tx.c 87.5 KB
Newer Older
1 2 3 4 5
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
6
 * Copyright 2013-2014  Intel Mobile Communications GmbH
7 8 9 10 11 12 13 14 15 16 17 18 19 20
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 *
 * Transmit and frame generation functions.
 */

#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/skbuff.h>
#include <linux/etherdevice.h>
#include <linux/bitmap.h>
21
#include <linux/rcupdate.h>
22
#include <linux/export.h>
23
#include <linux/time.h>
24
#include <net/net_namespace.h>
25 26 27 28 29 30
#include <net/ieee80211_radiotap.h>
#include <net/cfg80211.h>
#include <net/mac80211.h>
#include <asm/unaligned.h>

#include "ieee80211_i.h"
31
#include "driver-ops.h"
J
Johannes Berg 已提交
32
#include "led.h"
33
#include "mesh.h"
34 35 36
#include "wep.h"
#include "wpa.h"
#include "wme.h"
J
Johannes Berg 已提交
37
#include "rate.h"
38 39 40

/* misc utils */

41 42
static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
				 struct sk_buff *skb, int group_addr,
J
Johannes Berg 已提交
43
				 int next_frag_len)
44
{
45
	int rate, mrate, erp, dur, i, shift = 0;
46
	struct ieee80211_rate *txrate;
47
	struct ieee80211_local *local = tx->local;
48
	struct ieee80211_supported_band *sband;
49
	struct ieee80211_hdr *hdr;
50
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
51 52 53 54 55 56 57 58 59 60
	struct ieee80211_chanctx_conf *chanctx_conf;
	u32 rate_flags = 0;

	rcu_read_lock();
	chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
	if (chanctx_conf) {
		shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
		rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
	}
	rcu_read_unlock();
61 62

	/* assume HW handles this */
63
	if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
64 65 66
		return 0;

	/* uh huh? */
67
	if (WARN_ON_ONCE(tx->rate.idx < 0))
68
		return 0;
69

70
	sband = local->hw.wiphy->bands[info->band];
71
	txrate = &sband->bitrates[tx->rate.idx];
72

73
	erp = txrate->flags & IEEE80211_RATE_ERP_G;
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91

	/*
	 * data and mgmt (except PS Poll):
	 * - during CFP: 32768
	 * - during contention period:
	 *   if addr1 is group address: 0
	 *   if more fragments = 0 and addr1 is individual address: time to
	 *      transmit one ACK plus SIFS
	 *   if more fragments = 1 and addr1 is individual address: time to
	 *      transmit next fragment plus 2 x ACK plus 3 x SIFS
	 *
	 * IEEE 802.11, 9.6:
	 * - control response frame (CTS or ACK) shall be transmitted using the
	 *   same rate as the immediately previous frame in the frame exchange
	 *   sequence, if this rate belongs to the PHY mandatory rates, or else
	 *   at the highest possible rate belonging to the PHY rates in the
	 *   BSSBasicRateSet
	 */
92
	hdr = (struct ieee80211_hdr *)skb->data;
93
	if (ieee80211_is_ctl(hdr->frame_control)) {
94
		/* TODO: These control frames are not currently sent by
J
Johannes Berg 已提交
95
		 * mac80211, but should they be implemented, this function
96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112
		 * needs to be updated to support duration field calculation.
		 *
		 * RTS: time needed to transmit pending data/mgmt frame plus
		 *    one CTS frame plus one ACK frame plus 3 x SIFS
		 * CTS: duration of immediately previous RTS minus time
		 *    required to transmit CTS and its SIFS
		 * ACK: 0 if immediately previous directed data/mgmt had
		 *    more=0, with more=1 duration in ACK frame is duration
		 *    from previous frame minus time needed to transmit ACK
		 *    and its SIFS
		 * PS Poll: BIT(15) | BIT(14) | aid
		 */
		return 0;
	}

	/* data/mgmt */
	if (0 /* FIX: data/mgmt during CFP */)
J
Johannes Berg 已提交
113
		return cpu_to_le16(32768);
114 115 116 117 118 119 120 121 122 123 124 125 126 127 128

	if (group_addr) /* Group address as the destination - no ACK */
		return 0;

	/* Individual destination address:
	 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
	 * CTS and ACK frames shall be transmitted using the highest rate in
	 * basic rate set that is less than or equal to the rate of the
	 * immediately previous frame and that is using the same modulation
	 * (CCK or OFDM). If no basic rate set matches with these requirements,
	 * the highest mandatory rate of the PHY that is less than or equal to
	 * the rate of the previous frame is used.
	 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
	 */
	rate = -1;
129 130 131 132
	/* use lowest available if everything fails */
	mrate = sband->bitrates[0].bitrate;
	for (i = 0; i < sband->n_bitrates; i++) {
		struct ieee80211_rate *r = &sband->bitrates[i];
133

134 135
		if (r->bitrate > txrate->bitrate)
			break;
136

137 138 139
		if ((rate_flags & r->flags) != rate_flags)
			continue;

J
Johannes Berg 已提交
140
		if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
141
			rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157

		switch (sband->band) {
		case IEEE80211_BAND_2GHZ: {
			u32 flag;
			if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
				flag = IEEE80211_RATE_MANDATORY_G;
			else
				flag = IEEE80211_RATE_MANDATORY_B;
			if (r->flags & flag)
				mrate = r->bitrate;
			break;
		}
		case IEEE80211_BAND_5GHZ:
			if (r->flags & IEEE80211_RATE_MANDATORY_A)
				mrate = r->bitrate;
			break;
158 159
		case IEEE80211_BAND_60GHZ:
			/* TODO, for now fall through */
160 161 162 163
		case IEEE80211_NUM_BANDS:
			WARN_ON(1);
			break;
		}
164 165 166 167
	}
	if (rate == -1) {
		/* No matching basic rate found; use highest suitable mandatory
		 * PHY rate */
168
		rate = DIV_ROUND_UP(mrate, 1 << shift);
169 170
	}

171 172
	/* Don't calculate ACKs for QoS Frames with NoAck Policy set */
	if (ieee80211_is_data_qos(hdr->frame_control) &&
173
	    *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
174 175 176 177 178
		dur = 0;
	else
		/* Time needed to transmit ACK
		 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
		 * to closest integer */
179
		dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
180 181
				tx->sdata->vif.bss_conf.use_short_preamble,
				shift);
182 183 184 185 186 187

	if (next_frag_len) {
		/* Frame is fragmented: duration increases with time needed to
		 * transmit next fragment plus ACK and 2 x SIFS. */
		dur *= 2; /* ACK + SIFS */
		/* next fragment */
188
		dur += ieee80211_frame_duration(sband->band, next_frag_len,
189
				txrate->bitrate, erp,
190 191
				tx->sdata->vif.bss_conf.use_short_preamble,
				shift);
192 193
	}

J
Johannes Berg 已提交
194
	return cpu_to_le16(dur);
195 196 197
}

/* tx handlers */
198 199 200 201
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
{
	struct ieee80211_local *local = tx->local;
202
	struct ieee80211_if_managed *ifmgd;
203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226

	/* driver doesn't support power save */
	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
		return TX_CONTINUE;

	/* hardware does dynamic power save */
	if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
		return TX_CONTINUE;

	/* dynamic power save disabled */
	if (local->hw.conf.dynamic_ps_timeout <= 0)
		return TX_CONTINUE;

	/* we are scanning, don't enable power save */
	if (local->scanning)
		return TX_CONTINUE;

	if (!local->ps_sdata)
		return TX_CONTINUE;

	/* No point if we're going to suspend */
	if (local->quiescing)
		return TX_CONTINUE;

227 228 229 230 231 232 233 234 235 236 237 238 239 240 241
	/* dynamic ps is supported only in managed mode */
	if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
		return TX_CONTINUE;

	ifmgd = &tx->sdata->u.mgd;

	/*
	 * Don't wakeup from power save if u-apsd is enabled, voip ac has
	 * u-apsd enabled and the frame is in voip class. This effectively
	 * means that even if all access categories have u-apsd enabled, in
	 * practise u-apsd is only used with the voip ac. This is a
	 * workaround for the case when received voip class packets do not
	 * have correct qos tag for some reason, due the network or the
	 * peer application.
	 *
242
	 * Note: ifmgd->uapsd_queues access is racy here. If the value is
243 244 245
	 * changed via debugfs, user needs to reassociate manually to have
	 * everything in sync.
	 */
J
Johannes Berg 已提交
246 247 248
	if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
	    (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
	    skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
249 250
		return TX_CONTINUE;

251 252
	if (local->hw.conf.flags & IEEE80211_CONF_PS) {
		ieee80211_stop_queues_by_reason(&local->hw,
253
						IEEE80211_MAX_QUEUE_MAP,
254 255
						IEEE80211_QUEUE_STOP_REASON_PS,
						false);
256
		ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
257 258 259 260
		ieee80211_queue_work(&local->hw,
				     &local->dynamic_ps_disable_work);
	}

261 262 263 264
	/* Don't restart the timer if we're not disassociated */
	if (!ifmgd->associated)
		return TX_CONTINUE;

265 266 267 268 269
	mod_timer(&local->dynamic_ps_timer, jiffies +
		  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));

	return TX_CONTINUE;
}
270

271
static ieee80211_tx_result debug_noinline
272
ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
273
{
274

275 276
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
J
Johannes Berg 已提交
277
	bool assoc = false;
278

279
	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
280
		return TX_CONTINUE;
281

282 283
	if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
	    test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
284 285 286 287 288 289 290 291 292 293 294 295 296
	    !ieee80211_is_probe_req(hdr->frame_control) &&
	    !ieee80211_is_nullfunc(hdr->frame_control))
		/*
		 * When software scanning only nullfunc frames (to notify
		 * the sleep state to the AP) and probe requests (for the
		 * active scan) are allowed, all other frames should not be
		 * sent and we should not get here, but if we do
		 * nonetheless, drop them to avoid sending them
		 * off-channel. See the link below and
		 * ieee80211_start_scan() for more.
		 *
		 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
		 */
297
		return TX_DROP;
298

299 300 301
	if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
		return TX_CONTINUE;

B
Bill Jordan 已提交
302 303 304
	if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
		return TX_CONTINUE;

305
	if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
306 307
		return TX_CONTINUE;

308
	if (tx->flags & IEEE80211_TX_PS_BUFFERED)
309
		return TX_CONTINUE;
310

J
Johannes Berg 已提交
311 312
	if (tx->sta)
		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
313

314
	if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
J
Johannes Berg 已提交
315
		if (unlikely(!assoc &&
316
			     ieee80211_is_data(hdr->frame_control))) {
317
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
J
Johannes Berg 已提交
318 319 320 321
			sdata_info(tx->sdata,
				   "dropped data frame to not associated station %pM\n",
				   hdr->addr1);
#endif
322
			I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
323
			return TX_DROP;
324
		}
325 326
	} else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
			    ieee80211_is_data(hdr->frame_control) &&
327
			    !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) {
328 329 330 331 332
		/*
		 * No associated STAs - no need to send multicast
		 * frames.
		 */
		return TX_DROP;
333 334
	}

335
	return TX_CONTINUE;
336 337 338 339 340 341 342 343 344 345 346 347 348
}

/* This function is called whenever the AP is about to exceed the maximum limit
 * of buffered frames for power saving STAs. This situation should not really
 * happen often during normal operation, so dropping the oldest buffered packet
 * from each queue should be OK to make some room for new frames. */
static void purge_old_ps_buffers(struct ieee80211_local *local)
{
	int total = 0, purged = 0;
	struct sk_buff *skb;
	struct ieee80211_sub_if_data *sdata;
	struct sta_info *sta;

349
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
350 351 352 353
		struct ps_data *ps;

		if (sdata->vif.type == NL80211_IFTYPE_AP)
			ps = &sdata->u.ap.ps;
M
Marco Porsch 已提交
354 355
		else if (ieee80211_vif_is_mesh(&sdata->vif))
			ps = &sdata->u.mesh.ps;
356
		else
357
			continue;
358 359

		skb = skb_dequeue(&ps->bc_buf);
360 361 362 363
		if (skb) {
			purged++;
			dev_kfree_skb(skb);
		}
364
		total += skb_queue_len(&ps->bc_buf);
365 366
	}

367 368 369 370
	/*
	 * Drop one frame from each station from the lowest-priority
	 * AC that has frames at all.
	 */
371
	list_for_each_entry_rcu(sta, &local->sta_list, list) {
372 373 374 375 376 377 378
		int ac;

		for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
			skb = skb_dequeue(&sta->ps_tx_buf[ac]);
			total += skb_queue_len(&sta->ps_tx_buf[ac]);
			if (skb) {
				purged++;
379
				ieee80211_free_txskb(&local->hw, skb);
380 381
				break;
			}
382 383
		}
	}
384

385
	local->total_ps_buffered = total;
J
Johannes Berg 已提交
386
	ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
387 388
}

389
static ieee80211_tx_result
390
ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
391
{
392
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
393
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
394
	struct ps_data *ps;
395

396 397 398
	/*
	 * broadcast/multicast frame
	 *
M
Marco Porsch 已提交
399
	 * If any of the associated/peer stations is in power save mode,
400 401 402 403
	 * the frame is buffered to be sent after DTIM beacon frame.
	 * This is done either by the hardware or us.
	 */

M
Marco Porsch 已提交
404
	/* powersaving STAs currently only in AP/VLAN/mesh mode */
405 406 407 408 409 410
	if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
	    tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
		if (!tx->sdata->bss)
			return TX_CONTINUE;

		ps = &tx->sdata->bss->ps;
M
Marco Porsch 已提交
411 412
	} else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
		ps = &tx->sdata->u.mesh.ps;
413
	} else {
414
		return TX_CONTINUE;
415 416
	}

417 418

	/* no buffering for ordered frames */
419
	if (ieee80211_has_order(hdr->frame_control))
420
		return TX_CONTINUE;
421

