2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
21 #include "ieee80211_i.h"
29 u8
ieee80211_sta_manage_reorder_buf(struct ieee80211_hw
*hw
,
30 struct tid_ampdu_rx
*tid_agg_rx
,
31 struct sk_buff
*skb
, u16 mpdu_seq_num
,
34 * monitor mode reception
36 * This function cleans up the SKB, i.e. it removes all the stuff
37 * only useful for monitoring.
39 static struct sk_buff
*remove_monitor_info(struct ieee80211_local
*local
,
43 skb_pull(skb
, rtap_len
);
45 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
) {
46 if (likely(skb
->len
> FCS_LEN
))
47 skb_trim(skb
, skb
->len
- FCS_LEN
);
59 static inline int should_drop_frame(struct ieee80211_rx_status
*status
,
64 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*)skb
->data
;
66 if (status
->flag
& (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
68 if (unlikely(skb
->len
< 16 + present_fcs_len
+ radiotap_len
))
70 if (ieee80211_is_ctl(hdr
->frame_control
) &&
71 !ieee80211_is_pspoll(hdr
->frame_control
) &&
72 !ieee80211_is_back_req(hdr
->frame_control
))
78 ieee80211_rx_radiotap_len(struct ieee80211_local
*local
,
79 struct ieee80211_rx_status
*status
)
83 /* always present fields */
84 len
= sizeof(struct ieee80211_radiotap_header
) + 9;
86 if (status
->flag
& RX_FLAG_TSFT
)
88 if (local
->hw
.flags
& IEEE80211_HW_SIGNAL_DB
||
89 local
->hw
.flags
& IEEE80211_HW_SIGNAL_DBM
)
91 if (local
->hw
.flags
& IEEE80211_HW_NOISE_DBM
)
94 if (len
& 1) /* padding for RX_FLAGS if necessary */
97 /* make sure radiotap starts at a naturally aligned address */
99 len
= roundup(len
, 8);
105 * ieee80211_add_rx_radiotap_header - add radiotap header
107 * add a radiotap header containing all the fields which the hardware provided.
110 ieee80211_add_rx_radiotap_header(struct ieee80211_local
*local
,
112 struct ieee80211_rx_status
*status
,
113 struct ieee80211_rate
*rate
,
116 struct ieee80211_radiotap_header
*rthdr
;
119 rthdr
= (struct ieee80211_radiotap_header
*)skb_push(skb
, rtap_len
);
120 memset(rthdr
, 0, rtap_len
);
122 /* radiotap header, set always present flags */
124 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
125 (1 << IEEE80211_RADIOTAP_RATE
) |
126 (1 << IEEE80211_RADIOTAP_CHANNEL
) |
127 (1 << IEEE80211_RADIOTAP_ANTENNA
) |
128 (1 << IEEE80211_RADIOTAP_RX_FLAGS
));
129 rthdr
->it_len
= cpu_to_le16(rtap_len
);
131 pos
= (unsigned char *)(rthdr
+1);
133 /* the order of the following fields is important */
135 /* IEEE80211_RADIOTAP_TSFT */
136 if (status
->flag
& RX_FLAG_TSFT
) {
137 *(__le64
*)pos
= cpu_to_le64(status
->mactime
);
139 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT
);
143 /* IEEE80211_RADIOTAP_FLAGS */
144 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
145 *pos
|= IEEE80211_RADIOTAP_F_FCS
;
148 /* IEEE80211_RADIOTAP_RATE */
149 *pos
= rate
->bitrate
/ 5;
152 /* IEEE80211_RADIOTAP_CHANNEL */
153 *(__le16
*)pos
= cpu_to_le16(status
->freq
);
155 if (status
->band
== IEEE80211_BAND_5GHZ
)
156 *(__le16
*)pos
= cpu_to_le16(IEEE80211_CHAN_OFDM
|
157 IEEE80211_CHAN_5GHZ
);
159 *(__le16
*)pos
= cpu_to_le16(IEEE80211_CHAN_DYN
|
160 IEEE80211_CHAN_2GHZ
);
163 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
164 if (local
->hw
.flags
& IEEE80211_HW_SIGNAL_DBM
) {
165 *pos
= status
->signal
;
167 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL
);
171 /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
172 if (local
->hw
.flags
& IEEE80211_HW_NOISE_DBM
) {
173 *pos
= status
->noise
;
175 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE
);
179 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
181 /* IEEE80211_RADIOTAP_ANTENNA */
182 *pos
= status
->antenna
;
185 /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
186 if (local
->hw
.flags
& IEEE80211_HW_SIGNAL_DB
) {
187 *pos
= status
->signal
;
189 cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL
);
193 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
195 /* IEEE80211_RADIOTAP_RX_FLAGS */
196 /* ensure 2 byte alignment for the 2 byte field as required */
197 if ((pos
- (unsigned char *)rthdr
) & 1)
199 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
200 if (status
->flag
& (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
201 *(__le16
*)pos
|= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS
);
206 * This function copies a received frame to all monitor interfaces and
207 * returns a cleaned-up SKB that no longer includes the FCS nor the
208 * radiotap header the driver might have added.
210 static struct sk_buff
*
211 ieee80211_rx_monitor(struct ieee80211_local
*local
, struct sk_buff
*origskb
,
212 struct ieee80211_rx_status
*status
,
213 struct ieee80211_rate
*rate
)
215 struct ieee80211_sub_if_data
*sdata
;
216 int needed_headroom
= 0;
217 struct sk_buff
*skb
, *skb2
;
218 struct net_device
*prev_dev
= NULL
;
219 int present_fcs_len
= 0;
223 * First, we may need to make a copy of the skb because
224 * (1) we need to modify it for radiotap (if not present), and
225 * (2) the other RX handlers will modify the skb we got.
227 * We don't need to, of course, if we aren't going to return
228 * the SKB because it has a bad FCS/PLCP checksum.
230 if (status
->flag
& RX_FLAG_RADIOTAP
)
231 rtap_len
= ieee80211_get_radiotap_len(origskb
->data
);
233 /* room for the radiotap header based on driver features */
234 needed_headroom
= ieee80211_rx_radiotap_len(local
, status
);
236 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
237 present_fcs_len
= FCS_LEN
;
239 if (!local
->monitors
) {
240 if (should_drop_frame(status
, origskb
, present_fcs_len
,
242 dev_kfree_skb(origskb
);
246 return remove_monitor_info(local
, origskb
, rtap_len
);
249 if (should_drop_frame(status
, origskb
, present_fcs_len
, rtap_len
)) {
250 /* only need to expand headroom if necessary */
255 * This shouldn't trigger often because most devices have an
256 * RX header they pull before we get here, and that should
257 * be big enough for our radiotap information. We should
258 * probably export the length to drivers so that we can have
259 * them allocate enough headroom to start with.
261 if (skb_headroom(skb
) < needed_headroom
&&
262 pskb_expand_head(skb
, needed_headroom
, 0, GFP_ATOMIC
)) {
268 * Need to make a copy and possibly remove radiotap header
269 * and FCS from the original.
271 skb
= skb_copy_expand(origskb
, needed_headroom
, 0, GFP_ATOMIC
);
273 origskb
= remove_monitor_info(local
, origskb
, rtap_len
);
279 /* if necessary, prepend radiotap information */
280 if (!(status
->flag
& RX_FLAG_RADIOTAP
))
281 ieee80211_add_rx_radiotap_header(local
, skb
, status
, rate
,
284 skb_reset_mac_header(skb
);
285 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
286 skb
->pkt_type
= PACKET_OTHERHOST
;
287 skb
->protocol
= htons(ETH_P_802_2
);
289 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
290 if (!netif_running(sdata
->dev
))
293 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_MNTR
)
296 if (sdata
->u
.mntr_flags
& MONITOR_FLAG_COOK_FRAMES
)
300 skb2
= skb_clone(skb
, GFP_ATOMIC
);
302 skb2
->dev
= prev_dev
;
307 prev_dev
= sdata
->dev
;
308 sdata
->dev
->stats
.rx_packets
++;
309 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
322 static void ieee80211_parse_qos(struct ieee80211_rx_data
*rx
)
324 u8
*data
= rx
->skb
->data
;
327 /* does the frame have a qos control field? */
328 if (WLAN_FC_IS_QOS_DATA(rx
->fc
)) {
329 u8
*qc
= data
+ ieee80211_get_hdrlen(rx
->fc
) - QOS_CONTROL_LEN
;
330 /* frame has qos control */
331 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
332 if (qc
[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT
)
333 rx
->flags
|= IEEE80211_RX_AMSDU
;
335 rx
->flags
&= ~IEEE80211_RX_AMSDU
;
337 if (unlikely((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
)) {
338 /* Separate TID for management frames */
339 tid
= NUM_RX_DATA_QUEUES
- 1;
341 /* no qos control present */
342 tid
= 0; /* 802.1d - Best Effort */
347 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
348 * For now, set skb->priority to 0 for other cases. */
349 rx
->skb
->priority
= (tid
> 7) ? 0 : tid
;
352 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data
*rx
)
354 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
357 if (!WLAN_FC_DATA_PRESENT(rx
->fc
))
361 * Drivers are required to align the payload data in a way that
362 * guarantees that the contained IP header is aligned to a four-
363 * byte boundary. In the case of regular frames, this simply means
364 * aligning the payload to a four-byte boundary (because either
365 * the IP header is directly contained, or IV/RFC1042 headers that
366 * have a length divisible by four are in front of it.
