2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
21 #include "ieee80211_i.h"
29 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30 struct tid_ampdu_rx *tid_agg_rx,
35 * monitor mode reception
37 * This function cleans up the SKB, i.e. it removes all the stuff
38 * only useful for monitoring.
40 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
44 skb_pull(skb, rtap_len);
46 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
47 if (likely(skb->len > FCS_LEN))
48 skb_trim(skb, skb->len - FCS_LEN);
60 static inline int should_drop_frame(struct ieee80211_rx_status *status,
65 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
67 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
69 if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
71 if (ieee80211_is_ctl(hdr->frame_control) &&
72 !ieee80211_is_pspoll(hdr->frame_control) &&
73 !ieee80211_is_back_req(hdr->frame_control))
79 ieee80211_rx_radiotap_len(struct ieee80211_local *local,
80 struct ieee80211_rx_status *status)
84 /* always present fields */
85 len = sizeof(struct ieee80211_radiotap_header) + 9;
87 if (status->flag & RX_FLAG_TSFT)
89 if (local->hw.flags & IEEE80211_HW_SIGNAL_DB ||
90 local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
92 if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
95 if (len & 1) /* padding for RX_FLAGS if necessary */
98 /* make sure radiotap starts at a naturally aligned address */
100 len = roundup(len, 8);
106 * ieee80211_add_rx_radiotap_header - add radiotap header
108 * add a radiotap header containing all the fields which the hardware provided.
111 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
113 struct ieee80211_rx_status *status,
114 struct ieee80211_rate *rate,
117 struct ieee80211_radiotap_header *rthdr;
120 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
121 memset(rthdr, 0, rtap_len);
123 /* radiotap header, set always present flags */
125 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
126 (1 << IEEE80211_RADIOTAP_CHANNEL) |
127 (1 << IEEE80211_RADIOTAP_ANTENNA) |
128 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
129 rthdr->it_len = cpu_to_le16(rtap_len);
131 pos = (unsigned char *)(rthdr+1);
133 /* the order of the following fields is important */
135 /* IEEE80211_RADIOTAP_TSFT */
136 if (status->flag & RX_FLAG_TSFT) {
137 *(__le64 *)pos = cpu_to_le64(status->mactime);
139 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
143 /* IEEE80211_RADIOTAP_FLAGS */
144 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
145 *pos |= IEEE80211_RADIOTAP_F_FCS;
146 if (status->flag & RX_FLAG_SHORTPRE)
147 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
150 /* IEEE80211_RADIOTAP_RATE */
151 if (status->flag & RX_FLAG_HT) {
153 * TODO: add following information into radiotap header once
154 * suitable fields are defined for it:
155 * - MCS index (status->rate_idx)
156 * - HT40 (status->flag & RX_FLAG_40MHZ)
157 * - short-GI (status->flag & RX_FLAG_SHORT_GI)
161 rthdr->it_present |= (1 << IEEE80211_RADIOTAP_RATE);
162 *pos = rate->bitrate / 5;
166 /* IEEE80211_RADIOTAP_CHANNEL */
167 *(__le16 *)pos = cpu_to_le16(status->freq);
169 if (status->band == IEEE80211_BAND_5GHZ)
170 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
171 IEEE80211_CHAN_5GHZ);
172 else if (rate->flags & IEEE80211_RATE_ERP_G)
173 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_OFDM |
174 IEEE80211_CHAN_2GHZ);
176 *(__le16 *)pos = cpu_to_le16(IEEE80211_CHAN_CCK |
177 IEEE80211_CHAN_2GHZ);
180 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
181 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) {
182 *pos = status->signal;
184 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
188 /* IEEE80211_RADIOTAP_DBM_ANTNOISE */
189 if (local->hw.flags & IEEE80211_HW_NOISE_DBM) {
190 *pos = status->noise;
192 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTNOISE);
196 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
198 /* IEEE80211_RADIOTAP_ANTENNA */
199 *pos = status->antenna;
202 /* IEEE80211_RADIOTAP_DB_ANTSIGNAL */
203 if (local->hw.flags & IEEE80211_HW_SIGNAL_DB) {
204 *pos = status->signal;
206 cpu_to_le32(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL);
210 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
212 /* IEEE80211_RADIOTAP_RX_FLAGS */
213 /* ensure 2 byte alignment for the 2 byte field as required */
214 if ((pos - (unsigned char *)rthdr) & 1)
216 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
217 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
218 *(__le16 *)pos |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
223 * This function copies a received frame to all monitor interfaces and
224 * returns a cleaned-up SKB that no longer includes the FCS nor the
225 * radiotap header the driver might have added.
227 static struct sk_buff *
228 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
229 struct ieee80211_rx_status *status,
230 struct ieee80211_rate *rate)
232 struct ieee80211_sub_if_data *sdata;
233 int needed_headroom = 0;
234 struct sk_buff *skb, *skb2;
235 struct net_device *prev_dev = NULL;
236 int present_fcs_len = 0;
240 * First, we may need to make a copy of the skb because
241 * (1) we need to modify it for radiotap (if not present), and
242 * (2) the other RX handlers will modify the skb we got.
244 * We don't need to, of course, if we aren't going to return
245 * the SKB because it has a bad FCS/PLCP checksum.
247 if (status->flag & RX_FLAG_RADIOTAP)
248 rtap_len = ieee80211_get_radiotap_len(origskb->data);
250 /* room for the radiotap header based on driver features */
251 needed_headroom = ieee80211_rx_radiotap_len(local, status);
253 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
254 present_fcs_len = FCS_LEN;
256 if (!local->monitors) {
257 if (should_drop_frame(status, origskb, present_fcs_len,
259 dev_kfree_skb(origskb);
263 return remove_monitor_info(local, origskb, rtap_len);
266 if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
267 /* only need to expand headroom if necessary */
272 * This shouldn't trigger often because most devices have an
273 * RX header they pull before we get here, and that should
274 * be big enough for our radiotap information. We should
275 * probably export the length to drivers so that we can have
276 * them allocate enough headroom to start with.
278 if (skb_headroom(skb) < needed_headroom &&
279 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
285 * Need to make a copy and possibly remove radiotap header
286 * and FCS from the original.
288 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
290 origskb = remove_monitor_info(local, origskb, rtap_len);
296 /* if necessary, prepend radiotap information */
297 if (!(status->flag & RX_FLAG_RADIOTAP))
298 ieee80211_add_rx_radiotap_header(local, skb, status, rate,
301 skb_reset_mac_header(skb);
302 skb->ip_summed = CHECKSUM_UNNECESSARY;
303 skb->pkt_type = PACKET_OTHERHOST;
304 skb->protocol = htons(ETH_P_802_2);
306 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
307 if (!netif_running(sdata->dev))
310 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
313 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
317 skb2 = skb_clone(skb, GFP_ATOMIC);
319 skb2->dev = prev_dev;
324 prev_dev = sdata->dev;
325 sdata->dev->stats.rx_packets++;
326 sdata->dev->stats.rx_bytes += skb->len;
339 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
341 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
344 /* does the frame have a qos control field? */
345 if (ieee80211_is_data_qos(hdr->frame_control)) {
346 u8 *qc = ieee80211_get_qos_ctl(hdr);
347 /* frame has qos control */
348 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
349 if (*qc & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
350 rx->flags |= IEEE80211_RX_AMSDU;
352 rx->flags &= ~IEEE80211_RX_AMSDU;
355 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
357 * Sequence numbers for management frames, QoS data
358 * frames with a broadcast/multicast address in the
359 * Address 1 field, and all non-QoS data frames sent
360 * by QoS STAs are assigned using an additional single
361 * modulo-4096 counter, [...]
