net/mac80211/rx.c

   1 /*
   2  * Copyright 2002-2005, Instant802 Networks, Inc.
   3  * Copyright 2005-2006, Devicescape Software, Inc.
   4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   5  * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  */
  11
  12 #include <linux/jiffies.h>
  13 #include <linux/slab.h>
  14 #include <linux/kernel.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/netdevice.h>
  17 #include <linux/etherdevice.h>
  18 #include <linux/rcupdate.h>
  19 #include <net/mac80211.h>
  20 #include <net/ieee80211_radiotap.h>
  21
  22 #include "ieee80211_i.h"
  23 #include "driver-ops.h"
  24 #include "led.h"
  25 #include "mesh.h"
  26 #include "wep.h"
  27 #include "wpa.h"
  28 #include "tkip.h"
  29 #include "wme.h"
  30
  31 /*
  32  * monitor mode reception
  33  *
  34  * This function cleans up the SKB, i.e. it removes all the stuff
  35  * only useful for monitoring.
  36  */
  37 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  38                                            struct sk_buff *skb)
  39 {
  40         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
  41                 if (likely(skb->len > FCS_LEN))
  42                         __pskb_trim(skb, skb->len - FCS_LEN);
  43                 else {
  44                         /* driver bug */
  45                         WARN_ON(1);
  46                         dev_kfree_skb(skb);
  47                         skb = NULL;
  48                 }
  49         }
  50
  51         return skb;
  52 }
  53
  54 static inline int should_drop_frame(struct sk_buff *skb,
  55                                     int present_fcs_len)
  56 {
  57         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
  58         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
  59
  60         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
  61                 return 1;
  62         if (unlikely(skb->len < 16 + present_fcs_len))
  63                 return 1;
  64         if (ieee80211_is_ctl(hdr->frame_control) &&
  65             !ieee80211_is_pspoll(hdr->frame_control) &&
  66             !ieee80211_is_back_req(hdr->frame_control))
  67                 return 1;
  68         return 0;
  69 }
  70
  71 static int
  72 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
  73                           struct ieee80211_rx_status *status)
  74 {
  75         int len;
  76
  77         /* always present fields */
  78         len = sizeof(struct ieee80211_radiotap_header) + 9;
  79
  80         if (status->flag & RX_FLAG_TSFT)
  81                 len += 8;
  82         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
  83                 len += 1;
  84
  85         if (len & 1) /* padding for RX_FLAGS if necessary */
  86                 len++;
  87
  88         if (status->flag & RX_FLAG_HT) /* HT info */
  89                 len += 3;
  90
  91         return len;
  92 }
  93
  94 /*
  95  * ieee80211_add_rx_radiotap_header - add radiotap header
  96  *
  97  * add a radiotap header containing all the fields which the hardware provided.
  98  */
  99 static void
 100 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 101                                  struct sk_buff *skb,
 102                                  struct ieee80211_rate *rate,
 103                                  int rtap_len)
 104 {
 105         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 106         struct ieee80211_radiotap_header *rthdr;
 107         unsigned char *pos;
 108         u16 rx_flags = 0;
 109
 110         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
 111         memset(rthdr, 0, rtap_len);
 112
 113         /* radiotap header, set always present flags */
 114         rthdr->it_present =
 115                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
 116                             (1 << IEEE80211_RADIOTAP_CHANNEL) |
 117                             (1 << IEEE80211_RADIOTAP_ANTENNA) |
 118                             (1 << IEEE80211_RADIOTAP_RX_FLAGS));
 119         rthdr->it_len = cpu_to_le16(rtap_len);
 120
 121         pos = (unsigned char *)(rthdr+1);
 122
 123         /* the order of the following fields is important */
 124
 125         /* IEEE80211_RADIOTAP_TSFT */
 126         if (status->flag & RX_FLAG_TSFT) {
 127                 put_unaligned_le64(status->mactime, pos);
 128                 rthdr->it_present |=
 129                         cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
 130                 pos += 8;
 131         }
 132
 133         /* IEEE80211_RADIOTAP_FLAGS */
 134         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
 135                 *pos |= IEEE80211_RADIOTAP_F_FCS;
 136         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
 137                 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
 138         if (status->flag & RX_FLAG_SHORTPRE)
 139                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
 140         pos++;
 141
 142         /* IEEE80211_RADIOTAP_RATE */
 143         if (status->flag & RX_FLAG_HT) {
 144                 /*
 145                  * TODO: add following information into radiotap header once
 146                  * suitable fields are defined for it:
 147                  * - MCS index (status->rate_idx)
 148                  * - HT40 (status->flag & RX_FLAG_40MHZ)
 149                  * - short-GI (status->flag & RX_FLAG_SHORT_GI)
 150                  */
 151                 *pos = 0;
 152         } else {
 153                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
 154                 *pos = rate->bitrate / 5;
 155         }
 156         pos++;
 157
 158         /* IEEE80211_RADIOTAP_CHANNEL */
 159         put_unaligned_le16(status->freq, pos);
 160         pos += 2;
 161         if (status->band == IEEE80211_BAND_5GHZ)
 162                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
 163                                    pos);
 164         else if (status->flag & RX_FLAG_HT)
 165                 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
 166                                    pos);
 167         else if (rate->flags & IEEE80211_RATE_ERP_G)
 168                 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
 169                                    pos);
 170         else
 171                 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
 172                                    pos);
 173         pos += 2;
 174
 175         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
 176         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
 177                 *pos = status->signal;
 178                 rthdr->it_present |=
 179                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
 180                 pos++;
 181         }
 182
 183         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 184
 185         /* IEEE80211_RADIOTAP_ANTENNA */
 186         *pos = status->antenna;
 187         pos++;
 188
 189         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 190
 191         /* IEEE80211_RADIOTAP_RX_FLAGS */
 192         /* ensure 2 byte alignment for the 2 byte field as required */
 193         if ((pos - (u8 *)rthdr) & 1)
 194                 pos++;
 195         if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
 196                 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
 197         put_unaligned_le16(rx_flags, pos);
 198         pos += 2;
 199
 200         if (status->flag & RX_FLAG_HT) {
 201                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
 202                 *pos++ = IEEE80211_RADIOTAP_MCS_HAVE_MCS |
 203                          IEEE80211_RADIOTAP_MCS_HAVE_GI |
 204                          IEEE80211_RADIOTAP_MCS_HAVE_BW;
 205                 *pos = 0;
 206                 if (status->flag & RX_FLAG_SHORT_GI)
 207                         *pos |= IEEE80211_RADIOTAP_MCS_SGI;
 208                 if (status->flag & RX_FLAG_40MHZ)
 209                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
 210                 pos++;
 211                 *pos++ = status->rate_idx;
 212         }
 213 }
 214
 215 /*
 216  * This function copies a received frame to all monitor interfaces and
 217  * returns a cleaned-up SKB that no longer includes the FCS nor the
 218  * radiotap header the driver might have added.
 219  */
 220 static struct sk_buff *
 221 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 222                      struct ieee80211_rate *rate)
 223 {
 224         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
 225         struct ieee80211_sub_if_data *sdata;
 226         int needed_headroom = 0;
 227         struct sk_buff *skb, *skb2;
 228         struct net_device *prev_dev = NULL;
 229         int present_fcs_len = 0;
 230
 231         /*
 232          * First, we may need to make a copy of the skb because
 233          *  (1) we need to modify it for radiotap (if not present), and
 234          *  (2) the other RX handlers will modify the skb we got.
 235          *
 236          * We don't need to, of course, if we aren't going to return
 237          * the SKB because it has a bad FCS/PLCP checksum.
 238          */
 239
 240         /* room for the radiotap header based on driver features */
 241         needed_headroom = ieee80211_rx_radiotap_len(local, status);
 242
 243         if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
 244                 present_fcs_len = FCS_LEN;
 245
 246         /* make sure hdr->frame_control is on the linear part */
 247         if (!pskb_may_pull(origskb, 2)) {
 248                 dev_kfree_skb(origskb);
 249                 return NULL;
 250         }
 251
 252         if (!local->monitors) {
 253                 if (should_drop_frame(origskb, present_fcs_len)) {
 254                         dev_kfree_skb(origskb);
 255                         return NULL;
 256                 }
 257
 258                 return remove_monitor_info(local, origskb);
 259         }
 260
 261         if (should_drop_frame(origskb, present_fcs_len)) {
 262                 /* only need to expand headroom if necessary */
 263                 skb = origskb;
 264                 origskb = NULL;
 265
 266                 /*
 267                  * This shouldn't trigger often because most devices have an
 268                  * RX header they pull before we get here, and that should
 269                  * be big enough for our radiotap information. We should
 270                  * probably export the length to drivers so that we can have
 271                  * them allocate enough headroom to start with.
 272                  */
 273                 if (skb_headroom(skb) < needed_headroom &&
 274                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
 275                         dev_kfree_skb(skb);
 276                         return NULL;
 277                 }
 278         } else {
 279                 /*
 280                  * Need to make a copy and possibly remove radiotap header
 281                  * and FCS from the original.
 282                  */
 283                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
 284
 285                 origskb = remove_monitor_info(local, origskb);
 286
 287                 if (!skb)
 288                         return origskb;
 289         }
 290
 291         /* prepend radiotap information */
 292         ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom);
 293
 294         skb_reset_mac_header(skb);
 295         skb->ip_summed = CHECKSUM_UNNECESSARY;
 296         skb->pkt_type = PACKET_OTHERHOST;
 297         skb->protocol = htons(ETH_P_802_2);
 298
 299         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 300                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 301                         continue;
 302
 303                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
 304                         continue;
 305
 306                 if (!ieee80211_sdata_running(sdata))
 307                         continue;
 308
 309                 if (prev_dev) {
 310                         skb2 = skb_clone(skb, GFP_ATOMIC);
 311                         if (skb2) {
 312                                 skb2->dev = prev_dev;
 313                                 netif_receive_skb(skb2);
 314                         }
 315                 }
 316
 317                 prev_dev = sdata->dev;
 318                 sdata->dev->stats.rx_packets++;
 319                 sdata->dev->stats.rx_bytes += skb->len;
 320         }
 321
 322         if (prev_dev) {
 323                 skb->dev = prev_dev;
 324                 netif_receive_skb(skb);
 325         } else
 326                 dev_kfree_skb(skb);
 327
 328         return origskb;
 329 }
 330
 331
 332 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
 333 {
 334         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 335         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 336         int tid;
 337
 338         /* does the frame have a qos control field? */
 339         if (ieee80211_is_data_qos(hdr->frame_control)) {
 340                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 341                 /* frame has qos control */
 342                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 343                 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
 344                         status->rx_flags |= IEEE80211_RX_AMSDU;
 345         } else {
 346                 /*
 347                  * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
 348                  *
 349                  *      Sequence numbers for management frames, QoS data
 350                  *      frames with a broadcast/multicast address in the
 351                  *      Address 1 field, and all non-QoS data frames sent
 352                  *      by QoS STAs are assigned using an additional single
 353                  *      modulo-4096 counter, [...]
 354                  *
 355                  * We also use that counter for non-QoS STAs.
 356                  */
 357                 tid = NUM_RX_DATA_QUEUES - 1;
 358         }
 359
 360         rx->queue = tid;
 361         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
 362          * For now, set skb->priority to 0 for other cases. */
 363         rx->skb->priority = (tid > 7) ? 0 : tid;
 364 }
 365
 366 /**
 367  * DOC: Packet alignment
 368  *
 369  * Drivers always need to pass packets that are aligned to two-byte boundaries
 370  * to the stack.
 371  *
 372  * Additionally, should, if possible, align the payload data in a way that
 373  * guarantees that the contained IP header is aligned to a four-byte
 374  * boundary. In the case of regular frames, this simply means aligning the
 375  * payload to a four-byte boundary (because either the IP header is directly
 376  * contained, or IV/RFC1042 headers that have a length divisible by four are
 377  * in front of it).  If the payload data is not properly aligned and the
 378  * architecture doesn't support efficient unaligned operations, mac80211
 379  * will align the data.
