827d42c9ac
Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commitd75636ef9c
Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commitd92684e660
Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@marvell.com> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
168 lines
5.2 KiB
C
168 lines
5.2 KiB
C
/*
|
|
* HT handling
|
|
*
|
|
* Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
|
|
* Copyright 2002-2005, Instant802 Networks, Inc.
|
|
* Copyright 2005-2006, Devicescape Software, Inc.
|
|
* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
|
|
* Copyright 2007, Michael Wu <flamingice@sourmilk.net>
|
|
* Copyright 2007-2008, Intel Corporation
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#include <linux/ieee80211.h>
|
|
#include <net/mac80211.h>
|
|
#include "ieee80211_i.h"
|
|
#include "rate.h"
|
|
|
|
void ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_supported_band *sband,
|
|
struct ieee80211_ht_cap *ht_cap_ie,
|
|
struct ieee80211_sta_ht_cap *ht_cap)
|
|
{
|
|
u8 ampdu_info, tx_mcs_set_cap;
|
|
int i, max_tx_streams;
|
|
|
|
BUG_ON(!ht_cap);
|
|
|
|
memset(ht_cap, 0, sizeof(*ht_cap));
|
|
|
|
if (!ht_cap_ie)
|
|
return;
|
|
|
|
ht_cap->ht_supported = true;
|
|
|
|
ht_cap->cap = le16_to_cpu(ht_cap_ie->cap_info) & sband->ht_cap.cap;
|
|
ht_cap->cap &= ~IEEE80211_HT_CAP_SM_PS;
|
|
ht_cap->cap |= sband->ht_cap.cap & IEEE80211_HT_CAP_SM_PS;
|
|
|
|
ampdu_info = ht_cap_ie->ampdu_params_info;
|
|
ht_cap->ampdu_factor =
|
|
ampdu_info & IEEE80211_HT_AMPDU_PARM_FACTOR;
|
|
ht_cap->ampdu_density =
|
|
(ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
|
|
|
|
/* own MCS TX capabilities */
|
|
tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
|
|
|
|
/* can we TX with MCS rates? */
|
|
if (!(tx_mcs_set_cap & IEEE80211_HT_MCS_TX_DEFINED))
|
|
return;
|
|
|
|
/* Counting from 0, therefore +1 */
|
|
if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_RX_DIFF)
|
|
max_tx_streams =
|
|
((tx_mcs_set_cap & IEEE80211_HT_MCS_TX_MAX_STREAMS_MASK)
|
|
>> IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT) + 1;
|
|
else
|
|
max_tx_streams = IEEE80211_HT_MCS_TX_MAX_STREAMS;
|
|
|
|
/*
|
|
* 802.11n D5.0 20.3.5 / 20.6 says:
|
|
* - indices 0 to 7 and 32 are single spatial stream
|
|
* - 8 to 31 are multiple spatial streams using equal modulation
|
|
* [8..15 for two streams, 16..23 for three and 24..31 for four]
|
|
* - remainder are multiple spatial streams using unequal modulation
|
|
*/
|
|
for (i = 0; i < max_tx_streams; i++)
|
|
ht_cap->mcs.rx_mask[i] =
|
|
sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
|
|
|
|
if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
|
|
for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
|
|
i < IEEE80211_HT_MCS_MASK_LEN; i++)
|
|
ht_cap->mcs.rx_mask[i] =
|
|
sband->ht_cap.mcs.rx_mask[i] &
|
|
ht_cap_ie->mcs.rx_mask[i];
|
|
|
|
/* handle MCS rate 32 too */
|
|
if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
|
|
ht_cap->mcs.rx_mask[32/8] |= 1;
|
|
}
|
|
|
|
void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < STA_TID_NUM; i++) {
|
|
__ieee80211_stop_tx_ba_session(sta, i, WLAN_BACK_INITIATOR);
|
|
__ieee80211_stop_rx_ba_session(sta, i, WLAN_BACK_RECIPIENT,
|
|
WLAN_REASON_QSTA_LEAVE_QBSS);
|
|
}
|
|
}
|
|
|
|
void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
|
|
const u8 *da, u16 tid,
|
|
u16 initiator, u16 reason_code)
|
|
{
|
|
struct ieee80211_local *local = sdata->local;
|
|
struct sk_buff *skb;
|
|
struct ieee80211_mgmt *mgmt;
|
|
u16 params;
|
|
|
|
skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
|
|
|
|
if (!skb) {
|
|
printk(KERN_ERR "%s: failed to allocate buffer "
|
|
"for delba frame\n", sdata->dev->name);
|
|
return;
|
|
}
|
|
|
|
skb_reserve(skb, local->hw.extra_tx_headroom);
|
|
mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
|
|
memset(mgmt, 0, 24);
|
|
memcpy(mgmt->da, da, ETH_ALEN);
|
|
memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
|
|
if (sdata->vif.type == NL80211_IFTYPE_AP ||
|
|
sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
|
|
memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
|
|
else if (sdata->vif.type == NL80211_IFTYPE_STATION)
|
|
memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
|
|
|
|
mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
|
|
IEEE80211_STYPE_ACTION);
|
|
|
|
skb_put(skb, 1 + sizeof(mgmt->u.action.u.delba));
|
|
|
|
mgmt->u.action.category = WLAN_CATEGORY_BACK;
|
|
mgmt->u.action.u.delba.action_code = WLAN_ACTION_DELBA;
|
|
params = (u16)(initiator << 11); /* bit 11 initiator */
|
|
params |= (u16)(tid << 12); /* bit 15:12 TID number */
|
|
|
|
mgmt->u.action.u.delba.params = cpu_to_le16(params);
|
|
mgmt->u.action.u.delba.reason_code = cpu_to_le16(reason_code);
|
|
|
|
ieee80211_tx_skb(sdata, skb, 1);
|
|
}
|
|
|
|
void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
|
|
struct sta_info *sta,
|
|
struct ieee80211_mgmt *mgmt, size_t len)
|
|
{
|
|
u16 tid, params;
|
|
u16 initiator;
|
|
|
|
params = le16_to_cpu(mgmt->u.action.u.delba.params);
|
|
tid = (params & IEEE80211_DELBA_PARAM_TID_MASK) >> 12;
|
|
initiator = (params & IEEE80211_DELBA_PARAM_INITIATOR_MASK) >> 11;
|
|
|
|
#ifdef CONFIG_MAC80211_HT_DEBUG
|
|
if (net_ratelimit())
|
|
printk(KERN_DEBUG "delba from %pM (%s) tid %d reason code %d\n",
|
|
mgmt->sa, initiator ? "initiator" : "recipient", tid,
|
|
le16_to_cpu(mgmt->u.action.u.delba.reason_code));
|
|
#endif /* CONFIG_MAC80211_HT_DEBUG */
|
|
|
|
if (initiator == WLAN_BACK_INITIATOR)
|
|
ieee80211_sta_stop_rx_ba_session(sdata, sta->sta.addr, tid,
|
|
WLAN_BACK_INITIATOR, 0);
|
|
else { /* WLAN_BACK_RECIPIENT */
|
|
spin_lock_bh(&sta->lock);
|
|
if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK)
|
|
___ieee80211_stop_tx_ba_session(sta, tid,
|
|
WLAN_BACK_RECIPIENT);
|
|
spin_unlock_bh(&sta->lock);
|
|
}
|
|
}
|