363 * We also use that counter for non-QoS STAs.
365 tid = NUM_RX_DATA_QUEUES - 1;
369 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
370 * For now, set skb->priority to 0 for other cases. */
371 rx->skb->priority = (tid > 7) ? 0 : tid;
375 * DOC: Packet alignment
377 * Drivers always need to pass packets that are aligned to two-byte boundaries
380 * Additionally, should, if possible, align the payload data in a way that
381 * guarantees that the contained IP header is aligned to a four-byte
382 * boundary. In the case of regular frames, this simply means aligning the
383 * payload to a four-byte boundary (because either the IP header is directly
384 * contained, or IV/RFC1042 headers that have a length divisible by four are
387 * With A-MSDU frames, however, the payload data address must yield two modulo
388 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
389 * push the IP header further back to a multiple of four again. Thankfully, the
390 * specs were sane enough this time around to require padding each A-MSDU
391 * subframe to a length that is a multiple of four.
393 * Padding like Atheros hardware adds which is inbetween the 802.11 header and
394 * the payload is not supported, the driver is required to move the 802.11
395 * header to be directly in front of the payload in that case.
397 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
399 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
402 #ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
406 if (WARN_ONCE((unsigned long)rx->skb->data & 1,
407 "unaligned packet at 0x%p\n", rx->skb->data))
410 if (!ieee80211_is_data_present(hdr->frame_control))
413 hdrlen = ieee80211_hdrlen(hdr->frame_control);
414 if (rx->flags & IEEE80211_RX_AMSDU)
416 WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
417 "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
423 static ieee80211_rx_result debug_noinline
424 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
426 struct ieee80211_local *local = rx->local;
427 struct sk_buff *skb = rx->skb;
429 if (unlikely(local->hw_scanning))
430 return ieee80211_scan_rx(rx->sdata, skb, rx->status);
432 if (unlikely(local->sw_scanning)) {
433 /* drop all the other packets during a software scan anyway */
434 if (ieee80211_scan_rx(rx->sdata, skb, rx->status)
440 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
441 /* scanning finished during invoking of handlers */
442 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
443 return RX_DROP_UNUSABLE;
449 static ieee80211_rx_result
450 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
452 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
453 unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
455 if (ieee80211_is_data(hdr->frame_control)) {
456 if (!ieee80211_has_a4(hdr->frame_control))
457 return RX_DROP_MONITOR;
458 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
459 return RX_DROP_MONITOR;
462 /* If there is not an established peer link and this is not a peer link
463 * establisment frame, beacon or probe, drop the frame.
466 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
467 struct ieee80211_mgmt *mgmt;
469 if (!ieee80211_is_mgmt(hdr->frame_control))
470 return RX_DROP_MONITOR;
472 if (ieee80211_is_action(hdr->frame_control)) {
473 mgmt = (struct ieee80211_mgmt *)hdr;
474 if (mgmt->u.action.category != PLINK_CATEGORY)
475 return RX_DROP_MONITOR;
479 if (ieee80211_is_probe_req(hdr->frame_control) ||
480 ieee80211_is_probe_resp(hdr->frame_control) ||
481 ieee80211_is_beacon(hdr->frame_control))
484 return RX_DROP_MONITOR;
488 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
490 if (ieee80211_is_data(hdr->frame_control) &&
491 is_multicast_ether_addr(hdr->addr1) &&
492 mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->sdata))
493 return RX_DROP_MONITOR;
500 static ieee80211_rx_result debug_noinline
501 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
503 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
505 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
506 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
507 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
508 rx->sta->last_seq_ctrl[rx->queue] ==
510 if (rx->flags & IEEE80211_RX_RA_MATCH) {
511 rx->local->dot11FrameDuplicateCount++;
512 rx->sta->num_duplicates++;
514 return RX_DROP_MONITOR;
516 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
519 if (unlikely(rx->skb->len < 16)) {
520 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
521 return RX_DROP_MONITOR;
524 /* Drop disallowed frame classes based on STA auth/assoc state;
525 * IEEE 802.11, Chap 5.5.
527 * mac80211 filters only based on association state, i.e. it drops
528 * Class 3 frames from not associated stations. hostapd sends
529 * deauth/disassoc frames when needed. In addition, hostapd is
530 * responsible for filtering on both auth and assoc states.
533 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
534 return ieee80211_rx_mesh_check(rx);
536 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
537 ieee80211_is_pspoll(hdr->frame_control)) &&
538 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
539 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
540 if ((!ieee80211_has_fromds(hdr->frame_control) &&
541 !ieee80211_has_tods(hdr->frame_control) &&
542 ieee80211_is_data(hdr->frame_control)) ||
543 !(rx->flags & IEEE80211_RX_RA_MATCH)) {
544 /* Drop IBSS frames and frames for other hosts
546 return RX_DROP_MONITOR;
549 return RX_DROP_MONITOR;
556 static ieee80211_rx_result debug_noinline
557 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
559 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
562 ieee80211_rx_result result = RX_DROP_UNUSABLE;
563 struct ieee80211_key *stakey = NULL;
568 * There are three types of keys:
570 * - PTK (pairwise keys)
571 * - STK (station-to-station pairwise keys)
573 * When selecting a key, we have to distinguish between multicast
574 * (including broadcast) and unicast frames, the latter can only
575 * use PTKs and STKs while the former always use GTKs. Unless, of
576 * course, actual WEP keys ("pre-RSNA") are used, then unicast
577 * frames can also use key indizes like GTKs. Hence, if we don't
578 * have a PTK/STK we check the key index for a WEP key.
580 * Note that in a regular BSS, multicast frames are sent by the
581 * AP only, associated stations unicast the frame to the AP first
582 * which then multicasts it on their behalf.
584 * There is also a slight problem in IBSS mode: GTKs are negotiated
585 * with each station, that is something we don't currently handle.
586 * The spec seems to expect that one negotiates the same key with
587 * every station but there's no such requirement; VLANs could be
591 if (!ieee80211_has_protected(hdr->frame_control))
595 * No point in finding a key and decrypting if the frame is neither
596 * addressed to us nor a multicast frame.
598 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
602 stakey = rcu_dereference(rx->sta->key);
604 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
608 * The device doesn't give us the IV so we won't be
609 * able to look up the key. That's ok though, we
610 * don't need to decrypt the frame, we just won't
611 * be able to keep statistics accurate.
612 * Except for key threshold notifications, should
613 * we somehow allow the driver to tell us which key
614 * the hardware used if this flag is set?
616 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
617 (rx->status->flag & RX_FLAG_IV_STRIPPED))
620 hdrlen = ieee80211_hdrlen(hdr->frame_control);
622 if (rx->skb->len < 8 + hdrlen)
623 return RX_DROP_UNUSABLE; /* TODO: count this? */
626 * no need to call ieee80211_wep_get_keyidx,
627 * it verifies a bunch of things we've done already
629 keyidx = rx->skb->data[hdrlen + 3] >> 6;
631 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
634 * RSNA-protected unicast frames should always be sent with
635 * pairwise or station-to-station keys, but for WEP we allow
636 * using a key index as well.
