2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
22 #include "ieee80211_common.h"
29 * monitor mode reception
31 * This function cleans up the SKB, i.e. it removes all the stuff
32 * only useful for monitoring.
34 static struct sk_buff
*remove_monitor_info(struct ieee80211_local
*local
,
38 skb_pull(skb
, rtap_len
);
40 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
) {
41 if (likely(skb
->len
> FCS_LEN
))
42 skb_trim(skb
, skb
->len
- FCS_LEN
);
54 static inline int should_drop_frame(struct ieee80211_rx_status
*status
,
59 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
61 if (status
->flag
& (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
63 if (unlikely(skb
->len
< 16 + present_fcs_len
+ radiotap_len
))
65 if ((hdr
->frame_control
& cpu_to_le16(IEEE80211_FCTL_FTYPE
)) ==
66 cpu_to_le16(IEEE80211_FTYPE_CTL
))
72 * This function copies a received frame to all monitor interfaces and
73 * returns a cleaned-up SKB that no longer includes the FCS nor the
74 * radiotap header the driver might have added.
76 static struct sk_buff
*
77 ieee80211_rx_monitor(struct ieee80211_local
*local
, struct sk_buff
*origskb
,
78 struct ieee80211_rx_status
*status
)
80 struct ieee80211_sub_if_data
*sdata
;
81 struct ieee80211_rate
*rate
;
82 int needed_headroom
= 0;
83 struct ieee80211_rtap_hdr
{
84 struct ieee80211_radiotap_header hdr
;
90 u8 padding_for_rxflags
;
92 } __attribute__ ((packed
)) *rthdr
;
93 struct sk_buff
*skb
, *skb2
;
94 struct net_device
*prev_dev
= NULL
;
95 int present_fcs_len
= 0;
99 * First, we may need to make a copy of the skb because
100 * (1) we need to modify it for radiotap (if not present), and
101 * (2) the other RX handlers will modify the skb we got.
103 * We don't need to, of course, if we aren't going to return
104 * the SKB because it has a bad FCS/PLCP checksum.
106 if (status
->flag
& RX_FLAG_RADIOTAP
)
107 rtap_len
= ieee80211_get_radiotap_len(origskb
->data
);
109 needed_headroom
= sizeof(*rthdr
);
111 if (local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
)
112 present_fcs_len
= FCS_LEN
;
114 if (!local
->monitors
) {
115 if (should_drop_frame(status
, origskb
, present_fcs_len
,
117 dev_kfree_skb(origskb
);
121 return remove_monitor_info(local
, origskb
, rtap_len
);
124 if (should_drop_frame(status
, origskb
, present_fcs_len
, rtap_len
)) {
125 /* only need to expand headroom if necessary */
130 * This shouldn't trigger often because most devices have an
131 * RX header they pull before we get here, and that should
132 * be big enough for our radiotap information. We should
133 * probably export the length to drivers so that we can have
134 * them allocate enough headroom to start with.
136 if (skb_headroom(skb
) < needed_headroom
&&
137 pskb_expand_head(skb
, sizeof(*rthdr
), 0, GFP_ATOMIC
)) {
143 * Need to make a copy and possibly remove radiotap header
144 * and FCS from the original.
146 skb
= skb_copy_expand(origskb
, needed_headroom
, 0, GFP_ATOMIC
);
148 origskb
= remove_monitor_info(local
, origskb
, rtap_len
);
154 /* if necessary, prepend radiotap information */
155 if (!(status
->flag
& RX_FLAG_RADIOTAP
)) {
156 rthdr
= (void *) skb_push(skb
, sizeof(*rthdr
));
157 memset(rthdr
, 0, sizeof(*rthdr
));
158 rthdr
->hdr
.it_len
= cpu_to_le16(sizeof(*rthdr
));
159 rthdr
->hdr
.it_present
=
160 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
161 (1 << IEEE80211_RADIOTAP_RATE
) |
162 (1 << IEEE80211_RADIOTAP_CHANNEL
) |
163 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL
) |
164 (1 << IEEE80211_RADIOTAP_RX_FLAGS
));
165 rthdr
->flags
= local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
?
166 IEEE80211_RADIOTAP_F_FCS
: 0;
168 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
171 (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
173 cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS
);
175 rate
= ieee80211_get_rate(local
, status
->phymode
,
178 rthdr
->rate
= rate
->rate
/ 5;
180 rthdr
->chan_freq
= cpu_to_le16(status
->freq
);
182 if (status
->phymode
== MODE_IEEE80211A
)
184 cpu_to_le16(IEEE80211_CHAN_OFDM
|
185 IEEE80211_CHAN_5GHZ
);
188 cpu_to_le16(IEEE80211_CHAN_DYN
|
189 IEEE80211_CHAN_2GHZ
);
191 rthdr
->antsignal
= status
->ssi
;
194 skb_set_mac_header(skb
, 0);
195 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
196 skb
->pkt_type
= PACKET_OTHERHOST
;
197 skb
->protocol
= htons(ETH_P_802_2
);
199 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
200 if (!netif_running(sdata
->dev
))
203 if (sdata
->type
!= IEEE80211_IF_TYPE_MNTR
)
207 skb2
= skb_clone(skb
, GFP_ATOMIC
);
209 skb2
->dev
= prev_dev
;
214 prev_dev
= sdata
->dev
;
215 sdata
->dev
->stats
.rx_packets
++;
216 sdata
->dev
->stats
.rx_bytes
+= skb
->len
;
231 * these don't have dev/sdata fields in the rx data
232 * The sta value should also not be used because it may
233 * be NULL even though a STA (in IBSS mode) will be added.
