rx.c 59 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

12
#include <linux/jiffies.h>
13 14 15 16
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
17
#include <linux/rcupdate.h>
18 19 20 21
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>

#include "ieee80211_i.h"
Johannes Berg's avatar
Johannes Berg committed
22
#include "led.h"
23
#include "mesh.h"
24 25 26 27 28
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"

29 30 31 32
u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
				struct tid_ampdu_rx *tid_agg_rx,
				struct sk_buff *skb, u16 mpdu_seq_num,
				int bar_req);
33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
					   struct sk_buff *skb,
					   int rtap_len)
{
	skb_pull(skb, rtap_len);

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
			skb_trim(skb, skb->len - FCS_LEN);
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
			skb = NULL;
		}
	}

	return skb;
}

static inline int should_drop_frame(struct ieee80211_rx_status *status,
				    struct sk_buff *skb,
				    int present_fcs_len,
				    int radiotap_len)
{
64
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
65 66 67 68 69

	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		return 1;
	if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
		return 1;
70 71 72
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
73 74 75 76
		return 1;
	return 0;
}

77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204
static int
ieee80211_rx_radiotap_len(struct ieee80211_local *local,
			  struct ieee80211_rx_status *status)
{
	int len;

	/* always present fields */
	len = sizeof(struct ieee80211_radiotap_header) + 9;

	if (status->flag & RX_FLAG_TSFT)
		len += 8;
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
	    local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
		len += 1;
	if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
		len += 1;

	if (len & 1) /* padding for RX_FLAGS if necessary */
		len++;

	/* make sure radiotap starts at a naturally aligned address */
	if (len % 8)
		len = roundup(len, 8);

	return len;
}

/**
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rx_status *status,
				 struct ieee80211_rate *rate,
				 int rtap_len)
{
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
	memset(rthdr, 0, rtap_len);

	/* radiotap header, set always present flags */
	rthdr->it_present =
		cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
			    (1 << IEEE80211_RADIOTAP_RATE) |
			    (1 << IEEE80211_RADIOTAP_CHANNEL) |
			    (1 << IEEE80211_RADIOTAP_ANTENNA) |
			    (1 << IEEE80211_RADIOTAP_RX_FLAGS));
	rthdr->it_len = cpu_to_le16(rtap_len);

	pos = (unsigned char *)(rthdr+1);

	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
	if (status->flag & RX_FLAG_TSFT) {
		*(__le64 *)pos = cpu_to_le64(status->mactime);
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		*pos |= IEEE80211_RADIOTAP_F_FCS;
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
	*pos = rate->bitrate / 5;
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
	*(__le16 *)pos = cpu_to_le16(status->freq);
	pos += 2;
	if (status->band == IEEE80211_BAND_5GHZ)
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
					     IEEE80211_CHAN_5GHZ);
	else
		*(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_DYN |
					     IEEE80211_CHAN_2GHZ);
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_DBM_ANTNOISE */
	if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
		*pos = status->noise;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

	/* IEEE80211_RADIOTAP_ANTENNA */
	*pos = status->antenna;
	pos++;

	/* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
	if ((pos - (unsigned char *)rthdr) & 1)
		pos++;
	/* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
	pos += 2;
}

205 206 207 208 209 210 211
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
212 213
		     struct ieee80211_rx_status *status,
		     struct ieee80211_rate *rate)
214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232
{
	struct ieee80211_sub_if_data *sdata;
	int needed_headroom = 0;
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;
	int rtap_len = 0;

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
	if (status->flag & RX_FLAG_RADIOTAP)
		rtap_len = ieee80211_get_radiotap_len(origskb->data);
	else
233 234
		/* room for the radiotap header based on driver features */
		needed_headroom = ieee80211_rx_radiotap_len(local, status);
235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261

