projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
nl80211: Allow setting multicast rate on OCB interfaces
[deliverable/linux.git] / net / mac80211 / tx.c
CommitLineData
e2ebc74d
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
d98ad83e 6 * Copyright 2013-2014 Intel Mobile Communications GmbH
e2ebc74d
JB		 7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 *
12 *
13 * Transmit and frame generation functions.
14 */
15
16#include <linux/kernel.h>
17#include <linux/slab.h>
18#include <linux/skbuff.h>
19#include <linux/etherdevice.h>
20#include <linux/bitmap.h>
d4e46a3d 21#include <linux/rcupdate.h>
bc3b2d7f 22#include <linux/export.h>
881d966b 23#include <net/net_namespace.h>
e2ebc74d
JB		 24#include <net/ieee80211_radiotap.h>
25#include <net/cfg80211.h>
26#include <net/mac80211.h>
27#include <asm/unaligned.h>
28
29#include "ieee80211_i.h"
24487981 30#include "driver-ops.h"
2c8dccc7 31#include "led.h"
33b64eb2 32#include "mesh.h"
e2ebc74d
JB		 33#include "wep.h"
34#include "wpa.h"
35#include "wme.h"
2c8dccc7 36#include "rate.h"
e2ebc74d 37
e2ebc74d
JB		 38/* misc utils */
39
5a490510
JB		 40static inline void ieee80211_tx_stats(struct net_device *dev, u32 len)
41{
42 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
43
44 u64_stats_update_begin(&tstats->syncp);
45 tstats->tx_packets++;
46 tstats->tx_bytes += len;
47 u64_stats_update_end(&tstats->syncp);
48}
49
252b86c4
JB		 50static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
51 struct sk_buff *skb, int group_addr,
03f93c3d 52 int next_frag_len)
e2ebc74d 53{
2103dec1 54 int rate, mrate, erp, dur, i, shift = 0;
2e92e6f2 55 struct ieee80211_rate *txrate;
e2ebc74d 56 struct ieee80211_local *local = tx->local;
8318d78a 57 struct ieee80211_supported_band *sband;
358c8d9d 58 struct ieee80211_hdr *hdr;
252b86c4 59 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2103dec1
SW		 60 struct ieee80211_chanctx_conf *chanctx_conf;
61 u32 rate_flags = 0;
62
63 rcu_read_lock();
64 chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
65 if (chanctx_conf) {
66 shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
67 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
68 }
69 rcu_read_unlock();
e6a9854b
JB		 70
71 /* assume HW handles this */
336004e2 72 if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
e6a9854b
JB		 73 return 0;
74
75 /* uh huh? */
0d528d85 76 if (WARN_ON_ONCE(tx->rate.idx < 0))
e6a9854b 77 return 0;
e2ebc74d 78
2d56577b 79 sband = local->hw.wiphy->bands[info->band];
0d528d85 80 txrate = &sband->bitrates[tx->rate.idx];
8318d78a 81
e6a9854b 82 erp = txrate->flags & IEEE80211_RATE_ERP_G;
e2ebc74d
JB		 83
84 /*
85 * data and mgmt (except PS Poll):
86 * - during CFP: 32768
87 * - during contention period:
88 * if addr1 is group address: 0
89 * if more fragments = 0 and addr1 is individual address: time to
90 * transmit one ACK plus SIFS
91 * if more fragments = 1 and addr1 is individual address: time to
92 * transmit next fragment plus 2 x ACK plus 3 x SIFS
93 *
94 * IEEE 802.11, 9.6:
95 * - control response frame (CTS or ACK) shall be transmitted using the
96 * same rate as the immediately previous frame in the frame exchange
97 * sequence, if this rate belongs to the PHY mandatory rates, or else
98 * at the highest possible rate belonging to the PHY rates in the
99 * BSSBasicRateSet
100 */
252b86c4 101 hdr = (struct ieee80211_hdr *)skb->data;
358c8d9d 102 if (ieee80211_is_ctl(hdr->frame_control)) {
e2ebc74d 103 /* TODO: These control frames are not currently sent by
ccd7b362 104 * mac80211, but should they be implemented, this function
e2ebc74d
JB		 105 * needs to be updated to support duration field calculation.
106 *
107 * RTS: time needed to transmit pending data/mgmt frame plus
108 * one CTS frame plus one ACK frame plus 3 x SIFS
109 * CTS: duration of immediately previous RTS minus time
110 * required to transmit CTS and its SIFS
111 * ACK: 0 if immediately previous directed data/mgmt had
112 * more=0, with more=1 duration in ACK frame is duration
113 * from previous frame minus time needed to transmit ACK
114 * and its SIFS
115 * PS Poll: BIT(15) | BIT(14) | aid
116 */
117 return 0;
118 }
119
120 /* data/mgmt */
121 if (0 /* FIX: data/mgmt during CFP */)
03f93c3d 122 return cpu_to_le16(32768);
e2ebc74d
JB		 123
124 if (group_addr) /* Group address as the destination - no ACK */
125 return 0;
126
127 /* Individual destination address:
128 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
129 * CTS and ACK frames shall be transmitted using the highest rate in
130 * basic rate set that is less than or equal to the rate of the
131 * immediately previous frame and that is using the same modulation
132 * (CCK or OFDM). If no basic rate set matches with these requirements,
133 * the highest mandatory rate of the PHY that is less than or equal to
134 * the rate of the previous frame is used.
135 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
136 */
137 rate = -1;
8318d78a
JB		 138 /* use lowest available if everything fails */
139 mrate = sband->bitrates[0].bitrate;
140 for (i = 0; i < sband->n_bitrates; i++) {
141 struct ieee80211_rate *r = &sband->bitrates[i];
e2ebc74d 142
8318d78a
JB		 143 if (r->bitrate > txrate->bitrate)
144 break;
e2ebc74d 145
2103dec1
SW		 146 if ((rate_flags & r->flags) != rate_flags)
147 continue;
148
bda3933a 149 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
2103dec1 150 rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
8318d78a
JB		 151
152 switch (sband->band) {
153 case IEEE80211_BAND_2GHZ: {
154 u32 flag;
155 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
156 flag = IEEE80211_RATE_MANDATORY_G;
157 else
158 flag = IEEE80211_RATE_MANDATORY_B;
159 if (r->flags & flag)
160 mrate = r->bitrate;
161 break;
162 }
163 case IEEE80211_BAND_5GHZ:
164 if (r->flags & IEEE80211_RATE_MANDATORY_A)
165 mrate = r->bitrate;
166 break;
3a0c52a6
VK		 167 case IEEE80211_BAND_60GHZ:
168 /* TODO, for now fall through */
8318d78a
JB		 169 case IEEE80211_NUM_BANDS:
170 WARN_ON(1);
171 break;
172 }
e2ebc74d
JB		 173 }
174 if (rate == -1) {
175 /* No matching basic rate found; use highest suitable mandatory
176 * PHY rate */
2103dec1 177 rate = DIV_ROUND_UP(mrate, 1 << shift);
e2ebc74d
JB		 178 }
179
6674f210
SW		 180 /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
181 if (ieee80211_is_data_qos(hdr->frame_control) &&
c26a0e10 182 *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
6674f210
SW		 183 dur = 0;
184 else
185 /* Time needed to transmit ACK
186 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
187 * to closest integer */
4ee73f33 188 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
438b61b7
SW		 189 tx->sdata->vif.bss_conf.use_short_preamble,
190 shift);
e2ebc74d
JB		 191
192 if (next_frag_len) {
193 /* Frame is fragmented: duration increases with time needed to
194 * transmit next fragment plus ACK and 2 x SIFS. */
195 dur *= 2; /* ACK + SIFS */
196 /* next fragment */
4ee73f33 197 dur += ieee80211_frame_duration(sband->band, next_frag_len,
8318d78a 198 txrate->bitrate, erp,
438b61b7
SW		 199 tx->sdata->vif.bss_conf.use_short_preamble,
200 shift);
e2ebc74d
JB		 201 }
202
03f93c3d 203 return cpu_to_le16(dur);
e2ebc74d
JB		 204}
205
e2ebc74d 206/* tx handlers */
5c1b98a5
KV		 207static ieee80211_tx_result debug_noinline
208ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
209{
210 struct ieee80211_local *local = tx->local;
0c74211d 211 struct ieee80211_if_managed *ifmgd;
5c1b98a5
KV		 212
213 /* driver doesn't support power save */
30686bf7 214 if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS))
5c1b98a5
KV		 215 return TX_CONTINUE;
216
217 /* hardware does dynamic power save */
30686bf7 218 if (ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
5c1b98a5
KV		 219 return TX_CONTINUE;
220
221 /* dynamic power save disabled */
222 if (local->hw.conf.dynamic_ps_timeout <= 0)
223 return TX_CONTINUE;
224
225 /* we are scanning, don't enable power save */
226 if (local->scanning)
227 return TX_CONTINUE;
228
229 if (!local->ps_sdata)
230 return TX_CONTINUE;
231
232 /* No point if we're going to suspend */
233 if (local->quiescing)
234 return TX_CONTINUE;
235
0c74211d
KV		 236 /* dynamic ps is supported only in managed mode */
237 if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
238 return TX_CONTINUE;
239
240 ifmgd = &tx->sdata->u.mgd;
241
242 /*
243 * Don't wakeup from power save if u-apsd is enabled, voip ac has
244 * u-apsd enabled and the frame is in voip class. This effectively
245 * means that even if all access categories have u-apsd enabled, in
246 * practise u-apsd is only used with the voip ac. This is a
247 * workaround for the case when received voip class packets do not
248 * have correct qos tag for some reason, due the network or the
249 * peer application.
250 *
dc41e4d4 251 * Note: ifmgd->uapsd_queues access is racy here. If the value is
0c74211d
KV		 252 * changed via debugfs, user needs to reassociate manually to have
253 * everything in sync.
254 */
4875d30d
JB		 255 if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
256 (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
257 skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
0c74211d
KV		 258 return TX_CONTINUE;
259
5c1b98a5
KV		 260 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
261 ieee80211_stop_queues_by_reason(&local->hw,
445ea4e8 262 IEEE80211_MAX_QUEUE_MAP,
cca07b00
LC		 263 IEEE80211_QUEUE_STOP_REASON_PS,
264 false);
db28569a 265 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
5c1b98a5
KV		 266 ieee80211_queue_work(&local->hw,
267 &local->dynamic_ps_disable_work);
268 }
269
5db1c07c
LC		 270 /* Don't restart the timer if we're not disassociated */
271 if (!ifmgd->associated)
272 return TX_CONTINUE;
273
5c1b98a5
KV		 274 mod_timer(&local->dynamic_ps_timer, jiffies +
275 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
276
277 return TX_CONTINUE;
278}
e2ebc74d 279
d9e8a70f 280static ieee80211_tx_result debug_noinline
5cf121c3 281ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
e2ebc74d 282{
358c8d9d 283
e039fa4a 284 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
e039fa4a 285 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
c2c98fde 286 bool assoc = false;
e2ebc74d 287
e039fa4a 288 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
9ae54c84 289 return TX_CONTINUE;
58d4185e 290
b23b025f
BG		 291 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
292 test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
a9a6ffff
KV		 293 !ieee80211_is_probe_req(hdr->frame_control) &&
294 !ieee80211_is_nullfunc(hdr->frame_control))
295 /*
296 * When software scanning only nullfunc frames (to notify
297 * the sleep state to the AP) and probe requests (for the
298 * active scan) are allowed, all other frames should not be
299 * sent and we should not get here, but if we do
300 * nonetheless, drop them to avoid sending them
301 * off-channel. See the link below and
302 * ieee80211_start_scan() for more.
303 *
304 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
305 */
9ae54c84 306 return TX_DROP;
e2ebc74d 307
239281f8
RL		 308 if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
309 return TX_CONTINUE;
310
1be7fe8d
BJ		 311 if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
312 return TX_CONTINUE;
313
5cf121c3 314 if (tx->flags & IEEE80211_TX_PS_BUFFERED)
9ae54c84 315 return TX_CONTINUE;
e2ebc74d 316
c2c98fde
JB		 317 if (tx->sta)
318 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
e2ebc74d 319
5cf121c3 320 if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
c2c98fde 321 if (unlikely(!assoc &&
358c8d9d 322 ieee80211_is_data(hdr->frame_control))) {
e2ebc74d 323#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
bdcbd8e0
JB		 324 sdata_info(tx->sdata,
325 "dropped data frame to not associated station %pM\n",
326 hdr->addr1);
327#endif
e2ebc74d 328 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
9ae54c84 329 return TX_DROP;
e2ebc74d 330 }
29623892
JB		 331 } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
332 ieee80211_is_data(hdr->frame_control) &&
030ef8f8 333 !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) {
29623892
JB		 334 /*
335 * No associated STAs - no need to send multicast
336 * frames.
337 */
338 return TX_DROP;
e2ebc74d
JB		 339 }
340
9ae54c84 341 return TX_CONTINUE;
e2ebc74d
JB		 342}
343
e2ebc74d
JB		 344/* This function is called whenever the AP is about to exceed the maximum limit
345 * of buffered frames for power saving STAs. This situation should not really
346 * happen often during normal operation, so dropping the oldest buffered packet
347 * from each queue should be OK to make some room for new frames. */
348static void purge_old_ps_buffers(struct ieee80211_local *local)
349{
350 int total = 0, purged = 0;
351 struct sk_buff *skb;
352 struct ieee80211_sub_if_data *sdata;
353 struct sta_info *sta;
354
79010420 355 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
d012a605
MP		 356 struct ps_data *ps;
357
358 if (sdata->vif.type == NL80211_IFTYPE_AP)
359 ps = &sdata->u.ap.ps;
3f52b7e3
MP		 360 else if (ieee80211_vif_is_mesh(&sdata->vif))
361 ps = &sdata->u.mesh.ps;
d012a605 362 else
e2ebc74d 363 continue;
d012a605
MP		 364
365 skb = skb_dequeue(&ps->bc_buf);
e2ebc74d
JB		 366 if (skb) {
367 purged++;
368 dev_kfree_skb(skb);
369 }
d012a605 370 total += skb_queue_len(&ps->bc_buf);
e2ebc74d 371 }
e2ebc74d 372
948d887d
JB		 373 /*
374 * Drop one frame from each station from the lowest-priority
375 * AC that has frames at all.
376 */
d0709a65 377 list_for_each_entry_rcu(sta, &local->sta_list, list) {
948d887d
JB		 378 int ac;
379
380 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
381 skb = skb_dequeue(&sta->ps_tx_buf[ac]);
382 total += skb_queue_len(&sta->ps_tx_buf[ac]);
383 if (skb) {
384 purged++;
c3e7724b 385 ieee80211_free_txskb(&local->hw, skb);
948d887d
JB		 386 break;
387 }
e2ebc74d 388 }
e2ebc74d 389 }
d0709a65 390
e2ebc74d 391 local->total_ps_buffered = total;
bdcbd8e0 392 ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
e2ebc74d
JB		 393}
394
9ae54c84 395static ieee80211_tx_result
5cf121c3 396ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 397{
e039fa4a 398 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 399 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d012a605 400 struct ps_data *ps;
e039fa4a 401
7d54d0dd
JB		 402 /*
403 * broadcast/multicast frame
404 *
3f52b7e3 405 * If any of the associated/peer stations is in power save mode,
7d54d0dd
JB		 406 * the frame is buffered to be sent after DTIM beacon frame.
407 * This is done either by the hardware or us.
408 */
409
3f52b7e3 410 /* powersaving STAs currently only in AP/VLAN/mesh mode */
d012a605
MP		 411 if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
412 tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
413 if (!tx->sdata->bss)
414 return TX_CONTINUE;
415
416 ps = &tx->sdata->bss->ps;
3f52b7e3
MP		 417 } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
418 ps = &tx->sdata->u.mesh.ps;
d012a605 419 } else {
3e122be0 420 return TX_CONTINUE;
d012a605
MP		 421 }
422
3e122be0
JB		 423
424 /* no buffering for ordered frames */
358c8d9d 425 if (ieee80211_has_order(hdr->frame_control))
9ae54c84 426 return TX_CONTINUE;
7d54d0dd 427
08b99399
JB		 428 if (ieee80211_is_probe_req(hdr->frame_control))
429 return TX_CONTINUE;
430
30686bf7 431 if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
f4d57941
JB		 432 info->hw_queue = tx->sdata->vif.cab_queue;
433
7d54d0dd 434 /* no stations in PS mode */
d012a605 435 if (!atomic_read(&ps->num_sta_ps))
9ae54c84 436 return TX_CONTINUE;
7d54d0dd 437
62b517cb 438 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
62b1208e 439
62b517cb 440 /* device releases frame after DTIM beacon */
30686bf7 441 if (!ieee80211_hw_check(&tx->local->hw, HOST_BROADCAST_PS_BUFFERING))
62b1208e 442 return TX_CONTINUE;
62b1208e 443
7d54d0dd 444 /* buffered in mac80211 */
62b1208e
JB		 445 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
446 purge_old_ps_buffers(tx->local);
447
d012a605 448 if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
bdcbd8e0
JB		 449 ps_dbg(tx->sdata,
450 "BC TX buffer full - dropping the oldest frame\n");
d012a605 451 dev_kfree_skb(skb_dequeue(&ps->bc_buf));
62b1208e
JB		 452 } else
453 tx->local->total_ps_buffered++;
e2ebc74d 454
d012a605 455 skb_queue_tail(&ps->bc_buf, tx->skb);
7d54d0dd 456
62b1208e 457 return TX_QUEUED;
e2ebc74d
JB		 458}
459
fb733336
JM		 460static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
461 struct sk_buff *skb)
462{
463 if (!ieee80211_is_mgmt(fc))
464 return 0;
465
c2c98fde 466 if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
fb733336
JM		 467 return 0;
468
d8ca16db 469 if (!ieee80211_is_robust_mgmt_frame(skb))
fb733336
JM		 470 return 0;
471
472 return 1;
473}
474
9ae54c84 475static ieee80211_tx_result
5cf121c3 476ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d
JB		 477{
478 struct sta_info *sta = tx->sta;
e039fa4a 479 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
08b99399 480 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
3393a608 481 struct ieee80211_local *local = tx->local;
e2ebc74d 482
02f2f1a9 483 if (unlikely(!sta))
9ae54c84 484 return TX_CONTINUE;
e2ebc74d 485
c2c98fde 486 if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
5ac2e350
JB		 487 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
488 test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
02f2f1a9 489 !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
948d887d
JB		 490 int ac = skb_get_queue_mapping(tx->skb);
491
08b99399
JB		 492 if (ieee80211_is_mgmt(hdr->frame_control) &&
493 !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
494 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
495 return TX_CONTINUE;
496 }
497
bdcbd8e0
JB		 498 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
499 sta->sta.addr, sta->sta.aid, ac);
e2ebc74d
JB		 500 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
501 purge_old_ps_buffers(tx->local);
1d147bfa
EG		 502
503 /* sync with ieee80211_sta_ps_deliver_wakeup */
504 spin_lock(&sta->ps_lock);
505 /*
506 * STA woke up the meantime and all the frames on ps_tx_buf have
507 * been queued to pending queue. No reordering can happen, go
508 * ahead and Tx the packet.