422 423 424
	if (ieee80211_is_probe_req(hdr->frame_control))
		return TX_CONTINUE;

425 426 427
	if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
		info->hw_queue = tx->sdata->vif.cab_queue;

428
	/* no stations in PS mode */
429
	if (!atomic_read(&ps->num_sta_ps))
430
		return TX_CONTINUE;
431

432
	info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
J
Johannes Berg 已提交
433

434 435
	/* device releases frame after DTIM beacon */
	if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
J
Johannes Berg 已提交
436 437
		return TX_CONTINUE;

438
	/* buffered in mac80211 */
J
Johannes Berg 已提交
439 440 441
	if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
		purge_old_ps_buffers(tx->local);

442
	if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
J
Johannes Berg 已提交
443 444
		ps_dbg(tx->sdata,
		       "BC TX buffer full - dropping the oldest frame\n");
445
		dev_kfree_skb(skb_dequeue(&ps->bc_buf));
J
Johannes Berg 已提交
446 447
	} else
		tx->local->total_ps_buffered++;
448

449
	skb_queue_tail(&ps->bc_buf, tx->skb);
450

J
Johannes Berg 已提交
451
	return TX_QUEUED;
452 453
}

454 455 456 457 458 459
static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
			     struct sk_buff *skb)
{
	if (!ieee80211_is_mgmt(fc))
		return 0;

J
Johannes Berg 已提交
460
	if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
461 462
		return 0;

463
	if (!ieee80211_is_robust_mgmt_frame(skb))
464 465 466 467 468
		return 0;

	return 1;
}

469
static ieee80211_tx_result
470
ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
471 472
{
	struct sta_info *sta = tx->sta;
473
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
474
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
475
	struct ieee80211_local *local = tx->local;
476

477
	if (unlikely(!sta))
478
		return TX_CONTINUE;
479

J
Johannes Berg 已提交
480
	if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
481 482
		      test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
		      test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
483
		     !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
484 485
		int ac = skb_get_queue_mapping(tx->skb);

486 487 488 489 490 491
		if (ieee80211_is_mgmt(hdr->frame_control) &&
		    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
			info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
			return TX_CONTINUE;
		}

J
Johannes Berg 已提交
492 493
		ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
		       sta->sta.addr, sta->sta.aid, ac);
494 495
		if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
			purge_old_ps_buffers(tx->local);
496 497 498 499 500 501 502 503 504

		/* sync with ieee80211_sta_ps_deliver_wakeup */
		spin_lock(&sta->ps_lock);
		/*
		 * STA woke up the meantime and all the frames on ps_tx_buf have
		 * been queued to pending queue. No reordering can happen, go
		 * ahead and Tx the packet.
		 */
		if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
505 506
		    !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
		    !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
507 508 509 510
			spin_unlock(&sta->ps_lock);
			return TX_CONTINUE;
		}

511 512
		if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
			struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
J
Johannes Berg 已提交
513 514 515
			ps_dbg(tx->sdata,
			       "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
			       sta->sta.addr, ac);
516
			ieee80211_free_txskb(&local->hw, old);
517 518
		} else
			tx->local->total_ps_buffered++;
519

520
		info->control.jiffies = jiffies;
521
		info->control.vif = &tx->sdata->vif;
522
		info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
523
		info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
524
		skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
525
		spin_unlock(&sta->ps_lock);
526 527 528 529 530 531

		if (!timer_pending(&local->sta_cleanup))
			mod_timer(&local->sta_cleanup,
				  round_jiffies(jiffies +
						STA_INFO_CLEANUP_INTERVAL));

J
Johannes Berg 已提交
532 533 534 535 536 537
		/*
		 * We queued up some frames, so the TIM bit might
		 * need to be set, recalculate it.
		 */
		sta_info_recalc_tim(sta);

538
		return TX_QUEUED;
J
Johannes Berg 已提交
539 540 541 542
	} else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
		ps_dbg(tx->sdata,
		       "STA %pM in PS mode, but polling/in SP -> send frame\n",
		       sta->sta.addr);
543 544
	}

545
	return TX_CONTINUE;
546 547
}

548
static ieee80211_tx_result debug_noinline
549
ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
550
{
551
	if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
552
		return TX_CONTINUE;
553

554
	if (tx->flags & IEEE80211_TX_UNICAST)
555 556 557 558 559
		return ieee80211_tx_h_unicast_ps_buf(tx);
	else
		return ieee80211_tx_h_multicast_ps_buf(tx);
}

560 561 562 563 564
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
{
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

565 566 567 568 569
	if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
		if (tx->sdata->control_port_no_encrypt)
			info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
		info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
	}
570 571 572 573

	return TX_CONTINUE;
}

574
static ieee80211_tx_result debug_noinline
575
ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
576
{
577
	struct ieee80211_key *key;
578
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
579
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
580

J
Johannes Berg 已提交
581
	if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
582
		tx->key = NULL;
583 584
	else if (tx->sta &&
		 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
585
		tx->key = key;
586
	else if (ieee80211_is_mgmt(hdr->frame_control) &&
587
		 is_multicast_ether_addr(hdr->addr1) &&
588
		 ieee80211_is_robust_mgmt_frame(tx->skb) &&
589 590
		 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
		tx->key = key;
591 592 593 594 595
	else if (is_multicast_ether_addr(hdr->addr1) &&
		 (key = rcu_dereference(tx->sdata->default_multicast_key)))
		tx->key = key;
	else if (!is_multicast_ether_addr(hdr->addr1) &&
		 (key = rcu_dereference(tx->sdata->default_unicast_key)))
596
		tx->key = key;
597 598 599 600 601 602
	else if (info->flags & IEEE80211_TX_CTL_INJECTED)
		tx->key = NULL;
	else if (!tx->sdata->drop_unencrypted)
		tx->key = NULL;
	else if (tx->skb->protocol == tx->sdata->control_port_protocol)
		tx->key = NULL;
603
	else if (ieee80211_is_robust_mgmt_frame(tx->skb) &&
604 605 606
		 !(ieee80211_is_action(hdr->frame_control) &&
		   tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))
		tx->key = NULL;
607
	else if (ieee80211_is_mgmt(hdr->frame_control) &&
608
		 !ieee80211_is_robust_mgmt_frame(tx->skb))
609
		tx->key = NULL;
610
	else {
611
		I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
612
		return TX_DROP;
613
	}
614 615

	if (tx->key) {
616 617
		bool skip_hw = false;

618
		tx->key->tx_rx_count++;
619
		/* TODO: add threshold stuff again */
620

621 622 623 624
		switch (tx->key->conf.cipher) {
		case WLAN_CIPHER_SUITE_WEP40:
		case WLAN_CIPHER_SUITE_WEP104:
		case WLAN_CIPHER_SUITE_TKIP:
625
			if (!ieee80211_is_data_present(hdr->frame_control))
626 627
				tx->key = NULL;
			break;
628
		case WLAN_CIPHER_SUITE_CCMP:
J
Jouni Malinen 已提交
629
		case WLAN_CIPHER_SUITE_CCMP_256:
630 631
		case WLAN_CIPHER_SUITE_GCMP:
		case WLAN_CIPHER_SUITE_GCMP_256:
632 633 634 635
			if (!ieee80211_is_data_present(hdr->frame_control) &&
			    !ieee80211_use_mfp(hdr->frame_control, tx->sta,
					       tx->skb))
				tx->key = NULL;
636 637
			else
				skip_hw = (tx->key->conf.flags &
638
					   IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
639
					ieee80211_is_mgmt(hdr->frame_control);
640
			break;
641
		case WLAN_CIPHER_SUITE_AES_CMAC:
642 643 644
			if (!ieee80211_is_mgmt(hdr->frame_control))
				tx->key = NULL;
			break;
645
		}
646

647 648
		if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
			     !ieee80211_is_deauth(hdr->frame_control)))
649 650
			return TX_DROP;

J
Johannes Berg 已提交
651
		if (!skip_hw && tx->key &&
J
Johannes Berg 已提交
652
		    tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
653
			info->control.hw_key = &tx->key->conf;
654 655
	}

656
	return TX_CONTINUE;
657 658
}

659
static ieee80211_tx_result debug_noinline
660
ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
661
{
662
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
663 664
	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
	struct ieee80211_supported_band *sband;
S
Shanyu Zhao 已提交
665
	u32 len;
666
	struct ieee80211_tx_rate_control txrc;
667
	struct ieee80211_sta_rates *ratetbl = NULL;
J
Johannes Berg 已提交
668
	bool assoc = false;
669

670
	memset(&txrc, 0, sizeof(txrc));
671

672
	sband = tx->local->hw.wiphy->bands[info->band];
673

S
Shanyu Zhao 已提交
674
	len = min_t(u32, tx->skb->len + FCS_LEN,
675
			 tx->local->hw.wiphy->frag_threshold);
676 677

	/* set up the tx rate control struct we give the RC algo */
J
Johannes Berg 已提交
678
	txrc.hw = &tx->local->hw;
679 680 681 682
	txrc.sband = sband;
	txrc.bss_conf = &tx->sdata->vif.bss_conf;
	txrc.skb = tx->skb;
	txrc.reported_rate.idx = -1;
683
	txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
684 685 686 687
	if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
		txrc.max_rate_idx = -1;
	else
		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
688 689 690 691 692

	if (tx->sdata->rc_has_mcs_mask[info->band])
		txrc.rate_idx_mcs_mask =
			tx->sdata->rc_rateidx_mcs_mask[info->band];

693
	txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
694
		    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
695
		    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
696 697

	/* set up RTS protection if desired */
698
	if (len > tx->local->hw.wiphy->rts_threshold) {
699
		txrc.rts = true;
700 701
	}

702
	info->control.use_rts = txrc.rts;
703 704
	info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;

705 706 707 708 709 710 711 712
	/*
	 * Use short preamble if the BSS can handle it, but not for
	 * management frames unless we know the receiver can handle
	 * that -- the management frame might be to a station that
	 * just wants a probe response.
	 */
	if (tx->sdata->vif.bss_conf.use_short_preamble &&
	    (ieee80211_is_data(hdr->frame_control) ||
J
Johannes Berg 已提交
713
	     (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
714 715 716
		txrc.short_preamble = true;

	info->control.short_preamble = txrc.short_preamble;
717

J
Johannes Berg 已提交
718 719
	if (tx->sta)
		assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
720 721 722 723 724

	/*
	 * Lets not bother rate control if we're associated and cannot
	 * talk to the sta. This should not happen.
	 */
J
Johannes Berg 已提交
725
	if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
726 727 728 729
		 !rate_usable_index_exists(sband, &tx->sta->sta),
		 "%s: Dropped data frame as no usable bitrate found while "
		 "scanning and associated. Target station: "
		 "%pM on %d GHz band\n",
730
		 tx->sdata->name, hdr->addr1,
731
		 info->band ? 5 : 2))
732
		return TX_DROP;
733

734 735 736 737
	/*
	 * If we're associated with the sta at this point we know we can at
	 * least send the frame at the lowest bit rate.
	 */
738 739
	rate_control_get_rate(tx->sdata, tx->sta, &txrc);

740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760
	if (tx->sta && !info->control.skip_table)
		ratetbl = rcu_dereference(tx->sta->sta.rates);

	if (unlikely(info->control.rates[0].idx < 0)) {
		if (ratetbl) {
			struct ieee80211_tx_rate rate = {
				.idx = ratetbl->rate[0].idx,
				.flags = ratetbl->rate[0].flags,
				.count = ratetbl->rate[0].count
			};

			if (ratetbl->rate[0].idx < 0)
				return TX_DROP;

			tx->rate = rate;
		} else {
			return TX_DROP;
		}
	} else {
		tx->rate = info->control.rates[0];
	}
761

762
	if (txrc.reported_rate.idx < 0) {
763
		txrc.reported_rate = tx->rate;
764 765 766
		if (tx->sta && ieee80211_is_data(hdr->frame_control))
			tx->sta->last_tx_rate = txrc.reported_rate;
	} else if (tx->sta)
767
		tx->sta->last_tx_rate = txrc.reported_rate;
768

769 770 771
	if (ratetbl)
		return TX_CONTINUE;

772 773
	if (unlikely(!info->control.rates[0].count))
		info->control.rates[0].count = 1;
774

775 776 777 778
	if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
			 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
		info->control.rates[0].count = 1;

779 780 781
	return TX_CONTINUE;
}

782 783 784 785 786 787 788 789 790
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
{
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
	u16 *seq;
	u8 *qc;
	int tid;

791 792 793 794 795
	/*
	 * Packet injection may want to control the sequence
	 * number, if we have no matching interface then we
	 * neither assign one ourselves nor ask the driver to.
	 */
796
	if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
797 798
		return TX_CONTINUE;

799 800 801 802 803 804
	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
		return TX_CONTINUE;

	if (ieee80211_hdrlen(hdr->frame_control) < 24)
		return TX_CONTINUE;

805 806 807
	if (ieee80211_is_qos_nullfunc(hdr->frame_control))
		return TX_CONTINUE;

J
Johannes Berg 已提交
808 809 810
	/*
	 * Anything but QoS data that has a sequence number field
	 * (is long enough) gets a sequence number from the global
811 812
	 * counter.  QoS data frames with a multicast destination
	 * also use the global counter (802.11-2012 9.3.2.10).
J
Johannes Berg 已提交
813
	 */
814 815
	if (!ieee80211_is_data_qos(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1)) {
J
Johannes Berg 已提交
816
		/* driver should assign sequence number */
817
		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
J
Johannes Berg 已提交
818 819 820
		/* for pure STA mode without beacons, we can do it */
		hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
		tx->sdata->sequence_number += 0x10;
821 822
		if (tx->sta)
			tx->sta->tx_msdu[IEEE80211_NUM_TIDS]++;
823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838
		return TX_CONTINUE;
	}

