2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
27 u8
ieee80211_sta_manage_reorder_buf(struct ieee80211_hw
*hw
,
28 struct tid_ampdu_rx
*tid_agg_rx
,
29 struct sk_buff
*skb
, u16 mpdu_seq_num
,
32 * monitor mode reception
34 * This function cleans up the SKB, i.e. it removes all the stuff
35 * only useful for monitoring.
37 static struct sk_buff
*remove_monitor_info(struct ieee80211_local
*local
,
41 skb_pull(skb
, rtap_len
);
43 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
) {
44 if (likely(skb
->len
> FCS_LEN
))
45 skb_trim(skb
, skb
->len
- FCS_LEN
);
57 static inline int should_drop_frame(struct ieee80211_rx_status
*status
,
62 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
64 if (status
->flag
& (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
66 if (unlikely(skb
->len
< 16 + present_fcs_len
+ radiotap_len
))
68 if (((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_FTYPE
)) ==
69 cpu_to_le16(IEEE80211_FTYPE_CTL
)) &&
70 ((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_STYPE
)) !=
71 cpu_to_le16(IEEE80211_STYPE_PSPOLL
)) &&
72 ((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_STYPE
)) !=
73 cpu_to_le16(IEEE80211_STYPE_BACK_REQ
)))
79 * This function copies a received frame to all monitor interfaces and
80 * returns a cleaned-up SKB that no longer includes the FCS nor the
81 * radiotap header the driver might have added.
83 static struct sk_buff
*
84 ieee80211_rx_monitor(struct ieee80211_local
*local
, struct sk_buff
*origskb
,
85 struct ieee80211_rx_status
*status
,
86 struct ieee80211_rate
*rate
)
88 struct ieee80211_sub_if_data
*sdata
;
89 int needed_headroom
= 0;
90 struct ieee80211_radiotap_header
*rthdr
;
91 __le64
*rttsft
= NULL
;
92 struct ieee80211_rtap_fixed_data
{
98 u8 padding_for_rxflags
;
100 } __attribute__ ((packed
)) *rtfixed
;
101 struct sk_buff
*skb
, *skb2
;
102 struct net_device
*prev_dev
= NULL
;
103 int present_fcs_len
= 0;
107 * First, we may need to make a copy of the skb because
108 * (1) we need to modify it for radiotap (if not present), and
109 * (2) the other RX handlers will modify the skb we got.
111 * We don't need to, of course, if we aren't going to return
112 * the SKB because it has a bad FCS/PLCP checksum.
114 if (status
->flag
& RX_FLAG_RADIOTAP
)
115 rtap_len
= ieee80211_get_radiotap_len(origskb
->data
);
117 /* room for radiotap header, always present fields and TSFT */
118 needed_headroom
= sizeof(*rthdr
) + sizeof(*rtfixed
) + 8;
120 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
121 present_fcs_len
= FCS_LEN
;
123 if (!local
->monitors
) {
124 if (should_drop_frame(status
, origskb
, present_fcs_len
,
126 dev_kfree_skb(origskb
);
130 return remove_monitor_info(local
, origskb
, rtap_len
);
133 if (should_drop_frame(status
, origskb
, present_fcs_len
, rtap_len
)) {
134 /* only need to expand headroom if necessary */
139 * This shouldn't trigger often because most devices have an
140 * RX header they pull before we get here, and that should
141 * be big enough for our radiotap information. We should
142 * probably export the length to drivers so that we can have
143 * them allocate enough headroom to start with.
145 if (skb_headroom(skb
) < needed_headroom
&&
146 pskb_expand_head(skb
, needed_headroom
, 0, GFP_ATOMIC
)) {
152 * Need to make a copy and possibly remove radiotap header
153 * and FCS from the original.
155 skb
= skb_copy_expand(origskb
, needed_headroom
, 0, GFP_ATOMIC
);
157 origskb
= remove_monitor_info(local
, origskb
, rtap_len
);
163 /* if necessary, prepend radiotap information */
164 if (!(status
->flag
& RX_FLAG_RADIOTAP
)) {
165 rtfixed
= (void *) skb_push(skb
, sizeof(*rtfixed
));
166 rtap_len
= sizeof(*rthdr
) + sizeof(*rtfixed
);
167 if (status
->flag
& RX_FLAG_TSFT
) {
168 rttsft
= (void *) skb_push(skb
, sizeof(*rttsft
));
171 rthdr
= (void *) skb_push(skb
, sizeof(*rthdr
));
172 memset(rthdr
, 0, sizeof(*rthdr
));
173 memset(rtfixed
, 0, sizeof(*rtfixed
));
175 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
176 (1 << IEEE80211_RADIOTAP_RATE
) |
177 (1 << IEEE80211_RADIOTAP_CHANNEL
) |
178 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL
) |
179 (1 << IEEE80211_RADIOTAP_RX_FLAGS
));
181 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
182 rtfixed
->flags
|= IEEE80211_RADIOTAP_F_FCS
;
185 *rttsft
= cpu_to_le64(status
->mactime
);
187 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT
);
190 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
191 rtfixed
->rx_flags
= 0;
193 (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
195 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS
);
197 rtfixed
->rate
= rate
->bitrate
/ 5;
199 rtfixed
->chan_freq
= cpu_to_le16(status
->freq
);
201 if (status
->band
== IEEE80211_BAND_5GHZ
)
202 rtfixed
->chan_flags
=
203 cpu_to_le16(IEEE80211_CHAN_OFDM
|
204 IEEE80211_CHAN_5GHZ
);
206 rtfixed
->chan_flags
=
207 cpu_to_le16(IEEE80211_CHAN_DYN
|
208 IEEE80211_CHAN_2GHZ
);
210 rtfixed
->antsignal
= status
->ssi
;
211 rthdr
->it_len
= cpu_to_le16(rtap_len
);
214 skb_reset_mac_header(skb
);
215 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
216 skb
->pkt_type
= PACKET_OTHERHOST
;
217 skb
->protocol
= htons(ETH_P_802_2
);
219 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
220 if (!netif_running(sdata
->dev
))
223 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_MNTR
)
226 if (sdata
->u
.mntr_flags
& MONITOR_FLAG_COOK_FRAMES
)
230 skb2
= skb_clone(skb
, GFP_ATOMIC
);
232 skb2
->dev
= prev_dev
;
237 prev_dev
= sdata
->dev
;
238 sdata
->dev
->stats
.rx_packets
++;
239 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
252 static void ieee80211_parse_qos(struct ieee80211_txrx_data
*rx
)
254 u8
*data
= rx
->skb
->data
;
257 /* does the frame have a qos control field? */
258 if (WLAN_FC_IS_QOS_DATA(rx
->fc
)) {
259 u8
*qc
= data
+ ieee80211_get_hdrlen(rx
->fc
) - QOS_CONTROL_LEN
;
260 /* frame has qos control */
261 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
262 if (qc
[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT
)
263 rx
->flags
|= IEEE80211_TXRXD_RX_AMSDU
;
265 rx
->flags
&= ~IEEE80211_TXRXD_RX_AMSDU
;
267 if (unlikely((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
)) {
268 /* Separate TID for management frames */
269 tid
= NUM_RX_DATA_QUEUES
- 1;
271 /* no qos control present */
272 tid
= 0; /* 802.1d - Best Effort */
276 I802_DEBUG_INC(rx
->local
->wme_rx_queue
[tid
]);
277 /* only a debug counter, sta might not be assigned properly yet */
279 I802_DEBUG_INC(rx
->sta
->wme_rx_queue
[tid
]);
281 rx
->u
.rx
.queue
= tid
;
282 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
283 * For now, set skb->priority to 0 for other cases. */
284 rx
->skb
->priority
= (tid
> 7) ? 0 : tid
;
287 static void ieee80211_verify_ip_alignment(struct ieee80211_txrx_data
*rx
)
289 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
292 if (!WLAN_FC_DATA_PRESENT(rx
->fc
))
296 * Drivers are required to align the payload data in a way that
297 * guarantees that the contained IP header is aligned to a four-
298 * byte boundary. In the case of regular frames, this simply means
299 * aligning the payload to a four-byte boundary (because either
300 * the IP header is directly contained, or IV/RFC1042 headers that
301 * have a length divisible by four are in front of it.
