projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
mac80211: Fix mac80211.h docbook comments
[linux-2.6-block.git] / net / mac80211 / tx.c
CommitLineData
e2ebc74d
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
d98ad83e 6 * Copyright 2013-2014 Intel Mobile Communications GmbH
e2ebc74d
JB		 7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
11 *
12 *
13 * Transmit and frame generation functions.
14 */
15
16#include <linux/kernel.h>
17#include <linux/slab.h>
18#include <linux/skbuff.h>
19#include <linux/etherdevice.h>
20#include <linux/bitmap.h>
d4e46a3d 21#include <linux/rcupdate.h>
bc3b2d7f 22#include <linux/export.h>
881d966b 23#include <net/net_namespace.h>
e2ebc74d
JB		 24#include <net/ieee80211_radiotap.h>
25#include <net/cfg80211.h>
26#include <net/mac80211.h>
27#include <asm/unaligned.h>
28
29#include "ieee80211_i.h"
24487981 30#include "driver-ops.h"
2c8dccc7 31#include "led.h"
33b64eb2 32#include "mesh.h"
e2ebc74d
JB		 33#include "wep.h"
34#include "wpa.h"
35#include "wme.h"
2c8dccc7 36#include "rate.h"
e2ebc74d 37
e2ebc74d
JB		 38/* misc utils */
39
252b86c4
JB		 40static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
41 struct sk_buff *skb, int group_addr,
03f93c3d 42 int next_frag_len)
e2ebc74d 43{
2103dec1 44 int rate, mrate, erp, dur, i, shift = 0;
2e92e6f2 45 struct ieee80211_rate *txrate;
e2ebc74d 46 struct ieee80211_local *local = tx->local;
8318d78a 47 struct ieee80211_supported_band *sband;
358c8d9d 48 struct ieee80211_hdr *hdr;
252b86c4 49 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2103dec1
SW		 50 struct ieee80211_chanctx_conf *chanctx_conf;
51 u32 rate_flags = 0;
52
53 rcu_read_lock();
54 chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
55 if (chanctx_conf) {
56 shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
57 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
58 }
59 rcu_read_unlock();
e6a9854b
JB		 60
61 /* assume HW handles this */
336004e2 62 if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
e6a9854b
JB		 63 return 0;
64
65 /* uh huh? */
0d528d85 66 if (WARN_ON_ONCE(tx->rate.idx < 0))
e6a9854b 67 return 0;
e2ebc74d 68
2d56577b 69 sband = local->hw.wiphy->bands[info->band];
0d528d85 70 txrate = &sband->bitrates[tx->rate.idx];
8318d78a 71
e6a9854b 72 erp = txrate->flags & IEEE80211_RATE_ERP_G;
e2ebc74d
JB		 73
74 /*
75 * data and mgmt (except PS Poll):
76 * - during CFP: 32768
77 * - during contention period:
78 * if addr1 is group address: 0
79 * if more fragments = 0 and addr1 is individual address: time to
80 * transmit one ACK plus SIFS
81 * if more fragments = 1 and addr1 is individual address: time to
82 * transmit next fragment plus 2 x ACK plus 3 x SIFS
83 *
84 * IEEE 802.11, 9.6:
85 * - control response frame (CTS or ACK) shall be transmitted using the
86 * same rate as the immediately previous frame in the frame exchange
87 * sequence, if this rate belongs to the PHY mandatory rates, or else
88 * at the highest possible rate belonging to the PHY rates in the
89 * BSSBasicRateSet
90 */
252b86c4 91 hdr = (struct ieee80211_hdr *)skb->data;
358c8d9d 92 if (ieee80211_is_ctl(hdr->frame_control)) {
e2ebc74d 93 /* TODO: These control frames are not currently sent by
ccd7b362 94 * mac80211, but should they be implemented, this function
e2ebc74d
JB		 95 * needs to be updated to support duration field calculation.
96 *
97 * RTS: time needed to transmit pending data/mgmt frame plus
98 * one CTS frame plus one ACK frame plus 3 x SIFS
99 * CTS: duration of immediately previous RTS minus time
100 * required to transmit CTS and its SIFS
101 * ACK: 0 if immediately previous directed data/mgmt had
102 * more=0, with more=1 duration in ACK frame is duration
103 * from previous frame minus time needed to transmit ACK
104 * and its SIFS
105 * PS Poll: BIT(15) | BIT(14) | aid
106 */
107 return 0;
108 }
109
110 /* data/mgmt */
111 if (0 /* FIX: data/mgmt during CFP */)
03f93c3d 112 return cpu_to_le16(32768);
e2ebc74d
JB		 113
114 if (group_addr) /* Group address as the destination - no ACK */
115 return 0;
116
117 /* Individual destination address:
118 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
119 * CTS and ACK frames shall be transmitted using the highest rate in
120 * basic rate set that is less than or equal to the rate of the
121 * immediately previous frame and that is using the same modulation
122 * (CCK or OFDM). If no basic rate set matches with these requirements,
123 * the highest mandatory rate of the PHY that is less than or equal to
124 * the rate of the previous frame is used.
125 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
126 */
127 rate = -1;
8318d78a
JB		 128 /* use lowest available if everything fails */
129 mrate = sband->bitrates[0].bitrate;
130 for (i = 0; i < sband->n_bitrates; i++) {
131 struct ieee80211_rate *r = &sband->bitrates[i];
e2ebc74d 132
8318d78a
JB		 133 if (r->bitrate > txrate->bitrate)
134 break;
e2ebc74d 135
2103dec1
SW		 136 if ((rate_flags & r->flags) != rate_flags)
137 continue;
138
bda3933a 139 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
2103dec1 140 rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
8318d78a
JB		 141
142 switch (sband->band) {
143 case IEEE80211_BAND_2GHZ: {
144 u32 flag;
145 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
146 flag = IEEE80211_RATE_MANDATORY_G;
147 else
148 flag = IEEE80211_RATE_MANDATORY_B;
149 if (r->flags & flag)
150 mrate = r->bitrate;
151 break;
152 }
153 case IEEE80211_BAND_5GHZ:
154 if (r->flags & IEEE80211_RATE_MANDATORY_A)
155 mrate = r->bitrate;
156 break;
3a0c52a6
VK		 157 case IEEE80211_BAND_60GHZ:
158 /* TODO, for now fall through */
8318d78a
JB		 159 case IEEE80211_NUM_BANDS:
160 WARN_ON(1);
161 break;
162 }
e2ebc74d
JB		 163 }
164 if (rate == -1) {
165 /* No matching basic rate found; use highest suitable mandatory
166 * PHY rate */
2103dec1 167 rate = DIV_ROUND_UP(mrate, 1 << shift);
e2ebc74d
JB		 168 }
169
6674f210
SW		 170 /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
171 if (ieee80211_is_data_qos(hdr->frame_control) &&
c26a0e10 172 *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
6674f210
SW		 173 dur = 0;
174 else
175 /* Time needed to transmit ACK
176 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
177 * to closest integer */
4ee73f33 178 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
438b61b7
SW		 179 tx->sdata->vif.bss_conf.use_short_preamble,
180 shift);
e2ebc74d
JB		 181
182 if (next_frag_len) {
183 /* Frame is fragmented: duration increases with time needed to
184 * transmit next fragment plus ACK and 2 x SIFS. */
185 dur *= 2; /* ACK + SIFS */
186 /* next fragment */
4ee73f33 187 dur += ieee80211_frame_duration(sband->band, next_frag_len,
8318d78a 188 txrate->bitrate, erp,
438b61b7
SW		 189 tx->sdata->vif.bss_conf.use_short_preamble,
190 shift);
e2ebc74d
JB		 191 }
192
03f93c3d 193 return cpu_to_le16(dur);
e2ebc74d
JB		 194}
195
e2ebc74d 196/* tx handlers */
5c1b98a5
KV		 197static ieee80211_tx_result debug_noinline
198ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
199{
200 struct ieee80211_local *local = tx->local;
0c74211d 201 struct ieee80211_if_managed *ifmgd;
5c1b98a5
KV		 202
203 /* driver doesn't support power save */
204 if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
205 return TX_CONTINUE;
206
207 /* hardware does dynamic power save */
208 if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
209 return TX_CONTINUE;
210
211 /* dynamic power save disabled */
212 if (local->hw.conf.dynamic_ps_timeout <= 0)
213 return TX_CONTINUE;
214
215 /* we are scanning, don't enable power save */
216 if (local->scanning)
217 return TX_CONTINUE;
218
219 if (!local->ps_sdata)
220 return TX_CONTINUE;
221
222 /* No point if we're going to suspend */
223 if (local->quiescing)
224 return TX_CONTINUE;
225
0c74211d
KV		 226 /* dynamic ps is supported only in managed mode */
227 if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
228 return TX_CONTINUE;
229
230 ifmgd = &tx->sdata->u.mgd;
231
232 /*
233 * Don't wakeup from power save if u-apsd is enabled, voip ac has
234 * u-apsd enabled and the frame is in voip class. This effectively
235 * means that even if all access categories have u-apsd enabled, in
236 * practise u-apsd is only used with the voip ac. This is a
237 * workaround for the case when received voip class packets do not
238 * have correct qos tag for some reason, due the network or the
239 * peer application.
240 *
dc41e4d4 241 * Note: ifmgd->uapsd_queues access is racy here. If the value is
0c74211d
KV		 242 * changed via debugfs, user needs to reassociate manually to have
243 * everything in sync.
244 */
4875d30d
JB		 245 if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
246 (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
247 skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
0c74211d
KV		 248 return TX_CONTINUE;
249
5c1b98a5
KV		 250 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
251 ieee80211_stop_queues_by_reason(&local->hw,
445ea4e8 252 IEEE80211_MAX_QUEUE_MAP,
cca07b00
LC		 253 IEEE80211_QUEUE_STOP_REASON_PS,
254 false);
db28569a 255 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
5c1b98a5
KV		 256 ieee80211_queue_work(&local->hw,
257 &local->dynamic_ps_disable_work);
258 }
259
5db1c07c
LC		 260 /* Don't restart the timer if we're not disassociated */
261 if (!ifmgd->associated)
262 return TX_CONTINUE;
263
5c1b98a5
KV		 264 mod_timer(&local->dynamic_ps_timer, jiffies +
265 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
266
267 return TX_CONTINUE;
268}
e2ebc74d 269
d9e8a70f 270static ieee80211_tx_result debug_noinline
5cf121c3 271ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
e2ebc74d 272{
358c8d9d 273
e039fa4a 274 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
e039fa4a 275 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
c2c98fde 276 bool assoc = false;
e2ebc74d 277
e039fa4a 278 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
9ae54c84 279 return TX_CONTINUE;
58d4185e 280
b23b025f
BG		 281 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
282 test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
a9a6ffff
KV		 283 !ieee80211_is_probe_req(hdr->frame_control) &&
284 !ieee80211_is_nullfunc(hdr->frame_control))
285 /*
286 * When software scanning only nullfunc frames (to notify
287 * the sleep state to the AP) and probe requests (for the
288 * active scan) are allowed, all other frames should not be
289 * sent and we should not get here, but if we do
290 * nonetheless, drop them to avoid sending them
291 * off-channel. See the link below and
292 * ieee80211_start_scan() for more.
293 *
294 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
295 */
9ae54c84 296 return TX_DROP;
e2ebc74d 297
239281f8
RL		 298 if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
299 return TX_CONTINUE;
300
1be7fe8d
BJ		 301 if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
302 return TX_CONTINUE;
303
05c914fe 304 if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
33b64eb2
LCC		 305 return TX_CONTINUE;
306
5cf121c3 307 if (tx->flags & IEEE80211_TX_PS_BUFFERED)
9ae54c84 308 return TX_CONTINUE;
e2ebc74d 309
c2c98fde
JB		 310 if (tx->sta)
311 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
e2ebc74d 312
5cf121c3 313 if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
c2c98fde 314 if (unlikely(!assoc &&
358c8d9d 315 ieee80211_is_data(hdr->frame_control))) {
e2ebc74d 316#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
bdcbd8e0
JB		 317 sdata_info(tx->sdata,
318 "dropped data frame to not associated station %pM\n",
319 hdr->addr1);
320#endif
e2ebc74d 321 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
9ae54c84 322 return TX_DROP;
e2ebc74d 323 }
29623892
JB		 324 } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
325 ieee80211_is_data(hdr->frame_control) &&
030ef8f8 326 !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) {
29623892
JB		 327 /*
328 * No associated STAs - no need to send multicast
329 * frames.
330 */
331 return TX_DROP;
e2ebc74d
JB		 332 }
333
9ae54c84 334 return TX_CONTINUE;
e2ebc74d
JB		 335}
336
e2ebc74d
JB		 337/* This function is called whenever the AP is about to exceed the maximum limit
338 * of buffered frames for power saving STAs. This situation should not really
339 * happen often during normal operation, so dropping the oldest buffered packet
340 * from each queue should be OK to make some room for new frames. */
341static void purge_old_ps_buffers(struct ieee80211_local *local)
342{
343 int total = 0, purged = 0;
344 struct sk_buff *skb;
345 struct ieee80211_sub_if_data *sdata;
346 struct sta_info *sta;
347
79010420 348 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
d012a605
MP		 349 struct ps_data *ps;
350
351 if (sdata->vif.type == NL80211_IFTYPE_AP)
352 ps = &sdata->u.ap.ps;
3f52b7e3
MP		 353 else if (ieee80211_vif_is_mesh(&sdata->vif))
354 ps = &sdata->u.mesh.ps;
d012a605 355 else
e2ebc74d 356 continue;
d012a605
MP		 357
358 skb = skb_dequeue(&ps->bc_buf);
e2ebc74d
JB		 359 if (skb) {
360 purged++;
361 dev_kfree_skb(skb);
362 }
d012a605 363 total += skb_queue_len(&ps->bc_buf);
e2ebc74d 364 }
e2ebc74d 365
948d887d
JB		 366 /*
367 * Drop one frame from each station from the lowest-priority
368 * AC that has frames at all.
369 */
d0709a65 370 list_for_each_entry_rcu(sta, &local->sta_list, list) {
948d887d
JB		 371 int ac;
372
373 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
374 skb = skb_dequeue(&sta->ps_tx_buf[ac]);
375 total += skb_queue_len(&sta->ps_tx_buf[ac]);
376 if (skb) {
377 purged++;
c3e7724b 378 ieee80211_free_txskb(&local->hw, skb);
948d887d
JB		 379 break;
380 }
e2ebc74d 381 }
e2ebc74d 382 }
d0709a65 383
e2ebc74d 384 local->total_ps_buffered = total;
bdcbd8e0 385 ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
e2ebc74d
JB		 386}
387
9ae54c84 388static ieee80211_tx_result
5cf121c3 389ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 390{
e039fa4a 391 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 392 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d012a605 393 struct ps_data *ps;
e039fa4a 394
7d54d0dd
JB		 395 /*
396 * broadcast/multicast frame
397 *
3f52b7e3 398 * If any of the associated/peer stations is in power save mode,
7d54d0dd
JB		 399 * the frame is buffered to be sent after DTIM beacon frame.
400 * This is done either by the hardware or us.
