2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <net/mac80211.h>
17 #include <net/ieee80211_radiotap.h>
19 #include "ieee80211_i.h"
20 #include "ieee80211_led.h"
21 #include "ieee80211_common.h"
29 * these don't have dev/sdata fields in the rx data
30 * The sta value should also not be used because it may
31 * be NULL even though a STA (in IBSS mode) will be added.
34 static ieee80211_txrx_result
35 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data
*rx
)
37 u8
*data
= rx
->skb
->data
;
40 /* does the frame have a qos control field? */
41 if (WLAN_FC_IS_QOS_DATA(rx
->fc
)) {
42 u8
*qc
= data
+ ieee80211_get_hdrlen(rx
->fc
) - QOS_CONTROL_LEN
;
43 /* frame has qos control */
44 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
46 if (unlikely((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
)) {
47 /* Separate TID for management frames */
48 tid
= NUM_RX_DATA_QUEUES
- 1;
50 /* no qos control present */
51 tid
= 0; /* 802.1d - Best Effort */
55 I802_DEBUG_INC(rx
->local
->wme_rx_queue
[tid
]);
56 /* only a debug counter, sta might not be assigned properly yet */
58 I802_DEBUG_INC(rx
->sta
->wme_rx_queue
[tid
]);
61 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
62 * For now, set skb->priority to 0 for other cases. */
63 rx
->skb
->priority
= (tid
> 7) ? 0 : tid
;
68 static ieee80211_txrx_result
69 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data
*rx
)
71 struct ieee80211_local
*local
= rx
->local
;
72 struct sk_buff
*skb
= rx
->skb
;
73 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
74 u32 load
= 0, hdrtime
;
75 struct ieee80211_rate
*rate
;
76 struct ieee80211_hw_mode
*mode
= local
->hw
.conf
.mode
;
79 /* Estimate total channel use caused by this frame */
81 if (unlikely(mode
->num_rates
< 0))
84 rate
= &mode
->rates
[0];
85 for (i
= 0; i
< mode
->num_rates
; i
++) {
86 if (mode
->rates
[i
].val
== rx
->u
.rx
.status
->rate
) {
87 rate
= &mode
->rates
[i
];
92 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
93 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
95 if (mode
->mode
== MODE_IEEE80211A
||
96 mode
->mode
== MODE_ATHEROS_TURBO
||
97 mode
->mode
== MODE_ATHEROS_TURBOG
||
98 (mode
->mode
== MODE_IEEE80211G
&&
99 rate
->flags
& IEEE80211_RATE_ERP
))
100 hdrtime
= CHAN_UTIL_HDR_SHORT
;
102 hdrtime
= CHAN_UTIL_HDR_LONG
;
105 if (!is_multicast_ether_addr(hdr
->addr1
))
108 load
+= skb
->len
* rate
->rate_inv
;
110 /* Divide channel_use by 8 to avoid wrapping around the counter */
111 load
>>= CHAN_UTIL_SHIFT
;
112 local
->channel_use_raw
+= load
;
113 rx
->u
.rx
.load
= load
;
115 return TXRX_CONTINUE
;
118 ieee80211_rx_handler ieee80211_rx_pre_handlers
[] =
120 ieee80211_rx_h_parse_qos
,
121 ieee80211_rx_h_load_stats
,
127 static ieee80211_txrx_result
128 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data
*rx
)
131 rx
->sta
->channel_use_raw
+= rx
->u
.rx
.load
;
132 rx
->sdata
->channel_use_raw
+= rx
->u
.rx
.load
;
133 return TXRX_CONTINUE
;
137 ieee80211_rx_monitor(struct net_device
*dev
, struct sk_buff
*skb
,
138 struct ieee80211_rx_status
*status
)
140 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
141 struct ieee80211_sub_if_data
*sdata
;
142 struct ieee80211_rate
*rate
;
143 struct ieee80211_rtap_hdr
{
144 struct ieee80211_radiotap_header hdr
;
150 } __attribute__ ((packed
)) *rthdr
;
154 sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
156 if (status
->flag
& RX_FLAG_RADIOTAP
)
159 if (skb_headroom(skb
) < sizeof(*rthdr
)) {
160 I802_DEBUG_INC(local
->rx_expand_skb_head
);
161 if (pskb_expand_head(skb
, sizeof(*rthdr
), 0, GFP_ATOMIC
)) {
167 rthdr
= (struct ieee80211_rtap_hdr
*) skb_push(skb
, sizeof(*rthdr
));
168 memset(rthdr
, 0, sizeof(*rthdr
));
169 rthdr
->hdr
.it_len
= cpu_to_le16(sizeof(*rthdr
));
170 rthdr
->hdr
.it_present
=
171 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
172 (1 << IEEE80211_RADIOTAP_RATE
) |
173 (1 << IEEE80211_RADIOTAP_CHANNEL
) |
174 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL
));
175 rthdr
->flags
= local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
?
176 IEEE80211_RADIOTAP_F_FCS
: 0;
177 rate
= ieee80211_get_rate(local
, status
->phymode
, status
->rate
);
179 rthdr
->rate
= rate
->rate
/ 5;
180 rthdr
->chan_freq
= cpu_to_le16(status
->freq
);
182 status
->phymode
== MODE_IEEE80211A
?
