Devicescape Software, Inc.
00004  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
00005  * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
00006  *
00007  * This program is free software; you can redistribute it and/or modify
00008  * it under the terms of the GNU General Public License version 2 as
00009  * published by the Free Software Foundation.
00010  */
00011 
00012 #include <linux/jiffies.h>
00013 #include <linux/slab.h>
00014 #include <linux/kernel.h>
00015 #include <linux/skbuff.h>
00016 #include <linux/netdevice.h>
00017 #include <linux/etherdevice.h>
00018 #include <linux/rcupdate.h>
00019 #include <linux/export.h>
00020 #include <net/mac80211.h>
00021 #include <net/ieee80211_radiotap.h>
00022 
00023 #include "ieee80211_i.h"
00024 #include "driver-ops.h"
00025 #include "led.h"
00026 #include "mesh.h"
00027 #include "wep.h"
00028 #include "wpa.h"
00029 #include "tkip.h"
00030 #include "wme.h"
00031 #include "rt_wmp.h"
00032 
00033 /*
00034  * monitor mode reception
00035  *
00036  * This function cleans up the SKB, i.e. it removes all the stuff
00037  * only useful for monitoring.
00038  */
00039 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
00040                                            struct sk_buff *skb)
00041 {
00042         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
00043                 if (likely(skb->len > FCS_LEN))
00044                         __pskb_trim(skb, skb->len - FCS_LEN);
00045                 else {
00046                         /* driver bug */
00047                         WARN_ON(1);
00048                         dev_kfree_skb(skb);
00049                         skb = NULL;
00050                 }
00051         }
00052 
00053         return skb;
00054 }
00055 
00056 static inline int should_drop_frame(struct sk_buff *skb,
00057                                     int present_fcs_len)
00058 {
00059         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
00060         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
00061 
00062         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
00063                 return 1;
00064         if (unlikely(skb->len < 16 + present_fcs_len))
00065                 return 1;
00066         if (ieee80211_is_ctl(hdr->frame_control) &&
00067             !ieee80211_is_pspoll(hdr->frame_control) &&
00068             !ieee80211_is_back_req(hdr->frame_control))
00069                 return 1;
00070         return 0;
00071 }
00072 
00073 static int
00074 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
00075                           struct ieee80211_rx_status *status)
00076 {
00077         int len;
00078 
00079         /* always present fields */
00080         len = sizeof(struct ieee80211_radiotap_header) + 9;
00081 
00082         if (status->flag & RX_FLAG_MACTIME_MPDU)
00083                 len += 8;
00084         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
00085                 len += 1;
00086 
00087         if (len & 1) /* padding for RX_FLAGS if necessary */
00088                 len++;
00089 
00090         if (status->flag & RX_FLAG_HT) /* HT info */
00091                 len += 3;
00092 
00093         return len;
00094 }
00095 
00096 /*
00097  * ieee80211_add_rx_radiotap_header - add radiotap header
00098  *
00099  * add a radiotap header containing all the fields which the hardware provided.
00100  */
00101 static void
00102 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
00103                                  struct sk_buff *skb,
00104                                  struct ieee80211_rate *rate,
00105                                  int rtap_len)
00106 {
00107         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
00108         struct ieee80211_radiotap_header *rthdr;
00109         unsigned char *pos;
00110         u16 rx_flags = 0;
00111 
00112         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
00113         memset(rthdr, 0, rtap_len);
00114 
00115         /* radiotap header, set always present flags */
00116         rthdr->it_present =
00117                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
00118                             (1 << IEEE80211_RADIOTAP_CHANNEL) |
00119                             (1 << IEEE80211_RADIOTAP_ANTENNA) |
00120                             (1 << IEEE80211_RADIOTAP_RX_FLAGS));
00121         rthdr->it_len = cpu_to_le16(rtap_len);
00122 
00123         pos = (unsigned char *)(rthdr+1);
00124 
00125         /* the order of the following fields is important */
00126 
00127         /* IEEE80211_RADIOTAP_TSFT */
00128         if (status->flag & RX_FLAG_MACTIME_MPDU) {
00129                 put_unaligned_le64(status->mactime, pos);
00130                 rthdr->it_present |=
00131                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
00132                 pos += 8;
00133         }
00134 
00135         /* IEEE80211_RADIOTAP_FLAGS */
00136         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
00137                 *pos |= IEEE80211_RADIOTAP_F_FCS;
00138         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
00139                 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
00140         if (status->flag & RX_FLAG_SHORTPRE)
00141                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
00142         pos++;
00143 
00144         /* IEEE80211_RADIOTAP_RATE */
00145         if (!rate || status->flag & RX_FLAG_HT) {
00146                 /*
00147                  * Without rate information don't add it. If we have,
00148                  * MCS information is a separate field in radiotap,
00149                  * added below. The byte here is needed as padding
00150                  * for the channel though, so initialise it to 0.
00151                  */
00152                 *pos = 0;
00153         } else {
00154                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
00155                 *pos = rate->bitrate / 5;
00156         }
00157         pos++;
00158 
00159         /* IEEE80211_RADIOTAP_CHANNEL */
00160         put_unaligned_le16(status->freq, pos);
00161         pos += 2;
00162         if (status->band == IEEE80211_BAND_5GHZ)
00163                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
00164                                    pos);
00165         else if (status->flag & RX_FLAG_HT)
00166                 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
00167                                    pos);
00168         else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
00169                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
00170                                    pos);
00171         else if (rate)
00172                 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
00173                                    pos);
00174         else
00175                 put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
00176         pos += 2;
00177 
00178         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
00179         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
00180                 *pos = status->signal;
00181                 rthdr->it_present |=
00182                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
00183                 pos++;
00184         }
00185 
00186         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
00187 
00188         /* IEEE80211_RADIOTAP_ANTENNA */
00189         *pos = status->antenna;
00190         pos++;
00191 
00192         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
00193 
00194         /* IEEE80211_RADIOTAP_RX_FLAGS */
00195         /* ensure 2 byte alignment for the 2 byte field as required */
00196         if ((pos - (u8 *)rthdr) & 1)
00197                 pos++;
00198         if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
00199                 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
00200         put_unaligned_le16(rx_flags, pos);
00201         pos += 2;
00202 
00203         if (status->flag & RX_FLAG_HT) {
00204                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
00205                 *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
00206                          IEEE80211_RADIOTAP_MCS_HAVE_GI |
00207                          IEEE80211_RADIOTAP_MCS_HAVE_BW;
00208                 *pos = 0;
00209                 if (status->flag & RX_FLAG_SHORT_GI)
00210                         *pos |= IEEE80211_RADIOTAP_MCS_SGI;
00211                 if (status->flag & RX_FLAG_40MHZ)
00212                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
00213                 pos++;
00214                 *pos++ = status->rate_idx;
00215         }
00216 }
00217 
00218 /*
00219  * This function copies a received frame to all monitor interfaces and
00220  * returns a cleaned-up SKB that no longer includes the FCS nor the
00221  * radiotap header the driver might have added.
00222  */
00223 static struct sk_buff *
00224 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
00225                      struct ieee80211_rate *rate)
00226 {
00227         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
00228         struct ieee80211_sub_if_data *sdata;
00229         int needed_headroom = 0;
00230         struct sk_buff *skb, *skb2;
00231         struct net_device *prev_dev = NULL;
00232         int present_fcs_len = 0;
00233 
00234         /*
00235          * First, we may need to make a copy of the skb because
00236          *  (1) we need to modify it for radiotap (if not present), and
00237          *  (2) the other RX handlers will modify the skb we got.
00238          *
00239          * We don't need to, of course, if we aren't going to return
00240          * the SKB because it has a bad FCS/PLCP checksum.
00241          */
00242 
00243         /* room for the radiotap header based on driver features */
00244         needed_headroom = ieee80211_rx_radiotap_len(local, status);
00245 
00246         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
00247                 present_fcs_len = FCS_LEN;
00248 
00249         /* make sure hdr->frame_control is on the linear part */
00250         if (!pskb_may_pull(origskb, 2)) {
00251                 dev_kfree_skb(origskb);
00252                 return NULL;
00253         }
00254 
00255 
00256         /* DANILO */
00257         if (rt_wmp_is_active()){
00258                 struct sk_buff * skb3;
00259                 skb3 = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
00260                 skb3 = remove_monitor_info(local, skb3);
00261                 ieee80211_add_rx_radiotap_header(local, skb3, rate, needed_headroom);
00262                 //skb3->dev = sdata->dev;
00263                 //printk(KERN_ERR "DEV:%p\n", prev_dev);
00264                 rt_wmp_netif_receive_skb(skb3,status->signal);
00265         }
00266         /* DANILO */
00267 
00268         if (!local->monitors) {
00269                 if (should_drop_frame(origskb, present_fcs_len)) {
00270                         dev_kfree_skb(origskb);
00271                         return NULL;
00272                 }
00273 
00274                 return remove_monitor_info(local, origskb);
00275         }
00276 
00277         if (should_drop_frame(origskb, present_fcs_len)) {
00278                 /* only need to expand headroom if necessary */
00279                 skb = origskb;
00280                 origskb = NULL;
00281 
00282                 /*
00283                  * This shouldn't trigger often because most devices have an
00284                  * RX header they pull before we get here, and that should
00285                  * be big enough for our radiotap information. We should
00286                  * probably export the length to drivers so that we can have
00287                  * them allocate enough headroom to start with.
00288                  */
00289                 if (skb_headroom(skb) < needed_headroom &&
00290                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
00291                         dev_kfree_skb(skb);
00292                         return NULL;
00293                 }
00294         } else {
00295                 /*
00296                  * Need to make a copy and possibly remove radiotap header
00297                  * and FCS from the original.
00298                  */
00299                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
00300 
00301                 origskb = remove_monitor_info(local, origskb);
00302 
00303                 if (!skb)
00304                         return origskb;
00305         }
00306 
00307         /* prepend radiotap information */
00308         ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
00309 
00310         skb_reset_mac_header(skb);
00311         skb->ip_summed = CHECKSUM_UNNECESSARY;
00312         skb->pkt_type = PACKET_OTHERHOST;
00313         skb->protocol = htons(ETH_P_802_2);
00314 
00315         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
00316                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
00317                         continue;
00318 
00319                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
00320                         continue;
00321 
00322                 if (!ieee80211_sdata_running(sdata))
00323                         continue;
00324 
00325                 if (prev_dev) {
00326                         skb2 = skb_clone(skb, GFP_ATOMIC);
00327                         if (skb2) {
00328                                 skb2->dev = prev_dev;
00329                                 netif_receive_skb(skb2);
00330                         }
00331                 }
00332 
00333                 prev_dev = sdata->dev;
00334                 sdata->dev->stats.rx_packets++;
00335                 sdata->dev->stats.rx_bytes += skb->len;
00336         }
00337 
00338         if (prev_dev) {
00339                 skb->dev = prev_dev;
00340                 netif_receive_skb(skb);
00341         } else
00342                 dev_kfree_skb(skb);
00343 
00344         return origskb;
00345 }
00346 
00347 
00348 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
00349 {
00350         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
00351         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
00352         int tid, seqno_idx, security_idx;
00353 
00354         /* does the frame have a qos control field? */
00355         if (ieee80211_is_data_qos(hdr->frame_control)) {
00356                 u8 *qc = ieee80211_get_qos_ctl(hdr);
00357                 /* frame has qos control */
00358                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
00359                 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
00360                         status->rx_flags |= IEEE80211_RX_AMSDU;
00361 
00362                 seqno_idx = tid;
00363                 security_idx = tid;
00364         } else {
00365                 /*
00366                  * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
00367                  *
00368                  *      Sequence numbers for management frames, QoS data
00369                  *      frames with a broadcast/multicast address in the
00370                  *      Address 1 field, and all non-QoS data frames sent
00371                  *      by QoS STAs are assigned using an additional single
00372                  *      modulo-4096 counter, [...]
00373                  *
00374                  * We also use that counter for non-QoS STAs.
