2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
22 #include "ieee80211_common.h"
30 * these don't have dev/sdata fields in the rx data
31 * The sta value should also not be used because it may
32 * be NULL even though a STA (in IBSS mode) will be added.
35 static ieee80211_txrx_result
36 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data
*rx
)
38 u8
*data
= rx
->skb
->data
;
41 /* does the frame have a qos control field? */
42 if (WLAN_FC_IS_QOS_DATA(rx
->fc
)) {
43 u8
*qc
= data
+ ieee80211_get_hdrlen(rx
->fc
) - QOS_CONTROL_LEN
;
44 /* frame has qos control */
45 tid
= qc
[0] & QOS_CONTROL_TID_MASK
;
47 if (unlikely((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_MGMT
)) {
48 /* Separate TID for management frames */
49 tid
= NUM_RX_DATA_QUEUES
- 1;
51 /* no qos control present */
52 tid
= 0; /* 802.1d - Best Effort */
56 I802_DEBUG_INC(rx
->local
->wme_rx_queue
[tid
]);
57 /* only a debug counter, sta might not be assigned properly yet */
59 I802_DEBUG_INC(rx
->sta
->wme_rx_queue
[tid
]);
62 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
63 * For now, set skb->priority to 0 for other cases. */
64 rx
->skb
->priority
= (tid
> 7) ? 0 : tid
;
69 static ieee80211_txrx_result
70 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data
*rx
)
72 struct ieee80211_local
*local
= rx
->local
;
73 struct sk_buff
*skb
= rx
->skb
;
74 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) skb
->data
;
75 u32 load
= 0, hdrtime
;
76 struct ieee80211_rate
*rate
;
77 struct ieee80211_hw_mode
*mode
= local
->hw
.conf
.mode
;
80 /* Estimate total channel use caused by this frame */
82 if (unlikely(mode
->num_rates
< 0))
85 rate
= &mode
->rates
[0];
86 for (i
= 0; i
< mode
->num_rates
; i
++) {
87 if (mode
->rates
[i
].val
== rx
->u
.rx
.status
->rate
) {
88 rate
= &mode
->rates
[i
];
93 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
94 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
96 if (mode
->mode
== MODE_IEEE80211A
||
97 (mode
->mode
== MODE_IEEE80211G
&&
98 rate
->flags
& IEEE80211_RATE_ERP
))
99 hdrtime
= CHAN_UTIL_HDR_SHORT
;
101 hdrtime
= CHAN_UTIL_HDR_LONG
;
104 if (!is_multicast_ether_addr(hdr
->addr1
))
107 load
+= skb
->len
* rate
->rate_inv
;
109 /* Divide channel_use by 8 to avoid wrapping around the counter */
110 load
>>= CHAN_UTIL_SHIFT
;
111 local
->channel_use_raw
+= load
;
112 rx
->u
.rx
.load
= load
;
114 return TXRX_CONTINUE
;
117 ieee80211_rx_handler ieee80211_rx_pre_handlers
[] =
119 ieee80211_rx_h_parse_qos
,
120 ieee80211_rx_h_load_stats
,
126 static ieee80211_txrx_result
127 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data
*rx
)
130 rx
->sta
->channel_use_raw
+= rx
->u
.rx
.load
;
131 rx
->sdata
->channel_use_raw
+= rx
->u
.rx
.load
;
132 return TXRX_CONTINUE
;
136 ieee80211_rx_monitor(struct net_device
*dev
, struct sk_buff
*skb
,
137 struct ieee80211_rx_status
*status
)
139 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
140 struct ieee80211_rate
*rate
;
141 struct ieee80211_rtap_hdr
{
142 struct ieee80211_radiotap_header hdr
;
148 u8 padding_for_rxflags
;
150 } __attribute__ ((packed
)) *rthdr
;
154 if (status
->flag
& RX_FLAG_RADIOTAP
)
157 if (skb_headroom(skb
) < sizeof(*rthdr
)) {
158 I802_DEBUG_INC(local
->rx_expand_skb_head
);
159 if (pskb_expand_head(skb
, sizeof(*rthdr
), 0, GFP_ATOMIC
)) {
165 rthdr
= (struct ieee80211_rtap_hdr
*) skb_push(skb
, sizeof(*rthdr
));
166 memset(rthdr
, 0, sizeof(*rthdr
));
167 rthdr
->hdr
.it_len
= cpu_to_le16(sizeof(*rthdr
));
168 rthdr
->hdr
.it_present
=
169 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS
) |
170 (1 << IEEE80211_RADIOTAP_RATE
) |
171 (1 << IEEE80211_RADIOTAP_CHANNEL
) |
172 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL
) |
173 (1 << IEEE80211_RADIOTAP_RX_FLAGS
));
174 rthdr
->flags
= local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
?
175 IEEE80211_RADIOTAP_F_FCS
: 0;
177 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
180 (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
181 rthdr
->rx_flags
|= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS
);
183 rate
= ieee80211_get_rate(local
, status
->phymode
, status
->rate
);
185 rthdr
->rate
= rate
->rate
/ 5;
187 rthdr
->chan_freq
= cpu_to_le16(status
->freq
);
189 status
->phymode
== MODE_IEEE80211A
?
