projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
mac80211: allow checksum offload only in fast-xmit
[linux-2.6-block.git] / net / mac80211 / tx.c
CommitLineData
e2ebc74d
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
d98ad83e 6 * Copyright 2013-2014 Intel Mobile Communications GmbH
e2ebc74d
JB		 7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 *
12 *
13 * Transmit and frame generation functions.
14 */
15
16#include <linux/kernel.h>
17#include <linux/slab.h>
18#include <linux/skbuff.h>
19#include <linux/etherdevice.h>
20#include <linux/bitmap.h>
d4e46a3d 21#include <linux/rcupdate.h>
bc3b2d7f 22#include <linux/export.h>
881d966b 23#include <net/net_namespace.h>
e2ebc74d
JB		 24#include <net/ieee80211_radiotap.h>
25#include <net/cfg80211.h>
26#include <net/mac80211.h>
27#include <asm/unaligned.h>
28
29#include "ieee80211_i.h"
24487981 30#include "driver-ops.h"
2c8dccc7 31#include "led.h"
33b64eb2 32#include "mesh.h"
e2ebc74d
JB		 33#include "wep.h"
34#include "wpa.h"
35#include "wme.h"
2c8dccc7 36#include "rate.h"
e2ebc74d 37
e2ebc74d
JB		 38/* misc utils */
39
252b86c4
JB		 40static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
41 struct sk_buff *skb, int group_addr,
03f93c3d 42 int next_frag_len)
e2ebc74d 43{
2103dec1 44 int rate, mrate, erp, dur, i, shift = 0;
2e92e6f2 45 struct ieee80211_rate *txrate;
e2ebc74d 46 struct ieee80211_local *local = tx->local;
8318d78a 47 struct ieee80211_supported_band *sband;
358c8d9d 48 struct ieee80211_hdr *hdr;
252b86c4 49 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2103dec1
SW		 50 struct ieee80211_chanctx_conf *chanctx_conf;
51 u32 rate_flags = 0;
52
53 rcu_read_lock();
54 chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
55 if (chanctx_conf) {
56 shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
57 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
58 }
59 rcu_read_unlock();
e6a9854b
JB		 60
61 /* assume HW handles this */
336004e2 62 if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
e6a9854b
JB		 63 return 0;
64
65 /* uh huh? */
0d528d85 66 if (WARN_ON_ONCE(tx->rate.idx < 0))
e6a9854b 67 return 0;
e2ebc74d 68
2d56577b 69 sband = local->hw.wiphy->bands[info->band];
0d528d85 70 txrate = &sband->bitrates[tx->rate.idx];
8318d78a 71
e6a9854b 72 erp = txrate->flags & IEEE80211_RATE_ERP_G;
e2ebc74d
JB		 73
74 /*
75 * data and mgmt (except PS Poll):
76 * - during CFP: 32768
77 * - during contention period:
78 * if addr1 is group address: 0
79 * if more fragments = 0 and addr1 is individual address: time to
80 * transmit one ACK plus SIFS
81 * if more fragments = 1 and addr1 is individual address: time to
82 * transmit next fragment plus 2 x ACK plus 3 x SIFS
83 *
84 * IEEE 802.11, 9.6:
85 * - control response frame (CTS or ACK) shall be transmitted using the
86 * same rate as the immediately previous frame in the frame exchange
87 * sequence, if this rate belongs to the PHY mandatory rates, or else
88 * at the highest possible rate belonging to the PHY rates in the
89 * BSSBasicRateSet
90 */
252b86c4 91 hdr = (struct ieee80211_hdr *)skb->data;
358c8d9d 92 if (ieee80211_is_ctl(hdr->frame_control)) {
e2ebc74d 93 /* TODO: These control frames are not currently sent by
ccd7b362 94 * mac80211, but should they be implemented, this function
e2ebc74d
JB		 95 * needs to be updated to support duration field calculation.
96 *
97 * RTS: time needed to transmit pending data/mgmt frame plus
98 * one CTS frame plus one ACK frame plus 3 x SIFS
99 * CTS: duration of immediately previous RTS minus time
100 * required to transmit CTS and its SIFS
101 * ACK: 0 if immediately previous directed data/mgmt had
102 * more=0, with more=1 duration in ACK frame is duration
103 * from previous frame minus time needed to transmit ACK
104 * and its SIFS
105 * PS Poll: BIT(15) | BIT(14) | aid
106 */
107 return 0;
108 }
109
110 /* data/mgmt */
111 if (0 /* FIX: data/mgmt during CFP */)
03f93c3d 112 return cpu_to_le16(32768);
e2ebc74d
JB		 113
114 if (group_addr) /* Group address as the destination - no ACK */
115 return 0;
116
117 /* Individual destination address:
118 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
119 * CTS and ACK frames shall be transmitted using the highest rate in
120 * basic rate set that is less than or equal to the rate of the
121 * immediately previous frame and that is using the same modulation
122 * (CCK or OFDM). If no basic rate set matches with these requirements,
123 * the highest mandatory rate of the PHY that is less than or equal to
124 * the rate of the previous frame is used.
125 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
126 */
127 rate = -1;
8318d78a
JB		 128 /* use lowest available if everything fails */
129 mrate = sband->bitrates[0].bitrate;
130 for (i = 0; i < sband->n_bitrates; i++) {
131 struct ieee80211_rate *r = &sband->bitrates[i];
e2ebc74d 132
8318d78a
JB		 133 if (r->bitrate > txrate->bitrate)
134 break;
e2ebc74d 135
2103dec1
SW		 136 if ((rate_flags & r->flags) != rate_flags)
137 continue;
138
bda3933a 139 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
2103dec1 140 rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
8318d78a
JB		 141
142 switch (sband->band) {
143 case IEEE80211_BAND_2GHZ: {
144 u32 flag;
145 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
146 flag = IEEE80211_RATE_MANDATORY_G;
147 else
148 flag = IEEE80211_RATE_MANDATORY_B;
149 if (r->flags & flag)
150 mrate = r->bitrate;
151 break;
152 }
153 case IEEE80211_BAND_5GHZ:
154 if (r->flags & IEEE80211_RATE_MANDATORY_A)
155 mrate = r->bitrate;
156 break;
3a0c52a6
VK		 157 case IEEE80211_BAND_60GHZ:
158 /* TODO, for now fall through */
8318d78a
JB		 159 case IEEE80211_NUM_BANDS:
160 WARN_ON(1);
161 break;
162 }
e2ebc74d
JB		 163 }
164 if (rate == -1) {
165 /* No matching basic rate found; use highest suitable mandatory
166 * PHY rate */
2103dec1 167 rate = DIV_ROUND_UP(mrate, 1 << shift);
e2ebc74d
JB		 168 }
169
6674f210
SW		 170 /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
171 if (ieee80211_is_data_qos(hdr->frame_control) &&
c26a0e10 172 *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
6674f210
SW		 173 dur = 0;
174 else
175 /* Time needed to transmit ACK
176 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
177 * to closest integer */
4ee73f33 178 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
438b61b7
SW		 179 tx->sdata->vif.bss_conf.use_short_preamble,
180 shift);
e2ebc74d
JB		 181
182 if (next_frag_len) {
183 /* Frame is fragmented: duration increases with time needed to
184 * transmit next fragment plus ACK and 2 x SIFS. */
185 dur *= 2; /* ACK + SIFS */
186 /* next fragment */
4ee73f33 187 dur += ieee80211_frame_duration(sband->band, next_frag_len,
8318d78a 188 txrate->bitrate, erp,
438b61b7
SW		 189 tx->sdata->vif.bss_conf.use_short_preamble,
190 shift);
e2ebc74d
JB		 191 }
192
03f93c3d 193 return cpu_to_le16(dur);
e2ebc74d
JB		 194}
195
e2ebc74d 196/* tx handlers */
5c1b98a5
KV		 197static ieee80211_tx_result debug_noinline
198ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
199{
200 struct ieee80211_local *local = tx->local;
0c74211d 201 struct ieee80211_if_managed *ifmgd;
5c1b98a5
KV		 202
203 /* driver doesn't support power save */
204 if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
205 return TX_CONTINUE;
206
207 /* hardware does dynamic power save */
208 if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
209 return TX_CONTINUE;
210
211 /* dynamic power save disabled */
212 if (local->hw.conf.dynamic_ps_timeout <= 0)
213 return TX_CONTINUE;
214
215 /* we are scanning, don't enable power save */
216 if (local->scanning)
217 return TX_CONTINUE;
218
219 if (!local->ps_sdata)
220 return TX_CONTINUE;
221
222 /* No point if we're going to suspend */
223 if (local->quiescing)
224 return TX_CONTINUE;
225
0c74211d
KV		 226 /* dynamic ps is supported only in managed mode */
227 if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
228 return TX_CONTINUE;
229
230 ifmgd = &tx->sdata->u.mgd;
231
232 /*
233 * Don't wakeup from power save if u-apsd is enabled, voip ac has
234 * u-apsd enabled and the frame is in voip class. This effectively
235 * means that even if all access categories have u-apsd enabled, in
236 * practise u-apsd is only used with the voip ac. This is a
237 * workaround for the case when received voip class packets do not
238 * have correct qos tag for some reason, due the network or the
239 * peer application.
240 *
dc41e4d4 241 * Note: ifmgd->uapsd_queues access is racy here. If the value is
0c74211d
KV		 242 * changed via debugfs, user needs to reassociate manually to have
243 * everything in sync.
244 */
4875d30d
JB		 245 if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
246 (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
247 skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
0c74211d
KV		 248 return TX_CONTINUE;
249
5c1b98a5
KV		 250 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
251 ieee80211_stop_queues_by_reason(&local->hw,
445ea4e8 252 IEEE80211_MAX_QUEUE_MAP,
cca07b00
LC		 253 IEEE80211_QUEUE_STOP_REASON_PS,
254 false);
db28569a 255 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
5c1b98a5
KV		 256 ieee80211_queue_work(&local->hw,
257 &local->dynamic_ps_disable_work);
258 }
259
5db1c07c
LC		 260 /* Don't restart the timer if we're not disassociated */
261 if (!ifmgd->associated)
262 return TX_CONTINUE;
263
5c1b98a5
KV		 264 mod_timer(&local->dynamic_ps_timer, jiffies +
265 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
266
267 return TX_CONTINUE;
268}
e2ebc74d 269
d9e8a70f 270static ieee80211_tx_result debug_noinline
5cf121c3 271ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
e2ebc74d 272{
358c8d9d 273
e039fa4a 274 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
e039fa4a 275 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
c2c98fde 276 bool assoc = false;
e2ebc74d 277
e039fa4a 278 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
9ae54c84 279 return TX_CONTINUE;
58d4185e 280
b23b025f
BG		 281 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
282 test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
a9a6ffff
KV		 283 !ieee80211_is_probe_req(hdr->frame_control) &&
284 !ieee80211_is_nullfunc(hdr->frame_control))
285 /*
286 * When software scanning only nullfunc frames (to notify
287 * the sleep state to the AP) and probe requests (for the
288 * active scan) are allowed, all other frames should not be
289 * sent and we should not get here, but if we do
290 * nonetheless, drop them to avoid sending them
291 * off-channel. See the link below and
292 * ieee80211_start_scan() for more.
293 *
294 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
295 */
9ae54c84 296 return TX_DROP;
e2ebc74d 297
239281f8
RL		 298 if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
299 return TX_CONTINUE;
300
1be7fe8d
BJ		 301 if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
302 return TX_CONTINUE;
303
05c914fe 304 if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
33b64eb2
LCC		 305 return TX_CONTINUE;
306
5cf121c3 307 if (tx->flags & IEEE80211_TX_PS_BUFFERED)
9ae54c84 308 return TX_CONTINUE;
e2ebc74d 309
c2c98fde
JB		 310 if (tx->sta)
311 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
e2ebc74d 312
5cf121c3 313 if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
c2c98fde 314 if (unlikely(!assoc &&
358c8d9d 315 ieee80211_is_data(hdr->frame_control))) {
e2ebc74d 316#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
bdcbd8e0
JB		 317 sdata_info(tx->sdata,
318 "dropped data frame to not associated station %pM\n",
319 hdr->addr1);
320#endif
e2ebc74d 321 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
9ae54c84 322 return TX_DROP;
e2ebc74d 323 }
29623892
JB		 324 } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
325 ieee80211_is_data(hdr->frame_control) &&
030ef8f8 326 !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) {
29623892
JB		 327 /*
328 * No associated STAs - no need to send multicast
329 * frames.
330 */
331 return TX_DROP;
e2ebc74d
JB		 332 }
333
9ae54c84 334 return TX_CONTINUE;
e2ebc74d
JB		 335}
336
e2ebc74d
JB		 337/* This function is called whenever the AP is about to exceed the maximum limit
338 * of buffered frames for power saving STAs. This situation should not really
339 * happen often during normal operation, so dropping the oldest buffered packet
340 * from each queue should be OK to make some room for new frames. */
341static void purge_old_ps_buffers(struct ieee80211_local *local)
342{
343 int total = 0, purged = 0;
344 struct sk_buff *skb;
345 struct ieee80211_sub_if_data *sdata;
346 struct sta_info *sta;
347
79010420 348 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
d012a605
MP		 349 struct ps_data *ps;
350
351 if (sdata->vif.type == NL80211_IFTYPE_AP)
352 ps = &sdata->u.ap.ps;
3f52b7e3
MP		 353 else if (ieee80211_vif_is_mesh(&sdata->vif))
354 ps = &sdata->u.mesh.ps;
d012a605 355 else
e2ebc74d 356 continue;
d012a605
MP		 357
358 skb = skb_dequeue(&ps->bc_buf);
e2ebc74d
JB		 359 if (skb) {
360 purged++;
361 dev_kfree_skb(skb);
362 }
d012a605 363 total += skb_queue_len(&ps->bc_buf);
e2ebc74d 364 }
e2ebc74d 365
948d887d
JB		 366 /*
367 * Drop one frame from each station from the lowest-priority
368 * AC that has frames at all.
369 */
d0709a65 370 list_for_each_entry_rcu(sta, &local->sta_list, list) {
948d887d
JB		 371 int ac;
372
373 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
374 skb = skb_dequeue(&sta->ps_tx_buf[ac]);
375 total += skb_queue_len(&sta->ps_tx_buf[ac]);
376 if (skb) {
377 purged++;
c3e7724b 378 ieee80211_free_txskb(&local->hw, skb);
948d887d
JB		 379 break;
380 }
e2ebc74d 381 }
e2ebc74d 382 }
d0709a65 383
e2ebc74d 384 local->total_ps_buffered = total;
bdcbd8e0 385 ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
e2ebc74d
JB		 386}
387
9ae54c84 388static ieee80211_tx_result
5cf121c3 389ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 390{
e039fa4a 391 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 392 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d012a605 393 struct ps_data *ps;
e039fa4a 394
7d54d0dd
JB		 395 /*
396 * broadcast/multicast frame
397 *
3f52b7e3 398 * If any of the associated/peer stations is in power save mode,
7d54d0dd
JB		 399 * the frame is buffered to be sent after DTIM beacon frame.
400 * This is done either by the hardware or us.
401 */
402
3f52b7e3 403 /* powersaving STAs currently only in AP/VLAN/mesh mode */
d012a605
MP		 404 if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
405 tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
406 if (!tx->sdata->bss)
407 return TX_CONTINUE;
408
409 ps = &tx->sdata->bss->ps;
3f52b7e3
MP		 410 } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
411 ps = &tx->sdata->u.mesh.ps;
d012a605 412 } else {
3e122be0 413 return TX_CONTINUE;
d012a605
MP		 414 }
415
3e122be0
JB		 416
417 /* no buffering for ordered frames */
358c8d9d 418 if (ieee80211_has_order(hdr->frame_control))
9ae54c84 419 return TX_CONTINUE;
7d54d0dd 420
08b99399
JB		 421 if (ieee80211_is_probe_req(hdr->frame_control))
422 return TX_CONTINUE;
423
f4d57941
JB		 424 if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
425 info->hw_queue = tx->sdata->vif.cab_queue;
426
7d54d0dd 427 /* no stations in PS mode */
d012a605 428 if (!atomic_read(&ps->num_sta_ps))
9ae54c84 429 return TX_CONTINUE;
7d54d0dd 430
62b517cb 431 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
62b1208e 432
62b517cb
JB		 433 /* device releases frame after DTIM beacon */
434 if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
62b1208e 435 return TX_CONTINUE;
62b1208e 436
7d54d0dd 437 /* buffered in mac80211 */
62b1208e
JB		 438 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
439 purge_old_ps_buffers(tx->local);
440
d012a605 441 if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
bdcbd8e0
JB		 442 ps_dbg(tx->sdata,
443 "BC TX buffer full - dropping the oldest frame\n");
d012a605 444 dev_kfree_skb(skb_dequeue(&ps->bc_buf));
62b1208e
JB		 445 } else
446 tx->local->total_ps_buffered++;
e2ebc74d 447
d012a605 448 skb_queue_tail(&ps->bc_buf, tx->skb);
7d54d0dd 449
62b1208e 450 return TX_QUEUED;
e2ebc74d
JB		 451}
452
fb733336
JM		 453static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
454 struct sk_buff *skb)
455{
456 if (!ieee80211_is_mgmt(fc))
457 return 0;
458
c2c98fde 459 if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
fb733336
JM		 460 return 0;
461
d8ca16db 462 if (!ieee80211_is_robust_mgmt_frame(skb))
fb733336
JM		 463 return 0;
464
465 return 1;
466}
467
9ae54c84 468static ieee80211_tx_result
5cf121c3 469ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d
JB		 470{
471 struct sta_info *sta = tx->sta;
e039fa4a 472 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
08b99399 473 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
3393a608 474 struct ieee80211_local *local = tx->local;
e2ebc74d 475
02f2f1a9 476 if (unlikely(!sta))
9ae54c84 477 return TX_CONTINUE;
e2ebc74d 478
c2c98fde 479 if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
5ac2e350
JB		 480 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
481 test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
02f2f1a9 482 !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
948d887d
JB		 483 int ac = skb_get_queue_mapping(tx->skb);
484
08b99399
JB		 485 if (ieee80211_is_mgmt(hdr->frame_control) &&
486 !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
487 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
488 return TX_CONTINUE;
489 }
490
bdcbd8e0
JB		 491 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
492 sta->sta.addr, sta->sta.aid, ac);
e2ebc74d
JB		 493 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
494 purge_old_ps_buffers(tx->local);
1d147bfa
EG		 495
496 /* sync with ieee80211_sta_ps_deliver_wakeup */
497 spin_lock(&sta->ps_lock);
498 /*
499 * STA woke up the meantime and all the frames on ps_tx_buf have
500 * been queued to pending queue. No reordering can happen, go
501 * ahead and Tx the packet.
