1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * IEEE 802.15.4 scanning management 4 * 5 * Copyright (C) 2021 Qorvo US, Inc 6 * Authors: 7 * - David Girault <david.girault@qorvo.com> 8 * - Miquel Raynal <miquel.raynal@bootlin.com> 9 */ 10 11 #include <linux/module.h> 12 #include <linux/rtnetlink.h> 13 #include <net/mac802154.h> 14 15 #include "ieee802154_i.h" 16 #include "driver-ops.h" 17 #include "../ieee802154/nl802154.h" 18 19 #define IEEE802154_BEACON_MHR_SZ 13 20 #define IEEE802154_BEACON_PL_SZ 4 21 #define IEEE802154_MAC_CMD_MHR_SZ 23 22 #define IEEE802154_MAC_CMD_PL_SZ 1 23 #define IEEE802154_BEACON_SKB_SZ (IEEE802154_BEACON_MHR_SZ + \ 24 IEEE802154_BEACON_PL_SZ) 25 #define IEEE802154_MAC_CMD_SKB_SZ (IEEE802154_MAC_CMD_MHR_SZ + \ 26 IEEE802154_MAC_CMD_PL_SZ) 27 28 /* mac802154_scan_cleanup_locked() must be called upon scan completion or abort. 29 * - Completions are asynchronous, not locked by the rtnl and decided by the 30 * scan worker. 31 * - Aborts are decided by userspace, and locked by the rtnl. 32 * 33 * Concurrent modifications to the PHY, the interfaces or the hardware is in 34 * general prevented by the rtnl. So in most cases we don't need additional 35 * protection. 36 * 37 * However, the scan worker get's triggered without anybody noticing and thus we 38 * must ensure the presence of the devices as well as data consistency: 39 * - The sub-interface and device driver module get both their reference 40 * counters incremented whenever we start a scan, so they cannot disappear 41 * during operation. 42 * - Data consistency is achieved by the use of rcu protected pointers. 43 */ 44 static int mac802154_scan_cleanup_locked(struct ieee802154_local *local, 45 struct ieee802154_sub_if_data *sdata, 46 bool aborted) 47 { 48 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 49 struct wpan_phy *wpan_phy = local->phy; 50 struct cfg802154_scan_request *request; 51 u8 arg; 52 53 /* Prevent any further use of the scan request */ 54 clear_bit(IEEE802154_IS_SCANNING, &local->ongoing); 55 cancel_delayed_work(&local->scan_work); 56 request = rcu_replace_pointer(local->scan_req, NULL, 1); 57 if (!request) 58 return 0; 59 kvfree_rcu_mightsleep(request); 60 61 /* Advertize first, while we know the devices cannot be removed */ 62 if (aborted) 63 arg = NL802154_SCAN_DONE_REASON_ABORTED; 64 else 65 arg = NL802154_SCAN_DONE_REASON_FINISHED; 66 nl802154_scan_done(wpan_phy, wpan_dev, arg); 67 68 /* Cleanup software stack */ 69 ieee802154_mlme_op_post(local); 70 71 /* Set the hardware back in its original state */ 72 drv_set_channel(local, wpan_phy->current_page, 73 wpan_phy->current_channel); 74 ieee802154_configure_durations(wpan_phy, wpan_phy->current_page, 75 wpan_phy->current_channel); 76 drv_stop(local); 77 synchronize_net(); 78 sdata->required_filtering = sdata->iface_default_filtering; 79 drv_start(local, sdata->required_filtering, &local->addr_filt); 80 81 return 0; 82 } 83 84 int mac802154_abort_scan_locked(struct ieee802154_local *local, 85 struct ieee802154_sub_if_data *sdata) 86 { 87 ASSERT_RTNL(); 88 89 if (!mac802154_is_scanning(local)) 90 return -ESRCH; 91 92 return mac802154_scan_cleanup_locked(local, sdata, true); 93 } 94 95 static unsigned int mac802154_scan_get_channel_time(u8 duration_order, 96 u8 symbol_duration) 97 { 98 u64 base_super_frame_duration = (u64)symbol_duration * 99 IEEE802154_SUPERFRAME_PERIOD * IEEE802154_SLOT_PERIOD; 100 101 return usecs_to_jiffies(base_super_frame_duration * 102 (BIT(duration_order) + 1)); 103 } 104 105 static void mac802154_flush_queued_beacons(struct ieee802154_local *local) 106 { 107 struct cfg802154_mac_pkt *mac_pkt, *tmp; 108 109 list_for_each_entry_safe(mac_pkt, tmp, &local->rx_beacon_list, node) { 110 list_del(&mac_pkt->node); 111 kfree_skb(mac_pkt->skb); 112 kfree(mac_pkt); 113 } 114 } 115 116 static void 117 mac802154_scan_get_next_channel(struct ieee802154_local *local, 118 struct cfg802154_scan_request *scan_req, 119 u8 *channel) 120 { 121 (*channel)++; 122 *channel = find_next_bit((const unsigned long *)&scan_req->channels, 123 IEEE802154_MAX_CHANNEL + 1, 124 *channel); 125 } 126 127 static int mac802154_scan_find_next_chan(struct ieee802154_local *local, 128 struct cfg802154_scan_request *scan_req, 129 u8 page, u8 *channel) 130 { 131 mac802154_scan_get_next_channel(local, scan_req, channel); 132 if (*channel > IEEE802154_MAX_CHANNEL) 133 return -EINVAL; 134 135 return 0; 136 } 137 138 static int mac802154_scan_prepare_beacon_req(struct ieee802154_local *local) 139 { 140 memset(&local->scan_beacon_req, 0, sizeof(local->scan_beacon_req)); 141 local->scan_beacon_req.mhr.fc.type = IEEE802154_FC_TYPE_MAC_CMD; 142 local->scan_beacon_req.mhr.fc.dest_addr_mode = IEEE802154_SHORT_ADDRESSING; 143 local->scan_beacon_req.mhr.fc.version = IEEE802154_2003_STD; 144 local->scan_beacon_req.mhr.fc.source_addr_mode = IEEE802154_NO_ADDRESSING; 145 local->scan_beacon_req.mhr.dest.mode = IEEE802154_ADDR_SHORT; 146 local->scan_beacon_req.mhr.dest.pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST); 147 local->scan_beacon_req.mhr.dest.short_addr = cpu_to_le16(IEEE802154_ADDR_BROADCAST); 148 local->scan_beacon_req.mac_pl.cmd_id = IEEE802154_CMD_BEACON_REQ; 149 150 return 0; 151 } 152 153 static int mac802154_transmit_beacon_req(struct ieee802154_local *local, 154 struct ieee802154_sub_if_data *sdata) 155 { 156 struct sk_buff *skb; 157 int ret; 158 159 skb = alloc_skb(IEEE802154_MAC_CMD_SKB_SZ, GFP_KERNEL); 160 if (!skb) 161 return -ENOBUFS; 162 163 skb->dev = sdata->dev; 164 165 ret = ieee802154_mac_cmd_push(skb, &local->scan_beacon_req, NULL, 0); 166 if (ret) { 167 kfree_skb(skb); 168 return ret; 169 } 170 171 return ieee802154_mlme_tx(local, sdata, skb); 172 } 173 174 void mac802154_scan_worker(struct work_struct *work) 175 { 176 struct ieee802154_local *local = 177 container_of(work, struct ieee802154_local, scan_work.work); 178 struct cfg802154_scan_request *scan_req; 179 enum nl802154_scan_types scan_req_type; 180 struct ieee802154_sub_if_data *sdata; 181 unsigned int scan_duration = 0; 182 netdevice_tracker dev_tracker; 183 struct wpan_phy *wpan_phy; 184 u8 scan_req_duration; 185 u8 page, channel; 186 int ret; 187 188 /* Ensure the device receiver is turned off when changing channels 189 * because there is no atomic way to change the channel and know on 190 * which one a beacon might have been received. 191 */ 192 drv_stop(local); 193 synchronize_net(); 194 mac802154_flush_queued_beacons(local); 195 196 rcu_read_lock(); 197 scan_req = rcu_dereference(local->scan_req); 198 if (unlikely(!scan_req)) { 199 rcu_read_unlock(); 200 return; 201 } 202 203 sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(scan_req->wpan_dev); 204 205 /* Wait an arbitrary amount of time in case we cannot use the device */ 206 if (local->suspended || !ieee802154_sdata_running(sdata)) { 207 rcu_read_unlock(); 208 queue_delayed_work(local->mac_wq, &local->scan_work, 209 msecs_to_jiffies(1000)); 210 return; 211 } 212 213 /* 214 * sdata->dev is dereferenced below after rcu_read_unlock() and outside 215 * the rtnl, and a concurrent DEL_INTERFACE / PHY teardown can free it 216 * asynchronously from netdev_run_todo(). Pin it with a reference taken 217 * while the RCU read lock is still held, and drop it at every exit. 218 */ 219 netdev_hold(sdata->dev, &dev_tracker, GFP_ATOMIC); 220 221 wpan_phy = scan_req->wpan_phy; 222 scan_req_type = scan_req->type; 223 scan_req_duration = scan_req->duration; 224 225 /* Look for the next valid chan */ 226 page = local->scan_page; 227 channel = local->scan_channel; 228 do { 229 ret = mac802154_scan_find_next_chan(local, scan_req, page, &channel); 230 if (ret) { 231 rcu_read_unlock(); 232 goto end_scan; 233 } 234 } while (!ieee802154_chan_is_valid(scan_req->wpan_phy, page, channel)); 235 236 rcu_read_unlock(); 237 238 /* Bypass the stack on purpose when changing the channel */ 239 rtnl_lock(); 240 ret = drv_set_channel(local, page, channel); 241 