00375                  */
00376                 seqno_idx = NUM_RX_DATA_QUEUES;
00377                 security_idx = 0;
00378                 if (ieee80211_is_mgmt(hdr->frame_control))
00379                         security_idx = NUM_RX_DATA_QUEUES;
00380                 tid = 0;
00381         }
00382 
00383         rx->seqno_idx = seqno_idx;
00384         rx->security_idx = security_idx;
00385         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
00386          * For now, set skb->priority to 0 for other cases. */
00387         rx->skb->priority = (tid > 7) ? 0 : tid;
00388 }
00389 
00415 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
00416 {
00417 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
00418         WARN_ONCE((unsigned long)rx->skb->data & 1,
00419                   "unaligned packet at 0x%p\n", rx->skb->data);
00420 #endif
00421 }
00422 
00423 
00424 /* rx handlers */
00425 
00426 static ieee80211_rx_result debug_noinline
00427 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
00428 {
00429         struct ieee80211_local *local = rx->local;
00430         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
00431         struct sk_buff *skb = rx->skb;
00432 
00433         if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
00434                    !local->sched_scanning))
00435                 return RX_CONTINUE;
00436 
00437         if (test_bit(SCAN_HW_SCANNING, &local->scanning) ||
00438             local->sched_scanning)
00439                 return ieee80211_scan_rx(rx->sdata, skb);
00440 
00441         if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
00442                 /* drop all the other packets during a software scan anyway */
00443                 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
00444                         dev_kfree_skb(skb);
00445                 return RX_QUEUED;
00446         }
00447 
00448         /* scanning finished during invoking of handlers */
00449         I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
00450         return RX_DROP_UNUSABLE;
00451 }
00452 
00453 
00454 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
00455 {
00456         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00457 
00458         if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
00459                 return 0;
00460 
00461         return ieee80211_is_robust_mgmt_frame(hdr);
00462 }
00463 
00464 
00465 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
00466 {
00467         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00468 
00469         if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
00470                 return 0;
00471 
00472         return ieee80211_is_robust_mgmt_frame(hdr);
00473 }
00474 
00475 
00476 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
00477 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
00478 {
00479         struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
00480         struct ieee80211_mmie *mmie;
00481 
00482         if (skb->len < 24 + sizeof(*mmie) ||
00483             !is_multicast_ether_addr(hdr->da))
00484                 return -1;
00485 
00486         if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
00487                 return -1; /* not a robust management frame */
00488 
00489         mmie = (struct ieee80211_mmie *)
00490                 (skb->data + skb->len - sizeof(*mmie));
00491         if (mmie->element_id != WLAN_EID_MMIE ||
00492             mmie->length != sizeof(*mmie) - 2)
00493                 return -1;
00494 
00495         return le16_to_cpu(mmie->key_id);
00496 }
00497 
00498 
00499 static ieee80211_rx_result
00500 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
00501 {
00502         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
00503         char *dev_addr = rx->sdata->vif.addr;
00504 
00505         if (ieee80211_is_data(hdr->frame_control)) {
00506                 if (is_multicast_ether_addr(hdr->addr1)) {
00507                         if (ieee80211_has_tods(hdr->frame_control) ||
00508                                 !ieee80211_has_fromds(hdr->frame_control))
00509                                 return RX_DROP_MONITOR;
00510                         if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
00511                                 return RX_DROP_MONITOR;
00512                 } else {
00513                         if (!ieee80211_has_a4(hdr->frame_control))
00514                                 return RX_DROP_MONITOR;
00515                         if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
00516                                 return RX_DROP_MONITOR;
00517                 }
00518         }
00519 
00520         /* If there is not an established peer link and this is not a peer link
00521          * establisment frame, beacon or probe, drop the frame.
00522          */
00523 
00524         if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
00525                 struct ieee80211_mgmt *mgmt;
00526 
00527                 if (!ieee80211_is_mgmt(hdr->frame_control))
00528                         return RX_DROP_MONITOR;
00529 
00530                 if (ieee80211_is_action(hdr->frame_control)) {
00531                         u8 category;
00532                         mgmt = (struct ieee80211_mgmt *)hdr;
00533                         category = mgmt->u.action.category;
00534                         if (category != WLAN_CATEGORY_MESH_ACTION &&
00535                                 category != WLAN_CATEGORY_SELF_PROTECTED)
00536                                 return RX_DROP_MONITOR;
00537                         return RX_CONTINUE;
00538                 }
00539 
00540                 if (ieee80211_is_probe_req(hdr->frame_control) ||
00541                     ieee80211_is_probe_resp(hdr->frame_control) ||
00542                     ieee80211_is_beacon(hdr->frame_control) ||
00543                     ieee80211_is_auth(hdr->frame_control))
00544                         return RX_CONTINUE;
00545 
00546                 return RX_DROP_MONITOR;
00547 
00548         }
00549 
00550         return RX_CONTINUE;
00551 }
00552 
00553 #define SEQ_MODULO 0x1000
00554 #define SEQ_MASK   0xfff
00555 
00556 static inline int seq_less(u16 sq1, u16 sq2)
00557 {
00558         return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
00559 }
00560 
00561 static inline u16 seq_inc(u16 sq)
00562 {
00563         return (sq + 1) & SEQ_MASK;
00564 }
00565 
00566 static inline u16 seq_sub(u16 sq1, u16 sq2)
00567 {
00568         return (sq1 - sq2) & SEQ_MASK;
00569 }
00570 
00571 
00572 static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
00573                                             struct tid_ampdu_rx *tid_agg_rx,
00574                                             int index)
00575 {
00576         struct ieee80211_local *local = hw_to_local(hw);
00577         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
00578         struct ieee80211_rx_status *status;
00579 
00580         lockdep_assert_held(&tid_agg_rx->reorder_lock);
00581 
00582         if (!skb)
00583                 goto no_frame;
00584 
00585         /* release the frame from the reorder ring buffer */
00586         tid_agg_rx->stored_mpdu_num--;
00587         tid_agg_rx->reorder_buf[index] = NULL;
00588         status = IEEE80211_SKB_RXCB(skb);
00589         status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
00590         skb_queue_tail(&local->rx_skb_queue, skb);
00591 
00592 no_frame:
00593         tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
00594 }
00595 
00596 static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
00597                                              struct tid_ampdu_rx *tid_agg_rx,
00598                                              u16 head_seq_num)
00599 {
00600         int index;
00601 
00602         lockdep_assert_held(&tid_agg_rx->reorder_lock);
00603 
00604         while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
00605                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
00606                                                         tid_agg_rx->buf_size;
00607                 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
00608         }
00609 }
00610 
00611 /*
00612  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
00613  * the skb was added to the buffer longer than this time ago, the earlier
00614  * frames that have not yet been received are assumed to be lost and the skb
00615  * can be released for processing. This may also release other skb's from the
00616  * reorder buffer if there are no additional gaps between the frames.
00617  *
00618  * Callers must hold tid_agg_rx->reorder_lock.
00619  */
00620 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
00621 
00622 static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
00623                                           struct tid_ampdu_rx *tid_agg_rx)
00624 {
00625         int index, j;
00626 
00627         lockdep_assert_held(&tid_agg_rx->reorder_lock);
00628 
00629         /* release the buffer until next missing frame */
00630         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
00631                                                 tid_agg_rx->buf_size;
00632         if (!tid_agg_rx->reorder_buf[index] &&
00633             tid_agg_rx->stored_mpdu_num) {
00634                 /*
00635                  * No buffers ready to be released, but check whether any
00636                  * frames in the reorder buffer have timed out.
00637                  */
00638                 int skipped = 1;
00639                 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
00640                      j = (j + 1) % tid_agg_rx->buf_size) {
00641                         if (!tid_agg_rx->reorder_buf[j]) {
00642                                 skipped++;
00643                                 continue;
00644                         }
00645                         if (skipped &&
00646                             !time_after(jiffies, tid_agg_rx->reorder_time[j] +
00647                                         HT_RX_REORDER_BUF_TIMEOUT))
00648                                 goto set_release_timer;
00649 
00650 #ifdef CONFIG_MAC80211_HT_DEBUG
00651                         if (net_ratelimit())
00652                                 wiphy_debug(hw->wiphy,
00653                                             "release an RX reorder frame due to timeout on earlier frames\n");
00654 #endif
00655                         ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
00656 
00657                         /*
00658                          * Increment the head seq# also for the skipped slots.
00659                          */
00660                         tid_agg_rx->head_seq_num =
00661                                 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
00662                         skipped = 0;
00663                 }
00664         } else while (tid_agg_rx->reorder_buf[index]) {
00665                 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
00666                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
00667                                                         tid_agg_rx->buf_size;
00668         }
00669 
00670         if (tid_agg_rx->stored_mpdu_num) {
00671                 j = index = seq_sub(tid_agg_rx->head_seq_num,
00672                                     tid_agg_rx->ssn) % tid_agg_rx->buf_size;
00673 
00674                 for (; j != (index - 1) % tid_agg_rx->buf_size;
00675                      j = (j + 1) % tid_agg_rx->buf_size) {
00676                         if (tid_agg_rx->reorder_buf[j])
00677                                 break;
00678                 }
00679 
00680  set_release_timer:
00681 
00682                 mod_timer(&tid_agg_rx->reorder_timer,
00683                           tid_agg_rx->reorder_time[j] + 1 +
00684                           HT_RX_REORDER_BUF_TIMEOUT);
00685         } else {
00686                 del_timer(&tid_agg_rx->reorder_timer);
00687         }
00688 }
00689 
00690 /*
00691  * As this function belongs to the RX path it must be under
00692  * rcu_read_lock protection. It returns false if the frame
00693  * can be processed immediately, true if it was consumed.
00694  */
00695 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
00696                                              struct tid_ampdu_rx *tid_agg_rx,
00697                                              struct sk_buff *skb)
00698 {
00699         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00700         u16 sc = le16_to_cpu(hdr->seq_ctrl);
00701         u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
00702         u16 head_seq_num, buf_size;
00703         int index;
00704         bool ret = true;
00705 
00706         spin_lock(&tid_agg_rx->reorder_lock);
00707 
00708         buf_size = tid_agg_rx->buf_size;
00709         head_seq_num = tid_agg_rx->head_seq_num;
00710 
00711         /* frame with out of date sequence number */
00712         if (seq_less(mpdu_seq_num, head_seq_num)) {
00713                 dev_kfree_skb(skb);
00714                 goto out;
00715         }
00716 
00717         /*
00718          * If frame the sequence number exceeds our buffering window
00719          * size release some previous frames to make room for this one.
00720          */
00721         if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
00722                 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
00723                 /* release stored frames up to new head to stack */
00724                 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
00725         }
00726 
00727         /* Now the new frame is always in the range of the reordering buffer */
00728 
00729         index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
00730 
00731         /* check if we already stored this frame */
00732         if (tid_agg_rx->reorder_buf[index]) {
00733                 dev_kfree_skb(skb);
00734                 goto out;
00735         }
00736 
00737         /*
00738          * If the current MPDU is in the right order and nothing else
00739          * is stored we can process it directly, no need to buffer it.
00740          * If it is first but there's something stored, we may be able
00741          * to release frames after this one.
00742          */
00743         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
00744             tid_agg_rx->stored_mpdu_num == 0) {
00745                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
00746                 ret = false;
00747                 goto out;
00748         }
00749 
00750         /* put the frame in the reordering buffer */
00751         tid_agg_rx->reorder_buf[index] = skb;
00752         tid_agg_rx->reorder_time[index] = jiffies;
00753         tid_agg_rx->stored_mpdu_num++;
00754         ieee80211_sta_reorder_release(hw, tid_agg_rx);
00755 
00756  out:
00757         spin_unlock(&tid_agg_rx->reorder_lock);
00758         return ret;
00759 }
00760 
00761 /*
00762  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
00763  * true if the MPDU was buffered, false if it should be processed.
00764  */
00765 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
00766 {
00767         struct sk_buff *skb = rx->skb;
00768         struct ieee80211_local *local = rx->local;
00769         struct ieee80211_hw *hw = &local->hw;
00770         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
00771         struct sta_info *sta = rx->sta;
00772         struct tid_ampdu_rx *tid_agg_rx;
00773         u16 sc;
00774         int tid;
00775 
00776         if (!ieee80211_is_data_qos(hdr->frame_control))
00777                 goto dont_reorder;
00778 
00779         /*
00780          * filter the QoS data rx stream according to
00781          * STA/TID and check if this STA/TID is on aggregation
00782          */
00783 
00784         if (!sta)
00785                 goto dont_reorder;
00786 
00787         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
00788 
00789         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
00790         if (!tid_agg_rx)
00791                 goto dont_reorder;
00792 
00793         /* qos null data frames are excluded */
00794         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
00795                 goto dont_reorder;
00796 
00797         /* new, potentially un-ordered, ampdu frame - process it */
00798 
00799         /* reset session timer */
00800         if (tid_agg_rx->timeout)
00801                 mod_timer(&tid_agg_rx->session_timer,
00802                           TU_TO_EXP_TIME(tid_agg_rx->timeout));
00803 
00804         /* if this mpdu is fragmented - terminate rx aggregation session */
00805         sc = le16_to_cpu(hdr->seq_ctrl);
00806         if (sc & IEEE80211_SCTL_FRAG) {
00807                 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
00808                 skb_queue_tail(&rx->sdata->skb_queue, skb);
00809                 ieee80211_queue_work(&local->hw, &rx->sdata->work);
00810                 return;
00811         }
00812 
00813         /*
00814          * No locking needed -- we will only ever process one
00815          * RX packet at a time, and thus own tid_agg_rx. All
00816          * other code manipulating it needs to (and does) make
00817          * sure that we cannot get to it any more before doing
00818          * anything with it.