509 */
510 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
5ac2e350
JB		 511 !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
512 !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
1d147bfa
EG		 513 spin_unlock(&sta->ps_lock);
514 return TX_CONTINUE;
515 }
516
948d887d
JB		 517 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
518 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
bdcbd8e0
JB		 519 ps_dbg(tx->sdata,
520 "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
521 sta->sta.addr, ac);
c3e7724b 522 ieee80211_free_txskb(&local->hw, old);
e2ebc74d
JB		 523 } else
524 tx->local->total_ps_buffered++;
004c872e 525
e039fa4a 526 info->control.jiffies = jiffies;
5061b0c2 527 info->control.vif = &tx->sdata->vif;
8f77f384 528 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
03c8c06f 529 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
948d887d 530 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
1d147bfa 531 spin_unlock(&sta->ps_lock);
3393a608
JO		 532
533 if (!timer_pending(&local->sta_cleanup))
534 mod_timer(&local->sta_cleanup,
535 round_jiffies(jiffies +
536 STA_INFO_CLEANUP_INTERVAL));
537
c868cb35
JB		 538 /*
539 * We queued up some frames, so the TIM bit might
540 * need to be set, recalculate it.
541 */
542 sta_info_recalc_tim(sta);
543
9ae54c84 544 return TX_QUEUED;
bdcbd8e0
JB		 545 } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
546 ps_dbg(tx->sdata,
547 "STA %pM in PS mode, but polling/in SP -> send frame\n",
548 sta->sta.addr);
e2ebc74d 549 }
e2ebc74d 550
9ae54c84 551 return TX_CONTINUE;
e2ebc74d
JB		 552}
553
d9e8a70f 554static ieee80211_tx_result debug_noinline
5cf121c3 555ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 556{
5cf121c3 557 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
9ae54c84 558 return TX_CONTINUE;
e2ebc74d 559
5cf121c3 560 if (tx->flags & IEEE80211_TX_UNICAST)
e2ebc74d
JB		 561 return ieee80211_tx_h_unicast_ps_buf(tx);
562 else
563 return ieee80211_tx_h_multicast_ps_buf(tx);
564}
565
a621fa4d
JB		 566static ieee80211_tx_result debug_noinline
567ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
568{
569 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
570
af61a165
JB		 571 if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
572 if (tx->sdata->control_port_no_encrypt)
573 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
574 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
9c1c98a3 575 info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
af61a165 576 }
a621fa4d
JB		 577
578 return TX_CONTINUE;
579}
580
d9e8a70f 581static ieee80211_tx_result debug_noinline
5cf121c3 582ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
e2ebc74d 583{
46e6de15 584 struct ieee80211_key *key;
e039fa4a 585 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 586 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d4e46a3d 587
3b8d81e0 588 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
e2ebc74d 589 tx->key = NULL;
2475b1cc
MS		 590 else if (tx->sta &&
591 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
d4e46a3d 592 tx->key = key;
3cfcf6ac 593 else if (ieee80211_is_mgmt(hdr->frame_control) &&
ecbcd324 594 is_multicast_ether_addr(hdr->addr1) &&
d8ca16db 595 ieee80211_is_robust_mgmt_frame(tx->skb) &&
3cfcf6ac
JM		 596 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
597 tx->key = key;
f7e0104c
JB		 598 else if (is_multicast_ether_addr(hdr->addr1) &&
599 (key = rcu_dereference(tx->sdata->default_multicast_key)))
600 tx->key = key;
601 else if (!is_multicast_ether_addr(hdr->addr1) &&
602 (key = rcu_dereference(tx->sdata->default_unicast_key)))
d4e46a3d 603 tx->key = key;
e8f4fb7c 604 else
4922f71f 605 tx->key = NULL;
e2ebc74d
JB		 606
607 if (tx->key) {
813d7669
JB		 608 bool skip_hw = false;
609
011bfcc4 610 /* TODO: add threshold stuff again */
176e4f84 611
97359d12
JB		 612 switch (tx->key->conf.cipher) {
613 case WLAN_CIPHER_SUITE_WEP40:
614 case WLAN_CIPHER_SUITE_WEP104:
97359d12 615 case WLAN_CIPHER_SUITE_TKIP:
358c8d9d 616 if (!ieee80211_is_data_present(hdr->frame_control))
176e4f84
JB		 617 tx->key = NULL;
618 break;
97359d12 619 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db 620 case WLAN_CIPHER_SUITE_CCMP_256:
00b9cfa3
JM		 621 case WLAN_CIPHER_SUITE_GCMP:
622 case WLAN_CIPHER_SUITE_GCMP_256:
fb733336
JM		 623 if (!ieee80211_is_data_present(hdr->frame_control) &&
624 !ieee80211_use_mfp(hdr->frame_control, tx->sta,
625 tx->skb))
626 tx->key = NULL;
3b43a187
KV		 627 else
628 skip_hw = (tx->key->conf.flags &
e548c49e 629 IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
3b43a187 630 ieee80211_is_mgmt(hdr->frame_control);
fb733336 631 break;
97359d12 632 case WLAN_CIPHER_SUITE_AES_CMAC:
56c52da2 633 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
8ade538b
JM		 634 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
635 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3cfcf6ac
JM		 636 if (!ieee80211_is_mgmt(hdr->frame_control))
637 tx->key = NULL;
638 break;
176e4f84 639 }
813d7669 640
e54faf29
JB		 641 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
642 !ieee80211_is_deauth(hdr->frame_control)))
95acac61
JB		 643 return TX_DROP;
644
f12553eb 645 if (!skip_hw && tx->key &&
382b1655 646 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
813d7669 647 info->control.hw_key = &tx->key->conf;
e2ebc74d
JB		 648 }
649
9ae54c84 650 return TX_CONTINUE;
e2ebc74d
JB		 651}
652
d9e8a70f 653static ieee80211_tx_result debug_noinline
5cf121c3 654ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
e2ebc74d 655{
e039fa4a 656 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
e6a9854b
JB		 657 struct ieee80211_hdr *hdr = (void *)tx->skb->data;
658 struct ieee80211_supported_band *sband;
a2c40249 659 u32 len;
e6a9854b 660 struct ieee80211_tx_rate_control txrc;
0d528d85 661 struct ieee80211_sta_rates *ratetbl = NULL;
c2c98fde 662 bool assoc = false;
8318d78a 663
e6a9854b 664 memset(&txrc, 0, sizeof(txrc));
e2ebc74d 665
2d56577b 666 sband = tx->local->hw.wiphy->bands[info->band];
58d4185e 667
a2c40249 668 len = min_t(u32, tx->skb->len + FCS_LEN,
b9a5f8ca 669 tx->local->hw.wiphy->frag_threshold);
e6a9854b
JB		 670
671 /* set up the tx rate control struct we give the RC algo */
005e472b 672 txrc.hw = &tx->local->hw;
e6a9854b
JB		 673 txrc.sband = sband;
674 txrc.bss_conf = &tx->sdata->vif.bss_conf;
675 txrc.skb = tx->skb;
676 txrc.reported_rate.idx = -1;
2d56577b 677 txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
37eb0b16
JM		 678 if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
679 txrc.max_rate_idx = -1;
680 else
681 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
2ffbe6d3
FF		 682
683 if (tx->sdata->rc_has_mcs_mask[info->band])
684 txrc.rate_idx_mcs_mask =
685 tx->sdata->rc_rateidx_mcs_mask[info->band];
686
8f0729b1 687 txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
4bb62344 688 tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
8f0729b1 689 tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
e6a9854b
JB		 690
691 /* set up RTS protection if desired */
b9a5f8ca 692 if (len > tx->local->hw.wiphy->rts_threshold) {
0d528d85 693 txrc.rts = true;
e2ebc74d 694 }
e2ebc74d 695
0d528d85 696 info->control.use_rts = txrc.rts;
991fec09
FF		 697 info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
698
e6a9854b
JB		 699 /*
700 * Use short preamble if the BSS can handle it, but not for
701 * management frames unless we know the receiver can handle
702 * that -- the management frame might be to a station that
703 * just wants a probe response.
704 */
705 if (tx->sdata->vif.bss_conf.use_short_preamble &&
706 (ieee80211_is_data(hdr->frame_control) ||
c2c98fde 707 (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
0d528d85
FF		 708 txrc.short_preamble = true;
709
710 info->control.short_preamble = txrc.short_preamble;
e2ebc74d 711
c2c98fde
JB		 712 if (tx->sta)
713 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
b770b43e
LR		 714
715 /*
716 * Lets not bother rate control if we're associated and cannot
717 * talk to the sta. This should not happen.
718 */
c2c98fde 719 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
b770b43e
LR		 720 !rate_usable_index_exists(sband, &tx->sta->sta),
721 "%s: Dropped data frame as no usable bitrate found while "
722 "scanning and associated. Target station: "
723 "%pM on %d GHz band\n",
47846c9b 724 tx->sdata->name, hdr->addr1,
2d56577b 725 info->band ? 5 : 2))
b770b43e 726 return TX_DROP;
2e92e6f2 727
b770b43e
LR		 728 /*
729 * If we're associated with the sta at this point we know we can at
730 * least send the frame at the lowest bit rate.
731 */
e6a9854b
JB		 732 rate_control_get_rate(tx->sdata, tx->sta, &txrc);
733
0d528d85
FF		 734 if (tx->sta && !info->control.skip_table)
735 ratetbl = rcu_dereference(tx->sta->sta.rates);
736
737 if (unlikely(info->control.rates[0].idx < 0)) {
738 if (ratetbl) {
739 struct ieee80211_tx_rate rate = {
740 .idx = ratetbl->rate[0].idx,
741 .flags = ratetbl->rate[0].flags,
742 .count = ratetbl->rate[0].count
743 };
744
745 if (ratetbl->rate[0].idx < 0)
746 return TX_DROP;
747
748 tx->rate = rate;
749 } else {
750 return TX_DROP;
751 }
752 } else {
753 tx->rate = info->control.rates[0];
754 }
e6a9854b 755
c1ce5a74 756 if (txrc.reported_rate.idx < 0) {
0d528d85 757 txrc.reported_rate = tx->rate;
c1ce5a74
HS		 758 if (tx->sta && ieee80211_is_data(hdr->frame_control))
759 tx->sta->last_tx_rate = txrc.reported_rate;
760 } else if (tx->sta)
e6a9854b 761 tx->sta->last_tx_rate = txrc.reported_rate;
e039fa4a 762
0d528d85
FF		 763 if (ratetbl)
764 return TX_CONTINUE;
765
e6a9854b
JB		 766 if (unlikely(!info->control.rates[0].count))
767 info->control.rates[0].count = 1;
e2ebc74d 768
9955151d
GS		 769 if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
770 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
771 info->control.rates[0].count = 1;
772
e6a9854b
JB		 773 return TX_CONTINUE;
774}
775
ba8c3d6f
FF		 776static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
777{
778 u16 *seq = &sta->tid_seq[tid];
779 __le16 ret = cpu_to_le16(*seq);
780
781 /* Increase the sequence number. */
782 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
783
784 return ret;
785}
786
f591fa5d
JB		 787static ieee80211_tx_result debug_noinline
788ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
789{
790 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
791 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
f591fa5d
JB		 792 u8 *qc;
793 int tid;
794
25d834e1
JB		 795 /*
796 * Packet injection may want to control the sequence
797 * number, if we have no matching interface then we
798 * neither assign one ourselves nor ask the driver to.
799 */
5061b0c2 800 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
25d834e1
JB		 801 return TX_CONTINUE;
802
f591fa5d
JB		 803 if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
804 return TX_CONTINUE;
805
806 if (ieee80211_hdrlen(hdr->frame_control) < 24)
807 return TX_CONTINUE;
808
49a59543
JB		 809 if (ieee80211_is_qos_nullfunc(hdr->frame_control))
810 return TX_CONTINUE;
811
94778280
JB		 812 /*
813 * Anything but QoS data that has a sequence number field
814 * (is long enough) gets a sequence number from the global
c4c205f3
BC		 815 * counter. QoS data frames with a multicast destination
816 * also use the global counter (802.11-2012 9.3.2.10).
94778280 817 */
c4c205f3
BC		 818 if (!ieee80211_is_data_qos(hdr->frame_control) ||
819 is_multicast_ether_addr(hdr->addr1)) {
94778280 820 /* driver should assign sequence number */
f591fa5d 821 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
94778280
JB		 822 /* for pure STA mode without beacons, we can do it */
823 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
824 tx->sdata->sequence_number += 0x10;
79c892b8
JB		 825 if (tx->sta)
826 tx->sta->tx_msdu[IEEE80211_NUM_TIDS]++;
f591fa5d
JB		 827 return TX_CONTINUE;
828 }
829
830 /*
831 * This should be true for injected/management frames only, for
832 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
833 * above since they are not QoS-data frames.
834 */
835 if (!tx->sta)
836 return TX_CONTINUE;
837
838 /* include per-STA, per-TID sequence counter */
839
840 qc = ieee80211_get_qos_ctl(hdr);
841 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
79c892b8 842 tx->sta->tx_msdu[tid]++;
f591fa5d 843
ba8c3d6f
FF		 844 if (!tx->sta->sta.txq[0])
845 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
f591fa5d
JB		 846
847 return TX_CONTINUE;
848}
849
252b86c4 850static int ieee80211_fragment(struct ieee80211_tx_data *tx,
2de8e0d9
JB		 851 struct sk_buff *skb, int hdrlen,
852 int frag_threshold)
853{
252b86c4 854 struct ieee80211_local *local = tx->local;
a1a3fcec 855 struct ieee80211_tx_info *info;
252b86c4 856 struct sk_buff *tmp;
2de8e0d9
JB		 857 int per_fragm = frag_threshold - hdrlen - FCS_LEN;
858 int pos = hdrlen + per_fragm;
859 int rem = skb->len - hdrlen - per_fragm;
860
861 if (WARN_ON(rem < 0))
862 return -EINVAL;
863
252b86c4
JB		 864 /* first fragment was already added to queue by caller */
865
2de8e0d9
JB		 866 while (rem) {
867 int fraglen = per_fragm;
868
869 if (fraglen > rem)
870 fraglen = rem;
871 rem -= fraglen;
872 tmp = dev_alloc_skb(local->tx_headroom +
873 frag_threshold +
2475b1cc 874 tx->sdata->encrypt_headroom +
2de8e0d9
JB		 875 IEEE80211_ENCRYPT_TAILROOM);
876 if (!tmp)
877 return -ENOMEM;
252b86c4
JB		 878
879 __skb_queue_tail(&tx->skbs, tmp);
880
2475b1cc
MS		 881 skb_reserve(tmp,
882 local->tx_headroom + tx->sdata->encrypt_headroom);
883
2de8e0d9
JB		 884 /* copy control information */
885 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
a1a3fcec
JB		 886
887 info = IEEE80211_SKB_CB(tmp);
888 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
889 IEEE80211_TX_CTL_FIRST_FRAGMENT);
890
891 if (rem)
892 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
893
2de8e0d9
JB		 894 skb_copy_queue_mapping(tmp, skb);
895 tmp->priority = skb->priority;
2de8e0d9 896 tmp->dev = skb->dev;
2de8e0d9
JB		 897
898 /* copy header and data */
899 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
900 memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);
901
902 pos += fraglen;
903 }
904
252b86c4 905 /* adjust first fragment's length */
338f977f 906 skb_trim(skb, hdrlen + per_fragm);
2de8e0d9
JB		 907 return 0;
908}
909
d9e8a70f 910static ieee80211_tx_result debug_noinline
e2454948
JB		 911ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
912{
2de8e0d9
JB		 913 struct sk_buff *skb = tx->skb;
914 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
915 struct ieee80211_hdr *hdr = (void *)skb->data;
b9a5f8ca 916 int frag_threshold = tx->local->hw.wiphy->frag_threshold;
2de8e0d9
JB		 917 int hdrlen;
918 int fragnum;
e2454948 919
252b86c4
JB		 920 /* no matter what happens, tx->skb moves to tx->skbs */
921 __skb_queue_tail(&tx->skbs, skb);
922 tx->skb = NULL;
923
a26eb27a
JB		 924 if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
925 return TX_CONTINUE;
926
927 if (tx->local->ops->set_frag_threshold)
e2454948
JB		 928 return TX_CONTINUE;
929
eefce91a
JB		 930 /*
931 * Warn when submitting a fragmented A-MPDU frame and drop it.
3b8d81e0 932 * This scenario is handled in ieee80211_tx_prepare but extra
8d5e0d58 933 * caution taken here as fragmented ampdu may cause Tx stop.
eefce91a 934 */
8b30b1fe 935 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
eefce91a
JB		 936 return TX_DROP;
937
065e9605 938 hdrlen = ieee80211_hdrlen(hdr->frame_control);
e2454948 939
a26eb27a 940 /* internal error, why isn't DONTFRAG set? */
8ccd8f21 941 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
2de8e0d9 942 return TX_DROP;
e6a9854b 943
2de8e0d9
JB		 944 /*
945 * Now fragment the frame. This will allocate all the fragments and
946 * chain them (using skb as the first fragment) to skb->next.
947 * During transmission, we will remove the successfully transmitted
948 * fragments from this list. When the low-level driver rejects one
949 * of the fragments then we will simply pretend to accept the skb
950 * but store it away as pending.
951 */
252b86c4 952 if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
2de8e0d9 953 return TX_DROP;
e6a9854b 954
2de8e0d9
JB		 955 /* update duration/seq/flags of fragments */
956 fragnum = 0;
252b86c4
JB		 957
958 skb_queue_walk(&tx->skbs, skb) {
2de8e0d9 959 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
e6a9854b 960
2de8e0d9
JB		 961 hdr = (void *)skb->data;
962 info = IEEE80211_SKB_CB(skb);
e6a9854b 963
252b86c4 964 if (!skb_queue_is_last(&tx->skbs, skb)) {
2de8e0d9 965 hdr->frame_control |= morefrags;
e6a9854b
JB		 966 /*
967 * No multi-rate retries for fragmented frames, that
968 * would completely throw off the NAV at other STAs.
