2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
13 #include <linux/jiffies.h>
14 #include <linux/slab.h>
15 #include <linux/kernel.h>
16 #include <linux/skbuff.h>
17 #include <linux/netdevice.h>
18 #include <linux/etherdevice.h>
19 #include <linux/rcupdate.h>
20 #include <linux/export.h>
21 #include <net/mac80211.h>
22 #include <net/ieee80211_radiotap.h>
23 #include <asm/unaligned.h>
25 #include "ieee80211_i.h"
26 #include "driver-ops.h"
36 * monitor mode reception
38 * This function cleans up the SKB, i.e. it removes all the stuff
39 * only useful for monitoring.
41 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
43 unsigned int rtap_vendor_space)
45 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
46 if (likely(skb->len > FCS_LEN))
47 __pskb_trim(skb, skb->len - FCS_LEN);
56 __pskb_pull(skb, rtap_vendor_space);
61 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
62 unsigned int rtap_vendor_space)
64 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
65 struct ieee80211_hdr *hdr;
67 hdr = (void *)(skb->data + rtap_vendor_space);
69 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
70 RX_FLAG_FAILED_PLCP_CRC |
71 RX_FLAG_AMPDU_IS_ZEROLEN))
74 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
77 if (ieee80211_is_ctl(hdr->frame_control) &&
78 !ieee80211_is_pspoll(hdr->frame_control) &&
79 !ieee80211_is_back_req(hdr->frame_control))
86 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
87 struct ieee80211_rx_status *status,
92 /* always present fields */
93 len = sizeof(struct ieee80211_radiotap_header) + 8;
95 /* allocate extra bitmaps */
97 len += 4 * hweight8(status->chains);
99 if (ieee80211_have_rx_timestamp(status)) {
103 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
106 /* antenna field, if we don't have per-chain info */
110 /* padding for RX_FLAGS if necessary */
113 if (status->flag & RX_FLAG_HT) /* HT info */
116 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
121 if (status->flag & RX_FLAG_VHT) {
126 if (status->chains) {
127 /* antenna and antenna signal fields */
128 len += 2 * hweight8(status->chains);
131 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
132 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
134 /* vendor presence bitmap */
136 /* alignment for fixed 6-byte vendor data header */
138 /* vendor data header */
140 if (WARN_ON(rtap->align == 0))
142 len = ALIGN(len, rtap->align);
143 len += rtap->len + rtap->pad;
150 * ieee80211_add_rx_radiotap_header - add radiotap header
152 * add a radiotap header containing all the fields which the hardware provided.
155 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
157 struct ieee80211_rate *rate,
158 int rtap_len, bool has_fcs)
160 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
161 struct ieee80211_radiotap_header *rthdr;
166 u16 channel_flags = 0;
168 unsigned long chains = status->chains;
169 struct ieee80211_vendor_radiotap rtap = {};
171 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
172 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
173 /* rtap.len and rtap.pad are undone immediately */
174 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
178 if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
181 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
182 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
183 it_present = &rthdr->it_present;
185 /* radiotap header, set always present flags */
186 rthdr->it_len = cpu_to_le16(rtap_len);
187 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
188 BIT(IEEE80211_RADIOTAP_CHANNEL) |
189 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
192 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
194 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
196 BIT(IEEE80211_RADIOTAP_EXT) |
197 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
198 put_unaligned_le32(it_present_val, it_present);
200 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
201 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
204 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
205 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
206 BIT(IEEE80211_RADIOTAP_EXT);
207 put_unaligned_le32(it_present_val, it_present);
209 it_present_val = rtap.present;
212 put_unaligned_le32(it_present_val, it_present);
214 pos = (void *)(it_present + 1);
216 /* the order of the following fields is important */
218 /* IEEE80211_RADIOTAP_TSFT */
219 if (ieee80211_have_rx_timestamp(status)) {
221 while ((pos - (u8 *)rthdr) & 7)
224 ieee80211_calculate_rx_timestamp(local, status,
227 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
231 /* IEEE80211_RADIOTAP_FLAGS */
232 if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
233 *pos |= IEEE80211_RADIOTAP_F_FCS;
234 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
235 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
236 if (status->flag & RX_FLAG_SHORTPRE)
237 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
240 /* IEEE80211_RADIOTAP_RATE */
241 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
243 * Without rate information don't add it. If we have,
244 * MCS information is a separate field in radiotap,
245 * added below. The byte here is needed as padding
246 * for the channel though, so initialise it to 0.
251 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
252 if (status->flag & RX_FLAG_10MHZ)
254 else if (status->flag & RX_FLAG_5MHZ)
256 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
260 /* IEEE80211_RADIOTAP_CHANNEL */
261 put_unaligned_le16(status->freq, pos);
263 if (status->flag & RX_FLAG_10MHZ)
264 channel_flags |= IEEE80211_CHAN_HALF;
265 else if (status->flag & RX_FLAG_5MHZ)
266 channel_flags |= IEEE80211_CHAN_QUARTER;
268 if (status->band == IEEE80211_BAND_5GHZ)
269 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
270 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
271 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
272 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
273 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
275 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
277 channel_flags |= IEEE80211_CHAN_2GHZ;
278 put_unaligned_le16(channel_flags, pos);
281 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
282 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
283 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
284 *pos = status->signal;
286 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
290 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
292 if (!status->chains) {
293 /* IEEE80211_RADIOTAP_ANTENNA */
294 *pos = status->antenna;
298 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
300 /* IEEE80211_RADIOTAP_RX_FLAGS */
301 /* ensure 2 byte alignment for the 2 byte field as required */
302 if ((pos - (u8 *)rthdr) & 1)
304 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
305 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
306 put_unaligned_le16(rx_flags, pos);
309 if (status->flag & RX_FLAG_HT) {
312 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
313 *pos++ = local->hw.radiotap_mcs_details;
315 if (status->flag & RX_FLAG_SHORT_GI)
316 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
317 if (status->flag & RX_FLAG_40MHZ)
318 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
319 if (status->flag & RX_FLAG_HT_GF)
320 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
321 if (status->flag & RX_FLAG_LDPC)
322 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
323 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
324 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
326 *pos++ = status->rate_idx;
329 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
332 /* ensure 4 byte alignment */
333 while ((pos - (u8 *)rthdr) & 3)
336 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
337 put_unaligned_le32(status->ampdu_reference, pos);
339 if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
340 flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
341 if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
342 flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
343 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
344 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
345 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
346 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
347 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
348 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
349 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
350 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
351 put_unaligned_le16(flags, pos);
353 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
354 *pos++ = status->ampdu_delimiter_crc;
360 if (status->flag & RX_FLAG_VHT) {
361 u16 known = local->hw.radiotap_vht_details;
363 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
364 put_unaligned_le16(known, pos);
367 if (status->flag & RX_FLAG_SHORT_GI)
368 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
369 /* in VHT, STBC is binary */
370 if (status->flag & RX_FLAG_STBC_MASK)
371 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
372 if (status->vht_flag & RX_VHT_FLAG_BF)
373 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
376 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
378 else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
380 else if (status->flag & RX_FLAG_40MHZ)
385 *pos = (status->rate_idx << 4) | status->vht_nss;
388 if (status->flag & RX_FLAG_LDPC)
389 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
397 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
398 *pos++ = status->chain_signal[chain];
402 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
403 /* ensure 2 byte alignment for the vendor field as required */
404 if ((pos - (u8 *)rthdr) & 1)
406 *pos++ = rtap.oui[0];
407 *pos++ = rtap.oui[1];
408 *pos++ = rtap.oui[2];
410 put_unaligned_le16(rtap.len, pos);
412 /* align the actual payload as requested */
413 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
415 /* data (and possible padding) already follows */
420 * This function copies a received frame to all monitor interfaces and
421 * returns a cleaned-up SKB that no longer includes the FCS nor the
422 * radiotap header the driver might have added.
424 static struct sk_buff *
425 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
426 struct ieee80211_rate *rate)
428 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
429 struct ieee80211_sub_if_data *sdata;
430 int rt_hdrlen, needed_headroom;
431 struct sk_buff *skb, *skb2;
432 struct net_device *prev_dev = NULL;
433 int present_fcs_len = 0;
434 unsigned int rtap_vendor_space = 0;
436 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
437 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
439 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
443 * First, we may need to make a copy of the skb because
444 * (1) we need to modify it for radiotap (if not present), and
445 * (2) the other RX handlers will modify the skb we got.
447 * We don't need to, of course, if we aren't going to return
448 * the SKB because it has a bad FCS/PLCP checksum.
451 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
452 present_fcs_len = FCS_LEN;
454 /* ensure hdr->frame_control and vendor radiotap data are in skb head */
455 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
456 dev_kfree_skb(origskb);
460 if (!local->monitors) {
461 if (should_drop_frame(origskb, present_fcs_len,
462 rtap_vendor_space)) {
463 dev_kfree_skb(origskb);
467 return remove_monitor_info(local, origskb, rtap_vendor_space);
470 /* room for the radiotap header based on driver features */
471 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
472 needed_headroom = rt_hdrlen - rtap_vendor_space;
474 if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
475 /* only need to expand headroom if necessary */
480 * This shouldn't trigger often because most devices have an
481 * RX header they pull before we get here, and that should
482 * be big enough for our radiotap information. We should
483 * probably export the length to drivers so that we can have
484 * them allocate enough headroom to start with.
486 if (skb_headroom(skb) < needed_headroom &&
487 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
493 * Need to make a copy and possibly remove radiotap header
494 * and FCS from the original.
496 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
498 origskb = remove_monitor_info(local, origskb,
505 /* prepend radiotap information */
506 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
508 skb_reset_mac_header(skb);
509 skb->ip_summed = CHECKSUM_UNNECESSARY;
510 skb->pkt_type = PACKET_OTHERHOST;
511 skb->protocol = htons(ETH_P_802_2);
513 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
514 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
517 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
520 if (!ieee80211_sdata_running(sdata))
524 skb2 = skb_clone(skb, GFP_ATOMIC);
526 skb2->dev = prev_dev;
527 netif_receive_skb(skb2);
531 prev_dev = sdata->dev;
532 sdata->dev->stats.rx_packets++;
533 sdata->dev->stats.rx_bytes += skb->len;
538 netif_receive_skb(skb);
545 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
547 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
548 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
549 int tid, seqno_idx, security_idx;
551 /* does the frame have a qos control field? */
552 if (ieee80211_is_data_qos(hdr->frame_control)) {
553 u8 *qc = ieee80211_get_qos_ctl(hdr);
554 /* frame has qos control */
555 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
556 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
557 status->rx_flags |= IEEE80211_RX_AMSDU;
563 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
565 * Sequence numbers for management frames, QoS data
566 * frames with a broadcast/multicast address in the
567 * Address 1 field, and all non-QoS data frames sent
568 * by QoS STAs are assigned using an additional single
569 * modulo-4096 counter, [...]