00819          */
00820         if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
00821                 return;
00822 
00823  dont_reorder:
00824         skb_queue_tail(&local->rx_skb_queue, skb);
00825 }
00826 
00827 static ieee80211_rx_result debug_noinline
00828 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
00829 {
00830         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
00831         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
00832 
00833         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
00834         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
00835                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
00836                              rx->sta->last_seq_ctrl[rx->seqno_idx] ==
00837                              hdr->seq_ctrl)) {
00838                         if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
00839                                 rx->local->dot11FrameDuplicateCount++;
00840                                 rx->sta->num_duplicates++;
00841                         }
00842                         return RX_DROP_UNUSABLE;
00843                 } else
00844                         rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
00845         }
00846 
00847         if (unlikely(rx->skb->len < 16)) {
00848                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
00849                 return RX_DROP_MONITOR;
00850         }
00851 
00852         /* Drop disallowed frame classes based on STA auth/assoc state;
00853          * IEEE 802.11, Chap 5.5.
00854          *
00855          * mac80211 filters only based on association state, i.e. it drops
00856          * Class 3 frames from not associated stations. hostapd sends
00857          * deauth/disassoc frames when needed. In addition, hostapd is
00858          * responsible for filtering on both auth and assoc states.
00859          */
00860 
00861         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
00862                 return ieee80211_rx_mesh_check(rx);
00863 
00864         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
00865                       ieee80211_is_pspoll(hdr->frame_control)) &&
00866                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
00867                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
00868                      (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
00869                 if (rx->sta && rx->sta->dummy &&
00870                     ieee80211_is_data_present(hdr->frame_control)) {
00871                         u16 ethertype;
00872                         u8 *payload;
00873 
00874                         payload = rx->skb->data +
00875                                 ieee80211_hdrlen(hdr->frame_control);
00876                         ethertype = (payload[6] << 8) | payload[7];
00877                         if (cpu_to_be16(ethertype) ==
00878                             rx->sdata->control_port_protocol)
00879                                 return RX_CONTINUE;
00880                 }
00881                 return RX_DROP_MONITOR;
00882         }
00883 
00884         return RX_CONTINUE;
00885 }
00886 
00887 
00888 static ieee80211_rx_result debug_noinline
00889 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
00890 {
00891         struct sk_buff *skb = rx->skb;
00892         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
00893         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
00894         int keyidx;
00895         int hdrlen;
00896         ieee80211_rx_result result = RX_DROP_UNUSABLE;
00897         struct ieee80211_key *sta_ptk = NULL;
00898         int mmie_keyidx = -1;
00899         __le16 fc;
00900 
00901         /*
00902          * Key selection 101
00903          *
00904          * There are four types of keys:
00905          *  - GTK (group keys)
00906          *  - IGTK (group keys for management frames)
00907          *  - PTK (pairwise keys)
00908          *  - STK (station-to-station pairwise keys)
00909          *
00910          * When selecting a key, we have to distinguish between multicast
00911          * (including broadcast) and unicast frames, the latter can only
00912          * use PTKs and STKs while the former always use GTKs and IGTKs.
00913          * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
00914          * unicast frames can also use key indices like GTKs. Hence, if we
00915          * don't have a PTK/STK we check the key index for a WEP key.
00916          *
00917          * Note that in a regular BSS, multicast frames are sent by the
00918          * AP only, associated stations unicast the frame to the AP first
00919          * which then multicasts it on their behalf.
00920          *
00921          * There is also a slight problem in IBSS mode: GTKs are negotiated
00922          * with each station, that is something we don't currently handle.
00923          * The spec seems to expect that one negotiates the same key with
00924          * every station but there's no such requirement; VLANs could be
00925          * possible.
00926          */
00927 
00928         /*
00929          * No point in finding a key and decrypting if the frame is neither
00930          * addressed to us nor a multicast frame.
00931          */
00932         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
00933                 return RX_CONTINUE;
00934 
00935         /* start without a key */
00936         rx->key = NULL;
00937 
00938         if (rx->sta)
00939                 sta_ptk = rcu_dereference(rx->sta->ptk);
00940 
00941         fc = hdr->frame_control;
00942 
00943         if (!ieee80211_has_protected(fc))
00944                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
00945 
00946         if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
00947                 rx->key = sta_ptk;
00948                 if ((status->flag & RX_FLAG_DECRYPTED) &&
00949                     (status->flag & RX_FLAG_IV_STRIPPED))
00950                         return RX_CONTINUE;
00951                 /* Skip decryption if the frame is not protected. */
00952                 if (!ieee80211_has_protected(fc))
00953                         return RX_CONTINUE;
00954         } else if (mmie_keyidx >= 0) {
00955                 /* Broadcast/multicast robust management frame / BIP */
00956                 if ((status->flag & RX_FLAG_DECRYPTED) &&
00957                     (status->flag & RX_FLAG_IV_STRIPPED))
00958                         return RX_CONTINUE;
00959 
00960                 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
00961                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
00962                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
00963                 if (rx->sta)
00964                         rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
00965                 if (!rx->key)
00966                         rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
00967         } else if (!ieee80211_has_protected(fc)) {
00968                 /*
00969                  * The frame was not protected, so skip decryption. However, we
00970                  * need to set rx->key if there is a key that could have been
00971                  * used so that the frame may be dropped if encryption would
00972                  * have been expected.
00973                  */
00974                 struct ieee80211_key *key = NULL;
00975                 struct ieee80211_sub_if_data *sdata = rx->sdata;
00976                 int i;
00977 
00978                 if (ieee80211_is_mgmt(fc) &&
00979                     is_multicast_ether_addr(hdr->addr1) &&
00980                     (key = rcu_dereference(rx->sdata->default_mgmt_key)))
00981                         rx->key = key;
00982                 else {
00983                         if (rx->sta) {
00984                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
00985                                         key = rcu_dereference(rx->sta->gtk[i]);
00986                                         if (key)
00987                                                 break;
00988                                 }
00989                         }
00990                         if (!key) {
00991                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
00992                                         key = rcu_dereference(sdata->keys[i]);
00993                                         if (key)
00994                                                 break;
00995                                 }
00996                         }
00997                         if (key)
00998                                 rx->key = key;
00999                 }
01000                 return RX_CONTINUE;
01001         } else {
01002                 u8 keyid;
01003                 /*
01004                  * The device doesn't give us the IV so we won't be
01005                  * able to look up the key. That's ok though, we
01006                  * don't need to decrypt the frame, we just won't
01007                  * be able to keep statistics accurate.
01008                  * Except for key threshold notifications, should
01009                  * we somehow allow the driver to tell us which key
01010                  * the hardware used if this flag is set?
01011                  */
01012                 if ((status->flag & RX_FLAG_DECRYPTED) &&
01013                     (status->flag & RX_FLAG_IV_STRIPPED))
01014                         return RX_CONTINUE;
01015 
01016                 hdrlen = ieee80211_hdrlen(fc);
01017 
01018                 if (rx->skb->len < 8 + hdrlen)
01019                         return RX_DROP_UNUSABLE; /* TODO: count this? */
01020 
01021                 /*
01022                  * no need to call ieee80211_wep_get_keyidx,
01023                  * it verifies a bunch of things we've done already
01024                  */
01025                 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
01026                 keyidx = keyid >> 6;
01027 
01028                 /* check per-station GTK first, if multicast packet */
01029                 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
01030                         rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
01031 
01032                 /* if not found, try default key */
01033                 if (!rx->key) {
01034                         rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
01035 
01036                         /*
01037                          * RSNA-protected unicast frames should always be
01038                          * sent with pairwise or station-to-station keys,
01039                          * but for WEP we allow using a key index as well.
01040                          */
01041                         if (rx->key &&
01042                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
01043                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
01044                             !is_multicast_ether_addr(hdr->addr1))
01045                                 rx->key = NULL;
01046                 }
01047         }
01048 
01049         if (rx->key) {
01050                 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
01051                         return RX_DROP_MONITOR;
01052 
01053                 rx->key->tx_rx_count++;
01054                 /* TODO: add threshold stuff again */
01055         } else {
01056                 return RX_DROP_MONITOR;
01057         }
01058 
01059         if (skb_linearize(rx->skb))
01060                 return RX_DROP_UNUSABLE;
01061         /* the hdr variable is invalid now! */
01062 
01063         switch (rx->key->conf.cipher) {
01064         case WLAN_CIPHER_SUITE_WEP40:
01065         case WLAN_CIPHER_SUITE_WEP104:
01066                 /* Check for weak IVs if possible */
01067                 if (rx->sta && ieee80211_is_data(fc) &&
01068                     (!(status->flag & RX_FLAG_IV_STRIPPED) ||
01069                      !(status->flag & RX_FLAG_DECRYPTED)) &&
01070                     ieee80211_wep_is_weak_iv(rx->skb, rx->key))
01071                         rx->sta->wep_weak_iv_count++;
01072 
01073                 result = ieee80211_crypto_wep_decrypt(rx);
01074                 break;
01075         case WLAN_CIPHER_SUITE_TKIP:
01076                 result = ieee80211_crypto_tkip_decrypt(rx);
01077                 break;
01078         case WLAN_CIPHER_SUITE_CCMP:
01079                 result = ieee80211_crypto_ccmp_decrypt(rx);
01080                 break;
01081         case WLAN_CIPHER_SUITE_AES_CMAC:
01082                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
01083                 break;
01084         default:
01085                 /*
01086                  * We can reach here only with HW-only algorithms
01087                  * but why didn't it decrypt the frame?!
01088                  */
01089                 return RX_DROP_UNUSABLE;
01090         }
01091 
01092         /* either the frame has been decrypted or will be dropped */
01093         status->flag |= RX_FLAG_DECRYPTED;
01094 
01095         return result;
01096 }
01097 
01098 static ieee80211_rx_result debug_noinline
01099 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
01100 {
01101         struct ieee80211_local *local;
01102         struct ieee80211_hdr *hdr;
01103         struct sk_buff *skb;
01104 
01105         local = rx->local;
01106         skb = rx->skb;
01107         hdr = (struct ieee80211_hdr *) skb->data;
01108 
01109         if (!local->pspolling)
01110                 return RX_CONTINUE;
01111 
01112         if (!ieee80211_has_fromds(hdr->frame_control))
01113                 /* this is not from AP */
01114                 return RX_CONTINUE;
01115 
01116         if (!ieee80211_is_data(hdr->frame_control))
01117                 return RX_CONTINUE;
01118 
01119         if (!ieee80211_has_moredata(hdr->frame_control)) {
01120                 /* AP has no more frames buffered for us */
01121                 local->pspolling = false;
01122                 return RX_CONTINUE;
01123         }
01124 
01125         /* more data bit is set, let's request a new frame from the AP */
01126         ieee80211_send_pspoll(local, rx->sdata);
01127 
01128         return RX_CONTINUE;
01129 }
01130 
01131 static void ap_sta_ps_start(struct sta_info *sta)
01132 {
01133         struct ieee80211_sub_if_data *sdata = sta->sdata;
01134         struct ieee80211_local *local = sdata->local;
01135 
01136         atomic_inc(&sdata->bss->num_sta_ps);
01137         set_sta_flag(sta, WLAN_STA_PS_STA);
01138         if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
01139                 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
01140 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
01141         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
01142                sdata->name, sta->sta.addr, sta->sta.aid);
01143 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
01144 }
01145 
01146 static void ap_sta_ps_end(struct sta_info *sta)
01147 {
01148         struct ieee80211_sub_if_data *sdata = sta->sdata;
01149 
01150         atomic_dec(&sdata->bss->num_sta_ps);
01151 
01152 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
01153         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
01154                sdata->name, sta->sta.addr, sta->sta.aid);
01155 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
01156 
01157         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
01158 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
01159                 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
01160                        sdata->name, sta->sta.addr, sta->sta.aid);
01161 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
01162                 return;
01163         }
01164 
01165         ieee80211_sta_ps_deliver_wakeup(sta);
01166 }
01167 
01168 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
01169 {
01170         struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
01171         bool in_ps;
01172 
01173         WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
01174 
01175         /* Don't let the same PS state be set twice */
01176         in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
01177         if ((start && in_ps) || (!start && !in_ps))
01178                 return -EINVAL;
01179 
01180         if (start)
01181                 ap_sta_ps_start(sta_inf);
01182         else
01183                 ap_sta_ps_end(sta_inf);
01184 
01185         return 0;
01186 }
01187 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
01188 
01189 static ieee80211_rx_result debug_noinline
01190 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
01191 {
01192         struct ieee80211_sub_if_data *sdata = rx->sdata;
01193         struct ieee80211_hdr *hdr = (void *)rx->skb->data;
01194         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01195         int tid, ac;
01196 
01197         if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
01198                 return RX_CONTINUE;
01199 
01200         if (sdata->vif.type != NL80211_IFTYPE_AP &&
01201             sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
01202                 return RX_CONTINUE;
01203 
01204         /*
01205          * The device handles station powersave, so don't do anything about
01206          * uAPSD and PS-Poll frames (the latter shouldn't even come up from
01207          * it to mac80211 since they're handled.)
