aboutsummaryrefslogtreecommitdiffstats
path: root/net/mac80211/rx.c
diff options
context:
space:
mode:
Diffstat (limited to 'net/mac80211/rx.c')
-rw-r--r--net/mac80211/rx.c757
1 files changed, 471 insertions, 286 deletions
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 28624282c5f3..0b0e83ebe3d5 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -315,6 +315,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
315static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 315static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
316{ 316{
317 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 317 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
318 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
318 int tid; 319 int tid;
319 320
320 /* does the frame have a qos control field? */ 321 /* does the frame have a qos control field? */
@@ -323,9 +324,7 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
323 /* frame has qos control */ 324 /* frame has qos control */
324 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 325 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
325 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT) 326 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
326 rx->flags |= IEEE80211_RX_AMSDU; 327 status->rx_flags |= IEEE80211_RX_AMSDU;
327 else
328 rx->flags &= ~IEEE80211_RX_AMSDU;
329 } else { 328 } else {
330 /* 329 /*
331 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 330 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
@@ -387,26 +386,25 @@ static ieee80211_rx_result debug_noinline
387ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx) 386ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
388{ 387{
389 struct ieee80211_local *local = rx->local; 388 struct ieee80211_local *local = rx->local;
389 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
390 struct sk_buff *skb = rx->skb; 390 struct sk_buff *skb = rx->skb;
391 391
392 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning))) 392 if (likely(!(status->rx_flags & IEEE80211_RX_IN_SCAN)))
393 return RX_CONTINUE;
394
395 if (test_bit(SCAN_HW_SCANNING, &local->scanning))
393 return ieee80211_scan_rx(rx->sdata, skb); 396 return ieee80211_scan_rx(rx->sdata, skb);
394 397
395 if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning) && 398 if (test_bit(SCAN_SW_SCANNING, &local->scanning)) {
396 (rx->flags & IEEE80211_RX_IN_SCAN))) {
397 /* drop all the other packets during a software scan anyway */ 399 /* drop all the other packets during a software scan anyway */
398 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED) 400 if (ieee80211_scan_rx(rx->sdata, skb) != RX_QUEUED)
399 dev_kfree_skb(skb); 401 dev_kfree_skb(skb);
400 return RX_QUEUED; 402 return RX_QUEUED;
401 } 403 }
402 404
403 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) { 405 /* scanning finished during invoking of handlers */
404 /* scanning finished during invoking of handlers */ 406 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
405 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan); 407 return RX_DROP_UNUSABLE;
406 return RX_DROP_UNUSABLE;
407 }
408
409 return RX_CONTINUE;
410} 408}
411 409
412 410
@@ -538,20 +536,12 @@ static void ieee80211_release_reorder_frame(struct ieee80211_hw *hw,
538 int index, 536 int index,
539 struct sk_buff_head *frames) 537 struct sk_buff_head *frames)
540{ 538{
541 struct ieee80211_supported_band *sband;
542 struct ieee80211_rate *rate = NULL;
543 struct sk_buff *skb = tid_agg_rx->reorder_buf[index]; 539 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
544 struct ieee80211_rx_status *status;
545 540
546 if (!skb) 541 if (!skb)
547 goto no_frame; 542 goto no_frame;
548 543
549 status = IEEE80211_SKB_RXCB(skb); 544 /* release the frame from the reorder ring buffer */
550
551 /* release the reordered frames to stack */
552 sband = hw->wiphy->bands[status->band];
553 if (!(status->flag & RX_FLAG_HT))
554 rate = &sband->bitrates[status->rate_idx];
555 tid_agg_rx->stored_mpdu_num--; 545 tid_agg_rx->stored_mpdu_num--;
556 tid_agg_rx->reorder_buf[index] = NULL; 546 tid_agg_rx->reorder_buf[index] = NULL;
557 __skb_queue_tail(frames, skb); 547 __skb_queue_tail(frames, skb);
@@ -580,9 +570,78 @@ static void ieee80211_release_reorder_frames(struct ieee80211_hw *hw,
580 * frames that have not yet been received are assumed to be lost and the skb 570 * frames that have not yet been received are assumed to be lost and the skb
581 * can be released for processing. This may also release other skb's from the 571 * can be released for processing. This may also release other skb's from the
582 * reorder buffer if there are no additional gaps between the frames. 572 * reorder buffer if there are no additional gaps between the frames.
573 *
574 * Callers must hold tid_agg_rx->reorder_lock.
583 */ 575 */
584#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 576#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
585 577
578static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
579 struct tid_ampdu_rx *tid_agg_rx,
580 struct sk_buff_head *frames)
581{
582 int index, j;
583
584 /* release the buffer until next missing frame */
585 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
586 tid_agg_rx->buf_size;
587 if (!tid_agg_rx->reorder_buf[index] &&
588 tid_agg_rx->stored_mpdu_num > 1) {
589 /*
590 * No buffers ready to be released, but check whether any
591 * frames in the reorder buffer have timed out.
592 */
593 int skipped = 1;
594 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
595 j = (j + 1) % tid_agg_rx->buf_size) {
596 if (!tid_agg_rx->reorder_buf[j]) {
597 skipped++;
598 continue;
599 }
600 if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
601 HT_RX_REORDER_BUF_TIMEOUT))
602 goto set_release_timer;
603
604#ifdef CONFIG_MAC80211_HT_DEBUG
605 if (net_ratelimit())
606 wiphy_debug(hw->wiphy,
607 "release an RX reorder frame due to timeout on earlier frames\n");
608#endif
609 ieee80211_release_reorder_frame(hw, tid_agg_rx,
610 j, frames);
611
612 /*
613 * Increment the head seq# also for the skipped slots.