571 * We also use that counter for non-QoS STAs.
573 seqno_idx = IEEE80211_NUM_TIDS;
575 if (ieee80211_is_mgmt(hdr->frame_control))
576 security_idx = IEEE80211_NUM_TIDS;
580 rx->seqno_idx = seqno_idx;
581 rx->security_idx = security_idx;
582 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
583 * For now, set skb->priority to 0 for other cases. */
584 rx->skb->priority = (tid > 7) ? 0 : tid;
588 * DOC: Packet alignment
590 * Drivers always need to pass packets that are aligned to two-byte boundaries
593 * Additionally, should, if possible, align the payload data in a way that
594 * guarantees that the contained IP header is aligned to a four-byte
595 * boundary. In the case of regular frames, this simply means aligning the
596 * payload to a four-byte boundary (because either the IP header is directly
597 * contained, or IV/RFC1042 headers that have a length divisible by four are
598 * in front of it). If the payload data is not properly aligned and the
599 * architecture doesn't support efficient unaligned operations, mac80211
600 * will align the data.
602 * With A-MSDU frames, however, the payload data address must yield two modulo
603 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
604 * push the IP header further back to a multiple of four again. Thankfully, the
605 * specs were sane enough this time around to require padding each A-MSDU
606 * subframe to a length that is a multiple of four.
608 * Padding like Atheros hardware adds which is between the 802.11 header and
609 * the payload is not supported, the driver is required to move the 802.11
610 * header to be directly in front of the payload in that case.
612 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
614 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
615 WARN_ONCE((unsigned long)rx->skb->data & 1,
616 "unaligned packet at 0x%p\n", rx->skb->data);
623 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
625 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
627 if (is_multicast_ether_addr(hdr->addr1))
630 return ieee80211_is_robust_mgmt_frame(skb);
634 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
636 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
638 if (!is_multicast_ether_addr(hdr->addr1))
641 return ieee80211_is_robust_mgmt_frame(skb);
645 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
646 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
648 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
649 struct ieee80211_mmie *mmie;
651 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
654 if (!ieee80211_is_robust_mgmt_frame(skb))
655 return -1; /* not a robust management frame */
657 mmie = (struct ieee80211_mmie *)
658 (skb->data + skb->len - sizeof(*mmie));
659 if (mmie->element_id != WLAN_EID_MMIE ||
660 mmie->length != sizeof(*mmie) - 2)
663 return le16_to_cpu(mmie->key_id);
666 static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
669 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
674 fc = hdr->frame_control;
675 hdrlen = ieee80211_hdrlen(fc);
677 if (skb->len < hdrlen + cs->hdr_len)
680 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
681 keyid &= cs->key_idx_mask;
682 keyid >>= cs->key_idx_shift;
687 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
689 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
690 char *dev_addr = rx->sdata->vif.addr;
692 if (ieee80211_is_data(hdr->frame_control)) {
693 if (is_multicast_ether_addr(hdr->addr1)) {
694 if (ieee80211_has_tods(hdr->frame_control) ||
695 !ieee80211_has_fromds(hdr->frame_control))
696 return RX_DROP_MONITOR;
697 if (ether_addr_equal(hdr->addr3, dev_addr))
698 return RX_DROP_MONITOR;
700 if (!ieee80211_has_a4(hdr->frame_control))
701 return RX_DROP_MONITOR;
702 if (ether_addr_equal(hdr->addr4, dev_addr))
703 return RX_DROP_MONITOR;
707 /* If there is not an established peer link and this is not a peer link
708 * establisment frame, beacon or probe, drop the frame.
711 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
712 struct ieee80211_mgmt *mgmt;
714 if (!ieee80211_is_mgmt(hdr->frame_control))
715 return RX_DROP_MONITOR;
717 if (ieee80211_is_action(hdr->frame_control)) {
720 /* make sure category field is present */
721 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
722 return RX_DROP_MONITOR;
724 mgmt = (struct ieee80211_mgmt *)hdr;
725 category = mgmt->u.action.category;
726 if (category != WLAN_CATEGORY_MESH_ACTION &&
727 category != WLAN_CATEGORY_SELF_PROTECTED)
728 return RX_DROP_MONITOR;
732 if (ieee80211_is_probe_req(hdr->frame_control) ||
733 ieee80211_is_probe_resp(hdr->frame_control) ||
734 ieee80211_is_beacon(hdr->frame_control) ||
735 ieee80211_is_auth(hdr->frame_control))
738 return RX_DROP_MONITOR;
744 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
745 struct tid_ampdu_rx *tid_agg_rx,
747 struct sk_buff_head *frames)
749 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
751 struct ieee80211_rx_status *status;
753 lockdep_assert_held(&tid_agg_rx->reorder_lock);
755 if (skb_queue_empty(skb_list))
758 if (!ieee80211_rx_reorder_ready(skb_list)) {
759 __skb_queue_purge(skb_list);
763 /* release frames from the reorder ring buffer */
764 tid_agg_rx->stored_mpdu_num--;
765 while ((skb = __skb_dequeue(skb_list))) {
766 status = IEEE80211_SKB_RXCB(skb);
767 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
768 __skb_queue_tail(frames, skb);
772 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
775 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
776 struct tid_ampdu_rx *tid_agg_rx,
778 struct sk_buff_head *frames)
782 lockdep_assert_held(&tid_agg_rx->reorder_lock);
784 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
785 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
786 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
792 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
793 * the skb was added to the buffer longer than this time ago, the earlier
794 * frames that have not yet been received are assumed to be lost and the skb
795 * can be released for processing. This may also release other skb's from the
796 * reorder buffer if there are no additional gaps between the frames.
798 * Callers must hold tid_agg_rx->reorder_lock.
800 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
802 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
803 struct tid_ampdu_rx *tid_agg_rx,
804 struct sk_buff_head *frames)
808 lockdep_assert_held(&tid_agg_rx->reorder_lock);
810 /* release the buffer until next missing frame */
811 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
812 if (!ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index]) &&
813 tid_agg_rx->stored_mpdu_num) {
815 * No buffers ready to be released, but check whether any
816 * frames in the reorder buffer have timed out.
819 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
820 j = (j + 1) % tid_agg_rx->buf_size) {
821 if (!ieee80211_rx_reorder_ready(
822 &tid_agg_rx->reorder_buf[j])) {
827 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
828 HT_RX_REORDER_BUF_TIMEOUT))
829 goto set_release_timer;
831 /* don't leave incomplete A-MSDUs around */
832 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
833 i = (i + 1) % tid_agg_rx->buf_size)
834 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
836 ht_dbg_ratelimited(sdata,
837 "release an RX reorder frame due to timeout on earlier frames\n");
838 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
842 * Increment the head seq# also for the skipped slots.
844 tid_agg_rx->head_seq_num =
845 (tid_agg_rx->head_seq_num +
846 skipped) & IEEE80211_SN_MASK;
849 } else while (ieee80211_rx_reorder_ready(
850 &tid_agg_rx->reorder_buf[index])) {
851 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
853 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
856 if (tid_agg_rx->stored_mpdu_num) {
857 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
859 for (; j != (index - 1) % tid_agg_rx->buf_size;
860 j = (j + 1) % tid_agg_rx->buf_size) {
861 if (ieee80211_rx_reorder_ready(
862 &tid_agg_rx->reorder_buf[j]))
868 mod_timer(&tid_agg_rx->reorder_timer,
869 tid_agg_rx->reorder_time[j] + 1 +
870 HT_RX_REORDER_BUF_TIMEOUT);
872 del_timer(&tid_agg_rx->reorder_timer);
877 * As this function belongs to the RX path it must be under
878 * rcu_read_lock protection. It returns false if the frame
879 * can be processed immediately, true if it was consumed.
881 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
882 struct tid_ampdu_rx *tid_agg_rx,
884 struct sk_buff_head *frames)
886 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
887 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
888 u16 sc = le16_to_cpu(hdr->seq_ctrl);
889 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
890 u16 head_seq_num, buf_size;
894 spin_lock(&tid_agg_rx->reorder_lock);
897 * Offloaded BA sessions have no known starting sequence number so pick
898 * one from first Rxed frame for this tid after BA was started.
900 if (unlikely(tid_agg_rx->auto_seq)) {
901 tid_agg_rx->auto_seq = false;
902 tid_agg_rx->ssn = mpdu_seq_num;
903 tid_agg_rx->head_seq_num = mpdu_seq_num;
906 buf_size = tid_agg_rx->buf_size;
907 head_seq_num = tid_agg_rx->head_seq_num;
909 /* frame with out of date sequence number */
910 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
916 * If frame the sequence number exceeds our buffering window
917 * size release some previous frames to make room for this one.
919 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
920 head_seq_num = ieee80211_sn_inc(
921 ieee80211_sn_sub(mpdu_seq_num, buf_size));
922 /* release stored frames up to new head to stack */
923 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
924 head_seq_num, frames);
927 /* Now the new frame is always in the range of the reordering buffer */
929 index = mpdu_seq_num % tid_agg_rx->buf_size;
931 /* check if we already stored this frame */
932 if (ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index])) {
938 * If the current MPDU is in the right order and nothing else
939 * is stored we can process it directly, no need to buffer it.
940 * If it is first but there's something stored, we may be able
941 * to release frames after this one.
943 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
944 tid_agg_rx->stored_mpdu_num == 0) {
945 if (!(status->flag & RX_FLAG_AMSDU_MORE))
946 tid_agg_rx->head_seq_num =
947 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
952 /* put the frame in the reordering buffer */
953 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
954 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
955 tid_agg_rx->reorder_time[index] = jiffies;
956 tid_agg_rx->stored_mpdu_num++;
957 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
961 spin_unlock(&tid_agg_rx->reorder_lock);
966 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
967 * true if the MPDU was buffered, false if it should be processed.