 380  *
 381  * With A-MSDU frames, however, the payload data address must yield two modulo
 382  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 383  * push the IP header further back to a multiple of four again. Thankfully, the
 384  * specs were sane enough this time around to require padding each A-MSDU
 385  * subframe to a length that is a multiple of four.
 386  *
 387  * Padding like Atheros hardware adds which is inbetween the 802.11 header and
 388  * the payload is not supported, the driver is required to move the 802.11
 389  * header to be directly in front of the payload in that case.
 390  */
 391 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 392 {
 393 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 394         WARN_ONCE((unsigned long)rx->skb->data & 1,
 395                   "unaligned packet at 0x%p\n", rx->skb->data);
 396 #endif
 397 }
 398
 399
 400 /* rx handlers */
 401
 402 static ieee80211_rx_result debug_noinline
 403 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
 404 {
 405         struct ieee80211_local *local = rx->local;
 406         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 407         struct sk_buff *skb = rx->skb;
 408
 409         if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
 410                 return RX_CONTINUE;
 411
 412         if (test_bit(SCAN_HW_SCANNING, &local->scanning))
 413                 return ieee80211_scan_rx(rx->sdata, skb);
 414
 415         if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
 416                 /* drop all the other packets during a software scan anyway */
 417                 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
 418                         dev_kfree_skb(skb);
 419                 return RX_QUEUED;
 420         }
 421
 422         /* scanning finished during invoking of handlers */
 423         I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
 424         return RX_DROP_UNUSABLE;
 425 }
 426
 427
 428 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
 429 {
 430         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 431
 432         if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
 433                 return 0;
 434
 435         return ieee80211_is_robust_mgmt_frame(hdr);
 436 }
 437
 438
 439 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
 440 {
 441         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 442
 443         if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
 444                 return 0;
 445
 446         return ieee80211_is_robust_mgmt_frame(hdr);
 447 }
 448
 449
 450 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
 451 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
 452 {
 453         struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
 454         struct ieee80211_mmie *mmie;
 455
 456         if (skb->len < 24 + sizeof(*mmie) ||
 457             !is_multicast_ether_addr(hdr->da))
 458                 return -1;
 459
 460         if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
 461                 return -1; /* not a robust management frame */
 462
 463         mmie = (struct ieee80211_mmie *)
 464                 (skb->data + skb->len - sizeof(*mmie));
 465         if (mmie->element_id != WLAN_EID_MMIE ||
 466             mmie->length != sizeof(*mmie) - 2)
 467                 return -1;
 468
 469         return le16_to_cpu(mmie->key_id);
 470 }
 471
 472
 473 static ieee80211_rx_result
 474 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 475 {
 476         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 477         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 478         char *dev_addr = rx->sdata->vif.addr;
 479
 480         if (ieee80211_is_data(hdr->frame_control)) {
 481                 if (is_multicast_ether_addr(hdr->addr1)) {
 482                         if (ieee80211_has_tods(hdr->frame_control) ||
 483                                 !ieee80211_has_fromds(hdr->frame_control))
 484                                 return RX_DROP_MONITOR;
 485                         if (memcmp(hdr->addr3, dev_addr, ETH_ALEN) == 0)
 486                                 return RX_DROP_MONITOR;
 487                 } else {
 488                         if (!ieee80211_has_a4(hdr->frame_control))
 489                                 return RX_DROP_MONITOR;
 490                         if (memcmp(hdr->addr4, dev_addr, ETH_ALEN) == 0)
 491                                 return RX_DROP_MONITOR;
 492                 }
 493         }
 494
 495         /* If there is not an established peer link and this is not a peer link
 496          * establisment frame, beacon or probe, drop the frame.
 497          */
 498
 499         if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
 500                 struct ieee80211_mgmt *mgmt;
 501
 502                 if (!ieee80211_is_mgmt(hdr->frame_control))
 503                         return RX_DROP_MONITOR;
 504
 505                 if (ieee80211_is_action(hdr->frame_control)) {
 506                         mgmt = (struct ieee80211_mgmt *)hdr;
 507                         if (mgmt->u.action.category != WLAN_CATEGORY_MESH_PLINK)
 508                                 return RX_DROP_MONITOR;
 509                         return RX_CONTINUE;
 510                 }
 511
 512                 if (ieee80211_is_probe_req(hdr->frame_control) ||
 513                     ieee80211_is_probe_resp(hdr->frame_control) ||
 514                     ieee80211_is_beacon(hdr->frame_control))
 515                         return RX_CONTINUE;
 516
 517                 return RX_DROP_MONITOR;
 518
 519         }
 520
 521 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
 522
 523         if (ieee80211_is_data(hdr->frame_control) &&
 524             is_multicast_ether_addr(hdr->addr1) &&
 525             mesh_rmc_check(hdr->addr3, msh_h_get(hdr, hdrlen), rx->sdata))
 526                 return RX_DROP_MONITOR;
 527 #undef msh_h_get
 528
 529         return RX_CONTINUE;
 530 }
 531
 532 #define SEQ_MODULO 0x1000
 533 #define SEQ_MASK   0xfff
 534
 535 static inline int seq_less(u16 sq1, u16 sq2)
 536 {
 537         return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
 538 }
 539
 540 static inline u16 seq_inc(u16 sq)
 541 {
 542         return (sq + 1) & SEQ_MASK;
 543 }
 544
 545 static inline u16 seq_sub(u16 sq1, u16 sq2)
 546 {
 547         return (sq1 - sq2) & SEQ_MASK;
 548 }
 549
 550
 551 static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
 552                                             struct tid_ampdu_rx *tid_agg_rx,
 553                                             int index)
 554 {
 555         struct ieee80211_local *local = hw_to_local(hw);
 556         struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
 557         struct ieee80211_rx_status *status;
 558
 559         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 560
 561         if (!skb)
 562                 goto no_frame;
 563
 564         /* release the frame from the reorder ring buffer */
 565         tid_agg_rx->stored_mpdu_num--;
 566         tid_agg_rx->reorder_buf[index] = NULL;
 567         status = IEEE80211_SKB_RXCB(skb);
 568         status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
 569         skb_queue_tail(&local->rx_skb_queue, skb);
 570
 571 no_frame:
 572         tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
 573 }
 574
 575 static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
 576                                              struct tid_ampdu_rx *tid_agg_rx,
 577                                              u16 head_seq_num)
 578 {
 579         int index;
 580
 581         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 582
 583         while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
 584                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
 585                                                         tid_agg_rx->buf_size;
 586                 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
 587         }
 588 }
 589
 590 /*
 591  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 592  * the skb was added to the buffer longer than this time ago, the earlier
 593  * frames that have not yet been received are assumed to be lost and the skb
 594  * can be released for processing. This may also release other skb's from the
 595  * reorder buffer if there are no additional gaps between the frames.
 596  *
 597  * Callers must hold tid_agg_rx->reorder_lock.
 598  */
 599 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 600
 601 static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
 602                                           struct tid_ampdu_rx *tid_agg_rx)
 603 {
 604         int index, j;
 605
 606         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 607
 608         /* release the buffer until next missing frame */
 609         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
 610                                                 tid_agg_rx->buf_size;
 611         if (!tid_agg_rx->reorder_buf[index] &&
 612             tid_agg_rx->stored_mpdu_num > 1) {
 613                 /*
 614                  * No buffers ready to be released, but check whether any
 615                  * frames in the reorder buffer have timed out.
 616                  */
 617                 int skipped = 1;
 618                 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
 619                      j = (j + 1) % tid_agg_rx->buf_size) {
 620                         if (!tid_agg_rx->reorder_buf[j]) {
 621                                 skipped++;
 622                                 continue;
 623                         }
 624                         if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
 625                                         HT_RX_REORDER_BUF_TIMEOUT))
 626                                 goto set_release_timer;
 627
 628 #ifdef CONFIG_MAC80211_HT_DEBUG
 629                         if (net_ratelimit())
 630                                 wiphy_debug(hw->wiphy,
 631                                             "release an RX reorder frame due to timeout on earlier frames\n");
 632 #endif
 633                         ieee80211_release_reorder_frame(hw, tid_agg_rx, j);
 634
 635                         /*
 636                          * Increment the head seq# also for the skipped slots.
 637                          */
 638                         tid_agg_rx->head_seq_num =
 639                                 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
 640                         skipped = 0;
 641                 }
 642         } else while (tid_agg_rx->reorder_buf[index]) {
 643                 ieee80211_release_reorder_frame(hw, tid_agg_rx, index);
 644                 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
 645                                                         tid_agg_rx->buf_size;
 646         }
 647
 648         if (tid_agg_rx->stored_mpdu_num) {
 649                 j = index = seq_sub(tid_agg_rx->head_seq_num,
 650                                     tid_agg_rx->ssn) % tid_agg_rx->buf_size;
 651
 652                 for (; j != (index - 1) % tid_agg_rx->buf_size;
 653                      j = (j + 1) % tid_agg_rx->buf_size) {
 654                         if (tid_agg_rx->reorder_buf[j])
 655                                 break;
 656                 }
 657
 658  set_release_timer:
 659
 660                 mod_timer(&tid_agg_rx->reorder_timer,
 661                           tid_agg_rx->reorder_time[j] +
 662                           HT_RX_REORDER_BUF_TIMEOUT);
 663         } else {
 664                 del_timer(&tid_agg_rx->reorder_timer);
 665         }
 666 }
 667
 668 /*
 669  * As this function belongs to the RX path it must be under
 670  * rcu_read_lock protection. It returns false if the frame
 671  * can be processed immediately, true if it was consumed.
 672  */
 673 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
 674                                              struct tid_ampdu_rx *tid_agg_rx,
 675                                              struct sk_buff *skb)
 676 {
 677         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 678         u16 sc = le16_to_cpu(hdr->seq_ctrl);
 679         u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
 680         u16 head_seq_num, buf_size;
 681         int index;
 682         bool ret = true;
 683
 684         spin_lock(&tid_agg_rx->reorder_lock);
 685
 686         buf_size = tid_agg_rx->buf_size;
 687         head_seq_num = tid_agg_rx->head_seq_num;
 688
 689         /* frame with out of date sequence number */
 690         if (seq_less(mpdu_seq_num, head_seq_num)) {
 691                 dev_kfree_skb(skb);
 692                 goto out;
 693         }
 694
 695         /*
 696          * If frame the sequence number exceeds our buffering window
 697          * size release some previous frames to make room for this one.
 698          */
 699         if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
 700                 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
 701                 /* release stored frames up to new head to stack */
 702                 ieee80211_release_reorder_frames(hw, tid_agg_rx, head_seq_num);
 703         }
 704
 705         /* Now the new frame is always in the range of the reordering buffer */
 706
 707         index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
 708
 709         /* check if we already stored this frame */
 710         if (tid_agg_rx->reorder_buf[index]) {
 711                 dev_kfree_skb(skb);
 712                 goto out;
 713         }
 714
 715         /*
 716          * If the current MPDU is in the right order and nothing else
 717          * is stored we can process it directly, no need to buffer it.
 718          */
 719         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
 720             tid_agg_rx->stored_mpdu_num == 0) {
 721                 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
 722                 ret = false;
 723                 goto out;
 724         }
 725
 726         /* put the frame in the reordering buffer */
 727         tid_agg_rx->reorder_buf[index] = skb;
 728         tid_agg_rx->reorder_time[index] = jiffies;
 729         tid_agg_rx->stored_mpdu_num++;
 730         ieee80211_sta_reorder_release(hw, tid_agg_rx);
 731
 732  out:
 733         spin_unlock(&tid_agg_rx->reorder_lock);
 734         return ret;
 735 }
 736
 737 /*
 738  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 739  * true if the MPDU was buffered, false if it should be processed.
