24 #include <linux/compiler.h>
26 #include <linux/errno.h>
27 #include <linux/if_arp.h>
28 #include <linux/in6.h>
31 #include <linux/kernel.h>
32 #include <linux/module.h>
33 #include <linux/netdevice.h>
34 #include <linux/pci.h>
37 #include <linux/slab.h>
38 #include <linux/tcp.h>
39 #include <linux/types.h>
40 #include <linux/wireless.h>
42 #include <asm/uaccess.h>
43 #include <linux/ctype.h>
55 skb_reset_mac_header(skb);
60 memset(skb->cb, 0,
sizeof(skb->cb));
78 "expiring fragment cache entry "
79 "seq=%u last_frag=%u\n",
86 (entry->
last_frag + 1 == frag || frag == -1) &&
126 skb = dev_alloc_skb(ieee->
dev->mtu +
153 entry = ieee80211_frag_cache_find(ieee, seq, frag, tid,hdr->
addr2,
191 entry = ieee80211_frag_cache_find(ieee, seq, -1, tid,hdr->
addr2,
196 "could not invalidate fragment cache "
197 "entry (seq=%u)\n", seq);
248 if (ieee->hostapd && type == IEEE80211_TYPE_MGMT) {
249 if (stype == WLAN_FC_STYPE_BEACON &&
261 ieee->apdevstats.rx_packets++;
262 ieee->apdevstats.rx_bytes += skb->
len;
268 if (type != WLAN_FC_TYPE_MGMT && type != WLAN_FC_TYPE_CTRL) {
270 "(type=0x%02x, stype=0x%02x) dropped\n",
271 skb->
dev->name, type, stype);
280 "received in non-Host AP mode\n", skb->
dev->name);
289 static unsigned char rfc1042_header[] =
290 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
292 static unsigned char bridge_tunnel_header[] =
293 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
324 if (skb->
len < 24 + 8)
330 ethertype = (pos[6] << 8) | pos[7];
345 if (crypt ==
NULL || crypt->
ops->decrypt_mpdu ==
NULL)
355 #ifdef CONFIG_IEEE80211_CRYPT_TKIP
360 "received packet from %pM\n",
368 res = crypt->
ops->decrypt_mpdu(skb, hdrlen, crypt->
priv);
372 "decryption failed (SA=%pM"
373 ") res=%d\n", hdr->
addr2, res);
376 "mismatch (key %d)\n",
377 skb->
data[hdrlen + 3] >> 6);
394 if (crypt ==
NULL || crypt->
ops->decrypt_msdu ==
NULL)
406 res = crypt->
ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->
priv);
410 " (SA=%pM keyidx=%d)\n",
411 ieee->
dev->name, hdr->
addr2, keyidx);
420 #define IEEE_PACKET_RETRY_TIME (5*HZ)
428 u16 *last_seq, *last_frag;
478 last_seq = &entry->
seq_num[tid];
497 if ((*last_seq == seq) &&
499 if (*last_frag == frag){
504 if (*last_frag + 1 != frag)
543 pReorderEntry->
List.next = pList->
next;
544 pReorderEntry->
List.next->prev = &pReorderEntry->
List;
545 pReorderEntry->
List.prev = pList;
565 ethertype = (sub_skb->
data[6] << 8) | sub_skb->
data[7];
566 if (sub_skb->
len >= 8 &&
590 memset(sub_skb->cb, 0,
sizeof(sub_skb->cb));
616 bool bMatchWinStart =
false, bPktInBuf =
false;
646 bMatchWinStart =
true;
647 }
else if(
SN_LESS(WinEnd, SeqNum)) {
648 if(SeqNum >= (WinSize - 1)) {
669 prxbIndicateArray[0] = prxb;
677 list_del_init(&pReorderEntry->
List);
680 pReorderEntry->
SeqNum = SeqNum;
681 pReorderEntry->
prxb = prxb;
698 "Pkt insert into buffer!! IndicateSeq: %d, NewSeq: %d\n",pTS->
RxIndicateSeq, SeqNum);
733 list_del_init(&pReorderEntry->
List);
739 prxbIndicateArray[
index] = pReorderEntry->
