1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2007-2012 Siemens AG 4 * 5 * Written by: 6 * Pavel Smolenskiy <pavel.smolenskiy@gmail.com> 7 * Maxim Gorbachyov <maxim.gorbachev@siemens.com> 8 * Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> 9 * Alexander Smirnov <alex.bluesman.smirnov@gmail.com> 10 */ 11 12 #include <linux/kernel.h> 13 #include <linux/module.h> 14 #include <linux/netdevice.h> 15 #include <linux/crc-ccitt.h> 16 #include <linux/unaligned.h> 17 18 #include <net/mac802154.h> 19 #include <net/ieee802154_netdev.h> 20 #include <net/nl802154.h> 21 22 #include "ieee802154_i.h" 23 24 static int ieee802154_deliver_skb(struct sk_buff *skb) 25 { 26 skb->ip_summed = CHECKSUM_UNNECESSARY; 27 skb->protocol = htons(ETH_P_IEEE802154); 28 29 return netif_receive_skb(skb); 30 } 31 32 void mac802154_rx_beacon_worker(struct work_struct *work) 33 { 34 struct ieee802154_local *local = 35 container_of(work, struct ieee802154_local, rx_beacon_work); 36 struct cfg802154_mac_pkt *mac_pkt; 37 38 for (;;) { 39 spin_lock_bh(&local->rx_lock); 40 mac_pkt = list_first_entry_or_null(&local->rx_beacon_list, 41 struct cfg802154_mac_pkt, node); 42 if (mac_pkt) 43 list_del(&mac_pkt->node); 44 spin_unlock_bh(&local->rx_lock); 45 if (!mac_pkt) 46 break; 47 48 mac802154_process_beacon(local, mac_pkt->skb, 49 mac_pkt->page, mac_pkt->channel); 50 51 netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker); 52 kfree_skb(mac_pkt->skb); 53 kfree(mac_pkt); 54 } 55 } 56 57 static bool mac802154_should_answer_beacon_req(struct ieee802154_local *local) 58 { 59 struct cfg802154_beacon_request *beacon_req; 60 unsigned int interval; 61 62 rcu_read_lock(); 63 beacon_req = rcu_dereference(local->beacon_req); 64 if (!beacon_req) { 65 rcu_read_unlock(); 66 return false; 67 } 68 69 interval = beacon_req->interval; 70 rcu_read_unlock(); 71 72 if (!mac802154_is_beaconing(local)) 73 return false; 74 75 return interval == IEEE802154_ACTIVE_SCAN_DURATION; 76 } 77 78 static void mac802154_rx_mac_cmd(struct ieee802154_local *local, 79 struct cfg802154_mac_pkt *mac_pkt) 80 { 81 u8 mac_cmd; 82 int rc; 83 84 rc = ieee802154_get_mac_cmd(mac_pkt->skb, &mac_cmd); 85 if (rc) 86 return; 87 88 switch (mac_cmd) { 89 case IEEE802154_CMD_BEACON_REQ: 90 dev_dbg(&mac_pkt->sdata->dev->dev, "processing BEACON REQ\n"); 91 if (!mac802154_should_answer_beacon_req(local)) 92 break; 93 94 queue_delayed_work(local->mac_wq, &local->beacon_work, 0); 95 break; 96 97 case IEEE802154_CMD_ASSOCIATION_RESP: 98 dev_dbg(&mac_pkt->sdata->dev->dev, "processing ASSOC RESP\n"); 99 if (!mac802154_is_associating(local)) 100 break; 101 102 mac802154_process_association_resp(mac_pkt->sdata, mac_pkt->skb); 103 break; 104 105 case IEEE802154_CMD_ASSOCIATION_REQ: 106 dev_dbg(&mac_pkt->sdata->dev->dev, "processing ASSOC REQ\n"); 107 if (mac_pkt->sdata->wpan_dev.iftype != NL802154_IFTYPE_COORD) 108 break; 109 110 mac802154_process_association_req(mac_pkt->sdata, mac_pkt->skb); 111 break; 112 113 case IEEE802154_CMD_DISASSOCIATION_NOTIFY: 114 