	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

	if (!local->monitors) {
		if (should_drop_frame(status, origskb, present_fcs_len,
				      rtap_len)) {
			dev_kfree_skb(origskb);
			return NULL;
		}

		return remove_monitor_info(local, origskb, rtap_len);
	}

	if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
262
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

		origskb = remove_monitor_info(local, origskb, rtap_len);

		if (!skb)
			return origskb;
	}

	/* if necessary, prepend radiotap information */
280 281 282
	if (!(status->flag & RX_FLAG_RADIOTAP))
		ieee80211_add_rx_radiotap_header(local, skb, status, rate,
						 needed_headroom);
283

284
	skb_reset_mac_header(skb);
285 286 287 288 289 290 291 292
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!netif_running(sdata->dev))
			continue;

293
		if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
294 295
			continue;

296 297 298
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
				netif_rx(skb2);
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
		netif_rx(skb);
	} else
		dev_kfree_skb(skb);

	return origskb;
}


322
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
323
{
324
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
325 326 327
	int tid;

	/* does the frame have a qos control field? */
328 329
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
330
		/* frame has qos control */
331 332
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
		if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
333
			rx->flags |= IEEE80211_RX_AMSDU;
334
		else
335
			rx->flags &= ~IEEE80211_RX_AMSDU;
336
	} else {
337
		if (unlikely(ieee80211_is_mgmt(hdr->frame_control))) {
338 339 340 341 342 343 344
			/* Separate TID for management frames */
			tid = NUM_RX_DATA_QUEUES - 1;
		} else {
			/* no qos control present */
			tid = 0; /* 802.1d - Best Effort */
		}
	}
345

346
	rx->queue = tid;
347 348 349
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
350
}
351

352
static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379
{
#ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
	int hdrlen;

	if (!WLAN_FC_DATA_PRESENT(rx->fc))
		return;

	/*
	 * Drivers are required to align the payload data in a way that
	 * guarantees that the contained IP header is aligned to a four-
	 * byte boundary. In the case of regular frames, this simply means
	 * aligning the payload to a four-byte boundary (because either
	 * the IP header is directly contained, or IV/RFC1042 headers that
	 * have a length divisible by four are in front of it.
	 *
	 * With A-MSDU frames, however, the payload data address must
	 * yield two modulo four because there are 14-byte 802.3 headers
	 * within the A-MSDU frames that push the IP header further back
	 * to a multiple of four again. Thankfully, the specs were sane
	 * enough this time around to require padding each A-MSDU subframe
	 * to a length that is a multiple of four.
	 *
	 * Padding like atheros hardware adds which is inbetween the 802.11
	 * header and the payload is not supported, the driver is required
	 * to move the 802.11 header further back in that case.
	 */
	hdrlen = ieee80211_get_hdrlen(rx->fc);
380
	if (rx->flags & IEEE80211_RX_AMSDU)
381 382 383
		hdrlen += ETH_HLEN;
	WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
#endif
384 385
}

386

387 388
/* rx handlers */

389
static ieee80211_rx_result debug_noinline
390
ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
391 392 393 394
{
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb;

Zhu Yi's avatar
Zhu Yi committed
395
	if (unlikely(local->sta_hw_scanning))
396
		return ieee80211_sta_rx_scan(rx->dev, skb, rx->status);
Zhu Yi's avatar
Zhu Yi committed
397 398 399

	if (unlikely(local->sta_sw_scanning)) {
		/* drop all the other packets during a software scan anyway */
400
		if (ieee80211_sta_rx_scan(rx->dev, skb, rx->status)
401
		    != RX_QUEUED)
Zhu Yi's avatar
Zhu Yi committed
402
			dev_kfree_skb(skb);
403
		return RX_QUEUED;
404 405
	}

406
	if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
407 408
		/* scanning finished during invoking of handlers */
		I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
Johannes Berg's avatar
Johannes Berg committed
409
		return RX_DROP_UNUSABLE;
410 411
	}

412
	return RX_CONTINUE;
413 414
}

415
static ieee80211_rx_result
416
ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
417 418 419
{
	int hdrlen = ieee80211_get_hdrlen(rx->fc);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
420 421 422

#define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))

