diff options
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/tdls.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/tdls.c | 175 |
1 files changed, 99 insertions, 76 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c index 27779d7317fd..77a9a6de636d 100644 --- a/drivers/net/wireless/marvell/mwifiex/tdls.c +++ b/drivers/net/wireless/marvell/mwifiex/tdls.c @@ -1,9 +1,10 @@ -/* Marvell Wireless LAN device driver: TDLS handling +/* + * NXP Wireless LAN device driver: TDLS handling * - * Copyright (C) 2014, Marvell International Ltd. + * Copyright 2011-2020 NXP * - * This software file (the "File") is distributed by Marvell International - * Ltd. under the terms of the GNU General Public License Version 2, June 1991 + * This software file (the "File") is distributed by NXP + * under the terms of the GNU General Public License Version 2, June 1991 * (the "License"). You may use, redistribute and/or modify this File in * accordance with the terms and conditions of the License, a copy of which * is available on the worldwide web at @@ -33,12 +34,11 @@ static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv, struct list_head *tid_list; struct sk_buff *skb, *tmp; struct mwifiex_txinfo *tx_info; - unsigned long flags; u32 tid; u8 tid_down; mwifiex_dbg(priv->adapter, DATA, "%s: %pM\n", __func__, mac); - spin_lock_irqsave(&priv->wmm.ra_list_spinlock, flags); + spin_lock_bh(&priv->wmm.ra_list_spinlock); skb_queue_walk_safe(&priv->tdls_txq, skb, tmp) { if (!ether_addr_equal(mac, skb->data)) @@ -78,7 +78,7 @@ static void mwifiex_restore_tdls_packets(struct mwifiex_private *priv, atomic_inc(&priv->wmm.tx_pkts_queued); } - spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags); + spin_unlock_bh(&priv->wmm.ra_list_spinlock); return; } @@ -88,11 +88,10 @@ static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, struct mwifiex_ra_list_tbl *ra_list; struct list_head *ra_list_head; struct sk_buff *skb, *tmp; - unsigned long flags; int i; mwifiex_dbg(priv->adapter, DATA, "%s: %pM\n", __func__, mac); - spin_lock_irqsave(&priv->wmm.ra_list_spinlock, flags); + spin_lock_bh(&priv->wmm.ra_list_spinlock); for (i = 0; i < MAX_NUM_TID; i++) { if (!list_empty(&priv->wmm.tid_tbl_ptr[i].ra_list)) { @@ -111,7 +110,7 @@ static void mwifiex_hold_tdls_packets(struct mwifiex_private *priv, } } - spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, flags); + spin_unlock_bh(&priv->wmm.ra_list_spinlock); return; } @@ -733,10 +732,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, u16 status_code, struct sk_buff *skb) { struct ieee80211_mgmt *mgmt; - u8 bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; int ret; u16 capab; struct ieee80211_ht_cap *ht_cap; + unsigned int extra; u8 radio, *pos; capab = priv->curr_bss_params.bss_descriptor.cap_info_bitmap; @@ -755,7 +754,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, switch (action_code) { case WLAN_PUB_ACTION_TDLS_DISCOVER_RES: - skb_put(skb, sizeof(mgmt->u.action.u.tdls_discover_resp) + 1); + /* See the layout of 'struct ieee80211_mgmt'. */ + extra = sizeof(mgmt->u.action.u.tdls_discover_resp) + + sizeof(mgmt->u.action.category); + skb_put(skb, extra); mgmt->u.action.category = WLAN_CATEGORY_PUBLIC; mgmt->u.action.u.tdls_discover_resp.action_code = WLAN_PUB_ACTION_TDLS_DISCOVER_RES; @@ -764,10 +766,9 