1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Original code based Host AP (software wireless LAN access point) driver 4 * for Intersil Prism2/2.5/3 - hostap.o module, common routines 5 * 6 * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen 7 * <jkmaline@cc.hut.fi> 8 * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi> 9 * Copyright (c) 2004, Intel Corporation 10 * 11 * Few modifications for Realtek's Wi-Fi drivers by 12 * Andrea Merello <andrea.merello@gmail.com> 13 * 14 * A special thanks goes to Realtek for their support ! 15 */ 16 #include <linux/compiler.h> 17 #include <linux/errno.h> 18 #include <linux/if_arp.h> 19 #include <linux/in6.h> 20 #include <linux/in.h> 21 #include <linux/ip.h> 22 #include <linux/kernel.h> 23 #include <linux/module.h> 24 #include <linux/netdevice.h> 25 #include <linux/pci.h> 26 #include <linux/proc_fs.h> 27 #include <linux/skbuff.h> 28 #include <linux/slab.h> 29 #include <linux/tcp.h> 30 #include <linux/types.h> 31 #include <linux/wireless.h> 32 #include <linux/etherdevice.h> 33 #include <linux/uaccess.h> 34 #include <linux/ctype.h> 35 36 #include "rtllib.h" 37 #include "dot11d.h" 38 39 static void rtllib_rx_mgt(struct rtllib_device *ieee, struct sk_buff *skb, 40 struct rtllib_rx_stats *stats); 41 42 static inline void rtllib_monitor_rx(struct rtllib_device *ieee, 43 struct sk_buff *skb, 44 struct rtllib_rx_stats *rx_status, 45 size_t hdr_length) 46 { 47 skb->dev = ieee->dev; 48 skb_reset_mac_header(skb); 49 skb_pull(skb, hdr_length); 50 skb->pkt_type = PACKET_OTHERHOST; 51 skb->protocol = htons(ETH_P_80211_RAW); 52 memset(skb->cb, 0, sizeof(skb->cb)); 53 netif_rx(skb); 54 } 55 56 /* Called only as a tasklet (software IRQ) */ 57 static struct rtllib_frag_entry * 58 rtllib_frag_cache_find(struct rtllib_device *ieee, unsigned int seq, 59 unsigned int frag, u8 tid, u8 *src, u8 *dst) 60 { 61 struct rtllib_frag_entry *entry; 62 int i; 63 64 for (i = 0; i < RTLLIB_FRAG_CACHE_LEN; i++) { 65 entry = &ieee->frag_cache[tid][i]; 66 if (entry->skb != NULL && 67 time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 68 netdev_dbg(ieee->dev, 69 "expiring fragment cache entry seq=%u last_frag=%u\n", 70 entry->seq, entry->last_frag); 71 dev_kfree_skb_any(entry->skb); 72 entry->skb = NULL; 73 } 74 75 if (entry->skb != NULL && entry->seq == seq && 76 (entry->last_frag + 1 == frag || frag == -1) && 77 memcmp(entry->src_addr, src, ETH_ALEN) == 0 && 78 memcmp(entry->dst_addr, dst, ETH_ALEN) == 0) 79 return entry; 80 } 81 82 return NULL; 83 } 84 85 /* Called only as a tasklet (software IRQ) */ 86 static struct sk_buff * 87 rtllib_frag_cache_get(struct rtllib_device *ieee, 88 struct rtllib_hdr_4addr *hdr) 89 { 90 struct sk_buff *skb = NULL; 91 u16 fc = le16_to_cpu(hdr->frame_ctl); 92 u16 sc = le16_to_cpu(hdr->seq_ctl); 93 unsigned int frag = WLAN_GET_SEQ_FRAG(sc); 94 unsigned int seq = WLAN_GET_SEQ_SEQ(sc); 95 struct rtllib_frag_entry *entry; 96 struct rtllib_hdr_3addrqos *hdr_3addrqos; 97 struct rtllib_hdr_4addrqos *hdr_4addrqos; 98 u8 tid; 99 100 if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) && 101 RTLLIB_QOS_HAS_SEQ(fc)) { 102 hdr_4addrqos = (struct rtllib_hdr_4addrqos *)hdr; 103 tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID; 104 tid = UP2AC(tid); 105 tid++; 106 } else if (RTLLIB_QOS_HAS_SEQ(fc)) { 107 hdr_3addrqos = (struct rtllib_hdr_3addrqos *)hdr; 108 tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID; 109 tid = UP2AC(tid); 110 tid++; 111 } else { 112 tid = 0; 113 } 114 115 if (frag == 0) { 116 /* Reserve enough space to fit maximum frame length */ 117 skb = dev_alloc_skb(ieee->dev->mtu + 118 sizeof(struct rtllib_hdr_4addr) + 119 8 /* LLC */ + 120 2 /* alignment */ + 121 8 /* WEP */ + 122 ETH_ALEN /* WDS */ + 123 /* QOS Control */ 124 (RTLLIB_QOS_HAS_SEQ(fc) ? 2 : 0)); 125 if (!skb) 126 return NULL; 127 128 entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]]; 129 ieee->frag_next_idx[tid]++; 130 if (ieee->frag_next_idx[tid] >= RTLLIB_FRAG_CACHE_LEN) 131 ieee->frag_next_idx[tid] = 0; 132 133 if (entry->skb != NULL) 134 dev_kfree_skb_any(entry->skb); 135 136 entry->first_frag_time = jiffies; 137 entry->seq = seq; 138 entry->last_frag = frag; 139 entry->skb = skb; 140 ether_addr_copy(entry->src_addr, hdr->addr2); 141 ether_addr_copy(entry->dst_addr, hdr->addr1); 142 } else { 143 /* received a fragment of a frame for which the head fragment 144 * should have already been received 145 */ 146 entry = rtllib_frag_cache_find(ieee, seq, frag, tid, hdr->addr2, 147 hdr->addr1); 148 if (entry != NULL) { 149 entry->last_frag = frag; 150 skb = entry->skb; 151 } 152 } 153 154 return skb; 155 } 156 157 /* Called only as a tasklet (software IRQ) */ 158 static int rtllib_frag_cache_invalidate(struct rtllib_device *ieee, 159 struct rtllib_hdr_4addr *hdr) 160 { 161 u16 fc = le16_to_cpu(hdr->frame_ctl); 162 u16 sc = le16_to_cpu(hdr->seq_ctl); 163 unsigned int seq = WLAN_GET_SEQ_SEQ(sc); 164 struct rtllib_frag_entry *entry; 165 struct rtllib_hdr_3addrqos *hdr_3addrqos; 166 struct rtllib_hdr_4addrqos *hdr_4addrqos; 167 u8 tid; 168 169 if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) && 170 RTLLIB_QOS_HAS_SEQ(fc)) { 171 hdr_4addrqos = (struct rtllib_hdr_4addrqos *)hdr; 172 tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID; 173 tid = UP2AC(tid); 174 tid++; 175 } else if (RTLLIB_QOS_HAS_SEQ(fc)) { 176 hdr_3addrqos = (struct rtllib_hdr_3addrqos *)hdr; 177 tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID; 178 tid = UP2AC(tid); 179 tid++; 180 } else { 181 tid = 0; 182 } 183 184 entry = rtllib_frag_cache_find(ieee, seq, -1, tid, hdr->addr2, 185 hdr->addr1); 186 187 if (entry == NULL) { 188 netdev_dbg(ieee->dev, 189 "Couldn't invalidate fragment cache entry (seq=%u)\n", 190 seq); 191 return -1; 192 } 193 194 entry->skb = NULL; 195 return 0; 196 } 197 198 /* rtllib_rx_frame_mgtmt 199 * 200 * Responsible for handling management control frames 201 * 202 * Called by rtllib_rx 203 */ 204 static inline int 205 rtllib_rx_frame_mgmt(struct rtllib_device *ieee, struct sk_buff *skb, 206 struct rtllib_rx_stats *rx_stats, u16 type, 207 u16 stype) 208 { 209 /* On the struct stats definition there is written that 210 * this is not mandatory.... but seems that the probe 211 * response parser uses it 212 */ 213 struct rtllib_hdr_3addr *hdr = (struct rtllib_hdr_3addr *)skb->data; 214 215 rx_stats->len = skb->len; 216 rtllib_rx_mgt(ieee, skb, rx_stats); 217 if ((memcmp(hdr->addr1, ieee->dev->dev_addr, ETH_ALEN))) { 218 dev_kfree_skb_any(skb); 219 return 0; 220 } 221 rtllib_rx_frame_softmac(ieee, skb, rx_stats, type, stype); 222 223 dev_kfree_skb_any(skb); 224 225 return 0; 226 } 227 228 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation 229 * Ethernet-II snap header (RFC1042 for most EtherTypes) 230 */ 231 static unsigned char rfc1042_header[] = { 232 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 233 }; 234 235 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */ 236 static unsigned char bridge_tunnel_header[] = { 237 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 238 }; 239 240 /* No encapsulation header if EtherType < 0x600 (=length) */ 241 242 /* Called by rtllib_rx_frame_decrypt */ 243 static int rtllib_is_eapol_frame(struct rtllib_device *ieee, 244 struct sk_buff *skb, size_t hdrlen) 245 { 246 struct net_device *dev = ieee->dev; 247 u16 fc, ethertype; 248 struct rtllib_hdr_4addr *hdr; 249 u8 *pos; 250 251 if (skb->len < 24) 252 return 0; 253 254 hdr = (struct rtllib_hdr_4addr *)skb->data; 255 fc = le16_to_cpu(hdr->frame_ctl); 256 257 /* check that the frame is unicast frame to us */ 258 if ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) == 259 RTLLIB_FCTL_TODS && 260 memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 && 261 memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) { 262 /* ToDS frame with own addr BSSID and DA */ 263 } else if ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) == 264 RTLLIB_FCTL_FROMDS && 265 memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) { 266 /* FromDS frame with own addr as DA */ 267 } else 268 return 0; 269 270 if (skb->len < 24 + 8) 271 return 0; 272 273 /* check for port access entity Ethernet type */ 274 pos = skb->data + hdrlen; 275 ethertype = (pos[6] << 8) | pos[7]; 276 if (ethertype == ETH_P_PAE) 277 return 1; 278 279 return 0; 280 } 281 282 /* Called only as a tasklet (software IRQ), by rtllib_rx */ 283 static inline int 284 rtllib_rx_frame_decrypt(struct rtllib_device *ieee, struct sk_buff *skb, 285 struct lib80211_crypt_data *crypt) 286 { 287 struct rtllib_hdr_4addr *hdr; 288 int res, hdrlen; 289 290 if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL) 291 return 0; 292 293 if (ieee->hwsec_active) { 294 struct cb_desc *tcb_desc = (struct cb_desc *) 295 (skb->cb + MAX_DEV_ADDR_SIZE); 296 297 tcb_desc->bHwSec = 1; 298 299 if (ieee->need_sw_enc) 300 tcb_desc->bHwSec = 0; 301 } 302 303 hdr = (struct rtllib_hdr_4addr *)skb->data; 304 hdrlen = rtllib_get_hdrlen(le16_to_cpu(hdr->frame_ctl)); 305 306 atomic_inc(&crypt->refcnt); 307 res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv); 308 atomic_dec(&crypt->refcnt); 309 if (res < 0) { 310 netdev_dbg(ieee->dev, "decryption failed (SA= %pM) res=%d\n", 311 hdr->addr2, res); 312 if (res == -2) 313 netdev_dbg(ieee->dev, 314 "Decryption failed ICV mismatch (key %d)\n", 315 skb->data[hdrlen + 3] >> 6); 316 return -1; 317 } 318 319 return res; 320 } 321 322 /* Called only as a tasklet (software IRQ), by rtllib_rx */ 323 static inline int 324 rtllib_rx_frame_decrypt_msdu(struct rtllib_device *ieee, struct sk_buff *skb, 325 int keyidx, struct lib80211_crypt_data *crypt) 326 { 327 struct rtllib_hdr_4addr *hdr; 328 int res, hdrlen; 329 330 if (crypt == NULL || crypt->ops->decrypt_msdu == NULL) 331 return 0; 332 if (ieee->hwsec_active) { 333 struct cb_desc *tcb_desc = (struct cb_desc *) 334 (skb->cb + MAX_DEV_ADDR_SIZE); 335 336 tcb_desc->bHwSec = 1; 337 338 if (ieee->need_sw_enc) 339 tcb_desc->bHwSec = 0; 340 } 341 342 hdr = (struct rtllib_hdr_4addr *)skb->data; 343 hdrlen = rtllib_get_hdrlen(le16_to_cpu(hdr->frame_ctl)); 344 345 atomic_inc(&crypt->refcnt); 346 res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv); 347 atomic_dec(&crypt->refcnt); 348 if (res < 0) { 349 netdev_dbg(ieee->dev, 350 "MSDU decryption/MIC verification failed (SA= %pM keyidx=%d)\n", 351 hdr->addr2, keyidx); 352 return -1; 353 } 354 355 return 0; 356 } 357 358 /* this function is stolen from ipw2200 driver*/ 359 #define IEEE_PACKET_RETRY_TIME (5 * HZ) 360 static int is_duplicate_packet(struct rtllib_device *ieee, 361 struct rtllib_hdr_4addr *header) 362 { 363 u16 fc = le16_to_cpu(header->frame_ctl); 