423 424 425 426 427 428 429 430 431 432 433 434
	if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
		if (!((rx->fc & IEEE80211_FCTL_FROMDS) &&
		      (rx->fc & IEEE80211_FCTL_TODS)))
			return RX_DROP_MONITOR;
		if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
			return RX_DROP_MONITOR;
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

435
	if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
436
		struct ieee80211_mgmt *mgmt;
437

438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456
		if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
			return RX_DROP_MONITOR;

		switch (rx->fc & IEEE80211_FCTL_STYPE) {
		case IEEE80211_STYPE_ACTION:
			mgmt = (struct ieee80211_mgmt *)hdr;
			if (mgmt->u.action.category != PLINK_CATEGORY)
				return RX_DROP_MONITOR;
			/* fall through on else */
		case IEEE80211_STYPE_PROBE_REQ:
		case IEEE80211_STYPE_PROBE_RESP:
		case IEEE80211_STYPE_BEACON:
			return RX_CONTINUE;
			break;
		default:
			return RX_DROP_MONITOR;
		}

	 } else if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
457
		    is_multicast_ether_addr(hdr->addr1) &&
458 459
		    mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
		return RX_DROP_MONITOR;
Johannes Berg's avatar
Johannes Berg committed
460
#undef msh_h_get
461

Johannes Berg's avatar
Johannes Berg committed
462 463
	return RX_CONTINUE;
}
464 465


466
static ieee80211_rx_result debug_noinline
467
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
468 469
{
	struct ieee80211_hdr *hdr;
470

471 472 473 474 475
	hdr = (struct ieee80211_hdr *) rx->skb->data;

	/* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
	if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
		if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
476
			     rx->sta->last_seq_ctrl[rx->queue] ==
477
			     hdr->seq_ctrl)) {
478
			if (rx->flags & IEEE80211_RX_RA_MATCH) {
479 480 481
				rx->local->dot11FrameDuplicateCount++;
				rx->sta->num_duplicates++;
			}
Johannes Berg's avatar
Johannes Berg committed
482
			return RX_DROP_MONITOR;
483
		} else
484
			rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
485 486 487 488
	}

	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
Johannes Berg's avatar
Johannes Berg committed
489
		return RX_DROP_MONITOR;
490 491 492 493 494 495 496 497 498 499
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
	 * 80211.o does filtering only based on association state, i.e., it
	 * drops Class 3 frames from not associated stations. hostapd sends
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
500

Johannes Berg's avatar
Johannes Berg committed
501
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
502 503
		return ieee80211_rx_mesh_check(rx);

504 505 506
	if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
		      ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
		       (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
507
		     rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
508
		     (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
509 510 511
		if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
		     !(rx->fc & IEEE80211_FCTL_TODS) &&
		     (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
512
		    || !(rx->flags & IEEE80211_RX_RA_MATCH)) {
513 514
			/* Drop IBSS frames and frames for other hosts
			 * silently. */
Johannes Berg's avatar
Johannes Berg committed
515
			return RX_DROP_MONITOR;
516 517
		}

Johannes Berg's avatar
Johannes Berg committed
518
		return RX_DROP_MONITOR;
519 520
	}

521
	return RX_CONTINUE;
522 523 524
}


525
static ieee80211_rx_result debug_noinline
526
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
527 528
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
529 530
	int keyidx;
	int hdrlen;
Johannes Berg's avatar
Johannes Berg committed
531
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
532
	struct ieee80211_key *stakey = NULL;
533

534 535 536 537 538 539 540 541 542 543 544 545 546 547 548
	/*
	 * Key selection 101
	 *
	 * There are three types of keys:
	 *  - GTK (group keys)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs. Unless, of
	 * course, actual WEP keys ("pre-RSNA") are used, then unicast
	 * frames can also use key indizes like GTKs. Hence, if we don't
	 * have a PTK/STK we check the key index for a WEP key.
	 *
549 550 551 552
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
553 554
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
555 556 557
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
558 559 560
	 */

	if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
561
		return RX_CONTINUE;
562

563
	/*
564
	 * No point in finding a key and decrypting if the frame is neither
565 566
	 * addressed to us nor a multicast frame.
	 */
567
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
568
		return RX_CONTINUE;
569