638 if (rx->key && rx->key->conf.alg != ALG_WEP &&
639 !is_multicast_ether_addr(hdr->addr1))
644 rx->key->tx_rx_count++;
645 /* TODO: add threshold stuff again */
647 return RX_DROP_MONITOR;
650 /* Check for weak IVs if possible */
651 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
652 ieee80211_is_data(hdr->frame_control) &&
653 (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
654 !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
655 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
656 rx->sta->wep_weak_iv_count++;
658 switch (rx->key->conf.alg) {
660 result = ieee80211_crypto_wep_decrypt(rx);
663 result = ieee80211_crypto_tkip_decrypt(rx);
666 result = ieee80211_crypto_ccmp_decrypt(rx);
670 /* either the frame has been decrypted or will be dropped */
671 rx->status->flag |= RX_FLAG_DECRYPTED;
676 static void ap_sta_ps_start(struct sta_info *sta)
678 struct ieee80211_sub_if_data *sdata = sta->sdata;
679 struct ieee80211_local *local = sdata->local;
681 atomic_inc(&sdata->bss->num_sta_ps);
682 set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
683 if (local->ops->sta_notify)
684 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
685 STA_NOTIFY_SLEEP, &sta->sta);
686 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
687 printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
688 sdata->dev->name, sta->sta.addr, sta->sta.aid);
689 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
692 static int ap_sta_ps_end(struct sta_info *sta)
694 struct ieee80211_sub_if_data *sdata = sta->sdata;
695 struct ieee80211_local *local = sdata->local;
699 atomic_dec(&sdata->bss->num_sta_ps);
701 clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
702 if (local->ops->sta_notify)
703 local->ops->sta_notify(local_to_hw(local), &sdata->vif,
704 STA_NOTIFY_AWAKE, &sta->sta);
706 if (!skb_queue_empty(&sta->ps_tx_buf))
707 sta_info_clear_tim_bit(sta);
709 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
710 printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
711 sdata->dev->name, sta->sta.addr, sta->sta.aid);
712 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
714 /* Send all buffered frames to the station */
715 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
720 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
721 local->total_ps_buffered--;
723 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
724 printk(KERN_DEBUG "%s: STA %pM aid %d send PS frame "
725 "since STA not sleeping anymore\n", sdata->dev->name,
726 sta->sta.addr, sta->sta.aid);
727 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
735 static ieee80211_rx_result debug_noinline
736 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
738 struct sta_info *sta = rx->sta;
739 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
744 /* Update last_rx only for IBSS packets which are for the current
745 * BSSID to avoid keeping the current IBSS network alive in cases where
746 * other STAs are using different BSSID. */
747 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
748 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
749 NL80211_IFTYPE_ADHOC);
750 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
751 sta->last_rx = jiffies;
753 if (!is_multicast_ether_addr(hdr->addr1) ||
754 rx->sdata->vif.type == NL80211_IFTYPE_STATION) {
755 /* Update last_rx only for unicast frames in order to prevent
756 * the Probe Request frames (the only broadcast frames from a
757 * STA in infrastructure mode) from keeping a connection alive.
758 * Mesh beacons will update last_rx when if they are found to
759 * match the current local configuration when processed.
761 sta->last_rx = jiffies;
764 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
768 sta->rx_bytes += rx->skb->len;
769 sta->last_signal = rx->status->signal;
770 sta->last_qual = rx->status->qual;
771 sta->last_noise = rx->status->noise;
774 * Change STA power saving mode only at the end of a frame
777 if (!ieee80211_has_morefrags(hdr->frame_control) &&
778 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
779 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
780 if (test_sta_flags(sta, WLAN_STA_PS)) {
782 * Ignore doze->wake transitions that are
783 * indicated by non-data frames, the standard
784 * is unclear here, but for example going to
785 * PS mode and then scanning would cause a
786 * doze->wake transition for the probe request,
787 * and that is clearly undesirable.
789 if (ieee80211_is_data(hdr->frame_control) &&
790 !ieee80211_has_pm(hdr->frame_control))
791 rx->sent_ps_buffered += ap_sta_ps_end(sta);
793 if (ieee80211_has_pm(hdr->frame_control))
794 ap_sta_ps_start(sta);
798 /* Drop data::nullfunc frames silently, since they are used only to
799 * control station power saving mode. */
800 if (ieee80211_is_nullfunc(hdr->frame_control)) {
801 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
802 /* Update counter and free packet here to avoid counting this
803 * as a dropped packed. */
805 dev_kfree_skb(rx->skb);
810 } /* ieee80211_rx_h_sta_process */
812 static inline struct ieee80211_fragment_entry *
813 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
814 unsigned int frag, unsigned int seq, int rx_queue,
815 struct sk_buff **skb)
817 struct ieee80211_fragment_entry *entry;
820 idx = sdata->fragment_next;
821 entry = &sdata->fragments[sdata->fragment_next++];
822 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
823 sdata->fragment_next = 0;
825 if (!skb_queue_empty(&entry->skb_list)) {
826 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
827 struct ieee80211_hdr *hdr =
828 (struct ieee80211_hdr *) entry->skb_list.next->data;
829 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
830 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
831 "addr1=%pM addr2=%pM\n",
832 sdata->dev->name, idx,
833 jiffies - entry->first_frag_time, entry->seq,
834 entry->last_frag, hdr->addr1, hdr->addr2);
836 __skb_queue_purge(&entry->skb_list);
839 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
841 entry->first_frag_time = jiffies;
843 entry->rx_queue = rx_queue;
844 entry->last_frag = frag;
846 entry->extra_len = 0;
851 static inline struct ieee80211_fragment_entry *
852 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
853 unsigned int frag, unsigned int seq,
854 int rx_queue, struct ieee80211_hdr *hdr)
856 struct ieee80211_fragment_entry *entry;
859 idx = sdata->fragment_next;
860 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
861 struct ieee80211_hdr *f_hdr;
865 idx = IEEE80211_FRAGMENT_MAX - 1;
867 entry = &sdata->fragments[idx];
868 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
869 entry->rx_queue != rx_queue ||
870 entry->last_frag + 1 != frag)
873 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
876 * Check ftype and addresses are equal, else check next fragment
878 if (((hdr->frame_control ^ f_hdr->frame_control) &
879 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
880 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
881 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
884 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
885 __skb_queue_purge(&entry->skb_list);
894 static ieee80211_rx_result debug_noinline
895 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
897 struct ieee80211_hdr *hdr;
900 unsigned int frag, seq;
901 struct ieee80211_fragment_entry *entry;
904 hdr = (struct ieee80211_hdr *)rx->skb->data;
905 fc = hdr->frame_control;
906 sc = le16_to_cpu(hdr->seq_ctrl);
907 frag = sc & IEEE80211_SCTL_FRAG;
909 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
910 (rx->skb)->len < 24 ||
911 is_multicast_ether_addr(hdr->addr1))) {
915 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
917 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
920 /* This is the first fragment of a new frame. */
921 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
922 rx->queue, &(rx->skb));
923 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
924 ieee80211_has_protected(fc)) {
925 /* Store CCMP PN so that we can verify that the next
926 * fragment has a sequential PN value. */
928 memcpy(entry->last_pn,
929 rx->key->u.ccmp.rx_pn[rx->queue],
935 /* This is a fragment for a frame that should already be pending in
936 * fragment cache. Add this fragment to the end of the pending entry.