364 u16 sc = le16_to_cpu(header->seq_ctl); 365 u16 seq = WLAN_GET_SEQ_SEQ(sc); 366 u16 frag = WLAN_GET_SEQ_FRAG(sc); 367 u16 *last_seq, *last_frag; 368 unsigned long *last_time; 369 struct rtllib_hdr_3addrqos *hdr_3addrqos; 370 struct rtllib_hdr_4addrqos *hdr_4addrqos; 371 u8 tid; 372 373 if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) && 374 RTLLIB_QOS_HAS_SEQ(fc)) { 375 hdr_4addrqos = (struct rtllib_hdr_4addrqos *)header; 376 tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID; 377 tid = UP2AC(tid); 378 tid++; 379 } else if (RTLLIB_QOS_HAS_SEQ(fc)) { 380 hdr_3addrqos = (struct rtllib_hdr_3addrqos *)header; 381 tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID; 382 tid = UP2AC(tid); 383 tid++; 384 } else { 385 tid = 0; 386 } 387 388 switch (ieee->iw_mode) { 389 case IW_MODE_ADHOC: 390 { 391 struct list_head *p; 392 struct ieee_ibss_seq *entry = NULL; 393 u8 *mac = header->addr2; 394 int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE; 395 396 list_for_each(p, &ieee->ibss_mac_hash[index]) { 397 entry = list_entry(p, struct ieee_ibss_seq, list); 398 if (!memcmp(entry->mac, mac, ETH_ALEN)) 399 break; 400 } 401 if (p == &ieee->ibss_mac_hash[index]) { 402 entry = kmalloc(sizeof(struct ieee_ibss_seq), 403 GFP_ATOMIC); 404 if (!entry) 405 return 0; 406 407 ether_addr_copy(entry->mac, mac); 408 entry->seq_num[tid] = seq; 409 entry->frag_num[tid] = frag; 410 entry->packet_time[tid] = jiffies; 411 list_add(&entry->list, &ieee->ibss_mac_hash[index]); 412 return 0; 413 } 414 last_seq = &entry->seq_num[tid]; 415 last_frag = &entry->frag_num[tid]; 416 last_time = &entry->packet_time[tid]; 417 break; 418 } 419 420 case IW_MODE_INFRA: 421 last_seq = &ieee->last_rxseq_num[tid]; 422 last_frag = &ieee->last_rxfrag_num[tid]; 423 last_time = &ieee->last_packet_time[tid]; 424 break; 425 default: 426 return 0; 427 } 428 429 if ((*last_seq == seq) && 430 time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) { 431 if (*last_frag == frag) 432 goto drop; 433 if (*last_frag + 1 != frag) 434 /* out-of-order fragment */ 435 goto drop; 436 } else 437 *last_seq = seq; 438 439 *last_frag = frag; 440 *last_time = jiffies; 441 return 0; 442 443 drop: 444 445 return 1; 446 } 447 448 static bool AddReorderEntry(struct rx_ts_record *pTS, 449 struct rx_reorder_entry *pReorderEntry) 450 { 451 struct list_head *pList = &pTS->rx_pending_pkt_list; 452 453 while (pList->next != &pTS->rx_pending_pkt_list) { 454 if (SN_LESS(pReorderEntry->SeqNum, ((struct rx_reorder_entry *) 455 list_entry(pList->next, struct rx_reorder_entry, 456 List))->SeqNum)) 457 pList = pList->next; 458 else if (SN_EQUAL(pReorderEntry->SeqNum, 459 ((struct rx_reorder_entry *)list_entry(pList->next, 460 struct rx_reorder_entry, List))->SeqNum)) 461 return false; 462 else 463 break; 464 } 465 pReorderEntry->List.next = pList->next; 466 pReorderEntry->List.next->prev = &pReorderEntry->List; 467 pReorderEntry->List.prev = pList; 468 pList->next = &pReorderEntry->List; 469 470 return true; 471 } 472 473 void rtllib_indicate_packets(struct rtllib_device *ieee, 474 struct rtllib_rxb **prxbIndicateArray, u8 index) 475 { 476 struct net_device_stats *stats = &ieee->stats; 477 u8 i = 0, j = 0; 478 u16 ethertype; 479 480 for (j = 0; j < index; j++) { 481 struct rtllib_rxb *prxb = prxbIndicateArray[j]; 482 483 for (i = 0; i < prxb->nr_subframes; i++) { 484 struct sk_buff *sub_skb = prxb->subframes[i]; 485 486 /* convert hdr + possible LLC headers into Ethernet header */ 487 ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7]; 488 if (sub_skb->len >= 8 && 489 ((memcmp(sub_skb->data, rfc1042_header, 490 SNAP_SIZE) == 0 && 491 ethertype != ETH_P_AARP && 492 ethertype != ETH_P_IPX) || 493 memcmp(sub_skb->data, bridge_tunnel_header, 494 SNAP_SIZE) == 0)) { 495 /* remove RFC1042 or Bridge-Tunnel encapsulation 496 * and replace EtherType 497 */ 498 skb_pull(sub_skb, SNAP_SIZE); 499 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN); 500 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN); 501 } else { 502 u16 len; 503 /* Leave Ethernet header part of hdr and full payload */ 504 len = sub_skb->len; 505 memcpy(skb_push(sub_skb, 2), &len, 2); 506 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN); 507 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN); 508 } 509 510 /* Indicate the packets to upper layer */ 511 if (sub_skb) { 512 stats->rx_packets++; 513 stats->rx_bytes += sub_skb->len; 514 515 memset(sub_skb->cb, 0, sizeof(sub_skb->cb)); 516 sub_skb->protocol = eth_type_trans(sub_skb, 517 ieee->dev); 518 sub_skb->dev = ieee->dev; 519 sub_skb->dev->stats.rx_packets++; 520 sub_skb->dev->stats.rx_bytes += sub_skb->len; 521 /* 802.11 crc not sufficient */ 522 sub_skb->ip_summed = CHECKSUM_NONE; 523 ieee->last_rx_ps_time = jiffies; 524 netif_rx(sub_skb); 525 } 526 } 527 kfree(prxb); 528 prxb = NULL; 529 } 530 } 531 532 void rtllib_FlushRxTsPendingPkts(struct rtllib_device *ieee, 533 struct rx_ts_record *pTS) 534 { 535 struct rx_reorder_entry *pRxReorderEntry; 536 u8 RfdCnt = 0; 537 538 del_timer_sync(&pTS->rx_pkt_pending_timer); 539 while (!list_empty(&pTS->rx_pending_pkt_list)) { 540 if (RfdCnt >= REORDER_WIN_SIZE) { 541 netdev_info(ieee->dev, 542 "-------------->%s() error! RfdCnt >= REORDER_WIN_SIZE\n", 543 __func__); 544 break; 545 } 546 547 pRxReorderEntry = (struct rx_reorder_entry *) 548 list_entry(pTS->rx_pending_pkt_list.prev, 549 struct rx_reorder_entry, List); 550 netdev_dbg(ieee->dev, "%s(): Indicate SeqNum %d!\n", __func__, 551 pRxReorderEntry->SeqNum); 552 list_del_init(&pRxReorderEntry->List); 553 554 ieee->RfdArray[RfdCnt] = pRxReorderEntry->prxb; 555 556 RfdCnt = RfdCnt + 1; 557 list_add_tail(&pRxReorderEntry->List, 558 &ieee->RxReorder_Unused_List); 559 } 560 rtllib_indicate_packets(ieee, ieee->RfdArray, RfdCnt); 561 562 pTS->rx_indicate_seq = 0xffff; 563 } 564 565 static void RxReorderIndicatePacket(struct rtllib_device *ieee, 566 struct rtllib_rxb *prxb, 567 struct rx_ts_record *pTS, u16 SeqNum) 568 { 569 struct rt_hi_throughput *ht_info = ieee->ht_info; 570 struct rx_reorder_entry *pReorderEntry = NULL; 571 u8 WinSize = ht_info->rx_reorder_win_size; 572 u16 WinEnd = 0; 573 u8 index = 0; 574 bool bMatchWinStart = false, bPktInBuf = false; 575 unsigned long flags; 576 577 netdev_dbg(ieee->dev, 578 "%s(): Seq is %d, pTS->rx_indicate_seq is %d, WinSize is %d\n", 579 __func__, SeqNum, pTS->rx_indicate_seq, WinSize); 580 581 spin_lock_irqsave(&(ieee->reorder_spinlock), flags); 582 583 WinEnd = (pTS->rx_indicate_seq + WinSize - 1) % 4096; 584 /* Rx Reorder initialize condition.*/ 585 if (pTS->rx_indicate_seq == 0xffff) 586 pTS->rx_indicate_seq = SeqNum; 587 588 /* Drop out the packet which SeqNum is smaller than WinStart */ 589 if (SN_LESS(SeqNum, pTS->rx_indicate_seq)) { 590 netdev_dbg(ieee->dev, 591 "Packet Drop! IndicateSeq: %d, NewSeq: %d\n", 592 pTS->rx_indicate_seq, SeqNum); 593 ht_info->rx_reorder_drop_counter++; 594 { 595 int i; 596 597 for (i = 0; i < prxb->nr_subframes; i++) 598 dev_kfree_skb(prxb->subframes[i]); 599 kfree(prxb); 600 prxb = NULL; 601 } 602 spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags); 603 return; 604 } 605 606 /* Sliding window manipulation. Conditions includes: 607 * 1. Incoming SeqNum is equal to WinStart =>Window shift 1 608 * 2. Incoming SeqNum is larger than the WinEnd => Window shift N 609 */ 610 if (SN_EQUAL(SeqNum, pTS->rx_indicate_seq)) { 611 pTS->rx_indicate_seq = (pTS->rx_indicate_seq + 1) % 4096; 612 bMatchWinStart = true; 613 } else if (SN_LESS(WinEnd, SeqNum)) { 614 if (SeqNum >= (WinSize - 1)) 615 pTS->rx_indicate_seq = SeqNum + 1 - WinSize; 616 else 617 pTS->rx_indicate_seq = 4095 - 618 (WinSize - (SeqNum + 1)) + 1; 619 netdev_dbg(ieee->dev, 620 "Window Shift! IndicateSeq: %d, NewSeq: %d\n", 621 pTS->rx_indicate_seq, SeqNum); 622 } 623 624 /* Indication process. 625 * After Packet dropping and Sliding Window shifting as above, we can 626 * now just indicate the packets with the SeqNum smaller than latest 627 * WinStart and struct buffer other packets. 628 * 629 * For Rx Reorder condition: 630 * 1. All packets with SeqNum smaller than WinStart => Indicate 631 * 2. All packets with SeqNum larger than or equal to 632 * WinStart => Buffer it. 633 */ 634 if (bMatchWinStart) { 635 /* Current packet is going to be indicated.*/ 636 netdev_dbg(ieee->dev, 637 "Packets indication! IndicateSeq: %d, NewSeq: %d\n", 638 pTS->rx_indicate_seq, SeqNum); 639 ieee->prxbIndicateArray[0] = prxb; 640 index = 1; 641 } else { 642 /* Current packet is going to be inserted into pending list.*/ 643 if (!list_empty(&ieee->RxReorder_Unused_List)) { 644 pReorderEntry = (struct rx_reorder_entry *) 645 list_entry(ieee->RxReorder_Unused_List.next, 646 struct rx_reorder_entry, List); 647 list_del_init(&pReorderEntry->List); 648 649 /* Make a reorder entry and insert 650 * into a the packet list. 651 */ 652 pReorderEntry->SeqNum = SeqNum; 653 pReorderEntry->prxb = prxb; 654 655 if (!AddReorderEntry(pTS, pReorderEntry)) { 656 int i; 657 658 netdev_dbg(ieee->dev, 659 "%s(): Duplicate packet is dropped. IndicateSeq: %d, NewSeq: %d\n", 660 __func__, pTS->rx_indicate_seq, 661 SeqNum); 662 list_add_tail(&pReorderEntry->List, 663 &ieee->RxReorder_Unused_List); 664 665 for (i = 0; i < prxb->nr_subframes; i++) 666 dev_kfree_skb(prxb->subframes[i]); 667 kfree(prxb); 668 prxb = NULL; 669 } else { 670 netdev_dbg(ieee->dev, 671 "Pkt insert into struct buffer. IndicateSeq: %d, NewSeq: %d\n", 672 pTS->rx_indicate_seq, SeqNum); 673 } 674 } else { 675 /* Packets are dropped if there are not enough reorder 676 * entries. This part should be modified!! We can just 677 * indicate all the packets in struct buffer and get 678 * reorder entries. 679 */ 680 netdev_err(ieee->dev, 681 "%s(): There is no reorder entry! Packet is dropped!\n", 682 __func__); 683 { 684 int i; 685 686 for (i = 0; i < prxb->nr_subframes; i++) 687 dev_kfree_skb(prxb->subframes[i]); 688 kfree(prxb); 689 prxb = NULL; 690 } 691 } 692 } 693 694 /* Check if there is any packet need indicate.*/ 695 while (!list_empty(&pTS->rx_pending_pkt_list)) { 696 netdev_dbg(ieee->dev, "%s(): start RREORDER indicate\n", 697 __func__); 698 699 pReorderEntry = (struct rx_reorder_entry *) 700 list_entry(pTS->rx_pending_pkt_list.prev, 701 struct rx_reorder_entry, 702 List); 703 if (SN_LESS(pReorderEntry->SeqNum, pTS->rx_indicate_seq) || 704 SN_EQUAL(pReorderEntry->SeqNum, pTS->rx_indicate_seq)) { 705 /* This protect struct buffer from overflow. */ 706 if (index >= REORDER_WIN_SIZE) { 707 netdev_err(ieee->dev, 708 "%s(): Buffer overflow!