prxb;
784 bool bIsAggregateFrame =
false;
785 u16 nSubframe_Length;
786 u8 nPadding_Length = 0;
796 bIsAggregateFrame =
true;
808 ChkLength = LLCOffset;
810 if( skb->
len <= ChkLength ) {
816 if(!bIsAggregateFrame) {
834 nSubframe_Length = *((
u16*)(skb->
data + 12));
836 nSubframe_Length = (nSubframe_Length>>8) + (nSubframe_Length<<8);
839 printk(
"%s: A-MSDU parse error!! pRfd->nTotalSubframe : %d\n",\
841 printk(
"%s: A-MSDU parse error!! Subframe Length: %d\n",
__FUNCTION__, nSubframe_Length);
842 printk(
"nRemain_Length is %d and nSubframe_Length is : %d\n",skb->
len,nSubframe_Length);
843 printk(
"The Packet SeqNum is %d\n",SeqNum);
852 sub_skb->
len = nSubframe_Length;
853 sub_skb->
tail = sub_skb->
data + nSubframe_Length;
856 sub_skb = dev_alloc_skb(nSubframe_Length + 12);
857 skb_reserve(sub_skb, 12);
858 data_ptr = (
u8 *)
skb_put(sub_skb, nSubframe_Length);
870 if(nPadding_Length == 4) {
874 if(skb->
len < nPadding_Length) {
917 int frame_authorized = 0;
918 int from_assoc_ap = 0;
932 stats = &ieee->
stats;
951 printk(
"find HTCControl\n");
958 #if WIRELESS_EXT > 15
961 #ifdef IW_WIRELESS_SPY
963 if (iface->spy_data.spy_number > 0) {
976 #if WIRELESS_EXT > 15
978 ieee80211_monitor_rx(ieee, skb, rx_stats);
986 if (skb->
len >= hdrlen + 3)
987 idx = skb->
data[hdrlen + 3] >> 6;
999 if (!(hdr->
addr1[0] & 0x01) || local->bcrx_sta_key)
1006 if (crypt && (crypt->
ops ==
NULL ||
1007 crypt->
ops->decrypt_mpdu ==
NULL))
1018 ieee->
ieee_stats.rx_discards_undecryptable++;
1028 if (is_duplicate_packet(ieee, hdr))
1040 (
u8)Frame_QoSTID((
u8*)(skb->
data)),
1046 if( (fc & (1<<11)) &&
1068 if (ieee80211_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
1101 if (hostap_rx_frame_wds(ieee, hdr, fc, &wds))
1104 skb->
dev = dev = wds;
1113 skb->
dev = dev = ieee->stadev;
1128 frame_authorized = 0;
1131 frame_authorized = 1;
1151 "RX: dropped data frame "
1152 "with no data (type=0x%02x, "
1153 "subtype=0x%02x, len=%d)\n",
1154 type, stype, skb->
len);
1163 (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
1165 printk(
"decrypt frame error\n");
1177 struct sk_buff *frag_skb = ieee80211_frag_cache_get(ieee, hdr);
1182 "Rx cannot get skb from fragment "
1183 "cache (morefrag=%d seq=%u frag=%u)\n",
1184 (fc & IEEE80211_FCTL_MOREFRAGS) != 0,
1192 if (frag_skb->
tail + flen > frag_skb->
end) {
1194 "reassembled frame did not fit skb\n",
1196 ieee80211_frag_cache_invalidate(ieee, hdr);
1213 if (fc & IEEE80211_FCTL_MOREFRAGS) {
1224 ieee80211_frag_cache_invalidate(ieee, hdr);
1230 ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
1232 printk(
"==>decrypt msdu error\n");
1241 if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->
open_wep) {
1243 ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
1245 #ifdef CONFIG_IEEE80211_DEBUG
1251 eap_get_type(eap->
type));
1255 "encryption configured, but RX "
1256 "frame not encrypted (SA=%pM)\n",
1262 #ifdef CONFIG_IEEE80211_DEBUG
1263 if (crypt && !(fc & IEEE80211_FCTL_WEP) &&