368 * With A-MSDU frames, however, the payload data address must
369 * yield two modulo four because there are 14-byte 802.3 headers
370 * within the A-MSDU frames that push the IP header further back
371 * to a multiple of four again. Thankfully, the specs were sane
372 * enough this time around to require padding each A-MSDU subframe
373 * to a length that is a multiple of four.
375 * Padding like atheros hardware adds which is inbetween the 802.11
376 * header and the payload is not supported, the driver is required
377 * to move the 802.11 header further back in that case.
379 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
380 if (rx
->flags
& IEEE80211_RX_AMSDU
)
382 WARN_ON_ONCE(((unsigned long)(rx
->skb
->data
+ hdrlen
)) & 3);
389 static ieee80211_rx_result
390 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data
*rx
)
392 struct ieee80211_local
*local
= rx
->local
;
393 struct sk_buff
*skb
= rx
->skb
;
395 if (unlikely(local
->sta_hw_scanning
))
396 return ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->status
);
398 if (unlikely(local
->sta_sw_scanning
)) {
399 /* drop all the other packets during a software scan anyway */
400 if (ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->status
)
406 if (unlikely(rx
->flags
& IEEE80211_RX_IN_SCAN
)) {
407 /* scanning finished during invoking of handlers */
408 I802_DEBUG_INC(local
->rx_handlers_drop_passive_scan
);
409 return RX_DROP_UNUSABLE
;
415 static ieee80211_rx_result
416 ieee80211_rx_mesh_check(struct ieee80211_rx_data
*rx
)
418 int hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
419 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
421 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
423 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
) {
424 if (!((rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
425 (rx
->fc
& IEEE80211_FCTL_TODS
)))
426 return RX_DROP_MONITOR
;
427 if (memcmp(hdr
->addr4
, rx
->dev
->dev_addr
, ETH_ALEN
) == 0)
428 return RX_DROP_MONITOR
;
431 /* If there is not an established peer link and this is not a peer link
432 * establisment frame, beacon or probe, drop the frame.
435 if (!rx
->sta
|| sta_plink_state(rx
->sta
) != PLINK_ESTAB
) {
436 struct ieee80211_mgmt
*mgmt
;
438 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
)
439 return RX_DROP_MONITOR
;
441 switch (rx
->fc
& IEEE80211_FCTL_STYPE
) {
442 case IEEE80211_STYPE_ACTION
:
443 mgmt
= (struct ieee80211_mgmt
*)hdr
;
444 if (mgmt
->u
.action
.category
!= PLINK_CATEGORY
)
445 return RX_DROP_MONITOR
;
446 /* fall through on else */
447 case IEEE80211_STYPE_PROBE_REQ
:
448 case IEEE80211_STYPE_PROBE_RESP
:
449 case IEEE80211_STYPE_BEACON
:
453 return RX_DROP_MONITOR
;
456 } else if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
457 is_multicast_ether_addr(hdr
->addr1
) &&
458 mesh_rmc_check(hdr
->addr4
, msh_h_get(hdr
, hdrlen
), rx
->dev
))
459 return RX_DROP_MONITOR
;
466 static ieee80211_rx_result
467 ieee80211_rx_h_check(struct ieee80211_rx_data
*rx
)
469 struct ieee80211_hdr
*hdr
;
471 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
473 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
474 if (rx
->sta
&& !is_multicast_ether_addr(hdr
->addr1
)) {
475 if (unlikely(rx
->fc
& IEEE80211_FCTL_RETRY
&&
476 rx
->sta
->last_seq_ctrl
[rx
->queue
] ==
478 if (rx
->flags
& IEEE80211_RX_RA_MATCH
) {
479 rx
->local
->dot11FrameDuplicateCount
++;
480 rx
->sta
->num_duplicates
++;
482 return RX_DROP_MONITOR
;
484 rx
->sta
->last_seq_ctrl
[rx
->queue
] = hdr
->seq_ctrl
;
487 if (unlikely(rx
->skb
->len
< 16)) {
488 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_short
);
489 return RX_DROP_MONITOR
;
492 /* Drop disallowed frame classes based on STA auth/assoc state;
493 * IEEE 802.11, Chap 5.5.
495 * 80211.o does filtering only based on association state, i.e., it
496 * drops Class 3 frames from not associated stations. hostapd sends
497 * deauth/disassoc frames when needed. In addition, hostapd is
498 * responsible for filtering on both auth and assoc states.
501 if (ieee80211_vif_is_mesh(&rx
->sdata
->vif
))
502 return ieee80211_rx_mesh_check(rx
);
504 if (unlikely(((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
||
505 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_CTL
&&
506 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_PSPOLL
)) &&
507 rx
->sdata
->vif
.type
!= IEEE80211_IF_TYPE_IBSS
&&
508 (!rx
->sta
|| !test_sta_flags(rx
->sta
, WLAN_STA_ASSOC
)))) {
509 if ((!(rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
510 !(rx
->fc
& IEEE80211_FCTL_TODS
) &&
511 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
)
512 || !(rx
->flags
& IEEE80211_RX_RA_MATCH
)) {
513 /* Drop IBSS frames and frames for other hosts
515 return RX_DROP_MONITOR
;
518 return RX_DROP_MONITOR
;
525 static ieee80211_rx_result
526 ieee80211_rx_h_decrypt(struct ieee80211_rx_data
*rx
)
528 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
531 ieee80211_rx_result result
= RX_DROP_UNUSABLE
;
532 struct ieee80211_key
*stakey
= NULL
;
537 * There are three types of keys:
539 * - PTK (pairwise keys)
540 * - STK (station-to-station pairwise keys)
542 * When selecting a key, we have to distinguish between multicast
543 * (including broadcast) and unicast frames, the latter can only
544 * use PTKs and STKs while the former always use GTKs. Unless, of
545 * course, actual WEP keys ("pre-RSNA") are used, then unicast
546 * frames can also use key indizes like GTKs. Hence, if we don't
547 * have a PTK/STK we check the key index for a WEP key.
549 * Note that in a regular BSS, multicast frames are sent by the
550 * AP only, associated stations unicast the frame to the AP first
551 * which then multicasts it on their behalf.
553 * There is also a slight problem in IBSS mode: GTKs are negotiated
554 * with each station, that is something we don't currently handle.
555 * The spec seems to expect that one negotiates the same key with
556 * every station but there's no such requirement; VLANs could be
560 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
))
564 * No point in finding a key and decrypting if the frame is neither
565 * addressed to us nor a multicast frame.
567 if (!(rx
->flags
& IEEE80211_RX_RA_MATCH
))
571 stakey
= rcu_dereference(rx
->sta
->key
);
573 if (!is_multicast_ether_addr(hdr
->addr1
) && stakey
) {
577 * The device doesn't give us the IV so we won't be
578 * able to look up the key. That's ok though, we
579 * don't need to decrypt the frame, we just won't
580 * be able to keep statistics accurate.
581 * Except for key threshold notifications, should
582 * we somehow allow the driver to tell us which key
583 * the hardware used if this flag is set?
585 if ((rx
->status
->flag
& RX_FLAG_DECRYPTED
) &&
586 (rx
->status
->flag
& RX_FLAG_IV_STRIPPED
))
589 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
591 if (rx
->skb
->len
< 8 + hdrlen
)
592 return RX_DROP_UNUSABLE
; /* TODO: count this? */
595 * no need to call ieee80211_wep_get_keyidx,
596 * it verifies a bunch of things we've done already
598 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
600 rx
->key
= rcu_dereference(rx
->sdata
->keys
[keyidx
]);
603 * RSNA-protected unicast frames should always be sent with
604 * pairwise or station-to-station keys, but for WEP we allow
605 * using a key index as well.
