rx.c 59 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

12
#include <linux/jiffies.h>
13
14
15
16
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
17
#include <linux/rcupdate.h>
18
19
20
21
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>

#include "ieee80211_i.h"
Johannes Berg's avatar
Johannes Berg committed
22
#include "led.h"
23
#include "mesh.h"
24
25
26
27
28
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"

29
30
31
32
u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
				struct tid_ampdu_rx *tid_agg_rx,
				struct sk_buff *skb, u16 mpdu_seq_num,
				int bar_req);
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
					   struct sk_buff *skb,
					   int rtap_len)
{
	skb_pull(skb, rtap_len);

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
			skb_trim(skb, skb->len - FCS_LEN);
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
			skb = NULL;
		}
	}

	return skb;
}

static inline int should_drop_frame(struct ieee80211_rx_status *status,
				    struct sk_buff *skb,
				    int present_fcs_len,
				    int radiotap_len)
{
64
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
65
66
67
68
69

	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		return 1;
	if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
		return 1;
70
71
72
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
73
74
75
76
		return 1;
	return 0;
}

77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
static int
ieee80211_rx_radiotap_len(struct ieee80211_local *local,
			  struct ieee80211_rx_status *status)
{
	int len;

	/* always present fields */
	len = sizeof(struct ieee80211_radiotap_header) + 9;

	if (status->flag & RX_FLAG_TSFT)
		len += 8;
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
	    local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
		len += 1;
	if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
		len += 1;

	if (len & 1) /* padding for RX_FLAGS if necessary */
		len++;

	/* make sure radiotap starts at a naturally aligned address */
	if (len % 8)
		len = roundup(len, 8);

	return len;
}

/**
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rx_status *status,
				 struct ieee80211_rate *rate,
				 int rtap_len)
{
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
	memset(rthdr, 0, rtap_len);

	/* radiotap header, set always present flags */
	rthdr->it_present =
		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
			    (1 << IEEE80211_RADIOTAP_RATE) |
			    (1 << IEEE80211_RADIOTAP_CHANNEL) |
			    (1 << IEEE80211_RADIOTAP_ANTENNA) |
			    (1 << IEEE80211_RADIOTAP_RX_FLAGS));
	rthdr->it_len = cpu_to_le16(rtap_len);

	pos = (unsigned char *)(rthdr+1);

	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
	if (status->flag & RX_FLAG_TSFT) {
		*(__le64 *)pos = cpu_to_le64(status->mactime);
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		*pos |= IEEE80211_RADIOTAP_F_FCS;
146
147
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
148
149
150
151
152
153
154
155
156
157
158
159
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
	*pos = rate->bitrate / 5;
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
	*(__le16 *)pos = cpu_to_le16(status->freq);
	pos += 2;
	if (status->band == IEEE80211_BAND_5GHZ)
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
					     IEEE80211_CHAN_5GHZ);
160
161
162
	else if (rate->flags & IEEE80211_RATE_ERP_G)
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
					     IEEE80211_CHAN_2GHZ);
163
	else
164
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
					     IEEE80211_CHAN_2GHZ);
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_DBM_ANTNOISE */
	if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
		*pos = status->noise;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

	/* IEEE80211_RADIOTAP_ANTENNA */
	*pos = status->antenna;
	pos++;

	/* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
	if ((pos - (unsigned char *)rthdr) & 1)
		pos++;
	/* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
	pos += 2;
}

210
211
212
213
214
215
216
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
217
218
		     struct ieee80211_rx_status *status,
		     struct ieee80211_rate *rate)
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
{
	struct ieee80211_sub_if_data *sdata;
	int needed_headroom = 0;
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;
	int rtap_len = 0;

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
	if (status->flag & RX_FLAG_RADIOTAP)
		rtap_len = ieee80211_get_radiotap_len(origskb->data);
	else
238
239
		/* room for the radiotap header based on driver features */
		needed_headroom = ieee80211_rx_radiotap_len(local, status);
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

	if (!local->monitors) {
		if (should_drop_frame(status, origskb, present_fcs_len,
				      rtap_len)) {
			dev_kfree_skb(origskb);
			return NULL;
		}

		return remove_monitor_info(local, origskb, rtap_len);
	}

	if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
267
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

		origskb = remove_monitor_info(local, origskb, rtap_len);

		if (!skb)
			return origskb;
	}

	/* if necessary, prepend radiotap information */
285
286
287
	if (!(status->flag & RX_FLAG_RADIOTAP))
		ieee80211_add_rx_radiotap_header(local, skb, status, rate,
						 needed_headroom);
288