01208          */
01209         if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
01210                 return RX_CONTINUE;
01211 
01212         /*
01213          * Don't do anything if the station isn't already asleep. In
01214          * the uAPSD case, the station will probably be marked asleep,
01215          * in the PS-Poll case the station must be confused ...
01216          */
01217         if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
01218                 return RX_CONTINUE;
01219 
01220         if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
01221                 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
01222                         if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
01223                                 ieee80211_sta_ps_deliver_poll_response(rx->sta);
01224                         else
01225                                 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
01226                 }
01227 
01228                 /* Free PS Poll skb here instead of returning RX_DROP that would
01229                  * count as an dropped frame. */
01230                 dev_kfree_skb(rx->skb);
01231 
01232                 return RX_QUEUED;
01233         } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
01234                    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
01235                    ieee80211_has_pm(hdr->frame_control) &&
01236                    (ieee80211_is_data_qos(hdr->frame_control) ||
01237                     ieee80211_is_qos_nullfunc(hdr->frame_control))) {
01238                 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
01239                 ac = ieee802_1d_to_ac[tid & 7];
01240 
01241                 /*
01242                  * If this AC is not trigger-enabled do nothing.
01243                  *
01244                  * NB: This could/should check a separate bitmap of trigger-
01245                  * enabled queues, but for now we only implement uAPSD w/o
01246                  * TSPEC changes to the ACs, so they're always the same.
01247                  */
01248                 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
01249                         return RX_CONTINUE;
01250 
01251                 /* if we are in a service period, do nothing */
01252                 if (test_sta_flag(rx->sta, WLAN_STA_SP))
01253                         return RX_CONTINUE;
01254 
01255                 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
01256                         ieee80211_sta_ps_deliver_uapsd(rx->sta);
01257                 else
01258                         set_sta_flag(rx->sta, WLAN_STA_UAPSD);
01259         }
01260 
01261         return RX_CONTINUE;
01262 }
01263 
01264 static ieee80211_rx_result debug_noinline
01265 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
01266 {
01267         struct sta_info *sta = rx->sta;
01268         struct sk_buff *skb = rx->skb;
01269         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
01270         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
01271 
01272         if (!sta)
01273                 return RX_CONTINUE;
01274 
01275         /*
01276          * Update last_rx only for IBSS packets which are for the current
01277          * BSSID to avoid keeping the current IBSS network alive in cases
01278          * where other STAs start using different BSSID.
01279          */
01280         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
01281                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
01282                                                 NL80211_IFTYPE_ADHOC);
01283                 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0) {
01284                         sta->last_rx = jiffies;
01285                         if (ieee80211_is_data(hdr->frame_control)) {
01286                                 sta->last_rx_rate_idx = status->rate_idx;
01287                                 sta->last_rx_rate_flag = status->flag;
01288                         }
01289                 }
01290         } else if (!is_multicast_ether_addr(hdr->addr1)) {
01291                 /*
01292                  * Mesh beacons will update last_rx when if they are found to
01293                  * match the current local configuration when processed.
01294                  */
01295                 sta->last_rx = jiffies;
01296                 if (ieee80211_is_data(hdr->frame_control)) {
01297                         sta->last_rx_rate_idx = status->rate_idx;
01298                         sta->last_rx_rate_flag = status->flag;
01299                 }
01300         }
01301 
01302         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
01303                 return RX_CONTINUE;
01304 
01305         if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
01306                 ieee80211_sta_rx_notify(rx->sdata, hdr);
01307 
01308         sta->rx_fragments++;
01309         sta->rx_bytes += rx->skb->len;
01310         sta->last_signal = status->signal;
01311         ewma_add(&sta->avg_signal, -status->signal);
01312 
01313         /*
01314          * Change STA power saving mode only at the end of a frame
01315          * exchange sequence.
01316          */
01317         if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
01318             !ieee80211_has_morefrags(hdr->frame_control) &&
01319             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
01320             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
01321              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
01322                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
01323                         /*
01324                          * Ignore doze->wake transitions that are
01325                          * indicated by non-data frames, the standard
01326                          * is unclear here, but for example going to
01327                          * PS mode and then scanning would cause a
01328                          * doze->wake transition for the probe request,
01329                          * and that is clearly undesirable.
01330                          */
01331                         if (ieee80211_is_data(hdr->frame_control) &&
01332                             !ieee80211_has_pm(hdr->frame_control))
01333                                 ap_sta_ps_end(sta);
01334                 } else {
01335                         if (ieee80211_has_pm(hdr->frame_control))
01336                                 ap_sta_ps_start(sta);
01337                 }
01338         }
01339 
01340         /*
01341          * Drop (qos-)data::nullfunc frames silently, since they
01342          * are used only to control station power saving mode.
01343          */
01344         if (ieee80211_is_nullfunc(hdr->frame_control) ||
01345             ieee80211_is_qos_nullfunc(hdr->frame_control)) {
01346                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
01347 
01348                 /*
01349                  * If we receive a 4-addr nullfunc frame from a STA
01350                  * that was not moved to a 4-addr STA vlan yet, drop
01351                  * the frame to the monitor interface, to make sure
01352                  * that hostapd sees it
01353                  */
01354                 if (ieee80211_has_a4(hdr->frame_control) &&
01355                     (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
01356                      (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
01357                       !rx->sdata->u.vlan.sta)))
01358                         return RX_DROP_MONITOR;
01359                 /*
01360                  * Update counter and free packet here to avoid
01361                  * counting this as a dropped packed.
01362                  */
01363                 sta->rx_packets++;
01364                 dev_kfree_skb(rx->skb);
01365                 return RX_QUEUED;
01366         }
01367 
01368         return RX_CONTINUE;
01369 } /* ieee80211_rx_h_sta_process */
01370 
01371 static inline struct ieee80211_fragment_entry *
01372 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
01373                          unsigned int frag, unsigned int seq, int rx_queue,
01374                          struct sk_buff **skb)
01375 {
01376         struct ieee80211_fragment_entry *entry;
01377         int idx;
01378 
01379         idx = sdata->fragment_next;
01380         entry = &sdata->fragments[sdata->fragment_next++];
01381         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
01382                 sdata->fragment_next = 0;
01383 
01384         if (!skb_queue_empty(&entry->skb_list)) {
01385 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
01386                 struct ieee80211_hdr *hdr =
01387                         (struct ieee80211_hdr *) entry->skb_list.next->data;
01388                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
01389                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
01390                        "addr1=%pM addr2=%pM\n",
01391                        sdata->name, idx,
01392                        jiffies - entry->first_frag_time, entry->seq,
01393                        entry->last_frag, hdr->addr1, hdr->addr2);
01394 #endif
01395                 __skb_queue_purge(&entry->skb_list);
01396         }
01397 
01398         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
01399         *skb = NULL;
01400         entry->first_frag_time = jiffies;
01401         entry->seq = seq;
01402         entry->rx_queue = rx_queue;
01403         entry->last_frag = frag;
01404         entry->ccmp = 0;
01405         entry->extra_len = 0;
01406 
01407         return entry;
01408 }
01409 
01410 static inline struct ieee80211_fragment_entry *
01411 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
01412                           unsigned int frag, unsigned int seq,
01413                           int rx_queue, struct ieee80211_hdr *hdr)
01414 {
01415         struct ieee80211_fragment_entry *entry;
01416         int i, idx;
01417 
01418         idx = sdata->fragment_next;
01419         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
01420                 struct ieee80211_hdr *f_hdr;
01421 
01422                 idx--;
01423                 if (idx < 0)
01424                         idx = IEEE80211_FRAGMENT_MAX - 1;
01425 
01426                 entry = &sdata->fragments[idx];
01427                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
01428                     entry->rx_queue != rx_queue ||
01429                     entry->last_frag + 1 != frag)
01430                         continue;
01431 
01432                 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
01433 
01434                 /*
01435                  * Check ftype and addresses are equal, else check next fragment
01436                  */
01437                 if (((hdr->frame_control ^ f_hdr->frame_control) &
01438                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
01439                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
01440                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
01441                         continue;
01442 
01443                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
01444                         __skb_queue_purge(&entry->skb_list);
01445                         continue;
01446                 }
01447                 return entry;
01448         }
01449 
01450         return NULL;
01451 }
01452 
01453 static ieee80211_rx_result debug_noinline
01454 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
01455 {
01456         struct ieee80211_hdr *hdr;
01457         u16 sc;
01458         __le16 fc;
01459         unsigned int frag, seq;
01460         struct ieee80211_fragment_entry *entry;
01461         struct sk_buff *skb;
01462         struct ieee80211_rx_status *status;
01463 
01464         hdr = (struct ieee80211_hdr *)rx->skb->data;
01465         fc = hdr->frame_control;
01466         sc = le16_to_cpu(hdr->seq_ctrl);
01467         frag = sc & IEEE80211_SCTL_FRAG;
01468 
01469         if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
01470                    (rx->skb)->len < 24 ||
01471                    is_multicast_ether_addr(hdr->addr1))) {
01472                 /* not fragmented */
01473                 goto out;
01474         }
01475         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
01476 
01477         if (skb_linearize(rx->skb))
01478                 return RX_DROP_UNUSABLE;
01479 
01480         /*
01481          *  skb_linearize() might change the skb->data and
01482          *  previously cached variables (in this case, hdr) need to
01483          *  be refreshed with the new data.
01484          */
01485         hdr = (struct ieee80211_hdr *)rx->skb->data;
01486         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
01487 
01488         if (frag == 0) {
01489                 /* This is the first fragment of a new frame. */
01490                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
01491                                                  rx->seqno_idx, &(rx->skb));
01492                 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
01493                     ieee80211_has_protected(fc)) {
01494                         int queue = rx->security_idx;
01495                         /* Store CCMP PN so that we can verify that the next
01496                          * fragment has a sequential PN value. */
01497                         entry->ccmp = 1;
01498                         memcpy(entry->last_pn,
01499                                rx->key->u.ccmp.rx_pn[queue],
01500                                CCMP_PN_LEN);
01501                 }
01502                 return RX_QUEUED;
01503         }
01504 
01505         /* This is a fragment for a frame that should already be pending in
01506          * fragment cache. Add this fragment to the end of the pending entry.
01507          */
01508         entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
01509                                           rx->seqno_idx, hdr);
01510         if (!entry) {
01511                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
01512                 return RX_DROP_MONITOR;
01513         }
01514 
01515         /* Verify that MPDUs within one MSDU have sequential PN values.
