tx.c 65.0 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 * Copyright 2007	Johannes Berg <johannes@sipsolutions.net>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 *
 * Transmit and frame generation functions.
 */

#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/skbuff.h>
#include <linux/etherdevice.h>
#include <linux/bitmap.h>
20
#include <linux/rcupdate.h>
21
#include <net/net_namespace.h>
22 23 24 25 26 27
#include <net/ieee80211_radiotap.h>
#include <net/cfg80211.h>
#include <net/mac80211.h>
#include <asm/unaligned.h>

#include "ieee80211_i.h"
28
#include "driver-ops.h"
J
Johannes Berg 已提交
29
#include "led.h"
30
#include "mesh.h"
31 32 33
#include "wep.h"
#include "wpa.h"
#include "wme.h"
J
Johannes Berg 已提交
34
#include "rate.h"
35 36 37

#define IEEE80211_TX_OK		0
#define IEEE80211_TX_AGAIN	1
J
Johannes Berg 已提交
38
#define IEEE80211_TX_PENDING	2
39 40 41

/* misc utils */

J
Johannes Berg 已提交
42 43
static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
				 int next_frag_len)
44 45
{
	int rate, mrate, erp, dur, i;
46
	struct ieee80211_rate *txrate;
47
	struct ieee80211_local *local = tx->local;
48
	struct ieee80211_supported_band *sband;
49
	struct ieee80211_hdr *hdr;
50 51 52 53 54 55 56 57 58
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

	/* assume HW handles this */
	if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
		return 0;

	/* uh huh? */
	if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
		return 0;
59

60
	sband = local->hw.wiphy->bands[tx->channel->band];
61
	txrate = &sband->bitrates[info->control.rates[0].idx];
62

63
	erp = txrate->flags & IEEE80211_RATE_ERP_G;
64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81

	/*
	 * data and mgmt (except PS Poll):
	 * - during CFP: 32768
	 * - during contention period:
	 *   if addr1 is group address: 0
	 *   if more fragments = 0 and addr1 is individual address: time to
	 *      transmit one ACK plus SIFS
	 *   if more fragments = 1 and addr1 is individual address: time to
	 *      transmit next fragment plus 2 x ACK plus 3 x SIFS
	 *
	 * IEEE 802.11, 9.6:
	 * - control response frame (CTS or ACK) shall be transmitted using the
	 *   same rate as the immediately previous frame in the frame exchange
	 *   sequence, if this rate belongs to the PHY mandatory rates, or else
	 *   at the highest possible rate belonging to the PHY rates in the
	 *   BSSBasicRateSet
	 */
82 83
	hdr = (struct ieee80211_hdr *)tx->skb->data;
	if (ieee80211_is_ctl(hdr->frame_control)) {
84
		/* TODO: These control frames are not currently sent by
J
Johannes Berg 已提交
85
		 * mac80211, but should they be implemented, this function
86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102
		 * needs to be updated to support duration field calculation.
		 *
		 * RTS: time needed to transmit pending data/mgmt frame plus
		 *    one CTS frame plus one ACK frame plus 3 x SIFS
		 * CTS: duration of immediately previous RTS minus time
		 *    required to transmit CTS and its SIFS
		 * ACK: 0 if immediately previous directed data/mgmt had
		 *    more=0, with more=1 duration in ACK frame is duration
		 *    from previous frame minus time needed to transmit ACK
		 *    and its SIFS
		 * PS Poll: BIT(15) | BIT(14) | aid
		 */
		return 0;
	}

	/* data/mgmt */
	if (0 /* FIX: data/mgmt during CFP */)
J
Johannes Berg 已提交
103
		return cpu_to_le16(32768);
104 105 106 107 108 109 110 111 112 113 114 115 116 117 118

	if (group_addr) /* Group address as the destination - no ACK */
		return 0;

	/* Individual destination address:
	 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
	 * CTS and ACK frames shall be transmitted using the highest rate in
	 * basic rate set that is less than or equal to the rate of the
	 * immediately previous frame and that is using the same modulation
	 * (CCK or OFDM). If no basic rate set matches with these requirements,
	 * the highest mandatory rate of the PHY that is less than or equal to
	 * the rate of the previous frame is used.
	 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
	 */
	rate = -1;
119 120 121 122
	/* use lowest available if everything fails */
	mrate = sband->bitrates[0].bitrate;
	for (i = 0; i < sband->n_bitrates; i++) {
		struct ieee80211_rate *r = &sband->bitrates[i];
123

124 125
		if (r->bitrate > txrate->bitrate)
			break;
126

J
Johannes Berg 已提交
127
		if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148
			rate = r->bitrate;

		switch (sband->band) {
		case IEEE80211_BAND_2GHZ: {
			u32 flag;
			if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
				flag = IEEE80211_RATE_MANDATORY_G;
			else
				flag = IEEE80211_RATE_MANDATORY_B;
			if (r->flags & flag)
				mrate = r->bitrate;
			break;
		}
		case IEEE80211_BAND_5GHZ:
			if (r->flags & IEEE80211_RATE_MANDATORY_A)
				mrate = r->bitrate;
			break;
		case IEEE80211_NUM_BANDS:
			WARN_ON(1);
			break;
		}
149 150 151 152 153 154 155 156 157 158 159 160
	}
	if (rate == -1) {
		/* No matching basic rate found; use highest suitable mandatory
		 * PHY rate */
		rate = mrate;
	}

	/* Time needed to transmit ACK
	 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
	 * to closest integer */

	dur = ieee80211_frame_duration(local, 10, rate, erp,
J
Johannes Berg 已提交
161
				tx->sdata->vif.bss_conf.use_short_preamble);
162 163 164 165 166 167 168

	if (next_frag_len) {
		/* Frame is fragmented: duration increases with time needed to
		 * transmit next fragment plus ACK and 2 x SIFS. */
		dur *= 2; /* ACK + SIFS */
		/* next fragment */
		dur += ieee80211_frame_duration(local, next_frag_len,
169
				txrate->bitrate, erp,
J
Johannes Berg 已提交
170
				tx->sdata->vif.bss_conf.use_short_preamble);
171 172
	}

J
Johannes Berg 已提交
173
	return cpu_to_le16(dur);
174 175
}

176 177
static int inline is_ieee80211_device(struct ieee80211_local *local,
				      struct net_device *dev)
178
{
179
	return local == wdev_priv(dev->ieee80211_ptr);
180 181 182 183
}

/* tx handlers */

184
static ieee80211_tx_result debug_noinline
185
ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
186
{
187

188 189
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
190 191
	u32 sta_flags;

192
	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
193
		return TX_CONTINUE;
194

195
	if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
196 197 198 199 200 201 202 203 204 205 206 207 208
	    !ieee80211_is_probe_req(hdr->frame_control) &&
	    !ieee80211_is_nullfunc(hdr->frame_control))
		/*
		 * When software scanning only nullfunc frames (to notify
		 * the sleep state to the AP) and probe requests (for the
		 * active scan) are allowed, all other frames should not be
		 * sent and we should not get here, but if we do
		 * nonetheless, drop them to avoid sending them
		 * off-channel. See the link below and
		 * ieee80211_start_scan() for more.
		 *
		 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
		 */
209
		return TX_DROP;
210

211
	if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
212 213
		return TX_CONTINUE;

214
	if (tx->flags & IEEE80211_TX_PS_BUFFERED)
215
		return TX_CONTINUE;
216

217
	sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
218

219
	if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
220
		if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
221
			     tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
222
			     ieee80211_is_data(hdr->frame_control))) {
223 224
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
			printk(KERN_DEBUG "%s: dropped data frame to not "
225
			       "associated station %pM\n",
226
			       tx->sdata->name, hdr->addr1);
227 228
#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
			I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
229
			return TX_DROP;
230 231
		}
	} else {
232
		if (unlikely(ieee80211_is_data(hdr->frame_control) &&
233
			     tx->local->num_sta == 0 &&
234
			     tx->sdata->vif.type != NL80211_IFTYPE_ADHOC)) {
235 236 237 238
			/*
			 * No associated STAs - no need to send multicast
			 * frames.
			 */
239
			return TX_DROP;
240
		}
241
		return TX_CONTINUE;
242 243
	}

244
	return TX_CONTINUE;
245 246 247 248 249 250 251 252 253 254 255 256 257
}

/* This function is called whenever the AP is about to exceed the maximum limit
 * of buffered frames for power saving STAs. This situation should not really
 * happen often during normal operation, so dropping the oldest buffered packet
 * from each queue should be OK to make some room for new frames. */
static void purge_old_ps_buffers(struct ieee80211_local *local)
{
	int total = 0, purged = 0;
	struct sk_buff *skb;
	struct ieee80211_sub_if_data *sdata;
	struct sta_info *sta;

258 259 260 261 262 263
	/*
	 * virtual interfaces are protected by RCU
	 */
	rcu_read_lock();

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
264
		struct ieee80211_if_ap *ap;
265
		if (sdata->vif.type != NL80211_IFTYPE_AP)
266 267 268 269 270 271 272 273 274 275
			continue;
		ap = &sdata->u.ap;
		skb = skb_dequeue(&ap->ps_bc_buf);
		if (skb) {
			purged++;
			dev_kfree_skb(skb);
		}
		total += skb_queue_len(&ap->ps_bc_buf);
	}

276
	list_for_each_entry_rcu(sta, &local->sta_list, list) {
277 278 279 280 281 282 283
		skb = skb_dequeue(&sta->ps_tx_buf);
		if (skb) {
			purged++;
			dev_kfree_skb(skb);
		}
		total += skb_queue_len(&sta->ps_tx_buf);
	}
284 285

	rcu_read_unlock();
286 287

	local->total_ps_buffered = total;
288
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
289
	printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
290
	       wiphy_name(local->hw.wiphy), purged);
291
#endif
292 293
}

294
static ieee80211_tx_result
295
ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
296
{
297
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
298
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
299

300 301 302 303 304 305 306 307
	/*
	 * broadcast/multicast frame
	 *
	 * If any of the associated stations is in power save mode,
	 * the frame is buffered to be sent after DTIM beacon frame.
	 * This is done either by the hardware or us.
	 */