969 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
970 struct sk_buff_head *frames)
972 struct sk_buff *skb = rx->skb;
973 struct ieee80211_local *local = rx->local;
974 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
975 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
976 struct sta_info *sta = rx->sta;
977 struct tid_ampdu_rx *tid_agg_rx;
981 if (!ieee80211_is_data_qos(hdr->frame_control) ||
982 is_multicast_ether_addr(hdr->addr1))
986 * filter the QoS data rx stream according to
987 * STA/TID and check if this STA/TID is on aggregation
993 ack_policy = *ieee80211_get_qos_ctl(hdr) &
994 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
995 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
997 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1001 /* qos null data frames are excluded */
1002 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1005 /* not part of a BA session */
1006 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1007 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1010 /* not actually part of this BA session */
1011 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1014 /* new, potentially un-ordered, ampdu frame - process it */
1016 /* reset session timer */
1017 if (tid_agg_rx->timeout)
1018 tid_agg_rx->last_rx = jiffies;
1020 /* if this mpdu is fragmented - terminate rx aggregation session */
1021 sc = le16_to_cpu(hdr->seq_ctrl);
1022 if (sc & IEEE80211_SCTL_FRAG) {
1023 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
1024 skb_queue_tail(&rx->sdata->skb_queue, skb);
1025 ieee80211_queue_work(&local->hw, &rx->sdata->work);
1030 * No locking needed -- we will only ever process one
1031 * RX packet at a time, and thus own tid_agg_rx. All
1032 * other code manipulating it needs to (and does) make
1033 * sure that we cannot get to it any more before doing
1036 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1041 __skb_queue_tail(frames, skb);
1044 static ieee80211_rx_result debug_noinline
1045 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1047 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1048 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1051 * Drop duplicate 802.11 retransmissions
1052 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1055 if (rx->skb->len < 24)
1058 if (ieee80211_is_ctl(hdr->frame_control) ||
1059 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
1060 is_multicast_ether_addr(hdr->addr1))
1064 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1065 rx->sta->last_seq_ctrl[rx->seqno_idx] ==
1067 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1068 rx->local->dot11FrameDuplicateCount++;
1069 rx->sta->num_duplicates++;
1071 return RX_DROP_UNUSABLE;
1072 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1073 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1080 static ieee80211_rx_result debug_noinline
1081 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1083 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1085 if (unlikely(rx->skb->len < 16)) {
1086 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
1087 return RX_DROP_MONITOR;
1090 /* Drop disallowed frame classes based on STA auth/assoc state;
1091 * IEEE 802.11, Chap 5.5.
1093 * mac80211 filters only based on association state, i.e. it drops
1094 * Class 3 frames from not associated stations. hostapd sends
1095 * deauth/disassoc frames when needed. In addition, hostapd is
1096 * responsible for filtering on both auth and assoc states.
1099 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1100 return ieee80211_rx_mesh_check(rx);
1102 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1103 ieee80211_is_pspoll(hdr->frame_control)) &&
1104 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1105 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1106 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1107 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1109 * accept port control frames from the AP even when it's not
1110 * yet marked ASSOC to prevent a race where we don't set the
1111 * assoc bit quickly enough before it sends the first frame
1113 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1114 ieee80211_is_data_present(hdr->frame_control)) {
1115 unsigned int hdrlen;
1118 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1120 if (rx->skb->len < hdrlen + 8)
1121 return RX_DROP_MONITOR;
1123 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2);
1124 if (ethertype == rx->sdata->control_port_protocol)
1128 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1129 cfg80211_rx_spurious_frame(rx->sdata->dev,
1132 return RX_DROP_UNUSABLE;
1134 return RX_DROP_MONITOR;
1141 static ieee80211_rx_result debug_noinline
1142 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1144 struct ieee80211_local *local;
1145 struct ieee80211_hdr *hdr;
1146 struct sk_buff *skb;
1150 hdr = (struct ieee80211_hdr *) skb->data;
1152 if (!local->pspolling)
1155 if (!ieee80211_has_fromds(hdr->frame_control))
1156 /* this is not from AP */
1159 if (!ieee80211_is_data(hdr->frame_control))
1162 if (!ieee80211_has_moredata(hdr->frame_control)) {
1163 /* AP has no more frames buffered for us */
1164 local->pspolling = false;
1168 /* more data bit is set, let's request a new frame from the AP */
1169 ieee80211_send_pspoll(local, rx->sdata);
1174 static void sta_ps_start(struct sta_info *sta)
1176 struct ieee80211_sub_if_data *sdata = sta->sdata;
1177 struct ieee80211_local *local = sdata->local;
1180 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1181 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1182 ps = &sdata->bss->ps;
1186 atomic_inc(&ps->num_sta_ps);
1187 set_sta_flag(sta, WLAN_STA_PS_STA);
1188 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1189 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1190 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1191 sta->sta.addr, sta->sta.aid);
1194 static void sta_ps_end(struct sta_info *sta)
1196 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1197 sta->sta.addr, sta->sta.aid);
1199 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1201 * Clear the flag only if the other one is still set
1202 * so that the TX path won't start TX'ing new frames
1203 * directly ... In the case that the driver flag isn't
1204 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1206 clear_sta_flag(sta, WLAN_STA_PS_STA);
1207 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1208 sta->sta.addr, sta->sta.aid);
1212 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1213 clear_sta_flag(sta, WLAN_STA_PS_STA);
1214 ieee80211_sta_ps_deliver_wakeup(sta);
1217 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
1219 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
1222 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
1224 /* Don't let the same PS state be set twice */
1225 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
1226 if ((start && in_ps) || (!start && !in_ps))
1230 sta_ps_start(sta_inf);
1232 sta_ps_end(sta_inf);
1236 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1238 static ieee80211_rx_result debug_noinline
1239 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1241 struct ieee80211_sub_if_data *sdata = rx->sdata;
1242 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1243 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1246 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
1249 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1250 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1254 * The device handles station powersave, so don't do anything about
1255 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1256 * it to mac80211 since they're handled.)
1258 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
1262 * Don't do anything if the station isn't already asleep. In
1263 * the uAPSD case, the station will probably be marked asleep,
1264 * in the PS-Poll case the station must be confused ...
1266 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1269 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1270 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
1271 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1272 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1274 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1277 /* Free PS Poll skb here instead of returning RX_DROP that would
1278 * count as an dropped frame. */
1279 dev_kfree_skb(rx->skb);
1282 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1283 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1284 ieee80211_has_pm(hdr->frame_control) &&
1285 (ieee80211_is_data_qos(hdr->frame_control) ||
1286 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1287 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1288 ac = ieee802_1d_to_ac[tid & 7];
1291 * If this AC is not trigger-enabled do nothing.
1293 * NB: This could/should check a separate bitmap of trigger-
1294 * enabled queues, but for now we only implement uAPSD w/o
1295 * TSPEC changes to the ACs, so they're always the same.
1297 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
1300 /* if we are in a service period, do nothing */
1301 if (test_sta_flag(rx->sta, WLAN_STA_SP))
1304 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1305 ieee80211_sta_ps_deliver_uapsd(rx->sta);
1307 set_sta_flag(rx->sta, WLAN_STA_UAPSD);
1313 static ieee80211_rx_result debug_noinline
1314 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1316 struct sta_info *sta = rx->sta;
1317 struct sk_buff *skb = rx->skb;
1318 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1319 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1326 * Update last_rx only for IBSS packets which are for the current
1327 * BSSID and for station already AUTHORIZED to avoid keeping the
1328 * current IBSS network alive in cases where other STAs start
1329 * using different BSSID. This will also give the station another
1330 * chance to restart the authentication/authorization in case
1331 * something went wrong the first time.
1333 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1334 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1335 NL80211_IFTYPE_ADHOC);
1336 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1337 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1338 sta->last_rx = jiffies;
1339 if (ieee80211_is_data(hdr->frame_control) &&
1340 !is_multicast_ether_addr(hdr->addr1)) {
1341 sta->last_rx_rate_idx = status->rate_idx;
1342 sta->last_rx_rate_flag = status->flag;
1343 sta->last_rx_rate_vht_flag = status->vht_flag;
1344 sta->last_rx_rate_vht_nss = status->vht_nss;
1347 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1348 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1349 NL80211_IFTYPE_OCB);
1350 /* OCB uses wild-card BSSID */
1351 if (is_broadcast_ether_addr(bssid))
1352 sta->last_rx = jiffies;
1353 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1355 * Mesh beacons will update last_rx when if they are found to
1356 * match the current local configuration when processed.
1358 sta->last_rx = jiffies;
1359 if (ieee80211_is_data(hdr->frame_control)) {
1360 sta->last_rx_rate_idx = status->rate_idx;
1361 sta->last_rx_rate_flag = status->flag;
1362 sta->last_rx_rate_vht_flag = status->vht_flag;
1363 sta->last_rx_rate_vht_nss = status->vht_nss;
1367 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1370 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1371 ieee80211_sta_rx_notify(rx->sdata, hdr);
1373 sta->rx_fragments++;
1374 sta->rx_bytes += rx->skb->len;
1375 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1376 sta->last_signal = status->signal;
1377 ewma_add(&sta->avg_signal, -status->signal);
1380 if (status->chains) {
1381 sta->chains = status->chains;
1382 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1383 int signal = status->chain_signal[i];
1385 if (!(status->chains & BIT(i)))
1388 sta->chain_signal_last[i] = signal;
1389 ewma_add(&sta->chain_signal_avg[i], -signal);
1394 * Change STA power saving mode only at the end of a frame
1395 * exchange sequence.
1397 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
1398 !ieee80211_has_morefrags(hdr->frame_control) &&
1399 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1400 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1401 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1402 /* PM bit is only checked in frames where it isn't reserved,
1403 * in AP mode it's reserved in non-bufferable management frames
1404 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
1406 (!ieee80211_is_mgmt(hdr->frame_control) ||
1407 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
1408 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1409 if (!ieee80211_has_pm(hdr->frame_control))
1412 if (ieee80211_has_pm(hdr->frame_control))
1417 /* mesh power save support */
1418 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1419 ieee80211_mps_rx_h_sta_process(sta, hdr);
1422 * Drop (qos-)data::nullfunc frames silently, since they
1423 * are used only to control station power saving mode.