938 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, rx->queue, hdr);
940 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
941 return RX_DROP_MONITOR;
944 /* Verify that MPDUs within one MSDU have sequential PN values.
945 * (IEEE 802.11i, 8.3.3.4.5) */
948 u8 pn[CCMP_PN_LEN], *rpn;
949 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
950 return RX_DROP_UNUSABLE;
951 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
952 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
957 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
958 if (memcmp(pn, rpn, CCMP_PN_LEN))
959 return RX_DROP_UNUSABLE;
960 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
963 skb_pull(rx->skb, ieee80211_hdrlen(fc));
964 __skb_queue_tail(&entry->skb_list, rx->skb);
965 entry->last_frag = frag;
966 entry->extra_len += rx->skb->len;
967 if (ieee80211_has_morefrags(fc)) {
972 rx->skb = __skb_dequeue(&entry->skb_list);
973 if (skb_tailroom(rx->skb) < entry->extra_len) {
974 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
975 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
977 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
978 __skb_queue_purge(&entry->skb_list);
979 return RX_DROP_UNUSABLE;
982 while ((skb = __skb_dequeue(&entry->skb_list))) {
983 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
987 /* Complete frame has been reassembled - process it now */
988 rx->flags |= IEEE80211_RX_FRAGMENTED;
992 rx->sta->rx_packets++;
993 if (is_multicast_ether_addr(hdr->addr1))
994 rx->local->dot11MulticastReceivedFrameCount++;
996 ieee80211_led_rx(rx->local);
1000 static ieee80211_rx_result debug_noinline
1001 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
1003 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1004 struct sk_buff *skb;
1005 int no_pending_pkts;
1006 __le16 fc = ((struct ieee80211_hdr *)rx->skb->data)->frame_control;
1008 if (likely(!rx->sta || !ieee80211_is_pspoll(fc) ||
1009 !(rx->flags & IEEE80211_RX_RA_MATCH)))
1012 if ((sdata->vif.type != NL80211_IFTYPE_AP) &&
1013 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1014 return RX_DROP_UNUSABLE;
1016 skb = skb_dequeue(&rx->sta->tx_filtered);
1018 skb = skb_dequeue(&rx->sta->ps_tx_buf);
1020 rx->local->total_ps_buffered--;
1022 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
1023 skb_queue_empty(&rx->sta->ps_tx_buf);
1026 struct ieee80211_hdr *hdr =
1027 (struct ieee80211_hdr *) skb->data;
1030 * Tell TX path to send one frame even though the STA may
1031 * still remain is PS mode after this frame exchange.
1033 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
1035 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1036 printk(KERN_DEBUG "STA %pM aid %d: PS Poll (entries after %d)\n",
1037 rx->sta->sta.addr, rx->sta->sta.aid,
1038 skb_queue_len(&rx->sta->ps_tx_buf));
1039 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1041 /* Use MoreData flag to indicate whether there are more
1042 * buffered frames for this STA */
1043 if (no_pending_pkts)
1044 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
1046 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1048 dev_queue_xmit(skb);
1050 if (no_pending_pkts)
1051 sta_info_clear_tim_bit(rx->sta);
1052 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1053 } else if (!rx->sent_ps_buffered) {
1055 * FIXME: This can be the result of a race condition between
1056 * us expiring a frame and the station polling for it.
1057 * Should we send it a null-func frame indicating we
1058 * have nothing buffered for it?
1060 printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
1061 "though there are no buffered frames for it\n",
1062 rx->dev->name, rx->sta->sta.addr);
1063 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1066 /* Free PS Poll skb here instead of returning RX_DROP that would
1067 * count as an dropped frame. */
1068 dev_kfree_skb(rx->skb);
1073 static ieee80211_rx_result debug_noinline
1074 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1076 u8 *data = rx->skb->data;
1077 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)data;
1079 if (!ieee80211_is_data_qos(hdr->frame_control))
1082 /* remove the qos control field, update frame type and meta-data */
1083 memmove(data + IEEE80211_QOS_CTL_LEN, data,
1084 ieee80211_hdrlen(hdr->frame_control) - IEEE80211_QOS_CTL_LEN);
1085 hdr = (struct ieee80211_hdr *)skb_pull(rx->skb, IEEE80211_QOS_CTL_LEN);
1086 /* change frame type to non QOS */
1087 hdr->frame_control &= ~cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1093 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1095 if (unlikely(!rx->sta ||
1096 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED)))
1103 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1106 * Pass through unencrypted frames if the hardware has
1107 * decrypted them already.
1109 if (rx->status->flag & RX_FLAG_DECRYPTED)
1112 /* Drop unencrypted frames if key is set. */
1113 if (unlikely(!ieee80211_has_protected(fc) &&
1114 !ieee80211_is_nullfunc(fc) &&
1115 (rx->key || rx->sdata->drop_unencrypted)))
1122 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1124 struct net_device *dev = rx->dev;
1125 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1126 u16 hdrlen, ethertype;
1129 u8 src[ETH_ALEN] __aligned(2);
1130 struct sk_buff *skb = rx->skb;
1131 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1133 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1136 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1138 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1140 * IEEE 802.11 address fields:
1141 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1142 * 0 0 DA SA BSSID n/a
1143 * 0 1 DA BSSID SA n/a
1144 * 1 0 BSSID SA DA n/a
1147 memcpy(dst, ieee80211_get_DA(hdr), ETH_ALEN);
1148 memcpy(src, ieee80211_get_SA(hdr), ETH_ALEN);
1150 switch (hdr->frame_control &
1151 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1152 case __constant_cpu_to_le16(IEEE80211_FCTL_TODS):
1153 if (unlikely(sdata->vif.type != NL80211_IFTYPE_AP &&
1154 sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1157 case __constant_cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1158 if (unlikely(sdata->vif.type != NL80211_IFTYPE_WDS &&
1159 sdata->vif.type != NL80211_IFTYPE_MESH_POINT))
1161 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1162 struct ieee80211s_hdr *meshdr = (struct ieee80211s_hdr *)
1163 (skb->data + hdrlen);
1164 hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
1165 if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
1166 memcpy(dst, meshdr->eaddr1, ETH_ALEN);
1167 memcpy(src, meshdr->eaddr2, ETH_ALEN);
1171 case __constant_cpu_to_le16(IEEE80211_FCTL_FROMDS):
1172 if (sdata->vif.type != NL80211_IFTYPE_STATION ||
1173 (is_multicast_ether_addr(dst) &&
1174 !compare_ether_addr(src, dev->dev_addr)))
1177 case __constant_cpu_to_le16(0):
1178 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
1183 if (unlikely(skb->len - hdrlen < 8))
1186 payload = skb->data + hdrlen;
1187 ethertype = (payload[6] << 8) | payload[7];
1189 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1190 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1191 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1192 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1193 * replace EtherType */
1194 skb_pull(skb, hdrlen + 6);
1195 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1196 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1198 struct ethhdr *ehdr;
1201 skb_pull(skb, hdrlen);
1202 len = htons(skb->len);
1203 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1204 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1205 memcpy(ehdr->h_source, src, ETH_ALEN);
1206 ehdr->h_proto = len;
1212 * requires that rx->skb is a frame with ethernet header
1214 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1216 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1217 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1218 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1221 * Allow EAPOL frames to us/the PAE group address regardless
1222 * of whether the frame was encrypted or not.
