2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
21 #include "ieee80211_i.h"
22 #include "ieee80211_led.h"
29 u8
ieee80211_sta_manage_reorder_buf(struct ieee80211_hw
*hw
,
30 struct tid_ampdu_rx
*tid_agg_rx
,
31 struct sk_buff
*skb
, u16 mpdu_seq_num
,
34 * monitor mode reception
36 * This function cleans up the SKB, i.e. it removes all the stuff
37 * only useful for monitoring.
39 static struct sk_buff
*remove_monitor_info(struct ieee80211_local
*local
,
43 skb_pull(skb
, rtap_len
);
45 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
) {
46 if (likely(skb
->len
> FCS_LEN
))
47 skb_trim(skb
, skb
->len
- FCS_LEN
);
59 static inline int should_drop_frame(struct ieee80211_rx_status
*status
,
64 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
66 if (status
->flag
& (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
68 if (unlikely(skb
->len
< 16 + present_fcs_len
+ radiotap_len
))
70 if (((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_FTYPE
)) ==
71 cpu_to_le16(IEEE80211_FTYPE_CTL
)) &&
72 ((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_STYPE
)) !=
73 cpu_to_le16(IEEE80211_STYPE_PSPOLL
)) &&
74 ((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_STYPE
)) !=
75 cpu_to_le16(IEEE80211_STYPE_BACK_REQ
)))
81 * This function copies a received frame to all monitor interfaces and
82 * returns a cleaned-up SKB that no longer includes the FCS nor the
83 * radiotap header the driver might have added.
85 static struct sk_buff
*
86 ieee80211_rx_monitor(struct ieee80211_local
*local
, struct sk_buff
*origskb
,
87 struct ieee80211_rx_status
*status
,
88 struct ieee80211_rate
*rate
)
90 struct ieee80211_sub_if_data
*sdata
;
91 int needed_headroom
= 0;
92 struct ieee80211_radiotap_header
*rthdr
;
93 __le64
*rttsft
= NULL
;
94 struct ieee80211_rtap_fixed_data
{
100 u8 padding_for_rxflags
;
102 } __attribute__ ((packed
)) *rtfixed
;
103 struct sk_buff
*skb
, *skb2
;
104 struct net_device
*prev_dev
= NULL
;
105 int present_fcs_len
= 0;
109 * First, we may need to make a copy of the skb because
110 * (1) we need to modify it for radiotap (if not present), and
111 * (2) the other RX handlers will modify the skb we got.
113 * We don't need to, of course, if we aren't going to return
114 * the SKB because it has a bad FCS/PLCP checksum.
116 if (status
->flag
& RX_FLAG_RADIOTAP
)
117 rtap_len
= ieee80211_get_radiotap_len(origskb
->data
);
119 /* room for radiotap header, always present fields and TSFT */
120 needed_headroom
= sizeof(*rthdr
) + sizeof(*rtfixed
) + 8;
122 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
123 present_fcs_len
= FCS_LEN
;
125 if (!local
->monitors
) {
126 if (should_drop_frame(status
, origskb
, present_fcs_len
,
128 dev_kfree_skb(origskb
);
132 return remove_monitor_info(local
, origskb
, rtap_len
);
135 if (should_drop_frame(status
, origskb
, present_fcs_len
, rtap_len
)) {
136 /* only need to expand headroom if necessary */
141 * This shouldn't trigger often because most devices have an
142 * RX header they pull before we get here, and that should
143 * be big enough for our radiotap information. We should
144 * probably export the length to drivers so that we can have
145 * them allocate enough headroom to start with.
147 if (skb_headroom(skb
) < needed_headroom
&&
148 pskb_expand_head(skb
, needed_headroom
, 0, GFP_ATOMIC
)) {
154 * Need to make a copy and possibly remove radiotap header
155 * and FCS from the original.
157 skb
= skb_copy_expand(origskb
, needed_headroom
, 0, GFP_ATOMIC
);
159 origskb
= remove_monitor_info(local
, origskb
, rtap_len
);
165 /* if necessary, prepend radiotap information */
166 if (!(status
->flag
& RX_FLAG_RADIOTAP
)) {
167 rtfixed
= (void *) skb_push(skb
, sizeof(*rtfixed
));
168 rtap_len
= sizeof(*rthdr
) + sizeof(*rtfixed
);
169 if (status
->flag
& RX_FLAG_TSFT
) {
170 rttsft
= (void *) skb_push(skb
, sizeof(*rttsft
));
173 rthdr
= (void *) skb_push(skb
, sizeof(*rthdr
));
174 memset(rthdr
, 0, sizeof(*rthdr
));
175 memset(rtfixed
, 0, sizeof(*rtfixed
));
177 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
178 (1 << IEEE80211_RADIOTAP_RATE
) |
179 (1 << IEEE80211_RADIOTAP_CHANNEL
) |
180 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL
) |
181 (1 << IEEE80211_RADIOTAP_RX_FLAGS
));
183 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
184 rtfixed
->flags
|= IEEE80211_RADIOTAP_F_FCS
;
187 *rttsft
= cpu_to_le64(status
->mactime
);
189 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT
);
192 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
193 rtfixed
->rx_flags
= 0;
195 (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
197 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS
);
199 rtfixed
->rate
= rate
->bitrate
/ 5;
201 rtfixed
->chan_freq
= cpu_to_le16(status
->freq
);
203 if (status
->band
== IEEE80211_BAND_5GHZ
)
204 rtfixed
->chan_flags
=
205 cpu_to_le16(IEEE80211_CHAN_OFDM
|
206 IEEE80211_CHAN_5GHZ
);
208 rtfixed
->chan_flags
=
209 cpu_to_le16(IEEE80211_CHAN_DYN
|
210 IEEE80211_CHAN_2GHZ
);
212 rtfixed
->antsignal
= status
->ssi
;
213 rthdr
->it_len
= cpu_to_le16(rtap_len
);
216 skb_reset_mac_header(skb
);
217 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
218 skb
->pkt_type
= PACKET_OTHERHOST
;
219 skb
->protocol
= htons(ETH_P_802_2
);
221 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
222 if (!netif_running(sdata
->dev
))
225 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_MNTR
)
228 if (sdata
->u
.mntr_flags
& MONITOR_FLAG_COOK_FRAMES
)
232 skb2
= skb_clone(skb
, GFP_ATOMIC
);
234 skb2
->dev
= prev_dev
;
239 prev_dev
= sdata
->dev
;
240 sdata
->dev
->stats
.rx_packets
++;
241 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
254 static void ieee80211_parse_qos(struct ieee80211_rx_data
*rx
)
256 u8
*data
= rx
->skb
->data
;
259 /* does the frame have a qos control field? */
260 if (WLAN_FC_IS_QOS_DATA(rx
->fc
)) {
261 u8
*qc
= data
+ ieee80211_get_hdrlen(rx
->fc
) - QOS_CONTROL_LEN
;
262 /* frame has qos control */
263 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
264 if (qc
[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT
)
265 rx
->flags
|= IEEE80211_RX_AMSDU
;
267 rx
->flags
&= ~IEEE80211_RX_AMSDU
;
269 if (unlikely((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
)) {
270 /* Separate TID for management frames */
271 tid
= NUM_RX_DATA_QUEUES
- 1;
273 /* no qos control present */
274 tid
= 0; /* 802.1d - Best Effort */
278 I802_DEBUG_INC(rx
->local
->wme_rx_queue
[tid
]);
279 /* only a debug counter, sta might not be assigned properly yet */
281 I802_DEBUG_INC(rx
->sta
->wme_rx_queue
[tid
]);
284 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
285 * For now, set skb->priority to 0 for other cases. */
286 rx
->skb
->priority
= (tid
> 7) ? 0 : tid
;
289 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data
*rx
)
291 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
294 if (!WLAN_FC_DATA_PRESENT(rx
->fc
))
298 * Drivers are required to align the payload data in a way that
299 * guarantees that the contained IP header is aligned to a four-
300 * byte boundary. In the case of regular frames, this simply means
301 * aligning the payload to a four-byte boundary (because either
302 * the IP header is directly contained, or IV/RFC1042 headers that
303 * have a length divisible by four are in front of it.
305 * With A-MSDU frames, however, the payload data address must
306 * yield two modulo four because there are 14-byte 802.3 headers
307 * within the A-MSDU frames that push the IP header further back
308 * to a multiple of four again. Thankfully, the specs were sane
309 * enough this time around to require padding each A-MSDU subframe
310 * to a length that is a multiple of four.
312 * Padding like atheros hardware adds which is inbetween the 802.11
313 * header and the payload is not supported, the driver is required
314 * to move the 802.11 header further back in that case.