 740  */
 741 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
 742 {
 743         struct sk_buff *skb = rx->skb;
 744         struct ieee80211_local *local = rx->local;
 745         struct ieee80211_hw *hw = &local->hw;
 746         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 747         struct sta_info *sta = rx->sta;
 748         struct tid_ampdu_rx *tid_agg_rx;
 749         u16 sc;
 750         int tid;
 751
 752         if (!ieee80211_is_data_qos(hdr->frame_control))
 753                 goto dont_reorder;
 754
 755         /*
 756          * filter the QoS data rx stream according to
 757          * STA/TID and check if this STA/TID is on aggregation
 758          */
 759
 760         if (!sta)
 761                 goto dont_reorder;
 762
 763         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
 764
 765         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
 766         if (!tid_agg_rx)
 767                 goto dont_reorder;
 768
 769         /* qos null data frames are excluded */
 770         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
 771                 goto dont_reorder;
 772
 773         /* new, potentially un-ordered, ampdu frame - process it */
 774
 775         /* reset session timer */
 776         if (tid_agg_rx->timeout)
 777                 mod_timer(&tid_agg_rx->session_timer,
 778                           TU_TO_EXP_TIME(tid_agg_rx->timeout));
 779
 780         /* if this mpdu is fragmented - terminate rx aggregation session */
 781         sc = le16_to_cpu(hdr->seq_ctrl);
 782         if (sc & IEEE80211_SCTL_FRAG) {
 783                 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
 784                 skb_queue_tail(&rx->sdata->skb_queue, skb);
 785                 ieee80211_queue_work(&local->hw, &rx->sdata->work);
 786                 return;
 787         }
 788
 789         /*
 790          * No locking needed -- we will only ever process one
 791          * RX packet at a time, and thus own tid_agg_rx. All
 792          * other code manipulating it needs to (and does) make
 793          * sure that we cannot get to it any more before doing
 794          * anything with it.
 795          */
 796         if (ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb))
 797                 return;
 798
 799  dont_reorder:
 800         skb_queue_tail(&local->rx_skb_queue, skb);
 801 }
 802
 803 static ieee80211_rx_result debug_noinline
 804 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
 805 {
 806         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 807         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 808
 809         /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
 810         if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
 811                 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
 812                              rx->sta->last_seq_ctrl[rx->queue] ==
 813                              hdr->seq_ctrl)) {
 814                         if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
 815                                 rx->local->dot11FrameDuplicateCount++;
 816                                 rx->sta->num_duplicates++;
 817                         }
 818                         return RX_DROP_MONITOR;
 819                 } else
 820                         rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
 821         }
 822
 823         if (unlikely(rx->skb->len < 16)) {
 824                 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
 825                 return RX_DROP_MONITOR;
 826         }
 827
 828         /* Drop disallowed frame classes based on STA auth/assoc state;
 829          * IEEE 802.11, Chap 5.5.
 830          *
 831          * mac80211 filters only based on association state, i.e. it drops
 832          * Class 3 frames from not associated stations. hostapd sends
 833          * deauth/disassoc frames when needed. In addition, hostapd is
 834          * responsible for filtering on both auth and assoc states.
 835          */
 836
 837         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
 838                 return ieee80211_rx_mesh_check(rx);
 839
 840         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
 841                       ieee80211_is_pspoll(hdr->frame_control)) &&
 842                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
 843                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
 844                      (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
 845                 if ((!ieee80211_has_fromds(hdr->frame_control) &&
 846                      !ieee80211_has_tods(hdr->frame_control) &&
 847                      ieee80211_is_data(hdr->frame_control)) ||
 848                     !(status->rx_flags & IEEE80211_RX_RA_MATCH)) {
 849                         /* Drop IBSS frames and frames for other hosts
 850                          * silently. */
 851                         return RX_DROP_MONITOR;
 852                 }
 853
 854                 return RX_DROP_MONITOR;
 855         }
 856
 857         return RX_CONTINUE;
 858 }
 859
 860
 861 static ieee80211_rx_result debug_noinline
 862 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
 863 {
 864         struct sk_buff *skb = rx->skb;
 865         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 866         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 867         int keyidx;
 868         int hdrlen;
 869         ieee80211_rx_result result = RX_DROP_UNUSABLE;
 870         struct ieee80211_key *sta_ptk = NULL;
 871         int mmie_keyidx = -1;
 872         __le16 fc;
 873
 874         /*
 875          * Key selection 101
 876          *
 877          * There are four types of keys:
 878          *  - GTK (group keys)
 879          *  - IGTK (group keys for management frames)
 880          *  - PTK (pairwise keys)
 881          *  - STK (station-to-station pairwise keys)
 882          *
 883          * When selecting a key, we have to distinguish between multicast
 884          * (including broadcast) and unicast frames, the latter can only
 885          * use PTKs and STKs while the former always use GTKs and IGTKs.
 886          * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
 887          * unicast frames can also use key indices like GTKs. Hence, if we
 888          * don't have a PTK/STK we check the key index for a WEP key.
 889          *
 890          * Note that in a regular BSS, multicast frames are sent by the
 891          * AP only, associated stations unicast the frame to the AP first
 892          * which then multicasts it on their behalf.
 893          *
 894          * There is also a slight problem in IBSS mode: GTKs are negotiated
 895          * with each station, that is something we don't currently handle.
 896          * The spec seems to expect that one negotiates the same key with
 897          * every station but there's no such requirement; VLANs could be
 898          * possible.
 899          */
 900
 901         /*
 902          * No point in finding a key and decrypting if the frame is neither
 903          * addressed to us nor a multicast frame.
 904          */
 905         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
 906                 return RX_CONTINUE;
 907
 908         /* start without a key */
 909         rx->key = NULL;
 910
 911         if (rx->sta)
 912                 sta_ptk = rcu_dereference(rx->sta->ptk);
 913
 914         fc = hdr->frame_control;
 915
 916         if (!ieee80211_has_protected(fc))
 917                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
 918
 919         if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
 920                 rx->key = sta_ptk;
 921                 if ((status->flag & RX_FLAG_DECRYPTED) &&
 922                     (status->flag & RX_FLAG_IV_STRIPPED))
 923                         return RX_CONTINUE;
 924                 /* Skip decryption if the frame is not protected. */
 925                 if (!ieee80211_has_protected(fc))
 926                         return RX_CONTINUE;
 927         } else if (mmie_keyidx >= 0) {
 928                 /* Broadcast/multicast robust management frame / BIP */
 929                 if ((status->flag & RX_FLAG_DECRYPTED) &&
 930                     (status->flag & RX_FLAG_IV_STRIPPED))
 931                         return RX_CONTINUE;
 932
 933                 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
 934                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
 935                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
 936                 if (rx->sta)
 937                         rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
 938                 if (!rx->key)
 939                         rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
 940         } else if (!ieee80211_has_protected(fc)) {
 941                 /*
 942                  * The frame was not protected, so skip decryption. However, we
 943                  * need to set rx->key if there is a key that could have been
 944                  * used so that the frame may be dropped if encryption would
 945                  * have been expected.
 946                  */
 947                 struct ieee80211_key *key = NULL;
 948                 struct ieee80211_sub_if_data *sdata = rx->sdata;
 949                 int i;
 950
 951                 if (ieee80211_is_mgmt(fc) &&
 952                     is_multicast_ether_addr(hdr->addr1) &&
 953                     (key = rcu_dereference(rx->sdata->default_mgmt_key)))
 954                         rx->key = key;
 955                 else {
 956                         if (rx->sta) {
 957                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
 958                                         key = rcu_dereference(rx->sta->gtk[i]);
 959                                         if (key)
 960                                                 break;
 961                                 }
 962                         }
 963                         if (!key) {
 964                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
 965                                         key = rcu_dereference(sdata->keys[i]);
 966                                         if (key)
 967                                                 break;
 968                                 }
 969                         }
 970                         if (key)
 971                                 rx->key = key;
 972                 }
 973                 return RX_CONTINUE;
 974         } else {
 975                 u8 keyid;
 976                 /*
 977                  * The device doesn't give us the IV so we won't be
 978                  * able to look up the key. That's ok though, we
 979                  * don't need to decrypt the frame, we just won't
 980                  * be able to keep statistics accurate.
 981                  * Except for key threshold notifications, should
 982                  * we somehow allow the driver to tell us which key
 983                  * the hardware used if this flag is set?
 984                  */
 985                 if ((status->flag & RX_FLAG_DECRYPTED) &&
 986                     (status->flag & RX_FLAG_IV_STRIPPED))
 987                         return RX_CONTINUE;
 988
 989                 hdrlen = ieee80211_hdrlen(fc);
 990
 991                 if (rx->skb->len < 8 + hdrlen)
 992                         return RX_DROP_UNUSABLE; /* TODO: count this? */
 993
 994                 /*
 995                  * no need to call ieee80211_wep_get_keyidx,
 996                  * it verifies a bunch of things we've done already
 997                  */
 998                 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
 999                 keyidx = keyid >> 6;
1000
1001                 /* check per-station GTK first, if multicast packet */
1002                 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1003                         rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1004
1005                 /* if not found, try default key */
1006                 if (!rx->key) {
1007                         rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1008
1009                         /*
1010                          * RSNA-protected unicast frames should always be
1011                          * sent with pairwise or station-to-station keys,
1012                          * but for WEP we allow using a key index as well.
1013                          */
1014                         if (rx->key &&
1015                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1016                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1017                             !is_multicast_ether_addr(hdr->addr1))
1018                                 rx->key = NULL;
1019                 }
1020         }
1021
1022         if (rx->key) {
1023                 rx->key->tx_rx_count++;
1024                 /* TODO: add threshold stuff again */
1025         } else {
1026                 return RX_DROP_MONITOR;
1027         }
1028
1029         if (skb_linearize(rx->skb))
1030                 return RX_DROP_UNUSABLE;
1031         /* the hdr variable is invalid now! */
1032
1033         switch (rx->key->conf.cipher) {
1034         case WLAN_CIPHER_SUITE_WEP40:
1035         case WLAN_CIPHER_SUITE_WEP104:
1036                 /* Check for weak IVs if possible */
1037                 if (rx->sta && ieee80211_is_data(fc) &&
1038                     (!(status->flag & RX_FLAG_IV_STRIPPED) ||
1039                      !(status->flag & RX_FLAG_DECRYPTED)) &&
1040                     ieee80211_wep_is_weak_iv(rx->skb, rx->key))
1041                         rx->sta->wep_weak_iv_count++;
1042
1043                 result = ieee80211_crypto_wep_decrypt(rx);
1044                 break;
1045         case WLAN_CIPHER_SUITE_TKIP:
1046                 result = ieee80211_crypto_tkip_decrypt(rx);
1047                 break;
1048         case WLAN_CIPHER_SUITE_CCMP:
1049                 result = ieee80211_crypto_ccmp_decrypt(rx);
1050                 break;
1051         case WLAN_CIPHER_SUITE_AES_CMAC:
1052                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1053                 break;
1054         default:
1055                 /*
1056                  * We can reach here only with HW-only algorithms
1057                  * but why didn't it decrypt the frame?!