308 309 310 311 312
	/* powersaving STAs only in AP/VLAN mode */
	if (!tx->sdata->bss)
		return TX_CONTINUE;

	/* no buffering for ordered frames */
313
	if (ieee80211_has_order(hdr->frame_control))
314
		return TX_CONTINUE;
315 316 317

	/* no stations in PS mode */
	if (!atomic_read(&tx->sdata->bss->num_sta_ps))
318
		return TX_CONTINUE;
319

320
	info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
J
Johannes Berg 已提交
321

322 323
	/* device releases frame after DTIM beacon */
	if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
J
Johannes Berg 已提交
324 325
		return TX_CONTINUE;

326
	/* buffered in mac80211 */
J
Johannes Berg 已提交
327 328 329 330
	if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
		purge_old_ps_buffers(tx->local);

	if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= AP_MAX_BC_BUFFER) {
331
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
J
Johannes Berg 已提交
332 333
		if (net_ratelimit())
			printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
334
			       tx->sdata->name);
335
#endif
J
Johannes Berg 已提交
336 337 338
		dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
	} else
		tx->local->total_ps_buffered++;
339

J
Johannes Berg 已提交
340
	skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
341

J
Johannes Berg 已提交
342
	return TX_QUEUED;
343 344
}

345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360
static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
			     struct sk_buff *skb)
{
	if (!ieee80211_is_mgmt(fc))
		return 0;

	if (sta == NULL || !test_sta_flags(sta, WLAN_STA_MFP))
		return 0;

	if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
					    skb->data))
		return 0;

	return 1;
}

361
static ieee80211_tx_result
362
ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
363 364
{
	struct sta_info *sta = tx->sta;
365
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
366
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
367
	u32 staflags;
368

369 370 371 372 373
	if (unlikely(!sta ||
		     ieee80211_is_probe_resp(hdr->frame_control) ||
		     ieee80211_is_auth(hdr->frame_control) ||
		     ieee80211_is_assoc_resp(hdr->frame_control) ||
		     ieee80211_is_reassoc_resp(hdr->frame_control)))
374
		return TX_CONTINUE;
375

376 377
	staflags = get_sta_flags(sta);

378
	if (unlikely((staflags & (WLAN_STA_PS_STA | WLAN_STA_PS_DRIVER)) &&
379
		     !(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE))) {
380
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
381
		printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
382
		       "before %d)\n",
383
		       sta->sta.addr, sta->sta.aid,
384 385 386 387 388 389
		       skb_queue_len(&sta->ps_tx_buf));
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
		if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
			purge_old_ps_buffers(tx->local);
		if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
			struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
390
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
391
			if (net_ratelimit()) {
392
				printk(KERN_DEBUG "%s: STA %pM TX "
393
				       "buffer full - dropping oldest frame\n",
394
				       tx->sdata->name, sta->sta.addr);
395
			}
396
#endif
397 398 399
			dev_kfree_skb(old);
		} else
			tx->local->total_ps_buffered++;
400

401 402 403 404 405 406 407
		/*
		 * Queue frame to be sent after STA wakes up/polls,
		 * but don't set the TIM bit if the driver is blocking
		 * wakeup or poll response transmissions anyway.
		 */
		if (skb_queue_empty(&sta->ps_tx_buf) &&
		    !(staflags & WLAN_STA_PS_DRIVER))
408 409
			sta_info_set_tim_bit(sta);

410
		info->control.jiffies = jiffies;
411
		info->control.vif = &tx->sdata->vif;
412
		info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
413
		skb_queue_tail(&sta->ps_tx_buf, tx->skb);
414
		return TX_QUEUED;
415 416
	}
#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
417
	else if (unlikely(staflags & WLAN_STA_PS_STA)) {
418
		printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
419
		       "set -> send frame\n", tx->sdata->name,
420
		       sta->sta.addr);
421 422 423
	}
#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */

424
	return TX_CONTINUE;
425 426
}

427
static ieee80211_tx_result debug_noinline
428
ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
429
{
430
	if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
431
		return TX_CONTINUE;
432

433
	if (tx->flags & IEEE80211_TX_UNICAST)
434 435 436 437 438
		return ieee80211_tx_h_unicast_ps_buf(tx);
	else
		return ieee80211_tx_h_multicast_ps_buf(tx);
}

439
static ieee80211_tx_result debug_noinline
440
ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
441
{
442
	struct ieee80211_key *key = NULL;
443
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
444
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
445

J
Johannes Berg 已提交
446
	if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
447
		tx->key = NULL;
448 449
	else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
		tx->key = key;
450 451 452
	else if (ieee80211_is_mgmt(hdr->frame_control) &&
		 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
		tx->key = key;
453 454
	else if ((key = rcu_dereference(tx->sdata->default_key)))
		tx->key = key;
455
	else if (tx->sdata->drop_unencrypted &&
456
		 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
457 458 459 460
		 !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
		 (!ieee80211_is_robust_mgmt_frame(hdr) ||
		  (ieee80211_is_action(hdr->frame_control) &&
		   tx->sta && test_sta_flags(tx->sta, WLAN_STA_MFP)))) {
461
		I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
462
		return TX_DROP;
463
	} else
464 465 466 467
		tx->key = NULL;

	if (tx->key) {
		tx->key->tx_rx_count++;
468
		/* TODO: add threshold stuff again */
469 470 471

		switch (tx->key->conf.alg) {
		case ALG_WEP:
472
			if (ieee80211_is_auth(hdr->frame_control))
473 474
				break;
		case ALG_TKIP:
475
			if (!ieee80211_is_data_present(hdr->frame_control))
476 477
				tx->key = NULL;
			break;
478 479 480 481 482 483
		case ALG_CCMP:
			if (!ieee80211_is_data_present(hdr->frame_control) &&
			    !ieee80211_use_mfp(hdr->frame_control, tx->sta,
					       tx->skb))
				tx->key = NULL;
			break;
484 485 486 487
		case ALG_AES_CMAC:
			if (!ieee80211_is_mgmt(hdr->frame_control))
				tx->key = NULL;
			break;
488
		}
489 490
	}

491
	if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
J
Johannes Berg 已提交
492
		info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
493

494
	return TX_CONTINUE;
495 496
}

497
static ieee80211_tx_result debug_noinline
498
ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
499
{
500
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
501 502 503 504 505 506
	struct ieee80211_hdr *hdr = (void *)tx->skb->data;
	struct ieee80211_supported_band *sband;
	struct ieee80211_rate *rate;
	int i, len;
	bool inval = false, rts = false, short_preamble = false;
	struct ieee80211_tx_rate_control txrc;
507
	u32 sta_flags;
508

509
	memset(&txrc, 0, sizeof(txrc));
510

511
	sband = tx->local->hw.wiphy->bands[tx->channel->band];
512

513
	len = min_t(int, tx->skb->len + FCS_LEN,
514
			 tx->local->hw.wiphy->frag_threshold);
515 516 517 518 519 520 521

	/* set up the tx rate control struct we give the RC algo */
	txrc.hw = local_to_hw(tx->local);
	txrc.sband = sband;
	txrc.bss_conf = &tx->sdata->vif.bss_conf;
	txrc.skb = tx->skb;
	txrc.reported_rate.idx = -1;
522 523 524 525 526
	txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[tx->channel->band];
	if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
		txrc.max_rate_idx = -1;
	else
		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
527
	txrc.ap = tx->sdata->vif.type == NL80211_IFTYPE_AP;
528 529

	/* set up RTS protection if desired */
530
	if (len > tx->local->hw.wiphy->rts_threshold) {
531
		txrc.rts = rts = true;
532 533
	}

534 535 536 537 538 539 540 541 542 543
	/*
	 * Use short preamble if the BSS can handle it, but not for
	 * management frames unless we know the receiver can handle
	 * that -- the management frame might be to a station that
	 * just wants a probe response.
	 */
	if (tx->sdata->vif.bss_conf.use_short_preamble &&
	    (ieee80211_is_data(hdr->frame_control) ||
	     (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
		txrc.short_preamble = short_preamble = true;
544

545 546 547 548 549 550
	sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;

	/*
	 * Lets not bother rate control if we're associated and cannot
	 * talk to the sta. This should not happen.
	 */
551
	if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) &&
552 553 554 555 556
		 (sta_flags & WLAN_STA_ASSOC) &&
		 !rate_usable_index_exists(sband, &tx->sta->sta),
		 "%s: Dropped data frame as no usable bitrate found while "
		 "scanning and associated. Target station: "
		 "%pM on %d GHz band\n",
557
		 tx->sdata->name, hdr->addr1,
558 559
		 tx->channel->band ? 5 : 2))
		return TX_DROP;
560

561 562 563 564
	/*
	 * If we're associated with the sta at this point we know we can at
	 * least send the frame at the lowest bit rate.
	 */
565 566 567 568 569 570 571
	rate_control_get_rate(tx->sdata, tx->sta, &txrc);

	if (unlikely(info->control.rates[0].idx < 0))
		return TX_DROP;

	if (txrc.reported_rate.idx < 0)
		txrc.reported_rate = info->control.rates[0];
572

573
	if (tx->sta)
574
		tx->sta->last_tx_rate = txrc.reported_rate;
575

576 577
	if (unlikely(!info->control.rates[0].count))
		info->control.rates[0].count = 1;
578

579 580 581 582
	if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
			 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
		info->control.rates[0].count = 1;

583 584 585 586 587
	if (is_multicast_ether_addr(hdr->addr1)) {
		/*
		 * XXX: verify the rate is in the basic rateset
		 */
		return TX_CONTINUE;
588 589
	}

590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614
	/*
	 * set up the RTS/CTS rate as the fastest basic rate
	 * that is not faster than the data rate
	 *
	 * XXX: Should this check all retry rates?
	 */
	if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
		s8 baserate = 0;

		rate = &sband->bitrates[info->control.rates[0].idx];

		for (i = 0; i < sband->n_bitrates; i++) {
			/* must be a basic rate */
			if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
				continue;
			/* must not be faster than the data rate */
			if (sband->bitrates[i].bitrate > rate->bitrate)
				continue;
			/* maximum */
			if (sband->bitrates[baserate].bitrate <
			     sband->bitrates[i].bitrate)
				baserate = i;
		}

		info->control.rts_cts_rate_idx = baserate;
615 616
	}

617 618 619 620 621 622 623 624 625 626 627 628 629 630
	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
		/*
		 * make sure there's no valid rate following
		 * an invalid one, just in case drivers don't
		 * take the API seriously to stop at -1.
		 */
		if (inval) {
			info->control.rates[i].idx = -1;
			continue;
		}
		if (info->control.rates[i].idx < 0) {
			inval = true;
			continue;
		}
631