316 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
317 if (rx
->flags
& IEEE80211_RX_AMSDU
)
319 WARN_ON_ONCE(((unsigned long)(rx
->skb
->data
+ hdrlen
)) & 3);
324 static u32
ieee80211_rx_load_stats(struct ieee80211_local
*local
,
326 struct ieee80211_rx_status
*status
,
327 struct ieee80211_rate
*rate
)
329 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
330 u32 load
= 0, hdrtime
;
332 /* Estimate total channel use caused by this frame */
334 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
335 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
337 if (status
->band
== IEEE80211_BAND_5GHZ
||
338 (status
->band
== IEEE80211_BAND_5GHZ
&&
339 rate
->flags
& IEEE80211_RATE_ERP_G
))
340 hdrtime
= CHAN_UTIL_HDR_SHORT
;
342 hdrtime
= CHAN_UTIL_HDR_LONG
;
345 if (!is_multicast_ether_addr(hdr
->addr1
))
348 /* TODO: optimise again */
349 load
+= skb
->len
* CHAN_UTIL_RATE_LCM
/ rate
->bitrate
;
351 /* Divide channel_use by 8 to avoid wrapping around the counter */
352 load
>>= CHAN_UTIL_SHIFT
;
359 static ieee80211_rx_result
360 ieee80211_rx_h_if_stats(struct ieee80211_rx_data
*rx
)
363 rx
->sta
->channel_use_raw
+= rx
->load
;
364 rx
->sdata
->channel_use_raw
+= rx
->load
;
368 static ieee80211_rx_result
369 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data
*rx
)
371 struct ieee80211_local
*local
= rx
->local
;
372 struct sk_buff
*skb
= rx
->skb
;
374 if (unlikely(local
->sta_hw_scanning
))
375 return ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->status
);
377 if (unlikely(local
->sta_sw_scanning
)) {
378 /* drop all the other packets during a software scan anyway */
379 if (ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->status
)
385 if (unlikely(rx
->flags
& IEEE80211_RX_IN_SCAN
)) {
386 /* scanning finished during invoking of handlers */
387 I802_DEBUG_INC(local
->rx_handlers_drop_passive_scan
);
388 return RX_DROP_UNUSABLE
;
394 static ieee80211_rx_result
395 ieee80211_rx_mesh_check(struct ieee80211_rx_data
*rx
)
397 int hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
398 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
400 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
402 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
) {
403 if (!((rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
404 (rx
->fc
& IEEE80211_FCTL_TODS
)))
405 return RX_DROP_MONITOR
;
406 if (memcmp(hdr
->addr4
, rx
->dev
->dev_addr
, ETH_ALEN
) == 0)
407 return RX_DROP_MONITOR
;
410 /* If there is not an established peer link and this is not a peer link
411 * establisment frame, beacon or probe, drop the frame.
414 if (!rx
->sta
|| sta_plink_state(rx
->sta
) != ESTAB
) {
415 struct ieee80211_mgmt
*mgmt
;
417 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
)
418 return RX_DROP_MONITOR
;
420 switch (rx
->fc
& IEEE80211_FCTL_STYPE
) {
421 case IEEE80211_STYPE_ACTION
:
422 mgmt
= (struct ieee80211_mgmt
*)hdr
;
423 if (mgmt
->u
.action
.category
!= PLINK_CATEGORY
)
424 return RX_DROP_MONITOR
;
425 /* fall through on else */
426 case IEEE80211_STYPE_PROBE_REQ
:
427 case IEEE80211_STYPE_PROBE_RESP
:
428 case IEEE80211_STYPE_BEACON
:
432 return RX_DROP_MONITOR
;
435 } else if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
436 is_broadcast_ether_addr(hdr
->addr1
) &&
437 mesh_rmc_check(hdr
->addr4
, msh_h_get(hdr
, hdrlen
), rx
->dev
))
438 return RX_DROP_MONITOR
;
445 static ieee80211_rx_result
446 ieee80211_rx_h_check(struct ieee80211_rx_data
*rx
)
448 struct ieee80211_hdr
*hdr
;
450 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
452 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
453 if (rx
->sta
&& !is_multicast_ether_addr(hdr
->addr1
)) {
454 if (unlikely(rx
->fc
& IEEE80211_FCTL_RETRY
&&
455 rx
->sta
->last_seq_ctrl
[rx
->queue
] ==
457 if (rx
->flags
& IEEE80211_RX_RA_MATCH
) {
458 rx
->local
->dot11FrameDuplicateCount
++;
459 rx
->sta
->num_duplicates
++;
461 return RX_DROP_MONITOR
;
463 rx
->sta
->last_seq_ctrl
[rx
->queue
] = hdr
->seq_ctrl
;
466 if (unlikely(rx
->skb
->len
< 16)) {
467 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_short
);
468 return RX_DROP_MONITOR
;
471 /* Drop disallowed frame classes based on STA auth/assoc state;
472 * IEEE 802.11, Chap 5.5.
474 * 80211.o does filtering only based on association state, i.e., it
475 * drops Class 3 frames from not associated stations. hostapd sends
476 * deauth/disassoc frames when needed. In addition, hostapd is
477 * responsible for filtering on both auth and assoc states.
480 if (ieee80211_vif_is_mesh(&rx
->sdata
->vif
))
481 return ieee80211_rx_mesh_check(rx
);
483 if (unlikely(((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
||
484 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_CTL
&&
485 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_PSPOLL
)) &&
486 rx
->sdata
->vif
.type
!= IEEE80211_IF_TYPE_IBSS
&&
487 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_ASSOC
)))) {
488 if ((!(rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
489 !(rx
->fc
& IEEE80211_FCTL_TODS
) &&
490 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
)
491 || !(rx
->flags
& IEEE80211_RX_RA_MATCH
)) {
492 /* Drop IBSS frames and frames for other hosts
494 return RX_DROP_MONITOR
;
497 return RX_DROP_MONITOR
;
504 static ieee80211_rx_result
505 ieee80211_rx_h_decrypt(struct ieee80211_rx_data
*rx
)
507 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
510 ieee80211_rx_result result
= RX_DROP_UNUSABLE
;
511 struct ieee80211_key
*stakey
= NULL
;
516 * There are three types of keys:
518 * - PTK (pairwise keys)
519 * - STK (station-to-station pairwise keys)
521 * When selecting a key, we have to distinguish between multicast
522 * (including broadcast) and unicast frames, the latter can only
523 * use PTKs and STKs while the former always use GTKs. Unless, of
524 * course, actual WEP keys ("pre-RSNA") are used, then unicast
525 * frames can also use key indizes like GTKs. Hence, if we don't
526 * have a PTK/STK we check the key index for a WEP key.
528 * Note that in a regular BSS, multicast frames are sent by the
529 * AP only, associated stations unicast the frame to the AP first
530 * which then multicasts it on their behalf.
532 * There is also a slight problem in IBSS mode: GTKs are negotiated
533 * with each station, that is something we don't currently handle.
534 * The spec seems to expect that one negotiates the same key with
535 * every station but there's no such requirement; VLANs could be
539 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
))
543 * No point in finding a key and decrypting if the frame is neither
544 * addressed to us nor a multicast frame.
546 if (!(rx
->flags
& IEEE80211_RX_RA_MATCH
))
550 stakey
= rcu_dereference(rx
->sta
->key
);
552 if (!is_multicast_ether_addr(hdr
->addr1
) && stakey
) {
556 * The device doesn't give us the IV so we won't be
557 * able to look up the key. That's ok though, we
558 * don't need to decrypt the frame, we just won't
559 * be able to keep statistics accurate.
560 * Except for key threshold notifications, should
561 * we somehow allow the driver to tell us which key
562 * the hardware used if this flag is set?
564 if ((rx
->status
->flag
& RX_FLAG_DECRYPTED
) &&
565 (rx
->status
->flag
& RX_FLAG_IV_STRIPPED
))
568 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
570 if (rx
->skb
->len
< 8 + hdrlen
)
571 return RX_DROP_UNUSABLE
; /* TODO: count this? */
574 * no need to call ieee80211_wep_get_keyidx,
575 * it verifies a bunch of things we've done already
577 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
579 rx
->key
= rcu_dereference(rx
->sdata
->keys
[keyidx
]);
582 * RSNA-protected unicast frames should always be sent with
583 * pairwise or station-to-station keys, but for WEP we allow
584 * using a key index as well.