236 static ieee80211_txrx_result
237 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data
*rx
)
239 u8
*data
= rx
->skb
->data
;
242 /* does the frame have a qos control field? */
243 if (WLAN_FC_IS_QOS_DATA(rx
->fc
)) {
244 u8
*qc
= data
+ ieee80211_get_hdrlen(rx
->fc
) - QOS_CONTROL_LEN
;
245 /* frame has qos control */
246 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
248 if (unlikely((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
)) {
249 /* Separate TID for management frames */
250 tid
= NUM_RX_DATA_QUEUES
- 1;
252 /* no qos control present */
253 tid
= 0; /* 802.1d - Best Effort */
257 I802_DEBUG_INC(rx
->local
->wme_rx_queue
[tid
]);
258 /* only a debug counter, sta might not be assigned properly yet */
260 I802_DEBUG_INC(rx
->sta
->wme_rx_queue
[tid
]);
262 rx
->u
.rx
.queue
= tid
;
263 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
264 * For now, set skb->priority to 0 for other cases. */
265 rx
->skb
->priority
= (tid
> 7) ? 0 : tid
;
267 return TXRX_CONTINUE
;
270 static ieee80211_txrx_result
271 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data
*rx
)
273 struct ieee80211_local
*local
= rx
->local
;
274 struct sk_buff
*skb
= rx
->skb
;
275 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
276 u32 load
= 0, hdrtime
;
277 struct ieee80211_rate
*rate
;
278 struct ieee80211_hw_mode
*mode
= local
->hw
.conf
.mode
;
281 /* Estimate total channel use caused by this frame */
283 if (unlikely(mode
->num_rates
< 0))
284 return TXRX_CONTINUE
;
286 rate
= &mode
->rates
[0];
287 for (i
= 0; i
< mode
->num_rates
; i
++) {
288 if (mode
->rates
[i
].val
== rx
->u
.rx
.status
->rate
) {
289 rate
= &mode
->rates
[i
];
294 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
295 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
297 if (mode
->mode
== MODE_IEEE80211A
||
298 (mode
->mode
== MODE_IEEE80211G
&&
299 rate
->flags
& IEEE80211_RATE_ERP
))
300 hdrtime
= CHAN_UTIL_HDR_SHORT
;
302 hdrtime
= CHAN_UTIL_HDR_LONG
;
305 if (!is_multicast_ether_addr(hdr
->addr1
))
308 load
+= skb
->len
* rate
->rate_inv
;
310 /* Divide channel_use by 8 to avoid wrapping around the counter */
311 load
>>= CHAN_UTIL_SHIFT
;
312 local
->channel_use_raw
+= load
;
313 rx
->u
.rx
.load
= load
;
315 return TXRX_CONTINUE
;
318 ieee80211_rx_handler ieee80211_rx_pre_handlers
[] =
320 ieee80211_rx_h_parse_qos
,
321 ieee80211_rx_h_load_stats
,
327 static ieee80211_txrx_result
328 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data
*rx
)
331 rx
->sta
->channel_use_raw
+= rx
->u
.rx
.load
;
332 rx
->sdata
->channel_use_raw
+= rx
->u
.rx
.load
;
333 return TXRX_CONTINUE
;
336 static ieee80211_txrx_result
337 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data
*rx
)
339 struct ieee80211_local
*local
= rx
->local
;
340 struct sk_buff
*skb
= rx
->skb
;
342 if (unlikely(local
->sta_scanning
!= 0)) {
343 ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->u
.rx
.status
);
347 if (unlikely(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
)) {
348 /* scanning finished during invoking of handlers */
349 I802_DEBUG_INC(local
->rx_handlers_drop_passive_scan
);
353 return TXRX_CONTINUE
;
356 static ieee80211_txrx_result
357 ieee80211_rx_h_check(struct ieee80211_txrx_data
*rx
)
359 struct ieee80211_hdr
*hdr
;
360 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
362 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
363 if (rx
->sta
&& !is_multicast_ether_addr(hdr
->addr1
)) {
364 if (unlikely(rx
->fc
& IEEE80211_FCTL_RETRY
&&
365 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] ==
367 if (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
) {
368 rx
->local
->dot11FrameDuplicateCount
++;
369 rx
->sta
->num_duplicates
++;
373 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] = hdr
->seq_ctrl
;
376 if (unlikely(rx
->skb
->len
< 16)) {
377 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_short
);
381 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
382 rx
->skb
->pkt_type
= PACKET_OTHERHOST
;
383 else if (compare_ether_addr(rx
->dev
->dev_addr
, hdr
->addr1
) == 0)
384 rx
->skb
->pkt_type
= PACKET_HOST
;
385 else if (is_multicast_ether_addr(hdr
->addr1
)) {
386 if (is_broadcast_ether_addr(hdr
->addr1
))
387 rx
->skb
->pkt_type
= PACKET_BROADCAST
;
389 rx
->skb
->pkt_type
= PACKET_MULTICAST
;
391 rx
->skb
->pkt_type
= PACKET_OTHERHOST
;
393 /* Drop disallowed frame classes based on STA auth/assoc state;
394 * IEEE 802.11, Chap 5.5.
396 * 80211.o does filtering only based on association state, i.e., it
397 * drops Class 3 frames from not associated stations. hostapd sends
398 * deauth/disassoc frames when needed. In addition, hostapd is
399 * responsible for filtering on both auth and assoc states.
401 if (unlikely(((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
||
402 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_CTL
&&
403 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_PSPOLL
)) &&
404 rx
->sdata
->type
!= IEEE80211_IF_TYPE_IBSS
&&
405 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_ASSOC
)))) {
406 if ((!(rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
407 !(rx
->fc
& IEEE80211_FCTL_TODS
) &&
408 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
)
409 || !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
410 /* Drop IBSS frames and frames for other hosts
415 if (!rx
->local
->apdev
)
418 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
419 ieee80211_msg_sta_not_assoc
);
423 return TXRX_CONTINUE
;
427 static ieee80211_txrx_result
428 ieee80211_rx_h_load_key(struct ieee80211_txrx_data
*rx
)
430 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
433 struct ieee80211_key
*stakey
= NULL
;
438 * There are three types of keys:
440 * - PTK (pairwise keys)
441 * - STK (station-to-station pairwise keys)
443 * When selecting a key, we have to distinguish between multicast
444 * (including broadcast) and unicast frames, the latter can only
445 * use PTKs and STKs while the former always use GTKs. Unless, of
446 * course, actual WEP keys ("pre-RSNA") are used, then unicast
447 * frames can also use key indizes like GTKs. Hence, if we don't
448 * have a PTK/STK we check the key index for a WEP key.