570 571 572 573 574
	if (rx->sta)
		stakey = rcu_dereference(rx->sta->key);

	if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
		rx->key = stakey;
575
	} else {
576 577 578 579 580 581 582 583 584
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
585 586
		if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
		    (rx->status->flag & RX_FLAG_IV_STRIPPED))
587
			return RX_CONTINUE;
588 589 590 591

		hdrlen = ieee80211_get_hdrlen(rx->fc);

		if (rx->skb->len < 8 + hdrlen)
Johannes Berg's avatar
Johannes Berg committed
592
			return RX_DROP_UNUSABLE; /* TODO: count this? */
593 594 595 596 597 598 599

		/*
		 * no need to call ieee80211_wep_get_keyidx,
		 * it verifies a bunch of things we've done already
		 */
		keyidx = rx->skb->data[hdrlen + 3] >> 6;

600
		rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
601 602 603 604 605 606

		/*
		 * RSNA-protected unicast frames should always be sent with
		 * pairwise or station-to-station keys, but for WEP we allow
		 * using a key index as well.
		 */
607
		if (rx->key && rx->key->conf.alg != ALG_WEP &&
608 609
		    !is_multicast_ether_addr(hdr->addr1))
			rx->key = NULL;
610 611
	}

612
	if (rx->key) {
613
		rx->key->tx_rx_count++;
614
		/* TODO: add threshold stuff again */
615
	} else {
Johannes Berg's avatar
Johannes Berg committed
616
		return RX_DROP_MONITOR;
617 618
	}

619 620 621
	/* Check for weak IVs if possible */
	if (rx->sta && rx->key->conf.alg == ALG_WEP &&
	    ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
622 623
	    (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
	     !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
624 625 626
	    ieee80211_wep_is_weak_iv(rx->skb, rx->key))
		rx->sta->wep_weak_iv_count++;

627 628
	switch (rx->key->conf.alg) {
	case ALG_WEP:
629 630
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
631
	case ALG_TKIP:
632 633
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
634
	case ALG_CCMP:
635 636
		result = ieee80211_crypto_ccmp_decrypt(rx);
		break;
637 638
	}

639
	/* either the frame has been decrypted or will be dropped */
640
	rx->status->flag |= RX_FLAG_DECRYPTED;
641 642

	return result;
643 644
}

645 646 647
static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
{
	struct ieee80211_sub_if_data *sdata;
648 649
	DECLARE_MAC_BUF(mac);

650
	sdata = sta->sdata;
651 652 653

	if (sdata->bss)
		atomic_inc(&sdata->bss->num_sta_ps);
654
	set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
655
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
656 657
	printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
	       dev->name, print_mac(mac, sta->addr), sta->aid);
658 659 660 661 662 663 664 665 666
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
}

static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct sk_buff *skb;
	int sent = 0;
	struct ieee80211_sub_if_data *sdata;
667
	struct ieee80211_tx_info *info;
668
	DECLARE_MAC_BUF(mac);
669

670
	sdata = sta->sdata;
671

672 673
	if (sdata->bss)
		atomic_dec(&sdata->bss->num_sta_ps);
674

675
	clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
676 677 678 679

	if (!skb_queue_empty(&sta->ps_tx_buf))
		sta_info_clear_tim_bit(sta);

680
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
681 682
	printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
	       dev->name, print_mac(mac, sta->addr), sta->aid);
683
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
684