190 cpu_to_le16(IEEE80211_CHAN_OFDM
| IEEE80211_CHAN_5GHZ
) :
191 cpu_to_le16(IEEE80211_CHAN_DYN
| IEEE80211_CHAN_2GHZ
);
192 rthdr
->antsignal
= status
->ssi
;
195 dev
->stats
.rx_packets
++;
196 dev
->stats
.rx_bytes
+= skb
->len
;
198 skb_set_mac_header(skb
, 0);
199 skb
->ip_summed
= CHECKSUM_UNNECESSARY
;
200 skb
->pkt_type
= PACKET_OTHERHOST
;
201 skb
->protocol
= htons(ETH_P_802_2
);
202 memset(skb
->cb
, 0, sizeof(skb
->cb
));
206 static ieee80211_txrx_result
207 ieee80211_rx_h_monitor(struct ieee80211_txrx_data
*rx
)
209 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_MNTR
) {
210 ieee80211_rx_monitor(rx
->dev
, rx
->skb
, rx
->u
.rx
.status
);
215 * Drop frames with failed FCS/PLCP checksums here, they are only
216 * relevant for monitor mode, the rest of the stack should never
219 if (rx
->u
.rx
.status
->flag
&
220 (RX_FLAG_FAILED_FCS_CRC
| RX_FLAG_FAILED_PLCP_CRC
))
223 if (rx
->u
.rx
.status
->flag
& RX_FLAG_RADIOTAP
)
224 skb_pull(rx
->skb
, ieee80211_get_radiotap_len(rx
->skb
->data
));
226 return TXRX_CONTINUE
;
229 static ieee80211_txrx_result
230 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data
*rx
)
232 struct ieee80211_local
*local
= rx
->local
;
233 struct sk_buff
*skb
= rx
->skb
;
235 if (unlikely(local
->sta_scanning
!= 0)) {
236 ieee80211_sta_rx_scan(rx
->dev
, skb
, rx
->u
.rx
.status
);
240 if (unlikely(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
)) {
241 /* scanning finished during invoking of handlers */
242 I802_DEBUG_INC(local
->rx_handlers_drop_passive_scan
);
246 return TXRX_CONTINUE
;
249 static ieee80211_txrx_result
250 ieee80211_rx_h_check(struct ieee80211_txrx_data
*rx
)
252 struct ieee80211_hdr
*hdr
;
253 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
255 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
256 if (rx
->sta
&& !is_multicast_ether_addr(hdr
->addr1
)) {
257 if (unlikely(rx
->fc
& IEEE80211_FCTL_RETRY
&&
258 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] ==
260 if (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
) {
261 rx
->local
->dot11FrameDuplicateCount
++;
262 rx
->sta
->num_duplicates
++;
266 rx
->sta
->last_seq_ctrl
[rx
->u
.rx
.queue
] = hdr
->seq_ctrl
;
269 if ((rx
->local
->hw
.flags
& IEEE80211_HW_RX_INCLUDES_FCS
) &&
270 rx
->skb
->len
> FCS_LEN
)
271 skb_trim(rx
->skb
, rx
->skb
->len
- FCS_LEN
);
273 if (unlikely(rx
->skb
->len
< 16)) {
274 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_short
);
278 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
279 rx
->skb
->pkt_type
= PACKET_OTHERHOST
;
280 else if (compare_ether_addr(rx
->dev
->dev_addr
, hdr
->addr1
) == 0)
281 rx
->skb
->pkt_type
= PACKET_HOST
;
282 else if (is_multicast_ether_addr(hdr
->addr1
)) {
283 if (is_broadcast_ether_addr(hdr
->addr1
))
284 rx
->skb
->pkt_type
= PACKET_BROADCAST
;
286 rx
->skb
->pkt_type
= PACKET_MULTICAST
;
288 rx
->skb
->pkt_type
= PACKET_OTHERHOST
;
290 /* Drop disallowed frame classes based on STA auth/assoc state;
291 * IEEE 802.11, Chap 5.5.
293 * 80211.o does filtering only based on association state, i.e., it
294 * drops Class 3 frames from not associated stations. hostapd sends
295 * deauth/disassoc frames when needed. In addition, hostapd is
296 * responsible for filtering on both auth and assoc states.
298 if (unlikely(((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
||
299 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_CTL
&&
300 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_PSPOLL
)) &&
301 rx
->sdata
->type
!= IEEE80211_IF_TYPE_IBSS
&&
302 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_ASSOC
)))) {
303 if ((!(rx
->fc
& IEEE80211_FCTL_FROMDS
) &&
304 !(rx
->fc
& IEEE80211_FCTL_TODS
) &&
305 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
)
306 || !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
307 /* Drop IBSS frames and frames for other hosts
312 if (!rx
->local
->apdev
)
315 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
316 ieee80211_msg_sta_not_assoc
);
320 return TXRX_CONTINUE
;
324 static ieee80211_txrx_result
325 ieee80211_rx_h_load_key(struct ieee80211_txrx_data
*rx
)
327 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
330 struct ieee80211_key
*stakey
= NULL
;
335 * There are three types of keys:
337 * - PTK (pairwise keys)
338 * - STK (station-to-station pairwise keys)
340 * When selecting a key, we have to distinguish between multicast
341 * (including broadcast) and unicast frames, the latter can only
342 * use PTKs and STKs while the former always use GTKs. Unless, of
343 * course, actual WEP keys ("pre-RSNA") are used, then unicast
344 * frames can also use key indizes like GTKs. Hence, if we don't
345 * have a PTK/STK we check the key index for a WEP key.
347 * Note that in a regular BSS, multicast frames are sent by the
348 * AP only, associated stations unicast the frame to the AP first
349 * which then multicasts it on their behalf.
351 * There is also a slight problem in IBSS mode: GTKs are negotiated
352 * with each station, that is something we don't currently handle.
353 * The spec seems to expect that one negotiates the same key with
354 * every station but there's no such requirement; VLANs could be
358 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
))
359 return TXRX_CONTINUE
;
362 * No point in finding a key if the frame is neither
363 * addressed to us nor a multicast frame.
365 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
366 return TXRX_CONTINUE
;
369 stakey
= rcu_dereference(rx
->sta
->key
);
371 if (!is_multicast_ether_addr(hdr
->addr1
) && stakey
) {
375 * The device doesn't give us the IV so we won't be
376 * able to look up the key. That's ok though, we
377 * don't need to decrypt the frame, we just won't
378 * be able to keep statistics accurate.
379 * Except for key threshold notifications, should
380 * we somehow allow the driver to tell us which key
381 * the hardware used if this flag is set?
383 if ((rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
) &&
384 (rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
))
385 return TXRX_CONTINUE
;
387 hdrlen
= ieee80211_get_hdrlen(rx
->fc
);
389 if (rx
->skb
->len
< 8 + hdrlen
)
390 return TXRX_DROP
; /* TODO: count this? */
393 * no need to call ieee80211_wep_get_keyidx,
394 * it verifies a bunch of things we've done already
396 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
398 rx
->key
= rcu_dereference(rx
->sdata
->keys
[keyidx
]);
401 * RSNA-protected unicast frames should always be sent with
402 * pairwise or station-to-station keys, but for WEP we allow
403 * using a key index as well.