614 */
615 tid_agg_rx->head_seq_num =
616 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
617 skipped = 0;
618 }
619 } else while (tid_agg_rx->reorder_buf[index]) {
620 ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
621 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
622 tid_agg_rx->buf_size;
623 }
624
625 if (tid_agg_rx->stored_mpdu_num) {
626 j = index = seq_sub(tid_agg_rx->head_seq_num,
627 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
628
629 for (; j != (index - 1) % tid_agg_rx->buf_size;
630 j = (j + 1) % tid_agg_rx->buf_size) {
631 if (tid_agg_rx->reorder_buf[j])
632 break;
633 }
634
635 set_release_timer:
636
637 mod_timer(&tid_agg_rx->reorder_timer,
638 tid_agg_rx->reorder_time[j] +
639 HT_RX_REORDER_BUF_TIMEOUT);
640 } else {
641 del_timer(&tid_agg_rx->reorder_timer);
642 }
643}
644
586/* 645/*
587 * As this function belongs to the RX path it must be under 646 * As this function belongs to the RX path it must be under
588 * rcu_read_lock protection. It returns false if the frame 647 * rcu_read_lock protection. It returns false if the frame
@@ -598,14 +657,16 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
598 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 657 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
599 u16 head_seq_num, buf_size; 658 u16 head_seq_num, buf_size;
600 int index; 659 int index;
660 bool ret = true;
601 661
602 buf_size = tid_agg_rx->buf_size; 662 buf_size = tid_agg_rx->buf_size;
603 head_seq_num = tid_agg_rx->head_seq_num; 663 head_seq_num = tid_agg_rx->head_seq_num;
604 664
665 spin_lock(&tid_agg_rx->reorder_lock);
605 /* frame with out of date sequence number */ 666 /* frame with out of date sequence number */
606 if (seq_less(mpdu_seq_num, head_seq_num)) { 667 if (seq_less(mpdu_seq_num, head_seq_num)) {
607 dev_kfree_skb(skb); 668 dev_kfree_skb(skb);
608 return true; 669 goto out;
609 } 670 }
610 671
611 /* 672 /*
@@ -626,7 +687,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
626 /* check if we already stored this frame */ 687 /* check if we already stored this frame */
627 if (tid_agg_rx->reorder_buf[index]) { 688 if (tid_agg_rx->reorder_buf[index]) {
628 dev_kfree_skb(skb); 689 dev_kfree_skb(skb);
629 return true; 690 goto out;
630 } 691 }
631 692
632 /* 693 /*
@@ -636,58 +697,19 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
636 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 697 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
637 tid_agg_rx->stored_mpdu_num == 0) { 698 tid_agg_rx->stored_mpdu_num == 0) {
638 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num); 699 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
639 return false; 700 ret = false;
701 goto out;
640 } 702 }
641 703
642 /* put the frame in the reordering buffer */ 704 /* put the frame in the reordering buffer */
643 tid_agg_rx->reorder_buf[index] = skb; 705 tid_agg_rx->reorder_buf[index] = skb;
644 tid_agg_rx->reorder_time[index] = jiffies; 706 tid_agg_rx->reorder_time[index] = jiffies;
645 tid_agg_rx->stored_mpdu_num++; 707 tid_agg_rx->stored_mpdu_num++;
646 /* release the buffer until next missing frame */ 708 ieee80211_sta_reorder_release(hw, tid_agg_rx, frames);
647 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
648 tid_agg_rx->buf_size;
649 if (!tid_agg_rx->reorder_buf[index] &&
650 tid_agg_rx->stored_mpdu_num > 1) {
651 /*
652 * No buffers ready to be released, but check whether any
653 * frames in the reorder buffer have timed out.
654 */
655 int j;
656 int skipped = 1;
657 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
658 j = (j + 1) % tid_agg_rx->buf_size) {
659 if (!tid_agg_rx->reorder_buf[j]) {
660 skipped++;
661 continue;
662 }
663 if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
664 HT_RX_REORDER_BUF_TIMEOUT))
665 break;
666
667#ifdef CONFIG_MAC80211_HT_DEBUG
668 if (net_ratelimit())
669 printk(KERN_DEBUG "%s: release an RX reorder "
670 "frame due to timeout on earlier "
671 "frames\n",
672 wiphy_name(hw->wiphy));
673#endif
674 ieee80211_release_reorder_frame(hw, tid_agg_rx,
675 j, frames);
676 709
677 /* 710 out:
678 * Increment the head seq# also for the skipped slots. 711 spin_unlock(&tid_agg_rx->reorder_lock);
679 */ 712 return ret;
680 tid_agg_rx->head_seq_num =
681 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
682 skipped = 0;
683 }
684 } else while (tid_agg_rx->reorder_buf[index]) {
685 ieee80211_release_reorder_frame(hw, tid_agg_rx, index, frames);
686 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
687 tid_agg_rx->buf_size;
688 }
689
690 return true;
691} 713}
692 714
693/* 715/*
@@ -761,13 +783,14 @@ static ieee80211_rx_result debug_noinline
761ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 783ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
762{ 784{
763 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 785 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
786 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
764 787
765 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */ 788 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
766 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) { 789 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
767 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 790 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
768 rx->sta->last_seq_ctrl[rx->queue] == 791 rx->sta->last_seq_ctrl[rx->queue] ==
769 hdr->seq_ctrl)) { 792 hdr->seq_ctrl)) {
770 if (rx->flags & IEEE80211_RX_RA_MATCH) { 793 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
771 rx->local->dot11FrameDuplicateCount++; 794 rx->local->dot11FrameDuplicateCount++;
772 rx->sta->num_duplicates++; 795 rx->sta->num_duplicates++;
773 } 796 }
@@ -800,7 +823,7 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
800 if ((!ieee80211_has_fromds(hdr->frame_control) && 823 if ((!ieee80211_has_fromds(hdr->frame_control) &&
801 !ieee80211_has_tods(hdr->frame_control) && 824 !ieee80211_has_tods(hdr->frame_control) &&
802 ieee80211_is_data(hdr->frame_control)) || 825 ieee80211_is_data(hdr->frame_control)) ||
803 !(rx->flags & IEEE80211_RX_RA_MATCH)) { 826 !(status->rx_flags & IEEE80211_RX_RA_MATCH)) {
804 /* Drop IBSS frames and frames for other hosts 827 /* Drop IBSS frames and frames for other hosts
805 * silently. */ 828 * silently. */
806 return RX_DROP_MONITOR; 829 return RX_DROP_MONITOR;
@@ -857,7 +880,7 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
857 * No point in finding a key and decrypting if the frame is neither 880 * No point in finding a key and decrypting if the frame is neither
858 * addressed to us nor a multicast frame. 881 * addressed to us nor a multicast frame.
859 */ 882 */
860 if (!(rx->flags & IEEE80211_RX_RA_MATCH)) 883 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
861 return RX_CONTINUE; 884 return RX_CONTINUE;
862 885
863 /* start without a key */ 886 /* start without a key */
@@ -873,6 +896,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
873 896
874 if (!is_multicast_ether_addr(hdr->addr1) && stakey) { 897 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
875 rx->key = stakey; 898 rx->key = stakey;
899 if ((status->flag & RX_FLAG_DECRYPTED) &&
900 (status->flag & RX_FLAG_IV_STRIPPED))
901 return RX_CONTINUE;
876 /* Skip decryption if the frame is not protected. */ 902 /* Skip decryption if the frame is not protected. */
877 if (!ieee80211_has_protected(fc)) 903 if (!ieee80211_has_protected(fc))
878 return RX_CONTINUE; 904 return RX_CONTINUE;
@@ -935,7 +961,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
935 * pairwise or station-to-station keys, but for WEP we allow 961 * pairwise or station-to-station keys, but for WEP we allow
936 * using a key index as well. 962 * using a key index as well.
