?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
IB/mlx4: fix sprintf format warning
[linux/fpc-iii.git] / net / mac80211 / tx.c
blob94826680cf2b54e2a6254146856b495d0ba5e861
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 *
12 *
13 * Transmit and frame generation functions.
14 */
15
16 #include <linux/kernel.h>
17 #include <linux/slab.h>
18 #include <linux/skbuff.h>
19 #include <linux/if_vlan.h>
20 #include <linux/etherdevice.h>
21 #include <linux/bitmap.h>
22 #include <linux/rcupdate.h>
23 #include <linux/export.h>
24 #include <net/net_namespace.h>
25 #include <net/ieee80211_radiotap.h>
26 #include <net/cfg80211.h>
27 #include <net/mac80211.h>
28 #include <net/codel.h>
29 #include <net/codel_impl.h>
30 #include <asm/unaligned.h>
31 #include <net/fq_impl.h>
32
33 #include "ieee80211_i.h"
34 #include "driver-ops.h"
35 #include "led.h"
36 #include "mesh.h"
37 #include "wep.h"
38 #include "wpa.h"
39 #include "wme.h"
40 #include "rate.h"
41
42 /* misc utils */
43
44 static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
45 {
46 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
47
48 u64_stats_update_begin(&tstats->syncp);
49 tstats->tx_packets++;
50 tstats->tx_bytes += len;
51 u64_stats_update_end(&tstats->syncp);
52 }
53
54 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
55 struct sk_buff *skb, int group_addr,
56 int next_frag_len)
57 {
58 int rate, mrate, erp, dur, i, shift = 0;
59 struct ieee80211_rate *txrate;
60 struct ieee80211_local *local = tx->local;
61 struct ieee80211_supported_band *sband;
62 struct ieee80211_hdr *hdr;
63 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
64 struct ieee80211_chanctx_conf *chanctx_conf;
65 u32 rate_flags = 0;
66
67 /* assume HW handles this */
68 if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
69 return 0;
70
71 rcu_read_lock();
72 chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
73 if (chanctx_conf) {
74 shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
75 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
76 }
77 rcu_read_unlock();
78
79 /* uh huh? */
80 if (WARN_ON_ONCE(tx->rate.idx < 0))
81 return 0;
82
83 sband = local->hw.wiphy->bands[info->band];
84 txrate = &sband->bitrates[tx->rate.idx];
85
86 erp = txrate->flags & IEEE80211_RATE_ERP_G;
87
88 /*
89 * data and mgmt (except PS Poll):
90 * - during CFP: 32768
91 * - during contention period:
92 * if addr1 is group address: 0
93 * if more fragments = 0 and addr1 is individual address: time to
94 * transmit one ACK plus SIFS
95 * if more fragments = 1 and addr1 is individual address: time to
96 * transmit next fragment plus 2 x ACK plus 3 x SIFS
97 *
98 * IEEE 802.11, 9.6:
99 * - control response frame (CTS or ACK) shall be transmitted using the
100 * same rate as the immediately previous frame in the frame exchange
101 * sequence, if this rate belongs to the PHY mandatory rates, or else
102 * at the highest possible rate belonging to the PHY rates in the
103 * BSSBasicRateSet
104 */
105 hdr = (struct ieee80211_hdr *)skb->data;
106 if (ieee80211_is_ctl(hdr->frame_control)) {
107 /* TODO: These control frames are not currently sent by
108 * mac80211, but should they be implemented, this function
109 * needs to be updated to support duration field calculation.
110 *
111 * RTS: time needed to transmit pending data/mgmt frame plus
112 * one CTS frame plus one ACK frame plus 3 x SIFS
113 * CTS: duration of immediately previous RTS minus time
114 * required to transmit CTS and its SIFS
115 * ACK: 0 if immediately previous directed data/mgmt had
116 * more=0, with more=1 duration in ACK frame is duration
117 * from previous frame minus time needed to transmit ACK
118 * and its SIFS
119 * PS Poll: BIT(15) | BIT(14) | aid
120 */
121 return 0;
122 }
123
124 /* data/mgmt */
125 if (0 /* FIX: data/mgmt during CFP */)
126 return cpu_to_le16(32768);
127
128 if (group_addr) /* Group address as the destination - no ACK */
129 return 0;
130
131 /* Individual destination address:
132 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
133 * CTS and ACK frames shall be transmitted using the highest rate in
134 * basic rate set that is less than or equal to the rate of the
135 * immediately previous frame and that is using the same modulation
136 * (CCK or OFDM). If no basic rate set matches with these requirements,
137 * the highest mandatory rate of the PHY that is less than or equal to
138 * the rate of the previous frame is used.
139 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
140 */
141 rate = -1;
142 /* use lowest available if everything fails */
143 mrate = sband->bitrates[0].bitrate;
144 for (i = 0; i < sband->n_bitrates; i++) {
145 struct ieee80211_rate *r = &sband->bitrates[i];
146
147 if (r->bitrate > txrate->bitrate)
148 break;
149
150 if ((rate_flags & r->flags) != rate_flags)
151 continue;
152
153 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
154 rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
155
156 switch (sband->band) {
157 case NL80211_BAND_2GHZ: {
158 u32 flag;
159 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
160 flag = IEEE80211_RATE_MANDATORY_G;
161 else
162 flag = IEEE80211_RATE_MANDATORY_B;
163 if (r->flags & flag)
164 mrate = r->bitrate;
165 break;
166 }
167 case NL80211_BAND_5GHZ:
168 if (r->flags & IEEE80211_RATE_MANDATORY_A)
169 mrate = r->bitrate;
170 break;
171 case NL80211_BAND_60GHZ:
172 /* TODO, for now fall through */
173 case NUM_NL80211_BANDS:
174 WARN_ON(1);
175 break;
176 }
177 }
178 if (rate == -1) {
179 /* No matching basic rate found; use highest suitable mandatory
180 * PHY rate */
181 rate = DIV_ROUND_UP(mrate, 1 << shift);
182 }
183
184 /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
185 if (ieee80211_is_data_qos(hdr->frame_control) &&
186 *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
187 dur = 0;
188 else
189 /* Time needed to transmit ACK
190 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
191 * to closest integer */
192 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
193 tx->sdata->vif.bss_conf.use_short_preamble,
194 shift);
195
196 if (next_frag_len) {
197 /* Frame is fragmented: duration increases with time needed to
198 * transmit next fragment plus ACK and 2 x SIFS. */
199 dur *= 2; /* ACK + SIFS */
200 /* next fragment */
201 dur += ieee80211_frame_duration(sband->band, next_frag_len,
202 txrate->bitrate, erp,
203 tx->sdata->vif.bss_conf.use_short_preamble,
204 shift);
205 }
206
207 return cpu_to_le16(dur);
208 }
209
210 /* tx handlers */
211 static ieee80211_tx_result debug_noinline
212 ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
213 {
214 struct ieee80211_local *local = tx->local;
215 struct ieee80211_if_managed *ifmgd;
216
217 /* driver doesn't support power save */
218 if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS))
219 return TX_CONTINUE;
220
221 /* hardware does dynamic power save */
222 if (ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
223 return TX_CONTINUE;
224
225 /* dynamic power save disabled */
226 if (local->hw.conf.dynamic_ps_timeout <= 0)
227 return TX_CONTINUE;
228
229 /* we are scanning, don't enable power save */
230 if (local->scanning)
231 return TX_CONTINUE;
232
233 if (!local->ps_sdata)
234 return TX_CONTINUE;
235
236 /* No point if we're going to suspend */
237 if (local->quiescing)
238 return TX_CONTINUE;
239
240 /* dynamic ps is supported only in managed mode */
241 if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
242 return TX_CONTINUE;
243
244 ifmgd = &tx->sdata->u.mgd;
245
246 /*
247 * Don't wakeup from power save if u-apsd is enabled, voip ac has
248 * u-apsd enabled and the frame is in voip class. This effectively
249 * means that even if all access categories have u-apsd enabled, in
250 * practise u-apsd is only used with the voip ac. This is a
251 * workaround for the case when received voip class packets do not
252 * have correct qos tag for some reason, due the network or the
253 * peer application.
254 *
255 * Note: ifmgd->uapsd_queues access is racy here. If the value is
256 * changed via debugfs, user needs to reassociate manually to have
257 * everything in sync.
258 */
259 if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
260 (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
261 skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
262 return TX_CONTINUE;
263
264 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
265 ieee80211_stop_queues_by_reason(&local->hw,
266 IEEE80211_MAX_QUEUE_MAP,
267 IEEE80211_QUEUE_STOP_REASON_PS,
268 false);
269 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
270 ieee80211_queue_work(&local->hw,
271 &local->dynamic_ps_disable_work);
272 }
273
274 /* Don't restart the timer if we're not disassociated */
275 if (!ifmgd->associated)
276 return TX_CONTINUE;
277
278 mod_timer(&local->dynamic_ps_timer, jiffies +
279 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
280
281 return TX_CONTINUE;
282 }
283
284 static ieee80211_tx_result debug_noinline
285 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
286 {
287
288 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
289 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
290 bool assoc = false;
291
292 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
293 return TX_CONTINUE;
294
295 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
296 test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
297 !ieee80211_is_probe_req(hdr->frame_control) &&
298 !ieee80211_is_nullfunc(hdr->frame_control))
299 /*
300 * When software scanning only nullfunc frames (to notify
301 * the sleep state to the AP) and probe requests (for the
302 * active scan) are allowed, all other frames should not be
303 * sent and we should not get here, but if we do
304 * nonetheless, drop them to avoid sending them
305 * off-channel. See the link below and
306 * ieee80211_start_scan() for more.
307 *
308 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
309 */
310 return TX_DROP;
311
312 if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
313 return TX_CONTINUE;
314
315 if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
316 return TX_CONTINUE;
317
318 if (tx->flags & IEEE80211_TX_PS_BUFFERED)
319 return TX_CONTINUE;
320
321 if (tx->sta)
322 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
323
324 if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
325 if (unlikely(!assoc &&
326 ieee80211_is_data(hdr->frame_control))) {
327 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
328 sdata_info(tx->sdata,
329 "dropped data frame to not associated station %pM\n",
330 hdr->addr1);
331 #endif
332 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
333 return TX_DROP;
334 }
335 } else if (unlikely(ieee80211_is_data(hdr->frame_control) &&
336 ieee80211_vif_get_num_mcast_if(tx->sdata) == 0)) {
337 /*
338 * No associated STAs - no need to send multicast
339 * frames.
340 */
341 return TX_DROP;
342 }
343
344 return TX_CONTINUE;
345 }
346
347 /* This function is called whenever the AP is about to exceed the maximum limit
348 * of buffered frames for power saving STAs. This situation should not really
349 * happen often during normal operation, so dropping the oldest buffered packet
350 * from each queue should be OK to make some room for new frames. */
351 static void purge_old_ps_buffers(struct ieee80211_local *local)
352 {
353 int total = 0, purged = 0;
354 struct sk_buff *skb;
355 struct ieee80211_sub_if_data *sdata;
356 struct sta_info *sta;
357
358 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
359 struct ps_data *ps;
360
361 if (sdata->vif.type == NL80211_IFTYPE_AP)
362 ps = &sdata->u.ap.ps;
363 else if (ieee80211_vif_is_mesh(&sdata->vif))
364 ps = &sdata->u.mesh.ps;
365 else
366 continue;
367
368 skb = skb_dequeue(&ps->bc_buf);
369 if (skb) {
370 purged++;
371 ieee80211_free_txskb(&local->hw, skb);
372 }
373 total += skb_queue_len(&ps->bc_buf);
374 }
375
376 /*
377 * Drop one frame from each station from the lowest-priority
378 * AC that has frames at all.
379 */
380 list_for_each_entry_rcu(sta, &local->sta_list, list) {
381 int ac;
382
383 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
384 skb = skb_dequeue(&sta->ps_tx_buf[ac]);
385 total += skb_queue_len(&sta->ps_tx_buf[ac]);
386 if (skb) {
387 purged++;
388 ieee80211_free_txskb(&local->hw, skb);
389 break;
390 }
391 }
392 }
393
394 local->total_ps_buffered = total;
395 ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
396 }
397
398 static ieee80211_tx_result
399 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
400 {
401 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
402 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
403 struct ps_data *ps;
404
405 /*
406 * broadcast/multicast frame
407 *
408 * If any of the associated/peer stations is in power save mode,
409 * the frame is buffered to be sent after DTIM beacon frame.
410 * This is done either by the hardware or us.
411 */
412
413 /* powersaving STAs currently only in AP/VLAN/mesh mode */
414 if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
415 tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
416 if (!tx->sdata->bss)
417 return TX_CONTINUE;
418
419 ps = &tx->sdata->bss->ps;
420 } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
421 ps = &tx->sdata->u.mesh.ps;
422 } else {
423 return TX_CONTINUE;
424 }
425
426
427 /* no buffering for ordered frames */
428 if (ieee80211_has_order(hdr->frame_control))
429 return TX_CONTINUE;
430
431 if (ieee80211_is_probe_req(hdr->frame_control))
432 return TX_CONTINUE;
433
434 if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
435 info->hw_queue = tx->sdata->vif.cab_queue;
436
437 /* no stations in PS mode */
438 if (!atomic_read(&ps->num_sta_ps))
439 return TX_CONTINUE;
440
441 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
442
443 /* device releases frame after DTIM beacon */
444 if (!ieee80211_hw_check(&tx->local->hw, HOST_BROADCAST_PS_BUFFERING))
445 return TX_CONTINUE;
446
447 /* buffered in mac80211 */
448 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
449 purge_old_ps_buffers(tx->local);
450
451 if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
452 ps_dbg(tx->sdata,
453 "BC TX buffer full - dropping the oldest frame\n");
454 ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
455 } else
456 tx->local->total_ps_buffered++;
457
458 skb_queue_tail(&ps->bc_buf, tx->skb);
459
460 return TX_QUEUED;
461 }
462
463 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
464 struct sk_buff *skb)
465 {
466 if (!ieee80211_is_mgmt(fc))
467 return 0;
468
469 if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
470 return 0;
471
472 if (!ieee80211_is_robust_mgmt_frame(skb))
473 return 0;
474
475 return 1;
476 }
477
478 static ieee80211_tx_result
479 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
480 {
481 struct sta_info *sta = tx->sta;
482 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
483 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
484 struct ieee80211_local *local = tx->local;
485
486 if (unlikely(!sta))
487 return TX_CONTINUE;
488
489 if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
490 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
491 test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
492 !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
493 int ac = skb_get_queue_mapping(tx->skb);
494
495 if (ieee80211_is_mgmt(hdr->frame_control) &&
496 !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
497 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
498 return TX_CONTINUE;
499 }
500
501 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
502 sta->sta.addr, sta->sta.aid, ac);
503 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
504 purge_old_ps_buffers(tx->local);
505
506 /* sync with ieee80211_sta_ps_deliver_wakeup */
507 spin_lock(&sta->ps_lock);
508 /*
509 * STA woke up the meantime and all the frames on ps_tx_buf have
510 * been queued to pending queue. No reordering can happen, go
511 * ahead and Tx the packet.
512 */
513 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
514 !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
515 !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
516 spin_unlock(&sta->ps_lock);
517 return TX_CONTINUE;
518 }
519
520 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
521 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
522 ps_dbg(tx->sdata,
523 "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
524 sta->sta.addr, ac);
525 ieee80211_free_txskb(&local->hw, old);
526 } else
527 tx->local->total_ps_buffered++;
528
529 info->control.jiffies = jiffies;
530 info->control.vif = &tx->sdata->vif;
531 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
532 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
533 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
534 spin_unlock(&sta->ps_lock);
535
536 if (!timer_pending(&local->sta_cleanup))
537 mod_timer(&local->sta_cleanup,
538 round_jiffies(jiffies +
539 STA_INFO_CLEANUP_INTERVAL));
540
541 /*
542 * We queued up some frames, so the TIM bit might
543 * need to be set, recalculate it.