632 633 634 635 636 637 638 639
		/*
		 * For now assume MCS is already set up correctly, this
		 * needs to be fixed.
		 */
		if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
			WARN_ON(info->control.rates[i].idx > 76);
			continue;
		}
640

641 642 643 644
		/* set up RTS protection if desired */
		if (rts)
			info->control.rates[i].flags |=
				IEEE80211_TX_RC_USE_RTS_CTS;
645

646
		/* RC is busted */
S
Sujith 已提交
647 648
		if (WARN_ON_ONCE(info->control.rates[i].idx >=
				 sband->n_bitrates)) {
649 650
			info->control.rates[i].idx = -1;
			continue;
651
		}
652

653 654 655 656 657 658 659 660 661 662 663 664 665
		rate = &sband->bitrates[info->control.rates[i].idx];

		/* set up short preamble */
		if (short_preamble &&
		    rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
			info->control.rates[i].flags |=
				IEEE80211_TX_RC_USE_SHORT_PREAMBLE;

		/* set up G protection */
		if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
		    rate->flags & IEEE80211_RATE_ERP_G)
			info->control.rates[i].flags |=
				IEEE80211_TX_RC_USE_CTS_PROTECT;
666 667
	}

668 669 670 671 672 673 674 675
	return TX_CONTINUE;
}

static ieee80211_tx_result debug_noinline
ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
{
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

676
	if (tx->sta)
677
		info->control.sta = &tx->sta->sta;
678 679 680 681

	return TX_CONTINUE;
}

682 683 684 685 686 687 688 689 690
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
{
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
	u16 *seq;
	u8 *qc;
	int tid;

691 692 693 694 695
	/*
	 * Packet injection may want to control the sequence
	 * number, if we have no matching interface then we
	 * neither assign one ourselves nor ask the driver to.
	 */
696
	if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
697 698
		return TX_CONTINUE;

699 700 701 702 703 704
	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
		return TX_CONTINUE;

	if (ieee80211_hdrlen(hdr->frame_control) < 24)
		return TX_CONTINUE;

J
Johannes Berg 已提交
705 706 707 708 709
	/*
	 * Anything but QoS data that has a sequence number field
	 * (is long enough) gets a sequence number from the global
	 * counter.
	 */
710
	if (!ieee80211_is_data_qos(hdr->frame_control)) {
J
Johannes Berg 已提交
711
		/* driver should assign sequence number */
712
		info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
J
Johannes Berg 已提交
713 714 715
		/* for pure STA mode without beacons, we can do it */
		hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
		tx->sdata->sequence_number += 0x10;
716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740
		return TX_CONTINUE;
	}

	/*
	 * This should be true for injected/management frames only, for
	 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
	 * above since they are not QoS-data frames.
	 */
	if (!tx->sta)
		return TX_CONTINUE;

	/* include per-STA, per-TID sequence counter */

	qc = ieee80211_get_qos_ctl(hdr);
	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
	seq = &tx->sta->tid_seq[tid];

	hdr->seq_ctrl = cpu_to_le16(*seq);

	/* Increase the sequence number. */
	*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;

	return TX_CONTINUE;
}

J
Johannes Berg 已提交
741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785
static int ieee80211_fragment(struct ieee80211_local *local,
			      struct sk_buff *skb, int hdrlen,
			      int frag_threshold)
{
	struct sk_buff *tail = skb, *tmp;
	int per_fragm = frag_threshold - hdrlen - FCS_LEN;
	int pos = hdrlen + per_fragm;
	int rem = skb->len - hdrlen - per_fragm;

	if (WARN_ON(rem < 0))
		return -EINVAL;

	while (rem) {
		int fraglen = per_fragm;

		if (fraglen > rem)
			fraglen = rem;
		rem -= fraglen;
		tmp = dev_alloc_skb(local->tx_headroom +
				    frag_threshold +
				    IEEE80211_ENCRYPT_HEADROOM +
				    IEEE80211_ENCRYPT_TAILROOM);
		if (!tmp)
			return -ENOMEM;
		tail->next = tmp;
		tail = tmp;
		skb_reserve(tmp, local->tx_headroom +
				 IEEE80211_ENCRYPT_HEADROOM);
		/* copy control information */
		memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
		skb_copy_queue_mapping(tmp, skb);
		tmp->priority = skb->priority;
		tmp->dev = skb->dev;

		/* copy header and data */
		memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
		memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);

		pos += fraglen;
	}

	skb->len = hdrlen + per_fragm;
	return 0;
}

786
static ieee80211_tx_result debug_noinline
787 788
ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
{
J
Johannes Berg 已提交
789 790 791
	struct sk_buff *skb = tx->skb;
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
	struct ieee80211_hdr *hdr = (void *)skb->data;
792
	int frag_threshold = tx->local->hw.wiphy->frag_threshold;
J
Johannes Berg 已提交
793 794
	int hdrlen;
	int fragnum;
795 796 797 798

	if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
		return TX_CONTINUE;

799 800
	/*
	 * Warn when submitting a fragmented A-MPDU frame and drop it.
J
Johannes Berg 已提交
801
	 * This scenario is handled in ieee80211_tx_prepare but extra
802
	 * caution taken here as fragmented ampdu may cause Tx stop.
803
	 */
S
Sujith 已提交
804
	if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
805 806
		return TX_DROP;

807
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
808

J
Johannes Berg 已提交
809
	/* internal error, why is TX_FRAGMENTED set? */
810
	if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
J
Johannes Berg 已提交
811
		return TX_DROP;
812

J
Johannes Berg 已提交
813 814 815 816 817 818 819 820 821 822
	/*
	 * Now fragment the frame. This will allocate all the fragments and
	 * chain them (using skb as the first fragment) to skb->next.
	 * During transmission, we will remove the successfully transmitted
	 * fragments from this list. When the low-level driver rejects one
	 * of the fragments then we will simply pretend to accept the skb
	 * but store it away as pending.
	 */
	if (ieee80211_fragment(tx->local, skb, hdrlen, frag_threshold))
		return TX_DROP;
823

J
Johannes Berg 已提交
824 825 826 827 828
	/* update duration/seq/flags of fragments */
	fragnum = 0;
	do {
		int next_len;
		const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
829

J
Johannes Berg 已提交
830 831
		hdr = (void *)skb->data;
		info = IEEE80211_SKB_CB(skb);
832

J
Johannes Berg 已提交
833 834 835
		if (skb->next) {
			hdr->frame_control |= morefrags;
			next_len = skb->next->len;
836 837 838 839 840 841 842 843 844 845
			/*
			 * No multi-rate retries for fragmented frames, that
			 * would completely throw off the NAV at other STAs.
			 */
			info->control.rates[1].idx = -1;
			info->control.rates[2].idx = -1;
			info->control.rates[3].idx = -1;
			info->control.rates[4].idx = -1;
			BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
			info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
J
Johannes Berg 已提交
846 847 848
		} else {
			hdr->frame_control &= ~morefrags;
			next_len = 0;
849
		}
J
Johannes Berg 已提交
850 851 852 853
		hdr->duration_id = ieee80211_duration(tx, 0, next_len);
		hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
		fragnum++;
	} while ((skb = skb->next));
854

855
	return TX_CONTINUE;
856 857
}

858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
{
	struct sk_buff *skb = tx->skb;

	if (!tx->sta)
		return TX_CONTINUE;

	tx->sta->tx_packets++;
	do {
		tx->sta->tx_fragments++;
		tx->sta->tx_bytes += skb->len;
	} while ((skb = skb->next));

	return TX_CONTINUE;
}

875
static ieee80211_tx_result debug_noinline
876 877 878 879 880 881 882 883 884 885 886 887
ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
{
	if (!tx->key)
		return TX_CONTINUE;

	switch (tx->key->conf.alg) {
	case ALG_WEP:
		return ieee80211_crypto_wep_encrypt(tx);
	case ALG_TKIP:
		return ieee80211_crypto_tkip_encrypt(tx);
	case ALG_CCMP:
		return ieee80211_crypto_ccmp_encrypt(tx);
888 889
	case ALG_AES_CMAC:
		return ieee80211_crypto_aes_cmac_encrypt(tx);
890 891 892 893 894 895 896
	}

	/* not reached */
	WARN_ON(1);
	return TX_DROP;
}

897
static ieee80211_tx_result debug_noinline
J
Johannes Berg 已提交
898 899
ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
{
J
Johannes Berg 已提交
900 901 902 903
	struct sk_buff *skb = tx->skb;
	struct ieee80211_hdr *hdr;
	int next_len;
	bool group_addr;
J
Johannes Berg 已提交
904

J
Johannes Berg 已提交
905 906
	do {
		hdr = (void *) skb->data;
907 908
		if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
			break; /* must not overwrite AID */
J
Johannes Berg 已提交
909 910
		next_len = skb->next ? skb->next->len : 0;
		group_addr = is_multicast_ether_addr(hdr->addr1);
J
Johannes Berg 已提交
911

J
Johannes Berg 已提交
912 913 914
		hdr->duration_id =
			ieee80211_duration(tx, group_addr, next_len);
	} while ((skb = skb->next));
J
Johannes Berg 已提交
915 916 917 918

	return TX_CONTINUE;
}

919 920 921 922 923 924
/* actual transmit path */

/*
 * deal with packet injection down monitor interface
 * with Radiotap Header -- only called for monitor mode interface
 */
925 926
static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
					  struct sk_buff *skb)
927 928 929 930 931 932 933 934 935 936 937 938
{
	/*
	 * this is the moment to interpret and discard the radiotap header that
	 * must be at the start of the packet injected in Monitor mode
	 *
	 * Need to take some care with endian-ness since radiotap
	 * args are little-endian
	 */

	struct ieee80211_radiotap_iterator iterator;
	struct ieee80211_radiotap_header *rthdr =
		(struct ieee80211_radiotap_header *) skb->data;
939
	struct ieee80211_supported_band *sband;
J
Johannes Berg 已提交
940
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
941 942
	int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);

