2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/jiffies.h>
13 #include <linux/kernel.h>
14 #include <linux/skbuff.h>
15 #include <linux/netdevice.h>
16 #include <linux/etherdevice.h>
17 #include <linux/rcupdate.h>
18 #include <net/mac80211.h>
19 #include <net/ieee80211_radiotap.h>
21 #include "ieee80211_i.h"
29 u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
30 struct tid_ampdu_rx *tid_agg_rx,
31 struct sk_buff *skb, u16 mpdu_seq_num,
34 * monitor mode reception
36 * This function cleans up the SKB, i.e. it removes all the stuff
37 * only useful for monitoring.
39 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
43 skb_pull(skb, rtap_len);
45 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
46 if (likely(skb->len > FCS_LEN))
47 skb_trim(skb, skb->len - FCS_LEN);
59 static inline int should_drop_frame(struct ieee80211_rx_status *status,
64 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
66 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
68 if (unlikely(skb->len < 16 + present_fcs_len + radiotap_len))
70 if (((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
71 cpu_to_le16(IEEE80211_FTYPE_CTL)) &&
72 ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
73 cpu_to_le16(IEEE80211_STYPE_PSPOLL)) &&
74 ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE)) !=
75 cpu_to_le16(IEEE80211_STYPE_BACK_REQ)))
81 * This function copies a received frame to all monitor interfaces and
82 * returns a cleaned-up SKB that no longer includes the FCS nor the
83 * radiotap header the driver might have added.
85 static struct sk_buff *
86 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
87 struct ieee80211_rx_status *status,
88 struct ieee80211_rate *rate)
90 struct ieee80211_sub_if_data *sdata;
91 int needed_headroom = 0;
92 struct ieee80211_radiotap_header *rthdr;
93 __le64 *rttsft = NULL;
94 struct ieee80211_rtap_fixed_data {
100 u8 padding_for_rxflags;
102 } __attribute__ ((packed)) *rtfixed;
103 struct sk_buff *skb, *skb2;
104 struct net_device *prev_dev = NULL;
105 int present_fcs_len = 0;
109 * First, we may need to make a copy of the skb because
110 * (1) we need to modify it for radiotap (if not present), and
111 * (2) the other RX handlers will modify the skb we got.
113 * We don't need to, of course, if we aren't going to return
114 * the SKB because it has a bad FCS/PLCP checksum.
116 if (status->flag & RX_FLAG_RADIOTAP)
117 rtap_len = ieee80211_get_radiotap_len(origskb->data);
119 /* room for radiotap header, always present fields and TSFT */
120 needed_headroom = sizeof(*rthdr) + sizeof(*rtfixed) + 8;
122 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
123 present_fcs_len = FCS_LEN;
125 if (!local->monitors) {
126 if (should_drop_frame(status, origskb, present_fcs_len,
128 dev_kfree_skb(origskb);
132 return remove_monitor_info(local, origskb, rtap_len);
135 if (should_drop_frame(status, origskb, present_fcs_len, rtap_len)) {
136 /* only need to expand headroom if necessary */
141 * This shouldn't trigger often because most devices have an
142 * RX header they pull before we get here, and that should
143 * be big enough for our radiotap information. We should
144 * probably export the length to drivers so that we can have
145 * them allocate enough headroom to start with.
147 if (skb_headroom(skb) < needed_headroom &&
148 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
154 * Need to make a copy and possibly remove radiotap header
155 * and FCS from the original.
157 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
159 origskb = remove_monitor_info(local, origskb, rtap_len);
165 /* if necessary, prepend radiotap information */
166 if (!(status->flag & RX_FLAG_RADIOTAP)) {
167 rtfixed = (void *) skb_push(skb, sizeof(*rtfixed));
168 rtap_len = sizeof(*rthdr) + sizeof(*rtfixed);
169 if (status->flag & RX_FLAG_TSFT) {
170 rttsft = (void *) skb_push(skb, sizeof(*rttsft));
173 rthdr = (void *) skb_push(skb, sizeof(*rthdr));
174 memset(rthdr, 0, sizeof(*rthdr));
175 memset(rtfixed, 0, sizeof(*rtfixed));
177 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
178 (1 << IEEE80211_RADIOTAP_RATE) |
179 (1 << IEEE80211_RADIOTAP_CHANNEL) |
180 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |
181 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
183 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
184 rtfixed->flags |= IEEE80211_RADIOTAP_F_FCS;
187 *rttsft = cpu_to_le64(status->mactime);
189 cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
192 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
193 rtfixed->rx_flags = 0;
195 (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
197 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
199 rtfixed->rate = rate->bitrate / 5;
201 rtfixed->chan_freq = cpu_to_le16(status->freq);
203 if (status->band == IEEE80211_BAND_5GHZ)
204 rtfixed->chan_flags =
205 cpu_to_le16(IEEE80211_CHAN_OFDM |
206 IEEE80211_CHAN_5GHZ);
208 rtfixed->chan_flags =
209 cpu_to_le16(IEEE80211_CHAN_DYN |
210 IEEE80211_CHAN_2GHZ);
212 rtfixed->antsignal = status->signal;
213 rthdr->it_len = cpu_to_le16(rtap_len);
216 skb_reset_mac_header(skb);
217 skb->ip_summed = CHECKSUM_UNNECESSARY;
218 skb->pkt_type = PACKET_OTHERHOST;
219 skb->protocol = htons(ETH_P_802_2);
221 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
222 if (!netif_running(sdata->dev))
225 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR)
228 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
232 skb2 = skb_clone(skb, GFP_ATOMIC);
234 skb2->dev = prev_dev;
239 prev_dev = sdata->dev;
240 sdata->dev->stats.rx_packets++;
241 sdata->dev->stats.rx_bytes += skb->len;
254 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
256 u8 *data = rx->skb->data;
259 /* does the frame have a qos control field? */
260 if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
261 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
262 /* frame has qos control */
263 tid = qc[0] & QOS_CONTROL_TID_MASK;
264 if (qc[0] & IEEE80211_QOS_CONTROL_A_MSDU_PRESENT)
265 rx->flags |= IEEE80211_RX_AMSDU;
267 rx->flags &= ~IEEE80211_RX_AMSDU;
269 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
270 /* Separate TID for management frames */
271 tid = NUM_RX_DATA_QUEUES - 1;
273 /* no qos control present */
274 tid = 0; /* 802.1d - Best Effort */
279 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
280 * For now, set skb->priority to 0 for other cases. */
281 rx->skb->priority = (tid > 7) ? 0 : tid;
284 static void ieee80211_verify_ip_alignment(struct ieee80211_rx_data *rx)
286 #ifdef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
289 if (!WLAN_FC_DATA_PRESENT(rx->fc))
293 * Drivers are required to align the payload data in a way that
294 * guarantees that the contained IP header is aligned to a four-
295 * byte boundary. In the case of regular frames, this simply means
296 * aligning the payload to a four-byte boundary (because either
297 * the IP header is directly contained, or IV/RFC1042 headers that
298 * have a length divisible by four are in front of it.
300 * With A-MSDU frames, however, the payload data address must
301 * yield two modulo four because there are 14-byte 802.3 headers
302 * within the A-MSDU frames that push the IP header further back
303 * to a multiple of four again. Thankfully, the specs were sane
304 * enough this time around to require padding each A-MSDU subframe
305 * to a length that is a multiple of four.