1425 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1426 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1427 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1430 * If we receive a 4-addr nullfunc frame from a STA
1431 * that was not moved to a 4-addr STA vlan yet send
1432 * the event to userspace and for older hostapd drop
1433 * the frame to the monitor interface.
1435 if (ieee80211_has_a4(hdr->frame_control) &&
1436 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1437 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1438 !rx->sdata->u.vlan.sta))) {
1439 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1440 cfg80211_rx_unexpected_4addr_frame(
1441 rx->sdata->dev, sta->sta.addr,
1443 return RX_DROP_MONITOR;
1446 * Update counter and free packet here to avoid
1447 * counting this as a dropped packed.
1450 dev_kfree_skb(rx->skb);
1455 } /* ieee80211_rx_h_sta_process */
1457 static ieee80211_rx_result debug_noinline
1458 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1460 struct sk_buff *skb = rx->skb;
1461 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1462 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1465 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1466 struct ieee80211_key *sta_ptk = NULL;
1467 int mmie_keyidx = -1;
1469 const struct ieee80211_cipher_scheme *cs = NULL;
1474 * There are four types of keys:
1475 * - GTK (group keys)
1476 * - IGTK (group keys for management frames)
1477 * - PTK (pairwise keys)
1478 * - STK (station-to-station pairwise keys)
1480 * When selecting a key, we have to distinguish between multicast
1481 * (including broadcast) and unicast frames, the latter can only
1482 * use PTKs and STKs while the former always use GTKs and IGTKs.
1483 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1484 * unicast frames can also use key indices like GTKs. Hence, if we
1485 * don't have a PTK/STK we check the key index for a WEP key.
1487 * Note that in a regular BSS, multicast frames are sent by the
1488 * AP only, associated stations unicast the frame to the AP first
1489 * which then multicasts it on their behalf.
1491 * There is also a slight problem in IBSS mode: GTKs are negotiated
1492 * with each station, that is something we don't currently handle.
1493 * The spec seems to expect that one negotiates the same key with
1494 * every station but there's no such requirement; VLANs could be
1499 * No point in finding a key and decrypting if the frame is neither
1500 * addressed to us nor a multicast frame.
1502 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1505 /* start without a key */
1507 fc = hdr->frame_control;
1510 int keyid = rx->sta->ptk_idx;
1512 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1513 cs = rx->sta->cipher_scheme;
1514 keyid = iwl80211_get_cs_keyid(cs, rx->skb);
1515 if (unlikely(keyid < 0))
1516 return RX_DROP_UNUSABLE;
1518 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1521 if (!ieee80211_has_protected(fc))
1522 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1524 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1526 if ((status->flag & RX_FLAG_DECRYPTED) &&
1527 (status->flag & RX_FLAG_IV_STRIPPED))
1529 /* Skip decryption if the frame is not protected. */
1530 if (!ieee80211_has_protected(fc))
1532 } else if (mmie_keyidx >= 0) {
1533 /* Broadcast/multicast robust management frame / BIP */
1534 if ((status->flag & RX_FLAG_DECRYPTED) &&
1535 (status->flag & RX_FLAG_IV_STRIPPED))
1538 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1539 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1540 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
1542 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1544 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1545 } else if (!ieee80211_has_protected(fc)) {
1547 * The frame was not protected, so skip decryption. However, we
1548 * need to set rx->key if there is a key that could have been
1549 * used so that the frame may be dropped if encryption would
1550 * have been expected.
1552 struct ieee80211_key *key = NULL;
1553 struct ieee80211_sub_if_data *sdata = rx->sdata;
1556 if (ieee80211_is_mgmt(fc) &&
1557 is_multicast_ether_addr(hdr->addr1) &&
1558 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1562 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1563 key = rcu_dereference(rx->sta->gtk[i]);
1569 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1570 key = rcu_dereference(sdata->keys[i]);
1583 * The device doesn't give us the IV so we won't be
1584 * able to look up the key. That's ok though, we
1585 * don't need to decrypt the frame, we just won't
1586 * be able to keep statistics accurate.
1587 * Except for key threshold notifications, should
1588 * we somehow allow the driver to tell us which key
1589 * the hardware used if this flag is set?
1591 if ((status->flag & RX_FLAG_DECRYPTED) &&
1592 (status->flag & RX_FLAG_IV_STRIPPED))
1595 hdrlen = ieee80211_hdrlen(fc);
1598 keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
1600 if (unlikely(keyidx < 0))
1601 return RX_DROP_UNUSABLE;
1603 if (rx->skb->len < 8 + hdrlen)
1604 return RX_DROP_UNUSABLE; /* TODO: count this? */
1606 * no need to call ieee80211_wep_get_keyidx,
1607 * it verifies a bunch of things we've done already
1609 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1610 keyidx = keyid >> 6;
1613 /* check per-station GTK first, if multicast packet */
1614 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1615 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1617 /* if not found, try default key */
1619 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1622 * RSNA-protected unicast frames should always be
1623 * sent with pairwise or station-to-station keys,
1624 * but for WEP we allow using a key index as well.
1627 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1628 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1629 !is_multicast_ether_addr(hdr->addr1))
1635 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1636 return RX_DROP_MONITOR;
1638 rx->key->tx_rx_count++;
1639 /* TODO: add threshold stuff again */
1641 return RX_DROP_MONITOR;
1644 switch (rx->key->conf.cipher) {
1645 case WLAN_CIPHER_SUITE_WEP40:
1646 case WLAN_CIPHER_SUITE_WEP104:
1647 result = ieee80211_crypto_wep_decrypt(rx);
1649 case WLAN_CIPHER_SUITE_TKIP:
1650 result = ieee80211_crypto_tkip_decrypt(rx);
1652 case WLAN_CIPHER_SUITE_CCMP:
1653 result = ieee80211_crypto_ccmp_decrypt(rx);
1655 case WLAN_CIPHER_SUITE_AES_CMAC:
1656 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1659 result = ieee80211_crypto_hw_decrypt(rx);
1662 /* the hdr variable is invalid after the decrypt handlers */
1664 /* either the frame has been decrypted or will be dropped */
1665 status->flag |= RX_FLAG_DECRYPTED;
1670 static inline struct ieee80211_fragment_entry *
1671 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1672 unsigned int frag, unsigned int seq, int rx_queue,
1673 struct sk_buff **skb)
1675 struct ieee80211_fragment_entry *entry;
1677 entry = &sdata->fragments[sdata->fragment_next++];
1678 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1679 sdata->fragment_next = 0;
1681 if (!skb_queue_empty(&entry->skb_list))
1682 __skb_queue_purge(&entry->skb_list);
1684 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1686 entry->first_frag_time = jiffies;
1688 entry->rx_queue = rx_queue;
1689 entry->last_frag = frag;
1691 entry->extra_len = 0;
1696 static inline struct ieee80211_fragment_entry *
1697 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1698 unsigned int frag, unsigned int seq,
1699 int rx_queue, struct ieee80211_hdr *hdr)
1701 struct ieee80211_fragment_entry *entry;
1704 idx = sdata->fragment_next;
1705 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1706 struct ieee80211_hdr *f_hdr;
1710 idx = IEEE80211_FRAGMENT_MAX - 1;
1712 entry = &sdata->fragments[idx];
1713 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1714 entry->rx_queue != rx_queue ||
1715 entry->last_frag + 1 != frag)
1718 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1721 * Check ftype and addresses are equal, else check next fragment
1723 if (((hdr->frame_control ^ f_hdr->frame_control) &
1724 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1725 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1726 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1729 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1730 __skb_queue_purge(&entry->skb_list);
1739 static ieee80211_rx_result debug_noinline
1740 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1742 struct ieee80211_hdr *hdr;
1745 unsigned int frag, seq;
1746 struct ieee80211_fragment_entry *entry;
1747 struct sk_buff *skb;
1748 struct ieee80211_rx_status *status;
1750 hdr = (struct ieee80211_hdr *)rx->skb->data;
1751 fc = hdr->frame_control;
1753 if (ieee80211_is_ctl(fc))
1756 sc = le16_to_cpu(hdr->seq_ctrl);
1757 frag = sc & IEEE80211_SCTL_FRAG;
1759 if (is_multicast_ether_addr(hdr->addr1)) {
1760 rx->local->dot11MulticastReceivedFrameCount++;
1764 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1767 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1769 if (skb_linearize(rx->skb))
1770 return RX_DROP_UNUSABLE;
1773 * skb_linearize() might change the skb->data and
1774 * previously cached variables (in this case, hdr) need to
1775 * be refreshed with the new data.
1777 hdr = (struct ieee80211_hdr *)rx->skb->data;
1778 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1781 /* This is the first fragment of a new frame. */
1782 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1783 rx->seqno_idx, &(rx->skb));
1784 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1785 ieee80211_has_protected(fc)) {
1786 int queue = rx->security_idx;
1787 /* Store CCMP PN so that we can verify that the next
1788 * fragment has a sequential PN value. */
1790 memcpy(entry->last_pn,
1791 rx->key->u.ccmp.rx_pn[queue],
1792 IEEE80211_CCMP_PN_LEN);
1797 /* This is a fragment for a frame that should already be pending in
1798 * fragment cache. Add this fragment to the end of the pending entry.
1800 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
1801 rx->seqno_idx, hdr);
1803 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1804 return RX_DROP_MONITOR;
1807 /* Verify that MPDUs within one MSDU have sequential PN values.