01516          * (IEEE 802.11i, 8.3.3.4.5) */
01517         if (entry->ccmp) {
01518                 int i;
01519                 u8 pn[CCMP_PN_LEN], *rpn;
01520                 int queue;
01521                 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
01522                         return RX_DROP_UNUSABLE;
01523                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
01524                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
01525                         pn[i]++;
01526                         if (pn[i])
01527                                 break;
01528                 }
01529                 queue = rx->security_idx;
01530                 rpn = rx->key->u.ccmp.rx_pn[queue];
01531                 if (memcmp(pn, rpn, CCMP_PN_LEN))
01532                         return RX_DROP_UNUSABLE;
01533                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
01534         }
01535 
01536         skb_pull(rx->skb, ieee80211_hdrlen(fc));
01537         __skb_queue_tail(&entry->skb_list, rx->skb);
01538         entry->last_frag = frag;
01539         entry->extra_len += rx->skb->len;
01540         if (ieee80211_has_morefrags(fc)) {
01541                 rx->skb = NULL;
01542                 return RX_QUEUED;
01543         }
01544 
01545         rx->skb = __skb_dequeue(&entry->skb_list);
01546         if (skb_tailroom(rx->skb) < entry->extra_len) {
01547                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
01548                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
01549                                               GFP_ATOMIC))) {
01550                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
01551                         __skb_queue_purge(&entry->skb_list);
01552                         return RX_DROP_UNUSABLE;
01553                 }
01554         }
01555         while ((skb = __skb_dequeue(&entry->skb_list))) {
01556                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
01557                 dev_kfree_skb(skb);
01558         }
01559 
01560         /* Complete frame has been reassembled - process it now */
01561         status = IEEE80211_SKB_RXCB(rx->skb);
01562         status->rx_flags |= IEEE80211_RX_FRAGMENTED;
01563 
01564  out:
01565         if (rx->sta)
01566                 rx->sta->rx_packets++;
01567         if (is_multicast_ether_addr(hdr->addr1))
01568                 rx->local->dot11MulticastReceivedFrameCount++;
01569         else
01570                 ieee80211_led_rx(rx->local);
01571         return RX_CONTINUE;
01572 }
01573 
01574 static ieee80211_rx_result debug_noinline
01575 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
01576 {
01577         u8 *data = rx->skb->data;
01578         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
01579 
01580         if (!ieee80211_is_data_qos(hdr->frame_control))
01581                 return RX_CONTINUE;
01582 
01583         /* remove the qos control field, update frame type and meta-data */
01584         memmove(data + IEEE80211_QOS_CTL_LEN, data,
01585                 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
01586         hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
01587         /* change frame type to non QOS */
01588         hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
01589 
01590         return RX_CONTINUE;
01591 }
01592 
01593 static int
01594 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
01595 {
01596         if (unlikely(!rx->sta ||
01597             !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
01598                 return -EACCES;
01599 
01600         return 0;
01601 }
01602 
01603 static int
01604 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
01605 {
01606         struct sk_buff *skb = rx->skb;
01607         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
01608 
01609         /*
01610          * Pass through unencrypted frames if the hardware has
01611          * decrypted them already.
01612          */
01613         if (status->flag & RX_FLAG_DECRYPTED)
01614                 return 0;
01615 
01616         /* Drop unencrypted frames if key is set. */
01617         if (unlikely(!ieee80211_has_protected(fc) &&
01618                      !ieee80211_is_nullfunc(fc) &&
01619                      ieee80211_is_data(fc) &&
01620                      (rx->key || rx->sdata->drop_unencrypted)))
01621                 return -EACCES;
01622 
01623         return 0;
01624 }
01625 
01626 static int
01627 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
01628 {
01629         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
01630         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01631         __le16 fc = hdr->frame_control;
01632 
01633         /*
01634          * Pass through unencrypted frames if the hardware has
01635          * decrypted them already.
01636          */
01637         if (status->flag & RX_FLAG_DECRYPTED)
01638                 return 0;
01639 
01640         if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
01641                 if (unlikely(!ieee80211_has_protected(fc) &&
01642                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
01643                              rx->key)) {
01644                         if (ieee80211_is_deauth(fc))
01645                                 cfg80211_send_unprot_deauth(rx->sdata->dev,
01646                                                             rx->skb->data,
01647                                                             rx->skb->len);
01648                         else if (ieee80211_is_disassoc(fc))
01649                                 cfg80211_send_unprot_disassoc(rx->sdata->dev,
01650                                                               rx->skb->data,
01651                                                               rx->skb->len);
01652                         return -EACCES;
01653                 }
01654                 /* BIP does not use Protected field, so need to check MMIE */
01655                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
01656                              ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
01657                         if (ieee80211_is_deauth(fc))
01658                                 cfg80211_send_unprot_deauth(rx->sdata->dev,
01659                                                             rx->skb->data,
01660                                                             rx->skb->len);
01661                         else if (ieee80211_is_disassoc(fc))
01662                                 cfg80211_send_unprot_disassoc(rx->sdata->dev,
01663                                                               rx->skb->data,
01664                                                               rx->skb->len);
01665                         return -EACCES;
01666                 }
01667                 /*
01668                  * When using MFP, Action frames are not allowed prior to
01669                  * having configured keys.
01670                  */
01671                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
01672                              ieee80211_is_robust_mgmt_frame(
01673                                      (struct ieee80211_hdr *) rx->skb->data)))
01674                         return -EACCES;
01675         }
01676 
01677         return 0;
01678 }
01679 
01680 static int
01681 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
01682 {
01683         struct ieee80211_sub_if_data *sdata = rx->sdata;
01684         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
01685         bool check_port_control = false;
01686         struct ethhdr *ehdr;
01687         int ret;
01688 
01689         *port_control = false;
01690         if (ieee80211_has_a4(hdr->frame_control) &&
01691             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
01692                 return -1;
01693 
01694         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
01695             !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
01696 
01697                 if (!sdata->u.mgd.use_4addr)
01698                         return -1;
01699                 else
01700                         check_port_control = true;
01701         }
01702 
01703         if (is_multicast_ether_addr(hdr->addr1) &&
01704             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
01705                 return -1;
01706 
01707         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
01708         if (ret < 0)
01709                 return ret;
01710 
01711         ehdr = (struct ethhdr *) rx->skb->data;
01712         if (ehdr->h_proto == rx->sdata->control_port_protocol)
01713                 *port_control = true;
01714         else if (check_port_control)
01715                 return -1;
01716 
01717         return 0;
01718 }
01719 
01720 /*
01721  * requires that rx->skb is a frame with ethernet header
01722  */
01723 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
01724 {
01725         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
01726                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
01727         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
01728 
01729         /*
01730          * Allow EAPOL frames to us/the PAE group address regardless
01731          * of whether the frame was encrypted or not.
01732          */
01733         if (ehdr->h_proto == rx->sdata->control_port_protocol &&
01734             (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
01735              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
01736                 return true;
01737 
01738         if (ieee80211_802_1x_port_control(rx) ||
01739             ieee80211_drop_unencrypted(rx, fc))
01740                 return false;
01741 
01742         return true;
01743 }
01744 
01745 
01746 /*
01747  * requires that rx->skb is a frame with ethernet header
01748  */
01749 static void
01750 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
01751 {
01752         struct ieee80211_sub_if_data *sdata = rx->sdata;
01753         struct net_device *dev = sdata->dev;
01754         struct sk_buff *skb, *xmit_skb;
01755         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
01756         struct sta_info *dsta;
01757 
01758         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01759 
01760         skb = rx->skb;
01761         xmit_skb = NULL;
01762 
01763 
01764         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
01765              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
01766             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
01767             (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
01768             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
01769                 if (is_multicast_ether_addr(ehdr->h_dest)) {
01770                         /*
01771                          * send multicast frames both to higher layers in
01772                          * local net stack and back to the wireless medium
01773                          */
01774                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
01775                         if (!xmit_skb && net_ratelimit())
01776                                 printk(KERN_DEBUG "%s: failed to clone "
01777                                        "multicast frame\n", dev->name);
01778                 } else {
01779                         dsta = sta_info_get(sdata, skb->data);
01780                         if (dsta) {
01781                                 /*
01782                                  * The destination station is associated to
01783                                  * this AP (in this VLAN), so send the frame
01784                                  * directly to it and do not pass it to local
01785                                  * net stack.
01786                                  */
01787                                 xmit_skb = skb;
01788                                 skb = NULL;
01789                         }
01790                 }
01791         }
01792 
01793         if (skb) {
01794                 int align __maybe_unused;
01795 
01796 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
01797                 /*
01798                  * 'align' will only take the values 0 or 2 here
01799                  * since all frames are required to be aligned
01800                  * to 2-byte boundaries when being passed to
01801                  * mac80211. That also explains the __skb_push()
01802                  * below.
01803                  */
01804                 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
01805                 if (align) {
01806                         if (WARN_ON(skb_headroom(skb) < 3)) {
01807                                 dev_kfree_skb(skb);
01808                                 skb = NULL;
01809                         } else {
01810                                 u8 *data = skb->data;
01811                                 size_t len = skb_headlen(skb);
01812                                 skb->data -= align;
01813                                 memmove(skb->data, data, len);
01814                                 skb_set_tail_pointer(skb, len);
01815                         }
01816                 }
01817 #endif
01818 
01819                 if (skb) {      
01820                         skb->protocol = eth_type_trans(skb, dev);
01821                         memset(skb->cb, 0, sizeof(skb->cb));
01822                         netif_receive_skb(skb);
01823                 }
01824         }
01825 
01826         if (xmit_skb) {
01827                 /* send to wireless media */
01828                 xmit_skb->protocol = htons(ETH_P_802_3);
01829                 skb_reset_network_header(xmit_skb);
01830                 skb_reset_mac_header(xmit_skb);
01831                 dev_queue_xmit(xmit_skb);
01832         }
01833 }
01834 
01835 
01836 
01837 
01838 static ieee80211_rx_result debug_noinline
01839 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
01840 {
01841         struct net_device *dev = rx->sdata->dev;
01842         struct sk_buff *skb = rx->skb;
01843         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
01844         __le16 fc = hdr->frame_control;
01845         struct sk_buff_head frame_list;
01846         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
01847 
01848         if (unlikely(!ieee80211_is_data(fc)))
01849                 return RX_CONTINUE;
01850 
01851         if (unlikely(!ieee80211_is_data_present(fc)))
01852                 return RX_DROP_MONITOR;
01853 
01854         if (!(status->rx_flags & IEEE80211_RX_AMSDU))
01855                 return RX_CONTINUE;
01856 
01857         if (ieee80211_has_a4(hdr->frame_control) &&
01858             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
01859             !rx->sdata->u.vlan.sta)
01860                 return RX_DROP_UNUSABLE;
01861 
01862         if (is_multicast_ether_addr(hdr->addr1) &&
01863             ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
01864               rx->sdata->u.vlan.sta) ||
01865              (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
01866               rx->sdata->u.mgd.use_4addr)))
01867                 return RX_DROP_UNUSABLE;
01868 
01869         skb->dev = dev;
01870         __skb_queue_head_init(&frame_list);
01871 
01872         if (skb_linearize(skb))
01873                 return RX_DROP_UNUSABLE;
01874 
01875         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
01876                                  rx->sdata->vif.type,
01877                                  rx->local->hw.extra_tx_headroom, true);
01878 
01879         while (!skb_queue_empty(&frame_list)) {
01880                 rx->skb = __skb_dequeue(&frame_list);
01881 
01882                 if (!ieee80211_frame_allowed(rx, fc)) {
01883                         dev_kfree_skb(rx->skb);
01884                         continue;
01885                 }
01886                 dev->stats.rx_packets++;
01887                 dev->stats.rx_bytes += rx->skb->len;
01888 
01889                 ieee80211_deliver_skb(rx);
01890         }
01891 
01892         return RX_QUEUED;
01893 }
01894 
01895 #ifdef CONFIG_MAC80211_MESH
01896 static ieee80211_rx_result
01897 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
01898 {
01899         struct ieee80211_hdr *hdr;
01900         struct ieee80211s_hdr *mesh_hdr;
01901         unsigned int hdrlen;
01902         struct sk_buff *skb = rx->skb, *fwd_skb;
01903         struct ieee80211_local *local = rx->local;
01904         struct ieee80211_sub_if_data *sdata = rx->sdata;
01905         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
01906 
01907         hdr = (struct ieee80211_hdr *) skb->data;
01908         hdrlen = ieee80211_hdrlen(hdr->frame_control);
01909         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
01910 
01911         /* frame is in RMC, don't forward */
01912         if (ieee80211_is_data(hdr->frame_control) &&
01913             is_multicast_ether_addr(hdr->addr1) &&
01914             mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
01915                 return RX_DROP_MONITOR;
01916 
01917         if (!ieee80211_is_data(hdr->frame_control))
01918                 return RX_CONTINUE;
01919 
01920         if (!mesh_hdr->ttl)
01921                 /* illegal frame */
01922                 return RX_DROP_MONITOR;
01923 
01924         if (ieee80211_queue_stopped(&local->hw, skb_get_queue_mapping(skb))) {
01925                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
01926                                                 dropped_frames_congestion);
01927                 return RX_DROP_MONITOR;
01928         }
01929 
01930         if (mesh_hdr->flags & MESH_FLAGS_AE) {
01931                 struct mesh_path *mppath;
01932                 char *proxied_addr;
01933                 char *mpp_addr;
01934 
01935                 if (is_multicast_ether_addr(hdr->addr1)) {
01936                         mpp_addr = hdr->addr3;
01937                         proxied_addr = mesh_hdr->eaddr1;
01938                 } else {
01939                         mpp_addr = hdr->addr4;
01940                         proxied_addr = mesh_hdr->eaddr2;
01941                 }
01942 
01943                 rcu_read_lock();
01944                 mppath = mpp_path_lookup(proxied_addr, sdata);
01945                 if (!mppath) {
01946                         mpp_path_add(proxied_addr, mpp_addr, sdata);
01947                 } else {
01948                         spin_lock_bh(&mppath->state_lock);
01949                         if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
01950                                 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
01951                         spin_unlock_bh(&mppath->state_lock);
01952                 }
01953                 rcu_read_unlock();
01954         }
01955 