405 if (rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
&&
406 !is_multicast_ether_addr(hdr
->addr1
))
411 rx
->key
->tx_rx_count
++;
412 /* TODO: add threshold stuff again */
415 return TXRX_CONTINUE
;
418 static void ap_sta_ps_start(struct net_device
*dev
, struct sta_info
*sta
)
420 struct ieee80211_sub_if_data
*sdata
;
421 DECLARE_MAC_BUF(mac
);
423 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
426 atomic_inc(&sdata
->bss
->num_sta_ps
);
427 sta
->flags
|= WLAN_STA_PS
;
429 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
430 printk(KERN_DEBUG
"%s: STA %s aid %d enters power save mode\n",
431 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
432 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
435 static int ap_sta_ps_end(struct net_device
*dev
, struct sta_info
*sta
)
437 struct ieee80211_local
*local
= wdev_priv(dev
->ieee80211_ptr
);
440 struct ieee80211_sub_if_data
*sdata
;
441 struct ieee80211_tx_packet_data
*pkt_data
;
442 DECLARE_MAC_BUF(mac
);
444 sdata
= IEEE80211_DEV_TO_SUB_IF(sta
->dev
);
446 atomic_dec(&sdata
->bss
->num_sta_ps
);
447 sta
->flags
&= ~(WLAN_STA_PS
| WLAN_STA_TIM
);
449 if (!skb_queue_empty(&sta
->ps_tx_buf
)) {
450 if (local
->ops
->set_tim
)
451 local
->ops
->set_tim(local_to_hw(local
), sta
->aid
, 0);
453 bss_tim_clear(local
, sdata
->bss
, sta
->aid
);
455 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
456 printk(KERN_DEBUG
"%s: STA %s aid %d exits power save mode\n",
457 dev
->name
, print_mac(mac
, sta
->addr
), sta
->aid
);
458 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
459 /* Send all buffered frames to the station */
460 while ((skb
= skb_dequeue(&sta
->tx_filtered
)) != NULL
) {
461 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
463 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
466 while ((skb
= skb_dequeue(&sta
->ps_tx_buf
)) != NULL
) {
467 pkt_data
= (struct ieee80211_tx_packet_data
*) skb
->cb
;
468 local
->total_ps_buffered
--;
470 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
471 printk(KERN_DEBUG
"%s: STA %s aid %d send PS frame "
472 "since STA not sleeping anymore\n", dev
->name
,
473 print_mac(mac
, sta
->addr
), sta
->aid
);
474 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
475 pkt_data
->flags
|= IEEE80211_TXPD_REQUEUE
;
482 static ieee80211_txrx_result
483 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data
*rx
)
485 struct sta_info
*sta
= rx
->sta
;
486 struct net_device
*dev
= rx
->dev
;
487 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
490 return TXRX_CONTINUE
;
492 /* Update last_rx only for IBSS packets which are for the current
493 * BSSID to avoid keeping the current IBSS network alive in cases where
494 * other STAs are using different BSSID. */
495 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_IBSS
) {
496 u8
*bssid
= ieee80211_get_bssid(hdr
, rx
->skb
->len
);
497 if (compare_ether_addr(bssid
, rx
->sdata
->u
.sta
.bssid
) == 0)
498 sta
->last_rx
= jiffies
;
500 if (!is_multicast_ether_addr(hdr
->addr1
) ||
501 rx
->sdata
->type
== IEEE80211_IF_TYPE_STA
) {
502 /* Update last_rx only for unicast frames in order to prevent
503 * the Probe Request frames (the only broadcast frames from a
504 * STA in infrastructure mode) from keeping a connection alive.
506 sta
->last_rx
= jiffies
;
509 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
510 return TXRX_CONTINUE
;
513 sta
->rx_bytes
+= rx
->skb
->len
;
514 sta
->last_rssi
= rx
->u
.rx
.status
->ssi
;
515 sta
->last_signal
= rx
->u
.rx
.status
->signal
;
516 sta
->last_noise
= rx
->u
.rx
.status
->noise
;
518 if (!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
)) {
519 /* Change STA power saving mode only in the end of a frame
520 * exchange sequence */
521 if ((sta
->flags
& WLAN_STA_PS
) && !(rx
->fc
& IEEE80211_FCTL_PM
))
522 rx
->u
.rx
.sent_ps_buffered
+= ap_sta_ps_end(dev
, sta
);
523 else if (!(sta
->flags
& WLAN_STA_PS
) &&
524 (rx
->fc
& IEEE80211_FCTL_PM
))
525 ap_sta_ps_start(dev
, sta
);
528 /* Drop data::nullfunc frames silently, since they are used only to
529 * control station power saving mode. */
530 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
531 (rx
->fc
& IEEE80211_FCTL_STYPE
) == IEEE80211_STYPE_NULLFUNC
) {
532 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_nullfunc
);
533 /* Update counter and free packet here to avoid counting this
534 * as a dropped packed. */
536 dev_kfree_skb(rx
->skb
);
540 return TXRX_CONTINUE
;
541 } /* ieee80211_rx_h_sta_process */
543 static ieee80211_txrx_result
544 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data
*rx
)
546 if (!rx
->sta
|| !(rx
->fc
& IEEE80211_FCTL_PROTECTED
) ||
547 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
||
548 !rx
->key
|| rx
->key
->conf
.alg
!= ALG_WEP
||
549 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
550 return TXRX_CONTINUE
;
552 /* Check for weak IVs, if hwaccel did not remove IV from the frame */