586 if (rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
&&
587 !is_multicast_ether_addr(hdr
->addr1
))
592 rx
->key
->tx_rx_count
++;
593 /* TODO: add threshold stuff again */
595 #ifdef CONFIG_MAC80211_DEBUG
597 printk(KERN_DEBUG
"%s: RX protected frame,"
598 " but have no key\n", rx
->dev
->name
);
599 #endif /* CONFIG_MAC80211_DEBUG */
600 return RX_DROP_MONITOR
;
603 /* Check for weak IVs if possible */
604 if (rx
->sta
&& rx
->key
->conf
.alg
== ALG_WEP
&&
605 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
) &&
606 (!(rx
->status
->flag
& RX_FLAG_IV_STRIPPED
) ||
607 !(rx
->status
->flag
& RX_FLAG_DECRYPTED
)) &&
608 ieee80211_wep_is_weak_iv(rx
->skb
, rx
->key
))
609 rx
->sta
->wep_weak_iv_count
++;
611 switch (rx
->key
->conf
.alg
) {
613 result
= ieee80211_crypto_wep_decrypt(rx
);
616 result
= ieee80211_crypto_tkip_decrypt(rx
);
619 result
= ieee80211_crypto_ccmp_decrypt(rx
);
623 /* either the frame has been decrypted or will be dropped */
624 rx
->status
->flag
|= RX_FLAG_DECRYPTED
;
629 static void ap_sta_ps_start(struct net_device
*dev
, struct sta_info
*sta
)
631 struct ieee80211_sub_if_data
*sdata
;
632 DECLARE_MAC_BUF(mac
);
637 atomic_inc(&sdata
->bss
->num_sta_ps
);
638 sta
->flags
|= WLAN_STA_PS
;
639 sta
->flags
&= ~WLAN_STA_PSPOLL
;
640 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
641 printk(KERN_DEBUG
"%s: STA %s aid %d enters power save mode\n",
642 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
643 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
646 static int ap_sta_ps_end(struct net_device
*dev
, struct sta_info
*sta
)
648 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
651 struct ieee80211_sub_if_data
*sdata
;
652 struct ieee80211_tx_packet_data
*pkt_data
;
653 DECLARE_MAC_BUF(mac
);
658 atomic_dec(&sdata
->bss
->num_sta_ps
);
660 sta
->flags
&= ~(WLAN_STA_PS
| WLAN_STA_PSPOLL
);
662 if (!skb_queue_empty(&sta
->ps_tx_buf
))
663 sta_info_clear_tim_bit(sta
);
665 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
666 printk(KERN_DEBUG
"%s: STA %s aid %d exits power save mode\n",
667 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
668 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
670 /* Send all buffered frames to the station */
671 while ((skb
= skb_dequeue(&sta
->tx_filtered
)) != NULL
) {
672 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
674 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
677 while ((skb
= skb_dequeue(&sta
->ps_tx_buf
)) != NULL
) {
678 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
679 local
->total_ps_buffered
--;
681 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
682 printk(KERN_DEBUG
"%s: STA %s aid %d send PS frame "
683 "since STA not sleeping anymore\n", dev
->name
,
684 print_mac(mac
, sta
->addr
), sta
->aid
);
685 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
686 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
693 static ieee80211_rx_result
694 ieee80211_rx_h_sta_process(struct ieee80211_rx_data
*rx
)
696 struct sta_info
*sta
= rx
->sta
;
697 struct net_device
*dev
= rx
->dev
;
698 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
703 /* Update last_rx only for IBSS packets which are for the current
704 * BSSID to avoid keeping the current IBSS network alive in cases where
705 * other STAs are using different BSSID. */
706 if (rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_IBSS
) {
707 u8
*bssid
= ieee80211_get_bssid(hdr
, rx
->skb
->len
,
708 IEEE80211_IF_TYPE_IBSS
);
709 if (compare_ether_addr(bssid
, rx
->sdata
->u
.sta
.bssid
) == 0)
710 sta
->last_rx
= jiffies
;
712 if (!is_multicast_ether_addr(hdr
->addr1
) ||
713 rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_STA
) {
714 /* Update last_rx only for unicast frames in order to prevent
715 * the Probe Request frames (the only broadcast frames from a
716 * STA in infrastructure mode) from keeping a connection alive.
717 * Mesh beacons will update last_rx when if they are found to
718 * match the current local configuration when processed.
720 sta
->last_rx
= jiffies
;
723 if (!(rx
->flags
& IEEE80211_RX_RA_MATCH
))
727 sta
->rx_bytes
+= rx
->skb
->len
;
728 sta
->last_rssi
= rx
->status
->ssi
;
729 sta
->last_signal
= rx
->status
->signal
;
730 sta
->last_noise
= rx
->status
->noise
;
732 if (!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
)) {
733 /* Change STA power saving mode only in the end of a frame
734 * exchange sequence */
735 if ((sta
->flags
& WLAN_STA_PS
) && !(rx
->fc
& IEEE80211_FCTL_PM
))
736 rx
->sent_ps_buffered
+= ap_sta_ps_end(dev
, sta
);
737 else if (!(sta
->flags
& WLAN_STA_PS
) &&
738 (rx
->fc
& IEEE80211_FCTL_PM
))
739 ap_sta_ps_start(dev
, sta
);
742 /* Drop data::nullfunc frames silently, since they are used only to
743 * control station power saving mode. */
744 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
745 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_NULLFUNC
) {
746 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_nullfunc
);
747 /* Update counter and free packet here to avoid counting this
748 * as a dropped packed. */
750 dev_kfree_skb(rx
->skb
);
755 } /* ieee80211_rx_h_sta_process */
757 static inline struct ieee80211_fragment_entry
*
758 ieee80211_reassemble_add(struct ieee80211_sub_if_data
*sdata
,
759 unsigned int frag
, unsigned int seq
, int rx_queue
,
760 struct sk_buff
**skb
)
762 struct ieee80211_fragment_entry
*entry
;
765 idx
= sdata
->fragment_next
;
766 entry
= &sdata
->fragments
[sdata
->fragment_next
++];
767 if (sdata
->fragment_next
>= IEEE80211_FRAGMENT_MAX
)
768 sdata
->fragment_next
= 0;
770 if (!skb_queue_empty(&entry
->skb_list
)) {
771 #ifdef CONFIG_MAC80211_DEBUG
772 struct ieee80211_hdr
*hdr
=
773 (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
774 DECLARE_MAC_BUF(mac
);
775 DECLARE_MAC_BUF(mac2
);
776 printk(KERN_DEBUG
"%s: RX reassembly removed oldest "
777 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
778 "addr1=%s addr2=%s\n",
779 sdata
->dev
->name
, idx
,
780 jiffies
- entry
->first_frag_time
, entry
->seq
,
781 entry
->last_frag
, print_mac(mac
, hdr
->addr1
),
782 print_mac(mac2
, hdr
->addr2
));
783 #endif /* CONFIG_MAC80211_DEBUG */
784 __skb_queue_purge(&entry
->skb_list
);
787 __skb_queue_tail(&entry
->skb_list
, *skb
); /* no need for locking */
789 entry
->first_frag_time
= jiffies
;
791 entry
->rx_queue
= rx_queue
;
792 entry
->last_frag
= frag
;
794 entry
->extra_len
= 0;
799 static inline struct ieee80211_fragment_entry
*
800 ieee80211_reassemble_find(struct ieee80211_sub_if_data
*sdata
,
801 u16 fc
, unsigned int frag
, unsigned int seq
,
802 int rx_queue
, struct ieee80211_hdr
*hdr
)
804 struct ieee80211_fragment_entry
*entry
;
807 idx
= sdata
->fragment_next
;
808 for (i
= 0; i
< IEEE80211_FRAGMENT_MAX
; i
++) {
809 struct ieee80211_hdr
*f_hdr
;
814 idx
= IEEE80211_FRAGMENT_MAX
- 1;
816 entry
= &sdata
->fragments
[idx
];
817 if (skb_queue_empty(&entry
->skb_list
) || entry
->seq
!= seq
||
818 entry
->rx_queue
!= rx_queue
||
819 entry
->last_frag
+ 1 != frag
)
822 f_hdr
= (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
823 f_fc
= le16_to_cpu(f_hdr
->frame_control
);
825 if ((fc
& IEEE80211_FCTL_FTYPE
) != (f_fc
& IEEE80211_FCTL_FTYPE
) ||
826 compare_ether_addr(hdr
->addr1
, f_hdr
->addr1
) != 0 ||
827 compare_ether_addr(hdr
->addr2
, f_hdr
->addr2
) != 0)
830 if (time_after(jiffies
, entry
->first_frag_time
+ 2 * HZ
)) {
831 __skb_queue_purge(&entry
->skb_list
);
840 static ieee80211_rx_result
841 ieee80211_rx_h_defragment(struct ieee80211_rx_data
*rx
)
843 struct ieee80211_hdr
*hdr
;
845 unsigned int frag
, seq
;
846 struct ieee80211_fragment_entry
*entry
;
848 DECLARE_MAC_BUF(mac
);
850 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
851 sc
= le16_to_cpu(hdr
->seq_ctrl
);
852 frag
= sc
& IEEE80211_SCTL_FRAG
;
854 if (likely((!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) && frag
== 0) ||
855 (rx
->skb
)->len
< 24 ||
856 is_multicast_ether_addr(hdr
->addr1
))) {
860 I802_DEBUG_INC(rx
->local
->rx_handlers_fragments
);
862 seq
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
865 /* This is the first fragment of a new frame. */
866 entry
= ieee80211_reassemble_add(rx
->sdata
, frag
, seq
,
867 rx
->queue
, &(rx
->skb
));
868 if (rx
->key
&& rx
->key
->conf
.alg
== ALG_CCMP
&&
869 (rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
870 /* Store CCMP PN so that we can verify that the next
871 * fragment has a sequential PN value. */
873 memcpy(entry
->last_pn
,
874 rx
->key
->u
.ccmp
.rx_pn
[rx
->queue
],
880 /* This is a fragment for a frame that should already be pending in
881 * fragment cache. Add this fragment to the end of the pending entry.