\n", 709 __func__); 710 bPktInBuf = true; 711 break; 712 } 713 714 list_del_init(&pReorderEntry->List); 715 716 if (SN_EQUAL(pReorderEntry->SeqNum, pTS->rx_indicate_seq)) 717 pTS->rx_indicate_seq = (pTS->rx_indicate_seq + 1) % 718 4096; 719 720 ieee->prxbIndicateArray[index] = pReorderEntry->prxb; 721 netdev_dbg(ieee->dev, "%s(): Indicate SeqNum %d!\n", 722 __func__, pReorderEntry->SeqNum); 723 index++; 724 725 list_add_tail(&pReorderEntry->List, 726 &ieee->RxReorder_Unused_List); 727 } else { 728 bPktInBuf = true; 729 break; 730 } 731 } 732 733 /* Handling pending timer. Set this timer to prevent from long time 734 * Rx buffering. 735 */ 736 if (index > 0) { 737 if (timer_pending(&pTS->rx_pkt_pending_timer)) 738 del_timer_sync(&pTS->rx_pkt_pending_timer); 739 pTS->rx_timeout_indicate_seq = 0xffff; 740 741 if (index > REORDER_WIN_SIZE) { 742 netdev_err(ieee->dev, 743 "%s(): Rx Reorder struct buffer full!\n", 744 __func__); 745 spin_unlock_irqrestore(&(ieee->reorder_spinlock), 746 flags); 747 return; 748 } 749 rtllib_indicate_packets(ieee, ieee->prxbIndicateArray, index); 750 bPktInBuf = false; 751 } 752 753 if (bPktInBuf && pTS->rx_timeout_indicate_seq == 0xffff) { 754 netdev_dbg(ieee->dev, "%s(): SET rx timeout timer\n", __func__); 755 pTS->rx_timeout_indicate_seq = pTS->rx_indicate_seq; 756 mod_timer(&pTS->rx_pkt_pending_timer, jiffies + 757 msecs_to_jiffies(ht_info->rx_reorder_pending_time)); 758 } 759 spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags); 760 } 761 762 static u8 parse_subframe(struct rtllib_device *ieee, struct sk_buff *skb, 763 struct rtllib_rx_stats *rx_stats, 764 struct rtllib_rxb *rxb, u8 *src, u8 *dst) 765 { 766 struct rtllib_hdr_3addr *hdr = (struct rtllib_hdr_3addr *)skb->data; 767 u16 fc = le16_to_cpu(hdr->frame_ctl); 768 769 u16 LLCOffset = sizeof(struct rtllib_hdr_3addr); 770 u16 ChkLength; 771 bool bIsAggregateFrame = false; 772 u16 nSubframe_Length; 773 u8 nPadding_Length = 0; 774 u16 SeqNum = 0; 775 struct sk_buff *sub_skb; 776 /* just for debug purpose */ 777 SeqNum = WLAN_GET_SEQ_SEQ(le16_to_cpu(hdr->seq_ctl)); 778 if ((RTLLIB_QOS_HAS_SEQ(fc)) && 779 (((union frameqos *)(skb->data + RTLLIB_3ADDR_LEN))->field.reserved)) 780 bIsAggregateFrame = true; 781 782 if (RTLLIB_QOS_HAS_SEQ(fc)) 783 LLCOffset += 2; 784 if (rx_stats->bContainHTC) 785 LLCOffset += sHTCLng; 786 787 ChkLength = LLCOffset; 788 789 if (skb->len <= ChkLength) 790 return 0; 791 792 skb_pull(skb, LLCOffset); 793 ieee->bIsAggregateFrame = bIsAggregateFrame; 794 if (!bIsAggregateFrame) { 795 rxb->nr_subframes = 1; 796 797 /* altered by clark 3/30/2010 798 * The struct buffer size of the skb indicated to upper layer 799 * must be less than 5000, or the defraged IP datagram 800 * in the IP layer will exceed "ipfrag_high_tresh" and be 801 * discarded. so there must not use the function 802 * "skb_copy" and "skb_clone" for "skb". 803 */ 804 805 /* Allocate new skb for releasing to upper layer */ 806 sub_skb = dev_alloc_skb(RTLLIB_SKBBUFFER_SIZE); 807 if (!sub_skb) 808 return 0; 809 skb_reserve(sub_skb, 12); 810 skb_put_data(sub_skb, skb->data, skb->len); 811 sub_skb->dev = ieee->dev; 812 813 rxb->subframes[0] = sub_skb; 814 815 memcpy(rxb->src, src, ETH_ALEN); 816 memcpy(rxb->dst, dst, ETH_ALEN); 817 rxb->subframes[0]->dev = ieee->dev; 818 return 1; 819 } 820 821 rxb->nr_subframes = 0; 822 memcpy(rxb->src, src, ETH_ALEN); 823 memcpy(rxb->dst, dst, ETH_ALEN); 824 while (skb->len > ETHERNET_HEADER_SIZE) { 825 /* Offset 12 denote 2 mac address */ 826 nSubframe_Length = *((u16 *)(skb->data + 12)); 827 nSubframe_Length = (nSubframe_Length >> 8) + 828 (nSubframe_Length << 8); 829 830 if (skb->len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) { 831 netdev_info(ieee->dev, 832 "%s: A-MSDU parse error!! pRfd->nTotalSubframe : %d\n", 833 __func__, rxb->nr_subframes); 834 netdev_info(ieee->dev, 835 "%s: A-MSDU parse error!! Subframe Length: %d\n", 836 __func__, nSubframe_Length); 837 netdev_info(ieee->dev, 838 "nRemain_Length is %d and nSubframe_Length is : %d\n", 839 skb->len, nSubframe_Length); 840 netdev_info(ieee->dev, 841 "The Packet SeqNum is %d\n", 842 SeqNum); 843 return 0; 844 } 845 846 /* move the data point to data content */ 847 skb_pull(skb, ETHERNET_HEADER_SIZE); 848 849 /* altered by clark 3/30/2010 850 * The struct buffer size of the skb indicated to upper layer 851 * must be less than 5000, or the defraged IP datagram 852 * in the IP layer will exceed "ipfrag_high_tresh" and be 853 * discarded. so there must not use the function 854 * "skb_copy" and "skb_clone" for "skb". 855 */ 856 857 /* Allocate new skb for releasing to upper layer */ 858 sub_skb = dev_alloc_skb(nSubframe_Length + 12); 859 if (!sub_skb) 860 return 0; 861 skb_reserve(sub_skb, 12); 862 skb_put_data(sub_skb, skb->data, nSubframe_Length); 863 864 sub_skb->dev = ieee->dev; 865 rxb->subframes[rxb->nr_subframes++] = sub_skb; 866 if (rxb->nr_subframes >= MAX_SUBFRAME_COUNT) { 867 netdev_dbg(ieee->dev, 868 "ParseSubframe(): Too many Subframes! Packets dropped!\n"); 869 break; 870 } 871 skb_pull(skb, nSubframe_Length); 872 873 if (skb->len != 0) { 874 nPadding_Length = 4 - ((nSubframe_Length + 875 ETHERNET_HEADER_SIZE) % 4); 876 if (nPadding_Length == 4) 877 nPadding_Length = 0; 878 879 if (skb->len < nPadding_Length) 880 return 0; 881 882 skb_pull(skb, nPadding_Length); 883 } 884 } 885 886 return rxb->nr_subframes; 887 } 888 889 static size_t rtllib_rx_get_hdrlen(struct rtllib_device *ieee, 890 struct sk_buff *skb, 891 struct rtllib_rx_stats *rx_stats) 892 { 893 struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data; 894 u16 fc = le16_to_cpu(hdr->frame_ctl); 895 size_t hdrlen; 896 897 hdrlen = rtllib_get_hdrlen(fc); 898 if (HTCCheck(ieee, skb->data)) { 899 if (net_ratelimit()) 900 netdev_info(ieee->dev, "%s: find HTCControl!\n", 901 __func__); 902 hdrlen += 4; 903 rx_stats->bContainHTC = true; 904 } 905 906 if (RTLLIB_QOS_HAS_SEQ(fc)) 907 rx_stats->bIsQosData = true; 908 909 return hdrlen; 910 } 911 912 static int rtllib_rx_check_duplicate(struct rtllib_device *ieee, 913 struct sk_buff *skb, u8 multicast) 914 { 915 struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data; 916 u16 fc, sc; 917 u8 frag, type, stype; 918 919 fc = le16_to_cpu(hdr->frame_ctl); 920 type = WLAN_FC_GET_TYPE(fc); 921 stype = WLAN_FC_GET_STYPE(fc); 922 sc = le16_to_cpu(hdr->seq_ctl); 923 frag = WLAN_GET_SEQ_FRAG(sc); 924 925 if (!ieee->ht_info->cur_rx_reorder_enable || 926 !ieee->current_network.qos_data.active || 927 !IsDataFrame(skb->data) || 928 IsLegacyDataFrame(skb->data)) { 929 if (!((type == RTLLIB_FTYPE_MGMT) && 930 (stype == RTLLIB_STYPE_BEACON))) { 931 if (is_duplicate_packet(ieee, hdr)) 932 return -1; 933 } 934 } else { 935 struct rx_ts_record *pRxTS = NULL; 936 937 if (GetTs(ieee, (struct ts_common_info **)&pRxTS, hdr->addr2, 938 (u8)Frame_QoSTID((u8 *)(skb->data)), RX_DIR, true)) { 939 if ((fc & (1 << 11)) && (frag == pRxTS->rx_last_frag_num) && 940 (WLAN_GET_SEQ_SEQ(sc) == pRxTS->rx_last_seq_num)) 941 return -1; 942 pRxTS->rx_last_frag_num = frag; 943 pRxTS->rx_last_seq_num = WLAN_GET_SEQ_SEQ(sc); 944 } else { 945 netdev_warn(ieee->dev, "%s(): No TS! Skip the check!\n", 946 __func__); 947 return -1; 948 } 949 } 950 951 return 0; 952 } 953 954 static void rtllib_rx_extract_addr(struct rtllib_device *ieee, 955 struct rtllib_hdr_4addr *hdr, u8 *dst, 956 u8 *src, u8 *bssid) 957 { 958 u16 fc = le16_to_cpu(hdr->frame_ctl); 959 960 switch (fc & (RTLLIB_FCTL_FROMDS | RTLLIB_FCTL_TODS)) { 961 case RTLLIB_FCTL_FROMDS: 962 ether_addr_copy(dst, hdr->addr1); 963 ether_addr_copy(src, hdr->addr3); 964 ether_addr_copy(bssid, hdr->addr2); 965 break; 966 case RTLLIB_FCTL_TODS: 967 ether_addr_copy(dst, hdr->addr3); 968 ether_addr_copy(src, hdr->addr2); 969 ether_addr_copy(bssid, hdr->addr1); 970 break; 971 case RTLLIB_FCTL_FROMDS | RTLLIB_FCTL_TODS: 972 ether_addr_copy(dst, hdr->addr3); 973 ether_addr_copy(src, hdr->addr4); 974 ether_addr_copy(bssid, ieee->current_network.bssid); 975 break; 976 default: 977 ether_addr_copy(dst, hdr->addr1); 978 ether_addr_copy(src, hdr->addr2); 979 ether_addr_copy(bssid, hdr->addr3); 980 break; 981 } 982 } 983 984 static int rtllib_rx_data_filter(struct rtllib_device *ieee, u16 fc, 985 u8 *dst, u8 *src, u8 *bssid, u8 *addr2) 986 { 987 u8 type, stype; 988 989 type = WLAN_FC_GET_TYPE(fc); 990 stype = WLAN_FC_GET_STYPE(fc); 991 992 /* Filter frames from different BSS */ 993 if (((fc & RTLLIB_FCTL_DSTODS) != RTLLIB_FCTL_DSTODS) && 994 !ether_addr_equal(ieee->current_network.bssid, bssid) && 995 !is_zero_ether_addr(ieee->current_network.bssid)) { 996 return -1; 997 } 998 999 /* Filter packets sent by an STA that will be forwarded by AP */ 1000 if (ieee->intel_promiscuous_md_info.promiscuous_on && 1001 ieee->intel_promiscuous_md_info.fltr_src_sta_frame) { 1002 if ((fc & RTLLIB_FCTL_TODS) && !(fc & RTLLIB_FCTL_FROMDS) && 1003 !ether_addr_equal(dst, ieee->current_network.bssid) && 1004 ether_addr_equal(bssid, ieee->current_network.bssid)) { 1005 return -1; 1006 } 1007 } 1008 1009 /* Nullfunc frames may have PS-bit set, so they must be passed to 1010 * hostap_handle_sta_rx() before being dropped here. 1011 */ 1012 if (!ieee->intel_promiscuous_md_info.promiscuous_on) { 1013 if (stype != RTLLIB_STYPE_DATA && 1014 stype != RTLLIB_STYPE_DATA_CFACK && 1015 stype != RTLLIB_STYPE_DATA_CFPOLL && 1016 stype != RTLLIB_STYPE_DATA_CFACKPOLL && 1017 stype != RTLLIB_STYPE_QOS_DATA) { 1018 if (stype != RTLLIB_STYPE_NULLFUNC) 1019 netdev_dbg(ieee->dev, 1020 "RX: dropped data frame with no data (type=0x%02x, subtype=0x%02x)\n", 1021 type, stype); 1022 return -1; 1023 } 1024 } 1025 1026 if (ieee->iw_mode != IW_MODE_MESH) { 1027 /* packets from our adapter are dropped (echo) */ 1028 if (!memcmp(src, ieee->dev->dev_addr, ETH_ALEN)) 1029 return -1; 1030 1031 /* {broad,multi}cast packets to our BSS go through */ 1032 if (is_multicast_ether_addr(dst)) { 1033 if (memcmp(bssid, ieee->current_network.bssid, 1034 ETH_ALEN)) 1035 return -1; 1036 } 1037 } 1038 return 0; 1039 } 1040 1041 static int rtllib_rx_get_crypt(struct rtllib_device *ieee, struct sk_buff *skb, 1042 struct lib80211_crypt_data **crypt, size_t hdrlen) 1043 { 1044 struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data; 1045 u16 fc = le16_to_cpu(hdr->frame_ctl); 1046 int idx = 0; 1047 1048 if (ieee->host_decrypt) { 1049 if (skb->len >= hdrlen + 3) 1050 idx = skb->data[hdrlen + 3] >> 6; 1051 1052 *crypt = ieee->crypt_info.crypt[idx]; 1053 /* allow NULL decrypt to indicate an station specific override 1054 * for default encryption 1055 */ 1056 if (*crypt && ((*crypt)->ops == NULL || 1057 (*crypt)->ops->decrypt_mpdu == NULL)) 1058 *crypt = NULL; 1059 1060 if (!*crypt && (fc & RTLLIB_FCTL_WEP)) { 1061 /* This seems to be triggered by some (multicast?) 