502 */
503 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
5ac2e350
JB		 504 !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
505 !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
1d147bfa
EG		 506 spin_unlock(&sta->ps_lock);
507 return TX_CONTINUE;
508 }
509
948d887d
JB		 510 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
511 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
bdcbd8e0
JB		 512 ps_dbg(tx->sdata,
513 "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
514 sta->sta.addr, ac);
c3e7724b 515 ieee80211_free_txskb(&local->hw, old);
e2ebc74d
JB		 516 } else
517 tx->local->total_ps_buffered++;
004c872e 518
e039fa4a 519 info->control.jiffies = jiffies;
5061b0c2 520 info->control.vif = &tx->sdata->vif;
8f77f384 521 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
03c8c06f 522 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
948d887d 523 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
1d147bfa 524 spin_unlock(&sta->ps_lock);
3393a608
JO		 525
526 if (!timer_pending(&local->sta_cleanup))
527 mod_timer(&local->sta_cleanup,
528 round_jiffies(jiffies +
529 STA_INFO_CLEANUP_INTERVAL));
530
c868cb35
JB		 531 /*
532 * We queued up some frames, so the TIM bit might
533 * need to be set, recalculate it.
534 */
535 sta_info_recalc_tim(sta);
536
9ae54c84 537 return TX_QUEUED;
bdcbd8e0
JB		 538 } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
539 ps_dbg(tx->sdata,
540 "STA %pM in PS mode, but polling/in SP -> send frame\n",
541 sta->sta.addr);
e2ebc74d 542 }
e2ebc74d 543
9ae54c84 544 return TX_CONTINUE;
e2ebc74d
JB		 545}
546
d9e8a70f 547static ieee80211_tx_result debug_noinline
5cf121c3 548ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 549{
5cf121c3 550 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
9ae54c84 551 return TX_CONTINUE;
e2ebc74d 552
5cf121c3 553 if (tx->flags & IEEE80211_TX_UNICAST)
e2ebc74d
JB		 554 return ieee80211_tx_h_unicast_ps_buf(tx);
555 else
556 return ieee80211_tx_h_multicast_ps_buf(tx);
557}
558
a621fa4d
JB		 559static ieee80211_tx_result debug_noinline
560ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
561{
562 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
563
af61a165
JB		 564 if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
565 if (tx->sdata->control_port_no_encrypt)
566 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
567 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
9c1c98a3 568 info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
af61a165 569 }
a621fa4d
JB		 570
571 return TX_CONTINUE;
572}
573
d9e8a70f 574static ieee80211_tx_result debug_noinline
5cf121c3 575ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
e2ebc74d 576{
46e6de15 577 struct ieee80211_key *key;
e039fa4a 578 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 579 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d4e46a3d 580
3b8d81e0 581 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
e2ebc74d 582 tx->key = NULL;
2475b1cc
MS		 583 else if (tx->sta &&
584 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
d4e46a3d 585 tx->key = key;
3cfcf6ac 586 else if (ieee80211_is_mgmt(hdr->frame_control) &&
ecbcd324 587 is_multicast_ether_addr(hdr->addr1) &&
d8ca16db 588 ieee80211_is_robust_mgmt_frame(tx->skb) &&
3cfcf6ac
JM		 589 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
590 tx->key = key;
f7e0104c
JB		 591 else if (is_multicast_ether_addr(hdr->addr1) &&
592 (key = rcu_dereference(tx->sdata->default_multicast_key)))
593 tx->key = key;
594 else if (!is_multicast_ether_addr(hdr->addr1) &&
595 (key = rcu_dereference(tx->sdata->default_unicast_key)))
d4e46a3d 596 tx->key = key;
e8f4fb7c 597 else
4922f71f 598 tx->key = NULL;
e2ebc74d
JB		 599
600 if (tx->key) {
813d7669
JB		 601 bool skip_hw = false;
602
e2ebc74d 603 tx->key->tx_rx_count++;
011bfcc4 604 /* TODO: add threshold stuff again */
176e4f84 605
97359d12
JB		 606 switch (tx->key->conf.cipher) {
607 case WLAN_CIPHER_SUITE_WEP40:
608 case WLAN_CIPHER_SUITE_WEP104:
97359d12 609 case WLAN_CIPHER_SUITE_TKIP:
358c8d9d 610 if (!ieee80211_is_data_present(hdr->frame_control))
176e4f84
JB		 611 tx->key = NULL;
612 break;
97359d12 613 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db 614 case WLAN_CIPHER_SUITE_CCMP_256:
00b9cfa3
JM		 615 case WLAN_CIPHER_SUITE_GCMP:
616 case WLAN_CIPHER_SUITE_GCMP_256:
fb733336
JM		 617 if (!ieee80211_is_data_present(hdr->frame_control) &&
618 !ieee80211_use_mfp(hdr->frame_control, tx->sta,
619 tx->skb))
620 tx->key = NULL;
3b43a187
KV		 621 else
622 skip_hw = (tx->key->conf.flags &
e548c49e 623 IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
3b43a187 624 ieee80211_is_mgmt(hdr->frame_control);
fb733336 625 break;
97359d12 626 case WLAN_CIPHER_SUITE_AES_CMAC:
56c52da2 627 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
8ade538b
JM		 628 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
629 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3cfcf6ac
JM		 630 if (!ieee80211_is_mgmt(hdr->frame_control))
631 tx->key = NULL;
632 break;
176e4f84 633 }
813d7669 634
e54faf29
JB		 635 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
636 !ieee80211_is_deauth(hdr->frame_control)))
95acac61
JB		 637 return TX_DROP;
638
f12553eb 639 if (!skip_hw && tx->key &&
382b1655 640 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
813d7669 641 info->control.hw_key = &tx->key->conf;
e2ebc74d
JB		 642 }
643
9ae54c84 644 return TX_CONTINUE;
e2ebc74d
JB		 645}
646
d9e8a70f 647static ieee80211_tx_result debug_noinline
5cf121c3 648ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
e2ebc74d 649{
e039fa4a 650 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
e6a9854b
JB		 651 struct ieee80211_hdr *hdr = (void *)tx->skb->data;
652 struct ieee80211_supported_band *sband;
a2c40249 653 u32 len;
e6a9854b 654 struct ieee80211_tx_rate_control txrc;
0d528d85 655 struct ieee80211_sta_rates *ratetbl = NULL;
c2c98fde 656 bool assoc = false;
8318d78a 657
e6a9854b 658 memset(&txrc, 0, sizeof(txrc));
e2ebc74d 659
2d56577b 660 sband = tx->local->hw.wiphy->bands[info->band];
58d4185e 661
a2c40249 662 len = min_t(u32, tx->skb->len + FCS_LEN,
b9a5f8ca 663 tx->local->hw.wiphy->frag_threshold);
e6a9854b
JB		 664
665 /* set up the tx rate control struct we give the RC algo */
005e472b 666 txrc.hw = &tx->local->hw;
e6a9854b
JB		 667 txrc.sband = sband;
668 txrc.bss_conf = &tx->sdata->vif.bss_conf;
669 txrc.skb = tx->skb;
670 txrc.reported_rate.idx = -1;
2d56577b 671 txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
37eb0b16
JM		 672 if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
673 txrc.max_rate_idx = -1;
674 else
675 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
2ffbe6d3
FF		 676
677 if (tx->sdata->rc_has_mcs_mask[info->band])
678 txrc.rate_idx_mcs_mask =
679 tx->sdata->rc_rateidx_mcs_mask[info->band];
680
8f0729b1 681 txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
4bb62344 682 tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
8f0729b1 683 tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
e6a9854b
JB		 684
685 /* set up RTS protection if desired */
b9a5f8ca 686 if (len > tx->local->hw.wiphy->rts_threshold) {
0d528d85 687 txrc.rts = true;
e2ebc74d 688 }
e2ebc74d 689
0d528d85 690 info->control.use_rts = txrc.rts;
991fec09
FF		 691 info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
692
e6a9854b
JB		 693 /*
694 * Use short preamble if the BSS can handle it, but not for
695 * management frames unless we know the receiver can handle
696 * that -- the management frame might be to a station that
697 * just wants a probe response.
698 */
699 if (tx->sdata->vif.bss_conf.use_short_preamble &&
700 (ieee80211_is_data(hdr->frame_control) ||
c2c98fde 701 (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
0d528d85
FF		 702 txrc.short_preamble = true;
703
704 info->control.short_preamble = txrc.short_preamble;
e2ebc74d 705
c2c98fde
JB		 706 if (tx->sta)
707 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
b770b43e
LR		 708
709 /*
710 * Lets not bother rate control if we're associated and cannot
711 * talk to the sta. This should not happen.
712 */
c2c98fde 713 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
b770b43e
LR		 714 !rate_usable_index_exists(sband, &tx->sta->sta),
715 "%s: Dropped data frame as no usable bitrate found while "
716 "scanning and associated. Target station: "
717 "%pM on %d GHz band\n",
47846c9b 718 tx->sdata->name, hdr->addr1,
2d56577b 719 info->band ? 5 : 2))
b770b43e 720 return TX_DROP;
2e92e6f2 721
b770b43e
LR		 722 /*
723 * If we're associated with the sta at this point we know we can at
724 * least send the frame at the lowest bit rate.
725 */
e6a9854b
JB		 726 rate_control_get_rate(tx->sdata, tx->sta, &txrc);
727
0d528d85
FF		 728 if (tx->sta && !info->control.skip_table)
729 ratetbl = rcu_dereference(tx->sta->sta.rates);
730
731 if (unlikely(info->control.rates[0].idx < 0)) {
732 if (ratetbl) {
733 struct ieee80211_tx_rate rate = {
734 .idx = ratetbl->rate[0].idx,
735 .flags = ratetbl->rate[0].flags,
736 .count = ratetbl->rate[0].count
737 };
738
739 if (ratetbl->rate[0].idx < 0)
740 return TX_DROP;
741
742 tx->rate = rate;
743 } else {
744 return TX_DROP;
745 }
746 } else {
747 tx->rate = info->control.rates[0];
748 }
e6a9854b 749
c1ce5a74 750 if (txrc.reported_rate.idx < 0) {
0d528d85 751 txrc.reported_rate = tx->rate;
c1ce5a74
HS		 752 if (tx->sta && ieee80211_is_data(hdr->frame_control))
753 tx->sta->last_tx_rate = txrc.reported_rate;
754 } else if (tx->sta)
e6a9854b 755 tx->sta->last_tx_rate = txrc.reported_rate;
e039fa4a 756
0d528d85
FF		 757 if (ratetbl)
758 return TX_CONTINUE;
759
e6a9854b
JB		 760 if (unlikely(!info->control.rates[0].count))
761 info->control.rates[0].count = 1;
e2ebc74d 762
9955151d
GS		 763 if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
764 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
765 info->control.rates[0].count = 1;
766
e6a9854b
JB		 767 return TX_CONTINUE;
768}
769
ba8c3d6f
FF		 770static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
771{
772 u16 *seq = &sta->tid_seq[tid];
773 __le16 ret = cpu_to_le16(*seq);
774
775 /* Increase the sequence number. */
776 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
777
778 return ret;
779}
780
f591fa5d
JB		 781static ieee80211_tx_result debug_noinline
782ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
783{
784 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
785 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
f591fa5d
JB		 786 u8 *qc;
787 int tid;
788
25d834e1
JB		 789 /*
790 * Packet injection may want to control the sequence
791 * number, if we have no matching interface then we
792 * neither assign one ourselves nor ask the driver to.
793 */
5061b0c2 794 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
25d834e1
JB		 795 return TX_CONTINUE;
796
f591fa5d
JB		 797 if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
798 return TX_CONTINUE;
799
800 if (ieee80211_hdrlen(hdr->frame_control) < 24)
801 return TX_CONTINUE;
802
49a59543
JB		 803 if (ieee80211_is_qos_nullfunc(hdr->frame_control))
804 return TX_CONTINUE;
805
94778280
JB		 806 /*
807 * Anything but QoS data that has a sequence number field
808 * (is long enough) gets a sequence number from the global
c4c205f3
BC		 809 * counter. QoS data frames with a multicast destination
810 * also use the global counter (802.11-2012 9.3.2.10).
94778280 811 */
c4c205f3
BC		 812 if (!ieee80211_is_data_qos(hdr->frame_control) ||
813 is_multicast_ether_addr(hdr->addr1)) {
94778280 814 /* driver should assign sequence number */
f591fa5d 815 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
94778280
JB		 816 /* for pure STA mode without beacons, we can do it */
817 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
818 tx->sdata->sequence_number += 0x10;
79c892b8
JB		 819 if (tx->sta)
820 tx->sta->tx_msdu[IEEE80211_NUM_TIDS]++;
f591fa5d
JB		 821 return TX_CONTINUE;
822 }
823
824 /*
825 * This should be true for injected/management frames only, for
826 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
827 * above since they are not QoS-data frames.
828 */
829 if (!tx->sta)
830 return TX_CONTINUE;
831
832 /* include per-STA, per-TID sequence counter */
833
834 qc = ieee80211_get_qos_ctl(hdr);
835 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
79c892b8 836 tx->sta->tx_msdu[tid]++;
f591fa5d 837
ba8c3d6f
FF		 838 if (!tx->sta->sta.txq[0])
839 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
f591fa5d
JB		 840
841 return TX_CONTINUE;
842}
843
252b86c4 844static int ieee80211_fragment(struct ieee80211_tx_data *tx,
2de8e0d9
JB		 845 struct sk_buff *skb, int hdrlen,
846 int frag_threshold)
847{
252b86c4 848 struct ieee80211_local *local = tx->local;
a1a3fcec 849 struct ieee80211_tx_info *info;
252b86c4 850 struct sk_buff *tmp;
2de8e0d9
JB		 851 int per_fragm = frag_threshold - hdrlen - FCS_LEN;
852 int pos = hdrlen + per_fragm;
853 int rem = skb->len - hdrlen - per_fragm;
854
855 if (WARN_ON(rem < 0))
856 return -EINVAL;
857
252b86c4
JB		 858 /* first fragment was already added to queue by caller */
859
2de8e0d9
JB		 860 while (rem) {
861 int fraglen = per_fragm;
862
863 if (fraglen > rem)
864 fraglen = rem;
865 rem -= fraglen;
866 tmp = dev_alloc_skb(local->tx_headroom +
867 frag_threshold +
2475b1cc 868 tx->sdata->encrypt_headroom +
2de8e0d9
JB		 869 IEEE80211_ENCRYPT_TAILROOM);
870 if (!tmp)
871 return -ENOMEM;
252b86c4
JB		 872
873 __skb_queue_tail(&tx->skbs, tmp);
874
2475b1cc
MS		 875 skb_reserve(tmp,
876 local->tx_headroom + tx->sdata->encrypt_headroom);
877
2de8e0d9
JB		 878 /* copy control information */
879 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
a1a3fcec
JB		 880
881 info = IEEE80211_SKB_CB(tmp);
882 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
883 IEEE80211_TX_CTL_FIRST_FRAGMENT);
884
885 if (rem)
886 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
887
2de8e0d9
JB		 888 skb_copy_queue_mapping(tmp, skb);
889 tmp->priority = skb->priority;
2de8e0d9 890 tmp->dev = skb->dev;
2de8e0d9
JB		 891
892 /* copy header and data */
893 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
894 memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);
895
896 pos += fraglen;
897 }
898
252b86c4 899 /* adjust first fragment's length */
338f977f 900 skb_trim(skb, hdrlen + per_fragm);
2de8e0d9
JB		 901 return 0;
902}
903
d9e8a70f 904static ieee80211_tx_result debug_noinline
e2454948
JB		 905ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
906{
2de8e0d9
JB		 907 struct sk_buff *skb = tx->skb;
908 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
909 struct ieee80211_hdr *hdr = (void *)skb->data;
b9a5f8ca 910 int frag_threshold = tx->local->hw.wiphy->frag_threshold;
2de8e0d9
JB		 911 int hdrlen;
912 int fragnum;
e2454948 913
252b86c4
JB		 914 /* no matter what happens, tx->skb moves to tx->skbs */
915 __skb_queue_tail(&tx->skbs, skb);
916 tx->skb = NULL;
917
a26eb27a
JB		 918 if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
919 return TX_CONTINUE;
920
921 if (tx->local->ops->set_frag_threshold)
e2454948
JB		 922 return TX_CONTINUE;
923
eefce91a
JB		 924 /*
925 * Warn when submitting a fragmented A-MPDU frame and drop it.
3b8d81e0 926 * This scenario is handled in ieee80211_tx_prepare but extra
8d5e0d58 927 * caution taken here as fragmented ampdu may cause Tx stop.
eefce91a 928 */
8b30b1fe 929 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
eefce91a
JB		 930 return TX_DROP;
931
065e9605 932 hdrlen = ieee80211_hdrlen(hdr->frame_control);
e2454948 933
a26eb27a 934 /* internal error, why isn't DONTFRAG set? */
8ccd8f21 935 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
2de8e0d9 936 return TX_DROP;
e6a9854b 937
2de8e0d9
JB		 938 /*
939 * Now fragment the frame. This will allocate all the fragments and
940 * chain them (using skb as the first fragment) to skb->next.
941 * During transmission, we will remove the successfully transmitted
942 * fragments from this list. When the low-level driver rejects one
943 * of the fragments then we will simply pretend to accept the skb
944 * but store it away as pending.
945 */
252b86c4 946 if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
2de8e0d9 947 return TX_DROP;
e6a9854b 948
2de8e0d9
JB		 949 /* update duration/seq/flags of fragments */
950 fragnum = 0;
252b86c4
JB		 951
952 skb_queue_walk(&tx->skbs, skb) {
2de8e0d9 953 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
e6a9854b 954
2de8e0d9
JB		 955 hdr = (void *)skb->data;
956 info = IEEE80211_SKB_CB(skb);
e6a9854b 957
252b86c4 958 if (!skb_queue_is_last(&tx->skbs, skb)) {
2de8e0d9 959 hdr->frame_control |= morefrags;
e6a9854b
JB		 960 /*
961 * No multi-rate retries for fragmented frames, that
962 * would completely throw off the NAV at other STAs.