289
	skb_reset_mac_header(skb);
290
291
292
293
294
295
296
297
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!netif_running(sdata->dev))
			continue;

298
		if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
299
300
			continue;

301
302
303
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
				netif_rx(skb2);
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
		netif_rx(skb);
	} else
		dev_kfree_skb(skb);

	return origskb;
}


327
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
328
{
329
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
330
331
332
	int tid;

	/* does the frame have a qos control field? */
333
334
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
335
		/* frame has qos control */
336
337
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
		if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
338
			rx->flags |= IEEE80211_RX_AMSDU;
339
		else
340
			rx->flags &= ~IEEE80211_RX_AMSDU;
341
	} else {
342
343
344
345
346
347
348
349
350
351
352
353
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
		tid = NUM_RX_DATA_QUEUES - 1;
354
	}
355

356
	rx->queue = tid;
357
358
359
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
360
}
361

362
static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
363
364
{
#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
365
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
366
367
	int hdrlen;

368
	if (!ieee80211_is_data_present(hdr->frame_control))
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
		return;

	/*
	 * Drivers are required to align the payload data in a way that
	 * guarantees that the contained IP header is aligned to a four-
	 * byte boundary. In the case of regular frames, this simply means
	 * aligning the payload to a four-byte boundary (because either
	 * the IP header is directly contained, or IV/RFC1042 headers that
	 * have a length divisible by four are in front of it.
	 *
	 * With A-MSDU frames, however, the payload data address must
	 * yield two modulo four because there are 14-byte 802.3 headers
	 * within the A-MSDU frames that push the IP header further back
	 * to a multiple of four again. Thankfully, the specs were sane
	 * enough this time around to require padding each A-MSDU subframe
	 * to a length that is a multiple of four.
	 *
	 * Padding like atheros hardware adds which is inbetween the 802.11
	 * header and the payload is not supported, the driver is required
	 * to move the 802.11 header further back in that case.
	 */
390
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
391
	if (rx->flags & IEEE80211_RX_AMSDU)
392
393
394
		hdrlen += ETH_HLEN;
	WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
#endif
395
396
}

397

398
399
/* rx handlers */

400
static ieee80211_rx_result debug_noinline
401
ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
402
403
404
405
{
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb;

Zhu Yi's avatar
Zhu Yi committed
406
	if (unlikely(local->sta_hw_scanning))
407
		return ieee80211_sta_rx_scan(rx->dev, skb, rx->status);
Zhu Yi's avatar
Zhu Yi committed
408
409
410

	if (unlikely(local->sta_sw_scanning)) {
		/* drop all the other packets during a software scan anyway */
411
		if (ieee80211_sta_rx_scan(rx->dev, skb, rx->status)
412
		    != RX_QUEUED)
Zhu Yi's avatar
Zhu Yi committed
413
			dev_kfree_skb(skb);
414
		return RX_QUEUED;
415
416
	}

417
	if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
418
419
		/* scanning finished during invoking of handlers */
		I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
Johannes Berg's avatar
Johannes Berg committed
420
		return RX_DROP_UNUSABLE;
421
422
	}

423
	return RX_CONTINUE;
424
425
}

426
static ieee80211_rx_result
427
ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
428
{
429
430
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
431

432
433
	if (ieee80211_is_data(hdr->frame_control)) {
		if (!ieee80211_has_a4(hdr->frame_control))
434
435
436
437
438
439
440
441
442
			return RX_DROP_MONITOR;
		if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
			return RX_DROP_MONITOR;
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

443
	if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
444
		struct ieee80211_mgmt *mgmt;
445

446
		if (!ieee80211_is_mgmt(hdr->frame_control))
447
448
			return RX_DROP_MONITOR;

449
		if (ieee80211_is_action(hdr->frame_control)) {
450
451
452
453
454
455
			mgmt = (struct ieee80211_mgmt *)hdr;
			if (mgmt->u.action.category != PLINK_CATEGORY)
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

456
457
458
459
460
461
462
463
464
465
466
467
468
469
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
		    ieee80211_is_beacon(hdr->frame_control))
			return RX_CONTINUE;

		return RX_DROP_MONITOR;

	}

#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))

	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
	    mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
470
		return RX_DROP_MONITOR;
Johannes Berg's avatar
Johannes Berg committed
471
#undef msh_h_get
472

Johannes Berg's avatar
Johannes Berg committed
473
474
	return RX_CONTINUE;
}
475
476


477
static ieee80211_rx_result debug_noinline
478
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
479
{
480
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
481
482
483