607 if (rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
&&
608 !is_multicast_ether_addr(hdr
->addr1
))
613 rx
->key
->tx_rx_count
++;
614 /* TODO: add threshold stuff again */
616 #ifdef CONFIG_MAC80211_DEBUG
618 printk(KERN_DEBUG
"%s: RX protected frame,"
619 " but have no key\n", rx
->dev
->name
);
620 #endif /* CONFIG_MAC80211_DEBUG */
621 return RX_DROP_MONITOR
;
624 /* Check for weak IVs if possible */
625 if (rx
->sta
&& rx
->key
->conf
.alg
== ALG_WEP
&&
626 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
) &&
627 (!(rx
->status
->flag
& RX_FLAG_IV_STRIPPED
) ||
628 !(rx
->status
->flag
& RX_FLAG_DECRYPTED
)) &&
629 ieee80211_wep_is_weak_iv(rx
->skb
, rx
->key
))
630 rx
->sta
->wep_weak_iv_count
++;
632 switch (rx
->key
->conf
.alg
) {
634 result
= ieee80211_crypto_wep_decrypt(rx
);
637 result
= ieee80211_crypto_tkip_decrypt(rx
);
640 result
= ieee80211_crypto_ccmp_decrypt(rx
);
644 /* either the frame has been decrypted or will be dropped */
645 rx
->status
->flag
|= RX_FLAG_DECRYPTED
;
650 static void ap_sta_ps_start(struct net_device
*dev
, struct sta_info
*sta
)
652 struct ieee80211_sub_if_data
*sdata
;
653 DECLARE_MAC_BUF(mac
);
658 atomic_inc(&sdata
->bss
->num_sta_ps
);
659 set_and_clear_sta_flags(sta
, WLAN_STA_PS
, WLAN_STA_PSPOLL
);
660 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
661 printk(KERN_DEBUG
"%s: STA %s aid %d enters power save mode\n",
662 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
663 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
666 static int ap_sta_ps_end(struct net_device
*dev
, struct sta_info
*sta
)
668 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
671 struct ieee80211_sub_if_data
*sdata
;
672 struct ieee80211_tx_info
*info
;
673 DECLARE_MAC_BUF(mac
);
678 atomic_dec(&sdata
->bss
->num_sta_ps
);
680 clear_sta_flags(sta
, WLAN_STA_PS
| WLAN_STA_PSPOLL
);
682 if (!skb_queue_empty(&sta
->ps_tx_buf
))
683 sta_info_clear_tim_bit(sta
);
685 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
686 printk(KERN_DEBUG
"%s: STA %s aid %d exits power save mode\n",
687 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
688 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
690 /* Send all buffered frames to the station */
691 while ((skb
= skb_dequeue(&sta
->tx_filtered
)) != NULL
) {
692 info
= IEEE80211_SKB_CB(skb
);
694 info
->flags
|= IEEE80211_TX_CTL_REQUEUE
;
697 while ((skb
= skb_dequeue(&sta
->ps_tx_buf
)) != NULL
) {
698 info
= IEEE80211_SKB_CB(skb
);
699 local
->total_ps_buffered
--;
701 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
702 printk(KERN_DEBUG
"%s: STA %s aid %d send PS frame "
703 "since STA not sleeping anymore\n", dev
->name
,
704 print_mac(mac
, sta
->addr
), sta
->aid
);
705 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
706 info
->flags
|= IEEE80211_TX_CTL_REQUEUE
;
713 static ieee80211_rx_result
714 ieee80211_rx_h_sta_process(struct ieee80211_rx_data
*rx
)
716 struct sta_info
*sta
= rx
->sta
;
717 struct net_device
*dev
= rx
->dev
;
718 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
723 /* Update last_rx only for IBSS packets which are for the current
724 * BSSID to avoid keeping the current IBSS network alive in cases where
725 * other STAs are using different BSSID. */
726 if (rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_IBSS
) {
727 u8
*bssid
= ieee80211_get_bssid(hdr
, rx
->skb
->len
,
728 IEEE80211_IF_TYPE_IBSS
);
729 if (compare_ether_addr(bssid
, rx
->sdata
->u
.sta
.bssid
) == 0)
730 sta
->last_rx
= jiffies
;
732 if (!is_multicast_ether_addr(hdr
->addr1
) ||
733 rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_STA
) {
734 /* Update last_rx only for unicast frames in order to prevent
735 * the Probe Request frames (the only broadcast frames from a
736 * STA in infrastructure mode) from keeping a connection alive.
737 * Mesh beacons will update last_rx when if they are found to
738 * match the current local configuration when processed.
740 sta
->last_rx
= jiffies
;
743 if (!(rx
->flags
& IEEE80211_RX_RA_MATCH
))
747 sta
->rx_bytes
+= rx
->skb
->len
;
748 sta
->last_signal
= rx
->status
->signal
;
749 sta
->last_qual
= rx
->status
->qual
;
750 sta
->last_noise
= rx
->status
->noise
;
752 if (!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
)) {
753 /* Change STA power saving mode only in the end of a frame
754 * exchange sequence */
755 if (test_sta_flags(sta
, WLAN_STA_PS
) &&
756 !(rx
->fc
& IEEE80211_FCTL_PM
))
757 rx
->sent_ps_buffered
+= ap_sta_ps_end(dev
, sta
);
758 else if (!test_sta_flags(sta
, WLAN_STA_PS
) &&
759 (rx
->fc
& IEEE80211_FCTL_PM
))
760 ap_sta_ps_start(dev
, sta
);
763 /* Drop data::nullfunc frames silently, since they are used only to
764 * control station power saving mode. */
765 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
766 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_NULLFUNC
) {
767 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_nullfunc
);
768 /* Update counter and free packet here to avoid counting this
769 * as a dropped packed. */
771 dev_kfree_skb(rx
->skb
);
776 } /* ieee80211_rx_h_sta_process */
778 static inline struct ieee80211_fragment_entry
*
779 ieee80211_reassemble_add(struct ieee80211_sub_if_data
*sdata
,
780 unsigned int frag
, unsigned int seq
, int rx_queue
,
781 struct sk_buff
**skb
)
783 struct ieee80211_fragment_entry
*entry
;
786 idx
= sdata
->fragment_next
;
787 entry
= &sdata
->fragments
[sdata
->fragment_next
++];
788 if (sdata
->fragment_next
>= IEEE80211_FRAGMENT_MAX
)
789 sdata
->fragment_next
= 0;
791 if (!skb_queue_empty(&entry
->skb_list
)) {
792 #ifdef CONFIG_MAC80211_DEBUG
793 struct ieee80211_hdr
*hdr
=
794 (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
795 DECLARE_MAC_BUF(mac
);
796 DECLARE_MAC_BUF(mac2
);
797 printk(KERN_DEBUG
"%s: RX reassembly removed oldest "
798 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
799 "addr1=%s addr2=%s\n",
800 sdata
->dev
->name
, idx
,
801 jiffies
- entry
->first_frag_time
, entry
->seq
,
802 entry
->last_frag
, print_mac(mac
, hdr
->addr1
),
803 print_mac(mac2
, hdr
->addr2
));
804 #endif /* CONFIG_MAC80211_DEBUG */
805 __skb_queue_purge(&entry
->skb_list
);
808 __skb_queue_tail(&entry
->skb_list
, *skb
); /* no need for locking */
810 entry
->first_frag_time
= jiffies
;
812 entry
->rx_queue
= rx_queue
;
813 entry
->last_frag
= frag
;
815 entry
->extra_len
= 0;
820 static inline struct ieee80211_fragment_entry
*
821 ieee80211_reassemble_find(struct ieee80211_sub_if_data
*sdata
,
822 u16 fc
, unsigned int frag
, unsigned int seq
,
823 int rx_queue
, struct ieee80211_hdr
*hdr
)
825 struct ieee80211_fragment_entry
*entry
;
828 idx
= sdata
->fragment_next
;
829 for (i
= 0; i
< IEEE80211_FRAGMENT_MAX
; i
++) {
830 struct ieee80211_hdr
*f_hdr
;
835 idx
= IEEE80211_FRAGMENT_MAX
- 1;
837 entry
= &sdata
->fragments
[idx
];
838 if (skb_queue_empty(&entry
->skb_list
) || entry
->seq
!= seq
||
839 entry
->rx_queue
!= rx_queue
||
840 entry
->last_frag
+ 1 != frag
)
843 f_hdr
= (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
844 f_fc
= le16_to_cpu(f_hdr
->frame_control
);
846 if ((fc
& IEEE80211_FCTL_FTYPE
) != (f_fc
& IEEE80211_FCTL_FTYPE
) ||
847 compare_ether_addr(hdr
->addr1
, f_hdr
->addr1
) != 0 ||
848 compare_ether_addr(hdr
->addr2
, f_hdr
->addr2
) != 0)
851 if (time_after(jiffies
, entry
->first_frag_time
+ 2 * HZ
)) {
852 __skb_queue_purge(&entry
->skb_list
);
861 static ieee80211_rx_result
862 ieee80211_rx_h_defragment(struct ieee80211_rx_data
*rx
)
864 struct ieee80211_hdr
*hdr
;
866 unsigned int frag
, seq
;
867 struct ieee80211_fragment_entry
*entry
;
869 DECLARE_MAC_BUF(mac
);
871 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
872 sc
= le16_to_cpu(hdr
->seq_ctrl
);
873 frag
= sc
& IEEE80211_SCTL_FRAG
;
875 if (likely((!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) && frag
== 0) ||
876 (rx
->skb
)->len
< 24 ||
877 is_multicast_ether_addr(hdr
->addr1
))) {
881 I802_DEBUG_INC(rx
->local
->rx_handlers_fragments
);
883 seq
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
886 /* This is the first fragment of a new frame. */
887 entry
= ieee80211_reassemble_add(rx
->sdata
, frag
, seq
,
888 rx
->queue
, &(rx
->skb
));
889 if (rx
->key
&& rx
->key
->conf
.alg
== ALG_CCMP
&&
890 (rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
891 /* Store CCMP PN so that we can verify that the next
892 * fragment has a sequential PN value. */
894 memcpy(entry
->last_pn
,
895 rx
->key
->u
.ccmp
.rx_pn
[rx
->queue
],
901 /* This is a fragment for a frame that should already be pending in
902 * fragment cache. Add this fragment to the end of the pending entry.