183 cpu_to_le16(IEEE80211_CHAN_OFDM
| IEEE80211_CHAN_5GHZ
) :
184 cpu_to_le16(IEEE80211_CHAN_DYN
| IEEE80211_CHAN_2GHZ
);
185 rthdr
->antsignal
= status
->ssi
;
188 sdata
->stats
.rx_packets
++;
189 sdata
->stats
.rx_bytes
+= skb
->len
;
191 skb_set_mac_header(skb
, 0);
192 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
193 skb
->pkt_type
= PACKET_OTHERHOST
;
194 skb
->protocol
= htons(ETH_P_802_2
);
195 memset(skb
->cb
, 0, sizeof(skb
->cb
));
199 static ieee80211_txrx_result
200 ieee80211_rx_h_monitor(struct ieee80211_txrx_data
*rx
)
202 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_MNTR
) {
203 ieee80211_rx_monitor(rx
->dev
, rx
->skb
, rx
->u
.rx
.status
);
207 if (rx
->u
.rx
.status
->flag
& RX_FLAG_RADIOTAP
)
208 skb_pull(rx
->skb
, ieee80211_get_radiotap_len(rx
->skb
->data
));
210 return TXRX_CONTINUE
;
213 static ieee80211_txrx_result
214 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data
*rx
)
216 struct ieee80211_local
*local
= rx
->local
;
217 struct sk_buff
*skb
= rx
->skb
;
219 if (unlikely(local
->sta_scanning
!= 0)) {
220 ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->u
.rx
.status
);
224 if (unlikely(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
)) {
225 /* scanning finished during invoking of handlers */
226 I802_DEBUG_INC(local
->rx_handlers_drop_passive_scan
);
230 return TXRX_CONTINUE
;
233 static ieee80211_txrx_result
234 ieee80211_rx_h_check(struct ieee80211_txrx_data
*rx
)
236 struct ieee80211_hdr
*hdr
;
237 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
239 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
240 if (rx
->sta
&& !is_multicast_ether_addr(hdr
->addr1
)) {
241 if (unlikely(rx
->fc
& IEEE80211_FCTL_RETRY
&&
242 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] ==
244 if (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
) {
245 rx
->local
->dot11FrameDuplicateCount
++;
246 rx
->sta
->num_duplicates
++;
250 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] = hdr
->seq_ctrl
;
253 if ((rx
->local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
) &&
254 rx
->skb
->len
> FCS_LEN
)
255 skb_trim(rx
->skb
, rx
->skb
->len
- FCS_LEN
);
257 if (unlikely(rx
->skb
->len
< 16)) {
258 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_short
);
262 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
263 rx
->skb
->pkt_type
= PACKET_OTHERHOST
;
264 else if (compare_ether_addr(rx
->dev
->dev_addr
, hdr
->addr1
) == 0)
265 rx
->skb
->pkt_type
= PACKET_HOST
;
266 else if (is_multicast_ether_addr(hdr
->addr1
)) {
267 if (is_broadcast_ether_addr(hdr
->addr1
))
268 rx
->skb
->pkt_type
= PACKET_BROADCAST
;
270 rx
->skb
->pkt_type
= PACKET_MULTICAST
;
272 rx
->skb
->pkt_type
= PACKET_OTHERHOST
;
274 /* Drop disallowed frame classes based on STA auth/assoc state;
275 * IEEE 802.11, Chap 5.5.
277 * 80211.o does filtering only based on association state, i.e., it
278 * drops Class 3 frames from not associated stations. hostapd sends
279 * deauth/disassoc frames when needed. In addition, hostapd is
280 * responsible for filtering on both auth and assoc states.
282 if (unlikely(((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
||
283 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_CTL
&&
284 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_PSPOLL
)) &&
285 rx
->sdata
->type
!= IEEE80211_IF_TYPE_IBSS
&&
286 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_ASSOC
)))) {
287 if ((!(rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
288 !(rx
->fc
& IEEE80211_FCTL_TODS
) &&
289 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
)
290 || !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
291 /* Drop IBSS frames and frames for other hosts
296 if (!rx
->local
->apdev
)
299 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
300 ieee80211_msg_sta_not_assoc
);
304 return TXRX_CONTINUE
;
308 static ieee80211_txrx_result
309 ieee80211_rx_h_load_key(struct ieee80211_txrx_data
*rx
)
311 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
318 * There are three types of keys:
320 * - PTK (pairwise keys)
321 * - STK (station-to-station pairwise keys)
323 * When selecting a key, we have to distinguish between multicast
324 * (including broadcast) and unicast frames, the latter can only
325 * use PTKs and STKs while the former always use GTKs. Unless, of
326 * course, actual WEP keys ("pre-RSNA") are used, then unicast
327 * frames can also use key indizes like GTKs. Hence, if we don't
328 * have a PTK/STK we check the key index for a WEP key.
330 * There is also a slight problem in IBSS mode: GTKs are negotiated
331 * with each station, that is something we don't currently handle.
334 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
))
335 return TXRX_CONTINUE
;
338 * No point in finding a key if the frame is neither
339 * addressed to us nor a multicast frame.
341 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
342 return TXRX_CONTINUE
;
344 if (!is_multicast_ether_addr(hdr
->addr1
) && rx
->sta
&& rx
->sta
->key
) {
345 rx
->key
= rx
->sta
->key
;
348 * The device doesn't give us the IV so we won't be
349 * able to look up the key. That's ok though, we
350 * don't need to decrypt the frame, we just won't
351 * be able to keep statistics accurate.
352 * Except for key threshold notifications, should
353 * we somehow allow the driver to tell us which key
354 * the hardware used if this flag is set?
356 if (!(rx
->local
->hw
.flags
& IEEE80211_HW_WEP_INCLUDE_IV
))
357 return TXRX_CONTINUE
;
359 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
361 if (rx
->skb
->len
< 8 + hdrlen
)
362 return TXRX_DROP
; /* TODO: count this? */
365 * no need to call ieee80211_wep_get_keyidx,
366 * it verifies a bunch of things we've done already
368 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
370 rx
->key
= rx
->sdata
->keys
[keyidx
];
373 * RSNA-protected unicast frames should always be sent with
374 * pairwise or station-to-station keys, but for WEP we allow
375 * using a key index as well.