969 */
970 info->control.rates[1].idx = -1;
971 info->control.rates[2].idx = -1;
972 info->control.rates[3].idx = -1;
e3e1a0bc 973 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
e6a9854b 974 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
2de8e0d9
JB		 975 } else {
976 hdr->frame_control &= ~morefrags;
e6a9854b 977 }
2de8e0d9
JB		 978 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
979 fragnum++;
252b86c4 980 }
e2ebc74d 981
9ae54c84 982 return TX_CONTINUE;
e2ebc74d
JB		 983}
984
feff1f2f
JB		 985static ieee80211_tx_result debug_noinline
986ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
987{
252b86c4 988 struct sk_buff *skb;
560d2682 989 int ac = -1;
feff1f2f
JB		 990
991 if (!tx->sta)
992 return TX_CONTINUE;
993
252b86c4 994 skb_queue_walk(&tx->skbs, skb) {
560d2682 995 ac = skb_get_queue_mapping(skb);
560d2682 996 tx->sta->tx_bytes[ac] += skb->len;
252b86c4 997 }
560d2682
JB		 998 if (ac >= 0)
999 tx->sta->tx_packets[ac]++;
feff1f2f
JB		 1000
1001 return TX_CONTINUE;
1002}
1003
d9e8a70f 1004static ieee80211_tx_result debug_noinline
e2454948
JB		 1005ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
1006{
1007 if (!tx->key)
1008 return TX_CONTINUE;
1009
97359d12
JB		 1010 switch (tx->key->conf.cipher) {
1011 case WLAN_CIPHER_SUITE_WEP40:
1012 case WLAN_CIPHER_SUITE_WEP104:
e2454948 1013 return ieee80211_crypto_wep_encrypt(tx);
97359d12 1014 case WLAN_CIPHER_SUITE_TKIP:
e2454948 1015 return ieee80211_crypto_tkip_encrypt(tx);
97359d12 1016 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db
JM		 1017 return ieee80211_crypto_ccmp_encrypt(
1018 tx, IEEE80211_CCMP_MIC_LEN);
1019 case WLAN_CIPHER_SUITE_CCMP_256:
1020 return ieee80211_crypto_ccmp_encrypt(
1021 tx, IEEE80211_CCMP_256_MIC_LEN);
97359d12 1022 case WLAN_CIPHER_SUITE_AES_CMAC:
3cfcf6ac 1023 return ieee80211_crypto_aes_cmac_encrypt(tx);
56c52da2
JM		 1024 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1025 return ieee80211_crypto_aes_cmac_256_encrypt(tx);
8ade538b
JM		 1026 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1027 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1028 return ieee80211_crypto_aes_gmac_encrypt(tx);
00b9cfa3
JM		 1029 case WLAN_CIPHER_SUITE_GCMP:
1030 case WLAN_CIPHER_SUITE_GCMP_256:
1031 return ieee80211_crypto_gcmp_encrypt(tx);
3ffc2a90 1032 default:
d32a1028 1033 return ieee80211_crypto_hw_encrypt(tx);
e2454948
JB		 1034 }
1035
e2454948
JB		 1036 return TX_DROP;
1037}
1038
d9e8a70f 1039static ieee80211_tx_result debug_noinline
03f93c3d
JB		 1040ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
1041{
252b86c4 1042 struct sk_buff *skb;
2de8e0d9
JB		 1043 struct ieee80211_hdr *hdr;
1044 int next_len;
1045 bool group_addr;
03f93c3d 1046
252b86c4 1047 skb_queue_walk(&tx->skbs, skb) {
2de8e0d9 1048 hdr = (void *) skb->data;
7e0aae47
JM		 1049 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
1050 break; /* must not overwrite AID */
252b86c4
JB		 1051 if (!skb_queue_is_last(&tx->skbs, skb)) {
1052 struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
1053 next_len = next->len;
1054 } else
1055 next_len = 0;
2de8e0d9 1056 group_addr = is_multicast_ether_addr(hdr->addr1);
03f93c3d 1057
2de8e0d9 1058 hdr->duration_id =
252b86c4
JB		 1059 ieee80211_duration(tx, skb, group_addr, next_len);
1060 }
03f93c3d
JB		 1061
1062 return TX_CONTINUE;
1063}
1064
e2ebc74d
JB		 1065/* actual transmit path */
1066
a622ab72
JB		 1067static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
1068 struct sk_buff *skb,
1069 struct ieee80211_tx_info *info,
1070 struct tid_ampdu_tx *tid_tx,
1071 int tid)
1072{
1073 bool queued = false;
285fa695 1074 bool reset_agg_timer = false;
aa454580 1075 struct sk_buff *purge_skb = NULL;
a622ab72
JB		 1076
1077 if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1078 info->flags |= IEEE80211_TX_CTL_AMPDU;
285fa695 1079 reset_agg_timer = true;
0ab33703
JB		 1080 } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
1081 /*
1082 * nothing -- this aggregation session is being started
1083 * but that might still fail with the driver
1084 */
ba8c3d6f 1085 } else if (!tx->sta->sta.txq[tid]) {
a622ab72
JB		 1086 spin_lock(&tx->sta->lock);
1087 /*
1088 * Need to re-check now, because we may get here
1089 *
1090 * 1) in the window during which the setup is actually
1091 * already done, but not marked yet because not all
1092 * packets are spliced over to the driver pending
1093 * queue yet -- if this happened we acquire the lock
1094 * either before or after the splice happens, but
1095 * need to recheck which of these cases happened.
1096 *
1097 * 2) during session teardown, if the OPERATIONAL bit
1098 * was cleared due to the teardown but the pointer
1099 * hasn't been assigned NULL yet (or we loaded it
1100 * before it was assigned) -- in this case it may
1101 * now be NULL which means we should just let the
1102 * packet pass through because splicing the frames
1103 * back is already done.
1104 */
40b275b6 1105 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
a622ab72
JB		 1106
1107 if (!tid_tx) {
1108 /* do nothing, let packet pass through */
1109 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1110 info->flags |= IEEE80211_TX_CTL_AMPDU;
285fa695 1111 reset_agg_timer = true;
a622ab72
JB		 1112 } else {
1113 queued = true;
1114 info->control.vif = &tx->sdata->vif;
1115 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
e9de0190
MK		 1116 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS |
1117 IEEE80211_TX_CTL_NO_PS_BUFFER |
1118 IEEE80211_TX_STATUS_EOSP;
a622ab72 1119 __skb_queue_tail(&tid_tx->pending, skb);
aa454580
HS		 1120 if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
1121 purge_skb = __skb_dequeue(&tid_tx->pending);
a622ab72
JB		 1122 }
1123 spin_unlock(&tx->sta->lock);
aa454580
HS		 1124
1125 if (purge_skb)
c3e7724b 1126 ieee80211_free_txskb(&tx->local->hw, purge_skb);
a622ab72
JB		 1127 }
1128
285fa695
NM		 1129 /* reset session timer */
1130 if (reset_agg_timer && tid_tx->timeout)
12d3952f 1131 tid_tx->last_tx = jiffies;
285fa695 1132
a622ab72
JB		 1133 return queued;
1134}
1135
58d4185e
JB		 1136/*
1137 * initialises @tx
7c10770f
JB		 1138 * pass %NULL for the station if unknown, a valid pointer if known
1139 * or an ERR_PTR() if the station is known not to exist
58d4185e 1140 */
9ae54c84 1141static ieee80211_tx_result
3b8d81e0
JB		 1142ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1143 struct ieee80211_tx_data *tx,
7c10770f 1144 struct sta_info *sta, struct sk_buff *skb)
e2ebc74d 1145{
3b8d81e0 1146 struct ieee80211_local *local = sdata->local;
58d4185e 1147 struct ieee80211_hdr *hdr;
e039fa4a 1148 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
68f2b517 1149 int tid;
a622ab72 1150 u8 *qc;
e2ebc74d
JB		 1151
1152 memset(tx, 0, sizeof(*tx));
1153 tx->skb = skb;
e2ebc74d 1154 tx->local = local;
3b8d81e0 1155 tx->sdata = sdata;
252b86c4 1156 __skb_queue_head_init(&tx->skbs);
e2ebc74d 1157
cd8ffc80
JB		 1158 /*
1159 * If this flag is set to true anywhere, and we get here,
1160 * we are doing the needed processing, so remove the flag
1161 * now.
1162 */
1163 info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1164
58d4185e
JB		 1165 hdr = (struct ieee80211_hdr *) skb->data;
1166
7c10770f
JB		 1167 if (likely(sta)) {
1168 if (!IS_ERR(sta))
1169 tx->sta = sta;
1170 } else {
1171 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1172 tx->sta = rcu_dereference(sdata->u.vlan.sta);
1173 if (!tx->sta && sdata->wdev.use_4addr)
1174 return TX_DROP;
1175 } else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
1176 IEEE80211_TX_CTL_INJECTED) ||
1177 tx->sdata->control_port_protocol == tx->skb->protocol) {
1178 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1179 }
1180 if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
1181 tx->sta = sta_info_get(sdata, hdr->addr1);
3f0e0b22 1182 }
58d4185e 1183
cd8ffc80 1184 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
49a59543 1185 !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
30686bf7
JB		 1186 ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
1187 !ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW)) {
cd8ffc80
JB		 1188 struct tid_ampdu_tx *tid_tx;
1189
8b30b1fe
S		 1190 qc = ieee80211_get_qos_ctl(hdr);
1191 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
1192
a622ab72
JB		 1193 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1194 if (tid_tx) {
1195 bool queued;
cd8ffc80 1196
a622ab72
JB		 1197 queued = ieee80211_tx_prep_agg(tx, skb, info,
1198 tid_tx, tid);
1199
1200 if (unlikely(queued))
1201 return TX_QUEUED;
1202 }
8b30b1fe
S		 1203 }
1204
badffb72 1205 if (is_multicast_ether_addr(hdr->addr1)) {
5cf121c3 1206 tx->flags &= ~IEEE80211_TX_UNICAST;
e039fa4a 1207 info->flags |= IEEE80211_TX_CTL_NO_ACK;
6fd67e93 1208 } else
5cf121c3 1209 tx->flags |= IEEE80211_TX_UNICAST;
58d4185e 1210
a26eb27a
JB		 1211 if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
1212 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
1213 skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
1214 info->flags & IEEE80211_TX_CTL_AMPDU)
1215 info->flags |= IEEE80211_TX_CTL_DONTFRAG;
58d4185e
JB		 1216 }
1217
e2ebc74d 1218 if (!tx->sta)
e039fa4a 1219 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
c2c98fde 1220 else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
e039fa4a 1221 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
58d4185e 1222
e039fa4a 1223 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
e2ebc74d 1224
9ae54c84 1225 return TX_CONTINUE;
e2ebc74d
JB		 1226}
1227
ba8c3d6f
FF		 1228static void ieee80211_drv_tx(struct ieee80211_local *local,
1229 struct ieee80211_vif *vif,
1230 struct ieee80211_sta *pubsta,
1231 struct sk_buff *skb)
1232{
1233 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1234 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1235 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1236 struct ieee80211_tx_control control = {
1237 .sta = pubsta,
1238 };
1239 struct ieee80211_txq *txq = NULL;
1240 struct txq_info *txqi;
1241 u8 ac;
1242
1243 if (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE)
1244 goto tx_normal;
1245
1246 if (!ieee80211_is_data(hdr->frame_control))
1247 goto tx_normal;
1248
1249 if (pubsta) {
1250 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1251
1252 txq = pubsta->txq[tid];
1253 } else if (vif) {
1254 txq = vif->txq;
1255 }
1256
1257 if (!txq)
1258 goto tx_normal;
1259
1260 ac = txq->ac;
1261 txqi = to_txq_info(txq);
1262 atomic_inc(&sdata->txqs_len[ac]);
1263 if (atomic_read(&sdata->txqs_len[ac]) >= local->hw.txq_ac_max_pending)
1264 netif_stop_subqueue(sdata->dev, ac);
1265
1266 skb_queue_tail(&txqi->queue, skb);
1267 drv_wake_tx_queue(local, txqi);
1268
1269 return;
1270
1271tx_normal:
1272 drv_tx(local, &control, skb);
1273}
1274
1275struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
1276 struct ieee80211_txq *txq)
1277{
1278 struct ieee80211_local *local = hw_to_local(hw);
1279 struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
1280 struct txq_info *txqi = container_of(txq, struct txq_info, txq);
1281 struct ieee80211_hdr *hdr;
1282 struct sk_buff *skb = NULL;
1283 u8 ac = txq->ac;
1284
1285 spin_lock_bh(&txqi->queue.lock);
1286
1287 if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
1288 goto out;
1289
1290 skb = __skb_dequeue(&txqi->queue);
1291 if (!skb)
1292 goto out;
1293
1294 atomic_dec(&sdata->txqs_len[ac]);
1295 if (__netif_subqueue_stopped(sdata->dev, ac))
1296 ieee80211_propagate_queue_wake(local, sdata->vif.hw_queue[ac]);
1297
1298 hdr = (struct ieee80211_hdr *)skb->data;
1299 if (txq->sta && ieee80211_is_data_qos(hdr->frame_control)) {
1300 struct sta_info *sta = container_of(txq->sta, struct sta_info,
1301 sta);
1302 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1303
1304 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, txq->tid);
1305 if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
1306 info->flags |= IEEE80211_TX_CTL_AMPDU;
1307 else
1308 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
1309 }
1310
1311out:
1312 spin_unlock_bh(&txqi->queue.lock);
1313
1314 return skb;
1315}
1316EXPORT_SYMBOL(ieee80211_tx_dequeue);
1317
11127e91
JB		 1318static bool ieee80211_tx_frags(struct ieee80211_local *local,
1319 struct ieee80211_vif *vif,
1320 struct ieee80211_sta *sta,
1321 struct sk_buff_head *skbs,
1322 bool txpending)
e2ebc74d 1323{
252b86c4 1324 struct sk_buff *skb, *tmp;
3b8d81e0 1325 unsigned long flags;
e2ebc74d 1326
252b86c4 1327 skb_queue_walk_safe(skbs, skb, tmp) {
3a25a8c8
JB		 1328 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1329 int q = info->hw_queue;
1330
1331#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1332 if (WARN_ON_ONCE(q >= local->hw.queues)) {
1333 __skb_unlink(skb, skbs);
c3e7724b 1334 ieee80211_free_txskb(&local->hw, skb);
3a25a8c8
JB		 1335 continue;
1336 }
1337#endif
3b8d81e0
JB		 1338
1339 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
3b8d81e0 1340 if (local->queue_stop_reasons[q] ||
7bb45683 1341 (!txpending && !skb_queue_empty(&local->pending[q]))) {
6c17b77b 1342 if (unlikely(info->flags &
a7679ed5
SF		 1343 IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
1344 if (local->queue_stop_reasons[q] &
1345 ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
1346 /*
1347 * Drop off-channel frames if queues
1348 * are stopped for any reason other
1349 * than off-channel operation. Never
1350 * queue them.
1351 */
1352 spin_unlock_irqrestore(
1353 &local->queue_stop_reason_lock,
1354 flags);
1355 ieee80211_purge_tx_queue(&local->hw,
1356 skbs);
1357 return true;
1358 }
1359 } else {
1360
6c17b77b 1361 /*
a7679ed5
SF		 1362 * Since queue is stopped, queue up frames for
1363 * later transmission from the tx-pending
1364 * tasklet when the queue is woken again.
6c17b77b 1365 */
a7679ed5
SF		 1366 if (txpending)
1367 skb_queue_splice_init(skbs,
1368 &local->pending[q]);
1369 else
1370 skb_queue_splice_tail_init(skbs,
1371 &local->pending[q]);
1372
1373 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1374 flags);
1375 return false;
6c17b77b 1376 }
7bb45683 1377 }
3b8d81e0 1378 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
f8e79ddd 1379
11127e91 1380 info->control.vif = vif;
f0e72851 1381
11127e91 1382 __skb_unlink(skb, skbs);
ba8c3d6f 1383 ieee80211_drv_tx(local, vif, sta, skb);
11127e91 1384 }
5061b0c2 1385
11127e91
JB		 1386 return true;
1387}
1388
1389/*
1390 * Returns false if the frame couldn't be transmitted but was queued instead.
1391 */
1392static bool __ieee80211_tx(struct ieee80211_local *local,
1393 struct sk_buff_head *skbs, int led_len,
1394 struct sta_info *sta, bool txpending)
1395{
1396 struct ieee80211_tx_info *info;
1397 struct ieee80211_sub_if_data *sdata;
1398 struct ieee80211_vif *vif;
1399 struct ieee80211_sta *pubsta;
1400 struct sk_buff *skb;
1401 bool result = true;
1402 __le16 fc;
5061b0c2 1403
11127e91
JB		 1404 if (WARN_ON(skb_queue_empty(skbs)))
1405 return true;
ec25acc4 1406
11127e91
JB		 1407 skb = skb_peek(skbs);
1408 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
1409 info = IEEE80211_SKB_CB(skb);
1410 sdata = vif_to_sdata(info->control.vif);
1411 if (sta && !sta->uploaded)
1412 sta = NULL;
1413
1414 if (sta)
1415 pubsta = &sta->sta;
1416 else
1417 pubsta = NULL;
1418
1419 switch (sdata->vif.type) {
1420 case NL80211_IFTYPE_MONITOR:
c82b5a74
JB		 1421 if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
1422 vif = &sdata->vif;
1423 break;
1424 }
4b6f1dd6 1425 sdata = rcu_dereference(local->monitor_sdata);
3a25a8c8 1426 if (sdata) {
4b6f1dd6 1427 vif = &sdata->vif;
3a25a8c8
JB		 1428 info->hw_queue =
1429 vif->hw_queue[skb_get_queue_mapping(skb)];
30686bf7 1430 } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
3a25a8c8
JB		 1431 dev_kfree_skb(skb);
1432 return true;
1433 } else
4b6f1dd6 1434 vif = NULL;
11127e91
JB		 1435 break;
1436 case NL80211_IFTYPE_AP_VLAN:
1437 sdata = container_of(sdata->bss,
1438 struct ieee80211_sub_if_data, u.ap);
1439 /* fall through */
1440 default:
1441 vif = &sdata->vif;
1442 break;
e2ebc74d 1443 }
2de8e0d9 1444
cb831b53
JB		 1445 result = ieee80211_tx_frags(local, vif, pubsta, skbs,
1446 txpending);
11127e91 1447
74e4dbfd 1448 ieee80211_tpt_led_trig_tx(local, fc, led_len);
74e4dbfd 1449
4db4e0a1 1450 WARN_ON_ONCE(!skb_queue_empty(skbs));
252b86c4 1451
11127e91 1452 return result;
e2ebc74d
JB		 1453}
1454
97b045d6
JB		 1455/*
1456 * Invoke TX handlers, return 0 on success and non-zero if the
1457 * frame was dropped or queued.
