madwifi: merge fixes from trunk
[openwrt/svn-archive/archive.git] / package / madwifi / patches / 451-ibss_race_fix.patch
1 --- a/net80211/ieee80211_input.c
2 +++ b/net80211/ieee80211_input.c
3 @@ -294,10 +294,10 @@ ieee80211_input(struct ieee80211vap * va
4 break;
5 case IEEE80211_M_IBSS:
6 case IEEE80211_M_AHDEMO:
7 - if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bssid) ||
8 + if ((!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bssid) ||
9 (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr) &&
10 - !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
11 - (subtype != IEEE80211_FC0_SUBTYPE_BEACON))) {
12 + !IEEE80211_IS_MULTICAST(wh->i_addr1))) &&
13 + (type == IEEE80211_FC0_TYPE_DATA)) {
14 if (!(vap->iv_dev->flags & IFF_PROMISC)) {
15 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
16 bssid, NULL, "%s", "not to bss");
17 @@ -322,22 +322,15 @@ ieee80211_input(struct ieee80211vap * va
18 }
19 /* Do not try to find a node reference if the packet really did come from the BSS */
20 if (type == IEEE80211_FC0_TYPE_DATA && ni == vap->iv_bss &&
21 - !IEEE80211_ADDR_EQ(vap->iv_bss->ni_macaddr, wh->i_addr2) &&
22 IEEE80211_ADDR_EQ(vap->iv_bssid, wh->i_addr3)) {
23 /* Try to find sender in local node table. */
24 - ni = ieee80211_find_node(&ic->ic_sta, wh->i_addr2);
25 + if (!ni_or_null) {
26 + ieee80211_unref_node(&ni);
27 + ni = ieee80211_find_txnode(vap, wh->i_addr2);
28 + }
29 if (ni == NULL) {
30 - /*
31 - * Fake up a node for this newly discovered
32 - * member of the IBSS. This should probably
33 - * done after an ACL check.
34 - */
35 - ni = ieee80211_fakeup_adhoc_node(vap,
36 - wh->i_addr2);
37 - if (ni == NULL) {
38 - /* NB: stat kept for alloc failure */
39 - goto err;
40 - }
41 + /* NB: stat kept for alloc failure */
42 + goto discard;
43 }
44 }
45 iwspy_event(vap, ni, rssi);
46 @@ -3553,8 +3546,8 @@ ieee80211_recv_mgmt(struct ieee80211vap
47 (((vap->iv_opmode == IEEE80211_M_HOSTAP) ||
48 (vap->iv_opmode == IEEE80211_M_WDS)) &&
49 (scan.capinfo & IEEE80211_CAPINFO_ESS))) {
50 + struct ieee80211_node *tni = NULL;
51 struct ieee80211vap *avp = NULL;
52 - int do_unref = 0;
53 int found = 0;
54
55 IEEE80211_LOCK_IRQ(vap->iv_ic);
56 @@ -3568,14 +3561,12 @@ ieee80211_recv_mgmt(struct ieee80211vap
57 }
58 }
59 if (found)
60 - ni = ni_or_null = avp->iv_wdsnode;
61 + tni = ieee80211_ref_node(avp->iv_wdsnode);
62 } else if (vap->iv_opmode == IEEE80211_M_WDS) {
63 found = 1;
64 - ni = ni_or_null = vap->iv_wdsnode;
65 - } else if (vap->iv_opmode == IEEE80211_M_IBSS) {
66 - ni_or_null = ieee80211_find_node(&ic->ic_sta, wh->i_addr2);
67 - if (ni_or_null)
68 - ni = ni_or_null;
69 + tni = ieee80211_ref_node(vap->iv_wdsnode);
70 + } else if ((vap->iv_opmode == IEEE80211_M_IBSS) && (vap->iv_state == IEEE80211_S_RUN)) {
71 + tni = ieee80211_find_node(&ic->ic_sta, wh->i_addr2);
72 found = 1;
73 }
74 IEEE80211_UNLOCK_IRQ(vap->iv_ic);
75 @@ -3583,20 +3574,21 @@ ieee80211_recv_mgmt(struct ieee80211vap
76 if (!found)
77 break;
78
79 - if (ni_or_null == NULL) {
80 + memcpy(&SKB_CB(skb)->beacon_tsf, scan.tstamp, sizeof(u_int64_t));
81 +
82 + if (tni == NULL) {
83 if (avp) {
84 IEEE80211_LOCK_IRQ(ic);
85 - ni = ieee80211_add_neighbor(avp, wh, &scan);
86 + tni = ieee80211_add_neighbor(avp, wh, &scan);
87 /* force assoc */
88 - ni->ni_associd |= 0xc000;
89 - avp->iv_wdsnode = ieee80211_ref_node(ni);
90 + tni->ni_associd |= 0xc000;
91 + avp->iv_wdsnode = ieee80211_ref_node(tni);
92 IEEE80211_UNLOCK_IRQ(ic);
93 } else if ((vap->iv_opmode == IEEE80211_M_IBSS) &&
94 IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bssid)) {
95 /* Create a new entry in the neighbor table. */
96 - ni = ieee80211_add_neighbor(vap, wh, &scan);
97 + tni = ieee80211_add_neighbor(vap, wh, &scan);
98 }
99 - do_unref = 1;
100 } else {
101 /*
102 * Copy data from beacon to neighbor table.