303 * With A-MSDU frames, however, the payload data address must
304 * yield two modulo four because there are 14-byte 802.3 headers
305 * within the A-MSDU frames that push the IP header further back
306 * to a multiple of four again. Thankfully, the specs were sane
307 * enough this time around to require padding each A-MSDU subframe
308 * to a length that is a multiple of four.
310 * Padding like atheros hardware adds which is inbetween the 802.11
311 * header and the payload is not supported, the driver is required
312 * to move the 802.11 header further back in that case.
314 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
315 if (rx
->flags
& IEEE80211_TXRXD_RX_AMSDU
)
317 WARN_ON_ONCE(((unsigned long)(rx
->skb
->data
+ hdrlen
)) & 3);
322 static u32
ieee80211_rx_load_stats(struct ieee80211_local
*local
,
324 struct ieee80211_rx_status
*status
,
325 struct ieee80211_rate
*rate
)
327 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
328 u32 load
= 0, hdrtime
;
330 /* Estimate total channel use caused by this frame */
332 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
333 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
335 if (status
->band
== IEEE80211_BAND_5GHZ
||
336 (status
->band
== IEEE80211_BAND_5GHZ
&&
337 rate
->flags
& IEEE80211_RATE_ERP_G
))
338 hdrtime
= CHAN_UTIL_HDR_SHORT
;
340 hdrtime
= CHAN_UTIL_HDR_LONG
;
343 if (!is_multicast_ether_addr(hdr
->addr1
))
346 /* TODO: optimise again */
347 load
+= skb
->len
* CHAN_UTIL_RATE_LCM
/ rate
->bitrate
;
349 /* Divide channel_use by 8 to avoid wrapping around the counter */
350 load
>>= CHAN_UTIL_SHIFT
;
357 static ieee80211_rx_result
358 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data
*rx
)
361 rx
->sta
->channel_use_raw
+= rx
->u
.rx
.load
;
362 rx
->sdata
->channel_use_raw
+= rx
->u
.rx
.load
;
366 static ieee80211_rx_result
367 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data
*rx
)
369 struct ieee80211_local
*local
= rx
->local
;
370 struct sk_buff
*skb
= rx
->skb
;
372 if (unlikely(local
->sta_hw_scanning
))
373 return ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->u
.rx
.status
);
375 if (unlikely(local
->sta_sw_scanning
)) {
376 /* drop all the other packets during a software scan anyway */
377 if (ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->u
.rx
.status
)
383 if (unlikely(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
)) {
384 /* scanning finished during invoking of handlers */
385 I802_DEBUG_INC(local
->rx_handlers_drop_passive_scan
);
386 return RX_DROP_UNUSABLE
;
392 static ieee80211_rx_result
393 ieee80211_rx_h_check(struct ieee80211_txrx_data
*rx
)
395 struct ieee80211_hdr
*hdr
;
396 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
398 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
399 if (rx
->sta
&& !is_multicast_ether_addr(hdr
->addr1
)) {
400 if (unlikely(rx
->fc
& IEEE80211_FCTL_RETRY
&&
401 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] ==
403 if (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
) {
404 rx
->local
->dot11FrameDuplicateCount
++;
405 rx
->sta
->num_duplicates
++;
407 return RX_DROP_MONITOR
;
409 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] = hdr
->seq_ctrl
;
412 if (unlikely(rx
->skb
->len
< 16)) {
413 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_short
);
414 return RX_DROP_MONITOR
;
417 /* Drop disallowed frame classes based on STA auth/assoc state;
418 * IEEE 802.11, Chap 5.5.
420 * 80211.o does filtering only based on association state, i.e., it
421 * drops Class 3 frames from not associated stations. hostapd sends
422 * deauth/disassoc frames when needed. In addition, hostapd is
423 * responsible for filtering on both auth and assoc states.
425 if (unlikely(((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
||
426 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_CTL
&&
427 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_PSPOLL
)) &&
428 rx
->sdata
->vif
.type
!= IEEE80211_IF_TYPE_IBSS
&&
429 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_ASSOC
)))) {
430 if ((!(rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
431 !(rx
->fc
& IEEE80211_FCTL_TODS
) &&
432 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
)
433 || !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
434 /* Drop IBSS frames and frames for other hosts
436 return RX_DROP_MONITOR
;
439 return RX_DROP_MONITOR
;
446 static ieee80211_rx_result
447 ieee80211_rx_h_decrypt(struct ieee80211_txrx_data
*rx
)
449 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
452 ieee80211_rx_result result
= RX_DROP_UNUSABLE
;
453 struct ieee80211_key
*stakey
= NULL
;
458 * There are three types of keys:
460 * - PTK (pairwise keys)
461 * - STK (station-to-station pairwise keys)
463 * When selecting a key, we have to distinguish between multicast
464 * (including broadcast) and unicast frames, the latter can only
465 * use PTKs and STKs while the former always use GTKs. Unless, of
466 * course, actual WEP keys ("pre-RSNA") are used, then unicast
467 * frames can also use key indizes like GTKs. Hence, if we don't
468 * have a PTK/STK we check the key index for a WEP key.
470 * Note that in a regular BSS, multicast frames are sent by the
471 * AP only, associated stations unicast the frame to the AP first
472 * which then multicasts it on their behalf.
474 * There is also a slight problem in IBSS mode: GTKs are negotiated
475 * with each station, that is something we don't currently handle.
476 * The spec seems to expect that one negotiates the same key with
477 * every station but there's no such requirement; VLANs could be
481 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
))
485 * No point in finding a key and decrypting if the frame is neither
486 * addressed to us nor a multicast frame.
488 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
492 stakey
= rcu_dereference(rx
->sta
->key
);
494 if (!is_multicast_ether_addr(hdr
->addr1
) && stakey
) {
498 * The device doesn't give us the IV so we won't be
499 * able to look up the key. That's ok though, we
500 * don't need to decrypt the frame, we just won't
501 * be able to keep statistics accurate.
502 * Except for key threshold notifications, should
503 * we somehow allow the driver to tell us which key
504 * the hardware used if this flag is set?
506 if ((rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
) &&
507 (rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
))
510 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
512 if (rx
->skb
->len
< 8 + hdrlen
)
513 return RX_DROP_UNUSABLE
; /* TODO: count this? */
516 * no need to call ieee80211_wep_get_keyidx,
517 * it verifies a bunch of things we've done already
519 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
521 rx
->key
= rcu_dereference(rx
->sdata
->keys
[keyidx
]);
524 * RSNA-protected unicast frames should always be sent with
525 * pairwise or station-to-station keys, but for WEP we allow
526 * using a key index as well.