937 */ 963 */
938 if (rx->key && rx->key->conf.alg != ALG_WEP && 964 if (rx->key && rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
965 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
939 !is_multicast_ether_addr(hdr->addr1)) 966 !is_multicast_ether_addr(hdr->addr1))
940 rx->key = NULL; 967 rx->key = NULL;
941 } 968 }
@@ -951,8 +978,9 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
951 return RX_DROP_UNUSABLE; 978 return RX_DROP_UNUSABLE;
952 /* the hdr variable is invalid now! */ 979 /* the hdr variable is invalid now! */
953 980
954 switch (rx->key->conf.alg) { 981 switch (rx->key->conf.cipher) {
955 case ALG_WEP: 982 case WLAN_CIPHER_SUITE_WEP40:
983 case WLAN_CIPHER_SUITE_WEP104:
956 /* Check for weak IVs if possible */ 984 /* Check for weak IVs if possible */
957 if (rx->sta && ieee80211_is_data(fc) && 985 if (rx->sta && ieee80211_is_data(fc) &&
958 (!(status->flag & RX_FLAG_IV_STRIPPED) || 986 (!(status->flag & RX_FLAG_IV_STRIPPED) ||
@@ -962,15 +990,21 @@ ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
962 990
963 result = ieee80211_crypto_wep_decrypt(rx); 991 result = ieee80211_crypto_wep_decrypt(rx);
964 break; 992 break;
965 case ALG_TKIP: 993 case WLAN_CIPHER_SUITE_TKIP:
966 result = ieee80211_crypto_tkip_decrypt(rx); 994 result = ieee80211_crypto_tkip_decrypt(rx);
967 break; 995 break;
968 case ALG_CCMP: 996 case WLAN_CIPHER_SUITE_CCMP:
969 result = ieee80211_crypto_ccmp_decrypt(rx); 997 result = ieee80211_crypto_ccmp_decrypt(rx);
970 break; 998 break;
971 case ALG_AES_CMAC: 999 case WLAN_CIPHER_SUITE_AES_CMAC:
972 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1000 result = ieee80211_crypto_aes_cmac_decrypt(rx);
973 break; 1001 break;
1002 default:
1003 /*
1004 * We can reach here only with HW-only algorithms
1005 * but why didn't it decrypt the frame?!
1006 */
1007 return RX_DROP_UNUSABLE;
974 } 1008 }
975 1009
976 /* either the frame has been decrypted or will be dropped */ 1010 /* either the frame has been decrypted or will be dropped */
@@ -1079,7 +1113,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1079 sta->last_rx = jiffies; 1113 sta->last_rx = jiffies;
1080 } 1114 }
1081 1115
1082 if (!(rx->flags & IEEE80211_RX_RA_MATCH)) 1116 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1083 return RX_CONTINUE; 1117 return RX_CONTINUE;
1084 1118
1085 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1119 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
@@ -1236,6 +1270,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1236 unsigned int frag, seq; 1270 unsigned int frag, seq;
1237 struct ieee80211_fragment_entry *entry; 1271 struct ieee80211_fragment_entry *entry;
1238 struct sk_buff *skb; 1272 struct sk_buff *skb;
1273 struct ieee80211_rx_status *status;
1239 1274
1240 hdr = (struct ieee80211_hdr *)rx->skb->data; 1275 hdr = (struct ieee80211_hdr *)rx->skb->data;
1241 fc = hdr->frame_control; 1276 fc = hdr->frame_control;
@@ -1265,7 +1300,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1265 /* This is the first fragment of a new frame. */ 1300 /* This is the first fragment of a new frame. */
1266 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 1301 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1267 rx->queue, &(rx->skb)); 1302 rx->queue, &(rx->skb));
1268 if (rx->key && rx->key->conf.alg == ALG_CCMP && 1303 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1269 ieee80211_has_protected(fc)) { 1304 ieee80211_has_protected(fc)) {
1270 int queue = ieee80211_is_mgmt(fc) ? 1305 int queue = ieee80211_is_mgmt(fc) ?
1271 NUM_RX_DATA_QUEUES : rx->queue; 1306 NUM_RX_DATA_QUEUES : rx->queue;
@@ -1294,7 +1329,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1294 int i; 1329 int i;
1295 u8 pn[CCMP_PN_LEN], *rpn; 1330 u8 pn[CCMP_PN_LEN], *rpn;
1296 int queue; 1331 int queue;
1297 if (!rx->key || rx->key->conf.alg != ALG_CCMP) 1332 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
1298 return RX_DROP_UNUSABLE; 1333 return RX_DROP_UNUSABLE;
1299 memcpy(pn, entry->last_pn, CCMP_PN_LEN); 1334 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1300 for (i = CCMP_PN_LEN - 1; i >= 0; i--) { 1335 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
@@ -1335,7 +1370,8 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1335 } 1370 }
1336 1371
1337 /* Complete frame has been reassembled - process it now */ 1372 /* Complete frame has been reassembled - process it now */
1338 rx->flags |= IEEE80211_RX_FRAGMENTED; 1373 status = IEEE80211_SKB_RXCB(rx->skb);
1374 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1339 1375
1340 out: 1376 out:
1341 if (rx->sta) 1377 if (rx->sta)
@@ -1352,9 +1388,10 @@ ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1352{ 1388{
1353 struct ieee80211_sub_if_data *sdata = rx->sdata; 1389 struct ieee80211_sub_if_data *sdata = rx->sdata;
1354 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control; 1390 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1391 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1355 1392
1356 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) || 1393 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1357 !(rx->flags & IEEE80211_RX_RA_MATCH))) 1394 !(status->rx_flags & IEEE80211_RX_RA_MATCH)))
1358 return RX_CONTINUE; 1395 return RX_CONTINUE;
1359 1396
1360 if ((sdata->vif.type != NL80211_IFTYPE_AP) && 1397 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
@@ -1492,7 +1529,7 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1492 * Allow EAPOL frames to us/the PAE group address regardless 1529 * Allow EAPOL frames to us/the PAE group address regardless
1493 * of whether the frame was encrypted or not. 1530 * of whether the frame was encrypted or not.