01956         /* Frame has reached destination.  Don't forward */
01957         if (!is_multicast_ether_addr(hdr->addr1) &&
01958             compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
01959                 return RX_CONTINUE;
01960 
01961         mesh_hdr->ttl--;
01962 
01963         if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
01964                 if (!mesh_hdr->ttl)
01965                         IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
01966                                                      dropped_frames_ttl);
01967                 else {
01968                         struct ieee80211_hdr *fwd_hdr;
01969                         struct ieee80211_tx_info *info;
01970 
01971                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
01972 
01973                         if (!fwd_skb && net_ratelimit())
01974                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
01975                                                    sdata->name);
01976                         if (!fwd_skb)
01977                                 goto out;
01978 
01979                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
01980                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
01981                         info = IEEE80211_SKB_CB(fwd_skb);
01982                         memset(info, 0, sizeof(*info));
01983                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
01984                         info->control.vif = &rx->sdata->vif;
01985                         if (is_multicast_ether_addr(fwd_hdr->addr1)) {
01986                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
01987                                                                 fwded_mcast);
01988                                 skb_set_queue_mapping(fwd_skb,
01989                                         ieee80211_select_queue(sdata, fwd_skb));
01990                                 ieee80211_set_qos_hdr(sdata, fwd_skb);
01991                         } else {
01992                                 int err;
01993                                 /*
01994                                  * Save TA to addr1 to send TA a path error if a
01995                                  * suitable next hop is not found
01996                                  */
01997                                 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
01998                                                 ETH_ALEN);
01999                                 err = mesh_nexthop_lookup(fwd_skb, sdata);
02000                                 /* Failed to immediately resolve next hop:
02001                                  * fwded frame was dropped or will be added
02002                                  * later to the pending skb queue.  */
02003                                 if (err)
02004                                         return RX_DROP_MONITOR;
02005 
02006                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
02007                                                                 fwded_unicast);
02008                         }
02009                         IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
02010                                                      fwded_frames);
02011                         ieee80211_add_pending_skb(local, fwd_skb);
02012                 }
02013         }
02014 
02015  out:
02016         if (is_multicast_ether_addr(hdr->addr1) ||
02017             sdata->dev->flags & IFF_PROMISC)
02018                 return RX_CONTINUE;
02019         else
02020                 return RX_DROP_MONITOR;
02021 }
02022 #endif
02023 
02024 static ieee80211_rx_result debug_noinline
02025 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
02026 {
02027         struct ieee80211_sub_if_data *sdata = rx->sdata;
02028         struct ieee80211_local *local = rx->local;
02029         struct net_device *dev = sdata->dev;
02030         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
02031         __le16 fc = hdr->frame_control;
02032         bool port_control;
02033         int err;
02034 
02035         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
02036                 return RX_CONTINUE;
02037 
02038         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
02039                 return RX_DROP_MONITOR;
02040 
02041         /*
02042          * Allow the cooked monitor interface of an AP to see 4-addr frames so
02043          * that a 4-addr station can be detected and moved into a separate VLAN
02044          */
02045         if (ieee80211_has_a4(hdr->frame_control) &&
02046             sdata->vif.type == NL80211_IFTYPE_AP)
02047                 return RX_DROP_MONITOR;
02048 
02049         err = __ieee80211_data_to_8023(rx, &port_control);
02050         if (unlikely(err))
02051                 return RX_DROP_UNUSABLE;
02052 
02053         if (!ieee80211_frame_allowed(rx, fc))
02054                 return RX_DROP_MONITOR;
02055 
02056         if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
02057             unlikely(port_control) && sdata->bss) {
02058                 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
02059                                      u.ap);
02060                 dev = sdata->dev;
02061                 rx->sdata = sdata;
02062         }
02063 
02064         rx->skb->dev = dev;
02065 
02066         dev->stats.rx_packets++;
02067         dev->stats.rx_bytes += rx->skb->len;
02068 
02069         if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
02070             !is_multicast_ether_addr(
02071                     ((struct ethhdr *)rx->skb->data)->h_dest) &&
02072             (!local->scanning &&
02073              !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
02074                         mod_timer(&local->dynamic_ps_timer, jiffies +
02075                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
02076         }
02077 
02078         ieee80211_deliver_skb(rx);
02079 
02080         return RX_QUEUED;
02081 }
02082 
02083 static ieee80211_rx_result debug_noinline
02084 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
02085 {
02086         struct ieee80211_local *local = rx->local;
02087         struct ieee80211_hw *hw = &local->hw;
02088         struct sk_buff *skb = rx->skb;
02089         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
02090         struct tid_ampdu_rx *tid_agg_rx;
02091         u16 start_seq_num;
02092         u16 tid;
02093 
02094         if (likely(!ieee80211_is_ctl(bar->frame_control)))
02095                 return RX_CONTINUE;
02096 
02097         if (ieee80211_is_back_req(bar->frame_control)) {
02098                 struct {
02099                         __le16 control, start_seq_num;
02100                 } __packed bar_data;
02101 
02102                 if (!rx->sta)
02103                         return RX_DROP_MONITOR;
02104 
02105                 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
02106                                   &bar_data, sizeof(bar_data)))
02107                         return RX_DROP_MONITOR;
02108 
02109                 tid = le16_to_cpu(bar_data.control) >> 12;
02110 
02111                 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
02112                 if (!tid_agg_rx)
02113                         return RX_DROP_MONITOR;
02114 
02115                 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
02116 
02117                 /* reset session timer */
02118                 if (tid_agg_rx->timeout)
02119                         mod_timer(&tid_agg_rx->session_timer,
02120                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
02121 
02122                 spin_lock(&tid_agg_rx->reorder_lock);
02123                 /* release stored frames up to start of BAR */
02124                 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
02125                 spin_unlock(&tid_agg_rx->reorder_lock);
02126 
02127                 kfree_skb(skb);
02128                 return RX_QUEUED;
02129         }
02130 
02131         /*
02132          * After this point, we only want management frames,
02133          * so we can drop all remaining control frames to
02134          * cooked monitor interfaces.
02135          */
02136         return RX_DROP_MONITOR;
02137 }
02138 
02139 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
02140                                            struct ieee80211_mgmt *mgmt,
02141                                            size_t len)
02142 {
02143         struct ieee80211_local *local = sdata->local;
02144         struct sk_buff *skb;
02145         struct ieee80211_mgmt *resp;
02146 
02147         if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
02148                 /* Not to own unicast address */
02149                 return;
02150         }
02151 
02152         if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
02153             compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
02154                 /* Not from the current AP or not associated yet. */
02155                 return;
02156         }
02157 
02158         if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
02159                 /* Too short SA Query request frame */
02160                 return;
02161         }
02162 
02163         skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
02164         if (skb == NULL)
02165                 return;
02166 
02167         skb_reserve(skb, local->hw.extra_tx_headroom);
02168         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
02169         memset(resp, 0, 24);
02170         memcpy(resp->da, mgmt->sa, ETH_ALEN);
02171         memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
02172         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
02173         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
02174                                           IEEE80211_STYPE_ACTION);
02175         skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
02176         resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
02177         resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
02178         memcpy(resp->u.action.u.sa_query.trans_id,
02179                mgmt->u.action.u.sa_query.trans_id,
02180                WLAN_SA_QUERY_TR_ID_LEN);
02181 
02182         ieee80211_tx_skb(sdata, skb);
02183 }
02184 
02185 static ieee80211_rx_result debug_noinline
02186 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
02187 {
02188         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
02189         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02190 
02191         /*
02192          * From here on, look only at management frames.
02193          * Data and control frames are already handled,
02194          * and unknown (reserved) frames are useless.
02195          */
02196         if (rx->skb->len < 24)
02197                 return RX_DROP_MONITOR;
02198 
02199         if (!ieee80211_is_mgmt(mgmt->frame_control))
02200                 return RX_DROP_MONITOR;
02201 
02202         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
02203                 return RX_DROP_MONITOR;
02204 
02205         if (ieee80211_drop_unencrypted_mgmt(rx))
02206                 return RX_DROP_UNUSABLE;
02207 
02208         return RX_CONTINUE;
02209 }
02210 
02211 static ieee80211_rx_result debug_noinline
02212 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
02213 {
02214         struct ieee80211_local *local = rx->local;
02215         struct ieee80211_sub_if_data *sdata = rx->sdata;
02216         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
02217         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02218         int len = rx->skb->len;
02219 
02220         if (!ieee80211_is_action(mgmt->frame_control))
02221                 return RX_CONTINUE;
02222 
02223         /* drop too small frames */
02224         if (len < IEEE80211_MIN_ACTION_SIZE)
02225                 return RX_DROP_UNUSABLE;
02226 
02227         if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
02228                 return RX_DROP_UNUSABLE;
02229 
02230         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
02231                 return RX_DROP_UNUSABLE;
02232 
02233         switch (mgmt->u.action.category) {
02234         case WLAN_CATEGORY_BACK:
02235                 /*
02236                  * The aggregation code is not prepared to handle
02237                  * anything but STA/AP due to the BSSID handling;
02238                  * IBSS could work in the code but isn't supported
02239                  * by drivers or the standard.
02240                  */
02241                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
02242                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
02243                     sdata->vif.type != NL80211_IFTYPE_AP)
02244                         break;
02245 
02246                 /* verify action_code is present */
02247                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
02248                         break;
02249 
02250                 switch (mgmt->u.action.u.addba_req.action_code) {
02251                 case WLAN_ACTION_ADDBA_REQ:
02252                         if (len < (IEEE80211_MIN_ACTION_SIZE +
02253                                    sizeof(mgmt->u.action.u.addba_req)))
02254                                 goto invalid;
02255                         break;
02256                 case WLAN_ACTION_ADDBA_RESP:
02257                         if (len < (IEEE80211_MIN_ACTION_SIZE +
02258                                    sizeof(mgmt->u.action.u.addba_resp)))
02259                                 goto invalid;
02260                         break;
02261                 case WLAN_ACTION_DELBA:
02262                         if (len < (IEEE80211_MIN_ACTION_SIZE +
02263                                    sizeof(mgmt->u.action.u.delba)))
02264                                 goto invalid;
02265                         break;
02266                 default:
02267                         goto invalid;
02268                 }
02269 
02270                 goto queue;
02271         case WLAN_CATEGORY_SPECTRUM_MGMT:
02272                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
02273                         break;
02274 
02275                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
02276                         break;
02277 
02278                 /* verify action_code is present */
02279                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
02280                         break;
02281 
02282                 switch (mgmt->u.action.u.measurement.action_code) {
02283                 case WLAN_ACTION_SPCT_MSR_REQ:
02284                         if (len < (IEEE80211_MIN_ACTION_SIZE +
02285                                    sizeof(mgmt->u.action.u.measurement)))
02286                                 break;
02287                         ieee80211_process_measurement_req(sdata, mgmt, len);
02288                         goto handled;
02289                 case WLAN_ACTION_SPCT_CHL_SWITCH:
02290                         if (len < (IEEE80211_MIN_ACTION_SIZE +
02291                                    sizeof(mgmt->u.action.u.chan_switch)))
02292                                 break;
02293 
02294                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
02295                                 break;
02296 
02297                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
02298                                 break;
02299 
02300                         goto queue;
02301                 }
02302                 break;
02303         case WLAN_CATEGORY_SA_QUERY:
02304                 if (len < (IEEE80211_MIN_ACTION_SIZE +
02305                            sizeof(mgmt->u.action.u.sa_query)))
02306                         break;
02307 
02308                 switch (mgmt->u.action.u.sa_query.action) {
02309                 case WLAN_ACTION_SA_QUERY_REQUEST:
02310                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
02311                                 break;
02312                         ieee80211_process_sa_query_req(sdata, mgmt, len);
02313                         goto handled;
02314                 }
02315                 break;
02316         case WLAN_CATEGORY_SELF_PROTECTED:
02317                 switch (mgmt->u.action.u.self_prot.action_code) {
02318                 case WLAN_SP_MESH_PEERING_OPEN:
02319                 case WLAN_SP_MESH_PEERING_CLOSE:
02320                 case WLAN_SP_MESH_PEERING_CONFIRM:
02321                         if (!ieee80211_vif_is_mesh(&sdata->vif))
02322                                 goto invalid;
02323                         if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
02324                                 /* userspace handles this frame */
02325                                 break;
02326                         goto queue;
02327                 case WLAN_SP_MGK_INFORM:
02328                 case WLAN_SP_MGK_ACK:
02329                         if (!ieee80211_vif_is_mesh(&sdata->vif))
02330                                 goto invalid;
02331                         break;
02332                 }
02333                 break;
02334         case WLAN_CATEGORY_MESH_ACTION:
02335                 if (!ieee80211_vif_is_mesh(&sdata->vif))
02336                         break;
02337                 if (mesh_action_is_path_sel(mgmt) &&
02338                   (!mesh_path_sel_is_hwmp(sdata)))
02339                         break;
02340                 goto queue;
02341         }
02342 
02343         return RX_CONTINUE;
02344 
02345  invalid:
02346         status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
02347         /* will return in the next handlers */
02348         return RX_CONTINUE;
02349 
02350  handled:
02351         if (rx->sta)
02352                 rx->sta->rx_packets++;
02353         dev_kfree_skb(rx->skb);
02354         return RX_QUEUED;
02355 
02356  queue:
02357         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
02358         skb_queue_tail(&sdata->skb_queue, rx->skb);
02359         ieee80211_queue_work(&local->hw, &sdata->work);
02360         if (rx->sta)
02361                 rx->sta->rx_packets++;
02362         return RX_QUEUED;
02363 }
02364 
02365 static ieee80211_rx_result debug_noinline
02366 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
02367 {
02368         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02369 
02370         /* skip known-bad action frames and return them in the next handler */
02371         if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
02372                 return RX_CONTINUE;
02373 
02374         /*
02375          * Getting here means the kernel doesn't know how to handle
02376          * it, but maybe userspace does ... include returned frames
02377          * so userspace can register for those to know whether ones
02378          * it transmitted were processed or returned.