450 * Note that in a regular BSS, multicast frames are sent by the
451 * AP only, associated stations unicast the frame to the AP first
452 * which then multicasts it on their behalf.
454 * There is also a slight problem in IBSS mode: GTKs are negotiated
455 * with each station, that is something we don't currently handle.
456 * The spec seems to expect that one negotiates the same key with
457 * every station but there's no such requirement; VLANs could be
461 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
))
462 return TXRX_CONTINUE
;
465 * No point in finding a key if the frame is neither
466 * addressed to us nor a multicast frame.
468 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
469 return TXRX_CONTINUE
;
472 stakey
= rcu_dereference(rx
->sta
->key
);
474 if (!is_multicast_ether_addr(hdr
->addr1
) && stakey
) {
478 * The device doesn't give us the IV so we won't be
479 * able to look up the key. That's ok though, we
480 * don't need to decrypt the frame, we just won't
481 * be able to keep statistics accurate.
482 * Except for key threshold notifications, should
483 * we somehow allow the driver to tell us which key
484 * the hardware used if this flag is set?
486 if ((rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
) &&
487 (rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
))
488 return TXRX_CONTINUE
;
490 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
492 if (rx
->skb
->len
< 8 + hdrlen
)
493 return TXRX_DROP
; /* TODO: count this? */
496 * no need to call ieee80211_wep_get_keyidx,
497 * it verifies a bunch of things we've done already
499 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
501 rx
->key
= rcu_dereference(rx
->sdata
->keys
[keyidx
]);
504 * RSNA-protected unicast frames should always be sent with
505 * pairwise or station-to-station keys, but for WEP we allow
506 * using a key index as well.
508 if (rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
&&
509 !is_multicast_ether_addr(hdr
->addr1
))
514 rx
->key
->tx_rx_count
++;
515 /* TODO: add threshold stuff again */
518 return TXRX_CONTINUE
;
521 static void ap_sta_ps_start(struct net_device
*dev
, struct sta_info
*sta
)
523 struct ieee80211_sub_if_data
*sdata
;
524 DECLARE_MAC_BUF(mac
);
526 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
529 atomic_inc(&sdata
->bss
->num_sta_ps
);
530 sta
->flags
|= WLAN_STA_PS
;
532 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
533 printk(KERN_DEBUG
"%s: STA %s aid %d enters power save mode\n",
534 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
535 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
538 static int ap_sta_ps_end(struct net_device
*dev
, struct sta_info
*sta
)
540 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
543 struct ieee80211_sub_if_data
*sdata
;
544 struct ieee80211_tx_packet_data
*pkt_data
;
545 DECLARE_MAC_BUF(mac
);
547 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
549 atomic_dec(&sdata
->bss
->num_sta_ps
);
550 sta
->flags
&= ~(WLAN_STA_PS
| WLAN_STA_TIM
);
552 if (!skb_queue_empty(&sta
->ps_tx_buf
)) {
553 if (local
->ops
->set_tim
)
554 local
->ops
->set_tim(local_to_hw(local
), sta
->aid
, 0);
556 bss_tim_clear(local
, sdata
->bss
, sta
->aid
);
558 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
559 printk(KERN_DEBUG
"%s: STA %s aid %d exits power save mode\n",
560 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
561 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
562 /* Send all buffered frames to the station */
563 while ((skb
= skb_dequeue(&sta
->tx_filtered
)) != NULL
) {
564 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
566 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
569 while ((skb
= skb_dequeue(&sta
->ps_tx_buf
)) != NULL
) {
570 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
571 local
->total_ps_buffered
--;
573 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
574 printk(KERN_DEBUG
"%s: STA %s aid %d send PS frame "
575 "since STA not sleeping anymore\n", dev
->name
,
576 print_mac(mac
, sta
->addr
), sta
->aid
);
577 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
578 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
585 static ieee80211_txrx_result
586 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data
*rx
)
588 struct sta_info
*sta
= rx
->sta
;
589 struct net_device
*dev
= rx
->dev
;
590 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
593 return TXRX_CONTINUE
;
595 /* Update last_rx only for IBSS packets which are for the current
596 * BSSID to avoid keeping the current IBSS network alive in cases where
597 * other STAs are using different BSSID. */
598 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_IBSS
) {
599 u8
*bssid
= ieee80211_get_bssid(hdr
, rx
->skb
->len
);
600 if (compare_ether_addr(bssid
, rx
->sdata
->u
.sta
.bssid
) == 0)
601 sta
->last_rx
= jiffies
;
603 if (!is_multicast_ether_addr(hdr
->addr1
) ||
604 rx
->sdata
->type
== IEEE80211_IF_TYPE_STA
) {
605 /* Update last_rx only for unicast frames in order to prevent
606 * the Probe Request frames (the only broadcast frames from a
607 * STA in infrastructure mode) from keeping a connection alive.