377 if (rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
&&
378 !is_multicast_ether_addr(hdr
->addr1
))
383 rx
->key
->tx_rx_count
++;
384 if (unlikely(rx
->local
->key_tx_rx_threshold
&&
385 rx
->key
->tx_rx_count
>
386 rx
->local
->key_tx_rx_threshold
)) {
387 ieee80211_key_threshold_notify(rx
->dev
, rx
->key
,
392 return TXRX_CONTINUE
;
395 static void ap_sta_ps_start(struct net_device
*dev
, struct sta_info
*sta
)
397 struct ieee80211_sub_if_data
*sdata
;
398 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
401 atomic_inc(&sdata
->bss
->num_sta_ps
);
402 sta
->flags
|= WLAN_STA_PS
;
404 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
405 printk(KERN_DEBUG
"%s: STA " MAC_FMT
" aid %d enters power "
406 "save mode\n", dev
->name
, MAC_ARG(sta
->addr
), sta
->aid
);
407 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
410 static int ap_sta_ps_end(struct net_device
*dev
, struct sta_info
*sta
)
412 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
415 struct ieee80211_sub_if_data
*sdata
;
416 struct ieee80211_tx_packet_data
*pkt_data
;
418 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
420 atomic_dec(&sdata
->bss
->num_sta_ps
);
421 sta
->flags
&= ~(WLAN_STA_PS
| WLAN_STA_TIM
);
423 if (!skb_queue_empty(&sta
->ps_tx_buf
)) {
424 if (local
->ops
->set_tim
)
425 local
->ops
->set_tim(local_to_hw(local
), sta
->aid
, 0);
427 bss_tim_clear(local
, sdata
->bss
, sta
->aid
);
429 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
430 printk(KERN_DEBUG
"%s: STA " MAC_FMT
" aid %d exits power "
431 "save mode\n", dev
->name
, MAC_ARG(sta
->addr
), sta
->aid
);
432 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
433 /* Send all buffered frames to the station */
434 while ((skb
= skb_dequeue(&sta
->tx_filtered
)) != NULL
) {
435 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
437 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
440 while ((skb
= skb_dequeue(&sta
->ps_tx_buf
)) != NULL
) {
441 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
442 local
->total_ps_buffered
--;
444 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
445 printk(KERN_DEBUG
"%s: STA " MAC_FMT
" aid %d send PS frame "
446 "since STA not sleeping anymore\n", dev
->name
,
447 MAC_ARG(sta
->addr
), sta
->aid
);
448 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
449 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
456 static ieee80211_txrx_result
457 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data
*rx
)
459 struct sta_info
*sta
= rx
->sta
;
460 struct net_device
*dev
= rx
->dev
;
461 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
464 return TXRX_CONTINUE
;
466 /* Update last_rx only for IBSS packets which are for the current
467 * BSSID to avoid keeping the current IBSS network alive in cases where
468 * other STAs are using different BSSID. */
469 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_IBSS
) {
470 u8
*bssid
= ieee80211_get_bssid(hdr
, rx
->skb
->len
);
471 if (compare_ether_addr(bssid
, rx
->sdata
->u
.sta
.bssid
) == 0)
472 sta
->last_rx
= jiffies
;
474 if (!is_multicast_ether_addr(hdr
->addr1
) ||
475 rx
->sdata
->type
== IEEE80211_IF_TYPE_STA
) {
476 /* Update last_rx only for unicast frames in order to prevent
477 * the Probe Request frames (the only broadcast frames from a
478 * STA in infrastructure mode) from keeping a connection alive.
480 sta
->last_rx
= jiffies
;
483 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
484 return TXRX_CONTINUE
;
487 sta
->rx_bytes
+= rx
->skb
->len
;
488 sta
->last_rssi
= (sta
->last_rssi
* 15 +
489 rx
->u
.rx
.status
->ssi
) / 16;
490 sta
->last_signal
= (sta
->last_signal
* 15 +
491 rx
->u
.rx
.status
->signal
) / 16;
492 sta
->last_noise
= (sta
->last_noise
* 15 +
493 rx
->u
.rx
.status
->noise
) / 16;
495 if (!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
)) {
496 /* Change STA power saving mode only in the end of a frame
497 * exchange sequence */
498 if ((sta
->flags
& WLAN_STA_PS
) && !(rx
->fc
& IEEE80211_FCTL_PM
))
499 rx
->u
.rx
.sent_ps_buffered
+= ap_sta_ps_end(dev
, sta
);
500 else if (!(sta
->flags
& WLAN_STA_PS
) &&
501 (rx
->fc
& IEEE80211_FCTL_PM
))
502 ap_sta_ps_start(dev
, sta
);
505 /* Drop data::nullfunc frames silently, since they are used only to
506 * control station power saving mode. */
507 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
508 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_NULLFUNC
) {
509 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_nullfunc
);
510 /* Update counter and free packet here to avoid counting this
511 * as a dropped packed. */
513 dev_kfree_skb(rx
->skb
);
517 return TXRX_CONTINUE
;
518 } /* ieee80211_rx_h_sta_process */
520 static ieee80211_txrx_result
521 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data
*rx
)
523 if (!rx
->sta
|| !(rx
->fc
& IEEE80211_FCTL_PROTECTED
) ||
524 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
||
525 !rx
->key
|| rx
->key
->conf
.alg
!= ALG_WEP
||
526 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