883 entry
= ieee80211_reassemble_find(rx
->sdata
, rx
->fc
, frag
, seq
,
886 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
887 return RX_DROP_MONITOR
;
890 /* Verify that MPDUs within one MSDU have sequential PN values.
891 * (IEEE 802.11i, 8.3.3.4.5) */
894 u8 pn
[CCMP_PN_LEN
], *rpn
;
895 if (!rx
->key
|| rx
->key
->conf
.alg
!= ALG_CCMP
)
896 return RX_DROP_UNUSABLE
;
897 memcpy(pn
, entry
->last_pn
, CCMP_PN_LEN
);
898 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
903 rpn
= rx
->key
->u
.ccmp
.rx_pn
[rx
->queue
];
904 if (memcmp(pn
, rpn
, CCMP_PN_LEN
) != 0) {
906 printk(KERN_DEBUG
"%s: defrag: CCMP PN not "
908 " PN=%02x%02x%02x%02x%02x%02x "
909 "(expected %02x%02x%02x%02x%02x%02x)\n",
910 rx
->dev
->name
, print_mac(mac
, hdr
->addr2
),
911 rpn
[0], rpn
[1], rpn
[2], rpn
[3], rpn
[4],
912 rpn
[5], pn
[0], pn
[1], pn
[2], pn
[3],
914 return RX_DROP_UNUSABLE
;
916 memcpy(entry
->last_pn
, pn
, CCMP_PN_LEN
);
919 skb_pull(rx
->skb
, ieee80211_get_hdrlen(rx
->fc
));
920 __skb_queue_tail(&entry
->skb_list
, rx
->skb
);
921 entry
->last_frag
= frag
;
922 entry
->extra_len
+= rx
->skb
->len
;
923 if (rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) {
928 rx
->skb
= __skb_dequeue(&entry
->skb_list
);
929 if (skb_tailroom(rx
->skb
) < entry
->extra_len
) {
930 I802_DEBUG_INC(rx
->local
->rx_expand_skb_head2
);
931 if (unlikely(pskb_expand_head(rx
->skb
, 0, entry
->extra_len
,
933 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
934 __skb_queue_purge(&entry
->skb_list
);
935 return RX_DROP_UNUSABLE
;
938 while ((skb
= __skb_dequeue(&entry
->skb_list
))) {
939 memcpy(skb_put(rx
->skb
, skb
->len
), skb
->data
, skb
->len
);
943 /* Complete frame has been reassembled - process it now */
944 rx
->flags
|= IEEE80211_RX_FRAGMENTED
;
948 rx
->sta
->rx_packets
++;
949 if (is_multicast_ether_addr(hdr
->addr1
))
950 rx
->local
->dot11MulticastReceivedFrameCount
++;
952 ieee80211_led_rx(rx
->local
);
956 static ieee80211_rx_result
957 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data
*rx
)
959 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
962 DECLARE_MAC_BUF(mac
);
964 if (likely(!rx
->sta
||
965 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
||
966 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_PSPOLL
||
967 !(rx
->flags
& IEEE80211_RX_RA_MATCH
)))
970 if ((sdata
->vif
.type
!= IEEE80211_IF_TYPE_AP
) &&
971 (sdata
->vif
.type
!= IEEE80211_IF_TYPE_VLAN
))
972 return RX_DROP_UNUSABLE
;
974 skb
= skb_dequeue(&rx
->sta
->tx_filtered
);
976 skb
= skb_dequeue(&rx
->sta
->ps_tx_buf
);
978 rx
->local
->total_ps_buffered
--;
980 no_pending_pkts
= skb_queue_empty(&rx
->sta
->tx_filtered
) &&
981 skb_queue_empty(&rx
->sta
->ps_tx_buf
);
984 struct ieee80211_hdr
*hdr
=
985 (struct ieee80211_hdr
*) skb
->data
;
988 * Tell TX path to send one frame even though the STA may
989 * still remain is PS mode after this frame exchange.
991 rx
->sta
->flags
|= WLAN_STA_PSPOLL
;
993 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
994 printk(KERN_DEBUG
"STA %s aid %d: PS Poll (entries after %d)\n",
995 print_mac(mac
, rx
->sta
->addr
), rx
->sta
->aid
,
996 skb_queue_len(&rx
->sta
->ps_tx_buf
));
997 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
999 /* Use MoreData flag to indicate whether there are more
1000 * buffered frames for this STA */
1001 if (no_pending_pkts
)
1002 hdr
->frame_control
&= cpu_to_le16(~IEEE80211_FCTL_MOREDATA
);
1004 hdr
->frame_control
|= cpu_to_le16(IEEE80211_FCTL_MOREDATA
);
1006 dev_queue_xmit(skb
);
1008 if (no_pending_pkts
)
1009 sta_info_clear_tim_bit(rx
->sta
);
1010 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1011 } else if (!rx
->sent_ps_buffered
) {
1013 * FIXME: This can be the result of a race condition between
1014 * us expiring a frame and the station polling for it.
1015 * Should we send it a null-func frame indicating we
1016 * have nothing buffered for it?
1018 printk(KERN_DEBUG
"%s: STA %s sent PS Poll even "
1019 "though there is no buffered frames for it\n",
1020 rx
->dev
->name
, print_mac(mac
, rx
->sta
->addr
));
1021 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1024 /* Free PS Poll skb here instead of returning RX_DROP that would
1025 * count as an dropped frame. */
1026 dev_kfree_skb(rx
->skb
);
1031 static ieee80211_rx_result
1032 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data
*rx
)
1035 u8
*data
= rx
->skb
->data
;
1036 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) data
;
1038 if (!WLAN_FC_IS_QOS_DATA(fc
))
1041 /* remove the qos control field, update frame type and meta-data */
1042 memmove(data
+ 2, data
, ieee80211_get_hdrlen(fc
) - 2);
1043 hdr
= (struct ieee80211_hdr
*) skb_pull(rx
->skb
, 2);
1044 /* change frame type to non QOS */
1045 rx
->fc
= fc
&= ~IEEE80211_STYPE_QOS_DATA
;
1046 hdr
->frame_control
= cpu_to_le16(fc
);
1052 ieee80211_802_1x_port_control(struct ieee80211_rx_data
*rx
)
1054 if (unlikely(!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_AUTHORIZED
))) {
1055 #ifdef CONFIG_MAC80211_DEBUG
1056 if (net_ratelimit())
1057 printk(KERN_DEBUG
"%s: dropped frame "
1058 "(unauthorized port)\n", rx
->dev
->name
);
1059 #endif /* CONFIG_MAC80211_DEBUG */
1067 ieee80211_drop_unencrypted(struct ieee80211_rx_data
*rx
)
1070 * Pass through unencrypted frames if the hardware has
1071 * decrypted them already.
1073 if (rx
->status
->flag
& RX_FLAG_DECRYPTED
)
1076 /* Drop unencrypted frames if key is set. */
1077 if (unlikely(!(rx
->fc
& IEEE80211_FCTL_PROTECTED
) &&
1078 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
1079 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
1080 (rx
->key
|| rx
->sdata
->drop_unencrypted
))) {
1081 if (net_ratelimit())
1082 printk(KERN_DEBUG
"%s: RX non-WEP frame, but expected "
1083 "encryption\n", rx
->dev
->name
);
1090 ieee80211_data_to_8023(struct ieee80211_rx_data
*rx
)
1092 struct net_device
*dev
= rx
->dev
;
1093 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
1094 u16 fc
, hdrlen
, ethertype
;
1098 struct sk_buff
*skb
= rx
->skb
;
1099 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1100 DECLARE_MAC_BUF(mac
);
1101 DECLARE_MAC_BUF(mac2
);
1102 DECLARE_MAC_BUF(mac3
);
1103 DECLARE_MAC_BUF(mac4
);
1107 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1110 hdrlen
= ieee80211_get_hdrlen(fc
);
1112 if (ieee80211_vif_is_mesh(&sdata
->vif
)) {
1113 int meshhdrlen
= ieee80211_get_mesh_hdrlen(
1114 (struct ieee80211s_hdr
*) (skb
->data
+ hdrlen
));
1116 * - mesh header: to be used for mesh forwarding
1117 * decision. It will also be used as mesh header template at
1118 * tx.c:ieee80211_subif_start_xmit() if interface
1119 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
1120 * - ta: to be used if a RERR needs to be sent.