1458 */
1459static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1460{
252b86c4 1461 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
97b045d6 1462 ieee80211_tx_result res = TX_DROP;
97b045d6 1463
9aa4aee3
JB		 1464#define CALL_TXH(txh) \
1465 do { \
1466 res = txh(tx); \
1467 if (res != TX_CONTINUE) \
1468 goto txh_done; \
1469 } while (0)
1470
5c1b98a5 1471 CALL_TXH(ieee80211_tx_h_dynamic_ps);
9aa4aee3
JB		 1472 CALL_TXH(ieee80211_tx_h_check_assoc);
1473 CALL_TXH(ieee80211_tx_h_ps_buf);
a621fa4d 1474 CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
9aa4aee3 1475 CALL_TXH(ieee80211_tx_h_select_key);
30686bf7 1476 if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
af65cd96 1477 CALL_TXH(ieee80211_tx_h_rate_ctrl);
c6fcf6bc 1478
aa5b5492
JB		 1479 if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
1480 __skb_queue_tail(&tx->skbs, tx->skb);
1481 tx->skb = NULL;
c6fcf6bc 1482 goto txh_done;
aa5b5492 1483 }
c6fcf6bc
JB		 1484
1485 CALL_TXH(ieee80211_tx_h_michael_mic_add);
9aa4aee3
JB		 1486 CALL_TXH(ieee80211_tx_h_sequence);
1487 CALL_TXH(ieee80211_tx_h_fragment);
d9e8a70f 1488 /* handlers after fragment must be aware of tx info fragmentation! */
9aa4aee3
JB		 1489 CALL_TXH(ieee80211_tx_h_stats);
1490 CALL_TXH(ieee80211_tx_h_encrypt);
30686bf7 1491 if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
8fd369ee 1492 CALL_TXH(ieee80211_tx_h_calculate_duration);
d9e8a70f 1493#undef CALL_TXH
97b045d6 1494
d9e8a70f 1495 txh_done:
97b045d6 1496 if (unlikely(res == TX_DROP)) {
5479d0e7 1497 I802_DEBUG_INC(tx->local->tx_handlers_drop);
252b86c4 1498 if (tx->skb)
c3e7724b 1499 ieee80211_free_txskb(&tx->local->hw, tx->skb);
252b86c4 1500 else
1f98ab7f 1501 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
97b045d6
JB		 1502 return -1;
1503 } else if (unlikely(res == TX_QUEUED)) {
5479d0e7 1504 I802_DEBUG_INC(tx->local->tx_handlers_queued);
97b045d6
JB		 1505 return -1;
1506 }
1507
1508 return 0;
1509}
1510
06be6b14
FF		 1511bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
1512 struct ieee80211_vif *vif, struct sk_buff *skb,
1513 int band, struct ieee80211_sta **sta)
1514{
1515 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1516 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1517 struct ieee80211_tx_data tx;
88724a81 1518 struct sk_buff *skb2;
06be6b14 1519
7c10770f 1520 if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
06be6b14
FF		 1521 return false;
1522
1523 info->band = band;
1524 info->control.vif = vif;
1525 info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];
1526
1527 if (invoke_tx_handlers(&tx))
1528 return false;
1529
1530 if (sta) {
1531 if (tx.sta)
1532 *sta = &tx.sta->sta;
1533 else
1534 *sta = NULL;
1535 }
1536
88724a81
JB		 1537 /* this function isn't suitable for fragmented data frames */
1538 skb2 = __skb_dequeue(&tx.skbs);
1539 if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
1540 ieee80211_free_txskb(hw, skb2);
1541 ieee80211_purge_tx_queue(hw, &tx.skbs);
1542 return false;
1543 }
1544
06be6b14
FF		 1545 return true;
1546}
1547EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
1548
7bb45683
JB		 1549/*
1550 * Returns false if the frame couldn't be transmitted but was queued instead.
1551 */
1552static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
7c10770f
JB		 1553 struct sta_info *sta, struct sk_buff *skb,
1554 bool txpending)
e2ebc74d 1555{
3b8d81e0 1556 struct ieee80211_local *local = sdata->local;
5cf121c3 1557 struct ieee80211_tx_data tx;
97b045d6 1558 ieee80211_tx_result res_prepare;
e039fa4a 1559 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
7bb45683 1560 bool result = true;
74e4dbfd 1561 int led_len;
e2ebc74d 1562
e2ebc74d
JB		 1563 if (unlikely(skb->len < 10)) {
1564 dev_kfree_skb(skb);
7bb45683 1565 return true;
e2ebc74d
JB		 1566 }
1567
58d4185e 1568 /* initialises tx */
74e4dbfd 1569 led_len = skb->len;
7c10770f 1570 res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
e2ebc74d 1571
cd8ffc80 1572 if (unlikely(res_prepare == TX_DROP)) {
c3e7724b 1573 ieee80211_free_txskb(&local->hw, skb);
55de908a 1574 return true;
cd8ffc80 1575 } else if (unlikely(res_prepare == TX_QUEUED)) {
55de908a 1576 return true;
e2ebc74d
JB		 1577 }
1578
3a25a8c8
JB		 1579 /* set up hw_queue value early */
1580 if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
30686bf7 1581 !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3a25a8c8
JB		 1582 info->hw_queue =
1583 sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
1584
7bb45683 1585 if (!invoke_tx_handlers(&tx))
74e4dbfd
JB		 1586 result = __ieee80211_tx(local, &tx.skbs, led_len,
1587 tx.sta, txpending);
55de908a 1588
7bb45683 1589 return result;
e2ebc74d
JB		 1590}
1591
1592/* device xmit handlers */
1593
3bff1865 1594static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
23c0752a
JB		 1595 struct sk_buff *skb,
1596 int head_need, bool may_encrypt)
1597{
3bff1865 1598 struct ieee80211_local *local = sdata->local;
23c0752a
JB		 1599 int tail_need = 0;
1600
3bff1865 1601 if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
23c0752a
JB		 1602 tail_need = IEEE80211_ENCRYPT_TAILROOM;
1603 tail_need -= skb_tailroom(skb);
1604 tail_need = max_t(int, tail_need, 0);
1605 }
1606
c70f59a2 1607 if (skb_cloned(skb) &&
30686bf7 1608 (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
c70f59a2 1609 !skb_clone_writable(skb, ETH_HLEN) ||
17c18bf8 1610 (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
23c0752a 1611 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
4cd06a34 1612 else if (head_need || tail_need)
23c0752a 1613 I802_DEBUG_INC(local->tx_expand_skb_head);
4cd06a34
FF		 1614 else
1615 return 0;
23c0752a
JB		 1616
1617 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
0fb9a9ec
JP		 1618 wiphy_debug(local->hw.wiphy,
1619 "failed to reallocate TX buffer\n");
23c0752a
JB		 1620 return -ENOMEM;
1621 }
1622
23c0752a
JB		 1623 return 0;
1624}
1625
7c10770f
JB		 1626void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1627 struct sta_info *sta, struct sk_buff *skb)
e2ebc74d 1628{
3b8d81e0 1629 struct ieee80211_local *local = sdata->local;
e039fa4a 1630 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
e32f85f7 1631 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
e2ebc74d 1632 int headroom;
23c0752a 1633 bool may_encrypt;
e2ebc74d 1634
3b8d81e0 1635 may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
23c0752a 1636
3b8d81e0 1637 headroom = local->tx_headroom;
23c0752a 1638 if (may_encrypt)
2475b1cc 1639 headroom += sdata->encrypt_headroom;
23c0752a
JB		 1640 headroom -= skb_headroom(skb);
1641 headroom = max_t(int, 0, headroom);
1642
3bff1865 1643 if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
c3e7724b 1644 ieee80211_free_txskb(&local->hw, skb);
3b8d81e0 1645 return;
e2ebc74d
JB		 1646 }
1647
740c1aa3 1648 hdr = (struct ieee80211_hdr *) skb->data;
5061b0c2 1649 info->control.vif = &sdata->vif;
e2ebc74d 1650
3f52b7e3
MP		 1651 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1652 if (ieee80211_is_data(hdr->frame_control) &&
1653 is_unicast_ether_addr(hdr->addr1)) {
bf7cd94d 1654 if (mesh_nexthop_resolve(sdata, skb))
3f52b7e3
MP		 1655 return; /* skb queued: don't free */
1656 } else {
1657 ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
1658 }
98aed9fd 1659 }
cca89496 1660
2154c81c 1661 ieee80211_set_qos_hdr(sdata, skb);
7c10770f 1662 ieee80211_tx(sdata, sta, skb, false);
e2ebc74d
JB		 1663}
1664
73b9f03a
JB		 1665static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
1666{
1667 struct ieee80211_radiotap_iterator iterator;
1668 struct ieee80211_radiotap_header *rthdr =
1669 (struct ieee80211_radiotap_header *) skb->data;
1670 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1671 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
1672 NULL);
1673 u16 txflags;
1674
1675 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1676 IEEE80211_TX_CTL_DONTFRAG;
1677
1678 /*
1679 * for every radiotap entry that is present
1680 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
1681 * entries present, or -EINVAL on error)
1682 */
1683
1684 while (!ret) {
1685 ret = ieee80211_radiotap_iterator_next(&iterator);
1686
1687 if (ret)
1688 continue;
1689
1690 /* see if this argument is something we can use */
1691 switch (iterator.this_arg_index) {
1692 /*
1693 * You must take care when dereferencing iterator.this_arg
1694 * for multibyte types... the pointer is not aligned. Use
1695 * get_unaligned((type *)iterator.this_arg) to dereference
1696 * iterator.this_arg for type "type" safely on all arches.
1697 */
1698 case IEEE80211_RADIOTAP_FLAGS:
1699 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
1700 /*
1701 * this indicates that the skb we have been
1702 * handed has the 32-bit FCS CRC at the end...
1703 * we should react to that by snipping it off
1704 * because it will be recomputed and added
1705 * on transmission
1706 */
1707 if (skb->len < (iterator._max_length + FCS_LEN))
1708 return false;
1709
1710 skb_trim(skb, skb->len - FCS_LEN);
1711 }
1712 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
1713 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
1714 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
1715 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
1716 break;
1717
1718 case IEEE80211_RADIOTAP_TX_FLAGS:
1719 txflags = get_unaligned_le16(iterator.this_arg);
1720 if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
1721 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1722 break;
1723
1724 /*
1725 * Please update the file
1726 * Documentation/networking/mac80211-injection.txt
1727 * when parsing new fields here.
1728 */
1729
1730 default:
1731 break;
1732 }
1733 }
1734
1735 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
1736 return false;
1737
1738 /*
1739 * remove the radiotap header
1740 * iterator->_max_length was sanity-checked against
1741 * skb->len by iterator init
1742 */
1743 skb_pull(skb, iterator._max_length);
1744
1745 return true;
1746}
1747
d0cf9c0d
SH		 1748netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
1749 struct net_device *dev)
e2ebc74d
JB		 1750{
1751 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
55de908a 1752 struct ieee80211_chanctx_conf *chanctx_conf;
e2ebc74d
JB		 1753 struct ieee80211_radiotap_header *prthdr =
1754 (struct ieee80211_radiotap_header *)skb->data;
3b8d81e0 1755 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
f75f5c6f 1756 struct ieee80211_hdr *hdr;
5d9cf4a5 1757 struct ieee80211_sub_if_data *tmp_sdata, *sdata;
b4932836 1758 struct cfg80211_chan_def *chandef;
9b8a74e3 1759 u16 len_rthdr;
5d9cf4a5 1760 int hdrlen;
e2ebc74d 1761
9b8a74e3
AG		 1762 /* check for not even having the fixed radiotap header part */
1763 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
1764 goto fail; /* too short to be possibly valid */
1765
1766 /* is it a header version we can trust to find length from? */
1767 if (unlikely(prthdr->it_version))
1768 goto fail; /* only version 0 is supported */
1769
1770 /* then there must be a radiotap header with a length we can use */
1771 len_rthdr = ieee80211_get_radiotap_len(skb->data);
1772
1773 /* does the skb contain enough to deliver on the alleged length? */
1774 if (unlikely(skb->len < len_rthdr))
1775 goto fail; /* skb too short for claimed rt header extent */
e2ebc74d 1776
e2ebc74d
JB		 1777 /*
1778 * fix up the pointers accounting for the radiotap
1779 * header still being in there. We are being given
1780 * a precooked IEEE80211 header so no need for
1781 * normal processing
1782 */
9b8a74e3 1783 skb_set_mac_header(skb, len_rthdr);
e2ebc74d 1784 /*
9b8a74e3
AG		 1785 * these are just fixed to the end of the rt area since we
1786 * don't have any better information and at this point, nobody cares
e2ebc74d 1787 */
9b8a74e3
AG		 1788 skb_set_network_header(skb, len_rthdr);
1789 skb_set_transport_header(skb, len_rthdr);
e2ebc74d 1790
5d9cf4a5
JB		 1791 if (skb->len < len_rthdr + 2)
1792 goto fail;
1793
1794 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
1795 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1796
1797 if (skb->len < len_rthdr + hdrlen)
1798 goto fail;
1799
f75f5c6f
HS		 1800 /*
1801 * Initialize skb->protocol if the injected frame is a data frame
1802 * carrying a rfc1042 header
1803 */
5d9cf4a5
JB		 1804 if (ieee80211_is_data(hdr->frame_control) &&
1805 skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
1806 u8 *payload = (u8 *)hdr + hdrlen;
1807
b203ca39 1808 if (ether_addr_equal(payload, rfc1042_header))
5d9cf4a5
JB		 1809 skb->protocol = cpu_to_be16((payload[6] << 8) |
1810 payload[7]);
f75f5c6f
HS		 1811 }
1812
3b8d81e0
JB		 1813 memset(info, 0, sizeof(*info));
1814
5d9cf4a5 1815 info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
73b9f03a
JB		 1816 IEEE80211_TX_CTL_INJECTED;
1817
1818 /* process and remove the injection radiotap header */
1819 if (!ieee80211_parse_tx_radiotap(skb))
1820 goto fail;
5d9cf4a5
JB		 1821
1822 rcu_read_lock();
1823
1824 /*
1825 * We process outgoing injected frames that have a local address
1826 * we handle as though they are non-injected frames.
1827 * This code here isn't entirely correct, the local MAC address
1828 * isn't always enough to find the interface to use; for proper
1829 * VLAN/WDS support we will need a different mechanism (which
1830 * likely isn't going to be monitor interfaces).
1831 */
1832 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1833
1834 list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
1835 if (!ieee80211_sdata_running(tmp_sdata))
1836 continue;
1837 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
1838 tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
1839 tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
1840 continue;
b203ca39 1841 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
5d9cf4a5
JB		 1842 sdata = tmp_sdata;
1843 break;
1844 }
1845 }
7351c6bd 1846
55de908a
JB		 1847 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1848 if (!chanctx_conf) {
1849 tmp_sdata = rcu_dereference(local->monitor_sdata);
1850 if (tmp_sdata)
1851 chanctx_conf =
1852 rcu_dereference(tmp_sdata->vif.chanctx_conf);
1853 }
55de908a 1854
b4a7ff75 1855 if (chanctx_conf)
b4932836 1856 chandef = &chanctx_conf->def;
b4a7ff75 1857 else if (!local->use_chanctx)
b4932836 1858 chandef = &local->_oper_chandef;
b4a7ff75
FF		 1859 else
1860 goto fail_rcu;
55de908a
JB		 1861
1862 /*
1863 * Frame injection is not allowed if beaconing is not allowed
1864 * or if we need radar detection. Beaconing is usually not allowed when
1865 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
1866 * Passive scan is also used in world regulatory domains where
1867 * your country is not known and as such it should be treated as
1868 * NO TX unless the channel is explicitly allowed in which case
1869 * your current regulatory domain would not have the passive scan
1870 * flag.
1871 *
1872 * Since AP mode uses monitor interfaces to inject/TX management
1873 * frames we can make AP mode the exception to this rule once it
1874 * supports radar detection as its implementation can deal with
1875 * radar detection by itself. We can do that later by adding a
1876 * monitor flag interfaces used for AP support.
1877 */
b4932836
JD		 1878 if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
1879 sdata->vif.type))
55de908a
JB		 1880 goto fail_rcu;
1881
73c4e195 1882 info->band = chandef->chan->band;
7c10770f 1883 ieee80211_xmit(sdata, NULL, skb);
5d9cf4a5
JB		 1884 rcu_read_unlock();
1885
e2ebc74d 1886 return NETDEV_TX_OK;
9b8a74e3 1887
55de908a
JB		 1888fail_rcu:
1889 rcu_read_unlock();
9b8a74e3
AG		 1890fail:
1891 dev_kfree_skb(skb);
1892 return NETDEV_TX_OK; /* meaning, we dealt with the skb */
e2ebc74d
JB		 1893}
1894
97ffe757 1895static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
ad38bfc9 1896{
97ffe757 1897 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
ad38bfc9 1898
97ffe757
JB		 1899 return ethertype == ETH_P_TDLS &&
1900 skb->len > 14 &&
1901 skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
1902}
1903
1904static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
1905 struct sk_buff *skb,
1906 struct sta_info **sta_out)
1907{
1908 struct sta_info *sta;
1909
1910 switch (sdata->vif.type) {
1911 case NL80211_IFTYPE_AP_VLAN:
1912 sta = rcu_dereference(sdata->u.vlan.sta);
1913 if (sta) {
1914 *sta_out = sta;
1915 return 0;
1916 } else if (sdata->wdev.use_4addr) {
1917 return -ENOLINK;
1918 }
1919 /* fall through */
1920 case NL80211_IFTYPE_AP:
1921 case NL80211_IFTYPE_OCB:
1922 case NL80211_IFTYPE_ADHOC:
1923 if (is_multicast_ether_addr(skb->data)) {
1924 *sta_out = ERR_PTR(-ENOENT);
1925 return 0;
1926 }
1927 sta = sta_info_get_bss(sdata, skb->data);
1928 break;
1929 case NL80211_IFTYPE_WDS:
1930 sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
1931 break;
1932#ifdef CONFIG_MAC80211_MESH
1933 case NL80211_IFTYPE_MESH_POINT:
1934 /* determined much later */
1935 *sta_out = NULL;
1936 return 0;
1937#endif
1938 case NL80211_IFTYPE_STATION:
1939 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1940 sta = sta_info_get(sdata, skb->data);
1941 if (sta) {
1942 bool tdls_peer, tdls_auth;
1943
1944 tdls_peer = test_sta_flag(sta,
1945 WLAN_STA_TDLS_PEER);
1946 tdls_auth = test_sta_flag(sta,
1947 WLAN_STA_TDLS_PEER_AUTH);
1948
1949 if (tdls_peer && tdls_auth) {
1950 *sta_out = sta;
1951 return 0;
1952 }
1953
1954 /*
1955 * TDLS link during setup - throw out frames to
1956 * peer. Allow TDLS-setup frames to unauthorized
1957 * peers for the special case of a link teardown
1958 * after a TDLS sta is removed due to being
1959 * unreachable.