527 return TXRX_CONTINUE
;
529 /* Check for weak IVs, if hwaccel did not remove IV from the frame */
530 if ((rx
->local
->hw
.flags
& IEEE80211_HW_WEP_INCLUDE_IV
) ||
531 (rx
->key
->conf
.flags
& IEEE80211_KEY_FORCE_SW_ENCRYPT
))
532 if (ieee80211_wep_is_weak_iv(rx
->skb
, rx
->key
))
533 rx
->sta
->wep_weak_iv_count
++;
535 return TXRX_CONTINUE
;
538 static ieee80211_txrx_result
539 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data
*rx
)
541 if ((rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
) ||
542 !(rx
->fc
& IEEE80211_FCTL_PROTECTED
) ||
543 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
544 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
545 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)))
546 return TXRX_CONTINUE
;
550 printk(KERN_DEBUG
"%s: RX WEP frame, but no key set\n",
555 if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
) ||
556 (rx
->key
->conf
.flags
& IEEE80211_KEY_FORCE_SW_ENCRYPT
)) {
557 if (ieee80211_wep_decrypt(rx
->local
, rx
->skb
, rx
->key
)) {
559 printk(KERN_DEBUG
"%s: RX WEP frame, decrypt "
560 "failed\n", rx
->dev
->name
);
563 } else if (rx
->local
->hw
.flags
& IEEE80211_HW_WEP_INCLUDE_IV
) {
564 ieee80211_wep_remove_iv(rx
->local
, rx
->skb
, rx
->key
);
566 skb_trim(rx
->skb
, rx
->skb
->len
- 4);
569 return TXRX_CONTINUE
;
572 static inline struct ieee80211_fragment_entry
*
573 ieee80211_reassemble_add(struct ieee80211_sub_if_data
*sdata
,
574 unsigned int frag
, unsigned int seq
, int rx_queue
,
575 struct sk_buff
**skb
)
577 struct ieee80211_fragment_entry
*entry
;
580 idx
= sdata
->fragment_next
;
581 entry
= &sdata
->fragments
[sdata
->fragment_next
++];
582 if (sdata
->fragment_next
>= IEEE80211_FRAGMENT_MAX
)
583 sdata
->fragment_next
= 0;
585 if (!skb_queue_empty(&entry
->skb_list
)) {
586 #ifdef CONFIG_MAC80211_DEBUG
587 struct ieee80211_hdr
*hdr
=
588 (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
589 printk(KERN_DEBUG
"%s: RX reassembly removed oldest "
590 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
591 "addr1=" MAC_FMT
" addr2=" MAC_FMT
"\n",
592 sdata
->dev
->name
, idx
,
593 jiffies
- entry
->first_frag_time
, entry
->seq
,
594 entry
->last_frag
, MAC_ARG(hdr
->addr1
),
595 MAC_ARG(hdr
->addr2
));
596 #endif /* CONFIG_MAC80211_DEBUG */
597 __skb_queue_purge(&entry
->skb_list
);
600 __skb_queue_tail(&entry
->skb_list
, *skb
); /* no need for locking */
602 entry
->first_frag_time
= jiffies
;
604 entry
->rx_queue
= rx_queue
;
605 entry
->last_frag
= frag
;
607 entry
->extra_len
= 0;
612 static inline struct ieee80211_fragment_entry
*
613 ieee80211_reassemble_find(struct ieee80211_sub_if_data
*sdata
,
614 u16 fc
, unsigned int frag
, unsigned int seq
,
615 int rx_queue
, struct ieee80211_hdr
*hdr
)
617 struct ieee80211_fragment_entry
*entry
;
620 idx
= sdata
->fragment_next
;
621 for (i
= 0; i
< IEEE80211_FRAGMENT_MAX
; i
++) {
622 struct ieee80211_hdr
*f_hdr
;
627 idx
= IEEE80211_FRAGMENT_MAX
- 1;
629 entry
= &sdata
->fragments
[idx
];
630 if (skb_queue_empty(&entry
->skb_list
) || entry
->seq
!= seq
||
631 entry
->rx_queue
!= rx_queue
||
632 entry
->last_frag
+ 1 != frag
)
635 f_hdr
= (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
636 f_fc
= le16_to_cpu(f_hdr
->frame_control
);
638 if ((fc
& IEEE80211_FCTL_FTYPE
) != (f_fc
& IEEE80211_FCTL_FTYPE
) ||
639 compare_ether_addr(hdr
->addr1
, f_hdr
->addr1
) != 0 ||
640 compare_ether_addr(hdr
->addr2
, f_hdr
->addr2
) != 0)
643 if (entry
->first_frag_time
+ 2 * HZ
< jiffies
) {
644 __skb_queue_purge(&entry
->skb_list
);
653 static ieee80211_txrx_result
654 ieee80211_rx_h_defragment(struct ieee80211_txrx_data
*rx
)
656 struct ieee80211_hdr
*hdr
;
658 unsigned int frag
, seq
;
659 struct ieee80211_fragment_entry
*entry
;
662 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
663 sc
= le16_to_cpu(hdr
->seq_ctrl
);
664 frag
= sc
& IEEE80211_SCTL_FRAG
;
666 if (likely((!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) && frag
== 0) ||
667 (rx
->skb
)->len
< 24 ||
668 is_multicast_ether_addr(hdr
->addr1
))) {
672 I802_DEBUG_INC(rx
->local
->rx_handlers_fragments
);
674 seq
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
677 /* This is the first fragment of a new frame. */
678 entry
= ieee80211_reassemble_add(rx
->sdata
, frag
, seq
,
679 rx
->u
.rx
.queue
, &(rx
->skb
));
680 if (rx
->key
&& rx
->key
->conf
.alg
== ALG_CCMP
&&
681 (rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
682 /* Store CCMP PN so that we can verify that the next
683 * fragment has a sequential PN value. */
685 memcpy(entry
->last_pn
,
686 rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
],
692 /* This is a fragment for a frame that should already be pending in
693 * fragment cache. Add this fragment to the end of the pending entry.
695 entry
= ieee80211_reassemble_find(rx
->sdata
, rx
->fc
, frag
, seq
,
696 rx
->u
.rx
.queue
, hdr
);
698 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
702 /* Verify that MPDUs within one MSDU have sequential PN values.