401 */
402
3f52b7e3 403 /* powersaving STAs currently only in AP/VLAN/mesh mode */
d012a605
MP		 404 if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
405 tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
406 if (!tx->sdata->bss)
407 return TX_CONTINUE;
408
409 ps = &tx->sdata->bss->ps;
3f52b7e3
MP		 410 } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
411 ps = &tx->sdata->u.mesh.ps;
d012a605 412 } else {
3e122be0 413 return TX_CONTINUE;
d012a605
MP		 414 }
415
3e122be0
JB		 416
417 /* no buffering for ordered frames */
358c8d9d 418 if (ieee80211_has_order(hdr->frame_control))
9ae54c84 419 return TX_CONTINUE;
7d54d0dd 420
08b99399
JB		 421 if (ieee80211_is_probe_req(hdr->frame_control))
422 return TX_CONTINUE;
423
f4d57941
JB		 424 if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
425 info->hw_queue = tx->sdata->vif.cab_queue;
426
7d54d0dd 427 /* no stations in PS mode */
d012a605 428 if (!atomic_read(&ps->num_sta_ps))
9ae54c84 429 return TX_CONTINUE;
7d54d0dd 430
62b517cb 431 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
62b1208e 432
62b517cb
JB		 433 /* device releases frame after DTIM beacon */
434 if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
62b1208e 435 return TX_CONTINUE;
62b1208e 436
7d54d0dd 437 /* buffered in mac80211 */
62b1208e
JB		 438 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
439 purge_old_ps_buffers(tx->local);
440
d012a605 441 if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
bdcbd8e0
JB		 442 ps_dbg(tx->sdata,
443 "BC TX buffer full - dropping the oldest frame\n");
d012a605 444 dev_kfree_skb(skb_dequeue(&ps->bc_buf));
62b1208e
JB		 445 } else
446 tx->local->total_ps_buffered++;
e2ebc74d 447
d012a605 448 skb_queue_tail(&ps->bc_buf, tx->skb);
7d54d0dd 449
62b1208e 450 return TX_QUEUED;
e2ebc74d
JB		 451}
452
fb733336
JM		 453static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
454 struct sk_buff *skb)
455{
456 if (!ieee80211_is_mgmt(fc))
457 return 0;
458
c2c98fde 459 if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
fb733336
JM		 460 return 0;
461
d8ca16db 462 if (!ieee80211_is_robust_mgmt_frame(skb))
fb733336
JM		 463 return 0;
464
465 return 1;
466}
467
9ae54c84 468static ieee80211_tx_result
5cf121c3 469ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d
JB		 470{
471 struct sta_info *sta = tx->sta;
e039fa4a 472 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
08b99399 473 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
3393a608 474 struct ieee80211_local *local = tx->local;
e2ebc74d 475
02f2f1a9 476 if (unlikely(!sta))
9ae54c84 477 return TX_CONTINUE;
e2ebc74d 478
c2c98fde 479 if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
5ac2e350
JB		 480 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
481 test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
02f2f1a9 482 !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
948d887d
JB		 483 int ac = skb_get_queue_mapping(tx->skb);
484
08b99399
JB		 485 if (ieee80211_is_mgmt(hdr->frame_control) &&
486 !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
487 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
488 return TX_CONTINUE;
489 }
490
bdcbd8e0
JB		 491 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
492 sta->sta.addr, sta->sta.aid, ac);
e2ebc74d
JB		 493 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
494 purge_old_ps_buffers(tx->local);
1d147bfa
EG		 495
496 /* sync with ieee80211_sta_ps_deliver_wakeup */
497 spin_lock(&sta->ps_lock);
498 /*
499 * STA woke up the meantime and all the frames on ps_tx_buf have
500 * been queued to pending queue. No reordering can happen, go
501 * ahead and Tx the packet.
502 */
503 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
5ac2e350
JB		 504 !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
505 !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
1d147bfa
EG		 506 spin_unlock(&sta->ps_lock);
507 return TX_CONTINUE;
508 }
509
948d887d
JB		 510 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
511 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
bdcbd8e0
JB		 512 ps_dbg(tx->sdata,
513 "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
514 sta->sta.addr, ac);
c3e7724b 515 ieee80211_free_txskb(&local->hw, old);
e2ebc74d
JB		 516 } else
517 tx->local->total_ps_buffered++;
004c872e 518
e039fa4a 519 info->control.jiffies = jiffies;
5061b0c2 520 info->control.vif = &tx->sdata->vif;
8f77f384 521 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
03c8c06f 522 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
948d887d 523 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
1d147bfa 524 spin_unlock(&sta->ps_lock);
3393a608
JO		 525
526 if (!timer_pending(&local->sta_cleanup))
527 mod_timer(&local->sta_cleanup,
528 round_jiffies(jiffies +
529 STA_INFO_CLEANUP_INTERVAL));
530
c868cb35
JB		 531 /*
532 * We queued up some frames, so the TIM bit might
533 * need to be set, recalculate it.
534 */
535 sta_info_recalc_tim(sta);
536
9ae54c84 537 return TX_QUEUED;
bdcbd8e0
JB		 538 } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
539 ps_dbg(tx->sdata,
540 "STA %pM in PS mode, but polling/in SP -> send frame\n",
541 sta->sta.addr);
e2ebc74d 542 }
e2ebc74d 543
9ae54c84 544 return TX_CONTINUE;
e2ebc74d
JB		 545}
546
d9e8a70f 547static ieee80211_tx_result debug_noinline
5cf121c3 548ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 549{
5cf121c3 550 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
9ae54c84 551 return TX_CONTINUE;
e2ebc74d 552
5cf121c3 553 if (tx->flags & IEEE80211_TX_UNICAST)
e2ebc74d
JB		 554 return ieee80211_tx_h_unicast_ps_buf(tx);
555 else
556 return ieee80211_tx_h_multicast_ps_buf(tx);
557}
558
a621fa4d
JB		 559static ieee80211_tx_result debug_noinline
560ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
561{
562 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
563
af61a165
JB		 564 if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
565 if (tx->sdata->control_port_no_encrypt)
566 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
567 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
9c1c98a3 568 info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
af61a165 569 }
a621fa4d
JB		 570
571 return TX_CONTINUE;
572}
573
d9e8a70f 574static ieee80211_tx_result debug_noinline
5cf121c3 575ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
e2ebc74d 576{
46e6de15 577 struct ieee80211_key *key;
e039fa4a 578 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 579 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d4e46a3d 580
3b8d81e0 581 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
e2ebc74d 582 tx->key = NULL;
2475b1cc
MS		 583 else if (tx->sta &&
584 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
d4e46a3d 585 tx->key = key;
3cfcf6ac 586 else if (ieee80211_is_mgmt(hdr->frame_control) &&
ecbcd324 587 is_multicast_ether_addr(hdr->addr1) &&
d8ca16db 588 ieee80211_is_robust_mgmt_frame(tx->skb) &&
3cfcf6ac
JM		 589 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
590 tx->key = key;
f7e0104c
JB		 591 else if (is_multicast_ether_addr(hdr->addr1) &&
592 (key = rcu_dereference(tx->sdata->default_multicast_key)))
593 tx->key = key;
594 else if (!is_multicast_ether_addr(hdr->addr1) &&
595 (key = rcu_dereference(tx->sdata->default_unicast_key)))
d4e46a3d 596 tx->key = key;
e8f4fb7c 597 else
4922f71f 598 tx->key = NULL;
e2ebc74d
JB		 599
600 if (tx->key) {
813d7669
JB		 601 bool skip_hw = false;
602
e2ebc74d 603 tx->key->tx_rx_count++;
011bfcc4 604 /* TODO: add threshold stuff again */
176e4f84 605
97359d12
JB		 606 switch (tx->key->conf.cipher) {
607 case WLAN_CIPHER_SUITE_WEP40:
608 case WLAN_CIPHER_SUITE_WEP104:
97359d12 609 case WLAN_CIPHER_SUITE_TKIP:
358c8d9d 610 if (!ieee80211_is_data_present(hdr->frame_control))
176e4f84
JB		 611 tx->key = NULL;
612 break;
97359d12 613 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db 614 case WLAN_CIPHER_SUITE_CCMP_256:
00b9cfa3
JM		 615 case WLAN_CIPHER_SUITE_GCMP:
616 case WLAN_CIPHER_SUITE_GCMP_256:
fb733336
JM		 617 if (!ieee80211_is_data_present(hdr->frame_control) &&
618 !ieee80211_use_mfp(hdr->frame_control, tx->sta,
619 tx->skb))
620 tx->key = NULL;
3b43a187
KV		 621 else
622 skip_hw = (tx->key->conf.flags &
e548c49e 623 IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
3b43a187 624 ieee80211_is_mgmt(hdr->frame_control);
fb733336 625 break;
97359d12 626 case WLAN_CIPHER_SUITE_AES_CMAC:
56c52da2 627 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
8ade538b
JM		 628 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
629 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3cfcf6ac
JM		 630 if (!ieee80211_is_mgmt(hdr->frame_control))
631 tx->key = NULL;
632 break;
176e4f84 633 }
813d7669 634
e54faf29
JB		 635 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
636 !ieee80211_is_deauth(hdr->frame_control)))
95acac61
JB		 637 return TX_DROP;
638
f12553eb 639 if (!skip_hw && tx->key &&
382b1655 640 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
813d7669 641 info->control.hw_key = &tx->key->conf;
e2ebc74d
JB		 642 }
643
9ae54c84 644 return TX_CONTINUE;
e2ebc74d
JB		 645}
646
d9e8a70f 647static ieee80211_tx_result debug_noinline
5cf121c3 648ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
e2ebc74d 649{
e039fa4a 650 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
e6a9854b
JB		 651 struct ieee80211_hdr *hdr = (void *)tx->skb->data;
652 struct ieee80211_supported_band *sband;
a2c40249 653 u32 len;
e6a9854b 654 struct ieee80211_tx_rate_control txrc;
0d528d85 655 struct ieee80211_sta_rates *ratetbl = NULL;
c2c98fde 656 bool assoc = false;
8318d78a 657
e6a9854b 658 memset(&txrc, 0, sizeof(txrc));
e2ebc74d 659
2d56577b 660 sband = tx->local->hw.wiphy->bands[info->band];
58d4185e 661
a2c40249 662 len = min_t(u32, tx->skb->len + FCS_LEN,
b9a5f8ca 663 tx->local->hw.wiphy->frag_threshold);
e6a9854b
JB		 664
665 /* set up the tx rate control struct we give the RC algo */
005e472b 666 txrc.hw = &tx->local->hw;
e6a9854b
JB		 667 txrc.sband = sband;
668 txrc.bss_conf = &tx->sdata->vif.bss_conf;
669 txrc.skb = tx->skb;
670 txrc.reported_rate.idx = -1;
2d56577b 671 txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
37eb0b16
JM		 672 if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
673 txrc.max_rate_idx = -1;
674 else
675 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
2ffbe6d3
FF		 676
677 if (tx->sdata->rc_has_mcs_mask[info->band])
678 txrc.rate_idx_mcs_mask =
679 tx->sdata->rc_rateidx_mcs_mask[info->band];
680
8f0729b1 681 txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
4bb62344 682 tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
8f0729b1 683 tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
e6a9854b
JB		 684
685 /* set up RTS protection if desired */
b9a5f8ca 686 if (len > tx->local->hw.wiphy->rts_threshold) {
0d528d85 687 txrc.rts = true;
e2ebc74d 688 }
e2ebc74d 689
0d528d85 690 info->control.use_rts = txrc.rts;
991fec09
FF		 691 info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
692
e6a9854b
JB		 693 /*
694 * Use short preamble if the BSS can handle it, but not for
695 * management frames unless we know the receiver can handle
696 * that -- the management frame might be to a station that
697 * just wants a probe response.
698 */
699 if (tx->sdata->vif.bss_conf.use_short_preamble &&
700 (ieee80211_is_data(hdr->frame_control) ||
c2c98fde 701 (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
0d528d85
FF		 702 txrc.short_preamble = true;
703
704 info->control.short_preamble = txrc.short_preamble;
e2ebc74d 705
c2c98fde
JB		 706 if (tx->sta)
707 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
b770b43e
LR		 708
709 /*
710 * Lets not bother rate control if we're associated and cannot
711 * talk to the sta. This should not happen.
712 */
c2c98fde 713 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
b770b43e
LR		 714 !rate_usable_index_exists(sband, &tx->sta->sta),
715 "%s: Dropped data frame as no usable bitrate found while "
716 "scanning and associated. Target station: "
717 "%pM on %d GHz band\n",
47846c9b 718 tx->sdata->name, hdr->addr1,
2d56577b 719 info->band ? 5 : 2))
b770b43e 720 return TX_DROP;
2e92e6f2 721
b770b43e
LR		 722 /*
723 * If we're associated with the sta at this point we know we can at
724 * least send the frame at the lowest bit rate.
725 */
e6a9854b
JB		 726 rate_control_get_rate(tx->sdata, tx->sta, &txrc);
727
0d528d85
FF		 728 if (tx->sta && !info->control.skip_table)
729 ratetbl = rcu_dereference(tx->sta->sta.rates);
730
731 if (unlikely(info->control.rates[0].idx < 0)) {
732 if (ratetbl) {
733 struct ieee80211_tx_rate rate = {
734 .idx = ratetbl->rate[0].idx,
735 .flags = ratetbl->rate[0].flags,
736 .count = ratetbl->rate[0].count
737 };
738
739 if (ratetbl->rate[0].idx < 0)
740 return TX_DROP;
741
742 tx->rate = rate;
743 } else {
744 return TX_DROP;
745 }
746 } else {
747 tx->rate = info->control.rates[0];
748 }
e6a9854b 749
c1ce5a74 750 if (txrc.reported_rate.idx < 0) {
0d528d85 751 txrc.reported_rate = tx->rate;
c1ce5a74
HS		 752 if (tx->sta && ieee80211_is_data(hdr->frame_control))
753 tx->sta->last_tx_rate = txrc.reported_rate;
754 } else if (tx->sta)
e6a9854b 755 tx->sta->last_tx_rate = txrc.reported_rate;
e039fa4a 756
0d528d85
FF		 757 if (ratetbl)
758 return TX_CONTINUE;
759
e6a9854b
JB		 760 if (unlikely(!info->control.rates[0].count))
761 info->control.rates[0].count = 1;
e2ebc74d 762
9955151d
GS		 763 if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
764 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
765 info->control.rates[0].count = 1;
766
e6a9854b
JB		 767 return TX_CONTINUE;
768}
769
ba8c3d6f
FF		 770static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
771{
772 u16 *seq = &sta->tid_seq[tid];
773 __le16 ret = cpu_to_le16(*seq);
774
775 /* Increase the sequence number. */
776 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
777
778 return ret;
779}
780
f591fa5d
JB		 781static ieee80211_tx_result debug_noinline
782ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
783{
784 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
785 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
f591fa5d
JB		 786 u8 *qc;
787 int tid;
788
25d834e1
JB		 789 /*
790 * Packet injection may want to control the sequence
791 * number, if we have no matching interface then we
792 * neither assign one ourselves nor ask the driver to.
793 */
5061b0c2 794 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
25d834e1
JB		 795 return TX_CONTINUE;
796
f591fa5d
JB		 797 if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
798 return TX_CONTINUE;
799
800 if (ieee80211_hdrlen(hdr->frame_control) < 24)
801 return TX_CONTINUE;
802
49a59543
JB		 803 if (ieee80211_is_qos_nullfunc(hdr->frame_control))
804 return TX_CONTINUE;
805
94778280
JB		 806 /*
807 * Anything but QoS data that has a sequence number field
808 * (is long enough) gets a sequence number from the global
c4c205f3
BC		 809 * counter. QoS data frames with a multicast destination
810 * also use the global counter (802.11-2012 9.3.2.10).