553 if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
) ||
554 !(rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
))
555 if (ieee80211_wep_is_weak_iv(rx
->skb
, rx
->key
))
556 rx
->sta
->wep_weak_iv_count
++;
558 return TXRX_CONTINUE
;
561 static ieee80211_txrx_result
562 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data
*rx
)
564 if ((rx
->key
&& rx
->key
->conf
.alg
!= ALG_WEP
) ||
565 !(rx
->fc
& IEEE80211_FCTL_PROTECTED
) ||
566 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
567 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
568 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)))
569 return TXRX_CONTINUE
;
573 printk(KERN_DEBUG
"%s: RX WEP frame, but no key set\n",
578 if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
)) {
579 if (ieee80211_wep_decrypt(rx
->local
, rx
->skb
, rx
->key
)) {
581 printk(KERN_DEBUG
"%s: RX WEP frame, decrypt "
582 "failed\n", rx
->dev
->name
);
585 } else if (!(rx
->u
.rx
.status
->flag
& RX_FLAG_IV_STRIPPED
)) {
586 ieee80211_wep_remove_iv(rx
->local
, rx
->skb
, rx
->key
);
588 skb_trim(rx
->skb
, rx
->skb
->len
- 4);
591 return TXRX_CONTINUE
;
594 static inline struct ieee80211_fragment_entry
*
595 ieee80211_reassemble_add(struct ieee80211_sub_if_data
*sdata
,
596 unsigned int frag
, unsigned int seq
, int rx_queue
,
597 struct sk_buff
**skb
)
599 struct ieee80211_fragment_entry
*entry
;
602 idx
= sdata
->fragment_next
;
603 entry
= &sdata
->fragments
[sdata
->fragment_next
++];
604 if (sdata
->fragment_next
>= IEEE80211_FRAGMENT_MAX
)
605 sdata
->fragment_next
= 0;
607 if (!skb_queue_empty(&entry
->skb_list
)) {
608 #ifdef CONFIG_MAC80211_DEBUG
609 struct ieee80211_hdr
*hdr
=
610 (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
611 DECLARE_MAC_BUF(mac
);
612 DECLARE_MAC_BUF(mac2
);
613 printk(KERN_DEBUG
"%s: RX reassembly removed oldest "
614 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
615 "addr1=%s addr2=%s\n",
616 sdata
->dev
->name
, idx
,
617 jiffies
- entry
->first_frag_time
, entry
->seq
,
618 entry
->last_frag
, print_mac(mac
, hdr
->addr1
),
619 print_mac(mac2
, hdr
->addr2
));
620 #endif /* CONFIG_MAC80211_DEBUG */
621 __skb_queue_purge(&entry
->skb_list
);
624 __skb_queue_tail(&entry
->skb_list
, *skb
); /* no need for locking */
626 entry
->first_frag_time
= jiffies
;
628 entry
->rx_queue
= rx_queue
;
629 entry
->last_frag
= frag
;
631 entry
->extra_len
= 0;
636 static inline struct ieee80211_fragment_entry
*
637 ieee80211_reassemble_find(struct ieee80211_sub_if_data
*sdata
,
638 u16 fc
, unsigned int frag
, unsigned int seq
,
639 int rx_queue
, struct ieee80211_hdr
*hdr
)
641 struct ieee80211_fragment_entry
*entry
;
644 idx
= sdata
->fragment_next
;
645 for (i
= 0; i
< IEEE80211_FRAGMENT_MAX
; i
++) {
646 struct ieee80211_hdr
*f_hdr
;
651 idx
= IEEE80211_FRAGMENT_MAX
- 1;
653 entry
= &sdata
->fragments
[idx
];
654 if (skb_queue_empty(&entry
->skb_list
) || entry
->seq
!= seq
||
655 entry
->rx_queue
!= rx_queue
||
656 entry
->last_frag
+ 1 != frag
)
659 f_hdr
= (struct ieee80211_hdr
*) entry
->skb_list
.next
->data
;
660 f_fc
= le16_to_cpu(f_hdr
->frame_control
);
662 if ((fc
& IEEE80211_FCTL_FTYPE
) != (f_fc
& IEEE80211_FCTL_FTYPE
) ||
663 compare_ether_addr(hdr
->addr1
, f_hdr
->addr1
) != 0 ||
664 compare_ether_addr(hdr
->addr2
, f_hdr
->addr2
) != 0)
667 if (entry
->first_frag_time
+ 2 * HZ
< jiffies
) {
668 __skb_queue_purge(&entry
->skb_list
);
677 static ieee80211_txrx_result
678 ieee80211_rx_h_defragment(struct ieee80211_txrx_data
*rx
)
680 struct ieee80211_hdr
*hdr
;
682 unsigned int frag
, seq
;
683 struct ieee80211_fragment_entry
*entry
;
685 DECLARE_MAC_BUF(mac
);
687 hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
688 sc
= le16_to_cpu(hdr
->seq_ctrl
);
689 frag
= sc
& IEEE80211_SCTL_FRAG
;
691 if (likely((!(rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) && frag
== 0) ||
692 (rx
->skb
)->len
< 24 ||
693 is_multicast_ether_addr(hdr
->addr1
))) {
697 I802_DEBUG_INC(rx
->local
->rx_handlers_fragments
);
699 seq
= (sc
& IEEE80211_SCTL_SEQ
) >> 4;
702 /* This is the first fragment of a new frame. */
703 entry
= ieee80211_reassemble_add(rx
->sdata
, frag
, seq
,
704 rx
->u
.rx
.queue
, &(rx
->skb
));
705 if (rx
->key
&& rx
->key
->conf
.alg
== ALG_CCMP
&&
706 (rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
707 /* Store CCMP PN so that we can verify that the next
708 * fragment has a sequential PN value. */
710 memcpy(entry
->last_pn
,
711 rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
],
717 /* This is a fragment for a frame that should already be pending in
718 * fragment cache. Add this fragment to the end of the pending entry.
720 entry
= ieee80211_reassemble_find(rx
->sdata
, rx
->fc
, frag
, seq
,
721 rx
->u
.rx
.queue
, hdr
);
723 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
727 /* Verify that MPDUs within one MSDU have sequential PN values.