103 @@ -3604,39 +3596,38 @@ ieee80211_recv_mgmt(struct ieee80211vap
104 * ieee80211_add_neighbor(), so we just copy
105 * everything over to be safe.
106 */
107 - ni->ni_esslen = scan.ssid[1];
108 - memcpy(ni->ni_essid, scan.ssid + 2, scan.ssid[1]);
109 - IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
110 - memcpy(ni->ni_tstamp.data, scan.tstamp,
111 - sizeof(ni->ni_tstamp));
112 - ni->ni_inact = ni->ni_inact_reload;
113 - ni->ni_intval =
114 + tni->ni_esslen = scan.ssid[1];
115 + memcpy(tni->ni_essid, scan.ssid + 2, scan.ssid[1]);
116 + IEEE80211_ADDR_COPY(tni->ni_bssid, wh->i_addr3);
117 + memcpy(tni->ni_tstamp.data, scan.tstamp,
118 + sizeof(tni->ni_tstamp));
119 + tni->ni_inact = tni->ni_inact_reload;
120 + tni->ni_intval =
121 IEEE80211_BINTVAL_SANITISE(scan.bintval);
122 - ni->ni_capinfo = scan.capinfo;
123 - ni->ni_chan = ic->ic_curchan;
124 - ni->ni_fhdwell = scan.fhdwell;
125 - ni->ni_fhindex = scan.fhindex;
126 - ni->ni_erp = scan.erp;
127 - ni->ni_timoff = scan.timoff;
128 + tni->ni_capinfo = scan.capinfo;
129 + tni->ni_chan = ic->ic_curchan;
130 + tni->ni_fhdwell = scan.fhdwell;
131 + tni->ni_fhindex = scan.fhindex;
132 + tni->ni_erp = scan.erp;
133 + tni->ni_timoff = scan.timoff;
134 if (scan.wme != NULL)
135 - ieee80211_saveie(&ni->ni_wme_ie, scan.wme);
136 + ieee80211_saveie(&tni->ni_wme_ie, scan.wme);
137 if (scan.wpa != NULL)
138 - ieee80211_saveie(&ni->ni_wpa_ie, scan.wpa);
139 + ieee80211_saveie(&tni->ni_wpa_ie, scan.wpa);
140 if (scan.rsn != NULL)
141 - ieee80211_saveie(&ni->ni_rsn_ie, scan.rsn);
142 + ieee80211_saveie(&tni->ni_rsn_ie, scan.rsn);
143 if (scan.ath != NULL)
144 - ieee80211_saveath(ni, scan.ath);
145 + ieee80211_saveath(tni, scan.ath);
146
147 /* NB: must be after ni_chan is setup */
148 - ieee80211_setup_rates(ni, scan.rates,
149 + ieee80211_setup_rates(tni, scan.rates,
150 scan.xrates, IEEE80211_F_DOSORT);
151 }
152 - if (ni != NULL) {
153 - ni->ni_rssi = rssi;
154 - ni->ni_rtsf = rtsf;
155 - ni->ni_last_rx = jiffies;
156 - if (do_unref)
157 - ieee80211_unref_node(&ni);
158 + if (tni != NULL) {
159 + tni->ni_rssi = rssi;
160 + tni->ni_rtsf = rtsf;
161 + tni->ni_last_rx = jiffies;
162 + ieee80211_unref_node(&tni);
163 }
164 }
165 break;
166 --- a/net80211/ieee80211_node.c
167 +++ b/net80211/ieee80211_node.c
168 @@ -53,6 +53,7 @@
169
170 #include <net80211/ieee80211_var.h>
171 #include <net80211/if_athproto.h>
172 +#include <net80211/ieee80211_node.h>
173
174 /*
175 * Association IDs are managed with a bit vector.