94778280 811 */
c4c205f3
BC		 812 if (!ieee80211_is_data_qos(hdr->frame_control) ||
813 is_multicast_ether_addr(hdr->addr1)) {
94778280 814 /* driver should assign sequence number */
f591fa5d 815 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
94778280
JB		 816 /* for pure STA mode without beacons, we can do it */
817 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
818 tx->sdata->sequence_number += 0x10;
79c892b8
JB		 819 if (tx->sta)
820 tx->sta->tx_msdu[IEEE80211_NUM_TIDS]++;
f591fa5d
JB		 821 return TX_CONTINUE;
822 }
823
824 /*
825 * This should be true for injected/management frames only, for
826 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
827 * above since they are not QoS-data frames.
828 */
829 if (!tx->sta)
830 return TX_CONTINUE;
831
832 /* include per-STA, per-TID sequence counter */
833
834 qc = ieee80211_get_qos_ctl(hdr);
835 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
79c892b8 836 tx->sta->tx_msdu[tid]++;
f591fa5d 837
ba8c3d6f
FF		 838 if (!tx->sta->sta.txq[0])
839 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
f591fa5d
JB		 840
841 return TX_CONTINUE;
842}
843
252b86c4 844static int ieee80211_fragment(struct ieee80211_tx_data *tx,
2de8e0d9
JB		 845 struct sk_buff *skb, int hdrlen,
846 int frag_threshold)
847{
252b86c4 848 struct ieee80211_local *local = tx->local;
a1a3fcec 849 struct ieee80211_tx_info *info;
252b86c4 850 struct sk_buff *tmp;
2de8e0d9
JB		 851 int per_fragm = frag_threshold - hdrlen - FCS_LEN;
852 int pos = hdrlen + per_fragm;
853 int rem = skb->len - hdrlen - per_fragm;
854
855 if (WARN_ON(rem < 0))
856 return -EINVAL;
857
252b86c4
JB		 858 /* first fragment was already added to queue by caller */
859
2de8e0d9
JB		 860 while (rem) {
861 int fraglen = per_fragm;
862
863 if (fraglen > rem)
864 fraglen = rem;
865 rem -= fraglen;
866 tmp = dev_alloc_skb(local->tx_headroom +
867 frag_threshold +
2475b1cc 868 tx->sdata->encrypt_headroom +
2de8e0d9
JB		 869 IEEE80211_ENCRYPT_TAILROOM);
870 if (!tmp)
871 return -ENOMEM;
252b86c4
JB		 872
873 __skb_queue_tail(&tx->skbs, tmp);
874
2475b1cc
MS		 875 skb_reserve(tmp,
876 local->tx_headroom + tx->sdata->encrypt_headroom);
877
2de8e0d9
JB		 878 /* copy control information */
879 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
a1a3fcec
JB		 880
881 info = IEEE80211_SKB_CB(tmp);
882 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
883 IEEE80211_TX_CTL_FIRST_FRAGMENT);
884
885 if (rem)
886 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
887
2de8e0d9
JB		 888 skb_copy_queue_mapping(tmp, skb);
889 tmp->priority = skb->priority;
2de8e0d9 890 tmp->dev = skb->dev;
2de8e0d9
JB		 891
892 /* copy header and data */
893 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
894 memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);
895
896 pos += fraglen;
897 }
898
252b86c4 899 /* adjust first fragment's length */
338f977f 900 skb_trim(skb, hdrlen + per_fragm);
2de8e0d9
JB		 901 return 0;
902}
903
d9e8a70f 904static ieee80211_tx_result debug_noinline
e2454948
JB		 905ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
906{
2de8e0d9
JB		 907 struct sk_buff *skb = tx->skb;
908 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
909 struct ieee80211_hdr *hdr = (void *)skb->data;
b9a5f8ca 910 int frag_threshold = tx->local->hw.wiphy->frag_threshold;
2de8e0d9
JB		 911 int hdrlen;
912 int fragnum;
e2454948 913
252b86c4
JB		 914 /* no matter what happens, tx->skb moves to tx->skbs */
915 __skb_queue_tail(&tx->skbs, skb);
916 tx->skb = NULL;
917
a26eb27a
JB		 918 if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
919 return TX_CONTINUE;
920
921 if (tx->local->ops->set_frag_threshold)
e2454948
JB		 922 return TX_CONTINUE;
923
eefce91a
JB		 924 /*
925 * Warn when submitting a fragmented A-MPDU frame and drop it.
3b8d81e0 926 * This scenario is handled in ieee80211_tx_prepare but extra
8d5e0d58 927 * caution taken here as fragmented ampdu may cause Tx stop.
eefce91a 928 */
8b30b1fe 929 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
eefce91a
JB		 930 return TX_DROP;
931
065e9605 932 hdrlen = ieee80211_hdrlen(hdr->frame_control);
e2454948 933
a26eb27a 934 /* internal error, why isn't DONTFRAG set? */
8ccd8f21 935 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
2de8e0d9 936 return TX_DROP;
e6a9854b 937
2de8e0d9
JB		 938 /*
939 * Now fragment the frame. This will allocate all the fragments and
940 * chain them (using skb as the first fragment) to skb->next.
941 * During transmission, we will remove the successfully transmitted
942 * fragments from this list. When the low-level driver rejects one
943 * of the fragments then we will simply pretend to accept the skb
944 * but store it away as pending.
945 */
252b86c4 946 if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
2de8e0d9 947 return TX_DROP;
e6a9854b 948
2de8e0d9
JB		 949 /* update duration/seq/flags of fragments */
950 fragnum = 0;
252b86c4
JB		 951
952 skb_queue_walk(&tx->skbs, skb) {
2de8e0d9 953 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
e6a9854b 954
2de8e0d9
JB		 955 hdr = (void *)skb->data;
956 info = IEEE80211_SKB_CB(skb);
e6a9854b 957
252b86c4 958 if (!skb_queue_is_last(&tx->skbs, skb)) {
2de8e0d9 959 hdr->frame_control |= morefrags;
e6a9854b
JB		 960 /*
961 * No multi-rate retries for fragmented frames, that
962 * would completely throw off the NAV at other STAs.
963 */
964 info->control.rates[1].idx = -1;
965 info->control.rates[2].idx = -1;
966 info->control.rates[3].idx = -1;
e3e1a0bc 967 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
e6a9854b 968 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
2de8e0d9
JB		 969 } else {
970 hdr->frame_control &= ~morefrags;
e6a9854b 971 }
2de8e0d9
JB		 972 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
973 fragnum++;
252b86c4 974 }
e2ebc74d 975
9ae54c84 976 return TX_CONTINUE;
e2ebc74d
JB		 977}
978
feff1f2f
JB		 979static ieee80211_tx_result debug_noinline
980ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
981{
252b86c4 982 struct sk_buff *skb;
560d2682 983 int ac = -1;
feff1f2f
JB		 984
985 if (!tx->sta)
986 return TX_CONTINUE;
987
252b86c4 988 skb_queue_walk(&tx->skbs, skb) {
560d2682 989 ac = skb_get_queue_mapping(skb);
feff1f2f 990 tx->sta->tx_fragments++;
560d2682 991 tx->sta->tx_bytes[ac] += skb->len;
252b86c4 992 }
560d2682
JB		 993 if (ac >= 0)
994 tx->sta->tx_packets[ac]++;
feff1f2f
JB		 995
996 return TX_CONTINUE;
997}
998
d9e8a70f 999static ieee80211_tx_result debug_noinline
e2454948
JB		 1000ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
1001{
1002 if (!tx->key)
1003 return TX_CONTINUE;
1004
97359d12
JB		 1005 switch (tx->key->conf.cipher) {
1006 case WLAN_CIPHER_SUITE_WEP40:
1007 case WLAN_CIPHER_SUITE_WEP104:
e2454948 1008 return ieee80211_crypto_wep_encrypt(tx);
97359d12 1009 case WLAN_CIPHER_SUITE_TKIP:
e2454948 1010 return ieee80211_crypto_tkip_encrypt(tx);
97359d12 1011 case WLAN_CIPHER_SUITE_CCMP:
2b2ba0db
JM		 1012 return ieee80211_crypto_ccmp_encrypt(
1013 tx, IEEE80211_CCMP_MIC_LEN);
1014 case WLAN_CIPHER_SUITE_CCMP_256:
1015 return ieee80211_crypto_ccmp_encrypt(
1016 tx, IEEE80211_CCMP_256_MIC_LEN);
97359d12 1017 case WLAN_CIPHER_SUITE_AES_CMAC:
3cfcf6ac 1018 return ieee80211_crypto_aes_cmac_encrypt(tx);
56c52da2
JM		 1019 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1020 return ieee80211_crypto_aes_cmac_256_encrypt(tx);
8ade538b
JM		 1021 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1022 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1023 return ieee80211_crypto_aes_gmac_encrypt(tx);
00b9cfa3
JM		 1024 case WLAN_CIPHER_SUITE_GCMP:
1025 case WLAN_CIPHER_SUITE_GCMP_256:
1026 return ieee80211_crypto_gcmp_encrypt(tx);
3ffc2a90 1027 default:
d32a1028 1028 return ieee80211_crypto_hw_encrypt(tx);
e2454948
JB		 1029 }
1030
e2454948
JB		 1031 return TX_DROP;
1032}
1033
d9e8a70f 1034static ieee80211_tx_result debug_noinline
03f93c3d
JB		 1035ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
1036{
252b86c4 1037 struct sk_buff *skb;
2de8e0d9
JB		 1038 struct ieee80211_hdr *hdr;
1039 int next_len;
1040 bool group_addr;
03f93c3d 1041
252b86c4 1042 skb_queue_walk(&tx->skbs, skb) {
2de8e0d9 1043 hdr = (void *) skb->data;
7e0aae47
JM		 1044 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
1045 break; /* must not overwrite AID */
252b86c4
JB		 1046 if (!skb_queue_is_last(&tx->skbs, skb)) {
1047 struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
1048 next_len = next->len;
1049 } else
1050 next_len = 0;
2de8e0d9 1051 group_addr = is_multicast_ether_addr(hdr->addr1);
03f93c3d 1052
2de8e0d9 1053 hdr->duration_id =
252b86c4
JB		 1054 ieee80211_duration(tx, skb, group_addr, next_len);
1055 }
03f93c3d
JB		 1056
1057 return TX_CONTINUE;
1058}
1059
e2ebc74d
JB		 1060/* actual transmit path */
1061
a622ab72
JB		 1062static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
1063 struct sk_buff *skb,
1064 struct ieee80211_tx_info *info,
1065 struct tid_ampdu_tx *tid_tx,
1066 int tid)
1067{
1068 bool queued = false;
285fa695 1069 bool reset_agg_timer = false;
aa454580 1070 struct sk_buff *purge_skb = NULL;
a622ab72
JB		 1071
1072 if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1073 info->flags |= IEEE80211_TX_CTL_AMPDU;
285fa695 1074 reset_agg_timer = true;
0ab33703
JB		 1075 } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
1076 /*
1077 * nothing -- this aggregation session is being started
1078 * but that might still fail with the driver
1079 */
ba8c3d6f 1080 } else if (!tx->sta->sta.txq[tid]) {
a622ab72
JB		 1081 spin_lock(&tx->sta->lock);
1082 /*
1083 * Need to re-check now, because we may get here
1084 *
1085 * 1) in the window during which the setup is actually
1086 * already done, but not marked yet because not all
1087 * packets are spliced over to the driver pending
1088 * queue yet -- if this happened we acquire the lock
1089 * either before or after the splice happens, but
1090 * need to recheck which of these cases happened.
1091 *
1092 * 2) during session teardown, if the OPERATIONAL bit
1093 * was cleared due to the teardown but the pointer
1094 * hasn't been assigned NULL yet (or we loaded it
1095 * before it was assigned) -- in this case it may
1096 * now be NULL which means we should just let the
1097 * packet pass through because splicing the frames
1098 * back is already done.
1099 */
40b275b6 1100 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
a622ab72
JB		 1101
1102 if (!tid_tx) {
1103 /* do nothing, let packet pass through */
1104 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1105 info->flags |= IEEE80211_TX_CTL_AMPDU;
285fa695 1106 reset_agg_timer = true;
a622ab72
JB		 1107 } else {
1108 queued = true;
1109 info->control.vif = &tx->sdata->vif;
1110 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
03c8c06f 1111 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
a622ab72 1112 __skb_queue_tail(&tid_tx->pending, skb);
aa454580
HS		 1113 if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
1114 purge_skb = __skb_dequeue(&tid_tx->pending);
a622ab72
JB		 1115 }
1116 spin_unlock(&tx->sta->lock);
aa454580
HS		 1117
1118 if (purge_skb)
c3e7724b 1119 ieee80211_free_txskb(&tx->local->hw, purge_skb);
a622ab72
JB		 1120 }
1121
285fa695
NM		 1122 /* reset session timer */
1123 if (reset_agg_timer && tid_tx->timeout)
12d3952f 1124 tid_tx->last_tx = jiffies;
285fa695 1125
a622ab72
JB		 1126 return queued;
1127}
1128
58d4185e
JB		 1129/*
1130 * initialises @tx
7c10770f
JB		 1131 * pass %NULL for the station if unknown, a valid pointer if known
1132 * or an ERR_PTR() if the station is known not to exist
58d4185e 1133 */
9ae54c84 1134static ieee80211_tx_result
3b8d81e0
JB		 1135ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1136 struct ieee80211_tx_data *tx,
7c10770f 1137 struct sta_info *sta, struct sk_buff *skb)
e2ebc74d 1138{
3b8d81e0 1139 struct ieee80211_local *local = sdata->local;
58d4185e 1140 struct ieee80211_hdr *hdr;
e039fa4a 1141 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
68f2b517 1142 int tid;
a622ab72 1143 u8 *qc;
e2ebc74d
JB		 1144
1145 memset(tx, 0, sizeof(*tx));
1146 tx->skb = skb;
e2ebc74d 1147 tx->local = local;
3b8d81e0 1148 tx->sdata = sdata;
252b86c4 1149 __skb_queue_head_init(&tx->skbs);
e2ebc74d 1150
cd8ffc80
JB		 1151 /*
1152 * If this flag is set to true anywhere, and we get here,
1153 * we are doing the needed processing, so remove the flag
1154 * now.