528 if (rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
&&
529 !is_multicast_ether_addr(hdr
->addr1
))
534 rx
->key
->tx_rx_count
++;
535 /* TODO: add threshold stuff again */
537 #ifdef CONFIG_MAC80211_DEBUG
539 printk(KERN_DEBUG
"%s: RX protected frame,"
540 " but have no key\n", rx
->dev
->name
);
541 #endif /* CONFIG_MAC80211_DEBUG */
542 return RX_DROP_MONITOR
;
545 /* Check for weak IVs if possible */
546 if (rx
->sta
&& rx
->key
->conf
.alg
== ALG_WEP
&&
547 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
) &&
548 (!(rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
) ||
549 !(rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
)) &&
550 ieee80211_wep_is_weak_iv(rx
->skb
, rx
->key
))
551 rx
->sta
->wep_weak_iv_count
++;
553 switch (rx
->key
->conf
.alg
) {
555 result
= ieee80211_crypto_wep_decrypt(rx
);
558 result
= ieee80211_crypto_tkip_decrypt(rx
);
561 result
= ieee80211_crypto_ccmp_decrypt(rx
);
565 /* either the frame has been decrypted or will be dropped */
566 rx
->u
.rx
.status
->flag
|= RX_FLAG_DECRYPTED
;
571 static void ap_sta_ps_start(struct net_device
*dev
, struct sta_info
*sta
)
573 struct ieee80211_sub_if_data
*sdata
;
574 DECLARE_MAC_BUF(mac
);
576 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
579 atomic_inc(&sdata
->bss
->num_sta_ps
);
580 sta
->flags
|= WLAN_STA_PS
;
582 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
583 printk(KERN_DEBUG
"%s: STA %s aid %d enters power save mode\n",
584 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
585 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
588 static int ap_sta_ps_end(struct net_device
*dev
, struct sta_info
*sta
)
590 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
593 struct ieee80211_sub_if_data
*sdata
;
594 struct ieee80211_tx_packet_data
*pkt_data
;
595 DECLARE_MAC_BUF(mac
);
597 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
599 atomic_dec(&sdata
->bss
->num_sta_ps
);
600 sta
->flags
&= ~(WLAN_STA_PS
| WLAN_STA_TIM
);
602 if (!skb_queue_empty(&sta
->ps_tx_buf
)) {
603 if (local
->ops
->set_tim
)
604 local
->ops
->set_tim(local_to_hw(local
), sta
->aid
, 0);
606 bss_tim_clear(local
, sdata
->bss
, sta
->aid
);
608 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
609 printk(KERN_DEBUG
"%s: STA %s aid %d exits power save mode\n",
610 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
611 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
612 /* Send all buffered frames to the station */
613 while ((skb
= skb_dequeue(&sta
->tx_filtered
)) != NULL
) {
614 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
616 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
619 while ((skb
= skb_dequeue(&sta
->ps_tx_buf
)) != NULL
) {
620 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
621 local
->total_ps_buffered
--;
623 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
624 printk(KERN_DEBUG
"%s: STA %s aid %d send PS frame "
625 "since STA not sleeping anymore\n", dev
->name
,
626 print_mac(mac
, sta
->addr
), sta
->aid
);
627 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
628 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
635 static ieee80211_rx_result
636 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data
*rx
)
638 struct sta_info
*sta
= rx
->sta
;
639 struct net_device
*dev
= rx
->dev
;
640 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
645 /* Update last_rx only for IBSS packets which are for the current
646 * BSSID to avoid keeping the current IBSS network alive in cases where
647 * other STAs are using different BSSID. */
648 if (rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_IBSS
) {
649 u8
*bssid
= ieee80211_get_bssid(hdr
, rx
->skb
->len
,
650 IEEE80211_IF_TYPE_IBSS
);
651 if (compare_ether_addr(bssid
, rx
->sdata
->u
.sta
.bssid
) == 0)
652 sta
->last_rx
= jiffies
;
654 if (!is_multicast_ether_addr(hdr
->addr1
) ||
655 rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_STA
) {
656 /* Update last_rx only for unicast frames in order to prevent
657 * the Probe Request frames (the only broadcast frames from a
658 * STA in infrastructure mode) from keeping a connection alive.
660 sta
->last_rx
= jiffies
;
663 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
667 sta
->rx_bytes
+= rx
->skb
->len
;
668 sta
->last_rssi
= rx
->u
.rx
.status
->ssi
;
669 sta
->last_signal
= rx
->u
.rx
.status
->signal
;
670 sta
->last_noise
= rx
->u
.rx
.status
->noise
;
672 if (!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
)) {
673 /* Change STA power saving mode only in the end of a frame
674 * exchange sequence */
675 if ((sta
->flags
& WLAN_STA_PS
) && !(rx
->fc
& IEEE80211_FCTL_PM
))
676 rx
->u
.rx
.sent_ps_buffered
+= ap_sta_ps_end(dev
, sta
);
677 else if (!(sta
->flags
& WLAN_STA_PS
) &&
678 (rx
->fc
& IEEE80211_FCTL_PM
))
679 ap_sta_ps_start(dev
, sta
);
682 /* Drop data::nullfunc frames silently, since they are used only to
683 * control station power saving mode. */
684 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
685 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_NULLFUNC
) {
686 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_nullfunc
);
687 /* Update counter and free packet here to avoid counting this
688 * as a dropped packed. */
690 dev_kfree_skb(rx
->skb
);
695 } /* ieee80211_rx_h_sta_process */
697 static inline struct ieee80211_fragment_entry
*
698 ieee80211_reassemble_add(struct ieee80211_sub_if_data
*sdata
,
699 unsigned int frag
, unsigned int seq
, int rx_queue
,
700 struct sk_buff
**skb
)
702 struct ieee80211_fragment_entry
*entry
;
705 idx
= sdata
->fragment_next
;
706 entry
= &sdata
->fragments
[sdata
->fragment_next
++];
707 if (sdata
->fragment_next
>= IEEE80211_FRAGMENT_MAX
)
708 sdata
->fragment_next
= 0;
710 if (!skb_queue_empty(&entry
->skb_list
)) {
711 #ifdef CONFIG_MAC80211_DEBUG
712 struct ieee80211_hdr
*hdr
=
713 (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
714 DECLARE_MAC_BUF(mac
);
715 DECLARE_MAC_BUF(mac2
);
716 printk(KERN_DEBUG
"%s: RX reassembly removed oldest "
717 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
718 "addr1=%s addr2=%s\n",
719 sdata
->dev
->name
, idx
,
720 jiffies
- entry
->first_frag_time
, entry
->seq
,
721 entry
->last_frag
, print_mac(mac
, hdr
->addr1
),
722 print_mac(mac2
, hdr
->addr2
));
723 #endif /* CONFIG_MAC80211_DEBUG */
724 __skb_queue_purge(&entry
->skb_list
);
727 __skb_queue_tail(&entry
->skb_list
, *skb
); /* no need for locking */
729 entry
->first_frag_time
= jiffies
;
731 entry
->rx_queue
= rx_queue
;
732 entry
->last_frag
= frag
;
734 entry
->extra_len
= 0;
739 static inline struct ieee80211_fragment_entry
*
740 ieee80211_reassemble_find(struct ieee80211_sub_if_data
*sdata
,
741 u16 fc
, unsigned int frag
, unsigned int seq
,
742 int rx_queue
, struct ieee80211_hdr
*hdr
)
744 struct ieee80211_fragment_entry
*entry
;
747 idx
= sdata
->fragment_next
;
748 for (i
= 0; i
< IEEE80211_FRAGMENT_MAX
; i
++) {
749 struct ieee80211_hdr
*f_hdr
;
754 idx
= IEEE80211_FRAGMENT_MAX
- 1;
756 entry
= &sdata
->fragments
[idx
];
757 if (skb_queue_empty(&entry
->skb_list
) || entry
->seq
!= seq
||
758 entry
->rx_queue
!= rx_queue
||
759 entry
->last_frag
+ 1 != frag
)
762 f_hdr
= (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
763 f_fc
= le16_to_cpu(f_hdr
->frame_control
);
765 if ((fc
& IEEE80211_FCTL_FTYPE
) != (f_fc
& IEEE80211_FCTL_FTYPE
) ||
766 compare_ether_addr(hdr
->addr1
, f_hdr
->addr1
) != 0 ||
767 compare_ether_addr(hdr
->addr2
, f_hdr
->addr2
) != 0)
770 if (entry
->first_frag_time
+ 2 * HZ
< jiffies
) {
771 __skb_queue_purge(&entry
->skb_list
);
780 static ieee80211_rx_result
781 ieee80211_rx_h_defragment(struct ieee80211_txrx_data
*rx
)
783 struct ieee80211_hdr
*hdr
;
785 unsigned int frag
, seq
;
786 struct ieee80211_fragment_entry
*entry
;
788 DECLARE_MAC_BUF(mac
);
790 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
791 sc
= le16_to_cpu(hdr
->seq_ctrl
);
792 frag
= sc
& IEEE80211_SCTL_FRAG
;
794 if (likely((!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) && frag
== 0) ||
795 (rx
->skb
)->len
< 24 ||
796 is_multicast_ether_addr(hdr
->addr1
))) {
800 I802_DEBUG_INC(rx
->local
->rx_handlers_fragments
);
802 seq
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
805 /* This is the first fragment of a new frame. */
806 entry
= ieee80211_reassemble_add(rx
->sdata
, frag
, seq
,
807 rx
->u
.rx
.queue
, &(rx
->skb
));
808 if (rx
->key
&& rx
->key
->conf
.alg
== ALG_CCMP
&&
809 (rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
810 /* Store CCMP PN so that we can verify that the next
811 * fragment has a sequential PN value. */
813 memcpy(entry
->last_pn
,
814 rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
],
820 /* This is a fragment for a frame that should already be pending in
821 * fragment cache. Add this fragment to the end of the pending entry.
823 entry
= ieee80211_reassemble_find(rx
->sdata
, rx
->fc
, frag
, seq
,
824 rx
->u
.rx
.queue
, hdr
);
826 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
827 return RX_DROP_MONITOR
;
830 /* Verify that MPDUs within one MSDU have sequential PN values.