904 entry
= ieee80211_reassemble_find(rx
->sdata
, rx
->fc
, frag
, seq
,
907 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
908 return RX_DROP_MONITOR
;
911 /* Verify that MPDUs within one MSDU have sequential PN values.
912 * (IEEE 802.11i, 8.3.3.4.5) */
915 u8 pn
[CCMP_PN_LEN
], *rpn
;
916 if (!rx
->key
|| rx
->key
->conf
.alg
!= ALG_CCMP
)
917 return RX_DROP_UNUSABLE
;
918 memcpy(pn
, entry
->last_pn
, CCMP_PN_LEN
);
919 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
924 rpn
= rx
->key
->u
.ccmp
.rx_pn
[rx
->queue
];
925 if (memcmp(pn
, rpn
, CCMP_PN_LEN
) != 0) {
927 printk(KERN_DEBUG
"%s: defrag: CCMP PN not "
929 " PN=%02x%02x%02x%02x%02x%02x "
930 "(expected %02x%02x%02x%02x%02x%02x)\n",
931 rx
->dev
->name
, print_mac(mac
, hdr
->addr2
),
932 rpn
[0], rpn
[1], rpn
[2], rpn
[3], rpn
[4],
933 rpn
[5], pn
[0], pn
[1], pn
[2], pn
[3],
935 return RX_DROP_UNUSABLE
;
937 memcpy(entry
->last_pn
, pn
, CCMP_PN_LEN
);
940 skb_pull(rx
->skb
, ieee80211_get_hdrlen(rx
->fc
));
941 __skb_queue_tail(&entry
->skb_list
, rx
->skb
);
942 entry
->last_frag
= frag
;
943 entry
->extra_len
+= rx
->skb
->len
;
944 if (rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) {
949 rx
->skb
= __skb_dequeue(&entry
->skb_list
);
950 if (skb_tailroom(rx
->skb
) < entry
->extra_len
) {
951 I802_DEBUG_INC(rx
->local
->rx_expand_skb_head2
);
952 if (unlikely(pskb_expand_head(rx
->skb
, 0, entry
->extra_len
,
954 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
955 __skb_queue_purge(&entry
->skb_list
);
956 return RX_DROP_UNUSABLE
;
959 while ((skb
= __skb_dequeue(&entry
->skb_list
))) {
960 memcpy(skb_put(rx
->skb
, skb
->len
), skb
->data
, skb
->len
);
964 /* Complete frame has been reassembled - process it now */
965 rx
->flags
|= IEEE80211_RX_FRAGMENTED
;
969 rx
->sta
->rx_packets
++;
970 if (is_multicast_ether_addr(hdr
->addr1
))
971 rx
->local
->dot11MulticastReceivedFrameCount
++;
973 ieee80211_led_rx(rx
->local
);
977 static ieee80211_rx_result
978 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data
*rx
)
980 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
983 DECLARE_MAC_BUF(mac
);
985 if (likely(!rx
->sta
||
986 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
||
987 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_PSPOLL
||
988 !(rx
->flags
& IEEE80211_RX_RA_MATCH
)))
991 if ((sdata
->vif
.type
!= IEEE80211_IF_TYPE_AP
) &&
992 (sdata
->vif
.type
!= IEEE80211_IF_TYPE_VLAN
))
993 return RX_DROP_UNUSABLE
;
995 skb
= skb_dequeue(&rx
->sta
->tx_filtered
);
997 skb
= skb_dequeue(&rx
->sta
->ps_tx_buf
);
999 rx
->local
->total_ps_buffered
--;
1001 no_pending_pkts
= skb_queue_empty(&rx
->sta
->tx_filtered
) &&
1002 skb_queue_empty(&rx
->sta
->ps_tx_buf
);
1005 struct ieee80211_hdr
*hdr
=
1006 (struct ieee80211_hdr
*) skb
->data
;
1009 * Tell TX path to send one frame even though the STA may
1010 * still remain is PS mode after this frame exchange.
1012 set_sta_flags(rx
->sta
, WLAN_STA_PSPOLL
);
1014 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1015 printk(KERN_DEBUG
"STA %s aid %d: PS Poll (entries after %d)\n",
1016 print_mac(mac
, rx
->sta
->addr
), rx
->sta
->aid
,
1017 skb_queue_len(&rx
->sta
->ps_tx_buf
));
1018 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1020 /* Use MoreData flag to indicate whether there are more
1021 * buffered frames for this STA */
1022 if (no_pending_pkts
)
1023 hdr
->frame_control
&= cpu_to_le16(~IEEE80211_FCTL_MOREDATA
);
1025 hdr
->frame_control
|= cpu_to_le16(IEEE80211_FCTL_MOREDATA
);
1027 dev_queue_xmit(skb
);
1029 if (no_pending_pkts
)
1030 sta_info_clear_tim_bit(rx
->sta
);
1031 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1032 } else if (!rx
->sent_ps_buffered
) {
1034 * FIXME: This can be the result of a race condition between
1035 * us expiring a frame and the station polling for it.
1036 * Should we send it a null-func frame indicating we
1037 * have nothing buffered for it?
1039 printk(KERN_DEBUG
"%s: STA %s sent PS Poll even "
1040 "though there is no buffered frames for it\n",
1041 rx
->dev
->name
, print_mac(mac
, rx
->sta
->addr
));
1042 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1045 /* Free PS Poll skb here instead of returning RX_DROP that would
1046 * count as an dropped frame. */
1047 dev_kfree_skb(rx
->skb
);
1052 static ieee80211_rx_result
1053 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data
*rx
)
1056 u8
*data
= rx
->skb
->data
;
1057 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) data
;
1059 if (!WLAN_FC_IS_QOS_DATA(fc
))
1062 /* remove the qos control field, update frame type and meta-data */
1063 memmove(data
+ 2, data
, ieee80211_get_hdrlen(fc
) - 2);
1064 hdr
= (struct ieee80211_hdr
*) skb_pull(rx
->skb
, 2);
1065 /* change frame type to non QOS */
1066 rx
->fc
= fc
&= ~IEEE80211_STYPE_QOS_DATA
;
1067 hdr
->frame_control
= cpu_to_le16(fc
);
1073 ieee80211_802_1x_port_control(struct ieee80211_rx_data
*rx
)
1075 if (unlikely(!rx
->sta
||
1076 !test_sta_flags(rx
->sta
, WLAN_STA_AUTHORIZED
))) {
1077 #ifdef CONFIG_MAC80211_DEBUG
1078 if (net_ratelimit())
1079 printk(KERN_DEBUG
"%s: dropped frame "
1080 "(unauthorized port)\n", rx
->dev
->name
);
1081 #endif /* CONFIG_MAC80211_DEBUG */
1089 ieee80211_drop_unencrypted(struct ieee80211_rx_data
*rx
)
1092 * Pass through unencrypted frames if the hardware has
1093 * decrypted them already.
1095 if (rx
->status
->flag
& RX_FLAG_DECRYPTED
)
1098 /* Drop unencrypted frames if key is set. */
1099 if (unlikely(!(rx
->fc
& IEEE80211_FCTL_PROTECTED
) &&
1100 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
1101 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
1102 (rx
->key
|| rx
->sdata
->drop_unencrypted
)))
1109 ieee80211_data_to_8023(struct ieee80211_rx_data
*rx
)
1111 struct net_device
*dev
= rx
->dev
;
1112 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
1113 u16 fc
, hdrlen
, ethertype
;
1116 u8 src
[ETH_ALEN
] __aligned(2);
1117 struct sk_buff
*skb
= rx
->skb
;
1118 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1119 DECLARE_MAC_BUF(mac
);
1120 DECLARE_MAC_BUF(mac2
);
1121 DECLARE_MAC_BUF(mac3
);
1122 DECLARE_MAC_BUF(mac4
);
1126 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1129 hdrlen
= ieee80211_get_hdrlen(fc
);
1131 if (ieee80211_vif_is_mesh(&sdata
->vif
)) {
1132 int meshhdrlen
= ieee80211_get_mesh_hdrlen(
1133 (struct ieee80211s_hdr
*) (skb
->data
+ hdrlen
));
1135 * - mesh header: to be used for mesh forwarding
1136 * decision. It will also be used as mesh header template at
1137 * tx.c:ieee80211_subif_start_xmit() if interface
1138 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
1139 * - ta: to be used if a RERR needs to be sent.