307 * Padding like atheros hardware adds which is inbetween the 802.11
308 * header and the payload is not supported, the driver is required
309 * to move the 802.11 header further back in that case.
311 hdrlen = ieee80211_get_hdrlen(rx->fc);
312 if (rx->flags & IEEE80211_RX_AMSDU)
314 WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
319 static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
321 struct ieee80211_rx_status *status,
322 struct ieee80211_rate *rate)
324 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
325 u32 load = 0, hdrtime;
327 /* Estimate total channel use caused by this frame */
329 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
330 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
332 if (status->band == IEEE80211_BAND_5GHZ ||
333 (status->band == IEEE80211_BAND_5GHZ &&
334 rate->flags & IEEE80211_RATE_ERP_G))
335 hdrtime = CHAN_UTIL_HDR_SHORT;
337 hdrtime = CHAN_UTIL_HDR_LONG;
340 if (!is_multicast_ether_addr(hdr->addr1))
343 /* TODO: optimise again */
344 load += skb->len * CHAN_UTIL_RATE_LCM / rate->bitrate;
346 /* Divide channel_use by 8 to avoid wrapping around the counter */
347 load >>= CHAN_UTIL_SHIFT;
354 static ieee80211_rx_result
355 ieee80211_rx_h_if_stats(struct ieee80211_rx_data *rx)
358 rx->sta->channel_use_raw += rx->load;
359 rx->sdata->channel_use_raw += rx->load;
363 static ieee80211_rx_result
364 ieee80211_rx_h_passive_scan(struct ieee80211_rx_data *rx)
366 struct ieee80211_local *local = rx->local;
367 struct sk_buff *skb = rx->skb;
369 if (unlikely(local->sta_hw_scanning))
370 return ieee80211_sta_rx_scan(rx->dev, skb, rx->status);
372 if (unlikely(local->sta_sw_scanning)) {
373 /* drop all the other packets during a software scan anyway */
374 if (ieee80211_sta_rx_scan(rx->dev, skb, rx->status)
380 if (unlikely(rx->flags & IEEE80211_RX_IN_SCAN)) {
381 /* scanning finished during invoking of handlers */
382 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
383 return RX_DROP_UNUSABLE;
389 static ieee80211_rx_result
390 ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
392 int hdrlen = ieee80211_get_hdrlen(rx->fc);
393 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
395 #define msh_h_get(h, l) ((struct ieee80211s_hdr *) ((u8 *)h + l))
397 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) {
398 if (!((rx->fc & IEEE80211_FCTL_FROMDS) &&
399 (rx->fc & IEEE80211_FCTL_TODS)))
400 return RX_DROP_MONITOR;
401 if (memcmp(hdr->addr4, rx->dev->dev_addr, ETH_ALEN) == 0)
402 return RX_DROP_MONITOR;
405 /* If there is not an established peer link and this is not a peer link
406 * establisment frame, beacon or probe, drop the frame.
409 if (!rx->sta || sta_plink_state(rx->sta) != PLINK_ESTAB) {
410 struct ieee80211_mgmt *mgmt;
412 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
413 return RX_DROP_MONITOR;
415 switch (rx->fc & IEEE80211_FCTL_STYPE) {
416 case IEEE80211_STYPE_ACTION:
417 mgmt = (struct ieee80211_mgmt *)hdr;
418 if (mgmt->u.action.category != PLINK_CATEGORY)
419 return RX_DROP_MONITOR;
420 /* fall through on else */
421 case IEEE80211_STYPE_PROBE_REQ:
422 case IEEE80211_STYPE_PROBE_RESP:
423 case IEEE80211_STYPE_BEACON:
427 return RX_DROP_MONITOR;
430 } else if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
431 is_multicast_ether_addr(hdr->addr1) &&
432 mesh_rmc_check(hdr->addr4, msh_h_get(hdr, hdrlen), rx->dev))
433 return RX_DROP_MONITOR;
440 static ieee80211_rx_result
441 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
443 struct ieee80211_hdr *hdr;
445 hdr = (struct ieee80211_hdr *) rx->skb->data;
447 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
448 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
449 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
450 rx->sta->last_seq_ctrl[rx->queue] ==
452 if (rx->flags & IEEE80211_RX_RA_MATCH) {
453 rx->local->dot11FrameDuplicateCount++;
454 rx->sta->num_duplicates++;
456 return RX_DROP_MONITOR;
458 rx->sta->last_seq_ctrl[rx->queue] = hdr->seq_ctrl;
461 if (unlikely(rx->skb->len < 16)) {
462 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
463 return RX_DROP_MONITOR;
466 /* Drop disallowed frame classes based on STA auth/assoc state;
467 * IEEE 802.11, Chap 5.5.
469 * 80211.o does filtering only based on association state, i.e., it
470 * drops Class 3 frames from not associated stations. hostapd sends
471 * deauth/disassoc frames when needed. In addition, hostapd is
472 * responsible for filtering on both auth and assoc states.
475 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
476 return ieee80211_rx_mesh_check(rx);
478 if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
479 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
480 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
481 rx->sdata->vif.type != IEEE80211_IF_TYPE_IBSS &&
482 (!rx->sta || !test_sta_flags(rx->sta, WLAN_STA_ASSOC)))) {
483 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
484 !(rx->fc & IEEE80211_FCTL_TODS) &&
485 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
486 || !(rx->flags & IEEE80211_RX_RA_MATCH)) {
487 /* Drop IBSS frames and frames for other hosts
489 return RX_DROP_MONITOR;
492 return RX_DROP_MONITOR;
499 static ieee80211_rx_result
500 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
502 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
505 ieee80211_rx_result result = RX_DROP_UNUSABLE;
506 struct ieee80211_key *stakey = NULL;
511 * There are three types of keys:
513 * - PTK (pairwise keys)
514 * - STK (station-to-station pairwise keys)
516 * When selecting a key, we have to distinguish between multicast
517 * (including broadcast) and unicast frames, the latter can only
518 * use PTKs and STKs while the former always use GTKs. Unless, of
519 * course, actual WEP keys ("pre-RSNA") are used, then unicast
520 * frames can also use key indizes like GTKs. Hence, if we don't
521 * have a PTK/STK we check the key index for a WEP key.
523 * Note that in a regular BSS, multicast frames are sent by the
524 * AP only, associated stations unicast the frame to the AP first
525 * which then multicasts it on their behalf.
527 * There is also a slight problem in IBSS mode: GTKs are negotiated
528 * with each station, that is something we don't currently handle.
529 * The spec seems to expect that one negotiates the same key with
530 * every station but there's no such requirement; VLANs could be
534 if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
538 * No point in finding a key and decrypting if the frame is neither
539 * addressed to us nor a multicast frame.
541 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
545 stakey = rcu_dereference(rx->sta->key);
547 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
551 * The device doesn't give us the IV so we won't be
552 * able to look up the key. That's ok though, we
553 * don't need to decrypt the frame, we just won't
554 * be able to keep statistics accurate.
555 * Except for key threshold notifications, should
556 * we somehow allow the driver to tell us which key
557 * the hardware used if this flag is set?
559 if ((rx->status->flag & RX_FLAG_DECRYPTED) &&
560 (rx->status->flag & RX_FLAG_IV_STRIPPED))
563 hdrlen = ieee80211_get_hdrlen(rx->fc);
565 if (rx->skb->len < 8 + hdrlen)
566 return RX_DROP_UNUSABLE; /* TODO: count this? */
569 * no need to call ieee80211_wep_get_keyidx,
570 * it verifies a bunch of things we've done already
572 keyidx = rx->skb->data[hdrlen + 3] >> 6;
574 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
577 * RSNA-protected unicast frames should always be sent with
578 * pairwise or station-to-station keys, but for WEP we allow
579 * using a key index as well.