609 sta
->last_rx
= jiffies
;
612 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
613 return TXRX_CONTINUE
;
616 sta
->rx_bytes
+= rx
->skb
->len
;
617 sta
->last_rssi
= rx
->u
.rx
.status
->ssi
;
618 sta
->last_signal
= rx
->u
.rx
.status
->signal
;
619 sta
->last_noise
= rx
->u
.rx
.status
->noise
;
621 if (!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
)) {
622 /* Change STA power saving mode only in the end of a frame
623 * exchange sequence */
624 if ((sta
->flags
& WLAN_STA_PS
) && !(rx
->fc
& IEEE80211_FCTL_PM
))
625 rx
->u
.rx
.sent_ps_buffered
+= ap_sta_ps_end(dev
, sta
);
626 else if (!(sta
->flags
& WLAN_STA_PS
) &&
627 (rx
->fc
& IEEE80211_FCTL_PM
))
628 ap_sta_ps_start(dev
, sta
);
631 /* Drop data::nullfunc frames silently, since they are used only to
632 * control station power saving mode. */
633 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
634 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_NULLFUNC
) {
635 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_nullfunc
);
636 /* Update counter and free packet here to avoid counting this
637 * as a dropped packed. */
639 dev_kfree_skb(rx
->skb
);
643 return TXRX_CONTINUE
;
644 } /* ieee80211_rx_h_sta_process */
646 static ieee80211_txrx_result
647 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data
*rx
)
649 if (!rx
->sta
|| !(rx
->fc
& IEEE80211_FCTL_PROTECTED
) ||
650 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
||
651 !rx
->key
|| rx
->key
->conf
.alg
!= ALG_WEP
||
652 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
653 return TXRX_CONTINUE
;
655 /* Check for weak IVs, if hwaccel did not remove IV from the frame */
656 if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
) ||
657 !(rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
))
658 if (ieee80211_wep_is_weak_iv(rx
->skb
, rx
->key
))
659 rx
->sta
->wep_weak_iv_count
++;
661 return TXRX_CONTINUE
;
664 static ieee80211_txrx_result
665 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data
*rx
)
667 if ((rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
) ||
668 !(rx
->fc
& IEEE80211_FCTL_PROTECTED
) ||
669 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
670 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
671 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)))
672 return TXRX_CONTINUE
;
676 printk(KERN_DEBUG
"%s: RX WEP frame, but no key set\n",
681 if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
)) {
682 if (ieee80211_wep_decrypt(rx
->local
, rx
->skb
, rx
->key
)) {
684 printk(KERN_DEBUG
"%s: RX WEP frame, decrypt "
685 "failed\n", rx
->dev
->name
);
688 } else if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
)) {
689 ieee80211_wep_remove_iv(rx
->local
, rx
->skb
, rx
->key
);
691 skb_trim(rx
->skb
, rx
->skb
->len
- 4);
694 return TXRX_CONTINUE
;
697 static inline struct ieee80211_fragment_entry
*
698 ieee80211_reassemble_add(struct ieee80211_sub_if_data
*sdata
,
699 unsigned int frag
, unsigned int seq
, int rx_queue
,
700 struct sk_buff
**skb
)
702 struct ieee80211_fragment_entry
*entry
;
705 idx
= sdata
->fragment_next
;
706 entry
= &sdata
->fragments
[sdata
->fragment_next
++];
707 if (sdata
->fragment_next
>= IEEE80211_FRAGMENT_MAX
)
708 sdata
->fragment_next
= 0;
710 if (!skb_queue_empty(&entry
->skb_list
)) {
711 #ifdef CONFIG_MAC80211_DEBUG
712 struct ieee80211_hdr
*hdr
=
713 (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
714 DECLARE_MAC_BUF(mac
);
715 DECLARE_MAC_BUF(mac2
);
716 printk(KERN_DEBUG
"%s: RX reassembly removed oldest "
717 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
718 "addr1=%s addr2=%s\n",
719 sdata
->dev
->name
, idx
,
720 jiffies
- entry
->first_frag_time
, entry
->seq
,
721 entry
->last_frag
, print_mac(mac
, hdr
->addr1
),
722 print_mac(mac2
, hdr
->addr2
));
723 #endif /* CONFIG_MAC80211_DEBUG */
724 __skb_queue_purge(&entry
->skb_list
);
727 __skb_queue_tail(&entry
->skb_list
, *skb
); /* no need for locking */
729 entry
->first_frag_time
= jiffies
;
731 entry
->rx_queue
= rx_queue
;
732 entry
->last_frag
= frag
;
734 entry
->extra_len
= 0;
739 static inline struct ieee80211_fragment_entry
*
740 ieee80211_reassemble_find(struct ieee80211_sub_if_data
*sdata
,
741 u16 fc
, unsigned int frag
, unsigned int seq
,
742 int rx_queue
, struct ieee80211_hdr
*hdr
)
744 struct ieee80211_fragment_entry
*entry
;
747 idx
= sdata
->fragment_next
;
748 for (i
= 0; i
< IEEE80211_FRAGMENT_MAX
; i
++) {
749 struct ieee80211_hdr
*f_hdr
;
754 idx
= IEEE80211_FRAGMENT_MAX
- 1;
756 entry
= &sdata
->fragments
[idx
];
757 if (skb_queue_empty(&entry
->skb_list
) || entry
->seq
!= seq
||
758 entry
->rx_queue
!= rx_queue
||
759 entry
->last_frag
+ 1 != frag
)
762 f_hdr
= (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
763 f_fc
= le16_to_cpu(f_hdr
->frame_control
);
765 if ((fc
& IEEE80211_FCTL_FTYPE
) != (f_fc
& IEEE80211_FCTL_FTYPE
) ||
766 compare_ether_addr(hdr
->addr1
, f_hdr
->addr1
) != 0 ||
767 compare_ether_addr(hdr
->addr2
, f_hdr
->addr2
) != 0)
770 if (entry
->first_frag_time
+ 2 * HZ
< jiffies
) {
771 __skb_queue_purge(&entry
->skb_list
);
780 static ieee80211_txrx_result
781 ieee80211_rx_h_defragment(struct ieee80211_txrx_data
*rx
)
783 struct ieee80211_hdr
*hdr
;
785 unsigned int frag
, seq
;
786 struct ieee80211_fragment_entry
*entry
;
788 DECLARE_MAC_BUF(mac
);
790 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
791 sc
= le16_to_cpu(hdr
->seq_ctrl
);
792 frag
= sc
& IEEE80211_SCTL_FRAG
;
794 if (likely((!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) && frag
== 0) ||
795 (rx
->skb
)->len
< 24 ||
796 is_multicast_ether_addr(hdr
->addr1
))) {
800 I802_DEBUG_INC(rx
->local
->rx_handlers_fragments
);
802 seq
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
805 /* This is the first fragment of a new frame. */
806 entry
= ieee80211_reassemble_add(rx
->sdata
, frag
, seq
,
807 rx
->u
.rx
.queue
, &(rx
->skb
));
808 if (rx
->key
&& rx
->key
->conf
.alg
== ALG_CCMP
&&
809 (rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
810 /* Store CCMP PN so that we can verify that the next
811 * fragment has a sequential PN value. */
813 memcpy(entry
->last_pn
,
814 rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
],
820 /* This is a fragment for a frame that should already be pending in
821 * fragment cache. Add this fragment to the end of the pending entry.