1141 memcpy(skb
->cb
, skb
->data
+ hdrlen
, meshhdrlen
);
1142 memcpy(MESH_PREQ(skb
), hdr
->addr2
, ETH_ALEN
);
1143 hdrlen
+= meshhdrlen
;
1146 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1148 * IEEE 802.11 address fields:
1149 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1150 * 0 0 DA SA BSSID n/a
1151 * 0 1 DA BSSID SA n/a
1152 * 1 0 BSSID SA DA n/a
1156 switch (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) {
1157 case IEEE80211_FCTL_TODS
:
1159 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1160 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1162 if (unlikely(sdata
->vif
.type
!= IEEE80211_IF_TYPE_AP
&&
1163 sdata
->vif
.type
!= IEEE80211_IF_TYPE_VLAN
)) {
1164 if (net_ratelimit())
1165 printk(KERN_DEBUG
"%s: dropped ToDS frame "
1166 "(BSSID=%s SA=%s DA=%s)\n",
1168 print_mac(mac
, hdr
->addr1
),
1169 print_mac(mac2
, hdr
->addr2
),
1170 print_mac(mac3
, hdr
->addr3
));
1174 case (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
):
1176 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1177 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
1179 if (unlikely(sdata
->vif
.type
!= IEEE80211_IF_TYPE_WDS
&&
1180 sdata
->vif
.type
!= IEEE80211_IF_TYPE_MESH_POINT
)) {
1181 if (net_ratelimit())
1182 printk(KERN_DEBUG
"%s: dropped FromDS&ToDS "
1183 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1185 print_mac(mac
, hdr
->addr1
),
1186 print_mac(mac2
, hdr
->addr2
),
1187 print_mac(mac3
, hdr
->addr3
),
1188 print_mac(mac4
, hdr
->addr4
));
1192 case IEEE80211_FCTL_FROMDS
:
1194 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1195 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
1197 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_STA
||
1198 (is_multicast_ether_addr(dst
) &&
1199 !compare_ether_addr(src
, dev
->dev_addr
)))
1204 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1205 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1207 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_IBSS
) {
1208 if (net_ratelimit()) {
1209 printk(KERN_DEBUG
"%s: dropped IBSS frame "
1210 "(DA=%s SA=%s BSSID=%s)\n",
1212 print_mac(mac
, hdr
->addr1
),
1213 print_mac(mac2
, hdr
->addr2
),
1214 print_mac(mac3
, hdr
->addr3
));
1221 if (unlikely(skb
->len
- hdrlen
< 8)) {
1222 if (net_ratelimit()) {
1223 printk(KERN_DEBUG
"%s: RX too short data frame "
1224 "payload\n", dev
->name
);
1229 payload
= skb
->data
+ hdrlen
;
1230 ethertype
= (payload
[6] << 8) | payload
[7];
1232 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1233 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1234 compare_ether_addr(payload
, bridge_tunnel_header
) == 0)) {
1235 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1236 * replace EtherType */
1237 skb_pull(skb
, hdrlen
+ 6);
1238 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1239 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1241 struct ethhdr
*ehdr
;
1244 skb_pull(skb
, hdrlen
);
1245 len
= htons(skb
->len
);
1246 ehdr
= (struct ethhdr
*) skb_push(skb
, sizeof(struct ethhdr
));
1247 memcpy(ehdr
->h_dest
, dst
, ETH_ALEN
);
1248 memcpy(ehdr
->h_source
, src
, ETH_ALEN
);
1249 ehdr
->h_proto
= len
;
1255 * requires that rx->skb is a frame with ethernet header
1257 static bool ieee80211_frame_allowed(struct ieee80211_rx_data
*rx
)
1259 static const u8 pae_group_addr
[ETH_ALEN
] __aligned(2)
1260 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1261 struct ethhdr
*ehdr
= (struct ethhdr
*) rx
->skb
->data
;
1264 * Allow EAPOL frames to us/the PAE group address regardless
1265 * of whether the frame was encrypted or not.
1267 if (ehdr
->h_proto
== htons(ETH_P_PAE
) &&
1268 (compare_ether_addr(ehdr
->h_dest
, rx
->dev
->dev_addr
) == 0 ||
1269 compare_ether_addr(ehdr
->h_dest
, pae_group_addr
) == 0))
1272 if (ieee80211_802_1x_port_control(rx
) ||
1273 ieee80211_drop_unencrypted(rx
))
1280 * requires that rx->skb is a frame with ethernet header
1283 ieee80211_deliver_skb(struct ieee80211_rx_data
*rx
)
1285 struct net_device
*dev
= rx
->dev
;
1286 struct ieee80211_local
*local
= rx
->local
;
1287 struct sk_buff
*skb
, *xmit_skb
;
1288 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1289 struct ethhdr
*ehdr
= (struct ethhdr
*) rx
->skb
->data
;
1290 struct sta_info
*dsta
;
1295 if (local
->bridge_packets
&& (sdata
->vif
.type
== IEEE80211_IF_TYPE_AP
||
1296 sdata
->vif
.type
== IEEE80211_IF_TYPE_VLAN
) &&
1297 (rx
->flags
& IEEE80211_RX_RA_MATCH
)) {
1298 if (is_multicast_ether_addr(ehdr
->h_dest
)) {
1300 * send multicast frames both to higher layers in
1301 * local net stack and back to the wireless medium
1303 xmit_skb
= skb_copy(skb
, GFP_ATOMIC
);
1304 if (!xmit_skb
&& net_ratelimit())
1305 printk(KERN_DEBUG
"%s: failed to clone "
1306 "multicast frame\n", dev
->name
);
1308 dsta
= sta_info_get(local
, skb
->data
);
1309 if (dsta
&& dsta
->sdata
->dev
== dev
) {
1311 * The destination station is associated to
1312 * this AP (in this VLAN), so send the frame
1313 * directly to it and do not pass it to local
1322 /* Mesh forwarding */
1323 if (ieee80211_vif_is_mesh(&sdata
->vif
)) {
1324 u8
*mesh_ttl
= &((struct ieee80211s_hdr
*)skb
->cb
)->ttl
;
1327 if (is_multicast_ether_addr(skb
->data
)) {
1328 if (*mesh_ttl
> 0) {
1329 xmit_skb
= skb_copy(skb
, GFP_ATOMIC
);
1331 xmit_skb
->pkt_type
= PACKET_OTHERHOST
;
1332 else if (net_ratelimit())
1333 printk(KERN_DEBUG
"%s: failed to clone "
1334 "multicast frame\n", dev
->name
);
1336 IEEE80211_IFSTA_MESH_CTR_INC(&sdata
->u
.sta
,
1337 dropped_frames_ttl
);
1338 } else if (skb
->pkt_type
!= PACKET_OTHERHOST
&&
1339 compare_ether_addr(dev
->dev_addr
, skb
->data
) != 0) {
1340 if (*mesh_ttl
== 0) {
1341 IEEE80211_IFSTA_MESH_CTR_INC(&sdata
->u
.sta
,
1342 dropped_frames_ttl
);
1347 xmit_skb
->pkt_type
= PACKET_OTHERHOST
;
1348 if (!(dev
->flags
& IFF_PROMISC
))
1355 /* deliver to local stack */
1356 skb
->protocol
= eth_type_trans(skb
, dev
);
1357 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1362 /* send to wireless media */
1363 xmit_skb
->protocol
= htons(ETH_P_802_3
);
1364 skb_reset_network_header(xmit_skb
);
1365 skb_reset_mac_header(xmit_skb
);
1366 dev_queue_xmit(xmit_skb
);
1370 static ieee80211_rx_result
1371 ieee80211_rx_h_amsdu(struct ieee80211_rx_data
*rx
)