1960 */
1961 if (tdls_peer && !tdls_auth &&
1962 !ieee80211_is_tdls_setup(skb))
1963 return -EINVAL;
1964 }
1965
1966 }
1967
1968 sta = sta_info_get(sdata, sdata->u.mgd.bssid);
1969 if (!sta)
1970 return -ENOLINK;
1971 break;
1972 default:
1973 return -EINVAL;
1974 }
1975
1976 *sta_out = sta ?: ERR_PTR(-ENOENT);
1977 return 0;
ad38bfc9
MG		 1978}
1979
e2ebc74d 1980/**
4c9451ed
JB		 1981 * ieee80211_build_hdr - build 802.11 header in the given frame
1982 * @sdata: virtual interface to build the header for
1983 * @skb: the skb to build the header in
24d342c5 1984 * @info_flags: skb flags to set
e2ebc74d 1985 *
4c9451ed
JB		 1986 * This function takes the skb with 802.3 header and reformats the header to
1987 * the appropriate IEEE 802.11 header based on which interface the packet is
1988 * being transmitted on.
1989 *
1990 * Note that this function also takes care of the TX status request and
1991 * potential unsharing of the SKB - this needs to be interleaved with the
1992 * header building.
e2ebc74d 1993 *
4c9451ed
JB		 1994 * The function requires the read-side RCU lock held
1995 *
1996 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
e2ebc74d 1997 */
4c9451ed 1998static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
7c10770f 1999 struct sk_buff *skb, u32 info_flags,
97ffe757 2000 struct sta_info *sta)
e2ebc74d 2001{
133b8226 2002 struct ieee80211_local *local = sdata->local;
489ee919 2003 struct ieee80211_tx_info *info;
dcf33963 2004 int head_need;
065e9605
HH		 2005 u16 ethertype, hdrlen, meshhdrlen = 0;
2006 __le16 fc;
e2ebc74d 2007 struct ieee80211_hdr hdr;
ff67bb86 2008 struct ieee80211s_hdr mesh_hdr __maybe_unused;
b8bacc18 2009 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
e2ebc74d
JB		 2010 const u8 *encaps_data;
2011 int encaps_len, skip_header_bytes;
e8bf9649 2012 int nh_pos, h_pos;
97ffe757
JB		 2013 bool wme_sta = false, authorized = false;
2014 bool tdls_peer;
a729cff8 2015 bool multicast;
a729cff8 2016 u16 info_id = 0;
55de908a
JB		 2017 struct ieee80211_chanctx_conf *chanctx_conf;
2018 struct ieee80211_sub_if_data *ap_sdata;
2019 enum ieee80211_band band;
4c9451ed 2020 int ret;
e2ebc74d 2021
97ffe757
JB		 2022 if (IS_ERR(sta))
2023 sta = NULL;
2024
e2ebc74d
JB		 2025 /* convert Ethernet header to proper 802.11 header (based on
2026 * operation mode) */
2027 ethertype = (skb->data[12] << 8) | skb->data[13];
065e9605 2028 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
e2ebc74d 2029
51fb61e7 2030 switch (sdata->vif.type) {
05c914fe 2031 case NL80211_IFTYPE_AP_VLAN:
97ffe757 2032 if (sdata->wdev.use_4addr) {
f14543ee
FF		 2033 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2034 /* RA TA DA SA */
2035 memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
47846c9b 2036 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
f14543ee
FF		 2037 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2038 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2039 hdrlen = 30;
c2c98fde 2040 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
a74a8c84 2041 wme_sta = sta->sta.wme;
f14543ee 2042 }
55de908a
JB		 2043 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2044 u.ap);
2045 chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
4c9451ed
JB		 2046 if (!chanctx_conf) {
2047 ret = -ENOTCONN;
2048 goto free;
2049 }
4bf88530 2050 band = chanctx_conf->def.chan->band;
97ffe757 2051 if (sdata->wdev.use_4addr)
f14543ee
FF		 2052 break;
2053 /* fall through */
2054 case NL80211_IFTYPE_AP:
fe80123d
AB		 2055 if (sdata->vif.type == NL80211_IFTYPE_AP)
2056 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2057 if (!chanctx_conf) {
2058 ret = -ENOTCONN;
2059 goto free;
2060 }
065e9605 2061 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
e2ebc74d
JB		 2062 /* DA BSSID SA */
2063 memcpy(hdr.addr1, skb->data, ETH_ALEN);
47846c9b 2064 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
e2ebc74d
JB		 2065 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
2066 hdrlen = 24;
4bf88530 2067 band = chanctx_conf->def.chan->band;
cf966838 2068 break;
05c914fe 2069 case NL80211_IFTYPE_WDS:
065e9605 2070 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
e2ebc74d
JB		 2071 /* RA TA DA SA */
2072 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
47846c9b 2073 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
e2ebc74d
JB		 2074 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2075 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2076 hdrlen = 30;
55de908a
JB		 2077 /*
2078 * This is the exception! WDS style interfaces are prohibited
2079 * when channel contexts are in used so this must be valid
2080 */
675a0b04 2081 band = local->hw.conf.chandef.chan->band;
cf966838 2082 break;
33b64eb2 2083#ifdef CONFIG_MAC80211_MESH
05c914fe 2084 case NL80211_IFTYPE_MESH_POINT:
b8bacc18 2085 if (!is_multicast_ether_addr(skb->data)) {
163df6cf
CYY		 2086 struct sta_info *next_hop;
2087 bool mpp_lookup = true;
2088
bf7cd94d 2089 mpath = mesh_path_lookup(sdata, skb->data);
163df6cf
CYY		 2090 if (mpath) {
2091 mpp_lookup = false;
2092 next_hop = rcu_dereference(mpath->next_hop);
2093 if (!next_hop ||
2094 !(mpath->flags & (MESH_PATH_ACTIVE |
2095 MESH_PATH_RESOLVING)))
2096 mpp_lookup = true;
2097 }
2098
2099 if (mpp_lookup)
bf7cd94d 2100 mppath = mpp_path_lookup(sdata, skb->data);
163df6cf
CYY		 2101
2102 if (mppath && mpath)
2103 mesh_path_del(mpath->sdata, mpath->dst);
b8bacc18 2104 }
79617dee 2105
f76b57b4 2106 /*
9d52501b
JF		 2107 * Use address extension if it is a packet from
2108 * another interface or if we know the destination
2109 * is being proxied by a portal (i.e. portal address
2110 * differs from proxied address)
f76b57b4 2111 */
b203ca39
JP		 2112 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
2113 !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
3c5772a5
JC		 2114 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2115 skb->data, skb->data + ETH_ALEN);
bf7cd94d
JB		 2116 meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
2117 NULL, NULL);
79617dee 2118 } else {
27f01124
TP		 2119 /* DS -> MBSS (802.11-2012 13.11.3.3).
2120 * For unicast with unknown forwarding information,
2121 * destination might be in the MBSS or if that fails
2122 * forwarded to another mesh gate. In either case
2123 * resolution will be handled in ieee80211_xmit(), so
2124 * leave the original DA. This also works for mcast */
2125 const u8 *mesh_da = skb->data;
2126
2127 if (mppath)
2128 mesh_da = mppath->mpp;
2129 else if (mpath)
2130 mesh_da = mpath->dst;
79617dee 2131
3c5772a5 2132 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
47846c9b 2133 mesh_da, sdata->vif.addr);
27f01124
TP		 2134 if (is_multicast_ether_addr(mesh_da))
2135 /* DA TA mSA AE:SA */
bf7cd94d
JB		 2136 meshhdrlen = ieee80211_new_mesh_header(
2137 sdata, &mesh_hdr,
2138 skb->data + ETH_ALEN, NULL);
3c5772a5 2139 else
27f01124 2140 /* RA TA mDA mSA AE:DA SA */
bf7cd94d
JB		 2141 meshhdrlen = ieee80211_new_mesh_header(
2142 sdata, &mesh_hdr, skb->data,
2143 skb->data + ETH_ALEN);
79617dee 2144
79617dee 2145 }
55de908a 2146 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2147 if (!chanctx_conf) {
2148 ret = -ENOTCONN;
2149 goto free;
2150 }
4bf88530 2151 band = chanctx_conf->def.chan->band;
33b64eb2
LCC		 2152 break;
2153#endif
05c914fe 2154 case NL80211_IFTYPE_STATION:
97ffe757
JB		 2155 /* we already did checks when looking up the RA STA */
2156 tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
941c93cd 2157
97ffe757 2158 if (tdls_peer) {
941c93cd
AN		 2159 /* DA SA BSSID */
2160 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2161 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2162 memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
2163 hdrlen = 24;
2164 } else if (sdata->u.mgd.use_4addr &&
2165 cpu_to_be16(ethertype) != sdata->control_port_protocol) {
2166 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2167 IEEE80211_FCTL_TODS);
f14543ee 2168 /* RA TA DA SA */
941c93cd 2169 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
47846c9b 2170 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
f14543ee
FF		 2171 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2172 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2173 hdrlen = 30;
2174 } else {
2175 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2176 /* BSSID SA DA */
941c93cd 2177 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
f14543ee
FF		 2178 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2179 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2180 hdrlen = 24;
2181 }
55de908a 2182 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2183 if (!chanctx_conf) {
2184 ret = -ENOTCONN;
2185 goto free;
2186 }
4bf88530 2187 band = chanctx_conf->def.chan->band;
cf966838 2188 break;
239281f8
RL		 2189 case NL80211_IFTYPE_OCB:
2190 /* DA SA BSSID */
2191 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2192 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2193 eth_broadcast_addr(hdr.addr3);
2194 hdrlen = 24;
2195 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2196 if (!chanctx_conf) {
2197 ret = -ENOTCONN;
2198 goto free;
2199 }
239281f8
RL		 2200 band = chanctx_conf->def.chan->band;
2201 break;
05c914fe 2202 case NL80211_IFTYPE_ADHOC:
e2ebc74d
JB		 2203 /* DA SA BSSID */
2204 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2205 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
46900298 2206 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
e2ebc74d 2207 hdrlen = 24;
55de908a 2208 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2209 if (!chanctx_conf) {
2210 ret = -ENOTCONN;
2211 goto free;
2212 }
4bf88530 2213 band = chanctx_conf->def.chan->band;
cf966838
JB		 2214 break;
2215 default:
4c9451ed
JB		 2216 ret = -EINVAL;
2217 goto free;
e2ebc74d
JB		 2218 }
2219
a729cff8 2220 multicast = is_multicast_ether_addr(hdr.addr1);
e2ebc74d 2221
97ffe757
JB		 2222 /* sta is always NULL for mesh */
2223 if (sta) {
2224 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2225 wme_sta = sta->sta.wme;
2226 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2227 /* For mesh, the use of the QoS header is mandatory */
c2c98fde 2228 wme_sta = true;
97ffe757 2229 }
4777be41 2230
527871d7
JB		 2231 /* receiver does QoS (which also means we do) use it */
2232 if (wme_sta) {
065e9605 2233 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
ce3edf6d
JB		 2234 hdrlen += 2;
2235 }
2236
2237 /*
238814fd
JB		 2238 * Drop unicast frames to unauthorised stations unless they are
2239 * EAPOL frames from the local station.
ce3edf6d 2240 */
55182e4a 2241 if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
239281f8 2242 (sdata->vif.type != NL80211_IFTYPE_OCB) &&
a6ececf4 2243 !multicast && !authorized &&
55182e4a 2244 (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
b203ca39 2245 !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
ce3edf6d 2246#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
bdcbd8e0 2247 net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
4c9451ed 2248 sdata->name, hdr.addr1);
ce3edf6d
JB		 2249#endif
2250
2251 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
2252
4c9451ed
JB		 2253 ret = -EPERM;
2254 goto free;
ce3edf6d
JB		 2255 }
2256
a729cff8
JB		 2257 if (unlikely(!multicast && skb->sk &&
2258 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
bf7fa551 2259 struct sk_buff *ack_skb = skb_clone_sk(skb);
a729cff8 2260
bf7fa551 2261 if (ack_skb) {
a729cff8 2262 unsigned long flags;
9475af6e 2263 int id;
a729cff8
JB		 2264
2265 spin_lock_irqsave(&local->ack_status_lock, flags);
bf7fa551 2266 id = idr_alloc(&local->ack_status_frames, ack_skb,
9475af6e 2267 1, 0x10000, GFP_ATOMIC);
a729cff8
JB		 2268 spin_unlock_irqrestore(&local->ack_status_lock, flags);
2269
9475af6e 2270 if (id >= 0) {
a729cff8
JB		 2271 info_id = id;
2272 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
a729cff8 2273 } else {
bf7fa551 2274 kfree_skb(ack_skb);
a729cff8 2275 }
a729cff8
JB		 2276 }
2277 }
2278
7e244707
HS		 2279 /*
2280 * If the skb is shared we need to obtain our own copy.
2281 */
2282 if (skb_shared(skb)) {
a729cff8
JB		 2283 struct sk_buff *tmp_skb = skb;
2284
2285 /* can't happen -- skb is a clone if info_id != 0 */
2286 WARN_ON(info_id);
2287
f8a0a781 2288 skb = skb_clone(skb, GFP_ATOMIC);
7e244707
HS		 2289 kfree_skb(tmp_skb);
2290
4c9451ed
JB		 2291 if (!skb) {
2292 ret = -ENOMEM;
2293 goto free;
2294 }
7e244707
HS		 2295 }
2296
065e9605 2297 hdr.frame_control = fc;
e2ebc74d
JB		 2298 hdr.duration_id = 0;
2299 hdr.seq_ctrl = 0;
2300
2301 skip_header_bytes = ETH_HLEN;
2302 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
2303 encaps_data = bridge_tunnel_header;
2304 encaps_len = sizeof(bridge_tunnel_header);
2305 skip_header_bytes -= 2;
e5c5d22e 2306 } else if (ethertype >= ETH_P_802_3_MIN) {
e2ebc74d
JB		 2307 encaps_data = rfc1042_header;
2308 encaps_len = sizeof(rfc1042_header);
2309 skip_header_bytes -= 2;
2310 } else {
2311 encaps_data = NULL;
2312 encaps_len = 0;
2313 }
2314
7e244707
HS		 2315 nh_pos = skb_network_header(skb) - skb->data;
2316 h_pos = skb_transport_header(skb) - skb->data;
2317
e2ebc74d
JB		 2318 skb_pull(skb, skip_header_bytes);
2319 nh_pos -= skip_header_bytes;
2320 h_pos -= skip_header_bytes;
2321
23c0752a 2322 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
e2ebc74d 2323
23c0752a
JB		 2324 /*
2325 * So we need to modify the skb header and hence need a copy of
2326 * that. The head_need variable above doesn't, so far, include
2327 * the needed header space that we don't need right away. If we
2328 * can, then we don't reallocate right now but only after the
2329 * frame arrives at the master device (if it does...)
2330 *
2331 * If we cannot, however, then we will reallocate to include all
2332 * the ever needed space. Also, if we need to reallocate it anyway,
2333 * make it big enough for everything we may ever need.
2334 */
e2ebc74d 2335
3a5be7d4 2336 if (head_need > 0 || skb_cloned(skb)) {
2475b1cc 2337 head_need += sdata->encrypt_headroom;
23c0752a
JB		 2338 head_need += local->tx_headroom;
2339 head_need = max_t(int, 0, head_need);
c3e7724b
FF		 2340 if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
2341 ieee80211_free_txskb(&local->hw, skb);
1c963bec 2342 skb = NULL;
4c9451ed 2343 return ERR_PTR(-ENOMEM);
c3e7724b 2344 }
e2ebc74d
JB		 2345 }
2346
2347 if (encaps_data) {
2348 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
2349 nh_pos += encaps_len;
2350 h_pos += encaps_len;
2351 }
c29b9b9b 2352
e4ab7eb0 2353#ifdef CONFIG_MAC80211_MESH
33b64eb2
LCC		 2354 if (meshhdrlen > 0) {
2355 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
2356 nh_pos += meshhdrlen;
2357 h_pos += meshhdrlen;
2358 }
e4ab7eb0 2359#endif
33b64eb2 2360
065e9605 2361 if (ieee80211_is_data_qos(fc)) {
c29b9b9b
JB		 2362 __le16 *qos_control;
2363
f359d3fe 2364 qos_control = (__le16 *) skb_push(skb, 2);
c29b9b9b
JB		 2365 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
2366 /*
2367 * Maybe we could actually set some fields here, for now just
2368 * initialise to zero to indicate no special operation.
2369 */
2370 *qos_control = 0;
2371 } else
2372 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
2373
e2ebc74d
JB		 2374 nh_pos += hdrlen;
2375 h_pos += hdrlen;
2376
e2ebc74d
JB		 2377 /* Update skb pointers to various headers since this modified frame
2378 * is going to go through Linux networking code that may potentially
2379 * need things like pointer to IP header. */
2380 skb_set_mac_header(skb, 0);
2381 skb_set_network_header(skb, nh_pos);
2382 skb_set_transport_header(skb, h_pos);
2383
489ee919 2384 info = IEEE80211_SKB_CB(skb);
3b8d81e0
JB		 2385 memset(info, 0, sizeof(*info));
2386
a729cff8
JB		 2387 info->flags = info_flags;
2388 info->ack_frame_id = info_id;
73c4e195 2389 info->band = band;
a729cff8 2390
4c9451ed
JB		 2391 return skb;
2392 free:
2393 kfree_skb(skb);
2394 return ERR_PTR(ret);
2395}
2396
17c18bf8
JB		 2397/*
2398 * fast-xmit overview
2399 *
2400 * The core idea of this fast-xmit is to remove per-packet checks by checking
2401 * them out of band. ieee80211_check_fast_xmit() implements the out-of-band
2402 * checks that are needed to get the sta->fast_tx pointer assigned, after which
2403 * much less work can be done per packet. For example, fragmentation must be
2404 * disabled or the fast_tx pointer will not be set. All the conditions are seen
2405 * in the code here.