1058                  */
1059                 return RX_DROP_UNUSABLE;
1060         }
1061
1062         /* either the frame has been decrypted or will be dropped */
1063         status->flag |= RX_FLAG_DECRYPTED;
1064
1065         return result;
1066 }
1067
1068 static ieee80211_rx_result debug_noinline
1069 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1070 {
1071         struct ieee80211_local *local;
1072         struct ieee80211_hdr *hdr;
1073         struct sk_buff *skb;
1074
1075         local = rx->local;
1076         skb = rx->skb;
1077         hdr = (struct ieee80211_hdr *) skb->data;
1078
1079         if (!local->pspolling)
1080                 return RX_CONTINUE;
1081
1082         if (!ieee80211_has_fromds(hdr->frame_control))
1083                 /* this is not from AP */
1084                 return RX_CONTINUE;
1085
1086         if (!ieee80211_is_data(hdr->frame_control))
1087                 return RX_CONTINUE;
1088
1089         if (!ieee80211_has_moredata(hdr->frame_control)) {
1090                 /* AP has no more frames buffered for us */
1091                 local->pspolling = false;
1092                 return RX_CONTINUE;
1093         }
1094
1095         /* more data bit is set, let's request a new frame from the AP */
1096         ieee80211_send_pspoll(local, rx->sdata);
1097
1098         return RX_CONTINUE;
1099 }
1100
1101 static void ap_sta_ps_start(struct sta_info *sta)
1102 {
1103         struct ieee80211_sub_if_data *sdata = sta->sdata;
1104         struct ieee80211_local *local = sdata->local;
1105
1106         atomic_inc(&sdata->bss->num_sta_ps);
1107         set_sta_flags(sta, WLAN_STA_PS_STA);
1108         drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1109 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1110         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
1111                sdata->name, sta->sta.addr, sta->sta.aid);
1112 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1113 }
1114
1115 static void ap_sta_ps_end(struct sta_info *sta)
1116 {
1117         struct ieee80211_sub_if_data *sdata = sta->sdata;
1118
1119         atomic_dec(&sdata->bss->num_sta_ps);
1120
1121 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1122         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
1123                sdata->name, sta->sta.addr, sta->sta.aid);
1124 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1125
1126         if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
1127 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1128                 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
1129                        sdata->name, sta->sta.addr, sta->sta.aid);
1130 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1131                 return;
1132         }
1133
1134         ieee80211_sta_ps_deliver_wakeup(sta);
1135 }
1136
1137 static ieee80211_rx_result debug_noinline
1138 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1139 {
1140         struct sta_info *sta = rx->sta;
1141         struct sk_buff *skb = rx->skb;
1142         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1143         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1144
1145         if (!sta)
1146                 return RX_CONTINUE;
1147
1148         /*
1149          * Update last_rx only for IBSS packets which are for the current
1150          * BSSID to avoid keeping the current IBSS network alive in cases
1151          * where other STAs start using different BSSID.
1152          */
1153         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1154                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1155                                                 NL80211_IFTYPE_ADHOC);
1156                 if (compare_ether_addr(bssid, rx->sdata->u.ibss.bssid) == 0)
1157                         sta->last_rx = jiffies;
1158         } else if (!is_multicast_ether_addr(hdr->addr1)) {
1159                 /*
1160                  * Mesh beacons will update last_rx when if they are found to
1161                  * match the current local configuration when processed.
1162                  */
1163                 sta->last_rx = jiffies;
1164         }
1165
1166         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1167                 return RX_CONTINUE;
1168
1169         if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1170                 ieee80211_sta_rx_notify(rx->sdata, hdr);
1171
1172         sta->rx_fragments++;
1173         sta->rx_bytes += rx->skb->len;
1174         sta->last_signal = status->signal;
1175         ewma_add(&sta->avg_signal, -status->signal);
1176
1177         /*
1178          * Change STA power saving mode only at the end of a frame
1179          * exchange sequence.
1180          */
1181         if (!ieee80211_has_morefrags(hdr->frame_control) &&
1182             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1183             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1184              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1185                 if (test_sta_flags(sta, WLAN_STA_PS_STA)) {
1186                         /*
1187                          * Ignore doze->wake transitions that are
1188                          * indicated by non-data frames, the standard
1189                          * is unclear here, but for example going to
1190                          * PS mode and then scanning would cause a
1191                          * doze->wake transition for the probe request,
1192                          * and that is clearly undesirable.
1193                          */
1194                         if (ieee80211_is_data(hdr->frame_control) &&
1195                             !ieee80211_has_pm(hdr->frame_control))
1196                                 ap_sta_ps_end(sta);
1197                 } else {
1198                         if (ieee80211_has_pm(hdr->frame_control))
1199                                 ap_sta_ps_start(sta);
1200                 }
1201         }
1202
1203         /*
1204          * Drop (qos-)data::nullfunc frames silently, since they
1205          * are used only to control station power saving mode.
1206          */
1207         if (ieee80211_is_nullfunc(hdr->frame_control) ||
1208             ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1209                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1210
1211                 /*
1212                  * If we receive a 4-addr nullfunc frame from a STA
1213                  * that was not moved to a 4-addr STA vlan yet, drop
1214                  * the frame to the monitor interface, to make sure
1215                  * that hostapd sees it
1216                  */
1217                 if (ieee80211_has_a4(hdr->frame_control) &&
1218                     (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1219                      (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1220                       !rx->sdata->u.vlan.sta)))
1221                         return RX_DROP_MONITOR;
1222                 /*
1223                  * Update counter and free packet here to avoid
1224                  * counting this as a dropped packed.
1225                  */
1226                 sta->rx_packets++;
1227                 dev_kfree_skb(rx->skb);
1228                 return RX_QUEUED;
1229         }
1230
1231         return RX_CONTINUE;
1232 } /* ieee80211_rx_h_sta_process */
1233
1234 static inline struct ieee80211_fragment_entry *
1235 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1236                          unsigned int frag, unsigned int seq, int rx_queue,
1237                          struct sk_buff **skb)
1238 {
1239         struct ieee80211_fragment_entry *entry;
1240         int idx;
1241
1242         idx = sdata->fragment_next;
1243         entry = &sdata->fragments[sdata->fragment_next++];
1244         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1245                 sdata->fragment_next = 0;
1246
1247         if (!skb_queue_empty(&entry->skb_list)) {
1248 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1249                 struct ieee80211_hdr *hdr =
1250                         (struct ieee80211_hdr *) entry->skb_list.next->data;
1251                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
1252                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
1253                        "addr1=%pM addr2=%pM\n",
1254                        sdata->name, idx,
1255                        jiffies - entry->first_frag_time, entry->seq,
1256                        entry->last_frag, hdr->addr1, hdr->addr2);
1257 #endif
1258                 __skb_queue_purge(&entry->skb_list);
1259         }
1260
1261         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1262         *skb = NULL;
1263         entry->first_frag_time = jiffies;
1264         entry->seq = seq;
1265         entry->rx_queue = rx_queue;
1266         entry->last_frag = frag;
1267         entry->ccmp = 0;
1268         entry->extra_len = 0;
1269
1270         return entry;
1271 }
1272
1273 static inline struct ieee80211_fragment_entry *
1274 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1275                           unsigned int frag, unsigned int seq,
1276                           int rx_queue, struct ieee80211_hdr *hdr)
1277 {
1278         struct ieee80211_fragment_entry *entry;
1279         int i, idx;
1280
1281         idx = sdata->fragment_next;
1282         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1283                 struct ieee80211_hdr *f_hdr;
1284
1285                 idx--;
1286                 if (idx < 0)
1287                         idx = IEEE80211_FRAGMENT_MAX - 1;
1288
1289                 entry = &sdata->fragments[idx];
1290                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1291                     entry->rx_queue != rx_queue ||
1292                     entry->last_frag + 1 != frag)
1293                         continue;
1294
1295                 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1296
1297                 /*
1298                  * Check ftype and addresses are equal, else check next fragment
1299                  */
1300                 if (((hdr->frame_control ^ f_hdr->frame_control) &
1301                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1302                     compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
1303                     compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
1304                         continue;
1305
1306                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1307                         __skb_queue_purge(&entry->skb_list);
1308                         continue;
1309                 }
1310                 return entry;
1311         }
1312
1313         return NULL;
1314 }
1315
1316 static ieee80211_rx_result debug_noinline
1317 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1318 {
1319         struct ieee80211_hdr *hdr;
1320         u16 sc;
1321         __le16 fc;
1322         unsigned int frag, seq;
1323         struct ieee80211_fragment_entry *entry;
1324         struct sk_buff *skb;
1325         struct ieee80211_rx_status *status;
1326
1327         hdr = (struct ieee80211_hdr *)rx->skb->data;
1328         fc = hdr->frame_control;
1329         sc = le16_to_cpu(hdr->seq_ctrl);
1330         frag = sc & IEEE80211_SCTL_FRAG;
1331
1332         if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1333                    (rx->skb)->len < 24 ||
1334                    is_multicast_ether_addr(hdr->addr1))) {
1335                 /* not fragmented */
1336                 goto out;
1337         }
1338         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1339
1340         if (skb_linearize(rx->skb))
1341                 return RX_DROP_UNUSABLE;
1342
1343         /*
1344          *  skb_linearize() might change the skb->data and
1345          *  previously cached variables (in this case, hdr) need to
1346          *  be refreshed with the new data.
1347          */
1348         hdr = (struct ieee80211_hdr *)rx->skb->data;
1349         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1350
1351         if (frag == 0) {
1352                 /* This is the first fragment of a new frame. */
1353                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1354                                                  rx->queue, &(rx->skb));
1355                 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1356                     ieee80211_has_protected(fc)) {
1357                         int queue = ieee80211_is_mgmt(fc) ?
1358                                 NUM_RX_DATA_QUEUES : rx->queue;
1359                         /* Store CCMP PN so that we can verify that the next
1360                          * fragment has a sequential PN value. */
1361                         entry->ccmp = 1;
1362                         memcpy(entry->last_pn,
1363                                rx->key->u.ccmp.rx_pn[queue],
1364                                CCMP_PN_LEN);
1365                 }
1366                 return RX_QUEUED;
1367         }
1368
1369         /* This is a fragment for a frame that should already be pending in
1370          * fragment cache. Add this fragment to the end of the pending entry.
1371          */
1372         entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
1373         if (!entry) {
1374                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1375                 return RX_DROP_MONITOR;
1376         }
1377
1378         /* Verify that MPDUs within one MSDU have sequential PN values.
1379          * (IEEE 802.11i, 8.3.3.4.5) */
1380         if (entry->ccmp) {
1381                 int i;
1382                 u8 pn[CCMP_PN_LEN], *rpn;
1383                 int queue;
1384                 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
1385                         return RX_DROP_UNUSABLE;
1386                 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1387                 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1388                         pn[i]++;
1389                         if (pn[i])
1390                                 break;
1391                 }
1392                 queue = ieee80211_is_mgmt(fc) ?
1393                         NUM_RX_DATA_QUEUES : rx->queue;
1394                 rpn = rx->key->u.ccmp.rx_pn[queue];
1395                 if (memcmp(pn, rpn, CCMP_PN_LEN))
1396                         return RX_DROP_UNUSABLE;
1397                 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1398         }
1399
1400         skb_pull(rx->skb, ieee80211_hdrlen(fc));
1401         __skb_queue_tail(&entry->skb_list, rx->skb);
1402         entry->last_frag = frag;
1403         entry->extra_len += rx->skb->len;
1404         if (ieee80211_has_morefrags(fc)) {
1405                 rx->skb = NULL;
1406                 return RX_QUEUED;
1407         }
1408
1409         rx->skb = __skb_dequeue(&entry->skb_list);
1410         if (skb_tailroom(rx->skb) < entry->extra_len) {
1411                 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1412                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1413                                               GFP_ATOMIC))) {
1414                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1415                         __skb_queue_purge(&entry->skb_list);
1416                         return RX_DROP_UNUSABLE;
1417                 }
1418         }
1419         while ((skb = __skb_dequeue(&entry->skb_list))) {
1420                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1421                 dev_kfree_skb(skb);
1422         }
1423
1424         /* Complete frame has been reassembled - process it now */
1425         status = IEEE80211_SKB_RXCB(rx->skb);
1426         status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1427
1428  out:
1429         if (rx->sta)
1430                 rx->sta->rx_packets++;
1431         if (is_multicast_ether_addr(hdr->addr1))
1432                 rx->local->dot11MulticastReceivedFrameCount++;
1433         else
1434                 ieee80211_led_rx(rx->local);
1435         return RX_CONTINUE;
1436 }
1437
1438 static ieee80211_rx_result debug_noinline
1439 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1440 {
1441         struct ieee80211_sub_if_data *sdata = rx->sdata;
1442         __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1443         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1444
1445         if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1446                    !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
1447                 return RX_CONTINUE;
1448
1449         if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1450             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1451                 return RX_DROP_UNUSABLE;
1452
1453         if (!test_sta_flags(rx->sta, WLAN_STA_PS_DRIVER))
1454                 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1455         else
1456                 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1457
1458         /* Free PS Poll skb here instead of returning RX_DROP that would
1459          * count as an dropped frame. */
1460         dev_kfree_skb(rx->skb);
1461
1462         return RX_QUEUED;
1463 }
1464
1465 static ieee80211_rx_result debug_noinline
1466 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1467 {
1468         u8 *data = rx->skb->data;
1469         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1470
1471         if (!ieee80211_is_data_qos(hdr->frame_control))
1472                 return RX_CONTINUE;
1473
1474         /* remove the qos control field, update frame type and meta-data */
1475         memmove(data + IEEE80211_QOS_CTL_LEN, data,
1476                 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1477         hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1478         /* change frame type to non QOS */
1479         hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1480
1481         return RX_CONTINUE;
1482 }
1483
1484 static int
1485 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1486 {
1487         if (unlikely(!rx->sta ||
1488             !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1489                 return -EACCES;
1490
1491         return 0;
1492 }
1493
1494 static int
1495 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1496 {
1497         struct sk_buff *skb = rx->skb;
1498         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1499
1500         /*
1501          * Pass through unencrypted frames if the hardware has
1502          * decrypted them already.