	/*
	 * This should be true for injected/management frames only, for
	 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
	 * above since they are not QoS-data frames.
	 */
	if (!tx->sta)
		return TX_CONTINUE;

	/* include per-STA, per-TID sequence counter */

	qc = ieee80211_get_qos_ctl(hdr);
	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
	seq = &tx->sta->tid_seq[tid];
839
	tx->sta->tx_msdu[tid]++;
840 841 842 843 844 845 846 847 848

	hdr->seq_ctrl = cpu_to_le16(*seq);

	/* Increase the sequence number. */
	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;

	return TX_CONTINUE;
}

849
static int ieee80211_fragment(struct ieee80211_tx_data *tx,
J
Johannes Berg 已提交
850 851 852
			      struct sk_buff *skb, int hdrlen,
			      int frag_threshold)
{
853
	struct ieee80211_local *local = tx->local;
854
	struct ieee80211_tx_info *info;
855
	struct sk_buff *tmp;
J
Johannes Berg 已提交
856 857 858 859 860 861 862
	int per_fragm = frag_threshold - hdrlen - FCS_LEN;
	int pos = hdrlen + per_fragm;
	int rem = skb->len - hdrlen - per_fragm;

	if (WARN_ON(rem < 0))
		return -EINVAL;

863 864
	/* first fragment was already added to queue by caller */

J
Johannes Berg 已提交
865 866 867 868 869 870 871 872
	while (rem) {
		int fraglen = per_fragm;

		if (fraglen > rem)
			fraglen = rem;
		rem -= fraglen;
		tmp = dev_alloc_skb(local->tx_headroom +
				    frag_threshold +
873
				    tx->sdata->encrypt_headroom +
J
Johannes Berg 已提交
874 875 876
				    IEEE80211_ENCRYPT_TAILROOM);
		if (!tmp)
			return -ENOMEM;
877 878 879

		__skb_queue_tail(&tx->skbs, tmp);

880 881 882
		skb_reserve(tmp,
			    local->tx_headroom + tx->sdata->encrypt_headroom);

J
Johannes Berg 已提交
883 884
		/* copy control information */
		memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
885 886 887 888 889 890 891 892

		info = IEEE80211_SKB_CB(tmp);
		info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
				 IEEE80211_TX_CTL_FIRST_FRAGMENT);

		if (rem)
			info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;

J
Johannes Berg 已提交
893 894 895 896 897 898 899 900 901 902 903
		skb_copy_queue_mapping(tmp, skb);
		tmp->priority = skb->priority;
		tmp->dev = skb->dev;

		/* copy header and data */
		memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
		memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);

		pos += fraglen;
	}

904
	/* adjust first fragment's length */
905
	skb_trim(skb, hdrlen + per_fragm);
J
Johannes Berg 已提交
906 907 908
	return 0;
}

909
static ieee80211_tx_result debug_noinline
910 911
ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
{
J
Johannes Berg 已提交
912 913 914
	struct sk_buff *skb = tx->skb;
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
	struct ieee80211_hdr *hdr = (void *)skb->data;
915
	int frag_threshold = tx->local->hw.wiphy->frag_threshold;
J
Johannes Berg 已提交
916 917
	int hdrlen;
	int fragnum;
918

919 920 921 922
	/* no matter what happens, tx->skb moves to tx->skbs */
	__skb_queue_tail(&tx->skbs, skb);
	tx->skb = NULL;

923 924 925 926
	if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
		return TX_CONTINUE;

	if (tx->local->ops->set_frag_threshold)
927 928
		return TX_CONTINUE;

929 930
	/*
	 * Warn when submitting a fragmented A-MPDU frame and drop it.
J
Johannes Berg 已提交
931
	 * This scenario is handled in ieee80211_tx_prepare but extra
932
	 * caution taken here as fragmented ampdu may cause Tx stop.
933
	 */
S
Sujith 已提交
934
	if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
935 936
		return TX_DROP;

937
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
938

939
	/* internal error, why isn't DONTFRAG set? */
940
	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
J
Johannes Berg 已提交
941
		return TX_DROP;
942

J
Johannes Berg 已提交
943 944 945 946 947 948 949 950
	/*
	 * Now fragment the frame. This will allocate all the fragments and
	 * chain them (using skb as the first fragment) to skb->next.
	 * During transmission, we will remove the successfully transmitted
	 * fragments from this list. When the low-level driver rejects one
	 * of the fragments then we will simply pretend to accept the skb
	 * but store it away as pending.
	 */
951
	if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
J
Johannes Berg 已提交
952
		return TX_DROP;
953

J
Johannes Berg 已提交
954 955
	/* update duration/seq/flags of fragments */
	fragnum = 0;
956 957

	skb_queue_walk(&tx->skbs, skb) {
J
Johannes Berg 已提交
958
		const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
959

J
Johannes Berg 已提交
960 961
		hdr = (void *)skb->data;
		info = IEEE80211_SKB_CB(skb);
962

963
		if (!skb_queue_is_last(&tx->skbs, skb)) {
J
Johannes Berg 已提交
964
			hdr->frame_control |= morefrags;
965 966 967 968 969 970 971
			/*
			 * No multi-rate retries for fragmented frames, that
			 * would completely throw off the NAV at other STAs.
			 */
			info->control.rates[1].idx = -1;
			info->control.rates[2].idx = -1;
			info->control.rates[3].idx = -1;
972
			BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
973
			info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
J
Johannes Berg 已提交
974 975
		} else {
			hdr->frame_control &= ~morefrags;
976
		}
J
Johannes Berg 已提交
977 978
		hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
		fragnum++;
979
	}
980

981
	return TX_CONTINUE;
982 983
}

984 985 986
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
{
987
	struct sk_buff *skb;
988
	int ac = -1;
989 990 991 992

	if (!tx->sta)
		return TX_CONTINUE;

993
	skb_queue_walk(&tx->skbs, skb) {
994
		ac = skb_get_queue_mapping(skb);
995
		tx->sta->tx_fragments++;
996
		tx->sta->tx_bytes[ac] += skb->len;
997
	}
998 999
	if (ac >= 0)
		tx->sta->tx_packets[ac]++;
1000 1001 1002 1003

	return TX_CONTINUE;
}

1004
static ieee80211_tx_result debug_noinline
1005 1006 1007 1008 1009
ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
{
	if (!tx->key)
		return TX_CONTINUE;

1010 1011 1012
	switch (tx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
1013
		return ieee80211_crypto_wep_encrypt(tx);
1014
	case WLAN_CIPHER_SUITE_TKIP:
1015
		return ieee80211_crypto_tkip_encrypt(tx);
1016
	case WLAN_CIPHER_SUITE_CCMP:
J
Jouni Malinen 已提交
1017 1018 1019 1020 1021
		return ieee80211_crypto_ccmp_encrypt(
			tx, IEEE80211_CCMP_MIC_LEN);
	case WLAN_CIPHER_SUITE_CCMP_256:
		return ieee80211_crypto_ccmp_encrypt(
			tx, IEEE80211_CCMP_256_MIC_LEN);
1022
	case WLAN_CIPHER_SUITE_AES_CMAC:
1023
		return ieee80211_crypto_aes_cmac_encrypt(tx);
1024 1025 1026
	case WLAN_CIPHER_SUITE_GCMP:
	case WLAN_CIPHER_SUITE_GCMP_256:
		return ieee80211_crypto_gcmp_encrypt(tx);
1027
	default:
1028
		return ieee80211_crypto_hw_encrypt(tx);
1029 1030 1031 1032 1033
	}

	return TX_DROP;
}

1034
static ieee80211_tx_result debug_noinline
J
Johannes Berg 已提交
1035 1036
ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
{
1037
	struct sk_buff *skb;
J
Johannes Berg 已提交
1038 1039 1040
	struct ieee80211_hdr *hdr;
	int next_len;
	bool group_addr;
J
Johannes Berg 已提交
1041

1042
	skb_queue_walk(&tx->skbs, skb) {
J
Johannes Berg 已提交
1043
		hdr = (void *) skb->data;
1044 1045
		if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
			break; /* must not overwrite AID */
1046 1047 1048 1049 1050
		if (!skb_queue_is_last(&tx->skbs, skb)) {
			struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
			next_len = next->len;
		} else
			next_len = 0;
J
Johannes Berg 已提交
1051
		group_addr = is_multicast_ether_addr(hdr->addr1);
J
Johannes Berg 已提交
1052

J
Johannes Berg 已提交
1053
		hdr->duration_id =
1054 1055
			ieee80211_duration(tx, skb, group_addr, next_len);
	}
J
Johannes Berg 已提交
1056 1057 1058 1059

	return TX_CONTINUE;
}

1060 1061
/* actual transmit path */

1062 1063 1064 1065 1066 1067 1068
static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
				  struct sk_buff *skb,
				  struct ieee80211_tx_info *info,
				  struct tid_ampdu_tx *tid_tx,
				  int tid)
{
	bool queued = false;
1069
	bool reset_agg_timer = false;
1070
	struct sk_buff *purge_skb = NULL;
1071 1072 1073

	if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
		info->flags |= IEEE80211_TX_CTL_AMPDU;
1074
		reset_agg_timer = true;
1075 1076 1077 1078 1079
	} else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
		/*
		 * nothing -- this aggregation session is being started
		 * but that might still fail with the driver
		 */
1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099
	} else {
		spin_lock(&tx->sta->lock);
		/*
		 * Need to re-check now, because we may get here
		 *
		 *  1) in the window during which the setup is actually
		 *     already done, but not marked yet because not all
		 *     packets are spliced over to the driver pending
		 *     queue yet -- if this happened we acquire the lock
		 *     either before or after the splice happens, but
		 *     need to recheck which of these cases happened.
		 *
		 *  2) during session teardown, if the OPERATIONAL bit
		 *     was cleared due to the teardown but the pointer
		 *     hasn't been assigned NULL yet (or we loaded it
		 *     before it was assigned) -- in this case it may
		 *     now be NULL which means we should just let the
		 *     packet pass through because splicing the frames
		 *     back is already done.
		 */
J
Johannes Berg 已提交
1100
		tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
1101 1102 1103 1104 1105

		if (!tid_tx) {
			/* do nothing, let packet pass through */
		} else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
			info->flags |= IEEE80211_TX_CTL_AMPDU;
1106
			reset_agg_timer = true;
1107 1108 1109 1110
		} else {
			queued = true;
			info->control.vif = &tx->sdata->vif;
			info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1111
			info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
1112
			__skb_queue_tail(&tid_tx->pending, skb);
1113 1114
			if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
				purge_skb = __skb_dequeue(&tid_tx->pending);
1115 1116
		}
		spin_unlock(&tx->sta->lock);
1117 1118

		if (purge_skb)
1119
			ieee80211_free_txskb(&tx->local->hw, purge_skb);
1120 1121
	}

1122 1123
	/* reset session timer */
	if (reset_agg_timer && tid_tx->timeout)
1124
		tid_tx->last_tx = jiffies;
1125

1126 1127 1128
	return queued;
}

1129 1130 1131
/*
 * initialises @tx
 */
1132
static ieee80211_tx_result
J
Johannes Berg 已提交
1133 1134 1135
ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
		     struct ieee80211_tx_data *tx,
		     struct sk_buff *skb)
1136
{
J
Johannes Berg 已提交
1137
	struct ieee80211_local *local = sdata->local;
1138
	struct ieee80211_hdr *hdr;
1139
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
J
Johannes Berg 已提交
1140
	int tid;
1141
	u8 *qc;
1142 1143 1144 1145

	memset(tx, 0, sizeof(*tx));
	tx->skb = skb;
	tx->local = local;
J
Johannes Berg 已提交
1146
	tx->sdata = sdata;
1147
	__skb_queue_head_init(&tx->skbs);
1148

1149 1150 1151 1152 1153 1154 1155
	/*
	 * If this flag is set to true anywhere, and we get here,
	 * we are doing the needed processing, so remove the flag
	 * now.
	 */
	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;

1156 1157
	hdr = (struct ieee80211_hdr *) skb->data;

1158
	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1159
		tx->sta = rcu_dereference(sdata->u.vlan.sta);
1160 1161
		if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
			return TX_DROP;
1162 1163
	} else if (info->flags & (IEEE80211_TX_CTL_INJECTED |
				  IEEE80211_TX_INTFL_NL80211_FRAME_TX) ||
1164
		   tx->sdata->control_port_protocol == tx->skb->protocol) {
1165
		tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1166
	}
1167
	if (!tx->sta)
1168
		tx->sta = sta_info_get(sdata, hdr->addr1);
1169

1170
	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
1171
	    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
1172 1173
	    (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) &&
	    !(local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) {
1174 1175
		struct tid_ampdu_tx *tid_tx;

S
Sujith 已提交
1176 1177 1178
		qc = ieee80211_get_qos_ctl(hdr);
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;

1179 1180 1181
		tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
		if (tid_tx) {
			bool queued;
1182

1183 1184 1185 1186 1187 1188
			queued = ieee80211_tx_prep_agg(tx, skb, info,
						       tid_tx, tid);

			if (unlikely(queued))
				return TX_QUEUED;
		}
S
Sujith 已提交
1189 1190
	}

1191
	if (is_multicast_ether_addr(hdr->addr1)) {
1192
		tx->flags &= ~IEEE80211_TX_UNICAST;
1193
		info->flags |= IEEE80211_TX_CTL_NO_ACK;
1194
	} else
1195
		tx->flags |= IEEE80211_TX_UNICAST;
1196

1197 1198 1199 1200 1201
	if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
		if (!(tx->flags & IEEE80211_TX_UNICAST) ||
		    skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
		    info->flags & IEEE80211_TX_CTL_AMPDU)
			info->flags |= IEEE80211_TX_CTL_DONTFRAG;
1202 1203
	}

1204
	if (!tx->sta)
1205
		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
J
Johannes Berg 已提交
1206
	else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
1207
		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1208