02379          */
02380 
02381         if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
02382                              rx->skb->data, rx->skb->len,
02383                              GFP_ATOMIC)) {
02384                 if (rx->sta)
02385                         rx->sta->rx_packets++;
02386                 dev_kfree_skb(rx->skb);
02387                 return RX_QUEUED;
02388         }
02389 
02390 
02391         return RX_CONTINUE;
02392 }
02393 
02394 static ieee80211_rx_result debug_noinline
02395 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
02396 {
02397         struct ieee80211_local *local = rx->local;
02398         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
02399         struct sk_buff *nskb;
02400         struct ieee80211_sub_if_data *sdata = rx->sdata;
02401         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
02402 
02403         if (!ieee80211_is_action(mgmt->frame_control))
02404                 return RX_CONTINUE;
02405 
02406         /*
02407          * For AP mode, hostapd is responsible for handling any action
02408          * frames that we didn't handle, including returning unknown
02409          * ones. For all other modes we will return them to the sender,
02410          * setting the 0x80 bit in the action category, as required by
02411          * 802.11-2012 9.24.4.
02412          * Newer versions of hostapd shall also use the management frame
02413          * registration mechanisms, but older ones still use cooked
02414          * monitor interfaces so push all frames there.
02415          */
02416         if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
02417             (sdata->vif.type == NL80211_IFTYPE_AP ||
02418              sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
02419                 return RX_DROP_MONITOR;
02420 
02421         if (is_multicast_ether_addr(mgmt->da))
02422                 return RX_DROP_MONITOR;
02423 
02424         /* do not return rejected action frames */
02425         if (mgmt->u.action.category & 0x80)
02426                 return RX_DROP_UNUSABLE;
02427 
02428         nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
02429                                GFP_ATOMIC);
02430         if (nskb) {
02431                 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
02432 
02433                 nmgmt->u.action.category |= 0x80;
02434                 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
02435                 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
02436 
02437                 memset(nskb->cb, 0, sizeof(nskb->cb));
02438 
02439                 ieee80211_tx_skb(rx->sdata, nskb);
02440         }
02441         dev_kfree_skb(rx->skb);
02442         return RX_QUEUED;
02443 }
02444 
02445 static ieee80211_rx_result debug_noinline
02446 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
02447 {
02448         struct ieee80211_sub_if_data *sdata = rx->sdata;
02449         ieee80211_rx_result rxs;
02450         struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
02451         __le16 stype;
02452 
02453         rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
02454         if (rxs != RX_CONTINUE)
02455                 return rxs;
02456 
02457         stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
02458 
02459         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
02460             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
02461             sdata->vif.type != NL80211_IFTYPE_STATION)
02462                 return RX_DROP_MONITOR;
02463 
02464         switch (stype) {
02465         case cpu_to_le16(IEEE80211_STYPE_BEACON):
02466         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
02467                 /* process for all: mesh, mlme, ibss */
02468                 break;
02469         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
02470         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
02471                 if (is_multicast_ether_addr(mgmt->da) &&
02472                     !is_broadcast_ether_addr(mgmt->da))
02473                         return RX_DROP_MONITOR;
02474 
02475                 /* process only for station */
02476                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
02477                         return RX_DROP_MONITOR;
02478                 break;
02479         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
02480         case cpu_to_le16(IEEE80211_STYPE_AUTH):
02481                 /* process only for ibss */
02482                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
02483                         return RX_DROP_MONITOR;
02484                 break;
02485         default:
02486                 return RX_DROP_MONITOR;
02487         }
02488 
02489         /* queue up frame and kick off work to process it */
02490         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
02491         skb_queue_tail(&sdata->skb_queue, rx->skb);
02492         ieee80211_queue_work(&rx->local->hw, &sdata->work);
02493         if (rx->sta)
02494                 rx->sta->rx_packets++;
02495 
02496         return RX_QUEUED;
02497 }
02498 
02499 /* TODO: use IEEE80211_RX_FRAGMENTED */
02500 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
02501                                         struct ieee80211_rate *rate)
02502 {
02503         struct ieee80211_sub_if_data *sdata;
02504         struct ieee80211_local *local = rx->local;
02505         struct ieee80211_rtap_hdr {
02506                 struct ieee80211_radiotap_header hdr;
02507                 u8 flags;
02508                 u8 rate_or_pad;
02509                 __le16 chan_freq;
02510                 __le16 chan_flags;
02511         } __packed *rthdr;
02512         struct sk_buff *skb = rx->skb, *skb2;
02513         struct net_device *prev_dev = NULL;
02514         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02515 
02516         /*
02517          * If cooked monitor has been processed already, then
02518          * don't do it again. If not, set the flag.
02519          */
02520         if (rx->flags & IEEE80211_RX_CMNTR)
02521                 goto out_free_skb;
02522         rx->flags |= IEEE80211_RX_CMNTR;
02523 
02524         if (skb_headroom(skb) < sizeof(*rthdr) &&
02525             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
02526                 goto out_free_skb;
02527 
02528         rthdr = (void *)skb_push(skb, sizeof(*rthdr));
02529         memset(rthdr, 0, sizeof(*rthdr));
02530         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
02531         rthdr->hdr.it_present =
02532                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
02533                             (1 << IEEE80211_RADIOTAP_CHANNEL));
02534 
02535         if (rate) {
02536                 rthdr->rate_or_pad = rate->bitrate / 5;
02537                 rthdr->hdr.it_present |=
02538                         cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
02539         }
02540         rthdr->chan_freq = cpu_to_le16(status->freq);
02541 
02542         if (status->band == IEEE80211_BAND_5GHZ)
02543                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
02544                                                 IEEE80211_CHAN_5GHZ);
02545         else
02546                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
02547                                                 IEEE80211_CHAN_2GHZ);
02548 
02549         skb_set_mac_header(skb, 0);
02550         skb->ip_summed = CHECKSUM_UNNECESSARY;
02551         skb->pkt_type = PACKET_OTHERHOST;
02552         skb->protocol = htons(ETH_P_802_2);
02553 
02554         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
02555                 if (!ieee80211_sdata_running(sdata))
02556                         continue;
02557 
02558                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
02559                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
02560                         continue;
02561 
02562                 if (prev_dev) {
02563                         skb2 = skb_clone(skb, GFP_ATOMIC);
02564                         if (skb2) {
02565                                 skb2->dev = prev_dev;
02566                                 netif_receive_skb(skb2);
02567                         }
02568                 }
02569 
02570                 prev_dev = sdata->dev;
02571                 sdata->dev->stats.rx_packets++;
02572                 sdata->dev->stats.rx_bytes += skb->len;
02573         }
02574 
02575         if (prev_dev) {
02576                 skb->dev = prev_dev;
02577                 netif_receive_skb(skb);
02578                 return;
02579         }
02580 
02581  out_free_skb:
02582         dev_kfree_skb(skb);
02583 }
02584 
02585 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
02586                                          ieee80211_rx_result res)
02587 {
02588         switch (res) {
02589         case RX_DROP_MONITOR:
02590                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
02591                 if (rx->sta)
02592                         rx->sta->rx_dropped++;
02593                 /* fall through */
02594         case RX_CONTINUE: {
02595                 struct ieee80211_rate *rate = NULL;
02596                 struct ieee80211_supported_band *sband;
02597                 struct ieee80211_rx_status *status;
02598 
02599                 status = IEEE80211_SKB_RXCB((rx->skb));
02600 
02601                 sband = rx->local->hw.wiphy->bands[status->band];
02602                 if (!(status->flag & RX_FLAG_HT))
02603                         rate = &sband->bitrates[status->rate_idx];
02604 
02605                 ieee80211_rx_cooked_monitor(rx, rate);
02606                 break;
02607                 }
02608         case RX_DROP_UNUSABLE:
02609                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
02610                 if (rx->sta)
02611                         rx->sta->rx_dropped++;
02612                 dev_kfree_skb(rx->skb);
02613                 break;
02614         case RX_QUEUED:
02615                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
02616                 break;
02617         }
02618 }
02619 
02620 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
02621 {
02622         ieee80211_rx_result res = RX_DROP_MONITOR;
02623         struct sk_buff *skb;
02624 
02625 #define CALL_RXH(rxh)                   \
02626         do {                            \
02627                 res = rxh(rx);          \
02628                 if (res != RX_CONTINUE) \
02629                         goto rxh_next;  \
02630         } while (0);
02631 
02632         spin_lock(&rx->local->rx_skb_queue.lock);
02633         if (rx->local->running_rx_handler)
02634                 goto unlock;
02635 
02636         rx->local->running_rx_handler = true;
02637 
02638         while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
02639                 spin_unlock(&rx->local->rx_skb_queue.lock);
02640 
02641                 /*
02642                  * all the other fields are valid across frames
02643                  * that belong to an aMPDU since they are on the
02644                  * same TID from the same station
02645                  */
02646                 rx->skb = skb;
02647 
02648                 CALL_RXH(ieee80211_rx_h_decrypt)
02649                 CALL_RXH(ieee80211_rx_h_check_more_data)
02650                 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
02651                 CALL_RXH(ieee80211_rx_h_sta_process)
02652                 CALL_RXH(ieee80211_rx_h_defragment)
02653                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
02654                 /* must be after MMIC verify so header is counted in MPDU mic */
02655 #ifdef CONFIG_MAC80211_MESH
02656                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
02657                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
02658 #endif
02659                 CALL_RXH(ieee80211_rx_h_remove_qos_control)
02660                 CALL_RXH(ieee80211_rx_h_amsdu)
02661                 CALL_RXH(ieee80211_rx_h_data)
02662                 CALL_RXH(ieee80211_rx_h_ctrl);
02663                 CALL_RXH(ieee80211_rx_h_mgmt_check)
02664                 CALL_RXH(ieee80211_rx_h_action)
02665                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
02666                 CALL_RXH(ieee80211_rx_h_action_return)
02667                 CALL_RXH(ieee80211_rx_h_mgmt)
02668 
02669  rxh_next:
02670                 ieee80211_rx_handlers_result(rx, res);
02671                 spin_lock(&rx->local->rx_skb_queue.lock);
02672 #undef CALL_RXH
02673         }
02674 
02675         rx->local->running_rx_handler = false;
02676 
02677  unlock:
02678         spin_unlock(&rx->local->rx_skb_queue.lock);
02679 }
02680 
02681 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
02682 {
02683         ieee80211_rx_result res = RX_DROP_MONITOR;
02684 
02685 #define CALL_RXH(rxh)                   \
02686         do {                            \
02687                 res = rxh(rx);          \
02688                 if (res != RX_CONTINUE) \
02689                         goto rxh_next;  \
02690         } while (0);
02691 
02692         CALL_RXH(ieee80211_rx_h_passive_scan)
02693         CALL_RXH(ieee80211_rx_h_check)
02694 
02695         ieee80211_rx_reorder_ampdu(rx);
02696 
02697         ieee80211_rx_handlers(rx);
02698         return;
02699 
02700  rxh_next:
02701         ieee80211_rx_handlers_result(rx, res);
02702 
02703 #undef CALL_RXH
02704 }
02705 
02706 /*
02707  * This function makes calls into the RX path, therefore
02708  * it has to be invoked under RCU read lock.