dev_dbg(&mac_pkt->sdata->dev->dev, "processing DISASSOC NOTIF\n"); 115 if (mac_pkt->sdata->wpan_dev.iftype != NL802154_IFTYPE_COORD) 116 break; 117 118 mac802154_process_disassociation_notif(mac_pkt->sdata, mac_pkt->skb); 119 break; 120 121 default: 122 break; 123 } 124 } 125 126 void mac802154_rx_mac_cmd_worker(struct work_struct *work) 127 { 128 struct ieee802154_local *local = 129 container_of(work, struct ieee802154_local, rx_mac_cmd_work); 130 struct cfg802154_mac_pkt *mac_pkt; 131 132 for (;;) { 133 spin_lock_bh(&local->rx_lock); 134 mac_pkt = list_first_entry_or_null(&local->rx_mac_cmd_list, 135 struct cfg802154_mac_pkt, node); 136 if (mac_pkt) 137 list_del(&mac_pkt->node); 138 spin_unlock_bh(&local->rx_lock); 139 if (!mac_pkt) 140 break; 141 142 /* A stopped interface cannot transmit; skipping avoids a 143 * needless association response (and the !netif_running() 144 * warning it would trip) during teardown. The beacon worker 145 * needs no such check as it never transmits. 146 */ 147 if (ieee802154_sdata_running(mac_pkt->sdata)) 148 mac802154_rx_mac_cmd(local, mac_pkt); 149 150 netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker); 151 kfree_skb(mac_pkt->skb); 152 kfree(mac_pkt); 153 } 154 } 155 156 /** 157 * mac802154_flush_list - free queued RX frames on @list 158 * @list: rx_beacon_list or rx_mac_cmd_list 159 * @sdata: only free frames received on this interface, or %NULL for all 160 * 161 * Each frame pins the net_device it was received on (via netdev_hold()), 162 * so release that reference as the frame is dropped. Caller must hold 163 * local->rx_lock. 164 */ 165 void mac802154_flush_list(struct list_head *list, 166 struct ieee802154_sub_if_data *sdata) 167 { 168 struct cfg802154_mac_pkt *mac_pkt, *tmp; 169 170 list_for_each_entry_safe(mac_pkt, tmp, list, node) { 171 if (sdata && mac_pkt->sdata != sdata) 172 continue; 173 list_del(&mac_pkt->node); 174 netdev_put(mac_pkt->sdata->dev, &mac_pkt->dev_tracker); 175 kfree_skb(mac_pkt->skb); 176 kfree(mac_pkt); 177 } 178 } 179 180 /** 181 * mac802154_flush_queued_pkts - drop queued RX work referencing @sdata 182 * @local: the mac802154 device 183 * @sdata: interface being removed 184 * 185 * The workers dereference the queued frame's interface directly 186 * (mac_pkt->sdata) or through skb->dev in mac802154_process_beacon(). Drop 187 * the not-yet-started entries belonging to @sdata before it is unregistered 188 * so their netdev reference is released; an entry already dequeued by a 189 * running worker keeps its own reference until the worker completes, which 190 * unregister_netdevice() then waits out. 191 */ 192 void mac802154_flush_queued_pkts(struct ieee802154_local *local, 193 struct ieee802154_sub_if_data *sdata) 194 { 195 spin_lock_bh(&local->rx_lock); 196 mac802154_flush_list(&local->rx_beacon_list, sdata); 197 mac802154_flush_list(&local->rx_mac_cmd_list, sdata); 198 spin_unlock_bh(&local->rx_lock); 199 } 200 201 static int 202 ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata, 203 struct sk_buff *skb, const struct ieee802154_hdr *hdr) 204 { 205 struct wpan_phy *wpan_phy = sdata->local->hw.phy; 206 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 207 struct cfg802154_mac_pkt *mac_pkt; 208 __le16 span, sshort; 209 int rc; 210 211 pr_debug("getting packet via slave interface %s\n", sdata->dev->name); 212 213 span = wpan_dev->pan_id; 214 sshort = wpan_dev->short_addr; 215 216 /* Level 3 filtering: Only beacons are accepted during scans */ 217 if (sdata->required_filtering == IEEE802154_FILTERING_3_SCAN && 218 sdata->required_filtering > wpan_phy->filtering) { 219 if (mac_cb(skb)->type != IEEE802154_FC_TYPE_BEACON) { 220 dev_dbg(&sdata->dev->dev, 221 "drop non-beacon frame (0x%x) during scan\n", 222 mac_cb(skb)->type); 223 goto fail; 224 } 225 } 226 227 switch (mac_cb(skb)->dest.mode) { 228 case IEEE802154_ADDR_NONE: 229 if (hdr->source.mode == IEEE802154_ADDR_NONE) 230 /* ACK comes with both addresses empty */ 231 skb->pkt_type = PACKET_HOST; 232 else if (!wpan_dev->parent) 233 /* No dest means PAN coordinator is the recipient */ 234 skb->pkt_type = PACKET_HOST; 235 else 236 /* We are not the PAN coordinator, just relaying */ 237 skb->pkt_type = PACKET_OTHERHOST; 238 break; 239 case IEEE802154_ADDR_LONG: 240 if (mac_cb(skb)->dest.pan_id != span && 241 mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST)) 242 skb->pkt_type = PACKET_OTHERHOST; 243 else if (mac_cb(skb)->dest.extended_addr == wpan_dev->extended_addr) 244 skb->pkt_type = PACKET_HOST; 245 else 246 skb->pkt_type = PACKET_OTHERHOST; 247 break; 248 case IEEE802154_ADDR_SHORT: 249 if (mac_cb(skb)->dest.pan_id != span && 250 mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST)) 251 skb->pkt_type = PACKET_OTHERHOST; 252 else if (mac_cb(skb)->dest.short_addr == sshort) 253 skb->pkt_type = PACKET_HOST; 254 else if (mac_cb(skb)->dest.short_addr == 255 cpu_to_le16(IEEE802154_ADDR_BROADCAST)) 256 skb->pkt_type = PACKET_BROADCAST; 257 else 258 skb->pkt_type = PACKET_OTHERHOST; 259 break; 260 default: 261 pr_debug("invalid dest mode\n"); 262 goto fail; 263 } 264 265 skb->dev = sdata->dev; 266 267 /* TODO this should be moved after netif_receive_skb call, otherwise 268 * wireshark will show a mac header with security fields and the 269 * payload is already decrypted. 270 */ 271 rc = mac802154_llsec_decrypt(&sdata->sec, skb); 272 if (rc) { 273 pr_debug("decryption failed: %i\n", rc); 274 goto fail; 275 } 276 277 sdata->dev->stats.rx_packets++; 278 sdata->dev->stats.rx_bytes += skb->len; 279 280 switch (mac_cb(skb)->type) { 281 case IEEE802154_FC_TYPE_BEACON: 282 dev_dbg(&sdata->dev->dev, "BEACON received\n"); 283 if (!mac802154_is_scanning(sdata->local)) 284 goto fail; 285 286 mac_pkt = kzalloc_obj(*mac_pkt, GFP_ATOMIC); 287 if (!mac_pkt) 288 goto fail; 289 290 mac_pkt->skb = skb_get(skb); 291 mac_pkt->sdata = sdata; 292 mac_pkt->page = sdata->local->scan_page; 293 mac_pkt->channel = sdata->local->scan_channel; 294 netdev_hold(sdata->dev, &mac_pkt->dev_tracker, GFP_ATOMIC); 295 spin_lock(&sdata->local->rx_lock); 296 list_add_tail(&mac_pkt->node, &sdata->local->rx_beacon_list); 