[PATCH] ipw2200: Enable rtap interface for RF promiscuous mode while associated

With this patch, a new promiscuous mode is enabled. If the module is loaded
with the rtap_iface=1 module parameter, two interfaces will be created
(instead of just one).

The second interface is prefixed 'rtap' and provides received 802.11 frames
on the current channel to user space in a radiotap header format.

Example usage:

        % modprobe ipw2200 rtap_iface=1
        % iwconfig eth1 essid MyNetwork
        % dhcpcd eth1
        % tcpdump -i rtap0

If you do not specify 'rtap_iface=1' then the rtap interface will
not be created and you will need to turn it on via:

        % echo 1 > /sys/bus/pci/drivers/ipw2200/*/rtap_iface

You can filter out what type of information is passed to user space via
the rtap_filter sysfs entry.  Currently you can tell the driver to
transmit just the headers (which will provide the RADIOTAP and IEEE
802.11 header but not the payload), to filter based on frame control
type (Management, Control, or Data), and whether to report transmitted
frames, received frames, or both.

The transmit frame reporting is based on a patch by Stefan Rompf.

Filters can be get and set via a sysfs interface. For example, set the
filter to only send headers (0x7), don't report Tx'd frames (0x10), and
don't report data frames (0x100):

        % echo 0x117 > /sys/bus/pci/drivers/ipw2200/*/rtap_filter

All your packets are belong to us:

        % tethereal -n -i rtap0

Signed-off-by: James Ketrenos <jketreno@linux.intel.com>
Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 76 insertions, 1 deletions

diff --git a/drivers/net/wireless/ipw2200.h b/drivers/net/wireless/ipw2200.h
index 1f2cab3f9944..14fe79abca67 100644
--- a/drivers/net/wireless/ipw2200.h
+++ b/drivers/net/wireless/ipw2200.h
@@ -789,7 +789,7 @@ struct ipw_sys_config {
         u8 bt_coexist_collision_thr;
         u8 silence_threshold;
         u8 accept_all_mgmt_bcpr;
-        u8 accept_all_mgtm_frames;
+        u8 accept_all_mgmt_frames;
         u8 pass_noise_stats_to_host;
         u8 reserved3;
 } __attribute__ ((packed));
@@ -1122,6 +1122,52 @@ struct ipw_fw_error {
         u8 payload[0];
 } __attribute__ ((packed));
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+
+enum ipw_prom_filter {
+        IPW_PROM_CTL_HEADER_ONLY = (1 << 0),
+        IPW_PROM_MGMT_HEADER_ONLY = (1 << 1),
+        IPW_PROM_DATA_HEADER_ONLY = (1 << 2),
+        IPW_PROM_ALL_HEADER_ONLY = 0xf, /* bits 0..3 */
+        IPW_PROM_NO_TX = (1 << 4),
+        IPW_PROM_NO_RX = (1 << 5),
+        IPW_PROM_NO_CTL = (1 << 6),
+        IPW_PROM_NO_MGMT = (1 << 7),
+        IPW_PROM_NO_DATA = (1 << 8),
+};
+
+struct ipw_priv;
+struct ipw_prom_priv {
+        struct ipw_priv *priv;
+        struct ieee80211_device *ieee;
+        enum ipw_prom_filter filter;
+        int tx_packets;
+        int rx_packets;
+};
+#endif
+
+#if defined(CONFIG_IEEE80211_RADIOTAP) || defined(CONFIG_IPW2200_PROMISCUOUS)
+/* Magic struct that slots into the radiotap header -- no reason
+ * to build this manually element by element, we can write it much
+ * more efficiently than we can parse it. ORDER MATTERS HERE
+ *
+ * When sent to us via the simulated Rx interface in sysfs, the entire
+ * structure is provided regardless of any bits unset.
+ */
+struct ipw_rt_hdr {
+        struct ieee80211_radiotap_header rt_hdr;
+        u64 rt_tsf;      /* TSF */
+        u8 rt_flags;    /* radiotap packet flags */
+        u8 rt_rate;     /* rate in 500kb/s */
+        u16 rt_channel; /* channel in mhz */
+        u16 rt_chbitmask;       /* channel bitfield */
+        s8 rt_dbmsignal;        /* signal in dbM, kluged to signed */
+        s8 rt_dbmnoise;
+        u8 rt_antenna;  /* antenna number */
+        u8 payload[0];  /* payload... */
+} __attribute__ ((packed));
+#endif
+
 struct ipw_priv {
         /* ieee device used by generic ieee processing code */
         struct ieee80211_device *ieee;
@@ -1133,6 +1179,12 @@ struct ipw_priv {
         struct pci_dev *pci_dev;
         struct net_device *net_dev;
 
+#ifdef CONFIG_IPW2200_PROMISCUOUS
+        /* Promiscuous mode */
+        struct ipw_prom_priv *prom_priv;
+        struct net_device *prom_net_dev;
+#endif
+
         /* pci hardware address support */
         void __iomem *hw_base;
         unsigned long hw_len;
@@ -1306,6 +1358,29 @@ struct ipw_priv {
 
 /* debug macros */
 
+/* Debug and printf string expansion helpers for printing bitfields */
+#define BIT_FMT8 "%c%c%c%c-%c%c%c%c"
+#define BIT_FMT16 BIT_FMT8 ":" BIT_FMT8
+#define BIT_FMT32 BIT_FMT16 " " BIT_FMT16
+
+#define BITC(x,y) (((x>>y)&1)?'1':'0')
+#define BIT_ARG8(x) \
+BITC(x,7),BITC(x,6),BITC(x,5),BITC(x,4),\
+BITC(x,3),BITC(x,2),BITC(x,1),BITC(x,0)
+
+#define BIT_ARG16(x) \
+BITC(x,15),BITC(x,14),BITC(x,13),BITC(x,12),\
+BITC(x,11),BITC(x,10),BITC(x,9),BITC(x,8),\
+BIT_ARG8(x)
+
+#define BIT_ARG32(x) \
+BITC(x,31),BITC(x,30),BITC(x,29),BITC(x,28),\
+BITC(x,27),BITC(x,26),BITC(x,25),BITC(x,24),\
+BITC(x,23),BITC(x,22),BITC(x,21),BITC(x,20),\
+BITC(x,19),BITC(x,18),BITC(x,17),BITC(x,16),\
+BIT_ARG16(x)
+
+
 #ifdef CONFIG_IPW2200_DEBUG
 #define IPW_DEBUG(level, fmt, args...) \
 do { if (ipw_debug_level & (level)) \