1122 memcpy(skb
->cb
, skb
->data
+ hdrlen
, meshhdrlen
);
1123 memcpy(MESH_PREQ(skb
), hdr
->addr2
, ETH_ALEN
);
1124 hdrlen
+= meshhdrlen
;
1127 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1129 * IEEE 802.11 address fields:
1130 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1131 * 0 0 DA SA BSSID n/a
1132 * 0 1 DA BSSID SA n/a
1133 * 1 0 BSSID SA DA n/a
1137 switch (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) {
1138 case IEEE80211_FCTL_TODS
:
1140 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1141 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1143 if (unlikely(sdata
->vif
.type
!= IEEE80211_IF_TYPE_AP
&&
1144 sdata
->vif
.type
!= IEEE80211_IF_TYPE_VLAN
)) {
1145 if (net_ratelimit())
1146 printk(KERN_DEBUG
"%s: dropped ToDS frame "
1147 "(BSSID=%s SA=%s DA=%s)\n",
1149 print_mac(mac
, hdr
->addr1
),
1150 print_mac(mac2
, hdr
->addr2
),
1151 print_mac(mac3
, hdr
->addr3
));
1155 case (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
):
1157 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1158 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
1160 if (unlikely(sdata
->vif
.type
!= IEEE80211_IF_TYPE_WDS
&&
1161 sdata
->vif
.type
!= IEEE80211_IF_TYPE_MESH_POINT
)) {
1162 if (net_ratelimit())
1163 printk(KERN_DEBUG
"%s: dropped FromDS&ToDS "
1164 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1166 print_mac(mac
, hdr
->addr1
),
1167 print_mac(mac2
, hdr
->addr2
),
1168 print_mac(mac3
, hdr
->addr3
),
1169 print_mac(mac4
, hdr
->addr4
));
1173 case IEEE80211_FCTL_FROMDS
:
1175 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1176 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
1178 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_STA
||
1179 (is_multicast_ether_addr(dst
) &&
1180 !compare_ether_addr(src
, dev
->dev_addr
)))
1185 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1186 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1188 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_IBSS
) {
1189 if (net_ratelimit()) {
1190 printk(KERN_DEBUG
"%s: dropped IBSS frame "
1191 "(DA=%s SA=%s BSSID=%s)\n",
1193 print_mac(mac
, hdr
->addr1
),
1194 print_mac(mac2
, hdr
->addr2
),
1195 print_mac(mac3
, hdr
->addr3
));
1202 if (unlikely(skb
->len
- hdrlen
< 8)) {
1203 if (net_ratelimit()) {
1204 printk(KERN_DEBUG
"%s: RX too short data frame "
1205 "payload\n", dev
->name
);
1210 payload
= skb
->data
+ hdrlen
;
1211 ethertype
= (payload
[6] << 8) | payload
[7];
1213 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1214 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1215 compare_ether_addr(payload
, bridge_tunnel_header
) == 0)) {
1216 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1217 * replace EtherType */
1218 skb_pull(skb
, hdrlen
+ 6);
1219 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1220 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1222 struct ethhdr
*ehdr
;
1225 skb_pull(skb
, hdrlen
);
1226 len
= htons(skb
->len
);
1227 ehdr
= (struct ethhdr
*) skb_push(skb
, sizeof(struct ethhdr
));
1228 memcpy(ehdr
->h_dest
, dst
, ETH_ALEN
);
1229 memcpy(ehdr
->h_source
, src
, ETH_ALEN
);
1230 ehdr
->h_proto
= len
;
1236 * requires that rx->skb is a frame with ethernet header
1238 static bool ieee80211_frame_allowed(struct ieee80211_rx_data
*rx
)
1240 static const u8 pae_group_addr
[ETH_ALEN
]
1241 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1242 struct ethhdr
*ehdr
= (struct ethhdr
*) rx
->skb
->data
;
1245 * Allow EAPOL frames to us/the PAE group address regardless
1246 * of whether the frame was encrypted or not.
1248 if (ehdr
->h_proto
== htons(ETH_P_PAE
) &&
1249 (compare_ether_addr(ehdr
->h_dest
, rx
->dev
->dev_addr
) == 0 ||
1250 compare_ether_addr(ehdr
->h_dest
, pae_group_addr
) == 0))
1253 if (ieee80211_802_1x_port_control(rx
) ||
1254 ieee80211_drop_unencrypted(rx
))
1261 * requires that rx->skb is a frame with ethernet header
1264 ieee80211_deliver_skb(struct ieee80211_rx_data
*rx
)
1266 struct net_device
*dev
= rx
->dev
;
1267 struct ieee80211_local
*local
= rx
->local
;
1268 struct sk_buff
*skb
, *xmit_skb
;
1269 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1270 struct ethhdr
*ehdr
= (struct ethhdr
*) rx
->skb
->data
;
1271 struct sta_info
*dsta
;
1276 if (local
->bridge_packets
&& (sdata
->vif
.type
== IEEE80211_IF_TYPE_AP
||
1277 sdata
->vif
.type
== IEEE80211_IF_TYPE_VLAN
) &&
1278 (rx
->flags
& IEEE80211_RX_RA_MATCH
)) {
1279 if (is_multicast_ether_addr(ehdr
->h_dest
)) {
1281 * send multicast frames both to higher layers in
1282 * local net stack and back to the wireless medium
1284 xmit_skb
= skb_copy(skb
, GFP_ATOMIC
);
1285 if (!xmit_skb
&& net_ratelimit())
1286 printk(KERN_DEBUG
"%s: failed to clone "
1287 "multicast frame\n", dev
->name
);
1289 dsta
= sta_info_get(local
, skb
->data
);
1290 if (dsta
&& dsta
->sdata
->dev
== dev
) {
1292 * The destination station is associated to
1293 * this AP (in this VLAN), so send the frame
1294 * directly to it and do not pass it to local
1303 /* Mesh forwarding */
1304 if (ieee80211_vif_is_mesh(&sdata
->vif
)) {
1305 u8
*mesh_ttl
= &((struct ieee80211s_hdr
*)skb
->cb
)->ttl
;
1308 if (is_multicast_ether_addr(skb
->data
)) {
1309 if (*mesh_ttl
> 0) {
1310 xmit_skb
= skb_copy(skb
, GFP_ATOMIC
);
1311 if (!xmit_skb
&& net_ratelimit())
1312 printk(KERN_DEBUG
"%s: failed to clone "
1313 "multicast frame\n", dev
->name
);
1315 xmit_skb
->pkt_type
= PACKET_OTHERHOST
;
1317 IEEE80211_IFSTA_MESH_CTR_INC(&sdata
->u
.sta
,
1318 dropped_frames_ttl
);
1319 } else if (skb
->pkt_type
!= PACKET_OTHERHOST
&&
1320 compare_ether_addr(dev
->dev_addr
, skb
->data
) != 0) {
1321 if (*mesh_ttl
== 0) {
1322 IEEE80211_IFSTA_MESH_CTR_INC(&sdata
->u
.sta
,
1323 dropped_frames_ttl
);
1328 xmit_skb
->pkt_type
= PACKET_OTHERHOST
;
1329 if (!(dev
->flags
& IFF_PROMISC
))
1336 /* deliver to local stack */
1337 skb
->protocol
= eth_type_trans(skb
, dev
);
1338 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1343 /* send to wireless media */
1344 xmit_skb
->protocol
= htons(ETH_P_802_3
);
1345 skb_reset_network_header(xmit_skb
);
1346 skb_reset_mac_header(xmit_skb
);
1347 dev_queue_xmit(xmit_skb
);
1351 static ieee80211_rx_result
1352 ieee80211_rx_h_amsdu(struct ieee80211_rx_data