943
	sband = tx->local->hw.wiphy->bands[tx->channel->band];
944

J
Johannes Berg 已提交
945
	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
946
	tx->flags &= ~IEEE80211_TX_FRAGMENTED;
947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977

	/*
	 * for every radiotap entry that is present
	 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
	 * entries present, or -EINVAL on error)
	 */

	while (!ret) {
		ret = ieee80211_radiotap_iterator_next(&iterator);

		if (ret)
			continue;

		/* see if this argument is something we can use */
		switch (iterator.this_arg_index) {
		/*
		 * You must take care when dereferencing iterator.this_arg
		 * for multibyte types... the pointer is not aligned.  Use
		 * get_unaligned((type *)iterator.this_arg) to dereference
		 * iterator.this_arg for type "type" safely on all arches.
		*/
		case IEEE80211_RADIOTAP_FLAGS:
			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
				/*
				 * this indicates that the skb we have been
				 * handed has the 32-bit FCS CRC at the end...
				 * we should react to that by snipping it off
				 * because it will be recomputed and added
				 * on transmission
				 */
				if (skb->len < (iterator.max_length + FCS_LEN))
978
					return false;
979 980 981

				skb_trim(skb, skb->len - FCS_LEN);
			}
982
			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
J
Johannes Berg 已提交
983
				info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
984
			if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
985
				tx->flags |= IEEE80211_TX_FRAGMENTED;
986 987
			break;

988 989 990 991 992 993
		/*
		 * Please update the file
		 * Documentation/networking/mac80211-injection.txt
		 * when parsing new fields here.
		 */

994 995 996 997 998 999
		default:
			break;
		}
	}

	if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
1000
		return false;
1001 1002 1003 1004 1005 1006 1007 1008

	/*
	 * remove the radiotap header
	 * iterator->max_length was sanity-checked against
	 * skb->len by iterator init
	 */
	skb_pull(skb, iterator.max_length);

1009
	return true;
1010 1011
}

1012 1013 1014
/*
 * initialises @tx
 */
1015
static ieee80211_tx_result
J
Johannes Berg 已提交
1016 1017 1018
ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
		     struct ieee80211_tx_data *tx,
		     struct sk_buff *skb)
1019
{
J
Johannes Berg 已提交
1020
	struct ieee80211_local *local = sdata->local;
1021
	struct ieee80211_hdr *hdr;
1022
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
S
Sujith 已提交
1023 1024
	int hdrlen, tid;
	u8 *qc, *state;
1025
	bool queued = false;
1026 1027 1028 1029

	memset(tx, 0, sizeof(*tx));
	tx->skb = skb;
	tx->local = local;
J
Johannes Berg 已提交
1030
	tx->sdata = sdata;
1031
	tx->channel = local->hw.conf.channel;
1032
	/*
1033 1034
	 * Set this flag (used below to indicate "automatic fragmentation"),
	 * it will be cleared/left by radiotap as desired.
1035
	 */
1036
	tx->flags |= IEEE80211_TX_FRAGMENTED;
1037 1038

	/* process and remove the injection radiotap header */
1039
	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
1040
		if (!__ieee80211_parse_tx_radiotap(tx, skb))
1041
			return TX_DROP;
1042

1043
		/*
1044 1045 1046
		 * __ieee80211_parse_tx_radiotap has now removed
		 * the radiotap header that was present and pre-filled
		 * 'tx' with tx control information.
1047 1048 1049
		 */
	}

1050 1051 1052 1053 1054 1055 1056
	/*
	 * If this flag is set to true anywhere, and we get here,
	 * we are doing the needed processing, so remove the flag
	 * now.
	 */
	info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;

1057 1058
	hdr = (struct ieee80211_hdr *) skb->data;

1059
	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1060 1061
		tx->sta = rcu_dereference(sdata->u.vlan.sta);
	if (!tx->sta)
1062
		tx->sta = sta_info_get(sdata, hdr->addr1);
1063

1064 1065
	if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
	    (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
1066
		unsigned long flags;
1067 1068
		struct tid_ampdu_tx *tid_tx;

S
Sujith 已提交
1069 1070 1071
		qc = ieee80211_get_qos_ctl(hdr);
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;

1072
		spin_lock_irqsave(&tx->sta->lock, flags);
1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086
		/*
		 * XXX: This spinlock could be fairly expensive, but see the
		 *	comment in agg-tx.c:ieee80211_agg_tx_operational().
		 *	One way to solve this would be to do something RCU-like
		 *	for managing the tid_tx struct and using atomic bitops
		 *	for the actual state -- by introducing an actual
		 *	'operational' bit that would be possible. It would
		 *	require changing ieee80211_agg_tx_operational() to
		 *	set that bit, and changing the way tid_tx is managed
		 *	everywhere, including races between that bit and
		 *	tid_tx going away (tid_tx being added can be easily
		 *	committed to memory before the 'operational' bit).
		 */
		tid_tx = tx->sta->ampdu_mlme.tid_tx[tid];
S
Sujith 已提交
1087
		state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
1088
		if (*state == HT_AGG_STATE_OPERATIONAL) {
S
Sujith 已提交
1089
			info->flags |= IEEE80211_TX_CTL_AMPDU;
1090 1091 1092
		} else if (*state != HT_AGG_STATE_IDLE) {
			/* in progress */
			queued = true;
1093
			info->control.vif = &sdata->vif;
1094 1095 1096
			info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
			__skb_queue_tail(&tid_tx->pending, skb);
		}
1097
		spin_unlock_irqrestore(&tx->sta->lock, flags);
1098 1099 1100

		if (unlikely(queued))
			return TX_QUEUED;
S
Sujith 已提交
1101 1102
	}

1103
	if (is_multicast_ether_addr(hdr->addr1)) {
1104
		tx->flags &= ~IEEE80211_TX_UNICAST;
1105
		info->flags |= IEEE80211_TX_CTL_NO_ACK;
1106
	} else {
1107
		tx->flags |= IEEE80211_TX_UNICAST;
1108 1109 1110 1111
		if (unlikely(local->wifi_wme_noack_test))
			info->flags |= IEEE80211_TX_CTL_NO_ACK;
		else
			info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
1112
	}
1113

1114 1115
	if (tx->flags & IEEE80211_TX_FRAGMENTED) {
		if ((tx->flags & IEEE80211_TX_UNICAST) &&
1116
		    skb->len + FCS_LEN > local->hw.wiphy->frag_threshold &&
1117
		    !(info->flags & IEEE80211_TX_CTL_AMPDU))
1118
			tx->flags |= IEEE80211_TX_FRAGMENTED;
1119
		else
1120
			tx->flags &= ~IEEE80211_TX_FRAGMENTED;
1121 1122
	}

1123
	if (!tx->sta)
1124
		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1125
	else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
1126
		info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1127

1128
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
1129 1130 1131 1132
	if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
		u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
		tx->ethertype = (pos[0] << 8) | pos[1];
	}
1133
	info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
1134

1135
	return TX_CONTINUE;
1136 1137
}

J
Johannes Berg 已提交
1138
static int __ieee80211_tx(struct ieee80211_local *local,
1139
			  struct sk_buff **skbp,
J
Johannes Berg 已提交
1140 1141
			  struct sta_info *sta,
			  bool txpending)
1142
{
1143
	struct sk_buff *skb = *skbp, *next;
1144
	struct ieee80211_tx_info *info;
1145
	struct ieee80211_sub_if_data *sdata;
J
Johannes Berg 已提交
1146
	unsigned long flags;
1147
	int ret, len;
J
Johannes Berg 已提交
1148
	bool fragm = false;
1149

J
Johannes Berg 已提交
1150
	while (skb) {
J
Johannes Berg 已提交
1151 1152 1153 1154 1155 1156 1157 1158 1159 1160
		int q = skb_get_queue_mapping(skb);

		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
		ret = IEEE80211_TX_OK;
		if (local->queue_stop_reasons[q] ||
		    (!txpending && !skb_queue_empty(&local->pending[q])))
			ret = IEEE80211_TX_PENDING;
		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
		if (ret != IEEE80211_TX_OK)
			return ret;
1161

1162 1163 1164
		info = IEEE80211_SKB_CB(skb);

		if (fragm)
1165
			info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
1166
					 IEEE80211_TX_CTL_FIRST_FRAGMENT);
1167

J
Johannes Berg 已提交
1168
		next = skb->next;
1169
		len = skb->len;
1170

J
Johannes Berg 已提交
1171 1172 1173
		if (next)
			info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;

1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188
		sdata = vif_to_sdata(info->control.vif);

		switch (sdata->vif.type) {
		case NL80211_IFTYPE_MONITOR:
			info->control.vif = NULL;
			break;
		case NL80211_IFTYPE_AP_VLAN:
			info->control.vif = &container_of(sdata->bss,
				struct ieee80211_sub_if_data, u.ap)->vif;
			break;
		default:
			/* keep */
			break;
		}

1189
		ret = drv_tx(local, skb);
1190 1191 1192 1193
		if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
			dev_kfree_skb(skb);
			ret = NETDEV_TX_OK;
		}
1194 1195
		if (ret != NETDEV_TX_OK) {
			info->control.vif = &sdata->vif;
J
Johannes Berg 已提交
1196
			return IEEE80211_TX_AGAIN;
1197 1198
		}

1199
		*skbp = skb = next;
J
Johannes Berg 已提交
1200 1201
		ieee80211_led_tx(local, 1);
		fragm = true;
1202
	}
J
Johannes Berg 已提交
1203

1204 1205 1206
	return IEEE80211_TX_OK;
}

1207 1208 1209 1210 1211 1212 1213 1214 1215
/*
 * Invoke TX handlers, return 0 on success and non-zero if the
 * frame was dropped or queued.
 */
static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
{
	struct sk_buff *skb = tx->skb;
	ieee80211_tx_result res = TX_DROP;

1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226
#define CALL_TXH(txh) \
	do {				\
		res = txh(tx);		\
		if (res != TX_CONTINUE)	\
			goto txh_done;	\
	} while (0)