823 entry
= ieee80211_reassemble_find(rx
->sdata
, rx
->fc
, frag
, seq
,
824 rx
->u
.rx
.queue
, hdr
);
826 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
830 /* Verify that MPDUs within one MSDU have sequential PN values.
831 * (IEEE 802.11i, 8.3.3.4.5) */
834 u8 pn
[CCMP_PN_LEN
], *rpn
;
835 if (!rx
->key
|| rx
->key
->conf
.alg
!= ALG_CCMP
)
837 memcpy(pn
, entry
->last_pn
, CCMP_PN_LEN
);
838 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
843 rpn
= rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
];
844 if (memcmp(pn
, rpn
, CCMP_PN_LEN
) != 0) {
846 printk(KERN_DEBUG
"%s: defrag: CCMP PN not "
848 " PN=%02x%02x%02x%02x%02x%02x "
849 "(expected %02x%02x%02x%02x%02x%02x)\n",
850 rx
->dev
->name
, print_mac(mac
, hdr
->addr2
),
851 rpn
[0], rpn
[1], rpn
[2], rpn
[3], rpn
[4],
852 rpn
[5], pn
[0], pn
[1], pn
[2], pn
[3],
856 memcpy(entry
->last_pn
, pn
, CCMP_PN_LEN
);
859 skb_pull(rx
->skb
, ieee80211_get_hdrlen(rx
->fc
));
860 __skb_queue_tail(&entry
->skb_list
, rx
->skb
);
861 entry
->last_frag
= frag
;
862 entry
->extra_len
+= rx
->skb
->len
;
863 if (rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) {
868 rx
->skb
= __skb_dequeue(&entry
->skb_list
);
869 if (skb_tailroom(rx
->skb
) < entry
->extra_len
) {
870 I802_DEBUG_INC(rx
->local
->rx_expand_skb_head2
);
871 if (unlikely(pskb_expand_head(rx
->skb
, 0, entry
->extra_len
,
873 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
874 __skb_queue_purge(&entry
->skb_list
);
878 while ((skb
= __skb_dequeue(&entry
->skb_list
))) {
879 memcpy(skb_put(rx
->skb
, skb
->len
), skb
->data
, skb
->len
);
883 /* Complete frame has been reassembled - process it now */
884 rx
->flags
|= IEEE80211_TXRXD_FRAGMENTED
;
888 rx
->sta
->rx_packets
++;
889 if (is_multicast_ether_addr(hdr
->addr1
))
890 rx
->local
->dot11MulticastReceivedFrameCount
++;
892 ieee80211_led_rx(rx
->local
);
893 return TXRX_CONTINUE
;
896 static ieee80211_txrx_result
897 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data
*rx
)
901 DECLARE_MAC_BUF(mac
);
903 if (likely(!rx
->sta
||
904 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
||
905 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_PSPOLL
||
906 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)))
907 return TXRX_CONTINUE
;
909 skb
= skb_dequeue(&rx
->sta
->tx_filtered
);
911 skb
= skb_dequeue(&rx
->sta
->ps_tx_buf
);
913 rx
->local
->total_ps_buffered
--;
915 no_pending_pkts
= skb_queue_empty(&rx
->sta
->tx_filtered
) &&
916 skb_queue_empty(&rx
->sta
->ps_tx_buf
);
919 struct ieee80211_hdr
*hdr
=
920 (struct ieee80211_hdr
*) skb
->data
;
922 /* tell TX path to send one frame even though the STA may
923 * still remain is PS mode after this frame exchange */
926 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
927 printk(KERN_DEBUG
"STA %s aid %d: PS Poll (entries after %d)\n",
928 print_mac(mac
, rx
->sta
->addr
), rx
->sta
->aid
,
929 skb_queue_len(&rx
->sta
->ps_tx_buf
));
930 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
932 /* Use MoreData flag to indicate whether there are more
933 * buffered frames for this STA */
934 if (no_pending_pkts
) {
935 hdr
->frame_control
&= cpu_to_le16(~IEEE80211_FCTL_MOREDATA
);
936 rx
->sta
->flags
&= ~WLAN_STA_TIM
;
938 hdr
->frame_control
|= cpu_to_le16(IEEE80211_FCTL_MOREDATA
);
942 if (no_pending_pkts
) {
943 if (rx
->local
->ops
->set_tim
)
944 rx
->local
->ops
->set_tim(local_to_hw(rx
->local
),
947 bss_tim_clear(rx
->local
, rx
->sdata
->bss
, rx
->sta
->aid
);
949 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
950 } else if (!rx
->u
.rx
.sent_ps_buffered
) {
951 printk(KERN_DEBUG
"%s: STA %s sent PS Poll even "
952 "though there is no buffered frames for it\n",
953 rx
->dev
->name
, print_mac(mac
, rx
->sta
->addr
));
954 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
958 /* Free PS Poll skb here instead of returning TXRX_DROP that would
959 * count as an dropped frame. */
960 dev_kfree_skb(rx
->skb
);
965 static ieee80211_txrx_result
966 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data
*rx
)
969 u8
*data
= rx
->skb
->data
;
970 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) data
;
972 if (!WLAN_FC_IS_QOS_DATA(fc
))
973 return TXRX_CONTINUE
;
975 /* remove the qos control field, update frame type and meta-data */
976 memmove(data
+ 2, data
, ieee80211_get_hdrlen(fc
) - 2);
977 hdr
= (struct ieee80211_hdr
*) skb_pull(rx
->skb
, 2);
978 /* change frame type to non QOS */
979 rx
->fc
= fc
&= ~IEEE80211_STYPE_QOS_DATA
;
980 hdr
->frame_control
= cpu_to_le16(fc
);
982 return TXRX_CONTINUE
;
985 static ieee80211_txrx_result
986 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data
*rx
)
988 if (rx
->sdata
->eapol
&& ieee80211_is_eapol(rx
->skb
) &&
989 rx
->sdata
->type
!= IEEE80211_IF_TYPE_STA
&&
990 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
991 /* Pass both encrypted and unencrypted EAPOL frames to user
992 * space for processing. */
993 if (!rx
->local
->apdev
)
995 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
996 ieee80211_msg_normal
);
1000 if (unlikely(rx
->sdata
->ieee802_1x
&&
1001 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
1002 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
1003 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_AUTHORIZED
)) &&
1004 !ieee80211_is_eapol(rx
->skb
))) {
1005 #ifdef CONFIG_MAC80211_DEBUG
1006 struct ieee80211_hdr
*hdr
=
1007 (struct ieee80211_hdr
*) rx
->skb
->data
;
1008 DECLARE_MAC_BUF(mac
);
1009 printk(KERN_DEBUG
"%s: dropped frame from %s"
1010 " (unauthorized port)\n", rx
->dev
->name
,
1011 print_mac(mac
, hdr
->addr2
));
1012 #endif /* CONFIG_MAC80211_DEBUG */
1016 return TXRX_CONTINUE
;
1019 static ieee80211_txrx_result
1020 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data
*rx
)
1023 * Pass through unencrypted frames if the hardware has
1024 * decrypted them already.