581 if (rx->key && rx->key->conf.alg != ALG_WEP &&
582 !is_multicast_ether_addr(hdr->addr1))
587 rx->key->tx_rx_count++;
588 /* TODO: add threshold stuff again */
590 #ifdef CONFIG_MAC80211_DEBUG
592 printk(KERN_DEBUG "%s: RX protected frame,"
593 " but have no key\n", rx->dev->name);
594 #endif /* CONFIG_MAC80211_DEBUG */
595 return RX_DROP_MONITOR;
598 /* Check for weak IVs if possible */
599 if (rx->sta && rx->key->conf.alg == ALG_WEP &&
600 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA) &&
601 (!(rx->status->flag & RX_FLAG_IV_STRIPPED) ||
602 !(rx->status->flag & RX_FLAG_DECRYPTED)) &&
603 ieee80211_wep_is_weak_iv(rx->skb, rx->key))
604 rx->sta->wep_weak_iv_count++;
606 switch (rx->key->conf.alg) {
608 result = ieee80211_crypto_wep_decrypt(rx);
611 result = ieee80211_crypto_tkip_decrypt(rx);
614 result = ieee80211_crypto_ccmp_decrypt(rx);
618 /* either the frame has been decrypted or will be dropped */
619 rx->status->flag |= RX_FLAG_DECRYPTED;
624 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
626 struct ieee80211_sub_if_data *sdata;
627 DECLARE_MAC_BUF(mac);
632 atomic_inc(&sdata->bss->num_sta_ps);
633 set_and_clear_sta_flags(sta, WLAN_STA_PS, WLAN_STA_PSPOLL);
634 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
635 printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
636 dev->name, print_mac(mac, sta->addr), sta->aid);
637 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
640 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
642 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
645 struct ieee80211_sub_if_data *sdata;
646 struct ieee80211_tx_packet_data *pkt_data;
647 DECLARE_MAC_BUF(mac);
652 atomic_dec(&sdata->bss->num_sta_ps);
654 clear_sta_flags(sta, WLAN_STA_PS | WLAN_STA_PSPOLL);
656 if (!skb_queue_empty(&sta->ps_tx_buf))
657 sta_info_clear_tim_bit(sta);
659 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
660 printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
661 dev->name, print_mac(mac, sta->addr), sta->aid);
662 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
664 /* Send all buffered frames to the station */
665 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
666 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
668 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
671 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
672 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
673 local->total_ps_buffered--;
675 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
676 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
677 "since STA not sleeping anymore\n", dev->name,
678 print_mac(mac, sta->addr), sta->aid);
679 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
680 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
687 static ieee80211_rx_result
688 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
690 struct sta_info *sta = rx->sta;
691 struct net_device *dev = rx->dev;
692 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
697 /* Update last_rx only for IBSS packets which are for the current
698 * BSSID to avoid keeping the current IBSS network alive in cases where
699 * other STAs are using different BSSID. */
700 if (rx->sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
701 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
702 IEEE80211_IF_TYPE_IBSS);
703 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
704 sta->last_rx = jiffies;
706 if (!is_multicast_ether_addr(hdr->addr1) ||
707 rx->sdata->vif.type == IEEE80211_IF_TYPE_STA) {
708 /* Update last_rx only for unicast frames in order to prevent
709 * the Probe Request frames (the only broadcast frames from a
710 * STA in infrastructure mode) from keeping a connection alive.
711 * Mesh beacons will update last_rx when if they are found to
712 * match the current local configuration when processed.
714 sta->last_rx = jiffies;
717 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
721 sta->rx_bytes += rx->skb->len;
722 sta->last_signal = rx->status->signal;
723 sta->last_qual = rx->status->qual;
724 sta->last_noise = rx->status->noise;
726 if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
727 /* Change STA power saving mode only in the end of a frame
728 * exchange sequence */
729 if (test_sta_flags(sta, WLAN_STA_PS) &&
730 !(rx->fc & IEEE80211_FCTL_PM))
731 rx->sent_ps_buffered += ap_sta_ps_end(dev, sta);
732 else if (!test_sta_flags(sta, WLAN_STA_PS) &&
733 (rx->fc & IEEE80211_FCTL_PM))
734 ap_sta_ps_start(dev, sta);
737 /* Drop data::nullfunc frames silently, since they are used only to
738 * control station power saving mode. */
739 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
740 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
741 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
742 /* Update counter and free packet here to avoid counting this
743 * as a dropped packed. */
745 dev_kfree_skb(rx->skb);
750 } /* ieee80211_rx_h_sta_process */
752 static inline struct ieee80211_fragment_entry *
753 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
754 unsigned int frag, unsigned int seq, int rx_queue,
755 struct sk_buff **skb)
757 struct ieee80211_fragment_entry *entry;
760 idx = sdata->fragment_next;
761 entry = &sdata->fragments[sdata->fragment_next++];
762 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
763 sdata->fragment_next = 0;
765 if (!skb_queue_empty(&entry->skb_list)) {
766 #ifdef CONFIG_MAC80211_DEBUG
767 struct ieee80211_hdr *hdr =
768 (struct ieee80211_hdr *) entry->skb_list.next->data;
769 DECLARE_MAC_BUF(mac);
770 DECLARE_MAC_BUF(mac2);
771 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
772 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
773 "addr1=%s addr2=%s\n",
774 sdata->dev->name, idx,
775 jiffies - entry->first_frag_time, entry->seq,
776 entry->last_frag, print_mac(mac, hdr->addr1),
777 print_mac(mac2, hdr->addr2));
778 #endif /* CONFIG_MAC80211_DEBUG */
779 __skb_queue_purge(&entry->skb_list);
782 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
784 entry->first_frag_time = jiffies;
786 entry->rx_queue = rx_queue;
787 entry->last_frag = frag;
789 entry->extra_len = 0;
794 static inline struct ieee80211_fragment_entry *
795 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
796 u16 fc, unsigned int frag, unsigned int seq,
797 int rx_queue, struct ieee80211_hdr *hdr)
799 struct ieee80211_fragment_entry *entry;
802 idx = sdata->fragment_next;
803 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
804 struct ieee80211_hdr *f_hdr;
809 idx = IEEE80211_FRAGMENT_MAX - 1;
811 entry = &sdata->fragments[idx];
812 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
813 entry->rx_queue != rx_queue ||
814 entry->last_frag + 1 != frag)
817 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
818 f_fc = le16_to_cpu(f_hdr->frame_control);
820 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
821 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
822 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
825 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
826 __skb_queue_purge(&entry->skb_list);
835 static ieee80211_rx_result
836 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
838 struct ieee80211_hdr *hdr;
840 unsigned int frag, seq;
841 struct ieee80211_fragment_entry *entry;
843 DECLARE_MAC_BUF(mac);
845 hdr = (struct ieee80211_hdr *) rx->skb->data;
846 sc = le16_to_cpu(hdr->seq_ctrl);
847 frag = sc & IEEE80211_SCTL_FRAG;
849 if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
850 (rx->skb)->len < 24 ||
851 is_multicast_ether_addr(hdr->addr1))) {
855 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
857 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
860 /* This is the first fragment of a new frame. */
861 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
862 rx->queue, &(rx->skb));
863 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
864 (rx->fc & IEEE80211_FCTL_PROTECTED)) {
865 /* Store CCMP PN so that we can verify that the next
866 * fragment has a sequential PN value. */
868 memcpy(entry->last_pn,
869 rx->key->u.ccmp.rx_pn[rx->queue],
875 /* This is a fragment for a frame that should already be pending in
876 * fragment cache. Add this fragment to the end of the pending entry.