02709  */
02710 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
02711 {
02712         struct ieee80211_rx_data rx = {
02713                 .sta = sta,
02714                 .sdata = sta->sdata,
02715                 .local = sta->local,
02716                 /* This is OK -- must be QoS data frame */
02717                 .security_idx = tid,
02718                 .seqno_idx = tid,
02719                 .flags = 0,
02720         };
02721         struct tid_ampdu_rx *tid_agg_rx;
02722 
02723         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
02724         if (!tid_agg_rx)
02725                 return;
02726 
02727         spin_lock(&tid_agg_rx->reorder_lock);
02728         ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
02729         spin_unlock(&tid_agg_rx->reorder_lock);
02730 
02731         ieee80211_rx_handlers(&rx);
02732 }
02733 
02734 /* main receive path */
02735 
02736 static int prepare_for_handlers(struct ieee80211_rx_data *rx,
02737                                 struct ieee80211_hdr *hdr)
02738 {
02739         struct ieee80211_sub_if_data *sdata = rx->sdata;
02740         struct sk_buff *skb = rx->skb;
02741         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02742         u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
02743         int multicast = is_multicast_ether_addr(hdr->addr1);
02744 
02745         switch (sdata->vif.type) {
02746         case NL80211_IFTYPE_STATION:
02747                 if (!bssid && !sdata->u.mgd.use_4addr)
02748                         return 0;
02749                 if (!multicast &&
02750                     compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
02751                         if (!(sdata->dev->flags & IFF_PROMISC) ||
02752                             sdata->u.mgd.use_4addr)
02753                                 return 0;
02754                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02755                 }
02756                 break;
02757         case NL80211_IFTYPE_ADHOC:
02758                 if (!bssid)
02759                         return 0;
02760                 if (ieee80211_is_beacon(hdr->frame_control)) {
02761                         return 1;
02762                 }
02763                 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
02764                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
02765                                 return 0;
02766                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02767                 } else if (!multicast &&
02768                            compare_ether_addr(sdata->vif.addr,
02769                                               hdr->addr1) != 0) {
02770                         if (!(sdata->dev->flags & IFF_PROMISC))
02771                                 return 0;
02772                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02773                 } else if (!rx->sta) {
02774                         int rate_idx;
02775                         if (status->flag & RX_FLAG_HT)
02776                                 rate_idx = 0; /* TODO: HT rates */
02777                         else
02778                                 rate_idx = status->rate_idx;
02779                         rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
02780                                         hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
02781                 }
02782                 break;
02783         case NL80211_IFTYPE_MESH_POINT:
02784                 if (!multicast &&
02785                     compare_ether_addr(sdata->vif.addr,
02786                                        hdr->addr1) != 0) {
02787                         if (!(sdata->dev->flags & IFF_PROMISC))
02788                                 return 0;
02789 
02790                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02791                 }
02792                 break;
02793         case NL80211_IFTYPE_AP_VLAN:
02794         case NL80211_IFTYPE_AP:
02795                 if (!bssid) {
02796                         if (compare_ether_addr(sdata->vif.addr,
02797                                                hdr->addr1))
02798                                 return 0;
02799                 } else if (!ieee80211_bssid_match(bssid,
02800                                         sdata->vif.addr)) {
02801                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN) &&
02802                             !ieee80211_is_beacon(hdr->frame_control) &&
02803                             !(ieee80211_is_action(hdr->frame_control) &&
02804                               sdata->vif.p2p))
02805                                 return 0;
02806                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
02807                 }
02808                 break;
02809         case NL80211_IFTYPE_WDS:
02810                 if (bssid || !ieee80211_is_data(hdr->frame_control))
02811                         return 0;
02812                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
02813                         return 0;
02814                 break;
02815         default:
02816                 /* should never get here */
02817                 WARN_ON(1);
02818                 break;
02819         }
02820 
02821         return 1;
02822 }
02823 
02824 /*
02825  * This function returns whether or not the SKB
02826  * was destined for RX processing or not, which,
02827  * if consume is true, is equivalent to whether
02828  * or not the skb was consumed.
02829  */
02830 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
02831                                             struct sk_buff *skb, bool consume)
02832 {
02833         struct ieee80211_local *local = rx->local;
02834         struct ieee80211_sub_if_data *sdata = rx->sdata;
02835         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02836         struct ieee80211_hdr *hdr = (void *)skb->data;
02837         int prepares;
02838 
02839         rx->skb = skb;
02840         status->rx_flags |= IEEE80211_RX_RA_MATCH;
02841         prepares = prepare_for_handlers(rx, hdr);
02842 
02843         if (!prepares)
02844                 return false;
02845 
02846         if (!consume) {
02847                 skb = skb_copy(skb, GFP_ATOMIC);
02848                 if (!skb) {
02849                         if (net_ratelimit())
02850                                 wiphy_debug(local->hw.wiphy,
02851                                         "failed to copy skb for %s\n",
02852                                         sdata->name);
02853                         return true;
02854                 }
02855 
02856                 rx->skb = skb;
02857         }
02858 
02859         ieee80211_invoke_rx_handlers(rx);
02860         return true;
02861 }
02862 
02863 /*
02864  * This is the actual Rx frames handler. as it blongs to Rx path it must
02865  * be called with rcu_read_lock protection.
02866  */
02867 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
02868                                          struct sk_buff *skb)
02869 {
02870         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02871         struct ieee80211_local *local = hw_to_local(hw);
02872         struct ieee80211_sub_if_data *sdata;
02873         struct ieee80211_hdr *hdr;
02874         __le16 fc;
02875         struct ieee80211_rx_data rx;
02876         struct ieee80211_sub_if_data *prev;
02877         struct sta_info *sta, *tmp, *prev_sta;
02878         int err = 0;
02879 
02880         fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
02881         memset(&rx, 0, sizeof(rx));
02882         rx.skb = skb;
02883         rx.local = local;
02884 
02885         if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
02886                 local->dot11ReceivedFragmentCount++;
02887 
02888         if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
02889                      test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
02890                 status->rx_flags |= IEEE80211_RX_IN_SCAN;
02891 
02892         if (ieee80211_is_mgmt(fc))
02893                 err = skb_linearize(skb);
02894         else
02895                 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
02896 
02897         if (err) {
02898                 dev_kfree_skb(skb);
02899                 return;
02900         }
02901 
02902         hdr = (struct ieee80211_hdr *)skb->data;
02903         ieee80211_parse_qos(&rx);
02904         ieee80211_verify_alignment(&rx);
02905 
02906         if (ieee80211_is_data(fc)) {
02907                 prev_sta = NULL;
02908 
02909                 for_each_sta_info_rx(local, hdr->addr2, sta, tmp) {
02910                         if (!prev_sta) {
02911                                 prev_sta = sta;
02912                                 continue;
02913                         }
02914 
02915                         rx.sta = prev_sta;
02916                         rx.sdata = prev_sta->sdata;
02917                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
02918 
02919                         prev_sta = sta;
02920                 }
02921 
02922                 if (prev_sta) {
02923                         rx.sta = prev_sta;
02924                         rx.sdata = prev_sta->sdata;
02925 
02926                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
02927                                 return;
02928                         goto out;
02929                 }
02930         }
02931 
02932         prev = NULL;
02933 
02934         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
02935                 if (!ieee80211_sdata_running(sdata))
02936                         continue;
02937 
02938                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
02939                     sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
02940                         continue;
02941 
02942                 /*
02943                  * frame is destined for this interface, but if it's
02944                  * not also for the previous one we handle that after
02945                  * the loop to avoid copying the SKB once too much
02946                  */
02947 
02948                 if (!prev) {
02949                         prev = sdata;
02950                         continue;
02951                 }
02952 
02953                 rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
02954                 rx.sdata = prev;
02955                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
02956 
02957                 prev = sdata;
02958         }
02959 
02960         if (prev) {
02961                 rx.sta = sta_info_get_bss_rx(prev, hdr->addr2);
02962                 rx.sdata = prev;
02963 
02964                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
02965                         return;
02966         }
02967 
02968  out:
02969         dev_kfree_skb(skb);
02970 }
02971 
02972 /*
02973  * This is the receive path handler. It is called by a low level driver when an
02974  * 802.11 MPDU is received from the hardware.
02975  */
02976 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
02977 {
02978         struct ieee80211_local *local = hw_to_local(hw);
02979         struct ieee80211_rate *rate = NULL;
02980         struct ieee80211_supported_band *sband;
02981         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
02982 
02983         //printk(KERN_ERR "DEV_rx:%p\n",        local->hw_roc_dev);
02984 
02985         WARN_ON_ONCE(softirq_count() == 0);
02986         //printk(KERN_ERR "Uno\n");
02987 
02988         if (WARN_ON(status->band < 0 ||
02989                     status->band >= IEEE80211_NUM_BANDS))
02990                 goto drop;
02991         //printk(KERN_ERR "Due\n");
02992 
02993         sband = local->hw.wiphy->bands[status->band];
02994         if (WARN_ON(!sband))
02995                 goto drop;
02996 
02997         /*
02998          * If we're suspending, it is possible although not too likely
02999          * that we'd be receiving frames after having already partially
03000          * quiesced the stack. We can't process such frames then since
03001          * that might, for example, cause stations to be added or other
03002          * driver callbacks be invoked.
03003          */
03004 
03005         //printk(KERN_ERR "Tre\n");
03006 
03007         if (unlikely(local->quiescing || local->suspended))
03008                 goto drop;
03009 
03010         /*
03011          * The same happens when we're not even started,
03012          * but that's worth a warning.
03013          */
03014 
03015         //printk(KERN_ERR "quattro\n");
03016 
03017 
03018         if (WARN_ON(!local->started))
03019                 goto drop;
03020 
03021         //printk(KERN_ERR "Cinque\n");
03022 
03023 
03024         if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
03025                 /*
03026                  * Validate the rate, unless a PLCP error means that
03027                  * we probably can't have a valid rate here anyway.
03028                  */
03029                 //printk(KERN_ERR "Sei\n");
03030 
03031                 if (status->flag & RX_FLAG_HT) {
03032                         /*
03033                          * rate_idx is MCS index, which can be [0-76]
03034                          * as documented on:
03035                          *
03036                          * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
03037                          *
03038                          * Anything else would be some sort of driver or
03039                          * hardware error. The driver should catch hardware
03040                          * errors.
03041                          */
03042                         if (WARN((status->rate_idx < 0 ||
03043                                  status->rate_idx > 76),
03044                                  "Rate marked as an HT rate but passed "
03045                                  "status->rate_idx is not "
03046                                  "an MCS index [0-76]: %d (0x%02x)\n",
03047                                  status->rate_idx,
03048                                  status->rate_idx))
03049                                 goto drop;
03050                 } else {
03051                         if (WARN_ON(status->rate_idx < 0 ||
03052                                     status->rate_idx >= sband->n_bitrates))
03053                                 goto drop;
03054                         rate = &sband->bitrates[status->rate_idx];
03055                 }
03056         }
03057         //printk(KERN_ERR "Sette\n");
03058 
03059         status->rx_flags = 0;
03060 
03061         /*
03062          * key references and virtual interfaces are protected using RCU
03063          * and this requires that we are in a read-side RCU section during
03064          * receive processing
03065          */
03066         rcu_read_lock();
03067 
03068         /*
03069          * Frames with failed FCS/PLCP checksum are not returned,
03070          * all other frames are returned without radiotap header
03071          * if it was previously present.
03072          * Also, frames with less than 16 bytes are dropped.
03073          */
03074         skb = ieee80211_rx_monitor(local, skb, rate);
03075         if (!skb) {
03076                 rcu_read_unlock();
03077                 return;
03078         }
03079 
03080         ieee80211_tpt_led_trig_rx(local,
03081                         ((struct ieee80211_hdr *)skb->data)->frame_control,
03082                         skb->len);
03083         __ieee80211_rx_handle_packet(hw, skb);
03084 
03085         rcu_read_unlock();
03086 
03087         return;
03088  drop:
03089         kfree_skb(skb);
03090 }
03091 EXPORT_SYMBOL(ieee80211_rx);
03092 
03093 /* This is a version of the rx handler that can be called from hard irq
03094  * context. Post the skb on the queue and schedule the tasklet */
03095 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
03096 {
03097         struct ieee80211_local *local = hw_to_local(hw);
03098 
03099         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
03100 
03101         skb->pkt_type = IEEE80211_RX_MSG;
03102         skb_queue_tail(&local->skb_queue, skb);
03103         tasklet_schedule(&local->tasklet);
03104 }
03105 EXPORT_SYMBOL(ieee80211_rx_irqsafe);


ros_rt_wmp
Author(s): Danilo Tardioli, dantard@unizar.es
autogenerated on Mon Oct 6 2014 08:27:11