297 spin_unlock(&sdata->local->rx_lock); 298 queue_work(sdata->local->mac_wq, &sdata->local->rx_beacon_work); 299 return NET_RX_SUCCESS; 300 301 case IEEE802154_FC_TYPE_MAC_CMD: 302 dev_dbg(&sdata->dev->dev, "MAC COMMAND received\n"); 303 mac_pkt = kzalloc_obj(*mac_pkt, GFP_ATOMIC); 304 if (!mac_pkt) 305 goto fail; 306 307 mac_pkt->skb = skb_get(skb); 308 mac_pkt->sdata = sdata; 309 netdev_hold(sdata->dev, &mac_pkt->dev_tracker, GFP_ATOMIC); 310 spin_lock(&sdata->local->rx_lock); 311 list_add_tail(&mac_pkt->node, &sdata->local->rx_mac_cmd_list); 312 spin_unlock(&sdata->local->rx_lock); 313 queue_work(sdata->local->mac_wq, &sdata->local->rx_mac_cmd_work); 314 return NET_RX_SUCCESS; 315 316 case IEEE802154_FC_TYPE_ACK: 317 goto fail; 318 319 case IEEE802154_FC_TYPE_DATA: 320 return ieee802154_deliver_skb(skb); 321 default: 322 pr_warn_ratelimited("ieee802154: bad frame received " 323 "(type = %d)\n", mac_cb(skb)->type); 324 goto fail; 325 } 326 327 fail: 328 kfree_skb(skb); 329 return NET_RX_DROP; 330 } 331 332 static void 333 ieee802154_print_addr(const char *name, const struct ieee802154_addr *addr) 334 { 335 if (addr->mode == IEEE802154_ADDR_NONE) { 336 pr_debug("%s not present\n", name); 337 return; 338 } 339 340 pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id)); 341 if (addr->mode == IEEE802154_ADDR_SHORT) { 342 pr_debug("%s is short: %04x\n", name, 343 le16_to_cpu(addr->short_addr)); 344 } else { 345 u64 hw = swab64((__force u64)addr->extended_addr); 346 347 pr_debug("%s is hardware: %8phC\n", name, &hw); 348 } 349 } 350 351 static int 352 ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr) 353 { 354 int hlen; 355 struct ieee802154_mac_cb *cb = mac_cb(skb); 356 357 skb_reset_mac_header(skb); 358 359 hlen = ieee802154_hdr_pull(skb, hdr); 360 if (hlen < 0) 361 return -EINVAL; 362 363 skb->mac_len = hlen; 364 365 pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc), 366 hdr->seq); 367 368 cb->type = hdr->fc.type; 369 cb->ackreq = hdr->fc.ack_request; 370 cb->secen = hdr->fc.security_enabled; 371 372 ieee802154_print_addr("destination", &hdr->dest); 373 ieee802154_print_addr("source", &hdr->source); 374 375 cb->source = hdr->source; 376 cb->dest = hdr->dest; 377 378 if (hdr->fc.security_enabled) { 379 u64 key; 380 381 pr_debug("seclevel %i\n", hdr->sec.level); 382 383 switch (hdr->sec.key_id_mode) { 384 case IEEE802154_SCF_KEY_IMPLICIT: 385 pr_debug("implicit key\n"); 386 break; 387 388 case IEEE802154_SCF_KEY_INDEX: 389 pr_debug("key %02x\n", hdr->sec.key_id); 390 break; 391 392 case IEEE802154_SCF_KEY_SHORT_INDEX: 393 pr_debug("key %04x:%04x %02x\n", 394 le32_to_cpu(hdr->sec.short_src) >> 16, 395 le32_to_cpu(hdr->sec.short_src) & 0xffff, 396 hdr->sec.key_id); 397 break; 398 399 case IEEE802154_SCF_KEY_HW_INDEX: 400 key = swab64((__force u64)hdr->sec.extended_src); 401 pr_debug("key source %8phC %02x\n", &key, 402 hdr->sec.key_id); 403 break; 404 } 405 } 406 407 return 0; 408 } 409 410 static void 411 __ieee802154_rx_handle_packet(struct