878 entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
881 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
882 return RX_DROP_MONITOR;
885 /* Verify that MPDUs within one MSDU have sequential PN values.
886 * (IEEE 802.11i, 8.3.3.4.5) */
889 u8 pn[CCMP_PN_LEN], *rpn;
890 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
891 return RX_DROP_UNUSABLE;
892 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
893 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
898 rpn = rx->key->u.ccmp.rx_pn[rx->queue];
899 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
901 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
903 " PN=%02x%02x%02x%02x%02x%02x "
904 "(expected %02x%02x%02x%02x%02x%02x)\n",
905 rx->dev->name, print_mac(mac, hdr->addr2),
906 rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
907 rpn[5], pn[0], pn[1], pn[2], pn[3],
909 return RX_DROP_UNUSABLE;
911 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
914 skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
915 __skb_queue_tail(&entry->skb_list, rx->skb);
916 entry->last_frag = frag;
917 entry->extra_len += rx->skb->len;
918 if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
923 rx->skb = __skb_dequeue(&entry->skb_list);
924 if (skb_tailroom(rx->skb) < entry->extra_len) {
925 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
926 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
928 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
929 __skb_queue_purge(&entry->skb_list);
930 return RX_DROP_UNUSABLE;
933 while ((skb = __skb_dequeue(&entry->skb_list))) {
934 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
938 /* Complete frame has been reassembled - process it now */
939 rx->flags |= IEEE80211_RX_FRAGMENTED;
943 rx->sta->rx_packets++;
944 if (is_multicast_ether_addr(hdr->addr1))
945 rx->local->dot11MulticastReceivedFrameCount++;
947 ieee80211_led_rx(rx->local);
951 static ieee80211_rx_result
952 ieee80211_rx_h_ps_poll(struct ieee80211_rx_data *rx)
954 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
957 DECLARE_MAC_BUF(mac);
959 if (likely(!rx->sta ||
960 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
961 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
962 !(rx->flags & IEEE80211_RX_RA_MATCH)))
965 if ((sdata->vif.type != IEEE80211_IF_TYPE_AP) &&
966 (sdata->vif.type != IEEE80211_IF_TYPE_VLAN))
967 return RX_DROP_UNUSABLE;
969 skb = skb_dequeue(&rx->sta->tx_filtered);
971 skb = skb_dequeue(&rx->sta->ps_tx_buf);
973 rx->local->total_ps_buffered--;
975 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
976 skb_queue_empty(&rx->sta->ps_tx_buf);
979 struct ieee80211_hdr *hdr =
980 (struct ieee80211_hdr *) skb->data;
983 * Tell TX path to send one frame even though the STA may
984 * still remain is PS mode after this frame exchange.
986 set_sta_flags(rx->sta, WLAN_STA_PSPOLL);
988 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
989 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
990 print_mac(mac, rx->sta->addr), rx->sta->aid,
991 skb_queue_len(&rx->sta->ps_tx_buf));
992 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
994 /* Use MoreData flag to indicate whether there are more
995 * buffered frames for this STA */
997 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
999 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
1001 dev_queue_xmit(skb);
1003 if (no_pending_pkts)
1004 sta_info_clear_tim_bit(rx->sta);
1005 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
1006 } else if (!rx->sent_ps_buffered) {
1008 * FIXME: This can be the result of a race condition between
1009 * us expiring a frame and the station polling for it.
1010 * Should we send it a null-func frame indicating we
1011 * have nothing buffered for it?
1013 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
1014 "though there is no buffered frames for it\n",
1015 rx->dev->name, print_mac(mac, rx->sta->addr));
1016 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
1019 /* Free PS Poll skb here instead of returning RX_DROP that would
1020 * count as an dropped frame. */
1021 dev_kfree_skb(rx->skb);
1026 static ieee80211_rx_result
1027 ieee80211_rx_h_remove_qos_control(struct ieee80211_rx_data *rx)
1030 u8 *data = rx->skb->data;
1031 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
1033 if (!WLAN_FC_IS_QOS_DATA(fc))
1036 /* remove the qos control field, update frame type and meta-data */
1037 memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
1038 hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
1039 /* change frame type to non QOS */
1040 rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
1041 hdr->frame_control = cpu_to_le16(fc);
1047 ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1049 if (unlikely(!rx->sta ||
1050 !test_sta_flags(rx->sta, WLAN_STA_AUTHORIZED))) {
1051 #ifdef CONFIG_MAC80211_DEBUG
1052 if (net_ratelimit())
1053 printk(KERN_DEBUG "%s: dropped frame "
1054 "(unauthorized port)\n", rx->dev->name);
1055 #endif /* CONFIG_MAC80211_DEBUG */
1063 ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx)
1066 * Pass through unencrypted frames if the hardware has
1067 * decrypted them already.
1069 if (rx->status->flag & RX_FLAG_DECRYPTED)
1072 /* Drop unencrypted frames if key is set. */
1073 if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
1074 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
1075 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
1076 (rx->key || rx->sdata->drop_unencrypted)))
1083 ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
1085 struct net_device *dev = rx->dev;
1086 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
1087 u16 fc, hdrlen, ethertype;
1091 struct sk_buff *skb = rx->skb;
1092 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1093 DECLARE_MAC_BUF(mac);
1094 DECLARE_MAC_BUF(mac2);
1095 DECLARE_MAC_BUF(mac3);
1096 DECLARE_MAC_BUF(mac4);
1100 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1103 hdrlen = ieee80211_get_hdrlen(fc);
1105 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1106 int meshhdrlen = ieee80211_get_mesh_hdrlen(
1107 (struct ieee80211s_hdr *) (skb->data + hdrlen));
1109 * - mesh header: to be used for mesh forwarding
1110 * decision. It will also be used as mesh header template at
1111 * tx.c:ieee80211_subif_start_xmit() if interface
1112 * type is mesh and skb->pkt_type == PACKET_OTHERHOST
1113 * - ta: to be used if a RERR needs to be sent.