rtnl_unlock(); 242 if (ret) { 243 dev_err(&sdata->dev->dev, 244 "Channel change failure during scan, aborting (%d)\n", ret); 245 goto end_scan; 246 } 247 248 local->scan_page = page; 249 local->scan_channel = channel; 250 251 rtnl_lock(); 252 ret = drv_start(local, IEEE802154_FILTERING_3_SCAN, &local->addr_filt); 253 rtnl_unlock(); 254 if (ret) { 255 dev_err(&sdata->dev->dev, 256 "Restarting failure after channel change, aborting (%d)\n", ret); 257 goto end_scan; 258 } 259 260 if (scan_req_type == NL802154_SCAN_ACTIVE) { 261 ret = mac802154_transmit_beacon_req(local, sdata); 262 if (ret) 263 dev_err(&sdata->dev->dev, 264 "Error when transmitting beacon request (%d)\n", ret); 265 } 266 267 ieee802154_configure_durations(wpan_phy, page, channel); 268 scan_duration = mac802154_scan_get_channel_time(scan_req_duration, 269 wpan_phy->symbol_duration); 270 dev_dbg(&sdata->dev->dev, 271 "Scan page %u channel %u for %ums\n", 272 page, channel, jiffies_to_msecs(scan_duration)); 273 queue_delayed_work(local->mac_wq, &local->scan_work, scan_duration); 274 netdev_put(sdata->dev, &dev_tracker); 275 return; 276 277 end_scan: 278 rtnl_lock(); 279 mac802154_scan_cleanup_locked(local, sdata, false); 280 rtnl_unlock(); 281 netdev_put(sdata->dev, &dev_tracker); 282 } 283 284 int mac802154_trigger_scan_locked(struct ieee802154_sub_if_data *sdata, 285 struct cfg802154_scan_request *request) 286 { 287 struct ieee802154_local *local = sdata->local; 288 289 ASSERT_RTNL(); 290 291 if (mac802154_is_scanning(local)) 292 return -EBUSY; 293 294 if (request->type != NL802154_SCAN_PASSIVE && 295 request->type != NL802154_SCAN_ACTIVE) 296 return -EOPNOTSUPP; 297 298 /* Store scanning parameters */ 299 rcu_assign_pointer(local->scan_req, request); 300 301 /* Software scanning requires to set promiscuous mode, so we need to 302 * pause the Tx queue during the entire operation. 303 */ 304 ieee802154_mlme_op_pre(local); 305 306 sdata->required_filtering = IEEE802154_FILTERING_3_SCAN; 307 local->scan_page = request->page; 308 local->scan_channel = -1; 309 set_bit(IEEE802154_IS_SCANNING, &local->ongoing); 310 if (request->type == NL802154_SCAN_ACTIVE) 311 mac802154_scan_prepare_beacon_req(local); 312 313 nl802154_scan_started(request->wpan_phy, request->wpan_dev); 314 315 queue_delayed_work(local->mac_wq, &local->scan_work, 0); 316 317 return 0; 318 } 319 320 int mac802154_process_beacon(struct ieee802154_local *local, 321 struct sk_buff *skb, 322 u8 page, u8 channel) 323 { 324 struct ieee802154_beacon_hdr *bh = (void *)skb->data; 325 struct ieee802154_addr *src = &mac_cb(skb)->source; 326 struct cfg802154_scan_request *scan_req; 327 struct ieee802154_coord_desc desc; 328 329 if (skb->len != sizeof(*bh)) 330 return -EINVAL; 331 332 if (unlikely(src->mode == IEEE802154_ADDR_NONE)) 333 return -EINVAL; 334 335 dev_dbg(&skb->dev->dev, 336 "BEACON received on page %u channel %u\n", 337 page, channel); 338 339 memcpy(&desc.addr, src, sizeof(desc.addr)); 340 desc.page = page; 341 desc.channel = channel; 342 desc.link_quality = mac_cb(skb)->lqi; 343 desc.superframe_spec = get_unaligned_le16(skb->data); 344 desc.gts_permit = bh->gts_permit; 345 346 trace_802154_scan_event(&desc); 347 348 rcu_read_lock(); 349 scan_req = rcu_dereference(local->scan_req); 350 if (likely(scan_req)) 351 nl802154_scan_event(scan_req->wpan_phy, scan_req->wpan_dev, &desc); 352 rcu_read_unlock(); 353 354 return 0; 355 } 356 357 static int mac802154_transmit_beacon(struct ieee802154_local *local, 358 struct wpan_dev *wpan_dev) 359 { 360 struct cfg802154_beacon_request *beacon_req; 361 struct ieee802154_sub_if_data *sdata; 362 struct sk_buff *skb; 363 int ret; 364 365 /* Update the sequence number */ 366 local->beacon.mhr.seq = atomic_inc_return(&wpan_dev->bsn) & 0xFF; 367 368 skb = alloc_skb(IEEE802154_BEACON_SKB_SZ, GFP_KERNEL); 369 if (!skb) 370 return -ENOBUFS; 371 372 rcu_read_lock(); 373 beacon_req = rcu_dereference(local->beacon_req); 374 if (unlikely(!beacon_req)) { 375 rcu_read_unlock(); 376 kfree_skb(skb); 377 return -EINVAL; 378 } 379 380 sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(beacon_req->wpan_dev); 381 skb->dev = sdata->dev; 382 383 rcu_read_unlock(); 384 385 ret = ieee802154_beacon_push(skb, &local->beacon); 386 if (ret) { 387 kfree_skb(skb); 388 return ret; 389 } 390 391 /* Using the MLME transmission helper for sending beacons is a bit 392 * overkill because we do not really care about the final outcome. 