963 */
964 info->control.rates[1].idx = -1;
965 info->control.rates[2].idx = -1;
966 info->control.rates[3].idx = -1;
e3e1a0bc 967 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
e6a9854b 968 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
2de8e0d9
JB		 969 } else {
970 hdr->frame_control &= ~morefrags;
e6a9854b 971 }
2de8e0d9
JB		 972 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
973 fragnum++;
252b86c4 974 }
e2ebc74d 975
9ae54c84 976 return TX_CONTINUE;
e2ebc74d
JB		 977}
978
feff1f2f
JB		 979static ieee80211_tx_result debug_noinline
980ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
981{
252b86c4 982 struct sk_buff *skb;
560d2682 983 int ac = -1;
feff1f2f
JB		 984
985 if (!tx->sta)
986 return TX_CONTINUE;
987
252b86c4 988 skb_queue_walk(&tx->skbs, skb) {
560d2682 989 ac = skb_get_queue_mapping(skb);
feff1f2f 990 tx->sta->tx_fragments++;
560d2682 991 tx->sta->tx_bytes[ac] += skb->len;
252b86c4 992 }
560d2682
JB		 993 if (ac >= 0)
994 tx->sta->tx_packets[ac]++;
feff1f2f
JB		 995
996 return TX_CONTINUE;
997}
998
d9e8a70f 999static ieee80211_tx_result debug_noinline
e2454948
JB		 1000ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
1001{
1002 if (!tx->key)
1003 return TX_CONTINUE;
1004
97359d12
JB		 1005 switch (tx->key->conf.cipher) {
1006 case WLAN_CIPHER_SUITE_WEP40:
1007 case WLAN_CIPHER_SUITE_WEP104:
e2454948 1008 return ieee80211_crypto_wep_encrypt(tx);
97359d12 1009 case WLAN_CIPHER_SUITE_TKIP:
e2454948 1010 return ieee80211_crypto_tkip_encrypt(tx);
97359d12 1011 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db
JM		 1012 return ieee80211_crypto_ccmp_encrypt(
1013 tx, IEEE80211_CCMP_MIC_LEN);
1014 case WLAN_CIPHER_SUITE_CCMP_256:
1015 return ieee80211_crypto_ccmp_encrypt(
1016 tx, IEEE80211_CCMP_256_MIC_LEN);
97359d12 1017 case WLAN_CIPHER_SUITE_AES_CMAC:
3cfcf6ac 1018 return ieee80211_crypto_aes_cmac_encrypt(tx);
56c52da2
JM		 1019 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1020 return ieee80211_crypto_aes_cmac_256_encrypt(tx);
8ade538b
JM		 1021 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1022 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1023 return ieee80211_crypto_aes_gmac_encrypt(tx);
00b9cfa3
JM		 1024 case WLAN_CIPHER_SUITE_GCMP:
1025 case WLAN_CIPHER_SUITE_GCMP_256:
1026 return ieee80211_crypto_gcmp_encrypt(tx);
3ffc2a90 1027 default:
d32a1028 1028 return ieee80211_crypto_hw_encrypt(tx);
e2454948
JB		 1029 }
1030
e2454948
JB		 1031 return TX_DROP;
1032}
1033
d9e8a70f 1034static ieee80211_tx_result debug_noinline
03f93c3d
JB		 1035ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
1036{
252b86c4 1037 struct sk_buff *skb;
2de8e0d9
JB		 1038 struct ieee80211_hdr *hdr;
1039 int next_len;
1040 bool group_addr;
03f93c3d 1041
252b86c4 1042 skb_queue_walk(&tx->skbs, skb) {
2de8e0d9 1043 hdr = (void *) skb->data;
7e0aae47
JM		 1044 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
1045 break; /* must not overwrite AID */
252b86c4
JB		 1046 if (!skb_queue_is_last(&tx->skbs, skb)) {
1047 struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
1048 next_len = next->len;
1049 } else
1050 next_len = 0;
2de8e0d9 1051 group_addr = is_multicast_ether_addr(hdr->addr1);
03f93c3d 1052
2de8e0d9 1053 hdr->duration_id =
252b86c4
JB		 1054 ieee80211_duration(tx, skb, group_addr, next_len);
1055 }
03f93c3d
JB		 1056
1057 return TX_CONTINUE;
1058}
1059
e2ebc74d
JB		 1060/* actual transmit path */
1061
a622ab72
JB		 1062static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
1063 struct sk_buff *skb,
1064 struct ieee80211_tx_info *info,
1065 struct tid_ampdu_tx *tid_tx,
1066 int tid)
1067{
1068 bool queued = false;
285fa695 1069 bool reset_agg_timer = false;
aa454580 1070 struct sk_buff *purge_skb = NULL;
a622ab72
JB		 1071
1072 if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1073 info->flags |= IEEE80211_TX_CTL_AMPDU;
285fa695 1074 reset_agg_timer = true;
0ab33703
JB		 1075 } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
1076 /*
1077 * nothing -- this aggregation session is being started
1078 * but that might still fail with the driver
1079 */
ba8c3d6f 1080 } else if (!tx->sta->sta.txq[tid]) {
a622ab72
JB		 1081 spin_lock(&tx->sta->lock);
1082 /*
1083 * Need to re-check now, because we may get here
1084 *
1085 * 1) in the window during which the setup is actually
1086 * already done, but not marked yet because not all
1087 * packets are spliced over to the driver pending
1088 * queue yet -- if this happened we acquire the lock
1089 * either before or after the splice happens, but
1090 * need to recheck which of these cases happened.
1091 *
1092 * 2) during session teardown, if the OPERATIONAL bit
1093 * was cleared due to the teardown but the pointer
1094 * hasn't been assigned NULL yet (or we loaded it
1095 * before it was assigned) -- in this case it may
1096 * now be NULL which means we should just let the
1097 * packet pass through because splicing the frames
1098 * back is already done.
1099 */
40b275b6 1100 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
a622ab72
JB		 1101
1102 if (!tid_tx) {
1103 /* do nothing, let packet pass through */
1104 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1105 info->flags |= IEEE80211_TX_CTL_AMPDU;
285fa695 1106 reset_agg_timer = true;
a622ab72
JB		 1107 } else {
1108 queued = true;
1109 info->control.vif = &tx->sdata->vif;
1110 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
03c8c06f 1111 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
a622ab72 1112 __skb_queue_tail(&tid_tx->pending, skb);
aa454580
HS		 1113 if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
1114 purge_skb = __skb_dequeue(&tid_tx->pending);
a622ab72
JB		 1115 }
1116 spin_unlock(&tx->sta->lock);
aa454580
HS		 1117
1118 if (purge_skb)
c3e7724b 1119 ieee80211_free_txskb(&tx->local->hw, purge_skb);
a622ab72
JB		 1120 }
1121
285fa695
NM		 1122 /* reset session timer */
1123 if (reset_agg_timer && tid_tx->timeout)
12d3952f 1124 tid_tx->last_tx = jiffies;
285fa695 1125
a622ab72
JB		 1126 return queued;
1127}
1128
58d4185e
JB		 1129/*
1130 * initialises @tx
7c10770f
JB		 1131 * pass %NULL for the station if unknown, a valid pointer if known
1132 * or an ERR_PTR() if the station is known not to exist
58d4185e 1133 */
9ae54c84 1134static ieee80211_tx_result
3b8d81e0
JB		 1135ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1136 struct ieee80211_tx_data *tx,
7c10770f 1137 struct sta_info *sta, struct sk_buff *skb)
e2ebc74d 1138{
3b8d81e0 1139 struct ieee80211_local *local = sdata->local;
58d4185e 1140 struct ieee80211_hdr *hdr;
e039fa4a 1141 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
68f2b517 1142 int tid;
a622ab72 1143 u8 *qc;
e2ebc74d
JB		 1144
1145 memset(tx, 0, sizeof(*tx));
1146 tx->skb = skb;
e2ebc74d 1147 tx->local = local;
3b8d81e0 1148 tx->sdata = sdata;
252b86c4 1149 __skb_queue_head_init(&tx->skbs);
e2ebc74d 1150
cd8ffc80
JB		 1151 /*
1152 * If this flag is set to true anywhere, and we get here,
1153 * we are doing the needed processing, so remove the flag
1154 * now.
1155 */
1156 info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1157
58d4185e
JB		 1158 hdr = (struct ieee80211_hdr *) skb->data;
1159
7c10770f
JB		 1160 if (likely(sta)) {
1161 if (!IS_ERR(sta))
1162 tx->sta = sta;
1163 } else {
1164 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1165 tx->sta = rcu_dereference(sdata->u.vlan.sta);
1166 if (!tx->sta && sdata->wdev.use_4addr)
1167 return TX_DROP;
1168 } else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
1169 IEEE80211_TX_CTL_INJECTED) ||
1170 tx->sdata->control_port_protocol == tx->skb->protocol) {
1171 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1172 }
1173 if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
1174 tx->sta = sta_info_get(sdata, hdr->addr1);
3f0e0b22 1175 }
58d4185e 1176
cd8ffc80 1177 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
49a59543 1178 !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
edf6b784
AN		 1179 (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) &&
1180 !(local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) {
cd8ffc80
JB		 1181 struct tid_ampdu_tx *tid_tx;
1182
8b30b1fe
S		 1183 qc = ieee80211_get_qos_ctl(hdr);
1184 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
1185
a622ab72
JB		 1186 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1187 if (tid_tx) {
1188 bool queued;
cd8ffc80 1189
a622ab72
JB		 1190 queued = ieee80211_tx_prep_agg(tx, skb, info,
1191 tid_tx, tid);
1192
1193 if (unlikely(queued))
1194 return TX_QUEUED;
1195 }
8b30b1fe
S		 1196 }
1197
badffb72 1198 if (is_multicast_ether_addr(hdr->addr1)) {
5cf121c3 1199 tx->flags &= ~IEEE80211_TX_UNICAST;
e039fa4a 1200 info->flags |= IEEE80211_TX_CTL_NO_ACK;
6fd67e93 1201 } else
5cf121c3 1202 tx->flags |= IEEE80211_TX_UNICAST;
58d4185e 1203
a26eb27a
JB		 1204 if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
1205 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
1206 skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
1207 info->flags & IEEE80211_TX_CTL_AMPDU)
1208 info->flags |= IEEE80211_TX_CTL_DONTFRAG;
58d4185e
JB		 1209 }
1210
e2ebc74d 1211 if (!tx->sta)
e039fa4a 1212 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
c2c98fde 1213 else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
e039fa4a 1214 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
58d4185e 1215
e039fa4a 1216 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
e2ebc74d 1217
9ae54c84 1218 return TX_CONTINUE;
e2ebc74d
JB		 1219}
1220
ba8c3d6f
FF		 1221static void ieee80211_drv_tx(struct ieee80211_local *local,
1222 struct ieee80211_vif *vif,
1223 struct ieee80211_sta *pubsta,
1224 struct sk_buff *skb)
1225{
1226 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1227 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1228 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1229 struct ieee80211_tx_control control = {
1230 .sta = pubsta,
1231 };
1232 struct ieee80211_txq *txq = NULL;
1233 struct txq_info *txqi;
1234 u8 ac;
1235
1236 if (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE)
1237 goto tx_normal;
1238
1239 if (!ieee80211_is_data(hdr->frame_control))
1240 goto tx_normal;
1241
1242 if (pubsta) {
1243 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1244
1245 txq = pubsta->txq[tid];
1246 } else if (vif) {
1247 txq = vif->txq;
1248 }
1249
1250 if (!txq)
1251 goto tx_normal;
1252
1253 ac = txq->ac;
1254 txqi = to_txq_info(txq);
1255 atomic_inc(&sdata->txqs_len[ac]);
1256 if (atomic_read(&sdata->txqs_len[ac]) >= local->hw.txq_ac_max_pending)
1257 netif_stop_subqueue(sdata->dev, ac);
1258
1259 skb_queue_tail(&txqi->queue, skb);
1260 drv_wake_tx_queue(local, txqi);
1261
1262 return;
1263
1264tx_normal:
1265 drv_tx(local, &control, skb);
1266}
1267
1268struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
1269 struct ieee80211_txq *txq)
1270{
1271 struct ieee80211_local *local = hw_to_local(hw);
1272 struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
1273 struct txq_info *txqi = container_of(txq, struct txq_info, txq);
1274 struct ieee80211_hdr *hdr;
1275 struct sk_buff *skb = NULL;
1276 u8 ac = txq->ac;
1277
1278 spin_lock_bh(&txqi->queue.lock);
1279
1280 if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
1281 goto out;
1282
1283 skb = __skb_dequeue(&txqi->queue);
1284 if (!skb)
1285 goto out;
1286
1287 atomic_dec(&sdata->txqs_len[ac]);
1288 if (__netif_subqueue_stopped(sdata->dev, ac))
1289 ieee80211_propagate_queue_wake(local, sdata->vif.hw_queue[ac]);
1290
1291 hdr = (struct ieee80211_hdr *)skb->data;
1292 if (txq->sta && ieee80211_is_data_qos(hdr->frame_control)) {
1293 struct sta_info *sta = container_of(txq->sta, struct sta_info,
1294 sta);
1295 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1296
1297 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, txq->tid);
1298 if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
1299 info->flags |= IEEE80211_TX_CTL_AMPDU;
1300 else
1301 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
1302 }
1303
1304out:
1305 spin_unlock_bh(&txqi->queue.lock);
1306
1307 return skb;
1308}
1309EXPORT_SYMBOL(ieee80211_tx_dequeue);
1310
11127e91
JB		 1311static bool ieee80211_tx_frags(struct ieee80211_local *local,
1312 struct ieee80211_vif *vif,
1313 struct ieee80211_sta *sta,
1314 struct sk_buff_head *skbs,
1315 bool txpending)
e2ebc74d 1316{
252b86c4 1317 struct sk_buff *skb, *tmp;
3b8d81e0 1318 unsigned long flags;
e2ebc74d 1319
252b86c4 1320 skb_queue_walk_safe(skbs, skb, tmp) {
3a25a8c8
JB		 1321 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1322 int q = info->hw_queue;
1323
1324#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1325 if (WARN_ON_ONCE(q >= local->hw.queues)) {
1326 __skb_unlink(skb, skbs);
c3e7724b 1327 ieee80211_free_txskb(&local->hw, skb);
3a25a8c8
JB		 1328 continue;
1329 }
1330#endif
3b8d81e0
JB		 1331
1332 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
3b8d81e0 1333 if (local->queue_stop_reasons[q] ||
7bb45683 1334 (!txpending && !skb_queue_empty(&local->pending[q]))) {
6c17b77b 1335 if (unlikely(info->flags &
a7679ed5
SF		 1336 IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
1337 if (local->queue_stop_reasons[q] &
1338 ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
1339 /*
1340 * Drop off-channel frames if queues
1341 * are stopped for any reason other
1342 * than off-channel operation. Never
1343 * queue them.
1344 */
1345 spin_unlock_irqrestore(
1346 &local->queue_stop_reason_lock,
1347 flags);
1348 ieee80211_purge_tx_queue(&local->hw,
1349 skbs);
1350 return true;
1351 }
1352 } else {
1353
6c17b77b 1354 /*
a7679ed5
SF		 1355 * Since queue is stopped, queue up frames for
1356 * later transmission from the tx-pending
1357 * tasklet when the queue is woken again.
6c17b77b 1358 */
a7679ed5
SF		 1359 if (txpending)
1360 skb_queue_splice_init(skbs,
1361 &local->pending[q]);
1362 else
1363 skb_queue_splice_tail_init(skbs,
1364 &local->pending[q]);
1365
1366 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1367 flags);
1368 return false;
6c17b77b 1369 }
7bb45683 1370 }
3b8d81e0 1371 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
f8e79ddd 1372
11127e91 1373 info->control.vif = vif;
f0e72851 1374
11127e91 1375 __skb_unlink(skb, skbs);
ba8c3d6f 1376 ieee80211_drv_tx(local, vif, sta, skb);
11127e91 1377 }
5061b0c2 1378
11127e91
JB		 1379 return true;
1380}
1381
1382/*
1383 * Returns false if the frame couldn't be transmitted but was queued instead.
1384 */
1385static bool __ieee80211_tx(struct ieee80211_local *local,
1386 struct sk_buff_head *skbs, int led_len,
1387 struct sta_info *sta, bool txpending)
1388{
1389 struct ieee80211_tx_info *info;
1390 struct ieee80211_sub_if_data *sdata;
1391 struct ieee80211_vif *vif;
1392 struct ieee80211_sta *pubsta;
1393 struct sk_buff *skb;
1394 bool result = true;
1395 __le16 fc;
5061b0c2 1396
11127e91
JB		 1397 if (WARN_ON(skb_queue_empty(skbs)))
1398 return true;
ec25acc4 1399
11127e91
JB		 1400 skb = skb_peek(skbs);
1401 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
1402 info = IEEE80211_SKB_CB(skb);
1403 sdata = vif_to_sdata(info->control.vif);
1404 if (sta && !sta->uploaded)
1405 sta = NULL;
1406
1407 if (sta)
1408 pubsta = &sta->sta;
1409 else
1410 pubsta = NULL;
1411
1412 switch (sdata->vif.type) {
1413 case NL80211_IFTYPE_MONITOR:
c82b5a74
JB		 1414 if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
1415 vif = &sdata->vif;
1416 break;
1417 }
4b6f1dd6 1418 sdata = rcu_dereference(local->monitor_sdata);
3a25a8c8 1419 if (sdata) {
4b6f1dd6 1420 vif = &sdata->vif;
3a25a8c8
JB		 1421 info->hw_queue =
1422 vif->hw_queue[skb_get_queue_mapping(skb)];
1423 } else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) {
1424 dev_kfree_skb(skb);
1425 return true;
1426 } else
4b6f1dd6 1427 vif = NULL;
11127e91
JB		 1428 break;
1429 case NL80211_IFTYPE_AP_VLAN:
1430 sdata = container_of(sdata->bss,
1431 struct ieee80211_sub_if_data, u.ap);
1432 /* fall through */
1433 default:
1434 vif = &sdata->vif;
1435 break;
e2ebc74d 1436 }
2de8e0d9 1437
cb831b53
JB		 1438 result = ieee80211_tx_frags(local, vif, pubsta, skbs,
1439 txpending);
11127e91 1440
74e4dbfd 1441 ieee80211_tpt_led_trig_tx(local, fc, led_len);
74e4dbfd 1442
4db4e0a1 1443 WARN_ON_ONCE(!skb_queue_empty(skbs));
252b86c4 1444
11127e91 1445 return result;
e2ebc74d
JB		 1446}
1447
97b045d6
JB		 1448/*
1449 * Invoke TX handlers, return 0 on success and non-zero if the
1450 * frame was dropped or queued.