*rx
)
1354 struct net_device
*dev
= rx
->dev
;
1355 struct ieee80211_local
*local
= rx
->local
;
1358 struct sk_buff
*skb
= rx
->skb
, *frame
= NULL
;
1359 const struct ethhdr
*eth
;
1363 DECLARE_MAC_BUF(mac
);
1366 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1369 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1370 return RX_DROP_MONITOR
;
1372 if (!(rx
->flags
& IEEE80211_RX_AMSDU
))
1375 err
= ieee80211_data_to_8023(rx
);
1377 return RX_DROP_UNUSABLE
;
1381 dev
->stats
.rx_packets
++;
1382 dev
->stats
.rx_bytes
+= skb
->len
;
1384 /* skip the wrapping header */
1385 eth
= (struct ethhdr
*) skb_pull(skb
, sizeof(struct ethhdr
));
1387 return RX_DROP_UNUSABLE
;
1389 while (skb
!= frame
) {
1391 __be16 len
= eth
->h_proto
;
1392 unsigned int subframe_len
= sizeof(struct ethhdr
) + ntohs(len
);
1394 remaining
= skb
->len
;
1395 memcpy(dst
, eth
->h_dest
, ETH_ALEN
);
1396 memcpy(src
, eth
->h_source
, ETH_ALEN
);
1398 padding
= ((4 - subframe_len
) & 0x3);
1399 /* the last MSDU has no padding */
1400 if (subframe_len
> remaining
) {
1401 printk(KERN_DEBUG
"%s: wrong buffer size", dev
->name
);
1402 return RX_DROP_UNUSABLE
;
1405 skb_pull(skb
, sizeof(struct ethhdr
));
1406 /* if last subframe reuse skb */
1407 if (remaining
<= subframe_len
+ padding
)
1410 frame
= dev_alloc_skb(local
->hw
.extra_tx_headroom
+
1414 return RX_DROP_UNUSABLE
;
1416 skb_reserve(frame
, local
->hw
.extra_tx_headroom
+
1417 sizeof(struct ethhdr
));
1418 memcpy(skb_put(frame
, ntohs(len
)), skb
->data
,
1421 eth
= (struct ethhdr
*) skb_pull(skb
, ntohs(len
) +
1424 printk(KERN_DEBUG
"%s: wrong buffer size ",
1426 dev_kfree_skb(frame
);
1427 return RX_DROP_UNUSABLE
;
1431 skb_reset_network_header(frame
);
1433 frame
->priority
= skb
->priority
;
1436 payload
= frame
->data
;
1437 ethertype
= (payload
[6] << 8) | payload
[7];
1439 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1440 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1441 compare_ether_addr(payload
,
1442 bridge_tunnel_header
) == 0)) {
1443 /* remove RFC1042 or Bridge-Tunnel
1444 * encapsulation and replace EtherType */
1446 memcpy(skb_push(frame
, ETH_ALEN
), src
, ETH_ALEN
);
1447 memcpy(skb_push(frame
, ETH_ALEN
), dst
, ETH_ALEN
);
1449 memcpy(skb_push(frame
, sizeof(__be16
)),
1450 &len
, sizeof(__be16
));
1451 memcpy(skb_push(frame
, ETH_ALEN
), src
, ETH_ALEN
);
1452 memcpy(skb_push(frame
, ETH_ALEN
), dst
, ETH_ALEN
);
1455 if (!ieee80211_frame_allowed(rx
)) {
1456 if (skb
== frame
) /* last frame */
1457 return RX_DROP_UNUSABLE
;
1458 dev_kfree_skb(frame
);
1462 ieee80211_deliver_skb(rx
);
1468 static ieee80211_rx_result
1469 ieee80211_rx_h_data(struct ieee80211_rx_data
*rx
)
1471 struct net_device
*dev
= rx
->dev
;
1476 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1479 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1480 return RX_DROP_MONITOR
;
1482 err
= ieee80211_data_to_8023(rx
);
1484 return RX_DROP_UNUSABLE
;
1486 if (!ieee80211_frame_allowed(rx
))
1487 return RX_DROP_MONITOR
;
1491 dev
->stats
.rx_packets
++;
1492 dev
->stats
.rx_bytes
+= rx
->skb
->len
;
1494 ieee80211_deliver_skb(rx
);
1499 static ieee80211_rx_result
1500 ieee80211_rx_h_ctrl(struct ieee80211_rx_data
*rx
)
1502 struct ieee80211_local
*local
= rx
->local
;
1503 struct ieee80211_hw
*hw
= &local
->hw
;
1504 struct sk_buff
*skb
= rx
->skb
;
1505 struct ieee80211_bar
*bar
= (struct ieee80211_bar
*) skb
->data
;
1506 struct tid_ampdu_rx
*tid_agg_rx
;
1510 if (likely((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
))
1513 if ((rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_BACK_REQ
) {
1516 tid
= le16_to_cpu(bar
->control
) >> 12;
1517 tid_agg_rx
= &(rx
->sta
->ampdu_mlme
.tid_rx
[tid
]);
1518 if (tid_agg_rx
->state
!= HT_AGG_STATE_OPERATIONAL
)
1521 start_seq_num
= le16_to_cpu(bar
->start_seq_num
) >> 4;
1523 /* reset session timer */
1524 if (tid_agg_rx
->timeout
) {
1525 unsigned long expires
=
1526 jiffies
+ (tid_agg_rx
->timeout
/ 1000) * HZ
;
1527 mod_timer(&tid_agg_rx
->session_timer
, expires
);
1530 /* manage reordering buffer according to requested */
1531 /* sequence number */
1533 ieee80211_sta_manage_reorder_buf(hw
, tid_agg_rx
, NULL
,
1536 return RX_DROP_UNUSABLE
;
1542 static ieee80211_rx_result
1543 ieee80211_rx_h_mgmt(struct ieee80211_rx_data
*rx
)
1545 struct ieee80211_sub_if_data
*sdata
;
1547 if (!(rx
->flags
& IEEE80211_RX_RA_MATCH
))
1548 return RX_DROP_MONITOR
;
1550 sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
1551 if ((sdata
->vif
.type
== IEEE80211_IF_TYPE_STA
||
1552 sdata
->vif
.type
== IEEE80211_IF_TYPE_IBSS
||
1553 sdata
->vif
.type
== IEEE80211_IF_TYPE_MESH_POINT
) &&
1554 !(sdata
->flags
& IEEE80211_SDATA_USERSPACE_MLME
))
1555 ieee80211_sta_rx_mgmt(rx
->dev
, rx
->skb
, rx
->status
);
1557 return RX_DROP_MONITOR
;
1562 static void ieee80211_rx_michael_mic_report(struct net_device
*dev
,
1563 struct ieee80211_hdr
*hdr
,
1564 struct ieee80211_rx_data
*rx
)
1567 DECLARE_MAC_BUF(mac
);
1568 DECLARE_MAC_BUF(mac2
);
1570 hdrlen
= ieee80211_get_hdrlen_from_skb(rx
->skb
);
1571 if (rx
->skb
->len
>= hdrlen
+ 4)
1572 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
1576 if (net_ratelimit())
1577 printk(KERN_DEBUG
"%s: TKIP hwaccel reported Michael MIC "
1578 "failure from %s to %s keyidx=%d\n",
1579 dev
->name
, print_mac(mac
, hdr
->addr2
),
1580 print_mac(mac2
, hdr
->addr1
), keyidx
);
1584 * Some hardware seem to generate incorrect Michael MIC
1585 * reports; ignore them to avoid triggering countermeasures.
1587 if (net_ratelimit())
1588 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1589 "error for unknown address %s\n",
1590 dev
->name
, print_mac(mac
, hdr
->addr2
));
1594 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
1595 if (net_ratelimit())
1596 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1597 "error for a frame with no PROTECTED flag (src "
1598 "%s)\n", dev
->name
, print_mac(mac
, hdr
->addr2
));
1602 if (rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_AP
&& keyidx
) {
1604 * APs with pairwise keys should never receive Michael MIC
1605 * errors for non-zero keyidx because these are reserved for
1606 * group keys and only the AP is sending real multicast
1607 * frames in the BSS.