1224 if (ehdr->h_proto == htons(ETH_P_PAE) &&
1225 (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1226 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1229 if (ieee80211_802_1x_port_control(rx) ||
1230 ieee80211_drop_unencrypted(rx, fc))
1237 * requires that rx->skb is a frame with ethernet header
1240 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1242 struct net_device *dev = rx->dev;
1243 struct ieee80211_local *local = rx->local;
1244 struct sk_buff *skb, *xmit_skb;
1245 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1246 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1247 struct sta_info *dsta;
1252 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1253 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1254 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1255 (rx->flags & IEEE80211_RX_RA_MATCH)) {
1256 if (is_multicast_ether_addr(ehdr->h_dest)) {
1258 * send multicast frames both to higher layers in
1259 * local net stack and back to the wireless medium
1261 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1262 if (!xmit_skb && net_ratelimit())
1263 printk(KERN_DEBUG "%s: failed to clone "
1264 "multicast frame\n", dev->name);
1266 dsta = sta_info_get(local, skb->data);
1267 if (dsta && dsta->sdata->dev == dev) {
1269 * The destination station is associated to
1270 * this AP (in this VLAN), so send the frame
1271 * directly to it and do not pass it to local
1281 int align __maybe_unused;
1283 #if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
1285 * 'align' will only take the values 0 or 2 here
1286 * since all frames are required to be aligned
1287 * to 2-byte boundaries when being passed to
1288 * mac80211. That also explains the __skb_push()
1291 align = (unsigned long)skb->data & 4;
1293 if (WARN_ON(skb_headroom(skb) < 3)) {
1297 u8 *data = skb->data;
1298 size_t len = skb->len;
1299 u8 *new = __skb_push(skb, align);
1300 memmove(new, data, len);
1301 __skb_trim(skb, len);
1307 /* deliver to local stack */
1308 skb->protocol = eth_type_trans(skb, dev);
1309 memset(skb->cb, 0, sizeof(skb->cb));
1315 /* send to wireless media */
1316 xmit_skb->protocol = htons(ETH_P_802_3);
1317 skb_reset_network_header(xmit_skb);
1318 skb_reset_mac_header(xmit_skb);
1319 dev_queue_xmit(xmit_skb);
1323 static ieee80211_rx_result debug_noinline
1324 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1326 struct net_device *dev = rx->dev;
1327 struct ieee80211_local *local = rx->local;
1330 struct sk_buff *skb = rx->skb, *frame = NULL;
1331 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1332 __le16 fc = hdr->frame_control;
1333 const struct ethhdr *eth;
1338 if (unlikely(!ieee80211_is_data(fc)))
1341 if (unlikely(!ieee80211_is_data_present(fc)))
1342 return RX_DROP_MONITOR;
1344 if (!(rx->flags & IEEE80211_RX_AMSDU))
1347 err = ieee80211_data_to_8023(rx);
1349 return RX_DROP_UNUSABLE;
1353 dev->stats.rx_packets++;
1354 dev->stats.rx_bytes += skb->len;
1356 /* skip the wrapping header */
1357 eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1359 return RX_DROP_UNUSABLE;
1361 while (skb != frame) {
1363 __be16 len = eth->h_proto;
1364 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1366 remaining = skb->len;
1367 memcpy(dst, eth->h_dest, ETH_ALEN);
1368 memcpy(src, eth->h_source, ETH_ALEN);
1370 padding = ((4 - subframe_len) & 0x3);
1371 /* the last MSDU has no padding */
1372 if (subframe_len > remaining)
1373 return RX_DROP_UNUSABLE;
1375 skb_pull(skb, sizeof(struct ethhdr));
1376 /* if last subframe reuse skb */
1377 if (remaining <= subframe_len + padding)
1381 * Allocate and reserve two bytes more for payload
1382 * alignment since sizeof(struct ethhdr) is 14.
1384 frame = dev_alloc_skb(
1385 ALIGN(local->hw.extra_tx_headroom, 4) +
1389 return RX_DROP_UNUSABLE;
1392 ALIGN(local->hw.extra_tx_headroom, 4) +
1393 sizeof(struct ethhdr) + 2);
1394 memcpy(skb_put(frame, ntohs(len)), skb->data,
1397 eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1400 dev_kfree_skb(frame);
1401 return RX_DROP_UNUSABLE;
1405 skb_reset_network_header(frame);
1407 frame->priority = skb->priority;
1410 payload = frame->data;
1411 ethertype = (payload[6] << 8) | payload[7];
1413 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1414 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1415 compare_ether_addr(payload,
1416 bridge_tunnel_header) == 0)) {
1417 /* remove RFC1042 or Bridge-Tunnel
1418 * encapsulation and replace EtherType */
1420 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1421 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1423 memcpy(skb_push(frame, sizeof(__be16)),
1424 &len, sizeof(__be16));
1425 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1426 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1429 if (!ieee80211_frame_allowed(rx, fc)) {
1430 if (skb == frame) /* last frame */
1431 return RX_DROP_UNUSABLE;
1432 dev_kfree_skb(frame);
1436 ieee80211_deliver_skb(rx);
1442 #ifdef CONFIG_MAC80211_MESH
1443 static ieee80211_rx_result
1444 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1446 struct ieee80211_hdr *hdr;
1447 struct ieee80211s_hdr *mesh_hdr;
1448 unsigned int hdrlen;
1449 struct sk_buff *skb = rx->skb, *fwd_skb;
1451 hdr = (struct ieee80211_hdr *) skb->data;
1452 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1453 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1455 if (!ieee80211_is_data(hdr->frame_control))
1460 return RX_DROP_MONITOR;
1462 if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6){
1463 struct ieee80211_sub_if_data *sdata;
1464 struct mesh_path *mppath;
1466 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1468 mppath = mpp_path_lookup(mesh_hdr->eaddr2, sdata);
1470 mpp_path_add(mesh_hdr->eaddr2, hdr->addr4, sdata);
1472 spin_lock_bh(&mppath->state_lock);
1473 mppath->exp_time = jiffies;
1474 if (compare_ether_addr(mppath->mpp, hdr->addr4) != 0)
1475 memcpy(mppath->mpp, hdr->addr4, ETH_ALEN);
1476 spin_unlock_bh(&mppath->state_lock);
1481 if (compare_ether_addr(rx->dev->dev_addr, hdr->addr3) == 0)
1486 if (rx->flags & IEEE80211_RX_RA_MATCH) {
1488 IEEE80211_IFSTA_MESH_CTR_INC(&rx->sdata->u.mesh,
1489 dropped_frames_ttl);