1209
	info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
1210

1211
	return TX_CONTINUE;
1212 1213
}

1214 1215 1216 1217 1218
static bool ieee80211_tx_frags(struct ieee80211_local *local,
			       struct ieee80211_vif *vif,
			       struct ieee80211_sta *sta,
			       struct sk_buff_head *skbs,
			       bool txpending)
1219
{
1220
	struct ieee80211_tx_control control;
1221
	struct sk_buff *skb, *tmp;
J
Johannes Berg 已提交
1222
	unsigned long flags;
1223

1224
	skb_queue_walk_safe(skbs, skb, tmp) {
1225 1226 1227 1228 1229 1230
		struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
		int q = info->hw_queue;

#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
		if (WARN_ON_ONCE(q >= local->hw.queues)) {
			__skb_unlink(skb, skbs);
1231
			ieee80211_free_txskb(&local->hw, skb);
1232 1233 1234
			continue;
		}
#endif
J
Johannes Berg 已提交
1235 1236 1237

		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		if (local->queue_stop_reasons[q] ||
1238
		    (!txpending && !skb_queue_empty(&local->pending[q]))) {
1239
			if (unlikely(info->flags &
1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257
				     IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
				if (local->queue_stop_reasons[q] &
				    ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
					/*
					 * Drop off-channel frames if queues
					 * are stopped for any reason other
					 * than off-channel operation. Never
					 * queue them.
					 */
					spin_unlock_irqrestore(
						&local->queue_stop_reason_lock,
						flags);
					ieee80211_purge_tx_queue(&local->hw,
								 skbs);
					return true;
				}
			} else {

1258
				/*
1259 1260 1261
				 * Since queue is stopped, queue up frames for
				 * later transmission from the tx-pending
				 * tasklet when the queue is woken again.
1262
				 */
1263 1264 1265 1266 1267 1268 1269 1270 1271 1272
				if (txpending)
					skb_queue_splice_init(skbs,
							      &local->pending[q]);
				else
					skb_queue_splice_tail_init(skbs,
								   &local->pending[q]);

				spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						       flags);
				return false;
1273
			}
1274
		}
J
Johannes Berg 已提交
1275
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1276

1277
		info->control.vif = vif;
1278
		control.sta = sta;
1279

1280
		__skb_unlink(skb, skbs);
1281
		drv_tx(local, &control, skb);
1282
	}
1283

1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300
	return true;
}

/*
 * Returns false if the frame couldn't be transmitted but was queued instead.
 */
static bool __ieee80211_tx(struct ieee80211_local *local,
			   struct sk_buff_head *skbs, int led_len,
			   struct sta_info *sta, bool txpending)
{
	struct ieee80211_tx_info *info;
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_vif *vif;
	struct ieee80211_sta *pubsta;
	struct sk_buff *skb;
	bool result = true;
	__le16 fc;
1301

1302 1303
	if (WARN_ON(skb_queue_empty(skbs)))
		return true;
J
Johannes Berg 已提交
1304

1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318
	skb = skb_peek(skbs);
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
	info = IEEE80211_SKB_CB(skb);
	sdata = vif_to_sdata(info->control.vif);
	if (sta && !sta->uploaded)
		sta = NULL;

	if (sta)
		pubsta = &sta->sta;
	else
		pubsta = NULL;

	switch (sdata->vif.type) {
	case NL80211_IFTYPE_MONITOR:
1319 1320 1321 1322
		if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
			vif = &sdata->vif;
			break;
		}
1323
		sdata = rcu_dereference(local->monitor_sdata);
1324
		if (sdata) {
1325
			vif = &sdata->vif;
1326 1327 1328 1329 1330 1331
			info->hw_queue =
				vif->hw_queue[skb_get_queue_mapping(skb)];
		} else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) {
			dev_kfree_skb(skb);
			return true;
		} else
1332
			vif = NULL;
1333 1334 1335 1336 1337 1338 1339 1340
		break;
	case NL80211_IFTYPE_AP_VLAN:
		sdata = container_of(sdata->bss,
				     struct ieee80211_sub_if_data, u.ap);
		/* fall through */
	default:
		vif = &sdata->vif;
		break;
1341
	}
J
Johannes Berg 已提交
1342

1343 1344
	result = ieee80211_tx_frags(local, vif, pubsta, skbs,
				    txpending);
1345

1346 1347
	ieee80211_tpt_led_trig_tx(local, fc, led_len);

J
Johannes Berg 已提交
1348
	WARN_ON_ONCE(!skb_queue_empty(skbs));
1349

1350
	return result;
1351 1352
}

1353 1354 1355 1356 1357 1358
/*
 * Invoke TX handlers, return 0 on success and non-zero if the
 * frame was dropped or queued.
 */
static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
{
1359
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
1360 1361
	ieee80211_tx_result res = TX_DROP;

1362 1363 1364 1365 1366 1367 1368
#define CALL_TXH(txh) \
	do {				\
		res = txh(tx);		\
		if (res != TX_CONTINUE)	\
			goto txh_done;	\
	} while (0)

1369
	CALL_TXH(ieee80211_tx_h_dynamic_ps);
1370 1371
	CALL_TXH(ieee80211_tx_h_check_assoc);
	CALL_TXH(ieee80211_tx_h_ps_buf);
1372
	CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
1373
	CALL_TXH(ieee80211_tx_h_select_key);
1374 1375
	if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
		CALL_TXH(ieee80211_tx_h_rate_ctrl);
1376

J
Johannes Berg 已提交
1377 1378 1379
	if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
		__skb_queue_tail(&tx->skbs, tx->skb);
		tx->skb = NULL;
1380
		goto txh_done;
J
Johannes Berg 已提交
1381
	}
1382 1383

	CALL_TXH(ieee80211_tx_h_michael_mic_add);
1384 1385
	CALL_TXH(ieee80211_tx_h_sequence);
	CALL_TXH(ieee80211_tx_h_fragment);
1386
	/* handlers after fragment must be aware of tx info fragmentation! */
1387 1388
	CALL_TXH(ieee80211_tx_h_stats);
	CALL_TXH(ieee80211_tx_h_encrypt);
1389 1390
	if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
		CALL_TXH(ieee80211_tx_h_calculate_duration);
1391
#undef CALL_TXH
1392

1393
 txh_done:
1394
	if (unlikely(res == TX_DROP)) {
1395
		I802_DEBUG_INC(tx->local->tx_handlers_drop);
1396
		if (tx->skb)
1397
			ieee80211_free_txskb(&tx->local->hw, tx->skb);
1398
		else
1399
			ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1400 1401
		return -1;
	} else if (unlikely(res == TX_QUEUED)) {
1402
		I802_DEBUG_INC(tx->local->tx_handlers_queued);
1403 1404 1405 1406 1407 1408
		return -1;
	}

	return 0;
}

1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437
bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
			      struct ieee80211_vif *vif, struct sk_buff *skb,
			      int band, struct ieee80211_sta **sta)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
	struct ieee80211_tx_data tx;

	if (ieee80211_tx_prepare(sdata, &tx, skb) == TX_DROP)
		return false;

	info->band = band;
	info->control.vif = vif;
	info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];

	if (invoke_tx_handlers(&tx))
		return false;

	if (sta) {
		if (tx.sta)
			*sta = &tx.sta->sta;
		else
			*sta = NULL;
	}

	return true;
}
EXPORT_SYMBOL(ieee80211_tx_prepare_skb);

1438 1439 1440 1441
/*
 * Returns false if the frame couldn't be transmitted but was queued instead.
 */
static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
1442
			 struct sk_buff *skb, bool txpending)
1443
{
J
Johannes Berg 已提交
1444
	struct ieee80211_local *local = sdata->local;
1445
	struct ieee80211_tx_data tx;
1446
	ieee80211_tx_result res_prepare;
1447
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1448
	bool result = true;
1449
	int led_len;
1450 1451 1452

	if (unlikely(skb->len < 10)) {
		dev_kfree_skb(skb);
1453
		return true;
1454 1455
	}

1456
	/* initialises tx */
1457
	led_len = skb->len;
J
Johannes Berg 已提交
1458
	res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
1459

1460
	if (unlikely(res_prepare == TX_DROP)) {
1461
		ieee80211_free_txskb(&local->hw, skb);
J
Johannes Berg 已提交
1462
		return true;
1463
	} else if (unlikely(res_prepare == TX_QUEUED)) {
J
Johannes Berg 已提交
1464
		return true;
1465 1466
	}

1467 1468 1469 1470 1471 1472
	/* set up hw_queue value early */
	if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
	    !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL))
		info->hw_queue =
			sdata->vif.hw_queue[skb_get_queue_mapping(skb)];

1473
	if (!invoke_tx_handlers(&tx))
1474 1475
		result = __ieee80211_tx(local, &tx.skbs, led_len,
					tx.sta, txpending);
J
Johannes Berg 已提交
1476

1477
	return result;
1478 1479 1480 1481
}

/* device xmit handlers */

1482
static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
1483 1484 1485
				struct sk_buff *skb,
				int head_need, bool may_encrypt)
{
1486
	struct ieee80211_local *local = sdata->local;
1487 1488
	int tail_need = 0;

1489
	if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
1490 1491 1492 1493 1494
		tail_need = IEEE80211_ENCRYPT_TAILROOM;
		tail_need -= skb_tailroom(skb);
		tail_need = max_t(int, tail_need, 0);
	}

1495 1496 1497 1498
	if (skb_cloned(skb) &&
	    (!(local->hw.flags & IEEE80211_HW_SUPPORTS_CLONED_SKBS) ||
	     !skb_clone_writable(skb, ETH_HLEN) ||
	     sdata->crypto_tx_tailroom_needed_cnt))
1499
		I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1500
	else if (head_need || tail_need)
1501
		I802_DEBUG_INC(local->tx_expand_skb_head);
1502 1503
	else
		return 0;
1504 1505

	if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
J
Joe Perches 已提交
1506 1507
		wiphy_debug(local->hw.wiphy,
			    "failed to reallocate TX buffer\n");
1508 1509 1510 1511 1512 1513
		return -ENOMEM;
	}

	return 0;
}

1514
void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
1515
{
J
Johannes Berg 已提交
1516
	struct ieee80211_local *local = sdata->local;
1517
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1518
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1519
	int headroom;
1520
	bool may_encrypt;
1521

J
Johannes Berg 已提交
1522
	may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
1523

J
Johannes Berg 已提交
1524
	headroom = local->tx_headroom;
1525
	if (may_encrypt)
1526
		headroom += sdata->encrypt_headroom;
1527 1528 1529
	headroom -= skb_headroom(skb);
	headroom = max_t(int, 0, headroom);

1530
	if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
1531
		ieee80211_free_txskb(&local->hw, skb);
J
Johannes Berg 已提交
1532
		return;
1533 1534
	}

1535
	hdr = (struct ieee80211_hdr *) skb->data;
1536
	info->control.vif = &sdata->vif;
1537

M
Marco Porsch 已提交
1538 1539 1540
	if (ieee80211_vif_is_mesh(&sdata->vif)) {
		if (ieee80211_is_data(hdr->frame_control) &&
		    is_unicast_ether_addr(hdr->addr1)) {
J
Johannes Berg 已提交
1541
			if (mesh_nexthop_resolve(sdata, skb))
M
Marco Porsch 已提交
1542 1543 1544 1545
				return; /* skb queued: don't free */
		} else {
			ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
		}
1546
	}
1547

1548
	ieee80211_set_qos_hdr(sdata, skb);
1549
	ieee80211_tx(sdata, skb, false);
1550 1551
}

1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634
static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
{
	struct ieee80211_radiotap_iterator iterator;
	struct ieee80211_radiotap_header *rthdr =
		(struct ieee80211_radiotap_header *) skb->data;
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
	int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
						   NULL);
	u16 txflags;

	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
		       IEEE80211_TX_CTL_DONTFRAG;

	/*
	 * for every radiotap entry that is present
	 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
	 * entries present, or -EINVAL on error)
	 */

	while (!ret) {
		ret = ieee80211_radiotap_iterator_next(&iterator);

		if (ret)
			continue;

		/* see if this argument is something we can use */
		switch (iterator.this_arg_index) {
		/*
		 * You must take care when dereferencing iterator.this_arg
		 * for multibyte types... the pointer is not aligned.  Use
		 * get_unaligned((type *)iterator.this_arg) to dereference
		 * iterator.this_arg for type "type" safely on all arches.
		*/
		case IEEE80211_RADIOTAP_FLAGS:
			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
				/*
				 * this indicates that the skb we have been
				 * handed has the 32-bit FCS CRC at the end...
				 * we should react to that by snipping it off
				 * because it will be recomputed and added
				 * on transmission
				 */
				if (skb->len < (iterator._max_length + FCS_LEN))
					return false;

				skb_trim(skb, skb->len - FCS_LEN);
			}
			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
				info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
				info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
			break;

		case IEEE80211_RADIOTAP_TX_FLAGS:
			txflags = get_unaligned_le16(iterator.this_arg);
			if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
				info->flags |= IEEE80211_TX_CTL_NO_ACK;
			break;

		/*
		 * Please update the file
		 * Documentation/networking/mac80211-injection.txt
		 * when parsing new fields here.
		 */

		default:
			break;
		}
	}

	if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
		return false;

	/*
	 * remove the radiotap header
	 * iterator->_max_length was sanity-checked against
	 * skb->len by iterator init
	 */
	skb_pull(skb, iterator._max_length);

	return true;
}

1635 1636
netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
					 struct net_device *dev)
1637 1638
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
J
Johannes Berg 已提交
1639
	struct ieee80211_chanctx_conf *chanctx_conf;
1640 1641
	struct ieee80211_radiotap_header *prthdr =
		(struct ieee80211_radiotap_header *)skb->data;
J
Johannes Berg 已提交
1642
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1643
	struct ieee80211_hdr *hdr;
J
Johannes Berg 已提交
1644
	struct ieee80211_sub_if_data *tmp_sdata, *sdata;
1645
	struct cfg80211_chan_def *chandef;
1646
	u16 len_rthdr;
J
Johannes Berg 已提交
1647
	int hdrlen;
1648