1494 */ 1531 */
1495 if (ehdr->h_proto == htons(ETH_P_PAE) && 1532 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1496 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 || 1533 (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
1497 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0)) 1534 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1498 return true; 1535 return true;
@@ -1515,6 +1552,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1515 struct sk_buff *skb, *xmit_skb; 1552 struct sk_buff *skb, *xmit_skb;
1516 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1553 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1517 struct sta_info *dsta; 1554 struct sta_info *dsta;
1555 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1518 1556
1519 skb = rx->skb; 1557 skb = rx->skb;
1520 xmit_skb = NULL; 1558 xmit_skb = NULL;
@@ -1522,7 +1560,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1522 if ((sdata->vif.type == NL80211_IFTYPE_AP || 1560 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1523 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1561 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1524 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 1562 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1525 (rx->flags & IEEE80211_RX_RA_MATCH) && 1563 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1526 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 1564 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1527 if (is_multicast_ether_addr(ehdr->h_dest)) { 1565 if (is_multicast_ether_addr(ehdr->h_dest)) {
1528 /* 1566 /*
@@ -1599,6 +1637,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1599 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1637 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1600 __le16 fc = hdr->frame_control; 1638 __le16 fc = hdr->frame_control;
1601 struct sk_buff_head frame_list; 1639 struct sk_buff_head frame_list;
1640 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1602 1641
1603 if (unlikely(!ieee80211_is_data(fc))) 1642 if (unlikely(!ieee80211_is_data(fc)))
1604 return RX_CONTINUE; 1643 return RX_CONTINUE;
@@ -1606,7 +1645,7 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1606 if (unlikely(!ieee80211_is_data_present(fc))) 1645 if (unlikely(!ieee80211_is_data_present(fc)))
1607 return RX_DROP_MONITOR; 1646 return RX_DROP_MONITOR;
1608 1647
1609 if (!(rx->flags & IEEE80211_RX_AMSDU)) 1648 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1610 return RX_CONTINUE; 1649 return RX_CONTINUE;
1611 1650
1612 if (ieee80211_has_a4(hdr->frame_control) && 1651 if (ieee80211_has_a4(hdr->frame_control) &&
@@ -1657,6 +1696,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1657 struct sk_buff *skb = rx->skb, *fwd_skb; 1696 struct sk_buff *skb = rx->skb, *fwd_skb;
1658 struct ieee80211_local *local = rx->local; 1697 struct ieee80211_local *local = rx->local;
1659 struct ieee80211_sub_if_data *sdata = rx->sdata; 1698 struct ieee80211_sub_if_data *sdata = rx->sdata;
1699 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1660 1700
1661 hdr = (struct ieee80211_hdr *) skb->data; 1701 hdr = (struct ieee80211_hdr *) skb->data;
1662 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1702 hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -1702,7 +1742,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1702 1742
1703 mesh_hdr->ttl--; 1743 mesh_hdr->ttl--;
1704 1744
1705 if (rx->flags & IEEE80211_RX_RA_MATCH) { 1745 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1706 if (!mesh_hdr->ttl) 1746 if (!mesh_hdr->ttl)
1707 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh, 1747 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1708 dropped_frames_ttl); 1748 dropped_frames_ttl);
@@ -1909,13 +1949,38 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
1909} 1949}
1910 1950
1911static ieee80211_rx_result debug_noinline 1951static ieee80211_rx_result debug_noinline
1952ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
1953{
1954 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1955 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1956
1957 /*
1958 * From here on, look only at management frames.
1959 * Data and control frames are already handled,
1960 * and unknown (reserved) frames are useless.
1961 */
1962 if (rx->skb->len < 24)
1963 return RX_DROP_MONITOR;
1964
1965 if (!ieee80211_is_mgmt(mgmt->frame_control))
1966 return RX_DROP_MONITOR;
1967
1968 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1969 return RX_DROP_MONITOR;
1970
1971 if (ieee80211_drop_unencrypted_mgmt(rx))
1972 return RX_DROP_UNUSABLE;
1973
1974 return RX_CONTINUE;
1975}
1976
1977static ieee80211_rx_result debug_noinline
1912ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 1978ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1913{ 1979{
1914 struct ieee80211_local *local = rx->local; 1980 struct ieee80211_local *local = rx->local;
1915 struct ieee80211_sub_if_data *sdata = rx->sdata; 1981 struct ieee80211_sub_if_data *sdata = rx->sdata;
1916 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 1982 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1917 struct sk_buff *nskb; 1983 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1918 struct ieee80211_rx_status *status;
1919 int len = rx->skb->len; 1984 int len = rx->skb->len;
1920 1985
1921 if (!ieee80211_is_action(mgmt->frame_control)) 1986 if (!ieee80211_is_action(mgmt->frame_control))
@@ -1928,10 +1993,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1928 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) 1993 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
1929 return RX_DROP_UNUSABLE; 1994 return RX_DROP_UNUSABLE;
1930 1995
1931 if (!(rx->flags & IEEE80211_RX_RA_MATCH)) 1996 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1932 return RX_DROP_UNUSABLE;
1933
1934 if (ieee80211_drop_unencrypted_mgmt(rx))
1935 return RX_DROP_UNUSABLE; 1997 return RX_DROP_UNUSABLE;
1936 1998
1937 switch (mgmt->u.action.category) { 1999 switch (mgmt->u.action.category) {
@@ -2024,17 +2086,36 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2024 goto queue; 2086 goto queue;
2025 } 2087 }
2026 2088
2089 return RX_CONTINUE;
2090
2027 invalid: 2091 invalid:
2028 /* 2092 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2029 * For AP mode, hostapd is responsible for handling any action 2093 /* will return in the next handlers */
2030 * frames that we didn't handle, including returning unknown 2094 return RX_CONTINUE;
2031 * ones. For all other modes we will return them to the sender, 2095
2032 * setting the 0x80 bit in the action category, as required by 2096 handled:
2033 * 802.11-2007 7.3.1.11. 2097 if (rx->sta)
2034 */ 2098 rx->sta->rx_packets++;
2035 if (sdata->vif.type == NL80211_IFTYPE_AP || 2099 dev_kfree_skb(rx->skb);
2036 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 2100 return RX_QUEUED;
2037 return RX_DROP_MONITOR; 2101
2102 queue:
2103 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2104 skb_queue_tail(&sdata->skb_queue, rx->skb);
2105 ieee80211_queue_work(&local->hw, &sdata->work);
2106 if (rx->sta)
2107 rx->sta->rx_packets++;
2108 return RX_QUEUED;
2109}
2110
2111static ieee80211_rx_result debug_noinline
2112ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2113{
2114 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2115
2116 /* skip known-bad action frames and return them in the next handler */
2117 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2118 return RX_CONTINUE;
2038 2119
2039 /* 2120 /*
2040 * Getting here means the kernel doesn't know how to handle 2121 * Getting here means the kernel doesn't know how to handle
@@ -2042,12 +2123,46 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2042 * so userspace can register for those to know whether ones 2123 * so userspace can register for those to know whether ones
2043 * it transmitted were processed or returned. 2124 * it transmitted were processed or returned.