2406 *
2407 * Once assigned, the fast_tx data structure also caches the per-packet 802.11
2408 * header and other data to aid packet processing in ieee80211_xmit_fast().
2409 *
2410 * The most difficult part of this is that when any of these assumptions
2411 * change, an external trigger (i.e. a call to ieee80211_clear_fast_xmit(),
2412 * ieee80211_check_fast_xmit() or friends) is required to reset the data,
2413 * since the per-packet code no longer checks the conditions. This is reflected
2414 * by the calls to these functions throughout the rest of the code, and must be
2415 * maintained if any of the TX path checks change.
2416 */
2417
2418void ieee80211_check_fast_xmit(struct sta_info *sta)
2419{
2420 struct ieee80211_fast_tx build = {}, *fast_tx = NULL, *old;
2421 struct ieee80211_local *local = sta->local;
2422 struct ieee80211_sub_if_data *sdata = sta->sdata;
2423 struct ieee80211_hdr *hdr = (void *)build.hdr;
2424 struct ieee80211_chanctx_conf *chanctx_conf;
2425 __le16 fc;
2426
30686bf7 2427 if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
17c18bf8
JB		 2428 return;
2429
2430 /* Locking here protects both the pointer itself, and against concurrent
2431 * invocations winning data access races to, e.g., the key pointer that
2432 * is used.
2433 * Without it, the invocation of this function right after the key
2434 * pointer changes wouldn't be sufficient, as another CPU could access
2435 * the pointer, then stall, and then do the cache update after the CPU
2436 * that invalidated the key.
2437 * With the locking, such scenarios cannot happen as the check for the
2438 * key and the fast-tx assignment are done atomically, so the CPU that
2439 * modifies the key will either wait or other one will see the key
2440 * cleared/changed already.
2441 */
2442 spin_lock_bh(&sta->lock);
30686bf7
JB		 2443 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
2444 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
17c18bf8
JB		 2445 sdata->vif.type == NL80211_IFTYPE_STATION)
2446 goto out;
2447
2448 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2449 goto out;
2450
2451 if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
2452 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
2453 test_sta_flag(sta, WLAN_STA_PS_DELIVER))
2454 goto out;
2455
2456 if (sdata->noack_map)
2457 goto out;
2458
2459 /* fast-xmit doesn't handle fragmentation at all */
725b812c
JB		 2460 if (local->hw.wiphy->frag_threshold != (u32)-1 &&
2461 !local->ops->set_frag_threshold)
17c18bf8
JB		 2462 goto out;
2463
2464 rcu_read_lock();
2465 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2466 if (!chanctx_conf) {
2467 rcu_read_unlock();
2468 goto out;
2469 }
2470 build.band = chanctx_conf->def.chan->band;
2471 rcu_read_unlock();
2472
2473 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2474
2475 switch (sdata->vif.type) {
3ffd8840
JB		 2476 case NL80211_IFTYPE_ADHOC:
2477 /* DA SA BSSID */
2478 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2479 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2480 memcpy(hdr->addr3, sdata->u.ibss.bssid, ETH_ALEN);
2481 build.hdr_len = 24;
2482 break;
17c18bf8
JB		 2483 case NL80211_IFTYPE_STATION:
2484 if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2485 /* DA SA BSSID */
2486 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2487 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2488 memcpy(hdr->addr3, sdata->u.mgd.bssid, ETH_ALEN);
2489 build.hdr_len = 24;
2490 break;
2491 }
2492
2493 if (sdata->u.mgd.use_4addr) {
2494 /* non-regular ethertype cannot use the fastpath */
2495 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2496 IEEE80211_FCTL_TODS);
2497 /* RA TA DA SA */
2498 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2499 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2500 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2501 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2502 build.hdr_len = 30;
2503 break;
2504 }
2505 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2506 /* BSSID SA DA */
2507 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2508 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2509 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2510 build.hdr_len = 24;
2511 break;
2512 case NL80211_IFTYPE_AP_VLAN:
2513 if (sdata->wdev.use_4addr) {
2514 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2515 IEEE80211_FCTL_TODS);
2516 /* RA TA DA SA */
2517 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
2518 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2519 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2520 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2521 build.hdr_len = 30;
2522 break;
2523 }
2524 /* fall through */
2525 case NL80211_IFTYPE_AP:
2526 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2527 /* DA BSSID SA */
2528 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2529 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2530 build.sa_offs = offsetof(struct ieee80211_hdr, addr3);
2531 build.hdr_len = 24;
2532 break;
2533 default:
2534 /* not handled on fast-xmit */
2535 goto out;
2536 }
2537
2538 if (sta->sta.wme) {
2539 build.hdr_len += 2;
2540 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2541 }
2542
2543 /* We store the key here so there's no point in using rcu_dereference()
2544 * but that's fine because the code that changes the pointers will call
2545 * this function after doing so. For a single CPU that would be enough,
2546 * for multiple see the comment above.
2547 */
2548 build.key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
2549 if (!build.key)
2550 build.key = rcu_access_pointer(sdata->default_unicast_key);
2551 if (build.key) {
e495c247 2552 bool gen_iv, iv_spc, mmic;
17c18bf8
JB		 2553
2554 gen_iv = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
2555 iv_spc = build.key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
e495c247 2556 mmic = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC;
17c18bf8
JB		 2557
2558 /* don't handle software crypto */
2559 if (!(build.key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
2560 goto out;
2561
2562 switch (build.key->conf.cipher) {
2563 case WLAN_CIPHER_SUITE_CCMP:
2564 case WLAN_CIPHER_SUITE_CCMP_256:
2565 /* add fixed key ID */
2566 if (gen_iv) {
2567 (build.hdr + build.hdr_len)[3] =
2568 0x20 | (build.key->conf.keyidx << 6);
2569 build.pn_offs = build.hdr_len;
2570 }
2571 if (gen_iv || iv_spc)
2572 build.hdr_len += IEEE80211_CCMP_HDR_LEN;
2573 break;
2574 case WLAN_CIPHER_SUITE_GCMP:
2575 case WLAN_CIPHER_SUITE_GCMP_256:
2576 /* add fixed key ID */
2577 if (gen_iv) {
2578 (build.hdr + build.hdr_len)[3] =
2579 0x20 | (build.key->conf.keyidx << 6);
2580 build.pn_offs = build.hdr_len;
2581 }
2582 if (gen_iv || iv_spc)
2583 build.hdr_len += IEEE80211_GCMP_HDR_LEN;
2584 break;
e495c247
JB		 2585 case WLAN_CIPHER_SUITE_TKIP:
2586 /* cannot handle MMIC or IV generation in xmit-fast */
2587 if (mmic || gen_iv)
2588 goto out;
2589 if (iv_spc)
2590 build.hdr_len += IEEE80211_TKIP_IV_LEN;
2591 break;
2592 case WLAN_CIPHER_SUITE_WEP40:
2593 case WLAN_CIPHER_SUITE_WEP104:
2594 /* cannot handle IV generation in fast-xmit */
2595 if (gen_iv)
2596 goto out;
2597 if (iv_spc)
2598 build.hdr_len += IEEE80211_WEP_IV_LEN;
2599 break;
2600 case WLAN_CIPHER_SUITE_AES_CMAC:
2601 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2602 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2603 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2604 WARN(1,
2605 "management cipher suite 0x%x enabled for data\n",
2606 build.key->conf.cipher);
17c18bf8 2607 goto out;
e495c247
JB		 2608 default:
2609 /* we don't know how to generate IVs for this at all */
2610 if (WARN_ON(gen_iv))
2611 goto out;
2612 /* pure hardware keys are OK, of course */
2613 if (!(build.key->flags & KEY_FLAG_CIPHER_SCHEME))
2614 break;
2615 /* cipher scheme might require space allocation */
2616 if (iv_spc &&
2617 build.key->conf.iv_len > IEEE80211_FAST_XMIT_MAX_IV)
2618 goto out;
2619 if (iv_spc)
2620 build.hdr_len += build.key->conf.iv_len;
17c18bf8
JB		 2621 }
2622
2623 fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2624 }
2625
2626 hdr->frame_control = fc;
2627
2628 memcpy(build.hdr + build.hdr_len,
2629 rfc1042_header, sizeof(rfc1042_header));
2630 build.hdr_len += sizeof(rfc1042_header);
2631
2632 fast_tx = kmemdup(&build, sizeof(build), GFP_ATOMIC);
2633 /* if the kmemdup fails, continue w/o fast_tx */
2634 if (!fast_tx)
2635 goto out;
2636
2637 out:
2638 /* we might have raced against another call to this function */
2639 old = rcu_dereference_protected(sta->fast_tx,
2640 lockdep_is_held(&sta->lock));
2641 rcu_assign_pointer(sta->fast_tx, fast_tx);
2642 if (old)
2643 kfree_rcu(old, rcu_head);
2644 spin_unlock_bh(&sta->lock);
2645}
2646
2647void ieee80211_check_fast_xmit_all(struct ieee80211_local *local)
2648{
2649 struct sta_info *sta;
2650
2651 rcu_read_lock();
2652 list_for_each_entry_rcu(sta, &local->sta_list, list)
2653 ieee80211_check_fast_xmit(sta);
2654 rcu_read_unlock();
2655}
2656
2657void ieee80211_check_fast_xmit_iface(struct ieee80211_sub_if_data *sdata)
2658{
2659 struct ieee80211_local *local = sdata->local;
2660 struct sta_info *sta;
2661
2662 rcu_read_lock();
2663
2664 list_for_each_entry_rcu(sta, &local->sta_list, list) {
2665 if (sdata != sta->sdata &&
2666 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
2667 continue;
2668 ieee80211_check_fast_xmit(sta);
2669 }
2670
2671 rcu_read_unlock();
2672}
2673
2674void ieee80211_clear_fast_xmit(struct sta_info *sta)
2675{
2676 struct ieee80211_fast_tx *fast_tx;
2677
2678 spin_lock_bh(&sta->lock);
2679 fast_tx = rcu_dereference_protected(sta->fast_tx,
2680 lockdep_is_held(&sta->lock));
2681 RCU_INIT_POINTER(sta->fast_tx, NULL);
2682 spin_unlock_bh(&sta->lock);
2683
2684 if (fast_tx)
2685 kfree_rcu(fast_tx, rcu_head);
2686}
2687
2688static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
2689 struct net_device *dev, struct sta_info *sta,
2690 struct ieee80211_fast_tx *fast_tx,
2691 struct sk_buff *skb)
2692{
2693 struct ieee80211_local *local = sdata->local;
2694 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
2695 int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
2696 int hw_headroom = sdata->local->hw.extra_tx_headroom;
2697 struct ethhdr eth;
2698 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2699 struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
2700 struct ieee80211_tx_data tx;
2701 ieee80211_tx_result r;
2702 struct tid_ampdu_tx *tid_tx = NULL;
2703 u8 tid = IEEE80211_NUM_TIDS;
2704
2705 /* control port protocol needs a lot of special handling */
2706 if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
2707 return false;
2708
2709 /* only RFC 1042 SNAP */
2710 if (ethertype < ETH_P_802_3_MIN)
2711 return false;
2712
2713 /* don't handle TX status request here either */
2714 if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
2715 return false;
2716
2717 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
2718 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2719 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
472be00d
JB		 2720 if (tid_tx) {
2721 if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2722 return false;
2723 if (tid_tx->timeout)
2724 tid_tx->last_tx = jiffies;
2725 }
17c18bf8
JB		 2726 }
2727
2728 /* after this point (skb is modified) we cannot return false */
2729
2730 if (skb_shared(skb)) {
2731 struct sk_buff *tmp_skb = skb;
2732
2733 skb = skb_clone(skb, GFP_ATOMIC);
2734 kfree_skb(tmp_skb);
2735
2736 if (!skb)
2737 return true;
2738 }
2739
5a490510 2740 ieee80211_tx_stats(dev, skb->len + extra_head);
17c18bf8
JB		 2741
2742 /* will not be crypto-handled beyond what we do here, so use false
2743 * as the may-encrypt argument for the resize to not account for
2744 * more room than we already have in 'extra_head'
2745 */
2746 if (unlikely(ieee80211_skb_resize(sdata, skb,
2747 max_t(int, extra_head + hw_headroom -
2748 skb_headroom(skb), 0),
2749 false))) {
2750 kfree_skb(skb);
2751 return true;
2752 }
2753
2754 memcpy(&eth, skb->data, ETH_HLEN - 2);
2755 hdr = (void *)skb_push(skb, extra_head);
2756 memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
2757 memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
2758 memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
2759
2760 memset(info, 0, sizeof(*info));
2761 info->band = fast_tx->band;
2762 info->control.vif = &sdata->vif;
2763 info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
2764 IEEE80211_TX_CTL_DONTFRAG |
2765 (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
2766
2767 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
2768 *ieee80211_get_qos_ctl(hdr) = tid;
2769 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
2770 } else {
2771 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
2772 hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
2773 sdata->sequence_number += 0x10;
2774 }
2775
ccc6bb96
JB		 2776 if (skb_shinfo(skb)->gso_size)
2777 sta->tx_msdu[tid] +=
2778 DIV_ROUND_UP(skb->len, skb_shinfo(skb)->gso_size);
2779 else
2780 sta->tx_msdu[tid]++;
17c18bf8
JB		 2781
2782 info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
2783
2784 __skb_queue_head_init(&tx.skbs);
2785
2786 tx.flags = IEEE80211_TX_UNICAST;
2787 tx.local = local;
2788 tx.sdata = sdata;
2789 tx.sta = sta;
2790 tx.key = fast_tx->key;
2791
2792 if (fast_tx->key)
2793 info->control.hw_key = &fast_tx->key->conf;
2794
30686bf7 2795 if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
17c18bf8
JB		 2796 tx.skb = skb;
2797 r = ieee80211_tx_h_rate_ctrl(&tx);
2798 skb = tx.skb;
2799 tx.skb = NULL;
2800
2801 if (r != TX_CONTINUE) {
2802 if (r != TX_QUEUED)
2803 kfree_skb(skb);
2804 return true;
2805 }
2806 }
2807
2808 /* statistics normally done by ieee80211_tx_h_stats (but that
2809 * has to consider fragmentation, so is more complex)
2810 */
17c18bf8
JB		 2811 sta->tx_bytes[skb_get_queue_mapping(skb)] += skb->len;
2812 sta->tx_packets[skb_get_queue_mapping(skb)]++;
2813
2814 if (fast_tx->pn_offs) {
2815 u64 pn;
2816 u8 *crypto_hdr = skb->data + fast_tx->pn_offs;
2817
2818 switch (fast_tx->key->conf.cipher) {
2819 case WLAN_CIPHER_SUITE_CCMP:
2820 case WLAN_CIPHER_SUITE_CCMP_256:
17c18bf8
JB		 2821 case WLAN_CIPHER_SUITE_GCMP:
2822 case WLAN_CIPHER_SUITE_GCMP_256:
db388a56 2823 pn = atomic64_inc_return(&fast_tx->key->conf.tx_pn);
17c18bf8
JB		 2824 crypto_hdr[0] = pn;
2825 crypto_hdr[1] = pn >> 8;
2826 crypto_hdr[4] = pn >> 16;
2827 crypto_hdr[5] = pn >> 24;
2828 crypto_hdr[6] = pn >> 32;
2829 crypto_hdr[7] = pn >> 40;
2830 break;
2831 }
2832 }
2833
2834 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2835 sdata = container_of(sdata->bss,
2836 struct ieee80211_sub_if_data, u.ap);
2837
2838 __skb_queue_tail(&tx.skbs, skb);
2839 ieee80211_tx_frags(local, &sdata->vif, &sta->sta, &tx.skbs, false);
2840 return true;
2841}
2842
4c9451ed
JB		 2843void __ieee80211_subif_start_xmit(struct sk_buff *skb,
2844 struct net_device *dev,
2845 u32 info_flags)
2846{
2847 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
97ffe757 2848 struct sta_info *sta;
80616c0d 2849 struct sk_buff *next;
4c9451ed
JB		 2850
2851 if (unlikely(skb->len < ETH_HLEN)) {
2852 kfree_skb(skb);
2853 return;
2854 }
2855
2856 rcu_read_lock();
e2ebc74d 2857
2d981fdd
JB		 2858 if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
2859 goto out_free;
4c9451ed 2860
17c18bf8
JB		 2861 if (!IS_ERR_OR_NULL(sta)) {
2862 struct ieee80211_fast_tx *fast_tx;
2863
2864 fast_tx = rcu_dereference(sta->fast_tx);
2865
2866 if (fast_tx &&
2867 ieee80211_xmit_fast(sdata, dev, sta, fast_tx, skb))
2868 goto out;
2869 }
2870
80616c0d
JB		 2871 if (skb_is_gso(skb)) {
2872 struct sk_buff *segs;
680a0dab 2873
80616c0d
JB		 2874 segs = skb_gso_segment(skb, 0);
2875 if (IS_ERR(segs)) {
2d981fdd 2876 goto out_free;
80616c0d
JB		 2877 } else if (segs) {
2878 consume_skb(skb);
2879 skb = segs;
2880 }
2881 } else {
2882 /* we cannot process non-linear frames on this path */
2883 if (skb_linearize(skb)) {
2884 kfree_skb(skb);
2885 goto out;
2886 }
2887
2888 /* the frame could be fragmented, software-encrypted, and other
2889 * things so we cannot really handle checksum offload with it -
2890 * fix it up in software before we handle anything else.
2891 */
2892 if (skb->ip_summed == CHECKSUM_PARTIAL) {
f603f1f3
JB		 2893 skb_set_transport_header(skb,
2894 skb_checksum_start_offset(skb));
80616c0d
JB		 2895 if (skb_checksum_help(skb))
2896 goto out_free;
2897 }
2d981fdd
JB		 2898 }
2899
80616c0d
JB		 2900 next = skb;
2901 while (next) {
2902 skb = next;
2903 next = skb->next;
4c9451ed 2904
80616c0d
JB		 2905 skb->prev = NULL;
2906 skb->next = NULL;
2907
2908 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
2909 if (IS_ERR(skb))
2910 goto out;
e2ebc74d 2911
5a490510 2912 ieee80211_tx_stats(dev, skb->len);
80616c0d
JB		 2913
2914 ieee80211_xmit(sdata, sta, skb);
2915 }
2d981fdd
JB		 2916 goto out;
2917 out_free:
2918 kfree_skb(skb);
4c9451ed 2919 out:
55de908a 2920 rcu_read_unlock();
e2ebc74d
JB		 2921}
2922
4c9451ed
JB		 2923/**
2924 * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
2925 * @skb: packet to be sent
2926 * @dev: incoming interface
2927 *
2928 * On failure skb will be freed.