176 @@ -317,16 +318,11 @@ ieee80211_create_ibss(struct ieee80211va
177 /* Check to see if we already have a node for this mac
178 * NB: we gain a node reference here
179 */
180 - ni = ieee80211_find_txnode(vap, vap->iv_myaddr);
181 + ieee80211_node_table_reset(&ic->ic_sta, vap);
182 + ni = ieee80211_alloc_node_table(vap, vap->iv_myaddr);
183 if (ni == NULL) {
184 - ni = ieee80211_alloc_node_table(vap, vap->iv_myaddr);
185 - IEEE80211_DPRINTF(vap, IEEE80211_MSG_ASSOC,
186 - "%s: ni:%p allocated for " MAC_FMT "\n",
187 - __func__, ni, MAC_ADDR(vap->iv_myaddr));
188 - if (ni == NULL) {
189 - /* XXX recovery? */
190 - return;
191 - }
192 + /* XXX recovery? */
193 + return;
194 }
195
196 IEEE80211_ADDR_COPY(ni->ni_bssid, vap->iv_myaddr);
197 @@ -429,8 +425,8 @@ ieee80211_reset_bss(struct ieee80211vap
198 __func__, ni, MAC_ADDR(vap->iv_myaddr));
199 KASSERT(ni != NULL, ("unable to setup inital BSS node"));
200
201 - vap->iv_bss = ieee80211_ref_node(ni);
202 - KASSERT((atomic_read(&vap->iv_bss->ni_refcnt) == 3),
203 + vap->iv_bss = ni;
204 + KASSERT((atomic_read(&vap->iv_bss->ni_refcnt) == 2),
205 ("wrong refcount for new node."));
206
207 if (obss != NULL) {
208 @@ -647,7 +643,7 @@ ieee80211_sta_join1(struct ieee80211_nod
209 (vap->iv_state == IEEE80211_S_RUN) && bssid_equal(obss, selbs)); */
210 vap->iv_bss = selbs;
211 IEEE80211_ADDR_COPY(vap->iv_bssid, selbs->ni_bssid);
212 - if (obss != NULL) {
213 + if ((obss != NULL) && (obss != selbs)) {
214 if (obss->ni_table)
215 ieee80211_node_leave(obss);
216 ieee80211_unref_node(&obss);
217 --- a/ath/if_ath.c
218 +++ b/ath/if_ath.c
219 @@ -6625,14 +6625,6 @@ ath_recv_mgmt(struct ieee80211vap * vap,
220
221 sc->sc_recv_mgmt(vap, ni_or_null, skb, subtype, rssi, rtsf);
222
223 - /* Lookup the new node if any (this grabs a reference to it) */
224 - ni = ieee80211_find_rxnode(vap->iv_ic, vap,
225 - (const struct ieee80211_frame_min *)skb->data);
226 - if (ni == NULL) {
227 - DPRINTF(sc, ATH_DEBUG_BEACON, "Dropping; node unknown.\n");
228 - return;
229 - }
230 -
231 switch (subtype) {
232 case IEEE80211_FC0_SUBTYPE_BEACON:
233 /* update RSSI statistics for use by the HAL */
234 @@ -6654,11 +6646,9 @@ ath_recv_mgmt(struct ieee80211vap * vap,
235 * we do the IBSS merging in software. Also do not merge
236 * if the difference it too small. Otherwise we are playing
237 * tsf-pingpong with other vendors drivers */
238 - beacon_tsf = le64_to_cpu(ni->ni_tstamp.tsf);
239 - if (beacon_tsf > rtsf + 0xffff) {
240 + beacon_tsf = le64_to_cpu(SKB_CB(skb)->beacon_tsf);
241 + if (beacon_tsf > rtsf + 0xffff)
242 ath_hal_settsf64(sc->sc_ah, beacon_tsf - rtsf);
243 - ieee80211_ibss_merge(ni);
244 - }
245 break;
246 }
247 /* NB: Fall Through */
248 @@ -6680,13 +6670,21 @@ ath_recv_mgmt(struct ieee80211vap * vap,
249 hw_tsf = ath_hal_gettsf64(sc->sc_ah);
250 hw_tu = hw_tsf >> 10;
251
252 - beacon_tsf = le64_to_cpu(ni->ni_tstamp.tsf);
253 + beacon_tsf = le64_to_cpu(SKB_CB(skb)->beacon_tsf);
254 beacon_tu = beacon_tsf >> 10;