728 * (IEEE 802.11i, 8.3.3.4.5) */
731 u8 pn
[CCMP_PN_LEN
], *rpn
;
732 if (!rx
->key
|| rx
->key
->conf
.alg
!= ALG_CCMP
)
734 memcpy(pn
, entry
->last_pn
, CCMP_PN_LEN
);
735 for (i
= CCMP_PN_LEN
- 1; i
>= 0; i
--) {
740 rpn
= rx
->key
->u
.ccmp
.rx_pn
[rx
->u
.rx
.queue
];
741 if (memcmp(pn
, rpn
, CCMP_PN_LEN
) != 0) {
743 printk(KERN_DEBUG
"%s: defrag: CCMP PN not "
745 " PN=%02x%02x%02x%02x%02x%02x "
746 "(expected %02x%02x%02x%02x%02x%02x)\n",
747 rx
->dev
->name
, print_mac(mac
, hdr
->addr2
),
748 rpn
[0], rpn
[1], rpn
[2], rpn
[3], rpn
[4],
749 rpn
[5], pn
[0], pn
[1], pn
[2], pn
[3],
753 memcpy(entry
->last_pn
, pn
, CCMP_PN_LEN
);
756 skb_pull(rx
->skb
, ieee80211_get_hdrlen(rx
->fc
));
757 __skb_queue_tail(&entry
->skb_list
, rx
->skb
);
758 entry
->last_frag
= frag
;
759 entry
->extra_len
+= rx
->skb
->len
;
760 if (rx
->fc
& IEEE80211_FCTL_MOREFRAGS
) {
765 rx
->skb
= __skb_dequeue(&entry
->skb_list
);
766 if (skb_tailroom(rx
->skb
) < entry
->extra_len
) {
767 I802_DEBUG_INC(rx
->local
->rx_expand_skb_head2
);
768 if (unlikely(pskb_expand_head(rx
->skb
, 0, entry
->extra_len
,
770 I802_DEBUG_INC(rx
->local
->rx_handlers_drop_defrag
);
771 __skb_queue_purge(&entry
->skb_list
);
775 while ((skb
= __skb_dequeue(&entry
->skb_list
))) {
776 memcpy(skb_put(rx
->skb
, skb
->len
), skb
->data
, skb
->len
);
780 /* Complete frame has been reassembled - process it now */
781 rx
->flags
|= IEEE80211_TXRXD_FRAGMENTED
;
785 rx
->sta
->rx_packets
++;
786 if (is_multicast_ether_addr(hdr
->addr1
))
787 rx
->local
->dot11MulticastReceivedFrameCount
++;
789 ieee80211_led_rx(rx
->local
);
790 return TXRX_CONTINUE
;
793 static ieee80211_txrx_result
794 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data
*rx
)
798 DECLARE_MAC_BUF(mac
);
800 if (likely(!rx
->sta
||
801 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_CTL
||
802 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_PSPOLL
||
803 !(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)))
804 return TXRX_CONTINUE
;
806 skb
= skb_dequeue(&rx
->sta
->tx_filtered
);
808 skb
= skb_dequeue(&rx
->sta
->ps_tx_buf
);
810 rx
->local
->total_ps_buffered
--;
812 no_pending_pkts
= skb_queue_empty(&rx
->sta
->tx_filtered
) &&
813 skb_queue_empty(&rx
->sta
->ps_tx_buf
);
816 struct ieee80211_hdr
*hdr
=
817 (struct ieee80211_hdr
*) skb
->data
;
819 /* tell TX path to send one frame even though the STA may
820 * still remain is PS mode after this frame exchange */
823 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
824 printk(KERN_DEBUG
"STA %s aid %d: PS Poll (entries after %d)\n",
825 print_mac(mac
, rx
->sta
->addr
), rx
->sta
->aid
,
826 skb_queue_len(&rx
->sta
->ps_tx_buf
));
827 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
829 /* Use MoreData flag to indicate whether there are more
830 * buffered frames for this STA */
831 if (no_pending_pkts
) {
832 hdr
->frame_control
&= cpu_to_le16(~IEEE80211_FCTL_MOREDATA
);
833 rx
->sta
->flags
&= ~WLAN_STA_TIM
;
835 hdr
->frame_control
|= cpu_to_le16(IEEE80211_FCTL_MOREDATA
);
839 if (no_pending_pkts
) {
840 if (rx
->local
->ops
->set_tim
)
841 rx
->local
->ops
->set_tim(local_to_hw(rx
->local
),
844 bss_tim_clear(rx
->local
, rx
->sdata
->bss
, rx
->sta
->aid
);
846 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
847 } else if (!rx
->u
.rx
.sent_ps_buffered
) {
848 printk(KERN_DEBUG
"%s: STA %s sent PS Poll even "
849 "though there is no buffered frames for it\n",
850 rx
->dev
->name
, print_mac(mac
, rx
->sta
->addr
));
851 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
855 /* Free PS Poll skb here instead of returning TXRX_DROP that would
856 * count as an dropped frame. */
857 dev_kfree_skb(rx
->skb
);
862 static ieee80211_txrx_result
863 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data
*rx
)
866 u8
*data
= rx
->skb
->data
;
867 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) data
;
869 if (!WLAN_FC_IS_QOS_DATA(fc
))
870 return TXRX_CONTINUE
;
872 /* remove the qos control field, update frame type and meta-data */
873 memmove(data
+ 2, data
, ieee80211_get_hdrlen(fc
) - 2);
874 hdr
= (struct ieee80211_hdr
*) skb_pull(rx
->skb
, 2);
875 /* change frame type to non QOS */
876 rx
->fc
= fc
&= ~IEEE80211_STYPE_QOS_DATA
;
877 hdr
->frame_control
= cpu_to_le16(fc
);
879 return TXRX_CONTINUE
;
882 static ieee80211_txrx_result
883 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data
*rx
)
885 if (rx
->sdata
->eapol
&& ieee80211_is_eapol(rx
->skb
) &&
886 rx
->sdata
->type
!= IEEE80211_IF_TYPE_STA
&&
887 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
888 /* Pass both encrypted and unencrypted EAPOL frames to user
889 * space for processing. */
890 if (!rx
->local
->apdev
)
892 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
893 ieee80211_msg_normal
);
897 if (unlikely(rx
->sdata
->ieee802_1x
&&
898 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
899 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
900 (!rx
->sta
|| !(rx
->sta
->flags
& WLAN_STA_AUTHORIZED
)) &&
901 !ieee80211_is_eapol(rx
->skb
))) {
902 #ifdef CONFIG_MAC80211_DEBUG
903 struct ieee80211_hdr
*hdr
=
904 (struct ieee80211_hdr
*) rx
->skb
->data
;
905 DECLARE_MAC_BUF(mac
);
906 printk(KERN_DEBUG
"%s: dropped frame from %s"
907 " (unauthorized port)\n", rx
->dev
->name
,
908 print_mac(mac
, hdr
->addr2
));
909 #endif /* CONFIG_MAC80211_DEBUG */
913 return TXRX_CONTINUE
;
916 static ieee80211_txrx_result
917 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data
*rx
)
920 * Pass through unencrypted frames if the hardware has
921 * decrypted them already.