1451 */
1452static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1453{
252b86c4 1454 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
97b045d6 1455 ieee80211_tx_result res = TX_DROP;
97b045d6 1456
9aa4aee3
JB		 1457#define CALL_TXH(txh) \
1458 do { \
1459 res = txh(tx); \
1460 if (res != TX_CONTINUE) \
1461 goto txh_done; \
1462 } while (0)
1463
5c1b98a5 1464 CALL_TXH(ieee80211_tx_h_dynamic_ps);
9aa4aee3
JB		 1465 CALL_TXH(ieee80211_tx_h_check_assoc);
1466 CALL_TXH(ieee80211_tx_h_ps_buf);
a621fa4d 1467 CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
9aa4aee3 1468 CALL_TXH(ieee80211_tx_h_select_key);
af65cd96
JB		 1469 if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
1470 CALL_TXH(ieee80211_tx_h_rate_ctrl);
c6fcf6bc 1471
aa5b5492
JB		 1472 if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
1473 __skb_queue_tail(&tx->skbs, tx->skb);
1474 tx->skb = NULL;
c6fcf6bc 1475 goto txh_done;
aa5b5492 1476 }
c6fcf6bc
JB		 1477
1478 CALL_TXH(ieee80211_tx_h_michael_mic_add);
9aa4aee3
JB		 1479 CALL_TXH(ieee80211_tx_h_sequence);
1480 CALL_TXH(ieee80211_tx_h_fragment);
d9e8a70f 1481 /* handlers after fragment must be aware of tx info fragmentation! */
9aa4aee3
JB		 1482 CALL_TXH(ieee80211_tx_h_stats);
1483 CALL_TXH(ieee80211_tx_h_encrypt);
8fd369ee
AN		 1484 if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
1485 CALL_TXH(ieee80211_tx_h_calculate_duration);
d9e8a70f 1486#undef CALL_TXH
97b045d6 1487
d9e8a70f 1488 txh_done:
97b045d6 1489 if (unlikely(res == TX_DROP)) {
5479d0e7 1490 I802_DEBUG_INC(tx->local->tx_handlers_drop);
252b86c4 1491 if (tx->skb)
c3e7724b 1492 ieee80211_free_txskb(&tx->local->hw, tx->skb);
252b86c4 1493 else
1f98ab7f 1494 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
97b045d6
JB		 1495 return -1;
1496 } else if (unlikely(res == TX_QUEUED)) {
5479d0e7 1497 I802_DEBUG_INC(tx->local->tx_handlers_queued);
97b045d6
JB		 1498 return -1;
1499 }
1500
1501 return 0;
1502}
1503
06be6b14
FF		 1504bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
1505 struct ieee80211_vif *vif, struct sk_buff *skb,
1506 int band, struct ieee80211_sta **sta)
1507{
1508 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1509 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1510 struct ieee80211_tx_data tx;
88724a81 1511 struct sk_buff *skb2;
06be6b14 1512
7c10770f 1513 if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
06be6b14
FF		 1514 return false;
1515
1516 info->band = band;
1517 info->control.vif = vif;
1518 info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];
1519
1520 if (invoke_tx_handlers(&tx))
1521 return false;
1522
1523 if (sta) {
1524 if (tx.sta)
1525 *sta = &tx.sta->sta;
1526 else
1527 *sta = NULL;
1528 }
1529
88724a81
JB		 1530 /* this function isn't suitable for fragmented data frames */
1531 skb2 = __skb_dequeue(&tx.skbs);
1532 if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
1533 ieee80211_free_txskb(hw, skb2);
1534 ieee80211_purge_tx_queue(hw, &tx.skbs);
1535 return false;
1536 }
1537
06be6b14
FF		 1538 return true;
1539}
1540EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
1541
7bb45683
JB		 1542/*
1543 * Returns false if the frame couldn't be transmitted but was queued instead.
1544 */
1545static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
7c10770f
JB		 1546 struct sta_info *sta, struct sk_buff *skb,
1547 bool txpending)
e2ebc74d 1548{
3b8d81e0 1549 struct ieee80211_local *local = sdata->local;
5cf121c3 1550 struct ieee80211_tx_data tx;
97b045d6 1551 ieee80211_tx_result res_prepare;
e039fa4a 1552 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
7bb45683 1553 bool result = true;
74e4dbfd 1554 int led_len;
e2ebc74d 1555
e2ebc74d
JB		 1556 if (unlikely(skb->len < 10)) {
1557 dev_kfree_skb(skb);
7bb45683 1558 return true;
e2ebc74d
JB		 1559 }
1560
58d4185e 1561 /* initialises tx */
74e4dbfd 1562 led_len = skb->len;
7c10770f 1563 res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
e2ebc74d 1564
cd8ffc80 1565 if (unlikely(res_prepare == TX_DROP)) {
c3e7724b 1566 ieee80211_free_txskb(&local->hw, skb);
55de908a 1567 return true;
cd8ffc80 1568 } else if (unlikely(res_prepare == TX_QUEUED)) {
55de908a 1569 return true;
e2ebc74d
JB		 1570 }
1571
3a25a8c8
JB		 1572 /* set up hw_queue value early */
1573 if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
1574 !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL))
1575 info->hw_queue =
1576 sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
1577
7bb45683 1578 if (!invoke_tx_handlers(&tx))
74e4dbfd
JB		 1579 result = __ieee80211_tx(local, &tx.skbs, led_len,
1580 tx.sta, txpending);
55de908a 1581
7bb45683 1582 return result;
e2ebc74d
JB		 1583}
1584
1585/* device xmit handlers */
1586
3bff1865 1587static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
23c0752a
JB		 1588 struct sk_buff *skb,
1589 int head_need, bool may_encrypt)
1590{
3bff1865 1591 struct ieee80211_local *local = sdata->local;
23c0752a
JB		 1592 int tail_need = 0;
1593
3bff1865 1594 if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
23c0752a
JB		 1595 tail_need = IEEE80211_ENCRYPT_TAILROOM;
1596 tail_need -= skb_tailroom(skb);
1597 tail_need = max_t(int, tail_need, 0);
1598 }
1599
c70f59a2
IY		 1600 if (skb_cloned(skb) &&
1601 (!(local->hw.flags & IEEE80211_HW_SUPPORTS_CLONED_SKBS) ||
1602 !skb_clone_writable(skb, ETH_HLEN) ||
17c18bf8 1603 (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
23c0752a 1604 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
4cd06a34 1605 else if (head_need || tail_need)
23c0752a 1606 I802_DEBUG_INC(local->tx_expand_skb_head);
4cd06a34
FF		 1607 else
1608 return 0;
23c0752a
JB		 1609
1610 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
0fb9a9ec
JP		 1611 wiphy_debug(local->hw.wiphy,
1612 "failed to reallocate TX buffer\n");
23c0752a
JB		 1613 return -ENOMEM;
1614 }
1615
23c0752a
JB		 1616 return 0;
1617}
1618
7c10770f
JB		 1619void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1620 struct sta_info *sta, struct sk_buff *skb)
e2ebc74d 1621{
3b8d81e0 1622 struct ieee80211_local *local = sdata->local;
e039fa4a 1623 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
e32f85f7 1624 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
e2ebc74d 1625 int headroom;
23c0752a 1626 bool may_encrypt;
e2ebc74d 1627
3b8d81e0 1628 may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
23c0752a 1629
3b8d81e0 1630 headroom = local->tx_headroom;
23c0752a 1631 if (may_encrypt)
2475b1cc 1632 headroom += sdata->encrypt_headroom;
23c0752a
JB		 1633 headroom -= skb_headroom(skb);
1634 headroom = max_t(int, 0, headroom);
1635
3bff1865 1636 if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
c3e7724b 1637 ieee80211_free_txskb(&local->hw, skb);
3b8d81e0 1638 return;
e2ebc74d
JB		 1639 }
1640
740c1aa3 1641 hdr = (struct ieee80211_hdr *) skb->data;
5061b0c2 1642 info->control.vif = &sdata->vif;
e2ebc74d 1643
3f52b7e3
MP		 1644 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1645 if (ieee80211_is_data(hdr->frame_control) &&
1646 is_unicast_ether_addr(hdr->addr1)) {
bf7cd94d 1647 if (mesh_nexthop_resolve(sdata, skb))
3f52b7e3
MP		 1648 return; /* skb queued: don't free */
1649 } else {
1650 ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
1651 }
98aed9fd 1652 }
cca89496 1653
2154c81c 1654 ieee80211_set_qos_hdr(sdata, skb);
7c10770f 1655 ieee80211_tx(sdata, sta, skb, false);
e2ebc74d
JB		 1656}
1657
73b9f03a
JB		 1658static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
1659{
1660 struct ieee80211_radiotap_iterator iterator;
1661 struct ieee80211_radiotap_header *rthdr =
1662 (struct ieee80211_radiotap_header *) skb->data;
1663 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1664 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
1665 NULL);
1666 u16 txflags;
1667
1668 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1669 IEEE80211_TX_CTL_DONTFRAG;
1670
1671 /*
1672 * for every radiotap entry that is present
1673 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
1674 * entries present, or -EINVAL on error)
1675 */
1676
1677 while (!ret) {
1678 ret = ieee80211_radiotap_iterator_next(&iterator);
1679
1680 if (ret)
1681 continue;
1682
1683 /* see if this argument is something we can use */
1684 switch (iterator.this_arg_index) {
1685 /*
1686 * You must take care when dereferencing iterator.this_arg
1687 * for multibyte types... the pointer is not aligned. Use
1688 * get_unaligned((type *)iterator.this_arg) to dereference
1689 * iterator.this_arg for type "type" safely on all arches.
1690 */
1691 case IEEE80211_RADIOTAP_FLAGS:
1692 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
1693 /*
1694 * this indicates that the skb we have been
1695 * handed has the 32-bit FCS CRC at the end...
1696 * we should react to that by snipping it off
1697 * because it will be recomputed and added
1698 * on transmission
1699 */
1700 if (skb->len < (iterator._max_length + FCS_LEN))
1701 return false;
1702
1703 skb_trim(skb, skb->len - FCS_LEN);
1704 }
1705 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
1706 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
1707 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
1708 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
1709 break;
1710
1711 case IEEE80211_RADIOTAP_TX_FLAGS:
1712 txflags = get_unaligned_le16(iterator.this_arg);
1713 if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
1714 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1715 break;
1716
1717 /*
1718 * Please update the file
1719 * Documentation/networking/mac80211-injection.txt
1720 * when parsing new fields here.
1721 */
1722
1723 default:
1724 break;
1725 }
1726 }
1727
1728 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
1729 return false;
1730
1731 /*
1732 * remove the radiotap header
1733 * iterator->_max_length was sanity-checked against
1734 * skb->len by iterator init
1735 */
1736 skb_pull(skb, iterator._max_length);
1737
1738 return true;
1739}
1740
d0cf9c0d
SH		 1741netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
1742 struct net_device *dev)
e2ebc74d
JB		 1743{
1744 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
55de908a 1745 struct ieee80211_chanctx_conf *chanctx_conf;
e2ebc74d
JB		 1746 struct ieee80211_radiotap_header *prthdr =
1747 (struct ieee80211_radiotap_header *)skb->data;
3b8d81e0 1748 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
f75f5c6f 1749 struct ieee80211_hdr *hdr;
5d9cf4a5 1750 struct ieee80211_sub_if_data *tmp_sdata, *sdata;
b4932836 1751 struct cfg80211_chan_def *chandef;
9b8a74e3 1752 u16 len_rthdr;
5d9cf4a5 1753 int hdrlen;
e2ebc74d 1754
9b8a74e3
AG		 1755 /* check for not even having the fixed radiotap header part */
1756 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
1757 goto fail; /* too short to be possibly valid */
1758
1759 /* is it a header version we can trust to find length from? */
1760 if (unlikely(prthdr->it_version))
1761 goto fail; /* only version 0 is supported */
1762
1763 /* then there must be a radiotap header with a length we can use */
1764 len_rthdr = ieee80211_get_radiotap_len(skb->data);
1765
1766 /* does the skb contain enough to deliver on the alleged length? */
1767 if (unlikely(skb->len < len_rthdr))
1768 goto fail; /* skb too short for claimed rt header extent */
e2ebc74d 1769
e2ebc74d
JB		 1770 /*
1771 * fix up the pointers accounting for the radiotap
1772 * header still being in there. We are being given
1773 * a precooked IEEE80211 header so no need for
1774 * normal processing
1775 */
9b8a74e3 1776 skb_set_mac_header(skb, len_rthdr);
e2ebc74d 1777 /*
9b8a74e3
AG		 1778 * these are just fixed to the end of the rt area since we
1779 * don't have any better information and at this point, nobody cares
e2ebc74d 1780 */
9b8a74e3
AG		 1781 skb_set_network_header(skb, len_rthdr);
1782 skb_set_transport_header(skb, len_rthdr);
e2ebc74d 1783
5d9cf4a5
JB		 1784 if (skb->len < len_rthdr + 2)
1785 goto fail;
1786
1787 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
1788 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1789
1790 if (skb->len < len_rthdr + hdrlen)
1791 goto fail;
1792
f75f5c6f
HS		 1793 /*
1794 * Initialize skb->protocol if the injected frame is a data frame
1795 * carrying a rfc1042 header
1796 */
5d9cf4a5
JB		 1797 if (ieee80211_is_data(hdr->frame_control) &&
1798 skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
1799 u8 *payload = (u8 *)hdr + hdrlen;
1800
b203ca39 1801 if (ether_addr_equal(payload, rfc1042_header))
5d9cf4a5
JB		 1802 skb->protocol = cpu_to_be16((payload[6] << 8) |
1803 payload[7]);
f75f5c6f
HS		 1804 }
1805
3b8d81e0
JB		 1806 memset(info, 0, sizeof(*info));
1807
5d9cf4a5 1808 info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
73b9f03a
JB		 1809 IEEE80211_TX_CTL_INJECTED;
1810
1811 /* process and remove the injection radiotap header */
1812 if (!ieee80211_parse_tx_radiotap(skb))
1813 goto fail;
5d9cf4a5
JB		 1814
1815 rcu_read_lock();
1816
1817 /*
1818 * We process outgoing injected frames that have a local address
1819 * we handle as though they are non-injected frames.
1820 * This code here isn't entirely correct, the local MAC address
1821 * isn't always enough to find the interface to use; for proper
1822 * VLAN/WDS support we will need a different mechanism (which
1823 * likely isn't going to be monitor interfaces).
1824 */
1825 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1826
1827 list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
1828 if (!ieee80211_sdata_running(tmp_sdata))
1829 continue;
1830 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
1831 tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
1832 tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
1833 continue;
b203ca39 1834 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
5d9cf4a5
JB		 1835 sdata = tmp_sdata;
1836 break;
1837 }
1838 }
7351c6bd 1839
55de908a
JB		 1840 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1841 if (!chanctx_conf) {
1842 tmp_sdata = rcu_dereference(local->monitor_sdata);
1843 if (tmp_sdata)
1844 chanctx_conf =
1845 rcu_dereference(tmp_sdata->vif.chanctx_conf);
1846 }
55de908a 1847
b4a7ff75 1848 if (chanctx_conf)
b4932836 1849 chandef = &chanctx_conf->def;
b4a7ff75 1850 else if (!local->use_chanctx)
b4932836 1851 chandef = &local->_oper_chandef;
b4a7ff75
FF		 1852 else
1853 goto fail_rcu;
55de908a
JB		 1854
1855 /*
1856 * Frame injection is not allowed if beaconing is not allowed
1857 * or if we need radar detection. Beaconing is usually not allowed when
1858 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
1859 * Passive scan is also used in world regulatory domains where
1860 * your country is not known and as such it should be treated as
1861 * NO TX unless the channel is explicitly allowed in which case
1862 * your current regulatory domain would not have the passive scan
1863 * flag.
1864 *
1865 * Since AP mode uses monitor interfaces to inject/TX management
1866 * frames we can make AP mode the exception to this rule once it
1867 * supports radar detection as its implementation can deal with
1868 * radar detection by itself. We can do that later by adding a
1869 * monitor flag interfaces used for AP support.
1870 */
b4932836
JD		 1871 if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
1872 sdata->vif.type))
55de908a
JB		 1873 goto fail_rcu;
1874
73c4e195 1875 info->band = chandef->chan->band;
7c10770f 1876 ieee80211_xmit(sdata, NULL, skb);
5d9cf4a5
JB		 1877 rcu_read_unlock();
1878
e2ebc74d 1879 return NETDEV_TX_OK;
9b8a74e3 1880
55de908a
JB		 1881fail_rcu:
1882 rcu_read_unlock();
9b8a74e3
AG		 1883fail:
1884 dev_kfree_skb(skb);
1885 return NETDEV_TX_OK; /* meaning, we dealt with the skb */
e2ebc74d
JB		 1886}
1887
97ffe757 1888static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
ad38bfc9 1889{
97ffe757 1890 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
ad38bfc9 1891
97ffe757
JB		 1892 return ethertype == ETH_P_TDLS &&
1893 skb->len > 14 &&
1894 skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
1895}
1896
1897static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
1898 struct sk_buff *skb,
1899 struct sta_info **sta_out)
1900{
1901 struct sta_info *sta;
1902
1903 switch (sdata->vif.type) {
1904 case NL80211_IFTYPE_AP_VLAN:
1905 sta = rcu_dereference(sdata->u.vlan.sta);
1906 if (sta) {
1907 *sta_out = sta;
1908 return 0;
1909 } else if (sdata->wdev.use_4addr) {
1910 return -ENOLINK;
1911 }
1912 /* fall through */
1913 case NL80211_IFTYPE_AP:
1914 case NL80211_IFTYPE_OCB:
1915 case NL80211_IFTYPE_ADHOC:
1916 if (is_multicast_ether_addr(skb->data)) {
1917 *sta_out = ERR_PTR(-ENOENT);
1918 return 0;
1919 }
1920 sta = sta_info_get_bss(sdata, skb->data);
1921 break;
1922 case NL80211_IFTYPE_WDS:
1923 sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
1924 break;
1925#ifdef CONFIG_MAC80211_MESH
1926 case NL80211_IFTYPE_MESH_POINT:
1927 /* determined much later */
1928 *sta_out = NULL;
1929 return 0;
1930#endif
1931 case NL80211_IFTYPE_STATION:
1932 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1933 sta = sta_info_get(sdata, skb->data);
1934 if (sta) {
1935 bool tdls_peer, tdls_auth;
1936
1937 tdls_peer = test_sta_flag(sta,
1938 WLAN_STA_TDLS_PEER);
1939 tdls_auth = test_sta_flag(sta,
1940 WLAN_STA_TDLS_PEER_AUTH);
1941
1942 if (tdls_peer && tdls_auth) {
1943 *sta_out = sta;
1944 return 0;
1945 }
1946
1947 /*
1948 * TDLS link during setup - throw out frames to
1949 * peer. Allow TDLS-setup frames to unauthorized
1950 * peers for the special case of a link teardown
1951 * after a TDLS sta is removed due to being
1952 * unreachable.