	/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
	if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
484
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
485
			     rx->sta->last_seq_ctrl[rx->queue] ==
486
			     hdr->seq_ctrl)) {
487
			if (rx->flags & IEEE80211_RX_RA_MATCH) {
488
489
490
				rx->local->dot11FrameDuplicateCount++;
				rx->sta->num_duplicates++;
			}
Johannes Berg's avatar
Johannes Berg committed
491
			return RX_DROP_MONITOR;
492
		} else
493
			rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
494
495
496
497
	}

	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
Johannes Berg's avatar
Johannes Berg committed
498
		return RX_DROP_MONITOR;
499
500
501
502
503
504
505
506
507
508
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
	 * 80211.o does filtering only based on association state, i.e., it
	 * drops Class 3 frames from not associated stations. hostapd sends
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
509

Johannes Berg's avatar
Johannes Berg committed
510
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
511
512
		return ieee80211_rx_mesh_check(rx);

513
514
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
515
		     rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
516
		     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
517
518
519
520
		if ((!ieee80211_has_fromds(hdr->frame_control) &&
		     !ieee80211_has_tods(hdr->frame_control) &&
		     ieee80211_is_data(hdr->frame_control)) ||
		    !(rx->flags & IEEE80211_RX_RA_MATCH)) {
521
522
			/* Drop IBSS frames and frames for other hosts
			 * silently. */
Johannes Berg's avatar
Johannes Berg committed
523
			return RX_DROP_MONITOR;
524
525
		}

Johannes Berg's avatar
Johannes Berg committed
526
		return RX_DROP_MONITOR;
527
528
	}

529
	return RX_CONTINUE;
530
531
532
}


533
static ieee80211_rx_result debug_noinline
534
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
535
{
536
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
537
538
	int keyidx;
	int hdrlen;
Johannes Berg's avatar
Johannes Berg committed
539
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
540
	struct ieee80211_key *stakey = NULL;
541

542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
	/*
	 * Key selection 101
	 *
	 * There are three types of keys:
	 *  - GTK (group keys)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs. Unless, of
	 * course, actual WEP keys ("pre-RSNA") are used, then unicast
	 * frames can also use key indizes like GTKs. Hence, if we don't
	 * have a PTK/STK we check the key index for a WEP key.
	 *
557
558
559
560
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
561
562
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
563
564
565
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
566
567
	 */

568
	if (!ieee80211_has_protected(hdr->frame_control))
569
		return RX_CONTINUE;
570

571
	/*
572
	 * No point in finding a key and decrypting if the frame is neither
573
574
	 * addressed to us nor a multicast frame.
	 */
575
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
576
		return RX_CONTINUE;
577

578
579
580
581
582
	if (rx->sta)
		stakey = rcu_dereference(rx->sta->key);

	if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
		rx->key = stakey;
583
	} else {
584
585
586
587
588
589
590
591
592
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
593
594
		if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
		    (rx->status->flag & RX_FLAG_IV_STRIPPED))
595
			return RX_CONTINUE;
596

597
		hdrlen = ieee80211_hdrlen(hdr->frame_control);
598
599

		if (rx->skb->len < 8 + hdrlen)
Johannes Berg's avatar
Johannes Berg committed
600
			return RX_DROP_UNUSABLE; /* TODO: count this? */
601
602
603
604
605
606
607

		/*
		 * no need to call ieee80211_wep_get_keyidx,
		 * it verifies a bunch of things we've done already
		 */
		keyidx = rx->skb->data[hdrlen + 3] >> 6;

608
		rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
609
610
611
612
613
614

		/*
		 * RSNA-protected unicast frames should always be sent with
		 * pairwise or station-to-station keys, but for WEP we allow
		 * using a key index as well.
		 */
615
		if (rx->key && rx->key->conf.alg != ALG_WEP &&
616
617
		    !is_multicast_ether_addr(hdr->addr1))
			rx->key = NULL;
618
619
	}

620
	if (rx->key) {
621
		rx->key->tx_rx_count++;
622
		/* TODO: add threshold stuff again */
623
	} else {
Johannes Berg's avatar
Johannes Berg committed
624
		return RX_DROP_MONITOR;
625
626
	}

627
628
	/* Check for weak IVs if possible */
	if (rx->sta && rx->key->conf.alg == ALG_WEP &&
629
	    ieee80211_is_data(hdr->frame_control) &&
630
631
	    (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
	     !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
632
633
634
	    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
		rx->sta->wep_weak_iv_count++;