1491 struct ieee80211_hdr *fwd_hdr;
1492 fwd_skb = skb_copy(skb, GFP_ATOMIC);
1494 if (!fwd_skb && net_ratelimit())
1495 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
1498 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
1500 * Save TA to addr1 to send TA a path error if a
1501 * suitable next hop is not found
1503 memcpy(fwd_hdr->addr1, fwd_hdr->addr2, ETH_ALEN);
1504 memcpy(fwd_hdr->addr2, rx->dev->dev_addr, ETH_ALEN);
1505 fwd_skb->dev = rx->local->mdev;
1506 fwd_skb->iif = rx->dev->ifindex;
1507 dev_queue_xmit(fwd_skb);
1511 if (is_multicast_ether_addr(hdr->addr3) ||
1512 rx->dev->flags & IFF_PROMISC)
1515 return RX_DROP_MONITOR;
1519 static ieee80211_rx_result debug_noinline
1520 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1522 struct net_device *dev = rx->dev;
1523 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1524 __le16 fc = hdr->frame_control;
1527 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
1530 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
1531 return RX_DROP_MONITOR;
1533 err = ieee80211_data_to_8023(rx);
1535 return RX_DROP_UNUSABLE;
1537 if (!ieee80211_frame_allowed(rx, fc))
1538 return RX_DROP_MONITOR;
1542 dev->stats.rx_packets++;
1543 dev->stats.rx_bytes += rx->skb->len;
1545 ieee80211_deliver_skb(rx);
1550 static ieee80211_rx_result debug_noinline
1551 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1553 struct ieee80211_local *local = rx->local;
1554 struct ieee80211_hw *hw = &local->hw;
1555 struct sk_buff *skb = rx->skb;
1556 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
1557 struct tid_ampdu_rx *tid_agg_rx;
1561 if (likely(!ieee80211_is_ctl(bar->frame_control)))
1564 if (ieee80211_is_back_req(bar->frame_control)) {
1567 tid = le16_to_cpu(bar->control) >> 12;
1568 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1569 != HT_AGG_STATE_OPERATIONAL)
1571 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1573 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1575 /* reset session timer */
1576 if (tid_agg_rx->timeout) {
1577 unsigned long expires =
1578 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
1579 mod_timer(&tid_agg_rx->session_timer, expires);
1582 /* manage reordering buffer according to requested */
1583 /* sequence number */
1585 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1588 return RX_DROP_UNUSABLE;
1594 static ieee80211_rx_result debug_noinline
1595 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
1597 struct ieee80211_local *local = rx->local;
1598 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1599 struct ieee80211_if_sta *ifsta = &sdata->u.sta;
1600 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
1601 struct ieee80211_bss *bss;
1602 int len = rx->skb->len;
1604 if (!ieee80211_is_action(mgmt->frame_control))
1608 return RX_DROP_MONITOR;
1610 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1611 return RX_DROP_MONITOR;
1613 /* all categories we currently handle have action_code */
1614 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
1615 return RX_DROP_MONITOR;
1617 switch (mgmt->u.action.category) {
1618 case WLAN_CATEGORY_BACK:
1619 switch (mgmt->u.action.u.addba_req.action_code) {
1620 case WLAN_ACTION_ADDBA_REQ:
1621 if (len < (IEEE80211_MIN_ACTION_SIZE +
1622 sizeof(mgmt->u.action.u.addba_req)))
1623 return RX_DROP_MONITOR;
1624 ieee80211_process_addba_request(local, rx->sta, mgmt, len);
1626 case WLAN_ACTION_ADDBA_RESP:
1627 if (len < (IEEE80211_MIN_ACTION_SIZE +
1628 sizeof(mgmt->u.action.u.addba_resp)))
1629 return RX_DROP_MONITOR;
1630 ieee80211_process_addba_resp(local, rx->sta, mgmt, len);
1632 case WLAN_ACTION_DELBA:
1633 if (len < (IEEE80211_MIN_ACTION_SIZE +
1634 sizeof(mgmt->u.action.u.delba)))
1635 return RX_DROP_MONITOR;
1636 ieee80211_process_delba(sdata, rx->sta, mgmt, len);
1640 case WLAN_CATEGORY_SPECTRUM_MGMT:
1641 if (local->hw.conf.channel->band != IEEE80211_BAND_5GHZ)
1642 return RX_DROP_MONITOR;
1643 switch (mgmt->u.action.u.measurement.action_code) {
1644 case WLAN_ACTION_SPCT_MSR_REQ:
1645 if (len < (IEEE80211_MIN_ACTION_SIZE +
1646 sizeof(mgmt->u.action.u.measurement)))
1647 return RX_DROP_MONITOR;
1648 ieee80211_process_measurement_req(sdata, mgmt, len);
1650 case WLAN_ACTION_SPCT_CHL_SWITCH:
1651 if (len < (IEEE80211_MIN_ACTION_SIZE +
1652 sizeof(mgmt->u.action.u.chan_switch)))
1653 return RX_DROP_MONITOR;
1655 if (memcmp(mgmt->bssid, ifsta->bssid, ETH_ALEN) != 0)
1656 return RX_DROP_MONITOR;
1658 bss = ieee80211_rx_bss_get(local, ifsta->bssid,
1659 local->hw.conf.channel->center_freq,
1660 ifsta->ssid, ifsta->ssid_len);
1662 return RX_DROP_MONITOR;
1664 ieee80211_process_chanswitch(sdata,
1665 &mgmt->u.action.u.chan_switch.sw_elem, bss);
1666 ieee80211_rx_bss_put(local, bss);
1674 rx->sta->rx_packets++;
1675 dev_kfree_skb(rx->skb);
1679 static ieee80211_rx_result debug_noinline
1680 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1682 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1684 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1685 return RX_DROP_MONITOR;
1687 if (ieee80211_vif_is_mesh(&sdata->vif))
1688 return ieee80211_mesh_rx_mgmt(sdata, rx->skb, rx->status);
1690 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
1691 sdata->vif.type != NL80211_IFTYPE_ADHOC)
1692 return RX_DROP_MONITOR;
1694 if (sdata->flags & IEEE80211_SDATA_USERSPACE_MLME)
1695 return RX_DROP_MONITOR;
1697 ieee80211_sta_rx_mgmt(sdata, rx->skb, rx->status);
1701 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1702 struct ieee80211_hdr *hdr,
1703 struct ieee80211_rx_data *rx)
1706 unsigned int hdrlen;
1708 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1709 if (rx->skb->len >= hdrlen + 4)
1710 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1716 * Some hardware seem to generate incorrect Michael MIC
1717 * reports; ignore them to avoid triggering countermeasures.
1722 if (!ieee80211_has_protected(hdr->frame_control))
1725 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && keyidx) {
1727 * APs with pairwise keys should never receive Michael MIC
1728 * errors for non-zero keyidx because these are reserved for
1729 * group keys and only the AP is sending real multicast
1730 * frames in the BSS.