1808 * (IEEE 802.11i, 8.3.3.4.5) */
1811 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1813 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
1814 return RX_DROP_UNUSABLE;
1815 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
1816 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1821 queue = rx->security_idx;
1822 rpn = rx->key->u.ccmp.rx_pn[queue];
1823 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
1824 return RX_DROP_UNUSABLE;
1825 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1828 skb_pull(rx->skb, ieee80211_hdrlen(fc));
1829 __skb_queue_tail(&entry->skb_list, rx->skb);
1830 entry->last_frag = frag;
1831 entry->extra_len += rx->skb->len;
1832 if (ieee80211_has_morefrags(fc)) {
1837 rx->skb = __skb_dequeue(&entry->skb_list);
1838 if (skb_tailroom(rx->skb) < entry->extra_len) {
1839 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1840 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1842 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1843 __skb_queue_purge(&entry->skb_list);
1844 return RX_DROP_UNUSABLE;
1847 while ((skb = __skb_dequeue(&entry->skb_list))) {
1848 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1852 /* Complete frame has been reassembled - process it now */
1853 status = IEEE80211_SKB_RXCB(rx->skb);
1854 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1857 ieee80211_led_rx(rx->local);
1860 rx->sta->rx_packets++;
1864 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1866 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
1872 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1874 struct sk_buff *skb = rx->skb;
1875 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1878 * Pass through unencrypted frames if the hardware has
1879 * decrypted them already.
1881 if (status->flag & RX_FLAG_DECRYPTED)
1884 /* Drop unencrypted frames if key is set. */
1885 if (unlikely(!ieee80211_has_protected(fc) &&
1886 !ieee80211_is_nullfunc(fc) &&
1887 ieee80211_is_data(fc) &&
1888 (rx->key || rx->sdata->drop_unencrypted)))
1894 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1896 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1897 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1898 __le16 fc = hdr->frame_control;
1901 * Pass through unencrypted frames if the hardware has
1902 * decrypted them already.
1904 if (status->flag & RX_FLAG_DECRYPTED)
1907 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
1908 if (unlikely(!ieee80211_has_protected(fc) &&
1909 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1911 if (ieee80211_is_deauth(fc) ||
1912 ieee80211_is_disassoc(fc))
1913 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1918 /* BIP does not use Protected field, so need to check MMIE */
1919 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1920 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1921 if (ieee80211_is_deauth(fc) ||
1922 ieee80211_is_disassoc(fc))
1923 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1929 * When using MFP, Action frames are not allowed prior to
1930 * having configured keys.
1932 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1933 ieee80211_is_robust_mgmt_frame(rx->skb)))
1941 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
1943 struct ieee80211_sub_if_data *sdata = rx->sdata;
1944 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1945 bool check_port_control = false;
1946 struct ethhdr *ehdr;
1949 *port_control = false;
1950 if (ieee80211_has_a4(hdr->frame_control) &&
1951 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1954 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1955 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1957 if (!sdata->u.mgd.use_4addr)
1960 check_port_control = true;
1963 if (is_multicast_ether_addr(hdr->addr1) &&
1964 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1967 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1971 ehdr = (struct ethhdr *) rx->skb->data;
1972 if (ehdr->h_proto == rx->sdata->control_port_protocol)
1973 *port_control = true;
1974 else if (check_port_control)
1981 * requires that rx->skb is a frame with ethernet header
1983 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1985 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1986 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1987 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1990 * Allow EAPOL frames to us/the PAE group address regardless
1991 * of whether the frame was encrypted or not.
1993 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1994 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
1995 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
1998 if (ieee80211_802_1x_port_control(rx) ||
1999 ieee80211_drop_unencrypted(rx, fc))
2006 * requires that rx->skb is a frame with ethernet header
2009 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2011 struct ieee80211_sub_if_data *sdata = rx->sdata;
2012 struct net_device *dev = sdata->dev;
2013 struct sk_buff *skb, *xmit_skb;
2014 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2015 struct sta_info *dsta;
2016 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2021 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2022 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2023 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2024 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
2025 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2026 if (is_multicast_ether_addr(ehdr->h_dest)) {
2028 * send multicast frames both to higher layers in
2029 * local net stack and back to the wireless medium
2031 xmit_skb = skb_copy(skb, GFP_ATOMIC);
2033 net_info_ratelimited("%s: failed to clone multicast frame\n",
2036 dsta = sta_info_get(sdata, skb->data);
2039 * The destination station is associated to
2040 * this AP (in this VLAN), so send the frame
2041 * directly to it and do not pass it to local
2050 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2052 /* 'align' will only take the values 0 or 2 here since all
2053 * frames are required to be aligned to 2-byte boundaries
2054 * when being passed to mac80211; the code here works just
2055 * as well if that isn't true, but mac80211 assumes it can
2056 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2060 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2062 if (WARN_ON(skb_headroom(skb) < 3)) {
2066 u8 *data = skb->data;
2067 size_t len = skb_headlen(skb);
2069 memmove(skb->data, data, len);
2070 skb_set_tail_pointer(skb, len);
2077 /* deliver to local stack */
2078 skb->protocol = eth_type_trans(skb, dev);
2079 memset(skb->cb, 0, sizeof(skb->cb));
2080 if (rx->local->napi)
2081 napi_gro_receive(rx->local->napi, skb);
2083 netif_receive_skb(skb);
2088 * Send to wireless media and increase priority by 256 to
2089 * keep the received priority instead of reclassifying
2090 * the frame (see cfg80211_classify8021d).
2092 xmit_skb->priority += 256;
2093 xmit_skb->protocol = htons(ETH_P_802_3);
2094 skb_reset_network_header(xmit_skb);
2095 skb_reset_mac_header(xmit_skb);
2096 dev_queue_xmit(xmit_skb);
2100 static ieee80211_rx_result debug_noinline
2101 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2103 struct net_device *dev = rx->sdata->dev;
2104 struct sk_buff *skb = rx->skb;
2105 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2106 __le16 fc = hdr->frame_control;
2107 struct sk_buff_head frame_list;
2108 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2110 if (unlikely(!ieee80211_is_data(fc)))
2113 if (unlikely(!ieee80211_is_data_present(fc)))
2114 return RX_DROP_MONITOR;
2116 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2119 if (ieee80211_has_a4(hdr->frame_control) &&
2120 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2121 !rx->sdata->u.vlan.sta)
2122 return RX_DROP_UNUSABLE;
2124 if (is_multicast_ether_addr(hdr->addr1) &&
2125 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2126 rx->sdata->u.vlan.sta) ||
2127 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
2128 rx->sdata->u.mgd.use_4addr)))
2129 return RX_DROP_UNUSABLE;
2132 __skb_queue_head_init(&frame_list);
2134 if (skb_linearize(skb))
2135 return RX_DROP_UNUSABLE;
2137 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2138 rx->sdata->vif.type,
2139 rx->local->hw.extra_tx_headroom, true);
2141 while (!skb_queue_empty(&frame_list)) {
2142 rx->skb = __skb_dequeue(&frame_list);
2144 if (!ieee80211_frame_allowed(rx, fc)) {
2145 dev_kfree_skb(rx->skb);
2148 dev->stats.rx_packets++;
2149 dev->stats.rx_bytes += rx->skb->len;
2151 ieee80211_deliver_skb(rx);
2157 #ifdef CONFIG_MAC80211_MESH
2158 static ieee80211_rx_result
2159 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2161 struct ieee80211_hdr *fwd_hdr, *hdr;
2162 struct ieee80211_tx_info *info;
2163 struct ieee80211s_hdr *mesh_hdr;
2164 struct sk_buff *skb = rx->skb, *fwd_skb;
2165 struct ieee80211_local *local = rx->local;
2166 struct ieee80211_sub_if_data *sdata = rx->sdata;
2167 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2168 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2171 hdr = (struct ieee80211_hdr *) skb->data;
2172 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2174 /* make sure fixed part of mesh header is there, also checks skb len */
2175 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2176 return RX_DROP_MONITOR;
2178 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2180 /* make sure full mesh header is there, also checks skb len */
2181 if (!pskb_may_pull(rx->skb,
2182 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2183 return RX_DROP_MONITOR;
2185 /* reload pointers */
2186 hdr = (struct ieee80211_hdr *) skb->data;
2187 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2189 /* frame is in RMC, don't forward */
2190 if (ieee80211_is_data(hdr->frame_control) &&
2191 is_multicast_ether_addr(hdr->addr1) &&
2192 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2193 return RX_DROP_MONITOR;
2195 if (!ieee80211_is_data(hdr->frame_control) ||
2196 !(status->rx_flags & IEEE80211_RX_RA_MATCH))
2200 return RX_DROP_MONITOR;
2202 if (mesh_hdr->flags & MESH_FLAGS_AE) {
2203 struct mesh_path *mppath;
2207 if (is_multicast_ether_addr(hdr->addr1)) {
2208 mpp_addr = hdr->addr3;
2209 proxied_addr = mesh_hdr->eaddr1;
2210 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
2211 /* has_a4 already checked in ieee80211_rx_mesh_check */
2212 mpp_addr = hdr->addr4;
2213 proxied_addr = mesh_hdr->eaddr2;
2215 return RX_DROP_MONITOR;
2219 mppath = mpp_path_lookup(sdata, proxied_addr);
2221 mpp_path_add(sdata, proxied_addr, mpp_addr);
2223 spin_lock_bh(&mppath->state_lock);
2224 if (!ether_addr_equal(mppath->mpp, mpp_addr))
2225 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2226 spin_unlock_bh(&mppath->state_lock);
2231 /* Frame has reached destination. Don't forward */
2232 if (!is_multicast_ether_addr(hdr->addr1) &&
2233 ether_addr_equal(sdata->vif.addr, hdr->addr3))
2236 q = ieee80211_select_queue_80211(sdata, skb, hdr);
2237 if (ieee80211_queue_stopped(&local->hw, q)) {
2238 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2239 return RX_DROP_MONITOR;
2241 skb_set_queue_mapping(skb, q);
2243 if (!--mesh_hdr->ttl) {
2244 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2248 if (!ifmsh->mshcfg.dot11MeshForwarding)
2251 fwd_skb = skb_copy(skb, GFP_ATOMIC);
2253 net_info_ratelimited("%s: failed to clone mesh frame\n",
2258 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
2259 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2260 info = IEEE80211_SKB_CB(fwd_skb);
2261 memset(info, 0, sizeof(*info));
2262 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2263 info->control.vif = &rx->sdata->vif;
2264 info->control.jiffies = jiffies;
2265 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2266 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2267 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2268 /* update power mode indication when forwarding */
2269 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2270 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2271 /* mesh power mode flags updated in mesh_nexthop_lookup */
2272 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2274 /* unable to resolve next hop */
2275 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2277 WLAN_REASON_MESH_PATH_NOFORWARD,
2279 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2281 return RX_DROP_MONITOR;
2284 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2285 ieee80211_add_pending_skb(local, fwd_skb);
2287 if (is_multicast_ether_addr(hdr->addr1) ||
2288 sdata->dev->flags & IFF_PROMISC)
2291 return RX_DROP_MONITOR;
2295 static ieee80211_rx_result debug_noinline
2296 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2298 struct ieee80211_sub_if_data *sdata = rx->sdata;
2299 struct ieee80211_local *local = rx->local;
2300 struct net_device *dev = sdata->dev;
2301 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2302 __le16 fc = hdr->frame_control;
2306 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2309 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
2310 return RX_DROP_MONITOR;
2313 /* The security index has the same property as needed
2314 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2315 * for non-QoS-data frames. Here we know it's a data
2316 * frame, so count MSDUs.