1373 struct net_device
*dev
= rx
->dev
;
1374 struct ieee80211_local
*local
= rx
->local
;
1377 struct sk_buff
*skb
= rx
->skb
, *frame
= NULL
;
1378 const struct ethhdr
*eth
;
1382 DECLARE_MAC_BUF(mac
);
1385 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1388 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1389 return RX_DROP_MONITOR
;
1391 if (!(rx
->flags
& IEEE80211_RX_AMSDU
))
1394 err
= ieee80211_data_to_8023(rx
);
1396 return RX_DROP_UNUSABLE
;
1400 dev
->stats
.rx_packets
++;
1401 dev
->stats
.rx_bytes
+= skb
->len
;
1403 /* skip the wrapping header */
1404 eth
= (struct ethhdr
*) skb_pull(skb
, sizeof(struct ethhdr
));
1406 return RX_DROP_UNUSABLE
;
1408 while (skb
!= frame
) {
1410 __be16 len
= eth
->h_proto
;
1411 unsigned int subframe_len
= sizeof(struct ethhdr
) + ntohs(len
);
1413 remaining
= skb
->len
;
1414 memcpy(dst
, eth
->h_dest
, ETH_ALEN
);
1415 memcpy(src
, eth
->h_source
, ETH_ALEN
);
1417 padding
= ((4 - subframe_len
) & 0x3);
1418 /* the last MSDU has no padding */
1419 if (subframe_len
> remaining
) {
1420 printk(KERN_DEBUG
"%s: wrong buffer size\n", dev
->name
);
1421 return RX_DROP_UNUSABLE
;
1424 skb_pull(skb
, sizeof(struct ethhdr
));
1425 /* if last subframe reuse skb */
1426 if (remaining
<= subframe_len
+ padding
)
1429 frame
= dev_alloc_skb(local
->hw
.extra_tx_headroom
+
1433 return RX_DROP_UNUSABLE
;
1435 skb_reserve(frame
, local
->hw
.extra_tx_headroom
+
1436 sizeof(struct ethhdr
));
1437 memcpy(skb_put(frame
, ntohs(len
)), skb
->data
,
1440 eth
= (struct ethhdr
*) skb_pull(skb
, ntohs(len
) +
1443 printk(KERN_DEBUG
"%s: wrong buffer size\n",
1445 dev_kfree_skb(frame
);
1446 return RX_DROP_UNUSABLE
;
1450 skb_reset_network_header(frame
);
1452 frame
->priority
= skb
->priority
;
1455 payload
= frame
->data
;
1456 ethertype
= (payload
[6] << 8) | payload
[7];
1458 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1459 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1460 compare_ether_addr(payload
,
1461 bridge_tunnel_header
) == 0)) {
1462 /* remove RFC1042 or Bridge-Tunnel
1463 * encapsulation and replace EtherType */
1465 memcpy(skb_push(frame
, ETH_ALEN
), src
, ETH_ALEN
);
1466 memcpy(skb_push(frame
, ETH_ALEN
), dst
, ETH_ALEN
);
1468 memcpy(skb_push(frame
, sizeof(__be16
)),
1469 &len
, sizeof(__be16
));
1470 memcpy(skb_push(frame
, ETH_ALEN
), src
, ETH_ALEN
);
1471 memcpy(skb_push(frame
, ETH_ALEN
), dst
, ETH_ALEN
);
1474 if (!ieee80211_frame_allowed(rx
)) {
1475 if (skb
== frame
) /* last frame */
1476 return RX_DROP_UNUSABLE
;
1477 dev_kfree_skb(frame
);
1481 ieee80211_deliver_skb(rx
);
1487 static ieee80211_rx_result
1488 ieee80211_rx_h_data(struct ieee80211_rx_data
*rx
)
1490 struct net_device
*dev
= rx
->dev
;
1495 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1498 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1499 return RX_DROP_MONITOR
;
1501 err
= ieee80211_data_to_8023(rx
);
1503 return RX_DROP_UNUSABLE
;
1505 if (!ieee80211_frame_allowed(rx
))
1506 return RX_DROP_MONITOR
;
1510 dev
->stats
.rx_packets
++;
1511 dev
->stats
.rx_bytes
+= rx
->skb
->len
;
1513 ieee80211_deliver_skb(rx
);
1518 static ieee80211_rx_result
1519 ieee80211_rx_h_ctrl(struct ieee80211_rx_data
*rx
)
1521 struct ieee80211_local
*local
= rx
->local
;
1522 struct ieee80211_hw
*hw
= &local
->hw
;
1523 struct sk_buff
*skb
= rx
->skb
;
1524 struct ieee80211_bar
*bar
= (struct ieee80211_bar
*) skb
->data
;
1525 struct tid_ampdu_rx
*tid_agg_rx
;
1529 if (likely((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
))
1532 if ((rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_BACK_REQ
) {
1535 tid
= le16_to_cpu(bar
->control
) >> 12;
1536 if (rx
->sta
->ampdu_mlme
.tid_state_rx
[tid
]
1537 != HT_AGG_STATE_OPERATIONAL
)
1539 tid_agg_rx
= rx
->sta
->ampdu_mlme
.tid_rx
[tid
];
1541 start_seq_num
= le16_to_cpu(bar
->start_seq_num
) >> 4;
1543 /* reset session timer */
1544 if (tid_agg_rx
->timeout
) {
1545 unsigned long expires
=
1546 jiffies
+ (tid_agg_rx
->timeout
/ 1000) * HZ
;
1547 mod_timer(&tid_agg_rx
->session_timer
, expires
);
1550 /* manage reordering buffer according to requested */
1551 /* sequence number */
1553 ieee80211_sta_manage_reorder_buf(hw
, tid_agg_rx
, NULL
,
1556 return RX_DROP_UNUSABLE
;
1562 static ieee80211_rx_result
1563 ieee80211_rx_h_mgmt(struct ieee80211_rx_data
*rx
)
1565 struct ieee80211_sub_if_data
*sdata
;
1567 if (!(rx
->flags
& IEEE80211_RX_RA_MATCH
))
1568 return RX_DROP_MONITOR
;
1570 sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
1571 if ((sdata
->vif
.type
== IEEE80211_IF_TYPE_STA
||
1572 sdata
->vif
.type
== IEEE80211_IF_TYPE_IBSS
||
1573 sdata
->vif
.type
== IEEE80211_IF_TYPE_MESH_POINT
) &&
1574 !(sdata
->flags
& IEEE80211_SDATA_USERSPACE_MLME
))
1575 ieee80211_sta_rx_mgmt(rx
->dev
, rx
->skb
, rx
->status
);
1577 return RX_DROP_MONITOR
;
1582 static void ieee80211_rx_michael_mic_report(struct net_device
*dev
,
1583 struct ieee80211_hdr
*hdr
,
1584 struct ieee80211_rx_data
*rx
)
1587 DECLARE_MAC_BUF(mac
);
1588 DECLARE_MAC_BUF(mac2
);
1590 hdrlen
= ieee80211_get_hdrlen_from_skb(rx
->skb
);
1591 if (rx
->skb
->len
>= hdrlen
+ 4)
1592 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
1596 if (net_ratelimit())
1597 printk(KERN_DEBUG
"%s: TKIP hwaccel reported Michael MIC "
1598 "failure from %s to %s keyidx=%d\n",
1599 dev
->name
, print_mac(mac
, hdr
->addr2
),
1600 print_mac(mac2
, hdr
->addr1
), keyidx
);
1604 * Some hardware seem to generate incorrect Michael MIC
1605 * reports; ignore them to avoid triggering countermeasures.
1607 if (net_ratelimit())
1608 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1609 "error for unknown address %s\n",
1610 dev
->name
, print_mac(mac
, hdr
->addr2
));
1614 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
1615 if (net_ratelimit())
1616 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1617 "error for a frame with no PROTECTED flag (src "
1618 "%s)\n", dev
->name
, print_mac(mac
, hdr
->addr2
));
1622 if (rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_AP
&& keyidx
) {
1624 * APs with pairwise keys should never receive Michael MIC
1625 * errors for non-zero keyidx because these are reserved for
1626 * group keys and only the AP is sending real multicast
1627 * frames in the BSS.