ieee802154_local *local, 412 struct sk_buff *skb) 413 { 414 int ret; 415 struct ieee802154_sub_if_data *sdata; 416 struct ieee802154_hdr hdr; 417 struct sk_buff *skb2; 418 419 ret = ieee802154_parse_frame_start(skb, &hdr); 420 if (ret) { 421 pr_debug("got invalid frame\n"); 422 return; 423 } 424 425 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 426 if (sdata->wpan_dev.iftype == NL802154_IFTYPE_MONITOR) 427 continue; 428 429 if (!ieee802154_sdata_running(sdata)) 430 continue; 431 432 /* Do not deliver packets received on interfaces expecting 433 * AACK=1 if the address filters where disabled. 434 */ 435 if (local->hw.phy->filtering < IEEE802154_FILTERING_4_FRAME_FIELDS && 436 sdata->required_filtering == IEEE802154_FILTERING_4_FRAME_FIELDS) 437 continue; 438 439 skb2 = skb_clone(skb, GFP_ATOMIC); 440 if (skb2) { 441 skb2->dev = sdata->dev; 442 ieee802154_subif_frame(sdata, skb2, &hdr); 443 } 444 } 445 } 446 447 static void 448 ieee802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb) 449 { 450 struct sk_buff *skb2; 451 struct ieee802154_sub_if_data *sdata; 452 453 skb_reset_mac_header(skb); 454 skb->ip_summed = CHECKSUM_UNNECESSARY; 455 skb->pkt_type = PACKET_OTHERHOST; 456 skb->protocol = htons(ETH_P_IEEE802154); 457 458 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 459 if (sdata->wpan_dev.iftype != NL802154_IFTYPE_MONITOR) 460 continue; 461 462 if (!ieee802154_sdata_running(sdata)) 463 continue; 464 465 skb2 = skb_clone(skb, GFP_ATOMIC); 466 if (skb2) { 467 skb2->dev = sdata->dev; 468 ieee802154_deliver_skb(skb2); 469 470 sdata->dev->stats.rx_packets++; 471 sdata->dev->stats.rx_bytes += skb->len; 472 } 473 } 474 } 475 476 void ieee802154_rx(struct ieee802154_local *local, struct sk_buff *skb) 477 { 478 u16 crc; 479 480 WARN_ON_ONCE(softirq_count() == 0); 481 482 if (local->suspended) 483 goto free_skb; 484 485 /* TODO: When a transceiver omits the checksum here, we 486 * add an own calculated one. This is currently an ugly 487 * solution because the monitor needs a crc here. 488 */ 489 if (local->hw.flags & IEEE802154_HW_RX_OMIT_CKSUM) { 490 crc = crc_ccitt(0, skb->data, skb->len); 491 put_unaligned_le16(crc, skb_put(skb, 2)); 492 } 493 494 rcu_read_lock(); 495 496 ieee802154_monitors_rx(local, skb); 497 498 /* Level 1 filtering: Check the FCS by software when relevant */ 499 if (local->hw.phy->filtering == IEEE802154_FILTERING_NONE) { 500 crc = crc_ccitt(0, skb->data, skb->len); 501 if (crc) 502 goto drop; 503 } 504 /* remove crc */ 505 skb_trim(skb, skb->len - 2); 506 507 __ieee802154_rx_handle_packet(local, skb); 508 509 drop: 510 rcu_read_unlock(); 511 free_skb: 512 kfree_skb(skb); 513 } 514 515 void 516 ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi) 517 { 518 struct ieee802154_local *local = hw_to_local(hw); 519 struct ieee802154_mac_cb *cb = mac_cb_init(skb); 520 521 cb->lqi = lqi; 522 skb->pkt_type = IEEE802154_RX_MSG; 523 skb_queue_tail(&local->skb_queue, skb); 524 tasklet_schedule(&local->tasklet); 525 } 526 EXPORT_SYMBOL(ieee802154_rx_irqsafe); 527