544 */
545 sta_info_recalc_tim(sta);
546
547 return TX_QUEUED;
548 } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
549 ps_dbg(tx->sdata,
550 "STA %pM in PS mode, but polling/in SP -> send frame\n",
551 sta->sta.addr);
552 }
553
554 return TX_CONTINUE;
555 }
556
557 static ieee80211_tx_result debug_noinline
558 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
559 {
560 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
561 return TX_CONTINUE;
562
563 if (tx->flags & IEEE80211_TX_UNICAST)
564 return ieee80211_tx_h_unicast_ps_buf(tx);
565 else
566 return ieee80211_tx_h_multicast_ps_buf(tx);
567 }
568
569 static ieee80211_tx_result debug_noinline
570 ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
571 {
572 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
573
574 if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
575 if (tx->sdata->control_port_no_encrypt)
576 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
577 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
578 info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
579 }
580
581 return TX_CONTINUE;
582 }
583
584 static ieee80211_tx_result debug_noinline
585 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
586 {
587 struct ieee80211_key *key;
588 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
589 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
590
591 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
592 tx->key = NULL;
593 else if (tx->sta &&
594 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
595 tx->key = key;
596 else if (ieee80211_is_group_privacy_action(tx->skb) &&
597 (key = rcu_dereference(tx->sdata->default_multicast_key)))
598 tx->key = key;
599 else if (ieee80211_is_mgmt(hdr->frame_control) &&
600 is_multicast_ether_addr(hdr->addr1) &&
601 ieee80211_is_robust_mgmt_frame(tx->skb) &&
602 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
603 tx->key = key;
604 else if (is_multicast_ether_addr(hdr->addr1) &&
605 (key = rcu_dereference(tx->sdata->default_multicast_key)))
606 tx->key = key;
607 else if (!is_multicast_ether_addr(hdr->addr1) &&
608 (key = rcu_dereference(tx->sdata->default_unicast_key)))
609 tx->key = key;
610 else
611 tx->key = NULL;
612
613 if (tx->key) {
614 bool skip_hw = false;
615
616 /* TODO: add threshold stuff again */
617
618 switch (tx->key->conf.cipher) {
619 case WLAN_CIPHER_SUITE_WEP40:
620 case WLAN_CIPHER_SUITE_WEP104:
621 case WLAN_CIPHER_SUITE_TKIP:
622 if (!ieee80211_is_data_present(hdr->frame_control))
623 tx->key = NULL;
624 break;
625 case WLAN_CIPHER_SUITE_CCMP:
626 case WLAN_CIPHER_SUITE_CCMP_256:
627 case WLAN_CIPHER_SUITE_GCMP:
628 case WLAN_CIPHER_SUITE_GCMP_256:
629 if (!ieee80211_is_data_present(hdr->frame_control) &&
630 !ieee80211_use_mfp(hdr->frame_control, tx->sta,
631 tx->skb) &&
632 !ieee80211_is_group_privacy_action(tx->skb))
633 tx->key = NULL;
634 else
635 skip_hw = (tx->key->conf.flags &
636 IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
637 ieee80211_is_mgmt(hdr->frame_control);
638 break;
639 case WLAN_CIPHER_SUITE_AES_CMAC:
640 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
641 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
642 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
643 if (!ieee80211_is_mgmt(hdr->frame_control))
644 tx->key = NULL;
645 break;
646 }
647
648 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
649 !ieee80211_is_deauth(hdr->frame_control)))
650 return TX_DROP;
651
652 if (!skip_hw && tx->key &&
653 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
654 info->control.hw_key = &tx->key->conf;
655 }
656
657 return TX_CONTINUE;
658 }
659
660 static ieee80211_tx_result debug_noinline
661 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
662 {
663 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
664 struct ieee80211_hdr *hdr = (void *)tx->skb->data;
665 struct ieee80211_supported_band *sband;
666 u32 len;
667 struct ieee80211_tx_rate_control txrc;
668 struct ieee80211_sta_rates *ratetbl = NULL;
669 bool assoc = false;
670
671 memset(&txrc, 0, sizeof(txrc));
672
673 sband = tx->local->hw.wiphy->bands[info->band];
674
675 len = min_t(u32, tx->skb->len + FCS_LEN,
676 tx->local->hw.wiphy->frag_threshold);
677
678 /* set up the tx rate control struct we give the RC algo */
679 txrc.hw = &tx->local->hw;
680 txrc.sband = sband;
681 txrc.bss_conf = &tx->sdata->vif.bss_conf;
682 txrc.skb = tx->skb;
683 txrc.reported_rate.idx = -1;
684 txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
685
686 if (tx->sdata->rc_has_mcs_mask[info->band])
687 txrc.rate_idx_mcs_mask =
688 tx->sdata->rc_rateidx_mcs_mask[info->band];
689
690 txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
691 tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
692 tx->sdata->vif.type == NL80211_IFTYPE_ADHOC ||
693 tx->sdata->vif.type == NL80211_IFTYPE_OCB);
694
695 /* set up RTS protection if desired */
696 if (len > tx->local->hw.wiphy->rts_threshold) {
697 txrc.rts = true;
698 }
699
700 info->control.use_rts = txrc.rts;
701 info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
702
703 /*
704 * Use short preamble if the BSS can handle it, but not for
705 * management frames unless we know the receiver can handle
706 * that -- the management frame might be to a station that
707 * just wants a probe response.
708 */
709 if (tx->sdata->vif.bss_conf.use_short_preamble &&
710 (ieee80211_is_data(hdr->frame_control) ||
711 (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
712 txrc.short_preamble = true;
713
714 info->control.short_preamble = txrc.short_preamble;
715
716 /* don't ask rate control when rate already injected via radiotap */
717 if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
718 return TX_CONTINUE;
719
720 if (tx->sta)
721 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
722
723 /*
724 * Lets not bother rate control if we're associated and cannot
725 * talk to the sta. This should not happen.
726 */
727 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
728 !rate_usable_index_exists(sband, &tx->sta->sta),
729 "%s: Dropped data frame as no usable bitrate found while "
730 "scanning and associated. Target station: "
731 "%pM on %d GHz band\n",
732 tx->sdata->name, hdr->addr1,
733 info->band ? 5 : 2))
734 return TX_DROP;
735
736 /*
737 * If we're associated with the sta at this point we know we can at
738 * least send the frame at the lowest bit rate.
739 */
740 rate_control_get_rate(tx->sdata, tx->sta, &txrc);
741
742 if (tx->sta && !info->control.skip_table)
743 ratetbl = rcu_dereference(tx->sta->sta.rates);
744
745 if (unlikely(info->control.rates[0].idx < 0)) {
746 if (ratetbl) {
747 struct ieee80211_tx_rate rate = {
748 .idx = ratetbl->rate[0].idx,
749 .flags = ratetbl->rate[0].flags,
750 .count = ratetbl->rate[0].count
751 };
752
753 if (ratetbl->rate[0].idx < 0)
754 return TX_DROP;
755
756 tx->rate = rate;
757 } else {
758 return TX_DROP;
759 }
760 } else {
761 tx->rate = info->control.rates[0];
762 }
763
764 if (txrc.reported_rate.idx < 0) {
765 txrc.reported_rate = tx->rate;
766 if (tx->sta && ieee80211_is_data(hdr->frame_control))
767 tx->sta->tx_stats.last_rate = txrc.reported_rate;
768 } else if (tx->sta)
769 tx->sta->tx_stats.last_rate = txrc.reported_rate;
770
771 if (ratetbl)
772 return TX_CONTINUE;
773
774 if (unlikely(!info->control.rates[0].count))
775 info->control.rates[0].count = 1;
776
777 if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
778 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
779 info->control.rates[0].count = 1;
780
781 return TX_CONTINUE;
782 }
783
784 static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
785 {
786 u16 *seq = &sta->tid_seq[tid];
787 __le16 ret = cpu_to_le16(*seq);
788
789 /* Increase the sequence number. */
790 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
791
792 return ret;
793 }
794
795 static ieee80211_tx_result debug_noinline
796 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
797 {
798 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
799 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
800 u8 *qc;
801 int tid;
802
803 /*
804 * Packet injection may want to control the sequence
805 * number, if we have no matching interface then we
806 * neither assign one ourselves nor ask the driver to.
807 */
808 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
809 return TX_CONTINUE;
810
811 if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
812 return TX_CONTINUE;
813
814 if (ieee80211_hdrlen(hdr->frame_control) < 24)
815 return TX_CONTINUE;
816
817 if (ieee80211_is_qos_nullfunc(hdr->frame_control))
818 return TX_CONTINUE;
819
820 /*
821 * Anything but QoS data that has a sequence number field
822 * (is long enough) gets a sequence number from the global
823 * counter. QoS data frames with a multicast destination
824 * also use the global counter (802.11-2012 9.3.2.10).
825 */
826 if (!ieee80211_is_data_qos(hdr->frame_control) ||
827 is_multicast_ether_addr(hdr->addr1)) {
828 /* driver should assign sequence number */
829 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
830 /* for pure STA mode without beacons, we can do it */
831 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
832 tx->sdata->sequence_number += 0x10;
833 if (tx->sta)
834 tx->sta->tx_stats.msdu[IEEE80211_NUM_TIDS]++;
835 return TX_CONTINUE;
836 }
837
838 /*
839 * This should be true for injected/management frames only, for
840 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
841 * above since they are not QoS-data frames.
842 */
843 if (!tx->sta)
844 return TX_CONTINUE;
845
846 /* include per-STA, per-TID sequence counter */
847
848 qc = ieee80211_get_qos_ctl(hdr);
849 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
850 tx->sta->tx_stats.msdu[tid]++;
851
852 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
853
854 return TX_CONTINUE;
855 }
856
857 static int ieee80211_fragment(struct ieee80211_tx_data *tx,
858 struct sk_buff *skb, int hdrlen,
859 int frag_threshold)
860 {
861 struct ieee80211_local *local = tx->local;
862 struct ieee80211_tx_info *info;
863 struct sk_buff *tmp;
864 int per_fragm = frag_threshold - hdrlen - FCS_LEN;
865 int pos = hdrlen + per_fragm;
866 int rem = skb->len - hdrlen - per_fragm;
867
868 if (WARN_ON(rem < 0))
869 return -EINVAL;
870
871 /* first fragment was already added to queue by caller */
872
873 while (rem) {
874 int fraglen = per_fragm;
875
876 if (fraglen > rem)
877 fraglen = rem;
878 rem -= fraglen;
879 tmp = dev_alloc_skb(local->tx_headroom +
880 frag_threshold +
881 tx->sdata->encrypt_headroom +
882 IEEE80211_ENCRYPT_TAILROOM);
883 if (!tmp)
884 return -ENOMEM;
885
886 __skb_queue_tail(&tx->skbs, tmp);
887
888 skb_reserve(tmp,
889 local->tx_headroom + tx->sdata->encrypt_headroom);
890
891 /* copy control information */
892 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
893
894 info = IEEE80211_SKB_CB(tmp);
895 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
896 IEEE80211_TX_CTL_FIRST_FRAGMENT);
897
898 if (rem)
899 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
900
901 skb_copy_queue_mapping(tmp, skb);
902 tmp->priority = skb->priority;
903 tmp->dev = skb->dev;
904
905 /* copy header and data */
906 skb_put_data(tmp, skb->data, hdrlen);
907 skb_put_data(tmp, skb->data + pos, fraglen);
908
909 pos += fraglen;
910 }
911
912 /* adjust first fragment's length */
913 skb_trim(skb, hdrlen + per_fragm);
914 return 0;
915 }
916
917 static ieee80211_tx_result debug_noinline
918 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
919 {
920 struct sk_buff *skb = tx->skb;
921 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
922 struct ieee80211_hdr *hdr = (void *)skb->data;
923 int frag_threshold = tx->local->hw.wiphy->frag_threshold;
924 int hdrlen;
925 int fragnum;
926
927 /* no matter what happens, tx->skb moves to tx->skbs */
928 __skb_queue_tail(&tx->skbs, skb);
929 tx->skb = NULL;
930
931 if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
932 return TX_CONTINUE;
933
934 if (ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG))
935 return TX_CONTINUE;
936
937 /*
938 * Warn when submitting a fragmented A-MPDU frame and drop it.
939 * This scenario is handled in ieee80211_tx_prepare but extra
940 * caution taken here as fragmented ampdu may cause Tx stop.
941 */
942 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
943 return TX_DROP;
944
945 hdrlen = ieee80211_hdrlen(hdr->frame_control);
946
947 /* internal error, why isn't DONTFRAG set? */
948 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
949 return TX_DROP;
950
951 /*
952 * Now fragment the frame. This will allocate all the fragments and
953 * chain them (using skb as the first fragment) to skb->next.
954 * During transmission, we will remove the successfully transmitted
955 * fragments from this list. When the low-level driver rejects one
956 * of the fragments then we will simply pretend to accept the skb
957 * but store it away as pending.
958 */
959 if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
960 return TX_DROP;
961
962 /* update duration/seq/flags of fragments */
963 fragnum = 0;
964
965 skb_queue_walk(&tx->skbs, skb) {
966 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
967
968 hdr = (void *)skb->data;
969 info = IEEE80211_SKB_CB(skb);
970
971 if (!skb_queue_is_last(&tx->skbs, skb)) {
972 hdr->frame_control |= morefrags;
973 /*
974 * No multi-rate retries for fragmented frames, that
975 * would completely throw off the NAV at other STAs.
976 */
977 info->control.rates[1].idx = -1;
978 info->control.rates[2].idx = -1;
979 info->control.rates[3].idx = -1;
980 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
981 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
982 } else {
983 hdr->frame_control &= ~morefrags;
984 }
985 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
986 fragnum++;
987 }
988
989 return TX_CONTINUE;
990 }
991
992 static ieee80211_tx_result debug_noinline
993 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
994 {
995 struct sk_buff *skb;
996 int ac = -1;
997
998 if (!tx->sta)
999 return TX_CONTINUE;
1000
1001 skb_queue_walk(&tx->skbs, skb) {
1002 ac = skb_get_queue_mapping(skb);
1003 tx->sta->tx_stats.bytes[ac] += skb->len;
1004 }
1005 if (ac >= 0)
1006 tx->sta->tx_stats.packets[ac]++;
1007
1008 return TX_CONTINUE;
1009 }
1010
1011 static ieee80211_tx_result debug_noinline
1012 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
1013 {
1014 if (!tx->key)
1015 return TX_CONTINUE;
1016
1017 switch (tx->key->conf.cipher) {
1018 case WLAN_CIPHER_SUITE_WEP40:
1019 case WLAN_CIPHER_SUITE_WEP104:
1020 return ieee80211_crypto_wep_encrypt(tx);
1021 case WLAN_CIPHER_SUITE_TKIP:
1022 return ieee80211_crypto_tkip_encrypt(tx);
1023 case WLAN_CIPHER_SUITE_CCMP:
1024 return ieee80211_crypto_ccmp_encrypt(
1025 tx, IEEE80211_CCMP_MIC_LEN);
1026 case WLAN_CIPHER_SUITE_CCMP_256:
1027 return ieee80211_crypto_ccmp_encrypt(
1028 tx, IEEE80211_CCMP_256_MIC_LEN);
1029 case WLAN_CIPHER_SUITE_AES_CMAC:
1030 return ieee80211_crypto_aes_cmac_encrypt(tx);
1031 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1032 return ieee80211_crypto_aes_cmac_256_encrypt(tx);
1033 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1034 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1035 return ieee80211_crypto_aes_gmac_encrypt(tx);
1036 case WLAN_CIPHER_SUITE_GCMP:
1037 case WLAN_CIPHER_SUITE_GCMP_256:
1038 return ieee80211_crypto_gcmp_encrypt(tx);
1039 default:
1040 return ieee80211_crypto_hw_encrypt(tx);
1041 }
1042
1043 return TX_DROP;
1044 }
1045
1046 static ieee80211_tx_result debug_noinline
1047 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
1048 {
1049 struct sk_buff *skb;
1050 struct ieee80211_hdr *hdr;
1051 int next_len;
1052 bool group_addr;
1053
1054 skb_queue_walk(&tx->skbs, skb) {
1055 hdr = (void *) skb->data;
1056 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
1057 break; /* must not overwrite AID */
1058 if (!skb_queue_is_last(&tx->skbs, skb)) {
1059 struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
1060 next_len = next->len;
1061 } else
1062 next_len = 0;
1063 group_addr = is_multicast_ether_addr(hdr->addr1);
1064
1065 hdr->duration_id =
1066 ieee80211_duration(tx, skb, group_addr, next_len);
1067 }
1068
1069 return TX_CONTINUE;
1070 }
1071
1072 /* actual transmit path */
1073
1074 static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
1075 struct sk_buff *skb,
1076 struct ieee80211_tx_info *info,
1077 struct tid_ampdu_tx *tid_tx,
1078 int tid)
1079 {
1080 bool queued = false;
1081 bool reset_agg_timer = false;
1082 struct sk_buff *purge_skb = NULL;
1083
1084 if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1085 info->flags |= IEEE80211_TX_CTL_AMPDU;
1086 reset_agg_timer = true;
1087 } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
1088 /*
1089 * nothing -- this aggregation session is being started
1090 * but that might still fail with the driver
1091 */
1092 } else if (!tx->sta->sta.txq[tid]) {
1093 spin_lock(&tx->sta->lock);
1094 /*
1095 * Need to re-check now, because we may get here
1096 *
1097 * 1) in the window during which the setup is actually
1098 * already done, but not marked yet because not all
1099 * packets are spliced over to the driver pending
1100 * queue yet -- if this happened we acquire the lock
1101 * either before or after the splice happens, but
1102 * need to recheck which of these cases happened.
1103 *
1104 * 2) during session teardown, if the OPERATIONAL bit
1105 * was cleared due to the teardown but the pointer
1106 * hasn't been assigned NULL yet (or we loaded it
1107 * before it was assigned) -- in this case it may
1108 * now be NULL which means we should just let the
1109 * packet pass through because splicing the frames
1110 * back is already done.
1111 */
1112 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
1113
1114 if (!tid_tx) {
1115 /* do nothing, let packet pass through */
1116 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1117 info->flags |= IEEE80211_TX_CTL_AMPDU;
1118 reset_agg_timer = true;
1119 } else {
1120 queued = true;
1121 if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER) {
1122 clear_sta_flag(tx->sta, WLAN_STA_SP);
1123 ps_dbg(tx->sta->sdata,
1124 "STA %pM aid %d: SP frame queued, close the SP w/o telling the peer\n",
1125 tx->sta->sta.addr, tx->sta->sta.aid);
1126 }
1127 info->control.vif = &tx->sdata->vif;
1128 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1129 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
1130 __skb_queue_tail(&tid_tx->pending, skb);
1131 if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
1132 purge_skb = __skb_dequeue(&tid_tx->pending);
1133 }
1134 spin_unlock(&tx->sta->lock);
1135
1136 if (purge_skb)
1137 ieee80211_free_txskb(&tx->local->hw, purge_skb);
1138 }
1139
1140 /* reset session timer */
1141 if (reset_agg_timer && tid_tx->timeout)
1142 tid_tx->last_tx = jiffies;
1143
1144 return queued;
1145 }
1146
1147 /*
1148 * initialises @tx
1149 * pass %NULL for the station if unknown, a valid pointer if known
1150 * or an ERR_PTR() if the station is known not to exist
1151 */
1152 static ieee80211_tx_result
1153 ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1154 struct ieee80211_tx_data *tx,
1155 struct sta_info *sta, struct sk_buff *skb)
1156 {
1157 struct ieee80211_local *local = sdata->local;
1158 struct ieee80211_hdr *hdr;
1159 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1160 int tid;
1161 u8 *qc;
1162
1163 memset(tx, 0, sizeof(*tx));
1164 tx->skb = skb;
1165 tx->local = local;
1166 tx->sdata = sdata;
1167 __skb_queue_head_init(&tx->skbs);
1168
1169 /*
1170 * If this flag is set to true anywhere, and we get here,
1171 * we are doing the needed processing, so remove the flag
1172 * now.