635
636
	switch (rx->key->conf.alg) {
	case ALG_WEP:
637
638
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
639
	case ALG_TKIP:
640
641
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
642
	case ALG_CCMP:
643
644
		result = ieee80211_crypto_ccmp_decrypt(rx);
		break;
645
646
	}

647
	/* either the frame has been decrypted or will be dropped */
648
	rx->status->flag |= RX_FLAG_DECRYPTED;
649
650

	return result;
651
652
}

653
654
655
static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
{
	struct ieee80211_sub_if_data *sdata;
656
657
	DECLARE_MAC_BUF(mac);

658
	sdata = sta->sdata;
659

660
	atomic_inc(&sdata->bss->num_sta_ps);
661
	set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
662
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
663
664
	printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
	       dev->name, print_mac(mac, sta->addr), sta->aid);
665
666
667
668
669
670
671
672
673
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
}

static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct sk_buff *skb;
	int sent = 0;
	struct ieee80211_sub_if_data *sdata;
674
	struct ieee80211_tx_info *info;
675
	DECLARE_MAC_BUF(mac);
676

677
	sdata = sta->sdata;
678

679
	atomic_dec(&sdata->bss->num_sta_ps);
680

681
	clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
682
683
684
685

	if (!skb_queue_empty(&sta->ps_tx_buf))
		sta_info_clear_tim_bit(sta);

686
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
687
688
	printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
	       dev->name, print_mac(mac, sta->addr), sta->aid);
689
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
690

691
692
	/* Send all buffered frames to the station */
	while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
693
		info = IEEE80211_SKB_CB(skb);
694
		sent++;
695
		info->flags |= IEEE80211_TX_CTL_REQUEUE;
696
697
698
		dev_queue_xmit(skb);
	}
	while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
699
		info = IEEE80211_SKB_CB(skb);
700
701
702
		local->total_ps_buffered--;
		sent++;
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
703
		printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
704
		       "since STA not sleeping anymore\n", dev->name,
705
		       print_mac(mac, sta->addr), sta->aid);
706
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
707
		info->flags |= IEEE80211_TX_CTL_REQUEUE;
708
709
710
711
712
713
		dev_queue_xmit(skb);
	}

	return sent;
}

714
static ieee80211_rx_result debug_noinline
715
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
716
717
718
{
	struct sta_info *sta = rx->sta;
	struct net_device *dev = rx->dev;
719
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
720
721

	if (!sta)
722
		return RX_CONTINUE;
723
724
725
726

	/* Update last_rx only for IBSS packets which are for the current
	 * BSSID to avoid keeping the current IBSS network alive in cases where
	 * other STAs are using different BSSID. */
727
	if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
728
729
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
						IEEE80211_IF_TYPE_IBSS);
730
731
732
733
		if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
			sta->last_rx = jiffies;
	} else
	if (!is_multicast_ether_addr(hdr->addr1) ||
734
	    rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
735
736
737
		/* Update last_rx only for unicast frames in order to prevent
		 * the Probe Request frames (the only broadcast frames from a
		 * STA in infrastructure mode) from keeping a connection alive.
738
739
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
740
741
742
743
		 */
		sta->last_rx = jiffies;
	}

744
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
745
		return RX_CONTINUE;
746
747
748

	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
749
	sta->last_signal = rx->status->signal;
750
	sta->last_qual = rx->status->qual;
751
	sta->last_noise = rx->status->noise;
752

753
754
755
	if (!ieee80211_has_morefrags(hdr->frame_control) &&
	    (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP ||
	     rx->sdata->vif.type == IEEE80211_IF_TYPE_VLAN)) {
756
757
		/* Change STA power saving mode only in the end of a frame
		 * exchange sequence */
758
		if (test_sta_flags(sta, WLAN_STA_PS) &&
759
		    !ieee80211_has_pm(hdr->frame_control))
760
			rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
761
		else if (!test_sta_flags(sta, WLAN_STA_PS) &&
762
			 ieee80211_has_pm(hdr->frame_control))
763
764
765
766
767
			ap_sta_ps_start(dev, sta);
	}

	/* Drop data::nullfunc frames silently, since they are used only to
	 * control station power saving mode. */
768
	if (ieee80211_is_nullfunc(hdr->frame_control)) {
769
770
771
772
773
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
		/* Update counter and free packet here to avoid counting this
		 * as a dropped packed. */
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
774
		return RX_QUEUED;
775
776
	}

777
	return RX_CONTINUE;
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
} /* ieee80211_rx_h_sta_process */