393 * 394 * Even though, going through the whole net stack with a regular 395 * dev_queue_xmit() is not relevant either because we want beacons to be 396 * sent "now" rather than go through the whole net stack scheduling 397 * (qdisc & co). 398 * 399 * Finally, using ieee802154_subif_start_xmit() would only be an option 400 * if we had a generic transmit helper which would acquire the 401 * HARD_TX_LOCK() to prevent buffer handling conflicts with regular 402 * packets. 403 * 404 * So for now we keep it simple and send beacons with our MLME helper, 405 * even if it stops the ieee802154 queue entirely during these 406 * transmissions, wich anyway does not have a huge impact on the 407 * performances given the current design of the stack. 408 */ 409 return ieee802154_mlme_tx(local, sdata, skb); 410 } 411 412 void mac802154_beacon_worker(struct work_struct *work) 413 { 414 struct ieee802154_local *local = 415 container_of(work, struct ieee802154_local, beacon_work.work); 416 struct cfg802154_beacon_request *beacon_req; 417 struct ieee802154_sub_if_data *sdata; 418 netdevice_tracker dev_tracker; 419 struct wpan_dev *wpan_dev; 420 u8 interval; 421 int ret; 422 423 rcu_read_lock(); 424 beacon_req = rcu_dereference(local->beacon_req); 425 if (unlikely(!beacon_req)) { 426 rcu_read_unlock(); 427 return; 428 } 429 430 sdata = IEEE802154_WPAN_DEV_TO_SUB_IF(beacon_req->wpan_dev); 431 netdev_hold(sdata->dev, &dev_tracker, GFP_ATOMIC); 432 433 /* Wait an arbitrary amount of time in case we cannot use the device */ 434 if (local->suspended || !ieee802154_sdata_running(sdata)) { 435 rcu_read_unlock(); 436 queue_delayed_work(local->mac_wq, &local->beacon_work, 437 msecs_to_jiffies(1000)); 438 netdev_put(sdata->dev, &dev_tracker); 439 return; 440 } 441 442 wpan_dev = beacon_req->wpan_dev; 443 interval = beacon_req->interval; 444 445 rcu_read_unlock(); 446 447 dev_dbg(&sdata->dev->dev, "Sending beacon\n"); 448 ret = mac802154_transmit_beacon(local, wpan_dev); 449 if (ret) 450 dev_err(&sdata->dev->dev, 451 "Beacon could not be transmitted (%d)\n", ret); 452 453 if (interval < IEEE802154_ACTIVE_SCAN_DURATION) 454 queue_delayed_work(local->mac_wq, &local->beacon_work, 455 local->beacon_interval); 456 netdev_put(sdata->dev, &dev_tracker); 457 } 458 459 int mac802154_stop_beacons_locked(struct ieee802154_local *local, 460 struct ieee802154_sub_if_data *sdata) 461 { 462 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 463 struct cfg802154_beacon_request *request; 464 465 ASSERT_RTNL(); 466 467 if (!mac802154_is_beaconing(local)) 468 return -ESRCH; 469 470 clear_bit(IEEE802154_IS_BEACONING, &local->ongoing); 471 cancel_delayed_work(&local->beacon_work); 472 request = rcu_replace_pointer(local->beacon_req, NULL, 1); 473 if (!request) 474 return 0; 475 kvfree_rcu_mightsleep(request); 476 477 nl802154_beaconing_done(wpan_dev); 478 479 return 0; 480 } 481 482 int mac802154_send_beacons_locked(struct ieee802154_sub_if_data *sdata, 483 struct cfg802154_beacon_request *request) 484 { 485 struct ieee802154_local *local = sdata->local; 486 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 487 488 ASSERT_RTNL(); 489 490 if (mac802154_is_beaconing(local)) 491 mac802154_stop_beacons_locked(local, sdata); 492 493 /* Store beaconing parameters */ 494 rcu_assign_pointer(local->beacon_req, request); 495 496 set_bit(IEEE802154_IS_BEACONING, &local->ongoing); 497 498 memset(&local->beacon, 0, sizeof(local->beacon)); 499 local->beacon.mhr.fc.type = IEEE802154_FC_TYPE_BEACON; 500 