	CALL_TXH(ieee80211_tx_h_check_assoc);
	CALL_TXH(ieee80211_tx_h_ps_buf);
	CALL_TXH(ieee80211_tx_h_select_key);
	CALL_TXH(ieee80211_tx_h_michael_mic_add);
1227 1228
	if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
		CALL_TXH(ieee80211_tx_h_rate_ctrl);
1229 1230 1231
	CALL_TXH(ieee80211_tx_h_misc);
	CALL_TXH(ieee80211_tx_h_sequence);
	CALL_TXH(ieee80211_tx_h_fragment);
1232
	/* handlers after fragment must be aware of tx info fragmentation! */
1233 1234 1235
	CALL_TXH(ieee80211_tx_h_stats);
	CALL_TXH(ieee80211_tx_h_encrypt);
	CALL_TXH(ieee80211_tx_h_calculate_duration);
1236
#undef CALL_TXH
1237

1238
 txh_done:
1239
	if (unlikely(res == TX_DROP)) {
1240
		I802_DEBUG_INC(tx->local->tx_handlers_drop);
J
Johannes Berg 已提交
1241 1242 1243 1244 1245 1246 1247
		while (skb) {
			struct sk_buff *next;

			next = skb->next;
			dev_kfree_skb(skb);
			skb = next;
		}
1248 1249
		return -1;
	} else if (unlikely(res == TX_QUEUED)) {
1250
		I802_DEBUG_INC(tx->local->tx_handlers_queued);
1251 1252 1253 1254 1255 1256
		return -1;
	}

	return 0;
}

J
Johannes Berg 已提交
1257 1258
static void ieee80211_tx(struct ieee80211_sub_if_data *sdata,
			 struct sk_buff *skb, bool txpending)
1259
{
J
Johannes Berg 已提交
1260
	struct ieee80211_local *local = sdata->local;
1261
	struct ieee80211_tx_data tx;
1262
	ieee80211_tx_result res_prepare;
1263
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1264 1265 1266
	struct sk_buff *next;
	unsigned long flags;
	int ret, retries;
1267
	u16 queue;
1268

1269 1270
	queue = skb_get_queue_mapping(skb);

1271 1272
	if (unlikely(skb->len < 10)) {
		dev_kfree_skb(skb);
1273
		return;
1274 1275
	}

1276 1277
	rcu_read_lock();

1278
	/* initialises tx */
J
Johannes Berg 已提交
1279
	res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
1280

1281
	if (unlikely(res_prepare == TX_DROP)) {
1282
		dev_kfree_skb(skb);
1283
		rcu_read_unlock();
1284 1285 1286 1287
		return;
	} else if (unlikely(res_prepare == TX_QUEUED)) {
		rcu_read_unlock();
		return;
1288 1289
	}

1290
	tx.channel = local->hw.conf.channel;
1291
	info->band = tx.channel->band;
1292

1293 1294
	if (invoke_tx_handlers(&tx))
		goto out;
1295

1296 1297
	retries = 0;
 retry:
J
Johannes Berg 已提交
1298
	ret = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
1299 1300 1301 1302
	switch (ret) {
	case IEEE80211_TX_OK:
		break;
	case IEEE80211_TX_AGAIN:
1303 1304 1305 1306 1307
		/*
		 * Since there are no fragmented frames on A-MPDU
		 * queues, there's no reason for a driver to reject
		 * a frame there, warn and drop it.
		 */
1308 1309 1310 1311 1312
		if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
			goto drop;
		/* fall through */
	case IEEE80211_TX_PENDING:
		skb = tx.skb;
1313

1314
		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1315

J
Johannes Berg 已提交
1316 1317 1318 1319 1320 1321
		if (local->queue_stop_reasons[queue] ||
		    !skb_queue_empty(&local->pending[queue])) {
			/*
			 * if queue is stopped, queue up frames for later
			 * transmission from the tasklet
			 */
1322 1323 1324
			do {
				next = skb->next;
				skb->next = NULL;
1325
				if (unlikely(txpending))
J
Johannes Berg 已提交
1326 1327
					__skb_queue_head(&local->pending[queue],
							 skb);
1328
				else
J
Johannes Berg 已提交
1329 1330
					__skb_queue_tail(&local->pending[queue],
							 skb);
1331 1332 1333 1334 1335
			} while ((skb = next));

			spin_unlock_irqrestore(&local->queue_stop_reason_lock,
					       flags);
		} else {
J
Johannes Berg 已提交
1336 1337 1338 1339
			/*
			 * otherwise retry, but this is a race condition or
			 * a driver bug (which we warn about if it persists)
			 */
1340 1341 1342 1343
			spin_unlock_irqrestore(&local->queue_stop_reason_lock,
					       flags);

			retries++;
J
Johannes Berg 已提交
1344
			if (WARN(retries > 10, "tx refused but queue active\n"))
1345
				goto drop;
1346 1347 1348
			goto retry;
		}
	}
1349
 out:
1350
	rcu_read_unlock();
1351
	return;
1352 1353

 drop:
1354
	rcu_read_unlock();
J
Johannes Berg 已提交
1355 1356 1357 1358 1359 1360 1361

	skb = tx.skb;
	while (skb) {
		next = skb->next;
		dev_kfree_skb(skb);
		skb = next;
	}
1362 1363 1364 1365
}

/* device xmit handlers */

1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
static int ieee80211_skb_resize(struct ieee80211_local *local,
				struct sk_buff *skb,
				int head_need, bool may_encrypt)
{
	int tail_need = 0;

	/*
	 * This could be optimised, devices that do full hardware
	 * crypto (including TKIP MMIC) need no tailroom... But we
	 * have no drivers for such devices currently.
	 */
	if (may_encrypt) {
		tail_need = IEEE80211_ENCRYPT_TAILROOM;
		tail_need -= skb_tailroom(skb);
		tail_need = max_t(int, tail_need, 0);
	}

	if (head_need || tail_need) {
		/* Sorry. Can't account for this any more */
		skb_orphan(skb);
	}

	if (skb_header_cloned(skb))
		I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
	else
		I802_DEBUG_INC(local->tx_expand_skb_head);

	if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
		printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n",
		       wiphy_name(local->hw.wiphy));
		return -ENOMEM;
	}

	/* update truesize too */
	skb->truesize += head_need + tail_need;

	return 0;
}

1405 1406 1407
static bool need_dynamic_ps(struct ieee80211_local *local)
{
	/* driver doesn't support power save */
1408 1409 1410 1411 1412
	if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
		return false;

	/* hardware does dynamic power save */
	if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425
		return false;

	/* dynamic power save disabled */
	if (local->hw.conf.dynamic_ps_timeout <= 0)
		return false;

	/* we are scanning, don't enable power save */
	if (local->scanning)
		return false;

	if (!local->ps_sdata)
		return false;

1426 1427 1428 1429
	/* No point if we're going to suspend */
	if (local->quiescing)
		return false;

1430 1431 1432
	return true;
}

J
Johannes Berg 已提交
1433 1434
static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
			   struct sk_buff *skb)
1435
{
J
Johannes Berg 已提交
1436
	struct ieee80211_local *local = sdata->local;
1437
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1438
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
J
Johannes Berg 已提交
1439
	struct ieee80211_sub_if_data *tmp_sdata;
1440
	int headroom;
1441
	bool may_encrypt;
1442

1443
	if (need_dynamic_ps(local)) {
1444 1445 1446
		if (local->hw.conf.flags & IEEE80211_CONF_PS) {
			ieee80211_stop_queues_by_reason(&local->hw,
					IEEE80211_QUEUE_STOP_REASON_PS);
1447
			ieee80211_queue_work(&local->hw,
1448 1449 1450 1451
					&local->dynamic_ps_disable_work);
		}

		mod_timer(&local->dynamic_ps_timer, jiffies +
1452
		        msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
1453 1454
	}

1455 1456
	rcu_read_lock();

1457
	if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
1458 1459 1460 1461 1462 1463
		int hdrlen;
		u16 len_rthdr;

		info->flags |= IEEE80211_TX_CTL_INJECTED;

		len_rthdr = ieee80211_get_radiotap_len(skb->data);
1464
		hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478
		hdrlen = ieee80211_hdrlen(hdr->frame_control);

		/* check the header is complete in the frame */
		if (likely(skb->len >= len_rthdr + hdrlen)) {
			/*
			 * We process outgoing injected frames that have a
			 * local address we handle as though they are our
			 * own frames.
			 * This code here isn't entirely correct, the local
			 * MAC address is not necessarily enough to find
			 * the interface to use; for that proper VLAN/WDS
			 * support we will need a different mechanism.
			 */

J
Johannes Berg 已提交
1479
			list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
1480
						list) {
1481
				if (!ieee80211_sdata_running(tmp_sdata))
1482
					continue;
J
Johannes Berg 已提交
1483
				if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
1484
					continue;
1485
				if (compare_ether_addr(tmp_sdata->vif.addr,
1486
						       hdr->addr2) == 0) {
J
Johannes Berg 已提交
1487
					sdata = tmp_sdata;
1488 1489 1490 1491
					break;
				}
			}
		}
1492 1493
	}

J
Johannes Berg 已提交
1494
	may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
1495

J
Johannes Berg 已提交
1496
	headroom = local->tx_headroom;
1497 1498 1499 1500 1501
	if (may_encrypt)
		headroom += IEEE80211_ENCRYPT_HEADROOM;
	headroom -= skb_headroom(skb);
	headroom = max_t(int, 0, headroom);

J
Johannes Berg 已提交
1502
	if (ieee80211_skb_resize(local, skb, headroom, may_encrypt)) {
1503
		dev_kfree_skb(skb);
1504
		rcu_read_unlock();
J
Johannes Berg 已提交
1505
		return;
1506 1507
	}

1508
	info->control.vif = &sdata->vif;
1509

1510 1511 1512 1513 1514
	if (ieee80211_vif_is_mesh(&sdata->vif) &&
	    ieee80211_is_data(hdr->frame_control) &&
		!is_multicast_ether_addr(hdr->addr1))
			if (mesh_nexthop_lookup(skb, sdata)) {
				/* skb queued: don't free */
1515
				rcu_read_unlock();
1516 1517 1518
				return;
			}