255
256 + if (!beacon_tsf)
257 + break;
258 +
259 + if (IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bssid))
260 + break;
261 +
262 DPRINTF(sc, ATH_DEBUG_BEACON,
263 - "Beacon transmitted at %10llx, "
264 + "Beacon transmitted from "MAC_FMT" ("MAC_FMT") at %10llx, "
265 "received at %10llx(%lld), hw TSF "
266 "%10llx(%lld)\n",
267 + MAC_ADDR(wh->i_addr3),
268 + MAC_ADDR(vap->iv_bssid),
269 beacon_tsf,
270 rtsf, rtsf - beacon_tsf,
271 hw_tsf, hw_tsf - beacon_tsf);
272 @@ -6699,39 +6697,13 @@ ath_recv_mgmt(struct ieee80211vap * vap,
273 do_merge = 1;
274 }
275
276 - /* Check sc_nexttbtt */
277 - if (sc->sc_nexttbtt < hw_tu) {
278 - DPRINTF(sc, ATH_DEBUG_BEACON,
279 - "sc_nexttbtt (%8x TU) is in the past "
280 - "(tsf %8x TU), updating timers\n",
281 - sc->sc_nexttbtt, hw_tu);
282 - do_merge = 1;
283 - }
284 -
285 - intval = ni->ni_intval & HAL_BEACON_PERIOD;
286 -#if 0
287 - /* This code is disabled since it would produce
288 - * unwanted merge. For instance, in a two nodes network
289 - * A & B, A can merge to B and at the same time, B will
290 - * merge to A, still having a split */
291 - if (intval != 0) {
292 - if ((sc->sc_nexttbtt % intval) !=
293 - (beacon_tu % intval)) {
294 - DPRINTF(sc, ATH_DEBUG_BEACON,
295 - "ibss merge: "
296 - "sc_nexttbtt %10x TU "
297 - "(%3d) beacon %10x TU "
298 - "(%3d)\n",
299 - sc->sc_nexttbtt,
300 - sc->sc_nexttbtt % intval,
301 - beacon_tu,
302 - beacon_tu % intval);
303 - do_merge = 1;
304 - }
305 - }
306 -#endif
307 - if (do_merge)
308 + if (do_merge) {
309 + /* Lookup the new node if any (this grabs a reference to it) */
310 + ni = ieee80211_find_txnode(vap, wh->i_addr2);
311 + memcpy(ni->ni_bssid, wh->i_addr3, IEEE80211_ADDR_LEN);
312 ieee80211_ibss_merge(ni);
313 + ieee80211_unref_node(&ni);
314 + }
315
316 if ((sc->sc_opmode == HAL_M_IBSS) &&
317 ath_hw_check_atim(sc, 1, vap->iv_bss->ni_intval))
318 @@ -6739,8 +6711,6 @@ ath_recv_mgmt(struct ieee80211vap * vap,
319 }
320 break;
321 }
322 -
323 - ieee80211_unref_node(&ni);
324 }
325
326 static void
327 --- a/net80211/ieee80211_linux.h
328 +++ b/net80211/ieee80211_linux.h
329 @@ -411,7 +411,7 @@ typedef spinlock_t acl_lock_t;
330 * 8 bytes so we reserve/avoid it.
331 */
332 struct ieee80211_cb {
333 - u_int8_t vlan[8]; /* reserve for vlan tag info */
334 + u_int64_t beacon_tsf;
335 struct ieee80211_node *ni;
336 u_int32_t flags;
337 #define M_LINK0 0x01 /* frame needs WEP encryption */
338 --- a/net80211/ieee80211_scan_sta.c
339 +++ b/net80211/ieee80211_scan_sta.c
340 @@ -1125,11 +1125,8 @@ adhoc_default_action(struct ieee80211vap
341 u_int8_t zeroMacAddr[IEEE80211_ADDR_LEN];
342
343 memset(&zeroMacAddr, 0, IEEE80211_ADDR_LEN);
344 - if (IEEE80211_ADDR_EQ(se->se_bssid, &zeroMacAddr[0])) {
345 - ieee80211_create_ibss(vap, se->se_chan);
346 - return 1;
347 - } else
348 - return ieee80211_sta_join(vap, se);
349 + ieee80211_create_ibss(vap, se->se_chan);
350 + return 1;
351 }
352
353 static const struct ieee80211_scanner adhoc_default = {