2044 */ 2125 */
2045 status = IEEE80211_SKB_RXCB(rx->skb);
2046 2126
2047 if (cfg80211_rx_action(rx->sdata->dev, status->freq, 2127 if (cfg80211_rx_mgmt(rx->sdata->dev, status->freq,
2048 rx->skb->data, rx->skb->len, 2128 rx->skb->data, rx->skb->len,
2049 GFP_ATOMIC)) 2129 GFP_ATOMIC)) {
2050 goto handled; 2130 if (rx->sta)
2131 rx->sta->rx_packets++;
2132 dev_kfree_skb(rx->skb);
2133 return RX_QUEUED;
2134 }
2135
2136
2137 return RX_CONTINUE;
2138}
2139
2140static ieee80211_rx_result debug_noinline
2141ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2142{
2143 struct ieee80211_local *local = rx->local;
2144 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2145 struct sk_buff *nskb;
2146 struct ieee80211_sub_if_data *sdata = rx->sdata;
2147 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2148
2149 if (!ieee80211_is_action(mgmt->frame_control))
2150 return RX_CONTINUE;
2151
2152 /*
2153 * For AP mode, hostapd is responsible for handling any action
2154 * frames that we didn't handle, including returning unknown
2155 * ones. For all other modes we will return them to the sender,
2156 * setting the 0x80 bit in the action category, as required by
2157 * 802.11-2007 7.3.1.11.
2158 * Newer versions of hostapd shall also use the management frame
2159 * registration mechanisms, but older ones still use cooked
2160 * monitor interfaces so push all frames there.
2161 */
2162 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2163 (sdata->vif.type == NL80211_IFTYPE_AP ||
2164 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2165 return RX_DROP_MONITOR;
2051 2166
2052 /* do not return rejected action frames */ 2167 /* do not return rejected action frames */
2053 if (mgmt->u.action.category & 0x80) 2168 if (mgmt->u.action.category & 0x80)
@@ -2066,20 +2181,8 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2066 2181
2067 ieee80211_tx_skb(rx->sdata, nskb); 2182 ieee80211_tx_skb(rx->sdata, nskb);
2068 } 2183 }
2069
2070 handled:
2071 if (rx->sta)
2072 rx->sta->rx_packets++;
2073 dev_kfree_skb(rx->skb); 2184 dev_kfree_skb(rx->skb);
2074 return RX_QUEUED; 2185 return RX_QUEUED;
2075
2076 queue:
2077 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2078 skb_queue_tail(&sdata->skb_queue, rx->skb);
2079 ieee80211_queue_work(&local->hw, &sdata->work);
2080 if (rx->sta)
2081 rx->sta->rx_packets++;
2082 return RX_QUEUED;
2083} 2186}
2084 2187
2085static ieee80211_rx_result debug_noinline 2188static ieee80211_rx_result debug_noinline
@@ -2090,15 +2193,6 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2090 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 2193 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2091 __le16 stype; 2194 __le16 stype;
2092 2195
2093 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
2094 return RX_DROP_MONITOR;
2095
2096 if (rx->skb->len < 24)
2097 return RX_DROP_MONITOR;
2098
2099 if (ieee80211_drop_unencrypted_mgmt(rx))
2100 return RX_DROP_UNUSABLE;
2101
2102 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb); 2196 rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
2103 if (rxs != RX_CONTINUE) 2197 if (rxs != RX_CONTINUE)
2104 return rxs; 2198 return rxs;
@@ -2199,6 +2293,14 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2199 struct net_device *prev_dev = NULL; 2293 struct net_device *prev_dev = NULL;
2200 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2294 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2201 2295
2296 /*
2297 * If cooked monitor has been processed already, then
2298 * don't do it again. If not, set the flag.
2299 */
2300 if (rx->flags & IEEE80211_RX_CMNTR)
2301 goto out_free_skb;
2302 rx->flags |= IEEE80211_RX_CMNTR;
2303
2202 if (skb_headroom(skb) < sizeof(*rthdr) && 2304 if (skb_headroom(skb) < sizeof(*rthdr) &&
2203 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) 2305 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
2204 goto out_free_skb; 2306 goto out_free_skb;
@@ -2253,29 +2355,53 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2253 if (prev_dev) { 2355 if (prev_dev) {
2254 skb->dev = prev_dev; 2356 skb->dev = prev_dev;
2255 netif_receive_skb(skb); 2357 netif_receive_skb(skb);
2256 skb = NULL; 2358 return;
2257 } else 2359 }
2258 goto out_free_skb;
2259
2260 return;
2261 2360
2262 out_free_skb: 2361 out_free_skb:
2263 dev_kfree_skb(skb); 2362 dev_kfree_skb(skb);
2264} 2363}
2265 2364
2365static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2366 ieee80211_rx_result res)
2367{
2368 switch (res) {
2369 case RX_DROP_MONITOR:
2370 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2371 if (rx->sta)
2372 rx->sta->rx_dropped++;
2373 /* fall through */
2374 case RX_CONTINUE: {
2375 struct ieee80211_rate *rate = NULL;
2376 struct ieee80211_supported_band *sband;
2377 struct ieee80211_rx_status *status;
2378
2379 status = IEEE80211_SKB_RXCB((rx->skb));
2380
2381 sband = rx->local->hw.wiphy->bands[status->band];
2382 if (!(status->flag & RX_FLAG_HT))
2383 rate = &sband->bitrates[status->rate_idx];
2384
2385 ieee80211_rx_cooked_monitor(rx, rate);
2386 break;
2387 }
2388 case RX_DROP_UNUSABLE:
2389 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2390 if (rx->sta)
2391 rx->sta->rx_dropped++;
2392 dev_kfree_skb(rx->skb);
2393 break;
2394 case RX_QUEUED:
2395 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2396 break;
2397 }
2398}
2266 2399
2267static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata, 2400static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
2268 struct ieee80211_rx_data *rx, 2401 struct sk_buff_head *frames)
2269 struct sk_buff *skb,
2270 struct ieee80211_rate *rate)
2271{ 2402{
2272 struct sk_buff_head reorder_release;
2273 ieee80211_rx_result res = RX_DROP_MONITOR; 2403 ieee80211_rx_result res = RX_DROP_MONITOR;
2274 2404 struct sk_buff *skb;
2275 __skb_queue_head_init(&reorder_release);
2276
2277 rx->skb = skb;
2278 rx->sdata = sdata;
2279 2405
2280#define CALL_RXH(rxh) \ 2406#define CALL_RXH(rxh) \