923 if (rx
->u
.rx
.status
->flag
& RX_FLAG_DECRYPTED
)
924 return TXRX_CONTINUE
;
926 /* Drop unencrypted frames if key is set. */
927 if (unlikely(!(rx
->fc
& IEEE80211_FCTL_PROTECTED
) &&
928 (rx
->fc
& IEEE80211_FCTL_FTYPE
) == IEEE80211_FTYPE_DATA
&&
929 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_NULLFUNC
&&
930 (rx
->key
|| rx
->sdata
->drop_unencrypted
) &&
931 (rx
->sdata
->eapol
== 0 ||
932 !ieee80211_is_eapol(rx
->skb
)))) {
934 printk(KERN_DEBUG
"%s: RX non-WEP frame, but expected "
935 "encryption\n", rx
->dev
->name
);
938 return TXRX_CONTINUE
;
941 static ieee80211_txrx_result
942 ieee80211_rx_h_data(struct ieee80211_txrx_data
*rx
)
944 struct net_device
*dev
= rx
->dev
;
945 struct ieee80211_local
*local
= rx
->local
;
946 struct ieee80211_hdr
*hdr
= (struct ieee80211_hdr
*) rx
->skb
->data
;
947 u16 fc
, hdrlen
, ethertype
;
951 struct sk_buff
*skb
= rx
->skb
, *skb2
;
952 struct ieee80211_sub_if_data
*sdata
= IEEE80211_DEV_TO_SUB_IF(dev
);
953 DECLARE_MAC_BUF(mac
);
954 DECLARE_MAC_BUF(mac2
);
955 DECLARE_MAC_BUF(mac3
);
956 DECLARE_MAC_BUF(mac4
);
959 if (unlikely((fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
))
960 return TXRX_CONTINUE
;
962 if (unlikely(!WLAN_FC_DATA_PRESENT(fc
)))
965 hdrlen
= ieee80211_get_hdrlen(fc
);
967 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
969 * IEEE 802.11 address fields:
970 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
971 * 0 0 DA SA BSSID n/a
972 * 0 1 DA BSSID SA n/a
973 * 1 0 BSSID SA DA n/a
977 switch (fc
& (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
)) {
978 case IEEE80211_FCTL_TODS
:
980 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
981 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
983 if (unlikely(sdata
->type
!= IEEE80211_IF_TYPE_AP
&&
984 sdata
->type
!= IEEE80211_IF_TYPE_VLAN
)) {
986 printk(KERN_DEBUG
"%s: dropped ToDS frame "
987 "(BSSID=%s SA=%s DA=%s)\n",
989 print_mac(mac
, hdr
->addr1
),
990 print_mac(mac2
, hdr
->addr2
),
991 print_mac(mac3
, hdr
->addr3
));
995 case (IEEE80211_FCTL_TODS
| IEEE80211_FCTL_FROMDS
):
997 memcpy(dst
, hdr
->addr3
, ETH_ALEN
);
998 memcpy(src
, hdr
->addr4
, ETH_ALEN
);
1000 if (unlikely(sdata
->type
!= IEEE80211_IF_TYPE_WDS
)) {
1001 if (net_ratelimit())
1002 printk(KERN_DEBUG
"%s: dropped FromDS&ToDS "
1003 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1005 print_mac(mac
, hdr
->addr1
),
1006 print_mac(mac2
, hdr
->addr2
),
1007 print_mac(mac3
, hdr
->addr3
),
1008 print_mac(mac4
, hdr
->addr4
));
1012 case IEEE80211_FCTL_FROMDS
:
1014 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1015 memcpy(src
, hdr
->addr3
, ETH_ALEN
);
1017 if (sdata
->type
!= IEEE80211_IF_TYPE_STA
||
1018 (is_multicast_ether_addr(dst
) &&
1019 !compare_ether_addr(src
, dev
->dev_addr
)))
1024 memcpy(dst
, hdr
->addr1
, ETH_ALEN
);
1025 memcpy(src
, hdr
->addr2
, ETH_ALEN
);
1027 if (sdata
->type
!= IEEE80211_IF_TYPE_IBSS
) {
1028 if (net_ratelimit()) {
1029 printk(KERN_DEBUG
"%s: dropped IBSS frame "
1030 "(DA=%s SA=%s BSSID=%s)\n",
1032 print_mac(mac
, hdr
->addr1
),
1033 print_mac(mac2
, hdr
->addr2
),
1034 print_mac(mac3
, hdr
->addr3
));
1041 payload
= skb
->data
+ hdrlen
;
1043 if (unlikely(skb
->len
- hdrlen
< 8)) {
1044 if (net_ratelimit()) {
1045 printk(KERN_DEBUG
"%s: RX too short data frame "
1046 "payload\n", dev
->name
);
1051 ethertype
= (payload
[6] << 8) | payload
[7];
1053 if (likely((compare_ether_addr(payload
, rfc1042_header
) == 0 &&
1054 ethertype
!= ETH_P_AARP
&& ethertype
!= ETH_P_IPX
) ||
1055 compare_ether_addr(payload
, bridge_tunnel_header
) == 0)) {
1056 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1057 * replace EtherType */
1058 skb_pull(skb
, hdrlen
+ 6);
1059 memcpy(skb_push(skb
, ETH_ALEN
), src
, ETH_ALEN
);
1060 memcpy(skb_push(skb
, ETH_ALEN
), dst
, ETH_ALEN
);
1062 struct ethhdr
*ehdr
;
1064 skb_pull(skb
, hdrlen
);
1065 len
= htons(skb
->len
);
1066 ehdr
= (struct ethhdr
*) skb_push(skb
, sizeof(struct ethhdr
));
1067 memcpy(ehdr
->h_dest
, dst
, ETH_ALEN
);
1068 memcpy(ehdr
->h_source
, src
, ETH_ALEN
);
1069 ehdr
->h_proto
= len
;
1075 dev
->stats
.rx_packets
++;
1076 dev
->stats
.rx_bytes
+= skb
->len
;
1078 if (local
->bridge_packets
&& (sdata
->type
== IEEE80211_IF_TYPE_AP
1079 || sdata
->type
== IEEE80211_IF_TYPE_VLAN
) &&
1080 (rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
)) {
1081 if (is_multicast_ether_addr(skb
->data
)) {
1082 /* send multicast frames both to higher layers in
1083 * local net stack and back to the wireless media */
1084 skb2
= skb_copy(skb
, GFP_ATOMIC
);
1085 if (!skb2
&& net_ratelimit())
1086 printk(KERN_DEBUG
"%s: failed to clone "
1087 "multicast frame\n", dev
->name
);
1089 struct sta_info
*dsta
;
1090 dsta
= sta_info_get(local
, skb
->data
);
1091 if (dsta
&& !dsta
->dev
) {
1092 if (net_ratelimit())
1093 printk(KERN_DEBUG
"Station with null "
1094 "dev structure!\n");
1095 } else if (dsta
&& dsta
->dev
== dev
) {
1096 /* Destination station is associated to this
1097 * AP, so send the frame directly to it and
1098 * do not pass the frame to local net stack.