1115 memcpy(skb->cb, skb->data + hdrlen, meshhdrlen);
1116 memcpy(MESH_PREQ(skb), hdr->addr2, ETH_ALEN);
1117 hdrlen += meshhdrlen;
1120 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1122 * IEEE 802.11 address fields:
1123 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1124 * 0 0 DA SA BSSID n/a
1125 * 0 1 DA BSSID SA n/a
1126 * 1 0 BSSID SA DA n/a
1130 switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
1131 case IEEE80211_FCTL_TODS:
1133 memcpy(dst, hdr->addr3, ETH_ALEN);
1134 memcpy(src, hdr->addr2, ETH_ALEN);
1136 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_AP &&
1137 sdata->vif.type != IEEE80211_IF_TYPE_VLAN)) {
1138 if (net_ratelimit())
1139 printk(KERN_DEBUG "%s: dropped ToDS frame "
1140 "(BSSID=%s SA=%s DA=%s)\n",
1142 print_mac(mac, hdr->addr1),
1143 print_mac(mac2, hdr->addr2),
1144 print_mac(mac3, hdr->addr3));
1148 case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
1150 memcpy(dst, hdr->addr3, ETH_ALEN);
1151 memcpy(src, hdr->addr4, ETH_ALEN);
1153 if (unlikely(sdata->vif.type != IEEE80211_IF_TYPE_WDS &&
1154 sdata->vif.type != IEEE80211_IF_TYPE_MESH_POINT)) {
1155 if (net_ratelimit())
1156 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
1157 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1159 print_mac(mac, hdr->addr1),
1160 print_mac(mac2, hdr->addr2),
1161 print_mac(mac3, hdr->addr3),
1162 print_mac(mac4, hdr->addr4));
1166 case IEEE80211_FCTL_FROMDS:
1168 memcpy(dst, hdr->addr1, ETH_ALEN);
1169 memcpy(src, hdr->addr3, ETH_ALEN);
1171 if (sdata->vif.type != IEEE80211_IF_TYPE_STA ||
1172 (is_multicast_ether_addr(dst) &&
1173 !compare_ether_addr(src, dev->dev_addr)))
1178 memcpy(dst, hdr->addr1, ETH_ALEN);
1179 memcpy(src, hdr->addr2, ETH_ALEN);
1181 if (sdata->vif.type != IEEE80211_IF_TYPE_IBSS) {
1182 if (net_ratelimit()) {
1183 printk(KERN_DEBUG "%s: dropped IBSS frame "
1184 "(DA=%s SA=%s BSSID=%s)\n",
1186 print_mac(mac, hdr->addr1),
1187 print_mac(mac2, hdr->addr2),
1188 print_mac(mac3, hdr->addr3));
1195 if (unlikely(skb->len - hdrlen < 8)) {
1196 if (net_ratelimit()) {
1197 printk(KERN_DEBUG "%s: RX too short data frame "
1198 "payload\n", dev->name);
1203 payload = skb->data + hdrlen;
1204 ethertype = (payload[6] << 8) | payload[7];
1206 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1207 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1208 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1209 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1210 * replace EtherType */
1211 skb_pull(skb, hdrlen + 6);
1212 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1213 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1215 struct ethhdr *ehdr;
1218 skb_pull(skb, hdrlen);
1219 len = htons(skb->len);
1220 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1221 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1222 memcpy(ehdr->h_source, src, ETH_ALEN);
1223 ehdr->h_proto = len;
1229 * requires that rx->skb is a frame with ethernet header
1231 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx)
1233 static const u8 pae_group_addr[ETH_ALEN]
1234 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1235 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1238 * Allow EAPOL frames to us/the PAE group address regardless
1239 * of whether the frame was encrypted or not.
1241 if (ehdr->h_proto == htons(ETH_P_PAE) &&
1242 (compare_ether_addr(ehdr->h_dest, rx->dev->dev_addr) == 0 ||
1243 compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
1246 if (ieee80211_802_1x_port_control(rx) ||
1247 ieee80211_drop_unencrypted(rx))
1254 * requires that rx->skb is a frame with ethernet header
1257 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1259 struct net_device *dev = rx->dev;
1260 struct ieee80211_local *local = rx->local;
1261 struct sk_buff *skb, *xmit_skb;
1262 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1263 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1264 struct sta_info *dsta;
1269 if (local->bridge_packets && (sdata->vif.type == IEEE80211_IF_TYPE_AP ||
1270 sdata->vif.type == IEEE80211_IF_TYPE_VLAN) &&
1271 (rx->flags & IEEE80211_RX_RA_MATCH)) {
1272 if (is_multicast_ether_addr(ehdr->h_dest)) {
1274 * send multicast frames both to higher layers in
1275 * local net stack and back to the wireless medium
1277 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1278 if (!xmit_skb && net_ratelimit())
1279 printk(KERN_DEBUG "%s: failed to clone "
1280 "multicast frame\n", dev->name);
1282 dsta = sta_info_get(local, skb->data);
1283 if (dsta && dsta->sdata->dev == dev) {
1285 * The destination station is associated to
1286 * this AP (in this VLAN), so send the frame
1287 * directly to it and do not pass it to local
1296 /* Mesh forwarding */
1297 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1298 u8 *mesh_ttl = &((struct ieee80211s_hdr *)skb->cb)->ttl;
1301 if (is_multicast_ether_addr(skb->data)) {
1302 if (*mesh_ttl > 0) {
1303 xmit_skb = skb_copy(skb, GFP_ATOMIC);
1304 if (!xmit_skb && net_ratelimit())
1305 printk(KERN_DEBUG "%s: failed to clone "
1306 "multicast frame\n", dev->name);
1308 xmit_skb->pkt_type = PACKET_OTHERHOST;
1310 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
1311 dropped_frames_ttl);
1312 } else if (skb->pkt_type != PACKET_OTHERHOST &&
1313 compare_ether_addr(dev->dev_addr, skb->data) != 0) {
1314 if (*mesh_ttl == 0) {
1315 IEEE80211_IFSTA_MESH_CTR_INC(&sdata->u.sta,
1316 dropped_frames_ttl);
1321 xmit_skb->pkt_type = PACKET_OTHERHOST;
1322 if (!(dev->flags & IFF_PROMISC))
1329 /* deliver to local stack */
1330 skb->protocol = eth_type_trans(skb, dev);
1331 memset(skb->cb, 0, sizeof(skb->cb));
1336 /* send to wireless media */
1337 xmit_skb->protocol = htons(ETH_P_802_3);
1338 skb_reset_network_header(xmit_skb);
1339 skb_reset_mac_header(xmit_skb);
1340 dev_queue_xmit(xmit_skb);
1344 static ieee80211_rx_result
1345 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1347 struct net_device *dev = rx->dev;
1348 struct ieee80211_local *local = rx->local;
1351 struct sk_buff *skb = rx->skb, *frame = NULL;
1352 const struct ethhdr *eth;
1356 DECLARE_MAC_BUF(mac);
1359 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1362 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1363 return RX_DROP_MONITOR;
1365 if (!(rx->flags & IEEE80211_RX_AMSDU))
1368 err = ieee80211_data_to_8023(rx);
1370 return RX_DROP_UNUSABLE;
1374 dev->stats.rx_packets++;
1375 dev->stats.rx_bytes += skb->len;
1377 /* skip the wrapping header */
1378 eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
1380 return RX_DROP_UNUSABLE;
1382 while (skb != frame) {
1384 __be16 len = eth->h_proto;
1385 unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
1387 remaining = skb->len;
1388 memcpy(dst, eth->h_dest, ETH_ALEN);
1389 memcpy(src, eth->h_source, ETH_ALEN);
1391 padding = ((4 - subframe_len) & 0x3);
1392 /* the last MSDU has no padding */
1393 if (subframe_len > remaining) {