2318 rx->sta->rx_msdu[rx->security_idx]++;
2322 * Send unexpected-4addr-frame event to hostapd. For older versions,
2323 * also drop the frame to cooked monitor interfaces.
2325 if (ieee80211_has_a4(hdr->frame_control) &&
2326 sdata->vif.type == NL80211_IFTYPE_AP) {
2328 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2329 cfg80211_rx_unexpected_4addr_frame(
2330 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2331 return RX_DROP_MONITOR;
2334 err = __ieee80211_data_to_8023(rx, &port_control);
2336 return RX_DROP_UNUSABLE;
2338 if (!ieee80211_frame_allowed(rx, fc))
2339 return RX_DROP_MONITOR;
2341 /* directly handle TDLS channel switch requests/responses */
2342 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2343 cpu_to_be16(ETH_P_TDLS))) {
2344 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2346 if (pskb_may_pull(rx->skb,
2347 offsetof(struct ieee80211_tdls_data, u)) &&
2348 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2349 tf->category == WLAN_CATEGORY_TDLS &&
2350 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2351 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
2352 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TDLS_CHSW;
2353 skb_queue_tail(&sdata->skb_queue, rx->skb);
2354 ieee80211_queue_work(&rx->local->hw, &sdata->work);
2356 rx->sta->rx_packets++;
2362 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2363 unlikely(port_control) && sdata->bss) {
2364 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2372 dev->stats.rx_packets++;
2373 dev->stats.rx_bytes += rx->skb->len;
2375 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2376 !is_multicast_ether_addr(
2377 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2378 (!local->scanning &&
2379 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2380 mod_timer(&local->dynamic_ps_timer, jiffies +
2381 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2384 ieee80211_deliver_skb(rx);
2389 static ieee80211_rx_result debug_noinline
2390 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2392 struct sk_buff *skb = rx->skb;
2393 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2394 struct tid_ampdu_rx *tid_agg_rx;
2398 if (likely(!ieee80211_is_ctl(bar->frame_control)))
2401 if (ieee80211_is_back_req(bar->frame_control)) {
2403 __le16 control, start_seq_num;
2404 } __packed bar_data;
2407 return RX_DROP_MONITOR;
2409 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2410 &bar_data, sizeof(bar_data)))
2411 return RX_DROP_MONITOR;
2413 tid = le16_to_cpu(bar_data.control) >> 12;
2415 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2417 return RX_DROP_MONITOR;
2419 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2421 /* reset session timer */
2422 if (tid_agg_rx->timeout)
2423 mod_timer(&tid_agg_rx->session_timer,
2424 TU_TO_EXP_TIME(tid_agg_rx->timeout));
2426 spin_lock(&tid_agg_rx->reorder_lock);
2427 /* release stored frames up to start of BAR */
2428 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2429 start_seq_num, frames);
2430 spin_unlock(&tid_agg_rx->reorder_lock);
2437 * After this point, we only want management frames,
2438 * so we can drop all remaining control frames to
2439 * cooked monitor interfaces.
2441 return RX_DROP_MONITOR;
2444 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2445 struct ieee80211_mgmt *mgmt,
2448 struct ieee80211_local *local = sdata->local;
2449 struct sk_buff *skb;
2450 struct ieee80211_mgmt *resp;
2452 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2453 /* Not to own unicast address */
2457 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2458 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2459 /* Not from the current AP or not associated yet. */
2463 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2464 /* Too short SA Query request frame */
2468 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2472 skb_reserve(skb, local->hw.extra_tx_headroom);
2473 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2474 memset(resp, 0, 24);
2475 memcpy(resp->da, mgmt->sa, ETH_ALEN);
2476 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2477 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2478 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2479 IEEE80211_STYPE_ACTION);
2480 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2481 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2482 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2483 memcpy(resp->u.action.u.sa_query.trans_id,
2484 mgmt->u.action.u.sa_query.trans_id,
2485 WLAN_SA_QUERY_TR_ID_LEN);
2487 ieee80211_tx_skb(sdata, skb);
2490 static ieee80211_rx_result debug_noinline
2491 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2493 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2494 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2497 * From here on, look only at management frames.
2498 * Data and control frames are already handled,
2499 * and unknown (reserved) frames are useless.
2501 if (rx->skb->len < 24)
2502 return RX_DROP_MONITOR;
2504 if (!ieee80211_is_mgmt(mgmt->frame_control))
2505 return RX_DROP_MONITOR;
2507 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2508 ieee80211_is_beacon(mgmt->frame_control) &&
2509 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2512 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
2513 sig = status->signal;
2515 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2516 rx->skb->data, rx->skb->len,
2518 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2521 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2522 return RX_DROP_MONITOR;
2524 if (ieee80211_drop_unencrypted_mgmt(rx))
2525 return RX_DROP_UNUSABLE;
2530 static ieee80211_rx_result debug_noinline
2531 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2533 struct ieee80211_local *local = rx->local;
2534 struct ieee80211_sub_if_data *sdata = rx->sdata;
2535 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2536 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2537 int len = rx->skb->len;
2539 if (!ieee80211_is_action(mgmt->frame_control))
2542 /* drop too small frames */
2543 if (len < IEEE80211_MIN_ACTION_SIZE)
2544 return RX_DROP_UNUSABLE;
2546 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2547 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2548 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2549 return RX_DROP_UNUSABLE;
2551 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2552 return RX_DROP_UNUSABLE;
2554 switch (mgmt->u.action.category) {
2555 case WLAN_CATEGORY_HT:
2556 /* reject HT action frames from stations not supporting HT */
2557 if (!rx->sta->sta.ht_cap.ht_supported)
2560 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2561 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2562 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2563 sdata->vif.type != NL80211_IFTYPE_AP &&
2564 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2567 /* verify action & smps_control/chanwidth are present */
2568 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2571 switch (mgmt->u.action.u.ht_smps.action) {
2572 case WLAN_HT_ACTION_SMPS: {
2573 struct ieee80211_supported_band *sband;
2574 enum ieee80211_smps_mode smps_mode;
2576 /* convert to HT capability */
2577 switch (mgmt->u.action.u.ht_smps.smps_control) {
2578 case WLAN_HT_SMPS_CONTROL_DISABLED:
2579 smps_mode = IEEE80211_SMPS_OFF;
2581 case WLAN_HT_SMPS_CONTROL_STATIC:
2582 smps_mode = IEEE80211_SMPS_STATIC;
2584 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2585 smps_mode = IEEE80211_SMPS_DYNAMIC;
2591 /* if no change do nothing */
2592 if (rx->sta->sta.smps_mode == smps_mode)
2594 rx->sta->sta.smps_mode = smps_mode;
2596 sband = rx->local->hw.wiphy->bands[status->band];
2598 rate_control_rate_update(local, sband, rx->sta,
2599 IEEE80211_RC_SMPS_CHANGED);
2602 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2603 struct ieee80211_supported_band *sband;
2604 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2605 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
2607 /* If it doesn't support 40 MHz it can't change ... */
2608 if (!(rx->sta->sta.ht_cap.cap &
2609 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2612 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2613 max_bw = IEEE80211_STA_RX_BW_20;
2615 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2617 /* set cur_max_bandwidth and recalc sta bw */
2618 rx->sta->cur_max_bandwidth = max_bw;
2619 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2621 if (rx->sta->sta.bandwidth == new_bw)
2624 rx->sta->sta.bandwidth = new_bw;
2625 sband = rx->local->hw.wiphy->bands[status->band];
2627 rate_control_rate_update(local, sband, rx->sta,
2628 IEEE80211_RC_BW_CHANGED);
2636 case WLAN_CATEGORY_PUBLIC:
2637 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2639 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2643 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2645 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2646 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2648 if (len < offsetof(struct ieee80211_mgmt,
2649 u.action.u.ext_chan_switch.variable))
2652 case WLAN_CATEGORY_VHT:
2653 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2654 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2655 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2656 sdata->vif.type != NL80211_IFTYPE_AP &&
2657 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2660 /* verify action code is present */
2661 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2664 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2665 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
2668 /* verify opmode is present */
2669 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2672 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
2674 ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2675 opmode, status->band,
2683 case WLAN_CATEGORY_BACK:
2684 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2685 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2686 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2687 sdata->vif.type != NL80211_IFTYPE_AP &&
2688 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2691 /* verify action_code is present */
2692 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2695 switch (mgmt->u.action.u.addba_req.action_code) {
2696 case WLAN_ACTION_ADDBA_REQ:
2697 if (len < (IEEE80211_MIN_ACTION_SIZE +
2698 sizeof(mgmt->u.action.u.addba_req)))
2701 case WLAN_ACTION_ADDBA_RESP:
2702 if (len < (IEEE80211_MIN_ACTION_SIZE +
2703 sizeof(mgmt->u.action.u.addba_resp)))
2706 case WLAN_ACTION_DELBA:
2707 if (len < (IEEE80211_MIN_ACTION_SIZE +
2708 sizeof(mgmt->u.action.u.delba)))
2716 case WLAN_CATEGORY_SPECTRUM_MGMT:
2717 /* verify action_code is present */
2718 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2721 switch (mgmt->u.action.u.measurement.action_code) {
2722 case WLAN_ACTION_SPCT_MSR_REQ:
2723 if (status->band != IEEE80211_BAND_5GHZ)
2726 if (len < (IEEE80211_MIN_ACTION_SIZE +
2727 sizeof(mgmt->u.action.u.measurement)))
2730 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2733 ieee80211_process_measurement_req(sdata, mgmt, len);
2735 case WLAN_ACTION_SPCT_CHL_SWITCH: {
2737 if (len < (IEEE80211_MIN_ACTION_SIZE +
2738 sizeof(mgmt->u.action.u.chan_switch)))
2741 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2742 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2743 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2746 if (sdata->vif.type == NL80211_IFTYPE_STATION)
2747 bssid = sdata->u.mgd.bssid;
2748 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2749 bssid = sdata->u.ibss.bssid;
2750 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
2755 if (!ether_addr_equal(mgmt->bssid, bssid))
2762 case WLAN_CATEGORY_SA_QUERY:
2763 if (len < (IEEE80211_MIN_ACTION_SIZE +
2764 sizeof(mgmt->u.action.u.sa_query)))
2767 switch (mgmt->u.action.u.sa_query.action) {
2768 case WLAN_ACTION_SA_QUERY_REQUEST:
2769 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2771 ieee80211_process_sa_query_req(sdata, mgmt, len);
2775 case WLAN_CATEGORY_SELF_PROTECTED:
2776 if (len < (IEEE80211_MIN_ACTION_SIZE +
2777 sizeof(mgmt->u.action.u.self_prot.action_code)))
2780 switch (mgmt->u.action.u.self_prot.action_code) {
2781 case WLAN_SP_MESH_PEERING_OPEN:
2782 case WLAN_SP_MESH_PEERING_CLOSE:
2783 case WLAN_SP_MESH_PEERING_CONFIRM:
2784 if (!ieee80211_vif_is_mesh(&sdata->vif))
2786 if (sdata->u.mesh.user_mpm)
2787 /* userspace handles this frame */
2790 case WLAN_SP_MGK_INFORM:
2791 case WLAN_SP_MGK_ACK:
2792 if (!ieee80211_vif_is_mesh(&sdata->vif))
2797 case WLAN_CATEGORY_MESH_ACTION:
2798 if (len < (IEEE80211_MIN_ACTION_SIZE +
2799 sizeof(mgmt->u.action.u.mesh_action.action_code)))
2802 if (!ieee80211_vif_is_mesh(&sdata->vif))
2804 if (mesh_action_is_path_sel(mgmt) &&
2805 !mesh_path_sel_is_hwmp(sdata))
2813 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2814 /* will return in the next handlers */
2819 rx->sta->rx_packets++;
2820 dev_kfree_skb(rx->skb);
2824 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2825 skb_queue_tail(&sdata->skb_queue, rx->skb);
2826 ieee80211_queue_work(&local->hw, &sdata->work);
2828 rx->sta->rx_packets++;
2832 static ieee80211_rx_result debug_noinline
2833 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2835 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2838 /* skip known-bad action frames and return them in the next handler */
2839 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2843 * Getting here means the kernel doesn't know how to handle
2844 * it, but maybe userspace does ... include returned frames
2845 * so userspace can register for those to know whether ones
2846 * it transmitted were processed or returned.