local->beacon.mhr.fc.security_enabled = 0; 501 local->beacon.mhr.fc.frame_pending = 0; 502 local->beacon.mhr.fc.ack_request = 0; 503 local->beacon.mhr.fc.intra_pan = 0; 504 local->beacon.mhr.fc.dest_addr_mode = IEEE802154_NO_ADDRESSING; 505 local->beacon.mhr.fc.version = IEEE802154_2003_STD; 506 local->beacon.mhr.fc.source_addr_mode = IEEE802154_EXTENDED_ADDRESSING; 507 atomic_set(&request->wpan_dev->bsn, -1); 508 local->beacon.mhr.source.mode = IEEE802154_ADDR_LONG; 509 local->beacon.mhr.source.pan_id = request->wpan_dev->pan_id; 510 local->beacon.mhr.source.extended_addr = request->wpan_dev->extended_addr; 511 local->beacon.mac_pl.beacon_order = request->interval; 512 if (request->interval <= IEEE802154_MAX_SCAN_DURATION) 513 local->beacon.mac_pl.superframe_order = request->interval; 514 local->beacon.mac_pl.final_cap_slot = 0xf; 515 local->beacon.mac_pl.battery_life_ext = 0; 516 local->beacon.mac_pl.pan_coordinator = !wpan_dev->parent; 517 local->beacon.mac_pl.assoc_permit = 1; 518 519 if (request->interval == IEEE802154_ACTIVE_SCAN_DURATION) 520 return 0; 521 522 /* Start the beacon work */ 523 local->beacon_interval = 524 mac802154_scan_get_channel_time(request->interval, 525 request->wpan_phy->symbol_duration); 526 queue_delayed_work(local->mac_wq, &local->beacon_work, 0); 527 528 return 0; 529 } 530 531 int mac802154_perform_association(struct ieee802154_sub_if_data *sdata, 532 struct ieee802154_pan_device *coord, 533 __le16 *short_addr) 534 { 535 u64 ceaddr = swab64((__force u64)coord->extended_addr); 536 struct ieee802154_association_req_frame frame = {}; 537 struct ieee802154_local *local = sdata->local; 538 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 539 __le16 resp_short_addr; 540 struct sk_buff *skb; 541 u8 resp_status; 542 int ret; 543 544 frame.mhr.fc.type = IEEE802154_FC_TYPE_MAC_CMD; 545 frame.mhr.fc.security_enabled = 0; 546 frame.mhr.fc.frame_pending = 0; 547 frame.mhr.fc.ack_request = 1; /* We always expect an ack here */ 548 frame.mhr.fc.intra_pan = 0; 549 frame.mhr.fc.dest_addr_mode = (coord->mode == IEEE802154_ADDR_LONG) ? 550 IEEE802154_EXTENDED_ADDRESSING : IEEE802154_SHORT_ADDRESSING; 551 frame.mhr.fc.version = IEEE802154_2003_STD; 552 frame.mhr.fc.source_addr_mode = IEEE802154_EXTENDED_ADDRESSING; 553 frame.mhr.source.mode = IEEE802154_ADDR_LONG; 554 frame.mhr.source.pan_id = cpu_to_le16(IEEE802154_PANID_BROADCAST); 555 frame.mhr.source.extended_addr = wpan_dev->extended_addr; 556 frame.mhr.dest.mode = coord->mode; 557 frame.mhr.dest.pan_id = coord->pan_id; 558 if (coord->mode == IEEE802154_ADDR_LONG) 559 frame.mhr.dest.extended_addr = coord->extended_addr; 560 else 561 frame.mhr.dest.short_addr = coord->short_addr; 562 frame.mhr.seq = atomic_inc_return(&wpan_dev->dsn) & 0xFF; 563 frame.mac_pl.cmd_id = IEEE802154_CMD_ASSOCIATION_REQ; 564 frame.assoc_req_pl.device_type = 1; 565 frame.assoc_req_pl.power_source = 1; 566 frame.assoc_req_pl.rx_on_when_idle = 1; 567 frame.assoc_req_pl.alloc_addr = 1; 568 569 skb = alloc_skb(IEEE802154_MAC_CMD_SKB_SZ + sizeof(frame.assoc_req_pl), 570 GFP_KERNEL); 571 if (!skb) 572 return -ENOBUFS; 573 574 skb->dev = sdata->dev; 575 576 ret = ieee802154_mac_cmd_push(skb, &frame, &frame.assoc_req_pl, 577 sizeof(frame.assoc_req_pl)); 578 if (ret) { 579 kfree_skb(skb); 580 return ret; 581 } 582 583 spin_lock(&local->assoc_lock); 584 reinit_completion(&local->assoc_done); 585 local->assoc_dev_extended_addr = coord->extended_addr; 586 set_bit(IEEE802154_IS_ASSOCIATING, &local->ongoing); 587 spin_unlock(&local->assoc_lock); 588 589 ret = ieee802154_mlme_tx_one_locked(local, sdata, skb); 590 if (ret) { 591 if (ret > 0) 592 ret = (ret == IEEE802154_NO_ACK) ? -EREMOTEIO : -EIO; 593 dev_warn(&sdata->dev->dev, 594 "No ASSOC REQ ACK received from %8phC\n", &ceaddr); 595 goto clear_assoc; 596 } 597 598 ret = wait_for_completion_killable_timeout(&local->assoc_done, 10 * HZ); 599 if (ret <= 0) { 600 dev_warn(&sdata->dev->dev, 601 "No ASSOC RESP received from %8phC\n", &ceaddr); 602 ret = -ETIMEDOUT; 603 goto clear_assoc; 604 } 605 606 /* The association is complete: mac802154_process_association_resp() 607 * cleared the associating bit before waking us, so a second (e.g. 608 * malicious) ASSOC RESP can no longer pass the recheck and overwrite 609 * the result. Snapshot assoc_status/assoc_addr under the lock. 610 */ 611 spin_lock(&local->assoc_lock); 612 resp_status = local->assoc_status; 613 resp_short_addr = local->assoc_addr; 614 spin_unlock(&local->assoc_lock); 615 616 if (resp_status != IEEE802154_ASSOCIATION_SUCCESSFUL) { 617 if (resp_status == IEEE802154_PAN_AT_CAPACITY) 618 ret = -ERANGE; 619 else 620 ret = -EPERM; 621 622 dev_warn(&sdata->dev->dev, 623 "Negative ASSOC RESP received from %8phC: %s\n", &ceaddr, 624 resp_status == IEEE802154_PAN_AT_CAPACITY ? 625 "PAN at capacity" : "access denied"); 626 return ret; 627 } 628 629 *short_addr = resp_short_addr; 630 631 return 0; 632 633 clear_assoc: 634 spin_lock(&local->assoc_lock); 635 clear_bit(IEEE802154_IS_ASSOCIATING, &local->ongoing); 636 spin_unlock(&local->assoc_lock); 637 638 return ret; 639 } 640 641 int mac802154_process_association_resp(struct ieee802154_sub_if_data *sdata, 642 struct sk_buff *skb) 643 { 644 struct ieee802154_addr *src = &mac_cb(skb)->source; 645 struct ieee802154_addr *dest = &mac_cb(skb)->dest; 646 u64 deaddr = swab64((__force u64)dest->extended_addr); 647 struct ieee802154_local *local = sdata->local; 648 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 649 struct ieee802154_assoc_resp_pl resp_pl = {}; 650 651 if (skb->len != sizeof(resp_pl)) 652 return -EINVAL; 653 654 if (unlikely(src->mode != IEEE802154_EXTENDED_ADDRESSING || 655 dest->mode != IEEE802154_EXTENDED_ADDRESSING)) 656 return -EINVAL; 657 658 spin_lock(&local->assoc_lock); 659 if (unlikely(!test_bit(IEEE802154_IS_ASSOCIATING, &local->ongoing) || 660 dest->extended_addr != wpan_dev->extended_addr || 661 src->extended_addr != local->assoc_dev_extended_addr)) { 662 spin_unlock(&local->assoc_lock); 663 return -ENODEV; 664 } 665 666 memcpy(&resp_pl, skb->data, sizeof(resp_pl)); 667 local->assoc_addr = resp_pl.short_addr; 668 local->assoc_status = resp_pl.status; 669 /* Clear the associating bit before waking the waiter: once the result 670 * is saved, any subsequent (e.g. malicious) ASSOC RESP must fail the 671 * test_bit() recheck above and can no longer overwrite the result. 672 */ 673 clear_bit(IEEE802154_IS_ASSOCIATING, &local->ongoing); 674 complete(&local->assoc_done); 675 spin_unlock(&local->assoc_lock); 676 677 dev_dbg(&skb->dev->dev, 678 "ASSOC RESP 0x%x received from %8phC, getting short address %04x\n", 679 resp_pl.status, &deaddr, resp_pl.short_addr); 680 681 return 0; 682 } 683 684 int mac802154_send_disassociation_notif(struct ieee802154_sub_if_data *sdata, 685 struct ieee802154_pan_device *target, 686 u8 reason) 687 { 688 struct ieee802154_disassociation_notif_frame frame = {}; 689 u64 teaddr = swab64((__force u64)target->extended_addr); 690 struct ieee802154_local *local = sdata->local; 691 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 692 struct sk_buff *skb; 693 int ret; 694 695 frame.mhr.fc.type = IEEE802154_FC_TYPE_MAC_CMD; 696 frame.mhr.fc.security_enabled = 0; 697 frame.mhr.fc.frame_pending = 0; 698 frame.mhr.fc.ack_request = 1; 699 frame.mhr.fc.intra_pan = 1; 700 frame.mhr.fc.dest_addr_mode = (target->mode == IEEE802154_ADDR_LONG) ? 