1026 if (rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
)
1027 return TXRX_CONTINUE
;
1029 /* Drop unencrypted frames if key is set. */
1030 if (unlikely(!(rx
->fc
& IEEE80211_FCTL_PROTECTED
) &&
1031 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
1032 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
1033 (rx
->key
|| rx
->sdata
->drop_unencrypted
) &&
1034 (rx
->sdata
->eapol
== 0 ||
1035 !ieee80211_is_eapol(rx
->skb
)))) {
1036 if (net_ratelimit())
1037 printk(KERN_DEBUG
"%s: RX non-WEP frame, but expected "
1038 "encryption\n", rx
->dev
->name
);
1041 return TXRX_CONTINUE
;
1044 static ieee80211_txrx_result
1045 ieee80211_rx_h_data(struct ieee80211_txrx_data
*rx
)
1047 struct net_device
*dev
= rx
->dev
;
1048 struct ieee80211_local
*local
= rx
->local
;
1049 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
1050 u16 fc
, hdrlen
, ethertype
;
1054 struct sk_buff
*skb
= rx
->skb
, *skb2
;
1055 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
1056 DECLARE_MAC_BUF(mac
);
1057 DECLARE_MAC_BUF(mac2
);
1058 DECLARE_MAC_BUF(mac3
);
1059 DECLARE_MAC_BUF(mac4
);
1062 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
1063 return TXRX_CONTINUE
;
1065 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
1068 hdrlen
= ieee80211_get_hdrlen(fc
);
1070 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
1072 * IEEE 802.11 address fields:
1073 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
1074 * 0 0 DA SA BSSID n/a
1075 * 0 1 DA BSSID SA n/a
1076 * 1 0 BSSID SA DA n/a
1080 switch (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) {
1081 case IEEE80211_FCTL_TODS
:
1083 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1084 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1086 if (unlikely(sdata
->type
!= IEEE80211_IF_TYPE_AP
&&
1087 sdata
->type
!= IEEE80211_IF_TYPE_VLAN
)) {
1088 if (net_ratelimit())
1089 printk(KERN_DEBUG
"%s: dropped ToDS frame "
1090 "(BSSID=%s SA=%s DA=%s)\n",
1092 print_mac(mac
, hdr
->addr1
),
1093 print_mac(mac2
, hdr
->addr2
),
1094 print_mac(mac3
, hdr
->addr3
));
1098 case (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
):
1100 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
1101 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
1103 if (unlikely(sdata
->type
!= IEEE80211_IF_TYPE_WDS
)) {
1104 if (net_ratelimit())
1105 printk(KERN_DEBUG
"%s: dropped FromDS&ToDS "
1106 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1108 print_mac(mac
, hdr
->addr1
),
1109 print_mac(mac2
, hdr
->addr2
),
1110 print_mac(mac3
, hdr
->addr3
),
1111 print_mac(mac4
, hdr
->addr4
));
1115 case IEEE80211_FCTL_FROMDS
:
1117 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1118 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
1120 if (sdata
->type
!= IEEE80211_IF_TYPE_STA
||
1121 (is_multicast_ether_addr(dst
) &&
1122 !compare_ether_addr(src
, dev
->dev_addr
)))
1127 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1128 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1130 if (sdata
->type
!= IEEE80211_IF_TYPE_IBSS
) {
1131 if (net_ratelimit()) {
1132 printk(KERN_DEBUG
"%s: dropped IBSS frame "
1133 "(DA=%s SA=%s BSSID=%s)\n",
1135 print_mac(mac
, hdr
->addr1
),
1136 print_mac(mac2
, hdr
->addr2
),
1137 print_mac(mac3
, hdr
->addr3
));
1144 payload
= skb
->data
+ hdrlen
;
1146 if (unlikely(skb
->len
- hdrlen
< 8)) {
1147 if (net_ratelimit()) {
1148 printk(KERN_DEBUG
"%s: RX too short data frame "
1149 "payload\n", dev
->name
);
1154 ethertype
= (payload
[6] << 8) | payload
[7];
1156 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1157 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1158 compare_ether_addr(payload
, bridge_tunnel_header
) == 0)) {
1159 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1160 * replace EtherType */
1161 skb_pull(skb
, hdrlen
+ 6);
1162 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1163 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1165 struct ethhdr
*ehdr
;
1167 skb_pull(skb
, hdrlen
);
1168 len
= htons(skb
->len
);
1169 ehdr
= (struct ethhdr
*) skb_push(skb
, sizeof(struct ethhdr
));
1170 memcpy(ehdr
->h_dest
, dst
, ETH_ALEN
);
1171 memcpy(ehdr
->h_source
, src
, ETH_ALEN
);
1172 ehdr
->h_proto
= len
;
1178 dev
->stats
.rx_packets
++;
1179 dev
->stats
.rx_bytes
+= skb
->len
;
1181 if (local
->bridge_packets
&& (sdata
->type
== IEEE80211_IF_TYPE_AP
1182 || sdata
->type
== IEEE80211_IF_TYPE_VLAN
) &&
1183 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
1184 if (is_multicast_ether_addr(skb
->data
)) {
1185 /* send multicast frames both to higher layers in
1186 * local net stack and back to the wireless media */
1187 skb2
= skb_copy(skb
, GFP_ATOMIC
);
1188 if (!skb2
&& net_ratelimit())
1189 printk(KERN_DEBUG
"%s: failed to clone "
1190 "multicast frame\n", dev
->name
);
1192 struct sta_info
*dsta
;
1193 dsta
= sta_info_get(local
, skb
->data
);
1194 if (dsta
&& !dsta
->dev
) {
1195 if (net_ratelimit())
1196 printk(KERN_DEBUG
"Station with null "
1197 "dev structure!\n");
1198 } else if (dsta
&& dsta
->dev
== dev
) {
1199 /* Destination station is associated to this
1200 * AP, so send the frame directly to it and
1201 * do not pass the frame to local net stack.