1503          */
1504         if (status->flag & RX_FLAG_DECRYPTED)
1505                 return 0;
1506
1507         /* Drop unencrypted frames if key is set. */
1508         if (unlikely(!ieee80211_has_protected(fc) &&
1509                      !ieee80211_is_nullfunc(fc) &&
1510                      ieee80211_is_data(fc) &&
1511                      (rx->key || rx->sdata->drop_unencrypted)))
1512                 return -EACCES;
1513
1514         return 0;
1515 }
1516
1517 static int
1518 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1519 {
1520         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1521         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1522         __le16 fc = hdr->frame_control;
1523
1524         /*
1525          * Pass through unencrypted frames if the hardware has
1526          * decrypted them already.
1527          */
1528         if (status->flag & RX_FLAG_DECRYPTED)
1529                 return 0;
1530
1531         if (rx->sta && test_sta_flags(rx->sta, WLAN_STA_MFP)) {
1532                 if (unlikely(!ieee80211_has_protected(fc) &&
1533                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1534                              rx->key)) {
1535                         if (ieee80211_is_deauth(fc))
1536                                 cfg80211_send_unprot_deauth(rx->sdata->dev,
1537                                                             rx->skb->data,
1538                                                             rx->skb->len);
1539                         else if (ieee80211_is_disassoc(fc))
1540                                 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1541                                                               rx->skb->data,
1542                                                               rx->skb->len);
1543                         return -EACCES;
1544                 }
1545                 /* BIP does not use Protected field, so need to check MMIE */
1546                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1547                              ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1548                         if (ieee80211_is_deauth(fc))
1549                                 cfg80211_send_unprot_deauth(rx->sdata->dev,
1550                                                             rx->skb->data,
1551                                                             rx->skb->len);
1552                         else if (ieee80211_is_disassoc(fc))
1553                                 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1554                                                               rx->skb->data,
1555                                                               rx->skb->len);
1556                         return -EACCES;
1557                 }
1558                 /*
1559                  * When using MFP, Action frames are not allowed prior to
1560                  * having configured keys.
1561                  */
1562                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1563                              ieee80211_is_robust_mgmt_frame(
1564                                      (struct ieee80211_hdr *) rx->skb->data)))
1565                         return -EACCES;
1566         }
1567
1568         return 0;
1569 }
1570
1571 static int
1572 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1573 {
1574         struct ieee80211_sub_if_data *sdata = rx->sdata;
1575         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1576         bool check_port_control = false;
1577         struct ethhdr *ehdr;
1578         int ret;
1579
1580         if (ieee80211_has_a4(hdr->frame_control) &&
1581             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1582                 return -1;
1583
1584         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1585             !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1586
1587                 if (!sdata->u.mgd.use_4addr)
1588                         return -1;
1589                 else
1590                         check_port_control = true;
1591         }
1592
1593         if (is_multicast_ether_addr(hdr->addr1) &&
1594             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1595                 return -1;
1596
1597         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1598         if (ret < 0 || !check_port_control)
1599                 return ret;
1600
1601         ehdr = (struct ethhdr *) rx->skb->data;
1602         if (ehdr->h_proto != rx->sdata->control_port_protocol)
1603                 return -1;
1604
1605         return 0;
1606 }
1607
1608 /*
1609  * requires that rx->skb is a frame with ethernet header
1610  */
1611 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1612 {
1613         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1614                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1615         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1616
1617         /*
1618          * Allow EAPOL frames to us/the PAE group address regardless
1619          * of whether the frame was encrypted or not.
1620          */
1621         if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1622             (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
1623              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1624                 return true;
1625
1626         if (ieee80211_802_1x_port_control(rx) ||
1627             ieee80211_drop_unencrypted(rx, fc))
1628                 return false;
1629
1630         return true;
1631 }
1632
1633 /*
1634  * requires that rx->skb is a frame with ethernet header
1635  */
1636 static void
1637 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1638 {
1639         struct ieee80211_sub_if_data *sdata = rx->sdata;
1640         struct net_device *dev = sdata->dev;
1641         struct sk_buff *skb, *xmit_skb;
1642         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1643         struct sta_info *dsta;
1644         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1645
1646         skb = rx->skb;
1647         xmit_skb = NULL;
1648
1649         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1650              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1651             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1652             (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1653             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1654                 if (is_multicast_ether_addr(ehdr->h_dest)) {
1655                         /*
1656                          * send multicast frames both to higher layers in
1657                          * local net stack and back to the wireless medium
1658                          */
1659                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
1660                         if (!xmit_skb && net_ratelimit())
1661                                 printk(KERN_DEBUG "%s: failed to clone "
1662                                        "multicast frame\n", dev->name);
1663                 } else {
1664                         dsta = sta_info_get(sdata, skb->data);
1665                         if (dsta) {
1666                                 /*
1667                                  * The destination station is associated to
1668                                  * this AP (in this VLAN), so send the frame
1669                                  * directly to it and do not pass it to local
1670                                  * net stack.
1671                                  */
1672                                 xmit_skb = skb;
1673                                 skb = NULL;
1674                         }
1675                 }
1676         }
1677
1678         if (skb) {
1679                 int align __maybe_unused;
1680
1681 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1682                 /*
1683                  * 'align' will only take the values 0 or 2 here
1684                  * since all frames are required to be aligned
1685                  * to 2-byte boundaries when being passed to
1686                  * mac80211. That also explains the __skb_push()
1687                  * below.
1688                  */
1689                 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
1690                 if (align) {
1691                         if (WARN_ON(skb_headroom(skb) < 3)) {
1692                                 dev_kfree_skb(skb);
1693                                 skb = NULL;
1694                         } else {
1695                                 u8 *data = skb->data;
1696                                 size_t len = skb_headlen(skb);
1697                                 skb->data -= align;
1698                                 memmove(skb->data, data, len);
1699                                 skb_set_tail_pointer(skb, len);
1700                         }
1701                 }
1702 #endif
1703
1704                 if (skb) {
1705                         /* deliver to local stack */
1706                         skb->protocol = eth_type_trans(skb, dev);
1707                         memset(skb->cb, 0, sizeof(skb->cb));
1708                         netif_receive_skb(skb);
1709                 }
1710         }
1711
1712         if (xmit_skb) {
1713                 /* send to wireless media */
1714                 xmit_skb->protocol = htons(ETH_P_802_3);
1715                 skb_reset_network_header(xmit_skb);
1716                 skb_reset_mac_header(xmit_skb);
1717                 dev_queue_xmit(xmit_skb);
1718         }
1719 }
1720
1721 static ieee80211_rx_result debug_noinline
1722 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1723 {
1724         struct net_device *dev = rx->sdata->dev;
1725         struct sk_buff *skb = rx->skb;
1726         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1727         __le16 fc = hdr->frame_control;
1728         struct sk_buff_head frame_list;
1729         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1730
1731         if (unlikely(!ieee80211_is_data(fc)))
1732                 return RX_CONTINUE;
1733
1734         if (unlikely(!ieee80211_is_data_present(fc)))
1735                 return RX_DROP_MONITOR;
1736
1737         if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1738                 return RX_CONTINUE;
1739
1740         if (ieee80211_has_a4(hdr->frame_control) &&
1741             rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1742             !rx->sdata->u.vlan.sta)
1743                 return RX_DROP_UNUSABLE;
1744
1745         if (is_multicast_ether_addr(hdr->addr1) &&
1746             ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1747               rx->sdata->u.vlan.sta) ||
1748              (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1749               rx->sdata->u.mgd.use_4addr)))
1750                 return RX_DROP_UNUSABLE;
1751
1752         skb->dev = dev;
1753         __skb_queue_head_init(&frame_list);
1754
1755         if (skb_linearize(skb))
1756                 return RX_DROP_UNUSABLE;
1757
1758         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1759                                  rx->sdata->vif.type,
1760                                  rx->local->hw.extra_tx_headroom);
1761
1762         while (!skb_queue_empty(&frame_list)) {
1763                 rx->skb = __skb_dequeue(&frame_list);
1764
1765                 if (!ieee80211_frame_allowed(rx, fc)) {
1766                         dev_kfree_skb(rx->skb);
1767                         continue;
1768                 }
1769                 dev->stats.rx_packets++;
1770                 dev->stats.rx_bytes += rx->skb->len;
1771
1772                 ieee80211_deliver_skb(rx);
1773         }
1774
1775         return RX_QUEUED;
1776 }
1777
1778 #ifdef CONFIG_MAC80211_MESH
1779 static ieee80211_rx_result
1780 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1781 {
1782         struct ieee80211_hdr *hdr;
1783         struct ieee80211s_hdr *mesh_hdr;
1784         unsigned int hdrlen;
1785         struct sk_buff *skb = rx->skb, *fwd_skb;
1786         struct ieee80211_local *local = rx->local;
1787         struct ieee80211_sub_if_data *sdata = rx->sdata;
1788         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1789
1790         hdr = (struct ieee80211_hdr *) skb->data;
1791         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1792         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1793
1794         if (!ieee80211_is_data(hdr->frame_control))
1795                 return RX_CONTINUE;
1796
1797         if (!mesh_hdr->ttl)
1798                 /* illegal frame */
1799                 return RX_DROP_MONITOR;
1800
1801         if (mesh_hdr->flags & MESH_FLAGS_AE) {
1802                 struct mesh_path *mppath;
1803                 char *proxied_addr;
1804                 char *mpp_addr;
1805
1806                 if (is_multicast_ether_addr(hdr->addr1)) {
1807                         mpp_addr = hdr->addr3;
1808                         proxied_addr = mesh_hdr->eaddr1;
1809                 } else {
1810                         mpp_addr = hdr->addr4;
1811                         proxied_addr = mesh_hdr->eaddr2;
1812                 }
1813
1814                 rcu_read_lock();
1815                 mppath = mpp_path_lookup(proxied_addr, sdata);
1816                 if (!mppath) {
1817                         mpp_path_add(proxied_addr, mpp_addr, sdata);
1818                 } else {
1819                         spin_lock_bh(&mppath->state_lock);
1820                         if (compare_ether_addr(mppath->mpp, mpp_addr) != 0)
1821                                 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
1822                         spin_unlock_bh(&mppath->state_lock);
1823                 }
1824                 rcu_read_unlock();
1825         }
1826
1827         /* Frame has reached destination.  Don't forward */
1828         if (!is_multicast_ether_addr(hdr->addr1) &&
1829             compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
1830                 return RX_CONTINUE;
1831
1832         mesh_hdr->ttl--;
1833
1834         if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1835                 if (!mesh_hdr->ttl)
1836                         IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1837                                                      dropped_frames_ttl);
1838                 else {
1839                         struct ieee80211_hdr *fwd_hdr;
1840                         struct ieee80211_tx_info *info;
1841
1842                         fwd_skb = skb_copy(skb, GFP_ATOMIC);
1843
1844                         if (!fwd_skb && net_ratelimit())
1845                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1846                                                    sdata->name);
1847                         if (!fwd_skb)
1848                                 goto out;
1849
1850                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
1851                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
1852                         info = IEEE80211_SKB_CB(fwd_skb);
1853                         memset(info, 0, sizeof(*info));
1854                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1855                         info->control.vif = &rx->sdata->vif;
1856                         skb_set_queue_mapping(skb,
1857                                 ieee80211_select_queue(rx->sdata, fwd_skb));