1519
	ieee80211_set_qos_hdr(local, skb);
J
Johannes Berg 已提交
1520
	ieee80211_tx(sdata, skb, false);
1521
	rcu_read_unlock();
1522 1523
}

1524 1525
netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
					 struct net_device *dev)
1526 1527
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1528
	struct ieee80211_channel *chan = local->hw.conf.channel;
1529 1530
	struct ieee80211_radiotap_header *prthdr =
		(struct ieee80211_radiotap_header *)skb->data;
J
Johannes Berg 已提交
1531
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1532
	u16 len_rthdr;
1533

1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553
	/*
	 * Frame injection is not allowed if beaconing is not allowed
	 * or if we need radar detection. Beaconing is usually not allowed when
	 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
	 * Passive scan is also used in world regulatory domains where
	 * your country is not known and as such it should be treated as
	 * NO TX unless the channel is explicitly allowed in which case
	 * your current regulatory domain would not have the passive scan
	 * flag.
	 *
	 * Since AP mode uses monitor interfaces to inject/TX management
	 * frames we can make AP mode the exception to this rule once it
	 * supports radar detection as its implementation can deal with
	 * radar detection by itself. We can do that later by adding a
	 * monitor flag interfaces used for AP support.
	 */
	if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR |
	     IEEE80211_CHAN_PASSIVE_SCAN)))
		goto fail;

1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567
	/* check for not even having the fixed radiotap header part */
	if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
		goto fail; /* too short to be possibly valid */

	/* is it a header version we can trust to find length from? */
	if (unlikely(prthdr->it_version))
		goto fail; /* only version 0 is supported */

	/* then there must be a radiotap header with a length we can use */
	len_rthdr = ieee80211_get_radiotap_len(skb->data);

	/* does the skb contain enough to deliver on the alleged length? */
	if (unlikely(skb->len < len_rthdr))
		goto fail; /* skb too short for claimed rt header extent */
1568 1569 1570 1571 1572 1573 1574

	/*
	 * fix up the pointers accounting for the radiotap
	 * header still being in there.  We are being given
	 * a precooked IEEE80211 header so no need for
	 * normal processing
	 */
1575
	skb_set_mac_header(skb, len_rthdr);
1576
	/*
1577 1578
	 * these are just fixed to the end of the rt area since we
	 * don't have any better information and at this point, nobody cares
1579
	 */
1580 1581
	skb_set_network_header(skb, len_rthdr);
	skb_set_transport_header(skb, len_rthdr);
1582

J
Johannes Berg 已提交
1583 1584
	memset(info, 0, sizeof(*info));

1585 1586
	info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;

J
Johannes Berg 已提交
1587 1588
	/* pass the radiotap header up to xmit */
	ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
1589
	return NETDEV_TX_OK;
1590 1591 1592 1593

fail:
	dev_kfree_skb(skb);
	return NETDEV_TX_OK; /* meaning, we dealt with the skb */
1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610
}

/**
 * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type
 * subinterfaces (wlan#, WDS, and VLAN interfaces)
 * @skb: packet to be sent
 * @dev: incoming interface
 *
 * Returns: 0 on success (and frees skb in this case) or 1 on failure (skb will
 * not be freed, and caller is responsible for either retrying later or freeing
 * skb).
 *
 * This function takes in an Ethernet header and encapsulates it with suitable
 * IEEE 802.11 header based on which interface the packet is coming in. The
 * encapsulated packet will then be passed to master interface, wlan#.11, for
 * transmission (through low-level driver).
 */
1611 1612
netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
				    struct net_device *dev)
1613
{
1614 1615
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
	struct ieee80211_local *local = sdata->local;
J
Johannes Berg 已提交
1616
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1617
	int ret = NETDEV_TX_BUSY, head_need;
1618 1619
	u16 ethertype, hdrlen,  meshhdrlen = 0;
	__le16 fc;
1620
	struct ieee80211_hdr hdr;
1621
	struct ieee80211s_hdr mesh_hdr;
1622 1623
	const u8 *encaps_data;
	int encaps_len, skip_header_bytes;
1624
	int nh_pos, h_pos;
1625
	struct sta_info *sta = NULL;
1626
	u32 sta_flags = 0;
1627 1628

	if (unlikely(skb->len < ETH_HLEN)) {
1629
		ret = NETDEV_TX_OK;
1630 1631 1632 1633 1634 1635 1636 1637 1638
		goto fail;
	}

	nh_pos = skb_network_header(skb) - skb->data;
	h_pos = skb_transport_header(skb) - skb->data;

	/* convert Ethernet header to proper 802.11 header (based on
	 * operation mode) */
	ethertype = (skb->data[12] << 8) | skb->data[13];
1639
	fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
1640

1641
	switch (sdata->vif.type) {
1642
	case NL80211_IFTYPE_AP_VLAN:
1643
		rcu_read_lock();
1644
		sta = rcu_dereference(sdata->u.vlan.sta);
1645 1646 1647 1648
		if (sta) {
			fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
			/* RA TA DA SA */
			memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
1649
			memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1650 1651 1652 1653 1654 1655 1656 1657 1658 1659
			memcpy(hdr.addr3, skb->data, ETH_ALEN);
			memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
			hdrlen = 30;
			sta_flags = get_sta_flags(sta);
		}
		rcu_read_unlock();
		if (sta)
			break;
		/* fall through */
	case NL80211_IFTYPE_AP:
1660
		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
1661 1662
		/* DA BSSID SA */
		memcpy(hdr.addr1, skb->data, ETH_ALEN);
1663
		memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1664 1665
		memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
		hdrlen = 24;
1666
		break;
1667
	case NL80211_IFTYPE_WDS:
1668
		fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
1669 1670
		/* RA TA DA SA */
		memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
1671
		memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1672 1673 1674
		memcpy(hdr.addr3, skb->data, ETH_ALEN);
		memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
		hdrlen = 30;
1675
		break;
1676
#ifdef CONFIG_MAC80211_MESH
1677
	case NL80211_IFTYPE_MESH_POINT:
1678
		if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
1679
			/* Do not send frames with mesh_ttl == 0 */
1680
			sdata->u.mesh.mshstats.dropped_frames_ttl++;
1681
			ret = NETDEV_TX_OK;
1682
			goto fail;
1683
		}
1684

1685 1686
		if (compare_ether_addr(sdata->vif.addr,
				       skb->data + ETH_ALEN) == 0) {
1687 1688 1689 1690
			hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
					skb->data, skb->data + ETH_ALEN);
			meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
					sdata, NULL, NULL, NULL);
1691 1692 1693
		} else {
			/* packet from other interface */
			struct mesh_path *mppath;
1694
			int is_mesh_mcast = 1;
1695
			const u8 *mesh_da;
1696

1697
			rcu_read_lock();
1698
			if (is_multicast_ether_addr(skb->data))
1699 1700
				/* DA TA mSA AE:SA */
				mesh_da = skb->data;
1701
			else {
1702 1703 1704
				static const u8 bcast[ETH_ALEN] =
					{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };

1705
				mppath = mpp_path_lookup(skb->data, sdata);
1706 1707 1708 1709
				if (mppath) {
					/* RA TA mDA mSA AE:DA SA */
					mesh_da = mppath->mpp;
					is_mesh_mcast = 0;
1710
				} else {
1711
					/* DA TA mSA AE:SA */
1712 1713
					mesh_da = bcast;
				}
1714
			}
1715
			hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
1716
					mesh_da, sdata->vif.addr);
1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731
			rcu_read_unlock();
			if (is_mesh_mcast)
				meshhdrlen =
					ieee80211_new_mesh_header(&mesh_hdr,
							sdata,
							skb->data + ETH_ALEN,
							NULL,
							NULL);
			else
				meshhdrlen =
					ieee80211_new_mesh_header(&mesh_hdr,
							sdata,
							NULL,
							skb->data,
							skb->data + ETH_ALEN);
1732 1733

		}
1734 1735
		break;
#endif
1736
	case NL80211_IFTYPE_STATION:
1737
		memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
1738
		if (sdata->u.mgd.use_4addr && ethertype != ETH_P_PAE) {
1739 1740
			fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
			/* RA TA DA SA */
1741
			memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
1742 1743 1744 1745 1746 1747 1748 1749 1750 1751
			memcpy(hdr.addr3, skb->data, ETH_ALEN);
			memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
			hdrlen = 30;
		} else {
			fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
			/* BSSID SA DA */
			memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
			memcpy(hdr.addr3, skb->data, ETH_ALEN);
			hdrlen = 24;
		}
1752
		break;
1753
	case NL80211_IFTYPE_ADHOC:
1754 1755 1756
		/* DA SA BSSID */
		memcpy(hdr.addr1, skb->data, ETH_ALEN);
		memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
1757
		memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
1758
		hdrlen = 24;
1759 1760
		break;
	default:
1761
		ret = NETDEV_TX_OK;
1762 1763 1764
		goto fail;
	}

1765 1766 1767 1768 1769 1770
	/*
	 * There's no need to try to look up the destination
	 * if it is a multicast address (which can only happen
	 * in AP mode)
	 */
	if (!is_multicast_ether_addr(hdr.addr1)) {
1771
		rcu_read_lock();
1772 1773
		sta = sta_info_get(sdata, hdr.addr1);
		if (sta)
1774
			sta_flags = get_sta_flags(sta);
1775
		rcu_read_unlock();
1776 1777
	}

1778
	/* receiver and we are QoS enabled, use a QoS type frame */
1779
	if ((sta_flags & WLAN_STA_WME) && local->hw.queues >= 4) {
1780
		fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
1781 1782 1783 1784
		hdrlen += 2;
	}

	/*
1785 1786
	 * Drop unicast frames to unauthorised stations unless they are
	 * EAPOL frames from the local station.
1787
	 */
1788 1789
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
		unlikely(!is_multicast_ether_addr(hdr.addr1) &&
1790 1791
		      !(sta_flags & WLAN_STA_AUTHORIZED) &&
		      !(ethertype == ETH_P_PAE &&
1792
		       compare_ether_addr(sdata->vif.addr,
1793 1794 1795
					  skb->data + ETH_ALEN) == 0))) {
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
		if (net_ratelimit())
1796
			printk(KERN_DEBUG "%s: dropped frame to %pM"
1797
			       " (unauthorized port)\n", dev->name,
1798
			       hdr.addr1);
1799 1800 1801 1802
#endif