1394 printk(KERN_DEBUG "%s: wrong buffer size", dev->name);
1395 return RX_DROP_UNUSABLE;
1398 skb_pull(skb, sizeof(struct ethhdr));
1399 /* if last subframe reuse skb */
1400 if (remaining <= subframe_len + padding)
1403 frame = dev_alloc_skb(local->hw.extra_tx_headroom +
1407 return RX_DROP_UNUSABLE;
1409 skb_reserve(frame, local->hw.extra_tx_headroom +
1410 sizeof(struct ethhdr));
1411 memcpy(skb_put(frame, ntohs(len)), skb->data,
1414 eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
1417 printk(KERN_DEBUG "%s: wrong buffer size ",
1419 dev_kfree_skb(frame);
1420 return RX_DROP_UNUSABLE;
1424 skb_reset_network_header(frame);
1426 frame->priority = skb->priority;
1429 payload = frame->data;
1430 ethertype = (payload[6] << 8) | payload[7];
1432 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1433 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1434 compare_ether_addr(payload,
1435 bridge_tunnel_header) == 0)) {
1436 /* remove RFC1042 or Bridge-Tunnel
1437 * encapsulation and replace EtherType */
1439 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1440 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1442 memcpy(skb_push(frame, sizeof(__be16)),
1443 &len, sizeof(__be16));
1444 memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
1445 memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
1448 if (!ieee80211_frame_allowed(rx)) {
1449 if (skb == frame) /* last frame */
1450 return RX_DROP_UNUSABLE;
1451 dev_kfree_skb(frame);
1455 ieee80211_deliver_skb(rx);
1461 static ieee80211_rx_result
1462 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
1464 struct net_device *dev = rx->dev;
1469 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
1472 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
1473 return RX_DROP_MONITOR;
1475 err = ieee80211_data_to_8023(rx);
1477 return RX_DROP_UNUSABLE;
1479 if (!ieee80211_frame_allowed(rx))
1480 return RX_DROP_MONITOR;
1484 dev->stats.rx_packets++;
1485 dev->stats.rx_bytes += rx->skb->len;
1487 ieee80211_deliver_skb(rx);
1492 static ieee80211_rx_result
1493 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
1495 struct ieee80211_local *local = rx->local;
1496 struct ieee80211_hw *hw = &local->hw;
1497 struct sk_buff *skb = rx->skb;
1498 struct ieee80211_bar *bar = (struct ieee80211_bar *) skb->data;
1499 struct tid_ampdu_rx *tid_agg_rx;
1503 if (likely((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL))
1506 if ((rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BACK_REQ) {
1509 tid = le16_to_cpu(bar->control) >> 12;
1510 if (rx->sta->ampdu_mlme.tid_state_rx[tid]
1511 != HT_AGG_STATE_OPERATIONAL)
1513 tid_agg_rx = rx->sta->ampdu_mlme.tid_rx[tid];
1515 start_seq_num = le16_to_cpu(bar->start_seq_num) >> 4;
1517 /* reset session timer */
1518 if (tid_agg_rx->timeout) {
1519 unsigned long expires =
1520 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
1521 mod_timer(&tid_agg_rx->session_timer, expires);
1524 /* manage reordering buffer according to requested */
1525 /* sequence number */
1527 ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, NULL,
1530 return RX_DROP_UNUSABLE;
1536 static ieee80211_rx_result
1537 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
1539 struct ieee80211_sub_if_data *sdata;
1541 if (!(rx->flags & IEEE80211_RX_RA_MATCH))
1542 return RX_DROP_MONITOR;
1544 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1545 if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
1546 sdata->vif.type == IEEE80211_IF_TYPE_IBSS ||
1547 sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) &&
1548 !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
1549 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->status);
1551 return RX_DROP_MONITOR;
1556 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1557 struct ieee80211_hdr *hdr,
1558 struct ieee80211_rx_data *rx)
1561 DECLARE_MAC_BUF(mac);
1562 DECLARE_MAC_BUF(mac2);
1564 hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1565 if (rx->skb->len >= hdrlen + 4)
1566 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1570 if (net_ratelimit())
1571 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1572 "failure from %s to %s keyidx=%d\n",
1573 dev->name, print_mac(mac, hdr->addr2),
1574 print_mac(mac2, hdr->addr1), keyidx);
1578 * Some hardware seem to generate incorrect Michael MIC
1579 * reports; ignore them to avoid triggering countermeasures.
1581 if (net_ratelimit())
1582 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1583 "error for unknown address %s\n",
1584 dev->name, print_mac(mac, hdr->addr2));
1588 if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1589 if (net_ratelimit())
1590 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1591 "error for a frame with no PROTECTED flag (src "
1592 "%s)\n", dev->name, print_mac(mac, hdr->addr2));
1596 if (rx->sdata->vif.type == IEEE80211_IF_TYPE_AP && keyidx) {
1598 * APs with pairwise keys should never receive Michael MIC
1599 * errors for non-zero keyidx because these are reserved for
1600 * group keys and only the AP is sending real multicast
1601 * frames in the BSS.
1603 if (net_ratelimit())
1604 printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1605 "a frame with non-zero keyidx (%d)"
1606 " (src %s)\n", dev->name, keyidx,
1607 print_mac(mac, hdr->addr2));
1611 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1612 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1613 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1614 if (net_ratelimit())
1615 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1616 "error for a frame that cannot be encrypted "
1617 "(fc=0x%04x) (src %s)\n",
1618 dev->name, rx->fc, print_mac(mac, hdr->addr2));
1622 mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1624 dev_kfree_skb(rx->skb);
1628 /* TODO: use IEEE80211_RX_FRAGMENTED */
1629 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx)
1631 struct ieee80211_sub_if_data *sdata;
1632 struct ieee80211_local *local = rx->local;
1633 struct ieee80211_rtap_hdr {
1634 struct ieee80211_radiotap_header hdr;
1639 } __attribute__ ((packed)) *rthdr;
1640 struct sk_buff *skb = rx->skb, *skb2;
1641 struct net_device *prev_dev = NULL;
1642 struct ieee80211_rx_status *status = rx->status;
1644 if (rx->flags & IEEE80211_RX_CMNTR_REPORTED)
1647 if (skb_headroom(skb) < sizeof(*rthdr) &&
1648 pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
1651 rthdr = (void *)skb_push(skb, sizeof(*rthdr));
1652 memset(rthdr, 0, sizeof(*rthdr));
1653 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
1654 rthdr->hdr.it_present =
1655 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
1656 (1 << IEEE80211_RADIOTAP_RATE) |
1657 (1 << IEEE80211_RADIOTAP_CHANNEL));
1659 rthdr->rate = rx->rate->bitrate / 5;
1660 rthdr->chan_freq = cpu_to_le16(status->freq);
1662 if (status->band == IEEE80211_BAND_5GHZ)
1663 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_OFDM |