1109 /* deliver to local stack */
1110 skb
->protocol
= eth_type_trans(skb
, dev
);
1111 memset(skb
->cb
, 0, sizeof(skb
->cb
));
1116 /* send to wireless media */
1117 skb2
->protocol
= __constant_htons(ETH_P_802_3
);
1118 skb_set_network_header(skb2
, 0);
1119 skb_set_mac_header(skb2
, 0);
1120 dev_queue_xmit(skb2
);
1126 static ieee80211_txrx_result
1127 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data
*rx
)
1129 struct ieee80211_sub_if_data
*sdata
;
1131 if (!(rx
->flags
& IEEE80211_TXRXD_RXRA_MATCH
))
1134 sdata
= IEEE80211_DEV_TO_SUB_IF(rx
->dev
);
1135 if ((sdata
->type
== IEEE80211_IF_TYPE_STA
||
1136 sdata
->type
== IEEE80211_IF_TYPE_IBSS
) &&
1137 !rx
->local
->user_space_mlme
) {
1138 ieee80211_sta_rx_mgmt(rx
->dev
, rx
->skb
, rx
->u
.rx
.status
);
1140 /* Management frames are sent to hostapd for processing */
1141 if (!rx
->local
->apdev
)
1143 ieee80211_rx_mgmt(rx
->local
, rx
->skb
, rx
->u
.rx
.status
,
1144 ieee80211_msg_normal
);
1149 static inline ieee80211_txrx_result
__ieee80211_invoke_rx_handlers(
1150 struct ieee80211_local
*local
,
1151 ieee80211_rx_handler
*handlers
,
1152 struct ieee80211_txrx_data
*rx
,
1153 struct sta_info
*sta
)
1155 ieee80211_rx_handler
*handler
;
1156 ieee80211_txrx_result res
= TXRX_DROP
;
1158 for (handler
= handlers
; *handler
!= NULL
; handler
++) {
1159 res
= (*handler
)(rx
);
1165 I802_DEBUG_INC(local
->rx_handlers_drop
);
1170 I802_DEBUG_INC(local
->rx_handlers_queued
);
1176 if (res
== TXRX_DROP
)
1177 dev_kfree_skb(rx
->skb
);
1181 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local
*local
,
1182 ieee80211_rx_handler
*handlers
,
1183 struct ieee80211_txrx_data
*rx
,
1184 struct sta_info
*sta
)
1186 if (__ieee80211_invoke_rx_handlers(local
, handlers
, rx
, sta
) ==
1188 dev_kfree_skb(rx
->skb
);
1191 static void ieee80211_rx_michael_mic_report(struct net_device
*dev
,
1192 struct ieee80211_hdr
*hdr
,
1193 struct sta_info
*sta
,
1194 struct ieee80211_txrx_data
*rx
)
1197 DECLARE_MAC_BUF(mac
);
1198 DECLARE_MAC_BUF(mac2
);
1200 hdrlen
= ieee80211_get_hdrlen_from_skb(rx
->skb
);
1201 if (rx
->skb
->len
>= hdrlen
+ 4)
1202 keyidx
= rx
->skb
->data
[hdrlen
+ 3] >> 6;
1206 if (net_ratelimit())
1207 printk(KERN_DEBUG
"%s: TKIP hwaccel reported Michael MIC "
1208 "failure from %s to %s keyidx=%d\n",
1209 dev
->name
, print_mac(mac
, hdr
->addr2
),
1210 print_mac(mac2
, hdr
->addr1
), keyidx
);
1214 * Some hardware seem to generate incorrect Michael MIC
1215 * reports; ignore them to avoid triggering countermeasures.
1217 if (net_ratelimit())
1218 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1219 "error for unknown address %s\n",
1220 dev
->name
, print_mac(mac
, hdr
->addr2
));
1224 if (!(rx
->fc
& IEEE80211_FCTL_PROTECTED
)) {
1225 if (net_ratelimit())
1226 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1227 "error for a frame with no PROTECTED flag (src "
1228 "%s)\n", dev
->name
, print_mac(mac
, hdr
->addr2
));
1232 if (rx
->sdata
->type
== IEEE80211_IF_TYPE_AP
&& keyidx
) {
1234 * APs with pairwise keys should never receive Michael MIC
1235 * errors for non-zero keyidx because these are reserved for
1236 * group keys and only the AP is sending real multicast
1237 * frames in the BSS.
1239 if (net_ratelimit())
1240 printk(KERN_DEBUG
"%s: ignored Michael MIC error for "
1241 "a frame with non-zero keyidx (%d)"
1242 " (src %s)\n", dev
->name
, keyidx
,
1243 print_mac(mac
, hdr
->addr2
));
1247 if ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
&&
1248 ((rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_MGMT
||
1249 (rx
->fc
& IEEE80211_FCTL_STYPE
) != IEEE80211_STYPE_AUTH
)) {
1250 if (net_ratelimit())
1251 printk(KERN_DEBUG
"%s: ignored spurious Michael MIC "
1252 "error for a frame that cannot be encrypted "
1253 "(fc=0x%04x) (src %s)\n",
1254 dev
->name
, rx
->fc
, print_mac(mac
, hdr
->addr2
));
1258 mac80211_ev_michael_mic_failure(rx
->dev
, keyidx
, hdr
);
1260 dev_kfree_skb(rx
->skb
);
1264 ieee80211_rx_handler ieee80211_rx_handlers
[] =
1266 ieee80211_rx_h_if_stats
,
1267 ieee80211_rx_h_monitor
,
1268 ieee80211_rx_h_passive_scan
,
1269 ieee80211_rx_h_check
,
1270 ieee80211_rx_h_load_key
,
1271 ieee80211_rx_h_sta_process
,
1272 ieee80211_rx_h_ccmp_decrypt
,
1273 ieee80211_rx_h_tkip_decrypt
,
1274 ieee80211_rx_h_wep_weak_iv_detection
,
1275 ieee80211_rx_h_wep_decrypt
,
1276 ieee80211_rx_h_defragment
,
1277 ieee80211_rx_h_ps_poll
,
1278 ieee80211_rx_h_michael_mic_verify
,
1279 /* this must be after decryption - so header is counted in MPDU mic
1280 * must be before pae and data, so QOS_DATA format frames
1281 * are not passed to user space by these functions
1283 ieee80211_rx_h_remove_qos_control
,
1284 ieee80211_rx_h_802_1x_pae
,
1285 ieee80211_rx_h_drop_unencrypted
,
1286 ieee80211_rx_h_data
,
1287 ieee80211_rx_h_mgmt
,
1291 /* main receive path */
1293 static int prepare_for_handlers(struct ieee80211_sub_if_data
*sdata
,
1294 u8
*bssid
, struct ieee80211_txrx_data
*rx
,
1295 struct ieee80211_hdr
*hdr
)
1297 int multicast
= is_multicast_ether_addr(hdr
->addr1
);
1299 switch (sdata
->type
) {
1300 case IEEE80211_IF_TYPE_STA
:
1303 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1304 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1306 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1307 } else if (!multicast
&&
1308 compare_ether_addr(sdata
->dev
->dev_addr
,
1310 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1312 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1315 case IEEE80211_IF_TYPE_IBSS
:
1318 if (!ieee80211_bssid_match(bssid
, sdata
->u
.sta
.bssid
)) {
1319 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1321 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1322 } else if (!multicast
&&
1323 compare_ether_addr(sdata
->dev
->dev_addr
,
1325 if (!(sdata
->dev
->flags
& IFF_PROMISC
))
1327 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1328 } else if (!rx
->sta
)
1329 rx
->sta
= ieee80211_ibss_add_sta(sdata
->dev
, rx
->skb
,
1332 case IEEE80211_IF_TYPE_AP
:
1334 if (compare_ether_addr(sdata
->dev
->dev_addr
,
1337 } else if (!ieee80211_bssid_match(bssid
,
1338 sdata
->dev
->dev_addr
)) {
1339 if (!(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1341 rx
->flags
&= ~IEEE80211_TXRXD_RXRA_MATCH
;
1343 if (sdata
->dev
== sdata
->local
->mdev
&&
1344 !(rx
->flags
& IEEE80211_TXRXD_RXIN_SCAN
))
1345 /* do not receive anything via
1346 * master device when not scanning */
1349 case IEEE80211_IF_TYPE_WDS
:
1351 (rx
->fc
& IEEE80211_FCTL_FTYPE
) != IEEE80211_FTYPE_DATA
)
1353 if (compare_ether_addr(sdata
->u
.wds
.remote_addr
, hdr
->addr2
))
1362 * This is the receive path handler. It is called by a low level driver when an
1363 * 802.11 MPDU is received from the hardware.