1155 */
1156 info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1157
58d4185e
JB		 1158 hdr = (struct ieee80211_hdr *) skb->data;
1159
7c10770f
JB		 1160 if (likely(sta)) {
1161 if (!IS_ERR(sta))
1162 tx->sta = sta;
1163 } else {
1164 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1165 tx->sta = rcu_dereference(sdata->u.vlan.sta);
1166 if (!tx->sta && sdata->wdev.use_4addr)
1167 return TX_DROP;
1168 } else if (info->flags & (IEEE80211_TX_INTFL_NL80211_FRAME_TX |
1169 IEEE80211_TX_CTL_INJECTED) ||
1170 tx->sdata->control_port_protocol == tx->skb->protocol) {
1171 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1172 }
1173 if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
1174 tx->sta = sta_info_get(sdata, hdr->addr1);
3f0e0b22 1175 }
58d4185e 1176
cd8ffc80 1177 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
49a59543 1178 !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
edf6b784
AN		 1179 (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) &&
1180 !(local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) {
cd8ffc80
JB		 1181 struct tid_ampdu_tx *tid_tx;
1182
8b30b1fe
S		 1183 qc = ieee80211_get_qos_ctl(hdr);
1184 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
1185
a622ab72
JB		 1186 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1187 if (tid_tx) {
1188 bool queued;
cd8ffc80 1189
a622ab72
JB		 1190 queued = ieee80211_tx_prep_agg(tx, skb, info,
1191 tid_tx, tid);
1192
1193 if (unlikely(queued))
1194 return TX_QUEUED;
1195 }
8b30b1fe
S		 1196 }
1197
badffb72 1198 if (is_multicast_ether_addr(hdr->addr1)) {
5cf121c3 1199 tx->flags &= ~IEEE80211_TX_UNICAST;
e039fa4a 1200 info->flags |= IEEE80211_TX_CTL_NO_ACK;
6fd67e93 1201 } else
5cf121c3 1202 tx->flags |= IEEE80211_TX_UNICAST;
58d4185e 1203
a26eb27a
JB		 1204 if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
1205 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
1206 skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
1207 info->flags & IEEE80211_TX_CTL_AMPDU)
1208 info->flags |= IEEE80211_TX_CTL_DONTFRAG;
58d4185e
JB		 1209 }
1210
e2ebc74d 1211 if (!tx->sta)
e039fa4a 1212 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
c2c98fde 1213 else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
e039fa4a 1214 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
58d4185e 1215
e039fa4a 1216 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
e2ebc74d 1217
9ae54c84 1218 return TX_CONTINUE;
e2ebc74d
JB		 1219}
1220
ba8c3d6f
FF		 1221static void ieee80211_drv_tx(struct ieee80211_local *local,
1222 struct ieee80211_vif *vif,
1223 struct ieee80211_sta *pubsta,
1224 struct sk_buff *skb)
1225{
1226 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1227 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1228 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1229 struct ieee80211_tx_control control = {
1230 .sta = pubsta,
1231 };
1232 struct ieee80211_txq *txq = NULL;
1233 struct txq_info *txqi;
1234 u8 ac;
1235
1236 if (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE)
1237 goto tx_normal;
1238
1239 if (!ieee80211_is_data(hdr->frame_control))
1240 goto tx_normal;
1241
1242 if (pubsta) {
1243 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1244
1245 txq = pubsta->txq[tid];
1246 } else if (vif) {
1247 txq = vif->txq;
1248 }
1249
1250 if (!txq)
1251 goto tx_normal;
1252
1253 ac = txq->ac;
1254 txqi = to_txq_info(txq);
1255 atomic_inc(&sdata->txqs_len[ac]);
1256 if (atomic_read(&sdata->txqs_len[ac]) >= local->hw.txq_ac_max_pending)
1257 netif_stop_subqueue(sdata->dev, ac);
1258
1259 skb_queue_tail(&txqi->queue, skb);
1260 drv_wake_tx_queue(local, txqi);
1261
1262 return;
1263
1264tx_normal:
1265 drv_tx(local, &control, skb);
1266}
1267
1268struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
1269 struct ieee80211_txq *txq)
1270{
1271 struct ieee80211_local *local = hw_to_local(hw);
1272 struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
1273 struct txq_info *txqi = container_of(txq, struct txq_info, txq);
1274 struct ieee80211_hdr *hdr;
1275 struct sk_buff *skb = NULL;
1276 u8 ac = txq->ac;
1277
1278 spin_lock_bh(&txqi->queue.lock);
1279
1280 if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags))
1281 goto out;
1282
1283 skb = __skb_dequeue(&txqi->queue);
1284 if (!skb)
1285 goto out;
1286
1287 atomic_dec(&sdata->txqs_len[ac]);
1288 if (__netif_subqueue_stopped(sdata->dev, ac))
1289 ieee80211_propagate_queue_wake(local, sdata->vif.hw_queue[ac]);
1290
1291 hdr = (struct ieee80211_hdr *)skb->data;
1292 if (txq->sta && ieee80211_is_data_qos(hdr->frame_control)) {
1293 struct sta_info *sta = container_of(txq->sta, struct sta_info,
1294 sta);
1295 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1296
1297 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, txq->tid);
1298 if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
1299 info->flags |= IEEE80211_TX_CTL_AMPDU;
1300 else
1301 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
1302 }
1303
1304out:
1305 spin_unlock_bh(&txqi->queue.lock);
1306
1307 return skb;
1308}
1309EXPORT_SYMBOL(ieee80211_tx_dequeue);
1310
11127e91
JB		 1311static bool ieee80211_tx_frags(struct ieee80211_local *local,
1312 struct ieee80211_vif *vif,
1313 struct ieee80211_sta *sta,
1314 struct sk_buff_head *skbs,
1315 bool txpending)
e2ebc74d 1316{
252b86c4 1317 struct sk_buff *skb, *tmp;
3b8d81e0 1318 unsigned long flags;
e2ebc74d 1319
252b86c4 1320 skb_queue_walk_safe(skbs, skb, tmp) {
3a25a8c8
JB		 1321 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1322 int q = info->hw_queue;
1323
1324#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1325 if (WARN_ON_ONCE(q >= local->hw.queues)) {
1326 __skb_unlink(skb, skbs);
c3e7724b 1327 ieee80211_free_txskb(&local->hw, skb);
3a25a8c8
JB		 1328 continue;
1329 }
1330#endif
3b8d81e0
JB		 1331
1332 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
3b8d81e0 1333 if (local->queue_stop_reasons[q] ||
7bb45683 1334 (!txpending && !skb_queue_empty(&local->pending[q]))) {
6c17b77b 1335 if (unlikely(info->flags &
a7679ed5
SF		 1336 IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
1337 if (local->queue_stop_reasons[q] &
1338 ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
1339 /*
1340 * Drop off-channel frames if queues
1341 * are stopped for any reason other
1342 * than off-channel operation. Never
1343 * queue them.
1344 */
1345 spin_unlock_irqrestore(
1346 &local->queue_stop_reason_lock,
1347 flags);
1348 ieee80211_purge_tx_queue(&local->hw,
1349 skbs);
1350 return true;
1351 }
1352 } else {
1353
6c17b77b 1354 /*
a7679ed5
SF		 1355 * Since queue is stopped, queue up frames for
1356 * later transmission from the tx-pending
1357 * tasklet when the queue is woken again.
6c17b77b 1358 */
a7679ed5
SF		 1359 if (txpending)
1360 skb_queue_splice_init(skbs,
1361 &local->pending[q]);
1362 else
1363 skb_queue_splice_tail_init(skbs,
1364 &local->pending[q]);
1365
1366 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1367 flags);
1368 return false;
6c17b77b 1369 }
7bb45683 1370 }
3b8d81e0 1371 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
f8e79ddd 1372
11127e91 1373 info->control.vif = vif;
f0e72851 1374
11127e91 1375 __skb_unlink(skb, skbs);
ba8c3d6f 1376 ieee80211_drv_tx(local, vif, sta, skb);
11127e91 1377 }
5061b0c2 1378
11127e91
JB		 1379 return true;
1380}
1381
1382/*
1383 * Returns false if the frame couldn't be transmitted but was queued instead.
1384 */
1385static bool __ieee80211_tx(struct ieee80211_local *local,
1386 struct sk_buff_head *skbs, int led_len,
1387 struct sta_info *sta, bool txpending)
1388{
1389 struct ieee80211_tx_info *info;
1390 struct ieee80211_sub_if_data *sdata;
1391 struct ieee80211_vif *vif;
1392 struct ieee80211_sta *pubsta;
1393 struct sk_buff *skb;
1394 bool result = true;
1395 __le16 fc;
5061b0c2 1396
11127e91
JB		 1397 if (WARN_ON(skb_queue_empty(skbs)))
1398 return true;
ec25acc4 1399
11127e91
JB		 1400 skb = skb_peek(skbs);
1401 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
1402 info = IEEE80211_SKB_CB(skb);
1403 sdata = vif_to_sdata(info->control.vif);
1404 if (sta && !sta->uploaded)
1405 sta = NULL;
1406
1407 if (sta)
1408 pubsta = &sta->sta;
1409 else
1410 pubsta = NULL;
1411
1412 switch (sdata->vif.type) {
1413 case NL80211_IFTYPE_MONITOR:
c82b5a74
JB		 1414 if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
1415 vif = &sdata->vif;
1416 break;
1417 }
4b6f1dd6 1418 sdata = rcu_dereference(local->monitor_sdata);
3a25a8c8 1419 if (sdata) {
4b6f1dd6 1420 vif = &sdata->vif;
3a25a8c8
JB		 1421 info->hw_queue =
1422 vif->hw_queue[skb_get_queue_mapping(skb)];
1423 } else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) {
1424 dev_kfree_skb(skb);
1425 return true;
1426 } else
4b6f1dd6 1427 vif = NULL;
11127e91
JB		 1428 break;
1429 case NL80211_IFTYPE_AP_VLAN:
1430 sdata = container_of(sdata->bss,
1431 struct ieee80211_sub_if_data, u.ap);
1432 /* fall through */
1433 default:
1434 vif = &sdata->vif;
1435 break;
e2ebc74d 1436 }
2de8e0d9 1437
cb831b53
JB		 1438 result = ieee80211_tx_frags(local, vif, pubsta, skbs,
1439 txpending);
11127e91 1440
74e4dbfd 1441 ieee80211_tpt_led_trig_tx(local, fc, led_len);
74e4dbfd 1442
4db4e0a1 1443 WARN_ON_ONCE(!skb_queue_empty(skbs));
252b86c4 1444
11127e91 1445 return result;
e2ebc74d
JB		 1446}
1447
97b045d6
JB		 1448/*
1449 * Invoke TX handlers, return 0 on success and non-zero if the
1450 * frame was dropped or queued.
1451 */
1452static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1453{
252b86c4 1454 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
97b045d6 1455 ieee80211_tx_result res = TX_DROP;
97b045d6 1456
9aa4aee3
JB		 1457#define CALL_TXH(txh) \
1458 do { \
1459 res = txh(tx); \
1460 if (res != TX_CONTINUE) \
1461 goto txh_done; \
1462 } while (0)
1463
5c1b98a5 1464 CALL_TXH(ieee80211_tx_h_dynamic_ps);
9aa4aee3
JB		 1465 CALL_TXH(ieee80211_tx_h_check_assoc);
1466 CALL_TXH(ieee80211_tx_h_ps_buf);
a621fa4d 1467 CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
9aa4aee3 1468 CALL_TXH(ieee80211_tx_h_select_key);
af65cd96
JB		 1469 if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
1470 CALL_TXH(ieee80211_tx_h_rate_ctrl);
c6fcf6bc 1471
aa5b5492
JB		 1472 if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
1473 __skb_queue_tail(&tx->skbs, tx->skb);
1474 tx->skb = NULL;
c6fcf6bc 1475 goto txh_done;
aa5b5492 1476 }
c6fcf6bc
JB		 1477
1478 CALL_TXH(ieee80211_tx_h_michael_mic_add);
9aa4aee3
JB		 1479 CALL_TXH(ieee80211_tx_h_sequence);
1480 CALL_TXH(ieee80211_tx_h_fragment);
d9e8a70f 1481 /* handlers after fragment must be aware of tx info fragmentation! */
9aa4aee3
JB		 1482 CALL_TXH(ieee80211_tx_h_stats);
1483 CALL_TXH(ieee80211_tx_h_encrypt);
8fd369ee
AN		 1484 if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
1485 CALL_TXH(ieee80211_tx_h_calculate_duration);
d9e8a70f 1486#undef CALL_TXH
97b045d6 1487
d9e8a70f 1488 txh_done:
97b045d6 1489 if (unlikely(res == TX_DROP)) {
5479d0e7 1490 I802_DEBUG_INC(tx->local->tx_handlers_drop);
252b86c4 1491 if (tx->skb)
c3e7724b 1492 ieee80211_free_txskb(&tx->local->hw, tx->skb);
252b86c4 1493 else
1f98ab7f 1494 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
97b045d6
JB		 1495 return -1;
1496 } else if (unlikely(res == TX_QUEUED)) {
5479d0e7 1497 I802_DEBUG_INC(tx->local->tx_handlers_queued);
97b045d6
JB		 1498 return -1;
1499 }
1500
1501 return 0;
1502}
1503
06be6b14
FF		 1504bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
1505 struct ieee80211_vif *vif, struct sk_buff *skb,
1506 int band, struct ieee80211_sta **sta)
1507{
1508 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1509 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1510 struct ieee80211_tx_data tx;
88724a81 1511 struct sk_buff *skb2;
06be6b14 1512
7c10770f 1513 if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
06be6b14
FF		 1514 return false;
1515
1516 info->band = band;
1517 info->control.vif = vif;
1518 info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];
1519
1520 if (invoke_tx_handlers(&tx))
1521 return false;
1522
1523 if (sta) {
1524 if (tx.sta)
1525 *sta = &tx.sta->sta;
1526 else
1527 *sta = NULL;
1528 }
1529
88724a81
JB		 1530 /* this function isn't suitable for fragmented data frames */
1531 skb2 = __skb_dequeue(&tx.skbs);
1532 if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
1533 ieee80211_free_txskb(hw, skb2);
1534 ieee80211_purge_tx_queue(hw, &tx.skbs);
1535 return false;
1536 }
1537
06be6b14
FF		 1538 return true;
1539}
1540EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
1541
7bb45683
JB		 1542/*
1543 * Returns false if the frame couldn't be transmitted but was queued instead.