703 * (IEEE 802.11i, 8.3.3.4.5) */
706 u8 pn
[CCMP_PN_LEN
], *rpn
;
707 if (!rx
->key
|| rx
->key
->conf
.alg
!= ALG_CCMP
)
709 memcpy(pn
, entry
->last_pn
, CCMP_PN_LEN
);
710 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
715 rpn
= rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
];
716 if (memcmp(pn
, rpn
, CCMP_PN_LEN
) != 0) {
718 printk(KERN_DEBUG
"%s: defrag: CCMP PN not "
719 "sequential A2=" MAC_FMT
720 " PN=%02x%02x%02x%02x%02x%02x "
721 "(expected %02x%02x%02x%02x%02x%02x)\n",
722 rx
->dev
->name
, MAC_ARG(hdr
->addr2
),
723 rpn
[0], rpn
[1], rpn
[2], rpn
[3], rpn
[4],
724 rpn
[5], pn
[0], pn
[1], pn
[2], pn
[3],
728 memcpy(entry
->last_pn
, pn
, CCMP_PN_LEN
);
731 skb_pull(rx
->skb
, ieee80211_get_hdrlen(rx
->fc
));
732 __skb_queue_tail(&entry
->skb_list
, rx
->skb
);
733 entry
->last_frag
= frag
;
734 entry
->extra_len
+= rx
->skb
->len
;
735 if (rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) {
740 rx
->skb
= __skb_dequeue(&entry
->skb_list
);
741 if (skb_tailroom(rx
->skb
) < entry
->extra_len
) {
742 I802_DEBUG_INC(rx
->local
->rx_expand_skb_head2
);
743 if (unlikely(pskb_expand_head(rx
->skb
, 0, entry
->extra_len
,
745 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
746 __skb_queue_purge(&entry
->skb_list
);
750 while ((skb
= __skb_dequeue(&entry
->skb_list
))) {
751 memcpy(skb_put(rx
->skb
, skb
->len
), skb
->data
, skb
->len
);
755 /* Complete frame has been reassembled - process it now */
756 rx
->flags
|= IEEE80211_TXRXD_FRAGMENTED
;
760 rx
->sta
->rx_packets
++;
761 if (is_multicast_ether_addr(hdr
->addr1
))
762 rx
->local
->dot11MulticastReceivedFrameCount
++;
764 ieee80211_led_rx(rx
->local
);
765 return TXRX_CONTINUE
;
768 static ieee80211_txrx_result
769 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data
*rx
)
774 if (likely(!rx
->sta
||
775 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
||
776 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_PSPOLL
||
777 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)))
778 return TXRX_CONTINUE
;
780 skb
= skb_dequeue(&rx
->sta
->tx_filtered
);
782 skb
= skb_dequeue(&rx
->sta
->ps_tx_buf
);
784 rx
->local
->total_ps_buffered
--;
786 no_pending_pkts
= skb_queue_empty(&rx
->sta
->tx_filtered
) &&
787 skb_queue_empty(&rx
->sta
->ps_tx_buf
);
790 struct ieee80211_hdr
*hdr
=
791 (struct ieee80211_hdr
*) skb
->data
;
793 /* tell TX path to send one frame even though the STA may
794 * still remain is PS mode after this frame exchange */
797 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
798 printk(KERN_DEBUG
"STA " MAC_FMT
" aid %d: PS Poll (entries "
800 MAC_ARG(rx
->sta
->addr
), rx
->sta
->aid
,
801 skb_queue_len(&rx
->sta
->ps_tx_buf
));
802 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
804 /* Use MoreData flag to indicate whether there are more
805 * buffered frames for this STA */
806 if (no_pending_pkts
) {
807 hdr
->frame_control
&= cpu_to_le16(~IEEE80211_FCTL_MOREDATA
);
808 rx
->sta
->flags
&= ~WLAN_STA_TIM
;
810 hdr
->frame_control
|= cpu_to_le16(IEEE80211_FCTL_MOREDATA
);
814 if (no_pending_pkts
) {
815 if (rx
->local
->ops
->set_tim
)
816 rx
->local
->ops
->set_tim(local_to_hw(rx
->local
),
819 bss_tim_clear(rx
->local
, rx
->sdata
->bss
, rx
->sta
->aid
);
821 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
822 } else if (!rx
->u
.rx
.sent_ps_buffered
) {
823 printk(KERN_DEBUG
"%s: STA " MAC_FMT
" sent PS Poll even "
824 "though there is no buffered frames for it\n",
825 rx
->dev
->name
, MAC_ARG(rx
->sta
->addr
));
826 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
830 /* Free PS Poll skb here instead of returning TXRX_DROP that would
831 * count as an dropped frame. */
832 dev_kfree_skb(rx
->skb
);
837 static ieee80211_txrx_result
838 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data
*rx
)
841 u8
*data
= rx
->skb
->data
;
842 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) data
;
844 if (!WLAN_FC_IS_QOS_DATA(fc
))
845 return TXRX_CONTINUE
;
847 /* remove the qos control field, update frame type and meta-data */
848 memmove(data
+ 2, data
, ieee80211_get_hdrlen(fc
) - 2);
849 hdr
= (struct ieee80211_hdr
*) skb_pull(rx
->skb
, 2);
850 /* change frame type to non QOS */
851 rx
->fc
= fc
&= ~IEEE80211_STYPE_QOS_DATA
;
852 hdr
->frame_control
= cpu_to_le16(fc
);
854 return TXRX_CONTINUE
;
857 static ieee80211_txrx_result
858 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data
*rx
)
860 if (rx
->sdata
->eapol
&& ieee80211_is_eapol(rx
->skb
) &&
861 rx
->sdata
->type
!= IEEE80211_IF_TYPE_STA
&&
862 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
863 /* Pass both encrypted and unencrypted EAPOL frames to user
864 * space for processing. */
865 if (!rx
->local
->apdev
)
867 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
868 ieee80211_msg_normal
);
872 if (unlikely(rx
->sdata
->ieee802_1x
&&
873 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
874 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
875 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_AUTHORIZED
)) &&
876 !ieee80211_is_eapol(rx
->skb
))) {
877 #ifdef CONFIG_MAC80211_DEBUG
878 struct ieee80211_hdr
*hdr
=
879 (struct ieee80211_hdr
*) rx
->skb
->data
;
880 printk(KERN_DEBUG
"%s: dropped frame from " MAC_FMT
881 " (unauthorized port)\n", rx
->dev
->name
,
882 MAC_ARG(hdr
->addr2
));
883 #endif /* CONFIG_MAC80211_DEBUG */
887 return TXRX_CONTINUE
;
890 static ieee80211_txrx_result
891 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data
*rx
)
894 * Pass through unencrypted frames if the hardware might have
895 * decrypted them already without telling us, but that can only
896 * be true if we either didn't find a key or the found key is
897 * uploaded to the hardware.