1609 if (net_ratelimit())
1610 printk(KERN_DEBUG
"%s: ignored Michael MIC error for "
1611 "a frame with non-zero keyidx (%d)"
1612 " (src %s)\n", dev
->name
, keyidx
,
1613 print_mac(mac
, hdr
->addr2
));
1617 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
1618 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
1619 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)) {
1620 if (net_ratelimit())
1621 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1622 "error for a frame that cannot be encrypted "
1623 "(fc=0x%04x) (src %s)\n",
1624 dev
->name
, rx
->fc
, print_mac(mac
, hdr
->addr2
));
1628 mac80211_ev_michael_mic_failure(rx
->dev
, keyidx
, hdr
);
1630 dev_kfree_skb(rx
->skb
);
1634 /* TODO: use IEEE80211_RX_FRAGMENTED */
1635 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data
*rx
)
1637 struct ieee80211_sub_if_data
*sdata
;
1638 struct ieee80211_local
*local
= rx
->local
;
1639 struct ieee80211_rtap_hdr
{
1640 struct ieee80211_radiotap_header hdr
;
1645 } __attribute__ ((packed
)) *rthdr
;
1646 struct sk_buff
*skb
= rx
->skb
, *skb2
;
1647 struct net_device
*prev_dev
= NULL
;
1648 struct ieee80211_rx_status
*status
= rx
->status
;
1650 if (rx
->flags
& IEEE80211_RX_CMNTR_REPORTED
)
1653 if (skb_headroom(skb
) < sizeof(*rthdr
) &&
1654 pskb_expand_head(skb
, sizeof(*rthdr
), 0, GFP_ATOMIC
))
1657 rthdr
= (void *)skb_push(skb
, sizeof(*rthdr
));
1658 memset(rthdr
, 0, sizeof(*rthdr
));
1659 rthdr
->hdr
.it_len
= cpu_to_le16(sizeof(*rthdr
));
1660 rthdr
->hdr
.it_present
=
1661 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
1662 (1 << IEEE80211_RADIOTAP_RATE
) |
1663 (1 << IEEE80211_RADIOTAP_CHANNEL
));
1665 rthdr
->rate
= rx
->rate
->bitrate
/ 5;
1666 rthdr
->chan_freq
= cpu_to_le16(status
->freq
);
1668 if (status
->band
== IEEE80211_BAND_5GHZ
)
1669 rthdr
->chan_flags
= cpu_to_le16(IEEE80211_CHAN_OFDM
|
1670 IEEE80211_CHAN_5GHZ
);
1672 rthdr
->chan_flags
= cpu_to_le16(IEEE80211_CHAN_DYN
|
1673 IEEE80211_CHAN_2GHZ
);
1675 skb_set_mac_header(skb
, 0);
1676 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
1677 skb
->pkt_type
= PACKET_OTHERHOST
;
1678 skb
->protocol
= htons(ETH_P_802_2
);
1680 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1681 if (!netif_running(sdata
->dev
))
1684 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_MNTR
||
1685 !(sdata
->u
.mntr_flags
& MONITOR_FLAG_COOK_FRAMES
))
1689 skb2
= skb_clone(skb
, GFP_ATOMIC
);
1691 skb2
->dev
= prev_dev
;
1696 prev_dev
= sdata
->dev
;
1697 sdata
->dev
->stats
.rx_packets
++;
1698 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
1702 skb
->dev
= prev_dev
;
1708 rx
->flags
|= IEEE80211_RX_CMNTR_REPORTED
;
1715 typedef ieee80211_rx_result (*ieee80211_rx_handler
)(struct ieee80211_rx_data
*);
1716 static ieee80211_rx_handler ieee80211_rx_handlers
[] =
1718 ieee80211_rx_h_if_stats
,
1719 ieee80211_rx_h_passive_scan
,
1720 ieee80211_rx_h_check
,
1721 ieee80211_rx_h_decrypt
,
1722 ieee80211_rx_h_sta_process
,
1723 ieee80211_rx_h_defragment
,
1724 ieee80211_rx_h_ps_poll
,
1725 ieee80211_rx_h_michael_mic_verify
,
1726 /* this must be after decryption - so header is counted in MPDU mic
1727 * must be before pae and data, so QOS_DATA format frames
1728 * are not passed to user space by these functions
1730 ieee80211_rx_h_remove_qos_control
,
1731 ieee80211_rx_h_amsdu
,
1732 ieee80211_rx_h_data
,
1733 ieee80211_rx_h_ctrl
,
1734 ieee80211_rx_h_mgmt
,
1738 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data
*sdata
,
1739 struct ieee80211_rx_data
*rx
,
1740 struct sk_buff
*skb
)
1742 ieee80211_rx_handler
*handler
;
1743 ieee80211_rx_result res
= RX_DROP_MONITOR
;
1747 rx
->dev
= sdata
->dev
;
1749 for (handler
= ieee80211_rx_handlers
; *handler
!= NULL
; handler
++) {
1750 res
= (*handler
)(rx
);
1755 case RX_DROP_UNUSABLE
:
1756 case RX_DROP_MONITOR
:
1757 I802_DEBUG_INC(sdata
->local
->rx_handlers_drop
);
1759 rx
->sta
->rx_dropped
++;
1762 I802_DEBUG_INC(sdata
->local
->rx_handlers_queued
);
1770 case RX_DROP_MONITOR
:
1771 ieee80211_rx_cooked_monitor(rx
);
1773 case RX_DROP_UNUSABLE
:
1774 dev_kfree_skb(rx
->skb
);
1779 /* main receive path */
1781 static int prepare_for_handlers(struct ieee80211_sub_if_data
*sdata
,
1782 u8
*bssid
, struct ieee80211_rx_data
*rx
,
1783 struct ieee80211_hdr
*hdr
)
1785 int multicast
= is_multicast_ether_addr(hdr
->addr1
);
1787 switch (sdata
->vif
.type
) {
1788 case IEEE80211_IF_TYPE_STA
:
1791 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1792 if (!(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1794 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1795 } else if (!multicast
&&
1796 compare_ether_addr(sdata
->dev
->dev_addr
,
1798 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1800 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1803 case IEEE80211_IF_TYPE_IBSS
:
1806 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
&&
1807 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_BEACON
)
1809 else if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1810 if (!(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1812 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1813 } else if (!multicast
&&
1814 compare_ether_addr(sdata
->dev
->dev_addr
,
1816 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1818 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1819 } else if (!rx
->sta
)
1820 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
, rx
->skb
,
1823 case IEEE80211_IF_TYPE_MESH_POINT
:
1825 compare_ether_addr(sdata
->dev
->dev_addr
,
1827 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1830 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1833 case IEEE80211_IF_TYPE_VLAN
:
1834 case IEEE80211_IF_TYPE_AP
:
1836 if (compare_ether_addr(sdata
->dev
->dev_addr
,
1839 } else if (!ieee80211_bssid_match(bssid
,
1840 sdata
->dev
->dev_addr
)) {
1841 if (!(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1843 rx
->flags
&= ~IEEE80211_RX_RA_MATCH
;
1845 if (sdata
->dev
== sdata
->local
->mdev
&&
1846 !(rx
->flags
& IEEE80211_RX_IN_SCAN
))
1847 /* do not receive anything via
1848 * master device when not scanning */
1851 case IEEE80211_IF_TYPE_WDS
:
1853 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
)
1855 if (compare_ether_addr(sdata
->u
.wds
.remote_addr
, hdr
->addr2
))
1858 case IEEE80211_IF_TYPE_MNTR
:
1859 /* take everything */
1861 case IEEE80211_IF_TYPE_INVALID
:
1862 /* should never get here */
1871 * This is the actual Rx frames handler. as it blongs to Rx path it must
1872 * be called with rcu_read_lock protection.
1874 static void __ieee80211_rx_handle_packet(struct ieee80211_hw
*hw
,
1875 struct sk_buff
*skb
,
1876 struct ieee80211_rx_status
*status
,
1878 struct ieee80211_rate
*rate
)
1880 struct ieee80211_local
*local
= hw_to_local(hw
);
1881 struct ieee80211_sub_if_data
*sdata
;
1882 struct ieee80211_hdr
*hdr
;
1883 struct ieee80211_rx_data rx
;
1886 struct ieee80211_sub_if_data
*prev
= NULL
;
1887 struct sk_buff
*skb_new
;
1890 hdr
= (struct ieee80211_hdr
*) skb
->data
;
1891 memset(&rx
, 0, sizeof(rx
));
1898 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1899 type
= rx
.fc
& IEEE80211_FCTL_FTYPE
;
1901 if (type
== IEEE80211_FTYPE_DATA
|| type
== IEEE80211_FTYPE_MGMT
)
1902 local
->dot11ReceivedFragmentCount
++;
1904 rx
.sta
= sta_info_get(local
, hdr
->addr2
);
1906 rx
.sdata
= rx
.sta
->sdata
;
1907 rx
.dev
= rx
.sta
->sdata
->dev
;
1910 if ((status
->flag
& RX_FLAG_MMIC_ERROR
)) {
1911 ieee80211_rx_michael_mic_report(local
->mdev
, hdr
, &rx
);
1915 if (unlikely(local
->sta_sw_scanning
|| local
->sta_hw_scanning
))
1916 rx
.flags
|= IEEE80211_RX_IN_SCAN
;
1918 ieee80211_parse_qos(&rx
);
1919 ieee80211_verify_ip_alignment(&rx
);
1923 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1924 if (!netif_running(sdata
->dev
))
1927 if (sdata
->vif
.type
== IEEE80211_IF_TYPE_MNTR
)
1930 bssid
= ieee80211_get_bssid(hdr
, skb
->len
, sdata
->vif
.type
);
1931 rx
.flags
|= IEEE80211_RX_RA_MATCH
;
1932 prepares
= prepare_for_handlers(sdata
, bssid
, &rx
, hdr
);
1938 * frame is destined for this interface, but if it's not
1939 * also for the previous one we handle that after the
1940 * loop to avoid copying the SKB once too much
1949 * frame was destined for the previous interface
1950 * so invoke RX handlers for it
1953 skb_new
= skb_copy(skb
, GFP_ATOMIC
);
1955 if (net_ratelimit())
1956 printk(KERN_DEBUG
"%s: failed to copy "
1957 "multicast frame for %s",
1958 wiphy_name(local
->hw
.wiphy
),
1962 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1963 ieee80211_invoke_rx_handlers(prev
, &rx
, skb_new
);
1967 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1968 ieee80211_invoke_rx_handlers(prev
, &rx
, skb
);
1973 #define SEQ_MODULO 0x1000
1974 #define SEQ_MASK 0xfff
1976 static inline int seq_less(u16 sq1
, u16 sq2
)
1978 return (((sq1
- sq2
) & SEQ_MASK
) > (SEQ_MODULO
>> 1));
1981 static inline u16
seq_inc(u16 sq
)
1983 return ((sq
+ 1) & SEQ_MASK
);
1986 static inline u16
seq_sub(u16 sq1
, u16 sq2
)
1988 return ((sq1
- sq2
) & SEQ_MASK
);
1993 * As it function blongs to Rx path it must be called with
1994 * the proper rcu_read_lock protection for its flow.