1062 * frames from other than current BSS, so just drop the 1063 * frames silently instead of filling system log with 1064 * these reports. 1065 */ 1066 netdev_dbg(ieee->dev, 1067 "Decryption failed (not set) (SA= %pM)\n", 1068 hdr->addr2); 1069 return -1; 1070 } 1071 } 1072 1073 return 0; 1074 } 1075 1076 static int rtllib_rx_decrypt(struct rtllib_device *ieee, struct sk_buff *skb, 1077 struct rtllib_rx_stats *rx_stats, 1078 struct lib80211_crypt_data *crypt, size_t hdrlen) 1079 { 1080 struct rtllib_hdr_4addr *hdr; 1081 int keyidx = 0; 1082 u16 fc, sc; 1083 u8 frag; 1084 1085 hdr = (struct rtllib_hdr_4addr *)skb->data; 1086 fc = le16_to_cpu(hdr->frame_ctl); 1087 sc = le16_to_cpu(hdr->seq_ctl); 1088 frag = WLAN_GET_SEQ_FRAG(sc); 1089 1090 if ((!rx_stats->Decrypted)) 1091 ieee->need_sw_enc = 1; 1092 else 1093 ieee->need_sw_enc = 0; 1094 1095 keyidx = rtllib_rx_frame_decrypt(ieee, skb, crypt); 1096 if (ieee->host_decrypt && (fc & RTLLIB_FCTL_WEP) && (keyidx < 0)) { 1097 netdev_info(ieee->dev, "%s: decrypt frame error\n", __func__); 1098 return -1; 1099 } 1100 1101 hdr = (struct rtllib_hdr_4addr *)skb->data; 1102 if ((frag != 0 || (fc & RTLLIB_FCTL_MOREFRAGS))) { 1103 int flen; 1104 struct sk_buff *frag_skb = rtllib_frag_cache_get(ieee, hdr); 1105 1106 netdev_dbg(ieee->dev, "Rx Fragment received (%u)\n", frag); 1107 1108 if (!frag_skb) { 1109 netdev_dbg(ieee->dev, 1110 "Rx cannot get skb from fragment cache (morefrag=%d seq=%u frag=%u)\n", 1111 (fc & RTLLIB_FCTL_MOREFRAGS) != 0, 1112 WLAN_GET_SEQ_SEQ(sc), frag); 1113 return -1; 1114 } 1115 flen = skb->len; 1116 if (frag != 0) 1117 flen -= hdrlen; 1118 1119 if (frag_skb->tail + flen > frag_skb->end) { 1120 netdev_warn(ieee->dev, 1121 "%s: host decrypted and reassembled frame did not fit skb\n", 1122 __func__); 1123 rtllib_frag_cache_invalidate(ieee, hdr); 1124 return -1; 1125 } 1126 1127 if (frag == 0) { 1128 /* copy first fragment (including full headers) into 1129 * beginning of the fragment cache skb 1130 */ 1131 skb_put_data(frag_skb, skb->data, flen); 1132 } else { 1133 /* append frame payload to the end of the fragment 1134 * cache skb 1135 */ 1136 skb_put_data(frag_skb, skb->data + hdrlen, flen); 1137 } 1138 dev_kfree_skb_any(skb); 1139 skb = NULL; 1140 1141 if (fc & RTLLIB_FCTL_MOREFRAGS) { 1142 /* more fragments expected - leave the skb in fragment 1143 * cache for now; it will be delivered to upper layers 1144 * after all fragments have been received 1145 */ 1146 return -2; 1147 } 1148 1149 /* this was the last fragment and the frame will be 1150 * delivered, so remove skb from fragment cache 1151 */ 1152 skb = frag_skb; 1153 hdr = (struct rtllib_hdr_4addr *)skb->data; 1154 rtllib_frag_cache_invalidate(ieee, hdr); 1155 } 1156 1157 /* skb: hdr + (possible reassembled) full MSDU payload; possibly still 1158 * encrypted/authenticated 1159 */ 1160 if (ieee->host_decrypt && (fc & RTLLIB_FCTL_WEP) && 1161 rtllib_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt)) { 1162 netdev_info(ieee->dev, "%s: ==>decrypt msdu error\n", __func__); 1163 return -1; 1164 } 1165 1166 hdr = (struct rtllib_hdr_4addr *)skb->data; 1167 if (crypt && !(fc & RTLLIB_FCTL_WEP) && !ieee->open_wep) { 1168 if (/*ieee->ieee802_1x &&*/ 1169 rtllib_is_eapol_frame(ieee, skb, hdrlen)) { 1170 /* pass unencrypted EAPOL frames even if encryption is 1171 * configured 1172 */ 1173 struct eapol *eap = (struct eapol *)(skb->data + 1174 24); 1175 netdev_dbg(ieee->dev, 1176 "RX: IEEE 802.1X EAPOL frame: %s\n", 1177 eap_get_type(eap->type)); 1178 } else { 1179 netdev_dbg(ieee->dev, 1180 "encryption configured, but RX frame not encrypted (SA= %pM)\n", 1181 hdr->addr2); 1182 return -1; 1183 } 1184 } 1185 1186 if (crypt && !(fc & RTLLIB_FCTL_WEP) && 1187 rtllib_is_eapol_frame(ieee, skb, hdrlen)) { 1188 struct eapol *eap = (struct eapol *)(skb->data + 24); 1189 1190 netdev_dbg(ieee->dev, "RX: IEEE 802.1X EAPOL frame: %s\n", 1191 eap_get_type(eap->type)); 1192 } 1193 1194 if (crypt && !(fc & RTLLIB_FCTL_WEP) && !ieee->open_wep && 1195 !rtllib_is_eapol_frame(ieee, skb, hdrlen)) { 1196 netdev_dbg(ieee->dev, 1197 "dropped unencrypted RX data frame from %pM (drop_unencrypted=1)\n", 1198 hdr->addr2); 1199 return -1; 1200 } 1201 1202 return 0; 1203 } 1204 1205 static void rtllib_rx_check_leave_lps(struct rtllib_device *ieee, u8 unicast, 1206 u8 nr_subframes) 1207 { 1208 if (unicast) { 1209 if (ieee->state == RTLLIB_LINKED) { 1210 if (((ieee->link_detect_info.NumRxUnicastOkInPeriod + 1211 ieee->link_detect_info.NumTxOkInPeriod) > 8) || 1212 (ieee->link_detect_info.NumRxUnicastOkInPeriod > 2)) { 1213 ieee->LeisurePSLeave(ieee->dev); 1214 } 1215 } 1216 } 1217 ieee->last_rx_ps_time = jiffies; 1218 } 1219 1220 static void rtllib_rx_indicate_pkt_legacy(struct rtllib_device *ieee, 1221 struct rtllib_rx_stats *rx_stats, 1222 struct rtllib_rxb *rxb, 1223 u8 *dst, 1224 u8 *src) 1225 { 1226 struct net_device *dev = ieee->dev; 1227 u16 ethertype; 1228 int i = 0; 1229 1230 if (rxb == NULL) { 1231 netdev_info(dev, "%s: rxb is NULL!!\n", __func__); 1232 return; 1233 } 1234 1235 for (i = 0; i < rxb->nr_subframes; i++) { 1236 struct sk_buff *sub_skb = rxb->subframes[i]; 1237 1238 if (sub_skb) { 1239 /* convert hdr + possible LLC headers 1240 * into Ethernet header 1241 */ 1242 ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7]; 1243 if (sub_skb->len >= 8 && 1244 ((memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) == 0 && 1245 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) || 1246 memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE) == 0)) { 1247 /* remove RFC1042 or Bridge-Tunnel encapsulation 1248 * and replace EtherType 1249 */ 1250 skb_pull(sub_skb, SNAP_SIZE); 1251 ether_addr_copy(skb_push(sub_skb, ETH_ALEN), 1252 src); 1253 ether_addr_copy(skb_push(sub_skb, ETH_ALEN), 1254 dst); 1255 } else { 1256 u16 len; 1257 /* Leave Ethernet header part of hdr 1258 * and full payload 1259 */ 1260 len = sub_skb->len; 1261 memcpy(skb_push(sub_skb, 2), &len, 2); 1262 ether_addr_copy(skb_push(sub_skb, ETH_ALEN), 1263 src); 1264 ether_addr_copy(skb_push(sub_skb, ETH_ALEN), 1265 dst); 1266 } 1267 1268 ieee->stats.rx_packets++; 1269 ieee->stats.rx_bytes += sub_skb->len; 1270 1271 if (is_multicast_ether_addr(dst)) 1272 ieee->stats.multicast++; 1273 1274 /* Indicate the packets to upper layer */ 1275 memset(sub_skb->cb, 0, sizeof(sub_skb->cb)); 1276 sub_skb->protocol = eth_type_trans(sub_skb, dev); 1277 sub_skb->dev = dev; 1278 sub_skb->dev->stats.rx_packets++; 1279 sub_skb->dev->stats.rx_bytes += sub_skb->len; 1280 /* 802.11 crc not sufficient */ 1281 sub_skb->ip_summed = CHECKSUM_NONE; 1282 netif_rx(sub_skb); 1283 } 1284 } 1285 kfree(rxb); 1286 } 1287 1288 static int rtllib_rx_InfraAdhoc(struct rtllib_device *ieee, struct sk_buff *skb, 1289 struct rtllib_rx_stats *rx_stats) 1290 { 1291 struct net_device *dev = ieee->dev; 1292 struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data; 1293 struct lib80211_crypt_data *crypt = NULL; 1294 struct rtllib_rxb *rxb = NULL; 1295 struct rx_ts_record *pTS = NULL; 1296 u16 fc, sc, SeqNum = 0; 1297 u8 type, stype, multicast = 0, unicast = 0, nr_subframes = 0, TID = 0; 1298 u8 dst[ETH_ALEN]; 1299 u8 src[ETH_ALEN]; 1300 u8 bssid[ETH_ALEN] = {0}; 1301 1302 size_t hdrlen = 0; 1303 bool bToOtherSTA = false; 1304 int ret = 0, i = 0; 1305 1306 fc = le16_to_cpu(hdr->frame_ctl); 1307 type = WLAN_FC_GET_TYPE(fc); 1308 stype = WLAN_FC_GET_STYPE(fc); 1309 sc = le16_to_cpu(hdr->seq_ctl); 1310 1311 /*Filter pkt not to me*/ 1312 multicast = is_multicast_ether_addr(hdr->addr1); 1313 unicast = !multicast; 1314 if (unicast && !ether_addr_equal(dev->dev_addr, hdr->addr1)) { 1315 if (ieee->net_promiscuous_md) 1316 bToOtherSTA = true; 1317 else 1318 goto rx_dropped; 1319 } 1320 1321 /*Filter pkt has too small length */ 1322 hdrlen = rtllib_rx_get_hdrlen(ieee, skb, rx_stats); 1323 if (skb->len < hdrlen) { 1324 netdev_info(dev, 1325 "%s():ERR!!! skb->len is smaller than hdrlen\n", 1326 __func__); 1327 goto rx_dropped; 1328 } 1329 1330 /* Filter Duplicate pkt */ 1331 ret = rtllib_rx_check_duplicate(ieee, skb, multicast); 1332 if (ret < 0) 1333 goto rx_dropped; 1334 1335 /* Filter CTRL Frame */ 1336 if (type == RTLLIB_FTYPE_CTL) 1337 goto rx_dropped; 1338 1339 /* Filter MGNT Frame */ 1340 if (type == RTLLIB_FTYPE_MGMT) { 1341 if (bToOtherSTA) 1342 goto rx_dropped; 1343 if (rtllib_rx_frame_mgmt(ieee, skb, rx_stats, type, stype)) 1344 goto rx_dropped; 1345 else 1346 goto rx_exit; 1347 } 1348 1349 /* Filter WAPI DATA Frame */ 1350 1351 /* Update statstics for AP roaming */ 1352 if (!bToOtherSTA) { 1353 ieee->link_detect_info.NumRecvDataInPeriod++; 1354 ieee->link_detect_info.NumRxOkInPeriod++; 1355 } 1356 1357 /* Data frame - extract src/dst addresses */ 1358 rtllib_rx_extract_addr(ieee, hdr, dst, src, bssid); 1359 1360 /* Filter Data frames */ 1361 ret = rtllib_rx_data_filter(ieee, fc, dst, src, bssid, hdr->addr2); 1362 if (ret < 0) 1363 goto rx_dropped; 1364 1365 if (skb->len == hdrlen) 1366 goto rx_dropped; 1367 1368 /* Send pspoll based on moredata */ 1369 if ((ieee->iw_mode == IW_MODE_INFRA) && 1370 (ieee->sta_sleep == LPS_IS_SLEEP) && 1371 (ieee->polling) && (!bToOtherSTA)) { 1372 if (WLAN_FC_MORE_DATA(fc)) { 1373 /* more data bit is set, let's request a new frame 1374 * from the AP 1375 */ 1376 rtllib_sta_ps_send_pspoll_frame(ieee); 1377 } else { 1378 ieee->polling = false; 1379 } 1380 } 1381 1382 /* Get crypt if encrypted */ 1383 ret = rtllib_rx_get_crypt(ieee, skb, &crypt, hdrlen); 1384 if (ret == -1) 1385 goto rx_dropped; 1386 1387 /* Decrypt data frame (including reassemble) */ 1388 ret = rtllib_rx_decrypt(ieee, skb, rx_stats, crypt, hdrlen); 1389 if (ret == -1) 1390 goto rx_dropped; 1391 else if (ret == -2) 1392 goto rx_exit; 1393 1394 /* Get TS for Rx Reorder */ 1395 hdr = (struct rtllib_hdr_4addr *)skb->data; 1396 if (ieee->current_network.qos_data.active && IsQoSDataFrame(skb->data) 1397 && !is_multicast_ether_addr(hdr->addr1) 1398 && (!bToOtherSTA)) { 1399 TID = Frame_QoSTID(skb->data); 1400 SeqNum = WLAN_GET_SEQ_SEQ(sc); 1401 GetTs(ieee, (struct ts_common_info **)&pTS, hdr->addr2, TID, 1402 RX_DIR, true); 1403 if (TID != 0 && TID != 3) 1404 ieee->bis_any_nonbepkts = true; 1405 } 1406 1407 /* Parse rx data frame (For AMSDU) */ 1408 /* skb: hdr + (possible reassembled) full plaintext payload */ 1409 rxb = kmalloc(sizeof(struct rtllib_rxb), GFP_ATOMIC); 1410 if (!rxb) 1411 goto rx_dropped; 1412 1413 /* to parse amsdu packets */ 1414 /* qos data packets & reserved bit is 1 */ 1415 if (parse_subframe(ieee, skb, rx_stats, rxb, src, dst) == 0) { 1416 /* only to free rxb, and not submit the packets 1417 * to upper layer 1418 */ 1419 for (i = 0; i < rxb->nr_subframes; i++) 1420 dev_kfree_skb(rxb->subframes[i]); 1421 kfree(rxb); 1422 rxb = NULL; 1423 goto rx_dropped; 1424 } 1425 1426 /* Update WAPI PN */ 1427 1428 /* Check if leave LPS */ 1429 if (!bToOtherSTA) { 1430 if (ieee->bIsAggregateFrame) 1431 nr_subframes = rxb->nr_subframes; 1432 else 1433 nr_subframes = 1; 1434 if (unicast) 1435 ieee->link_detect_info.NumRxUnicastOkInPeriod += nr_subframes; 1436 rtllib_rx_check_leave_lps(ieee, unicast, nr_subframes); 1437 } 1438 1439 /* Indicate packets to upper layer or Rx Reorder */ 1440 if (!ieee->ht_info->cur_rx_reorder_enable || pTS == NULL || bToOtherSTA) 1441 rtllib_rx_indicate_pkt_legacy(ieee, rx_stats, rxb, dst, src); 1442 else 1443 RxReorderIndicatePacket(ieee, rxb, pTS, SeqNum); 1444 1445 dev_kfree_skb(skb); 1446 1447 rx_exit: 1448 return 1; 1449 1450 rx_dropped: 1451 ieee->stats.rx_dropped++; 1452 1453 /* Returning 0 indicates to caller that we have not handled the SKB-- 1454 * so it is still allocated and can be used again by underlying 1455 * hardware as a DMA target 1456 */ 1457 return 0; 1458 } 1459 1460 static int rtllib_rx_Master(struct rtllib_device *ieee, struct sk_buff *skb, 1461 struct rtllib_rx_stats *rx_stats) 1462 { 1463 return 0; 1464 } 1465 1466 static int rtllib_rx_Monitor(struct rtllib_device *ieee, struct sk_buff *skb, 1467 struct rtllib_rx_stats *rx_stats) 1468 { 1469 struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data; 1470 u16 fc = le16_to_cpu(hdr->frame_ctl); 1471 size_t hdrlen = rtllib_get_hdrlen(fc); 1472 1473 if (skb->len < hdrlen) { 1474 netdev_info(ieee->dev, 1475 "%s():ERR!!! skb->len is smaller than hdrlen\n", 1476 __func__); 1477 return 0; 1478 } 1479 1480 if (HTCCheck(ieee, skb->data)) { 1481 if (net_ratelimit()) 1482 netdev_info(ieee->dev, "%s: Find HTCControl!\n", 1483 __func__); 1484 hdrlen += 4; 1485 } 1486 1487 ieee->stats.rx_packets++; 1488 ieee->stats.rx_bytes += skb->len; 1489 rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen); 1490 1491 return 1; 1492 } 1493 1494 static int rtllib_rx_Mesh(struct rtllib_device *ieee, struct sk_buff *skb, 1495 struct rtllib_rx_stats *rx_stats) 1496 { 1497 return 0; 1498 } 1499 1500 /* All received frames are sent to this function. @skb contains the frame in 1501 * IEEE 802.11 format, i.e., in the format it was sent over air. 1502 * This function is called only as a tasklet (software IRQ). 1503 */ 1504 int rtllib_rx(struct rtllib_device *ieee, struct sk_buff *skb, 1505 struct rtllib_rx_stats *rx_stats) 1506 { 1507 int ret = 0; 1508 1509 if (!ieee || !skb || !rx_stats) { 1510 pr_info("%s: Input parameters NULL!\n", __func__); 1511 goto rx_dropped; 1512 } 1513 if (skb->len < 10) { 1514 netdev_info(ieee->dev, "%s: SKB length < 10\n", __func__); 1515 goto rx_dropped; 1516 } 1517 1518 switch (ieee->iw_mode) { 1519 case IW_MODE_ADHOC: 1520 case IW_MODE_INFRA: 1521 ret = rtllib_rx_InfraAdhoc(ieee, skb, rx_stats); 1522 break; 1523 case IW_MODE_MASTER: 1524 case IW_MODE_REPEAT: 1525 ret = rtllib_rx_Master(ieee, skb, rx_stats); 1526 break; 1527 case IW_MODE_MONITOR: 1528 ret = rtllib_rx_Monitor(ieee, skb, rx_stats); 1529 break; 1530 case IW_MODE_MESH: 1531 ret = rtllib_rx_Mesh(ieee, skb, rx_stats); 1532 break; 1533 default: 1534 netdev_info(ieee->dev, "%s: ERR iw mode!!!\n", __func__); 1535 break; 1536 } 1537 1538 return ret; 1539 1540 rx_dropped: 1541 if (ieee) 1542 ieee->stats.rx_dropped++; 1543 return 0; 1544 } 1545 EXPORT_SYMBOL(rtllib_rx); 1546 1547 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 }; 1548 1549 /* Make ther structure we read from the beacon packet has the right values */ 1550 static int rtllib_verify_qos_info(struct rtllib_qos_information_element 1551 *info_element, int sub_type) 1552 { 1553 if (info_element->elementID != QOS_ELEMENT_ID) 1554 return -1; 1555 if (info_element->qui_subtype != sub_type) 1556 return -1; 1557 if (memcmp(info_element->qui, qos_oui, QOS_OUI_LEN)) 1558 return -1; 1559 if (info_element->qui_type != QOS_OUI_TYPE) 1560 return -1; 1561 if (info_element->version != QOS_VERSION_1) 1562 return -1; 1563 1564 return 0; 1565 } 1566 1567 /* Parse a QoS parameter element */ 1568 static int rtllib_read_qos_param_element( 1569 struct rtllib_qos_parameter_info *element_param, 1570 struct rtllib_info_element *info_element) 1571 { 1572 size_t size = sizeof(*element_param); 1573 1574 if (!element_param || !info_element || info_element->len != size - 2) 1575 return -1; 1576 1577 memcpy(element_param, info_element, size); 1578 return rtllib_verify_qos_info(&element_param->info_element, 1579 QOS_OUI_PARAM_SUB_TYPE); 1580 } 1581 1582 /* Parse a QoS information element */ 1583 static int rtllib_read_qos_info_element( 1584 struct rtllib_qos_information_element *element_info, 1585 struct rtllib_info_element *info_element) 1586 { 1587 size_t size = sizeof(*element_info); 1588 1589 if (!element_info || !info_element || info_element->len != size - 2) 1590 return -1; 1591 1592 memcpy(element_info, info_element, size); 1593 return rtllib_verify_qos_info(element_info, QOS_OUI_INFO_SUB_TYPE); 1594 } 1595 1596 /* Write QoS parameters from the ac parameters. */ 1597 static int rtllib_qos_convert_ac_to_parameters(struct rtllib_qos_parameter_info *param_elm, 1598 struct rtllib_qos_data *qos_data) 1599 { 1600 struct rtllib_qos_ac_parameter *ac_params; 1601 struct rtllib_qos_parameters *qos_param = &(qos_data->parameters); 1602 int i; 1603 u8 aci; 1604 u8 acm; 1605 1606 qos_data->wmm_acm = 0; 1607 for (i = 0; i < QOS_QUEUE_NUM; i++) { 1608 ac_params = &(param_elm->ac_params_record[i]); 1609 1610 aci = (ac_params->aci_aifsn & 0x60) >> 5; 1611 acm = (ac_params->aci_aifsn & 0x10) >> 4; 1612 1613 if (aci >= QOS_QUEUE_NUM) 1614 continue; 1615 switch (aci) { 1616 case 1: 1617 /* BIT(0) | BIT(3) */ 1618 if (acm) 1619 qos_data->wmm_acm |= (0x01 << 0) | (0x01 << 3); 1620 break; 1621 case 2: 1622 /* BIT(4) | BIT(5) */ 1623 if (acm) 1624 qos_data->wmm_acm |= (0x01 << 4) | (0x01 << 5); 1625 break; 1626 case 3: 1627 /* BIT(6) | BIT(7) */ 1628 if (acm) 1629 qos_data->wmm_acm |= (0x01 << 6) | (0x01 << 7); 1630 break; 1631 case 0: 1632 default: 1633 /* BIT(1) | BIT(2) */ 1634 if (acm) 1635 qos_data->wmm_acm |= (0x01 << 1) | (0x01 << 2); 1636 break; 1637 } 1638 1639 qos_param->aifs[aci] = (ac_params->aci_aifsn) & 0x0f; 1640 1641 /* WMM spec P.11: The minimum value for AIFSN shall be 2 */ 1642 qos_param->aifs[aci] = max_t(u8, qos_param->aifs[aci], 2); 1643 1644 qos_param->cw_min[aci] = cpu_to_le16(ac_params->ecw_min_max & 1645 0x0F); 1646 1647 qos_param->cw_max[aci] = cpu_to_le16((ac_params->ecw_min_max & 1648 0xF0) >> 4); 1649 1650 qos_param->flag[aci] = 1651 (ac_params->aci_aifsn & 0x10) ? 0x01 : 0x00; 1652 qos_param->tx_op_limit[aci] = ac_params->tx_op_limit; 1653 } 1654 return 0; 1655 } 1656 1657 /* we have a generic data element which it may contain QoS information or 1658 * parameters element. check the information element length to decide 1659 * which type to read 1660 */ 1661 static int rtllib_parse_qos_info_param_IE(struct rtllib_device *ieee, 1662 struct rtllib_info_element 1663 *info_element, 1664 struct rtllib_network *network) 1665 { 1666 int rc = 0; 1667 struct rtllib_qos_information_element qos_info_element; 1668 1669 rc = rtllib_read_qos_info_element(&qos_info_element, info_element); 1670 1671 if (rc == 0) { 1672 network->qos_data.param_count = qos_info_element.ac_info & 0x0F; 1673 network->flags |= NETWORK_HAS_QOS_INFORMATION; 1674 } else { 1675 struct rtllib_qos_parameter_info param_element; 1676 1677 rc = rtllib_read_qos_param_element(¶m_element, 1678 info_element); 1679 if (rc == 0) { 1680 rtllib_qos_convert_ac_to_parameters(¶m_element, 1681 &(network->qos_data)); 1682 network->flags |= NETWORK_HAS_QOS_PARAMETERS; 1683 network->qos_data.param_count = 1684 param_element.info_element.ac_info & 0x0F; 1685 } 1686 } 1687 1688 if (rc == 0) { 1689 netdev_dbg(ieee->dev, "QoS is supported\n"); 1690 network->qos_data.supported = 1; 1691 } 1692 return rc; 1693 } 1694 1695 static const char *get_info_element_string(u16 id) 1696 { 1697 switch (id) { 1698 case MFIE_TYPE_SSID: 1699 return "SSID"; 1700 case MFIE_TYPE_RATES: 1701 return "RATES"; 1702 case MFIE_TYPE_FH_SET: 1703 return "FH_SET"; 1704 case MFIE_TYPE_DS_SET: 1705 return "DS_SET"; 1706 case MFIE_TYPE_CF_SET: 1707 return "CF_SET"; 1708 case MFIE_TYPE_TIM: 1709 return "TIM"; 1710 case MFIE_TYPE_IBSS_SET: 1711 return "IBSS_SET"; 1712 case MFIE_TYPE_COUNTRY: 1713 return "COUNTRY"; 1714 case MFIE_TYPE_HOP_PARAMS: 1715 return "HOP_PARAMS"; 1716 case MFIE_TYPE_HOP_TABLE: 1717 return "HOP_TABLE"; 1718 case MFIE_TYPE_REQUEST: 1719 return "REQUEST"; 1720 case MFIE_TYPE_CHALLENGE: 1721 return "CHALLENGE"; 1722 case MFIE_TYPE_POWER_CONSTRAINT: 1723 return "POWER_CONSTRAINT"; 1724 case MFIE_TYPE_POWER_CAPABILITY: 1725 return "POWER_CAPABILITY"; 1726 case MFIE_TYPE_TPC_REQUEST: 1727 return "TPC_REQUEST"; 1728 case MFIE_TYPE_TPC_REPORT: 1729 return "TPC_REPORT"; 1730 case MFIE_TYPE_SUPP_CHANNELS: 1731 return "SUPP_CHANNELS"; 1732 case MFIE_TYPE_CSA: 1733 return "CSA"; 1734 case MFIE_TYPE_MEASURE_REQUEST: 1735 return "MEASURE_REQUEST"; 1736 case MFIE_TYPE_MEASURE_REPORT: 1737 return "MEASURE_REPORT"; 1738 case MFIE_TYPE_QUIET: 1739 return "QUIET"; 1740 case MFIE_TYPE_IBSS_DFS: 1741 return "IBSS_DFS"; 1742 case MFIE_TYPE_RSN: 1743 return "RSN"; 1744 case MFIE_TYPE_RATES_EX: 1745 return "RATES_EX"; 1746 case MFIE_TYPE_GENERIC: 1747 return "GENERIC"; 1748 case MFIE_TYPE_QOS_PARAMETER: 1749 return "QOS_PARAMETER"; 1750 default: 1751 return "UNKNOWN"; 1752 } 1753 } 1754 1755 static inline void rtllib_extract_country_ie( 1756 struct rtllib_device *ieee, 1757 struct rtllib_info_element *info_element, 1758 struct rtllib_network *network, 1759 u8 *addr2) 1760 { 1761 if (IS_DOT11D_ENABLE(ieee)) { 1762 if (info_element->len != 0) { 1763 memcpy(network->CountryIeBuf, info_element->data, 1764 info_element->len); 1765 network->CountryIeLen = info_element->len; 1766 1767 if (!IS_COUNTRY_IE_VALID(ieee)) { 1768 if (rtllib_act_scanning(ieee, false) && 1769 ieee->FirstIe_InScan) 1770 netdev_info(ieee->dev, 1771 "Received beacon CountryIE, SSID: <%s>\n", 1772 network->ssid); 1773 dot11d_update_country(ieee, addr2, 1774 info_element->len, 1775 info_element->data); 1776 } 1777 } 1778 1779 if (IS_EQUAL_CIE_SRC(ieee, addr2)) 1780 UPDATE_CIE_WATCHDOG(ieee); 1781 } 1782 } 1783 1784 static void rtllib_parse_mife_generic(struct rtllib_device *ieee, 1785 struct rtllib_info_element *info_element, 1786 struct rtllib_network *network, 1787 u16 *tmp_htcap_len, 1788 u16 *tmp_htinfo_len) 1789 { 1790 u16 ht_realtek_agg_len = 0; 1791 u8 ht_realtek_agg_buf[MAX_IE_LEN]; 1792 1793 if (!rtllib_parse_qos_info_param_IE(ieee, info_element, network)) 1794 return; 1795 if (info_element->len >= 4 && 1796 info_element->data[0] == 0x00 && 1797 info_element->data[1] == 0x50 && 1798 info_element->data[2] == 0xf2 && 1799 info_element->data[3] == 0x01) { 1800 network->wpa_ie_len = min(info_element->len + 2, 1801 MAX_WPA_IE_LEN); 1802 memcpy(network->wpa_ie, info_element, network->wpa_ie_len); 1803 return; 1804 } 1805 if (info_element->len == 7 && 1806 info_element->data[0] == 0x00 && 1807 info_element->data[1] == 0xe0 && 1808 info_element->data[2] == 0x4c && 1809 info_element->data[3] == 0x01 && 1810 info_element->data[4] == 0x02) 1811 network->Turbo_Enable = 1; 1812 1813 if (*tmp_htcap_len == 0) { 1814 if (info_element->len >= 4 && 1815 info_element->data[0] == 0x00 && 1816 info_element->data[1] == 0x90 && 1817 info_element->data[2] == 0x4c && 1818 info_element->data[3] == 0x033) { 1819 *tmp_htcap_len = min_t(u8, info_element->len, 1820 MAX_IE_LEN); 1821 if (*tmp_htcap_len != 0) { 1822 network->bssht.bd_ht_spec_ver = HT_SPEC_VER_EWC; 1823 network->bssht.bd_ht_cap_len = min_t(u16, *tmp_htcap_len, 1824 sizeof(network->bssht.bd_ht_cap_buf)); 1825 memcpy(network->bssht.bd_ht_cap_buf, 1826 info_element->data, 1827 network->bssht.bd_ht_cap_len); 1828 } 1829 } 1830 if (*tmp_htcap_len != 0) { 1831 network->bssht.bd_support_ht = true; 1832 network->bssht.bd_ht_1r = ((((struct ht_capab_ele *)(network->bssht.bd_ht_cap_buf))->MCS[1]) == 0); 1833 } else { 1834 network->bssht.bd_support_ht = false; 1835 network->bssht.bd_ht_1r = false; 1836 } 1837 } 1838 1839 if (*tmp_htinfo_len == 0) { 1840 if (info_element->len >= 4 && 1841 info_element->data[0] == 0x00 && 1842 info_element->data[1] == 0x90 && 1843 info_element->data[2] == 0x4c && 1844 info_element->data[3] == 0x034) { 1845 *tmp_htinfo_len = min_t(u8, info_element->len, 1846 MAX_IE_LEN); 1847 if (*tmp_htinfo_len != 0) { 1848 network->bssht.bd_ht_spec_ver = HT_SPEC_VER_EWC; 1849 network->bssht.bd_ht_info_len = min_t(u16, *tmp_htinfo_len, 1850 sizeof(network->bssht.bd_ht_info_buf)); 1851 memcpy(network->bssht.bd_ht_info_buf, 1852 info_element->data, 1853 network->bssht.bd_ht_info_len); 1854 } 1855 } 1856 } 1857 1858 if (network->bssht.bd_support_ht) { 1859 if (info_element->len >= 4 && 1860 info_element->data[0] == 0x00 && 1861 info_element->data[1] == 0xe0 && 1862 info_element->data[2] == 0x4c && 1863 info_element->data[3] == 0x02) { 1864 ht_realtek_agg_len = min_t(u8, info_element->len, 1865 MAX_IE_LEN); 1866 memcpy(ht_realtek_agg_buf, info_element->data, 1867 info_element->len); 1868 } 1869 if (ht_realtek_agg_len >= 5) { 1870 network->realtek_cap_exit = true; 1871 network->bssht.bd_rt2rt_aggregation = true; 1872 1873 if ((ht_realtek_agg_buf[4] == 1) && 1874 (ht_realtek_agg_buf[5] & 0x02)) 1875 network->bssht.bd_rt2rt_long_slot_time = true; 1876 1877 if ((ht_realtek_agg_buf[4] == 1) && 1878 (ht_realtek_agg_buf[5] & RT_HT_CAP_USE_92SE)) 1879 network->bssht.rt2rt_ht_mode |= RT_HT_CAP_USE_92SE; 1880 } 1881 } 1882 if (ht_realtek_agg_len >= 5) { 1883 if ((ht_realtek_agg_buf[5] & RT_HT_CAP_USE_SOFTAP)) 1884 network->bssht.rt2rt_ht_mode |= RT_HT_CAP_USE_SOFTAP; 1885 } 1886 1887 if ((info_element->len >= 3 && 1888 info_element->data[0] == 0x00 && 1889 info_element->data[1] == 0x05 && 1890 info_element->data[2] == 0xb5) || 1891 (info_element->len >= 3 && 1892 info_element->data[0] == 0x00 && 1893 info_element->data[1] == 0x0a && 1894 info_element->data[2] == 0xf7) || 1895 (info_element->len >= 3 && 1896 info_element->data[0] == 0x00 && 1897 info_element->data[1] == 0x10 && 1898 info_element->data[2] == 0x18)) { 1899 network->broadcom_cap_exist = true; 1900 } 1901 if (info_element->len >= 3 && 1902 info_element->data[0] == 0x00 && 1903 info_element->data[1] == 0x0c && 1904 info_element->data[2] == 0x43) 1905 network->ralink_cap_exist = true; 1906 if ((info_element->len >= 3 && 1907 info_element->data[0] == 0x00 && 1908 info_element->data[1] == 0x03 && 1909 info_element->data[2] == 0x7f) || 1910 (info_element->len >= 3 && 1911 info_element->data[0] == 0x00 && 1912 info_element->data[1] == 0x13 && 1913 info_element->data[2] == 0x74)) 1914 network->atheros_cap_exist = true; 1915 1916 if ((info_element->len >= 3 && 1917 info_element->data[0] == 0x00 && 1918 info_element->data[1] == 0x50 && 1919 info_element->data[2] == 0x43)) 1920 network->marvell_cap_exist = true; 1921 if (info_element->len >= 3 && 1922 info_element->data[0] == 0x00 && 1923 info_element->data[1] == 0x40 && 1924 info_element->data[2] == 0x96) 1925 network->cisco_cap_exist = true; 1926 1927 if (info_element->len >= 3 && 1928 info_element->data[0] == 0x00 && 1929 info_element->data[1] == 0x0a && 1930 info_element->data[2] == 0xf5) 1931 network->airgo_cap_exist = true; 1932 1933 if (info_element->len > 4 && 1934 info_element->data[0] == 0x00 && 1935 info_element->data[1] == 0x40 && 1936 info_element->data[2] == 0x96 && 1937 info_element->data[3] == 0x01) { 1938 if (info_element->len == 6) { 1939 memcpy(network->CcxRmState, &info_element->data[4], 2); 1940 if (network->CcxRmState[0] != 0) 1941 network->bCcxRmEnable = true; 1942 else 1943 network->bCcxRmEnable = false; 1944 network->MBssidMask = network->CcxRmState[1] & 0x07; 1945 if (network->MBssidMask != 0) { 1946 network->bMBssidValid = true; 1947 network->MBssidMask = 0xff << 1948 (network->MBssidMask); 1949 ether_addr_copy(network->MBssid, 1950 network->bssid); 1951 network->MBssid[5] &= network->MBssidMask; 1952 } else { 1953 network->bMBssidValid = false; 1954 } 1955 } else { 1956 network->bCcxRmEnable = false; 1957 } 1958 } 1959 if (info_element->len > 4 && 1960 info_element->data[0] == 0x00 && 1961 info_element->data[1] == 0x40 && 1962 info_element->data[2] == 0x96 && 1963 info_element->data[3] == 0x03) { 1964 if (info_element->len == 5) { 1965 network->bWithCcxVerNum = true; 1966 network->BssCcxVerNumber = info_element->data[4]; 1967 } else { 1968 network->bWithCcxVerNum = false; 1969 network->BssCcxVerNumber = 0; 1970 } 1971 } 1972 if (info_element->len > 4 && 1973 info_element->data[0] == 0x00 && 1974 info_element->data[1] == 0x50 && 1975 info_element->data[2] == 0xf2 && 1976 info_element->data[3] == 0x04) { 1977 netdev_dbg(ieee->dev, "MFIE_TYPE_WZC: %d bytes\n", 1978 info_element->len); 1979 network->wzc_ie_len = min(info_element->len + 2, MAX_WZC_IE_LEN); 1980 memcpy(network->wzc_ie, info_element, network->wzc_ie_len); 1981 } 1982 } 1983 1984 static void rtllib_parse_mfie_ht_cap(struct rtllib_info_element *info_element, 1985 struct rtllib_network *network, 1986 u16 *tmp_htcap_len) 1987 { 1988 struct bss_ht *ht = &network->bssht; 1989 1990 *tmp_htcap_len = min_t(u8, info_element->len, MAX_IE_LEN); 1991 if (*tmp_htcap_len != 0) { 1992 ht->bd_ht_spec_ver = HT_SPEC_VER_EWC; 1993 ht->bd_ht_cap_len = min_t(u16, *tmp_htcap_len, 1994 sizeof(ht->bd_ht_cap_buf)); 1995 memcpy(ht->bd_ht_cap_buf, info_element->data, ht->bd_ht_cap_len); 1996 1997 ht->bd_support_ht = true; 1998 ht->bd_ht_1r = ((((struct ht_capab_ele *) 1999 ht->bd_ht_cap_buf))->MCS[1]) == 0; 2000 2001 ht->bd_bandwidth = (enum ht_channel_width) 2002 (((struct ht_capab_ele *) 2003 (ht->bd_ht_cap_buf))->ChlWidth); 2004 } else { 2005 ht->bd_support_ht = false; 2006 ht->bd_ht_1r = false; 2007 ht->bd_bandwidth = HT_CHANNEL_WIDTH_20; 2008 } 2009 } 2010 2011 int rtllib_parse_info_param(struct rtllib_device *ieee, 2012 struct rtllib_info_element *info_element, 2013 u16 length, 2014 struct rtllib_network *network, 2015 struct rtllib_rx_stats *stats) 2016 { 2017 u8 i; 2018 short offset; 2019 u16 tmp_htcap_len = 0; 2020 u16 tmp_htinfo_len = 0; 2021 char rates_str[64]; 2022 char *p; 2023 2024 while (length >= sizeof(*info_element)) { 2025 if (sizeof(*info_element) + info_element->len > length) { 2026 netdev_dbg(ieee->dev, 2027 "Info elem: parse failed: info_element->len + 2 > left : info_element->len+2=%zd left=%d, id=%d.\n", 2028 info_element->len + sizeof(*info_element), 2029 length, info_element->id); 2030 /* We stop processing but don't return an error here 2031 * because some misbehaviour APs break this rule. ie. 2032 * Orinoco AP1000. 2033 */ 2034 break; 2035 } 2036 2037 switch (info_element->id) { 2038 case MFIE_TYPE_SSID: 2039 if (rtllib_is_empty_essid(info_element->data, 2040 info_element->len)) { 2041 network->flags |= NETWORK_EMPTY_ESSID; 2042 break; 2043 } 2044 2045 network->ssid_len = min(info_element->len, 2046 (u8)IW_ESSID_MAX_SIZE); 2047 memcpy(network->ssid, info_element->data, 2048 network->ssid_len); 2049 if (network->ssid_len < IW_ESSID_MAX_SIZE) 2050 memset(network->ssid + network->ssid_len, 0, 2051 IW_ESSID_MAX_SIZE - network->ssid_len); 2052 2053 netdev_dbg(ieee->dev, "MFIE_TYPE_SSID: '%s' len=%d.\n", 2054 network->ssid, network->ssid_len); 2055 break; 2056 2057 case MFIE_TYPE_RATES: 2058 p = rates_str; 2059 network->rates_len = min(info_element->len, 2060 MAX_RATES_LENGTH); 2061 for (i = 0; i < network->rates_len; i++) { 2062 network->rates[i] = info_element->data[i]; 2063 p += scnprintf(p, sizeof(rates_str) - 2064 (p - rates_str), "%02X ", 2065 network->rates[i]); 2066 if (rtllib_is_ofdm_rate 2067 (info_element->data[i])) { 2068 network->flags |= NETWORK_HAS_OFDM; 2069 if (info_element->data[i] & 2070 RTLLIB_BASIC_RATE_MASK) 2071 network->flags &= 2072 ~NETWORK_HAS_CCK; 2073 } 2074 2075 if (rtllib_is_cck_rate 2076 (info_element->data[i])) { 2077 network->flags |= NETWORK_HAS_CCK; 2078 } 2079 } 2080 2081 netdev_dbg(ieee->dev, "MFIE_TYPE_RATES: '%s' (%d)\n", 2082 rates_str, network->rates_len); 2083 break; 2084 2085 case MFIE_TYPE_RATES_EX: 2086 p = rates_str; 2087 network->rates_ex_len = min(info_element->len, 2088 MAX_RATES_EX_LENGTH); 2089 for (i = 0; i < network->rates_ex_len; i++) { 2090 network->rates_ex[i] = info_element->data[i]; 2091 p += scnprintf(p, sizeof(rates_str) - 2092 (p - rates_str), "%02X ", 2093 network->rates_ex[i]); 2094 if (rtllib_is_ofdm_rate 2095 (info_element->data[i])) { 2096 network->flags |= NETWORK_HAS_OFDM; 2097 if (info_element->data[i] & 2098 RTLLIB_BASIC_RATE_MASK) 2099 network->flags &= 2100 ~NETWORK_HAS_CCK; 2101 } 2102 } 2103 2104 netdev_dbg(ieee->dev, "MFIE_TYPE_RATES_EX: '%s' (%d)\n", 2105 rates_str, network->rates_ex_len); 2106 break; 2107 2108 case MFIE_TYPE_DS_SET: 2109 netdev_dbg(ieee->dev, "MFIE_TYPE_DS_SET: %d\n", 2110 info_element->data[0]); 2111 network->channel = info_element->data[0]; 2112 break; 2113 2114 case MFIE_TYPE_FH_SET: 2115 netdev_dbg(ieee->dev, "MFIE_TYPE_FH_SET: ignored\n"); 2116 break; 2117 2118 case MFIE_TYPE_CF_SET: 2119 netdev_dbg(ieee->dev, "MFIE_TYPE_CF_SET: ignored\n"); 2120 break; 2121 2122 case MFIE_TYPE_TIM: 2123 if (info_element->len < 4) 2124 break; 2125 2126 network->tim.tim_count = info_element->data[0]; 2127 network->tim.tim_period = info_element->data[1]; 2128 2129 network->dtim_period = info_element->data[1]; 2130 if (ieee->state != RTLLIB_LINKED) 2131 break; 2132 network->last_dtim_sta_time = jiffies; 2133 2134 network->dtim_data = RTLLIB_DTIM_VALID; 2135 2136 if (info_element->data[2] & 1) 2137 network->dtim_data |= RTLLIB_DTIM_MBCAST; 2138 2139 offset = (info_element->data[2] >> 1) * 2; 2140 2141 if (ieee->assoc_id < 8 * offset || 2142 ieee->assoc_id > 8 * (offset + info_element->len - 3)) 2143 break; 2144 2145 offset = (ieee->assoc_id / 8) - offset; 2146 if (info_element->data[3 + offset] & 2147 (1 << (ieee->assoc_id % 8))) 2148 network->dtim_data |= RTLLIB_DTIM_UCAST; 2149 2150 network->listen_interval = network->dtim_period; 2151 break; 2152 2153 case MFIE_TYPE_ERP: 2154 network->erp_value = info_element->data[0]; 2155 network->flags |= NETWORK_HAS_ERP_VALUE; 2156 netdev_dbg(ieee->dev, "MFIE_TYPE_ERP_SET: %d\n", 2157 network->erp_value); 2158 break; 2159 case MFIE_TYPE_IBSS_SET: 2160 network->atim_window = info_element->data[0]; 2161 netdev_dbg(ieee->dev, "MFIE_TYPE_IBSS_SET: %d\n", 2162 network->atim_window); 2163 break; 2164 2165 case MFIE_TYPE_CHALLENGE: 2166 netdev_dbg(ieee->dev, "MFIE_TYPE_CHALLENGE: ignored\n"); 2167 break; 2168 2169 case MFIE_TYPE_GENERIC: 2170 netdev_dbg(ieee->dev, "MFIE_TYPE_GENERIC: %d bytes\n", 2171 info_element->len); 2172 2173 rtllib_parse_mife_generic(ieee, info_element, network, 2174 &tmp_htcap_len, 2175 &tmp_htinfo_len); 2176 break; 2177 2178 case MFIE_TYPE_RSN: 2179 netdev_dbg(ieee->dev, "MFIE_TYPE_RSN: %d bytes\n", 2180 info_element->len); 2181 network->rsn_ie_len = min(info_element->len + 2, 2182 MAX_WPA_IE_LEN); 2183 memcpy(network->rsn_ie, info_element, 2184 network->rsn_ie_len); 2185 break; 2186 2187 case MFIE_TYPE_HT_CAP: 2188 netdev_dbg(ieee->dev, "MFIE_TYPE_HT_CAP: %d bytes\n", 2189 info_element->len); 2190 2191 rtllib_parse_mfie_ht_cap(info_element, network, 2192 &tmp_htcap_len); 2193 break; 2194 2195 case MFIE_TYPE_HT_INFO: 2196 netdev_dbg(ieee->dev, "MFIE_TYPE_HT_INFO: %d bytes\n", 2197 info_element->len); 2198 tmp_htinfo_len = min_t(u8, info_element->len, 2199 MAX_IE_LEN); 2200 if (tmp_htinfo_len) { 2201 network->bssht.bd_ht_spec_ver = HT_SPEC_VER_IEEE; 2202 network->bssht.bd_ht_info_len = tmp_htinfo_len > 2203 sizeof(network->bssht.bd_ht_info_buf) ? 2204 sizeof(network->bssht.bd_ht_info_buf) : 2205 tmp_htinfo_len; 2206 memcpy(network->bssht.bd_ht_info_buf, 2207 info_element->data, 2208 network->bssht.bd_ht_info_len); 2209 } 2210 break; 2211 2212 case MFIE_TYPE_AIRONET: 2213 netdev_dbg(ieee->dev, "MFIE_TYPE_AIRONET: %d bytes\n", 2214 info_element->len); 2215 if (info_element->len > IE_CISCO_FLAG_POSITION) { 2216 network->bWithAironetIE = true; 2217 2218 if ((info_element->data[IE_CISCO_FLAG_POSITION] 2219 & SUPPORT_CKIP_MIC) || 2220 (info_element->data[IE_CISCO_FLAG_POSITION] 2221 & SUPPORT_CKIP_PK)) 2222 network->bCkipSupported = true; 2223 else 2224 network->bCkipSupported = false; 2225 } else { 2226 network->bWithAironetIE = false; 2227 network->bCkipSupported = false; 2228 } 2229 break; 2230 case MFIE_TYPE_QOS_PARAMETER: 2231 netdev_err(ieee->dev, 2232 "QoS Error need to parse QOS_PARAMETER IE\n"); 2233 break; 2234 2235 case MFIE_TYPE_COUNTRY: 2236 netdev_dbg(ieee->dev, "MFIE_TYPE_COUNTRY: %d bytes\n", 2237 info_element->len); 2238 rtllib_extract_country_ie(ieee, info_element, network, 2239 network->bssid); 2240 break; 2241 /* TODO */ 2242 default: 2243 netdev_dbg(ieee->dev, 2244 "Unsupported info element: %s (%d)\n", 2245 get_info_element_string(info_element->id), 2246 info_element->id); 2247 break; 2248 } 2249 2250 length -= sizeof(*info_element) + info_element->len; 2251 info_element = 2252 (struct rtllib_info_element *)&info_element->data[info_element->len]; 2253 } 2254 2255 if (!network->atheros_cap_exist && !network->broadcom_cap_exist && 2256 !network->cisco_cap_exist && !network->ralink_cap_exist && 2257 !network->bssht.bd_rt2rt_aggregation) 2258 network->unknown_cap_exist = true; 2259 else 2260 network->unknown_cap_exist = false; 2261 return 0; 2262 } 2263 2264 static long rtllib_translate_todbm(u8 signal_strength_index) 2265 { 2266 long signal_power; 2267 2268 signal_power = (long)((signal_strength_index + 1) >> 1); 2269 signal_power -= 95; 2270 2271 return signal_power; 2272 } 2273 2274 static inline int rtllib_network_init( 2275 struct rtllib_device *ieee, 2276 struct rtllib_probe_response *beacon, 2277 struct rtllib_network *network, 2278 struct rtllib_rx_stats *stats) 2279 { 2280 memset(&network->qos_data, 0, sizeof(struct rtllib_qos_data)); 2281 2282 /* Pull out fixed field data */ 2283 ether_addr_copy(network->bssid, beacon->header.addr3); 2284 network->capability = le16_to_cpu(beacon->capability); 2285 network->last_scanned = jiffies; 2286 network->time_stamp[0] = beacon->time_stamp[0]; 2287 network->time_stamp[1] = beacon->time_stamp[1]; 2288 network->beacon_interval = le16_to_cpu(beacon->beacon_interval); 2289 /* Where to pull this? beacon->listen_interval;*/ 2290 network->listen_interval = 0x0A; 2291 network->rates_len = network->rates_ex_len = 0; 2292 network->ssid_len = 0; 2293 network->hidden_ssid_len = 0; 2294 memset(network->hidden_ssid, 0, sizeof(network->hidden_ssid)); 2295 network->flags = 0; 2296 network->atim_window = 0; 2297 network->erp_value = (network->capability & WLAN_CAPABILITY_IBSS) ? 2298 0x3 : 0x0; 2299 network->berp_info_valid = false; 2300 network->broadcom_cap_exist = false; 2301 network->ralink_cap_exist = false; 2302 network->atheros_cap_exist = false; 2303 network->cisco_cap_exist = false; 2304 network->unknown_cap_exist = false; 2305 network->realtek_cap_exit = false; 2306 network->marvell_cap_exist = false; 2307 network->airgo_cap_exist = false; 2308 network->Turbo_Enable = 0; 2309 network->SignalStrength = stats->SignalStrength; 2310 network->RSSI = stats->SignalStrength; 2311 network->CountryIeLen = 0; 2312 memset(network->CountryIeBuf, 0, MAX_IE_LEN); 2313 HTInitializeBssDesc(&network->bssht); 2314 if (stats->freq == RTLLIB_52GHZ_BAND) { 2315 /* for A band (No DS info) */ 2316 network->channel = stats->received_channel; 2317 } else 2318 network->flags |= NETWORK_HAS_CCK; 2319 2320 network->wpa_ie_len = 0; 2321 network->rsn_ie_len = 0; 2322 network->wzc_ie_len = 0; 2323 2324 if (rtllib_parse_info_param(ieee, 2325 beacon->info_element, 2326 (stats->len - sizeof(*beacon)), 2327 network, 2328 stats)) 2329 return 1; 2330 2331 network->mode = 0; 2332 if (stats->freq == RTLLIB_52GHZ_BAND) 2333 network->mode = IEEE_A; 2334 else { 2335 if (network->flags & NETWORK_HAS_OFDM) 2336 network->mode |= IEEE_G; 2337 if (network->flags & NETWORK_HAS_CCK) 2338 network->mode |= IEEE_B; 2339 } 2340 2341 if (network->mode == 0) { 2342 netdev_dbg(ieee->dev, "Filtered out '%s (%pM)' network.\n", 2343 escape_essid(network->ssid, network->ssid_len), 2344 network->bssid); 2345 return 1; 2346 } 2347 2348 if (network->bssht.bd_support_ht) { 2349 if (network->mode == IEEE_A) 2350 network->mode = IEEE_N_5G; 2351 else if (network->mode & (IEEE_G | IEEE_B)) 2352 network->mode = IEEE_N_24G; 2353 } 2354 if (rtllib_is_empty_essid(network->ssid, network->ssid_len)) 2355 network->flags |= NETWORK_EMPTY_ESSID; 2356 stats->signal = 30 + (stats->SignalStrength * 70) / 100; 2357 stats->noise = rtllib_translate_todbm((u8)(100 - stats->signal)) - 25; 2358 2359 memcpy(&network->stats, stats, sizeof(network->stats)); 2360 2361 return 0; 2362 } 2363 2364 static inline int is_same_network(struct rtllib_network *src, 2365 struct rtllib_network *dst, u8 ssidbroad) 2366 { 2367 /* A network is only a duplicate if the channel, BSSID, ESSID 2368 * and the capability field (in particular IBSS and BSS) all match. 2369 * We treat all <hidden> with the same BSSID and channel 2370 * as one network 2371 */ 2372 return (((src->ssid_len == dst->ssid_len) || (!ssidbroad)) && 2373 (src->channel == dst->channel) && 2374 !memcmp(src->bssid, dst->bssid, ETH_ALEN) && 2375 (!memcmp(src->ssid, dst->ssid, src->ssid_len) || 2376 (!ssidbroad)) && 2377 ((src->capability & WLAN_CAPABILITY_IBSS) == 2378 (dst->capability & WLAN_CAPABILITY_IBSS)) && 2379 ((src->capability & WLAN_CAPABILITY_ESS) == 2380 (dst->capability & WLAN_CAPABILITY_ESS))); 2381 } 2382 2383 static inline void update_network(struct rtllib_device *ieee, 2384 struct rtllib_network *dst, 2385 struct rtllib_network *src) 2386 { 2387 int qos_active; 2388 u8 old_param; 2389 2390 memcpy(&dst->stats, &src->stats, sizeof(struct rtllib_rx_stats)); 2391 dst->capability = src->capability; 2392 memcpy(dst->rates, src->rates, src->rates_len); 2393 dst->rates_len = src->rates_len; 2394 memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len); 2395 dst->rates_ex_len = src->rates_ex_len; 2396 if (src->ssid_len > 0) { 2397 if (dst->ssid_len == 0) { 2398 memset(dst->hidden_ssid, 0, sizeof(dst->hidden_ssid)); 2399 dst->hidden_ssid_len = src->ssid_len; 2400 memcpy(dst->hidden_ssid, src->ssid, src->ssid_len); 2401 } else { 2402 memset(dst->ssid, 0, dst->ssid_len); 2403 dst->ssid_len = src->ssid_len; 2404 memcpy(dst->ssid, src->ssid, src->ssid_len); 2405 } 2406 } 2407 dst->mode = src->mode; 2408 dst->flags = src->flags; 2409 dst->time_stamp[0] = src->time_stamp[0]; 2410 dst->time_stamp[1] = src->time_stamp[1]; 2411 if (src->flags & NETWORK_HAS_ERP_VALUE) { 2412 dst->erp_value = src->erp_value; 2413 dst->berp_info_valid = src->berp_info_valid = true; 2414 } 2415 dst->beacon_interval = src->beacon_interval; 2416 dst->listen_interval = src->listen_interval; 2417 dst->atim_window = src->atim_window; 2418 dst->dtim_period = src->dtim_period; 2419 dst->dtim_data = src->dtim_data; 2420 dst->last_dtim_sta_time = src->last_dtim_sta_time; 2421 memcpy(&dst->tim, &src->tim, sizeof(struct rtllib_tim_parameters)); 2422 2423 dst->bssht.bd_support_ht = src->bssht.bd_support_ht; 2424 dst->bssht.bd_rt2rt_aggregation = src->bssht.bd_rt2rt_aggregation; 2425 dst->bssht.bd_ht_cap_len = src->bssht.bd_ht_cap_len; 2426 memcpy(dst->bssht.bd_ht_cap_buf, src->bssht.bd_ht_cap_buf, 2427 src->bssht.bd_ht_cap_len); 2428 dst->bssht.bd_ht_info_len = src->bssht.bd_ht_info_len; 2429 memcpy(dst->bssht.bd_ht_info_buf, src->bssht.bd_ht_info_buf, 2430 src->bssht.bd_ht_info_len); 2431 dst->bssht.bd_ht_spec_ver = src->bssht.bd_ht_spec_ver; 2432 dst->bssht.bd_rt2rt_long_slot_time = src->bssht.bd_rt2rt_long_slot_time; 2433 dst->broadcom_cap_exist = src->broadcom_cap_exist; 2434 dst->ralink_cap_exist = src->ralink_cap_exist; 2435 dst->atheros_cap_exist = src->atheros_cap_exist; 2436 dst->realtek_cap_exit = src->realtek_cap_exit; 2437 dst->marvell_cap_exist = src->marvell_cap_exist; 2438 dst->cisco_cap_exist = src->cisco_cap_exist; 2439 dst->airgo_cap_exist = src->airgo_cap_exist; 2440 dst->unknown_cap_exist = src->unknown_cap_exist; 2441 memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len); 2442 dst->wpa_ie_len = src->wpa_ie_len; 2443 memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len); 2444 dst->rsn_ie_len = src->rsn_ie_len; 2445 memcpy(dst->wzc_ie, src->wzc_ie, src->wzc_ie_len); 2446 dst->wzc_ie_len = src->wzc_ie_len; 2447 2448 dst->last_scanned = jiffies; 2449 /* qos related parameters */ 2450 qos_active = dst->qos_data.active; 2451 old_param = dst->qos_data.param_count; 2452 dst->qos_data.supported = src->qos_data.supported; 2453 if (dst->flags & NETWORK_HAS_QOS_PARAMETERS) 2454 memcpy(&dst->qos_data, &src->qos_data, 2455 sizeof(struct rtllib_qos_data)); 2456 if (dst->qos_data.supported == 1) { 2457 if (dst->ssid_len) 2458 netdev_dbg(ieee->dev, 2459 "QoS the network %s is QoS supported\n", 2460 dst->ssid); 2461 else 2462 netdev_dbg(ieee->dev, 2463 "QoS the network is QoS supported\n"); 2464 } 2465 dst->qos_data.active = qos_active; 2466 dst->qos_data.old_param_count = old_param; 2467 2468 dst->wmm_info = src->wmm_info; 2469 if (src->wmm_param[0].ac_aci_acm_aifsn || 2470 src->wmm_param[1].ac_aci_acm_aifsn || 2471 src->wmm_param[2].ac_aci_acm_aifsn || 2472 src->wmm_param[3].ac_aci_acm_aifsn) 2473 memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN); 2474 2475 dst->SignalStrength = src->SignalStrength; 2476 dst->RSSI = src->RSSI; 2477 dst->Turbo_Enable = src->Turbo_Enable; 2478 2479 dst->CountryIeLen = src->CountryIeLen; 2480 memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen); 2481 2482 dst->bWithAironetIE = src->bWithAironetIE; 2483 dst->bCkipSupported = src->bCkipSupported; 2484 memcpy(dst->CcxRmState, src->CcxRmState, 2); 2485 dst->bCcxRmEnable = src->bCcxRmEnable; 2486 dst->MBssidMask = src->MBssidMask; 2487 dst->bMBssidValid = src->bMBssidValid; 2488 memcpy(dst->MBssid, src->MBssid, 6); 2489 dst->bWithCcxVerNum = src->bWithCcxVerNum; 2490 dst->BssCcxVerNumber = src->BssCcxVerNumber; 2491 } 2492 2493 static inline int is_beacon(u16 fc) 2494 { 2495 return (WLAN_FC_GET_STYPE(fc) == RTLLIB_STYPE_BEACON); 2496 } 2497 2498 static int IsPassiveChannel(struct rtllib_device *rtllib, u8 channel) 2499 { 2500 if (channel > MAX_CHANNEL_NUMBER) { 2501 netdev_info(rtllib->dev, "%s(): Invalid Channel\n", __func__); 2502 return 0; 2503 } 2504 2505 if (rtllib->active_channel_map[channel] == 2) 2506 return 1; 2507 2508 return 0; 2509 } 2510 2511 int rtllib_legal_channel(struct rtllib_device *rtllib, u8 channel) 2512 { 2513 if (channel > MAX_CHANNEL_NUMBER) { 2514 netdev_info(rtllib->dev, "%s(): Invalid Channel\n", __func__); 2515 return 0; 2516 } 2517 if (rtllib->active_channel_map[channel] > 0) 2518 return 1; 2519 2520 return 0; 2521 } 2522 EXPORT_SYMBOL(rtllib_legal_channel); 2523 2524 static inline void rtllib_process_probe_response( 2525 struct rtllib_device *ieee, 2526 struct rtllib_probe_response *beacon, 2527 struct rtllib_rx_stats *stats) 2528 { 2529 struct rtllib_network *target; 2530 struct rtllib_network *oldest = NULL; 2531 struct rtllib_info_element *info_element = &beacon->info_element[0]; 2532 unsigned long flags; 2533 short renew; 2534 struct rtllib_network *network = kzalloc(sizeof(struct rtllib_network), 2535 GFP_ATOMIC); 2536 u16 frame_ctl = le16_to_cpu(beacon->header.frame_ctl); 2537 2538 if (!network) 2539 return; 2540 2541 netdev_dbg(ieee->dev, 2542 "'%s' ( %pM ): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n", 2543 escape_essid(info_element->data, info_element->len), 2544 beacon->header.addr3, 2545 (le16_to_cpu(beacon->capability) & (1 << 0xf)) ? '1' : '0', 2546 (le16_to_cpu(beacon->capability) & (1 << 0xe)) ? '1' : '0', 2547 (le16_to_cpu(beacon->capability) & (1 << 0xd)) ? '1' : '0', 2548 (le16_to_cpu(beacon->capability) & (1 << 0xc)) ? '1' : '0', 2549 (le16_to_cpu(beacon->capability) & (1 << 0xb)) ? '1' : '0', 2550 (le16_to_cpu(beacon->capability) & (1 << 0xa)) ? '1' : '0', 2551 (le16_to_cpu(beacon->capability) & (1 << 0x9)) ? '1' : '0', 2552 (le16_to_cpu(beacon->capability) & (1 << 0x8)) ? '1' : '0', 2553 (le16_to_cpu(beacon->capability) & (1 << 0x7)) ? '1' : '0', 2554 (le16_to_cpu(beacon->capability) & (1 << 0x6)) ? '1' : '0', 2555 (le16_to_cpu(beacon->capability) & (1 << 0x5)) ? '1' : '0', 2556 (le16_to_cpu(beacon->capability) & (1 << 0x4)) ? '1' : '0', 2557 (le16_to_cpu(beacon->capability) & (1 << 0x3)) ? '1' : '0', 2558 (le16_to_cpu(beacon->capability) & (1 << 0x2)) ? '1' : '0', 2559 (le16_to_cpu(beacon->capability) & (1 << 0x1)) ? '1' : '0', 2560 (le16_to_cpu(beacon->capability) & (1 << 0x0)) ? '1' : '0'); 2561 2562 if (rtllib_network_init(ieee, beacon, network, stats)) { 2563 netdev_dbg(ieee->dev, "Dropped '%s' ( %pM) via %s.\n", 2564 escape_essid(info_element->data, info_element->len), 2565 beacon->header.addr3, 2566 is_beacon(frame_ctl) ? "BEACON" : "PROBE RESPONSE"); 2567 goto free_network; 2568 } 2569 2570 if (!rtllib_legal_channel(ieee, network->channel)) 2571 goto free_network; 2572 2573 if (WLAN_FC_GET_STYPE(frame_ctl) == RTLLIB_STYPE_PROBE_RESP) { 2574 if (IsPassiveChannel(ieee, network->channel)) { 2575 netdev_info(ieee->dev, 2576 "GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n", 2577 network->channel); 2578 goto free_network; 2579 } 2580 } 2581 2582 /* The network parsed correctly -- so now we scan our known networks 2583 * to see if we can find it in our list. 2584 * 2585 * NOTE: This search is definitely not optimized. Once its doing 2586 * the "right thing" we'll optimize it for efficiency if 2587 * necessary 2588 */ 2589 2590 /* Search for this entry in the list and update it if it is 2591 * already there. 2592 */ 2593 2594 spin_lock_irqsave(&ieee->lock, flags); 2595 if (is_same_network(&ieee->current_network, network, 2596 (network->ssid_len ? 1 : 0))) { 2597 update_network(ieee, &ieee->current_network, network); 2598 if ((ieee->current_network.mode == IEEE_N_24G || 2599 ieee->current_network.mode == IEEE_G) && 2600 ieee->current_network.berp_info_valid) { 2601 if (ieee->current_network.erp_value & ERP_UseProtection) 2602 ieee->current_network.buseprotection = true; 2603 else 2604 ieee->current_network.buseprotection = false; 2605 } 2606 if (is_beacon(frame_ctl)) { 2607 if (ieee->state >= RTLLIB_LINKED) 2608 ieee->link_detect_info.NumRecvBcnInPeriod++; 2609 } 2610 } 2611 list_for_each_entry(target, &ieee->network_list, list) { 2612 if (is_same_network(target, network, 2613 (target->ssid_len ? 1 : 0))) 2614 break; 2615 if ((oldest == NULL) || 2616 (target->last_scanned < oldest->last_scanned)) 2617 oldest = target; 2618 } 2619 2620 /* If we didn't find a match, then get a new network slot to initialize 2621 * with this beacon's information 2622 */ 2623 if (&target->list == &ieee->network_list) { 2624 if (list_empty(&ieee->network_free_list)) { 2625 /* If there are no more slots, expire the oldest */ 2626 list_del(&oldest->list); 2627 target = oldest; 2628 netdev_dbg(ieee->dev, 2629 "Expired '%s' ( %pM) from network list.\n", 2630 escape_essid(target->ssid, target->ssid_len), 2631 target->bssid); 2632 } else { 2633 /* Otherwise just pull from the free list */ 2634 target = list_entry(ieee->network_free_list.next, 2635 struct rtllib_network, list); 2636 list_del(ieee->network_free_list.next); 2637 } 2638 2639 netdev_dbg(ieee->dev, "Adding '%s' ( %pM) via %s.\n", 2640 escape_essid(network->ssid, network->ssid_len), 2641 network->bssid, 2642 is_beacon(frame_ctl) ? "BEACON" : "PROBE RESPONSE"); 2643 2644 memcpy(target, network, sizeof(*target)); 2645 list_add_tail(&target->list, &ieee->network_list); 2646 if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE) 2647 rtllib_softmac_new_net(ieee, network); 2648 } else { 2649 netdev_dbg(ieee->dev, "Updating '%s' ( %pM) via %s.\n", 2650 escape_essid(target->ssid, target->ssid_len), 2651 target->bssid, 2652 is_beacon(frame_ctl) ? "BEACON" : "PROBE RESPONSE"); 2653 2654 /* we have an entry and we are going to update it. But this 2655 * entry may be already expired. In this case we do the same 2656 * as we found a new net and call the new_net handler 2657 */ 2658 renew = !time_after(target->last_scanned + ieee->scan_age, 2659 jiffies); 2660 if ((!target->ssid_len) && 2661 (((network->ssid_len > 0) && (target->hidden_ssid_len == 0)) 2662 || ((ieee->current_network.ssid_len == network->ssid_len) && 2663 (strncmp(ieee->current_network.ssid, network->ssid, 2664 network->ssid_len) == 0) && 2665 (ieee->state == RTLLIB_NOLINK)))) 2666 renew = 1; 2667 update_network(ieee, target, network); 2668 if (renew && (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE)) 2669 rtllib_softmac_new_net(ieee, network); 2670 } 2671 2672 spin_unlock_irqrestore(&ieee->lock, flags); 2673 if (is_beacon(frame_ctl) && 2674 is_same_network(&ieee->current_network, network, 2675 (network->ssid_len ? 1 : 0)) && 2676 (ieee->state == RTLLIB_LINKED)) { 2677 ieee->handle_beacon(ieee->dev, beacon, &ieee->current_network); 2678 } 2679 free_network: 2680 kfree(network); 2681 } 2682 2683 static void rtllib_rx_mgt(struct rtllib_device *ieee, 2684 struct sk_buff *skb, 2685 struct rtllib_rx_stats *stats) 2686 { 2687 struct rtllib_hdr_4addr *header = (struct rtllib_hdr_4addr *)skb->data; 2688 2689 if ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) != 2690 RTLLIB_STYPE_PROBE_RESP) && 2691 (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) != 2692 RTLLIB_STYPE_BEACON)) 2693 ieee->last_rx_ps_time = jiffies; 2694 2695 switch (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl))) { 2696 case RTLLIB_STYPE_BEACON: 2697 netdev_dbg(ieee->dev, "received BEACON (%d)\n", 2698 WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl))); 2699 rtllib_process_probe_response( 2700 ieee, (struct rtllib_probe_response *)header, 2701 stats); 2702 2703 if (ieee->sta_sleep || (ieee->ps != RTLLIB_PS_DISABLED && 2704 ieee->iw_mode == IW_MODE_INFRA && 2705 ieee->state == RTLLIB_LINKED)) 2706 schedule_work(&ieee->ps_task); 2707 2708 break; 2709 2710 case RTLLIB_STYPE_PROBE_RESP: 2711 netdev_dbg(ieee->dev, "received PROBE RESPONSE (%d)\n", 2712 WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl))); 2713 rtllib_process_probe_response(ieee, 2714 (struct rtllib_probe_response *)header, stats); 2715 break; 2716 case RTLLIB_STYPE_PROBE_REQ: 2717 netdev_dbg(ieee->dev, "received PROBE REQUEST (%d)\n", 2718 WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl))); 2719 if ((ieee->softmac_features & IEEE_SOFTMAC_PROBERS) && 2720 ((ieee->iw_mode == IW_MODE_ADHOC || 2721 ieee->iw_mode == IW_MODE_MASTER) && 2722 ieee->state == RTLLIB_LINKED)) 2723 rtllib_rx_probe_rq(ieee, skb); 2724 break; 2725 } 2726 } 2727