685 686
	/* Send all buffered frames to the station */
	while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
687
		info = IEEE80211_SKB_CB(skb);
688
		sent++;
689
		info->flags |= IEEE80211_TX_CTL_REQUEUE;
690 691 692
		dev_queue_xmit(skb);
	}
	while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
693
		info = IEEE80211_SKB_CB(skb);
694 695 696
		local->total_ps_buffered--;
		sent++;
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
697
		printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
698
		       "since STA not sleeping anymore\n", dev->name,
699
		       print_mac(mac, sta->addr), sta->aid);
700
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
701
		info->flags |= IEEE80211_TX_CTL_REQUEUE;
702 703 704 705 706 707
		dev_queue_xmit(skb);
	}

	return sent;
}

708
static ieee80211_rx_result debug_noinline
709
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
710 711 712 713 714 715
{
	struct sta_info *sta = rx->sta;
	struct net_device *dev = rx->dev;
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;

	if (!sta)
716
		return RX_CONTINUE;
717 718 719 720

	/* Update last_rx only for IBSS packets which are for the current
	 * BSSID to avoid keeping the current IBSS network alive in cases where
	 * other STAs are using different BSSID. */
721
	if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
722 723
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
						IEEE80211_IF_TYPE_IBSS);
724 725 726 727
		if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
			sta->last_rx = jiffies;
	} else
	if (!is_multicast_ether_addr(hdr->addr1) ||
728
	    rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
729 730 731
		/* Update last_rx only for unicast frames in order to prevent
		 * the Probe Request frames (the only broadcast frames from a
		 * STA in infrastructure mode) from keeping a connection alive.
732 733
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
734 735 736 737
		 */
		sta->last_rx = jiffies;
	}

738
	if (!(rx->flags & IEEE80211_RX_RA_MATCH))
739
		return RX_CONTINUE;
740 741 742

	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
743
	sta->last_signal = rx->status->signal;
744
	sta->last_qual = rx->status->qual;
745
	sta->last_noise = rx->status->noise;
746 747 748 749

	if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
		/* Change STA power saving mode only in the end of a frame
		 * exchange sequence */
750 751
		if (test_sta_flags(sta, WLAN_STA_PS) &&
		    !(rx->fc & IEEE80211_FCTL_PM))
752
			rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
753
		else if (!test_sta_flags(sta, WLAN_STA_PS) &&
754 755 756 757 758 759 760 761 762 763 764 765 766
			 (rx->fc & IEEE80211_FCTL_PM))
			ap_sta_ps_start(dev, sta);
	}

	/* Drop data::nullfunc frames silently, since they are used only to
	 * control station power saving mode. */
	if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
	    (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
		/* Update counter and free packet here to avoid counting this
		 * as a dropped packed. */
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
767
		return RX_QUEUED;
768 769
	}

770
	return RX_CONTINUE;
771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786
} /* ieee80211_rx_h_sta_process */

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;
	int idx;

	idx = sdata->fragment_next;
	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

	if (!skb_queue_empty(&entry->skb_list)) {
787
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
788 789
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) entry->skb_list.next->data;
790 791
		DECLARE_MAC_BUF(mac);
		DECLARE_MAC_BUF(mac2);
792 793
		printk(KERN_DEBUG "%s: RX reassembly removed oldest "
		       "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
794
		       "addr1=%s addr2=%s\n",
795 796
		       sdata->dev->name, idx,
		       jiffies - entry->first_frag_time, entry->seq,
797 798
		       entry->last_frag, print_mac(mac, hdr->addr1),
		       print_mac(mac2, hdr->addr2));
799
#endif
800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845
		__skb_queue_purge(&entry->skb_list);
	}

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
			  u16 fc, unsigned int frag, unsigned int seq,
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;
		u16 f_fc;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

		f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
		f_fc = le16_to_cpu(f_hdr->frame_control);

		if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
		    compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
		    compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
			continue;

846
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
847 848 849 850 851 852 853 854 855
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

856
static ieee80211_rx_result debug_noinline
857
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
858 859 860 861 862 863
{
	struct ieee80211_hdr *hdr;
	u16 sc;
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
864
	DECLARE_MAC_BUF(mac);
865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882

	hdr = (struct ieee80211_hdr *) rx->skb->data;
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