2281 do { \ 2407 do { \
@@ -2284,23 +2410,14 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
2284 goto rxh_next; \ 2410 goto rxh_next; \
2285 } while (0); 2411 } while (0);
2286 2412
2287 /* 2413 while ((skb = __skb_dequeue(frames))) {
2288 * NB: the rxh_next label works even if we jump
2289 * to it from here because then the list will
2290 * be empty, which is a trivial check
2291 */
2292 CALL_RXH(ieee80211_rx_h_passive_scan)
2293 CALL_RXH(ieee80211_rx_h_check)
2294
2295 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
2296
2297 while ((skb = __skb_dequeue(&reorder_release))) {
2298 /* 2414 /*
2299 * all the other fields are valid across frames 2415 * all the other fields are valid across frames
2300 * that belong to an aMPDU since they are on the 2416 * that belong to an aMPDU since they are on the
2301 * same TID from the same station 2417 * same TID from the same station
2302 */ 2418 */
2303 rx->skb = skb; 2419 rx->skb = skb;
2420 rx->flags = 0;
2304 2421
2305 CALL_RXH(ieee80211_rx_h_decrypt) 2422 CALL_RXH(ieee80211_rx_h_decrypt)
2306 CALL_RXH(ieee80211_rx_h_check_more_data) 2423 CALL_RXH(ieee80211_rx_h_check_more_data)
@@ -2312,50 +2429,92 @@ static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
2312 CALL_RXH(ieee80211_rx_h_remove_qos_control) 2429 CALL_RXH(ieee80211_rx_h_remove_qos_control)
2313 CALL_RXH(ieee80211_rx_h_amsdu) 2430 CALL_RXH(ieee80211_rx_h_amsdu)
2314#ifdef CONFIG_MAC80211_MESH 2431#ifdef CONFIG_MAC80211_MESH
2315 if (ieee80211_vif_is_mesh(&sdata->vif)) 2432 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2316 CALL_RXH(ieee80211_rx_h_mesh_fwding); 2433 CALL_RXH(ieee80211_rx_h_mesh_fwding);
2317#endif 2434#endif
2318 CALL_RXH(ieee80211_rx_h_data) 2435 CALL_RXH(ieee80211_rx_h_data)
2319 2436
2320 /* special treatment -- needs the queue */ 2437 /* special treatment -- needs the queue */
2321 res = ieee80211_rx_h_ctrl(rx, &reorder_release); 2438 res = ieee80211_rx_h_ctrl(rx, frames);
2322 if (res != RX_CONTINUE) 2439 if (res != RX_CONTINUE)
2323 goto rxh_next; 2440 goto rxh_next;
2324 2441
2442 CALL_RXH(ieee80211_rx_h_mgmt_check)
2325 CALL_RXH(ieee80211_rx_h_action) 2443 CALL_RXH(ieee80211_rx_h_action)
2444 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2445 CALL_RXH(ieee80211_rx_h_action_return)
2326 CALL_RXH(ieee80211_rx_h_mgmt) 2446 CALL_RXH(ieee80211_rx_h_mgmt)
2327 2447
2448 rxh_next:
2449 ieee80211_rx_handlers_result(rx, res);
2450
2328#undef CALL_RXH 2451#undef CALL_RXH
2452 }
2453}
2454
2455static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2456{
2457 struct sk_buff_head reorder_release;
2458 ieee80211_rx_result res = RX_DROP_MONITOR;
2459
2460 __skb_queue_head_init(&reorder_release);
2461
2462#define CALL_RXH(rxh) \
2463 do { \
2464 res = rxh(rx); \
2465 if (res != RX_CONTINUE) \
2466 goto rxh_next; \
2467 } while (0);
2468
2469 CALL_RXH(ieee80211_rx_h_passive_scan)
2470 CALL_RXH(ieee80211_rx_h_check)
2471
2472 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
2473
2474 ieee80211_rx_handlers(rx, &reorder_release);
2475 return;
2329 2476
2330 rxh_next: 2477 rxh_next:
2331 switch (res) { 2478 ieee80211_rx_handlers_result(rx, res);
2332 case RX_DROP_MONITOR: 2479
2333 I802_DEBUG_INC(sdata->local->rx_handlers_drop); 2480#undef CALL_RXH
2334 if (rx->sta) 2481}
2335 rx->sta->rx_dropped++; 2482
2336 /* fall through */ 2483/*
2337 case RX_CONTINUE: 2484 * This function makes calls into the RX path. Therefore the
2338 ieee80211_rx_cooked_monitor(rx, rate); 2485 * caller must hold the sta_info->lock and everything has to
2339 break; 2486 * be under rcu_read_lock protection as well.
2340 case RX_DROP_UNUSABLE: 2487 */
2341 I802_DEBUG_INC(sdata->local->rx_handlers_drop); 2488void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2342 if (rx->sta) 2489{
2343 rx->sta->rx_dropped++; 2490 struct sk_buff_head frames;
2344 dev_kfree_skb(rx->skb); 2491 struct ieee80211_rx_data rx = {
2345 break; 2492 .sta = sta,
2346 case RX_QUEUED: 2493 .sdata = sta->sdata,
2347 I802_DEBUG_INC(sdata->local->rx_handlers_queued); 2494 .local = sta->local,
2348 break; 2495 .queue = tid,
2349 } 2496 };
2350 } 2497 struct tid_ampdu_rx *tid_agg_rx;
2498
2499 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2500 if (!tid_agg_rx)
2501 return;
2502
2503 __skb_queue_head_init(&frames);
2504
2505 spin_lock(&tid_agg_rx->reorder_lock);
2506 ieee80211_sta_reorder_release(&sta->local->hw, tid_agg_rx, &frames);
2507 spin_unlock(&tid_agg_rx->reorder_lock);
2508
2509 ieee80211_rx_handlers(&rx, &frames);
2351} 2510}
2352 2511
2353/* main receive path */ 2512/* main receive path */
2354 2513
2355static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata, 2514static int prepare_for_handlers(struct ieee80211_rx_data *rx,
2356 struct ieee80211_rx_data *rx,
2357 struct ieee80211_hdr *hdr) 2515 struct ieee80211_hdr *hdr)
2358{ 2516{
2517 struct ieee80211_sub_if_data *sdata = rx->sdata;
2359 struct sk_buff *skb = rx->skb; 2518 struct sk_buff *skb = rx->skb;
2360 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2519 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2361 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 2520 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
@@ -2369,7 +2528,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2369 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) { 2528 compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
2370 if (!(sdata->dev->flags & IFF_PROMISC)) 2529 if (!(sdata->dev->flags & IFF_PROMISC))
2371 return 0; 2530 return 0;
2372 rx->flags &= ~IEEE80211_RX_RA_MATCH; 2531 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2373 } 2532 }
2374 break; 2533 break;
2375 case NL80211_IFTYPE_ADHOC: 2534 case NL80211_IFTYPE_ADHOC:
@@ -2379,15 +2538,15 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2379 return 1; 2538 return 1;
2380 } 2539 }