701 IEEE802154_EXTENDED_ADDRESSING : IEEE802154_SHORT_ADDRESSING; 702 frame.mhr.fc.version = IEEE802154_2003_STD; 703 frame.mhr.fc.source_addr_mode = IEEE802154_EXTENDED_ADDRESSING; 704 frame.mhr.source.mode = IEEE802154_ADDR_LONG; 705 frame.mhr.source.pan_id = wpan_dev->pan_id; 706 frame.mhr.source.extended_addr = wpan_dev->extended_addr; 707 frame.mhr.dest.mode = target->mode; 708 frame.mhr.dest.pan_id = wpan_dev->pan_id; 709 if (target->mode == IEEE802154_ADDR_LONG) 710 frame.mhr.dest.extended_addr = target->extended_addr; 711 else 712 frame.mhr.dest.short_addr = target->short_addr; 713 frame.mhr.seq = atomic_inc_return(&wpan_dev->dsn) & 0xFF; 714 frame.mac_pl.cmd_id = IEEE802154_CMD_DISASSOCIATION_NOTIFY; 715 frame.disassoc_pl = reason; 716 717 skb = alloc_skb(IEEE802154_MAC_CMD_SKB_SZ + sizeof(frame.disassoc_pl), 718 GFP_KERNEL); 719 if (!skb) 720 return -ENOBUFS; 721 722 skb->dev = sdata->dev; 723 724 ret = ieee802154_mac_cmd_push(skb, &frame, &frame.disassoc_pl, 725 sizeof(frame.disassoc_pl)); 726 if (ret) { 727 kfree_skb(skb); 728 return ret; 729 } 730 731 ret = ieee802154_mlme_tx_one_locked(local, sdata, skb); 732 if (ret) { 733 dev_warn(&sdata->dev->dev, 734 "No DISASSOC ACK received from %8phC\n", &teaddr); 735 if (ret > 0) 736 ret = (ret == IEEE802154_NO_ACK) ? -EREMOTEIO : -EIO; 737 return ret; 738 } 739 740 dev_dbg(&sdata->dev->dev, "DISASSOC ACK received from %8phC\n", &teaddr); 741 return 0; 742 } 743 744 static int 745 mac802154_send_association_resp_locked(struct ieee802154_sub_if_data *sdata, 746 struct ieee802154_pan_device *target, 747 struct ieee802154_assoc_resp_pl *assoc_resp_pl) 748 { 749 u64 teaddr = swab64((__force u64)target->extended_addr); 750 struct ieee802154_association_resp_frame frame = {}; 751 struct ieee802154_local *local = sdata->local; 752 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 753 struct sk_buff *skb; 754 int ret; 755 756 frame.mhr.fc.type = IEEE802154_FC_TYPE_MAC_CMD; 757 frame.mhr.fc.security_enabled = 0; 758 frame.mhr.fc.frame_pending = 0; 759 frame.mhr.fc.ack_request = 1; /* We always expect an ack here */ 760 frame.mhr.fc.intra_pan = 1; 761 frame.mhr.fc.dest_addr_mode = IEEE802154_EXTENDED_ADDRESSING; 762 frame.mhr.fc.version = IEEE802154_2003_STD; 763 frame.mhr.fc.source_addr_mode = IEEE802154_EXTENDED_ADDRESSING; 764 frame.mhr.source.mode = IEEE802154_ADDR_LONG; 765 frame.mhr.source.extended_addr = wpan_dev->extended_addr; 766 frame.mhr.dest.mode = IEEE802154_ADDR_LONG; 767 frame.mhr.dest.pan_id = wpan_dev->pan_id; 768 frame.mhr.dest.extended_addr = target->extended_addr; 769 frame.mhr.seq = atomic_inc_return(&wpan_dev->dsn) & 0xFF; 770 frame.mac_pl.cmd_id = IEEE802154_CMD_ASSOCIATION_RESP; 771 772 skb = alloc_skb(IEEE802154_MAC_CMD_SKB_SZ + sizeof(*assoc_resp_pl), 773 GFP_KERNEL); 774 if (!skb) 775 return -ENOBUFS; 776 777 skb->dev = sdata->dev; 778 779 ret = ieee802154_mac_cmd_push(skb, &frame, assoc_resp_pl, 780 sizeof(*assoc_resp_pl)); 781 if (ret) { 782 kfree_skb(skb); 783 return ret; 784 } 785 786 ret = ieee802154_mlme_tx_locked(local, sdata, skb); 787 if (ret) { 788 dev_warn(&sdata->dev->dev, 789 "No ASSOC RESP ACK received from %8phC\n", &teaddr); 790 if (ret > 0) 791 ret = (ret == IEEE802154_NO_ACK) ? -EREMOTEIO : -EIO; 792 return ret; 793 } 794 795 return 0; 796 } 797 798 int mac802154_process_association_req(struct ieee802154_sub_if_data *sdata, 799 struct sk_buff *skb) 800 { 801 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 802 struct ieee802154_addr *src = &mac_cb(skb)->source; 803 struct ieee802154_addr *dest = &mac_cb(skb)->dest; 804 struct ieee802154_assoc_resp_pl assoc_resp_pl = {}; 805 struct ieee802154_assoc_req_pl assoc_req_pl; 806 struct ieee802154_pan_device *child, *exchild; 807 struct ieee802154_addr tmp = {}; 808 u64 ceaddr; 809 int ret; 810 811 if (skb->len != sizeof(assoc_req_pl)) 812 return -EINVAL; 813 814 if (unlikely(src->mode != IEEE802154_EXTENDED_ADDRESSING)) 815 return -EINVAL; 816 817 if (unlikely(dest->pan_id != wpan_dev->pan_id)) 818 return -ENODEV; 819 820 if (dest->mode == IEEE802154_EXTENDED_ADDRESSING && 821 unlikely(dest->extended_addr != wpan_dev->extended_addr)) 822 return -ENODEV; 823 else if (dest->mode == IEEE802154_SHORT_ADDRESSING && 824 unlikely(dest->short_addr != wpan_dev->short_addr)) 825 return -ENODEV; 826 827 if (wpan_dev->parent) { 828 dev_dbg(&sdata->dev->dev, 829 "Ignoring ASSOC REQ, not the PAN coordinator\n"); 830 return -ENODEV; 831 } 832 833 mutex_lock(&wpan_dev->association_lock); 834 835 