1212 /* deliver to local stack */
1213 skb
->protocol
= eth_type_trans(skb
, dev
);
1214 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1219 /* send to wireless media */
1220 skb2
->protocol
= __constant_htons(ETH_P_802_3
);
1221 skb_set_network_header(skb2
, 0);
1222 skb_set_mac_header(skb2
, 0);
1223 dev_queue_xmit(skb2
);
1229 static ieee80211_txrx_result
1230 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data
*rx
)
1232 struct ieee80211_sub_if_data
*sdata
;
1234 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
1237 sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
1238 if ((sdata
->type
== IEEE80211_IF_TYPE_STA
||
1239 sdata
->type
== IEEE80211_IF_TYPE_IBSS
) &&
1240 !rx
->local
->user_space_mlme
) {
1241 ieee80211_sta_rx_mgmt(rx
->dev
, rx
->skb
, rx
->u
.rx
.status
);
1243 /* Management frames are sent to hostapd for processing */
1244 if (!rx
->local
->apdev
)
1246 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
1247 ieee80211_msg_normal
);
1252 static inline ieee80211_txrx_result
__ieee80211_invoke_rx_handlers(
1253 struct ieee80211_local
*local
,
1254 ieee80211_rx_handler
*handlers
,
1255 struct ieee80211_txrx_data
*rx
,
1256 struct sta_info
*sta
)
1258 ieee80211_rx_handler
*handler
;
1259 ieee80211_txrx_result res
= TXRX_DROP
;
1261 for (handler
= handlers
; *handler
!= NULL
; handler
++) {
1262 res
= (*handler
)(rx
);
1268 I802_DEBUG_INC(local
->rx_handlers_drop
);
1273 I802_DEBUG_INC(local
->rx_handlers_queued
);
1279 if (res
== TXRX_DROP
)
1280 dev_kfree_skb(rx
->skb
);
1284 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local
*local
,
1285 ieee80211_rx_handler
*handlers
,
1286 struct ieee80211_txrx_data
*rx
,
1287 struct sta_info
*sta
)
1289 if (__ieee80211_invoke_rx_handlers(local
, handlers
, rx
, sta
) ==
1291 dev_kfree_skb(rx
->skb
);
1294 static void ieee80211_rx_michael_mic_report(struct net_device
*dev
,
1295 struct ieee80211_hdr
*hdr
,
1296 struct sta_info
*sta
,
1297 struct ieee80211_txrx_data
*rx
)
1300 DECLARE_MAC_BUF(mac
);
1301 DECLARE_MAC_BUF(mac2
);
1303 hdrlen
= ieee80211_get_hdrlen_from_skb(rx
->skb
);
1304 if (rx
->skb
->len
>= hdrlen
+ 4)
1305 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
1309 if (net_ratelimit())
1310 printk(KERN_DEBUG
"%s: TKIP hwaccel reported Michael MIC "
1311 "failure from %s to %s keyidx=%d\n",
1312 dev
->name
, print_mac(mac
, hdr
->addr2
),
1313 print_mac(mac2
, hdr
->addr1
), keyidx
);
1317 * Some hardware seem to generate incorrect Michael MIC
1318 * reports; ignore them to avoid triggering countermeasures.
1320 if (net_ratelimit())
1321 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1322 "error for unknown address %s\n",
1323 dev
->name
, print_mac(mac
, hdr
->addr2
));
1327 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
1328 if (net_ratelimit())
1329 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1330 "error for a frame with no PROTECTED flag (src "
1331 "%s)\n", dev
->name
, print_mac(mac
, hdr
->addr2
));
1335 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_AP
&& keyidx
) {
1337 * APs with pairwise keys should never receive Michael MIC
1338 * errors for non-zero keyidx because these are reserved for
1339 * group keys and only the AP is sending real multicast
1340 * frames in the BSS.