1953 */
1954 if (tdls_peer && !tdls_auth &&
1955 !ieee80211_is_tdls_setup(skb))
1956 return -EINVAL;
1957 }
1958
1959 }
1960
1961 sta = sta_info_get(sdata, sdata->u.mgd.bssid);
1962 if (!sta)
1963 return -ENOLINK;
1964 break;
1965 default:
1966 return -EINVAL;
1967 }
1968
1969 *sta_out = sta ?: ERR_PTR(-ENOENT);
1970 return 0;
ad38bfc9
MG		 1971}
1972
e2ebc74d 1973/**
4c9451ed
JB		 1974 * ieee80211_build_hdr - build 802.11 header in the given frame
1975 * @sdata: virtual interface to build the header for
1976 * @skb: the skb to build the header in
24d342c5 1977 * @info_flags: skb flags to set
e2ebc74d 1978 *
4c9451ed
JB		 1979 * This function takes the skb with 802.3 header and reformats the header to
1980 * the appropriate IEEE 802.11 header based on which interface the packet is
1981 * being transmitted on.
1982 *
1983 * Note that this function also takes care of the TX status request and
1984 * potential unsharing of the SKB - this needs to be interleaved with the
1985 * header building.
e2ebc74d 1986 *
4c9451ed
JB		 1987 * The function requires the read-side RCU lock held
1988 *
1989 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
e2ebc74d 1990 */
4c9451ed 1991static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
7c10770f 1992 struct sk_buff *skb, u32 info_flags,
97ffe757 1993 struct sta_info *sta)
e2ebc74d 1994{
133b8226 1995 struct ieee80211_local *local = sdata->local;
489ee919 1996 struct ieee80211_tx_info *info;
dcf33963 1997 int head_need;
065e9605
HH		 1998 u16 ethertype, hdrlen, meshhdrlen = 0;
1999 __le16 fc;
e2ebc74d 2000 struct ieee80211_hdr hdr;
ff67bb86 2001 struct ieee80211s_hdr mesh_hdr __maybe_unused;
b8bacc18 2002 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
e2ebc74d
JB		 2003 const u8 *encaps_data;
2004 int encaps_len, skip_header_bytes;
e8bf9649 2005 int nh_pos, h_pos;
97ffe757
JB		 2006 bool wme_sta = false, authorized = false;
2007 bool tdls_peer;
a729cff8 2008 bool multicast;
a729cff8 2009 u16 info_id = 0;
55de908a
JB		 2010 struct ieee80211_chanctx_conf *chanctx_conf;
2011 struct ieee80211_sub_if_data *ap_sdata;
2012 enum ieee80211_band band;
4c9451ed 2013 int ret;
e2ebc74d 2014
97ffe757
JB		 2015 if (IS_ERR(sta))
2016 sta = NULL;
2017
e2ebc74d
JB		 2018 /* convert Ethernet header to proper 802.11 header (based on
2019 * operation mode) */
2020 ethertype = (skb->data[12] << 8) | skb->data[13];
065e9605 2021 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
e2ebc74d 2022
51fb61e7 2023 switch (sdata->vif.type) {
05c914fe 2024 case NL80211_IFTYPE_AP_VLAN:
97ffe757 2025 if (sdata->wdev.use_4addr) {
f14543ee
FF		 2026 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2027 /* RA TA DA SA */
2028 memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
47846c9b 2029 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
f14543ee
FF		 2030 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2031 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2032 hdrlen = 30;
c2c98fde 2033 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
a74a8c84 2034 wme_sta = sta->sta.wme;
f14543ee 2035 }
55de908a
JB		 2036 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2037 u.ap);
2038 chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
4c9451ed
JB		 2039 if (!chanctx_conf) {
2040 ret = -ENOTCONN;
2041 goto free;
2042 }
4bf88530 2043 band = chanctx_conf->def.chan->band;
97ffe757 2044 if (sdata->wdev.use_4addr)
f14543ee
FF		 2045 break;
2046 /* fall through */
2047 case NL80211_IFTYPE_AP:
fe80123d
AB		 2048 if (sdata->vif.type == NL80211_IFTYPE_AP)
2049 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2050 if (!chanctx_conf) {
2051 ret = -ENOTCONN;
2052 goto free;
2053 }
065e9605 2054 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
e2ebc74d
JB		 2055 /* DA BSSID SA */
2056 memcpy(hdr.addr1, skb->data, ETH_ALEN);
47846c9b 2057 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
e2ebc74d
JB		 2058 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
2059 hdrlen = 24;
4bf88530 2060 band = chanctx_conf->def.chan->band;
cf966838 2061 break;
05c914fe 2062 case NL80211_IFTYPE_WDS:
065e9605 2063 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
e2ebc74d
JB		 2064 /* RA TA DA SA */
2065 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
47846c9b 2066 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
e2ebc74d
JB		 2067 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2068 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2069 hdrlen = 30;
55de908a
JB		 2070 /*
2071 * This is the exception! WDS style interfaces are prohibited
2072 * when channel contexts are in used so this must be valid
2073 */
675a0b04 2074 band = local->hw.conf.chandef.chan->band;
cf966838 2075 break;
33b64eb2 2076#ifdef CONFIG_MAC80211_MESH
05c914fe 2077 case NL80211_IFTYPE_MESH_POINT:
b8bacc18 2078 if (!is_multicast_ether_addr(skb->data)) {
163df6cf
CYY		 2079 struct sta_info *next_hop;
2080 bool mpp_lookup = true;
2081
bf7cd94d 2082 mpath = mesh_path_lookup(sdata, skb->data);
163df6cf
CYY		 2083 if (mpath) {
2084 mpp_lookup = false;
2085 next_hop = rcu_dereference(mpath->next_hop);
2086 if (!next_hop ||
2087 !(mpath->flags & (MESH_PATH_ACTIVE |
2088 MESH_PATH_RESOLVING)))
2089 mpp_lookup = true;
2090 }
2091
2092 if (mpp_lookup)
bf7cd94d 2093 mppath = mpp_path_lookup(sdata, skb->data);
163df6cf
CYY		 2094
2095 if (mppath && mpath)
2096 mesh_path_del(mpath->sdata, mpath->dst);
b8bacc18 2097 }
79617dee 2098
f76b57b4 2099 /*
9d52501b
JF		 2100 * Use address extension if it is a packet from
2101 * another interface or if we know the destination
2102 * is being proxied by a portal (i.e. portal address
2103 * differs from proxied address)
f76b57b4 2104 */
b203ca39
JP		 2105 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
2106 !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
3c5772a5
JC		 2107 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2108 skb->data, skb->data + ETH_ALEN);
bf7cd94d
JB		 2109 meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
2110 NULL, NULL);
79617dee 2111 } else {
27f01124
TP		 2112 /* DS -> MBSS (802.11-2012 13.11.3.3).
2113 * For unicast with unknown forwarding information,
2114 * destination might be in the MBSS or if that fails
2115 * forwarded to another mesh gate. In either case
2116 * resolution will be handled in ieee80211_xmit(), so
2117 * leave the original DA. This also works for mcast */
2118 const u8 *mesh_da = skb->data;
2119
2120 if (mppath)
2121 mesh_da = mppath->mpp;
2122 else if (mpath)
2123 mesh_da = mpath->dst;
79617dee 2124
3c5772a5 2125 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
47846c9b 2126 mesh_da, sdata->vif.addr);
27f01124
TP		 2127 if (is_multicast_ether_addr(mesh_da))
2128 /* DA TA mSA AE:SA */
bf7cd94d
JB		 2129 meshhdrlen = ieee80211_new_mesh_header(
2130 sdata, &mesh_hdr,
2131 skb->data + ETH_ALEN, NULL);
3c5772a5 2132 else
27f01124 2133 /* RA TA mDA mSA AE:DA SA */
bf7cd94d
JB		 2134 meshhdrlen = ieee80211_new_mesh_header(
2135 sdata, &mesh_hdr, skb->data,
2136 skb->data + ETH_ALEN);
79617dee 2137
79617dee 2138 }
55de908a 2139 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2140 if (!chanctx_conf) {
2141 ret = -ENOTCONN;
2142 goto free;
2143 }
4bf88530 2144 band = chanctx_conf->def.chan->band;
33b64eb2
LCC		 2145 break;
2146#endif
05c914fe 2147 case NL80211_IFTYPE_STATION:
97ffe757
JB		 2148 /* we already did checks when looking up the RA STA */
2149 tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
941c93cd 2150
97ffe757 2151 if (tdls_peer) {
941c93cd
AN		 2152 /* DA SA BSSID */
2153 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2154 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2155 memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
2156 hdrlen = 24;
2157 } else if (sdata->u.mgd.use_4addr &&
2158 cpu_to_be16(ethertype) != sdata->control_port_protocol) {
2159 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2160 IEEE80211_FCTL_TODS);
f14543ee 2161 /* RA TA DA SA */
941c93cd 2162 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
47846c9b 2163 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
f14543ee
FF		 2164 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2165 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2166 hdrlen = 30;
2167 } else {
2168 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2169 /* BSSID SA DA */
941c93cd 2170 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
f14543ee
FF		 2171 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2172 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2173 hdrlen = 24;
2174 }
55de908a 2175 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2176 if (!chanctx_conf) {
2177 ret = -ENOTCONN;
2178 goto free;
2179 }
4bf88530 2180 band = chanctx_conf->def.chan->band;
cf966838 2181 break;
239281f8
RL		 2182 case NL80211_IFTYPE_OCB:
2183 /* DA SA BSSID */
2184 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2185 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2186 eth_broadcast_addr(hdr.addr3);
2187 hdrlen = 24;
2188 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2189 if (!chanctx_conf) {
2190 ret = -ENOTCONN;
2191 goto free;
2192 }
239281f8
RL		 2193 band = chanctx_conf->def.chan->band;
2194 break;
05c914fe 2195 case NL80211_IFTYPE_ADHOC:
e2ebc74d
JB		 2196 /* DA SA BSSID */
2197 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2198 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
46900298 2199 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
e2ebc74d 2200 hdrlen = 24;
55de908a 2201 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2202 if (!chanctx_conf) {
2203 ret = -ENOTCONN;
2204 goto free;
2205 }
4bf88530 2206 band = chanctx_conf->def.chan->band;
cf966838
JB		 2207 break;
2208 default:
4c9451ed
JB		 2209 ret = -EINVAL;
2210 goto free;
e2ebc74d
JB		 2211 }
2212
a729cff8 2213 multicast = is_multicast_ether_addr(hdr.addr1);
e2ebc74d 2214
97ffe757
JB		 2215 /* sta is always NULL for mesh */
2216 if (sta) {
2217 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2218 wme_sta = sta->sta.wme;
2219 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2220 /* For mesh, the use of the QoS header is mandatory */
c2c98fde 2221 wme_sta = true;
97ffe757 2222 }
4777be41 2223
527871d7
JB		 2224 /* receiver does QoS (which also means we do) use it */
2225 if (wme_sta) {
065e9605 2226 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
ce3edf6d
JB		 2227 hdrlen += 2;
2228 }
2229
2230 /*
238814fd
JB		 2231 * Drop unicast frames to unauthorised stations unless they are
2232 * EAPOL frames from the local station.
ce3edf6d 2233 */
55182e4a 2234 if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
239281f8 2235 (sdata->vif.type != NL80211_IFTYPE_OCB) &&
a6ececf4 2236 !multicast && !authorized &&
55182e4a 2237 (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
b203ca39 2238 !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
ce3edf6d 2239#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
bdcbd8e0 2240 net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
4c9451ed 2241 sdata->name, hdr.addr1);
ce3edf6d
JB		 2242#endif
2243
2244 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
2245
4c9451ed
JB		 2246 ret = -EPERM;
2247 goto free;
ce3edf6d
JB		 2248 }
2249
a729cff8
JB		 2250 if (unlikely(!multicast && skb->sk &&
2251 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
bf7fa551 2252 struct sk_buff *ack_skb = skb_clone_sk(skb);
a729cff8 2253
bf7fa551 2254 if (ack_skb) {
a729cff8 2255 unsigned long flags;
9475af6e 2256 int id;
a729cff8
JB		 2257
2258 spin_lock_irqsave(&local->ack_status_lock, flags);
bf7fa551 2259 id = idr_alloc(&local->ack_status_frames, ack_skb,
9475af6e 2260 1, 0x10000, GFP_ATOMIC);
a729cff8
JB		 2261 spin_unlock_irqrestore(&local->ack_status_lock, flags);
2262
9475af6e 2263 if (id >= 0) {
a729cff8
JB		 2264 info_id = id;
2265 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
a729cff8 2266 } else {
bf7fa551 2267 kfree_skb(ack_skb);
a729cff8 2268 }
a729cff8
JB		 2269 }
2270 }
2271
7e244707
HS		 2272 /*
2273 * If the skb is shared we need to obtain our own copy.
2274 */
2275 if (skb_shared(skb)) {
a729cff8
JB		 2276 struct sk_buff *tmp_skb = skb;
2277
2278 /* can't happen -- skb is a clone if info_id != 0 */
2279 WARN_ON(info_id);
2280
f8a0a781 2281 skb = skb_clone(skb, GFP_ATOMIC);
7e244707
HS		 2282 kfree_skb(tmp_skb);
2283
4c9451ed
JB		 2284 if (!skb) {
2285 ret = -ENOMEM;
2286 goto free;
2287 }
7e244707
HS		 2288 }
2289
065e9605 2290 hdr.frame_control = fc;
e2ebc74d
JB		 2291 hdr.duration_id = 0;
2292 hdr.seq_ctrl = 0;
2293
2294 skip_header_bytes = ETH_HLEN;
2295 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
2296 encaps_data = bridge_tunnel_header;
2297 encaps_len = sizeof(bridge_tunnel_header);
2298 skip_header_bytes -= 2;
e5c5d22e 2299 } else if (ethertype >= ETH_P_802_3_MIN) {
e2ebc74d
JB		 2300 encaps_data = rfc1042_header;
2301 encaps_len = sizeof(rfc1042_header);
2302 skip_header_bytes -= 2;
2303 } else {
2304 encaps_data = NULL;
2305 encaps_len = 0;
2306 }
2307
7e244707
HS		 2308 nh_pos = skb_network_header(skb) - skb->data;
2309 h_pos = skb_transport_header(skb) - skb->data;
2310
e2ebc74d
JB		 2311 skb_pull(skb, skip_header_bytes);
2312 nh_pos -= skip_header_bytes;
2313 h_pos -= skip_header_bytes;
2314
23c0752a 2315 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
e2ebc74d 2316
23c0752a
JB		 2317 /*
2318 * So we need to modify the skb header and hence need a copy of
2319 * that. The head_need variable above doesn't, so far, include
2320 * the needed header space that we don't need right away. If we
2321 * can, then we don't reallocate right now but only after the
2322 * frame arrives at the master device (if it does...)
2323 *
2324 * If we cannot, however, then we will reallocate to include all
2325 * the ever needed space. Also, if we need to reallocate it anyway,
2326 * make it big enough for everything we may ever need.
2327 */
e2ebc74d 2328
3a5be7d4 2329 if (head_need > 0 || skb_cloned(skb)) {
2475b1cc 2330 head_need += sdata->encrypt_headroom;
23c0752a
JB		 2331 head_need += local->tx_headroom;
2332 head_need = max_t(int, 0, head_need);
c3e7724b
FF		 2333 if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
2334 ieee80211_free_txskb(&local->hw, skb);
1c963bec 2335 skb = NULL;
4c9451ed 2336 return ERR_PTR(-ENOMEM);
c3e7724b 2337 }
e2ebc74d
JB		 2338 }
2339
2340 if (encaps_data) {
2341 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
2342 nh_pos += encaps_len;
2343 h_pos += encaps_len;
2344 }
c29b9b9b 2345
e4ab7eb0 2346#ifdef CONFIG_MAC80211_MESH
33b64eb2
LCC		 2347 if (meshhdrlen > 0) {
2348 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
2349 nh_pos += meshhdrlen;
2350 h_pos += meshhdrlen;
2351 }
e4ab7eb0 2352#endif
33b64eb2 2353
065e9605 2354 if (ieee80211_is_data_qos(fc)) {
c29b9b9b
JB		 2355 __le16 *qos_control;
2356
f359d3fe 2357 qos_control = (__le16 *) skb_push(skb, 2);
c29b9b9b
JB		 2358 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
2359 /*
2360 * Maybe we could actually set some fields here, for now just
2361 * initialise to zero to indicate no special operation.
2362 */
2363 *qos_control = 0;
2364 } else
2365 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
2366
e2ebc74d
JB		 2367 nh_pos += hdrlen;
2368 h_pos += hdrlen;
2369
e2ebc74d
JB		 2370 /* Update skb pointers to various headers since this modified frame
2371 * is going to go through Linux networking code that may potentially
2372 * need things like pointer to IP header. */
2373 skb_set_mac_header(skb, 0);
2374 skb_set_network_header(skb, nh_pos);
2375 skb_set_transport_header(skb, h_pos);
2376
489ee919 2377 info = IEEE80211_SKB_CB(skb);
3b8d81e0
JB		 2378 memset(info, 0, sizeof(*info));
2379
a729cff8
JB		 2380 info->flags = info_flags;
2381 info->ack_frame_id = info_id;
73c4e195 2382 info->band = band;
a729cff8 2383
4c9451ed
JB		 2384 return skb;
2385 free:
2386 kfree_skb(skb);
2387 return ERR_PTR(ret);
2388}
2389
17c18bf8
JB		 2390/*
2391 * fast-xmit overview
2392 *
2393 * The core idea of this fast-xmit is to remove per-packet checks by checking
2394 * them out of band. ieee80211_check_fast_xmit() implements the out-of-band
2395 * checks that are needed to get the sta->fast_tx pointer assigned, after which
2396 * much less work can be done per packet. For example, fragmentation must be
2397 * disabled or the fast_tx pointer will not be set. All the conditions are seen
2398 * in the code here.