2929 */
24d342c5
LK		 2930netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
2931 struct net_device *dev)
2932{
2933 __ieee80211_subif_start_xmit(skb, dev, 0);
2934 return NETDEV_TX_OK;
2935}
e2ebc74d 2936
7528ec57
JB		 2937struct sk_buff *
2938ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
2939 struct sk_buff *skb, u32 info_flags)
2940{
2941 struct ieee80211_hdr *hdr;
2942 struct ieee80211_tx_data tx = {
2943 .local = sdata->local,
2944 .sdata = sdata,
2945 };
97ffe757 2946 struct sta_info *sta;
7528ec57
JB		 2947
2948 rcu_read_lock();
2949
97ffe757
JB		 2950 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
2951 kfree_skb(skb);
2952 skb = ERR_PTR(-EINVAL);
2953 goto out;
2954 }
2955
2956 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
7528ec57
JB		 2957 if (IS_ERR(skb))
2958 goto out;
2959
2960 hdr = (void *)skb->data;
2961 tx.sta = sta_info_get(sdata, hdr->addr1);
2962 tx.skb = skb;
2963
2964 if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
2965 rcu_read_unlock();
2966 kfree_skb(skb);
2967 return ERR_PTR(-EINVAL);
2968 }
2969
2970out:
2971 rcu_read_unlock();
2972 return skb;
2973}
2974
e2530083
JB		 2975/*
2976 * ieee80211_clear_tx_pending may not be called in a context where
2977 * it is possible that it packets could come in again.
2978 */
e2ebc74d
JB		 2979void ieee80211_clear_tx_pending(struct ieee80211_local *local)
2980{
1f98ab7f 2981 struct sk_buff *skb;
2de8e0d9 2982 int i;
e2ebc74d 2983
1f98ab7f
FF		 2984 for (i = 0; i < local->hw.queues; i++) {
2985 while ((skb = skb_dequeue(&local->pending[i])) != NULL)
2986 ieee80211_free_txskb(&local->hw, skb);
2987 }
e2ebc74d
JB		 2988}
2989
7bb45683
JB		 2990/*
2991 * Returns false if the frame couldn't be transmitted but was queued instead,
2992 * which in this case means re-queued -- take as an indication to stop sending
2993 * more pending frames.
2994 */
cd8ffc80
JB		 2995static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
2996 struct sk_buff *skb)
2997{
2998 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2999 struct ieee80211_sub_if_data *sdata;
3000 struct sta_info *sta;
3001 struct ieee80211_hdr *hdr;
7bb45683 3002 bool result;
55de908a 3003 struct ieee80211_chanctx_conf *chanctx_conf;
cd8ffc80 3004
5061b0c2 3005 sdata = vif_to_sdata(info->control.vif);
cd8ffc80
JB		 3006
3007 if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
55de908a
JB		 3008 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
3009 if (unlikely(!chanctx_conf)) {
3010 dev_kfree_skb(skb);
3011 return true;
3012 }
73c4e195 3013 info->band = chanctx_conf->def.chan->band;
7c10770f 3014 result = ieee80211_tx(sdata, NULL, skb, true);
cd8ffc80 3015 } else {
252b86c4
JB		 3016 struct sk_buff_head skbs;
3017
3018 __skb_queue_head_init(&skbs);
3019 __skb_queue_tail(&skbs, skb);
3020
cd8ffc80 3021 hdr = (struct ieee80211_hdr *)skb->data;
abe60632 3022 sta = sta_info_get(sdata, hdr->addr1);
cd8ffc80 3023
74e4dbfd 3024 result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
cd8ffc80
JB		 3025 }
3026
cd8ffc80
JB		 3027 return result;
3028}
3029
e2530083 3030/*
3b8d81e0 3031 * Transmit all pending packets. Called from tasklet.
e2530083 3032 */
e2ebc74d
JB		 3033void ieee80211_tx_pending(unsigned long data)
3034{
3035 struct ieee80211_local *local = (struct ieee80211_local *)data;
2a577d98 3036 unsigned long flags;
cd8ffc80 3037 int i;
3b8d81e0 3038 bool txok;
e2ebc74d 3039
f0e72851 3040 rcu_read_lock();
e2530083 3041
3b8d81e0 3042 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2a577d98
JB		 3043 for (i = 0; i < local->hw.queues; i++) {
3044 /*
3045 * If queue is stopped by something other than due to pending
3046 * frames, or we have no pending frames, proceed to next queue.
3047 */
3b8d81e0 3048 if (local->queue_stop_reasons[i] ||
2a577d98 3049 skb_queue_empty(&local->pending[i]))
e2ebc74d 3050 continue;
e2530083 3051
2a577d98 3052 while (!skb_queue_empty(&local->pending[i])) {
3b8d81e0 3053 struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
5061b0c2 3054 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
5061b0c2 3055
a7bc376c 3056 if (WARN_ON(!info->control.vif)) {
c3e7724b 3057 ieee80211_free_txskb(&local->hw, skb);
a7bc376c
JB		 3058 continue;
3059 }
3060
3b8d81e0
JB		 3061 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
3062 flags);
3063
3064 txok = ieee80211_tx_pending_skb(local, skb);
3b8d81e0
JB		 3065 spin_lock_irqsave(&local->queue_stop_reason_lock,
3066 flags);
3067 if (!txok)
2a577d98 3068 break;
e2ebc74d 3069 }
7236fe29
JB		 3070
3071 if (skb_queue_empty(&local->pending[i]))
3a25a8c8 3072 ieee80211_propagate_queue_wake(local, i);
e2ebc74d 3073 }
3b8d81e0 3074 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2a577d98 3075
f0e72851 3076 rcu_read_unlock();
e2ebc74d
JB		 3077}
3078
3079/* functions for drivers to get certain frames */
3080
eac70c13 3081static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
6ec8c332
AO		 3082 struct ps_data *ps, struct sk_buff *skb,
3083 bool is_template)
e2ebc74d
JB		 3084{
3085 u8 *pos, *tim;
3086 int aid0 = 0;
3087 int i, have_bits = 0, n1, n2;
3088
3089 /* Generate bitmap for TIM only if there are any STAs in power save
3090 * mode. */
d012a605 3091 if (atomic_read(&ps->num_sta_ps) > 0)
e2ebc74d
JB		 3092 /* in the hope that this is faster than
3093 * checking byte-for-byte */
f359d3fe 3094 have_bits = !bitmap_empty((unsigned long *)ps->tim,
e2ebc74d 3095 IEEE80211_MAX_AID+1);
6ec8c332
AO		 3096 if (!is_template) {
3097 if (ps->dtim_count == 0)
3098 ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
3099 else
3100 ps->dtim_count--;
3101 }
e2ebc74d
JB		 3102
3103 tim = pos = (u8 *) skb_put(skb, 6);
3104 *pos++ = WLAN_EID_TIM;
3105 *pos++ = 4;
d012a605 3106 *pos++ = ps->dtim_count;
8860020e 3107 *pos++ = sdata->vif.bss_conf.dtim_period;
e2ebc74d 3108
d012a605 3109 if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf))
e2ebc74d
JB		 3110 aid0 = 1;
3111
d012a605 3112 ps->dtim_bc_mc = aid0 == 1;
512119b3 3113
e2ebc74d
JB		 3114 if (have_bits) {
3115 /* Find largest even number N1 so that bits numbered 1 through
3116 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
3117 * (N2 + 1) x 8 through 2007 are 0. */
3118 n1 = 0;
3119 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
d012a605 3120 if (ps->tim[i]) {
e2ebc74d
JB		 3121 n1 = i & 0xfe;
3122 break;
3123 }
3124 }
3125 n2 = n1;
3126 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
d012a605 3127 if (ps->tim[i]) {
e2ebc74d
JB		 3128 n2 = i;
3129 break;
3130 }
3131 }
3132
3133 /* Bitmap control */
3134 *pos++ = n1 | aid0;
3135 /* Part Virt Bitmap */
5220da39 3136 skb_put(skb, n2 - n1);
d012a605 3137 memcpy(pos, ps->tim + n1, n2 - n1 + 1);
e2ebc74d
JB		 3138
3139 tim[1] = n2 - n1 + 4;
e2ebc74d
JB		 3140 } else {
3141 *pos++ = aid0; /* Bitmap control */
3142 *pos++ = 0; /* Part Virt Bitmap */
3143 }
e2ebc74d
JB		 3144}
3145
eac70c13 3146static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
6ec8c332
AO		 3147 struct ps_data *ps, struct sk_buff *skb,
3148 bool is_template)
eac70c13
MP		 3149{
3150 struct ieee80211_local *local = sdata->local;
3151
3152 /*
3153 * Not very nice, but we want to allow the driver to call
3154 * ieee80211_beacon_get() as a response to the set_tim()
3155 * callback. That, however, is already invoked under the
3156 * sta_lock to guarantee consistent and race-free update
3157 * of the tim bitmap in mac80211 and the driver.
3158 */
3159 if (local->tim_in_locked_section) {
6ec8c332 3160 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
eac70c13 3161 } else {
1b91731d 3162 spin_lock_bh(&local->tim_lock);
6ec8c332 3163 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
1b91731d 3164 spin_unlock_bh(&local->tim_lock);
eac70c13
MP		 3165 }
3166
3167 return 0;
3168}
3169
1af586c9
AO		 3170static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
3171 struct beacon_data *beacon)
73da7d5b
SW		 3172{
3173 struct probe_resp *resp;
cd7760e6
SW		 3174 u8 *beacon_data;
3175 size_t beacon_data_len;
0d06d9ba 3176 int i;
af296bdb 3177 u8 count = beacon->csa_current_counter;
cd7760e6
SW		 3178
3179 switch (sdata->vif.type) {
3180 case NL80211_IFTYPE_AP:
3181 beacon_data = beacon->tail;
3182 beacon_data_len = beacon->tail_len;
3183 break;
3184 case NL80211_IFTYPE_ADHOC:
3185 beacon_data = beacon->head;
3186 beacon_data_len = beacon->head_len;
3187 break;
b8456a14
CYY		 3188 case NL80211_IFTYPE_MESH_POINT:
3189 beacon_data = beacon->head;
3190 beacon_data_len = beacon->head_len;
3191 break;
cd7760e6
SW		 3192 default:
3193 return;
3194 }
73da7d5b 3195
af296bdb 3196 rcu_read_lock();
0d06d9ba 3197 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
af296bdb 3198 resp = rcu_dereference(sdata->u.ap.probe_resp);
0d06d9ba 3199
af296bdb
MK		 3200 if (beacon->csa_counter_offsets[i]) {
3201 if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
3202 beacon_data_len)) {
0d06d9ba
AO		 3203 rcu_read_unlock();
3204 return;
3205 }
af296bdb
MK		 3206
3207 beacon_data[beacon->csa_counter_offsets[i]] = count;
73da7d5b 3208 }
af296bdb
MK		 3209
3210 if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
3211 resp->data[resp->csa_counter_offsets[i]] = count;
73da7d5b 3212 }
af296bdb 3213 rcu_read_unlock();
1af586c9
AO		 3214}
3215
e996ec2a
WD		 3216static u8 __ieee80211_csa_update_counter(struct beacon_data *beacon)
3217{
3218 beacon->csa_current_counter--;
3219
3220 /* the counter should never reach 0 */
3221 WARN_ON_ONCE(!beacon->csa_current_counter);
3222
3223 return beacon->csa_current_counter;
3224}
3225
1af586c9
AO		 3226u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
3227{
3228 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
af296bdb
MK		 3229 struct beacon_data *beacon = NULL;
3230 u8 count = 0;
0d06d9ba 3231
af296bdb
MK		 3232 rcu_read_lock();
3233
3234 if (sdata->vif.type == NL80211_IFTYPE_AP)
3235 beacon = rcu_dereference(sdata->u.ap.beacon);
3236 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3237 beacon = rcu_dereference(sdata->u.ibss.presp);
3238 else if (ieee80211_vif_is_mesh(&sdata->vif))
3239 beacon = rcu_dereference(sdata->u.mesh.beacon);
3240
3241 if (!beacon)
3242 goto unlock;
3243
e996ec2a 3244 count = __ieee80211_csa_update_counter(beacon);
1af586c9 3245
af296bdb
MK		 3246unlock:
3247 rcu_read_unlock();
3248 return count;
73da7d5b 3249}
1af586c9 3250EXPORT_SYMBOL(ieee80211_csa_update_counter);
73da7d5b
SW		 3251
3252bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
3253{
3254 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3255 struct beacon_data *beacon = NULL;
3256 u8 *beacon_data;
3257 size_t beacon_data_len;
73da7d5b
SW		 3258 int ret = false;
3259
3260 if (!ieee80211_sdata_running(sdata))
3261 return false;
3262
3263 rcu_read_lock();
3264 if (vif->type == NL80211_IFTYPE_AP) {
3265 struct ieee80211_if_ap *ap = &sdata->u.ap;
3266
3267 beacon = rcu_dereference(ap->beacon);
3268 if (WARN_ON(!beacon || !beacon->tail))
3269 goto out;
3270 beacon_data = beacon->tail;
3271 beacon_data_len = beacon->tail_len;
cd7760e6
SW		 3272 } else if (vif->type == NL80211_IFTYPE_ADHOC) {
3273 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
3274
3275 beacon = rcu_dereference(ifibss->presp);
3276 if (!beacon)
3277 goto out;
3278
b8456a14
CYY		 3279 beacon_data = beacon->head;
3280 beacon_data_len = beacon->head_len;
3281 } else if (vif->type == NL80211_IFTYPE_MESH_POINT) {
3282 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
3283
3284 beacon = rcu_dereference(ifmsh->beacon);
3285 if (!beacon)
3286 goto out;
3287
cd7760e6
SW		 3288 beacon_data = beacon->head;
3289 beacon_data_len = beacon->head_len;
73da7d5b
SW		 3290 } else {
3291 WARN_ON(1);
3292 goto out;
3293 }
3294
10d78f27
MK		 3295 if (!beacon->csa_counter_offsets[0])
3296 goto out;
3297
af296bdb 3298 if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
73da7d5b
SW		 3299 goto out;
3300
af296bdb 3301 if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
73da7d5b
SW		 3302 ret = true;
3303 out:
3304 rcu_read_unlock();
3305
3306 return ret;
3307}
3308EXPORT_SYMBOL(ieee80211_csa_is_complete);
3309
6ec8c332
AO		 3310static struct sk_buff *
3311__ieee80211_beacon_get(struct ieee80211_hw *hw,
3312 struct ieee80211_vif *vif,
3313 struct ieee80211_mutable_offsets *offs,
3314 bool is_template)
e2ebc74d
JB		 3315{
3316 struct ieee80211_local *local = hw_to_local(hw);
af296bdb 3317 struct beacon_data *beacon = NULL;
9d139c81 3318 struct sk_buff *skb = NULL;
e039fa4a 3319 struct ieee80211_tx_info *info;
e2ebc74d 3320 struct ieee80211_sub_if_data *sdata = NULL;
55de908a 3321 enum ieee80211_band band;
e00cfce0 3322 struct ieee80211_tx_rate_control txrc;
55de908a 3323 struct ieee80211_chanctx_conf *chanctx_conf;
1af586c9 3324 int csa_off_base = 0;
8318d78a 3325
5dfdaf58 3326 rcu_read_lock();
e2ebc74d 3327
32bfd35d 3328 sdata = vif_to_sdata(vif);
55de908a 3329 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
e2ebc74d 3330
55de908a 3331 if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
eb3e554b
FF		 3332 goto out;
3333
6ec8c332
AO		 3334 if (offs)
3335 memset(offs, 0, sizeof(*offs));
eddcbb94 3336
05c914fe 3337 if (sdata->vif.type == NL80211_IFTYPE_AP) {
d012a605 3338 struct ieee80211_if_ap *ap = &sdata->u.ap;
d012a605 3339
af296bdb 3340 beacon = rcu_dereference(ap->beacon);
3ad97fbc 3341 if (beacon) {
10d78f27 3342 if (beacon->csa_counter_offsets[0]) {
1af586c9 3343 if (!is_template)
e996ec2a 3344 __ieee80211_csa_update_counter(beacon);
1af586c9
AO		 3345
3346 ieee80211_set_csa(sdata, beacon);
3347 }
73da7d5b 3348
902acc78
JB		 3349 /*
3350 * headroom, head length,
3351 * tail length and maximum TIM length
3352 */
3353 skb = dev_alloc_skb(local->tx_headroom +
3354 beacon->head_len +
70dabeb7
FF		 3355 beacon->tail_len + 256 +
3356 local->hw.extra_beacon_tailroom);
902acc78
JB		 3357 if (!skb)
3358 goto out;
33b64eb2 3359
902acc78
JB		 3360 skb_reserve(skb, local->tx_headroom);
3361 memcpy(skb_put(skb, beacon->head_len), beacon->head,
3362 beacon->head_len);
33b64eb2 3363
6ec8c332
AO		 3364 ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
3365 is_template);
33b64eb2 3366
6ec8c332
AO		 3367 if (offs) {
3368 offs->tim_offset = beacon->head_len;
3369 offs->tim_length = skb->len - beacon->head_len;
1af586c9
AO		 3370
3371 /* for AP the csa offsets are from tail */
3372 csa_off_base = skb->len;
6ec8c332 3373 }
eddcbb94 3374
902acc78
JB		 3375 if (beacon->tail)
3376 memcpy(skb_put(skb, beacon->tail_len),
3377 beacon->tail, beacon->tail_len);
9d139c81
JB		 3378 } else
3379 goto out;
05c914fe 3380 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
46900298 3381 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
9d139c81 3382 struct ieee80211_hdr *hdr;
33b64eb2 3383
af296bdb
MK		 3384 beacon = rcu_dereference(ifibss->presp);
3385 if (!beacon)
9d139c81
JB		 3386 goto out;
3387
10d78f27 3388 if (beacon->csa_counter_offsets[0]) {
1af586c9 3389 if (!is_template)
e996ec2a 3390 __ieee80211_csa_update_counter(beacon);
cd7760e6 3391
af296bdb 3392 ieee80211_set_csa(sdata, beacon);
1af586c9 3393 }
cd7760e6 3394
af296bdb 3395 skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
70dabeb7 3396 local->hw.extra_beacon_tailroom);
9d139c81
JB		 3397 if (!skb)
3398 goto out;
c3ffeab4 3399 skb_reserve(skb, local->tx_headroom);
af296bdb
MK		 3400 memcpy(skb_put(skb, beacon->head_len), beacon->head,
3401 beacon->head_len);
9d139c81
JB		 3402
3403 hdr = (struct ieee80211_hdr *) skb->data;
e7827a70
HH		 3404 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3405 IEEE80211_STYPE_BEACON);
902acc78 3406 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
dbf498fb 3407 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
472dbc45 3408
af296bdb
MK		 3409 beacon = rcu_dereference(ifmsh->beacon);
3410 if (!beacon)
ac1bd846 3411 goto out;
ac1bd846 3412
10d78f27 3413 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 3414 if (!is_template)
3415 /* TODO: For mesh csa_counter is in TU, so
3416 * decrementing it by one isn't correct, but
3417 * for now we leave it consistent with overall
3418 * mac80211's behavior.