	if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
		   (rx->skb)->len < 24 ||
		   is_multicast_ether_addr(hdr->addr1))) {
		/* not fragmented */
		goto out;
	}
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
883
						 rx->queue, &(rx->skb));
884
		if (rx->key && rx->key->conf.alg == ALG_CCMP &&
885 886 887 888 889
		    (rx->fc & IEEE80211_FCTL_PROTECTED)) {
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
890
			       rx->key->u.ccmp.rx_pn[rx->queue],
891 892
			       CCMP_PN_LEN);
		}
893
		return RX_QUEUED;
894 895 896 897 898 899
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
	entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
900
					  rx->queue, hdr);
901 902
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berg's avatar
Johannes Berg committed
903
		return RX_DROP_MONITOR;
904 905 906 907 908 909 910
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
		u8 pn[CCMP_PN_LEN], *rpn;
911
		if (!rx->key || rx->key->conf.alg != ALG_CCMP)
Johannes Berg's avatar
Johannes Berg committed
912
			return RX_DROP_UNUSABLE;
913 914 915 916 917 918
		memcpy(pn, entry->last_pn, CCMP_PN_LEN);
		for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
			pn[i]++;
			if (pn[i])
				break;
		}
919
		rpn = rx->key->u.ccmp.rx_pn[rx->queue];
920
		if (memcmp(pn, rpn, CCMP_PN_LEN))
Johannes Berg's avatar
Johannes Berg committed
921
			return RX_DROP_UNUSABLE;
922 923 924 925 926 927 928 929 930
		memcpy(entry->last_pn, pn, CCMP_PN_LEN);
	}

	skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
	if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
		rx->skb = NULL;
931
		return RX_QUEUED;
932 933 934 935 936 937 938 939 940
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
Johannes Berg's avatar
Johannes Berg committed
941
			return RX_DROP_UNUSABLE;
942 943 944 945 946 947 948 949
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
950
	rx->flags |= IEEE80211_RX_FRAGMENTED;
951 952 953 954 955 956 957 958

 out:
	if (rx->sta)
		rx->sta->rx_packets++;
	if (is_multicast_ether_addr(hdr->addr1))
		rx->local->dot11MulticastReceivedFrameCount++;
	else
		ieee80211_led_rx(rx->local);
959
	return RX_CONTINUE;
960 961
}

962
static ieee80211_rx_result debug_noinline
963
ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
964
{
965
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
966 967
	struct sk_buff *skb;
	int no_pending_pkts;
968
	DECLARE_MAC_BUF(mac);
969 970 971 972

	if (likely(!rx->sta ||
		   (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
		   (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
973
		   !(rx->flags & IEEE80211_RX_RA_MATCH)))
974
		return RX_CONTINUE;
975

976 977
	if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
	    (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
Johannes Berg's avatar
Johannes Berg committed
978
		return RX_DROP_UNUSABLE;
979

980 981 982 983 984 985 986 987 988 989 990 991 992
	skb = skb_dequeue(&rx->sta->tx_filtered);
	if (!skb) {
		skb = skb_dequeue(&rx->sta->ps_tx_buf);
		if (skb)
			rx->local->total_ps_buffered--;
	}
	no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
		skb_queue_empty(&rx->sta->ps_tx_buf);

	if (skb) {
		struct ieee80211_hdr *hdr =
			(struct ieee80211_hdr *) skb->data;

993 994 995 996
		/*
		 * Tell TX path to send one frame even though the STA may
		 * still remain is PS mode after this frame exchange.
		 */
997
		set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
998 999

#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1000 1001
		printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
		       print_mac(mac, rx->sta->addr), rx->sta->aid,
1002 1003 1004 1005 1006
		       skb_queue_len(&rx->sta->ps_tx_buf));
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */

		/* Use MoreData flag to indicate whether there are more
		 * buffered frames for this STA */
1007
		if (no_pending_pkts)
1008
			hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1009
		else
1010 1011 1012 1013
			hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);

		dev_queue_xmit(skb);

1014 1015
		if (no_pending_pkts)
			sta_info_clear_tim_bit(rx->sta);
1016
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1017
	} else if (!rx->sent_ps_buffered) {
1018 1019 1020 1021 1022 1023
		/*
		 * FIXME: This can be the result of a race condition between
		 *	  us expiring a frame and the station polling for it.
		 *	  Should we send it a null-func frame indicating we
		 *	  have nothing buffered for it?
		 */
1024
		printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
1025
		       "though there are no buffered frames for it\n",
1026
		       rx->dev->name, print_mac(mac, rx->sta->addr));
1027 1028 1029
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
	}