2399 *
2400 * Once assigned, the fast_tx data structure also caches the per-packet 802.11
2401 * header and other data to aid packet processing in ieee80211_xmit_fast().
2402 *
2403 * The most difficult part of this is that when any of these assumptions
2404 * change, an external trigger (i.e. a call to ieee80211_clear_fast_xmit(),
2405 * ieee80211_check_fast_xmit() or friends) is required to reset the data,
2406 * since the per-packet code no longer checks the conditions. This is reflected
2407 * by the calls to these functions throughout the rest of the code, and must be
2408 * maintained if any of the TX path checks change.
2409 */
2410
2411void ieee80211_check_fast_xmit(struct sta_info *sta)
2412{
2413 struct ieee80211_fast_tx build = {}, *fast_tx = NULL, *old;
2414 struct ieee80211_local *local = sta->local;
2415 struct ieee80211_sub_if_data *sdata = sta->sdata;
2416 struct ieee80211_hdr *hdr = (void *)build.hdr;
2417 struct ieee80211_chanctx_conf *chanctx_conf;
2418 __le16 fc;
2419
2420 if (!(local->hw.flags & IEEE80211_HW_SUPPORT_FAST_XMIT))
2421 return;
2422
2423 /* Locking here protects both the pointer itself, and against concurrent
2424 * invocations winning data access races to, e.g., the key pointer that
2425 * is used.
2426 * Without it, the invocation of this function right after the key
2427 * pointer changes wouldn't be sufficient, as another CPU could access
2428 * the pointer, then stall, and then do the cache update after the CPU
2429 * that invalidated the key.
2430 * With the locking, such scenarios cannot happen as the check for the
2431 * key and the fast-tx assignment are done atomically, so the CPU that
2432 * modifies the key will either wait or other one will see the key
2433 * cleared/changed already.
2434 */
2435 spin_lock_bh(&sta->lock);
2436 if (local->hw.flags & IEEE80211_HW_SUPPORTS_PS &&
2437 !(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS) &&
2438 sdata->vif.type == NL80211_IFTYPE_STATION)
2439 goto out;
2440
2441 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2442 goto out;
2443
2444 if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
2445 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
2446 test_sta_flag(sta, WLAN_STA_PS_DELIVER))
2447 goto out;
2448
2449 if (sdata->noack_map)
2450 goto out;
2451
2452 /* fast-xmit doesn't handle fragmentation at all */
725b812c
JB		 2453 if (local->hw.wiphy->frag_threshold != (u32)-1 &&
2454 !local->ops->set_frag_threshold)
17c18bf8
JB		 2455 goto out;
2456
2457 rcu_read_lock();
2458 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2459 if (!chanctx_conf) {
2460 rcu_read_unlock();
2461 goto out;
2462 }
2463 build.band = chanctx_conf->def.chan->band;
2464 rcu_read_unlock();
2465
2466 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2467
2468 switch (sdata->vif.type) {
3ffd8840
JB		 2469 case NL80211_IFTYPE_ADHOC:
2470 /* DA SA BSSID */
2471 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2472 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2473 memcpy(hdr->addr3, sdata->u.ibss.bssid, ETH_ALEN);
2474 build.hdr_len = 24;
2475 break;
17c18bf8
JB		 2476 case NL80211_IFTYPE_STATION:
2477 if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2478 /* DA SA BSSID */
2479 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2480 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2481 memcpy(hdr->addr3, sdata->u.mgd.bssid, ETH_ALEN);
2482 build.hdr_len = 24;
2483 break;
2484 }
2485
2486 if (sdata->u.mgd.use_4addr) {
2487 /* non-regular ethertype cannot use the fastpath */
2488 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2489 IEEE80211_FCTL_TODS);
2490 /* RA TA DA SA */
2491 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2492 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2493 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2494 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2495 build.hdr_len = 30;
2496 break;
2497 }
2498 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2499 /* BSSID SA DA */
2500 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2501 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2502 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2503 build.hdr_len = 24;
2504 break;
2505 case NL80211_IFTYPE_AP_VLAN:
2506 if (sdata->wdev.use_4addr) {
2507 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2508 IEEE80211_FCTL_TODS);
2509 /* RA TA DA SA */
2510 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
2511 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2512 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2513 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2514 build.hdr_len = 30;
2515 break;
2516 }
2517 /* fall through */
2518 case NL80211_IFTYPE_AP:
2519 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2520 /* DA BSSID SA */
2521 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2522 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2523 build.sa_offs = offsetof(struct ieee80211_hdr, addr3);
2524 build.hdr_len = 24;
2525 break;
2526 default:
2527 /* not handled on fast-xmit */
2528 goto out;
2529 }
2530
2531 if (sta->sta.wme) {
2532 build.hdr_len += 2;
2533 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2534 }
2535
2536 /* We store the key here so there's no point in using rcu_dereference()
2537 * but that's fine because the code that changes the pointers will call
2538 * this function after doing so. For a single CPU that would be enough,
2539 * for multiple see the comment above.
2540 */
2541 build.key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
2542 if (!build.key)
2543 build.key = rcu_access_pointer(sdata->default_unicast_key);
2544 if (build.key) {
e495c247 2545 bool gen_iv, iv_spc, mmic;
17c18bf8
JB		 2546
2547 gen_iv = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
2548 iv_spc = build.key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
e495c247 2549 mmic = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC;
17c18bf8
JB		 2550
2551 /* don't handle software crypto */
2552 if (!(build.key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
2553 goto out;
2554
2555 switch (build.key->conf.cipher) {
2556 case WLAN_CIPHER_SUITE_CCMP:
2557 case WLAN_CIPHER_SUITE_CCMP_256:
2558 /* add fixed key ID */
2559 if (gen_iv) {
2560 (build.hdr + build.hdr_len)[3] =
2561 0x20 | (build.key->conf.keyidx << 6);
2562 build.pn_offs = build.hdr_len;
2563 }
2564 if (gen_iv || iv_spc)
2565 build.hdr_len += IEEE80211_CCMP_HDR_LEN;
2566 break;
2567 case WLAN_CIPHER_SUITE_GCMP:
2568 case WLAN_CIPHER_SUITE_GCMP_256:
2569 /* add fixed key ID */
2570 if (gen_iv) {
2571 (build.hdr + build.hdr_len)[3] =
2572 0x20 | (build.key->conf.keyidx << 6);
2573 build.pn_offs = build.hdr_len;
2574 }
2575 if (gen_iv || iv_spc)
2576 build.hdr_len += IEEE80211_GCMP_HDR_LEN;
2577 break;
e495c247
JB		 2578 case WLAN_CIPHER_SUITE_TKIP:
2579 /* cannot handle MMIC or IV generation in xmit-fast */
2580 if (mmic || gen_iv)
2581 goto out;
2582 if (iv_spc)
2583 build.hdr_len += IEEE80211_TKIP_IV_LEN;
2584 break;
2585 case WLAN_CIPHER_SUITE_WEP40:
2586 case WLAN_CIPHER_SUITE_WEP104:
2587 /* cannot handle IV generation in fast-xmit */
2588 if (gen_iv)
2589 goto out;
2590 if (iv_spc)
2591 build.hdr_len += IEEE80211_WEP_IV_LEN;
2592 break;
2593 case WLAN_CIPHER_SUITE_AES_CMAC:
2594 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2595 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2596 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2597 WARN(1,
2598 "management cipher suite 0x%x enabled for data\n",
2599 build.key->conf.cipher);
17c18bf8 2600 goto out;
e495c247
JB		 2601 default:
2602 /* we don't know how to generate IVs for this at all */
2603 if (WARN_ON(gen_iv))
2604 goto out;
2605 /* pure hardware keys are OK, of course */
2606 if (!(build.key->flags & KEY_FLAG_CIPHER_SCHEME))
2607 break;
2608 /* cipher scheme might require space allocation */
2609 if (iv_spc &&
2610 build.key->conf.iv_len > IEEE80211_FAST_XMIT_MAX_IV)
2611 goto out;
2612 if (iv_spc)
2613 build.hdr_len += build.key->conf.iv_len;
17c18bf8
JB		 2614 }
2615
2616 fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
2617 }
2618
2619 hdr->frame_control = fc;
2620
2621 memcpy(build.hdr + build.hdr_len,
2622 rfc1042_header, sizeof(rfc1042_header));
2623 build.hdr_len += sizeof(rfc1042_header);
2624
2625 fast_tx = kmemdup(&build, sizeof(build), GFP_ATOMIC);
2626 /* if the kmemdup fails, continue w/o fast_tx */
2627 if (!fast_tx)
2628 goto out;
2629
2630 out:
2631 /* we might have raced against another call to this function */
2632 old = rcu_dereference_protected(sta->fast_tx,
2633 lockdep_is_held(&sta->lock));
2634 rcu_assign_pointer(sta->fast_tx, fast_tx);
2635 if (old)
2636 kfree_rcu(old, rcu_head);
2637 spin_unlock_bh(&sta->lock);
2638}
2639
2640void ieee80211_check_fast_xmit_all(struct ieee80211_local *local)
2641{
2642 struct sta_info *sta;
2643
2644 rcu_read_lock();
2645 list_for_each_entry_rcu(sta, &local->sta_list, list)
2646 ieee80211_check_fast_xmit(sta);
2647 rcu_read_unlock();
2648}
2649
2650void ieee80211_check_fast_xmit_iface(struct ieee80211_sub_if_data *sdata)
2651{
2652 struct ieee80211_local *local = sdata->local;
2653 struct sta_info *sta;
2654
2655 rcu_read_lock();
2656
2657 list_for_each_entry_rcu(sta, &local->sta_list, list) {
2658 if (sdata != sta->sdata &&
2659 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
2660 continue;
2661 ieee80211_check_fast_xmit(sta);
2662 }
2663
2664 rcu_read_unlock();
2665}
2666
2667void ieee80211_clear_fast_xmit(struct sta_info *sta)
2668{
2669 struct ieee80211_fast_tx *fast_tx;
2670
2671 spin_lock_bh(&sta->lock);
2672 fast_tx = rcu_dereference_protected(sta->fast_tx,
2673 lockdep_is_held(&sta->lock));
2674 RCU_INIT_POINTER(sta->fast_tx, NULL);
2675 spin_unlock_bh(&sta->lock);
2676
2677 if (fast_tx)
2678 kfree_rcu(fast_tx, rcu_head);
2679}
2680
2681static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
2682 struct net_device *dev, struct sta_info *sta,
2683 struct ieee80211_fast_tx *fast_tx,
2684 struct sk_buff *skb)
2685{
2686 struct ieee80211_local *local = sdata->local;
2687 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
2688 int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
2689 int hw_headroom = sdata->local->hw.extra_tx_headroom;
2690 struct ethhdr eth;
2691 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2692 struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
2693 struct ieee80211_tx_data tx;
2694 ieee80211_tx_result r;
2695 struct tid_ampdu_tx *tid_tx = NULL;
2696 u8 tid = IEEE80211_NUM_TIDS;
2697
2698 /* control port protocol needs a lot of special handling */
2699 if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
2700 return false;
2701
2702 /* only RFC 1042 SNAP */
2703 if (ethertype < ETH_P_802_3_MIN)
2704 return false;
2705
2706 /* don't handle TX status request here either */
2707 if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
2708 return false;
2709
2710 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
2711 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2712 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2713 if (tid_tx &&
2714 !test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2715 return false;
2716 }
2717
2718 /* after this point (skb is modified) we cannot return false */
2719
2720 if (skb_shared(skb)) {
2721 struct sk_buff *tmp_skb = skb;
2722
2723 skb = skb_clone(skb, GFP_ATOMIC);
2724 kfree_skb(tmp_skb);
2725
2726 if (!skb)
2727 return true;
2728 }
2729
2730 dev->stats.tx_packets++;
2731 dev->stats.tx_bytes += skb->len + extra_head;
2732 dev->trans_start = jiffies;
2733
2734 /* will not be crypto-handled beyond what we do here, so use false
2735 * as the may-encrypt argument for the resize to not account for
2736 * more room than we already have in 'extra_head'
2737 */
2738 if (unlikely(ieee80211_skb_resize(sdata, skb,
2739 max_t(int, extra_head + hw_headroom -
2740 skb_headroom(skb), 0),
2741 false))) {
2742 kfree_skb(skb);
2743 return true;
2744 }
2745
2746 memcpy(&eth, skb->data, ETH_HLEN - 2);
2747 hdr = (void *)skb_push(skb, extra_head);
2748 memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
2749 memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
2750 memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
2751
2752 memset(info, 0, sizeof(*info));
2753 info->band = fast_tx->band;
2754 info->control.vif = &sdata->vif;
2755 info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
2756 IEEE80211_TX_CTL_DONTFRAG |
2757 (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
2758
2759 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
2760 *ieee80211_get_qos_ctl(hdr) = tid;
2761 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
2762 } else {
2763 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
2764 hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
2765 sdata->sequence_number += 0x10;
2766 }
2767
2768 sta->tx_msdu[tid]++;
2769
2770 info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
2771
2772 __skb_queue_head_init(&tx.skbs);
2773
2774 tx.flags = IEEE80211_TX_UNICAST;
2775 tx.local = local;
2776 tx.sdata = sdata;
2777 tx.sta = sta;
2778 tx.key = fast_tx->key;
2779
2780 if (fast_tx->key)
2781 info->control.hw_key = &fast_tx->key->conf;
2782
2783 if (!(local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)) {
2784 tx.skb = skb;
2785 r = ieee80211_tx_h_rate_ctrl(&tx);
2786 skb = tx.skb;
2787 tx.skb = NULL;
2788
2789 if (r != TX_CONTINUE) {
2790 if (r != TX_QUEUED)
2791 kfree_skb(skb);
2792 return true;
2793 }
2794 }
2795
2796 /* statistics normally done by ieee80211_tx_h_stats (but that
2797 * has to consider fragmentation, so is more complex)
2798 */
2799 sta->tx_fragments++;
2800 sta->tx_bytes[skb_get_queue_mapping(skb)] += skb->len;
2801 sta->tx_packets[skb_get_queue_mapping(skb)]++;
2802
2803 if (fast_tx->pn_offs) {
2804 u64 pn;
2805 u8 *crypto_hdr = skb->data + fast_tx->pn_offs;
2806
2807 switch (fast_tx->key->conf.cipher) {
2808 case WLAN_CIPHER_SUITE_CCMP:
2809 case WLAN_CIPHER_SUITE_CCMP_256:
2810 pn = atomic64_inc_return(&fast_tx->key->u.ccmp.tx_pn);
2811 crypto_hdr[0] = pn;
2812 crypto_hdr[1] = pn >> 8;
2813 crypto_hdr[4] = pn >> 16;
2814 crypto_hdr[5] = pn >> 24;
2815 crypto_hdr[6] = pn >> 32;
2816 crypto_hdr[7] = pn >> 40;
2817 break;
2818 case WLAN_CIPHER_SUITE_GCMP:
2819 case WLAN_CIPHER_SUITE_GCMP_256:
2820 pn = atomic64_inc_return(&fast_tx->key->u.gcmp.tx_pn);
2821 crypto_hdr[0] = pn;
2822 crypto_hdr[1] = pn >> 8;
2823 crypto_hdr[4] = pn >> 16;
2824 crypto_hdr[5] = pn >> 24;
2825 crypto_hdr[6] = pn >> 32;
2826 crypto_hdr[7] = pn >> 40;
2827 break;
2828 }
2829 }
2830
2831 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2832 sdata = container_of(sdata->bss,
2833 struct ieee80211_sub_if_data, u.ap);
2834
2835 __skb_queue_tail(&tx.skbs, skb);
2836 ieee80211_tx_frags(local, &sdata->vif, &sta->sta, &tx.skbs, false);
2837 return true;
2838}
2839
4c9451ed
JB		 2840void __ieee80211_subif_start_xmit(struct sk_buff *skb,
2841 struct net_device *dev,
2842 u32 info_flags)
2843{
2844 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
97ffe757 2845 struct sta_info *sta;
4c9451ed
JB		 2846
2847 if (unlikely(skb->len < ETH_HLEN)) {
2848 kfree_skb(skb);
2849 return;
2850 }
2851
2852 rcu_read_lock();
e2ebc74d 2853
2d981fdd
JB		 2854 if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
2855 goto out_free;
4c9451ed 2856
17c18bf8
JB		 2857 if (!IS_ERR_OR_NULL(sta)) {
2858 struct ieee80211_fast_tx *fast_tx;
2859
2860 fast_tx = rcu_dereference(sta->fast_tx);
2861
2862 if (fast_tx &&
2863 ieee80211_xmit_fast(sdata, dev, sta, fast_tx, skb))
2864 goto out;
2865 }
2866
2d981fdd
JB		 2867 /* the frame could be fragmented, software-encrypted, and other things
2868 * so we cannot really handle checksum offload with it - fix it up in
2869 * software before we handle anything else.
2870 */
2871 if (skb->ip_summed == CHECKSUM_PARTIAL) {
2872 if (skb->encapsulation)
2873 skb_set_inner_transport_header(skb,
2874 skb_checksum_start_offset(skb));
2875 else
2876 skb_set_transport_header(skb,
2877 skb_checksum_start_offset(skb));
2878 if (skb_checksum_help(skb))
2879 goto out_free;
2880 }
2881
97ffe757 2882 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
4c9451ed
JB		 2883 if (IS_ERR(skb))
2884 goto out;
2885
2886 dev->stats.tx_packets++;
2887 dev->stats.tx_bytes += skb->len;
2888 dev->trans_start = jiffies;
e2ebc74d 2889
7c10770f 2890 ieee80211_xmit(sdata, sta, skb);
2d981fdd
JB		 2891 goto out;
2892 out_free:
2893 kfree_skb(skb);
4c9451ed 2894 out:
55de908a 2895 rcu_read_unlock();
e2ebc74d
JB		 2896}
2897
4c9451ed
JB		 2898/**
2899 * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
2900 * @skb: packet to be sent
2901 * @dev: incoming interface
2902 *
2903 * On failure skb will be freed.