899 if ((rx
->local
->hw
.flags
& IEEE80211_HW_DEVICE_HIDES_WEP
) &&
901 !(rx
->key
->conf
.flags
& IEEE80211_KEY_FORCE_SW_ENCRYPT
)))
902 return TXRX_CONTINUE
;
904 /* Drop unencrypted frames if key is set. */
905 if (unlikely(!(rx
->fc
& IEEE80211_FCTL_PROTECTED
) &&
906 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
907 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
908 (rx
->key
|| rx
->sdata
->drop_unencrypted
) &&
909 (rx
->sdata
->eapol
== 0 ||
910 !ieee80211_is_eapol(rx
->skb
)))) {
912 printk(KERN_DEBUG
"%s: RX non-WEP frame, but expected "
913 "encryption\n", rx
->dev
->name
);
916 return TXRX_CONTINUE
;
919 static ieee80211_txrx_result
920 ieee80211_rx_h_data(struct ieee80211_txrx_data
*rx
)
922 struct net_device
*dev
= rx
->dev
;
923 struct ieee80211_local
*local
= rx
->local
;
924 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
925 u16 fc
, hdrlen
, ethertype
;
929 struct sk_buff
*skb
= rx
->skb
, *skb2
;
930 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
933 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
934 return TXRX_CONTINUE
;
936 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
939 hdrlen
= ieee80211_get_hdrlen(fc
);
941 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
943 * IEEE 802.11 address fields:
944 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
945 * 0 0 DA SA BSSID n/a
946 * 0 1 DA BSSID SA n/a
947 * 1 0 BSSID SA DA n/a
951 switch (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) {
952 case IEEE80211_FCTL_TODS
:
954 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
955 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
957 if (unlikely(sdata
->type
!= IEEE80211_IF_TYPE_AP
&&
958 sdata
->type
!= IEEE80211_IF_TYPE_VLAN
)) {
960 printk(KERN_DEBUG
"%s: dropped ToDS frame "
963 " DA=" MAC_FMT
")\n",
967 MAC_ARG(hdr
->addr3
));
971 case (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
):
973 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
974 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
976 if (unlikely(sdata
->type
!= IEEE80211_IF_TYPE_WDS
)) {
978 printk(KERN_DEBUG
"%s: dropped FromDS&ToDS "
980 " TA=" MAC_FMT
" DA=" MAC_FMT
981 " SA=" MAC_FMT
")\n",
986 MAC_ARG(hdr
->addr4
));
990 case IEEE80211_FCTL_FROMDS
:
992 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
993 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
995 if (sdata
->type
!= IEEE80211_IF_TYPE_STA
) {
1001 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1002 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1004 if (sdata
->type
!= IEEE80211_IF_TYPE_IBSS
) {
1005 if (net_ratelimit()) {
1006 printk(KERN_DEBUG
"%s: dropped IBSS frame (DA="
1007 MAC_FMT
" SA=" MAC_FMT
" BSSID=" MAC_FMT
1009 dev
->name
, MAC_ARG(hdr
->addr1
),
1010 MAC_ARG(hdr
->addr2
),
1011 MAC_ARG(hdr
->addr3
));
1018 payload
= skb
->data
+ hdrlen
;
1020 if (unlikely(skb
->len
- hdrlen
< 8)) {
1021 if (net_ratelimit()) {
1022 printk(KERN_DEBUG
"%s: RX too short data frame "
1023 "payload\n", dev
->name
);
1028 ethertype
= (payload
[6] << 8) | payload
[7];
1030 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1031 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1032 compare_ether_addr(payload
, bridge_tunnel_header
) == 0)) {
1033 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1034 * replace EtherType */
1035 skb_pull(skb
, hdrlen
+ 6);
1036 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1037 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1039 struct ethhdr
*ehdr
;
1041 skb_pull(skb
, hdrlen
);
1042 len
= htons(skb
->len
);
1043 ehdr
= (struct ethhdr
*) skb_push(skb
, sizeof(struct ethhdr
));
1044 memcpy(ehdr
->h_dest
, dst
, ETH_ALEN
);
1045 memcpy(ehdr
->h_source
, src
, ETH_ALEN
);
1046 ehdr
->h_proto
= len
;
1052 sdata
->stats
.rx_packets
++;
1053 sdata
->stats
.rx_bytes
+= skb
->len
;
1055 if (local
->bridge_packets
&& (sdata
->type
== IEEE80211_IF_TYPE_AP
1056 || sdata
->type
== IEEE80211_IF_TYPE_VLAN
) &&
1057 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
1058 if (is_multicast_ether_addr(skb
->data
)) {
1059 /* send multicast frames both to higher layers in
1060 * local net stack and back to the wireless media */
1061 skb2
= skb_copy(skb
, GFP_ATOMIC
);
1062 if (!skb2
&& net_ratelimit())
1063 printk(KERN_DEBUG
"%s: failed to clone "
1064 "multicast frame\n", dev
->name
);
1066 struct sta_info
*dsta
;
1067 dsta
= sta_info_get(local
, skb
->data
);
1068 if (dsta
&& !dsta
->dev
) {
1069 if (net_ratelimit())
1070 printk(KERN_DEBUG
"Station with null "
1071 "dev structure!\n");
1072 } else if (dsta
&& dsta
->dev
== dev
) {
1073 /* Destination station is associated to this
1074 * AP, so send the frame directly to it and
1075 * do not pass the frame to local net stack.