831 * (IEEE 802.11i, 8.3.3.4.5) */
834 u8 pn
[CCMP_PN_LEN
], *rpn
;
835 if (!rx
->key
|| rx
->key
->conf
.alg
!= ALG_CCMP
)
836 return RX_DROP_UNUSABLE
;
837 memcpy(pn
, entry
->last_pn
, CCMP_PN_LEN
);
838 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
843 rpn
= rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
];
844 if (memcmp(pn
, rpn
, CCMP_PN_LEN
) != 0) {
846 printk(KERN_DEBUG
"%s: defrag: CCMP PN not "
848 " PN=%02x%02x%02x%02x%02x%02x "
849 "(expected %02x%02x%02x%02x%02x%02x)\n",
850 rx
->dev
->name
, print_mac(mac
, hdr
->addr2
),
851 rpn
[0], rpn
[1], rpn
[2], rpn
[3], rpn
[4],
852 rpn
[5], pn
[0], pn
[1], pn
[2], pn
[3],
854 return RX_DROP_UNUSABLE
;
856 memcpy(entry
->last_pn
, pn
, CCMP_PN_LEN
);
859 skb_pull(rx
->skb
, ieee80211_get_hdrlen(rx
->fc
));
860 __skb_queue_tail(&entry
->skb_list
, rx
->skb
);
861 entry
->last_frag
= frag
;
862 entry
->extra_len
+= rx
->skb
->len
;
863 if (rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) {
868 rx
->skb
= __skb_dequeue(&entry
->skb_list
);
869 if (skb_tailroom(rx
->skb
) < entry
->extra_len
) {
870 I802_DEBUG_INC(rx
->local
->rx_expand_skb_head2
);
871 if (unlikely(pskb_expand_head(rx
->skb
, 0, entry
->extra_len
,
873 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
874 __skb_queue_purge(&entry
->skb_list
);
875 return RX_DROP_UNUSABLE
;
878 while ((skb
= __skb_dequeue(&entry
->skb_list
))) {
879 memcpy(skb_put(rx
->skb
, skb
->len
), skb
->data
, skb
->len
);
883 /* Complete frame has been reassembled - process it now */
884 rx
->flags
|= IEEE80211_TXRXD_FRAGMENTED
;
888 rx
->sta
->rx_packets
++;
889 if (is_multicast_ether_addr(hdr
->addr1
))
890 rx
->local
->dot11MulticastReceivedFrameCount
++;
892 ieee80211_led_rx(rx
->local
);
896 static ieee80211_rx_result
897 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data
*rx
)
899 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
902 DECLARE_MAC_BUF(mac
);
904 if (likely(!rx
->sta
||
905 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
||
906 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_PSPOLL
||
907 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)))
910 if ((sdata
->vif
.type
!= IEEE80211_IF_TYPE_AP
) &&
911 (sdata
->vif
.type
!= IEEE80211_IF_TYPE_VLAN
))
912 return RX_DROP_UNUSABLE
;
914 skb
= skb_dequeue(&rx
->sta
->tx_filtered
);
916 skb
= skb_dequeue(&rx
->sta
->ps_tx_buf
);
918 rx
->local
->total_ps_buffered
--;
920 no_pending_pkts
= skb_queue_empty(&rx
->sta
->tx_filtered
) &&
921 skb_queue_empty(&rx
->sta
->ps_tx_buf
);
924 struct ieee80211_hdr
*hdr
=
925 (struct ieee80211_hdr
*) skb
->data
;
927 /* tell TX path to send one frame even though the STA may
928 * still remain is PS mode after this frame exchange */
931 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
932 printk(KERN_DEBUG
"STA %s aid %d: PS Poll (entries after %d)\n",
933 print_mac(mac
, rx
->sta
->addr
), rx
->sta
->aid
,
934 skb_queue_len(&rx
->sta
->ps_tx_buf
));
935 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
937 /* Use MoreData flag to indicate whether there are more
938 * buffered frames for this STA */
939 if (no_pending_pkts
) {
940 hdr
->frame_control
&= cpu_to_le16(~IEEE80211_FCTL_MOREDATA
);
941 rx
->sta
->flags
&= ~WLAN_STA_TIM
;
943 hdr
->frame_control
|= cpu_to_le16(IEEE80211_FCTL_MOREDATA
);
947 if (no_pending_pkts
) {
948 if (rx
->local
->ops
->set_tim
)
949 rx
->local
->ops
->set_tim(local_to_hw(rx
->local
),
952 bss_tim_clear(rx
->local
, rx
->sdata
->bss
, rx
->sta
->aid
);
954 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
955 } else if (!rx
->u
.rx
.sent_ps_buffered
) {
956 printk(KERN_DEBUG
"%s: STA %s sent PS Poll even "
957 "though there is no buffered frames for it\n",
958 rx
->dev
->name
, print_mac(mac
, rx
->sta
->addr
));
959 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
963 /* Free PS Poll skb here instead of returning RX_DROP that would
964 * count as an dropped frame. */
965 dev_kfree_skb(rx
->skb
);
970 static ieee80211_rx_result
971 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data
*rx
)
974 u8
*data
= rx
->skb
->data
;
975 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) data
;
977 if (!WLAN_FC_IS_QOS_DATA(fc
))
980 /* remove the qos control field, update frame type and meta-data */
981 memmove(data
+ 2, data
, ieee80211_get_hdrlen(fc
) - 2);
982 hdr
= (struct ieee80211_hdr
*) skb_pull(rx
->skb
, 2);
983 /* change frame type to non QOS */
984 rx
->fc
= fc
&= ~IEEE80211_STYPE_QOS_DATA
;
985 hdr
->frame_control
= cpu_to_le16(fc
);
991 ieee80211_802_1x_port_control(struct ieee80211_txrx_data
*rx
)
993 if (unlikely(!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_AUTHORIZED
))) {
994 #ifdef CONFIG_MAC80211_DEBUG
996 printk(KERN_DEBUG
"%s: dropped frame "
997 "(unauthorized port)\n", rx
->dev
->name
);
998 #endif /* CONFIG_MAC80211_DEBUG */
1006 ieee80211_drop_unencrypted(struct ieee80211_txrx_data
*rx
)
1009 * Pass through unencrypted frames if the hardware has
1010 * decrypted them already.