1264 ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
1268 eap_get_type(eap->
type));
1272 if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->
open_wep &&
1273 !ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
1275 "dropped unencrypted RX data "
1277 " (drop_unencrypted=1)\n",
1288 && !is_multicast_ether_addr(hdr->
addr1))
1290 TID = Frame_QoSTID(skb->
data);
1293 if(TID !=0 && TID !=3)
1328 ethertype = (sub_skb->
data[6] << 8) | sub_skb->
data[7];
1329 if (sub_skb->
len >= 8 &&
1349 if(is_multicast_ether_addr(dst)) {
1356 memset(sub_skb->cb, 0,
sizeof(sub_skb->cb));
1396 #define MGMT_FRAME_FIXED_PART_LENGTH 0x24
1431 if ((info_element ==
NULL) || (element_param ==
NULL))
1442 ret = ieee80211_verify_qos_info(&element_param->
info_element,
1450 static int ieee80211_read_qos_info_element(
struct
1458 if (element_info ==
NULL)
1460 if (info_element ==
NULL)
1467 element_info->
length = info_element->
len;
1472 ret = ieee80211_verify_qos_info(element_info,
1481 static int ieee80211_qos_convert_ac_to_parameters(
struct
1497 aci = (ac_params->
aci_aifsn & 0x60) >> 5;
1499 if(aci >= QOS_QUEUE_NUM)
1504 qos_param->
aifs[aci] = (qos_param->
aifs[aci] < 2) ? 2:qos_param->
aifs[aci];
1510 qos_param->
flag[aci] =
1511 (ac_params->
aci_aifsn & 0x10) ? 0x01 : 0x00;
1530 rc = ieee80211_read_qos_info_element(&qos_info_element, info_element);
1533 network->
qos_data.param_count = qos_info_element.ac_info & 0x0F;
1538 rc = ieee80211_read_qos_param_element(¶m_element,
1541 qos_param = &(network->
qos_data.parameters);
1542 ieee80211_qos_convert_ac_to_parameters(¶m_element,
1546 param_element.info_element.ac_info & 0x0F;
1557 #ifdef CONFIG_IEEE80211_DEBUG
1558 #define MFIE_STRING(x) case MFIE_TYPE_ ##x: return #x
1560 static const char *get_info_element_string(
u16 id)
1596 static inline void ieee80211_extract_country_ie(
1605 if(info_element->
len!= 0)
1637 u16 tmp_htcap_len=0;
1638 u16 tmp_htinfo_len=0;
1639 u16 ht_realtek_agg_len=0;
1642 #ifdef CONFIG_IEEE80211_DEBUG
1647 while (length >=
sizeof(*info_element)) {
1648 if (
sizeof(*info_element) + info_element->
len > length) {
1650 "info_element->len + 2 > left : "
1651 "info_element->len+2=%zd left=%d, id=%d.\n",
1653 sizeof(*info_element),
1654 length, info_element->
id);
1661 switch (info_element->
id) {
1664 info_element->
len)) {
1672 if (network->
ssid_len < IW_ESSID_MAX_SIZE)
1674 IW_ESSID_MAX_SIZE - network->
ssid_len);
1681 #ifdef CONFIG_IEEE80211_DEBUG
1686 for (i = 0; i < network->
rates_len; i++) {
1688 #ifdef CONFIG_IEEE80211_DEBUG
1689 p +=
snprintf(p,
sizeof(rates_str) -
1690 (p - rates_str),
"%02X ",
1693 if (ieee80211_is_ofdm_rate
1694 (info_element->
data[i])) {
1696 if (info_element->
data[i] &
1708 #ifdef CONFIG_IEEE80211_DEBUG
1715 #ifdef CONFIG_IEEE80211_DEBUG
1716 p +=
snprintf(p,
sizeof(rates_str) -
1717 (p - rates_str),
"%02X ",
1720 if (ieee80211_is_ofdm_rate
1721 (info_element->
data[i])) {
1723 if (info_element->
data[i] &
1736 info_element->
data[0]);
1749 if(info_element->
len < 4)