1086 /* deliver to local stack */
1087 skb
->protocol
= eth_type_trans(skb
, dev
);
1088 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1093 /* send to wireless media */
1094 skb2
->protocol
= __constant_htons(ETH_P_802_3
);
1095 skb_set_network_header(skb2
, 0);
1096 skb_set_mac_header(skb2
, 0);
1097 dev_queue_xmit(skb2
);
1103 static ieee80211_txrx_result
1104 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data
*rx
)
1106 struct ieee80211_sub_if_data
*sdata
;
1108 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
1111 sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
1112 if ((sdata
->type
== IEEE80211_IF_TYPE_STA
||
1113 sdata
->type
== IEEE80211_IF_TYPE_IBSS
) &&
1114 !rx
->local
->user_space_mlme
) {
1115 ieee80211_sta_rx_mgmt(rx
->dev
, rx
->skb
, rx
->u
.rx
.status
);
1117 /* Management frames are sent to hostapd for processing */
1118 if (!rx
->local
->apdev
)
1120 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
1121 ieee80211_msg_normal
);
1126 static inline ieee80211_txrx_result
__ieee80211_invoke_rx_handlers(
1127 struct ieee80211_local
*local
,
1128 ieee80211_rx_handler
*handlers
,
1129 struct ieee80211_txrx_data
*rx
,
1130 struct sta_info
*sta
)
1132 ieee80211_rx_handler
*handler
;
1133 ieee80211_txrx_result res
= TXRX_DROP
;
1135 for (handler
= handlers
; *handler
!= NULL
; handler
++) {
1136 res
= (*handler
)(rx
);
1142 I802_DEBUG_INC(local
->rx_handlers_drop
);
1147 I802_DEBUG_INC(local
->rx_handlers_queued
);
1153 if (res
== TXRX_DROP
)
1154 dev_kfree_skb(rx
->skb
);
1158 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local
*local
,
1159 ieee80211_rx_handler
*handlers
,
1160 struct ieee80211_txrx_data
*rx
,
1161 struct sta_info
*sta
)
1163 if (__ieee80211_invoke_rx_handlers(local
, handlers
, rx
, sta
) ==
1165 dev_kfree_skb(rx
->skb
);
1168 static void ieee80211_rx_michael_mic_report(struct net_device
*dev
,
1169 struct ieee80211_hdr
*hdr
,
1170 struct sta_info
*sta
,
1171 struct ieee80211_txrx_data
*rx
)
1175 hdrlen
= ieee80211_get_hdrlen_from_skb(rx
->skb
);
1176 if (rx
->skb
->len
>= hdrlen
+ 4)
1177 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
1181 /* TODO: verify that this is not triggered by fragmented
1182 * frames (hw does not verify MIC for them). */
1183 if (net_ratelimit())
1184 printk(KERN_DEBUG
"%s: TKIP hwaccel reported Michael MIC "
1185 "failure from " MAC_FMT
" to " MAC_FMT
" keyidx=%d\n",
1186 dev
->name
, MAC_ARG(hdr
->addr2
), MAC_ARG(hdr
->addr1
),
1190 /* Some hardware versions seem to generate incorrect
1191 * Michael MIC reports; ignore them to avoid triggering
1192 * countermeasures. */
1193 if (net_ratelimit())
1194 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1195 "error for unknown address " MAC_FMT
"\n",
1196 dev
->name
, MAC_ARG(hdr
->addr2
));
1200 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
1201 if (net_ratelimit())
1202 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1203 "error for a frame with no ISWEP flag (src "
1204 MAC_FMT
")\n", dev
->name
, MAC_ARG(hdr
->addr2
));
1208 if ((rx
->local
->hw
.flags
& IEEE80211_HW_WEP_INCLUDE_IV
) &&
1209 rx
->sdata
->type
== IEEE80211_IF_TYPE_AP
&& keyidx
) {
1210 /* AP with Pairwise keys support should never receive Michael
1211 * MIC errors for non-zero keyidx because these are reserved
1212 * for group keys and only the AP is sending real multicast
1214 if (net_ratelimit())
1215 printk(KERN_DEBUG
"%s: ignored Michael MIC error for "
1216 "a frame with non-zero keyidx (%d)"
1217 " (src " MAC_FMT
")\n", dev
->name
, keyidx
,
1218 MAC_ARG(hdr
->addr2
));
1222 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
1223 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
1224 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)) {
1225 if (net_ratelimit())
1226 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1227 "error for a frame that cannot be encrypted "
1228 "(fc=0x%04x) (src " MAC_FMT
")\n",
1229 dev
->name
, rx
->fc
, MAC_ARG(hdr
->addr2
));
1233 /* TODO: consider verifying the MIC error report with software
1234 * implementation if we get too many spurious reports from the
1237 mac80211_ev_michael_mic_failure(rx
->dev
, keyidx
, hdr
);
1239 dev_kfree_skb(rx
->skb
);
1243 ieee80211_rx_handler ieee80211_rx_handlers
[] =
1245 ieee80211_rx_h_if_stats
,
1246 ieee80211_rx_h_monitor
,
1247 ieee80211_rx_h_passive_scan
,
1248 ieee80211_rx_h_check
,
1249 ieee80211_rx_h_load_key
,
1250 ieee80211_rx_h_sta_process
,
1251 ieee80211_rx_h_ccmp_decrypt
,
1252 ieee80211_rx_h_tkip_decrypt
,
1253 ieee80211_rx_h_wep_weak_iv_detection
,
1254 ieee80211_rx_h_wep_decrypt
,
1255 ieee80211_rx_h_defragment
,
1256 ieee80211_rx_h_ps_poll
,
1257 ieee80211_rx_h_michael_mic_verify
,
1258 /* this must be after decryption - so header is counted in MPDU mic
1259 * must be before pae and data, so QOS_DATA format frames
1260 * are not passed to user space by these functions
1262 ieee80211_rx_h_remove_qos_control
,
1263 ieee80211_rx_h_802_1x_pae
,
1264 ieee80211_rx_h_drop_unencrypted
,
1265 ieee80211_rx_h_data
,
1266 ieee80211_rx_h_mgmt
,
1270 /* main receive path */
1272 static int prepare_for_handlers(struct ieee80211_sub_if_data
*sdata
,
1273 u8
*bssid
, struct ieee80211_txrx_data
*rx
,
1274 struct ieee80211_hdr
*hdr
)
1276 int multicast
= is_multicast_ether_addr(hdr
->addr1
);
1278 switch (sdata
->type
) {
1279 case IEEE80211_IF_TYPE_STA
:
1282 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1283 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1285 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1286 } else if (!multicast
&&
1287 compare_ether_addr(sdata
->dev
->dev_addr
,
1289 if (!(sdata
->flags
& IEEE80211_SDATA_PROMISC
))
1291 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1294 case IEEE80211_IF_TYPE_IBSS
:
1297 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1298 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1300 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1301 } else if (!multicast
&&
1302 compare_ether_addr(sdata
->dev
->dev_addr
,
1304 if (!(sdata
->flags
& IEEE80211_SDATA_PROMISC
))
1306 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1307 } else if (!rx
->sta
)
1308 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
, rx
->skb
,
1311 case IEEE80211_IF_TYPE_AP
:
1313 if (compare_ether_addr(sdata
->dev
->dev_addr
,
1316 } else if (!ieee80211_bssid_match(bssid
,
1317 sdata
->dev
->dev_addr
)) {
1318 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1320 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1322 if (sdata
->dev
== sdata
->local
->mdev
&&
1323 !(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1324 /* do not receive anything via
1325 * master device when not scanning */
1328 case IEEE80211_IF_TYPE_WDS
:
1330 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
)
1332 if (compare_ether_addr(sdata
->u
.wds
.remote_addr
, hdr
->addr2
))
1341 * This is the receive path handler. It is called by a low level driver when an
1342 * 802.11 MPDU is received from the hardware.