1664 IEEE80211_CHAN_5GHZ);
1666 rthdr->chan_flags = cpu_to_le16(IEEE80211_CHAN_DYN |
1667 IEEE80211_CHAN_2GHZ);
1669 skb_set_mac_header(skb, 0);
1670 skb->ip_summed = CHECKSUM_UNNECESSARY;
1671 skb->pkt_type = PACKET_OTHERHOST;
1672 skb->protocol = htons(ETH_P_802_2);
1674 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1675 if (!netif_running(sdata->dev))
1678 if (sdata->vif.type != IEEE80211_IF_TYPE_MNTR ||
1679 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
1683 skb2 = skb_clone(skb, GFP_ATOMIC);
1685 skb2->dev = prev_dev;
1690 prev_dev = sdata->dev;
1691 sdata->dev->stats.rx_packets++;
1692 sdata->dev->stats.rx_bytes += skb->len;
1696 skb->dev = prev_dev;
1702 rx->flags |= IEEE80211_RX_CMNTR_REPORTED;
1709 typedef ieee80211_rx_result (*ieee80211_rx_handler)(struct ieee80211_rx_data *);
1710 static ieee80211_rx_handler ieee80211_rx_handlers[] =
1712 ieee80211_rx_h_if_stats,
1713 ieee80211_rx_h_passive_scan,
1714 ieee80211_rx_h_check,
1715 ieee80211_rx_h_decrypt,
1716 ieee80211_rx_h_sta_process,
1717 ieee80211_rx_h_defragment,
1718 ieee80211_rx_h_ps_poll,
1719 ieee80211_rx_h_michael_mic_verify,
1720 /* this must be after decryption - so header is counted in MPDU mic
1721 * must be before pae and data, so QOS_DATA format frames
1722 * are not passed to user space by these functions
1724 ieee80211_rx_h_remove_qos_control,
1725 ieee80211_rx_h_amsdu,
1726 ieee80211_rx_h_data,
1727 ieee80211_rx_h_ctrl,
1728 ieee80211_rx_h_mgmt,
1732 static void ieee80211_invoke_rx_handlers(struct ieee80211_sub_if_data *sdata,
1733 struct ieee80211_rx_data *rx,
1734 struct sk_buff *skb)
1736 ieee80211_rx_handler *handler;
1737 ieee80211_rx_result res = RX_DROP_MONITOR;
1741 rx->dev = sdata->dev;
1743 for (handler = ieee80211_rx_handlers; *handler != NULL; handler++) {
1744 res = (*handler)(rx);
1749 case RX_DROP_UNUSABLE:
1750 case RX_DROP_MONITOR:
1751 I802_DEBUG_INC(sdata->local->rx_handlers_drop);
1753 rx->sta->rx_dropped++;
1756 I802_DEBUG_INC(sdata->local->rx_handlers_queued);
1764 case RX_DROP_MONITOR:
1765 ieee80211_rx_cooked_monitor(rx);
1767 case RX_DROP_UNUSABLE:
1768 dev_kfree_skb(rx->skb);
1773 /* main receive path */
1775 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1776 u8 *bssid, struct ieee80211_rx_data *rx,
1777 struct ieee80211_hdr *hdr)
1779 int multicast = is_multicast_ether_addr(hdr->addr1);
1781 switch (sdata->vif.type) {
1782 case IEEE80211_IF_TYPE_STA:
1785 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1786 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1788 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1789 } else if (!multicast &&
1790 compare_ether_addr(sdata->dev->dev_addr,
1792 if (!(sdata->dev->flags & IFF_PROMISC))
1794 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1797 case IEEE80211_IF_TYPE_IBSS:
1800 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT &&
1801 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_BEACON)
1803 else if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1804 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1806 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1807 } else if (!multicast &&
1808 compare_ether_addr(sdata->dev->dev_addr,
1810 if (!(sdata->dev->flags & IFF_PROMISC))
1812 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1813 } else if (!rx->sta)
1814 rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1817 case IEEE80211_IF_TYPE_MESH_POINT:
1819 compare_ether_addr(sdata->dev->dev_addr,
1821 if (!(sdata->dev->flags & IFF_PROMISC))
1824 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1827 case IEEE80211_IF_TYPE_VLAN:
1828 case IEEE80211_IF_TYPE_AP:
1830 if (compare_ether_addr(sdata->dev->dev_addr,
1833 } else if (!ieee80211_bssid_match(bssid,
1834 sdata->dev->dev_addr)) {
1835 if (!(rx->flags & IEEE80211_RX_IN_SCAN))
1837 rx->flags &= ~IEEE80211_RX_RA_MATCH;
1839 if (sdata->dev == sdata->local->mdev &&
1840 !(rx->flags & IEEE80211_RX_IN_SCAN))
1841 /* do not receive anything via
1842 * master device when not scanning */
1845 case IEEE80211_IF_TYPE_WDS:
1847 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1849 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1852 case IEEE80211_IF_TYPE_MNTR:
1853 /* take everything */
1855 case IEEE80211_IF_TYPE_INVALID:
1856 /* should never get here */
1865 * This is the actual Rx frames handler. as it blongs to Rx path it must
1866 * be called with rcu_read_lock protection.
1868 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
1869 struct sk_buff *skb,
1870 struct ieee80211_rx_status *status,
1872 struct ieee80211_rate *rate)
1874 struct ieee80211_local *local = hw_to_local(hw);
1875 struct ieee80211_sub_if_data *sdata;
1876 struct ieee80211_hdr *hdr;
1877 struct ieee80211_rx_data rx;
1880 struct ieee80211_sub_if_data *prev = NULL;
1881 struct sk_buff *skb_new;
1884 hdr = (struct ieee80211_hdr *) skb->data;
1885 memset(&rx, 0, sizeof(rx));
1892 rx.fc = le16_to_cpu(hdr->frame_control);
1893 type = rx.fc & IEEE80211_FCTL_FTYPE;
1895 if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
1896 local->dot11ReceivedFragmentCount++;
1898 rx.sta = sta_info_get(local, hdr->addr2);
1900 rx.sdata = rx.sta->sdata;
1901 rx.dev = rx.sta->sdata->dev;
1904 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1905 ieee80211_rx_michael_mic_report(local->mdev, hdr, &rx);
1909 if (unlikely(local->sta_sw_scanning || local->sta_hw_scanning))
1910 rx.flags |= IEEE80211_RX_IN_SCAN;
1912 ieee80211_parse_qos(&rx);
1913 ieee80211_verify_ip_alignment(&rx);
1917 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1918 if (!netif_running(sdata->dev))
1921 if (sdata->vif.type == IEEE80211_IF_TYPE_MNTR)
1924 bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
1925 rx.flags |= IEEE80211_RX_RA_MATCH;
1926 prepares = prepare_for_handlers(sdata, bssid, &rx, hdr);
1932 * frame is destined for this interface, but if it's not
1933 * also for the previous one we handle that after the
1934 * loop to avoid copying the SKB once too much
1943 * frame was destined for the previous interface
1944 * so invoke RX handlers for it
1947 skb_new = skb_copy(skb, GFP_ATOMIC);
1949 if (net_ratelimit())
1950 printk(KERN_DEBUG "%s: failed to copy "
1951 "multicast frame for %s",
1952 wiphy_name(local->hw.wiphy),
1956 rx.fc = le16_to_cpu(hdr->frame_control);
1957 ieee80211_invoke_rx_handlers(prev, &rx, skb_new);
1961 rx.fc = le16_to_cpu(hdr->frame_control);
1962 ieee80211_invoke_rx_handlers(prev, &rx, skb);
1967 #define SEQ_MODULO 0x1000
1968 #define SEQ_MASK 0xfff
1970 static inline int seq_less(u16 sq1, u16 sq2)
1972 return (((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1));
1975 static inline u16 seq_inc(u16 sq)
1977 return ((sq + 1) & SEQ_MASK);
1980 static inline u16 seq_sub(u16 sq1, u16 sq2)
1982 return ((sq1 - sq2) & SEQ_MASK);
1987 * As it function blongs to Rx path it must be called with
1988 * the proper rcu_read_lock protection for its flow.