2904 */
24d342c5
LK		 2905netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
2906 struct net_device *dev)
2907{
2908 __ieee80211_subif_start_xmit(skb, dev, 0);
2909 return NETDEV_TX_OK;
2910}
e2ebc74d 2911
7528ec57
JB		 2912struct sk_buff *
2913ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
2914 struct sk_buff *skb, u32 info_flags)
2915{
2916 struct ieee80211_hdr *hdr;
2917 struct ieee80211_tx_data tx = {
2918 .local = sdata->local,
2919 .sdata = sdata,
2920 };
97ffe757 2921 struct sta_info *sta;
7528ec57
JB		 2922
2923 rcu_read_lock();
2924
97ffe757
JB		 2925 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
2926 kfree_skb(skb);
2927 skb = ERR_PTR(-EINVAL);
2928 goto out;
2929 }
2930
2931 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
7528ec57
JB		 2932 if (IS_ERR(skb))
2933 goto out;
2934
2935 hdr = (void *)skb->data;
2936 tx.sta = sta_info_get(sdata, hdr->addr1);
2937 tx.skb = skb;
2938
2939 if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
2940 rcu_read_unlock();
2941 kfree_skb(skb);
2942 return ERR_PTR(-EINVAL);
2943 }
2944
2945out:
2946 rcu_read_unlock();
2947 return skb;
2948}
2949
e2530083
JB		 2950/*
2951 * ieee80211_clear_tx_pending may not be called in a context where
2952 * it is possible that it packets could come in again.
2953 */
e2ebc74d
JB		 2954void ieee80211_clear_tx_pending(struct ieee80211_local *local)
2955{
1f98ab7f 2956 struct sk_buff *skb;
2de8e0d9 2957 int i;
e2ebc74d 2958
1f98ab7f
FF		 2959 for (i = 0; i < local->hw.queues; i++) {
2960 while ((skb = skb_dequeue(&local->pending[i])) != NULL)
2961 ieee80211_free_txskb(&local->hw, skb);
2962 }
e2ebc74d
JB		 2963}
2964
7bb45683
JB		 2965/*
2966 * Returns false if the frame couldn't be transmitted but was queued instead,
2967 * which in this case means re-queued -- take as an indication to stop sending
2968 * more pending frames.
2969 */
cd8ffc80
JB		 2970static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
2971 struct sk_buff *skb)
2972{
2973 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2974 struct ieee80211_sub_if_data *sdata;
2975 struct sta_info *sta;
2976 struct ieee80211_hdr *hdr;
7bb45683 2977 bool result;
55de908a 2978 struct ieee80211_chanctx_conf *chanctx_conf;
cd8ffc80 2979
5061b0c2 2980 sdata = vif_to_sdata(info->control.vif);
cd8ffc80
JB		 2981
2982 if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
55de908a
JB		 2983 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2984 if (unlikely(!chanctx_conf)) {
2985 dev_kfree_skb(skb);
2986 return true;
2987 }
73c4e195 2988 info->band = chanctx_conf->def.chan->band;
7c10770f 2989 result = ieee80211_tx(sdata, NULL, skb, true);
cd8ffc80 2990 } else {
252b86c4
JB		 2991 struct sk_buff_head skbs;
2992
2993 __skb_queue_head_init(&skbs);
2994 __skb_queue_tail(&skbs, skb);
2995
cd8ffc80 2996 hdr = (struct ieee80211_hdr *)skb->data;
abe60632 2997 sta = sta_info_get(sdata, hdr->addr1);
cd8ffc80 2998
74e4dbfd 2999 result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
cd8ffc80
JB		 3000 }
3001
cd8ffc80
JB		 3002 return result;
3003}
3004
e2530083 3005/*
3b8d81e0 3006 * Transmit all pending packets. Called from tasklet.
e2530083 3007 */
e2ebc74d
JB		 3008void ieee80211_tx_pending(unsigned long data)
3009{
3010 struct ieee80211_local *local = (struct ieee80211_local *)data;
2a577d98 3011 unsigned long flags;
cd8ffc80 3012 int i;
3b8d81e0 3013 bool txok;
e2ebc74d 3014
f0e72851 3015 rcu_read_lock();
e2530083 3016
3b8d81e0 3017 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2a577d98
JB		 3018 for (i = 0; i < local->hw.queues; i++) {
3019 /*
3020 * If queue is stopped by something other than due to pending
3021 * frames, or we have no pending frames, proceed to next queue.
3022 */
3b8d81e0 3023 if (local->queue_stop_reasons[i] ||
2a577d98 3024 skb_queue_empty(&local->pending[i]))
e2ebc74d 3025 continue;
e2530083 3026
2a577d98 3027 while (!skb_queue_empty(&local->pending[i])) {
3b8d81e0 3028 struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
5061b0c2 3029 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
5061b0c2 3030
a7bc376c 3031 if (WARN_ON(!info->control.vif)) {
c3e7724b 3032 ieee80211_free_txskb(&local->hw, skb);
a7bc376c
JB		 3033 continue;
3034 }
3035
3b8d81e0
JB		 3036 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
3037 flags);
3038
3039 txok = ieee80211_tx_pending_skb(local, skb);
3b8d81e0
JB		 3040 spin_lock_irqsave(&local->queue_stop_reason_lock,
3041 flags);
3042 if (!txok)
2a577d98 3043 break;
e2ebc74d 3044 }
7236fe29
JB		 3045
3046 if (skb_queue_empty(&local->pending[i]))
3a25a8c8 3047 ieee80211_propagate_queue_wake(local, i);
e2ebc74d 3048 }
3b8d81e0 3049 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2a577d98 3050
f0e72851 3051 rcu_read_unlock();
e2ebc74d
JB		 3052}
3053
3054/* functions for drivers to get certain frames */
3055
eac70c13 3056static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
6ec8c332
AO		 3057 struct ps_data *ps, struct sk_buff *skb,
3058 bool is_template)
e2ebc74d
JB		 3059{
3060 u8 *pos, *tim;
3061 int aid0 = 0;
3062 int i, have_bits = 0, n1, n2;
3063
3064 /* Generate bitmap for TIM only if there are any STAs in power save
3065 * mode. */
d012a605 3066 if (atomic_read(&ps->num_sta_ps) > 0)
e2ebc74d
JB		 3067 /* in the hope that this is faster than
3068 * checking byte-for-byte */
f359d3fe 3069 have_bits = !bitmap_empty((unsigned long *)ps->tim,
e2ebc74d 3070 IEEE80211_MAX_AID+1);
6ec8c332
AO		 3071 if (!is_template) {
3072 if (ps->dtim_count == 0)
3073 ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
3074 else
3075 ps->dtim_count--;
3076 }
e2ebc74d
JB		 3077
3078 tim = pos = (u8 *) skb_put(skb, 6);
3079 *pos++ = WLAN_EID_TIM;
3080 *pos++ = 4;
d012a605 3081 *pos++ = ps->dtim_count;
8860020e 3082 *pos++ = sdata->vif.bss_conf.dtim_period;
e2ebc74d 3083
d012a605 3084 if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf))
e2ebc74d
JB		 3085 aid0 = 1;
3086
d012a605 3087 ps->dtim_bc_mc = aid0 == 1;
512119b3 3088
e2ebc74d
JB		 3089 if (have_bits) {
3090 /* Find largest even number N1 so that bits numbered 1 through
3091 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
3092 * (N2 + 1) x 8 through 2007 are 0. */
3093 n1 = 0;
3094 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
d012a605 3095 if (ps->tim[i]) {
e2ebc74d
JB		 3096 n1 = i & 0xfe;
3097 break;
3098 }
3099 }
3100 n2 = n1;
3101 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
d012a605 3102 if (ps->tim[i]) {
e2ebc74d
JB		 3103 n2 = i;
3104 break;
3105 }
3106 }
3107
3108 /* Bitmap control */
3109 *pos++ = n1 | aid0;
3110 /* Part Virt Bitmap */
5220da39 3111 skb_put(skb, n2 - n1);
d012a605 3112 memcpy(pos, ps->tim + n1, n2 - n1 + 1);
e2ebc74d
JB		 3113
3114 tim[1] = n2 - n1 + 4;
e2ebc74d
JB		 3115 } else {
3116 *pos++ = aid0; /* Bitmap control */
3117 *pos++ = 0; /* Part Virt Bitmap */
3118 }
e2ebc74d
JB		 3119}
3120
eac70c13 3121static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
6ec8c332
AO		 3122 struct ps_data *ps, struct sk_buff *skb,
3123 bool is_template)
eac70c13
MP		 3124{
3125 struct ieee80211_local *local = sdata->local;
3126
3127 /*
3128 * Not very nice, but we want to allow the driver to call
3129 * ieee80211_beacon_get() as a response to the set_tim()
3130 * callback. That, however, is already invoked under the
3131 * sta_lock to guarantee consistent and race-free update
3132 * of the tim bitmap in mac80211 and the driver.
3133 */
3134 if (local->tim_in_locked_section) {
6ec8c332 3135 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
eac70c13 3136 } else {
1b91731d 3137 spin_lock_bh(&local->tim_lock);
6ec8c332 3138 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
1b91731d 3139 spin_unlock_bh(&local->tim_lock);
eac70c13
MP		 3140 }
3141
3142 return 0;
3143}
3144
1af586c9
AO		 3145static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
3146 struct beacon_data *beacon)
73da7d5b
SW		 3147{
3148 struct probe_resp *resp;
cd7760e6
SW		 3149 u8 *beacon_data;
3150 size_t beacon_data_len;
0d06d9ba 3151 int i;
af296bdb 3152 u8 count = beacon->csa_current_counter;
cd7760e6
SW		 3153
3154 switch (sdata->vif.type) {
3155 case NL80211_IFTYPE_AP:
3156 beacon_data = beacon->tail;
3157 beacon_data_len = beacon->tail_len;
3158 break;
3159 case NL80211_IFTYPE_ADHOC:
3160 beacon_data = beacon->head;
3161 beacon_data_len = beacon->head_len;
3162 break;
b8456a14
CYY		 3163 case NL80211_IFTYPE_MESH_POINT:
3164 beacon_data = beacon->head;
3165 beacon_data_len = beacon->head_len;
3166 break;
cd7760e6
SW		 3167 default:
3168 return;
3169 }
73da7d5b 3170
af296bdb 3171 rcu_read_lock();
0d06d9ba 3172 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
af296bdb 3173 resp = rcu_dereference(sdata->u.ap.probe_resp);
0d06d9ba 3174
af296bdb
MK		 3175 if (beacon->csa_counter_offsets[i]) {
3176 if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
3177 beacon_data_len)) {
0d06d9ba
AO		 3178 rcu_read_unlock();
3179 return;
3180 }
af296bdb
MK		 3181
3182 beacon_data[beacon->csa_counter_offsets[i]] = count;
73da7d5b 3183 }
af296bdb
MK		 3184
3185 if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
3186 resp->data[resp->csa_counter_offsets[i]] = count;
73da7d5b 3187 }
af296bdb 3188 rcu_read_unlock();
1af586c9
AO		 3189}
3190
3191u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
3192{
3193 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
af296bdb
MK		 3194 struct beacon_data *beacon = NULL;
3195 u8 count = 0;
0d06d9ba 3196
af296bdb
MK		 3197 rcu_read_lock();
3198
3199 if (sdata->vif.type == NL80211_IFTYPE_AP)
3200 beacon = rcu_dereference(sdata->u.ap.beacon);
3201 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3202 beacon = rcu_dereference(sdata->u.ibss.presp);
3203 else if (ieee80211_vif_is_mesh(&sdata->vif))
3204 beacon = rcu_dereference(sdata->u.mesh.beacon);
3205
3206 if (!beacon)
3207 goto unlock;
3208
3209 beacon->csa_current_counter--;
1af586c9
AO		 3210
3211 /* the counter should never reach 0 */
af296bdb
MK		 3212 WARN_ON_ONCE(!beacon->csa_current_counter);
3213 count = beacon->csa_current_counter;
1af586c9 3214
af296bdb
MK		 3215unlock:
3216 rcu_read_unlock();
3217 return count;
73da7d5b 3218}
1af586c9 3219EXPORT_SYMBOL(ieee80211_csa_update_counter);
73da7d5b
SW		 3220
3221bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
3222{
3223 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3224 struct beacon_data *beacon = NULL;
3225 u8 *beacon_data;
3226 size_t beacon_data_len;
73da7d5b
SW		 3227 int ret = false;
3228
3229 if (!ieee80211_sdata_running(sdata))
3230 return false;
3231
3232 rcu_read_lock();
3233 if (vif->type == NL80211_IFTYPE_AP) {
3234 struct ieee80211_if_ap *ap = &sdata->u.ap;
3235
3236 beacon = rcu_dereference(ap->beacon);
3237 if (WARN_ON(!beacon || !beacon->tail))
3238 goto out;
3239 beacon_data = beacon->tail;
3240 beacon_data_len = beacon->tail_len;
cd7760e6
SW		 3241 } else if (vif->type == NL80211_IFTYPE_ADHOC) {
3242 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
3243
3244 beacon = rcu_dereference(ifibss->presp);
3245 if (!beacon)
3246 goto out;
3247
b8456a14
CYY		 3248 beacon_data = beacon->head;
3249 beacon_data_len = beacon->head_len;
3250 } else if (vif->type == NL80211_IFTYPE_MESH_POINT) {
3251 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
3252
3253 beacon = rcu_dereference(ifmsh->beacon);
3254 if (!beacon)
3255 goto out;
3256
cd7760e6
SW		 3257 beacon_data = beacon->head;
3258 beacon_data_len = beacon->head_len;
73da7d5b
SW		 3259 } else {
3260 WARN_ON(1);
3261 goto out;
3262 }
3263
10d78f27
MK		 3264 if (!beacon->csa_counter_offsets[0])
3265 goto out;
3266
af296bdb 3267 if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
73da7d5b
SW		 3268 goto out;
3269
af296bdb 3270 if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
73da7d5b
SW		 3271 ret = true;
3272 out:
3273 rcu_read_unlock();
3274
3275 return ret;
3276}
3277EXPORT_SYMBOL(ieee80211_csa_is_complete);
3278
6ec8c332
AO		 3279static struct sk_buff *
3280__ieee80211_beacon_get(struct ieee80211_hw *hw,
3281 struct ieee80211_vif *vif,
3282 struct ieee80211_mutable_offsets *offs,
3283 bool is_template)
e2ebc74d
JB		 3284{
3285 struct ieee80211_local *local = hw_to_local(hw);
af296bdb 3286 struct beacon_data *beacon = NULL;
9d139c81 3287 struct sk_buff *skb = NULL;
e039fa4a 3288 struct ieee80211_tx_info *info;
e2ebc74d 3289 struct ieee80211_sub_if_data *sdata = NULL;
55de908a 3290 enum ieee80211_band band;
e00cfce0 3291 struct ieee80211_tx_rate_control txrc;
55de908a 3292 struct ieee80211_chanctx_conf *chanctx_conf;
1af586c9 3293 int csa_off_base = 0;
8318d78a 3294
5dfdaf58 3295 rcu_read_lock();
e2ebc74d 3296
32bfd35d 3297 sdata = vif_to_sdata(vif);
55de908a 3298 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
e2ebc74d 3299
55de908a 3300 if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
eb3e554b
FF		 3301 goto out;
3302
6ec8c332
AO		 3303 if (offs)
3304 memset(offs, 0, sizeof(*offs));
eddcbb94 3305
05c914fe 3306 if (sdata->vif.type == NL80211_IFTYPE_AP) {
d012a605 3307 struct ieee80211_if_ap *ap = &sdata->u.ap;
d012a605 3308
af296bdb 3309 beacon = rcu_dereference(ap->beacon);
3ad97fbc 3310 if (beacon) {
10d78f27 3311 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 3312 if (!is_template)
3313 ieee80211_csa_update_counter(vif);
3314
3315 ieee80211_set_csa(sdata, beacon);
3316 }
73da7d5b 3317
902acc78
JB		 3318 /*
3319 * headroom, head length,
3320 * tail length and maximum TIM length
3321 */
3322 skb = dev_alloc_skb(local->tx_headroom +
3323 beacon->head_len +
70dabeb7
FF		 3324 beacon->tail_len + 256 +
3325 local->hw.extra_beacon_tailroom);
902acc78
JB		 3326 if (!skb)
3327 goto out;
33b64eb2 3328
902acc78
JB		 3329 skb_reserve(skb, local->tx_headroom);
3330 memcpy(skb_put(skb, beacon->head_len), beacon->head,
3331 beacon->head_len);
33b64eb2 3332
6ec8c332
AO		 3333 ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
3334 is_template);
33b64eb2 3335
6ec8c332
AO		 3336 if (offs) {
3337 offs->tim_offset = beacon->head_len;
3338 offs->tim_length = skb->len - beacon->head_len;
1af586c9
AO		 3339
3340 /* for AP the csa offsets are from tail */
3341 csa_off_base = skb->len;
6ec8c332 3342 }
eddcbb94 3343
902acc78
JB		 3344 if (beacon->tail)
3345 memcpy(skb_put(skb, beacon->tail_len),
3346 beacon->tail, beacon->tail_len);
9d139c81
JB		 3347 } else
3348 goto out;
05c914fe 3349 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
46900298 3350 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
9d139c81 3351 struct ieee80211_hdr *hdr;
33b64eb2 3352
af296bdb
MK		 3353 beacon = rcu_dereference(ifibss->presp);
3354 if (!beacon)
9d139c81
JB		 3355 goto out;
3356
10d78f27 3357 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 3358 if (!is_template)
3359 ieee80211_csa_update_counter(vif);
cd7760e6 3360
af296bdb 3361 ieee80211_set_csa(sdata, beacon);
1af586c9 3362 }
cd7760e6 3363
af296bdb 3364 skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
70dabeb7 3365 local->hw.extra_beacon_tailroom);
9d139c81
JB		 3366 if (!skb)
3367 goto out;
c3ffeab4 3368 skb_reserve(skb, local->tx_headroom);
af296bdb
MK		 3369 memcpy(skb_put(skb, beacon->head_len), beacon->head,
3370 beacon->head_len);
9d139c81
JB		 3371
3372 hdr = (struct ieee80211_hdr *) skb->data;
e7827a70
HH		 3373 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3374 IEEE80211_STYPE_BEACON);
902acc78 3375 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
dbf498fb 3376 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
472dbc45 3377
af296bdb
MK		 3378 beacon = rcu_dereference(ifmsh->beacon);
3379 if (!beacon)
ac1bd846 3380 goto out;
ac1bd846 3381
10d78f27 3382 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 3383 if (!is_template)
3384 /* TODO: For mesh csa_counter is in TU, so
3385 * decrementing it by one isn't correct, but
3386 * for now we leave it consistent with overall
3387 * mac80211's behavior.
