ath9k: Proper padding/unpadding for the TX/RX path.

Software padding is done on the TX path and software unpadding is done on the
RX path. This patch corrects the position where the padding occurs. A specific
function computes the pad position and this function is used in the TX and RX
path. This patch has been tested by generating every possible 802.11 frames
with every possible frame_control field and a varying length. This patch is
useful for analyzing non standard 802.11 frames going over the air

Signed-off-by: Benoit Papillault <benoit.papillault@free.fr>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

4 files changed, 31 insertions, 18 deletions

diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index d96751ccee96..4d775ae141db 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -236,16 +236,8 @@ void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
         /* see if any padding is done by the hw and remove it */
         hdr = (struct ieee80211_hdr *) skb->data;
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        padpos = 24;
         fc = hdr->frame_control;
-        if ((fc & cpu_to_le16(IEEE80211_FCTL_FROMDS|IEEE80211_FCTL_TODS)) ==
-            cpu_to_le16(IEEE80211_FCTL_FROMDS|IEEE80211_FCTL_TODS)) {
-          padpos += 6; /* ETH_ALEN */
-        }
-        if ((fc & cpu_to_le16(IEEE80211_STYPE_QOS_DATA|IEEE80211_FCTL_FTYPE)) ==
-            cpu_to_le16(IEEE80211_STYPE_QOS_DATA|IEEE80211_FTYPE_DATA)) {
-          padpos += 2;
-        }
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
 
         /* The MAC header is padded to have 32-bit boundary if the
          * packet payload is non-zero. The general calculation for
@@ -280,6 +272,20 @@ void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
 }
 EXPORT_SYMBOL(ath9k_cmn_rx_skb_postprocess);
 
+int ath9k_cmn_padpos(__le16 frame_control)
+{
+        int padpos = 24;
+        if (ieee80211_has_a4(frame_control)) {
+                padpos += ETH_ALEN;
+        }
+        if (ieee80211_is_data_qos(frame_control)) {
+                padpos += IEEE80211_QOS_CTL_LEN;
+        }
+
+        return padpos;
+}
+EXPORT_SYMBOL(ath9k_cmn_padpos);
+
 static int __init ath9k_cmn_init(void)
 {
         return 0;
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index b230bb15279e..042999c2fe9c 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -123,3 +123,5 @@ void ath9k_cmn_rx_skb_postprocess(struct ath_common *common,
                                   struct ath_rx_status *rx_stats,
                                   struct ieee80211_rx_status *rxs,
                                   bool decrypt_error);
+
+int ath9k_cmn_padpos(__le16 frame_control);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 55c669648bd6..cfe710b01d85 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2364,7 +2364,8 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         struct ath_softc *sc = aphy->sc;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_tx_control txctl;
-        int hdrlen, padsize;
+        int padpos, padsize;
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 
         if (aphy->state != ATH_WIPHY_ACTIVE && aphy->state != ATH_WIPHY_SCAN) {
                 ath_print(common, ATH_DBG_XMIT,
@@ -2374,7 +2375,6 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         }
 
         if (sc->ps_enabled) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 /*
                  * mac80211 does not set PM field for normal data frames, so we
                  * need to update that based on the current PS mode.
@@ -2394,7 +2394,6 @@ static int ath9k_tx(struct ieee80211_hw *hw,
                  * power save mode. Need to wake up hardware for the TX to be
                  * completed and if needed, also for RX of buffered frames.
                  */
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 ath9k_ps_wakeup(sc);
                 ath9k_hw_setrxabort(sc->sc_ah, 0);
                 if (ieee80211_is_pspoll(hdr->frame_control)) {
@@ -2422,7 +2421,6 @@ static int ath9k_tx(struct ieee80211_hw *hw,
          * BSSes.
          */
         if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
-                struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
                 if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
                         sc->tx.seq_no += 0x10;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
@@ -2430,13 +2428,13 @@ static int ath9k_tx(struct ieee80211_hw *hw,
         }
 
         /* Add the padding after the header if this is not already done */
-        hdrlen = ieee80211_get_hdrlen_from_skb(skb);
-        if (hdrlen & 3) {
-                padsize = hdrlen % 4;
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos) {
                 if (skb_headroom(skb) < padsize)
                         return -1;
                 skb_push(skb, padsize);
-                memmove(skb->data, skb->data + padsize, hdrlen);
+                memmove(skb->data, skb->data + padsize, padpos);
         }
 
         /* Check if a tx queue is available */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 6f91a8ae616f..564c6cb1c2b4 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1596,6 +1596,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         int hdrlen;
         __le16 fc;
+        int padpos, padsize;
 
         tx_info->pad[0] = 0;
         switch (txctl->frame_type) {
@@ -1614,7 +1615,13 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
         ATH_TXBUF_RESET(bf);
 
         bf->aphy = aphy;
-        bf->bf_frmlen = skb->len + FCS_LEN - (hdrlen & 3);
+        bf->bf_frmlen = skb->len + FCS_LEN;
+        /* Remove the padding size from bf_frmlen, if any */
+        padpos = ath9k_cmn_padpos(hdr->frame_control);
+        padsize = padpos & 3;
+        if (padsize && skb->len>padpos+padsize) {
+                bf->bf_frmlen -= padsize;
+        }
 
         if (conf_is_ht(&hw->conf) && !is_pae(skb))
                 bf->bf_state.bf_type |= BUF_HT;