2381 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) { 2540 else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2382 if (!(rx->flags & IEEE80211_RX_IN_SCAN)) 2541 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2383 return 0; 2542 return 0;
2384 rx->flags &= ~IEEE80211_RX_RA_MATCH; 2543 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2385 } else if (!multicast && 2544 } else if (!multicast &&
2386 compare_ether_addr(sdata->vif.addr, 2545 compare_ether_addr(sdata->vif.addr,
2387 hdr->addr1) != 0) { 2546 hdr->addr1) != 0) {
2388 if (!(sdata->dev->flags & IFF_PROMISC)) 2547 if (!(sdata->dev->flags & IFF_PROMISC))
2389 return 0; 2548 return 0;
2390 rx->flags &= ~IEEE80211_RX_RA_MATCH; 2549 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2391 } else if (!rx->sta) { 2550 } else if (!rx->sta) {
2392 int rate_idx; 2551 int rate_idx;
2393 if (status->flag & RX_FLAG_HT) 2552 if (status->flag & RX_FLAG_HT)
@@ -2405,7 +2564,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2405 if (!(sdata->dev->flags & IFF_PROMISC)) 2564 if (!(sdata->dev->flags & IFF_PROMISC))
2406 return 0; 2565 return 0;
2407 2566
2408 rx->flags &= ~IEEE80211_RX_RA_MATCH; 2567 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2409 } 2568 }
2410 break; 2569 break;
2411 case NL80211_IFTYPE_AP_VLAN: 2570 case NL80211_IFTYPE_AP_VLAN:
@@ -2416,9 +2575,9 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2416 return 0; 2575 return 0;
2417 } else if (!ieee80211_bssid_match(bssid, 2576 } else if (!ieee80211_bssid_match(bssid,
2418 sdata->vif.addr)) { 2577 sdata->vif.addr)) {
2419 if (!(rx->flags & IEEE80211_RX_IN_SCAN)) 2578 if (!(status->rx_flags & IEEE80211_RX_IN_SCAN))
2420 return 0; 2579 return 0;
2421 rx->flags &= ~IEEE80211_RX_RA_MATCH; 2580 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2422 } 2581 }
2423 break; 2582 break;
2424 case NL80211_IFTYPE_WDS: 2583 case NL80211_IFTYPE_WDS:
@@ -2427,9 +2586,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2427 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2)) 2586 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
2428 return 0; 2587 return 0;
2429 break; 2588 break;
2430 case NL80211_IFTYPE_MONITOR: 2589 default:
2431 case NL80211_IFTYPE_UNSPECIFIED:
2432 case __NL80211_IFTYPE_AFTER_LAST:
2433 /* should never get here */ 2590 /* should never get here */
2434 WARN_ON(1); 2591 WARN_ON(1);
2435 break; 2592 break;
@@ -2439,12 +2596,56 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
2439} 2596}
2440 2597
2441/* 2598/*
2599 * This function returns whether or not the SKB
2600 * was destined for RX processing or not, which,
2601 * if consume is true, is equivalent to whether
2602 * or not the skb was consumed.
2603 */
2604static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2605 struct sk_buff *skb, bool consume)
2606{
2607 struct ieee80211_local *local = rx->local;
2608 struct ieee80211_sub_if_data *sdata = rx->sdata;
2609 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2610 struct ieee80211_hdr *hdr = (void *)skb->data;
2611 int prepares;
2612
2613 rx->skb = skb;
2614 status->rx_flags |= IEEE80211_RX_RA_MATCH;
2615 prepares = prepare_for_handlers(rx, hdr);
2616
2617 if (!prepares)
2618 return false;
2619
2620 if (status->flag & RX_FLAG_MMIC_ERROR) {
2621 if (status->rx_flags & IEEE80211_RX_RA_MATCH)
2622 ieee80211_rx_michael_mic_report(hdr, rx);
2623 return false;
2624 }
2625
2626 if (!consume) {
2627 skb = skb_copy(skb, GFP_ATOMIC);
2628 if (!skb) {
2629 if (net_ratelimit())
2630 wiphy_debug(local->hw.wiphy,
2631 "failed to copy multicast frame for %s\n",
2632 sdata->name);
2633 return true;
2634 }
2635
2636 rx->skb = skb;
2637 }
2638
2639 ieee80211_invoke_rx_handlers(rx);
2640 return true;
2641}
2642
2643/*
2442 * This is the actual Rx frames handler. as it blongs to Rx path it must 2644 * This is the actual Rx frames handler. as it blongs to Rx path it must
2443 * be called with rcu_read_lock protection. 2645 * be called with rcu_read_lock protection.
2444 */ 2646 */
2445static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 2647static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2446 struct sk_buff *skb, 2648 struct sk_buff *skb)
2447 struct ieee80211_rate *rate)
2448{ 2649{
2449 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2650 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2450 struct ieee80211_local *local = hw_to_local(hw); 2651 struct ieee80211_local *local = hw_to_local(hw);
@@ -2452,11 +2653,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2452 struct ieee80211_hdr *hdr; 2653 struct ieee80211_hdr *hdr;
2453 __le16 fc; 2654 __le16 fc;
2454 struct ieee80211_rx_data rx; 2655 struct ieee80211_rx_data rx;
2455 int prepares; 2656 struct ieee80211_sub_if_data *prev;
2456 struct ieee80211_sub_if_data *prev = NULL; 2657 struct sta_info *sta, *tmp, *prev_sta;
2457 struct sk_buff *skb_new;
2458 struct sta_info *sta, *tmp;
2459 bool found_sta = false;
2460 int err = 0; 2658 int err = 0;
2461 2659
2462 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 2660 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
@@ -2469,7 +2667,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2469 2667
2470 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) || 2668 if (unlikely(test_bit(SCAN_HW_SCANNING, &local->scanning) ||
2471 test_bit(SCAN_OFF_CHANNEL, &local->scanning))) 2669 test_bit(SCAN_OFF_CHANNEL, &local->scanning)))
2472 rx.flags |= IEEE80211_RX_IN_SCAN; 2670 status->rx_flags |= IEEE80211_RX_IN_SCAN;
2473 2671
2474 if (ieee80211_is_mgmt(fc)) 2672 if (ieee80211_is_mgmt(fc))
2475 err = skb_linearize(skb); 2673 err = skb_linearize(skb);
@@ -2486,91 +2684,67 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2486 ieee80211_verify_alignment(&rx); 2684 ieee80211_verify_alignment(&rx);
2487 2685
2488 if (ieee80211_is_data(fc)) { 2686 if (ieee80211_is_data(fc)) {
2687 prev_sta = NULL;
2688
2489 for_each_sta_info(local, hdr->addr2, sta, tmp) { 2689 for_each_sta_info(local, hdr->addr2, sta, tmp) {
2490 rx.sta = sta; 2690 if (!prev_sta) {