1544 */
1545static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
7c10770f
JB		 1546 struct sta_info *sta, struct sk_buff *skb,
1547 bool txpending)
e2ebc74d 1548{
3b8d81e0 1549 struct ieee80211_local *local = sdata->local;
5cf121c3 1550 struct ieee80211_tx_data tx;
97b045d6 1551 ieee80211_tx_result res_prepare;
e039fa4a 1552 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
7bb45683 1553 bool result = true;
74e4dbfd 1554 int led_len;
e2ebc74d 1555
e2ebc74d
JB		 1556 if (unlikely(skb->len < 10)) {
1557 dev_kfree_skb(skb);
7bb45683 1558 return true;
e2ebc74d
JB		 1559 }
1560
58d4185e 1561 /* initialises tx */
74e4dbfd 1562 led_len = skb->len;
7c10770f 1563 res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
e2ebc74d 1564
cd8ffc80 1565 if (unlikely(res_prepare == TX_DROP)) {
c3e7724b 1566 ieee80211_free_txskb(&local->hw, skb);
55de908a 1567 return true;
cd8ffc80 1568 } else if (unlikely(res_prepare == TX_QUEUED)) {
55de908a 1569 return true;
e2ebc74d
JB		 1570 }
1571
3a25a8c8
JB		 1572 /* set up hw_queue value early */
1573 if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
1574 !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL))
1575 info->hw_queue =
1576 sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
1577
7bb45683 1578 if (!invoke_tx_handlers(&tx))
74e4dbfd
JB		 1579 result = __ieee80211_tx(local, &tx.skbs, led_len,
1580 tx.sta, txpending);
55de908a 1581
7bb45683 1582 return result;
e2ebc74d
JB		 1583}
1584
1585/* device xmit handlers */
1586
3bff1865 1587static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
23c0752a
JB		 1588 struct sk_buff *skb,
1589 int head_need, bool may_encrypt)
1590{
3bff1865 1591 struct ieee80211_local *local = sdata->local;
23c0752a
JB		 1592 int tail_need = 0;
1593
3bff1865 1594 if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
23c0752a
JB		 1595 tail_need = IEEE80211_ENCRYPT_TAILROOM;
1596 tail_need -= skb_tailroom(skb);
1597 tail_need = max_t(int, tail_need, 0);
1598 }
1599
c70f59a2
IY		 1600 if (skb_cloned(skb) &&
1601 (!(local->hw.flags & IEEE80211_HW_SUPPORTS_CLONED_SKBS) ||
1602 !skb_clone_writable(skb, ETH_HLEN) ||
1603 sdata->crypto_tx_tailroom_needed_cnt))
23c0752a 1604 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
4cd06a34 1605 else if (head_need || tail_need)
23c0752a 1606 I802_DEBUG_INC(local->tx_expand_skb_head);
4cd06a34
FF		 1607 else
1608 return 0;
23c0752a
JB		 1609
1610 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
0fb9a9ec
JP		 1611 wiphy_debug(local->hw.wiphy,
1612 "failed to reallocate TX buffer\n");
23c0752a
JB		 1613 return -ENOMEM;
1614 }
1615
23c0752a
JB		 1616 return 0;
1617}
1618
7c10770f
JB		 1619void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1620 struct sta_info *sta, struct sk_buff *skb)
e2ebc74d 1621{
3b8d81e0 1622 struct ieee80211_local *local = sdata->local;
e039fa4a 1623 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
e32f85f7 1624 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
e2ebc74d 1625 int headroom;
23c0752a 1626 bool may_encrypt;
e2ebc74d 1627
3b8d81e0 1628 may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
23c0752a 1629
3b8d81e0 1630 headroom = local->tx_headroom;
23c0752a 1631 if (may_encrypt)
2475b1cc 1632 headroom += sdata->encrypt_headroom;
23c0752a
JB		 1633 headroom -= skb_headroom(skb);
1634 headroom = max_t(int, 0, headroom);
1635
3bff1865 1636 if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
c3e7724b 1637 ieee80211_free_txskb(&local->hw, skb);
3b8d81e0 1638 return;
e2ebc74d
JB		 1639 }
1640
740c1aa3 1641 hdr = (struct ieee80211_hdr *) skb->data;
5061b0c2 1642 info->control.vif = &sdata->vif;
e2ebc74d 1643
3f52b7e3
MP		 1644 if (ieee80211_vif_is_mesh(&sdata->vif)) {
1645 if (ieee80211_is_data(hdr->frame_control) &&
1646 is_unicast_ether_addr(hdr->addr1)) {
bf7cd94d 1647 if (mesh_nexthop_resolve(sdata, skb))
3f52b7e3
MP		 1648 return; /* skb queued: don't free */
1649 } else {
1650 ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
1651 }
98aed9fd 1652 }
cca89496 1653
2154c81c 1654 ieee80211_set_qos_hdr(sdata, skb);
7c10770f 1655 ieee80211_tx(sdata, sta, skb, false);
e2ebc74d
JB		 1656}
1657
73b9f03a
JB		 1658static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
1659{
1660 struct ieee80211_radiotap_iterator iterator;
1661 struct ieee80211_radiotap_header *rthdr =
1662 (struct ieee80211_radiotap_header *) skb->data;
1663 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1664 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
1665 NULL);
1666 u16 txflags;
1667
1668 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
1669 IEEE80211_TX_CTL_DONTFRAG;
1670
1671 /*
1672 * for every radiotap entry that is present
1673 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
1674 * entries present, or -EINVAL on error)
1675 */
1676
1677 while (!ret) {
1678 ret = ieee80211_radiotap_iterator_next(&iterator);
1679
1680 if (ret)
1681 continue;
1682
1683 /* see if this argument is something we can use */
1684 switch (iterator.this_arg_index) {
1685 /*
1686 * You must take care when dereferencing iterator.this_arg
1687 * for multibyte types... the pointer is not aligned. Use
1688 * get_unaligned((type *)iterator.this_arg) to dereference
1689 * iterator.this_arg for type "type" safely on all arches.
1690 */
1691 case IEEE80211_RADIOTAP_FLAGS:
1692 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
1693 /*
1694 * this indicates that the skb we have been
1695 * handed has the 32-bit FCS CRC at the end...
1696 * we should react to that by snipping it off
1697 * because it will be recomputed and added
1698 * on transmission
1699 */
1700 if (skb->len < (iterator._max_length + FCS_LEN))
1701 return false;
1702
1703 skb_trim(skb, skb->len - FCS_LEN);
1704 }
1705 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
1706 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
1707 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
1708 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
1709 break;
1710
1711 case IEEE80211_RADIOTAP_TX_FLAGS:
1712 txflags = get_unaligned_le16(iterator.this_arg);
1713 if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
1714 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1715 break;
1716
1717 /*
1718 * Please update the file
1719 * Documentation/networking/mac80211-injection.txt
1720 * when parsing new fields here.
1721 */
1722
1723 default:
1724 break;
1725 }
1726 }
1727
1728 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
1729 return false;
1730
1731 /*
1732 * remove the radiotap header
1733 * iterator->_max_length was sanity-checked against
1734 * skb->len by iterator init
1735 */
1736 skb_pull(skb, iterator._max_length);
1737
1738 return true;
1739}
1740
d0cf9c0d
SH		 1741netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
1742 struct net_device *dev)
e2ebc74d
JB		 1743{
1744 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
55de908a 1745 struct ieee80211_chanctx_conf *chanctx_conf;
e2ebc74d
JB		 1746 struct ieee80211_radiotap_header *prthdr =
1747 (struct ieee80211_radiotap_header *)skb->data;
3b8d81e0 1748 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
f75f5c6f 1749 struct ieee80211_hdr *hdr;
5d9cf4a5 1750 struct ieee80211_sub_if_data *tmp_sdata, *sdata;
b4932836 1751 struct cfg80211_chan_def *chandef;
9b8a74e3 1752 u16 len_rthdr;
5d9cf4a5 1753 int hdrlen;
e2ebc74d 1754
9b8a74e3
AG		 1755 /* check for not even having the fixed radiotap header part */
1756 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
1757 goto fail; /* too short to be possibly valid */
1758
1759 /* is it a header version we can trust to find length from? */
1760 if (unlikely(prthdr->it_version))
1761 goto fail; /* only version 0 is supported */
1762
1763 /* then there must be a radiotap header with a length we can use */
1764 len_rthdr = ieee80211_get_radiotap_len(skb->data);
1765
1766 /* does the skb contain enough to deliver on the alleged length? */
1767 if (unlikely(skb->len < len_rthdr))
1768 goto fail; /* skb too short for claimed rt header extent */
e2ebc74d 1769
e2ebc74d
JB		 1770 /*
1771 * fix up the pointers accounting for the radiotap
1772 * header still being in there. We are being given
1773 * a precooked IEEE80211 header so no need for
1774 * normal processing
1775 */
9b8a74e3 1776 skb_set_mac_header(skb, len_rthdr);
e2ebc74d 1777 /*
9b8a74e3
AG		 1778 * these are just fixed to the end of the rt area since we
1779 * don't have any better information and at this point, nobody cares
e2ebc74d 1780 */
9b8a74e3
AG		 1781 skb_set_network_header(skb, len_rthdr);
1782 skb_set_transport_header(skb, len_rthdr);
e2ebc74d 1783
5d9cf4a5
JB		 1784 if (skb->len < len_rthdr + 2)
1785 goto fail;
1786
1787 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
1788 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1789
1790 if (skb->len < len_rthdr + hdrlen)
1791 goto fail;
1792
f75f5c6f
HS		 1793 /*
1794 * Initialize skb->protocol if the injected frame is a data frame
1795 * carrying a rfc1042 header
1796 */
5d9cf4a5
JB		 1797 if (ieee80211_is_data(hdr->frame_control) &&
1798 skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
1799 u8 *payload = (u8 *)hdr + hdrlen;
1800
b203ca39 1801 if (ether_addr_equal(payload, rfc1042_header))
5d9cf4a5
JB		 1802 skb->protocol = cpu_to_be16((payload[6] << 8) |
1803 payload[7]);
f75f5c6f
HS		 1804 }
1805
3b8d81e0
JB		 1806 memset(info, 0, sizeof(*info));
1807
5d9cf4a5 1808 info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
73b9f03a
JB		 1809 IEEE80211_TX_CTL_INJECTED;
1810
1811 /* process and remove the injection radiotap header */
1812 if (!ieee80211_parse_tx_radiotap(skb))
1813 goto fail;
5d9cf4a5
JB		 1814
1815 rcu_read_lock();
1816
1817 /*
1818 * We process outgoing injected frames that have a local address
1819 * we handle as though they are non-injected frames.
1820 * This code here isn't entirely correct, the local MAC address
1821 * isn't always enough to find the interface to use; for proper
1822 * VLAN/WDS support we will need a different mechanism (which
1823 * likely isn't going to be monitor interfaces).
1824 */
1825 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1826
1827 list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
1828 if (!ieee80211_sdata_running(tmp_sdata))
1829 continue;
1830 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
1831 tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
1832 tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
1833 continue;
b203ca39 1834 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
5d9cf4a5
JB		 1835 sdata = tmp_sdata;
1836 break;
1837 }
1838 }
7351c6bd 1839
55de908a
JB		 1840 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
1841 if (!chanctx_conf) {
1842 tmp_sdata = rcu_dereference(local->monitor_sdata);
1843 if (tmp_sdata)
1844 chanctx_conf =
1845 rcu_dereference(tmp_sdata->vif.chanctx_conf);
1846 }
55de908a 1847
b4a7ff75 1848 if (chanctx_conf)
b4932836 1849 chandef = &chanctx_conf->def;
b4a7ff75 1850 else if (!local->use_chanctx)
b4932836 1851 chandef = &local->_oper_chandef;
b4a7ff75
FF		 1852 else
1853 goto fail_rcu;
55de908a
JB		 1854
1855 /*
1856 * Frame injection is not allowed if beaconing is not allowed
1857 * or if we need radar detection. Beaconing is usually not allowed when
1858 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
1859 * Passive scan is also used in world regulatory domains where
1860 * your country is not known and as such it should be treated as
1861 * NO TX unless the channel is explicitly allowed in which case
1862 * your current regulatory domain would not have the passive scan
1863 * flag.
1864 *
1865 * Since AP mode uses monitor interfaces to inject/TX management
1866 * frames we can make AP mode the exception to this rule once it
1867 * supports radar detection as its implementation can deal with
1868 * radar detection by itself. We can do that later by adding a
1869 * monitor flag interfaces used for AP support.
1870 */
b4932836
JD		 1871 if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
1872 sdata->vif.type))
55de908a
JB		 1873 goto fail_rcu;
1874
73c4e195 1875 info->band = chandef->chan->band;
7c10770f 1876 ieee80211_xmit(sdata, NULL, skb);
5d9cf4a5
JB		 1877 rcu_read_unlock();
1878
e2ebc74d 1879 return NETDEV_TX_OK;
9b8a74e3 1880
55de908a
JB		 1881fail_rcu:
1882 rcu_read_unlock();
9b8a74e3
AG		 1883fail:
1884 dev_kfree_skb(skb);
1885 return NETDEV_TX_OK; /* meaning, we dealt with the skb */
e2ebc74d
JB		 1886}
1887
97ffe757 1888static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
ad38bfc9 1889{
97ffe757 1890 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
ad38bfc9 1891
97ffe757
JB		 1892 return ethertype == ETH_P_TDLS &&
1893 skb->len > 14 &&
1894 skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
1895}
1896
1897static int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
1898 struct sk_buff *skb,
1899 struct sta_info **sta_out)
1900{
1901 struct sta_info *sta;
1902
1903 switch (sdata->vif.type) {
1904 case NL80211_IFTYPE_AP_VLAN:
1905 sta = rcu_dereference(sdata->u.vlan.sta);
1906 if (sta) {
1907 *sta_out = sta;
1908 return 0;
1909 } else if (sdata->wdev.use_4addr) {
1910 return -ENOLINK;
1911 }
1912 /* fall through */
1913 case NL80211_IFTYPE_AP:
1914 case NL80211_IFTYPE_OCB:
1915 case NL80211_IFTYPE_ADHOC:
1916 if (is_multicast_ether_addr(skb->data)) {
1917 *sta_out = ERR_PTR(-ENOENT);
1918 return 0;
1919 }
1920 sta = sta_info_get_bss(sdata, skb->data);
1921 break;
1922 case NL80211_IFTYPE_WDS:
1923 sta = sta_info_get(sdata, sdata->u.wds.remote_addr);
1924 break;
1925#ifdef CONFIG_MAC80211_MESH
1926 case NL80211_IFTYPE_MESH_POINT:
1927 /* determined much later */
1928 *sta_out = NULL;
1929 return 0;
1930#endif
1931 case NL80211_IFTYPE_STATION:
1932 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1933 sta = sta_info_get(sdata, skb->data);
1934 if (sta) {
1935 bool tdls_peer, tdls_auth;
1936
1937 tdls_peer = test_sta_flag(sta,
1938 WLAN_STA_TDLS_PEER);
1939 tdls_auth = test_sta_flag(sta,
1940 WLAN_STA_TDLS_PEER_AUTH);
1941
1942 if (tdls_peer && tdls_auth) {
1943 *sta_out = sta;
1944 return 0;
1945 }
1946
1947 /*
1948 * TDLS link during setup - throw out frames to
1949 * peer. Allow TDLS-setup frames to unauthorized
1950 * peers for the special case of a link teardown
1951 * after a TDLS sta is removed due to being
1952 * unreachable.
1953 */
1954 if (tdls_peer && !tdls_auth &&
1955 !ieee80211_is_tdls_setup(skb))
1956 return -EINVAL;
1957 }
1958
1959 }
1960
1961 sta = sta_info_get(sdata, sdata->u.mgd.bssid);
1962 if (!sta)
1963 return -ENOLINK;
1964 break;
1965 default:
1966 return -EINVAL;
1967 }
1968
1969 *sta_out = sta ?: ERR_PTR(-ENOENT);
1970 return 0;
ad38bfc9
MG		 1971}
1972
e2ebc74d 1973/**
4c9451ed
JB		 1974 * ieee80211_build_hdr - build 802.11 header in the given frame
1975 * @sdata: virtual interface to build the header for
1976 * @skb: the skb to build the header in
24d342c5 1977 * @info_flags: skb flags to set
e2ebc74d 1978 *
4c9451ed
JB		 1979 * This function takes the skb with 802.3 header and reformats the header to
1980 * the appropriate IEEE 802.11 header based on which interface the packet is
1981 * being transmitted on.