1173 */
1174 info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1175
1176 hdr = (struct ieee80211_hdr *) skb->data;
1177
1178 if (likely(sta)) {
1179 if (!IS_ERR(sta))
1180 tx->sta = sta;
1181 } else {
1182 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1183 tx->sta = rcu_dereference(sdata->u.vlan.sta);
1184 if (!tx->sta && sdata->wdev.use_4addr)
1185 return TX_DROP;
1186 } else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
1187 IEEE80211_TX_CTL_INJECTED) ||
1188 tx->sdata->control_port_protocol == tx->skb->protocol) {
1189 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1190 }
1191 if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
1192 tx->sta = sta_info_get(sdata, hdr->addr1);
1193 }
1194
1195 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
1196 !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
1197 ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
1198 !ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW)) {
1199 struct tid_ampdu_tx *tid_tx;
1200
1201 qc = ieee80211_get_qos_ctl(hdr);
1202 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
1203
1204 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1205 if (tid_tx) {
1206 bool queued;
1207
1208 queued = ieee80211_tx_prep_agg(tx, skb, info,
1209 tid_tx, tid);
1210
1211 if (unlikely(queued))
1212 return TX_QUEUED;
1213 }
1214 }
1215
1216 if (is_multicast_ether_addr(hdr->addr1)) {
1217 tx->flags &= ~IEEE80211_TX_UNICAST;
1218 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1219 } else
1220 tx->flags |= IEEE80211_TX_UNICAST;
1221
1222 if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
1223 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
1224 skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
1225 info->flags & IEEE80211_TX_CTL_AMPDU)
1226 info->flags |= IEEE80211_TX_CTL_DONTFRAG;
1227 }
1228
1229 if (!tx->sta)
1230 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1231 else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) {
1232 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1233 ieee80211_check_fast_xmit(tx->sta);
1234 }
1235
1236 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
1237
1238 return TX_CONTINUE;
1239 }
1240
1241 static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
1242 struct ieee80211_vif *vif,
1243 struct sta_info *sta,
1244 struct sk_buff *skb)
1245 {
1246 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1247 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1248 struct ieee80211_txq *txq = NULL;
1249
1250 if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
1251 (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
1252 return NULL;
1253
1254 if (!ieee80211_is_data(hdr->frame_control))
1255 return NULL;
1256
1257 if (sta) {
1258 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1259
1260 if (!sta->uploaded)
1261 return NULL;
1262
1263 txq = sta->sta.txq[tid];
1264 } else if (vif) {
1265 txq = vif->txq;
1266 }
1267
1268 if (!txq)
1269 return NULL;
1270
1271 return to_txq_info(txq);
1272 }
1273
1274 static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
1275 {
1276 IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
1277 }
1278
1279 static u32 codel_skb_len_func(const struct sk_buff *skb)
1280 {
1281 return skb->len;
1282 }
1283
1284 static codel_time_t codel_skb_time_func(const struct sk_buff *skb)
1285 {
1286 const struct ieee80211_tx_info *info;
1287
1288 info = (const struct ieee80211_tx_info *)skb->cb;
1289 return info->control.enqueue_time;
1290 }
1291
1292 static struct sk_buff *codel_dequeue_func(struct codel_vars *cvars,
1293 void *ctx)
1294 {
1295 struct ieee80211_local *local;
1296 struct txq_info *txqi;
1297 struct fq *fq;
1298 struct fq_flow *flow;
1299
1300 txqi = ctx;
1301 local = vif_to_sdata(txqi->txq.vif)->local;
1302 fq = &local->fq;
1303
1304 if (cvars == &txqi->def_cvars)
1305 flow = &txqi->def_flow;
1306 else
1307 flow = &fq->flows[cvars - local->cvars];
1308
1309 return fq_flow_dequeue(fq, flow);
1310 }
1311
1312 static void codel_drop_func(struct sk_buff *skb,
1313 void *ctx)
1314 {
1315 struct ieee80211_local *local;
1316 struct ieee80211_hw *hw;
1317 struct txq_info *txqi;
1318
1319 txqi = ctx;
1320 local = vif_to_sdata(txqi->txq.vif)->local;
1321 hw = &local->hw;
1322
1323 ieee80211_free_txskb(hw, skb);
1324 }
1325
1326 static struct sk_buff *fq_tin_dequeue_func(struct fq *fq,
1327 struct fq_tin *tin,
1328 struct fq_flow *flow)
1329 {
1330 struct ieee80211_local *local;
1331 struct txq_info *txqi;
1332 struct codel_vars *cvars;
1333 struct codel_params *cparams;
1334 struct codel_stats *cstats;
1335
1336 local = container_of(fq, struct ieee80211_local, fq);
1337 txqi = container_of(tin, struct txq_info, tin);
1338 cstats = &txqi->cstats;
1339
1340 if (txqi->txq.sta) {
1341 struct sta_info *sta = container_of(txqi->txq.sta,
1342 struct sta_info, sta);
1343 cparams = &sta->cparams;
1344 } else {
1345 cparams = &local->cparams;
1346 }
1347
1348 if (flow == &txqi->def_flow)
1349 cvars = &txqi->def_cvars;
1350 else
1351 cvars = &local->cvars[flow - fq->flows];
1352
1353 return codel_dequeue(txqi,
1354 &flow->backlog,
1355 cparams,
1356 cvars,
1357 cstats,
1358 codel_skb_len_func,
1359 codel_skb_time_func,
1360 codel_drop_func,
1361 codel_dequeue_func);
1362 }
1363
1364 static void fq_skb_free_func(struct fq *fq,
1365 struct fq_tin *tin,
1366 struct fq_flow *flow,
1367 struct sk_buff *skb)
1368 {
1369 struct ieee80211_local *local;
1370
1371 local = container_of(fq, struct ieee80211_local, fq);
1372 ieee80211_free_txskb(&local->hw, skb);
1373 }
1374
1375 static struct fq_flow *fq_flow_get_default_func(struct fq *fq,
1376 struct fq_tin *tin,
1377 int idx,
1378 struct sk_buff *skb)
1379 {
1380 struct txq_info *txqi;
1381
1382 txqi = container_of(tin, struct txq_info, tin);
1383 return &txqi->def_flow;
1384 }
1385
1386 static void ieee80211_txq_enqueue(struct ieee80211_local *local,
1387 struct txq_info *txqi,
1388 struct sk_buff *skb)
1389 {
1390 struct fq *fq = &local->fq;
1391 struct fq_tin *tin = &txqi->tin;
1392
1393 ieee80211_set_skb_enqueue_time(skb);
1394 fq_tin_enqueue(fq, tin, skb,
1395 fq_skb_free_func,
1396 fq_flow_get_default_func);
1397 }
1398
1399 void ieee80211_txq_init(struct ieee80211_sub_if_data *sdata,
1400 struct sta_info *sta,
1401 struct txq_info *txqi, int tid)
1402 {
1403 fq_tin_init(&txqi->tin);
1404 fq_flow_init(&txqi->def_flow);
1405 codel_vars_init(&txqi->def_cvars);
1406 codel_stats_init(&txqi->cstats);
1407 __skb_queue_head_init(&txqi->frags);
1408
1409 txqi->txq.vif = &sdata->vif;
1410
1411 if (sta) {
1412 txqi->txq.sta = &sta->sta;
1413 sta->sta.txq[tid] = &txqi->txq;
1414 txqi->txq.tid = tid;
1415 txqi->txq.ac = ieee80211_ac_from_tid(tid);
1416 } else {
1417 sdata->vif.txq = &txqi->txq;
1418 txqi->txq.tid = 0;
1419 txqi->txq.ac = IEEE80211_AC_BE;
1420 }
1421 }
1422
1423 void ieee80211_txq_purge(struct ieee80211_local *local,
1424 struct txq_info *txqi)
1425 {
1426 struct fq *fq = &local->fq;
1427 struct fq_tin *tin = &txqi->tin;
1428
1429 fq_tin_reset(fq, tin, fq_skb_free_func);
1430 ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
1431 }
1432
1433 int ieee80211_txq_setup_flows(struct ieee80211_local *local)
1434 {
1435 struct fq *fq = &local->fq;
1436 int ret;
1437 int i;
1438 bool supp_vht = false;
1439 enum nl80211_band band;
1440
1441 if (!local->ops->wake_tx_queue)
1442 return 0;
1443
1444 ret = fq_init(fq, 4096);
1445 if (ret)
1446 return ret;
1447
1448 /*
1449 * If the hardware doesn't support VHT, it is safe to limit the maximum
1450 * queue size. 4 Mbytes is 64 max-size aggregates in 802.11n.
1451 */
1452 for (band = 0; band < NUM_NL80211_BANDS; band++) {
1453 struct ieee80211_supported_band *sband;
1454
1455 sband = local->hw.wiphy->bands[band];
1456 if (!sband)
1457 continue;
1458
1459 supp_vht = supp_vht || sband->vht_cap.vht_supported;
1460 }
1461
1462 if (!supp_vht)
1463 fq->memory_limit = 4 << 20; /* 4 Mbytes */
1464
1465 codel_params_init(&local->cparams);
1466 local->cparams.interval = MS2TIME(100);
1467 local->cparams.target = MS2TIME(20);
1468 local->cparams.ecn = true;
1469
1470 local->cvars = kcalloc(fq->flows_cnt, sizeof(local->cvars[0]),
1471 GFP_KERNEL);
1472 if (!local->cvars) {
1473 spin_lock_bh(&fq->lock);
1474 fq_reset(fq, fq_skb_free_func);
1475 spin_unlock_bh(&fq->lock);
1476 return -ENOMEM;
1477 }
1478
1479 for (i = 0; i < fq->flows_cnt; i++)
1480 codel_vars_init(&local->cvars[i]);
1481
1482 return 0;
1483 }
1484
1485 void ieee80211_txq_teardown_flows(struct ieee80211_local *local)
1486 {
1487 struct fq *fq = &local->fq;
1488
1489 if (!local->ops->wake_tx_queue)
1490 return;
1491
1492 kfree(local->cvars);
1493 local->cvars = NULL;
1494
1495 spin_lock_bh(&fq->lock);
1496 fq_reset(fq, fq_skb_free_func);
1497 spin_unlock_bh(&fq->lock);
1498 }
1499
1500 static bool ieee80211_queue_skb(struct ieee80211_local *local,
1501 struct ieee80211_sub_if_data *sdata,
1502 struct sta_info *sta,
1503 struct sk_buff *skb)
1504 {
1505 struct fq *fq = &local->fq;
1506 struct ieee80211_vif *vif;
1507 struct txq_info *txqi;
1508
1509 if (!local->ops->wake_tx_queue ||
1510 sdata->vif.type == NL80211_IFTYPE_MONITOR)
1511 return false;
1512
1513 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1514 sdata = container_of(sdata->bss,
1515 struct ieee80211_sub_if_data, u.ap);
1516
1517 vif = &sdata->vif;
1518 txqi = ieee80211_get_txq(local, vif, sta, skb);
1519
1520 if (!txqi)
1521 return false;
1522
1523 spin_lock_bh(&fq->lock);
1524 ieee80211_txq_enqueue(local, txqi, skb);
1525 spin_unlock_bh(&fq->lock);
1526
1527 drv_wake_tx_queue(local, txqi);
1528
1529 return true;
1530 }
1531
1532 static bool ieee80211_tx_frags(struct ieee80211_local *local,
1533 struct ieee80211_vif *vif,
1534 struct ieee80211_sta *sta,
1535 struct sk_buff_head *skbs,
1536 bool txpending)
1537 {
1538 struct ieee80211_tx_control control = {};
1539 struct sk_buff *skb, *tmp;
1540 unsigned long flags;
1541
1542 skb_queue_walk_safe(skbs, skb, tmp) {
1543 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1544 int q = info->hw_queue;
1545
1546 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1547 if (WARN_ON_ONCE(q >= local->hw.queues)) {
1548 __skb_unlink(skb, skbs);
1549 ieee80211_free_txskb(&local->hw, skb);
1550 continue;
1551 }
1552 #endif
1553
1554 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1555 if (local->queue_stop_reasons[q] ||
1556 (!txpending && !skb_queue_empty(&local->pending[q]))) {
1557 if (unlikely(info->flags &
1558 IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
1559 if (local->queue_stop_reasons[q] &
1560 ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
1561 /*
1562 * Drop off-channel frames if queues
1563 * are stopped for any reason other
1564 * than off-channel operation. Never
1565 * queue them.
1566 */
1567 spin_unlock_irqrestore(
1568 &local->queue_stop_reason_lock,
1569 flags);
1570 ieee80211_purge_tx_queue(&local->hw,
1571 skbs);
1572 return true;
1573 }
1574 } else {
1575
1576 /*
1577 * Since queue is stopped, queue up frames for
1578 * later transmission from the tx-pending
1579 * tasklet when the queue is woken again.
1580 */
1581 if (txpending)
1582 skb_queue_splice_init(skbs,
1583 &local->pending[q]);
1584 else
1585 skb_queue_splice_tail_init(skbs,
1586 &local->pending[q]);
1587
1588 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1589 flags);
1590 return false;
1591 }
1592 }
1593 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1594
1595 info->control.vif = vif;
1596 control.sta = sta;
1597
1598 __skb_unlink(skb, skbs);
1599 drv_tx(local, &control, skb);
1600 }
1601
1602 return true;
1603 }
1604
1605 /*
1606 * Returns false if the frame couldn't be transmitted but was queued instead.
1607 */
1608 static bool __ieee80211_tx(struct ieee80211_local *local,
1609 struct sk_buff_head *skbs, int led_len,
1610 struct sta_info *sta, bool txpending)
1611 {
1612 struct ieee80211_tx_info *info;
1613 struct ieee80211_sub_if_data *sdata;
1614 struct ieee80211_vif *vif;
1615 struct ieee80211_sta *pubsta;
1616 struct sk_buff *skb;
1617 bool result = true;
1618 __le16 fc;
1619
1620 if (WARN_ON(skb_queue_empty(skbs)))
1621 return true;
1622
1623 skb = skb_peek(skbs);
1624 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
1625 info = IEEE80211_SKB_CB(skb);
1626 sdata = vif_to_sdata(info->control.vif);
1627 if (sta && !sta->uploaded)
1628 sta = NULL;
1629
1630 if (sta)
1631 pubsta = &sta->sta;
1632 else
1633 pubsta = NULL;
1634
1635 switch (sdata->vif.type) {
1636 case NL80211_IFTYPE_MONITOR:
1637 if (sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
1638 vif = &sdata->vif;
1639 break;
1640 }
1641 sdata = rcu_dereference(local->monitor_sdata);
1642 if (sdata) {
1643 vif = &sdata->vif;
1644 info->hw_queue =
1645 vif->hw_queue[skb_get_queue_mapping(skb)];
1646 } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
1647 ieee80211_purge_tx_queue(&local->hw, skbs);
1648 return true;
1649 } else
1650 vif = NULL;
1651 break;
1652 case NL80211_IFTYPE_AP_VLAN:
1653 sdata = container_of(sdata->bss,
1654 struct ieee80211_sub_if_data, u.ap);
1655 /* fall through */
1656 default:
1657 vif = &sdata->vif;
1658 break;
1659 }
1660
1661 result = ieee80211_tx_frags(local, vif, pubsta, skbs,
1662 txpending);
1663
1664 ieee80211_tpt_led_trig_tx(local, fc, led_len);
1665
1666 WARN_ON_ONCE(!skb_queue_empty(skbs));
1667
1668 return result;
1669 }
1670
1671 /*
1672 * Invoke TX handlers, return 0 on success and non-zero if the
1673 * frame was dropped or queued.
1674 *
1675 * The handlers are split into an early and late part. The latter is everything
1676 * that can be sensitive to reordering, and will be deferred to after packets
1677 * are dequeued from the intermediate queues (when they are enabled).
1678 */
1679 static int invoke_tx_handlers_early(struct ieee80211_tx_data *tx)
1680 {
1681 ieee80211_tx_result res = TX_DROP;
1682
1683 #define CALL_TXH(txh) \
1684 do { \
1685 res = txh(tx); \
1686 if (res != TX_CONTINUE) \
1687 goto txh_done; \
1688 } while (0)
1689
1690 CALL_TXH(ieee80211_tx_h_dynamic_ps);
1691 CALL_TXH(ieee80211_tx_h_check_assoc);
1692 CALL_TXH(ieee80211_tx_h_ps_buf);
1693 CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
1694 CALL_TXH(ieee80211_tx_h_select_key);
1695 if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
1696 CALL_TXH(ieee80211_tx_h_rate_ctrl);
1697
1698 txh_done:
1699 if (unlikely(res == TX_DROP)) {
1700 I802_DEBUG_INC(tx->local->tx_handlers_drop);
1701 if (tx->skb)
1702 ieee80211_free_txskb(&tx->local->hw, tx->skb);
1703 else
1704 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1705 return -1;
1706 } else if (unlikely(res == TX_QUEUED)) {
1707 I802_DEBUG_INC(tx->local->tx_handlers_queued);
1708 return -1;
1709 }
1710
1711 return 0;
1712 }
1713
1714 /*
1715 * Late handlers can be called while the sta lock is held. Handlers that can
1716 * cause packets to be generated will cause deadlock!
1717 */
1718 static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
1719 {
1720 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
1721 ieee80211_tx_result res = TX_CONTINUE;
1722
1723 if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
1724 __skb_queue_tail(&tx->skbs, tx->skb);
1725 tx->skb = NULL;
1726 goto txh_done;
1727 }
1728
1729 CALL_TXH(ieee80211_tx_h_michael_mic_add);
1730 CALL_TXH(ieee80211_tx_h_sequence);
1731 CALL_TXH(ieee80211_tx_h_fragment);
1732 /* handlers after fragment must be aware of tx info fragmentation! */
1733 CALL_TXH(ieee80211_tx_h_stats);
1734 CALL_TXH(ieee80211_tx_h_encrypt);
1735 if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
1736 CALL_TXH(ieee80211_tx_h_calculate_duration);
1737 #undef CALL_TXH
1738
1739 txh_done:
1740 if (unlikely(res == TX_DROP)) {
1741 I802_DEBUG_INC(tx->local->tx_handlers_drop);
1742 if (tx->skb)
1743 ieee80211_free_txskb(&tx->local->hw, tx->skb);
1744 else
1745 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1746 return -1;
1747 } else if (unlikely(res == TX_QUEUED)) {
1748 I802_DEBUG_INC(tx->local->tx_handlers_queued);
1749 return -1;
1750 }
1751
1752 return 0;
1753 }
1754
1755 static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1756 {
1757 int r = invoke_tx_handlers_early(tx);
1758
1759 if (r)
1760 return r;
1761 return invoke_tx_handlers_late(tx);
1762 }
1763
1764 bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
1765 struct ieee80211_vif *vif, struct sk_buff *skb,
1766 int band, struct ieee80211_sta **sta)
1767 {
1768 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1769 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1770 struct ieee80211_tx_data tx;
1771 struct sk_buff *skb2;
1772
1773 if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
1774 return false;
1775
1776 info->band = band;
1777 info->control.vif = vif;
1778 info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];
1779
1780 if (invoke_tx_handlers(&tx))
1781 return false;
1782
1783 if (sta) {
1784 if (tx.sta)
1785 *sta = &tx.sta->sta;
1786 else
1787 *sta = NULL;
1788 }
1789
1790 /* this function isn't suitable for fragmented data frames */
1791 skb2 = __skb_dequeue(&tx.skbs);
1792 if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
1793 ieee80211_free_txskb(hw, skb2);
1794 ieee80211_purge_tx_queue(hw, &tx.skbs);
1795 return false;
1796 }
1797
1798 return true;
1799 }
1800 EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
1801
1802 /*
1803 * Returns false if the frame couldn't be transmitted but was queued instead.