1735 if (!ieee80211_is_data(hdr->frame_control) &&
1736 !ieee80211_is_auth(hdr->frame_control))
1739 mac80211_ev_michael_mic_failure(rx->sdata, keyidx, hdr);
1741 dev_kfree_skb(rx->skb);
1745 /* TODO: use IEEE80211_RX_FRAGMENTED */
1746 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1748 struct ieee80211_sub_if_data *sdata;
1749 struct ieee80211_local *local = rx->local;
1750 struct ieee80211_rtap_hdr {
1751 struct ieee80211_radiotap_header hdr;
1756 } __attribute__ ((packed)) *rthdr;
1757 struct sk_buff *skb = rx->skb, *skb2;
1758 struct net_device *prev_dev = NULL;
1759 struct ieee80211_rx_status *status = rx->status;
1761 if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1764 if (skb_headroom(skb) < sizeof(*rthdr) &&
1765 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1768 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1769 memset(rthdr, 0, sizeof(*rthdr));
1770 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1771 rthdr->hdr.it_present =
1772 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1773 (1 << IEEE80211_RADIOTAP_RATE) |
1774 (1 << IEEE80211_RADIOTAP_CHANNEL));
1776 rthdr->rate = rx->rate->bitrate / 5;
1777 rthdr->chan_freq = cpu_to_le16(status->freq);
1779 if (status->band == IEEE80211_BAND_5GHZ)
1780 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1781 IEEE80211_CHAN_5GHZ);
1783 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1784 IEEE80211_CHAN_2GHZ);
1786 skb_set_mac_header(skb, 0);
1787 skb->ip_summed = CHECKSUM_UNNECESSARY;
1788 skb->pkt_type = PACKET_OTHERHOST;
1789 skb->protocol = htons(ETH_P_802_2);
1791 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1792 if (!netif_running(sdata->dev))
1795 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
1796 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1800 skb2 = skb_clone(skb, GFP_ATOMIC);
1802 skb2->dev = prev_dev;
1807 prev_dev = sdata->dev;
1808 sdata->dev->stats.rx_packets++;
1809 sdata->dev->stats.rx_bytes += skb->len;
1813 skb->dev = prev_dev;
1819 rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
1827 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
1828 struct ieee80211_rx_data *rx,
1829 struct sk_buff *skb)
1831 ieee80211_rx_result res = RX_DROP_MONITOR;
1835 rx->dev = sdata->dev;
1837 #define CALL_RXH(rxh) \
1840 if (res != RX_CONTINUE) \
1844 CALL_RXH(ieee80211_rx_h_passive_scan)
1845 CALL_RXH(ieee80211_rx_h_check)
1846 CALL_RXH(ieee80211_rx_h_decrypt)
1847 CALL_RXH(ieee80211_rx_h_sta_process)
1848 CALL_RXH(ieee80211_rx_h_defragment)
1849 CALL_RXH(ieee80211_rx_h_ps_poll)
1850 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
1851 /* must be after MMIC verify so header is counted in MPDU mic */
1852 CALL_RXH(ieee80211_rx_h_remove_qos_control)
1853 CALL_RXH(ieee80211_rx_h_amsdu)
1854 #ifdef CONFIG_MAC80211_MESH
1855 if (ieee80211_vif_is_mesh(&sdata->vif))
1856 CALL_RXH(ieee80211_rx_h_mesh_fwding);
1858 CALL_RXH(ieee80211_rx_h_data)
1859 CALL_RXH(ieee80211_rx_h_ctrl)
1860 CALL_RXH(ieee80211_rx_h_action)
1861 CALL_RXH(ieee80211_rx_h_mgmt)
1867 case RX_DROP_MONITOR:
1868 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1870 rx->sta->rx_dropped++;
1873 ieee80211_rx_cooked_monitor(rx);
1875 case RX_DROP_UNUSABLE:
1876 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1878 rx->sta->rx_dropped++;
1879 dev_kfree_skb(rx->skb);
1882 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1887 /* main receive path */
1889 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1890 u8 *bssid, struct ieee80211_rx_data *rx,
1891 struct ieee80211_hdr *hdr)
1893 int multicast = is_multicast_ether_addr(hdr->addr1);
1895 switch (sdata->vif.type) {
1896 case NL80211_IFTYPE_STATION:
1899 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1900 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1902 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1903 } else if (!multicast &&
1904 compare_ether_addr(sdata->dev->dev_addr,
1906 if (!(sdata->dev->flags & IFF_PROMISC))
1908 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1911 case NL80211_IFTYPE_ADHOC:
1914 if (ieee80211_is_beacon(hdr->frame_control)) {
1917 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1918 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1920 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1921 } else if (!multicast &&
1922 compare_ether_addr(sdata->dev->dev_addr,
1924 if (!(sdata->dev->flags & IFF_PROMISC))
1926 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1927 } else if (!rx->sta) {
1929 if (rx->status->flag & RX_FLAG_HT)
1930 rate_idx = 0; /* TODO: HT rates */
1932 rate_idx = rx->status->rate_idx;
1933 rx->sta = ieee80211_ibss_add_sta(sdata, bssid, hdr->addr2,
1937 case NL80211_IFTYPE_MESH_POINT:
1939 compare_ether_addr(sdata->dev->dev_addr,
1941 if (!(sdata->dev->flags & IFF_PROMISC))
1944 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1947 case NL80211_IFTYPE_AP_VLAN:
1948 case NL80211_IFTYPE_AP:
1950 if (compare_ether_addr(sdata->dev->dev_addr,
1953 } else if (!ieee80211_bssid_match(bssid,
1954 sdata->dev->dev_addr)) {
1955 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1957 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1960 case NL80211_IFTYPE_WDS:
1961 if (bssid || !ieee80211_is_data(hdr->frame_control))
1963 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1966 case NL80211_IFTYPE_MONITOR:
1967 /* take everything */
1969 case NL80211_IFTYPE_UNSPECIFIED:
1970 case __NL80211_IFTYPE_AFTER_LAST:
1971 /* should never get here */
1980 * This is the actual Rx frames handler. as it blongs to Rx path it must
1981 * be called with rcu_read_lock protection.
1983 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
1984 struct sk_buff *skb,
1985 struct ieee80211_rx_status *status,
1986 struct ieee80211_rate *rate)
1988 struct ieee80211_local *local = hw_to_local(hw);
1989 struct ieee80211_sub_if_data *sdata;
1990 struct ieee80211_hdr *hdr;
1991 struct ieee80211_rx_data rx;
1993 struct ieee80211_sub_if_data *prev = NULL;
1994 struct sk_buff *skb_new;
1997 hdr = (struct ieee80211_hdr *)skb->data;
1998 memset(&rx, 0, sizeof(rx));
2005 if (ieee80211_is_data(hdr->frame_control) || ieee80211_is_mgmt(hdr->frame_control))
2006 local->dot11ReceivedFragmentCount++;
2008 rx.sta = sta_info_get(local, hdr->addr2);
2010 rx.sdata = rx.sta->sdata;
2011 rx.dev = rx.sta->sdata->dev;
2014 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
2015 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
2019 if (unlikely(local->sw_scanning || local->hw_scanning))
2020 rx.flags |= IEEE80211_RX_IN_SCAN;
2022 ieee80211_parse_qos(&rx);
2023 ieee80211_verify_alignment(&rx);
2027 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2028 if (!netif_running(sdata->dev))
2031 if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
2034 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
2035 rx.flags |= IEEE80211_RX_RA_MATCH;
2036 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
2042 * frame is destined for this interface, but if it's not
2043 * also for the previous one we handle that after the
2044 * loop to avoid copying the SKB once too much
2053 * frame was destined for the previous interface
2054 * so invoke RX handlers for it
2057 skb_new = skb_copy(skb, GFP_ATOMIC);
2059 if (net_ratelimit())
2060 printk(KERN_DEBUG "%s: failed to copy "
2061 "multicast frame for %s\n",
2062 wiphy_name(local->hw.wiphy),
2066 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
2070 ieee80211_invoke_rx_handlers(prev, &rx, skb);
2075 #define SEQ_MODULO 0x1000
2076 #define SEQ_MASK 0xfff
2078 static inline int seq_less(u16 sq1, u16 sq2)
2080 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
2083 static inline u16 seq_inc(u16 sq)
2085 return (sq + 1) & SEQ_MASK;
2088 static inline u16 seq_sub(u16 sq1, u16 sq2)
2090 return (sq1 - sq2) & SEQ_MASK;
2095 * As it function blongs to Rx path it must be called with
2096 * the proper rcu_read_lock protection for its flow.