1752 network->
tim.tim_count = info_element->
data[0];
1753 network->
tim.tim_period = info_element->
data[1];
1764 if(info_element->
data[0] != 0)
1767 if(info_element->
data[2] & 1)
1770 offset = (info_element->
data[2] >> 1)*2;
1775 ieee->
assoc_id > 8*(offset + info_element->
len -3))
1779 offset = (ieee->
assoc_id / 8) - offset;
1781 if(info_element->
data[3+offset] & (1<<(ieee->
assoc_id%8)))
1806 if (!ieee80211_parse_qos_info_param_IE(info_element,
1810 if (info_element->
len >= 4 &&
1811 info_element->
data[0] == 0x00 &&
1812 info_element->
data[1] == 0x50 &&
1813 info_element->
data[2] == 0xf2 &&
1814 info_element->
data[3] == 0x01) {
1823 if (info_element->
len == 7 &&
1824 info_element->
data[0] == 0x00 &&
1825 info_element->
data[1] == 0xe0 &&
1826 info_element->
data[2] == 0x4c &&
1827 info_element->
data[3] == 0x01 &&
1828 info_element->
data[4] == 0x02) {
1834 if(tmp_htcap_len == 0){
1835 if(info_element->
len >= 4 &&
1836 info_element->
data[0] == 0x00 &&
1837 info_element->
data[1] == 0x90 &&
1838 info_element->
data[2] == 0x4c &&
1839 info_element->
data[3] == 0x033){
1842 if(tmp_htcap_len != 0){
1849 if(tmp_htcap_len != 0)
1856 if(tmp_htinfo_len == 0){
1857 if(info_element->
len >= 4 &&
1858 info_element->
data[0] == 0x00 &&
1859 info_element->
data[1] == 0x90 &&
1860 info_element->
data[2] == 0x4c &&
1861 info_element->
data[3] == 0x034){
1864 if(tmp_htinfo_len != 0){
1879 if(info_element->
len >= 4 &&
1880 info_element->
data[0] == 0x00 &&
1881 info_element->
data[1] == 0xe0 &&
1882 info_element->
data[2] == 0x4c &&
1883 info_element->
data[3] == 0x02){
1886 memcpy(ht_realtek_agg_buf,info_element->
data,info_element->
len);
1889 if(ht_realtek_agg_len >= 5){
1892 if((ht_realtek_agg_buf[4] == 1) && (ht_realtek_agg_buf[5] & 0x02))
1901 if((info_element->
len >= 3 &&
1902 info_element->
data[0] == 0x00 &&
1903 info_element->
data[1] == 0x05 &&
1904 info_element->
data[2] == 0xb5) ||
1905 (info_element->
len >= 3 &&
1906 info_element->
data[0] == 0x00 &&
1907 info_element->
data[1] == 0x0a &&
1908 info_element->
data[2] == 0xf7) ||
1909 (info_element->
len >= 3 &&
1910 info_element->
data[0] == 0x00 &&
1911 info_element->
data[1] == 0x10 &&
1912 info_element->
data[2] == 0x18)){
1918 if(info_element->
len >= 3 &&
1919 info_element->
data[0] == 0x00 &&
1920 info_element->
data[1] == 0x0c &&
1921 info_element->
data[2] == 0x43)
1928 if((info_element->
len >= 3 &&
1929 info_element->
data[0] == 0x00 &&
1930 info_element->
data[1] == 0x03 &&
1931 info_element->
data[2] == 0x7f) ||
1932 (info_element->
len >= 3 &&
1933 info_element->
data[0] == 0x00 &&
1934 info_element->
data[1] == 0x13 &&
1935 info_element->
data[2] == 0x74))
1943 if(info_element->
len >= 3 &&
1944 info_element->
data[0] == 0x00 &&
1945 info_element->
data[1] == 0x40 &&
1946 info_element->
data[2] == 0x96)
1953 if(info_element->
len > 4 &&
1954 info_element->
data[0] == 0x00 &&
1955 info_element->
data[1] == 0x40 &&
1956 info_element->
data[2] == 0x96 &&
1957 info_element->