1804 */
1805 static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
1806 struct sta_info *sta, struct sk_buff *skb,
1807 bool txpending)
1808 {
1809 struct ieee80211_local *local = sdata->local;
1810 struct ieee80211_tx_data tx;
1811 ieee80211_tx_result res_prepare;
1812 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1813 bool result = true;
1814 int led_len;
1815
1816 if (unlikely(skb->len < 10)) {
1817 dev_kfree_skb(skb);
1818 return true;
1819 }
1820
1821 /* initialises tx */
1822 led_len = skb->len;
1823 res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
1824
1825 if (unlikely(res_prepare == TX_DROP)) {
1826 ieee80211_free_txskb(&local->hw, skb);
1827 return true;
1828 } else if (unlikely(res_prepare == TX_QUEUED)) {
1829 return true;
1830 }
1831
1832 /* set up hw_queue value early */
1833 if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
1834 !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
1835 info->hw_queue =
1836 sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
1837
1838 if (invoke_tx_handlers_early(&tx))
1839 return false;
1840
1841 if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb))
1842 return true;
1843
1844 if (!invoke_tx_handlers_late(&tx))
1845 result = __ieee80211_tx(local, &tx.skbs, led_len,
1846 tx.sta, txpending);
1847
1848 return result;
1849 }
1850
1851 /* device xmit handlers */
1852
1853 static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
1854 struct sk_buff *skb,
1855 int head_need, bool may_encrypt)
1856 {
1857 struct ieee80211_local *local = sdata->local;
1858 int tail_need = 0;
1859
1860 if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
1861 tail_need = IEEE80211_ENCRYPT_TAILROOM;
1862 tail_need -= skb_tailroom(skb);
1863 tail_need = max_t(int, tail_need, 0);
1864 }
1865
1866 if (skb_cloned(skb) &&
1867 (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
1868 !skb_clone_writable(skb, ETH_HLEN) ||
1869 (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
1870 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1871 else if (head_need || tail_need)
1872 I802_DEBUG_INC(local->tx_expand_skb_head);
1873 else
1874 return 0;
1875
1876 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
1877 wiphy_debug(local->hw.wiphy,
1878 "failed to reallocate TX buffer\n");
1879 return -ENOMEM;
1880 }
1881
1882 return 0;
1883 }
1884
1885 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1886 struct sta_info *sta, struct sk_buff *skb)
1887 {
1888 struct ieee80211_local *local = sdata->local;
1889 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1890 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1891 int headroom;
1892 bool may_encrypt;
1893
1894 may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
1895
1896 headroom = local->tx_headroom;
1897 if (may_encrypt)
1898 headroom += sdata->encrypt_headroom;
1899 headroom -= skb_headroom(skb);
1900 headroom = max_t(int, 0, headroom);
1901
1902 if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
1903 ieee80211_free_txskb(&local->hw, skb);
1904 return;
1905 }
1906
1907 hdr = (struct ieee80211_hdr *) skb->data;
1908 info->control.vif = &sdata->vif;
1909
1910 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1911 if (ieee80211_is_data(hdr->frame_control) &&
1912 is_unicast_ether_addr(hdr->addr1)) {
1913 if (mesh_nexthop_resolve(sdata, skb))
1914 return; /* skb queued: don't free */
1915 } else {
1916 ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
1917 }
1918 }
1919
1920 ieee80211_set_qos_hdr(sdata, skb);
1921 ieee80211_tx(sdata, sta, skb, false);
1922 }
1923
1924 static bool ieee80211_parse_tx_radiotap(struct ieee80211_local *local,
1925 struct sk_buff *skb)
1926 {
1927 struct ieee80211_radiotap_iterator iterator;
1928 struct ieee80211_radiotap_header *rthdr =
1929 (struct ieee80211_radiotap_header *) skb->data;
1930 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1931 struct ieee80211_supported_band *sband =
1932 local->hw.wiphy->bands[info->band];
1933 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
1934 NULL);
1935 u16 txflags;
1936 u16 rate = 0;
1937 bool rate_found = false;
1938 u8 rate_retries = 0;
1939 u16 rate_flags = 0;
1940 u8 mcs_known, mcs_flags, mcs_bw;
1941 u16 vht_known;
1942 u8 vht_mcs = 0, vht_nss = 0;
1943 int i;
1944
1945 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1946 IEEE80211_TX_CTL_DONTFRAG;
1947
1948 /*
1949 * for every radiotap entry that is present
1950 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
1951 * entries present, or -EINVAL on error)
1952 */
1953
1954 while (!ret) {
1955 ret = ieee80211_radiotap_iterator_next(&iterator);
1956
1957 if (ret)
1958 continue;
1959
1960 /* see if this argument is something we can use */
1961 switch (iterator.this_arg_index) {
1962 /*
1963 * You must take care when dereferencing iterator.this_arg
1964 * for multibyte types... the pointer is not aligned. Use
1965 * get_unaligned((type *)iterator.this_arg) to dereference
1966 * iterator.this_arg for type "type" safely on all arches.
1967 */
1968 case IEEE80211_RADIOTAP_FLAGS:
1969 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
1970 /*
1971 * this indicates that the skb we have been
1972 * handed has the 32-bit FCS CRC at the end...
1973 * we should react to that by snipping it off
1974 * because it will be recomputed and added
1975 * on transmission
1976 */
1977 if (skb->len < (iterator._max_length + FCS_LEN))
1978 return false;
1979
1980 skb_trim(skb, skb->len - FCS_LEN);
1981 }
1982 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
1983 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
1984 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
1985 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
1986 break;
1987
1988 case IEEE80211_RADIOTAP_TX_FLAGS:
1989 txflags = get_unaligned_le16(iterator.this_arg);
1990 if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
1991 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1992 break;
1993
1994 case IEEE80211_RADIOTAP_RATE:
1995 rate = *iterator.this_arg;
1996 rate_flags = 0;
1997 rate_found = true;
1998 break;
1999
2000 case IEEE80211_RADIOTAP_DATA_RETRIES:
2001 rate_retries = *iterator.this_arg;
2002 break;
2003
2004 case IEEE80211_RADIOTAP_MCS:
2005 mcs_known = iterator.this_arg[0];
2006 mcs_flags = iterator.this_arg[1];
2007 if (!(mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_MCS))
2008 break;
2009
2010 rate_found = true;
2011 rate = iterator.this_arg[2];
2012 rate_flags = IEEE80211_TX_RC_MCS;
2013
2014 if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_GI &&
2015 mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
2016 rate_flags |= IEEE80211_TX_RC_SHORT_GI;
2017
2018 mcs_bw = mcs_flags & IEEE80211_RADIOTAP_MCS_BW_MASK;
2019 if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
2020 mcs_bw == IEEE80211_RADIOTAP_MCS_BW_40)
2021 rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
2022 break;
2023
2024 case IEEE80211_RADIOTAP_VHT:
2025 vht_known = get_unaligned_le16(iterator.this_arg);
2026 rate_found = true;
2027
2028 rate_flags = IEEE80211_TX_RC_VHT_MCS;
2029 if ((vht_known & IEEE80211_RADIOTAP_VHT_KNOWN_GI) &&
2030 (iterator.this_arg[2] &
2031 IEEE80211_RADIOTAP_VHT_FLAG_SGI))
2032 rate_flags |= IEEE80211_TX_RC_SHORT_GI;
2033 if (vht_known &
2034 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH) {
2035 if (iterator.this_arg[3] == 1)
2036 rate_flags |=
2037 IEEE80211_TX_RC_40_MHZ_WIDTH;
2038 else if (iterator.this_arg[3] == 4)
2039 rate_flags |=
2040 IEEE80211_TX_RC_80_MHZ_WIDTH;
2041 else if (iterator.this_arg[3] == 11)
2042 rate_flags |=
2043 IEEE80211_TX_RC_160_MHZ_WIDTH;
2044 }
2045
2046 vht_mcs = iterator.this_arg[4] >> 4;
2047 vht_nss = iterator.this_arg[4] & 0xF;
2048 break;
2049
2050 /*
2051 * Please update the file
2052 * Documentation/networking/mac80211-injection.txt
2053 * when parsing new fields here.
2054 */
2055
2056 default:
2057 break;
2058 }
2059 }
2060
2061 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
2062 return false;
2063
2064 if (rate_found) {
2065 info->control.flags |= IEEE80211_TX_CTRL_RATE_INJECT;
2066
2067 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
2068 info->control.rates[i].idx = -1;
2069 info->control.rates[i].flags = 0;
2070 info->control.rates[i].count = 0;
2071 }
2072
2073 if (rate_flags & IEEE80211_TX_RC_MCS) {
2074 info->control.rates[0].idx = rate;
2075 } else if (rate_flags & IEEE80211_TX_RC_VHT_MCS) {
2076 ieee80211_rate_set_vht(info->control.rates, vht_mcs,
2077 vht_nss);
2078 } else {
2079 for (i = 0; i < sband->n_bitrates; i++) {
2080 if (rate * 5 != sband->bitrates[i].bitrate)
2081 continue;
2082
2083 info->control.rates[0].idx = i;
2084 break;
2085 }
2086 }
2087
2088 if (info->control.rates[0].idx < 0)
2089 info->control.flags &= ~IEEE80211_TX_CTRL_RATE_INJECT;
2090
2091 info->control.rates[0].flags = rate_flags;
2092 info->control.rates[0].count = min_t(u8, rate_retries + 1,
2093 local->hw.max_rate_tries);
2094 }
2095
2096 /*
2097 * remove the radiotap header
2098 * iterator->_max_length was sanity-checked against
2099 * skb->len by iterator init
2100 */
2101 skb_pull(skb, iterator._max_length);
2102
2103 return true;
2104 }
2105
2106 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
2107 struct net_device *dev)
2108 {
2109 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2110 struct ieee80211_chanctx_conf *chanctx_conf;
2111 struct ieee80211_radiotap_header *prthdr =
2112 (struct ieee80211_radiotap_header *)skb->data;
2113 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2114 struct ieee80211_hdr *hdr;
2115 struct ieee80211_sub_if_data *tmp_sdata, *sdata;
2116 struct cfg80211_chan_def *chandef;
2117 u16 len_rthdr;
2118 int hdrlen;
2119
2120 /* check for not even having the fixed radiotap header part */
2121 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
2122 goto fail; /* too short to be possibly valid */
2123
2124 /* is it a header version we can trust to find length from? */
2125 if (unlikely(prthdr->it_version))
2126 goto fail; /* only version 0 is supported */
2127
2128 /* then there must be a radiotap header with a length we can use */
2129 len_rthdr = ieee80211_get_radiotap_len(skb->data);
2130
2131 /* does the skb contain enough to deliver on the alleged length? */
2132 if (unlikely(skb->len < len_rthdr))
2133 goto fail; /* skb too short for claimed rt header extent */
2134
2135 /*
2136 * fix up the pointers accounting for the radiotap
2137 * header still being in there. We are being given
2138 * a precooked IEEE80211 header so no need for
2139 * normal processing
2140 */
2141 skb_set_mac_header(skb, len_rthdr);
2142 /*
2143 * these are just fixed to the end of the rt area since we
2144 * don't have any better information and at this point, nobody cares
2145 */
2146 skb_set_network_header(skb, len_rthdr);
2147 skb_set_transport_header(skb, len_rthdr);
2148
2149 if (skb->len < len_rthdr + 2)
2150 goto fail;
2151
2152 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
2153 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2154
2155 if (skb->len < len_rthdr + hdrlen)
2156 goto fail;
2157
2158 /*
2159 * Initialize skb->protocol if the injected frame is a data frame
2160 * carrying a rfc1042 header
2161 */
2162 if (ieee80211_is_data(hdr->frame_control) &&
2163 skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
2164 u8 *payload = (u8 *)hdr + hdrlen;
2165
2166 if (ether_addr_equal(payload, rfc1042_header))
2167 skb->protocol = cpu_to_be16((payload[6] << 8) |
2168 payload[7]);
2169 }
2170
2171 memset(info, 0, sizeof(*info));
2172
2173 info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2174 IEEE80211_TX_CTL_INJECTED;
2175
2176 rcu_read_lock();
2177
2178 /*
2179 * We process outgoing injected frames that have a local address
2180 * we handle as though they are non-injected frames.
2181 * This code here isn't entirely correct, the local MAC address
2182 * isn't always enough to find the interface to use; for proper
2183 * VLAN/WDS support we will need a different mechanism (which
2184 * likely isn't going to be monitor interfaces).
2185 */
2186 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2187
2188 list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
2189 if (!ieee80211_sdata_running(tmp_sdata))
2190 continue;
2191 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2192 tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
2193 tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
2194 continue;
2195 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
2196 sdata = tmp_sdata;
2197 break;
2198 }
2199 }
2200
2201 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2202 if (!chanctx_conf) {
2203 tmp_sdata = rcu_dereference(local->monitor_sdata);
2204 if (tmp_sdata)
2205 chanctx_conf =
2206 rcu_dereference(tmp_sdata->vif.chanctx_conf);
2207 }
2208
2209 if (chanctx_conf)
2210 chandef = &chanctx_conf->def;
2211 else if (!local->use_chanctx)
2212 chandef = &local->_oper_chandef;
2213 else
2214 goto fail_rcu;
2215
2216 /*
2217 * Frame injection is not allowed if beaconing is not allowed
2218 * or if we need radar detection. Beaconing is usually not allowed when
2219 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
2220 * Passive scan is also used in world regulatory domains where
2221 * your country is not known and as such it should be treated as
2222 * NO TX unless the channel is explicitly allowed in which case
2223 * your current regulatory domain would not have the passive scan
2224 * flag.
2225 *
2226 * Since AP mode uses monitor interfaces to inject/TX management
2227 * frames we can make AP mode the exception to this rule once it
2228 * supports radar detection as its implementation can deal with
2229 * radar detection by itself. We can do that later by adding a
2230 * monitor flag interfaces used for AP support.
2231 */
2232 if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
2233 sdata->vif.type))
2234 goto fail_rcu;
2235
2236 info->band = chandef->chan->band;
2237
2238 /* process and remove the injection radiotap header */
2239 if (!ieee80211_parse_tx_radiotap(local, skb))
2240 goto fail_rcu;
2241
2242 ieee80211_xmit(sdata, NULL, skb);
2243 rcu_read_unlock();
2244
2245 return NETDEV_TX_OK;
2246
2247 fail_rcu:
2248 rcu_read_unlock();
2249 fail:
2250 dev_kfree_skb(skb);
2251 return NETDEV_TX_OK; /* meaning, we dealt with the skb */
2252 }
2253
2254 static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
2255 {
2256 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
2257
2258 return ethertype == ETH_P_TDLS &&
2259 skb->len > 14 &&
2260 skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
2261 }
2262
2263 static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
2264 struct sk_buff *skb,
2265 struct sta_info **sta_out)
2266 {
2267 struct sta_info *sta;
2268
2269 switch (sdata->vif.type) {
2270 case NL80211_IFTYPE_AP_VLAN:
2271 sta = rcu_dereference(sdata->u.vlan.sta);
2272 if (sta) {
2273 *sta_out = sta;
2274 return 0;
2275 } else if (sdata->wdev.use_4addr) {
2276 return -ENOLINK;
2277 }
2278 /* fall through */
2279 case NL80211_IFTYPE_AP:
2280 case NL80211_IFTYPE_OCB:
2281 case NL80211_IFTYPE_ADHOC:
2282 if (is_multicast_ether_addr(skb->data)) {
2283 *sta_out = ERR_PTR(-ENOENT);
2284 return 0;
2285 }
2286 sta = sta_info_get_bss(sdata, skb->data);
2287 break;
2288 case NL80211_IFTYPE_WDS:
2289 sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
2290 break;
2291 #ifdef CONFIG_MAC80211_MESH
2292 case NL80211_IFTYPE_MESH_POINT:
2293 /* determined much later */
2294 *sta_out = NULL;
2295 return 0;
2296 #endif
2297 case NL80211_IFTYPE_STATION:
2298 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2299 sta = sta_info_get(sdata, skb->data);
2300 if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2301 if (test_sta_flag(sta,
2302 WLAN_STA_TDLS_PEER_AUTH)) {
2303 *sta_out = sta;
2304 return 0;
2305 }
2306
2307 /*
2308 * TDLS link during setup - throw out frames to
2309 * peer. Allow TDLS-setup frames to unauthorized
2310 * peers for the special case of a link teardown
2311 * after a TDLS sta is removed due to being
2312 * unreachable.
2313 */
2314 if (!ieee80211_is_tdls_setup(skb))
2315 return -EINVAL;
2316 }
2317
2318 }
2319
2320 sta = sta_info_get(sdata, sdata->u.mgd.bssid);
2321 if (!sta)
2322 return -ENOLINK;
2323 break;
2324 default:
2325 return -EINVAL;
2326 }
2327
2328 *sta_out = sta ?: ERR_PTR(-ENOENT);
2329 return 0;
2330 }
2331
2332 /**
2333 * ieee80211_build_hdr - build 802.11 header in the given frame
2334 * @sdata: virtual interface to build the header for
2335 * @skb: the skb to build the header in
2336 * @info_flags: skb flags to set
2337 *
2338 * This function takes the skb with 802.3 header and reformats the header to
2339 * the appropriate IEEE 802.11 header based on which interface the packet is
2340 * being transmitted on.
2341 *
2342 * Note that this function also takes care of the TX status request and
2343 * potential unsharing of the SKB - this needs to be interleaved with the
2344 * header building.