1990 u8 ieee80211_sta_manage_reorder_buf(struct ieee80211_hw *hw,
1991 struct tid_ampdu_rx *tid_agg_rx,
1992 struct sk_buff *skb, u16 mpdu_seq_num,
1995 struct ieee80211_local *local = hw_to_local(hw);
1996 struct ieee80211_rx_status status;
1997 u16 head_seq_num, buf_size;
2000 struct ieee80211_supported_band *sband;
2001 struct ieee80211_rate *rate;
2003 buf_size = tid_agg_rx->buf_size;
2004 head_seq_num = tid_agg_rx->head_seq_num;
2006 /* frame with out of date sequence number */
2007 if (seq_less(mpdu_seq_num, head_seq_num)) {
2012 /* if frame sequence number exceeds our buffering window size or
2013 * block Ack Request arrived - release stored frames */
2014 if ((!seq_less(mpdu_seq_num, head_seq_num + buf_size)) || (bar_req)) {
2015 /* new head to the ordering buffer */
2017 head_seq_num = mpdu_seq_num;
2020 seq_inc(seq_sub(mpdu_seq_num, buf_size));
2021 /* release stored frames up to new head to stack */
2022 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
2023 index = seq_sub(tid_agg_rx->head_seq_num,
2025 % tid_agg_rx->buf_size;
2027 if (tid_agg_rx->reorder_buf[index]) {
2028 /* release the reordered frames to stack */
2030 tid_agg_rx->reorder_buf[index]->cb,
2032 sband = local->hw.wiphy->bands[status.band];
2033 rate = &sband->bitrates[status.rate_idx];
2034 pkt_load = ieee80211_rx_load_stats(local,
2035 tid_agg_rx->reorder_buf[index],
2037 __ieee80211_rx_handle_packet(hw,
2038 tid_agg_rx->reorder_buf[index],
2039 &status, pkt_load, rate);
2040 tid_agg_rx->stored_mpdu_num--;
2041 tid_agg_rx->reorder_buf[index] = NULL;
2043 tid_agg_rx->head_seq_num =
2044 seq_inc(tid_agg_rx->head_seq_num);
2050 /* now the new frame is always in the range of the reordering */
2052 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn)
2053 % tid_agg_rx->buf_size;
2054 /* check if we already stored this frame */
2055 if (tid_agg_rx->reorder_buf[index]) {
2060 /* if arrived mpdu is in the right order and nothing else stored */
2061 /* release it immediately */
2062 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
2063 tid_agg_rx->stored_mpdu_num == 0) {
2064 tid_agg_rx->head_seq_num =
2065 seq_inc(tid_agg_rx->head_seq_num);
2069 /* put the frame in the reordering buffer */
2070 tid_agg_rx->reorder_buf[index] = skb;
2071 tid_agg_rx->stored_mpdu_num++;
2072 /* release the buffer until next missing frame */
2073 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn)
2074 % tid_agg_rx->buf_size;
2075 while (tid_agg_rx->reorder_buf[index]) {
2076 /* release the reordered frame back to stack */
2077 memcpy(&status, tid_agg_rx->reorder_buf[index]->cb,
2079 sband = local->hw.wiphy->bands[status.band];
2080 rate = &sband->bitrates[status.rate_idx];
2081 pkt_load = ieee80211_rx_load_stats(local,
2082 tid_agg_rx->reorder_buf[index],
2084 __ieee80211_rx_handle_packet(hw, tid_agg_rx->reorder_buf[index],
2085 &status, pkt_load, rate);
2086 tid_agg_rx->stored_mpdu_num--;
2087 tid_agg_rx->reorder_buf[index] = NULL;
2088 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2089 index = seq_sub(tid_agg_rx->head_seq_num,
2090 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
2095 static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
2096 struct sk_buff *skb)
2098 struct ieee80211_hw *hw = &local->hw;
2099 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2100 struct sta_info *sta;
2101 struct tid_ampdu_rx *tid_agg_rx;
2107 sta = sta_info_get(local, hdr->addr2);
2111 fc = le16_to_cpu(hdr->frame_control);
2113 /* filter the QoS data rx stream according to
2114 * STA/TID and check if this STA/TID is on aggregation */
2115 if (!WLAN_FC_IS_QOS_DATA(fc))
2118 qc = skb->data + ieee80211_get_hdrlen(fc) - QOS_CONTROL_LEN;
2119 tid = qc[0] & QOS_CONTROL_TID_MASK;
2121 if (sta->ampdu_mlme.tid_state_rx[tid] != HT_AGG_STATE_OPERATIONAL)
2124 tid_agg_rx = sta->ampdu_mlme.tid_rx[tid];
2126 /* null data frames are excluded */
2127 if (unlikely(fc & IEEE80211_STYPE_NULLFUNC))
2130 /* new un-ordered ampdu frame - process it */
2132 /* reset session timer */
2133 if (tid_agg_rx->timeout) {
2134 unsigned long expires =
2135 jiffies + (tid_agg_rx->timeout / 1000) * HZ;
2136 mod_timer(&tid_agg_rx->session_timer, expires);
2139 /* if this mpdu is fragmented - terminate rx aggregation session */
2140 sc = le16_to_cpu(hdr->seq_ctrl);
2141 if (sc & IEEE80211_SCTL_FRAG) {
2142 ieee80211_sta_stop_rx_ba_session(sta->sdata->dev, sta->addr,
2143 tid, 0, WLAN_REASON_QSTA_REQUIRE_SETUP);
2148 /* according to mpdu sequence number deal with reordering buffer */
2149 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
2150 ret = ieee80211_sta_manage_reorder_buf(hw, tid_agg_rx, skb,
2157 * This is the receive path handler. It is called by a low level driver when an
2158 * 802.11 MPDU is received from the hardware.
2160 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2161 struct ieee80211_rx_status *status)
2163 struct ieee80211_local *local = hw_to_local(hw);
2165 struct ieee80211_rate *rate = NULL;
2166 struct ieee80211_supported_band *sband;
2168 if (status->band < 0 ||
2169 status->band >= IEEE80211_NUM_BANDS) {
2174 sband = local->hw.wiphy->bands[status->band];
2177 status->rate_idx < 0 ||
2178 status->rate_idx >= sband->n_bitrates) {
2183 rate = &sband->bitrates[status->rate_idx];
2186 * key references and virtual interfaces are protected using RCU
2187 * and this requires that we are in a read-side RCU section during
2188 * receive processing
2193 * Frames with failed FCS/PLCP checksum are not returned,
2194 * all other frames are returned without radiotap header
2195 * if it was previously present.
2196 * Also, frames with less than 16 bytes are dropped.
2198 skb = ieee80211_rx_monitor(local, skb, status, rate);
2204 pkt_load = ieee80211_rx_load_stats(local, skb, status, rate);
2205 local->channel_use_raw += pkt_load;
2207 if (!ieee80211_rx_reorder_ampdu(local, skb))
2208 __ieee80211_rx_handle_packet(hw, skb, status, pkt_load, rate);
2212 EXPORT_SYMBOL(__ieee80211_rx);
2214 /* This is a version of the rx handler that can be called from hard irq
2215 * context. Post the skb on the queue and schedule the tasklet */
2216 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
2217 struct ieee80211_rx_status *status)
2219 struct ieee80211_local *local = hw_to_local(hw);
2221 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
2223 skb->dev = local->mdev;
2224 /* copy status into skb->cb for use by tasklet */
2225 memcpy(skb->cb, status, sizeof(*status));
2226 skb->pkt_type = IEEE80211_RX_MSG;
2227 skb_queue_tail(&local->skb_queue, skb);
2228 tasklet_schedule(&local->tasklet);
2230 EXPORT_SYMBOL(ieee80211_rx_irqsafe);