1982 *
1983 * Note that this function also takes care of the TX status request and
1984 * potential unsharing of the SKB - this needs to be interleaved with the
1985 * header building.
e2ebc74d 1986 *
4c9451ed
JB		 1987 * The function requires the read-side RCU lock held
1988 *
1989 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
e2ebc74d 1990 */
4c9451ed 1991static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
7c10770f 1992 struct sk_buff *skb, u32 info_flags,
97ffe757 1993 struct sta_info *sta)
e2ebc74d 1994{
133b8226 1995 struct ieee80211_local *local = sdata->local;
489ee919 1996 struct ieee80211_tx_info *info;
dcf33963 1997 int head_need;
065e9605
HH		 1998 u16 ethertype, hdrlen, meshhdrlen = 0;
1999 __le16 fc;
e2ebc74d 2000 struct ieee80211_hdr hdr;
ff67bb86 2001 struct ieee80211s_hdr mesh_hdr __maybe_unused;
b8bacc18 2002 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
e2ebc74d
JB		 2003 const u8 *encaps_data;
2004 int encaps_len, skip_header_bytes;
e8bf9649 2005 int nh_pos, h_pos;
97ffe757
JB		 2006 bool wme_sta = false, authorized = false;
2007 bool tdls_peer;
a729cff8 2008 bool multicast;
a729cff8 2009 u16 info_id = 0;
55de908a
JB		 2010 struct ieee80211_chanctx_conf *chanctx_conf;
2011 struct ieee80211_sub_if_data *ap_sdata;
2012 enum ieee80211_band band;
4c9451ed 2013 int ret;
e2ebc74d 2014
97ffe757
JB		 2015 if (IS_ERR(sta))
2016 sta = NULL;
2017
e2ebc74d
JB		 2018 /* convert Ethernet header to proper 802.11 header (based on
2019 * operation mode) */
2020 ethertype = (skb->data[12] << 8) | skb->data[13];
065e9605 2021 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
e2ebc74d 2022
51fb61e7 2023 switch (sdata->vif.type) {
05c914fe 2024 case NL80211_IFTYPE_AP_VLAN:
97ffe757 2025 if (sdata->wdev.use_4addr) {
f14543ee
FF		 2026 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2027 /* RA TA DA SA */
2028 memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
47846c9b 2029 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
f14543ee
FF		 2030 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2031 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2032 hdrlen = 30;
c2c98fde 2033 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
a74a8c84 2034 wme_sta = sta->sta.wme;
f14543ee 2035 }
55de908a
JB		 2036 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2037 u.ap);
2038 chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
4c9451ed
JB		 2039 if (!chanctx_conf) {
2040 ret = -ENOTCONN;
2041 goto free;
2042 }
4bf88530 2043 band = chanctx_conf->def.chan->band;
97ffe757 2044 if (sdata->wdev.use_4addr)
f14543ee
FF		 2045 break;
2046 /* fall through */
2047 case NL80211_IFTYPE_AP:
fe80123d
AB		 2048 if (sdata->vif.type == NL80211_IFTYPE_AP)
2049 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2050 if (!chanctx_conf) {
2051 ret = -ENOTCONN;
2052 goto free;
2053 }
065e9605 2054 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
e2ebc74d
JB		 2055 /* DA BSSID SA */
2056 memcpy(hdr.addr1, skb->data, ETH_ALEN);
47846c9b 2057 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
e2ebc74d
JB		 2058 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
2059 hdrlen = 24;
4bf88530 2060 band = chanctx_conf->def.chan->band;
cf966838 2061 break;
05c914fe 2062 case NL80211_IFTYPE_WDS:
065e9605 2063 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
e2ebc74d
JB		 2064 /* RA TA DA SA */
2065 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
47846c9b 2066 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
e2ebc74d
JB		 2067 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2068 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2069 hdrlen = 30;
55de908a
JB		 2070 /*
2071 * This is the exception! WDS style interfaces are prohibited
2072 * when channel contexts are in used so this must be valid
2073 */
675a0b04 2074 band = local->hw.conf.chandef.chan->band;
cf966838 2075 break;
33b64eb2 2076#ifdef CONFIG_MAC80211_MESH
05c914fe 2077 case NL80211_IFTYPE_MESH_POINT:
b8bacc18 2078 if (!is_multicast_ether_addr(skb->data)) {
163df6cf
CYY		 2079 struct sta_info *next_hop;
2080 bool mpp_lookup = true;
2081
bf7cd94d 2082 mpath = mesh_path_lookup(sdata, skb->data);
163df6cf
CYY		 2083 if (mpath) {
2084 mpp_lookup = false;
2085 next_hop = rcu_dereference(mpath->next_hop);
2086 if (!next_hop ||
2087 !(mpath->flags & (MESH_PATH_ACTIVE |
2088 MESH_PATH_RESOLVING)))
2089 mpp_lookup = true;
2090 }
2091
2092 if (mpp_lookup)
bf7cd94d 2093 mppath = mpp_path_lookup(sdata, skb->data);
163df6cf
CYY		 2094
2095 if (mppath && mpath)
2096 mesh_path_del(mpath->sdata, mpath->dst);
b8bacc18 2097 }
79617dee 2098
f76b57b4 2099 /*
9d52501b
JF		 2100 * Use address extension if it is a packet from
2101 * another interface or if we know the destination
2102 * is being proxied by a portal (i.e. portal address
2103 * differs from proxied address)
f76b57b4 2104 */
b203ca39
JP		 2105 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
2106 !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
3c5772a5
JC		 2107 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2108 skb->data, skb->data + ETH_ALEN);
bf7cd94d
JB		 2109 meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
2110 NULL, NULL);
79617dee 2111 } else {
27f01124
TP		 2112 /* DS -> MBSS (802.11-2012 13.11.3.3).
2113 * For unicast with unknown forwarding information,
2114 * destination might be in the MBSS or if that fails
2115 * forwarded to another mesh gate. In either case
2116 * resolution will be handled in ieee80211_xmit(), so
2117 * leave the original DA. This also works for mcast */
2118 const u8 *mesh_da = skb->data;
2119
2120 if (mppath)
2121 mesh_da = mppath->mpp;
2122 else if (mpath)
2123 mesh_da = mpath->dst;
79617dee 2124
3c5772a5 2125 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
47846c9b 2126 mesh_da, sdata->vif.addr);
27f01124
TP		 2127 if (is_multicast_ether_addr(mesh_da))
2128 /* DA TA mSA AE:SA */
bf7cd94d
JB		 2129 meshhdrlen = ieee80211_new_mesh_header(
2130 sdata, &mesh_hdr,
2131 skb->data + ETH_ALEN, NULL);
3c5772a5 2132 else
27f01124 2133 /* RA TA mDA mSA AE:DA SA */
bf7cd94d
JB		 2134 meshhdrlen = ieee80211_new_mesh_header(
2135 sdata, &mesh_hdr, skb->data,
2136 skb->data + ETH_ALEN);
79617dee 2137
79617dee 2138 }
55de908a 2139 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2140 if (!chanctx_conf) {
2141 ret = -ENOTCONN;
2142 goto free;
2143 }
4bf88530 2144 band = chanctx_conf->def.chan->band;
33b64eb2
LCC		 2145 break;
2146#endif
05c914fe 2147 case NL80211_IFTYPE_STATION:
97ffe757
JB		 2148 /* we already did checks when looking up the RA STA */
2149 tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
941c93cd 2150
97ffe757 2151 if (tdls_peer) {
941c93cd
AN		 2152 /* DA SA BSSID */
2153 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2154 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2155 memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
2156 hdrlen = 24;
2157 } else if (sdata->u.mgd.use_4addr &&
2158 cpu_to_be16(ethertype) != sdata->control_port_protocol) {
2159 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2160 IEEE80211_FCTL_TODS);
f14543ee 2161 /* RA TA DA SA */
941c93cd 2162 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
47846c9b 2163 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
f14543ee
FF		 2164 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2165 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2166 hdrlen = 30;
2167 } else {
2168 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2169 /* BSSID SA DA */
941c93cd 2170 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
f14543ee
FF		 2171 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2172 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2173 hdrlen = 24;
2174 }
55de908a 2175 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2176 if (!chanctx_conf) {
2177 ret = -ENOTCONN;
2178 goto free;
2179 }
4bf88530 2180 band = chanctx_conf->def.chan->band;
cf966838 2181 break;
239281f8
RL		 2182 case NL80211_IFTYPE_OCB:
2183 /* DA SA BSSID */
2184 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2185 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2186 eth_broadcast_addr(hdr.addr3);
2187 hdrlen = 24;
2188 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2189 if (!chanctx_conf) {
2190 ret = -ENOTCONN;
2191 goto free;
2192 }
239281f8
RL		 2193 band = chanctx_conf->def.chan->band;
2194 break;
05c914fe 2195 case NL80211_IFTYPE_ADHOC:
e2ebc74d
JB		 2196 /* DA SA BSSID */
2197 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2198 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
46900298 2199 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
e2ebc74d 2200 hdrlen = 24;
55de908a 2201 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4c9451ed
JB		 2202 if (!chanctx_conf) {
2203 ret = -ENOTCONN;
2204 goto free;
2205 }
4bf88530 2206 band = chanctx_conf->def.chan->band;
cf966838
JB		 2207 break;
2208 default:
4c9451ed
JB		 2209 ret = -EINVAL;
2210 goto free;
e2ebc74d
JB		 2211 }
2212
a729cff8 2213 multicast = is_multicast_ether_addr(hdr.addr1);
e2ebc74d 2214
97ffe757
JB		 2215 /* sta is always NULL for mesh */
2216 if (sta) {
2217 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2218 wme_sta = sta->sta.wme;
2219 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2220 /* For mesh, the use of the QoS header is mandatory */
c2c98fde 2221 wme_sta = true;
97ffe757 2222 }
4777be41 2223
527871d7
JB		 2224 /* receiver does QoS (which also means we do) use it */
2225 if (wme_sta) {
065e9605 2226 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
ce3edf6d
JB		 2227 hdrlen += 2;
2228 }
2229
2230 /*
238814fd
JB		 2231 * Drop unicast frames to unauthorised stations unless they are
2232 * EAPOL frames from the local station.
ce3edf6d 2233 */
55182e4a 2234 if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
239281f8 2235 (sdata->vif.type != NL80211_IFTYPE_OCB) &&
a6ececf4 2236 !multicast && !authorized &&
55182e4a 2237 (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
b203ca39 2238 !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
ce3edf6d 2239#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
bdcbd8e0 2240 net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
4c9451ed 2241 sdata->name, hdr.addr1);
ce3edf6d
JB		 2242#endif
2243
2244 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
2245
4c9451ed
JB		 2246 ret = -EPERM;
2247 goto free;
ce3edf6d
JB		 2248 }
2249
a729cff8
JB		 2250 if (unlikely(!multicast && skb->sk &&
2251 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
bf7fa551 2252 struct sk_buff *ack_skb = skb_clone_sk(skb);
a729cff8 2253
bf7fa551 2254 if (ack_skb) {
a729cff8 2255 unsigned long flags;
9475af6e 2256 int id;
a729cff8
JB		 2257
2258 spin_lock_irqsave(&local->ack_status_lock, flags);
bf7fa551 2259 id = idr_alloc(&local->ack_status_frames, ack_skb,
9475af6e 2260 1, 0x10000, GFP_ATOMIC);
a729cff8
JB		 2261 spin_unlock_irqrestore(&local->ack_status_lock, flags);
2262
9475af6e 2263 if (id >= 0) {
a729cff8
JB		 2264 info_id = id;
2265 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
a729cff8 2266 } else {
bf7fa551 2267 kfree_skb(ack_skb);
a729cff8 2268 }
a729cff8
JB		 2269 }
2270 }
2271
7e244707
HS		 2272 /*
2273 * If the skb is shared we need to obtain our own copy.
2274 */
2275 if (skb_shared(skb)) {
a729cff8
JB		 2276 struct sk_buff *tmp_skb = skb;
2277
2278 /* can't happen -- skb is a clone if info_id != 0 */
2279 WARN_ON(info_id);
2280
f8a0a781 2281 skb = skb_clone(skb, GFP_ATOMIC);
7e244707
HS		 2282 kfree_skb(tmp_skb);
2283
4c9451ed
JB		 2284 if (!skb) {
2285 ret = -ENOMEM;
2286 goto free;
2287 }
7e244707
HS		 2288 }
2289
065e9605 2290 hdr.frame_control = fc;
e2ebc74d
JB		 2291 hdr.duration_id = 0;
2292 hdr.seq_ctrl = 0;
2293
2294 skip_header_bytes = ETH_HLEN;
2295 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
2296 encaps_data = bridge_tunnel_header;
2297 encaps_len = sizeof(bridge_tunnel_header);
2298 skip_header_bytes -= 2;
e5c5d22e 2299 } else if (ethertype >= ETH_P_802_3_MIN) {
e2ebc74d
JB		 2300 encaps_data = rfc1042_header;
2301 encaps_len = sizeof(rfc1042_header);
2302 skip_header_bytes -= 2;
2303 } else {
2304 encaps_data = NULL;
2305 encaps_len = 0;
2306 }
2307
7e244707
HS		 2308 nh_pos = skb_network_header(skb) - skb->data;
2309 h_pos = skb_transport_header(skb) - skb->data;
2310
e2ebc74d
JB		 2311 skb_pull(skb, skip_header_bytes);
2312 nh_pos -= skip_header_bytes;
2313 h_pos -= skip_header_bytes;
2314
23c0752a 2315 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
e2ebc74d 2316
23c0752a
JB		 2317 /*
2318 * So we need to modify the skb header and hence need a copy of
2319 * that. The head_need variable above doesn't, so far, include
2320 * the needed header space that we don't need right away. If we
2321 * can, then we don't reallocate right now but only after the
2322 * frame arrives at the master device (if it does...)
2323 *
2324 * If we cannot, however, then we will reallocate to include all
2325 * the ever needed space. Also, if we need to reallocate it anyway,
2326 * make it big enough for everything we may ever need.
2327 */
e2ebc74d 2328
3a5be7d4 2329 if (head_need > 0 || skb_cloned(skb)) {
2475b1cc 2330 head_need += sdata->encrypt_headroom;
23c0752a
JB		 2331 head_need += local->tx_headroom;
2332 head_need = max_t(int, 0, head_need);
c3e7724b
FF		 2333 if (ieee80211_skb_resize(sdata, skb, head_need, true)) {
2334 ieee80211_free_txskb(&local->hw, skb);
1c963bec 2335 skb = NULL;
4c9451ed 2336 return ERR_PTR(-ENOMEM);
c3e7724b 2337 }
e2ebc74d
JB		 2338 }
2339
2340 if (encaps_data) {
2341 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
2342 nh_pos += encaps_len;
2343 h_pos += encaps_len;
2344 }
c29b9b9b 2345
e4ab7eb0 2346#ifdef CONFIG_MAC80211_MESH
33b64eb2
LCC		 2347 if (meshhdrlen > 0) {
2348 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
2349 nh_pos += meshhdrlen;
2350 h_pos += meshhdrlen;
2351 }
e4ab7eb0 2352#endif
33b64eb2 2353
065e9605 2354 if (ieee80211_is_data_qos(fc)) {
c29b9b9b
JB		 2355 __le16 *qos_control;
2356
f359d3fe 2357 qos_control = (__le16 *) skb_push(skb, 2);
c29b9b9b
JB		 2358 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
2359 /*
2360 * Maybe we could actually set some fields here, for now just
2361 * initialise to zero to indicate no special operation.