		I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);

1803
		ret = NETDEV_TX_OK;
1804 1805 1806
		goto fail;
	}

1807
	hdr.frame_control = fc;
1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828
	hdr.duration_id = 0;
	hdr.seq_ctrl = 0;

	skip_header_bytes = ETH_HLEN;
	if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
		encaps_data = bridge_tunnel_header;
		encaps_len = sizeof(bridge_tunnel_header);
		skip_header_bytes -= 2;
	} else if (ethertype >= 0x600) {
		encaps_data = rfc1042_header;
		encaps_len = sizeof(rfc1042_header);
		skip_header_bytes -= 2;
	} else {
		encaps_data = NULL;
		encaps_len = 0;
	}

	skb_pull(skb, skip_header_bytes);
	nh_pos -= skip_header_bytes;
	h_pos -= skip_header_bytes;

1829
	head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
1830

1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841
	/*
	 * So we need to modify the skb header and hence need a copy of
	 * that. The head_need variable above doesn't, so far, include
	 * the needed header space that we don't need right away. If we
	 * can, then we don't reallocate right now but only after the
	 * frame arrives at the master device (if it does...)
	 *
	 * If we cannot, however, then we will reallocate to include all
	 * the ever needed space. Also, if we need to reallocate it anyway,
	 * make it big enough for everything we may ever need.
	 */
1842

1843
	if (head_need > 0 || skb_cloned(skb)) {
1844 1845 1846 1847
		head_need += IEEE80211_ENCRYPT_HEADROOM;
		head_need += local->tx_headroom;
		head_need = max_t(int, 0, head_need);
		if (ieee80211_skb_resize(local, skb, head_need, true))
1848 1849 1850 1851 1852 1853 1854 1855
			goto fail;
	}

	if (encaps_data) {
		memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
		nh_pos += encaps_len;
		h_pos += encaps_len;
	}
1856

1857 1858 1859 1860 1861 1862
	if (meshhdrlen > 0) {
		memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
		nh_pos += meshhdrlen;
		h_pos += meshhdrlen;
	}

1863
	if (ieee80211_is_data_qos(fc)) {
1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875
		__le16 *qos_control;

		qos_control = (__le16*) skb_push(skb, 2);
		memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
		/*
		 * Maybe we could actually set some fields here, for now just
		 * initialise to zero to indicate no special operation.
		 */
		*qos_control = 0;
	} else
		memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);

1876 1877 1878
	nh_pos += hdrlen;
	h_pos += hdrlen;

1879 1880
	dev->stats.tx_packets++;
	dev->stats.tx_bytes += skb->len;
1881 1882 1883 1884 1885 1886 1887 1888

	/* Update skb pointers to various headers since this modified frame
	 * is going to go through Linux networking code that may potentially
	 * need things like pointer to IP header. */
	skb_set_mac_header(skb, 0);
	skb_set_network_header(skb, nh_pos);
	skb_set_transport_header(skb, h_pos);

J
Johannes Berg 已提交
1889 1890
	memset(info, 0, sizeof(*info));

1891
	dev->trans_start = jiffies;
J
Johannes Berg 已提交
1892
	ieee80211_xmit(sdata, skb);
1893

1894
	return NETDEV_TX_OK;
1895 1896

 fail:
1897
	if (ret == NETDEV_TX_OK)
1898 1899 1900 1901 1902 1903
		dev_kfree_skb(skb);

	return ret;
}


1904 1905 1906 1907
/*
 * ieee80211_clear_tx_pending may not be called in a context where
 * it is possible that it packets could come in again.
 */
1908 1909
void ieee80211_clear_tx_pending(struct ieee80211_local *local)
{
J
Johannes Berg 已提交
1910
	int i;
1911

1912 1913
	for (i = 0; i < local->hw.queues; i++)
		skb_queue_purge(&local->pending[i]);
1914 1915
}

1916 1917 1918 1919 1920 1921 1922 1923 1924 1925
static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
				     struct sk_buff *skb)
{
	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
	struct ieee80211_sub_if_data *sdata;
	struct sta_info *sta;
	struct ieee80211_hdr *hdr;
	int ret;
	bool result = true;

1926
	sdata = vif_to_sdata(info->control.vif);
1927 1928

	if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
1929
		ieee80211_tx(sdata, skb, true);
1930 1931
	} else {
		hdr = (struct ieee80211_hdr *)skb->data;
1932
		sta = sta_info_get(sdata, hdr->addr1);
1933

J
Johannes Berg 已提交
1934
		ret = __ieee80211_tx(local, &skb, sta, true);
1935 1936 1937 1938 1939 1940 1941
		if (ret != IEEE80211_TX_OK)
			result = false;
	}

	return result;
}

1942
/*
J
Johannes Berg 已提交
1943
 * Transmit all pending packets. Called from tasklet.
1944
 */
1945 1946 1947
void ieee80211_tx_pending(unsigned long data)
{
	struct ieee80211_local *local = (struct ieee80211_local *)data;
1948
	unsigned long flags;
1949
	int i;
J
Johannes Berg 已提交
1950
	bool txok;
1951

1952
	rcu_read_lock();
1953

J
Johannes Berg 已提交
1954
	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1955 1956 1957 1958 1959
	for (i = 0; i < local->hw.queues; i++) {
		/*
		 * If queue is stopped by something other than due to pending
		 * frames, or we have no pending frames, proceed to next queue.
		 */
J
Johannes Berg 已提交
1960
		if (local->queue_stop_reasons[i] ||
1961
		    skb_queue_empty(&local->pending[i]))
1962
			continue;
1963

1964
		while (!skb_queue_empty(&local->pending[i])) {
J
Johannes Berg 已提交
1965
			struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
1966 1967 1968
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
			struct ieee80211_sub_if_data *sdata;

1969 1970 1971 1972 1973
			if (WARN_ON(!info->control.vif)) {
				kfree_skb(skb);
				continue;
			}

1974
			sdata = vif_to_sdata(info->control.vif);
J
Johannes Berg 已提交
1975 1976 1977 1978 1979 1980 1981 1982 1983
			spin_unlock_irqrestore(&local->queue_stop_reason_lock,
						flags);

			txok = ieee80211_tx_pending_skb(local, skb);
			if (!txok)
				__skb_queue_head(&local->pending[i], skb);
			spin_lock_irqsave(&local->queue_stop_reason_lock,
					  flags);
			if (!txok)
1984
				break;
1985 1986
		}
	}
J
Johannes Berg 已提交
1987
	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1988

1989
	rcu_read_unlock();
1990 1991 1992 1993
}

/* functions for drivers to get certain frames */

R
Rami Rosen 已提交
1994
static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
1995 1996
				     struct sk_buff *skb,
				     struct beacon_data *beacon)
1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010
{
	u8 *pos, *tim;
	int aid0 = 0;
	int i, have_bits = 0, n1, n2;

	/* Generate bitmap for TIM only if there are any STAs in power save
	 * mode. */
	if (atomic_read(&bss->num_sta_ps) > 0)
		/* in the hope that this is faster than
		 * checking byte-for-byte */
		have_bits = !bitmap_empty((unsigned long*)bss->tim,
					  IEEE80211_MAX_AID+1);

	if (bss->dtim_count == 0)
2011
		bss->dtim_count = beacon->dtim_period - 1;
2012 2013 2014 2015 2016 2017 2018
	else
		bss->dtim_count--;

	tim = pos = (u8 *) skb_put(skb, 6);
	*pos++ = WLAN_EID_TIM;
	*pos++ = 4;
	*pos++ = bss->dtim_count;
2019
	*pos++ = beacon->dtim_period;
2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055

	if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
		aid0 = 1;

	if (have_bits) {
		/* Find largest even number N1 so that bits numbered 1 through
		 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
		 * (N2 + 1) x 8 through 2007 are 0. */
		n1 = 0;
		for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
			if (bss->tim[i]) {
				n1 = i & 0xfe;
				break;
			}
		}
		n2 = n1;
		for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
			if (bss->tim[i]) {
				n2 = i;
				break;
			}
		}

		/* Bitmap control */
		*pos++ = n1 | aid0;
		/* Part Virt Bitmap */
		memcpy(pos, bss->tim + n1, n2 - n1 + 1);

		tim[1] = n2 - n1 + 4;
		skb_put(skb, n2 - n1);
	} else {
		*pos++ = aid0; /* Bitmap control */
		*pos++ = 0; /* Part Virt Bitmap */
	}
}

2056 2057 2058
struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
					 struct ieee80211_vif *vif,
					 u16 *tim_offset, u16 *tim_length)
2059 2060
{
	struct ieee80211_local *local = hw_to_local(hw);
2061
	struct sk_buff *skb = NULL;
2062
	struct ieee80211_tx_info *info;
2063 2064
	struct ieee80211_sub_if_data *sdata = NULL;
	struct ieee80211_if_ap *ap = NULL;
2065
	struct beacon_data *beacon;
2066
	struct ieee80211_supported_band *sband;
2067
	enum ieee80211_band band = local->hw.conf.channel->band;
2068
	struct ieee80211_tx_rate_control txrc;
2069

2070
	sband = local->hw.wiphy->bands[band];
2071 2072

	rcu_read_lock();
2073

2074
	sdata = vif_to_sdata(vif);
2075

2076 2077 2078 2079 2080
	if (tim_offset)
		*tim_offset = 0;
	if (tim_length)
		*tim_length = 0;

2081
	if (sdata->vif.type == NL80211_IFTYPE_AP) {
2082 2083
		ap = &sdata->u.ap;
		beacon = rcu_dereference(ap->beacon);
J
Johannes Berg 已提交
2084 2085 2086 2087 2088 2089 2090 2091 2092 2093
		if (ap && beacon) {
			/*
			 * headroom, head length,
			 * tail length and maximum TIM length
			 */
			skb = dev_alloc_skb(local->tx_headroom +
					    beacon->head_len +
					    beacon->tail_len + 256);
			if (!skb)
				goto out;
2094