1629 if (net_ratelimit())
1630 printk(KERN_DEBUG
"%s: ignored Michael MIC error for "
1631 "a frame with non-zero keyidx (%d)"
1632 " (src %s)\n", dev
->name
, keyidx
,
1633 print_mac(mac
, hdr
->addr2
));
1637 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
1638 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
1639 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)) {
1640 if (net_ratelimit())
1641 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1642 "error for a frame that cannot be encrypted "
1643 "(fc=0x%04x) (src %s)\n",
1644 dev
->name
, rx
->fc
, print_mac(mac
, hdr
->addr2
));
1648 mac80211_ev_michael_mic_failure(rx
->dev
, keyidx
, hdr
);
1650 dev_kfree_skb(rx
->skb
);
1654 /* TODO: use IEEE80211_RX_FRAGMENTED */
1655 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data
*rx
)
1657 struct ieee80211_sub_if_data
*sdata
;
1658 struct ieee80211_local
*local
= rx
->local
;
1659 struct ieee80211_rtap_hdr
{
1660 struct ieee80211_radiotap_header hdr
;
1665 } __attribute__ ((packed
)) *rthdr
;
1666 struct sk_buff
*skb
= rx
->skb
, *skb2
;
1667 struct net_device
*prev_dev
= NULL
;
1668 struct ieee80211_rx_status
*status
= rx
->status
;
1670 if (rx
->flags
& IEEE80211_RX_CMNTR_REPORTED
)
1673 if (skb_headroom(skb
) < sizeof(*rthdr
) &&
1674 pskb_expand_head(skb
, sizeof(*rthdr
), 0, GFP_ATOMIC
))
1677 rthdr
= (void *)skb_push(skb
, sizeof(*rthdr
));
1678 memset(rthdr
, 0, sizeof(*rthdr
));
1679 rthdr
->hdr
.it_len
= cpu_to_le16(sizeof(*rthdr
));
1680 rthdr
->hdr
.it_present
=
1681 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
1682 (1 << IEEE80211_RADIOTAP_RATE
) |
1683 (1 << IEEE80211_RADIOTAP_CHANNEL
));
1685 rthdr
->rate
= rx
->rate
->bitrate
/ 5;
1686 rthdr
->chan_freq
= cpu_to_le16(status
->freq
);
1688 if (status
->band
== IEEE80211_BAND_5GHZ
)
1689 rthdr
->chan_flags
= cpu_to_le16(IEEE80211_CHAN_OFDM
|
1690 IEEE80211_CHAN_5GHZ
);
1692 rthdr
->chan_flags
= cpu_to_le16(IEEE80211_CHAN_DYN
|
1693 IEEE80211_CHAN_2GHZ
);
1695 skb_set_mac_header(skb
, 0);
1696 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
1697 skb
->pkt_type
= PACKET_OTHERHOST
;
1698 skb
->protocol
= htons(ETH_P_802_2
);
1700 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1701 if (!netif_running(sdata
->dev
))
1704 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_MNTR
||
1705 !(sdata
->u
.mntr_flags
& MONITOR_FLAG_COOK_FRAMES
))
1709 skb2
= skb_clone(skb
, GFP_ATOMIC
);
1711 skb2
->dev
= prev_dev
;
1716 prev_dev
= sdata
->dev
;
1717 sdata
->dev
->stats
.rx_packets
++;
1718 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
1722 skb
->dev
= prev_dev
;
1728 rx
->flags
|= IEEE80211_RX_CMNTR_REPORTED
;
1735 typedef ieee80211_rx_result (*ieee80211_rx_handler
)(struct ieee80211_rx_data
*);
1736 static ieee80211_rx_handler ieee80211_rx_handlers
[] =
1738 ieee80211_rx_h_passive_scan
,
1739 ieee80211_rx_h_check
,
1740 ieee80211_rx_h_decrypt
,
1741 ieee80211_rx_h_sta_process
,
1742 ieee80211_rx_h_defragment
,
1743 ieee80211_rx_h_ps_poll
,
1744 ieee80211_rx_h_michael_mic_verify
,
1745 /* this must be after decryption - so header is counted in MPDU mic
1746 * must be before pae and data, so QOS_DATA format frames
1747 * are not passed to user space by these functions
1749 ieee80211_rx_h_remove_qos_control
,
1750 ieee80211_rx_h_amsdu
,
1751 ieee80211_rx_h_data
,
1752 ieee80211_rx_h_ctrl
,
1753 ieee80211_rx_h_mgmt
,
1757 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data
*sdata
,
1758 struct ieee80211_rx_data
*rx
,
1759 struct sk_buff
*skb
)
1761 ieee80211_rx_handler
*handler
;
1762 ieee80211_rx_result res
= RX_DROP_MONITOR
;
1766 rx
->dev
= sdata
->dev
;
1768 for (handler
= ieee80211_rx_handlers
; *handler
!= NULL
; handler
++) {
1769 res
= (*handler
)(rx
);
1774 case RX_DROP_UNUSABLE
:
1775 case RX_DROP_MONITOR
:
1776 I802_DEBUG_INC(sdata
->local
->rx_handlers_drop
);
1778 rx
->sta
->rx_dropped
++;
1781 I802_DEBUG_INC(sdata
->local
->rx_handlers_queued
);
1789 case RX_DROP_MONITOR
:
1790 ieee80211_rx_cooked_monitor(rx
);
1792 case RX_DROP_UNUSABLE
:
1793 dev_kfree_skb(rx
->skb
);
1798 /* main receive path */
1800 static int prepare_for_handlers(struct ieee80211_sub_if_data
*sdata
,
1801 u8
*bssid
, struct ieee80211_rx_data
*rx
,
1802 struct ieee80211_hdr
*hdr
)
1804 int multicast
= is_multicast_ether_addr(hdr
->addr1
);
1806 switch (sdata
->vif
.type
) {
1807 case IEEE80211_IF_TYPE_STA
:
1810 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1811 if (!(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1813 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1814 } else if (!multicast
&&
1815 compare_ether_addr(sdata
->dev
->dev_addr
,
1817 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1819 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1822 case IEEE80211_IF_TYPE_IBSS
:
1825 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
&&
1826 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_BEACON
) {
1828 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
,
1829 rx
->skb
, bssid
, hdr
->addr2
,
1830 BIT(rx
->status
->rate_idx
));
1833 else if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1834 if (!(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1836 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1837 } else if (!multicast
&&
1838 compare_ether_addr(sdata
->dev
->dev_addr
,
1840 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1842 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1843 } else if (!rx
->sta
)
1844 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
, rx
->skb
,
1846 BIT(rx
->status
->rate_idx
));
1848 case IEEE80211_IF_TYPE_MESH_POINT
:
1850 compare_ether_addr(sdata
->dev
->dev_addr
,
1852 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1855 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1858 case IEEE80211_IF_TYPE_VLAN
:
1859 case IEEE80211_IF_TYPE_AP
:
1861 if (compare_ether_addr(sdata
->dev
->dev_addr
,
1864 } else if (!ieee80211_bssid_match(bssid
,
1865 sdata
->dev
->dev_addr
)) {
1866 if (!(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1868 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1870 if (sdata
->dev
== sdata
->local
->mdev
&&
1871 !(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1872 /* do not receive anything via
1873 * master device when not scanning */
1876 case IEEE80211_IF_TYPE_WDS
:
1878 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
)
1880 if (compare_ether_addr(sdata
->u
.wds
.remote_addr
, hdr
->addr2
))
1883 case IEEE80211_IF_TYPE_MNTR
:
1884 /* take everything */
1886 case IEEE80211_IF_TYPE_INVALID
:
1887 /* should never get here */
1896 * This is the actual Rx frames handler. as it blongs to Rx path it must
1897 * be called with rcu_read_lock protection.
1899 static void __ieee80211_rx_handle_packet(struct ieee80211_hw
*hw
,
1900 struct sk_buff
*skb
,
1901 struct ieee80211_rx_status
*status
,
1902 struct ieee80211_rate
*rate
)
1904 struct ieee80211_local
*local
= hw_to_local(hw
);
1905 struct ieee80211_sub_if_data
*sdata
;
1906 struct ieee80211_hdr
*hdr
;
1907 struct ieee80211_rx_data rx
;
1910 struct ieee80211_sub_if_data
*prev
= NULL
;
1911 struct sk_buff
*skb_new
;
1914 hdr
= (struct ieee80211_hdr
*) skb
->data
;
1915 memset(&rx
, 0, sizeof(rx
));
1921 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1922 type
= rx
.fc
& IEEE80211_FCTL_FTYPE
;
1924 if (type
== IEEE80211_FTYPE_DATA
|| type
== IEEE80211_FTYPE_MGMT
)
1925 local
->dot11ReceivedFragmentCount
++;
1927 rx
.sta
= sta_info_get(local
, hdr
->addr2
);
1929 rx
.sdata
= rx
.sta
->sdata
;
1930 rx
.dev
= rx
.sta
->sdata
->dev
;
1933 if ((status
->flag
& RX_FLAG_MMIC_ERROR
)) {
1934 ieee80211_rx_michael_mic_report(local
->mdev
, hdr
, &rx
);
1938 if (unlikely(local
->sta_sw_scanning
|| local
->sta_hw_scanning
))
1939 rx
.flags
|= IEEE80211_RX_IN_SCAN
;
1941 ieee80211_parse_qos(&rx
);
1942 ieee80211_verify_ip_alignment(&rx
);
1946 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1947 if (!netif_running(sdata
->dev
))
1950 if (sdata
->vif
.type
== IEEE80211_IF_TYPE_MNTR
)
1953 bssid
= ieee80211_get_bssid(hdr
, skb
->len
, sdata
->vif
.type
);
1954 rx
.flags
|= IEEE80211_RX_RA_MATCH
;
1955 prepares
= prepare_for_handlers(sdata
, bssid
, &rx
, hdr
);
1961 * frame is destined for this interface, but if it's not
1962 * also for the previous one we handle that after the
1963 * loop to avoid copying the SKB once too much
1972 * frame was destined for the previous interface
1973 * so invoke RX handlers for it
1976 skb_new
= skb_copy(skb
, GFP_ATOMIC
);
1978 if (net_ratelimit())
1979 printk(KERN_DEBUG
"%s: failed to copy "
1980 "multicast frame for %s\n",
1981 wiphy_name(local
->hw
.wiphy
),
1985 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1986 ieee80211_invoke_rx_handlers(prev
, &rx
, skb_new
);
1990 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1991 ieee80211_invoke_rx_handlers(prev
, &rx
, skb
);
1996 #define SEQ_MODULO 0x1000
1997 #define SEQ_MASK 0xfff
1999 static inline int seq_less(u16 sq1
, u16 sq2
)
2001 return (((sq1
- sq2
) & SEQ_MASK
) > (SEQ_MODULO
>> 1));
2004 static inline u16
seq_inc(u16 sq
)
2006 return ((sq
+ 1) & SEQ_MASK
);
2009 static inline u16
seq_sub(u16 sq1
, u16 sq2
)
2011 return ((sq1
- sq2
) & SEQ_MASK
);
2016 * As it function blongs to Rx path it must be called with
2017 * the proper rcu_read_lock protection for its flow.