1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662
	/* check for not even having the fixed radiotap header part */
	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
		goto fail; /* too short to be possibly valid */

	/* is it a header version we can trust to find length from? */
	if (unlikely(prthdr->it_version))
		goto fail; /* only version 0 is supported */

	/* then there must be a radiotap header with a length we can use */
	len_rthdr = ieee80211_get_radiotap_len(skb->data);

	/* does the skb contain enough to deliver on the alleged length? */
	if (unlikely(skb->len < len_rthdr))
		goto fail; /* skb too short for claimed rt header extent */
1663 1664 1665 1666 1667 1668 1669

	/*
	 * fix up the pointers accounting for the radiotap
	 * header still being in there.  We are being given
	 * a precooked IEEE80211 header so no need for
	 * normal processing
	 */
1670
	skb_set_mac_header(skb, len_rthdr);
1671
	/*
1672 1673
	 * these are just fixed to the end of the rt area since we
	 * don't have any better information and at this point, nobody cares
1674
	 */
1675 1676
	skb_set_network_header(skb, len_rthdr);
	skb_set_transport_header(skb, len_rthdr);
1677

J
Johannes Berg 已提交
1678 1679 1680 1681 1682 1683 1684 1685 1686
	if (skb->len < len_rthdr + 2)
		goto fail;

	hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
	hdrlen = ieee80211_hdrlen(hdr->frame_control);

	if (skb->len < len_rthdr + hdrlen)
		goto fail;

1687 1688 1689 1690
	/*
	 * Initialize skb->protocol if the injected frame is a data frame
	 * carrying a rfc1042 header
	 */
J
Johannes Berg 已提交
1691 1692 1693 1694
	if (ieee80211_is_data(hdr->frame_control) &&
	    skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
		u8 *payload = (u8 *)hdr + hdrlen;

1695
		if (ether_addr_equal(payload, rfc1042_header))
J
Johannes Berg 已提交
1696 1697
			skb->protocol = cpu_to_be16((payload[6] << 8) |
						    payload[7]);
1698 1699
	}

J
Johannes Berg 已提交
1700 1701
	memset(info, 0, sizeof(*info));

J
Johannes Berg 已提交
1702
	info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
1703 1704 1705 1706 1707
		      IEEE80211_TX_CTL_INJECTED;

	/* process and remove the injection radiotap header */
	if (!ieee80211_parse_tx_radiotap(skb))
		goto fail;
J
Johannes Berg 已提交
1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727

	rcu_read_lock();

	/*
	 * We process outgoing injected frames that have a local address
	 * we handle as though they are non-injected frames.
	 * This code here isn't entirely correct, the local MAC address
	 * isn't always enough to find the interface to use; for proper
	 * VLAN/WDS support we will need a different mechanism (which
	 * likely isn't going to be monitor interfaces).
	 */
	sdata = IEEE80211_DEV_TO_SUB_IF(dev);

	list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(tmp_sdata))
			continue;
		if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
		    tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
			continue;
1728
		if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
J
Johannes Berg 已提交
1729 1730 1731 1732
			sdata = tmp_sdata;
			break;
		}
	}
1733

J
Johannes Berg 已提交
1734 1735 1736 1737 1738 1739 1740 1741
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
	if (!chanctx_conf) {
		tmp_sdata = rcu_dereference(local->monitor_sdata);
		if (tmp_sdata)
			chanctx_conf =
				rcu_dereference(tmp_sdata->vif.chanctx_conf);
	}

1742
	if (chanctx_conf)
1743
		chandef = &chanctx_conf->def;
1744
	else if (!local->use_chanctx)
1745
		chandef = &local->_oper_chandef;
1746 1747
	else
		goto fail_rcu;
J
Johannes Berg 已提交
1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764

	/*
	 * Frame injection is not allowed if beaconing is not allowed
	 * or if we need radar detection. Beaconing is usually not allowed when
	 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
	 * Passive scan is also used in world regulatory domains where
	 * your country is not known and as such it should be treated as
	 * NO TX unless the channel is explicitly allowed in which case
	 * your current regulatory domain would not have the passive scan
	 * flag.
	 *
	 * Since AP mode uses monitor interfaces to inject/TX management
	 * frames we can make AP mode the exception to this rule once it
	 * supports radar detection as its implementation can deal with
	 * radar detection by itself. We can do that later by adding a
	 * monitor flag interfaces used for AP support.
	 */
1765 1766
	if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
				     sdata->vif.type))
J
Johannes Berg 已提交
1767 1768
		goto fail_rcu;

1769 1770
	info->band = chandef->chan->band;
	ieee80211_xmit(sdata, skb);
J
Johannes Berg 已提交
1771 1772
	rcu_read_unlock();

1773
	return NETDEV_TX_OK;
1774

J
Johannes Berg 已提交
1775 1776
fail_rcu:
	rcu_read_unlock();
1777 1778 1779
fail:
	dev_kfree_skb(skb);
	return NETDEV_TX_OK; /* meaning, we dealt with the skb */
1780 1781
}

1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795
/*
 * Measure Tx frame arrival time for Tx latency statistics calculation
 * A single Tx frame latency should be measured from when it is entering the
 * Kernel until we receive Tx complete confirmation indication and the skb is
 * freed.
 */
static void ieee80211_tx_latency_start_msrmnt(struct ieee80211_local *local,
					      struct sk_buff *skb)
{
	struct ieee80211_tx_latency_bin_ranges *tx_latency;

	tx_latency = rcu_dereference(local->tx_latency);
	if (!tx_latency)
		return;
1796
	skb->tstamp = ktime_get();
1797 1798
}

1799
/**
1800 1801 1802
 * ieee80211_build_hdr - build 802.11 header in the given frame
 * @sdata: virtual interface to build the header for
 * @skb: the skb to build the header in
1803
 * @info_flags: skb flags to set
1804
 *
1805 1806 1807 1808 1809 1810 1811
 * This function takes the skb with 802.3 header and reformats the header to
 * the appropriate IEEE 802.11 header based on which interface the packet is
 * being transmitted on.
 *
 * Note that this function also takes care of the TX status request and
 * potential unsharing of the SKB - this needs to be interleaved with the
 * header building.
1812
 *
1813 1814 1815
 * The function requires the read-side RCU lock held
 *
 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
1816
 */
1817 1818
static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
					   struct sk_buff *skb, u32 info_flags)
1819
{
1820
	struct ieee80211_local *local = sdata->local;
1821
	struct ieee80211_tx_info *info;
1822
	int head_need;
1823 1824
	u16 ethertype, hdrlen,  meshhdrlen = 0;
	__le16 fc;
1825
	struct ieee80211_hdr hdr;
1826
	struct ieee80211s_hdr mesh_hdr __maybe_unused;
1827
	struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
1828 1829
	const u8 *encaps_data;
	int encaps_len, skip_header_bytes;
1830
	int nh_pos, h_pos;
1831
	struct sta_info *sta = NULL;
J
Johannes Berg 已提交
1832
	bool wme_sta = false, authorized = false, tdls_auth = false;
1833
	bool tdls_peer = false, tdls_setup_frame = false;
J
Johannes Berg 已提交
1834 1835
	bool multicast;
	u16 info_id = 0;
J
Johannes Berg 已提交
1836 1837 1838
	struct ieee80211_chanctx_conf *chanctx_conf;
	struct ieee80211_sub_if_data *ap_sdata;
	enum ieee80211_band band;
1839
	int ret;
1840 1841 1842 1843

	/* convert Ethernet header to proper 802.11 header (based on
	 * operation mode) */
	ethertype = (skb->data[12] << 8) | skb->data[13];
1844
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
1845

1846
	switch (sdata->vif.type) {
1847
	case NL80211_IFTYPE_AP_VLAN:
1848
		sta = rcu_dereference(sdata->u.vlan.sta);
1849 1850 1851 1852
		if (sta) {
			fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
			/* RA TA DA SA */
			memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
1853
			memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1854 1855 1856
			memcpy(hdr.addr3, skb->data, ETH_ALEN);
			memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
			hdrlen = 30;
J
Johannes Berg 已提交
1857
			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
1858
			wme_sta = sta->sta.wme;
1859
		}
J
Johannes Berg 已提交
1860 1861 1862
		ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
					u.ap);
		chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
1863 1864 1865 1866
		if (!chanctx_conf) {
			ret = -ENOTCONN;
			goto free;
		}
1867
		band = chanctx_conf->def.chan->band;
1868 1869 1870 1871
		if (sta)
			break;
		/* fall through */
	case NL80211_IFTYPE_AP:
A
Arnd Bergmann 已提交
1872 1873
		if (sdata->vif.type == NL80211_IFTYPE_AP)
			chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1874 1875 1876 1877
		if (!chanctx_conf) {
			ret = -ENOTCONN;
			goto free;
		}
1878
		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
1879 1880
		/* DA BSSID SA */
		memcpy(hdr.addr1, skb->data, ETH_ALEN);
1881
		memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1882 1883
		memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
		hdrlen = 24;
1884
		band = chanctx_conf->def.chan->band;
1885
		break;
1886
	case NL80211_IFTYPE_WDS:
1887
		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1888 1889
		/* RA TA DA SA */
		memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
1890
		memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1891 1892 1893
		memcpy(hdr.addr3, skb->data, ETH_ALEN);
		memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
		hdrlen = 30;
J
Johannes Berg 已提交
1894 1895 1896 1897
		/*
		 * This is the exception! WDS style interfaces are prohibited
		 * when channel contexts are in used so this must be valid
		 */
1898
		band = local->hw.conf.chandef.chan->band;
1899
		break;
1900
#ifdef CONFIG_MAC80211_MESH
1901
	case NL80211_IFTYPE_MESH_POINT:
1902
		if (!is_multicast_ether_addr(skb->data)) {
1903 1904 1905
			struct sta_info *next_hop;
			bool mpp_lookup = true;

J
Johannes Berg 已提交
1906
			mpath = mesh_path_lookup(sdata, skb->data);
1907 1908 1909 1910 1911 1912 1913 1914 1915 1916
			if (mpath) {
				mpp_lookup = false;
				next_hop = rcu_dereference(mpath->next_hop);
				if (!next_hop ||
				    !(mpath->flags & (MESH_PATH_ACTIVE |
						      MESH_PATH_RESOLVING)))
					mpp_lookup = true;
			}

			if (mpp_lookup)
J
Johannes Berg 已提交
1917
				mppath = mpp_path_lookup(sdata, skb->data);
1918 1919 1920

			if (mppath && mpath)
				mesh_path_del(mpath->sdata, mpath->dst);
1921
		}
1922

1923
		/*
1924 1925 1926 1927
		 * Use address extension if it is a packet from
		 * another interface or if we know the destination
		 * is being proxied by a portal (i.e. portal address
		 * differs from proxied address)
1928
		 */
1929 1930
		if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
		    !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
1931 1932
			hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
					skb->data, skb->data + ETH_ALEN);
J
Johannes Berg 已提交
1933 1934
			meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
							       NULL, NULL);
1935
		} else {
1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947
			/* DS -> MBSS (802.11-2012 13.11.3.3).
			 * For unicast with unknown forwarding information,
			 * destination might be in the MBSS or if that fails
			 * forwarded to another mesh gate. In either case
			 * resolution will be handled in ieee80211_xmit(), so
			 * leave the original DA. This also works for mcast */
			const u8 *mesh_da = skb->data;

			if (mppath)
				mesh_da = mppath->mpp;
			else if (mpath)
				mesh_da = mpath->dst;
1948

1949
			hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
1950
					mesh_da, sdata->vif.addr);
1951 1952
			if (is_multicast_ether_addr(mesh_da))
				/* DA TA mSA AE:SA */
J
Johannes Berg 已提交
1953 1954 1955
				meshhdrlen = ieee80211_new_mesh_header(
						sdata, &mesh_hdr,
						skb->data + ETH_ALEN, NULL);
1956
			else
1957
				/* RA TA mDA mSA AE:DA SA */
J
Johannes Berg 已提交
1958 1959 1960
				meshhdrlen = ieee80211_new_mesh_header(
						sdata, &mesh_hdr, skb->data,
						skb->data + ETH_ALEN);
1961 1962

		}
J
Johannes Berg 已提交
1963
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1964 1965 1966 1967
		if (!chanctx_conf) {
			ret = -ENOTCONN;
			goto free;
		}
1968
		band = chanctx_conf->def.chan->band;
1969 1970
		break;
#endif
1971
	case NL80211_IFTYPE_STATION:
1972 1973
		if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
			sta = sta_info_get(sdata, skb->data);
J
Johannes Berg 已提交
1974 1975 1976
			if (sta) {
				authorized = test_sta_flag(sta,
							WLAN_STA_AUTHORIZED);
1977
				wme_sta = sta->sta.wme;
J
Johannes Berg 已提交
1978
				tdls_peer = test_sta_flag(sta,
1979
							  WLAN_STA_TDLS_PEER);
J
Johannes Berg 已提交
1980 1981 1982
				tdls_auth = test_sta_flag(sta,
						WLAN_STA_TDLS_PEER_AUTH);
			}
1983

1984 1985 1986 1987 1988
			if (tdls_peer)
				tdls_setup_frame =
					ethertype == ETH_P_TDLS &&
					skb->len > 14 &&
					skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
1989 1990
		}

1991 1992 1993 1994 1995 1996
		/*
		 * TDLS link during setup - throw out frames to peer. We allow
		 * TDLS-setup frames to unauthorized peers for the special case
		 * of a link teardown after a TDLS sta is removed due to being
		 * unreachable.
		 */
1997 1998 1999 2000
		if (tdls_peer && !tdls_auth && !tdls_setup_frame) {
			ret = -EINVAL;
			goto free;
		}
2001

