net/wireless/radiotap.c

   1 /*
   2  * Radiotap parser
   3  *
   4  * Copyright 2007               Andy Green <andy@warmcat.com>
   5  */
   6
   7 #include <net/cfg80211.h>
   8 #include <net/ieee80211_radiotap.h>
   9 #include <asm/unaligned.h>
  10
  11 /* function prototypes and related defs are in include/net/cfg80211.h */
  12
  13 /**
  14  * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
  15  * @iterator: radiotap_iterator to initialize
  16  * @radiotap_header: radiotap header to parse
  17  * @max_length: total length we can parse into (eg, whole packet length)
  18  *
  19  * Returns: 0 or a negative error code if there is a problem.
  20  *
  21  * This function initializes an opaque iterator struct which can then
  22  * be passed to ieee80211_radiotap_iterator_next() to visit every radiotap
  23  * argument which is present in the header.  It knows about extended
  24  * present headers and handles them.
  25  *
  26  * How to use:
  27  * call __ieee80211_radiotap_iterator_init() to init a semi-opaque iterator
  28  * struct ieee80211_radiotap_iterator (no need to init the struct beforehand)
  29  * checking for a good 0 return code.  Then loop calling
  30  * __ieee80211_radiotap_iterator_next()... it returns either 0,
  31  * -ENOENT if there are no more args to parse, or -EINVAL if there is a problem.
  32  * The iterator's @this_arg member points to the start of the argument
  33  * associated with the current argument index that is present, which can be
  34  * found in the iterator's @this_arg_index member.  This arg index corresponds
  35  * to the IEEE80211_RADIOTAP_... defines.
  36  *
  37  * Radiotap header length:
  38  * You can find the CPU-endian total radiotap header length in
  39  * iterator->max_length after executing ieee80211_radiotap_iterator_init()
  40  * successfully.
  41  *
  42  * Alignment Gotcha:
  43  * You must take care when dereferencing iterator.this_arg
  44  * for multibyte types... the pointer is not aligned.  Use
  45  * get_unaligned((type *)iterator.this_arg) to dereference
  46  * iterator.this_arg for type "type" safely on all arches.
  47  *
  48  * Example code:
  49  * See Documentation/networking/radiotap-headers.txt
  50  */
  51
  52 int ieee80211_radiotap_iterator_init(
  53     struct ieee80211_radiotap_iterator *iterator,
  54     struct ieee80211_radiotap_header *radiotap_header,
  55     int max_length)
  56 {
  57         /* Linux only supports version 0 radiotap format */
  58         if (radiotap_header->it_version)
  59                 return -EINVAL;
  60
  61         /* sanity check for allowed length and radiotap length field */
  62         if (max_length < get_unaligned_le16(&radiotap_header->it_len))
  63                 return -EINVAL;
  64
  65         iterator->rtheader = radiotap_header;
  66         iterator->max_length = get_unaligned_le16(&radiotap_header->it_len);
  67         iterator->arg_index = 0;
  68         iterator->bitmap_shifter = get_unaligned_le32(&radiotap_header->it_present);
  69         iterator->arg = (u8 *)radiotap_header + sizeof(*radiotap_header);
  70         iterator->this_arg = NULL;
  71
  72         /* find payload start allowing for extended bitmap(s) */
  73
  74         if (unlikely(iterator->bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT))) {
  75                 while (get_unaligned_le32(iterator->arg) &
  76                        (1 << IEEE80211_RADIOTAP_EXT)) {
  77                         iterator->arg += sizeof(u32);
  78
  79                         /*
  80                          * check for insanity where the present bitmaps
  81                          * keep claiming to extend up to or even beyond the
  82                          * stated radiotap header length
  83                          */
  84
  85                         if (((ulong)iterator->arg -
  86                              (ulong)iterator->rtheader) > iterator->max_length)
  87                                 return -EINVAL;
  88                 }
  89
  90                 iterator->arg += sizeof(u32);
  91
  92                 /*
  93                  * no need to check again for blowing past stated radiotap
  94                  * header length, because ieee80211_radiotap_iterator_next
  95                  * checks it before it is dereferenced
  96                  */
  97         }
  98
  99         /* we are all initialized happily */
 100
 101         return 0;
 102 }
 103 EXPORT_SYMBOL(ieee80211_radiotap_iterator_init);
 104
 105
 106 /**
 107  * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
 108  * @iterator: radiotap_iterator to move to next arg (if any)
 109  *
 110  * Returns: 0 if there is an argument to handle,
 111  * -ENOENT if there are no more args or -EINVAL
 112  * if there is something else wrong.
 113  *
 114  * This function provides the next radiotap arg index (IEEE80211_RADIOTAP_*)
 115  * in @this_arg_index and sets @this_arg to point to the
 116  * payload for the field.  It takes care of alignment handling and extended
 117  * present fields.  @this_arg can be changed by the caller (eg,
 118  * incremented to move inside a compound argument like
 119  * IEEE80211_RADIOTAP_CHANNEL).  The args pointed to are in
 120  * little-endian format whatever the endianess of your CPU.
 121  *
 122  * Alignment Gotcha:
 123  * You must take care when dereferencing iterator.this_arg
 124  * for multibyte types... the pointer is not aligned.  Use
 125  * get_unaligned((type *)iterator.this_arg) to dereference
 126  * iterator.this_arg for type "type" safely on all arches.