1858                         ieee80211_set_qos_hdr(local, skb);
1859                         if (is_multicast_ether_addr(fwd_hdr->addr1))
1860                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1861                                                                 fwded_mcast);
1862                         else {
1863                                 int err;
1864                                 /*
1865                                  * Save TA to addr1 to send TA a path error if a
1866                                  * suitable next hop is not found
1867                                  */
1868                                 memcpy(fwd_hdr->addr1, fwd_hdr->addr2,
1869                                                 ETH_ALEN);
1870                                 err = mesh_nexthop_lookup(fwd_skb, sdata);
1871                                 /* Failed to immediately resolve next hop:
1872                                  * fwded frame was dropped or will be added
1873                                  * later to the pending skb queue.  */
1874                                 if (err)
1875                                         return RX_DROP_MONITOR;
1876
1877                                 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1878                                                                 fwded_unicast);
1879                         }
1880                         IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.mesh,
1881                                                      fwded_frames);
1882                         ieee80211_add_pending_skb(local, fwd_skb);
1883                 }
1884         }
1885
1886  out:
1887         if (is_multicast_ether_addr(hdr->addr1) ||
1888             sdata->dev->flags & IFF_PROMISC)
1889                 return RX_CONTINUE;
1890         else
1891                 return RX_DROP_MONITOR;
1892 }
1893 #endif
1894
1895 static ieee80211_rx_result debug_noinline
1896 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1897 {
1898         struct ieee80211_sub_if_data *sdata = rx->sdata;
1899         struct ieee80211_local *local = rx->local;
1900         struct net_device *dev = sdata->dev;
1901         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1902         __le16 fc = hdr->frame_control;
1903         int err;
1904
1905         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1906                 return RX_CONTINUE;
1907
1908         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1909                 return RX_DROP_MONITOR;
1910
1911         /*
1912          * Allow the cooked monitor interface of an AP to see 4-addr frames so
1913          * that a 4-addr station can be detected and moved into a separate VLAN
1914          */
1915         if (ieee80211_has_a4(hdr->frame_control) &&
1916             sdata->vif.type == NL80211_IFTYPE_AP)
1917                 return RX_DROP_MONITOR;
1918
1919         err = __ieee80211_data_to_8023(rx);
1920         if (unlikely(err))
1921                 return RX_DROP_UNUSABLE;
1922
1923         if (!ieee80211_frame_allowed(rx, fc))
1924                 return RX_DROP_MONITOR;
1925
1926         rx->skb->dev = dev;
1927
1928         dev->stats.rx_packets++;
1929         dev->stats.rx_bytes += rx->skb->len;
1930
1931         if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
1932             !is_multicast_ether_addr(((struct ethhdr *)rx->skb->data)->h_dest)) {
1933                         mod_timer(&local->dynamic_ps_timer, jiffies +
1934                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1935         }
1936
1937         ieee80211_deliver_skb(rx);
1938
1939         return RX_QUEUED;
1940 }
1941
1942 static ieee80211_rx_result debug_noinline
1943 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1944 {
1945         struct ieee80211_local *local = rx->local;
1946         struct ieee80211_hw *hw = &local->hw;
1947         struct sk_buff *skb = rx->skb;
1948         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1949         struct tid_ampdu_rx *tid_agg_rx;
1950         u16 start_seq_num;
1951         u16 tid;
1952
1953         if (likely(!ieee80211_is_ctl(bar->frame_control)))
1954                 return RX_CONTINUE;
1955
1956         if (ieee80211_is_back_req(bar->frame_control)) {
1957                 struct {
1958                         __le16 control, start_seq_num;
1959                 } __packed bar_data;
1960
1961                 if (!rx->sta)
1962                         return RX_DROP_MONITOR;
1963
1964                 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
1965                                   &bar_data, sizeof(bar_data)))
1966                         return RX_DROP_MONITOR;
1967
1968                 tid = le16_to_cpu(bar_data.control) >> 12;
1969
1970                 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
1971                 if (!tid_agg_rx)
1972                         return RX_DROP_MONITOR;
1973
1974                 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
1975
1976                 /* reset session timer */
1977                 if (tid_agg_rx->timeout)
1978                         mod_timer(&tid_agg_rx->session_timer,
1979                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
1980
1981                 spin_lock(&tid_agg_rx->reorder_lock);
1982                 /* release stored frames up to start of BAR */
1983                 ieee80211_release_reorder_frames(hw, tid_agg_rx, start_seq_num);
1984                 spin_unlock(&tid_agg_rx->reorder_lock);
1985
1986                 kfree_skb(skb);
1987                 return RX_QUEUED;
1988         }
1989
1990         /*
1991          * After this point, we only want management frames,
1992          * so we can drop all remaining control frames to
1993          * cooked monitor interfaces.
1994          */
1995         return RX_DROP_MONITOR;
1996 }
1997
1998 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1999                                            struct ieee80211_mgmt *mgmt,
2000                                            size_t len)
2001 {
2002         struct ieee80211_local *local = sdata->local;
2003         struct sk_buff *skb;
2004         struct ieee80211_mgmt *resp;
2005
2006         if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
2007                 /* Not to own unicast address */
2008                 return;
2009         }
2010
2011         if (compare_ether_addr(mgmt->sa, sdata->u.mgd.bssid) != 0 ||
2012             compare_ether_addr(mgmt->bssid, sdata->u.mgd.bssid) != 0) {
2013                 /* Not from the current AP or not associated yet. */
2014                 return;
2015         }
2016
2017         if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2018                 /* Too short SA Query request frame */
2019                 return;
2020         }
2021
2022         skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2023         if (skb == NULL)
2024                 return;
2025
2026         skb_reserve(skb, local->hw.extra_tx_headroom);
2027         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2028         memset(resp, 0, 24);
2029         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2030         memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2031         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2032         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2033                                           IEEE80211_STYPE_ACTION);
2034         skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2035         resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2036         resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2037         memcpy(resp->u.action.u.sa_query.trans_id,
2038                mgmt->u.action.u.sa_query.trans_id,
2039                WLAN_SA_QUERY_TR_ID_LEN);
2040
2041         ieee80211_tx_skb(sdata, skb);
2042 }
2043
2044 static ieee80211_rx_result debug_noinline
2045 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2046 {
2047         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2048         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2049
2050         /*
2051          * From here on, look only at management frames.
2052          * Data and control frames are already handled,
2053          * and unknown (reserved) frames are useless.
2054          */
2055         if (rx->skb->len < 24)
2056                 return RX_DROP_MONITOR;
2057
2058         if (!ieee80211_is_mgmt(mgmt->frame_control))
2059                 return RX_DROP_MONITOR;
2060
2061         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2062                 return RX_DROP_MONITOR;
2063
2064         if (ieee80211_drop_unencrypted_mgmt(rx))
2065                 return RX_DROP_UNUSABLE;
2066
2067         return RX_CONTINUE;
2068 }
2069
2070 static ieee80211_rx_result debug_noinline
2071 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2072 {
2073         struct ieee80211_local *local = rx->local;
2074         struct ieee80211_sub_if_data *sdata = rx->sdata;
2075         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2076         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2077         int len = rx->skb->len;
2078
2079         if (!ieee80211_is_action(mgmt->frame_control))
2080                 return RX_CONTINUE;
2081
2082         /* drop too small frames */
2083         if (len < IEEE80211_MIN_ACTION_SIZE)
2084                 return RX_DROP_UNUSABLE;
2085
2086         if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
2087                 return RX_DROP_UNUSABLE;
2088
2089         if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2090                 return RX_DROP_UNUSABLE;
2091
2092         switch (mgmt->u.action.category) {
2093         case WLAN_CATEGORY_BACK:
2094                 /*
2095                  * The aggregation code is not prepared to handle
2096                  * anything but STA/AP due to the BSSID handling;
2097                  * IBSS could work in the code but isn't supported
2098                  * by drivers or the standard.
2099                  */
2100                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2101                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2102                     sdata->vif.type != NL80211_IFTYPE_AP)
2103                         break;
2104
2105                 /* verify action_code is present */
2106                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2107                         break;
2108
2109                 switch (mgmt->u.action.u.addba_req.action_code) {
2110                 case WLAN_ACTION_ADDBA_REQ:
2111                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2112                                    sizeof(mgmt->u.action.u.addba_req)))
2113                                 goto invalid;
2114                         break;
2115                 case WLAN_ACTION_ADDBA_RESP:
2116                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2117                                    sizeof(mgmt->u.action.u.addba_resp)))
2118                                 goto invalid;
2119                         break;
2120                 case WLAN_ACTION_DELBA:
2121                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2122                                    sizeof(mgmt->u.action.u.delba)))
2123                                 goto invalid;
2124                         break;
2125                 default:
2126                         goto invalid;
2127                 }
2128
2129                 goto queue;
2130         case WLAN_CATEGORY_SPECTRUM_MGMT:
2131                 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
2132                         break;
2133
2134                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2135                         break;
2136
2137                 /* verify action_code is present */
2138                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2139                         break;
2140
2141                 switch (mgmt->u.action.u.measurement.action_code) {
2142                 case WLAN_ACTION_SPCT_MSR_REQ:
2143                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2144                                    sizeof(mgmt->u.action.u.measurement)))
2145                                 break;
2146                         ieee80211_process_measurement_req(sdata, mgmt, len);
2147                         goto handled;
2148                 case WLAN_ACTION_SPCT_CHL_SWITCH:
2149                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2150                                    sizeof(mgmt->u.action.u.chan_switch)))
2151                                 break;
2152
2153                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2154                                 break;
2155
2156                         if (memcmp(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN))
2157                                 break;
2158
2159                         goto queue;
2160                 }
2161                 break;
2162         case WLAN_CATEGORY_SA_QUERY:
2163                 if (len < (IEEE80211_MIN_ACTION_SIZE +
2164                            sizeof(mgmt->u.action.u.sa_query)))
2165                         break;
2166
2167                 switch (mgmt->u.action.u.sa_query.action) {
2168                 case WLAN_ACTION_SA_QUERY_REQUEST:
2169                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2170                                 break;
2171                         ieee80211_process_sa_query_req(sdata, mgmt, len);
2172                         goto handled;
2173                 }
2174                 break;
2175         case WLAN_CATEGORY_MESH_PLINK:
2176                 if (!ieee80211_vif_is_mesh(&sdata->vif))
2177                         break;
2178                 goto queue;
2179         case WLAN_CATEGORY_MESH_PATH_SEL:
2180                 if (!mesh_path_sel_is_hwmp(sdata))
2181                         break;
2182                 goto queue;
2183         }
2184
2185         return RX_CONTINUE;
2186
2187  invalid:
2188         status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2189         /* will return in the next handlers */
2190         return RX_CONTINUE;
2191
2192  handled:
2193         if (rx->sta)
2194                 rx->sta->rx_packets++;
2195         dev_kfree_skb(rx->skb);
2196         return RX_QUEUED;
2197
2198  queue:
2199         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2200         skb_queue_tail(&sdata->skb_queue, rx->skb);
2201         ieee80211_queue_work(&local->hw, &sdata->work);
2202         if (rx->sta)
2203                 rx->sta->rx_packets++;
2204         return RX_QUEUED;
2205 }
2206
2207 static ieee80211_rx_result debug_noinline
2208 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2209 {
2210         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2211
2212         /* skip known-bad action frames and return them in the next handler */
2213         if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2214                 return RX_CONTINUE;
2215
2216         /*
2217          * Getting here means the kernel doesn't know how to handle
2218          * it, but maybe userspace does ... include returned frames
2219          * so userspace can register for those to know whether ones
2220          * it transmitted were processed or returned.