1012 if (rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
)
1015 /* Drop unencrypted frames if key is set. */
1016 if (unlikely(!(rx
->fc
& IEEE80211_FCTL_PROTECTED
) &&
1017 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
1018 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
1019 (rx
->key
|| rx
->sdata
->drop_unencrypted
))) {
1020 if (net_ratelimit())
1021 printk(KERN_DEBUG
"%s: RX non-WEP frame, but expected "
1022 "encryption\n", rx
->dev
->name
);
1029 ieee80211_data_to_8023(struct ieee80211_txrx_data
*rx
)
1031 struct net_device
*dev
= rx
->dev
;
1032 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
1033 u16 fc
, hdrlen
, ethertype
;
1037 struct sk_buff
*skb
= rx
->skb
;
1038 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1039 DECLARE_MAC_BUF(mac
);
1040 DECLARE_MAC_BUF(mac2
);
1041 DECLARE_MAC_BUF(mac3
);
1042 DECLARE_MAC_BUF(mac4
);
1046 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1049 hdrlen
= ieee80211_get_hdrlen(fc
);
1051 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1053 * IEEE 802.11 address fields:
1054 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1055 * 0 0 DA SA BSSID n/a
1056 * 0 1 DA BSSID SA n/a
1057 * 1 0 BSSID SA DA n/a
1061 switch (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) {
1062 case IEEE80211_FCTL_TODS
:
1064 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1065 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1067 if (unlikely(sdata
->vif
.type
!= IEEE80211_IF_TYPE_AP
&&
1068 sdata
->vif
.type
!= IEEE80211_IF_TYPE_VLAN
)) {
1069 if (net_ratelimit())
1070 printk(KERN_DEBUG
"%s: dropped ToDS frame "
1071 "(BSSID=%s SA=%s DA=%s)\n",
1073 print_mac(mac
, hdr
->addr1
),
1074 print_mac(mac2
, hdr
->addr2
),
1075 print_mac(mac3
, hdr
->addr3
));
1079 case (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
):
1081 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1082 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
1084 if (unlikely(sdata
->vif
.type
!= IEEE80211_IF_TYPE_WDS
)) {
1085 if (net_ratelimit())
1086 printk(KERN_DEBUG
"%s: dropped FromDS&ToDS "
1087 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1089 print_mac(mac
, hdr
->addr1
),
1090 print_mac(mac2
, hdr
->addr2
),
1091 print_mac(mac3
, hdr
->addr3
),
1092 print_mac(mac4
, hdr
->addr4
));
1096 case IEEE80211_FCTL_FROMDS
:
1098 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1099 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
1101 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_STA
||
1102 (is_multicast_ether_addr(dst
) &&
1103 !compare_ether_addr(src
, dev
->dev_addr
)))
1108 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1109 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1111 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_IBSS
) {
1112 if (net_ratelimit()) {
1113 printk(KERN_DEBUG
"%s: dropped IBSS frame "
1114 "(DA=%s SA=%s BSSID=%s)\n",
1116 print_mac(mac
, hdr
->addr1
),
1117 print_mac(mac2
, hdr
->addr2
),
1118 print_mac(mac3
, hdr
->addr3
));
1125 if (unlikely(skb
->len
- hdrlen
< 8)) {
1126 if (net_ratelimit()) {
1127 printk(KERN_DEBUG
"%s: RX too short data frame "
1128 "payload\n", dev
->name
);
1133 payload
= skb
->data
+ hdrlen
;
1134 ethertype
= (payload
[6] << 8) | payload
[7];
1136 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1137 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1138 compare_ether_addr(payload
, bridge_tunnel_header
) == 0)) {
1139 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1140 * replace EtherType */
1141 skb_pull(skb
, hdrlen
+ 6);
1142 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1143 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1145 struct ethhdr
*ehdr
;
1148 skb_pull(skb
, hdrlen
);
1149 len
= htons(skb
->len
);
1150 ehdr
= (struct ethhdr
*) skb_push(skb
, sizeof(struct ethhdr
));
1151 memcpy(ehdr
->h_dest
, dst
, ETH_ALEN
);
1152 memcpy(ehdr
->h_source
, src
, ETH_ALEN
);
1153 ehdr
->h_proto
= len
;
1159 * requires that rx->skb is a frame with ethernet header
1161 static bool ieee80211_frame_allowed(struct ieee80211_txrx_data
*rx
)
1163 static const u8 pae_group_addr
[ETH_ALEN
]
1164 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1165 struct ethhdr
*ehdr
= (struct ethhdr
*) rx
->skb
->data
;
1168 * Allow EAPOL frames to us/the PAE group address regardless
1169 * of whether the frame was encrypted or not.
1171 if (ehdr
->h_proto
== htons(ETH_P_PAE
) &&
1172 (compare_ether_addr(ehdr
->h_dest
, rx
->dev
->dev_addr
) == 0 ||
1173 compare_ether_addr(ehdr
->h_dest
, pae_group_addr
) == 0))
1176 if (ieee80211_802_1x_port_control(rx
) ||
1177 ieee80211_drop_unencrypted(rx
))
1184 * requires that rx->skb is a frame with ethernet header
1187 ieee80211_deliver_skb(struct ieee80211_txrx_data
*rx
)
1189 struct net_device
*dev
= rx
->dev
;
1190 struct ieee80211_local
*local
= rx
->local
;
1191 struct sk_buff
*skb
, *xmit_skb
;
1192 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1193 struct ethhdr
*ehdr
= (struct ethhdr
*) rx
->skb
->data
;
1194 struct sta_info
*dsta
;
1199 if (local
->bridge_packets
&& (sdata
->vif
.type
== IEEE80211_IF_TYPE_AP
||
1200 sdata
->vif
.type
== IEEE80211_IF_TYPE_VLAN
) &&
1201 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
1202 if (is_multicast_ether_addr(ehdr
->h_dest
)) {
1204 * send multicast frames both to higher layers in
1205 * local net stack and back to the wireless medium
1207 xmit_skb
= skb_copy(skb
, GFP_ATOMIC
);
1208 if (!xmit_skb
&& net_ratelimit())
1209 printk(KERN_DEBUG
"%s: failed to clone "
1210 "multicast frame\n", dev
->name
);
1212 dsta
= sta_info_get(local
, skb
->data
);
1213 if (dsta
&& dsta
->dev
== dev
) {
1215 * The destination station is associated to
1216 * this AP (in this VLAN), so send the frame
1217 * directly to it and do not pass it to local
1229 /* deliver to local stack */
1230 skb
->protocol
= eth_type_trans(skb
, dev
);
1231 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1236 /* send to wireless media */
1237 xmit_skb
->protocol
= __constant_htons(ETH_P_802_3
);
1238 skb_reset_network_header(xmit_skb
);
1239 skb_reset_mac_header(xmit_skb
);
1240 dev_queue_xmit(xmit_skb
);
1244 static ieee80211_rx_result
1245 ieee80211_rx_h_amsdu(struct ieee80211_txrx_data
*rx
)
1247 struct net_device
*dev
= rx
->dev
;
1248 struct ieee80211_local
*local
= rx
->local
;
1251 struct sk_buff
*skb
= rx
->skb
, *frame
= NULL
;
1252 const struct ethhdr
*eth
;
1256 DECLARE_MAC_BUF(mac
);
1259 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1262 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1263 return RX_DROP_MONITOR
;
1265 if (!(rx
->flags
& IEEE80211_TXRXD_RX_AMSDU
))
1268 err
= ieee80211_data_to_8023(rx
);
1270 return RX_DROP_UNUSABLE
;
1274 dev
->stats
.rx_packets
++;
1275 dev
->stats
.rx_bytes
+= skb
->len
;
1277 /* skip the wrapping header */
1278 eth
= (struct ethhdr
*) skb_pull(skb
, sizeof(struct ethhdr
));
1280 return RX_DROP_UNUSABLE
;
1282 while (skb
!= frame
) {
1284 __be16 len
= eth
->h_proto
;
1285 unsigned int subframe_len
= sizeof(struct ethhdr
) + ntohs(len
);
1287 remaining
= skb
->len
;
1288 memcpy(dst
, eth
->h_dest
, ETH_ALEN
);