2362 */
2363 *qos_control = 0;
2364 } else
2365 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
2366
e2ebc74d
JB		 2367 nh_pos += hdrlen;
2368 h_pos += hdrlen;
2369
e2ebc74d
JB		 2370 /* Update skb pointers to various headers since this modified frame
2371 * is going to go through Linux networking code that may potentially
2372 * need things like pointer to IP header. */
2373 skb_set_mac_header(skb, 0);
2374 skb_set_network_header(skb, nh_pos);
2375 skb_set_transport_header(skb, h_pos);
2376
489ee919 2377 info = IEEE80211_SKB_CB(skb);
3b8d81e0
JB		 2378 memset(info, 0, sizeof(*info));
2379
a729cff8
JB		 2380 info->flags = info_flags;
2381 info->ack_frame_id = info_id;
73c4e195 2382 info->band = band;
a729cff8 2383
4c9451ed
JB		 2384 return skb;
2385 free:
2386 kfree_skb(skb);
2387 return ERR_PTR(ret);
2388}
2389
2390void __ieee80211_subif_start_xmit(struct sk_buff *skb,
2391 struct net_device *dev,
2392 u32 info_flags)
2393{
2394 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
97ffe757 2395 struct sta_info *sta;
4c9451ed
JB		 2396
2397 if (unlikely(skb->len < ETH_HLEN)) {
2398 kfree_skb(skb);
2399 return;
2400 }
2401
2402 rcu_read_lock();
e2ebc74d 2403
97ffe757
JB		 2404 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
2405 kfree_skb(skb);
2406 goto out;
2407 }
4c9451ed 2408
97ffe757 2409 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
4c9451ed
JB		 2410 if (IS_ERR(skb))
2411 goto out;
2412
2413 dev->stats.tx_packets++;
2414 dev->stats.tx_bytes += skb->len;
2415 dev->trans_start = jiffies;
e2ebc74d 2416
7c10770f 2417 ieee80211_xmit(sdata, sta, skb);
4c9451ed 2418 out:
55de908a 2419 rcu_read_unlock();
e2ebc74d
JB		 2420}
2421
4c9451ed
JB		 2422/**
2423 * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
2424 * @skb: packet to be sent
2425 * @dev: incoming interface
2426 *
2427 * On failure skb will be freed.
2428 */
24d342c5
LK		 2429netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
2430 struct net_device *dev)
2431{
2432 __ieee80211_subif_start_xmit(skb, dev, 0);
2433 return NETDEV_TX_OK;
2434}
e2ebc74d 2435
7528ec57
JB		 2436struct sk_buff *
2437ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
2438 struct sk_buff *skb, u32 info_flags)
2439{
2440 struct ieee80211_hdr *hdr;
2441 struct ieee80211_tx_data tx = {
2442 .local = sdata->local,
2443 .sdata = sdata,
2444 };
97ffe757 2445 struct sta_info *sta;
7528ec57
JB		 2446
2447 rcu_read_lock();
2448
97ffe757
JB		 2449 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
2450 kfree_skb(skb);
2451 skb = ERR_PTR(-EINVAL);
2452 goto out;
2453 }
2454
2455 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta);
7528ec57
JB		 2456 if (IS_ERR(skb))
2457 goto out;
2458
2459 hdr = (void *)skb->data;
2460 tx.sta = sta_info_get(sdata, hdr->addr1);
2461 tx.skb = skb;
2462
2463 if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
2464 rcu_read_unlock();
2465 kfree_skb(skb);
2466 return ERR_PTR(-EINVAL);
2467 }
2468
2469out:
2470 rcu_read_unlock();
2471 return skb;
2472}
2473
e2530083
JB		 2474/*
2475 * ieee80211_clear_tx_pending may not be called in a context where
2476 * it is possible that it packets could come in again.
2477 */
e2ebc74d
JB		 2478void ieee80211_clear_tx_pending(struct ieee80211_local *local)
2479{
1f98ab7f 2480 struct sk_buff *skb;
2de8e0d9 2481 int i;
e2ebc74d 2482
1f98ab7f
FF		 2483 for (i = 0; i < local->hw.queues; i++) {
2484 while ((skb = skb_dequeue(&local->pending[i])) != NULL)
2485 ieee80211_free_txskb(&local->hw, skb);
2486 }
e2ebc74d
JB		 2487}
2488
7bb45683
JB		 2489/*
2490 * Returns false if the frame couldn't be transmitted but was queued instead,
2491 * which in this case means re-queued -- take as an indication to stop sending
2492 * more pending frames.
2493 */
cd8ffc80
JB		 2494static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
2495 struct sk_buff *skb)
2496{
2497 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2498 struct ieee80211_sub_if_data *sdata;
2499 struct sta_info *sta;
2500 struct ieee80211_hdr *hdr;
7bb45683 2501 bool result;
55de908a 2502 struct ieee80211_chanctx_conf *chanctx_conf;
cd8ffc80 2503
5061b0c2 2504 sdata = vif_to_sdata(info->control.vif);
cd8ffc80
JB		 2505
2506 if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
55de908a
JB		 2507 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2508 if (unlikely(!chanctx_conf)) {
2509 dev_kfree_skb(skb);
2510 return true;
2511 }
73c4e195 2512 info->band = chanctx_conf->def.chan->band;
7c10770f 2513 result = ieee80211_tx(sdata, NULL, skb, true);
cd8ffc80 2514 } else {
252b86c4
JB		 2515 struct sk_buff_head skbs;
2516
2517 __skb_queue_head_init(&skbs);
2518 __skb_queue_tail(&skbs, skb);
2519
cd8ffc80 2520 hdr = (struct ieee80211_hdr *)skb->data;
abe60632 2521 sta = sta_info_get(sdata, hdr->addr1);
cd8ffc80 2522
74e4dbfd 2523 result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
cd8ffc80
JB		 2524 }
2525
cd8ffc80
JB		 2526 return result;
2527}
2528
e2530083 2529/*
3b8d81e0 2530 * Transmit all pending packets. Called from tasklet.
e2530083 2531 */
e2ebc74d
JB		 2532void ieee80211_tx_pending(unsigned long data)
2533{
2534 struct ieee80211_local *local = (struct ieee80211_local *)data;
2a577d98 2535 unsigned long flags;
cd8ffc80 2536 int i;
3b8d81e0 2537 bool txok;
e2ebc74d 2538
f0e72851 2539 rcu_read_lock();
e2530083 2540
3b8d81e0 2541 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2a577d98
JB		 2542 for (i = 0; i < local->hw.queues; i++) {
2543 /*
2544 * If queue is stopped by something other than due to pending
2545 * frames, or we have no pending frames, proceed to next queue.
2546 */
3b8d81e0 2547 if (local->queue_stop_reasons[i] ||
2a577d98 2548 skb_queue_empty(&local->pending[i]))
e2ebc74d 2549 continue;
e2530083 2550
2a577d98 2551 while (!skb_queue_empty(&local->pending[i])) {
3b8d81e0 2552 struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
5061b0c2 2553 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
5061b0c2 2554
a7bc376c 2555 if (WARN_ON(!info->control.vif)) {
c3e7724b 2556 ieee80211_free_txskb(&local->hw, skb);
a7bc376c
JB		 2557 continue;
2558 }
2559
3b8d81e0
JB		 2560 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
2561 flags);
2562
2563 txok = ieee80211_tx_pending_skb(local, skb);
3b8d81e0
JB		 2564 spin_lock_irqsave(&local->queue_stop_reason_lock,
2565 flags);
2566 if (!txok)
2a577d98 2567 break;
e2ebc74d 2568 }
7236fe29
JB		 2569
2570 if (skb_queue_empty(&local->pending[i]))
3a25a8c8 2571 ieee80211_propagate_queue_wake(local, i);
e2ebc74d 2572 }
3b8d81e0 2573 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2a577d98 2574
f0e72851 2575 rcu_read_unlock();
e2ebc74d
JB		 2576}
2577
2578/* functions for drivers to get certain frames */
2579
eac70c13 2580static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
6ec8c332
AO		 2581 struct ps_data *ps, struct sk_buff *skb,
2582 bool is_template)
e2ebc74d
JB		 2583{
2584 u8 *pos, *tim;
2585 int aid0 = 0;
2586 int i, have_bits = 0, n1, n2;
2587
2588 /* Generate bitmap for TIM only if there are any STAs in power save
2589 * mode. */
d012a605 2590 if (atomic_read(&ps->num_sta_ps) > 0)
e2ebc74d
JB		 2591 /* in the hope that this is faster than
2592 * checking byte-for-byte */
f359d3fe 2593 have_bits = !bitmap_empty((unsigned long *)ps->tim,
e2ebc74d 2594 IEEE80211_MAX_AID+1);
6ec8c332
AO		 2595 if (!is_template) {
2596 if (ps->dtim_count == 0)
2597 ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
2598 else
2599 ps->dtim_count--;
2600 }
e2ebc74d
JB		 2601
2602 tim = pos = (u8 *) skb_put(skb, 6);
2603 *pos++ = WLAN_EID_TIM;
2604 *pos++ = 4;
d012a605 2605 *pos++ = ps->dtim_count;
8860020e 2606 *pos++ = sdata->vif.bss_conf.dtim_period;
e2ebc74d 2607
d012a605 2608 if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf))
e2ebc74d
JB		 2609 aid0 = 1;
2610
d012a605 2611 ps->dtim_bc_mc = aid0 == 1;
512119b3 2612
e2ebc74d
JB		 2613 if (have_bits) {
2614 /* Find largest even number N1 so that bits numbered 1 through
2615 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
2616 * (N2 + 1) x 8 through 2007 are 0. */
2617 n1 = 0;
2618 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
d012a605 2619 if (ps->tim[i]) {
e2ebc74d
JB		 2620 n1 = i & 0xfe;
2621 break;
2622 }
2623 }
2624 n2 = n1;
2625 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
d012a605 2626 if (ps->tim[i]) {
e2ebc74d
JB		 2627 n2 = i;
2628 break;
2629 }
2630 }
2631
2632 /* Bitmap control */
2633 *pos++ = n1 | aid0;
2634 /* Part Virt Bitmap */
5220da39 2635 skb_put(skb, n2 - n1);
d012a605 2636 memcpy(pos, ps->tim + n1, n2 - n1 + 1);
e2ebc74d
JB		 2637
2638 tim[1] = n2 - n1 + 4;
e2ebc74d
JB		 2639 } else {
2640 *pos++ = aid0; /* Bitmap control */
2641 *pos++ = 0; /* Part Virt Bitmap */
2642 }
e2ebc74d
JB		 2643}
2644
eac70c13 2645static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
6ec8c332
AO		 2646 struct ps_data *ps, struct sk_buff *skb,
2647 bool is_template)
eac70c13
MP		 2648{
2649 struct ieee80211_local *local = sdata->local;
2650
2651 /*
2652 * Not very nice, but we want to allow the driver to call
2653 * ieee80211_beacon_get() as a response to the set_tim()
2654 * callback. That, however, is already invoked under the
2655 * sta_lock to guarantee consistent and race-free update
2656 * of the tim bitmap in mac80211 and the driver.
2657 */
2658 if (local->tim_in_locked_section) {
6ec8c332 2659 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
eac70c13 2660 } else {
1b91731d 2661 spin_lock_bh(&local->tim_lock);
6ec8c332 2662 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
1b91731d 2663 spin_unlock_bh(&local->tim_lock);
eac70c13
MP		 2664 }
2665
2666 return 0;
2667}
2668
1af586c9
AO		 2669static void ieee80211_set_csa(struct ieee80211_sub_if_data *sdata,
2670 struct beacon_data *beacon)
73da7d5b
SW		 2671{
2672 struct probe_resp *resp;
cd7760e6
SW		 2673 u8 *beacon_data;
2674 size_t beacon_data_len;
0d06d9ba 2675 int i;
af296bdb 2676 u8 count = beacon->csa_current_counter;
cd7760e6
SW		 2677
2678 switch (sdata->vif.type) {
2679 case NL80211_IFTYPE_AP:
2680 beacon_data = beacon->tail;
2681 beacon_data_len = beacon->tail_len;
2682 break;
2683 case NL80211_IFTYPE_ADHOC:
2684 beacon_data = beacon->head;
2685 beacon_data_len = beacon->head_len;
2686 break;
b8456a14
CYY		 2687 case NL80211_IFTYPE_MESH_POINT:
2688 beacon_data = beacon->head;
2689 beacon_data_len = beacon->head_len;
2690 break;
cd7760e6
SW		 2691 default:
2692 return;
2693 }
73da7d5b 2694
af296bdb 2695 rcu_read_lock();
0d06d9ba 2696 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; ++i) {
af296bdb 2697 resp = rcu_dereference(sdata->u.ap.probe_resp);
0d06d9ba 2698
af296bdb
MK		 2699 if (beacon->csa_counter_offsets[i]) {
2700 if (WARN_ON_ONCE(beacon->csa_counter_offsets[i] >=
2701 beacon_data_len)) {
0d06d9ba
AO		 2702 rcu_read_unlock();
2703 return;
2704 }
af296bdb
MK		 2705
2706 beacon_data[beacon->csa_counter_offsets[i]] = count;
73da7d5b 2707 }
af296bdb
MK		 2708
2709 if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
2710 resp->data[resp->csa_counter_offsets[i]] = count;
73da7d5b 2711 }
af296bdb 2712 rcu_read_unlock();
1af586c9
AO		 2713}
2714
2715u8 ieee80211_csa_update_counter(struct ieee80211_vif *vif)
2716{
2717 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
af296bdb
MK		 2718 struct beacon_data *beacon = NULL;
2719 u8 count = 0;
0d06d9ba 2720
af296bdb
MK		 2721 rcu_read_lock();
2722
2723 if (sdata->vif.type == NL80211_IFTYPE_AP)
2724 beacon = rcu_dereference(sdata->u.ap.beacon);
2725 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2726 beacon = rcu_dereference(sdata->u.ibss.presp);
2727 else if (ieee80211_vif_is_mesh(&sdata->vif))
2728 beacon = rcu_dereference(sdata->u.mesh.beacon);
2729
2730 if (!beacon)
2731 goto unlock;
2732
2733 beacon->csa_current_counter--;
1af586c9
AO		 2734
2735 /* the counter should never reach 0 */
af296bdb
MK		 2736 WARN_ON_ONCE(!beacon->csa_current_counter);
2737 count = beacon->csa_current_counter;
1af586c9 2738
af296bdb
MK		 2739unlock:
2740 rcu_read_unlock();
2741 return count;
73da7d5b 2742}
1af586c9 2743EXPORT_SYMBOL(ieee80211_csa_update_counter);
73da7d5b
SW		 2744
2745bool ieee80211_csa_is_complete(struct ieee80211_vif *vif)
2746{
2747 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
2748 struct beacon_data *beacon = NULL;
2749 u8 *beacon_data;
2750 size_t beacon_data_len;
73da7d5b
SW		 2751 int ret = false;
2752
2753 if (!ieee80211_sdata_running(sdata))
2754 return false;
2755
2756 rcu_read_lock();
2757 if (vif->type == NL80211_IFTYPE_AP) {
2758 struct ieee80211_if_ap *ap = &sdata->u.ap;
2759
2760 beacon = rcu_dereference(ap->beacon);
2761 if (WARN_ON(!beacon || !beacon->tail))
2762 goto out;
2763 beacon_data = beacon->tail;
2764 beacon_data_len = beacon->tail_len;
cd7760e6
SW		 2765 } else if (vif->type == NL80211_IFTYPE_ADHOC) {
2766 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
2767
2768 beacon = rcu_dereference(ifibss->presp);
2769 if (!beacon)
2770 goto out;
2771
b8456a14
CYY		 2772 beacon_data = beacon->head;
2773 beacon_data_len = beacon->head_len;
2774 } else if (vif->type == NL80211_IFTYPE_MESH_POINT) {
2775 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2776
2777 beacon = rcu_dereference(ifmsh->beacon);
2778 if (!beacon)
2779 goto out;
2780
cd7760e6
SW		 2781 beacon_data = beacon->head;
2782 beacon_data_len = beacon->head_len;
73da7d5b