3419 */
e996ec2a 3420 __ieee80211_csa_update_counter(beacon);
1af586c9 3421
af296bdb 3422 ieee80211_set_csa(sdata, beacon);
1af586c9 3423 }
b8456a14 3424
dbf498fb 3425 if (ifmsh->sync_ops)
af296bdb 3426 ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
dbf498fb 3427
3b69a9c5 3428 skb = dev_alloc_skb(local->tx_headroom +
af296bdb 3429 beacon->head_len +
3f52b7e3 3430 256 + /* TIM IE */
af296bdb 3431 beacon->tail_len +
70dabeb7 3432 local->hw.extra_beacon_tailroom);
902acc78
JB		 3433 if (!skb)
3434 goto out;
2b5e1967 3435 skb_reserve(skb, local->tx_headroom);
af296bdb
MK		 3436 memcpy(skb_put(skb, beacon->head_len), beacon->head,
3437 beacon->head_len);
6ec8c332
AO		 3438 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
3439
3440 if (offs) {
af296bdb
MK		 3441 offs->tim_offset = beacon->head_len;
3442 offs->tim_length = skb->len - beacon->head_len;
6ec8c332
AO		 3443 }
3444
af296bdb
MK		 3445 memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
3446 beacon->tail_len);
9d139c81
JB		 3447 } else {
3448 WARN_ON(1);
5dfdaf58 3449 goto out;
e2ebc74d
JB		 3450 }
3451
1af586c9 3452 /* CSA offsets */
af296bdb 3453 if (offs && beacon) {
1af586c9
AO		 3454 int i;
3455
3456 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
af296bdb 3457 u16 csa_off = beacon->csa_counter_offsets[i];
1af586c9
AO		 3458
3459 if (!csa_off)
3460 continue;
3461
3462 offs->csa_counter_offs[i] = csa_off_base + csa_off;
3463 }
3464 }
3465
4bf88530 3466 band = chanctx_conf->def.chan->band;
55de908a 3467
e039fa4a
JB		 3468 info = IEEE80211_SKB_CB(skb);
3469
3b8d81e0 3470 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
e00cfce0 3471 info->flags |= IEEE80211_TX_CTL_NO_ACK;
e039fa4a 3472 info->band = band;
e00cfce0
JM		 3473
3474 memset(&txrc, 0, sizeof(txrc));
3475 txrc.hw = hw;
e31583cd 3476 txrc.sband = local->hw.wiphy->bands[band];
e00cfce0
JM		 3477 txrc.bss_conf = &sdata->vif.bss_conf;
3478 txrc.skb = skb;
3479 txrc.reported_rate.idx = -1;
37eb0b16 3480 txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
e31583cd 3481 if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1)
37eb0b16
JM		 3482 txrc.max_rate_idx = -1;
3483 else
3484 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
8f0729b1 3485 txrc.bss = true;
e00cfce0 3486 rate_control_get_rate(sdata, NULL, &txrc);
e039fa4a
JB		 3487
3488 info->control.vif = vif;
f591fa5d 3489
a472e71b
JL		 3490 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
3491 IEEE80211_TX_CTL_ASSIGN_SEQ |
3492 IEEE80211_TX_CTL_FIRST_FRAGMENT;
e6a9854b 3493 out:
5dfdaf58 3494 rcu_read_unlock();
e2ebc74d 3495 return skb;
6ec8c332
AO		 3496
3497}
3498
3499struct sk_buff *
3500ieee80211_beacon_get_template(struct ieee80211_hw *hw,
3501 struct ieee80211_vif *vif,
3502 struct ieee80211_mutable_offsets *offs)
3503{
3504 return __ieee80211_beacon_get(hw, vif, offs, true);
3505}
3506EXPORT_SYMBOL(ieee80211_beacon_get_template);
3507
3508struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
3509 struct ieee80211_vif *vif,
3510 u16 *tim_offset, u16 *tim_length)
3511{
3512 struct ieee80211_mutable_offsets offs = {};
3513 struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
3514
3515 if (tim_offset)
3516 *tim_offset = offs.tim_offset;
3517
3518 if (tim_length)
3519 *tim_length = offs.tim_length;
3520
3521 return bcn;
e2ebc74d 3522}
eddcbb94 3523EXPORT_SYMBOL(ieee80211_beacon_get_tim);
e2ebc74d 3524
02945821
AN		 3525struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
3526 struct ieee80211_vif *vif)
3527{
3528 struct ieee80211_if_ap *ap = NULL;
aa7a0080
ES		 3529 struct sk_buff *skb = NULL;
3530 struct probe_resp *presp = NULL;
02945821
AN		 3531 struct ieee80211_hdr *hdr;
3532 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3533
3534 if (sdata->vif.type != NL80211_IFTYPE_AP)
3535 return NULL;
3536
3537 rcu_read_lock();
3538
3539 ap = &sdata->u.ap;
3540 presp = rcu_dereference(ap->probe_resp);
3541 if (!presp)
3542 goto out;
3543
aa7a0080 3544 skb = dev_alloc_skb(presp->len);
02945821
AN		 3545 if (!skb)
3546 goto out;
3547
aa7a0080
ES		 3548 memcpy(skb_put(skb, presp->len), presp->data, presp->len);
3549
02945821
AN		 3550 hdr = (struct ieee80211_hdr *) skb->data;
3551 memset(hdr->addr1, 0, sizeof(hdr->addr1));
3552
3553out:
3554 rcu_read_unlock();
3555 return skb;
3556}
3557EXPORT_SYMBOL(ieee80211_proberesp_get);
3558
7044cc56
KV		 3559struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
3560 struct ieee80211_vif *vif)
3561{
3562 struct ieee80211_sub_if_data *sdata;
3563 struct ieee80211_if_managed *ifmgd;
3564 struct ieee80211_pspoll *pspoll;
3565 struct ieee80211_local *local;
3566 struct sk_buff *skb;
3567
3568 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3569 return NULL;
3570
3571 sdata = vif_to_sdata(vif);
3572 ifmgd = &sdata->u.mgd;
3573 local = sdata->local;
3574
3575 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
d15b8459 3576 if (!skb)
7044cc56 3577 return NULL;
d15b8459 3578
7044cc56
KV		 3579 skb_reserve(skb, local->hw.extra_tx_headroom);
3580
3581 pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
3582 memset(pspoll, 0, sizeof(*pspoll));
3583 pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
3584 IEEE80211_STYPE_PSPOLL);
3585 pspoll->aid = cpu_to_le16(ifmgd->aid);
3586
3587 /* aid in PS-Poll has its two MSBs each set to 1 */
3588 pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
3589
3590 memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
3591 memcpy(pspoll->ta, vif->addr, ETH_ALEN);
3592
3593 return skb;
3594}
3595EXPORT_SYMBOL(ieee80211_pspoll_get);
3596
3597struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
3598 struct ieee80211_vif *vif)
3599{
3600 struct ieee80211_hdr_3addr *nullfunc;
3601 struct ieee80211_sub_if_data *sdata;
3602 struct ieee80211_if_managed *ifmgd;
3603 struct ieee80211_local *local;
3604 struct sk_buff *skb;
3605
3606 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3607 return NULL;
3608
3609 sdata = vif_to_sdata(vif);
3610 ifmgd = &sdata->u.mgd;
3611 local = sdata->local;
3612
3613 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
d15b8459 3614 if (!skb)
7044cc56 3615 return NULL;
d15b8459 3616
7044cc56
KV		 3617 skb_reserve(skb, local->hw.extra_tx_headroom);
3618
3619 nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
3620 sizeof(*nullfunc));
3621 memset(nullfunc, 0, sizeof(*nullfunc));
3622 nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
3623 IEEE80211_STYPE_NULLFUNC |
3624 IEEE80211_FCTL_TODS);
3625 memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
3626 memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
3627 memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
3628
3629 return skb;
3630}
3631EXPORT_SYMBOL(ieee80211_nullfunc_get);
3632
05e54ea6 3633struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
a344d677 3634 const u8 *src_addr,
05e54ea6 3635 const u8 *ssid, size_t ssid_len,
b9a9ada1 3636 size_t tailroom)
05e54ea6 3637{
a344d677 3638 struct ieee80211_local *local = hw_to_local(hw);
05e54ea6
KV		 3639 struct ieee80211_hdr_3addr *hdr;
3640 struct sk_buff *skb;
3641 size_t ie_ssid_len;
3642 u8 *pos;
3643
05e54ea6
KV		 3644 ie_ssid_len = 2 + ssid_len;
3645
3646 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
b9a9ada1 3647 ie_ssid_len + tailroom);
d15b8459 3648 if (!skb)
05e54ea6 3649 return NULL;
05e54ea6
KV		 3650
3651 skb_reserve(skb, local->hw.extra_tx_headroom);
3652
3653 hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
3654 memset(hdr, 0, sizeof(*hdr));
3655 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3656 IEEE80211_STYPE_PROBE_REQ);
e83e6541 3657 eth_broadcast_addr(hdr->addr1);
a344d677 3658 memcpy(hdr->addr2, src_addr, ETH_ALEN);
e83e6541 3659 eth_broadcast_addr(hdr->addr3);
05e54ea6
KV		 3660
3661 pos = skb_put(skb, ie_ssid_len);
3662 *pos++ = WLAN_EID_SSID;
3663 *pos++ = ssid_len;
88c868c4 3664 if (ssid_len)
05e54ea6
KV		 3665 memcpy(pos, ssid, ssid_len);
3666 pos += ssid_len;
3667
05e54ea6
KV		 3668 return skb;
3669}
3670EXPORT_SYMBOL(ieee80211_probereq_get);
3671
32bfd35d 3672void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 3673 const void *frame, size_t frame_len,
e039fa4a 3674 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB		 3675 struct ieee80211_rts *rts)
3676{
3677 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 3678
065e9605
HH		 3679 rts->frame_control =
3680 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
32bfd35d
JB		 3681 rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
3682 frame_txctl);
e2ebc74d
JB		 3683 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
3684 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
3685}
3686EXPORT_SYMBOL(ieee80211_rts_get);
3687
32bfd35d 3688void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 3689 const void *frame, size_t frame_len,
e039fa4a 3690 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB		 3691 struct ieee80211_cts *cts)
3692{
3693 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 3694
065e9605
HH		 3695 cts->frame_control =
3696 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
32bfd35d
JB		 3697 cts->duration = ieee80211_ctstoself_duration(hw, vif,
3698 frame_len, frame_txctl);
e2ebc74d
JB		 3699 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
3700}
3701EXPORT_SYMBOL(ieee80211_ctstoself_get);
3702
3703struct sk_buff *
32bfd35d 3704ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
e039fa4a 3705 struct ieee80211_vif *vif)
e2ebc74d
JB		 3706{
3707 struct ieee80211_local *local = hw_to_local(hw);
747cf5e9 3708 struct sk_buff *skb = NULL;
5cf121c3 3709 struct ieee80211_tx_data tx;
e2ebc74d 3710 struct ieee80211_sub_if_data *sdata;
d012a605 3711 struct ps_data *ps;
e039fa4a 3712 struct ieee80211_tx_info *info;
55de908a 3713 struct ieee80211_chanctx_conf *chanctx_conf;
e2ebc74d 3714
32bfd35d 3715 sdata = vif_to_sdata(vif);
5dfdaf58 3716
5dfdaf58 3717 rcu_read_lock();
55de908a 3718 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
5dfdaf58 3719
d012a605
MP		 3720 if (!chanctx_conf)
3721 goto out;
3722
3723 if (sdata->vif.type == NL80211_IFTYPE_AP) {
3724 struct beacon_data *beacon =
3725 rcu_dereference(sdata->u.ap.beacon);
3726
3727 if (!beacon || !beacon->head)
3728 goto out;
3729
3730 ps = &sdata->u.ap.ps;
3f52b7e3
MP		 3731 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
3732 ps = &sdata->u.mesh.ps;
d012a605 3733 } else {
747cf5e9 3734 goto out;
d012a605 3735 }
5dfdaf58 3736
d012a605 3737 if (ps->dtim_count != 0 || !ps->dtim_bc_mc)
747cf5e9 3738 goto out; /* send buffered bc/mc only after DTIM beacon */
e039fa4a 3739
e2ebc74d 3740 while (1) {
d012a605 3741 skb = skb_dequeue(&ps->bc_buf);
e2ebc74d 3742 if (!skb)
747cf5e9 3743 goto out;
e2ebc74d
JB		 3744 local->total_ps_buffered--;
3745
d012a605 3746 if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) {
e2ebc74d
JB		 3747 struct ieee80211_hdr *hdr =
3748 (struct ieee80211_hdr *) skb->data;
3749 /* more buffered multicast/broadcast frames ==> set
3750 * MoreData flag in IEEE 802.11 header to inform PS
3751 * STAs */
3752 hdr->frame_control |=
3753 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
3754 }
3755
112c44b2 3756 if (sdata->vif.type == NL80211_IFTYPE_AP)
7cbf9d01 3757 sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
7c10770f 3758 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
e2ebc74d
JB		 3759 break;
3760 dev_kfree_skb_any(skb);
3761 }
e039fa4a
JB		 3762
3763 info = IEEE80211_SKB_CB(skb);
3764
5cf121c3 3765 tx.flags |= IEEE80211_TX_PS_BUFFERED;
4bf88530 3766 info->band = chanctx_conf->def.chan->band;
e2ebc74d 3767
97b045d6 3768 if (invoke_tx_handlers(&tx))
e2ebc74d 3769 skb = NULL;
97b045d6 3770 out:
d0709a65 3771 rcu_read_unlock();
e2ebc74d
JB		 3772
3773 return skb;
3774}
3775EXPORT_SYMBOL(ieee80211_get_buffered_bc);
3b8d81e0 3776
b6da911b
LK		 3777int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
3778{
3779 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
3780 struct ieee80211_sub_if_data *sdata = sta->sdata;
3781 struct ieee80211_local *local = sdata->local;
3782 int ret;
3783 u32 queues;
3784
3785 lockdep_assert_held(&local->sta_mtx);
3786
3787 /* only some cases are supported right now */
3788 switch (sdata->vif.type) {
3789 case NL80211_IFTYPE_STATION:
3790 case NL80211_IFTYPE_AP:
3791 case NL80211_IFTYPE_AP_VLAN:
3792 break;
3793 default:
3794 WARN_ON(1);
3795 return -EINVAL;
3796 }
3797
3798 if (WARN_ON(tid >= IEEE80211_NUM_UPS))
3799 return -EINVAL;
3800
3801 if (sta->reserved_tid == tid) {
3802 ret = 0;
3803 goto out;
3804 }
3805
3806 if (sta->reserved_tid != IEEE80211_TID_UNRESERVED) {
3807 sdata_err(sdata, "TID reservation already active\n");
3808 ret = -EALREADY;
3809 goto out;
3810 }
3811
3812 ieee80211_stop_vif_queues(sdata->local, sdata,
3813 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
3814
3815 synchronize_net();
3816
3817 /* Tear down BA sessions so we stop aggregating on this TID */
30686bf7 3818 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION)) {
b6da911b
LK		 3819 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
3820 __ieee80211_stop_tx_ba_session(sta, tid,
3821 AGG_STOP_LOCAL_REQUEST);
3822 }
3823
3824 queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
3b24f4c6 3825 __ieee80211_flush_queues(local, sdata, queues, false);
b6da911b
LK		 3826
3827 sta->reserved_tid = tid;
3828
3829 ieee80211_wake_vif_queues(local, sdata,
3830 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
3831
30686bf7 3832 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION))
b6da911b
LK		 3833 clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
3834
3835 ret = 0;
3836 out:
3837 return ret;
3838}
3839EXPORT_SYMBOL(ieee80211_reserve_tid);
3840
3841void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
3842{
3843 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
3844 struct ieee80211_sub_if_data *sdata = sta->sdata;
3845
3846 lockdep_assert_held(&sdata->local->sta_mtx);
3847
3848 /* only some cases are supported right now */
3849 switch (sdata->vif.type) {
3850 case NL80211_IFTYPE_STATION:
3851 case NL80211_IFTYPE_AP:
3852 case NL80211_IFTYPE_AP_VLAN:
3853 break;
3854 default:
3855 WARN_ON(1);
3856 return;
3857 }
3858
3859 if (tid != sta->reserved_tid) {
3860 sdata_err(sdata, "TID to unreserve (%d) isn't reserved\n", tid);
3861 return;
3862 }
3863
3864 sta->reserved_tid = IEEE80211_TID_UNRESERVED;
3865}
3866EXPORT_SYMBOL(ieee80211_unreserve_tid);
3867
55de908a
JB		 3868void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
3869 struct sk_buff *skb, int tid,
3870 enum ieee80211_band band)
3b8d81e0 3871{
353d09c6 3872 int ac = ieee802_1d_to_ac[tid & 7];
3a25a8c8 3873
3b8d81e0
JB		 3874 skb_set_mac_header(skb, 0);
3875 skb_set_network_header(skb, 0);
3876 skb_set_transport_header(skb, 0);
3877
3a25a8c8 3878 skb_set_queue_mapping(skb, ac);
cf6bb79a 3879 skb->priority = tid;
cf0277e7 3880
89afe614
JB		 3881 skb->dev = sdata->dev;
3882
3d34deb6
JB		 3883 /*
3884 * The other path calling ieee80211_xmit is from the tasklet,
3885 * and while we can handle concurrent transmissions locking
3886 * requirements are that we do not come into tx with bhs on.
3887 */
3888 local_bh_disable();
73c4e195 3889 IEEE80211_SKB_CB(skb)->band = band;
7c10770f 3890 ieee80211_xmit(sdata, NULL, skb);
3d34deb6 3891 local_bh_enable();
3b8d81e0 3892}
Linux kernel - Deliverables
This page took 1.301605 seconds and 5 git commands to generate.