3388 */
3389 ieee80211_csa_update_counter(vif);
3390
af296bdb 3391 ieee80211_set_csa(sdata, beacon);
1af586c9 3392 }
b8456a14 3393
dbf498fb 3394 if (ifmsh->sync_ops)
af296bdb 3395 ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
dbf498fb 3396
3b69a9c5 3397 skb = dev_alloc_skb(local->tx_headroom +
af296bdb 3398 beacon->head_len +
3f52b7e3 3399 256 + /* TIM IE */
af296bdb 3400 beacon->tail_len +
70dabeb7 3401 local->hw.extra_beacon_tailroom);
902acc78
JB		 3402 if (!skb)
3403 goto out;
2b5e1967 3404 skb_reserve(skb, local->tx_headroom);
af296bdb
MK		 3405 memcpy(skb_put(skb, beacon->head_len), beacon->head,
3406 beacon->head_len);
6ec8c332
AO		 3407 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
3408
3409 if (offs) {
af296bdb
MK		 3410 offs->tim_offset = beacon->head_len;
3411 offs->tim_length = skb->len - beacon->head_len;
6ec8c332
AO		 3412 }
3413
af296bdb
MK		 3414 memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
3415 beacon->tail_len);
9d139c81
JB		 3416 } else {
3417 WARN_ON(1);
5dfdaf58 3418 goto out;
e2ebc74d
JB		 3419 }
3420
1af586c9 3421 /* CSA offsets */
af296bdb 3422 if (offs && beacon) {
1af586c9
AO		 3423 int i;
3424
3425 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
af296bdb 3426 u16 csa_off = beacon->csa_counter_offsets[i];
1af586c9
AO		 3427
3428 if (!csa_off)
3429 continue;
3430
3431 offs->csa_counter_offs[i] = csa_off_base + csa_off;
3432 }
3433 }
3434
4bf88530 3435 band = chanctx_conf->def.chan->band;
55de908a 3436
e039fa4a
JB		 3437 info = IEEE80211_SKB_CB(skb);
3438
3b8d81e0 3439 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
e00cfce0 3440 info->flags |= IEEE80211_TX_CTL_NO_ACK;
e039fa4a 3441 info->band = band;
e00cfce0
JM		 3442
3443 memset(&txrc, 0, sizeof(txrc));
3444 txrc.hw = hw;
e31583cd 3445 txrc.sband = local->hw.wiphy->bands[band];
e00cfce0
JM		 3446 txrc.bss_conf = &sdata->vif.bss_conf;
3447 txrc.skb = skb;
3448 txrc.reported_rate.idx = -1;
37eb0b16 3449 txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
e31583cd 3450 if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1)
37eb0b16
JM		 3451 txrc.max_rate_idx = -1;
3452 else
3453 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
8f0729b1 3454 txrc.bss = true;
e00cfce0 3455 rate_control_get_rate(sdata, NULL, &txrc);
e039fa4a
JB		 3456
3457 info->control.vif = vif;
f591fa5d 3458
a472e71b
JL		 3459 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
3460 IEEE80211_TX_CTL_ASSIGN_SEQ |
3461 IEEE80211_TX_CTL_FIRST_FRAGMENT;
e6a9854b 3462 out:
5dfdaf58 3463 rcu_read_unlock();
e2ebc74d 3464 return skb;
6ec8c332
AO		 3465
3466}
3467
3468struct sk_buff *
3469ieee80211_beacon_get_template(struct ieee80211_hw *hw,
3470 struct ieee80211_vif *vif,
3471 struct ieee80211_mutable_offsets *offs)
3472{
3473 return __ieee80211_beacon_get(hw, vif, offs, true);
3474}
3475EXPORT_SYMBOL(ieee80211_beacon_get_template);
3476
3477struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
3478 struct ieee80211_vif *vif,
3479 u16 *tim_offset, u16 *tim_length)
3480{
3481 struct ieee80211_mutable_offsets offs = {};
3482 struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
3483
3484 if (tim_offset)
3485 *tim_offset = offs.tim_offset;
3486
3487 if (tim_length)
3488 *tim_length = offs.tim_length;
3489
3490 return bcn;
e2ebc74d 3491}
eddcbb94 3492EXPORT_SYMBOL(ieee80211_beacon_get_tim);
e2ebc74d 3493
02945821
AN		 3494struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
3495 struct ieee80211_vif *vif)
3496{
3497 struct ieee80211_if_ap *ap = NULL;
aa7a0080
ES		 3498 struct sk_buff *skb = NULL;
3499 struct probe_resp *presp = NULL;
02945821
AN		 3500 struct ieee80211_hdr *hdr;
3501 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3502
3503 if (sdata->vif.type != NL80211_IFTYPE_AP)
3504 return NULL;
3505
3506 rcu_read_lock();
3507
3508 ap = &sdata->u.ap;
3509 presp = rcu_dereference(ap->probe_resp);
3510 if (!presp)
3511 goto out;
3512
aa7a0080 3513 skb = dev_alloc_skb(presp->len);
02945821
AN		 3514 if (!skb)
3515 goto out;
3516
aa7a0080
ES		 3517 memcpy(skb_put(skb, presp->len), presp->data, presp->len);
3518
02945821
AN		 3519 hdr = (struct ieee80211_hdr *) skb->data;
3520 memset(hdr->addr1, 0, sizeof(hdr->addr1));
3521
3522out:
3523 rcu_read_unlock();
3524 return skb;
3525}
3526EXPORT_SYMBOL(ieee80211_proberesp_get);
3527
7044cc56
KV		 3528struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
3529 struct ieee80211_vif *vif)
3530{
3531 struct ieee80211_sub_if_data *sdata;
3532 struct ieee80211_if_managed *ifmgd;
3533 struct ieee80211_pspoll *pspoll;
3534 struct ieee80211_local *local;
3535 struct sk_buff *skb;
3536
3537 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3538 return NULL;
3539
3540 sdata = vif_to_sdata(vif);
3541 ifmgd = &sdata->u.mgd;
3542 local = sdata->local;
3543
3544 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
d15b8459 3545 if (!skb)
7044cc56 3546 return NULL;
d15b8459 3547
7044cc56
KV		 3548 skb_reserve(skb, local->hw.extra_tx_headroom);
3549
3550 pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
3551 memset(pspoll, 0, sizeof(*pspoll));
3552 pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
3553 IEEE80211_STYPE_PSPOLL);
3554 pspoll->aid = cpu_to_le16(ifmgd->aid);
3555
3556 /* aid in PS-Poll has its two MSBs each set to 1 */
3557 pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
3558
3559 memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
3560 memcpy(pspoll->ta, vif->addr, ETH_ALEN);
3561
3562 return skb;
3563}
3564EXPORT_SYMBOL(ieee80211_pspoll_get);
3565
3566struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
3567 struct ieee80211_vif *vif)
3568{
3569 struct ieee80211_hdr_3addr *nullfunc;
3570 struct ieee80211_sub_if_data *sdata;
3571 struct ieee80211_if_managed *ifmgd;
3572 struct ieee80211_local *local;
3573 struct sk_buff *skb;
3574
3575 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3576 return NULL;
3577
3578 sdata = vif_to_sdata(vif);
3579 ifmgd = &sdata->u.mgd;
3580 local = sdata->local;
3581
3582 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
d15b8459 3583 if (!skb)
7044cc56 3584 return NULL;
d15b8459 3585
7044cc56
KV		 3586 skb_reserve(skb, local->hw.extra_tx_headroom);
3587
3588 nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
3589 sizeof(*nullfunc));
3590 memset(nullfunc, 0, sizeof(*nullfunc));
3591 nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
3592 IEEE80211_STYPE_NULLFUNC |
3593 IEEE80211_FCTL_TODS);
3594 memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
3595 memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
3596 memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
3597
3598 return skb;
3599}
3600EXPORT_SYMBOL(ieee80211_nullfunc_get);
3601
05e54ea6 3602struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
a344d677 3603 const u8 *src_addr,
05e54ea6 3604 const u8 *ssid, size_t ssid_len,
b9a9ada1 3605 size_t tailroom)
05e54ea6 3606{
a344d677 3607 struct ieee80211_local *local = hw_to_local(hw);
05e54ea6
KV		 3608 struct ieee80211_hdr_3addr *hdr;
3609 struct sk_buff *skb;
3610 size_t ie_ssid_len;
3611 u8 *pos;
3612
05e54ea6
KV		 3613 ie_ssid_len = 2 + ssid_len;
3614
3615 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
b9a9ada1 3616 ie_ssid_len + tailroom);
d15b8459 3617 if (!skb)
05e54ea6 3618 return NULL;
05e54ea6
KV		 3619
3620 skb_reserve(skb, local->hw.extra_tx_headroom);
3621
3622 hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
3623 memset(hdr, 0, sizeof(*hdr));
3624 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3625 IEEE80211_STYPE_PROBE_REQ);
e83e6541 3626 eth_broadcast_addr(hdr->addr1);
a344d677 3627 memcpy(hdr->addr2, src_addr, ETH_ALEN);
e83e6541 3628 eth_broadcast_addr(hdr->addr3);
05e54ea6
KV		 3629
3630 pos = skb_put(skb, ie_ssid_len);
3631 *pos++ = WLAN_EID_SSID;
3632 *pos++ = ssid_len;
88c868c4 3633 if (ssid_len)
05e54ea6
KV		 3634 memcpy(pos, ssid, ssid_len);
3635 pos += ssid_len;
3636
05e54ea6
KV		 3637 return skb;
3638}
3639EXPORT_SYMBOL(ieee80211_probereq_get);
3640
32bfd35d 3641void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 3642 const void *frame, size_t frame_len,
e039fa4a 3643 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB		 3644 struct ieee80211_rts *rts)
3645{
3646 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 3647
065e9605
HH		 3648 rts->frame_control =
3649 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
32bfd35d
JB		 3650 rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
3651 frame_txctl);
e2ebc74d
JB		 3652 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
3653 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
3654}
3655EXPORT_SYMBOL(ieee80211_rts_get);
3656
32bfd35d 3657void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 3658 const void *frame, size_t frame_len,
e039fa4a 3659 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB		 3660 struct ieee80211_cts *cts)
3661{
3662 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 3663
065e9605
HH		 3664 cts->frame_control =
3665 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
32bfd35d
JB		 3666 cts->duration = ieee80211_ctstoself_duration(hw, vif,
3667 frame_len, frame_txctl);
e2ebc74d
JB		 3668 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
3669}
3670EXPORT_SYMBOL(ieee80211_ctstoself_get);
3671
3672struct sk_buff *
32bfd35d 3673ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
e039fa4a 3674 struct ieee80211_vif *vif)
e2ebc74d
JB		 3675{
3676 struct ieee80211_local *local = hw_to_local(hw);
747cf5e9 3677 struct sk_buff *skb = NULL;
5cf121c3 3678 struct ieee80211_tx_data tx;
e2ebc74d 3679 struct ieee80211_sub_if_data *sdata;
d012a605 3680 struct ps_data *ps;
e039fa4a 3681 struct ieee80211_tx_info *info;
55de908a 3682 struct ieee80211_chanctx_conf *chanctx_conf;
e2ebc74d 3683
32bfd35d 3684 sdata = vif_to_sdata(vif);
5dfdaf58 3685
5dfdaf58 3686 rcu_read_lock();
55de908a 3687 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
5dfdaf58 3688
d012a605
MP		 3689 if (!chanctx_conf)
3690 goto out;
3691
3692 if (sdata->vif.type == NL80211_IFTYPE_AP) {
3693 struct beacon_data *beacon =
3694 rcu_dereference(sdata->u.ap.beacon);
3695
3696 if (!beacon || !beacon->head)
3697 goto out;
3698
3699 ps = &sdata->u.ap.ps;
3f52b7e3
MP		 3700 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
3701 ps = &sdata->u.mesh.ps;
d012a605 3702 } else {
747cf5e9 3703 goto out;
d012a605 3704 }
5dfdaf58 3705
d012a605 3706 if (ps->dtim_count != 0 || !ps->dtim_bc_mc)
747cf5e9 3707 goto out; /* send buffered bc/mc only after DTIM beacon */
e039fa4a 3708
e2ebc74d 3709 while (1) {
d012a605 3710 skb = skb_dequeue(&ps->bc_buf);
e2ebc74d 3711 if (!skb)
747cf5e9 3712 goto out;
e2ebc74d
JB		 3713 local->total_ps_buffered--;
3714
d012a605 3715 if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) {
e2ebc74d
JB		 3716 struct ieee80211_hdr *hdr =
3717 (struct ieee80211_hdr *) skb->data;
3718 /* more buffered multicast/broadcast frames ==> set
3719 * MoreData flag in IEEE 802.11 header to inform PS
3720 * STAs */
3721 hdr->frame_control |=
3722 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
3723 }
3724
112c44b2 3725 if (sdata->vif.type == NL80211_IFTYPE_AP)
7cbf9d01 3726 sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
7c10770f 3727 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
e2ebc74d
JB		 3728 break;
3729 dev_kfree_skb_any(skb);
3730 }
e039fa4a
JB		 3731
3732 info = IEEE80211_SKB_CB(skb);
3733
5cf121c3 3734 tx.flags |= IEEE80211_TX_PS_BUFFERED;
4bf88530 3735 info->band = chanctx_conf->def.chan->band;
e2ebc74d 3736
97b045d6 3737 if (invoke_tx_handlers(&tx))
e2ebc74d 3738 skb = NULL;
97b045d6 3739 out:
d0709a65 3740 rcu_read_unlock();
e2ebc74d
JB		 3741
3742 return skb;
3743}
3744EXPORT_SYMBOL(ieee80211_get_buffered_bc);
3b8d81e0 3745
b6da911b
LK		 3746int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
3747{
3748 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
3749 struct ieee80211_sub_if_data *sdata = sta->sdata;
3750 struct ieee80211_local *local = sdata->local;
3751 int ret;
3752 u32 queues;
3753
3754 lockdep_assert_held(&local->sta_mtx);
3755
3756 /* only some cases are supported right now */
3757 switch (sdata->vif.type) {
3758 case NL80211_IFTYPE_STATION:
3759 case NL80211_IFTYPE_AP:
3760 case NL80211_IFTYPE_AP_VLAN:
3761 break;
3762 default:
3763 WARN_ON(1);
3764 return -EINVAL;
3765 }
3766
3767 if (WARN_ON(tid >= IEEE80211_NUM_UPS))
3768 return -EINVAL;
3769
3770 if (sta->reserved_tid == tid) {
3771 ret = 0;
3772 goto out;
3773 }
3774
3775 if (sta->reserved_tid != IEEE80211_TID_UNRESERVED) {
3776 sdata_err(sdata, "TID reservation already active\n");
3777 ret = -EALREADY;
3778 goto out;
3779 }
3780
3781 ieee80211_stop_vif_queues(sdata->local, sdata,
3782 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
3783
3784 synchronize_net();
3785
3786 /* Tear down BA sessions so we stop aggregating on this TID */
3787 if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) {
3788 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
3789 __ieee80211_stop_tx_ba_session(sta, tid,
3790 AGG_STOP_LOCAL_REQUEST);
3791 }
3792
3793 queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
3b24f4c6 3794 __ieee80211_flush_queues(local, sdata, queues, false);
b6da911b
LK		 3795
3796 sta->reserved_tid = tid;
3797
3798 ieee80211_wake_vif_queues(local, sdata,
3799 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
3800
3801 if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
3802 clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
3803
3804 ret = 0;
3805 out:
3806 return ret;
3807}
3808EXPORT_SYMBOL(ieee80211_reserve_tid);
3809
3810void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
3811{
3812 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
3813 struct ieee80211_sub_if_data *sdata = sta->sdata;
3814
3815 lockdep_assert_held(&sdata->local->sta_mtx);
3816
3817 /* only some cases are supported right now */
3818 switch (sdata->vif.type) {
3819 case NL80211_IFTYPE_STATION:
3820 case NL80211_IFTYPE_AP:
3821 case NL80211_IFTYPE_AP_VLAN:
3822 break;
3823 default:
3824 WARN_ON(1);
3825 return;
3826 }
3827
3828 if (tid != sta->reserved_tid) {
3829 sdata_err(sdata, "TID to unreserve (%d) isn't reserved\n", tid);
3830 return;
3831 }
3832
3833 sta->reserved_tid = IEEE80211_TID_UNRESERVED;
3834}
3835EXPORT_SYMBOL(ieee80211_unreserve_tid);
3836
55de908a
JB		 3837void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
3838 struct sk_buff *skb, int tid,
3839 enum ieee80211_band band)
3b8d81e0 3840{
353d09c6 3841 int ac = ieee802_1d_to_ac[tid & 7];
3a25a8c8 3842
3b8d81e0
JB		 3843 skb_set_mac_header(skb, 0);
3844 skb_set_network_header(skb, 0);
3845 skb_set_transport_header(skb, 0);
3846
3a25a8c8 3847 skb_set_queue_mapping(skb, ac);
cf6bb79a 3848 skb->priority = tid;
cf0277e7 3849
89afe614
JB		 3850 skb->dev = sdata->dev;
3851
3d34deb6
JB		 3852 /*
3853 * The other path calling ieee80211_xmit is from the tasklet,
3854 * and while we can handle concurrent transmissions locking
3855 * requirements are that we do not come into tx with bhs on.
3856 */
3857 local_bh_disable();
73c4e195 3858 IEEE80211_SKB_CB(skb)->band = band;
7c10770f 3859 ieee80211_xmit(sdata, NULL, skb);
3d34deb6 3860 local_bh_enable();
3b8d81e0 3861}
Linux 6.x block layer and io_uring tree(s)