2345 *
2346 * The function requires the read-side RCU lock held
2347 *
2348 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
2349 */
2350 static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
2351 struct sk_buff *skb, u32 info_flags,
2352 struct sta_info *sta)
2353 {
2354 struct ieee80211_local *local = sdata->local;
2355 struct ieee80211_tx_info *info;
2356 int head_need;
2357 u16 ethertype, hdrlen, meshhdrlen = 0;
2358 __le16 fc;
2359 struct ieee80211_hdr hdr;
2360 struct ieee80211s_hdr mesh_hdr __maybe_unused;
2361 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
2362 const u8 *encaps_data;
2363 int encaps_len, skip_header_bytes;
2364 bool wme_sta = false, authorized = false;
2365 bool tdls_peer;
2366 bool multicast;
2367 u16 info_id = 0;
2368 struct ieee80211_chanctx_conf *chanctx_conf;
2369 struct ieee80211_sub_if_data *ap_sdata;
2370 enum nl80211_band band;
2371 int ret;
2372
2373 if (IS_ERR(sta))
2374 sta = NULL;
2375
2376 /* convert Ethernet header to proper 802.11 header (based on
2377 * operation mode) */
2378 ethertype = (skb->data[12] << 8) | skb->data[13];
2379 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2380
2381 switch (sdata->vif.type) {
2382 case NL80211_IFTYPE_AP_VLAN:
2383 if (sdata->wdev.use_4addr) {
2384 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2385 /* RA TA DA SA */
2386 memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
2387 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2388 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2389 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2390 hdrlen = 30;
2391 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2392 wme_sta = sta->sta.wme;
2393 }
2394 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2395 u.ap);
2396 chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
2397 if (!chanctx_conf) {
2398 ret = -ENOTCONN;
2399 goto free;
2400 }
2401 band = chanctx_conf->def.chan->band;
2402 if (sdata->wdev.use_4addr)
2403 break;
2404 /* fall through */
2405 case NL80211_IFTYPE_AP:
2406 if (sdata->vif.type == NL80211_IFTYPE_AP)
2407 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2408 if (!chanctx_conf) {
2409 ret = -ENOTCONN;
2410 goto free;
2411 }
2412 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2413 /* DA BSSID SA */
2414 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2415 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2416 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
2417 hdrlen = 24;
2418 band = chanctx_conf->def.chan->band;
2419 break;
2420 case NL80211_IFTYPE_WDS:
2421 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2422 /* RA TA DA SA */
2423 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
2424 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2425 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2426 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2427 hdrlen = 30;
2428 /*
2429 * This is the exception! WDS style interfaces are prohibited
2430 * when channel contexts are in used so this must be valid
2431 */
2432 band = local->hw.conf.chandef.chan->band;
2433 break;
2434 #ifdef CONFIG_MAC80211_MESH
2435 case NL80211_IFTYPE_MESH_POINT:
2436 if (!is_multicast_ether_addr(skb->data)) {
2437 struct sta_info *next_hop;
2438 bool mpp_lookup = true;
2439
2440 mpath = mesh_path_lookup(sdata, skb->data);
2441 if (mpath) {
2442 mpp_lookup = false;
2443 next_hop = rcu_dereference(mpath->next_hop);
2444 if (!next_hop ||
2445 !(mpath->flags & (MESH_PATH_ACTIVE |
2446 MESH_PATH_RESOLVING)))
2447 mpp_lookup = true;
2448 }
2449
2450 if (mpp_lookup) {
2451 mppath = mpp_path_lookup(sdata, skb->data);
2452 if (mppath)
2453 mppath->exp_time = jiffies;
2454 }
2455
2456 if (mppath && mpath)
2457 mesh_path_del(sdata, mpath->dst);
2458 }
2459
2460 /*
2461 * Use address extension if it is a packet from
2462 * another interface or if we know the destination
2463 * is being proxied by a portal (i.e. portal address
2464 * differs from proxied address)
2465 */
2466 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
2467 !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
2468 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2469 skb->data, skb->data + ETH_ALEN);
2470 meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
2471 NULL, NULL);
2472 } else {
2473 /* DS -> MBSS (802.11-2012 13.11.3.3).
2474 * For unicast with unknown forwarding information,
2475 * destination might be in the MBSS or if that fails
2476 * forwarded to another mesh gate. In either case
2477 * resolution will be handled in ieee80211_xmit(), so
2478 * leave the original DA. This also works for mcast */
2479 const u8 *mesh_da = skb->data;
2480
2481 if (mppath)
2482 mesh_da = mppath->mpp;
2483 else if (mpath)
2484 mesh_da = mpath->dst;
2485
2486 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2487 mesh_da, sdata->vif.addr);
2488 if (is_multicast_ether_addr(mesh_da))
2489 /* DA TA mSA AE:SA */
2490 meshhdrlen = ieee80211_new_mesh_header(
2491 sdata, &mesh_hdr,
2492 skb->data + ETH_ALEN, NULL);
2493 else
2494 /* RA TA mDA mSA AE:DA SA */
2495 meshhdrlen = ieee80211_new_mesh_header(
2496 sdata, &mesh_hdr, skb->data,
2497 skb->data + ETH_ALEN);
2498
2499 }
2500 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2501 if (!chanctx_conf) {
2502 ret = -ENOTCONN;
2503 goto free;
2504 }
2505 band = chanctx_conf->def.chan->band;
2506 break;
2507 #endif
2508 case NL80211_IFTYPE_STATION:
2509 /* we already did checks when looking up the RA STA */
2510 tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
2511
2512 if (tdls_peer) {
2513 /* DA SA BSSID */
2514 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2515 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2516 memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
2517 hdrlen = 24;
2518 } else if (sdata->u.mgd.use_4addr &&
2519 cpu_to_be16(ethertype) != sdata->control_port_protocol) {
2520 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2521 IEEE80211_FCTL_TODS);
2522 /* RA TA DA SA */
2523 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2524 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2525 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2526 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2527 hdrlen = 30;
2528 } else {
2529 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2530 /* BSSID SA DA */
2531 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2532 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2533 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2534 hdrlen = 24;
2535 }
2536 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2537 if (!chanctx_conf) {
2538 ret = -ENOTCONN;
2539 goto free;
2540 }
2541 band = chanctx_conf->def.chan->band;
2542 break;
2543 case NL80211_IFTYPE_OCB:
2544 /* DA SA BSSID */
2545 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2546 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2547 eth_broadcast_addr(hdr.addr3);
2548 hdrlen = 24;
2549 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2550 if (!chanctx_conf) {
2551 ret = -ENOTCONN;
2552 goto free;
2553 }
2554 band = chanctx_conf->def.chan->band;
2555 break;
2556 case NL80211_IFTYPE_ADHOC:
2557 /* DA SA BSSID */
2558 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2559 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2560 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
2561 hdrlen = 24;
2562 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2563 if (!chanctx_conf) {
2564 ret = -ENOTCONN;
2565 goto free;
2566 }
2567 band = chanctx_conf->def.chan->band;
2568 break;
2569 default:
2570 ret = -EINVAL;
2571 goto free;
2572 }
2573
2574 multicast = is_multicast_ether_addr(hdr.addr1);
2575
2576 /* sta is always NULL for mesh */
2577 if (sta) {
2578 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2579 wme_sta = sta->sta.wme;
2580 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2581 /* For mesh, the use of the QoS header is mandatory */
2582 wme_sta = true;
2583 }
2584
2585 /* receiver does QoS (which also means we do) use it */
2586 if (wme_sta) {
2587 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2588 hdrlen += 2;
2589 }
2590
2591 /*
2592 * Drop unicast frames to unauthorised stations unless they are
2593 * EAPOL frames from the local station.
2594 */
2595 if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
2596 (sdata->vif.type != NL80211_IFTYPE_OCB) &&
2597 !multicast && !authorized &&
2598 (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
2599 !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
2600 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2601 net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
2602 sdata->name, hdr.addr1);
2603 #endif
2604
2605 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
2606
2607 ret = -EPERM;
2608 goto free;
2609 }
2610
2611 if (unlikely(!multicast && skb->sk &&
2612 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
2613 struct sk_buff *ack_skb = skb_clone_sk(skb);
2614
2615 if (ack_skb) {
2616 unsigned long flags;
2617 int id;
2618
2619 spin_lock_irqsave(&local->ack_status_lock, flags);
2620 id = idr_alloc(&local->ack_status_frames, ack_skb,
2621 1, 0x10000, GFP_ATOMIC);
2622 spin_unlock_irqrestore(&local->ack_status_lock, flags);
2623
2624 if (id >= 0) {
2625 info_id = id;
2626 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
2627 } else {
2628 kfree_skb(ack_skb);
2629 }
2630 }
2631 }
2632
2633 /*
2634 * If the skb is shared we need to obtain our own copy.
2635 */
2636 if (skb_shared(skb)) {
2637 struct sk_buff *tmp_skb = skb;
2638
2639 /* can't happen -- skb is a clone if info_id != 0 */
2640 WARN_ON(info_id);
2641
2642 skb = skb_clone(skb, GFP_ATOMIC);
2643 kfree_skb(tmp_skb);
2644
2645 if (!skb) {
2646 ret = -ENOMEM;
2647 goto free;
2648 }
2649 }
2650
2651 hdr.frame_control = fc;
2652 hdr.duration_id = 0;
2653 hdr.seq_ctrl = 0;
2654
2655 skip_header_bytes = ETH_HLEN;
2656 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
2657 encaps_data = bridge_tunnel_header;
2658 encaps_len = sizeof(bridge_tunnel_header);
2659 skip_header_bytes -= 2;
2660 } else if (ethertype >= ETH_P_802_3_MIN) {
2661 encaps_data = rfc1042_header;
2662 encaps_len = sizeof(rfc1042_header);
2663 skip_header_bytes -= 2;
2664 } else {
2665 encaps_data = NULL;
2666 encaps_len = 0;
2667 }
2668
2669 skb_pull(skb, skip_header_bytes);
2670 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
2671
2672 /*
2673 * So we need to modify the skb header and hence need a copy of
2674 * that. The head_need variable above doesn't, so far, include
2675 * the needed header space that we don't need right away. If we
2676 * can, then we don't reallocate right now but only after the
2677 * frame arrives at the master device (if it does...)
2678 *
2679 * If we cannot, however, then we will reallocate to include all
2680 * the ever needed space. Also, if we need to reallocate it anyway,
2681 * make it big enough for everything we may ever need.
2682 */
2683
2684 if (head_need > 0 || skb_cloned(skb)) {
2685 head_need += sdata->encrypt_headroom;
2686 head_need += local->tx_headroom;
2687 head_need = max_t(int, 0, head_need);
2688 if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
2689 ieee80211_free_txskb(&local->hw, skb);
2690 skb = NULL;
2691 return ERR_PTR(-ENOMEM);
2692 }
2693 }
2694
2695 if (encaps_data)
2696 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
2697
2698 #ifdef CONFIG_MAC80211_MESH
2699 if (meshhdrlen > 0)
2700 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
2701 #endif
2702
2703 if (ieee80211_is_data_qos(fc)) {
2704 __le16 *qos_control;
2705
2706 qos_control = skb_push(skb, 2);
2707 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
2708 /*
2709 * Maybe we could actually set some fields here, for now just
2710 * initialise to zero to indicate no special operation.
2711 */
2712 *qos_control = 0;
2713 } else
2714 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
2715
2716 skb_reset_mac_header(skb);
2717
2718 info = IEEE80211_SKB_CB(skb);
2719 memset(info, 0, sizeof(*info));
2720
2721 info->flags = info_flags;
2722 info->ack_frame_id = info_id;
2723 info->band = band;
2724
2725 return skb;
2726 free:
2727 kfree_skb(skb);
2728 return ERR_PTR(ret);
2729 }
2730
2731 /*
2732 * fast-xmit overview
2733 *
2734 * The core idea of this fast-xmit is to remove per-packet checks by checking
2735 * them out of band. ieee80211_check_fast_xmit() implements the out-of-band
2736 * checks that are needed to get the sta->fast_tx pointer assigned, after which
2737 * much less work can be done per packet. For example, fragmentation must be
2738 * disabled or the fast_tx pointer will not be set. All the conditions are seen
2739 * in the code here.
2740 *
2741 * Once assigned, the fast_tx data structure also caches the per-packet 802.11
2742 * header and other data to aid packet processing in ieee80211_xmit_fast().
2743 *
2744 * The most difficult part of this is that when any of these assumptions
2745 * change, an external trigger (i.e. a call to ieee80211_clear_fast_xmit(),
2746 * ieee80211_check_fast_xmit() or friends) is required to reset the data,
2747 * since the per-packet code no longer checks the conditions. This is reflected
2748 * by the calls to these functions throughout the rest of the code, and must be
2749 * maintained if any of the TX path checks change.
2750 */
2751
2752 void ieee80211_check_fast_xmit(struct sta_info *sta)
2753 {
2754 struct ieee80211_fast_tx build = {}, *fast_tx = NULL, *old;
2755 struct ieee80211_local *local = sta->local;
2756 struct ieee80211_sub_if_data *sdata = sta->sdata;
2757 struct ieee80211_hdr *hdr = (void *)build.hdr;
2758 struct ieee80211_chanctx_conf *chanctx_conf;
2759 __le16 fc;
2760
2761 if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
2762 return;
2763
2764 /* Locking here protects both the pointer itself, and against concurrent
2765 * invocations winning data access races to, e.g., the key pointer that
2766 * is used.
2767 * Without it, the invocation of this function right after the key
2768 * pointer changes wouldn't be sufficient, as another CPU could access
2769 * the pointer, then stall, and then do the cache update after the CPU
2770 * that invalidated the key.
2771 * With the locking, such scenarios cannot happen as the check for the
2772 * key and the fast-tx assignment are done atomically, so the CPU that
2773 * modifies the key will either wait or other one will see the key
2774 * cleared/changed already.
2775 */
2776 spin_lock_bh(&sta->lock);
2777 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
2778 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
2779 sdata->vif.type == NL80211_IFTYPE_STATION)
2780 goto out;
2781
2782 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2783 goto out;
2784
2785 if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
2786 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
2787 test_sta_flag(sta, WLAN_STA_PS_DELIVER) ||
2788 test_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT))
2789 goto out;
2790
2791 if (sdata->noack_map)
2792 goto out;
2793
2794 /* fast-xmit doesn't handle fragmentation at all */
2795 if (local->hw.wiphy->frag_threshold != (u32)-1 &&
2796 !ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG))
2797 goto out;
2798
2799 rcu_read_lock();
2800 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2801 if (!chanctx_conf) {
2802 rcu_read_unlock();
2803 goto out;
2804 }
2805 build.band = chanctx_conf->def.chan->band;
2806 rcu_read_unlock();
2807
2808 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2809
2810 switch (sdata->vif.type) {
2811 case NL80211_IFTYPE_ADHOC:
2812 /* DA SA BSSID */
2813 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2814 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2815 memcpy(hdr->addr3, sdata->u.ibss.bssid, ETH_ALEN);
2816 build.hdr_len = 24;
2817 break;
2818 case NL80211_IFTYPE_STATION:
2819 if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2820 /* DA SA BSSID */
2821 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2822 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2823 memcpy(hdr->addr3, sdata->u.mgd.bssid, ETH_ALEN);
2824 build.hdr_len = 24;
2825 break;
2826 }
2827
2828 if (sdata->u.mgd.use_4addr) {
2829 /* non-regular ethertype cannot use the fastpath */
2830 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2831 IEEE80211_FCTL_TODS);
2832 /* RA TA DA SA */
2833 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2834 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2835 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2836 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2837 build.hdr_len = 30;
2838 break;
2839 }
2840 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2841 /* BSSID SA DA */
2842 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2843 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2844 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2845 build.hdr_len = 24;
2846 break;
2847 case NL80211_IFTYPE_AP_VLAN:
2848 if (sdata->wdev.use_4addr) {
2849 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2850 IEEE80211_FCTL_TODS);
2851 /* RA TA DA SA */
2852 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
2853 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2854 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2855 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2856 build.hdr_len = 30;
2857 break;
2858 }
2859 /* fall through */
2860 case NL80211_IFTYPE_AP:
2861 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2862 /* DA BSSID SA */
2863 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2864 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2865 build.sa_offs = offsetof(struct ieee80211_hdr, addr3);
2866 build.hdr_len = 24;
2867 break;
2868 default:
2869 /* not handled on fast-xmit */
2870 goto out;
2871 }
2872
2873 if (sta->sta.wme) {
2874 build.hdr_len += 2;
2875 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2876 }
2877
2878 /* We store the key here so there's no point in using rcu_dereference()
2879 * but that's fine because the code that changes the pointers will call
2880 * this function after doing so. For a single CPU that would be enough,
2881 * for multiple see the comment above.