 127  */
 128
 129 int ieee80211_radiotap_iterator_next(
 130     struct ieee80211_radiotap_iterator *iterator)
 131 {
 132
 133         /*
 134          * small length lookup table for all radiotap types we heard of
 135          * starting from b0 in the bitmap, so we can walk the payload
 136          * area of the radiotap header
 137          *
 138          * There is a requirement to pad args, so that args
 139          * of a given length must begin at a boundary of that length
 140          * -- but note that compound args are allowed (eg, 2 x u16
 141          * for IEEE80211_RADIOTAP_CHANNEL) so total arg length is not
 142          * a reliable indicator of alignment requirement.
 143          *
 144          * upper nybble: content alignment for arg
 145          * lower nybble: content length for arg
 146          */
 147
 148         static const u8 rt_sizes[] = {
 149                 [IEEE80211_RADIOTAP_TSFT] = 0x88,
 150                 [IEEE80211_RADIOTAP_FLAGS] = 0x11,
 151                 [IEEE80211_RADIOTAP_RATE] = 0x11,
 152                 [IEEE80211_RADIOTAP_CHANNEL] = 0x24,
 153                 [IEEE80211_RADIOTAP_FHSS] = 0x22,
 154                 [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = 0x11,
 155                 [IEEE80211_RADIOTAP_DBM_ANTNOISE] = 0x11,
 156                 [IEEE80211_RADIOTAP_LOCK_QUALITY] = 0x22,
 157                 [IEEE80211_RADIOTAP_TX_ATTENUATION] = 0x22,
 158                 [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = 0x22,
 159                 [IEEE80211_RADIOTAP_DBM_TX_POWER] = 0x11,
 160                 [IEEE80211_RADIOTAP_ANTENNA] = 0x11,
 161                 [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = 0x11,
 162                 [IEEE80211_RADIOTAP_DB_ANTNOISE] = 0x11,
 163                 [IEEE80211_RADIOTAP_RX_FLAGS] = 0x22,
 164                 [IEEE80211_RADIOTAP_TX_FLAGS] = 0x22,
 165                 [IEEE80211_RADIOTAP_RTS_RETRIES] = 0x11,
 166                 [IEEE80211_RADIOTAP_DATA_RETRIES] = 0x11,
 167                 /*
 168                  * add more here as they are defined in
 169                  * include/net/ieee80211_radiotap.h
 170                  */
 171         };
 172
 173         /*
 174          * for every radiotap entry we can at
 175          * least skip (by knowing the length)...
 176          */
 177
 178         while (iterator->arg_index < sizeof(rt_sizes)) {
 179                 int hit = 0;
 180                 int pad;
 181
 182                 if (!(iterator->bitmap_shifter & 1))
 183                         goto next_entry; /* arg not present */
 184
 185                 /*
 186                  * arg is present, account for alignment padding
 187                  *  8-bit args can be at any alignment
 188                  * 16-bit args must start on 16-bit boundary
 189                  * 32-bit args must start on 32-bit boundary
 190                  * 64-bit args must start on 64-bit boundary
 191                  *
 192                  * note that total arg size can differ from alignment of
 193                  * elements inside arg, so we use upper nybble of length
 194                  * table to base alignment on
 195                  *
 196                  * also note: these alignments are ** relative to the
 197                  * start of the radiotap header **.  There is no guarantee
 198                  * that the radiotap header itself is aligned on any
 199                  * kind of boundary.
 200                  *
 201                  * the above is why get_unaligned() is used to dereference
 202                  * multibyte elements from the radiotap area
 203                  */
 204
 205                 pad = (((ulong)iterator->arg) -
 206                         ((ulong)iterator->rtheader)) &
 207                         ((rt_sizes[iterator->arg_index] >> 4) - 1);
 208
 209                 if (pad)
 210                         iterator->arg +=
 211                                 (rt_sizes[iterator->arg_index] >> 4) - pad;
 212
 213                 /*
 214                  * this is what we will return to user, but we need to
 215                  * move on first so next call has something fresh to test
 216                  */
 217                 iterator->this_arg_index = iterator->arg_index;
 218                 iterator->this_arg = iterator->arg;
 219                 hit = 1;
 220
 221                 /* internally move on the size of this arg */
 222                 iterator->arg += rt_sizes[iterator->arg_index] & 0x0f;
 223
 224                 /*
 225                  * check for insanity where we are given a bitmap that
 226                  * claims to have more arg content than the length of the
 227                  * radiotap section.  We will normally end up equalling this
 228                  * max_length on the last arg, never exceeding it.
 229                  */
 230
 231                 if (((ulong)iterator->arg - (ulong)iterator->rtheader) >
 232                     iterator->max_length)
 233                         return -EINVAL;
 234
 235         next_entry:
 236                 iterator->arg_index++;
 237                 if (unlikely((iterator->arg_index & 31) == 0)) {
 238                         /* completed current u32 bitmap */
 239                         if (iterator->bitmap_shifter & 1) {
 240                                 /* b31 was set, there is more */
 241                                 /* move to next u32 bitmap */
 242                                 iterator->bitmap_shifter =
 243                                     get_unaligned_le32(iterator->next_bitmap);
 244                                 iterator->next_bitmap++;
 245                         } else
 246                                 /* no more bitmaps: end */
 247                                 iterator->arg_index = sizeof(rt_sizes);
 248                 } else /* just try the next bit */
 249                         iterator->bitmap_shifter >>= 1;
 250
 251                 /* if we found a valid arg earlier, return it now */
 252                 if (hit)
 253                         return 0;
 254         }
 255
 256         /* we don't know how to handle any more args, we're done */
 257         return -ENOENT;
 258 }
 259 EXPORT_SYMBOL(ieee80211_radiotap_iterator_next);