2849 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
2850 sig = status->signal;
2852 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2853 rx->skb->data, rx->skb->len, 0)) {
2855 rx->sta->rx_packets++;
2856 dev_kfree_skb(rx->skb);
2863 static ieee80211_rx_result debug_noinline
2864 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2866 struct ieee80211_local *local = rx->local;
2867 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2868 struct sk_buff *nskb;
2869 struct ieee80211_sub_if_data *sdata = rx->sdata;
2870 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2872 if (!ieee80211_is_action(mgmt->frame_control))
2876 * For AP mode, hostapd is responsible for handling any action
2877 * frames that we didn't handle, including returning unknown
2878 * ones. For all other modes we will return them to the sender,
2879 * setting the 0x80 bit in the action category, as required by
2880 * 802.11-2012 9.24.4.
2881 * Newer versions of hostapd shall also use the management frame
2882 * registration mechanisms, but older ones still use cooked
2883 * monitor interfaces so push all frames there.
2885 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2886 (sdata->vif.type == NL80211_IFTYPE_AP ||
2887 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2888 return RX_DROP_MONITOR;
2890 if (is_multicast_ether_addr(mgmt->da))
2891 return RX_DROP_MONITOR;
2893 /* do not return rejected action frames */
2894 if (mgmt->u.action.category & 0x80)
2895 return RX_DROP_UNUSABLE;
2897 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2900 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2902 nmgmt->u.action.category |= 0x80;
2903 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2904 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2906 memset(nskb->cb, 0, sizeof(nskb->cb));
2908 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
2909 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
2911 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
2912 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
2913 IEEE80211_TX_CTL_NO_CCK_RATE;
2914 if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
2916 local->hw.offchannel_tx_hw_queue;
2919 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
2922 dev_kfree_skb(rx->skb);
2926 static ieee80211_rx_result debug_noinline
2927 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2929 struct ieee80211_sub_if_data *sdata = rx->sdata;
2930 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2933 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2935 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2936 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2937 sdata->vif.type != NL80211_IFTYPE_OCB &&
2938 sdata->vif.type != NL80211_IFTYPE_STATION)
2939 return RX_DROP_MONITOR;
2942 case cpu_to_le16(IEEE80211_STYPE_AUTH):
2943 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2944 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2945 /* process for all: mesh, mlme, ibss */
2947 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
2948 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
2949 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2950 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2951 if (is_multicast_ether_addr(mgmt->da) &&
2952 !is_broadcast_ether_addr(mgmt->da))
2953 return RX_DROP_MONITOR;
2955 /* process only for station */
2956 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2957 return RX_DROP_MONITOR;
2959 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2960 /* process only for ibss and mesh */
2961 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2962 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2963 return RX_DROP_MONITOR;
2966 return RX_DROP_MONITOR;
2969 /* queue up frame and kick off work to process it */
2970 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2971 skb_queue_tail(&sdata->skb_queue, rx->skb);
2972 ieee80211_queue_work(&rx->local->hw, &sdata->work);
2974 rx->sta->rx_packets++;
2979 /* TODO: use IEEE80211_RX_FRAGMENTED */
2980 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2981 struct ieee80211_rate *rate)
2983 struct ieee80211_sub_if_data *sdata;
2984 struct ieee80211_local *local = rx->local;
2985 struct sk_buff *skb = rx->skb, *skb2;
2986 struct net_device *prev_dev = NULL;
2987 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2988 int needed_headroom;
2991 * If cooked monitor has been processed already, then
2992 * don't do it again. If not, set the flag.
2994 if (rx->flags & IEEE80211_RX_CMNTR)
2996 rx->flags |= IEEE80211_RX_CMNTR;
2998 /* If there are no cooked monitor interfaces, just free the SKB */
2999 if (!local->cooked_mntrs)
3002 /* vendor data is long removed here */
3003 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3004 /* room for the radiotap header based on driver features */
3005 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3007 if (skb_headroom(skb) < needed_headroom &&
3008 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3011 /* prepend radiotap information */
3012 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3015 skb_set_mac_header(skb, 0);
3016 skb->ip_summed = CHECKSUM_UNNECESSARY;
3017 skb->pkt_type = PACKET_OTHERHOST;
3018 skb->protocol = htons(ETH_P_802_2);
3020 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3021 if (!ieee80211_sdata_running(sdata))
3024 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3025 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
3029 skb2 = skb_clone(skb, GFP_ATOMIC);
3031 skb2->dev = prev_dev;
3032 netif_receive_skb(skb2);
3036 prev_dev = sdata->dev;
3037 sdata->dev->stats.rx_packets++;
3038 sdata->dev->stats.rx_bytes += skb->len;
3042 skb->dev = prev_dev;
3043 netif_receive_skb(skb);
3051 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3052 ieee80211_rx_result res)
3055 case RX_DROP_MONITOR:
3056 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3058 rx->sta->rx_dropped++;
3061 struct ieee80211_rate *rate = NULL;
3062 struct ieee80211_supported_band *sband;
3063 struct ieee80211_rx_status *status;
3065 status = IEEE80211_SKB_RXCB((rx->skb));
3067 sband = rx->local->hw.wiphy->bands[status->band];
3068 if (!(status->flag & RX_FLAG_HT) &&
3069 !(status->flag & RX_FLAG_VHT))
3070 rate = &sband->bitrates[status->rate_idx];
3072 ieee80211_rx_cooked_monitor(rx, rate);
3075 case RX_DROP_UNUSABLE:
3076 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3078 rx->sta->rx_dropped++;
3079 dev_kfree_skb(rx->skb);
3082 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3087 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3088 struct sk_buff_head *frames)
3090 ieee80211_rx_result res = RX_DROP_MONITOR;
3091 struct sk_buff *skb;
3093 #define CALL_RXH(rxh) \
3096 if (res != RX_CONTINUE) \
3100 spin_lock_bh(&rx->local->rx_path_lock);
3102 while ((skb = __skb_dequeue(frames))) {
3104 * all the other fields are valid across frames
3105 * that belong to an aMPDU since they are on the
3106 * same TID from the same station
3110 CALL_RXH(ieee80211_rx_h_check_more_data)
3111 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
3112 CALL_RXH(ieee80211_rx_h_sta_process)
3113 CALL_RXH(ieee80211_rx_h_decrypt)
3114 CALL_RXH(ieee80211_rx_h_defragment)
3115 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
3116 /* must be after MMIC verify so header is counted in MPDU mic */
3117 #ifdef CONFIG_MAC80211_MESH
3118 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3119 CALL_RXH(ieee80211_rx_h_mesh_fwding);
3121 CALL_RXH(ieee80211_rx_h_amsdu)
3122 CALL_RXH(ieee80211_rx_h_data)
3124 /* special treatment -- needs the queue */
3125 res = ieee80211_rx_h_ctrl(rx, frames);
3126 if (res != RX_CONTINUE)
3129 CALL_RXH(ieee80211_rx_h_mgmt_check)
3130 CALL_RXH(ieee80211_rx_h_action)
3131 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
3132 CALL_RXH(ieee80211_rx_h_action_return)
3133 CALL_RXH(ieee80211_rx_h_mgmt)
3136 ieee80211_rx_handlers_result(rx, res);
3141 spin_unlock_bh(&rx->local->rx_path_lock);
3144 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3146 struct sk_buff_head reorder_release;
3147 ieee80211_rx_result res = RX_DROP_MONITOR;
3149 __skb_queue_head_init(&reorder_release);
3151 #define CALL_RXH(rxh) \
3154 if (res != RX_CONTINUE) \
3158 CALL_RXH(ieee80211_rx_h_check_dup)
3159 CALL_RXH(ieee80211_rx_h_check)
3161 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3163 ieee80211_rx_handlers(rx, &reorder_release);
3167 ieee80211_rx_handlers_result(rx, res);
3173 * This function makes calls into the RX path, therefore
3174 * it has to be invoked under RCU read lock.