1289 memcpy(src
, eth
->h_source
, ETH_ALEN
);
1291 padding
= ((4 - subframe_len
) & 0x3);
1292 /* the last MSDU has no padding */
1293 if (subframe_len
> remaining
) {
1294 printk(KERN_DEBUG
"%s: wrong buffer size", dev
->name
);
1295 return RX_DROP_UNUSABLE
;
1298 skb_pull(skb
, sizeof(struct ethhdr
));
1299 /* if last subframe reuse skb */
1300 if (remaining
<= subframe_len
+ padding
)
1303 frame
= dev_alloc_skb(local
->hw
.extra_tx_headroom
+
1307 return RX_DROP_UNUSABLE
;
1309 skb_reserve(frame
, local
->hw
.extra_tx_headroom
+
1310 sizeof(struct ethhdr
));
1311 memcpy(skb_put(frame
, ntohs(len
)), skb
->data
,
1314 eth
= (struct ethhdr
*) skb_pull(skb
, ntohs(len
) +
1317 printk(KERN_DEBUG
"%s: wrong buffer size ",
1319 dev_kfree_skb(frame
);
1320 return RX_DROP_UNUSABLE
;
1324 skb_reset_network_header(frame
);
1326 frame
->priority
= skb
->priority
;
1329 payload
= frame
->data
;
1330 ethertype
= (payload
[6] << 8) | payload
[7];
1332 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1333 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1334 compare_ether_addr(payload
,
1335 bridge_tunnel_header
) == 0)) {
1336 /* remove RFC1042 or Bridge-Tunnel
1337 * encapsulation and replace EtherType */
1339 memcpy(skb_push(frame
, ETH_ALEN
), src
, ETH_ALEN
);
1340 memcpy(skb_push(frame
, ETH_ALEN
), dst
, ETH_ALEN
);
1342 memcpy(skb_push(frame
, sizeof(__be16
)),
1343 &len
, sizeof(__be16
));
1344 memcpy(skb_push(frame
, ETH_ALEN
), src
, ETH_ALEN
);
1345 memcpy(skb_push(frame
, ETH_ALEN
), dst
, ETH_ALEN
);
1348 if (!ieee80211_frame_allowed(rx
)) {
1349 if (skb
== frame
) /* last frame */
1350 return RX_DROP_UNUSABLE
;
1351 dev_kfree_skb(frame
);
1355 ieee80211_deliver_skb(rx
);
1361 static ieee80211_rx_result
1362 ieee80211_rx_h_data(struct ieee80211_txrx_data
*rx
)
1364 struct net_device
*dev
= rx
->dev
;
1369 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1372 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1373 return RX_DROP_MONITOR
;
1375 err
= ieee80211_data_to_8023(rx
);
1377 return RX_DROP_UNUSABLE
;
1379 if (!ieee80211_frame_allowed(rx
))
1380 return RX_DROP_MONITOR
;
1384 dev
->stats
.rx_packets
++;
1385 dev
->stats
.rx_bytes
+= rx
->skb
->len
;
1387 ieee80211_deliver_skb(rx
);
1392 static ieee80211_rx_result
1393 ieee80211_rx_h_ctrl(struct ieee80211_txrx_data
*rx
)
1395 struct ieee80211_local
*local
= rx
->local
;
1396 struct ieee80211_hw
*hw
= &local
->hw
;
1397 struct sk_buff
*skb
= rx
->skb
;
1398 struct ieee80211_bar
*bar
= (struct ieee80211_bar
*) skb
->data
;
1399 struct tid_ampdu_rx
*tid_agg_rx
;
1403 if (likely((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
))
1406 if ((rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_BACK_REQ
) {
1409 tid
= le16_to_cpu(bar
->control
) >> 12;
1410 tid_agg_rx
= &(rx
->sta
->ampdu_mlme
.tid_rx
[tid
]);
1411 if (tid_agg_rx
->state
!= HT_AGG_STATE_OPERATIONAL
)
1414 start_seq_num
= le16_to_cpu(bar
->start_seq_num
) >> 4;
1416 /* reset session timer */
1417 if (tid_agg_rx
->timeout
) {
1418 unsigned long expires
=
1419 jiffies
+ (tid_agg_rx
->timeout
/ 1000) * HZ
;
1420 mod_timer(&tid_agg_rx
->session_timer
, expires
);
1423 /* manage reordering buffer according to requested */
1424 /* sequence number */
1426 ieee80211_sta_manage_reorder_buf(hw
, tid_agg_rx
, NULL
,
1429 return RX_DROP_UNUSABLE
;
1435 static ieee80211_rx_result
1436 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data
*rx
)
1438 struct ieee80211_sub_if_data
*sdata
;
1440 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
1441 return RX_DROP_MONITOR
;
1443 sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
1444 if ((sdata
->vif
.type
== IEEE80211_IF_TYPE_STA
||
1445 sdata
->vif
.type
== IEEE80211_IF_TYPE_IBSS
) &&
1446 !(sdata
->flags
& IEEE80211_SDATA_USERSPACE_MLME
))
1447 ieee80211_sta_rx_mgmt(rx
->dev
, rx
->skb
, rx
->u
.rx
.status
);
1449 return RX_DROP_MONITOR
;
1454 static void ieee80211_rx_michael_mic_report(struct net_device
*dev
,
1455 struct ieee80211_hdr
*hdr
,
1456 struct ieee80211_txrx_data
*rx
)
1459 DECLARE_MAC_BUF(mac
);
1460 DECLARE_MAC_BUF(mac2
);
1462 hdrlen
= ieee80211_get_hdrlen_from_skb(rx
->skb
);
1463 if (rx
->skb
->len
>= hdrlen
+ 4)
1464 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
1468 if (net_ratelimit())
1469 printk(KERN_DEBUG
"%s: TKIP hwaccel reported Michael MIC "
1470 "failure from %s to %s keyidx=%d\n",
1471 dev
->name
, print_mac(mac
, hdr
->addr2
),
1472 print_mac(mac2
, hdr
->addr1
), keyidx
);
1476 * Some hardware seem to generate incorrect Michael MIC
1477 * reports; ignore them to avoid triggering countermeasures.
1479 if (net_ratelimit())
1480 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1481 "error for unknown address %s\n",
1482 dev
->name
, print_mac(mac
, hdr
->addr2
));
1486 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
1487 if (net_ratelimit())
1488 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1489 "error for a frame with no PROTECTED flag (src "
1490 "%s)\n", dev
->name
, print_mac(mac
, hdr
->addr2
));
1494 if (rx
->sdata
->vif
.type
== IEEE80211_IF_TYPE_AP
&& keyidx
) {
1496 * APs with pairwise keys should never receive Michael MIC
1497 * errors for non-zero keyidx because these are reserved for
1498 * group keys and only the AP is sending real multicast
1499 * frames in the BSS.
1501 if (net_ratelimit())
1502 printk(KERN_DEBUG
"%s: ignored Michael MIC error for "
1503 "a frame with non-zero keyidx (%d)"
1504 " (src %s)\n", dev
->name
, keyidx
,
1505 print_mac(mac
, hdr
->addr2
));
1509 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
1510 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
1511 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)) {
1512 if (net_ratelimit())
1513 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1514 "error for a frame that cannot be encrypted "
1515 "(fc=0x%04x) (src %s)\n",
1516 dev
->name
, rx
->fc
, print_mac(mac
, hdr
->addr2
));
1520 mac80211_ev_michael_mic_failure(rx
->dev
, keyidx
, hdr
);
1522 dev_kfree_skb(rx
->skb
);
1526 static void ieee80211_rx_cooked_monitor(struct ieee80211_txrx_data
*rx
)
1528 struct ieee80211_sub_if_data
*sdata
;
1529 struct ieee80211_local
*local
= rx
->local
;
1530 struct ieee80211_rtap_hdr
{
1531 struct ieee80211_radiotap_header hdr
;
1536 } __attribute__ ((packed
)) *rthdr
;
1537 struct sk_buff
*skb
= rx
->skb
, *skb2
;
1538 struct net_device
*prev_dev
= NULL
;
1539 struct ieee80211_rx_status
*status
= rx
->u
.rx
.status
;
1541 if (rx
->flags
& IEEE80211_TXRXD_RX_CMNTR_REPORTED
)
1544 if (skb_headroom(skb
) < sizeof(*rthdr
) &&
1545 pskb_expand_head(skb
, sizeof(*rthdr
), 0, GFP_ATOMIC
))
1548 rthdr
= (void *)skb_push(skb
, sizeof(*rthdr
));
1549 memset(rthdr
, 0, sizeof(*rthdr
));
1550 rthdr
->hdr
.it_len
= cpu_to_le16(sizeof(*rthdr
));
1551 rthdr
->hdr
.it_present
=
1552 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
1553 (1 << IEEE80211_RADIOTAP_RATE
) |
1554 (1 << IEEE80211_RADIOTAP_CHANNEL
));
1556 rthdr
->rate
= rx
->u
.rx
.rate
->bitrate
/ 5;
1557 rthdr
->chan_freq
= cpu_to_le16(status
->freq
);
1559 if (status
->band
== IEEE80211_BAND_5GHZ
)
1560 rthdr
->chan_flags