2221          */
2222
2223         if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
2224                              rx->skb->data, rx->skb->len,
2225                              GFP_ATOMIC)) {
2226                 if (rx->sta)
2227                         rx->sta->rx_packets++;
2228                 dev_kfree_skb(rx->skb);
2229                 return RX_QUEUED;
2230         }
2231
2232
2233         return RX_CONTINUE;
2234 }
2235
2236 static ieee80211_rx_result debug_noinline
2237 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2238 {
2239         struct ieee80211_local *local = rx->local;
2240         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2241         struct sk_buff *nskb;
2242         struct ieee80211_sub_if_data *sdata = rx->sdata;
2243         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2244
2245         if (!ieee80211_is_action(mgmt->frame_control))
2246                 return RX_CONTINUE;
2247
2248         /*
2249          * For AP mode, hostapd is responsible for handling any action
2250          * frames that we didn't handle, including returning unknown
2251          * ones. For all other modes we will return them to the sender,
2252          * setting the 0x80 bit in the action category, as required by
2253          * 802.11-2007 7.3.1.11.
2254          * Newer versions of hostapd shall also use the management frame
2255          * registration mechanisms, but older ones still use cooked
2256          * monitor interfaces so push all frames there.
2257          */
2258         if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2259             (sdata->vif.type == NL80211_IFTYPE_AP ||
2260              sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2261                 return RX_DROP_MONITOR;
2262
2263         /* do not return rejected action frames */
2264         if (mgmt->u.action.category & 0x80)
2265                 return RX_DROP_UNUSABLE;
2266
2267         nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2268                                GFP_ATOMIC);
2269         if (nskb) {
2270                 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2271
2272                 nmgmt->u.action.category |= 0x80;
2273                 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2274                 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2275
2276                 memset(nskb->cb, 0, sizeof(nskb->cb));
2277
2278                 ieee80211_tx_skb(rx->sdata, nskb);
2279         }
2280         dev_kfree_skb(rx->skb);
2281         return RX_QUEUED;
2282 }
2283
2284 static ieee80211_rx_result debug_noinline
2285 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2286 {
2287         struct ieee80211_sub_if_data *sdata = rx->sdata;
2288         ieee80211_rx_result rxs;
2289         struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2290         __le16 stype;
2291
2292         rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2293         if (rxs != RX_CONTINUE)
2294                 return rxs;
2295
2296         stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2297
2298         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2299             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2300             sdata->vif.type != NL80211_IFTYPE_STATION)
2301                 return RX_DROP_MONITOR;
2302
2303         switch (stype) {
2304         case cpu_to_le16(IEEE80211_STYPE_BEACON):
2305         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2306                 /* process for all: mesh, mlme, ibss */
2307                 break;
2308         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2309         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2310                 if (is_multicast_ether_addr(mgmt->da) &&
2311                     !is_broadcast_ether_addr(mgmt->da))
2312                         return RX_DROP_MONITOR;
2313
2314                 /* process only for station */
2315                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2316                         return RX_DROP_MONITOR;
2317                 break;
2318         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2319         case cpu_to_le16(IEEE80211_STYPE_AUTH):
2320                 /* process only for ibss */
2321                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
2322                         return RX_DROP_MONITOR;
2323                 break;
2324         default:
2325                 return RX_DROP_MONITOR;
2326         }
2327
2328         /* queue up frame and kick off work to process it */
2329         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2330         skb_queue_tail(&sdata->skb_queue, rx->skb);
2331         ieee80211_queue_work(&rx->local->hw, &sdata->work);
2332         if (rx->sta)
2333                 rx->sta->rx_packets++;
2334
2335         return RX_QUEUED;
2336 }
2337
2338 static void ieee80211_rx_michael_mic_report(struct ieee80211_hdr *hdr,
2339                                             struct ieee80211_rx_data *rx)
2340 {
2341         int keyidx;
2342         unsigned int hdrlen;
2343
2344         hdrlen = ieee80211_hdrlen(hdr->frame_control);
2345         if (rx->skb->len >= hdrlen + 4)
2346                 keyidx = rx->skb->data[hdrlen + 3] >> 6;
2347         else
2348                 keyidx = -1;
2349
2350         if (!rx->sta) {
2351                 /*
2352                  * Some hardware seem to generate incorrect Michael MIC
2353                  * reports; ignore them to avoid triggering countermeasures.
2354                  */
2355                 return;
2356         }
2357
2358         if (!ieee80211_has_protected(hdr->frame_control))
2359                 return;
2360
2361         if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
2362                 /*
2363                  * APs with pairwise keys should never receive Michael MIC
2364                  * errors for non-zero keyidx because these are reserved for
2365                  * group keys and only the AP is sending real multicast
2366                  * frames in the BSS.
2367                  */
2368                 return;
2369         }
2370
2371         if (!ieee80211_is_data(hdr->frame_control) &&
2372             !ieee80211_is_auth(hdr->frame_control))
2373                 return;
2374
2375         mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr, NULL,
2376                                         GFP_ATOMIC);
2377 }
2378
2379 /* TODO: use IEEE80211_RX_FRAGMENTED */
2380 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2381                                         struct ieee80211_rate *rate)
2382 {
2383         struct ieee80211_sub_if_data *sdata;
2384         struct ieee80211_local *local = rx->local;
2385         struct ieee80211_rtap_hdr {
2386                 struct ieee80211_radiotap_header hdr;
2387                 u8 flags;
2388                 u8 rate_or_pad;
2389                 __le16 chan_freq;
2390                 __le16 chan_flags;
2391         } __packed *rthdr;
2392         struct sk_buff *skb = rx->skb, *skb2;
2393         struct net_device *prev_dev = NULL;
2394         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2395
2396         /*
2397          * If cooked monitor has been processed already, then
2398          * don't do it again. If not, set the flag.
2399          */
2400         if (rx->flags & IEEE80211_RX_CMNTR)
2401                 goto out_free_skb;
2402         rx->flags |= IEEE80211_RX_CMNTR;
2403
2404         if (skb_headroom(skb) < sizeof(*rthdr) &&
2405             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2406                 goto out_free_skb;
2407
2408         rthdr = (void *)skb_push(skb, sizeof(*rthdr));
2409         memset(rthdr, 0, sizeof(*rthdr));
2410         rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
2411         rthdr->hdr.it_present =
2412                 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
2413                             (1 << IEEE80211_RADIOTAP_CHANNEL));
2414
2415         if (rate) {
2416                 rthdr->rate_or_pad = rate->bitrate / 5;
2417                 rthdr->hdr.it_present |=
2418                         cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
2419         }
2420         rthdr->chan_freq = cpu_to_le16(status->freq);
2421
2422         if (status->band == IEEE80211_BAND_5GHZ)
2423                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
2424                                                 IEEE80211_CHAN_5GHZ);
2425         else
2426                 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
2427                                                 IEEE80211_CHAN_2GHZ);
2428
2429         skb_set_mac_header(skb, 0);
2430         skb->ip_summed = CHECKSUM_UNNECESSARY;
2431         skb->pkt_type = PACKET_OTHERHOST;
2432         skb->protocol = htons(ETH_P_802_2);
2433
2434         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2435                 if (!ieee80211_sdata_running(sdata))
2436                         continue;
2437
2438                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2439                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2440                         continue;
2441
2442                 if (prev_dev) {
2443                         skb2 = skb_clone(skb, GFP_ATOMIC);
2444                         if (skb2) {
2445                                 skb2->dev = prev_dev;
2446                                 netif_receive_skb(skb2);
2447                         }
2448                 }
2449
2450                 prev_dev = sdata->dev;
2451                 sdata->dev->stats.rx_packets++;
2452                 sdata->dev->stats.rx_bytes += skb->len;
2453         }
2454
2455         if (prev_dev) {
2456                 skb->dev = prev_dev;
2457                 netif_receive_skb(skb);
2458                 return;
2459         }
2460
2461  out_free_skb:
2462         dev_kfree_skb(skb);
2463 }
2464
2465 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2466                                          ieee80211_rx_result res)
2467 {
2468         switch (res) {
2469         case RX_DROP_MONITOR:
2470                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2471                 if (rx->sta)
2472                         rx->sta->rx_dropped++;
2473                 /* fall through */
2474         case RX_CONTINUE: {
2475                 struct ieee80211_rate *rate = NULL;
2476                 struct ieee80211_supported_band *sband;
2477                 struct ieee80211_rx_status *status;
2478
2479                 status = IEEE80211_SKB_RXCB((rx->skb));
2480
2481                 sband = rx->local->hw.wiphy->bands[status->band];
2482                 if (!(status->flag & RX_FLAG_HT))
2483                         rate = &sband->bitrates[status->rate_idx];
2484
2485                 ieee80211_rx_cooked_monitor(rx, rate);
2486                 break;
2487                 }
2488         case RX_DROP_UNUSABLE:
2489                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2490                 if (rx->sta)
2491                         rx->sta->rx_dropped++;
2492                 dev_kfree_skb(rx->skb);
2493                 break;
2494         case RX_QUEUED:
2495                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2496                 break;
2497         }
2498 }
2499
2500 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
2501 {
2502         ieee80211_rx_result res = RX_DROP_MONITOR;
2503         struct sk_buff *skb;
2504
2505 #define CALL_RXH(rxh)                   \
2506         do {                            \
2507                 res = rxh(rx);          \
2508                 if (res != RX_CONTINUE) \
2509                         goto rxh_next;  \
2510         } while (0);
2511
2512         spin_lock(&rx->local->rx_skb_queue.lock);
2513         if (rx->local->running_rx_handler)
2514                 goto unlock;
2515
2516         rx->local->running_rx_handler = true;
2517
2518         while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
2519                 spin_unlock(&rx->local->rx_skb_queue.lock);
2520
2521                 /*
2522                  * all the other fields are valid across frames
2523                  * that belong to an aMPDU since they are on the
2524                  * same TID from the same station
2525                  */
2526                 rx->skb = skb;
2527                 rx->flags = 0;
2528
2529                 CALL_RXH(ieee80211_rx_h_decrypt)
2530                 CALL_RXH(ieee80211_rx_h_check_more_data)
2531                 CALL_RXH(ieee80211_rx_h_sta_process)
2532                 CALL_RXH(ieee80211_rx_h_defragment)
2533                 CALL_RXH(ieee80211_rx_h_ps_poll)
2534                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2535                 /* must be after MMIC verify so header is counted in MPDU mic */
2536                 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2537                 CALL_RXH(ieee80211_rx_h_amsdu)
2538 #ifdef CONFIG_MAC80211_MESH
2539                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2540                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
2541 #endif
2542                 CALL_RXH(ieee80211_rx_h_data)
2543                 CALL_RXH(ieee80211_rx_h_ctrl);
2544                 CALL_RXH(ieee80211_rx_h_mgmt_check)
2545                 CALL_RXH(ieee80211_rx_h_action)
2546                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2547                 CALL_RXH(ieee80211_rx_h_action_return)
2548                 CALL_RXH(ieee80211_rx_h_mgmt)
2549
2550  rxh_next:
2551                 ieee80211_rx_handlers_result(rx, res);
2552                 spin_lock(&rx->local->rx_skb_queue.lock);
2553 #undef CALL_RXH
2554         }
2555
2556         rx->local->running_rx_handler = false;
2557
2558  unlock:
2559         spin_unlock(&rx->local->rx_skb_queue.lock);
2560 }
2561
2562 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2563 {
2564         ieee80211_rx_result res = RX_DROP_MONITOR;
2565
2566 #define CALL_RXH(rxh)                   \
2567         do {                            \
2568                 res = rxh(rx);          \
2569                 if (res != RX_CONTINUE) \
2570                         goto rxh_next;  \
2571         } while (0);
2572
2573         CALL_RXH(ieee80211_rx_h_passive_scan)
2574         CALL_RXH(ieee80211_rx_h_check)
2575
2576         ieee80211_rx_reorder_ampdu(rx);
2577
2578         ieee80211_rx_handlers(rx);
2579         return;
2580
2581  rxh_next:
2582         ieee80211_rx_handlers_result(rx, res);
2583
2584 #undef CALL_RXH
2585 }
2586
2587 /*
2588  * This function makes calls into the RX path, therefore
2589  * it has to be invoked under RCU read lock.