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, mgmt->u.action.u.tdls_discover_resp.capability = cpu_to_le16(capab); /* move back for addr4 */ - memmove(pos + ETH_ALEN, &mgmt->u.action.category, - sizeof(mgmt->u.action.u.tdls_discover_resp)); + memmove(pos + ETH_ALEN, &mgmt->u.action, extra); /* init address 4 */ - memcpy(pos, bc_addr, ETH_ALEN); + eth_broadcast_addr(pos); ret = mwifiex_tdls_append_rates_ie(priv, skb); if (ret) { @@ -897,7 +898,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, u8 *peer, *pos, *end; u8 i, action, basic; u16 cap = 0; - int ie_len = 0; + int ies_len = 0; if (len < (sizeof(struct ethhdr) + 3)) return; @@ -919,7 +920,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, pos = buf + sizeof(struct ethhdr) + 4; /* payload 1+ category 1 + action 1 + dialog 1 */ cap = get_unaligned_le16(pos); - ie_len = len - sizeof(struct ethhdr) - TDLS_REQ_FIX_LEN; + ies_len = len - sizeof(struct ethhdr) - TDLS_REQ_FIX_LEN; pos += 2; break; @@ -929,7 +930,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, /* payload 1+ category 1 + action 1 + dialog 1 + status code 2*/ pos = buf + sizeof(struct ethhdr) + 6; cap = get_unaligned_le16(pos); - ie_len = len - sizeof(struct ethhdr) - TDLS_RESP_FIX_LEN; + ies_len = len - sizeof(struct ethhdr) - TDLS_RESP_FIX_LEN; pos += 2; break; @@ -937,7 +938,7 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, if (len < (sizeof(struct ethhdr) + TDLS_CONFIRM_FIX_LEN)) return; pos = buf + sizeof(struct ethhdr) + TDLS_CONFIRM_FIX_LEN; - ie_len = len - sizeof(struct ethhdr) - TDLS_CONFIRM_FIX_LEN; + ies_len = len - sizeof(struct ethhdr) - TDLS_CONFIRM_FIX_LEN; break; default: mwifiex_dbg(priv->adapter, ERROR, "Unknown TDLS frame type.\n"); @@ -950,65 +951,104 @@ void mwifiex_process_tdls_action_frame(struct mwifiex_private *priv, sta_ptr->tdls_cap.capab = cpu_to_le16(cap); - for (end = pos + ie_len; pos + 1 < end; pos += 2 + pos[1]) { - if (pos + 2 + pos[1] > end) + for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) { + u8 ie_len = pos[1]; + + if (pos + 2 + ie_len > end) break; switch (*pos) { case WLAN_EID_SUPP_RATES: - sta_ptr->tdls_cap.rates_len = pos[1]; - for (i = 0; i < pos[1]; i++) + if (ie_len > sizeof(sta_ptr->tdls_cap.rates)) + return; + sta_ptr->tdls_cap.rates_len = ie_len; + for (i = 0; i < ie_len; i++) sta_ptr->tdls_cap.rates[i] = pos[i + 2]; break; case WLAN_EID_EXT_SUPP_RATES: + if (ie_len > sizeof(sta_ptr->tdls_cap.rates)) + return; basic = sta_ptr->tdls_cap.rates_len; - for (i = 0; i < pos[1]; i++) + if (ie_len > sizeof(sta_ptr->tdls_cap.rates) - basic) + return; + for (i = 0; i < ie_len; i++) sta_ptr->tdls_cap.rates[basic + i] = pos[i + 2]; - sta_ptr->tdls_cap.rates_len += pos[1]; + sta_ptr->tdls_cap.rates_len += ie_len; break; case WLAN_EID_HT_CAPABILITY: - memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos, + if (ie_len != sizeof(struct ieee80211_ht_cap)) + return; + /* copy the ie's value into ht_capb*/ + memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2, sizeof(struct ieee80211_ht_cap)); sta_ptr->is_11n_enabled = 1; break; case WLAN_EID_HT_OPERATION: - memcpy(&sta_ptr->tdls_cap.ht_oper, pos, + if (ie_len != sizeof(struct ieee80211_ht_operation)) + return; + /* copy the ie's value into ht_oper*/ + memcpy(&sta_ptr->tdls_cap.ht_oper, pos + 2, sizeof(struct ieee80211_ht_operation)); break; case WLAN_EID_BSS_COEX_2040: + if (ie_len != sizeof(pos[2])) + return; sta_ptr->tdls_cap.coex_2040 = pos[2]; break; case WLAN_EID_EXT_CAPABILITY: + if (ie_len < sizeof(struct ieee_types_header)) + return; + if (ie_len > 8) + return; memcpy((u8 *)&sta_ptr->tdls_cap.extcap, pos, sizeof(struct ieee_types_header) + - min_t(u8, pos[1], 8)); + min_t(u8, ie_len, 8)); break; case WLAN_EID_RSN: + if (ie_len < sizeof(struct ieee_types_header)) + return; + if (ie_len > IEEE_MAX_IE_SIZE - + sizeof(struct ieee_types_header)) + return; memcpy((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos, sizeof(struct ieee_types_header) + - min_t(u8, pos[1], IEEE_MAX_IE_SIZE - + min_t(u8, ie_len, IEEE_MAX_IE_SIZE - sizeof(struct ieee_types_header))); break; case WLAN_EID_QOS_CAPA: + if (ie_len != sizeof(pos[2])) + return; sta_ptr->tdls_cap.qos_info = pos[2]; break; case WLAN_EID_VHT_OPERATION: - if (priv->adapter->is_hw_11ac_capable) - memcpy(&sta_ptr->tdls_cap.vhtoper, pos, + if (priv->adapter->is_hw_11ac_capable) { + if (ie_len != + sizeof(struct ieee80211_vht_operation)) + return; + /* copy the ie's value into vhtoper*/ + memcpy(&sta_ptr->tdls_cap.vhtoper, pos + 2, sizeof(struct ieee80211_vht_operation)); + } break; case WLAN_EID_VHT_CAPABILITY: if (priv->adapter->is_hw_11ac_capable) { - memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos, + if (ie_len != sizeof(struct ieee80211_vht_cap)) + return; + /* copy the ie's value into vhtcap*/ + memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2, sizeof(struct ieee80211_vht_cap)); sta_ptr->is_11ac_enabled = 1; } break; case WLAN_EID_AID: - if (priv->adapter->is_hw_11ac_capable) + if (priv->adapter->is_hw_11ac_capable) { + if (ie_len != sizeof(u16)) + return; sta_ptr->tdls_cap.aid = get_unaligned_le16((pos + 2)); + } + break; default: break; } @@ -1070,7 +1110,6 @@ mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer) { struct mwifiex_sta_node *sta_ptr; struct mwifiex_ds_tdls_oper tdls_oper; - unsigned long flags; memset(&tdls_oper, 0, sizeof(struct mwifiex_ds_tdls_oper)); sta_ptr = mwifiex_get_sta_entry(priv, peer); @@ -1078,11 +1117,9 @@ mwifiex_tdls_process_disable_link(struct mwifiex_private *priv, const u8 *peer) if (sta_ptr) { if (sta_ptr->is_11n_enabled) { mwifiex_11n_cleanup_reorder_tbl(priv); - spin_lock_irqsave(&priv->wmm.ra_list_spinlock, - flags); + spin_lock_bh(&priv->wmm.ra_list_spinlock); mwifiex_11n_delete_all_tx_ba_stream_tbl(priv); - spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, - flags); + spin_unlock_bh(&priv->wmm.ra_list_spinlock); } mwifiex_del_sta_entry(priv, peer); } @@ -1100,7 +1137,6 @@ mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer) { struct mwifiex_sta_node *sta_ptr; struct ieee80211_mcs_info mcs; - unsigned long flags; int i; sta_ptr = mwifiex_get_sta_entry(priv, peer); @@ -1145,11 +1181,9 @@ mwifiex_tdls_process_enable_link(struct mwifiex_private *priv, const u8 *peer) "tdls: enable link %pM failed\n", peer); if (sta_ptr) { mwifiex_11n_cleanup_reorder_tbl(priv); - spin_lock_irqsave(&priv->wmm.ra_list_spinlock, - flags); + spin_lock_bh(&priv->wmm.ra_list_spinlock); mwifiex_11n_delete_all_tx_ba_stream_tbl(priv); - spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, - flags); + spin_unlock_bh(&priv->wmm.ra_list_spinlock); mwifiex_del_sta_entry(priv, peer); } mwifiex_restore_tdls_packets(priv, peer, TDLS_LINK_TEARDOWN); @@ -1194,7 +1228,6 @@ int mwifiex_get_tdls_list(struct mwifiex_private *priv, struct mwifiex_sta_node *sta_ptr; struct tdls_peer_info *peer = buf; int count = 0; - unsigned long flags; if (!ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info)) return 0; @@ -1203,7 +1236,7 @@ int mwifiex_get_tdls_list(struct mwifiex_private *priv, if (!(priv->bss_type == MWIFIEX_BSS_TYPE_STA && priv->media_connected)) return 0; - spin_lock_irqsave(&priv->sta_list_spinlock, flags); + spin_lock_bh(&priv->sta_list_spinlock); list_for_each_entry(sta_ptr, &priv->sta_list, list) { if (mwifiex_is_tdls_link_setup(sta_ptr->tdls_status)) { ether_addr_copy(peer->peer_addr, sta_ptr->mac_addr); @@ -1213,7 +1246,7 @@ int mwifiex_get_tdls_list(struct mwifiex_private *priv, break; } } - spin_unlock_irqrestore(&priv->sta_list_spinlock, flags); + spin_unlock_bh(&priv->sta_list_spinlock); return count; } @@ -1222,7 +1255,6 @@ void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv) { struct mwifiex_sta_node *sta_ptr; struct mwifiex_ds_tdls_oper tdls_oper; - unsigned long flags; if (list_empty(&priv->sta_list)) return; @@ -1232,11 +1264,9 @@ void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv) if (sta_ptr->is_11n_enabled) { mwifiex_11n_cleanup_reorder_tbl(priv); - spin_lock_irqsave(&priv->wmm.ra_list_spinlock, - flags); + spin_lock_bh(&priv->wmm.ra_list_spinlock); mwifiex_11n_delete_all_tx_ba_stream_tbl(priv); - spin_unlock_irqrestore(&priv->wmm.ra_list_spinlock, - flags); + spin_unlock_bh(&priv->wmm.ra_list_spinlock); } mwifiex_restore_tdls_packets(priv, sta_ptr->mac_addr, @@ -1256,12 +1286,11 @@ void mwifiex_disable_all_tdls_links(struct mwifiex_private *priv) int mwifiex_tdls_check_tx(struct mwifiex_private *priv, struct sk_buff *skb) { struct mwifiex_auto_tdls_peer *peer; - unsigned long flags; u8 mac[ETH_ALEN]; ether_addr_copy(mac, skb->data); - spin_lock_irqsave(&priv->auto_tdls_lock, flags); + spin_lock_bh(&priv->auto_tdls_lock); list_for_each_entry(peer, &priv->auto_tdls_list, list) { if (!memcmp(mac, peer->mac_addr, ETH_ALEN)) { if (peer->rssi <= MWIFIEX_TDLS_RSSI_HIGH && @@ -1277,7 +1306,6 @@ int mwifiex_tdls_check_tx(struct mwifiex_private *priv, struct sk_buff *skb) peer->mac_addr, NL80211_TDLS_SETUP, 0, GFP_ATOMIC); - peer->do_setup = false; priv->check_tdls_tx = false; } else if (peer->failure_count < MWIFIEX_TDLS_MAX_FAIL_COUNT && @@ -1290,7 +1318,7 @@ int mwifiex_tdls_check_tx(struct mwifiex_private *priv, struct sk_buff *skb) } } } - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); return 0; } @@ -1298,33 +1326,31 @@ int mwifiex_tdls_check_tx(struct mwifiex_private *priv, struct sk_buff *skb) void mwifiex_flush_auto_tdls_list(struct mwifiex_private *priv) { struct mwifiex_auto_tdls_peer *peer, *tmp_node; - unsigned long flags; - spin_lock_irqsave(&priv->auto_tdls_lock, flags); + spin_lock_bh(&priv->auto_tdls_lock); list_for_each_entry_safe(peer, tmp_node, &priv->auto_tdls_list, list) { list_del(&peer->list); kfree(peer); } INIT_LIST_HEAD(&priv->auto_tdls_list); - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); priv->check_tdls_tx = false; } void mwifiex_add_auto_tdls_peer(struct mwifiex_private *priv, const u8 *mac) { struct mwifiex_auto_tdls_peer *tdls_peer; - unsigned long flags; if (!priv->adapter->auto_tdls) return; - spin_lock_irqsave(&priv->auto_tdls_lock, flags); + spin_lock_bh(&priv->auto_tdls_lock); list_for_each_entry(tdls_peer, &priv->auto_tdls_list, list) { if (!memcmp(tdls_peer->mac_addr, mac, ETH_ALEN)) { tdls_peer->tdls_status = TDLS_SETUP_INPROGRESS; tdls_peer->rssi_jiffies = jiffies; - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); return; } } @@ -1341,19 +1367,18 @@ void mwifiex_add_auto_tdls_peer(struct mwifiex_private *priv, const u8 *mac) "Add auto TDLS peer= %pM to list\n", mac); } - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); } void mwifiex_auto_tdls_update_peer_status(struct mwifiex_private *priv, const u8 *mac, u8 link_status) { struct mwifiex_auto_tdls_peer *peer; - unsigned long flags; if (!priv->adapter->auto_tdls) return; - spin_lock_irqsave(&priv->auto_tdls_lock, flags); + spin_lock_bh(&priv->auto_tdls_lock); list_for_each_entry(peer, &priv->auto_tdls_list, list) { if (!memcmp(peer->mac_addr, mac, ETH_ALEN)) { if ((link_status == TDLS_NOT_SETUP) && @@ -1366,19 +1391,18 @@ void mwifiex_auto_tdls_update_peer_status(struct mwifiex_private *priv, break; } } - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); } void mwifiex_auto_tdls_update_peer_signal(struct mwifiex_private *priv, u8 *mac, s8 snr, s8 nflr) { struct mwifiex_auto_tdls_peer *peer; - unsigned long flags; if (!priv->adapter->auto_tdls) return; - spin_lock_irqsave(&priv->auto_tdls_lock, flags); + spin_lock_bh(&priv->auto_tdls_lock); list_for_each_entry(peer, &priv->auto_tdls_list, list) { if (!memcmp(peer->mac_addr, mac, ETH_ALEN)) { peer->rssi = nflr - snr; @@ -1386,14 +1410,14 @@ void mwifiex_auto_tdls_update_peer_signal(struct mwifiex_private *priv, break; } } - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); } void mwifiex_check_auto_tdls(struct timer_list *t) { - struct mwifiex_private *priv = from_timer(priv, t, auto_tdls_timer); + struct mwifiex_private *priv = timer_container_of(priv, t, + auto_tdls_timer); struct mwifiex_auto_tdls_peer *tdls_peer; - unsigned long flags; u16 reason = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED; if (WARN_ON_ONCE(!priv || !priv->adapter)) { @@ -1413,10 +1437,10 @@ void mwifiex_check_auto_tdls(struct timer_list *t) priv->check_tdls_tx = false; - spin_lock_irqsave(&priv->auto_tdls_lock, flags); + spin_lock_bh(&priv->auto_tdls_lock); list_for_each_entry(tdls_peer, &priv->auto_tdls_list, list) { - if ((jiffies - tdls_peer->rssi_jiffies) > - (MWIFIEX_AUTO_TDLS_IDLE_TIME * HZ)) { + if (time_after(jiffies, tdls_peer->rssi_jiffies + + MWIFIEX_AUTO_TDLS_IDLE_TIME * HZ)) { tdls_peer->rssi = 0; tdls_peer->do_discover = true; priv->check_tdls_tx = true; @@ -1441,14 +1465,13 @@ void mwifiex_check_auto_tdls(struct timer_list *t) tdls_peer->failure_count < MWIFIEX_TDLS_MAX_FAIL_COUNT) { priv->check_tdls_tx = true; - tdls_peer->do_setup = true; mwifiex_dbg(priv->adapter, INFO, "check TDLS with peer=%pM\t" "rssi=%d\n", tdls_peer->mac_addr, tdls_peer->rssi); } } - spin_unlock_irqrestore(&priv->auto_tdls_lock, flags); + spin_unlock_bh(&priv->auto_tdls_lock); mod_timer(&priv->auto_tdls_timer, jiffies + msecs_to_jiffies(MWIFIEX_TIMER_10S)); @@ -1468,7 +1491,7 @@ void mwifiex_clean_auto_tdls(struct mwifiex_private *priv) priv->adapter->auto_tdls && priv->bss_type == MWIFIEX_BSS_TYPE_STA) { priv->auto_tdls_timer_active = false; - del_timer(&priv->auto_tdls_timer); + timer_delete(&priv->auto_tdls_timer); mwifiex_flush_auto_tdls_list(priv); } } |