1996 u8
ieee80211_sta_manage_reorder_buf(struct ieee80211_hw
*hw
,
1997 struct tid_ampdu_rx
*tid_agg_rx
,
1998 struct sk_buff
*skb
, u16 mpdu_seq_num
,
2001 struct ieee80211_local
*local
= hw_to_local(hw
);
2002 struct ieee80211_rx_status status
;
2003 u16 head_seq_num
, buf_size
;
2006 struct ieee80211_supported_band
*sband
;
2007 struct ieee80211_rate
*rate
;
2009 buf_size
= tid_agg_rx
->buf_size
;
2010 head_seq_num
= tid_agg_rx
->head_seq_num
;
2012 /* frame with out of date sequence number */
2013 if (seq_less(mpdu_seq_num
, head_seq_num
)) {
2018 /* if frame sequence number exceeds our buffering window size or
2019 * block Ack Request arrived - release stored frames */
2020 if ((!seq_less(mpdu_seq_num
, head_seq_num
+ buf_size
)) || (bar_req
)) {
2021 /* new head to the ordering buffer */
2023 head_seq_num
= mpdu_seq_num
;
2026 seq_inc(seq_sub(mpdu_seq_num
, buf_size
));
2027 /* release stored frames up to new head to stack */
2028 while (seq_less(tid_agg_rx
->head_seq_num
, head_seq_num
)) {
2029 index
= seq_sub(tid_agg_rx
->head_seq_num
,
2031 % tid_agg_rx
->buf_size
;
2033 if (tid_agg_rx
->reorder_buf
[index
]) {
2034 /* release the reordered frames to stack */
2036 tid_agg_rx
->reorder_buf
[index
]->cb
,
2038 sband
= local
->hw
.wiphy
->bands
[status
.band
];
2039 rate
= &sband
->bitrates
[status
.rate_idx
];
2040 pkt_load
= ieee80211_rx_load_stats(local
,
2041 tid_agg_rx
->reorder_buf
[index
],
2043 __ieee80211_rx_handle_packet(hw
,
2044 tid_agg_rx
->reorder_buf
[index
],
2045 &status
, pkt_load
, rate
);
2046 tid_agg_rx
->stored_mpdu_num
--;
2047 tid_agg_rx
->reorder_buf
[index
] = NULL
;
2049 tid_agg_rx
->head_seq_num
=
2050 seq_inc(tid_agg_rx
->head_seq_num
);
2056 /* now the new frame is always in the range of the reordering */
2058 index
= seq_sub(mpdu_seq_num
, tid_agg_rx
->ssn
)
2059 % tid_agg_rx
->buf_size
;
2060 /* check if we already stored this frame */
2061 if (tid_agg_rx
->reorder_buf
[index
]) {
2066 /* if arrived mpdu is in the right order and nothing else stored */
2067 /* release it immediately */
2068 if (mpdu_seq_num
== tid_agg_rx
->head_seq_num
&&
2069 tid_agg_rx
->stored_mpdu_num
== 0) {
2070 tid_agg_rx
->head_seq_num
=
2071 seq_inc(tid_agg_rx
->head_seq_num
);
2075 /* put the frame in the reordering buffer */
2076 tid_agg_rx
->reorder_buf
[index
] = skb
;
2077 tid_agg_rx
->stored_mpdu_num
++;
2078 /* release the buffer until next missing frame */
2079 index
= seq_sub(tid_agg_rx
->head_seq_num
, tid_agg_rx
->ssn
)
2080 % tid_agg_rx
->buf_size
;
2081 while (tid_agg_rx
->reorder_buf
[index
]) {
2082 /* release the reordered frame back to stack */
2083 memcpy(&status
, tid_agg_rx
->reorder_buf
[index
]->cb
,
2085 sband
= local
->hw
.wiphy
->bands
[status
.band
];
2086 rate
= &sband
->bitrates
[status
.rate_idx
];
2087 pkt_load
= ieee80211_rx_load_stats(local
,
2088 tid_agg_rx
->reorder_buf
[index
],
2090 __ieee80211_rx_handle_packet(hw
, tid_agg_rx
->reorder_buf
[index
],
2091 &status
, pkt_load
, rate
);
2092 tid_agg_rx
->stored_mpdu_num
--;
2093 tid_agg_rx
->reorder_buf
[index
] = NULL
;
2094 tid_agg_rx
->head_seq_num
= seq_inc(tid_agg_rx
->head_seq_num
);
2095 index
= seq_sub(tid_agg_rx
->head_seq_num
,
2096 tid_agg_rx
->ssn
) % tid_agg_rx
->buf_size
;
2101 static u8
ieee80211_rx_reorder_ampdu(struct ieee80211_local
*local
,
2102 struct sk_buff
*skb
)
2104 struct ieee80211_hw
*hw
= &local
->hw
;
2105 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
2106 struct sta_info
*sta
;
2107 struct tid_ampdu_rx
*tid_agg_rx
;
2113 sta
= sta_info_get(local
, hdr
->addr2
);
2117 fc
= le16_to_cpu(hdr
->frame_control
);
2119 /* filter the QoS data rx stream according to
2120 * STA/TID and check if this STA/TID is on aggregation */
2121 if (!WLAN_FC_IS_QOS_DATA(fc
))
2124 qc
= skb
->data
+ ieee80211_get_hdrlen(fc
) - QOS_CONTROL_LEN
;
2125 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
2126 tid_agg_rx
= &(sta
->ampdu_mlme
.tid_rx
[tid
]);
2128 if (tid_agg_rx
->state
!= HT_AGG_STATE_OPERATIONAL
)
2131 /* null data frames are excluded */
2132 if (unlikely(fc
& IEEE80211_STYPE_NULLFUNC
))
2135 /* new un-ordered ampdu frame - process it */
2137 /* reset session timer */
2138 if (tid_agg_rx
->timeout
) {
2139 unsigned long expires
=
2140 jiffies
+ (tid_agg_rx
->timeout
/ 1000) * HZ
;
2141 mod_timer(&tid_agg_rx
->session_timer
, expires
);
2144 /* if this mpdu is fragmented - terminate rx aggregation session */
2145 sc
= le16_to_cpu(hdr
->seq_ctrl
);
2146 if (sc
& IEEE80211_SCTL_FRAG
) {
2147 ieee80211_sta_stop_rx_ba_session(sta
->sdata
->dev
, sta
->addr
,
2148 tid
, 0, WLAN_REASON_QSTA_REQUIRE_SETUP
);
2153 /* according to mpdu sequence number deal with reordering buffer */
2154 mpdu_seq_num
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
2155 ret
= ieee80211_sta_manage_reorder_buf(hw
, tid_agg_rx
, skb
,
2162 * This is the receive path handler. It is called by a low level driver when an
2163 * 802.11 MPDU is received from the hardware.
2165 void __ieee80211_rx(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
2166 struct ieee80211_rx_status
*status
)
2168 struct ieee80211_local
*local
= hw_to_local(hw
);
2170 struct ieee80211_rate
*rate
= NULL
;
2171 struct ieee80211_supported_band
*sband
;
2173 if (status
->band
< 0 ||
2174 status
->band
> IEEE80211_NUM_BANDS
) {
2179 sband
= local
->hw
.wiphy
->bands
[status
->band
];
2182 status
->rate_idx
< 0 ||
2183 status
->rate_idx
>= sband
->n_bitrates
) {
2188 rate
= &sband
->bitrates
[status
->rate_idx
];
2191 * key references and virtual interfaces are protected using RCU
2192 * and this requires that we are in a read-side RCU section during
2193 * receive processing
2198 * Frames with failed FCS/PLCP checksum are not returned,
2199 * all other frames are returned without radiotap header
2200 * if it was previously present.
2201 * Also, frames with less than 16 bytes are dropped.
2203 skb
= ieee80211_rx_monitor(local
, skb
, status
, rate
);
2209 pkt_load
= ieee80211_rx_load_stats(local
, skb
, status
, rate
);
2210 local
->channel_use_raw
+= pkt_load
;
2212 if (!ieee80211_rx_reorder_ampdu(local
, skb
))
2213 __ieee80211_rx_handle_packet(hw
, skb
, status
, pkt_load
, rate
);
2217 EXPORT_SYMBOL(__ieee80211_rx
);
2219 /* This is a version of the rx handler that can be called from hard irq
2220 * context. Post the skb on the queue and schedule the tasklet */
2221 void ieee80211_rx_irqsafe(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
2222 struct ieee80211_rx_status
*status
)
2224 struct ieee80211_local
*local
= hw_to_local(hw
);
2226 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status
) > sizeof(skb
->cb
));
2228 skb
->dev
= local
->mdev
;
2229 /* copy status into skb->cb for use by tasklet */
2230 memcpy(skb
->cb
, status
, sizeof(*status
));
2231 skb
->pkt_type
= IEEE80211_RX_MSG
;
2232 skb_queue_tail(&local
->skb_queue
, skb
);
2233 tasklet_schedule(&local
->tasklet
);
2235 EXPORT_SYMBOL(ieee80211_rx_irqsafe
);