2019 u8
ieee80211_sta_manage_reorder_buf(struct ieee80211_hw
*hw
,
2020 struct tid_ampdu_rx
*tid_agg_rx
,
2021 struct sk_buff
*skb
, u16 mpdu_seq_num
,
2024 struct ieee80211_local
*local
= hw_to_local(hw
);
2025 struct ieee80211_rx_status status
;
2026 u16 head_seq_num
, buf_size
;
2028 struct ieee80211_supported_band
*sband
;
2029 struct ieee80211_rate
*rate
;
2031 buf_size
= tid_agg_rx
->buf_size
;
2032 head_seq_num
= tid_agg_rx
->head_seq_num
;
2034 /* frame with out of date sequence number */
2035 if (seq_less(mpdu_seq_num
, head_seq_num
)) {
2040 /* if frame sequence number exceeds our buffering window size or
2041 * block Ack Request arrived - release stored frames */
2042 if ((!seq_less(mpdu_seq_num
, head_seq_num
+ buf_size
)) || (bar_req
)) {
2043 /* new head to the ordering buffer */
2045 head_seq_num
= mpdu_seq_num
;
2048 seq_inc(seq_sub(mpdu_seq_num
, buf_size
));
2049 /* release stored frames up to new head to stack */
2050 while (seq_less(tid_agg_rx
->head_seq_num
, head_seq_num
)) {
2051 index
= seq_sub(tid_agg_rx
->head_seq_num
,
2053 % tid_agg_rx
->buf_size
;
2055 if (tid_agg_rx
->reorder_buf
[index
]) {
2056 /* release the reordered frames to stack */
2058 tid_agg_rx
->reorder_buf
[index
]->cb
,
2060 sband
= local
->hw
.wiphy
->bands
[status
.band
];
2061 rate
= &sband
->bitrates
[status
.rate_idx
];
2062 __ieee80211_rx_handle_packet(hw
,
2063 tid_agg_rx
->reorder_buf
[index
],
2065 tid_agg_rx
->stored_mpdu_num
--;
2066 tid_agg_rx
->reorder_buf
[index
] = NULL
;
2068 tid_agg_rx
->head_seq_num
=
2069 seq_inc(tid_agg_rx
->head_seq_num
);
2075 /* now the new frame is always in the range of the reordering */
2077 index
= seq_sub(mpdu_seq_num
, tid_agg_rx
->ssn
)
2078 % tid_agg_rx
->buf_size
;
2079 /* check if we already stored this frame */
2080 if (tid_agg_rx
->reorder_buf
[index
]) {
2085 /* if arrived mpdu is in the right order and nothing else stored */
2086 /* release it immediately */
2087 if (mpdu_seq_num
== tid_agg_rx
->head_seq_num
&&
2088 tid_agg_rx
->stored_mpdu_num
== 0) {
2089 tid_agg_rx
->head_seq_num
=
2090 seq_inc(tid_agg_rx
->head_seq_num
);
2094 /* put the frame in the reordering buffer */
2095 tid_agg_rx
->reorder_buf
[index
] = skb
;
2096 tid_agg_rx
->stored_mpdu_num
++;
2097 /* release the buffer until next missing frame */
2098 index
= seq_sub(tid_agg_rx
->head_seq_num
, tid_agg_rx
->ssn
)
2099 % tid_agg_rx
->buf_size
;
2100 while (tid_agg_rx
->reorder_buf
[index
]) {
2101 /* release the reordered frame back to stack */
2102 memcpy(&status
, tid_agg_rx
->reorder_buf
[index
]->cb
,
2104 sband
= local
->hw
.wiphy
->bands
[status
.band
];
2105 rate
= &sband
->bitrates
[status
.rate_idx
];
2106 __ieee80211_rx_handle_packet(hw
, tid_agg_rx
->reorder_buf
[index
],
2108 tid_agg_rx
->stored_mpdu_num
--;
2109 tid_agg_rx
->reorder_buf
[index
] = NULL
;
2110 tid_agg_rx
->head_seq_num
= seq_inc(tid_agg_rx
->head_seq_num
);
2111 index
= seq_sub(tid_agg_rx
->head_seq_num
,
2112 tid_agg_rx
->ssn
) % tid_agg_rx
->buf_size
;
2117 static u8
ieee80211_rx_reorder_ampdu(struct ieee80211_local
*local
,
2118 struct sk_buff
*skb
)
2120 struct ieee80211_hw
*hw
= &local
->hw
;
2121 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
2122 struct sta_info
*sta
;
2123 struct tid_ampdu_rx
*tid_agg_rx
;
2129 sta
= sta_info_get(local
, hdr
->addr2
);
2133 /* filter the QoS data rx stream according to
2134 * STA/TID and check if this STA/TID is on aggregation */
2135 if (!ieee80211_is_data_qos(hdr
->frame_control
))
2138 tid
= *ieee80211_get_qos_ctl(hdr
) & QOS_CONTROL_TID_MASK
;
2140 if (sta
->ampdu_mlme
.tid_state_rx
[tid
] != HT_AGG_STATE_OPERATIONAL
)
2143 tid_agg_rx
= sta
->ampdu_mlme
.tid_rx
[tid
];
2145 /* null data frames are excluded */
2146 if (unlikely(ieee80211_is_nullfunc(hdr
->frame_control
)))
2149 /* new un-ordered ampdu frame - process it */
2151 /* reset session timer */
2152 if (tid_agg_rx
->timeout
) {
2153 unsigned long expires
=
2154 jiffies
+ (tid_agg_rx
->timeout
/ 1000) * HZ
;
2155 mod_timer(&tid_agg_rx
->session_timer
, expires
);
2158 /* if this mpdu is fragmented - terminate rx aggregation session */
2159 sc
= le16_to_cpu(hdr
->seq_ctrl
);
2160 if (sc
& IEEE80211_SCTL_FRAG
) {
2161 ieee80211_sta_stop_rx_ba_session(sta
->sdata
->dev
, sta
->addr
,
2162 tid
, 0, WLAN_REASON_QSTA_REQUIRE_SETUP
);
2167 /* according to mpdu sequence number deal with reordering buffer */
2168 mpdu_seq_num
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
2169 ret
= ieee80211_sta_manage_reorder_buf(hw
, tid_agg_rx
, skb
,
2176 * This is the receive path handler. It is called by a low level driver when an
2177 * 802.11 MPDU is received from the hardware.
2179 void __ieee80211_rx(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
2180 struct ieee80211_rx_status
*status
)
2182 struct ieee80211_local
*local
= hw_to_local(hw
);
2183 struct ieee80211_rate
*rate
= NULL
;
2184 struct ieee80211_supported_band
*sband
;
2186 if (status
->band
< 0 ||
2187 status
->band
>= IEEE80211_NUM_BANDS
) {
2192 sband
= local
->hw
.wiphy
->bands
[status
->band
];
2195 status
->rate_idx
< 0 ||
2196 status
->rate_idx
>= sband
->n_bitrates
) {
2201 rate
= &sband
->bitrates
[status
->rate_idx
];
2204 * key references and virtual interfaces are protected using RCU
2205 * and this requires that we are in a read-side RCU section during
2206 * receive processing
2211 * Frames with failed FCS/PLCP checksum are not returned,
2212 * all other frames are returned without radiotap header
2213 * if it was previously present.
2214 * Also, frames with less than 16 bytes are dropped.
2216 skb
= ieee80211_rx_monitor(local
, skb
, status
, rate
);
2222 if (!ieee80211_rx_reorder_ampdu(local
, skb
))
2223 __ieee80211_rx_handle_packet(hw
, skb
, status
, rate
);
2227 EXPORT_SYMBOL(__ieee80211_rx
);
2229 /* This is a version of the rx handler that can be called from hard irq
2230 * context. Post the skb on the queue and schedule the tasklet */
2231 void ieee80211_rx_irqsafe(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
2232 struct ieee80211_rx_status
*status
)
2234 struct ieee80211_local
*local
= hw_to_local(hw
);
2236 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status
) > sizeof(skb
->cb
));
2238 skb
->dev
= local
->mdev
;
2239 /* copy status into skb->cb for use by tasklet */
2240 memcpy(skb
->cb
, status
, sizeof(*status
));
2241 skb
->pkt_type
= IEEE80211_RX_MSG
;
2242 skb_queue_tail(&local
->skb_queue
, skb
);
2243 tasklet_schedule(&local
->tasklet
);
2245 EXPORT_SYMBOL(ieee80211_rx_irqsafe
);