2491 found_sta = true; 2691 prev_sta = sta;
2492 rx.sdata = sta->sdata;
2493
2494 rx.flags |= IEEE80211_RX_RA_MATCH;
2495 prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
2496 if (prepares) {
2497 if (status->flag & RX_FLAG_MMIC_ERROR) {
2498 if (rx.flags & IEEE80211_RX_RA_MATCH)
2499 ieee80211_rx_michael_mic_report(hdr, &rx);
2500 } else
2501 prev = rx.sdata;
2502 }
2503 }
2504 }
2505 if (!found_sta) {
2506 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2507 if (!ieee80211_sdata_running(sdata))
2508 continue; 2692 continue;
2693 }
2509 2694
2510 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 2695 rx.sta = prev_sta;
2511 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 2696 rx.sdata = prev_sta->sdata;
2512 continue; 2697 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2513 2698
2514 /* 2699 prev_sta = sta;
2515 * frame is destined for this interface, but if it's 2700 }
2516 * not also for the previous one we handle that after
2517 * the loop to avoid copying the SKB once too much
2518 */
2519 2701
2520 if (!prev) { 2702 if (prev_sta) {
2521 prev = sdata; 2703 rx.sta = prev_sta;
2522 continue; 2704 rx.sdata = prev_sta->sdata;
2523 }
2524 2705
2525 rx.sta = sta_info_get_bss(prev, hdr->addr2); 2706 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2707 return;
2708 }
2709 }
2526 2710
2527 rx.flags |= IEEE80211_RX_RA_MATCH; 2711 prev = NULL;
2528 prepares = prepare_for_handlers(prev, &rx, hdr);
2529 2712
2530 if (!prepares) 2713 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2531 goto next; 2714 if (!ieee80211_sdata_running(sdata))
2715 continue;
2532 2716
2533 if (status->flag & RX_FLAG_MMIC_ERROR) { 2717 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2534 rx.sdata = prev; 2718 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2535 if (rx.flags & IEEE80211_RX_RA_MATCH) 2719 continue;
2536 ieee80211_rx_michael_mic_report(hdr,
2537 &rx);
2538 goto next;
2539 }
2540 2720
2541 /* 2721 /*
2542 * frame was destined for the previous interface 2722 * frame is destined for this interface, but if it's
2543 * so invoke RX handlers for it 2723 * not also for the previous one we handle that after
2544 */ 2724 * the loop to avoid copying the SKB once too much
2725 */
2545 2726
2546 skb_new = skb_copy(skb, GFP_ATOMIC); 2727 if (!prev) {
2547 if (!skb_new) {
2548 if (net_ratelimit())
2549 printk(KERN_DEBUG "%s: failed to copy "
2550 "multicast frame for %s\n",
2551 wiphy_name(local->hw.wiphy),
2552 prev->name);
2553 goto next;
2554 }
2555 ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
2556next:
2557 prev = sdata; 2728 prev = sdata;
2729 continue;
2558 } 2730 }
2559 2731
2560 if (prev) { 2732 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2561 rx.sta = sta_info_get_bss(prev, hdr->addr2); 2733 rx.sdata = prev;
2734 ieee80211_prepare_and_rx_handle(&rx, skb, false);
2562 2735
2563 rx.flags |= IEEE80211_RX_RA_MATCH; 2736 prev = sdata;
2564 prepares = prepare_for_handlers(prev, &rx, hdr); 2737 }
2565 2738
2566 if (!prepares) 2739 if (prev) {
2567 prev = NULL; 2740 rx.sta = sta_info_get_bss(prev, hdr->addr2);
2568 } 2741 rx.sdata = prev;
2742
2743 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2744 return;
2569 } 2745 }
2570 if (prev) 2746
2571 ieee80211_invoke_rx_handlers(prev, &rx, skb, rate); 2747 dev_kfree_skb(skb);
2572 else
2573 dev_kfree_skb(skb);
2574} 2748}
2575 2749
2576/* 2750/*
@@ -2611,30 +2785,41 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
2611 if (WARN_ON(!local->started)) 2785 if (WARN_ON(!local->started))
2612 goto drop; 2786 goto drop;
2613 2787
2614 if (status->flag & RX_FLAG_HT) { 2788 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
2615 /* 2789 /*
2616 * rate_idx is MCS index, which can be [0-76] as documented on: 2790 * Validate the rate, unless a PLCP error means that
2617 * 2791 * we probably can't have a valid rate here anyway.
2618 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2619 *
2620 * Anything else would be some sort of driver or hardware error.
2621 * The driver should catch hardware errors.
2622 */ 2792 */
2623 if (WARN((status->rate_idx < 0 || 2793
2624 status->rate_idx > 76), 2794 if (status->flag & RX_FLAG_HT) {
2625 "Rate marked as an HT rate but passed " 2795 /*
2626 "status->rate_idx is not " 2796 * rate_idx is MCS index, which can be [0-76]
2627 "an MCS index [0-76]: %d (0x%02x)\n", 2797 * as documented on:
2628 status->rate_idx, 2798 *
2629 status->rate_idx)) 2799 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
2630 goto drop; 2800 *
2631 } else { 2801 * Anything else would be some sort of driver or
2632 if (WARN_ON(status->rate_idx < 0 || 2802 * hardware error. The driver should catch hardware
2633 status->rate_idx >= sband->n_bitrates)) 2803 * errors.
2634 goto drop; 2804 */
2635 rate = &sband->bitrates[status->rate_idx]; 2805 if (WARN((status->rate_idx < 0 ||
2806 status->rate_idx > 76),
2807 "Rate marked as an HT rate but passed "
2808 "status->rate_idx is not "
2809 "an MCS index [0-76]: %d (0x%02x)\n",
2810 status->rate_idx,
2811 status->rate_idx))
2812 goto drop;
2813 } else {
2814 if (WARN_ON(status->rate_idx < 0 ||
2815 status->rate_idx >= sband->n_bitrates))
2816 goto drop;
2817 rate = &sband->bitrates[status->rate_idx];
2818 }
2636 } 2819 }
2637 2820
2821 status->rx_flags = 0;
2822
2638 /* 2823 /*
2639 * key references and virtual interfaces are protected using RCU 2824 * key references and virtual interfaces are protected using RCU
2640 * and this requires that we are in a read-side RCU section during 2825 * and this requires that we are in a read-side RCU section during
@@ -2654,7 +2839,7 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
2654 return; 2839 return;
2655 } 2840 }
2656 2841
2657 __ieee80211_rx_handle_packet(hw, skb, rate); 2842 __ieee80211_rx_handle_packet(hw, skb);
2658 2843
2659 rcu_read_unlock(); 2844 rcu_read_unlock();
2660 2845
generated by cgit v1.2.2 (git 2.25.0) at 2025-02-10 23:30:41 -0500