data[3] == 0x01)
1959 if(info_element->
len == 6)
1989 if(info_element->
len > 4 &&
1990 info_element->
data[0] == 0x00 &&
1991 info_element->
data[1] == 0x40 &&
1992 info_element->
data[2] == 0x96 &&
1993 info_element->
data[3] == 0x03)
1995 if(info_element->
len == 5)
2022 if(tmp_htcap_len != 0){
2041 tmp_htinfo_len =
min(info_element->
len,(
u8)MAX_IE_LEN);
2078 "QoS Error need to parse QOS_PARAMETER IE\n");
2085 ieee80211_extract_country_ie(ieee, info_element, network, network->
bssid);
2090 (
"Unsupported info element: %s (%d)\n",
2091 get_info_element_string(info_element->
id),
2096 length -=
sizeof(*info_element) + info_element->
len;
2114 static inline u8 ieee80211_SignalStrengthTranslate(
2121 if(CurrSS >= 71 && CurrSS <= 100)
2123 RetSS = 90 + ((CurrSS - 70) / 3);
2125 else if(CurrSS >= 41 && CurrSS <= 70)
2127 RetSS = 78 + ((CurrSS - 40) / 3);
2129 else if(CurrSS >= 31 && CurrSS <= 40)
2131 RetSS = 66 + (CurrSS - 30);
2133 else if(CurrSS >= 21 && CurrSS <= 30)
2135 RetSS = 54 + (CurrSS - 20);
2137 else if(CurrSS >= 5 && CurrSS <= 20)
2139 RetSS = 42 + (((CurrSS - 5) * 2) / 3);
2141 else if(CurrSS == 4)
2145 else if(CurrSS == 3)
2149 else if(CurrSS == 2)
2153 else if(CurrSS == 1)
2175 signal_power = (
long)((signal_strength_index + 1) >> 1);
2178 return signal_power;
2187 #ifdef CONFIG_IEEE80211_DEBUG
2195 network->
qos_data.old_param_count = 0;
2237 (ieee,beacon->
info_element, stats->
len -
sizeof(*beacon), network, stats))
2250 if (network->
mode == 0) {
2253 escape_essid(network->
ssid,
2355 old_param = dst->
qos_data.param_count;
2368 (
"QoS the network %s is QoS supported\n",
2372 (
"QoS the network is QoS supported\n");
2375 dst->
qos_data.old_param_count = old_param;
2379 if(src->
wmm_param[0].ac_aci_acm_aifsn|| \
2406 static inline int is_beacon(
__le16 fc)
2419 #ifdef CONFIG_IEEE80211_DEBUG
2422 unsigned long flags;
2428 "'%s' (%pM): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
2429 escape_essid(info_element->
data, info_element->
len),
2446 (beacon->
capability & (1<<0x0)) ?
'1' :
'0');
2450 escape_essid(info_element->
data,
2455 "PROBE RESPONSE" :
"BEACON");
2477 printk(
"GetScanInfo(): For Country code, filter probe response at channel(%d).\n", network.
channel);
2487 printk(
"GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n", network.
channel);
2499 printk(
"GetScanInfo(): For Country code, filter beacon at channel(%d).\n",network.
channel);
2509 printk(
"GetScanInfo(): For Global Domain, filter beacon at channel(%d).\n",network.
channel);
2537 if(is_beacon(beacon->
header.frame_ctl))
2547 if (is_same_network(target, &network, ieee))
2549 if ((oldest ==
NULL) ||
2563 escape_essid(target->
ssid,
2574 #ifdef CONFIG_IEEE80211_DEBUG
2576 escape_essid(network.
ssid,
2581 "PROBE RESPONSE" :
"BEACON");
2583 memcpy(target, &network,
sizeof(*target));
2589 escape_essid(target->
ssid,
2594 "PROBE RESPONSE" :
"BEACON");
2602 if(is_beacon(beacon->
header.frame_ctl) == 0)
2617 spin_unlock_irqrestore(&ieee->
lock, flags);