1344 void __ieee80211_rx(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1345 struct ieee80211_rx_status
*status
)
1347 struct ieee80211_local
*local
= hw_to_local(hw
);
1348 struct ieee80211_sub_if_data
*sdata
;
1349 struct sta_info
*sta
;
1350 struct ieee80211_hdr
*hdr
;
1351 struct ieee80211_txrx_data rx
;
1353 int radiotap_len
= 0, prepres
;
1354 struct ieee80211_sub_if_data
*prev
= NULL
;
1355 struct sk_buff
*skb_new
;
1358 if (status
->flag
& RX_FLAG_RADIOTAP
) {
1359 radiotap_len
= ieee80211_get_radiotap_len(skb
->data
);
1360 skb_pull(skb
, radiotap_len
);
1363 hdr
= (struct ieee80211_hdr
*) skb
->data
;
1364 memset(&rx
, 0, sizeof(rx
));
1368 rx
.u
.rx
.status
= status
;
1369 rx
.fc
= skb
->len
>= 2 ? le16_to_cpu(hdr
->frame_control
) : 0;
1370 type
= rx
.fc
& IEEE80211_FCTL_FTYPE
;
1371 if (type
== IEEE80211_FTYPE_DATA
|| type
== IEEE80211_FTYPE_MGMT
)
1372 local
->dot11ReceivedFragmentCount
++;
1374 if (skb
->len
>= 16) {
1375 sta
= rx
.sta
= sta_info_get(local
, hdr
->addr2
);
1377 rx
.dev
= rx
.sta
->dev
;
1378 rx
.sdata
= IEEE80211_DEV_TO_SUB_IF(rx
.dev
);
1381 sta
= rx
.sta
= NULL
;
1383 if ((status
->flag
& RX_FLAG_MMIC_ERROR
)) {
1384 ieee80211_rx_michael_mic_report(local
->mdev
, hdr
, sta
, &rx
);
1388 if (unlikely(local
->sta_scanning
))
1389 rx
.flags
|= IEEE80211_TXRXD_RXIN_SCAN
;
1391 if (__ieee80211_invoke_rx_handlers(local
, local
->rx_pre_handlers
, &rx
,
1392 sta
) != TXRX_CONTINUE
)
1396 skb_push(skb
, radiotap_len
);
1397 if (sta
&& !sta
->assoc_ap
&& !(sta
->flags
& WLAN_STA_WDS
) &&
1398 !local
->iff_promiscs
&& !is_multicast_ether_addr(hdr
->addr1
)) {
1399 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1400 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
, &rx
,
1406 bssid
= ieee80211_get_bssid(hdr
, skb
->len
- radiotap_len
);
1408 read_lock(&local
->sub_if_lock
);
1409 list_for_each_entry(sdata
, &local
->sub_if_list
, list
) {
1410 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1412 if (!netif_running(sdata
->dev
))
1415 prepres
= prepare_for_handlers(sdata
, bssid
, &rx
, hdr
);
1416 /* prepare_for_handlers can change sta */
1423 * frame is destined for this interface, but if it's not
1424 * also for the previous one we handle that after the
1425 * loop to avoid copying the SKB once too much
1434 * frame was destined for the previous interface
1435 * so invoke RX handlers for it
1438 skb_new
= skb_copy(skb
, GFP_ATOMIC
);
1440 if (net_ratelimit())
1441 printk(KERN_DEBUG
"%s: failed to copy "
1442 "multicast frame for %s",
1443 local
->mdev
->name
, prev
->dev
->name
);
1449 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
,
1457 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
,
1461 read_unlock(&local
->sub_if_lock
);
1467 EXPORT_SYMBOL(__ieee80211_rx
);
1469 /* This is a version of the rx handler that can be called from hard irq
1470 * context. Post the skb on the queue and schedule the tasklet */
1471 void ieee80211_rx_irqsafe(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1472 struct ieee80211_rx_status
*status
)
1474 struct ieee80211_local
*local
= hw_to_local(hw
);
1476 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status
) > sizeof(skb
->cb
));
1478 skb
->dev
= local
->mdev
;
1479 /* copy status into skb->cb for use by tasklet */
1480 memcpy(skb
->cb
, status
, sizeof(*status
));
1481 skb
->pkt_type
= IEEE80211_RX_MSG
;
1482 skb_queue_tail(&local
->skb_queue
, skb
);
1483 tasklet_schedule(&local
->tasklet
);
1485 EXPORT_SYMBOL(ieee80211_rx_irqsafe
);