= cpu_to_le16(IEEE80211_CHAN_OFDM
|
1561 IEEE80211_CHAN_5GHZ
);
1563 rthdr
->chan_flags
= cpu_to_le16(IEEE80211_CHAN_DYN
|
1564 IEEE80211_CHAN_2GHZ
);
1566 skb_set_mac_header(skb
, 0);
1567 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
1568 skb
->pkt_type
= PACKET_OTHERHOST
;
1569 skb
->protocol
= htons(ETH_P_802_2
);
1571 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1572 if (!netif_running(sdata
->dev
))
1575 if (sdata
->vif
.type
!= IEEE80211_IF_TYPE_MNTR
||
1576 !(sdata
->u
.mntr_flags
& MONITOR_FLAG_COOK_FRAMES
))
1580 skb2
= skb_clone(skb
, GFP_ATOMIC
);
1582 skb2
->dev
= prev_dev
;
1587 prev_dev
= sdata
->dev
;
1588 sdata
->dev
->stats
.rx_packets
++;
1589 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
1593 skb
->dev
= prev_dev
;
1599 rx
->flags
|= IEEE80211_TXRXD_RX_CMNTR_REPORTED
;
1606 typedef ieee80211_rx_result (*ieee80211_rx_handler
)(struct ieee80211_txrx_data
*);
1607 static ieee80211_rx_handler ieee80211_rx_handlers
[] =
1609 ieee80211_rx_h_if_stats
,
1610 ieee80211_rx_h_passive_scan
,
1611 ieee80211_rx_h_check
,
1612 ieee80211_rx_h_decrypt
,
1613 ieee80211_rx_h_sta_process
,
1614 ieee80211_rx_h_defragment
,
1615 ieee80211_rx_h_ps_poll
,
1616 ieee80211_rx_h_michael_mic_verify
,
1617 /* this must be after decryption - so header is counted in MPDU mic
1618 * must be before pae and data, so QOS_DATA format frames
1619 * are not passed to user space by these functions
1621 ieee80211_rx_h_remove_qos_control
,
1622 ieee80211_rx_h_amsdu
,
1623 ieee80211_rx_h_data
,
1624 ieee80211_rx_h_ctrl
,
1625 ieee80211_rx_h_mgmt
,
1629 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data
*sdata
,
1630 struct ieee80211_txrx_data
*rx
,
1631 struct sk_buff
*skb
)
1633 ieee80211_rx_handler
*handler
;
1634 ieee80211_rx_result res
= RX_DROP_MONITOR
;
1638 rx
->dev
= sdata
->dev
;
1640 for (handler
= ieee80211_rx_handlers
; *handler
!= NULL
; handler
++) {
1641 res
= (*handler
)(rx
);
1646 case RX_DROP_UNUSABLE
:
1647 case RX_DROP_MONITOR
:
1648 I802_DEBUG_INC(sdata
->local
->rx_handlers_drop
);
1650 rx
->sta
->rx_dropped
++;
1653 I802_DEBUG_INC(sdata
->local
->rx_handlers_queued
);
1661 case RX_DROP_MONITOR
:
1662 ieee80211_rx_cooked_monitor(rx
);
1664 case RX_DROP_UNUSABLE
:
1665 dev_kfree_skb(rx
->skb
);
1670 /* main receive path */
1672 static int prepare_for_handlers(struct ieee80211_sub_if_data
*sdata
,
1673 u8
*bssid
, struct ieee80211_txrx_data
*rx
,
1674 struct ieee80211_hdr
*hdr
)
1676 int multicast
= is_multicast_ether_addr(hdr
->addr1
);
1678 switch (sdata
->vif
.type
) {
1679 case IEEE80211_IF_TYPE_STA
:
1682 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1683 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1685 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1686 } else if (!multicast
&&
1687 compare_ether_addr(sdata
->dev
->dev_addr
,
1689 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1691 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1694 case IEEE80211_IF_TYPE_IBSS
:
1697 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1698 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1700 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1701 } else if (!multicast
&&
1702 compare_ether_addr(sdata
->dev
->dev_addr
,
1704 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1706 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1707 } else if (!rx
->sta
)
1708 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
, rx
->skb
,
1711 case IEEE80211_IF_TYPE_VLAN
:
1712 case IEEE80211_IF_TYPE_AP
:
1714 if (compare_ether_addr(sdata
->dev
->dev_addr
,
1717 } else if (!ieee80211_bssid_match(bssid
,
1718 sdata
->dev
->dev_addr
)) {
1719 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1721 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1723 if (sdata
->dev
== sdata
->local
->mdev
&&
1724 !(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1725 /* do not receive anything via
1726 * master device when not scanning */
1729 case IEEE80211_IF_TYPE_WDS
:
1731 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
)
1733 if (compare_ether_addr(sdata
->u
.wds
.remote_addr
, hdr
->addr2
))
1736 case IEEE80211_IF_TYPE_MNTR
:
1737 /* take everything */
1739 case IEEE80211_IF_TYPE_INVALID
:
1740 /* should never get here */
1749 * This is the actual Rx frames handler. as it blongs to Rx path it must
1750 * be called with rcu_read_lock protection.
1752 static void __ieee80211_rx_handle_packet(struct ieee80211_hw
*hw
,
1753 struct sk_buff
*skb
,
1754 struct ieee80211_rx_status
*status
,
1756 struct ieee80211_rate
*rate
)
1758 struct ieee80211_local
*local
= hw_to_local(hw
);
1759 struct ieee80211_sub_if_data
*sdata
;
1760 struct ieee80211_hdr
*hdr
;
1761 struct ieee80211_txrx_data rx
;
1764 struct ieee80211_sub_if_data
*prev
= NULL
;
1765 struct sk_buff
*skb_new
;
1768 hdr
= (struct ieee80211_hdr
*) skb
->data
;
1769 memset(&rx
, 0, sizeof(rx
));
1773 rx
.u
.rx
.status
= status
;
1774 rx
.u
.rx
.load
= load
;
1775 rx
.u
.rx
.rate
= rate
;
1776 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1777 type
= rx
.fc
& IEEE80211_FCTL_FTYPE
;
1779 if (type
== IEEE80211_FTYPE_DATA
|| type
== IEEE80211_FTYPE_MGMT
)
1780 local
->dot11ReceivedFragmentCount
++;
1782 rx
.sta
= sta_info_get(local
, hdr
->addr2
);
1784 rx
.dev
= rx
.sta
->dev
;
1785 rx
.sdata
= IEEE80211_DEV_TO_SUB_IF(rx
.dev
);
1788 if ((status
->flag
& RX_FLAG_MMIC_ERROR
)) {
1789 ieee80211_rx_michael_mic_report(local
->mdev
, hdr
, &rx
);
1793 if (unlikely(local
->sta_sw_scanning
|| local
->sta_hw_scanning
))
1794 rx
.flags
|= IEEE80211_TXRXD_RXIN_SCAN
;
1796 ieee80211_parse_qos(&rx
);
1797 ieee80211_verify_ip_alignment(&rx
);
1801 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1802 if (!netif_running(sdata
->dev
))
1805 if (sdata
->vif
.type
== IEEE80211_IF_TYPE_MNTR
)
1808 bssid
= ieee80211_get_bssid(hdr
, skb
->len
, sdata
->vif
.type
);
1809 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1810 prepares
= prepare_for_handlers(sdata
, bssid
, &rx
, hdr
);
1816 * frame is destined for this interface, but if it's not
1817 * also for the previous one we handle that after the
1818 * loop to avoid copying the SKB once too much
1827 * frame was destined for the previous interface
1828 * so invoke RX handlers for it
1831 skb_new
= skb_copy(skb
, GFP_ATOMIC
);
1833 if (net_ratelimit())
1834 printk(KERN_DEBUG
"%s: failed to copy "
1835 "multicast frame for %s",
1836 wiphy_name(local
->hw
.wiphy
),
1840 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1841 ieee80211_invoke_rx_handlers(prev
, &rx
, skb_new
);
1845 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1846 ieee80211_invoke_rx_handlers(prev
, &rx
, skb
);
1852 sta_info_put(rx
.sta
);
1855 #define SEQ_MODULO 0x1000
1856 #define SEQ_MASK 0xfff
1858 static inline int seq_less(u16 sq1
, u16 sq2
)
1860 return (((sq1
- sq2
) & SEQ_MASK
) > (SEQ_MODULO
>> 1));
1863 static inline u16
seq_inc(u16 sq
)
1865 return ((sq
+ 1) & SEQ_MASK
);
1868 static inline u16
seq_sub(u16 sq1
, u16 sq2
)
1870 return ((sq1
- sq2
) & SEQ_MASK
);
1875 * As it function blongs to Rx path it must be called with
1876 * the proper rcu_read_lock protection for its flow.