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;
	int idx;

	idx = sdata->fragment_next;
	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

	if (!skb_queue_empty(&entry->skb_list)) {
794
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
795
796
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) entry->skb_list.next->data;
797
798
		DECLARE_MAC_BUF(mac);
		DECLARE_MAC_BUF(mac2);
799
800
		printk(KERN_DEBUG "%s: RX reassembly removed oldest "
		       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
801
		       "addr1=%s addr2=%s\n",
802
803
		       sdata->dev->name, idx,
		       jiffies - entry->first_frag_time, entry->seq,
804
805
		       entry->last_frag, print_mac(mac, hdr->addr1),
		       print_mac(mac2, hdr->addr2));
806
#endif
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
		__skb_queue_purge(&entry->skb_list);
	}

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
824
			  unsigned int frag, unsigned int seq,
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

844
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
845

846
847
848
849
850
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
851
852
853
854
		    compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
		    compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
			continue;

855
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
856
857
858
859
860
861
862
863
864
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

865
static ieee80211_rx_result debug_noinline
866
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
867
868
869
{
	struct ieee80211_hdr *hdr;
	u16 sc;
870
	__le16 fc;
871
872
873
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
874
	DECLARE_MAC_BUF(mac);
875

876
	hdr = (struct ieee80211_hdr *)rx->skb->data;
877
	fc = hdr->frame_control;
878
879
880
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

881
	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
882
883
884
885
886
887
888
889
890
891
892
893
		   (rx->skb)->len < 24 ||
		   is_multicast_ether_addr(hdr->addr1))) {
		/* not fragmented */
		goto out;
	}
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
894
						 rx->queue, &(rx->skb));
895
		if (rx->key && rx->key->conf.alg == ALG_CCMP &&
896
		    ieee80211_has_protected(fc)) {
897
898
899
900
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
901
			       rx->key->u.ccmp.rx_pn[rx->queue],
902
903
			       CCMP_PN_LEN);
		}
904
		return RX_QUEUED;
905
906
907
908
909
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
910
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
911
912
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berg's avatar
Johannes Berg committed
913
		return RX_DROP_MONITOR;
914
915
916
917
918
919
920
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
		u8 pn[CCMP_PN_LEN], *rpn;
921
		if (!rx->key || rx->key->conf.alg != ALG_CCMP)
Johannes Berg's avatar
Johannes Berg committed
922
			return RX_DROP_UNUSABLE;
923
924
925
926
927
928
		memcpy(pn, entry->last_pn, CCMP_PN_LEN);
		for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
			pn[i]++;
			if (pn[i])
				break;
		}
929
		rpn = rx->key->u.ccmp.rx_pn[rx->queue];
930
		if (memcmp(pn, rpn, CCMP_PN_LEN))
Johannes Berg's avatar
Johannes Berg committed
931
			return RX_DROP_UNUSABLE;
932
933
934
		memcpy(entry->last_pn, pn, CCMP_PN_LEN);
	}

935
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
936
937
938
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
939
	if (ieee80211_has_morefrags(fc)) {
940
		rx->skb = NULL;
941
		return RX_QUEUED;
942
943
944
945
946
947
948
949
950
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
Johannes Berg's avatar
Johannes Berg committed
951
			return RX_DROP_UNUSABLE;
952
953
954
955
956
957
958
959
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
960
	rx->flags |= IEEE80211_RX_FRAGMENTED;
961
962
963
964
965
966
967
968

 out:
	if (rx->sta)
		rx->sta->rx_packets++;
	if (is_multicast_ether_addr(hdr->addr1))
		rx->local->dot11MulticastReceivedFrameCount++;
	else
		ieee80211_led_rx(rx->local);
969
	return RX_CONTINUE;
970
971
}

972
static ieee80211_rx_result debug_noinline
973
ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
974
{
975
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
976
977
	struct sk_buff *skb;
	int no_pending_pkts;
978
	DECLARE_MAC_BUF(mac);
979
	__le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
980

981
	if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
982
		   !(rx->flags & IEEE80211_RX_RA_MATCH)))
983
		return RX_CONTINUE;
984

985
986
	if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
	    (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
Johannes Berg's avatar
Johannes Berg committed
987
		return RX_DROP_UNUSABLE;
988

989
990
991
992
993
994
995
996
997
998
999
1000
	skb = skb_dequeue(&rx->sta->tx_filtered);
	if (!skb) {
		skb = skb_dequeue(&rx->sta->ps_tx_buf);
		if (skb)
			rx->local->total_ps_buffered--;
	}
	no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
		skb_queue_empty(&rx->sta->ps_tx_buf);

	if (skb) {
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) skb->data;
For faster browsing, not all history is shown. View entire blame