2882 */
2883 build.key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
2884 if (!build.key)
2885 build.key = rcu_access_pointer(sdata->default_unicast_key);
2886 if (build.key) {
2887 bool gen_iv, iv_spc, mmic;
2888
2889 gen_iv = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
2890 iv_spc = build.key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
2891 mmic = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC;
2892
2893 /* don't handle software crypto */
2894 if (!(build.key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
2895 goto out;
2896
2897 switch (build.key->conf.cipher) {
2898 case WLAN_CIPHER_SUITE_CCMP:
2899 case WLAN_CIPHER_SUITE_CCMP_256:
2900 /* add fixed key ID */
2901 if (gen_iv) {
2902 (build.hdr + build.hdr_len)[3] =
2903 0x20 | (build.key->conf.keyidx << 6);
2904 build.pn_offs = build.hdr_len;
2905 }
2906 if (gen_iv || iv_spc)
2907 build.hdr_len += IEEE80211_CCMP_HDR_LEN;
2908 break;
2909 case WLAN_CIPHER_SUITE_GCMP:
2910 case WLAN_CIPHER_SUITE_GCMP_256:
2911 /* add fixed key ID */
2912 if (gen_iv) {
2913 (build.hdr + build.hdr_len)[3] =
2914 0x20 | (build.key->conf.keyidx << 6);
2915 build.pn_offs = build.hdr_len;
2916 }
2917 if (gen_iv || iv_spc)
2918 build.hdr_len += IEEE80211_GCMP_HDR_LEN;
2919 break;
2920 case WLAN_CIPHER_SUITE_TKIP:
2921 /* cannot handle MMIC or IV generation in xmit-fast */
2922 if (mmic || gen_iv)
2923 goto out;
2924 if (iv_spc)
2925 build.hdr_len += IEEE80211_TKIP_IV_LEN;
2926 break;
2927 case WLAN_CIPHER_SUITE_WEP40:
2928 case WLAN_CIPHER_SUITE_WEP104:
2929 /* cannot handle IV generation in fast-xmit */
2930 if (gen_iv)
2931 goto out;
2932 if (iv_spc)
2933 build.hdr_len += IEEE80211_WEP_IV_LEN;
2934 break;
2935 case WLAN_CIPHER_SUITE_AES_CMAC:
2936 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2937 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2938 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2939 WARN(1,
2940 "management cipher suite 0x%x enabled for data\n",
2941 build.key->conf.cipher);
2942 goto out;
2943 default:
2944 /* we don't know how to generate IVs for this at all */
2945 if (WARN_ON(gen_iv))
2946 goto out;
2947 /* pure hardware keys are OK, of course */
2948 if (!(build.key->flags & KEY_FLAG_CIPHER_SCHEME))
2949 break;
2950 /* cipher scheme might require space allocation */
2951 if (iv_spc &&
2952 build.key->conf.iv_len > IEEE80211_FAST_XMIT_MAX_IV)
2953 goto out;
2954 if (iv_spc)
2955 build.hdr_len += build.key->conf.iv_len;
2956 }
2957
2958 fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2959 }
2960
2961 hdr->frame_control = fc;
2962
2963 memcpy(build.hdr + build.hdr_len,
2964 rfc1042_header, sizeof(rfc1042_header));
2965 build.hdr_len += sizeof(rfc1042_header);
2966
2967 fast_tx = kmemdup(&build, sizeof(build), GFP_ATOMIC);
2968 /* if the kmemdup fails, continue w/o fast_tx */
2969 if (!fast_tx)
2970 goto out;
2971
2972 out:
2973 /* we might have raced against another call to this function */
2974 old = rcu_dereference_protected(sta->fast_tx,
2975 lockdep_is_held(&sta->lock));
2976 rcu_assign_pointer(sta->fast_tx, fast_tx);
2977 if (old)
2978 kfree_rcu(old, rcu_head);
2979 spin_unlock_bh(&sta->lock);
2980 }
2981
2982 void ieee80211_check_fast_xmit_all(struct ieee80211_local *local)
2983 {
2984 struct sta_info *sta;
2985
2986 rcu_read_lock();
2987 list_for_each_entry_rcu(sta, &local->sta_list, list)
2988 ieee80211_check_fast_xmit(sta);
2989 rcu_read_unlock();
2990 }
2991
2992 void ieee80211_check_fast_xmit_iface(struct ieee80211_sub_if_data *sdata)
2993 {
2994 struct ieee80211_local *local = sdata->local;
2995 struct sta_info *sta;
2996
2997 rcu_read_lock();
2998
2999 list_for_each_entry_rcu(sta, &local->sta_list, list) {
3000 if (sdata != sta->sdata &&
3001 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
3002 continue;
3003 ieee80211_check_fast_xmit(sta);
3004 }
3005
3006 rcu_read_unlock();
3007 }
3008
3009 void ieee80211_clear_fast_xmit(struct sta_info *sta)
3010 {
3011 struct ieee80211_fast_tx *fast_tx;
3012
3013 spin_lock_bh(&sta->lock);
3014 fast_tx = rcu_dereference_protected(sta->fast_tx,
3015 lockdep_is_held(&sta->lock));
3016 RCU_INIT_POINTER(sta->fast_tx, NULL);
3017 spin_unlock_bh(&sta->lock);
3018
3019 if (fast_tx)
3020 kfree_rcu(fast_tx, rcu_head);
3021 }
3022
3023 static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
3024 struct sk_buff *skb, int headroom,
3025 int *subframe_len)
3026 {
3027 int amsdu_len = *subframe_len + sizeof(struct ethhdr);
3028 int padding = (4 - amsdu_len) & 3;
3029
3030 if (skb_headroom(skb) < headroom || skb_tailroom(skb) < padding) {
3031 I802_DEBUG_INC(local->tx_expand_skb_head);
3032
3033 if (pskb_expand_head(skb, headroom, padding, GFP_ATOMIC)) {
3034 wiphy_debug(local->hw.wiphy,
3035 "failed to reallocate TX buffer\n");
3036 return false;
3037 }
3038 }
3039
3040 if (padding) {
3041 *subframe_len += padding;
3042 skb_put_zero(skb, padding);
3043 }
3044
3045 return true;
3046 }
3047
3048 static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
3049 struct ieee80211_fast_tx *fast_tx,
3050 struct sk_buff *skb)
3051 {
3052 struct ieee80211_local *local = sdata->local;
3053 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3054 struct ieee80211_hdr *hdr;
3055 struct ethhdr *amsdu_hdr;
3056 int hdr_len = fast_tx->hdr_len - sizeof(rfc1042_header);
3057 int subframe_len = skb->len - hdr_len;
3058 void *data;
3059 u8 *qc, *h_80211_src, *h_80211_dst;
3060 const u8 *bssid;
3061
3062 if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
3063 return false;
3064
3065 if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
3066 return true;
3067
3068 if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr),
3069 &subframe_len))
3070 return false;
3071
3072 data = skb_push(skb, sizeof(*amsdu_hdr));
3073 memmove(data, data + sizeof(*amsdu_hdr), hdr_len);
3074 hdr = data;
3075 amsdu_hdr = data + hdr_len;
3076 /* h_80211_src/dst is addr* field within hdr */
3077 h_80211_src = data + fast_tx->sa_offs;
3078 h_80211_dst = data + fast_tx->da_offs;
3079
3080 amsdu_hdr->h_proto = cpu_to_be16(subframe_len);
3081 ether_addr_copy(amsdu_hdr->h_source, h_80211_src);
3082 ether_addr_copy(amsdu_hdr->h_dest, h_80211_dst);
3083
3084 /* according to IEEE 802.11-2012 8.3.2 table 8-19, the outer SA/DA
3085 * fields needs to be changed to BSSID for A-MSDU frames depending
3086 * on FromDS/ToDS values.
3087 */
3088 switch (sdata->vif.type) {
3089 case NL80211_IFTYPE_STATION:
3090 bssid = sdata->u.mgd.bssid;
3091 break;
3092 case NL80211_IFTYPE_AP:
3093 case NL80211_IFTYPE_AP_VLAN:
3094 bssid = sdata->vif.addr;
3095 break;
3096 default:
3097 bssid = NULL;
3098 }
3099
3100 if (bssid && ieee80211_has_fromds(hdr->frame_control))
3101 ether_addr_copy(h_80211_src, bssid);
3102
3103 if (bssid && ieee80211_has_tods(hdr->frame_control))
3104 ether_addr_copy(h_80211_dst, bssid);
3105
3106 qc = ieee80211_get_qos_ctl(hdr);
3107 *qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
3108
3109 info->control.flags |= IEEE80211_TX_CTRL_AMSDU;
3110
3111 return true;
3112 }
3113
3114 static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
3115 struct sta_info *sta,
3116 struct ieee80211_fast_tx *fast_tx,
3117 struct sk_buff *skb)
3118 {
3119 struct ieee80211_local *local = sdata->local;
3120 struct fq *fq = &local->fq;
3121 struct fq_tin *tin;
3122 struct fq_flow *flow;
3123 u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3124 struct ieee80211_txq *txq = sta->sta.txq[tid];
3125 struct txq_info *txqi;
3126 struct sk_buff **frag_tail, *head;
3127 int subframe_len = skb->len - ETH_ALEN;
3128 u8 max_subframes = sta->sta.max_amsdu_subframes;
3129 int max_frags = local->hw.max_tx_fragments;
3130 int max_amsdu_len = sta->sta.max_amsdu_len;
3131 __be16 len;
3132 void *data;
3133 bool ret = false;
3134 unsigned int orig_len;
3135 int n = 1, nfrags;
3136
3137 if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
3138 return false;
3139
3140 if (!txq)
3141 return false;
3142
3143 txqi = to_txq_info(txq);
3144 if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
3145 return false;
3146
3147 if (sta->sta.max_rc_amsdu_len)
3148 max_amsdu_len = min_t(int, max_amsdu_len,
3149 sta->sta.max_rc_amsdu_len);
3150
3151 spin_lock_bh(&fq->lock);
3152
3153 /* TODO: Ideally aggregation should be done on dequeue to remain
3154 * responsive to environment changes.
3155 */
3156
3157 tin = &txqi->tin;
3158 flow = fq_flow_classify(fq, tin, skb, fq_flow_get_default_func);
3159 head = skb_peek_tail(&flow->queue);
3160 if (!head)
3161 goto out;
3162
3163 orig_len = head->len;
3164
3165 if (skb->len + head->len > max_amsdu_len)
3166 goto out;
3167
3168 if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
3169 goto out;
3170
3171 nfrags = 1 + skb_shinfo(skb)->nr_frags;
3172 nfrags += 1 + skb_shinfo(head)->nr_frags;
3173 frag_tail = &skb_shinfo(head)->frag_list;
3174 while (*frag_tail) {
3175 nfrags += 1 + skb_shinfo(*frag_tail)->nr_frags;
3176 frag_tail = &(*frag_tail)->next;
3177 n++;
3178 }
3179
3180 if (max_subframes && n > max_subframes)
3181 goto out;
3182
3183 if (max_frags && nfrags > max_frags)
3184 goto out;
3185
3186 if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) + 2,
3187 &subframe_len))
3188 goto out;
3189
3190 ret = true;
3191 data = skb_push(skb, ETH_ALEN + 2);
3192 memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
3193
3194 data += 2 * ETH_ALEN;
3195 len = cpu_to_be16(subframe_len);
3196 memcpy(data, &len, 2);
3197 memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
3198
3199 head->len += skb->len;
3200 head->data_len += skb->len;
3201 *frag_tail = skb;
3202
3203 flow->backlog += head->len - orig_len;
3204 tin->backlog_bytes += head->len - orig_len;
3205
3206 fq_recalc_backlog(fq, tin, flow);
3207
3208 out:
3209 spin_unlock_bh(&fq->lock);
3210
3211 return ret;
3212 }
3213
3214 /*
3215 * Can be called while the sta lock is held. Anything that can cause packets to
3216 * be generated will cause deadlock!
3217 */
3218 static void ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
3219 struct sta_info *sta, u8 pn_offs,
3220 struct ieee80211_key *key,
3221 struct sk_buff *skb)
3222 {
3223 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3224 struct ieee80211_hdr *hdr = (void *)skb->data;
3225 u8 tid = IEEE80211_NUM_TIDS;
3226
3227 if (key)
3228 info->control.hw_key = &key->conf;
3229
3230 ieee80211_tx_stats(skb->dev, skb->len);
3231
3232 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3233 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3234 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
3235 } else {
3236 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
3237 hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
3238 sdata->sequence_number += 0x10;
3239 }
3240
3241 if (skb_shinfo(skb)->gso_size)
3242 sta->tx_stats.msdu[tid] +=
3243 DIV_ROUND_UP(skb->len, skb_shinfo(skb)->gso_size);
3244 else
3245 sta->tx_stats.msdu[tid]++;
3246
3247 info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
3248
3249 /* statistics normally done by ieee80211_tx_h_stats (but that
3250 * has to consider fragmentation, so is more complex)
3251 */
3252 sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
3253 sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
3254
3255 if (pn_offs) {
3256 u64 pn;
3257 u8 *crypto_hdr = skb->data + pn_offs;
3258
3259 switch (key->conf.cipher) {
3260 case WLAN_CIPHER_SUITE_CCMP:
3261 case WLAN_CIPHER_SUITE_CCMP_256:
3262 case WLAN_CIPHER_SUITE_GCMP:
3263 case WLAN_CIPHER_SUITE_GCMP_256:
3264 pn = atomic64_inc_return(&key->conf.tx_pn);
3265 crypto_hdr[0] = pn;
3266 crypto_hdr[1] = pn >> 8;
3267 crypto_hdr[4] = pn >> 16;
3268 crypto_hdr[5] = pn >> 24;
3269 crypto_hdr[6] = pn >> 32;
3270 crypto_hdr[7] = pn >> 40;
3271 break;
3272 }
3273 }
3274 }
3275
3276 static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
3277 struct sta_info *sta,
3278 struct ieee80211_fast_tx *fast_tx,
3279 struct sk_buff *skb)
3280 {
3281 struct ieee80211_local *local = sdata->local;
3282 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
3283 int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
3284 int hw_headroom = sdata->local->hw.extra_tx_headroom;
3285 struct ethhdr eth;
3286 struct ieee80211_tx_info *info;
3287 struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
3288 struct ieee80211_tx_data tx;
3289 ieee80211_tx_result r;
3290 struct tid_ampdu_tx *tid_tx = NULL;
3291 u8 tid = IEEE80211_NUM_TIDS;
3292
3293 /* control port protocol needs a lot of special handling */
3294 if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
3295 return false;
3296
3297 /* only RFC 1042 SNAP */
3298 if (ethertype < ETH_P_802_3_MIN)
3299 return false;
3300
3301 /* don't handle TX status request here either */
3302 if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
3303 return false;
3304
3305 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3306 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3307 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
3308 if (tid_tx) {
3309 if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
3310 return false;
3311 if (tid_tx->timeout)
3312 tid_tx->last_tx = jiffies;
3313 }
3314 }
3315
3316 /* after this point (skb is modified) we cannot return false */
3317
3318 if (skb_shared(skb)) {
3319 struct sk_buff *tmp_skb = skb;
3320
3321 skb = skb_clone(skb, GFP_ATOMIC);
3322 kfree_skb(tmp_skb);
3323
3324 if (!skb)
3325 return true;
3326 }
3327
3328 if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
3329 ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
3330 return true;
3331
3332 /* will not be crypto-handled beyond what we do here, so use false
3333 * as the may-encrypt argument for the resize to not account for
3334 * more room than we already have in 'extra_head'
3335 */
3336 if (unlikely(ieee80211_skb_resize(sdata, skb,
3337 max_t(int, extra_head + hw_headroom -
3338 skb_headroom(skb), 0),
3339 false))) {
3340 kfree_skb(skb);
3341 return true;
3342 }
3343
3344 memcpy(&eth, skb->data, ETH_HLEN - 2);
3345 hdr = skb_push(skb, extra_head);
3346 memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
3347 memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
3348 memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
3349
3350 info = IEEE80211_SKB_CB(skb);
3351 memset(info, 0, sizeof(*info));
3352 info->band = fast_tx->band;
3353 info->control.vif = &sdata->vif;
3354 info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
3355 IEEE80211_TX_CTL_DONTFRAG |
3356 (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
3357 info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
3358
3359 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3360 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3361 *ieee80211_get_qos_ctl(hdr) = tid;
3362 }
3363
3364 __skb_queue_head_init(&tx.skbs);
3365
3366 tx.flags = IEEE80211_TX_UNICAST;
3367 tx.local = local;
3368 tx.sdata = sdata;
3369 tx.sta = sta;
3370 tx.key = fast_tx->key;
3371
3372 if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
3373 tx.skb = skb;
3374 r = ieee80211_tx_h_rate_ctrl(&tx);
3375 skb = tx.skb;
3376 tx.skb = NULL;
3377
3378 if (r != TX_CONTINUE) {
3379 if (r != TX_QUEUED)
3380 kfree_skb(skb);
3381 return true;
3382 }
3383 }
3384
3385 if (ieee80211_queue_skb(local, sdata, sta, skb))
3386 return true;
3387
3388 ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
3389 fast_tx->key, skb);
3390
3391 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3392 sdata = container_of(sdata->bss,
3393 struct ieee80211_sub_if_data, u.ap);
3394
3395 __skb_queue_tail(&tx.skbs, skb);
3396 ieee80211_tx_frags(local, &sdata->vif, &sta->sta, &tx.skbs, false);
3397 return true;
3398 }
3399
3400 struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
3401 struct ieee80211_txq *txq)
3402 {
3403 struct ieee80211_local *local = hw_to_local(hw);
3404 struct txq_info *txqi = container_of(txq, struct txq_info, txq);
3405 struct ieee80211_hdr *hdr;
3406 struct sk_buff *skb = NULL;
3407 struct fq *fq = &local->fq;
3408 struct fq_tin *tin = &txqi->tin;
3409 struct ieee80211_tx_info *info;
3410 struct ieee80211_tx_data tx;
3411 ieee80211_tx_result r;
3412 struct ieee80211_vif *vif;
3413
3414 spin_lock_bh(&fq->lock);
3415
3416 if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
3417 goto out;
3418
3419 /* Make sure fragments stay together. */
3420 skb = __skb_dequeue(&txqi->frags);
3421 if (skb)
3422 goto out;
3423
3424 begin:
3425 skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func);
3426 if (!skb)
3427 goto out;
3428
3429 hdr = (struct ieee80211_hdr *)skb->data;
3430 info = IEEE80211_SKB_CB(skb);
3431
3432 memset(&tx, 0, sizeof(tx));
3433 __skb_queue_head_init(&tx.skbs);
3434 tx.local = local;
3435 tx.skb = skb;
3436 tx.sdata = vif_to_sdata(info->control.vif);
3437
3438 if (txq->sta)
3439 tx.sta = container_of(txq->sta, struct sta_info, sta);
3440
3441 /*
3442 * The key can be removed while the packet was queued, so need to call
3443 * this here to get the current key.
3444 */
3445 r = ieee80211_tx_h_select_key(&tx);
3446 if (r != TX_CONTINUE) {
3447 ieee80211_free_txskb(&local->hw, skb);
3448 goto begin;
3449 }
3450
3451 if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
3452 info->flags |= IEEE80211_TX_CTL_AMPDU;
3453 else
3454 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
3455
3456 if (info->control.flags & IEEE80211_TX_CTRL_FAST_XMIT) {
3457 struct sta_info *sta = container_of(txq->sta, struct sta_info,
3458 sta);
3459 u8 pn_offs = 0;
3460
3461 if (tx.key &&
3462 (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
3463 pn_offs = ieee80211_hdrlen(hdr->frame_control);
3464
3465 ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
3466 tx.key, skb);
3467 } else {
3468 if (invoke_tx_handlers_late(&tx))
3469 goto begin;
3470
3471 skb = __skb_dequeue(&tx.skbs);
3472
3473 if (!skb_queue_empty(&tx.skbs))
3474 skb_queue_splice_tail(&tx.skbs, &txqi->frags);
3475 }
3476
3477 if (skb && skb_has_frag_list(skb) &&
3478 !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
3479 if (skb_linearize(skb)) {
3480 ieee80211_free_txskb(&local->hw, skb);
3481 goto begin;
3482 }
3483 }
3484
3485 switch (tx.sdata->vif.type) {
3486 case NL80211_IFTYPE_MONITOR:
3487 if (tx.sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
3488 vif = &tx.sdata->vif;
3489 break;
3490 }
3491 tx.sdata = rcu_dereference(local->monitor_sdata);
3492 if (tx.sdata) {
3493 vif = &tx.sdata->vif;
3494 info->hw_queue =
3495 vif->hw_queue[skb_get_queue_mapping(skb)];
3496 } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
3497 ieee80211_free_txskb(&local->hw, skb);
3498 goto begin;
3499 } else {
3500 vif = NULL;
3501 }
3502 break;
3503 case NL80211_IFTYPE_AP_VLAN:
3504 tx.sdata = container_of(tx.sdata->bss,
3505 struct ieee80211_sub_if_data, u.ap);
3506 /* fall through */
3507 default:
3508 vif = &tx.sdata->vif;
3509 break;
3510 }
3511
3512 IEEE80211_SKB_CB(skb)->control.vif = vif;
3513 out:
3514 spin_unlock_bh(&fq->lock);
3515
3516 return skb;
3517 }
3518 EXPORT_SYMBOL(ieee80211_tx_dequeue);
3519
3520 void __ieee80211_subif_start_xmit(struct sk_buff *skb,
3521 struct net_device *dev,
3522 u32 info_flags)
3523 {
3524 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3525 struct sta_info *sta;
3526 struct sk_buff *next;
3527
3528 if (unlikely(skb->len < ETH_HLEN)) {
3529 kfree_skb(skb);
3530 return;
3531 }
3532
3533 rcu_read_lock();
3534
3535 if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
3536 goto out_free;
3537
3538 if (!IS_ERR_OR_NULL(sta)) {
3539 struct ieee80211_fast_tx *fast_tx;
3540
3541 fast_tx = rcu_dereference(sta->fast_tx);
3542
3543 if (fast_tx &&
3544 ieee80211_xmit_fast(sdata, sta, fast_tx, skb))
3545 goto out;
3546 }
3547
3548 if (skb_is_gso(skb)) {
3549 struct sk_buff *segs;
3550
3551 segs = skb_gso_segment(skb, 0);
3552 if (IS_ERR(segs)) {
3553 goto out_free;
3554 } else if (segs) {
3555 consume_skb(skb);
3556 skb = segs;
3557 }
3558 } else {
3559 /* we cannot process non-linear frames on this path */
3560 if (skb_linearize(skb)) {
3561 kfree_skb(skb);
3562 goto out;
3563 }
3564
3565 /* the frame could be fragmented, software-encrypted, and other
3566 * things so we cannot really handle checksum offload with it -
3567 * fix it up in software before we handle anything else.