1365 void __ieee80211_rx(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1366 struct ieee80211_rx_status
*status
)
1368 struct ieee80211_local
*local
= hw_to_local(hw
);
1369 struct ieee80211_sub_if_data
*sdata
;
1370 struct sta_info
*sta
;
1371 struct ieee80211_hdr
*hdr
;
1372 struct ieee80211_txrx_data rx
;
1374 int radiotap_len
= 0, prepres
;
1375 struct ieee80211_sub_if_data
*prev
= NULL
;
1376 struct sk_buff
*skb_new
;
1380 if (status
->flag
& RX_FLAG_RADIOTAP
) {
1381 radiotap_len
= ieee80211_get_radiotap_len(skb
->data
);
1382 skb_pull(skb
, radiotap_len
);
1386 * key references and virtual interfaces are protected using RCU
1387 * and this requires that we are in a read-side RCU section during
1388 * receive processing
1392 hdr
= (struct ieee80211_hdr
*) skb
->data
;
1393 memset(&rx
, 0, sizeof(rx
));
1397 rx
.u
.rx
.status
= status
;
1398 rx
.fc
= skb
->len
>= 2 ? le16_to_cpu(hdr
->frame_control
) : 0;
1399 type
= rx
.fc
& IEEE80211_FCTL_FTYPE
;
1401 bogon
= status
->flag
& (RX_FLAG_FAILED_FCS_CRC
|
1402 RX_FLAG_FAILED_PLCP_CRC
);
1404 if (!bogon
&& (type
== IEEE80211_FTYPE_DATA
||
1405 type
== IEEE80211_FTYPE_MGMT
))
1406 local
->dot11ReceivedFragmentCount
++;
1408 if (!bogon
&& skb
->len
>= 16) {
1409 sta
= rx
.sta
= sta_info_get(local
, hdr
->addr2
);
1411 rx
.dev
= rx
.sta
->dev
;
1412 rx
.sdata
= IEEE80211_DEV_TO_SUB_IF(rx
.dev
);
1415 sta
= rx
.sta
= NULL
;
1417 if ((status
->flag
& RX_FLAG_MMIC_ERROR
)) {
1418 ieee80211_rx_michael_mic_report(local
->mdev
, hdr
, sta
, &rx
);
1422 if (unlikely(local
->sta_scanning
))
1423 rx
.flags
|= IEEE80211_TXRXD_RXIN_SCAN
;
1425 if (__ieee80211_invoke_rx_handlers(local
, local
->rx_pre_handlers
, &rx
,
1426 sta
) != TXRX_CONTINUE
)
1430 skb_push(skb
, radiotap_len
);
1431 if (sta
&& !(sta
->flags
& (WLAN_STA_WDS
| WLAN_STA_ASSOC_AP
)) &&
1432 !local
->iff_promiscs
&& !is_multicast_ether_addr(hdr
->addr1
)) {
1433 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1434 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
, &rx
,
1441 bssid
= ieee80211_get_bssid(hdr
, skb
->len
- radiotap_len
);
1443 list_for_each_entry_rcu(sdata
, &local
->interfaces
, list
) {
1444 rx
.flags
|= IEEE80211_TXRXD_RXRA_MATCH
;
1446 if (!netif_running(sdata
->dev
))
1449 prepres
= prepare_for_handlers(sdata
, bssid
, &rx
, hdr
);
1450 /* prepare_for_handlers can change sta */
1457 * frame is destined for this interface, but if it's not
1458 * also for the previous one we handle that after the
1459 * loop to avoid copying the SKB once too much
1468 * frame was destined for the previous interface
1469 * so invoke RX handlers for it
1472 skb_new
= skb_copy(skb
, GFP_ATOMIC
);
1474 if (net_ratelimit())
1475 printk(KERN_DEBUG
"%s: failed to copy "
1476 "multicast frame for %s",
1477 wiphy_name(local
->hw
.wiphy
),
1484 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
,
1492 ieee80211_invoke_rx_handlers(local
, local
->rx_handlers
,
1503 EXPORT_SYMBOL(__ieee80211_rx
);
1505 /* This is a version of the rx handler that can be called from hard irq
1506 * context. Post the skb on the queue and schedule the tasklet */
1507 void ieee80211_rx_irqsafe(struct ieee80211_hw
*hw
, struct sk_buff
*skb
,
1508 struct ieee80211_rx_status
*status
)
1510 struct ieee80211_local
*local
= hw_to_local(hw
);
1512 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status
) > sizeof(skb
->cb
));
1514 skb
->dev
= local
->mdev
;
1515 /* copy status into skb->cb for use by tasklet */
1516 memcpy(skb
->cb
, status
, sizeof(*status
));
1517 skb
->pkt_type
= IEEE80211_RX_MSG
;
1518 skb_queue_tail(&local
->skb_queue
, skb
);
1519 tasklet_schedule(&local
->tasklet
);
1521 EXPORT_SYMBOL(ieee80211_rx_irqsafe
);