3176 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3178 struct sk_buff_head frames;
3179 struct ieee80211_rx_data rx = {
3181 .sdata = sta->sdata,
3182 .local = sta->local,
3183 /* This is OK -- must be QoS data frame */
3184 .security_idx = tid,
3188 struct tid_ampdu_rx *tid_agg_rx;
3190 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3194 __skb_queue_head_init(&frames);
3196 spin_lock(&tid_agg_rx->reorder_lock);
3197 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3198 spin_unlock(&tid_agg_rx->reorder_lock);
3200 ieee80211_rx_handlers(&rx, &frames);
3203 /* main receive path */
3205 static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
3206 struct ieee80211_hdr *hdr)
3208 struct ieee80211_sub_if_data *sdata = rx->sdata;
3209 struct sk_buff *skb = rx->skb;
3210 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3211 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3212 int multicast = is_multicast_ether_addr(hdr->addr1);
3214 switch (sdata->vif.type) {
3215 case NL80211_IFTYPE_STATION:
3216 if (!bssid && !sdata->u.mgd.use_4addr)
3219 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3220 if (!(sdata->dev->flags & IFF_PROMISC) ||
3221 sdata->u.mgd.use_4addr)
3223 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3226 case NL80211_IFTYPE_ADHOC:
3229 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3230 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3232 if (ieee80211_is_beacon(hdr->frame_control)) {
3234 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
3236 } else if (!multicast &&
3237 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3238 if (!(sdata->dev->flags & IFF_PROMISC))
3240 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3241 } else if (!rx->sta) {
3243 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3244 rate_idx = 0; /* TODO: HT/VHT rates */
3246 rate_idx = status->rate_idx;
3247 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3251 case NL80211_IFTYPE_OCB:
3254 if (ieee80211_is_beacon(hdr->frame_control)) {
3256 } else if (!is_broadcast_ether_addr(bssid)) {
3257 ocb_dbg(sdata, "BSSID mismatch in OCB mode!\n");
3259 } else if (!multicast &&
3260 !ether_addr_equal(sdata->dev->dev_addr,
3262 /* if we are in promisc mode we also accept
3263 * packets not destined for us
3265 if (!(sdata->dev->flags & IFF_PROMISC))
3267 rx->flags &= ~IEEE80211_RX_RA_MATCH;
3268 } else if (!rx->sta) {
3270 if (status->flag & RX_FLAG_HT)
3271 rate_idx = 0; /* TODO: HT rates */
3273 rate_idx = status->rate_idx;
3274 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3278 case NL80211_IFTYPE_MESH_POINT:
3280 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3281 if (!(sdata->dev->flags & IFF_PROMISC))
3284 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3287 case NL80211_IFTYPE_AP_VLAN:
3288 case NL80211_IFTYPE_AP:
3290 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
3292 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3294 * Accept public action frames even when the
3295 * BSSID doesn't match, this is used for P2P
3296 * and location updates. Note that mac80211
3297 * itself never looks at these frames.
3300 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3302 if (ieee80211_is_public_action(hdr, skb->len))
3304 if (!ieee80211_is_beacon(hdr->frame_control))
3306 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3307 } else if (!ieee80211_has_tods(hdr->frame_control)) {
3308 /* ignore data frames to TDLS-peers */
3309 if (ieee80211_is_data(hdr->frame_control))
3311 /* ignore action frames to TDLS-peers */
3312 if (ieee80211_is_action(hdr->frame_control) &&
3313 !ether_addr_equal(bssid, hdr->addr1))
3317 case NL80211_IFTYPE_WDS:
3318 if (bssid || !ieee80211_is_data(hdr->frame_control))
3320 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
3323 case NL80211_IFTYPE_P2P_DEVICE:
3324 if (!ieee80211_is_public_action(hdr, skb->len) &&
3325 !ieee80211_is_probe_req(hdr->frame_control) &&
3326 !ieee80211_is_probe_resp(hdr->frame_control) &&
3327 !ieee80211_is_beacon(hdr->frame_control))
3329 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
3331 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3334 /* should never get here */
3343 * This function returns whether or not the SKB
3344 * was destined for RX processing or not, which,
3345 * if consume is true, is equivalent to whether
3346 * or not the skb was consumed.
3348 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
3349 struct sk_buff *skb, bool consume)
3351 struct ieee80211_local *local = rx->local;
3352 struct ieee80211_sub_if_data *sdata = rx->sdata;
3353 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3354 struct ieee80211_hdr *hdr = (void *)skb->data;
3357 status->rx_flags |= IEEE80211_RX_RA_MATCH;
3359 if (!prepare_for_handlers(rx, hdr))
3363 skb = skb_copy(skb, GFP_ATOMIC);
3365 if (net_ratelimit())
3366 wiphy_debug(local->hw.wiphy,
3367 "failed to copy skb for %s\n",
3375 ieee80211_invoke_rx_handlers(rx);
3380 * This is the actual Rx frames handler. as it belongs to Rx path it must
3381 * be called with rcu_read_lock protection.
3383 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3384 struct sk_buff *skb)
3386 struct ieee80211_local *local = hw_to_local(hw);
3387 struct ieee80211_sub_if_data *sdata;
3388 struct ieee80211_hdr *hdr;
3390 struct ieee80211_rx_data rx;
3391 struct ieee80211_sub_if_data *prev;
3392 struct sta_info *sta, *tmp, *prev_sta;
3395 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3396 memset(&rx, 0, sizeof(rx));
3400 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3401 local->dot11ReceivedFragmentCount++;
3403 if (ieee80211_is_mgmt(fc)) {
3404 /* drop frame if too short for header */
3405 if (skb->len < ieee80211_hdrlen(fc))
3408 err = skb_linearize(skb);
3410 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3418 hdr = (struct ieee80211_hdr *)skb->data;
3419 ieee80211_parse_qos(&rx);
3420 ieee80211_verify_alignment(&rx);
3422 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
3423 ieee80211_is_beacon(hdr->frame_control)))
3424 ieee80211_scan_rx(local, skb);
3426 if (ieee80211_is_data(fc)) {
3429 for_each_sta_info(local, hdr->addr2, sta, tmp) {
3436 rx.sdata = prev_sta->sdata;
3437 ieee80211_prepare_and_rx_handle(&rx, skb, false);
3444 rx.sdata = prev_sta->sdata;
3446 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3454 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3455 if (!ieee80211_sdata_running(sdata))
3458 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
3459 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3463 * frame is destined for this interface, but if it's
3464 * not also for the previous one we handle that after
3465 * the loop to avoid copying the SKB once too much
3473 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3475 ieee80211_prepare_and_rx_handle(&rx, skb, false);
3481 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3484 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3493 * This is the receive path handler. It is called by a low level driver when an
3494 * 802.11 MPDU is received from the hardware.
3496 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
3498 struct ieee80211_local *local = hw_to_local(hw);
3499 struct ieee80211_rate *rate = NULL;
3500 struct ieee80211_supported_band *sband;
3501 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3503 WARN_ON_ONCE(softirq_count() == 0);
3505 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
3508 sband = local->hw.wiphy->bands[status->band];
3509 if (WARN_ON(!sband))
3513 * If we're suspending, it is possible although not too likely
3514 * that we'd be receiving frames after having already partially
3515 * quiesced the stack. We can't process such frames then since
3516 * that might, for example, cause stations to be added or other
3517 * driver callbacks be invoked.
3519 if (unlikely(local->quiescing || local->suspended))
3522 /* We might be during a HW reconfig, prevent Rx for the same reason */
3523 if (unlikely(local->in_reconfig))
3527 * The same happens when we're not even started,
3528 * but that's worth a warning.
3530 if (WARN_ON(!local->started))
3533 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3535 * Validate the rate, unless a PLCP error means that
3536 * we probably can't have a valid rate here anyway.
3539 if (status->flag & RX_FLAG_HT) {
3541 * rate_idx is MCS index, which can be [0-76]
3544 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
3546 * Anything else would be some sort of driver or
3547 * hardware error. The driver should catch hardware
3550 if (WARN(status->rate_idx > 76,
3551 "Rate marked as an HT rate but passed "
3552 "status->rate_idx is not "
3553 "an MCS index [0-76]: %d (0x%02x)\n",
3557 } else if (status->flag & RX_FLAG_VHT) {
3558 if (WARN_ONCE(status->rate_idx > 9 ||
3560 status->vht_nss > 8,
3561 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
3562 status->rate_idx, status->vht_nss))
3565 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3567 rate = &sband->bitrates[status->rate_idx];
3571 status->rx_flags = 0;
3574 * key references and virtual interfaces are protected using RCU
3575 * and this requires that we are in a read-side RCU section during
3576 * receive processing
3581 * Frames with failed FCS/PLCP checksum are not returned,
3582 * all other frames are returned without radiotap header
3583 * if it was previously present.
3584 * Also, frames with less than 16 bytes are dropped.
3586 skb = ieee80211_rx_monitor(local, skb, rate);
3592 ieee80211_tpt_led_trig_rx(local,
3593 ((struct ieee80211_hdr *)skb->data)->frame_control,
3595 __ieee80211_rx_handle_packet(hw, skb);
3603 EXPORT_SYMBOL(ieee80211_rx);
3605 /* This is a version of the rx handler that can be called from hard irq
3606 * context. Post the skb on the queue and schedule the tasklet */
3607 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3609 struct ieee80211_local *local = hw_to_local(hw);
3611 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
3613 skb->pkt_type = IEEE80211_RX_MSG;
3614 skb_queue_tail(&local->skb_queue, skb);
3615 tasklet_schedule(&local->tasklet);
3617 EXPORT_SYMBOL(ieee80211_rx_irqsafe);