2002 2003
		/* send direct packets to authorized TDLS peers */
		if (tdls_peer && tdls_auth) {
2004 2005 2006 2007 2008 2009 2010 2011 2012
			/* DA SA BSSID */
			memcpy(hdr.addr1, skb->data, ETH_ALEN);
			memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
			memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
			hdrlen = 24;
		}  else if (sdata->u.mgd.use_4addr &&
			    cpu_to_be16(ethertype) != sdata->control_port_protocol) {
			fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
					  IEEE80211_FCTL_TODS);
2013
			/* RA TA DA SA */
2014
			memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2015
			memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2016 2017 2018 2019 2020 2021
			memcpy(hdr.addr3, skb->data, ETH_ALEN);
			memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
			hdrlen = 30;
		} else {
			fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
			/* BSSID SA DA */
2022
			memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2023 2024 2025 2026
			memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
			memcpy(hdr.addr3, skb->data, ETH_ALEN);
			hdrlen = 24;
		}
J
Johannes Berg 已提交
2027
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2028 2029 2030 2031
		if (!chanctx_conf) {
			ret = -ENOTCONN;
			goto free;
		}
2032
		band = chanctx_conf->def.chan->band;
2033
		break;
2034 2035 2036 2037 2038 2039 2040
	case NL80211_IFTYPE_OCB:
		/* DA SA BSSID */
		memcpy(hdr.addr1, skb->data, ETH_ALEN);
		memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
		eth_broadcast_addr(hdr.addr3);
		hdrlen = 24;
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2041 2042 2043 2044
		if (!chanctx_conf) {
			ret = -ENOTCONN;
			goto free;
		}
2045 2046
		band = chanctx_conf->def.chan->band;
		break;
2047
	case NL80211_IFTYPE_ADHOC:
2048 2049 2050
		/* DA SA BSSID */
		memcpy(hdr.addr1, skb->data, ETH_ALEN);
		memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2051
		memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
2052
		hdrlen = 24;
J
Johannes Berg 已提交
2053
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2054 2055 2056 2057
		if (!chanctx_conf) {
			ret = -ENOTCONN;
			goto free;
		}
2058
		band = chanctx_conf->def.chan->band;
2059 2060
		break;
	default:
2061 2062
		ret = -EINVAL;
		goto free;
2063 2064
	}

2065 2066 2067 2068 2069
	/*
	 * There's no need to try to look up the destination
	 * if it is a multicast address (which can only happen
	 * in AP mode)
	 */
J
Johannes Berg 已提交
2070 2071
	multicast = is_multicast_ether_addr(hdr.addr1);
	if (!multicast) {
2072
		sta = sta_info_get(sdata, hdr.addr1);
J
Johannes Berg 已提交
2073 2074
		if (sta) {
			authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2075
			wme_sta = sta->sta.wme;
J
Johannes Berg 已提交
2076
		}
2077 2078
	}

2079 2080
	/* For mesh, the use of the QoS header is mandatory */
	if (ieee80211_vif_is_mesh(&sdata->vif))
J
Johannes Berg 已提交
2081
		wme_sta = true;
2082

2083
	/* receiver and we are QoS enabled, use a QoS type frame */
J
Johannes Berg 已提交
2084
	if (wme_sta && local->hw.queues >= IEEE80211_NUM_ACS) {
2085
		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2086 2087 2088 2089
		hdrlen += 2;
	}

	/*
2090 2091
	 * Drop unicast frames to unauthorised stations unless they are
	 * EAPOL frames from the local station.
2092
	 */
2093
	if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
2094
		     (sdata->vif.type != NL80211_IFTYPE_OCB) &&
2095
		     !multicast && !authorized &&
2096
		     (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
2097
		      !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
2098
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
J
Johannes Berg 已提交
2099
		net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
2100
				    sdata->name, hdr.addr1);
2101 2102 2103 2104
#endif

		I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);

2105 2106
		ret = -EPERM;
		goto free;
2107 2108
	}

J
Johannes Berg 已提交
2109 2110
	if (unlikely(!multicast && skb->sk &&
		     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
2111
		struct sk_buff *ack_skb = skb_clone_sk(skb);
J
Johannes Berg 已提交
2112

2113
		if (ack_skb) {
J
Johannes Berg 已提交
2114
			unsigned long flags;
T
Tejun Heo 已提交
2115
			int id;
J
Johannes Berg 已提交
2116 2117

			spin_lock_irqsave(&local->ack_status_lock, flags);
2118
			id = idr_alloc(&local->ack_status_frames, ack_skb,
T
Tejun Heo 已提交
2119
				       1, 0x10000, GFP_ATOMIC);
J
Johannes Berg 已提交
2120 2121
			spin_unlock_irqrestore(&local->ack_status_lock, flags);

T
Tejun Heo 已提交
2122
			if (id >= 0) {
J
Johannes Berg 已提交
2123 2124 2125
				info_id = id;
				info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
			} else {
2126
				kfree_skb(ack_skb);
J
Johannes Berg 已提交
2127 2128 2129 2130
			}
		}
	}

2131 2132 2133 2134
	/*
	 * If the skb is shared we need to obtain our own copy.
	 */
	if (skb_shared(skb)) {
J
Johannes Berg 已提交
2135 2136 2137 2138 2139
		struct sk_buff *tmp_skb = skb;

		/* can't happen -- skb is a clone if info_id != 0 */
		WARN_ON(info_id);

2140
		skb = skb_clone(skb, GFP_ATOMIC);
2141 2142
		kfree_skb(tmp_skb);

2143 2144 2145 2146
		if (!skb) {
			ret = -ENOMEM;
			goto free;
		}
2147 2148
	}

2149
	hdr.frame_control = fc;
2150 2151 2152 2153 2154 2155 2156 2157
	hdr.duration_id = 0;
	hdr.seq_ctrl = 0;

	skip_header_bytes = ETH_HLEN;
	if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
		encaps_data = bridge_tunnel_header;
		encaps_len = sizeof(bridge_tunnel_header);
		skip_header_bytes -= 2;
S
Simon Horman 已提交
2158
	} else if (ethertype >= ETH_P_802_3_MIN) {
2159 2160 2161 2162 2163 2164 2165 2166
		encaps_data = rfc1042_header;
		encaps_len = sizeof(rfc1042_header);
		skip_header_bytes -= 2;
	} else {
		encaps_data = NULL;
		encaps_len = 0;
	}

2167 2168 2169
	nh_pos = skb_network_header(skb) - skb->data;
	h_pos = skb_transport_header(skb) - skb->data;

2170 2171 2172 2173
	skb_pull(skb, skip_header_bytes);
	nh_pos -= skip_header_bytes;
	h_pos -= skip_header_bytes;

2174
	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
2175

2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186
	/*
	 * So we need to modify the skb header and hence need a copy of
	 * that. The head_need variable above doesn't, so far, include
	 * the needed header space that we don't need right away. If we
	 * can, then we don't reallocate right now but only after the
	 * frame arrives at the master device (if it does...)
	 *
	 * If we cannot, however, then we will reallocate to include all
	 * the ever needed space. Also, if we need to reallocate it anyway,
	 * make it big enough for everything we may ever need.
	 */
2187

2188
	if (head_need > 0 || skb_cloned(skb)) {
2189
		head_need += sdata->encrypt_headroom;
2190 2191
		head_need += local->tx_headroom;
		head_need = max_t(int, 0, head_need);
2192 2193
		if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
			ieee80211_free_txskb(&local->hw, skb);
J
Johannes Berg 已提交
2194
			skb = NULL;
2195
			return ERR_PTR(-ENOMEM);
2196
		}
2197 2198 2199 2200 2201 2202 2203
	}

	if (encaps_data) {
		memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
		nh_pos += encaps_len;
		h_pos += encaps_len;
	}
2204

2205
#ifdef CONFIG_MAC80211_MESH
2206 2207 2208 2209 2210
	if (meshhdrlen > 0) {
		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
		nh_pos += meshhdrlen;
		h_pos += meshhdrlen;
	}
2211
#endif
2212

2213
	if (ieee80211_is_data_qos(fc)) {
2214 2215
		__le16 *qos_control;

W
Weilong Chen 已提交
2216
		qos_control = (__le16 *) skb_push(skb, 2);
2217 2218 2219 2220 2221 2222 2223 2224 2225
		memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
		/*
		 * Maybe we could actually set some fields here, for now just
		 * initialise to zero to indicate no special operation.
		 */
		*qos_control = 0;
	} else
		memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);

2226 2227 2228 2229 2230 2231 2232 2233 2234 2235
	nh_pos += hdrlen;
	h_pos += hdrlen;

	/* Update skb pointers to various headers since this modified frame
	 * is going to go through Linux networking code that may potentially
	 * need things like pointer to IP header. */
	skb_set_mac_header(skb, 0);
	skb_set_network_header(skb, nh_pos);
	skb_set_transport_header(skb, h_pos);

2236
	info = IEEE80211_SKB_CB(skb);
J
Johannes Berg 已提交
2237 2238
	memset(info, 0, sizeof(*info));

J
Johannes Berg 已提交
2239 2240
	info->flags = info_flags;
	info->ack_frame_id = info_id;
2241
	info->band = band;
J
Johannes Berg 已提交
2242

2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261
	return skb;
 free:
	kfree_skb(skb);
	return ERR_PTR(ret);
}

void __ieee80211_subif_start_xmit(struct sk_buff *skb,
				  struct net_device *dev,
				  u32 info_flags)
{
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
	struct ieee80211_local *local = sdata->local;

	if (unlikely(skb->len < ETH_HLEN)) {
		kfree_skb(skb);
		return;
	}

	rcu_read_lock();
2262

2263 2264 2265 2266 2267 2268 2269 2270 2271 2272
	/* Measure frame arrival for Tx latency statistics calculation */
	ieee80211_tx_latency_start_msrmnt(local, skb);

	skb = ieee80211_build_hdr(sdata, skb, info_flags);
	if (IS_ERR(skb))
		goto out;

	dev->stats.tx_packets++;
	dev->stats.tx_bytes += skb->len;
	dev->trans_start = jiffies;
2273

2274 2275
	ieee80211_xmit(sdata, skb);
 out:
J
Johannes Berg 已提交
2276
	rcu_read_unlock();
2277 2278
}

2279 2280 2281 2282 2283 2284 2285
/**
 * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
 * @skb: packet to be sent
 * @dev: incoming interface
 *
 * On failure skb will be freed.
 */
2286 2287 2288 2289 2290 2291
netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
				       struct net_device *dev)
{
	__ieee80211_subif_start_xmit(skb, dev, 0);
	return NETDEV_TX_OK;
}
2292

2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323
struct sk_buff *
ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
			      struct sk_buff *skb, u32 info_flags)
{
	struct ieee80211_hdr *hdr;
	struct ieee80211_tx_data tx = {
		.local = sdata->local,
		.sdata = sdata,
	};

	rcu_read_lock();

	skb = ieee80211_build_hdr(sdata, skb, info_flags);
	if (IS_ERR(skb))
		goto out;

	hdr = (void *)skb->data;
	tx.sta = sta_info_get(sdata, hdr->addr1);
	tx.skb = skb;

	if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
		rcu_read_unlock();
		kfree_skb(skb);
		return ERR_PTR(-EINVAL);
	}

out:
	rcu_read_unlock();
	return skb;
}

2324 2325 2326 2327
/*
 * ieee80211_clear_tx_pending may not be called in a context where
 * it is possible that it packets could come in again.
 */
2328 2329
void ieee80211_clear_tx_pending(struct ieee80211_local *local)
{
2330
	struct sk_buff *skb;
J
Johannes Berg 已提交
2331
	int i;
2332

2333 2334 2335 2336
	for (i = 0; i < local->hw.queues; i++) {
		while ((skb = skb_dequeue(&local->pending[i])) != NULL)
			ieee80211_free_txskb(&local->hw, skb);
	}
2337 2338
}

2339 2340 2341 2342 2343
/*
 * Returns false if the frame couldn't be transmitted but was queued instead,
 * which in this case means re-queued -- take as an indication to stop sending
 * more pending frames.
 */
2344 2345 2346 2347 2348 2349 2350
static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
				     struct sk_buff *skb)
{
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
	struct ieee80211_sub_if_data *sdata;
	struct sta_info *sta;
	struct ieee80211_hdr *hdr;
2351
	bool result;
J
Johannes Berg 已提交
2352
	struct ieee80211_chanctx_conf *chanctx_conf;
2353

2354
	sdata = vif_to_sdata(info->control.vif);
2355 2356

	if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
J
Johannes Berg 已提交
2357 2358 2359 2360 2361
		chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
		if (unlikely(!chanctx_conf)) {
			dev_kfree_skb(skb);
			return true;
		}
2362 2363
		info->band = chanctx_conf->def.chan->band;
		result = ieee80211_tx(sdata, skb, true);
2364
	} else {
2365 2366 2367 2368 2369
		struct sk_buff_head skbs;

		__skb_queue_head_init(&skbs);
		__skb_queue_tail(&skbs, skb);

2370
		hdr = (struct ieee80211_hdr *)skb->data;
2371
		sta = sta_info_get(sdata, hdr->addr1);
2372

2373
		result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
2374 2375 2376 2377 2378
	}

	return result;
}

2379
/*
J
Johannes Berg 已提交
2380
 * Transmit all pending packets. Called from tasklet.
2381
 */
2382 2383 2384
void ieee80211_tx_pending(unsigned long data)
{
	struct ieee80211_local *local = (struct ieee80211_local *)data;
2385
	unsigned long flags;
2386
	int i;
J
Johannes Berg 已提交
2387
	bool txok;
2388