1878 u8
ieee80211_sta_manage_reorder_buf(struct ieee80211_hw
*hw
,
1879 struct tid_ampdu_rx
*tid_agg_rx
,
1880 struct sk_buff
*skb
, u16 mpdu_seq_num
,
1883 struct ieee80211_local
*local
= hw_to_local(hw
);
1884 struct ieee80211_rx_status status
;
1885 u16 head_seq_num
, buf_size
;
1888 struct ieee80211_supported_band
*sband
;
1889 struct ieee80211_rate
*rate
;
1891 buf_size
= tid_agg_rx
->buf_size
;
1892 head_seq_num
= tid_agg_rx
->head_seq_num
;
1894 /* frame with out of date sequence number */
1895 if (seq_less(mpdu_seq_num
, head_seq_num
)) {
1900 /* if frame sequence number exceeds our buffering window size or
1901 * block Ack Request arrived - release stored frames */
1902 if ((!seq_less(mpdu_seq_num
, head_seq_num
+ buf_size
)) || (bar_req
)) {
1903 /* new head to the ordering buffer */
1905 head_seq_num
= mpdu_seq_num
;
1908 seq_inc(seq_sub(mpdu_seq_num
, buf_size
));
1909 /* release stored frames up to new head to stack */
1910 while (seq_less(tid_agg_rx
->head_seq_num
, head_seq_num
)) {
1911 index
= seq_sub(tid_agg_rx
->head_seq_num
,
1913 % tid_agg_rx
->buf_size
;
1915 if (tid_agg_rx
->reorder_buf
[index
]) {
1916 /* release the reordered frames to stack */
1918 tid_agg_rx
->reorder_buf
[index
]->cb
,
1920 sband
= local
->hw
.wiphy
->bands
[status
.band
];
1921 rate
= &sband
->bitrates
[status
.rate_idx
];
1922 pkt_load
= ieee80211_rx_load_stats(local
,
1923 tid_agg_rx
->reorder_buf
[index
],
1925 __ieee80211_rx_handle_packet(hw
,
1926 tid_agg_rx
->reorder_buf
[index
],
1927 &status
, pkt_load
, rate
);
1928 tid_agg_rx
->stored_mpdu_num
--;
1929 tid_agg_rx
->reorder_buf
[index
] = NULL
;
1931 tid_agg_rx
->head_seq_num
=
1932 seq_inc(tid_agg_rx
->head_seq_num
);
1938 /* now the new frame is always in the range of the reordering */
1940 index
= seq_sub(mpdu_seq_num
, tid_agg_rx
->ssn
)
1941 % tid_agg_rx
->buf_size
;
1942 /* check if we already stored this frame */
1943 if (tid_agg_rx
->reorder_buf
[index
]) {
1948 /* if arrived mpdu is in the right order and nothing else stored */
1949 /* release it immediately */
1950 if (mpdu_seq_num
== tid_agg_rx
->head_seq_num
&&
1951 tid_agg_rx
->stored_mpdu_num
== 0) {
1952 tid_agg_rx
->head_seq_num
=
1953 seq_inc(tid_agg_rx
->head_seq_num
);
1957 /* put the frame in the reordering buffer */
1958 tid_agg_rx
->reorder_buf
[index
] = skb
;
1959 tid_agg_rx
->stored_mpdu_num
++;
1960 /* release the buffer until next missing frame */
1961 index
= seq_sub(tid_agg_rx
->head_seq_num
, tid_agg_rx
->ssn
)
1962 % tid_agg_rx
->buf_size
;
1963 while (tid_agg_rx
->reorder_buf
[index
]) {
1964 /* release the reordered frame back to stack */
1965 memcpy(&status
, tid_agg_rx
->reorder_buf
[index
]->cb
,
1967 sband
= local
->hw
.wiphy
->bands
[status
.band
];
1968 rate
= &sband
->bitrates
[status
.rate_idx
];
1969 pkt_load
= ieee80211_rx_load_stats(local
,
1970 tid_agg_rx
->reorder_buf
[index
],
1972 __ieee80211_rx_handle_packet(hw
, tid_agg_rx
->reorder_buf
[index
],
1973 &status
, pkt_load
, rate
);
1974 tid_agg_rx
->stored_mpdu_num
--;
1975 tid_agg_rx
->reorder_buf
[index
] = NULL
;
1976 tid_agg_rx
->head_seq_num
= seq_inc(tid_agg_rx
->head_seq_num
);
1977 index
= seq_sub(tid_agg_rx
->head_seq_num
,
1978 tid_agg_rx
->ssn
) % tid_agg_rx
->buf_size
;
1983 static u8
ieee80211_rx_reorder_ampdu(struct ieee80211_local
*local
,
1984 struct sk_buff
*skb
)
1986 struct ieee80211_hw
*hw
= &local
->hw
;
1987 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
1988 struct sta_info
*sta
;
1989 struct tid_ampdu_rx
*tid_agg_rx
;
1995 sta
= sta_info_get(local
, hdr
->addr2
);
1999 fc
= le16_to_cpu(hdr
->frame_control
);
2001 /* filter the QoS data rx stream according to
2002 * STA/TID and check if this STA/TID is on aggregation */
2003 if (!WLAN_FC_IS_QOS_DATA(fc
))
2006 qc
= skb
->data
+ ieee80211_get_hdrlen(fc
) - QOS_CONTROL_LEN
;
2007 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
2008 tid_agg_rx
= &(sta
->ampdu_mlme
.tid_rx
[tid
]);
2010 if (tid_agg_rx
->state
!= HT_AGG_STATE_OPERATIONAL
)
2013 /* null data frames are excluded */
2014 if (unlikely(fc
& IEEE80211_STYPE_NULLFUNC
))
2017 /* new un-ordered ampdu frame - process it */
2019 /* reset session timer */
2020 if (tid_agg_rx
->timeout
) {
2021 unsigned long expires
=
2022 jiffies
+ (tid_agg_rx
->timeout
/ 1000) * HZ
;
2023 mod_timer(&tid_agg_rx
->session_timer
, expires
);
2026 /* if this mpdu is fragmented - terminate rx aggregation session */
2027 sc
= le16_to_cpu(hdr
->seq_ctrl
);
2028 if (sc
& IEEE80211_SCTL_FRAG
) {
2029 ieee80211_sta_stop_rx_ba_session(sta
->dev
, sta
->addr
,
2030 tid
, 0, WLAN_REASON_QSTA_REQUIRE_SETUP
);
2035 /* according to mpdu sequence number deal with reordering buffer */
2036 mpdu_seq_num
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
2037 ret
= ieee80211_sta_manage_reorder_buf(hw
, tid_agg_rx
, skb
,
2046 * This is the receive path handler. It is called by a low level driver when an
2047 * 802.11 MPDU is received from the hardware.
2049 void __ieee80211_rx(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
2050 struct ieee80211_rx_status
*status
)
2052 struct ieee80211_local
*local
= hw_to_local(hw
);
2054 struct ieee80211_rate
*rate
= NULL
;
2055 struct ieee80211_supported_band
*sband
;
2057 if (status
->band
< 0 ||
2058 status
->band
> IEEE80211_NUM_BANDS
) {
2063 sband
= local
->hw
.wiphy
->bands
[status
->band
];
2066 status
->rate_idx
< 0 ||
2067 status
->rate_idx
>= sband
->n_bitrates
) {
2072 rate
= &sband
->bitrates
[status
->rate_idx
];
2075 * key references and virtual interfaces are protected using RCU
2076 * and this requires that we are in a read-side RCU section during
2077 * receive processing
2082 * Frames with failed FCS/PLCP checksum are not returned,
2083 * all other frames are returned without radiotap header
2084 * if it was previously present.
2085 * Also, frames with less than 16 bytes are dropped.
2087 skb
= ieee80211_rx_monitor(local
, skb
, status
, rate
);
2093 pkt_load
= ieee80211_rx_load_stats(local
, skb
, status
, rate
);
2094 local
->channel_use_raw
+= pkt_load
;
2096 if (!ieee80211_rx_reorder_ampdu(local
, skb
))
2097 __ieee80211_rx_handle_packet(hw
, skb
, status
, pkt_load
, rate
);
2101 EXPORT_SYMBOL(__ieee80211_rx
);
2103 /* This is a version of the rx handler that can be called from hard irq
2104 * context. Post the skb on the queue and schedule the tasklet */
2105 void ieee80211_rx_irqsafe(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
2106 struct ieee80211_rx_status
*status
)
2108 struct ieee80211_local
*local
= hw_to_local(hw
);
2110 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status
) > sizeof(skb
->cb
));
2112 skb
->dev
= local
->mdev
;
2113 /* copy status into skb->cb for use by tasklet */
2114 memcpy(skb
->cb
, status
, sizeof(*status
));
2115 skb
->pkt_type
= IEEE80211_RX_MSG
;
2116 skb_queue_tail(&local
->skb_queue
, skb
);
2117 tasklet_schedule(&local
->tasklet
);
2119 EXPORT_SYMBOL(ieee80211_rx_irqsafe
);