memcpy(&assoc_req_pl, skb->data, sizeof(assoc_req_pl)); 836 if (assoc_req_pl.assoc_type) { 837 dev_err(&skb->dev->dev, "Fast associations not supported yet\n"); 838 ret = -EOPNOTSUPP; 839 goto unlock; 840 } 841 842 child = kzalloc_obj(*child); 843 if (!child) { 844 ret = -ENOMEM; 845 goto unlock; 846 } 847 848 child->extended_addr = src->extended_addr; 849 child->mode = IEEE802154_EXTENDED_ADDRESSING; 850 ceaddr = swab64((__force u64)child->extended_addr); 851 852 if (wpan_dev->nchildren >= wpan_dev->max_associations) { 853 if (!wpan_dev->max_associations) 854 assoc_resp_pl.status = IEEE802154_PAN_ACCESS_DENIED; 855 else 856 assoc_resp_pl.status = IEEE802154_PAN_AT_CAPACITY; 857 assoc_resp_pl.short_addr = cpu_to_le16(IEEE802154_ADDR_SHORT_BROADCAST); 858 dev_dbg(&sdata->dev->dev, 859 "Refusing ASSOC REQ from child %8phC, %s\n", &ceaddr, 860 assoc_resp_pl.status == IEEE802154_PAN_ACCESS_DENIED ? 861 "access denied" : "too many children"); 862 } else { 863 assoc_resp_pl.status = IEEE802154_ASSOCIATION_SUCCESSFUL; 864 if (assoc_req_pl.alloc_addr) { 865 assoc_resp_pl.short_addr = cfg802154_get_free_short_addr(wpan_dev); 866 child->mode = IEEE802154_SHORT_ADDRESSING; 867 } else { 868 assoc_resp_pl.short_addr = cpu_to_le16(IEEE802154_ADDR_SHORT_UNSPEC); 869 } 870 child->short_addr = assoc_resp_pl.short_addr; 871 dev_dbg(&sdata->dev->dev, 872 "Accepting ASSOC REQ from child %8phC, providing short address 0x%04x\n", 873 &ceaddr, le16_to_cpu(child->short_addr)); 874 } 875 876 ret = mac802154_send_association_resp_locked(sdata, child, &assoc_resp_pl); 877 if (ret || assoc_resp_pl.status != IEEE802154_ASSOCIATION_SUCCESSFUL) { 878 kfree(child); 879 goto unlock; 880 } 881 882 dev_dbg(&sdata->dev->dev, 883 "Successful association with new child %8phC\n", &ceaddr); 884 885 /* Ensure this child is not already associated (might happen due to 886 * retransmissions), in this case drop the ex structure. 887 */ 888 tmp.mode = child->mode; 889 tmp.extended_addr = child->extended_addr; 890 exchild = cfg802154_device_is_child(wpan_dev, &tmp); 891 if (exchild) { 892 dev_dbg(&sdata->dev->dev, 893 "Child %8phC was already known\n", &ceaddr); 894 list_del(&exchild->node); 895 } 896 897 list_add(&child->node, &wpan_dev->children); 898 wpan_dev->nchildren++; 899 900 unlock: 901 mutex_unlock(&wpan_dev->association_lock); 902 return ret; 903 } 904 905 int mac802154_process_disassociation_notif(struct ieee802154_sub_if_data *sdata, 906 struct sk_buff *skb) 907 { 908 struct ieee802154_addr *src = &mac_cb(skb)->source; 909 struct ieee802154_addr *dest = &mac_cb(skb)->dest; 910 struct wpan_dev *wpan_dev = &sdata->wpan_dev; 911 struct ieee802154_pan_device *child; 912 struct ieee802154_addr target; 913 bool parent; 914 u64 teaddr; 915 916 if (skb->len != sizeof(u8)) 917 return -EINVAL; 918 919 if (unlikely(src->mode != IEEE802154_EXTENDED_ADDRESSING)) 920 return -EINVAL; 921 922 if (dest->mode == IEEE802154_EXTENDED_ADDRESSING && 923 unlikely(dest->extended_addr != wpan_dev->extended_addr)) 924 return -ENODEV; 925 else if (dest->mode == IEEE802154_SHORT_ADDRESSING && 926 unlikely(dest->short_addr != wpan_dev->short_addr)) 927 return -ENODEV; 928 929 if (dest->pan_id != wpan_dev->pan_id) 930 return -ENODEV; 931 932 target.mode = IEEE802154_EXTENDED_ADDRESSING; 933 target.extended_addr = src->extended_addr; 934 teaddr = swab64((__force u64)target.extended_addr); 935 dev_dbg(&skb->dev->dev, "Processing DISASSOC NOTIF from %8phC\n", &teaddr); 936 937 mutex_lock(&wpan_dev->association_lock); 938 parent = cfg802154_device_is_parent(wpan_dev, &target); 939 if (!parent) 940 child = cfg802154_device_is_child(wpan_dev, &target); 941 if (!parent && !child) { 942 mutex_unlock(&wpan_dev->association_lock); 943 return -EINVAL; 944 } 945 946 if (parent) { 947 kfree(wpan_dev->parent); 948 wpan_dev->parent = NULL; 949 } else { 950 list_del(&child->node); 951 kfree(child); 952 wpan_dev->nchildren--; 953 } 954 955 mutex_unlock(&wpan_dev->association_lock); 956 957 return 0; 958 } 959