J
Johannes Berg 已提交
2095 2096 2097
			skb_reserve(skb, local->tx_headroom);
			memcpy(skb_put(skb, beacon->head_len), beacon->head,
			       beacon->head_len);
2098

2099 2100 2101 2102 2103 2104 2105 2106
			/*
			 * Not very nice, but we want to allow the driver to call
			 * ieee80211_beacon_get() as a response to the set_tim()
			 * callback. That, however, is already invoked under the
			 * sta_lock to guarantee consistent and race-free update
			 * of the tim bitmap in mac80211 and the driver.
			 */
			if (local->tim_in_locked_section) {
R
Rami Rosen 已提交
2107
				ieee80211_beacon_add_tim(ap, skb, beacon);
2108 2109 2110 2111
			} else {
				unsigned long flags;

				spin_lock_irqsave(&local->sta_lock, flags);
R
Rami Rosen 已提交
2112
				ieee80211_beacon_add_tim(ap, skb, beacon);
2113 2114
				spin_unlock_irqrestore(&local->sta_lock, flags);
			}
2115

2116 2117 2118 2119 2120
			if (tim_offset)
				*tim_offset = beacon->head_len;
			if (tim_length)
				*tim_length = skb->len - beacon->head_len;

J
Johannes Berg 已提交
2121 2122 2123
			if (beacon->tail)
				memcpy(skb_put(skb, beacon->tail_len),
				       beacon->tail, beacon->tail_len);
2124 2125
		} else
			goto out;
2126
	} else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
2127
		struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
2128
		struct ieee80211_hdr *hdr;
2129
		struct sk_buff *presp = rcu_dereference(ifibss->presp);
2130

2131
		if (!presp)
2132 2133
			goto out;

2134
		skb = skb_copy(presp, GFP_ATOMIC);
2135 2136 2137 2138
		if (!skb)
			goto out;

		hdr = (struct ieee80211_hdr *) skb->data;
2139 2140
		hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
						 IEEE80211_STYPE_BEACON);
J
Johannes Berg 已提交
2141
	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2142 2143 2144
		struct ieee80211_mgmt *mgmt;
		u8 *pos;

J
Johannes Berg 已提交
2145 2146 2147 2148 2149 2150 2151 2152 2153
		/* headroom, head length, tail length and maximum TIM length */
		skb = dev_alloc_skb(local->tx_headroom + 400);
		if (!skb)
			goto out;

		skb_reserve(skb, local->hw.extra_tx_headroom);
		mgmt = (struct ieee80211_mgmt *)
			skb_put(skb, 24 + sizeof(mgmt->u.beacon));
		memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2154 2155
		mgmt->frame_control =
		    cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
J
Johannes Berg 已提交
2156
		memset(mgmt->da, 0xff, ETH_ALEN);
2157 2158
		memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
		memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
J
Johannes Berg 已提交
2159
		mgmt->u.beacon.beacon_int =
2160
			cpu_to_le16(sdata->vif.bss_conf.beacon_int);
J
Johannes Berg 已提交
2161 2162 2163 2164 2165 2166
		mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */

		pos = skb_put(skb, 2);
		*pos++ = WLAN_EID_SSID;
		*pos++ = 0x0;

2167
		mesh_mgmt_ies_add(skb, sdata);
2168 2169
	} else {
		WARN_ON(1);
2170
		goto out;
2171 2172
	}

2173 2174
	info = IEEE80211_SKB_CB(skb);

J
Johannes Berg 已提交
2175
	info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2176
	info->flags |= IEEE80211_TX_CTL_NO_ACK;
2177
	info->band = band;
2178 2179 2180 2181 2182 2183 2184

	memset(&txrc, 0, sizeof(txrc));
	txrc.hw = hw;
	txrc.sband = sband;
	txrc.bss_conf = &sdata->vif.bss_conf;
	txrc.skb = skb;
	txrc.reported_rate.idx = -1;
2185 2186 2187 2188 2189
	txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
	if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
		txrc.max_rate_idx = -1;
	else
		txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
2190 2191
	txrc.ap = true;
	rate_control_get_rate(sdata, NULL, &txrc);
2192 2193

	info->control.vif = vif;
2194 2195 2196

	info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
	info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
2197
 out:
2198
	rcu_read_unlock();
2199 2200
	return skb;
}
2201
EXPORT_SYMBOL(ieee80211_beacon_get_tim);
2202

2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280
struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
				     struct ieee80211_vif *vif)
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_if_managed *ifmgd;
	struct ieee80211_pspoll *pspoll;
	struct ieee80211_local *local;
	struct sk_buff *skb;

	if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
		return NULL;

	sdata = vif_to_sdata(vif);
	ifmgd = &sdata->u.mgd;
	local = sdata->local;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
	if (!skb) {
		printk(KERN_DEBUG "%s: failed to allocate buffer for "
		       "pspoll template\n", sdata->name);
		return NULL;
	}
	skb_reserve(skb, local->hw.extra_tx_headroom);

	pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
	memset(pspoll, 0, sizeof(*pspoll));
	pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
					    IEEE80211_STYPE_PSPOLL);
	pspoll->aid = cpu_to_le16(ifmgd->aid);

	/* aid in PS-Poll has its two MSBs each set to 1 */
	pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);

	memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
	memcpy(pspoll->ta, vif->addr, ETH_ALEN);

	return skb;
}
EXPORT_SYMBOL(ieee80211_pspoll_get);

struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
				       struct ieee80211_vif *vif)
{
	struct ieee80211_hdr_3addr *nullfunc;
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_if_managed *ifmgd;
	struct ieee80211_local *local;
	struct sk_buff *skb;

	if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
		return NULL;

	sdata = vif_to_sdata(vif);
	ifmgd = &sdata->u.mgd;
	local = sdata->local;

	skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
	if (!skb) {
		printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
		       "template\n", sdata->name);
		return NULL;
	}
	skb_reserve(skb, local->hw.extra_tx_headroom);

	nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
							  sizeof(*nullfunc));
	memset(nullfunc, 0, sizeof(*nullfunc));
	nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
					      IEEE80211_STYPE_NULLFUNC |
					      IEEE80211_FCTL_TODS);
	memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
	memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
	memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);

	return skb;
}
EXPORT_SYMBOL(ieee80211_nullfunc_get);

2281
void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2282
		       const void *frame, size_t frame_len,
2283
		       const struct ieee80211_tx_info *frame_txctl,
2284 2285 2286 2287
		       struct ieee80211_rts *rts)
{
	const struct ieee80211_hdr *hdr = frame;

2288 2289
	rts->frame_control =
	    cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
2290 2291
	rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
					       frame_txctl);
2292 2293 2294 2295 2296
	memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
	memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
}
EXPORT_SYMBOL(ieee80211_rts_get);

2297
void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
2298
			     const void *frame, size_t frame_len,
2299
			     const struct ieee80211_tx_info *frame_txctl,
2300 2301 2302 2303
			     struct ieee80211_cts *cts)
{
	const struct ieee80211_hdr *hdr = frame;

2304 2305
	cts->frame_control =
	    cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
2306 2307
	cts->duration = ieee80211_ctstoself_duration(hw, vif,
						     frame_len, frame_txctl);
2308 2309 2310 2311 2312
	memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
}
EXPORT_SYMBOL(ieee80211_ctstoself_get);

struct sk_buff *
2313
ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
2314
			  struct ieee80211_vif *vif)
2315 2316
{
	struct ieee80211_local *local = hw_to_local(hw);
2317
	struct sk_buff *skb = NULL;
2318
	struct sta_info *sta;
2319
	struct ieee80211_tx_data tx;
2320 2321
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_if_ap *bss = NULL;
2322
	struct beacon_data *beacon;
2323
	struct ieee80211_tx_info *info;
2324

2325
	sdata = vif_to_sdata(vif);
2326
	bss = &sdata->u.ap;
2327 2328 2329 2330

	rcu_read_lock();
	beacon = rcu_dereference(bss->beacon);

2331
	if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
2332
		goto out;
2333

2334
	if (bss->dtim_count != 0)
2335
		goto out; /* send buffered bc/mc only after DTIM beacon */
2336

2337 2338 2339
	while (1) {
		skb = skb_dequeue(&bss->ps_bc_buf);
		if (!skb)
2340
			goto out;
2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352
		local->total_ps_buffered--;

		if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
			struct ieee80211_hdr *hdr =
				(struct ieee80211_hdr *) skb->data;
			/* more buffered multicast/broadcast frames ==> set
			 * MoreData flag in IEEE 802.11 header to inform PS
			 * STAs */
			hdr->frame_control |=
				cpu_to_le16(IEEE80211_FCTL_MOREDATA);
		}

J
Johannes Berg 已提交
2353
		if (!ieee80211_tx_prepare(sdata, &tx, skb))
2354 2355 2356
			break;
		dev_kfree_skb_any(skb);
	}
2357 2358 2359

	info = IEEE80211_SKB_CB(skb);

2360
	sta = tx.sta;
2361 2362
	tx.flags |= IEEE80211_TX_PS_BUFFERED;
	tx.channel = local->hw.conf.channel;
2363
	info->band = tx.channel->band;
2364

2365
	if (invoke_tx_handlers(&tx))
2366
		skb = NULL;
2367
 out:
2368
	rcu_read_unlock();
2369 2370 2371 2372

	return skb;
}
EXPORT_SYMBOL(ieee80211_get_buffered_bc);
J
Johannes Berg 已提交
2373

2374
void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
J
Johannes Berg 已提交
2375 2376 2377 2378 2379
{
	skb_set_mac_header(skb, 0);
	skb_set_network_header(skb, 0);
	skb_set_transport_header(skb, 0);

2380 2381 2382
	/* send all internal mgmt frames on VO */
	skb_set_queue_mapping(skb, 0);

2383 2384 2385 2386 2387 2388
	/*
	 * The other path calling ieee80211_xmit is from the tasklet,
	 * and while we can handle concurrent transmissions locking
	 * requirements are that we do not come into tx with bhs on.
	 */
	local_bh_disable();
J
Johannes Berg 已提交
2389
	ieee80211_xmit(sdata, skb);
2390
	local_bh_enable();
J
Johannes Berg 已提交
2391
}