1342 if (net_ratelimit())
1343 printk(KERN_DEBUG
"%s: ignored Michael MIC error for "
1344 "a frame with non-zero keyidx (%d)"
1345 " (src %s)\n", dev
->name
, keyidx
,
1346 print_mac(mac
, hdr
->addr2
));
1350 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
1351 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
1352 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)) {
1353 if (net_ratelimit())
1354 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1355 "error for a frame that cannot be encrypted "
1356 "(fc=0x%04x) (src %s)\n",
1357 dev
->name
, rx
->fc
, print_mac(mac
, hdr
->addr2
));
1361 mac80211_ev_michael_mic_failure(rx
->dev
, keyidx
, hdr
);
1363 dev_kfree_skb(rx
->skb
);
1367 ieee80211_rx_handler ieee80211_rx_handlers
[] =
1369 ieee80211_rx_h_if_stats
,
1370 ieee80211_rx_h_passive_scan
,
1371 ieee80211_rx_h_check
,
1372 ieee80211_rx_h_load_key
,
1373 ieee80211_rx_h_sta_process
,
1374 ieee80211_rx_h_ccmp_decrypt
,
1375 ieee80211_rx_h_tkip_decrypt
,
1376 ieee80211_rx_h_wep_weak_iv_detection
,
1377 ieee80211_rx_h_wep_decrypt
,
1378 ieee80211_rx_h_defragment
,
1379 ieee80211_rx_h_ps_poll
,
1380 ieee80211_rx_h_michael_mic_verify
,
1381 /* this must be after decryption - so header is counted in MPDU mic
1382 * must be before pae and data, so QOS_DATA format frames
1383 * are not passed to user space by these functions
1385 ieee80211_rx_h_remove_qos_control
,
1386 ieee80211_rx_h_802_1x_pae
,
1387 ieee80211_rx_h_drop_unencrypted
,
1388 ieee80211_rx_h_data
,
1389 ieee80211_rx_h_mgmt
,
1393 /* main receive path */
1395 static int prepare_for_handlers(struct ieee80211_sub_if_data
*sdata
,
1396 u8
*bssid
, struct ieee80211_txrx_data
*rx
,
1397 struct ieee80211_hdr
*hdr
)
1399 int multicast
= is_multicast_ether_addr(hdr
->addr1
);
1401 switch (sdata
->type
) {
1402 case IEEE80211_IF_TYPE_STA
:
1405 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1406 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1408 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1409 } else if (!multicast
&&
1410 compare_ether_addr(sdata
->dev
->dev_addr
,
1412 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1414 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1417 case IEEE80211_IF_TYPE_IBSS
:
1420 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1421 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1423 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1424 } else if (!multicast
&&
1425 compare_ether_addr(sdata
->dev
->dev_addr
,
1427 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1429 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1430 } else if (!rx
->sta
)
1431 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
, rx
->skb
,
1434 case IEEE80211_IF_TYPE_AP
:
1436 if (compare_ether_addr(sdata
->dev
->dev_addr
,
1439 } else if (!ieee80211_bssid_match(bssid
,
1440 sdata
->dev
->dev_addr
)) {
1441 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1443 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1445 if (sdata
->dev
== sdata
->local
->mdev
&&
1446 !(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1447 /* do not receive anything via
1448 * master device when not scanning */
1451 case IEEE80211_IF_TYPE_WDS
:
1453 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
)
1455 if (compare_ether_addr(sdata
->u
.wds
.remote_addr
, hdr
->addr2
))
1464 * This is the receive path handler. It is called by a low level driver when an
1465 * 802.11 MPDU is received from the hardware.
1467 void __ieee80211_rx(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1468 struct ieee80211_rx_status
*status
)
1470 struct ieee80211_local
*local
= hw_to_local(hw
);
1471 struct ieee80211_sub_if_data
*sdata
;
1472 struct sta_info
*sta
;
1473 struct ieee80211_hdr
*hdr
;
1474 struct ieee80211_txrx_data rx
;
1477 struct ieee80211_sub_if_data
*prev
= NULL
;
1478 struct sk_buff
*skb_new
;
1482 * key references and virtual interfaces are protected using RCU
1483 * and this requires that we are in a read-side RCU section during
1484 * receive processing
1489 * Frames with failed FCS/PLCP checksum are not returned,
1490 * all other frames are returned without radiotap header
1491 * if it was previously present.
1492 * Also, frames with less than 16 bytes are dropped.
1494 skb
= ieee80211_rx_monitor(local
, skb
, status
);
1500 hdr
= (struct ieee80211_hdr
*) skb
->data
;
1501 memset(&rx
, 0, sizeof(rx
));
1505 rx
.u
.rx
.status
= status
;
1506 rx
.fc
= le16_to_cpu(hdr
->frame_control
);
1507 type
= rx
.fc
& IEEE80211_FCTL_FTYPE
;
1509 if (type
== IEEE80211_FTYPE_DATA
|| type
== IEEE80211_FTYPE_MGMT
)
1510 local
->dot11ReceivedFragmentCount
++;
1512 sta
= rx
.sta
= sta_info_get(local
, hdr
->addr2
);
1514 rx
.dev
= rx
.sta
->dev
;
1515 rx
.sdata
= IEEE80211_DEV_TO_SUB_IF(rx
.dev
);
1518 if ((status
->flag
& RX_FLAG_MMIC_ERROR
)) {
1519 ieee80211_rx_michael_mic_report(local
->mdev
, hdr
, sta
, &rx
);
1523 if (unlikely(local
->sta_scanning
))
1524 rx
.flags
|= IEEE80211_TXRXD_RXIN_SCAN
;
1526 if (__ieee80211_invoke_rx_handlers(local
, local
->rx_pre_handlers
, &rx
,
1527 sta
) != TXRX_CONTINUE
)
1531 if (sta
&& !(sta
->flags
& (WLAN_STA_WDS
| WLAN_STA_ASSOC_AP
)) &&
1532 !local
->iff_promiscs
&& !is_multicast_ether_addr(hdr
->addr1
)) {
1533 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1534 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
, &rx
,
1541 bssid
= ieee80211_get_bssid(hdr
, skb
->len
);
1543 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1544 if (!netif_running(sdata
->dev
))
1547 if (sdata
->type
== IEEE80211_IF_TYPE_MNTR
)
1550 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1551 prepres
= prepare_for_handlers(sdata
, bssid
, &rx
, hdr
);
1552 /* prepare_for_handlers can change sta */
1559 * frame is destined for this interface, but if it's not
1560 * also for the previous one we handle that after the
1561 * loop to avoid copying the SKB once too much
1570 * frame was destined for the previous interface
1571 * so invoke RX handlers for it
1574 skb_new
= skb_copy(skb
, GFP_ATOMIC
);
1576 if (net_ratelimit())
1577 printk(KERN_DEBUG
"%s: failed to copy "
1578 "multicast frame for %s",
1579 wiphy_name(local
->hw
.wiphy
),
1586 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
,
1594 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
,
1605 EXPORT_SYMBOL(__ieee80211_rx
);
1607 /* This is a version of the rx handler that can be called from hard irq
1608 * context. Post the skb on the queue and schedule the tasklet */
1609 void ieee80211_rx_irqsafe(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1610 struct ieee80211_rx_status
*status
)
1612 struct ieee80211_local
*local
= hw_to_local(hw
);
1614 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status
) > sizeof(skb
->cb
));
1616 skb
->dev
= local
->mdev
;
1617 /* copy status into skb->cb for use by tasklet */
1618 memcpy(skb
->cb
, status
, sizeof(*status
));
1619 skb
->pkt_type
= IEEE80211_RX_MSG
;
1620 skb_queue_tail(&local
->skb_queue
, skb
);
1621 tasklet_schedule(&local
->tasklet
);
1623 EXPORT_SYMBOL(ieee80211_rx_irqsafe
);