3568 */
3569 if (skb->ip_summed == CHECKSUM_PARTIAL) {
3570 skb_set_transport_header(skb,
3571 skb_checksum_start_offset(skb));
3572 if (skb_checksum_help(skb))
3573 goto out_free;
3574 }
3575 }
3576
3577 next = skb;
3578 while (next) {
3579 skb = next;
3580 next = skb->next;
3581
3582 skb->prev = NULL;
3583 skb->next = NULL;
3584
3585 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
3586 if (IS_ERR(skb))
3587 goto out;
3588
3589 ieee80211_tx_stats(dev, skb->len);
3590
3591 ieee80211_xmit(sdata, sta, skb);
3592 }
3593 goto out;
3594 out_free:
3595 kfree_skb(skb);
3596 out:
3597 rcu_read_unlock();
3598 }
3599
3600 static int ieee80211_change_da(struct sk_buff *skb, struct sta_info *sta)
3601 {
3602 struct ethhdr *eth;
3603 int err;
3604
3605 err = skb_ensure_writable(skb, ETH_HLEN);
3606 if (unlikely(err))
3607 return err;
3608
3609 eth = (void *)skb->data;
3610 ether_addr_copy(eth->h_dest, sta->sta.addr);
3611
3612 return 0;
3613 }
3614
3615 static bool ieee80211_multicast_to_unicast(struct sk_buff *skb,
3616 struct net_device *dev)
3617 {
3618 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3619 const struct ethhdr *eth = (void *)skb->data;
3620 const struct vlan_ethhdr *ethvlan = (void *)skb->data;
3621 __be16 ethertype;
3622
3623 if (likely(!is_multicast_ether_addr(eth->h_dest)))
3624 return false;
3625
3626 switch (sdata->vif.type) {
3627 case NL80211_IFTYPE_AP_VLAN:
3628 if (sdata->u.vlan.sta)
3629 return false;
3630 if (sdata->wdev.use_4addr)
3631 return false;
3632 /* fall through */
3633 case NL80211_IFTYPE_AP:
3634 /* check runtime toggle for this bss */
3635 if (!sdata->bss->multicast_to_unicast)
3636 return false;
3637 break;
3638 default:
3639 return false;
3640 }
3641
3642 /* multicast to unicast conversion only for some payload */
3643 ethertype = eth->h_proto;
3644 if (ethertype == htons(ETH_P_8021Q) && skb->len >= VLAN_ETH_HLEN)
3645 ethertype = ethvlan->h_vlan_encapsulated_proto;
3646 switch (ethertype) {
3647 case htons(ETH_P_ARP):
3648 case htons(ETH_P_IP):
3649 case htons(ETH_P_IPV6):
3650 break;
3651 default:
3652 return false;
3653 }
3654
3655 return true;
3656 }
3657
3658 static void
3659 ieee80211_convert_to_unicast(struct sk_buff *skb, struct net_device *dev,
3660 struct sk_buff_head *queue)
3661 {
3662 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3663 struct ieee80211_local *local = sdata->local;
3664 const struct ethhdr *eth = (struct ethhdr *)skb->data;
3665 struct sta_info *sta, *first = NULL;
3666 struct sk_buff *cloned_skb;
3667
3668 rcu_read_lock();
3669
3670 list_for_each_entry_rcu(sta, &local->sta_list, list) {
3671 if (sdata != sta->sdata)
3672 /* AP-VLAN mismatch */
3673 continue;
3674 if (unlikely(ether_addr_equal(eth->h_source, sta->sta.addr)))
3675 /* do not send back to source */
3676 continue;
3677 if (!first) {
3678 first = sta;
3679 continue;
3680 }
3681 cloned_skb = skb_clone(skb, GFP_ATOMIC);
3682 if (!cloned_skb)
3683 goto multicast;
3684 if (unlikely(ieee80211_change_da(cloned_skb, sta))) {
3685 dev_kfree_skb(cloned_skb);
3686 goto multicast;
3687 }
3688 __skb_queue_tail(queue, cloned_skb);
3689 }
3690
3691 if (likely(first)) {
3692 if (unlikely(ieee80211_change_da(skb, first)))
3693 goto multicast;
3694 __skb_queue_tail(queue, skb);
3695 } else {
3696 /* no STA connected, drop */
3697 kfree_skb(skb);
3698 skb = NULL;
3699 }
3700
3701 goto out;
3702 multicast:
3703 __skb_queue_purge(queue);
3704 __skb_queue_tail(queue, skb);
3705 out:
3706 rcu_read_unlock();
3707 }
3708
3709 /**
3710 * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
3711 * @skb: packet to be sent
3712 * @dev: incoming interface
3713 *
3714 * On failure skb will be freed.
3715 */
3716 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
3717 struct net_device *dev)
3718 {
3719 if (unlikely(ieee80211_multicast_to_unicast(skb, dev))) {
3720 struct sk_buff_head queue;
3721
3722 __skb_queue_head_init(&queue);
3723 ieee80211_convert_to_unicast(skb, dev, &queue);
3724 while ((skb = __skb_dequeue(&queue)))
3725 __ieee80211_subif_start_xmit(skb, dev, 0);
3726 } else {
3727 __ieee80211_subif_start_xmit(skb, dev, 0);
3728 }
3729
3730 return NETDEV_TX_OK;
3731 }
3732
3733 struct sk_buff *
3734 ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
3735 struct sk_buff *skb, u32 info_flags)
3736 {
3737 struct ieee80211_hdr *hdr;
3738 struct ieee80211_tx_data tx = {
3739 .local = sdata->local,
3740 .sdata = sdata,
3741 };
3742 struct sta_info *sta;
3743
3744 rcu_read_lock();
3745
3746 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
3747 kfree_skb(skb);
3748 skb = ERR_PTR(-EINVAL);
3749 goto out;
3750 }
3751
3752 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
3753 if (IS_ERR(skb))
3754 goto out;
3755
3756 hdr = (void *)skb->data;
3757 tx.sta = sta_info_get(sdata, hdr->addr1);
3758 tx.skb = skb;
3759
3760 if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
3761 rcu_read_unlock();
3762 kfree_skb(skb);
3763 return ERR_PTR(-EINVAL);
3764 }
3765
3766 out:
3767 rcu_read_unlock();
3768 return skb;
3769 }
3770
3771 /*
3772 * ieee80211_clear_tx_pending may not be called in a context where
3773 * it is possible that it packets could come in again.
3774 */
3775 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
3776 {
3777 struct sk_buff *skb;
3778 int i;
3779
3780 for (i = 0; i < local->hw.queues; i++) {
3781 while ((skb = skb_dequeue(&local->pending[i])) != NULL)
3782 ieee80211_free_txskb(&local->hw, skb);
3783 }
3784 }
3785
3786 /*
3787 * Returns false if the frame couldn't be transmitted but was queued instead,
3788 * which in this case means re-queued -- take as an indication to stop sending
3789 * more pending frames.
3790 */
3791 static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
3792 struct sk_buff *skb)
3793 {
3794 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3795 struct ieee80211_sub_if_data *sdata;
3796 struct sta_info *sta;
3797 struct ieee80211_hdr *hdr;
3798 bool result;
3799 struct ieee80211_chanctx_conf *chanctx_conf;
3800
3801 sdata = vif_to_sdata(info->control.vif);
3802
3803 if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
3804 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3805 if (unlikely(!chanctx_conf)) {
3806 dev_kfree_skb(skb);
3807 return true;
3808 }
3809 info->band = chanctx_conf->def.chan->band;
3810 result = ieee80211_tx(sdata, NULL, skb, true);
3811 } else {
3812 struct sk_buff_head skbs;
3813
3814 __skb_queue_head_init(&skbs);
3815 __skb_queue_tail(&skbs, skb);
3816
3817 hdr = (struct ieee80211_hdr *)skb->data;
3818 sta = sta_info_get(sdata, hdr->addr1);
3819
3820 result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
3821 }
3822
3823 return result;
3824 }
3825
3826 /*
3827 * Transmit all pending packets. Called from tasklet.
3828 */
3829 void ieee80211_tx_pending(unsigned long data)
3830 {
3831 struct ieee80211_local *local = (struct ieee80211_local *)data;
3832 unsigned long flags;
3833 int i;
3834 bool txok;
3835
3836 rcu_read_lock();
3837
3838 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
3839 for (i = 0; i < local->hw.queues; i++) {
3840 /*
3841 * If queue is stopped by something other than due to pending
3842 * frames, or we have no pending frames, proceed to next queue.
3843 */
3844 if (local->queue_stop_reasons[i] ||
3845 skb_queue_empty(&local->pending[i]))
3846 continue;
3847
3848 while (!skb_queue_empty(&local->pending[i])) {
3849 struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
3850 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3851
3852 if (WARN_ON(!info->control.vif)) {
3853 ieee80211_free_txskb(&local->hw, skb);
3854 continue;
3855 }
3856
3857 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
3858 flags);
3859
3860 txok = ieee80211_tx_pending_skb(local, skb);
3861 spin_lock_irqsave(&local->queue_stop_reason_lock,
3862 flags);
3863 if (!txok)
3864 break;
3865 }
3866
3867 if (skb_queue_empty(&local->pending[i]))
3868 ieee80211_propagate_queue_wake(local, i);
3869 }
3870 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
3871
3872 rcu_read_unlock();
3873 }
3874
3875 /* functions for drivers to get certain frames */
3876
3877 static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
3878 struct ps_data *ps, struct sk_buff *skb,
3879 bool is_template)
3880 {
3881 u8 *pos, *tim;
3882 int aid0 = 0;
3883 int i, have_bits = 0, n1, n2;
3884
3885 /* Generate bitmap for TIM only if there are any STAs in power save
3886 * mode. */
3887 if (atomic_read(&ps->num_sta_ps) > 0)
3888 /* in the hope that this is faster than
3889 * checking byte-for-byte */
3890 have_bits = !bitmap_empty((unsigned long *)ps->tim,
3891 IEEE80211_MAX_AID+1);
3892 if (!is_template) {
3893 if (ps->dtim_count == 0)
3894 ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
3895 else
3896 ps->dtim_count--;
3897 }
3898
3899 tim = pos = skb_put(skb, 6);
3900 *pos++ = WLAN_EID_TIM;
3901 *pos++ = 4;
3902 *pos++ = ps->dtim_count;
3903 *pos++ = sdata->vif.bss_conf.dtim_period;
3904
3905 if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf))
3906 aid0 = 1;
3907
3908 ps->dtim_bc_mc = aid0 == 1;
3909
3910 if (have_bits) {
3911 /* Find largest even number N1 so that bits numbered 1 through
3912 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
3913 * (N2 + 1) x 8 through 2007 are 0. */
3914 n1 = 0;
3915 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
3916 if (ps->tim[i]) {
3917 n1 = i & 0xfe;
3918 break;
3919 }
3920 }
3921 n2 = n1;
3922 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
3923 if (ps->tim[i]) {
3924 n2 = i;
3925 break;
3926 }
3927 }
3928
3929 /* Bitmap control */
3930 *pos++ = n1 | aid0;
3931 /* Part Virt Bitmap */
3932 skb_put(skb, n2 - n1);
3933 memcpy(pos, ps->tim + n1, n2 - n1 + 1);
3934
3935 tim[1] = n2 - n1 + 4;
3936 } else {
3937 *pos++ = aid0; /* Bitmap control */
3938 *pos++ = 0; /* Part Virt Bitmap */
3939 }
3940 }
3941
3942 static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
3943 struct ps_data *ps, struct sk_buff *skb,
3944 bool is_template)
3945 {
3946 struct ieee80211_local *local = sdata->local;
3947
3948 /*
3949 * Not very nice, but we want to allow the driver to call
3950 * ieee80211_beacon_get() as a response to the set_tim()
3951 * callback. That, however, is already invoked under the
3952 * sta_lock to guarantee consistent and race-free update
3953 * of the tim bitmap in mac80211 and the driver.
3954 */
3955 if (local->tim_in_locked_section) {
3956 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
3957 } else {
3958 spin_lock_bh(&local->tim_lock);
3959 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
3960 spin_unlock_bh(&local->tim_lock);
3961 }
3962
3963 return 0;
3964 }
3965
3966 static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
3967 struct beacon_data *beacon)
3968 {
3969 struct probe_resp *resp;
3970 u8 *beacon_data;
3971 size_t beacon_data_len;
3972 int i;
3973 u8 count = beacon->csa_current_counter;
3974
3975 switch (sdata->vif.type) {
3976 case NL80211_IFTYPE_AP:
3977 beacon_data = beacon->tail;
3978 beacon_data_len = beacon->tail_len;
3979 break;
3980 case NL80211_IFTYPE_ADHOC:
3981 beacon_data = beacon->head;
3982 beacon_data_len = beacon->head_len;
3983 break;
3984 case NL80211_IFTYPE_MESH_POINT:
3985 beacon_data = beacon->head;
3986 beacon_data_len = beacon->head_len;
3987 break;
3988 default:
3989 return;
3990 }
3991
3992 rcu_read_lock();
3993 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
3994 resp = rcu_dereference(sdata->u.ap.probe_resp);
3995
3996 if (beacon->csa_counter_offsets[i]) {
3997 if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
3998 beacon_data_len)) {
3999 rcu_read_unlock();
4000 return;
4001 }
4002
4003 beacon_data[beacon->csa_counter_offsets[i]] = count;
4004 }
4005
4006 if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
4007 resp->data[resp->csa_counter_offsets[i]] = count;
4008 }
4009 rcu_read_unlock();
4010 }
4011
4012 static u8 __ieee80211_csa_update_counter(struct beacon_data *beacon)
4013 {
4014 beacon->csa_current_counter--;
4015
4016 /* the counter should never reach 0 */
4017 WARN_ON_ONCE(!beacon->csa_current_counter);
4018
4019 return beacon->csa_current_counter;
4020 }
4021
4022 u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
4023 {
4024 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4025 struct beacon_data *beacon = NULL;
4026 u8 count = 0;
4027
4028 rcu_read_lock();
4029
4030 if (sdata->vif.type == NL80211_IFTYPE_AP)
4031 beacon = rcu_dereference(sdata->u.ap.beacon);
4032 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
4033 beacon = rcu_dereference(sdata->u.ibss.presp);
4034 else if (ieee80211_vif_is_mesh(&sdata->vif))
4035 beacon = rcu_dereference(sdata->u.mesh.beacon);
4036
4037 if (!beacon)
4038 goto unlock;
4039
4040 count = __ieee80211_csa_update_counter(beacon);
4041
4042 unlock:
4043 rcu_read_unlock();
4044 return count;
4045 }
4046 EXPORT_SYMBOL(ieee80211_csa_update_counter);
4047
4048 bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
4049 {
4050 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4051 struct beacon_data *beacon = NULL;
4052 u8 *beacon_data;
4053 size_t beacon_data_len;
4054 int ret = false;
4055
4056 if (!ieee80211_sdata_running(sdata))
4057 return false;
4058
4059 rcu_read_lock();
4060 if (vif->type == NL80211_IFTYPE_AP) {
4061 struct ieee80211_if_ap *ap = &sdata->u.ap;
4062
4063 beacon = rcu_dereference(ap->beacon);
4064 if (WARN_ON(!beacon || !beacon->tail))
4065 goto out;
4066 beacon_data = beacon->tail;
4067 beacon_data_len = beacon->tail_len;
4068 } else if (vif->type == NL80211_IFTYPE_ADHOC) {
4069 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
4070
4071 beacon = rcu_dereference(ifibss->presp);
4072 if (!beacon)
4073 goto out;
4074
4075 beacon_data = beacon->head;
4076 beacon_data_len = beacon->head_len;
4077 } else if (vif->type == NL80211_IFTYPE_MESH_POINT) {
4078 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
4079
4080 beacon = rcu_dereference(ifmsh->beacon);
4081 if (!beacon)
4082 goto out;
4083
4084 beacon_data = beacon->head;
4085 beacon_data_len = beacon->head_len;
4086 } else {
4087 WARN_ON(1);
4088 goto out;
4089 }
4090
4091 if (!beacon->csa_counter_offsets[0])
4092 goto out;
4093
4094 if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
4095 goto out;
4096
4097 if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
4098 ret = true;
4099 out:
4100 rcu_read_unlock();
4101
4102 return ret;
4103 }
4104 EXPORT_SYMBOL(ieee80211_csa_is_complete);
4105
4106 static struct sk_buff *
4107 __ieee80211_beacon_get(struct ieee80211_hw *hw,
4108 struct ieee80211_vif *vif,
4109 struct ieee80211_mutable_offsets *offs,
4110 bool is_template)
4111 {
4112 struct ieee80211_local *local = hw_to_local(hw);
4113 struct beacon_data *beacon = NULL;
4114 struct sk_buff *skb = NULL;
4115 struct ieee80211_tx_info *info;
4116 struct ieee80211_sub_if_data *sdata = NULL;
4117 enum nl80211_band band;
4118 struct ieee80211_tx_rate_control txrc;
4119 struct ieee80211_chanctx_conf *chanctx_conf;
4120 int csa_off_base = 0;
4121
4122 rcu_read_lock();
4123
4124 sdata = vif_to_sdata(vif);
4125 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4126
4127 if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
4128 goto out;
4129
4130 if (offs)
4131 memset(offs, 0, sizeof(*offs));
4132
4133 if (sdata->vif.type == NL80211_IFTYPE_AP) {
4134 struct ieee80211_if_ap *ap = &sdata->u.ap;
4135
4136 beacon = rcu_dereference(ap->beacon);
4137 if (beacon) {
4138 if (beacon->csa_counter_offsets[0]) {
4139 if (!is_template)
4140 __ieee80211_csa_update_counter(beacon);
4141
4142 ieee80211_set_csa(sdata, beacon);
4143 }
4144
4145 /*
4146 * headroom, head length,
4147 * tail length and maximum TIM length
4148 */
4149 skb = dev_alloc_skb(local->tx_headroom +
4150 beacon->head_len +
4151 beacon->tail_len + 256 +
4152 local->hw.extra_beacon_tailroom);
4153 if (!skb)
4154 goto out;
4155
4156 skb_reserve(skb, local->tx_headroom);
4157 skb_put_data(skb, beacon->head, beacon->head_len);
4158
4159 ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
4160 is_template);
4161
4162 if (offs) {
4163 offs->tim_offset = beacon->head_len;
4164 offs->tim_length = skb->len - beacon->head_len;
4165
4166 /* for AP the csa offsets are from tail */
4167 csa_off_base = skb->len;
4168 }
4169
4170 if (beacon->tail)
4171 skb_put_data(skb, beacon->tail,
4172 beacon->tail_len);
4173 } else
4174 goto out;
4175 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
4176 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
4177 struct ieee80211_hdr *hdr;
4178
4179 beacon = rcu_dereference(ifibss->presp);
4180 if (!beacon)
4181 goto out;
4182
4183 if (beacon->csa_counter_offsets[0]) {
4184 if (!is_template)
4185 __ieee80211_csa_update_counter(beacon);
4186
4187 ieee80211_set_csa(sdata, beacon);
4188 }
4189
4190 skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
4191 local->hw.extra_beacon_tailroom);
4192 if (!skb)
4193 goto out;
4194 skb_reserve(skb, local->tx_headroom);
4195 skb_put_data(skb, beacon->head, beacon->head_len);
4196
4197 hdr = (struct ieee80211_hdr *) skb->data;
4198 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
4199 IEEE80211_STYPE_BEACON);
4200 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
4201 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
4202
4203 beacon = rcu_dereference(ifmsh->beacon);
4204 if (!beacon)
4205 goto out;
4206
4207 if (beacon->csa_counter_offsets[0]) {
4208 if (!is_template)
4209 /* TODO: For mesh csa_counter is in TU, so
4210 * decrementing it by one isn't correct, but
4211 * for now we leave it consistent with overall
4212 * mac80211's behavior.