1030
	/* Free PS Poll skb here instead of returning RX_DROP that would
1031 1032 1033
	 * count as an dropped frame. */
	dev_kfree_skb(rx->skb);

1034
	return RX_QUEUED;
1035 1036
}

1037
static ieee80211_rx_result debug_noinline
1038
ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1039 1040
{
	u8 *data = rx->skb->data;
1041
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1042

1043
	if (!ieee80211_is_data_qos(hdr->frame_control))
1044
		return RX_CONTINUE;
1045 1046

	/* remove the qos control field, update frame type and meta-data */
1047 1048 1049
	memmove(data + IEEE80211_QOS_CTL_LEN, data,
		ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
	hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1050
	/* change frame type to non QOS */
1051 1052
	rx->fc &= ~IEEE80211_STYPE_QOS_DATA;
	hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1053

1054
	return RX_CONTINUE;
1055 1056
}

1057
static int
1058
ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1059
{
1060
	if (unlikely(!rx->sta ||
1061
	    !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1062
		return -EACCES;
1063

1064
	return 0;
1065 1066
}

1067
static int
1068
ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx)
1069
{
1070
	/*
1071 1072
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
1073
	 */
1074
	if (rx->status->flag & RX_FLAG_DECRYPTED)
1075
		return 0;
1076 1077 1078 1079 1080

	/* Drop unencrypted frames if key is set. */
	if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
		     (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
		     (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1081
		     (rx->key || rx->sdata->drop_unencrypted)))
1082
		return -EACCES;
1083

1084
	return 0;
1085 1086
}

1087
static int
1088
ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1089 1090 1091 1092 1093 1094
{
	struct net_device *dev = rx->dev;
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
	u16 fc, hdrlen, ethertype;
	u8 *payload;
	u8 dst[ETH_ALEN];
1095
	u8 src[ETH_ALEN] __aligned(2);
1096
	struct sk_buff *skb = rx->skb;
1097
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1098 1099 1100 1101
	DECLARE_MAC_BUF(mac);
	DECLARE_MAC_BUF(mac2);
	DECLARE_MAC_BUF(mac3);
	DECLARE_MAC_BUF(mac4);
1102 1103 1104 1105

	fc = rx->fc;

	if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1106
		return -1;
1107 1108 1109

	hdrlen = ieee80211_get_hdrlen(fc);

Johannes Berg's avatar
Johannes Berg committed
1110
	if (ieee80211_vif_is_mesh(&sdata->vif)) {
1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124
		int meshhdrlen = ieee80211_get_mesh_hdrlen(
				(struct ieee80211s_hdr *) (skb->data + hdrlen));
		/* Copy on cb:
		 *  - mesh header: to be used for mesh forwarding
		 * decision. It will also be used as mesh header template at
		 * tx.c:ieee80211_subif_start_xmit() if interface
		 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
		 *  - ta: to be used if a RERR needs to be sent.
		 */
		memcpy(skb->cb, skb->data + hdrlen, meshhdrlen);
		memcpy(MESH_PREQ(skb), hdr->addr2, ETH_ALEN);
		hdrlen += meshhdrlen;
	}

1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140
	/* convert IEEE 802.11 header + possible LLC headers into Ethernet
	 * header
	 * IEEE 802.11 address fields:
	 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
	 *   0     0   DA    SA    BSSID n/a
	 *   0     1   DA    BSSID SA    n/a
	 *   1     0   BSSID SA    DA    n/a
	 *   1     1   RA    TA    DA    SA
	 */

	switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
	case IEEE80211_FCTL_TODS:
		/* BSSID SA DA */
		memcpy(dst, hdr->addr3, ETH_ALEN);
		memcpy(src, hdr->addr2, ETH_ALEN);

1141
		if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
1142
			     sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
1143
			return -1;
1144 1145 1146 1147