2590  */
2591 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2592 {
2593         struct ieee80211_rx_data rx = {
2594                 .sta = sta,
2595                 .sdata = sta->sdata,
2596                 .local = sta->local,
2597                 .queue = tid,
2598         };
2599         struct tid_ampdu_rx *tid_agg_rx;
2600
2601         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2602         if (!tid_agg_rx)
2603                 return;
2604
2605         spin_lock(&tid_agg_rx->reorder_lock);
2606         ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx);
2607         spin_unlock(&tid_agg_rx->reorder_lock);
2608
2609         ieee80211_rx_handlers(&rx);
2610 }
2611
2612 /* main receive path */
2613
2614 static int prepare_for_handlers(struct ieee80211_rx_data *rx,
2615                                 struct ieee80211_hdr *hdr)
2616 {
2617         struct ieee80211_sub_if_data *sdata = rx->sdata;
2618         struct sk_buff *skb = rx->skb;
2619         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2620         u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
2621         int multicast = is_multicast_ether_addr(hdr->addr1);
2622
2623         switch (sdata->vif.type) {
2624         case NL80211_IFTYPE_STATION:
2625                 if (!bssid && !sdata->u.mgd.use_4addr)
2626                         return 0;
2627                 if (!multicast &&
2628                     compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
2629                         if (!(sdata->dev->flags & IFF_PROMISC))
2630                                 return 0;
2631                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2632                 }
2633                 break;
2634         case NL80211_IFTYPE_ADHOC:
2635                 if (!bssid)
2636                         return 0;
2637                 if (ieee80211_is_beacon(hdr->frame_control)) {
2638                         return 1;
2639                 }
2640                 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2641                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2642                                 return 0;
2643                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2644                 } else if (!multicast &&
2645                            compare_ether_addr(sdata->vif.addr,
2646                                               hdr->addr1) != 0) {
2647                         if (!(sdata->dev->flags & IFF_PROMISC))
2648                                 return 0;
2649                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2650                 } else if (!rx->sta) {
2651                         int rate_idx;
2652                         if (status->flag & RX_FLAG_HT)
2653                                 rate_idx = 0; /* TODO: HT rates */
2654                         else
2655                                 rate_idx = status->rate_idx;
2656                         rx->sta = ieee80211_ibss_add_sta(sdata, bssid,
2657                                         hdr->addr2, BIT(rate_idx), GFP_ATOMIC);
2658                 }
2659                 break;
2660         case NL80211_IFTYPE_MESH_POINT:
2661                 if (!multicast &&
2662                     compare_ether_addr(sdata->vif.addr,
2663                                        hdr->addr1) != 0) {
2664                         if (!(sdata->dev->flags & IFF_PROMISC))
2665                                 return 0;
2666
2667                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2668                 }
2669                 break;
2670         case NL80211_IFTYPE_AP_VLAN:
2671         case NL80211_IFTYPE_AP:
2672                 if (!bssid) {
2673                         if (compare_ether_addr(sdata->vif.addr,
2674                                                hdr->addr1))
2675                                 return 0;
2676                 } else if (!ieee80211_bssid_match(bssid,
2677                                         sdata->vif.addr)) {
2678                         if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2679                                 return 0;
2680                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2681                 }
2682                 break;
2683         case NL80211_IFTYPE_WDS:
2684                 if (bssid || !ieee80211_is_data(hdr->frame_control))
2685                         return 0;
2686                 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2687                         return 0;
2688                 break;
2689         default:
2690                 /* should never get here */
2691                 WARN_ON(1);
2692                 break;
2693         }
2694
2695         return 1;
2696 }
2697
2698 /*
2699  * This function returns whether or not the SKB
2700  * was destined for RX processing or not, which,
2701  * if consume is true, is equivalent to whether
2702  * or not the skb was consumed.
2703  */
2704 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2705                                             struct sk_buff *skb, bool consume)
2706 {
2707         struct ieee80211_local *local = rx->local;
2708         struct ieee80211_sub_if_data *sdata = rx->sdata;
2709         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2710         struct ieee80211_hdr *hdr = (void *)skb->data;
2711         int prepares;
2712
2713         rx->skb = skb;
2714         status->rx_flags |= IEEE80211_RX_RA_MATCH;
2715         prepares = prepare_for_handlers(rx, hdr);
2716
2717         if (!prepares)
2718                 return false;
2719
2720         if (status->flag & RX_FLAG_MMIC_ERROR) {
2721                 if (status->rx_flags & IEEE80211_RX_RA_MATCH)
2722                         ieee80211_rx_michael_mic_report(hdr, rx);
2723                 return false;
2724         }
2725
2726         if (!consume) {
2727                 skb = skb_copy(skb, GFP_ATOMIC);
2728                 if (!skb) {
2729                         if (net_ratelimit())
2730                                 wiphy_debug(local->hw.wiphy,
2731                                         "failed to copy skb for %s\n",
2732                                         sdata->name);
2733                         return true;
2734                 }
2735
2736                 rx->skb = skb;
2737         }
2738
2739         ieee80211_invoke_rx_handlers(rx);
2740         return true;
2741 }
2742
2743 /*
2744  * This is the actual Rx frames handler. as it blongs to Rx path it must
2745  * be called with rcu_read_lock protection.
2746  */
2747 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2748                                          struct sk_buff *skb)
2749 {
2750         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2751         struct ieee80211_local *local = hw_to_local(hw);
2752         struct ieee80211_sub_if_data *sdata;
2753         struct ieee80211_hdr *hdr;
2754         __le16 fc;
2755         struct ieee80211_rx_data rx;
2756         struct ieee80211_sub_if_data *prev;
2757         struct sta_info *sta, *tmp, *prev_sta;
2758         int err = 0;
2759
2760         fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
2761         memset(&rx, 0, sizeof(rx));
2762         rx.skb = skb;
2763         rx.local = local;
2764
2765         if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
2766                 local->dot11ReceivedFragmentCount++;
2767
2768         if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2769                      test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
2770                 status->rx_flags |= IEEE80211_RX_IN_SCAN;
2771
2772         if (ieee80211_is_mgmt(fc))
2773                 err = skb_linearize(skb);
2774         else
2775                 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
2776
2777         if (err) {
2778                 dev_kfree_skb(skb);
2779                 return;
2780         }
2781
2782         hdr = (struct ieee80211_hdr *)skb->data;
2783         ieee80211_parse_qos(&rx);
2784         ieee80211_verify_alignment(&rx);
2785
2786         if (ieee80211_is_data(fc)) {
2787                 prev_sta = NULL;
2788
2789                 for_each_sta_info(local, hdr->addr2, sta, tmp) {
2790                         if (!prev_sta) {
2791                                 prev_sta = sta;
2792                                 continue;
2793                         }
2794
2795                         rx.sta = prev_sta;
2796                         rx.sdata = prev_sta->sdata;
2797                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
2798
2799                         prev_sta = sta;
2800                 }
2801
2802                 if (prev_sta) {
2803                         rx.sta = prev_sta;
2804                         rx.sdata = prev_sta->sdata;
2805
2806                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2807                                 return;
2808                         goto out;
2809                 }
2810         }
2811
2812         prev = NULL;
2813
2814         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2815                 if (!ieee80211_sdata_running(sdata))
2816                         continue;
2817
2818                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2819                     sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2820                         continue;
2821
2822                 /*
2823                  * frame is destined for this interface, but if it's
2824                  * not also for the previous one we handle that after
2825                  * the loop to avoid copying the SKB once too much
2826                  */
2827
2828                 if (!prev) {
2829                         prev = sdata;
2830                         continue;
2831                 }
2832
2833                 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2834                 rx.sdata = prev;
2835                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2836
2837                 prev = sdata;
2838         }
2839
2840         if (prev) {
2841                 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2842                 rx.sdata = prev;
2843
2844                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2845                         return;
2846         }
2847
2848  out:
2849         dev_kfree_skb(skb);
2850 }
2851
2852 /*
2853  * This is the receive path handler. It is called by a low level driver when an
2854  * 802.11 MPDU is received from the hardware.
2855  */
2856 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
2857 {
2858         struct ieee80211_local *local = hw_to_local(hw);
2859         struct ieee80211_rate *rate = NULL;
2860         struct ieee80211_supported_band *sband;
2861         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2862
2863         WARN_ON_ONCE(softirq_count() == 0);
2864
2865         if (WARN_ON(status->band < 0 ||
2866                     status->band >= IEEE80211_NUM_BANDS))
2867                 goto drop;
2868
2869         sband = local->hw.wiphy->bands[status->band];
2870         if (WARN_ON(!sband))
2871                 goto drop;
2872
2873         /*
2874          * If we're suspending, it is possible although not too likely
2875          * that we'd be receiving frames after having already partially
2876          * quiesced the stack. We can't process such frames then since
2877          * that might, for example, cause stations to be added or other
2878          * driver callbacks be invoked.
2879          */
2880         if (unlikely(local->quiescing || local->suspended))
2881                 goto drop;
2882
2883         /*
2884          * The same happens when we're not even started,
2885          * but that's worth a warning.
2886          */
2887         if (WARN_ON(!local->started))
2888                 goto drop;
2889
2890         if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
2891                 /*
2892                  * Validate the rate, unless a PLCP error means that
2893                  * we probably can't have a valid rate here anyway.
2894                  */
2895
2896                 if (status->flag & RX_FLAG_HT) {
2897                         /*
2898                          * rate_idx is MCS index, which can be [0-76]
2899                          * as documented on:
2900                          *
2901                          * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2902                          *
2903                          * Anything else would be some sort of driver or
2904                          * hardware error. The driver should catch hardware
2905                          * errors.
2906                          */
2907                         if (WARN((status->rate_idx < 0 ||
2908                                  status->rate_idx > 76),
2909                                  "Rate marked as an HT rate but passed "
2910                                  "status->rate_idx is not "
2911                                  "an MCS index [0-76]: %d (0x%02x)\n",
2912                                  status->rate_idx,
2913                                  status->rate_idx))
2914                                 goto drop;
2915                 } else {
2916                         if (WARN_ON(status->rate_idx < 0 ||
2917                                     status->rate_idx >= sband->n_bitrates))
2918                                 goto drop;
2919                         rate = &sband->bitrates[status->rate_idx];
2920                 }
2921         }
2922
2923         status->rx_flags = 0;
2924
2925         /*
2926          * key references and virtual interfaces are protected using RCU
2927          * and this requires that we are in a read-side RCU section during
2928          * receive processing
2929          */
2930         rcu_read_lock();
2931
2932         /*
2933          * Frames with failed FCS/PLCP checksum are not returned,
2934          * all other frames are returned without radiotap header
2935          * if it was previously present.
2936          * Also, frames with less than 16 bytes are dropped.
2937          */
2938         skb = ieee80211_rx_monitor(local, skb, rate);
2939         if (!skb) {
2940                 rcu_read_unlock();
2941                 return;
2942         }
2943
2944         ieee80211_tpt_led_trig_rx(local,
2945                         ((struct ieee80211_hdr *)skb->data)->frame_control,
2946                         skb->len);
2947         __ieee80211_rx_handle_packet(hw, skb);
2948
2949         rcu_read_unlock();
2950
2951         return;
2952  drop:
2953         kfree_skb(skb);
2954 }
2955 EXPORT_SYMBOL(ieee80211_rx);
2956
2957 /* This is a version of the rx handler that can be called from hard irq
2958  * context. Post the skb on the queue and schedule the tasklet */
2959 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
2960 {
2961         struct ieee80211_local *local = hw_to_local(hw);
2962
2963         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2964
2965         skb->pkt_type = IEEE80211_RX_MSG;
2966         skb_queue_tail(&local->skb_queue, skb);
2967         tasklet_schedule(&local->tasklet);
2968 }
2969 EXPORT_SYMBOL(ieee80211_rx_irqsafe);