4213 */
4214 __ieee80211_csa_update_counter(beacon);
4215
4216 ieee80211_set_csa(sdata, beacon);
4217 }
4218
4219 if (ifmsh->sync_ops)
4220 ifmsh->sync_ops->adjust_tsf(sdata, beacon);
4221
4222 skb = dev_alloc_skb(local->tx_headroom +
4223 beacon->head_len +
4224 256 + /* TIM IE */
4225 beacon->tail_len +
4226 local->hw.extra_beacon_tailroom);
4227 if (!skb)
4228 goto out;
4229 skb_reserve(skb, local->tx_headroom);
4230 skb_put_data(skb, beacon->head, beacon->head_len);
4231 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
4232
4233 if (offs) {
4234 offs->tim_offset = beacon->head_len;
4235 offs->tim_length = skb->len - beacon->head_len;
4236 }
4237
4238 skb_put_data(skb, beacon->tail, beacon->tail_len);
4239 } else {
4240 WARN_ON(1);
4241 goto out;
4242 }
4243
4244 /* CSA offsets */
4245 if (offs && beacon) {
4246 int i;
4247
4248 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
4249 u16 csa_off = beacon->csa_counter_offsets[i];
4250
4251 if (!csa_off)
4252 continue;
4253
4254 offs->csa_counter_offs[i] = csa_off_base + csa_off;
4255 }
4256 }
4257
4258 band = chanctx_conf->def.chan->band;
4259
4260 info = IEEE80211_SKB_CB(skb);
4261
4262 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
4263 info->flags |= IEEE80211_TX_CTL_NO_ACK;
4264 info->band = band;
4265
4266 memset(&txrc, 0, sizeof(txrc));
4267 txrc.hw = hw;
4268 txrc.sband = local->hw.wiphy->bands[band];
4269 txrc.bss_conf = &sdata->vif.bss_conf;
4270 txrc.skb = skb;
4271 txrc.reported_rate.idx = -1;
4272 txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
4273 txrc.bss = true;
4274 rate_control_get_rate(sdata, NULL, &txrc);
4275
4276 info->control.vif = vif;
4277
4278 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
4279 IEEE80211_TX_CTL_ASSIGN_SEQ |
4280 IEEE80211_TX_CTL_FIRST_FRAGMENT;
4281 out:
4282 rcu_read_unlock();
4283 return skb;
4284
4285 }
4286
4287 struct sk_buff *
4288 ieee80211_beacon_get_template(struct ieee80211_hw *hw,
4289 struct ieee80211_vif *vif,
4290 struct ieee80211_mutable_offsets *offs)
4291 {
4292 return __ieee80211_beacon_get(hw, vif, offs, true);
4293 }
4294 EXPORT_SYMBOL(ieee80211_beacon_get_template);
4295
4296 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
4297 struct ieee80211_vif *vif,
4298 u16 *tim_offset, u16 *tim_length)
4299 {
4300 struct ieee80211_mutable_offsets offs = {};
4301 struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
4302 struct sk_buff *copy;
4303 struct ieee80211_supported_band *sband;
4304 int shift;
4305
4306 if (!bcn)
4307 return bcn;
4308
4309 if (tim_offset)
4310 *tim_offset = offs.tim_offset;
4311
4312 if (tim_length)
4313 *tim_length = offs.tim_length;
4314
4315 if (ieee80211_hw_check(hw, BEACON_TX_STATUS) ||
4316 !hw_to_local(hw)->monitors)
4317 return bcn;
4318
4319 /* send a copy to monitor interfaces */
4320 copy = skb_copy(bcn, GFP_ATOMIC);
4321 if (!copy)
4322 return bcn;
4323
4324 shift = ieee80211_vif_get_shift(vif);
4325 sband = ieee80211_get_sband(vif_to_sdata(vif));
4326 if (!sband)
4327 return bcn;
4328
4329 ieee80211_tx_monitor(hw_to_local(hw), copy, sband, 1, shift, false);
4330
4331 return bcn;
4332 }
4333 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
4334
4335 struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
4336 struct ieee80211_vif *vif)
4337 {
4338 struct ieee80211_if_ap *ap = NULL;
4339 struct sk_buff *skb = NULL;
4340 struct probe_resp *presp = NULL;
4341 struct ieee80211_hdr *hdr;
4342 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4343
4344 if (sdata->vif.type != NL80211_IFTYPE_AP)
4345 return NULL;
4346
4347 rcu_read_lock();
4348
4349 ap = &sdata->u.ap;
4350 presp = rcu_dereference(ap->probe_resp);
4351 if (!presp)
4352 goto out;
4353
4354 skb = dev_alloc_skb(presp->len);
4355 if (!skb)
4356 goto out;
4357
4358 skb_put_data(skb, presp->data, presp->len);
4359
4360 hdr = (struct ieee80211_hdr *) skb->data;
4361 memset(hdr->addr1, 0, sizeof(hdr->addr1));
4362
4363 out:
4364 rcu_read_unlock();
4365 return skb;
4366 }
4367 EXPORT_SYMBOL(ieee80211_proberesp_get);
4368
4369 struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
4370 struct ieee80211_vif *vif)
4371 {
4372 struct ieee80211_sub_if_data *sdata;
4373 struct ieee80211_if_managed *ifmgd;
4374 struct ieee80211_pspoll *pspoll;
4375 struct ieee80211_local *local;
4376 struct sk_buff *skb;
4377
4378 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
4379 return NULL;
4380
4381 sdata = vif_to_sdata(vif);
4382 ifmgd = &sdata->u.mgd;
4383 local = sdata->local;
4384
4385 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
4386 if (!skb)
4387 return NULL;
4388
4389 skb_reserve(skb, local->hw.extra_tx_headroom);
4390
4391 pspoll = skb_put_zero(skb, sizeof(*pspoll));
4392 pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
4393 IEEE80211_STYPE_PSPOLL);
4394 pspoll->aid = cpu_to_le16(ifmgd->aid);
4395
4396 /* aid in PS-Poll has its two MSBs each set to 1 */
4397 pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
4398
4399 memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
4400 memcpy(pspoll->ta, vif->addr, ETH_ALEN);
4401
4402 return skb;
4403 }
4404 EXPORT_SYMBOL(ieee80211_pspoll_get);
4405
4406 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
4407 struct ieee80211_vif *vif)
4408 {
4409 struct ieee80211_hdr_3addr *nullfunc;
4410 struct ieee80211_sub_if_data *sdata;
4411 struct ieee80211_if_managed *ifmgd;
4412 struct ieee80211_local *local;
4413 struct sk_buff *skb;
4414
4415 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
4416 return NULL;
4417
4418 sdata = vif_to_sdata(vif);
4419 ifmgd = &sdata->u.mgd;
4420 local = sdata->local;
4421
4422 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
4423 if (!skb)
4424 return NULL;
4425
4426 skb_reserve(skb, local->hw.extra_tx_headroom);
4427
4428 nullfunc = skb_put_zero(skb, sizeof(*nullfunc));
4429 nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
4430 IEEE80211_STYPE_NULLFUNC |
4431 IEEE80211_FCTL_TODS);
4432 memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
4433 memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
4434 memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
4435
4436 return skb;
4437 }
4438 EXPORT_SYMBOL(ieee80211_nullfunc_get);
4439
4440 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
4441 const u8 *src_addr,
4442 const u8 *ssid, size_t ssid_len,
4443 size_t tailroom)
4444 {
4445 struct ieee80211_local *local = hw_to_local(hw);
4446 struct ieee80211_hdr_3addr *hdr;
4447 struct sk_buff *skb;
4448 size_t ie_ssid_len;
4449 u8 *pos;
4450
4451 ie_ssid_len = 2 + ssid_len;
4452
4453 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
4454 ie_ssid_len + tailroom);
4455 if (!skb)
4456 return NULL;
4457
4458 skb_reserve(skb, local->hw.extra_tx_headroom);
4459
4460 hdr = skb_put_zero(skb, sizeof(*hdr));
4461 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
4462 IEEE80211_STYPE_PROBE_REQ);
4463 eth_broadcast_addr(hdr->addr1);
4464 memcpy(hdr->addr2, src_addr, ETH_ALEN);
4465 eth_broadcast_addr(hdr->addr3);
4466
4467 pos = skb_put(skb, ie_ssid_len);
4468 *pos++ = WLAN_EID_SSID;
4469 *pos++ = ssid_len;
4470 if (ssid_len)
4471 memcpy(pos, ssid, ssid_len);
4472 pos += ssid_len;
4473
4474 return skb;
4475 }
4476 EXPORT_SYMBOL(ieee80211_probereq_get);
4477
4478 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4479 const void *frame, size_t frame_len,
4480 const struct ieee80211_tx_info *frame_txctl,
4481 struct ieee80211_rts *rts)
4482 {
4483 const struct ieee80211_hdr *hdr = frame;
4484
4485 rts->frame_control =
4486 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
4487 rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
4488 frame_txctl);
4489 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
4490 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
4491 }
4492 EXPORT_SYMBOL(ieee80211_rts_get);
4493
4494 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
4495 const void *frame, size_t frame_len,
4496 const struct ieee80211_tx_info *frame_txctl,
4497 struct ieee80211_cts *cts)
4498 {
4499 const struct ieee80211_hdr *hdr = frame;
4500
4501 cts->frame_control =
4502 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
4503 cts->duration = ieee80211_ctstoself_duration(hw, vif,
4504 frame_len, frame_txctl);
4505 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
4506 }
4507 EXPORT_SYMBOL(ieee80211_ctstoself_get);
4508
4509 struct sk_buff *
4510 ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
4511 struct ieee80211_vif *vif)
4512 {
4513 struct ieee80211_local *local = hw_to_local(hw);
4514 struct sk_buff *skb = NULL;
4515 struct ieee80211_tx_data tx;
4516 struct ieee80211_sub_if_data *sdata;
4517 struct ps_data *ps;
4518 struct ieee80211_tx_info *info;
4519 struct ieee80211_chanctx_conf *chanctx_conf;
4520
4521 sdata = vif_to_sdata(vif);
4522
4523 rcu_read_lock();
4524 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4525
4526 if (!chanctx_conf)
4527 goto out;
4528
4529 if (sdata->vif.type == NL80211_IFTYPE_AP) {
4530 struct beacon_data *beacon =
4531 rcu_dereference(sdata->u.ap.beacon);
4532
4533 if (!beacon || !beacon->head)
4534 goto out;
4535
4536 ps = &sdata->u.ap.ps;
4537 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
4538 ps = &sdata->u.mesh.ps;
4539 } else {
4540 goto out;
4541 }
4542
4543 if (ps->dtim_count != 0 || !ps->dtim_bc_mc)
4544 goto out; /* send buffered bc/mc only after DTIM beacon */
4545
4546 while (1) {
4547 skb = skb_dequeue(&ps->bc_buf);
4548 if (!skb)
4549 goto out;
4550 local->total_ps_buffered--;
4551
4552 if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) {
4553 struct ieee80211_hdr *hdr =
4554 (struct ieee80211_hdr *) skb->data;
4555 /* more buffered multicast/broadcast frames ==> set
4556 * MoreData flag in IEEE 802.11 header to inform PS
4557 * STAs */
4558 hdr->frame_control |=
4559 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
4560 }
4561
4562 if (sdata->vif.type == NL80211_IFTYPE_AP)
4563 sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
4564 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
4565 break;
4566 ieee80211_free_txskb(hw, skb);
4567 }
4568
4569 info = IEEE80211_SKB_CB(skb);
4570
4571 tx.flags |= IEEE80211_TX_PS_BUFFERED;
4572 info->band = chanctx_conf->def.chan->band;
4573
4574 if (invoke_tx_handlers(&tx))
4575 skb = NULL;
4576 out:
4577 rcu_read_unlock();
4578
4579 return skb;
4580 }
4581 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
4582
4583 int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
4584 {
4585 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
4586 struct ieee80211_sub_if_data *sdata = sta->sdata;
4587 struct ieee80211_local *local = sdata->local;
4588 int ret;
4589 u32 queues;
4590
4591 lockdep_assert_held(&local->sta_mtx);
4592
4593 /* only some cases are supported right now */
4594 switch (sdata->vif.type) {
4595 case NL80211_IFTYPE_STATION:
4596 case NL80211_IFTYPE_AP:
4597 case NL80211_IFTYPE_AP_VLAN:
4598 break;
4599 default:
4600 WARN_ON(1);
4601 return -EINVAL;
4602 }
4603
4604 if (WARN_ON(tid >= IEEE80211_NUM_UPS))
4605 return -EINVAL;
4606
4607 if (sta->reserved_tid == tid) {
4608 ret = 0;
4609 goto out;
4610 }
4611
4612 if (sta->reserved_tid != IEEE80211_TID_UNRESERVED) {
4613 sdata_err(sdata, "TID reservation already active\n");
4614 ret = -EALREADY;
4615 goto out;
4616 }
4617
4618 ieee80211_stop_vif_queues(sdata->local, sdata,
4619 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
4620
4621 synchronize_net();
4622
4623 /* Tear down BA sessions so we stop aggregating on this TID */
4624 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION)) {
4625 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
4626 __ieee80211_stop_tx_ba_session(sta, tid,
4627 AGG_STOP_LOCAL_REQUEST);
4628 }
4629
4630 queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
4631 __ieee80211_flush_queues(local, sdata, queues, false);
4632
4633 sta->reserved_tid = tid;
4634
4635 ieee80211_wake_vif_queues(local, sdata,
4636 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
4637
4638 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION))
4639 clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
4640
4641 ret = 0;
4642 out:
4643 return ret;
4644 }
4645 EXPORT_SYMBOL(ieee80211_reserve_tid);
4646
4647 void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
4648 {
4649 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
4650 struct ieee80211_sub_if_data *sdata = sta->sdata;
4651
4652 lockdep_assert_held(&sdata->local->sta_mtx);
4653
4654 /* only some cases are supported right now */
4655 switch (sdata->vif.type) {
4656 case NL80211_IFTYPE_STATION:
4657 case NL80211_IFTYPE_AP:
4658 case NL80211_IFTYPE_AP_VLAN:
4659 break;
4660 default:
4661 WARN_ON(1);
4662 return;
4663 }
4664
4665 if (tid != sta->reserved_tid) {
4666 sdata_err(sdata, "TID to unreserve (%d) isn't reserved\n", tid);
4667 return;
4668 }
4669
4670 sta->reserved_tid = IEEE80211_TID_UNRESERVED;
4671 }
4672 EXPORT_SYMBOL(ieee80211_unreserve_tid);
4673
4674 void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
4675 struct sk_buff *skb, int tid,
4676 enum nl80211_band band)
4677 {
4678 int ac = ieee80211_ac_from_tid(tid);
4679
4680 skb_reset_mac_header(skb);
4681 skb_set_queue_mapping(skb, ac);
4682 skb->priority = tid;
4683
4684 skb->dev = sdata->dev;
4685
4686 /*
4687 * The other path calling ieee80211_xmit is from the tasklet,
4688 * and while we can handle concurrent transmissions locking
4689 * requirements are that we do not come into tx with bhs on.
4690 */
4691 local_bh_disable();
4692 IEEE80211_SKB_CB(skb)->band = band;
4693 ieee80211_xmit(sdata, NULL, skb);
4694 local_bh_enable();
4695 }
Linux with added FPC-III support