2389
	rcu_read_lock();
2390

J
Johannes Berg 已提交
2391
	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2392 2393 2394 2395 2396
	for (i = 0; i < local->hw.queues; i++) {
		/*
		 * If queue is stopped by something other than due to pending
		 * frames, or we have no pending frames, proceed to next queue.
		 */
J
Johannes Berg 已提交
2397
		if (local->queue_stop_reasons[i] ||
2398
		    skb_queue_empty(&local->pending[i]))
2399
			continue;
2400

2401
		while (!skb_queue_empty(&local->pending[i])) {
J
Johannes Berg 已提交
2402
			struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
2403 2404
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

2405
			if (WARN_ON(!info->control.vif)) {
2406
				ieee80211_free_txskb(&local->hw, skb);
2407 2408 2409
				continue;
			}

J
Johannes Berg 已提交
2410 2411 2412 2413 2414 2415 2416
			spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						flags);

			txok = ieee80211_tx_pending_skb(local, skb);
			spin_lock_irqsave(&local->queue_stop_reason_lock,
					  flags);
			if (!txok)
2417
				break;
2418
		}
2419 2420

		if (skb_queue_empty(&local->pending[i]))
2421
			ieee80211_propagate_queue_wake(local, i);
2422
	}
J
Johannes Berg 已提交
2423
	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2424

2425
	rcu_read_unlock();
2426 2427 2428 2429
}

/* functions for drivers to get certain frames */

2430
static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
2431 2432
				       struct ps_data *ps, struct sk_buff *skb,
				       bool is_template)
2433 2434 2435 2436 2437 2438 2439
{
	u8 *pos, *tim;
	int aid0 = 0;
	int i, have_bits = 0, n1, n2;

	/* Generate bitmap for TIM only if there are any STAs in power save
	 * mode. */
2440
	if (atomic_read(&ps->num_sta_ps) > 0)
2441 2442
		/* in the hope that this is faster than
		 * checking byte-for-byte */
W
Weilong Chen 已提交
2443
		have_bits = !bitmap_empty((unsigned long *)ps->tim,
2444
					  IEEE80211_MAX_AID+1);
2445 2446 2447 2448 2449 2450
	if (!is_template) {
		if (ps->dtim_count == 0)
			ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
		else
			ps->dtim_count--;
	}
2451 2452 2453 2454

	tim = pos = (u8 *) skb_put(skb, 6);
	*pos++ = WLAN_EID_TIM;
	*pos++ = 4;
2455
	*pos++ = ps->dtim_count;
2456
	*pos++ = sdata->vif.bss_conf.dtim_period;
2457

2458
	if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf))
2459 2460
		aid0 = 1;

2461
	ps->dtim_bc_mc = aid0 == 1;
2462

2463 2464 2465 2466 2467 2468
	if (have_bits) {
		/* Find largest even number N1 so that bits numbered 1 through
		 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
		 * (N2 + 1) x 8 through 2007 are 0. */
		n1 = 0;
		for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
2469
			if (ps->tim[i]) {
2470 2471 2472 2473 2474 2475
				n1 = i & 0xfe;
				break;
			}
		}
		n2 = n1;
		for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
2476
			if (ps->tim[i]) {
2477 2478 2479 2480 2481 2482 2483 2484
				n2 = i;
				break;
			}
		}

		/* Bitmap control */
		*pos++ = n1 | aid0;
		/* Part Virt Bitmap */
2485
		skb_put(skb, n2 - n1);
2486
		memcpy(pos, ps->tim + n1, n2 - n1 + 1);
2487 2488 2489 2490 2491 2492 2493 2494

		tim[1] = n2 - n1 + 4;
	} else {
		*pos++ = aid0; /* Bitmap control */
		*pos++ = 0; /* Part Virt Bitmap */
	}
}

2495
static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
2496 2497
				    struct ps_data *ps, struct sk_buff *skb,
				    bool is_template)
2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508
{
	struct ieee80211_local *local = sdata->local;

	/*
	 * Not very nice, but we want to allow the driver to call
	 * ieee80211_beacon_get() as a response to the set_tim()
	 * callback. That, however, is already invoked under the
	 * sta_lock to guarantee consistent and race-free update
	 * of the tim bitmap in mac80211 and the driver.
	 */
	if (local->tim_in_locked_section) {
2509
		__ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
2510
	} else {
J
Johannes Berg 已提交
2511
		spin_lock_bh(&local->tim_lock);
2512
		__ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
J
Johannes Berg 已提交
2513
		spin_unlock_bh(&local->tim_lock);
2514 2515 2516 2517 2518
	}

	return 0;
}

2519 2520
static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
			      struct beacon_data *beacon)
2521 2522
{
	struct probe_resp *resp;
2523 2524
	u8 *beacon_data;
	size_t beacon_data_len;
2525
	int i;
2526
	u8 count = beacon->csa_current_counter;
2527 2528 2529 2530 2531 2532 2533 2534 2535 2536

	switch (sdata->vif.type) {
	case NL80211_IFTYPE_AP:
		beacon_data = beacon->tail;
		beacon_data_len = beacon->tail_len;
		break;
	case NL80211_IFTYPE_ADHOC:
		beacon_data = beacon->head;
		beacon_data_len = beacon->head_len;
		break;
2537 2538 2539 2540
	case NL80211_IFTYPE_MESH_POINT:
		beacon_data = beacon->head;
		beacon_data_len = beacon->head_len;
		break;
2541 2542 2543
	default:
		return;
	}
2544

2545
	rcu_read_lock();
2546
	for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
2547
		resp = rcu_dereference(sdata->u.ap.probe_resp);
2548

2549 2550 2551
		if (beacon->csa_counter_offsets[i]) {
			if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
					 beacon_data_len)) {
2552 2553 2554
				rcu_read_unlock();
				return;
			}
2555 2556

			beacon_data[beacon->csa_counter_offsets[i]] = count;
2557
		}
2558 2559 2560

		if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
			resp->data[resp->csa_counter_offsets[i]] = count;
2561
	}
2562
	rcu_read_unlock();
2563 2564 2565 2566 2567
}

u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2568 2569
	struct beacon_data *beacon = NULL;
	u8 count = 0;
2570

2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583
	rcu_read_lock();

	if (sdata->vif.type == NL80211_IFTYPE_AP)
		beacon = rcu_dereference(sdata->u.ap.beacon);
	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
		beacon = rcu_dereference(sdata->u.ibss.presp);
	else if (ieee80211_vif_is_mesh(&sdata->vif))
		beacon = rcu_dereference(sdata->u.mesh.beacon);

	if (!beacon)
		goto unlock;

	beacon->csa_current_counter--;
2584 2585

	/* the counter should never reach 0 */
2586 2587
	WARN_ON_ONCE(!beacon->csa_current_counter);
	count = beacon->csa_current_counter;
2588

2589 2590 2591
unlock:
	rcu_read_unlock();
	return count;
2592
}
2593
EXPORT_SYMBOL(ieee80211_csa_update_counter);
2594 2595 2596 2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614

bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
	struct beacon_data *beacon = NULL;
	u8 *beacon_data;
	size_t beacon_data_len;
	int ret = false;

	if (!ieee80211_sdata_running(sdata))
		return false;

	rcu_read_lock();
	if (vif->type == NL80211_IFTYPE_AP) {
		struct ieee80211_if_ap *ap = &sdata->u.ap;

		beacon = rcu_dereference(ap->beacon);
		if (WARN_ON(!beacon || !beacon->tail))
			goto out;
		beacon_data = beacon->tail;
		beacon_data_len = beacon->tail_len;
2615 2616 2617 2618 2619 2620 2621
	} else if (vif->type == NL80211_IFTYPE_ADHOC) {
		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;

		beacon = rcu_dereference(ifibss->presp);
		if (!beacon)
			goto out;

2622 2623 2624 2625 2626 2627 2628 2629 2630
		beacon_data = beacon->head;
		beacon_data_len = beacon->head_len;
	} else if (vif->type == NL80211_IFTYPE_MESH_POINT) {
		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;

		beacon = rcu_dereference(ifmsh->beacon);
		if (!beacon)
			goto out;

2631 2632
		beacon_data = beacon->head;
		beacon_data_len = beacon->head_len;
2633 2634 2635 2636 2637
	} else {
		WARN_ON(1);
		goto out;
	}

2638 2639 2640
	if (!beacon->csa_counter_offsets[0])
		goto out;

2641
	if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
2642 2643
		goto out;

2644
	if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
2645 2646 2647 2648 2649 2650 2651 2652
		ret = true;
 out:
	rcu_read_unlock();

	return ret;
}
EXPORT_SYMBOL(ieee80211_csa_is_complete);

2653 2654 2655 2656 2657
static struct sk_buff *
__ieee80211_beacon_get(struct ieee80211_hw *hw,
		       struct ieee80211_vif *vif,
		       struct ieee80211_mutable_offsets *offs,
		       bool is_template)
2658 2659
{
	struct ieee80211_local *local = hw_to_local(hw);
2660
	struct beacon_data *beacon = NULL;
2661
	struct sk_buff *skb = NULL;
2662
	struct ieee80211_tx_info *info;
2663
	struct ieee80211_sub_if_data *sdata = NULL;
J
Johannes Berg 已提交
2664
	enum ieee80211_band band;
2665
	struct ieee80211_tx_rate_control txrc;
J
Johannes Berg 已提交
2666
	struct ieee80211_chanctx_conf *chanctx_conf;
2667
	int csa_off_base = 0;
2668

2669
	rcu_read_lock();
2670

2671
	sdata = vif_to_sdata(vif);
J
Johannes Berg 已提交
2672
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2673

J
Johannes Berg 已提交
2674
	if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
2675 2676
		goto out;

2677 2678
	if (offs)
		memset(offs, 0, sizeof(*offs));
2679

2680
	if (sdata->vif.type == NL80211_IFTYPE_AP) {
2681 2682
		struct ieee80211_if_ap *ap = &sdata->u.ap;

2683
		beacon = rcu_dereference(ap->beacon);
D
Dan Carpenter 已提交
2684
		if (beacon) {
2685
			if (beacon->csa_counter_offsets[0]) {
2686 2687 2688 2689 2690
				if (!is_template)
					ieee80211_csa_update_counter(vif);

				ieee80211_set_csa(sdata, beacon);
			}
2691

J
Johannes Berg 已提交
2692 2693 2694 2695 2696 2697
			/*
			 * headroom, head length,
			 * tail length and maximum TIM length
			 */
			skb = dev_alloc_skb(local->tx_headroom +
					    beacon->head_len +
2698 2699
					    beacon->tail_len + 256 +
					    local->hw.extra_beacon_tailroom);
J
Johannes Berg 已提交
2700 2701
			if (!skb)
				goto out;
2702

J
Johannes Berg 已提交
2703 2704 2705
			skb_reserve(skb, local->tx_headroom);
			memcpy(skb_put(skb, beacon->head_len), beacon->head,
			       beacon->head_len);
2706

2707 2708
			ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
						 is_template);
2709

2710 2711 2712
			if (offs) {
				offs->tim_offset = beacon->head_len;
				offs->tim_length = skb->len - beacon->head_len;
2713 2714 2715

				/* for AP the csa offsets are from tail */
				csa_off_base = skb->len;
2716
			}
2717

J
Johannes Berg 已提交
2718 2719 2720
			if (beacon->tail)
				memcpy(skb_put(skb, beacon->tail_len),
				       beacon->tail, beacon->tail_len);
2721 2722
		} else
			goto out;
2723
	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
2724
		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
2725
		struct ieee80211_hdr *hdr;
2726

2727 2728
		beacon = rcu_dereference(ifibss->presp);
		if (!beacon)
2729 2730
			goto out;

2731
		if (beacon->csa_counter_offsets[0]) {
2732 2733
			if (!is_template)
				ieee80211_csa_update_counter(vif);
2734

2735
			ieee80211_set_csa(sdata, beacon);
2736
		}
2737

2738
		skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
2739
				    local->hw.extra_beacon_tailroom);
2740 2741
		if (!skb)
			goto out;
2742
		skb_reserve(skb, local->tx_headroom);
2743 2744
		memcpy(skb_put(skb, beacon->head_len), beacon->head,
		       beacon->head_len);
2745 2746

		hdr = (struct ieee80211_hdr *) skb->data;
2747 2748
		hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						 IEEE80211_STYPE_BEACON);
J
Johannes Berg 已提交
2749
	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2750
		struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2751

2752 2753
		beacon = rcu_dereference(ifmsh->beacon);
		if (!beacon)
2754 2755
			goto out;

2756
		if (beacon->csa_counter_offsets[0]) {
2757 2758 2759 2760 2761 2762 2763 2764
			if (!is_template)
				/* TODO: For mesh csa_counter is in TU, so
				 * decrementing it by one isn't correct, but
				 * for now we leave it consistent with overall
				 * mac80211's behavior.
				 */
				ieee80211_csa_update_counter(vif);

2765
			ieee80211_set_csa(sdata, beacon);
2766
		}
2767

2768
		if (ifmsh->sync_ops)
2769
			ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
2770

2771
		skb = dev_alloc_skb(local->tx_headroom +
2772
				    beacon->head_len +
M
Marco Porsch 已提交
2773
				    256 + /* TIM IE */
2774
				    beacon->tail_len +
2775
				    local->hw.extra_beacon_tailroom);
J
Johannes Berg 已提交
2776 2777
		if (!skb)
			goto out;
T
Thomas Pedersen 已提交
2778
		skb_reserve(skb, local->tx_headroom);
2779 2780
		memcpy(skb_put(skb, beacon->head_len), beacon->head,
		       beacon->head_len);
2781 2782 2783
		ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);

		if (offs) {
2784 2785
			offs->tim_offset = beacon->head_len;
			offs->tim_length = skb->len - beacon->head_len;
2786 2787
		}