2098 static u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
2099 struct tid_ampdu_rx *tid_agg_rx,
2100 struct sk_buff *skb,
2104 struct ieee80211_local *local = hw_to_local(hw);
2105 struct ieee80211_rx_status status;
2106 u16 head_seq_num, buf_size;
2108 struct ieee80211_supported_band *sband;
2109 struct ieee80211_rate *rate;
2111 buf_size = tid_agg_rx->buf_size;
2112 head_seq_num = tid_agg_rx->head_seq_num;
2114 /* frame with out of date sequence number */
2115 if (seq_less(mpdu_seq_num, head_seq_num)) {
2120 /* if frame sequence number exceeds our buffering window size or
2121 * block Ack Request arrived - release stored frames */
2122 if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2123 /* new head to the ordering buffer */
2125 head_seq_num = mpdu_seq_num;
2128 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2129 /* release stored frames up to new head to stack */
2130 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2131 index = seq_sub(tid_agg_rx->head_seq_num,
2133 % tid_agg_rx->buf_size;
2135 if (tid_agg_rx->reorder_buf[index]) {
2136 /* release the reordered frames to stack */
2138 tid_agg_rx->reorder_buf[index]->cb,
2140 sband = local->hw.wiphy->bands[status.band];
2141 if (status.flag & RX_FLAG_HT) {
2142 /* TODO: HT rates */
2143 rate = sband->bitrates;
2145 rate = &sband->bitrates
2148 __ieee80211_rx_handle_packet(hw,
2149 tid_agg_rx->reorder_buf[index],
2151 tid_agg_rx->stored_mpdu_num--;
2152 tid_agg_rx->reorder_buf[index] = NULL;
2154 tid_agg_rx->head_seq_num =
2155 seq_inc(tid_agg_rx->head_seq_num);
2161 /* now the new frame is always in the range of the reordering */
2163 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2164 % tid_agg_rx->buf_size;
2165 /* check if we already stored this frame */
2166 if (tid_agg_rx->reorder_buf[index]) {
2171 /* if arrived mpdu is in the right order and nothing else stored */
2172 /* release it immediately */
2173 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2174 tid_agg_rx->stored_mpdu_num == 0) {
2175 tid_agg_rx->head_seq_num =
2176 seq_inc(tid_agg_rx->head_seq_num);
2180 /* put the frame in the reordering buffer */
2181 tid_agg_rx->reorder_buf[index] = skb;
2182 tid_agg_rx->stored_mpdu_num++;
2183 /* release the buffer until next missing frame */
2184 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2185 % tid_agg_rx->buf_size;
2186 while (tid_agg_rx->reorder_buf[index]) {
2187 /* release the reordered frame back to stack */
2188 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2190 sband = local->hw.wiphy->bands[status.band];
2191 if (status.flag & RX_FLAG_HT)
2192 rate = sband->bitrates; /* TODO: HT rates */
2194 rate = &sband->bitrates[status.rate_idx];
2195 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
2197 tid_agg_rx->stored_mpdu_num--;
2198 tid_agg_rx->reorder_buf[index] = NULL;
2199 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2200 index = seq_sub(tid_agg_rx->head_seq_num,
2201 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2206 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2207 struct sk_buff *skb)
2209 struct ieee80211_hw *hw = &local->hw;
2210 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2211 struct sta_info *sta;
2212 struct tid_ampdu_rx *tid_agg_rx;
2218 sta = sta_info_get(local, hdr->addr2);
2222 /* filter the QoS data rx stream according to
2223 * STA/TID and check if this STA/TID is on aggregation */
2224 if (!ieee80211_is_data_qos(hdr->frame_control))
2227 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
2229 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2232 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2234 /* qos null data frames are excluded */
2235 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
2238 /* new un-ordered ampdu frame - process it */
2240 /* reset session timer */
2241 if (tid_agg_rx->timeout) {
2242 unsigned long expires =
2243 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
2244 mod_timer(&tid_agg_rx->session_timer, expires);
2247 /* if this mpdu is fragmented - terminate rx aggregation session */
2248 sc = le16_to_cpu(hdr->seq_ctrl);
2249 if (sc & IEEE80211_SCTL_FRAG) {
2250 ieee80211_sta_stop_rx_ba_session(sta->sdata, sta->sta.addr,
2251 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2256 /* according to mpdu sequence number deal with reordering buffer */
2257 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2258 ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2265 * This is the receive path handler. It is called by a low level driver when an
2266 * 802.11 MPDU is received from the hardware.
2268 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2269 struct ieee80211_rx_status *status)
2271 struct ieee80211_local *local = hw_to_local(hw);
2272 struct ieee80211_rate *rate = NULL;
2273 struct ieee80211_supported_band *sband;
2275 if (status->band < 0 ||
2276 status->band >= IEEE80211_NUM_BANDS) {
2281 sband = local->hw.wiphy->bands[status->band];
2287 if (status->flag & RX_FLAG_HT) {
2288 /* rate_idx is MCS index */
2289 if (WARN_ON(status->rate_idx < 0 ||
2290 status->rate_idx >= 76))
2292 /* HT rates are not in the table - use the highest legacy rate
2293 * for now since other parts of mac80211 may not yet be fully
2295 rate = &sband->bitrates[sband->n_bitrates - 1];
2297 if (WARN_ON(status->rate_idx < 0 ||
2298 status->rate_idx >= sband->n_bitrates))
2300 rate = &sband->bitrates[status->rate_idx];
2304 * key references and virtual interfaces are protected using RCU
2305 * and this requires that we are in a read-side RCU section during
2306 * receive processing
2311 * Frames with failed FCS/PLCP checksum are not returned,
2312 * all other frames are returned without radiotap header
2313 * if it was previously present.
2314 * Also, frames with less than 16 bytes are dropped.
2316 skb = ieee80211_rx_monitor(local, skb, status, rate);
2322 if (!ieee80211_rx_reorder_ampdu(local, skb))
2323 __ieee80211_rx_handle_packet(hw, skb, status, rate);
2327 EXPORT_SYMBOL(__ieee80211_rx);
2329 /* This is a version of the rx handler that can be called from hard irq
2330 * context. Post the skb on the queue and schedule the tasklet */
2331 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2332 struct ieee80211_rx_status *status)
2334 struct ieee80211_local *local = hw_to_local(hw);
2336 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2338 skb->dev = local->mdev;
2339 /* copy status into skb->cb for use by tasklet */
2340 memcpy(skb->cb, status, sizeof(*status));
2341 skb->pkt_type = IEEE80211_RX_MSG;
2342 skb_queue_tail(&local->skb_queue, skb);
2343 tasklet_schedule(&local->tasklet);
2345 EXPORT_SYMBOL(ieee80211_rx_irqsafe);