2788 2789
		memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
		       beacon->tail_len);
2790 2791
	} else {
		WARN_ON(1);
2792
		goto out;
2793 2794
	}

2795
	/* CSA offsets */
2796
	if (offs && beacon) {
2797 2798 2799
		int i;

		for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
2800
			u16 csa_off = beacon->csa_counter_offsets[i];
2801 2802 2803 2804 2805 2806 2807 2808

			if (!csa_off)
				continue;

			offs->csa_counter_offs[i] = csa_off_base + csa_off;
		}
	}

2809
	band = chanctx_conf->def.chan->band;
J
Johannes Berg 已提交
2810

2811 2812
	info = IEEE80211_SKB_CB(skb);

J
Johannes Berg 已提交
2813
	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2814
	info->flags |= IEEE80211_TX_CTL_NO_ACK;
2815
	info->band = band;
2816 2817 2818

	memset(&txrc, 0, sizeof(txrc));
	txrc.hw = hw;
2819
	txrc.sband = local->hw.wiphy->bands[band];
2820 2821 2822
	txrc.bss_conf = &sdata->vif.bss_conf;
	txrc.skb = skb;
	txrc.reported_rate.idx = -1;
2823
	txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
2824
	if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1)
2825 2826 2827
		txrc.max_rate_idx = -1;
	else
		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
2828
	txrc.bss = true;
2829
	rate_control_get_rate(sdata, NULL, &txrc);
2830 2831

	info->control.vif = vif;
2832

2833 2834 2835
	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
			IEEE80211_TX_CTL_ASSIGN_SEQ |
			IEEE80211_TX_CTL_FIRST_FRAGMENT;
2836
 out:
2837
	rcu_read_unlock();
2838
	return skb;
2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864

}

struct sk_buff *
ieee80211_beacon_get_template(struct ieee80211_hw *hw,
			      struct ieee80211_vif *vif,
			      struct ieee80211_mutable_offsets *offs)
{
	return __ieee80211_beacon_get(hw, vif, offs, true);
}
EXPORT_SYMBOL(ieee80211_beacon_get_template);

struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
					 struct ieee80211_vif *vif,
					 u16 *tim_offset, u16 *tim_length)
{
	struct ieee80211_mutable_offsets offs = {};
	struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);

	if (tim_offset)
		*tim_offset = offs.tim_offset;

	if (tim_length)
		*tim_length = offs.tim_length;

	return bcn;
2865
}
2866
EXPORT_SYMBOL(ieee80211_beacon_get_tim);
2867

2868 2869 2870 2871
struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
					struct ieee80211_vif *vif)
{
	struct ieee80211_if_ap *ap = NULL;
2872 2873
	struct sk_buff *skb = NULL;
	struct probe_resp *presp = NULL;
2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886
	struct ieee80211_hdr *hdr;
	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);

	if (sdata->vif.type != NL80211_IFTYPE_AP)
		return NULL;

	rcu_read_lock();

	ap = &sdata->u.ap;
	presp = rcu_dereference(ap->probe_resp);
	if (!presp)
		goto out;

2887
	skb = dev_alloc_skb(presp->len);
2888 2889 2890
	if (!skb)
		goto out;

2891 2892
	memcpy(skb_put(skb, presp->len), presp->data, presp->len);

2893 2894 2895 2896 2897 2898 2899 2900 2901
	hdr = (struct ieee80211_hdr *) skb->data;
	memset(hdr->addr1, 0, sizeof(hdr->addr1));

out:
	rcu_read_unlock();
	return skb;
}
EXPORT_SYMBOL(ieee80211_proberesp_get);

2902 2903 2904 2905 2906 2907 2908 2909 2910 2911 2912 2913 2914 2915 2916 2917 2918
struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
				     struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_if_managed *ifmgd;
	struct ieee80211_pspoll *pspoll;
	struct ieee80211_local *local;
	struct sk_buff *skb;

	if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
		return NULL;

	sdata = vif_to_sdata(vif);
	ifmgd = &sdata->u.mgd;
	local = sdata->local;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
2919
	if (!skb)
2920
		return NULL;
2921

2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956
	skb_reserve(skb, local->hw.extra_tx_headroom);

	pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
	memset(pspoll, 0, sizeof(*pspoll));
	pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
					    IEEE80211_STYPE_PSPOLL);
	pspoll->aid = cpu_to_le16(ifmgd->aid);

	/* aid in PS-Poll has its two MSBs each set to 1 */
	pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);

	memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
	memcpy(pspoll->ta, vif->addr, ETH_ALEN);

	return skb;
}
EXPORT_SYMBOL(ieee80211_pspoll_get);

struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
				       struct ieee80211_vif *vif)
{
	struct ieee80211_hdr_3addr *nullfunc;
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_if_managed *ifmgd;
	struct ieee80211_local *local;
	struct sk_buff *skb;

	if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
		return NULL;

	sdata = vif_to_sdata(vif);
	ifmgd = &sdata->u.mgd;
	local = sdata->local;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
2957
	if (!skb)
2958
		return NULL;
2959

2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
							  sizeof(*nullfunc));
	memset(nullfunc, 0, sizeof(*nullfunc));
	nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
					      IEEE80211_STYPE_NULLFUNC |
					      IEEE80211_FCTL_TODS);
	memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
	memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);

	return skb;
}
EXPORT_SYMBOL(ieee80211_nullfunc_get);

2976
struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
2977
				       const u8 *src_addr,
2978
				       const u8 *ssid, size_t ssid_len,
2979
				       size_t tailroom)
2980
{
2981
	struct ieee80211_local *local = hw_to_local(hw);
2982 2983 2984 2985 2986 2987 2988 2989
	struct ieee80211_hdr_3addr *hdr;
	struct sk_buff *skb;
	size_t ie_ssid_len;
	u8 *pos;

	ie_ssid_len = 2 + ssid_len;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
2990
			    ie_ssid_len + tailroom);
2991
	if (!skb)
2992 2993 2994 2995 2996 2997 2998 2999
		return NULL;

	skb_reserve(skb, local->hw.extra_tx_headroom);

	hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
	memset(hdr, 0, sizeof(*hdr));
	hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					 IEEE80211_STYPE_PROBE_REQ);
J
Johannes Berg 已提交
3000
	eth_broadcast_addr(hdr->addr1);
3001
	memcpy(hdr->addr2, src_addr, ETH_ALEN);
J
Johannes Berg 已提交
3002
	eth_broadcast_addr(hdr->addr3);
3003 3004 3005 3006

	pos = skb_put(skb, ie_ssid_len);
	*pos++ = WLAN_EID_SSID;
	*pos++ = ssid_len;
3007
	if (ssid_len)
3008 3009 3010 3011 3012 3013 3014
		memcpy(pos, ssid, ssid_len);
	pos += ssid_len;

	return skb;
}
EXPORT_SYMBOL(ieee80211_probereq_get);

3015
void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3016
		       const void *frame, size_t frame_len,
3017
		       const struct ieee80211_tx_info *frame_txctl,
3018 3019 3020 3021
		       struct ieee80211_rts *rts)
{
	const struct ieee80211_hdr *hdr = frame;

3022 3023
	rts->frame_control =
	    cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
3024 3025
	rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
					       frame_txctl);
3026 3027 3028 3029 3030
	memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
	memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
}
EXPORT_SYMBOL(ieee80211_rts_get);

3031
void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
3032
			     const void *frame, size_t frame_len,
3033
			     const struct ieee80211_tx_info *frame_txctl,
3034 3035 3036 3037
			     struct ieee80211_cts *cts)
{
	const struct ieee80211_hdr *hdr = frame;

3038 3039
	cts->frame_control =
	    cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
3040 3041
	cts->duration = ieee80211_ctstoself_duration(hw, vif,
						     frame_len, frame_txctl);
3042 3043 3044 3045 3046
	memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
}
EXPORT_SYMBOL(ieee80211_ctstoself_get);

struct sk_buff *
3047
ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
3048
			  struct ieee80211_vif *vif)
3049 3050
{
	struct ieee80211_local *local = hw_to_local(hw);
3051
	struct sk_buff *skb = NULL;
3052
	struct ieee80211_tx_data tx;
3053
	struct ieee80211_sub_if_data *sdata;
3054
	struct ps_data *ps;
3055
	struct ieee80211_tx_info *info;
J
Johannes Berg 已提交
3056
	struct ieee80211_chanctx_conf *chanctx_conf;
3057

3058
	sdata = vif_to_sdata(vif);
3059 3060

	rcu_read_lock();
J
Johannes Berg 已提交
3061
	chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3062

3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073
	if (!chanctx_conf)
		goto out;

	if (sdata->vif.type == NL80211_IFTYPE_AP) {
		struct beacon_data *beacon =
				rcu_dereference(sdata->u.ap.beacon);

		if (!beacon || !beacon->head)
			goto out;

		ps = &sdata->u.ap.ps;
M
Marco Porsch 已提交
3074 3075
	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
		ps = &sdata->u.mesh.ps;
3076
	} else {
3077
		goto out;
3078
	}
3079

3080
	if (ps->dtim_count != 0 || !ps->dtim_bc_mc)
3081
		goto out; /* send buffered bc/mc only after DTIM beacon */
3082

3083
	while (1) {
3084
		skb = skb_dequeue(&ps->bc_buf);
3085
		if (!skb)
3086
			goto out;
3087 3088
		local->total_ps_buffered--;

3089
		if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) {
3090 3091 3092 3093 3094 3095 3096 3097 3098
			struct ieee80211_hdr *hdr =
				(struct ieee80211_hdr *) skb->data;
			/* more buffered multicast/broadcast frames ==> set
			 * MoreData flag in IEEE 802.11 header to inform PS
			 * STAs */
			hdr->frame_control |=
				cpu_to_le16(IEEE80211_FCTL_MOREDATA);
		}

3099
		if (sdata->vif.type == NL80211_IFTYPE_AP)
3100
			sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
J
Johannes Berg 已提交
3101
		if (!ieee80211_tx_prepare(sdata, &tx, skb))
3102 3103 3104
			break;
		dev_kfree_skb_any(skb);
	}
3105 3106 3107

	info = IEEE80211_SKB_CB(skb);

3108
	tx.flags |= IEEE80211_TX_PS_BUFFERED;
3109
	info->band = chanctx_conf->def.chan->band;
3110

3111
	if (invoke_tx_handlers(&tx))
3112
		skb = NULL;
3113
 out:
3114
	rcu_read_unlock();
3115 3116 3117 3118

	return skb;
}
EXPORT_SYMBOL(ieee80211_get_buffered_bc);
J
Johannes Berg 已提交
3119

3120 3121 3122 3123 3124 3125 3126 3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137 3138 3139 3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167
int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
{
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
	int ret;
	u32 queues;

	lockdep_assert_held(&local->sta_mtx);

	/* only some cases are supported right now */
	switch (sdata->vif.type) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
		break;
	default:
		WARN_ON(1);
		return -EINVAL;
	}

	if (WARN_ON(tid >= IEEE80211_NUM_UPS))
		return -EINVAL;

	if (sta->reserved_tid == tid) {
		ret = 0;
		goto out;
	}

	if (sta->reserved_tid != IEEE80211_TID_UNRESERVED) {
		sdata_err(sdata, "TID reservation already active\n");
		ret = -EALREADY;
		goto out;
	}

	ieee80211_stop_vif_queues(sdata->local, sdata,
				  IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);

	synchronize_net();

	/* Tear down BA sessions so we stop aggregating on this TID */
	if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) {
		set_sta_flag(sta, WLAN_STA_BLOCK_BA);
		__ieee80211_stop_tx_ba_session(sta, tid,
					       AGG_STOP_LOCAL_REQUEST);
	}

	queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
3168
	__ieee80211_flush_queues(local, sdata, queues, false);
3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200 3201 3202 3203 3204 3205 3206 3207 3208 3209 3210

	sta->reserved_tid = tid;

	ieee80211_wake_vif_queues(local, sdata,
				  IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);

	if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
		clear_sta_flag(sta, WLAN_STA_BLOCK_BA);

	ret = 0;
 out:
	return ret;
}
EXPORT_SYMBOL(ieee80211_reserve_tid);

void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
{
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
	struct ieee80211_sub_if_data *sdata = sta->sdata;

	lockdep_assert_held(&sdata->local->sta_mtx);

	/* only some cases are supported right now */
	switch (sdata->vif.type) {
	case NL80211_IFTYPE_STATION:
	case NL80211_IFTYPE_AP:
	case NL80211_IFTYPE_AP_VLAN:
		break;
	default:
		WARN_ON(1);
		return;
	}

	if (tid != sta->reserved_tid) {
		sdata_err(sdata, "TID to unreserve (%d) isn't reserved\n", tid);
		return;
	}

	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
}
EXPORT_SYMBOL(ieee80211_unreserve_tid);

J
Johannes Berg 已提交
3211 3212 3213
void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
				 struct sk_buff *skb, int tid,
				 enum ieee80211_band band)
J
Johannes Berg 已提交
3214
{
3215
	int ac = ieee802_1d_to_ac[tid & 7];
3216

J
Johannes Berg 已提交
3217 3218 3219 3220
	skb_set_mac_header(skb, 0);
	skb_set_network_header(skb, 0);
	skb_set_transport_header(skb, 0);

3221
	skb_set_queue_mapping(skb, ac);
3222
	skb->priority = tid;
3223

3224 3225
	skb->dev = sdata->dev;

3226 3227 3228 3229 3230 3231
	/*
	 * The other path calling ieee80211_xmit is from the tasklet,
	 * and while we can handle concurrent transmissions locking
	 * requirements are that we do not come into tx with bhs on.
	 */
	local_bh_disable();
3232 3233
	IEEE80211_SKB_CB(skb)->band = band;
	ieee80211_xmit(sdata, skb);
3234
	local_bh_enable();
J
Johannes Berg 已提交
3235
}