SW		 2783 } else {
2784 WARN_ON(1);
2785 goto out;
2786 }
2787
10d78f27
MK		 2788 if (!beacon->csa_counter_offsets[0])
2789 goto out;
2790
af296bdb 2791 if (WARN_ON_ONCE(beacon->csa_counter_offsets[0] > beacon_data_len))
73da7d5b
SW		 2792 goto out;
2793
af296bdb 2794 if (beacon_data[beacon->csa_counter_offsets[0]] == 1)
73da7d5b
SW		 2795 ret = true;
2796 out:
2797 rcu_read_unlock();
2798
2799 return ret;
2800}
2801EXPORT_SYMBOL(ieee80211_csa_is_complete);
2802
6ec8c332
AO		 2803static struct sk_buff *
2804__ieee80211_beacon_get(struct ieee80211_hw *hw,
2805 struct ieee80211_vif *vif,
2806 struct ieee80211_mutable_offsets *offs,
2807 bool is_template)
e2ebc74d
JB		 2808{
2809 struct ieee80211_local *local = hw_to_local(hw);
af296bdb 2810 struct beacon_data *beacon = NULL;
9d139c81 2811 struct sk_buff *skb = NULL;
e039fa4a 2812 struct ieee80211_tx_info *info;
e2ebc74d 2813 struct ieee80211_sub_if_data *sdata = NULL;
55de908a 2814 enum ieee80211_band band;
e00cfce0 2815 struct ieee80211_tx_rate_control txrc;
55de908a 2816 struct ieee80211_chanctx_conf *chanctx_conf;
1af586c9 2817 int csa_off_base = 0;
8318d78a 2818
5dfdaf58 2819 rcu_read_lock();
e2ebc74d 2820
32bfd35d 2821 sdata = vif_to_sdata(vif);
55de908a 2822 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
e2ebc74d 2823
55de908a 2824 if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
eb3e554b
FF		 2825 goto out;
2826
6ec8c332
AO		 2827 if (offs)
2828 memset(offs, 0, sizeof(*offs));
eddcbb94 2829
05c914fe 2830 if (sdata->vif.type == NL80211_IFTYPE_AP) {
d012a605 2831 struct ieee80211_if_ap *ap = &sdata->u.ap;
d012a605 2832
af296bdb 2833 beacon = rcu_dereference(ap->beacon);
3ad97fbc 2834 if (beacon) {
10d78f27 2835 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 2836 if (!is_template)
2837 ieee80211_csa_update_counter(vif);
2838
2839 ieee80211_set_csa(sdata, beacon);
2840 }
73da7d5b 2841
902acc78
JB		 2842 /*
2843 * headroom, head length,
2844 * tail length and maximum TIM length
2845 */
2846 skb = dev_alloc_skb(local->tx_headroom +
2847 beacon->head_len +
70dabeb7
FF		 2848 beacon->tail_len + 256 +
2849 local->hw.extra_beacon_tailroom);
902acc78
JB		 2850 if (!skb)
2851 goto out;
33b64eb2 2852
902acc78
JB		 2853 skb_reserve(skb, local->tx_headroom);
2854 memcpy(skb_put(skb, beacon->head_len), beacon->head,
2855 beacon->head_len);
33b64eb2 2856
6ec8c332
AO		 2857 ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
2858 is_template);
33b64eb2 2859
6ec8c332
AO		 2860 if (offs) {
2861 offs->tim_offset = beacon->head_len;
2862 offs->tim_length = skb->len - beacon->head_len;
1af586c9
AO		 2863
2864 /* for AP the csa offsets are from tail */
2865 csa_off_base = skb->len;
6ec8c332 2866 }
eddcbb94 2867
902acc78
JB		 2868 if (beacon->tail)
2869 memcpy(skb_put(skb, beacon->tail_len),
2870 beacon->tail, beacon->tail_len);
9d139c81
JB		 2871 } else
2872 goto out;
05c914fe 2873 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
46900298 2874 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
9d139c81 2875 struct ieee80211_hdr *hdr;
33b64eb2 2876
af296bdb
MK		 2877 beacon = rcu_dereference(ifibss->presp);
2878 if (!beacon)
9d139c81
JB		 2879 goto out;
2880
10d78f27 2881 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 2882 if (!is_template)
2883 ieee80211_csa_update_counter(vif);
cd7760e6 2884
af296bdb 2885 ieee80211_set_csa(sdata, beacon);
1af586c9 2886 }
cd7760e6 2887
af296bdb 2888 skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
70dabeb7 2889 local->hw.extra_beacon_tailroom);
9d139c81
JB		 2890 if (!skb)
2891 goto out;
c3ffeab4 2892 skb_reserve(skb, local->tx_headroom);
af296bdb
MK		 2893 memcpy(skb_put(skb, beacon->head_len), beacon->head,
2894 beacon->head_len);
9d139c81
JB		 2895
2896 hdr = (struct ieee80211_hdr *) skb->data;
e7827a70
HH		 2897 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2898 IEEE80211_STYPE_BEACON);
902acc78 2899 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
dbf498fb 2900 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
472dbc45 2901
af296bdb
MK		 2902 beacon = rcu_dereference(ifmsh->beacon);
2903 if (!beacon)
ac1bd846 2904 goto out;
ac1bd846 2905
10d78f27 2906 if (beacon->csa_counter_offsets[0]) {
1af586c9
AO		 2907 if (!is_template)
2908 /* TODO: For mesh csa_counter is in TU, so
2909 * decrementing it by one isn't correct, but
2910 * for now we leave it consistent with overall
2911 * mac80211's behavior.
2912 */
2913 ieee80211_csa_update_counter(vif);
2914
af296bdb 2915 ieee80211_set_csa(sdata, beacon);
1af586c9 2916 }
b8456a14 2917
dbf498fb 2918 if (ifmsh->sync_ops)
af296bdb 2919 ifmsh->sync_ops->adjust_tbtt(sdata, beacon);
dbf498fb 2920
3b69a9c5 2921 skb = dev_alloc_skb(local->tx_headroom +
af296bdb 2922 beacon->head_len +
3f52b7e3 2923 256 + /* TIM IE */
af296bdb 2924 beacon->tail_len +
70dabeb7 2925 local->hw.extra_beacon_tailroom);
902acc78
JB		 2926 if (!skb)
2927 goto out;
2b5e1967 2928 skb_reserve(skb, local->tx_headroom);
af296bdb
MK		 2929 memcpy(skb_put(skb, beacon->head_len), beacon->head,
2930 beacon->head_len);
6ec8c332
AO		 2931 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
2932
2933 if (offs) {
af296bdb
MK		 2934 offs->tim_offset = beacon->head_len;
2935 offs->tim_length = skb->len - beacon->head_len;
6ec8c332
AO		 2936 }
2937
af296bdb
MK		 2938 memcpy(skb_put(skb, beacon->tail_len), beacon->tail,
2939 beacon->tail_len);
9d139c81
JB		 2940 } else {
2941 WARN_ON(1);
5dfdaf58 2942 goto out;
e2ebc74d
JB		 2943 }
2944
1af586c9 2945 /* CSA offsets */
af296bdb 2946 if (offs && beacon) {
1af586c9
AO		 2947 int i;
2948
2949 for (i = 0; i < IEEE80211_MAX_CSA_COUNTERS_NUM; i++) {
af296bdb 2950 u16 csa_off = beacon->csa_counter_offsets[i];
1af586c9
AO		 2951
2952 if (!csa_off)
2953 continue;
2954
2955 offs->csa_counter_offs[i] = csa_off_base + csa_off;
2956 }
2957 }
2958
4bf88530 2959 band = chanctx_conf->def.chan->band;
55de908a 2960
e039fa4a
JB		 2961 info = IEEE80211_SKB_CB(skb);
2962
3b8d81e0 2963 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
e00cfce0 2964 info->flags |= IEEE80211_TX_CTL_NO_ACK;
e039fa4a 2965 info->band = band;
e00cfce0
JM		 2966
2967 memset(&txrc, 0, sizeof(txrc));
2968 txrc.hw = hw;
e31583cd 2969 txrc.sband = local->hw.wiphy->bands[band];
e00cfce0
JM		 2970 txrc.bss_conf = &sdata->vif.bss_conf;
2971 txrc.skb = skb;
2972 txrc.reported_rate.idx = -1;
37eb0b16 2973 txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
e31583cd 2974 if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1)
37eb0b16
JM		 2975 txrc.max_rate_idx = -1;
2976 else
2977 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
8f0729b1 2978 txrc.bss = true;
e00cfce0 2979 rate_control_get_rate(sdata, NULL, &txrc);
e039fa4a
JB		 2980
2981 info->control.vif = vif;
f591fa5d 2982
a472e71b
JL		 2983 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
2984 IEEE80211_TX_CTL_ASSIGN_SEQ |
2985 IEEE80211_TX_CTL_FIRST_FRAGMENT;
e6a9854b 2986 out:
5dfdaf58 2987 rcu_read_unlock();
e2ebc74d 2988 return skb;
6ec8c332
AO		 2989
2990}
2991
2992struct sk_buff *
2993ieee80211_beacon_get_template(struct ieee80211_hw *hw,
2994 struct ieee80211_vif *vif,
2995 struct ieee80211_mutable_offsets *offs)
2996{
2997 return __ieee80211_beacon_get(hw, vif, offs, true);
2998}
2999EXPORT_SYMBOL(ieee80211_beacon_get_template);
3000
3001struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
3002 struct ieee80211_vif *vif,
3003 u16 *tim_offset, u16 *tim_length)
3004{
3005 struct ieee80211_mutable_offsets offs = {};
3006 struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
3007
3008 if (tim_offset)
3009 *tim_offset = offs.tim_offset;
3010
3011 if (tim_length)
3012 *tim_length = offs.tim_length;
3013
3014 return bcn;
e2ebc74d 3015}
eddcbb94 3016EXPORT_SYMBOL(ieee80211_beacon_get_tim);
e2ebc74d 3017
02945821
AN		 3018struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
3019 struct ieee80211_vif *vif)
3020{
3021 struct ieee80211_if_ap *ap = NULL;
aa7a0080
ES		 3022 struct sk_buff *skb = NULL;
3023 struct probe_resp *presp = NULL;
02945821
AN		 3024 struct ieee80211_hdr *hdr;
3025 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
3026
3027 if (sdata->vif.type != NL80211_IFTYPE_AP)
3028 return NULL;
3029
3030 rcu_read_lock();
3031
3032 ap = &sdata->u.ap;
3033 presp = rcu_dereference(ap->probe_resp);
3034 if (!presp)
3035 goto out;
3036
aa7a0080 3037 skb = dev_alloc_skb(presp->len);
02945821
AN		 3038 if (!skb)
3039 goto out;
3040
aa7a0080
ES		 3041 memcpy(skb_put(skb, presp->len), presp->data, presp->len);
3042
02945821
AN		 3043 hdr = (struct ieee80211_hdr *) skb->data;
3044 memset(hdr->addr1, 0, sizeof(hdr->addr1));
3045
3046out:
3047 rcu_read_unlock();
3048 return skb;
3049}
3050EXPORT_SYMBOL(ieee80211_proberesp_get);
3051
7044cc56
KV		 3052struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
3053 struct ieee80211_vif *vif)
3054{
3055 struct ieee80211_sub_if_data *sdata;
3056 struct ieee80211_if_managed *ifmgd;
3057 struct ieee80211_pspoll *pspoll;
3058 struct ieee80211_local *local;
3059 struct sk_buff *skb;
3060
3061 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3062 return NULL;
3063
3064 sdata = vif_to_sdata(vif);
3065 ifmgd = &sdata->u.mgd;
3066 local = sdata->local;
3067
3068 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
d15b8459 3069 if (!skb)
7044cc56 3070 return NULL;
d15b8459 3071
7044cc56
KV		 3072 skb_reserve(skb, local->hw.extra_tx_headroom);
3073
3074 pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
3075 memset(pspoll, 0, sizeof(*pspoll));
3076 pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
3077 IEEE80211_STYPE_PSPOLL);
3078 pspoll->aid = cpu_to_le16(ifmgd->aid);
3079
3080 /* aid in PS-Poll has its two MSBs each set to 1 */
3081 pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
3082
3083 memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
3084 memcpy(pspoll->ta, vif->addr, ETH_ALEN);
3085
3086 return skb;
3087}
3088EXPORT_SYMBOL(ieee80211_pspoll_get);
3089
3090struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
3091 struct ieee80211_vif *vif)
3092{
3093 struct ieee80211_hdr_3addr *nullfunc;
3094 struct ieee80211_sub_if_data *sdata;
3095 struct ieee80211_if_managed *ifmgd;
3096 struct ieee80211_local *local;
3097 struct sk_buff *skb;
3098
3099 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
3100 return NULL;
3101
3102 sdata = vif_to_sdata(vif);
3103 ifmgd = &sdata->u.mgd;
3104 local = sdata->local;
3105
3106 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
d15b8459 3107 if (!skb)
7044cc56 3108 return NULL;
d15b8459 3109
7044cc56
KV		 3110 skb_reserve(skb, local->hw.extra_tx_headroom);
3111
3112 nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
3113 sizeof(*nullfunc));
3114 memset(nullfunc, 0, sizeof(*nullfunc));
3115 nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
3116 IEEE80211_STYPE_NULLFUNC |
3117 IEEE80211_FCTL_TODS);
3118 memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
3119 memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
3120 memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
3121
3122 return skb;
3123}
3124EXPORT_SYMBOL(ieee80211_nullfunc_get);
3125
05e54ea6 3126struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
a344d677 3127 const u8 *src_addr,
05e54ea6 3128 const u8 *ssid, size_t ssid_len,
b9a9ada1 3129 size_t tailroom)
05e54ea6 3130{
a344d677 3131 struct ieee80211_local *local = hw_to_local(hw);
05e54ea6
KV		 3132 struct ieee80211_hdr_3addr *hdr;
3133 struct sk_buff *skb;
3134 size_t ie_ssid_len;
3135 u8 *pos;
3136
05e54ea6
KV		 3137 ie_ssid_len = 2 + ssid_len;
3138
3139 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
b9a9ada1 3140 ie_ssid_len + tailroom);
d15b8459 3141 if (!skb)
05e54ea6 3142 return NULL;
05e54ea6
KV		 3143
3144 skb_reserve(skb, local->hw.extra_tx_headroom);
3145
3146 hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
3147 memset(hdr, 0, sizeof(*hdr));
3148 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3149 IEEE80211_STYPE_PROBE_REQ);
e83e6541 3150 eth_broadcast_addr(hdr->addr1);
a344d677 3151 memcpy(hdr->addr2, src_addr, ETH_ALEN);
e83e6541 3152 eth_broadcast_addr(hdr->addr3);
05e54ea6
KV		 3153
3154 pos = skb_put(skb, ie_ssid_len);
3155 *pos++ = WLAN_EID_SSID;
3156 *pos++ = ssid_len;
88c868c4 3157 if (ssid_len)
05e54ea6
KV		 3158 memcpy(pos, ssid, ssid_len);
3159 pos += ssid_len;
3160
05e54ea6
KV		 3161 return skb;
3162}
3163EXPORT_SYMBOL(ieee80211_probereq_get);
3164
32bfd35d 3165void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 3166 const void *frame, size_t frame_len,
e039fa4a 3167 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB		 3168 struct ieee80211_rts *rts)
3169{
3170 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 3171
065e9605
HH		 3172 rts->frame_control =
3173 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
32bfd35d
JB		 3174 rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
3175 frame_txctl);
e2ebc74d
JB		 3176 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
3177 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
3178}
3179EXPORT_SYMBOL(ieee80211_rts_get);
3180
32bfd35d 3181void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 3182 const void *frame, size_t frame_len,
e039fa4a 3183 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB		 3184 struct ieee80211_cts *cts)
3185{
3186 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 3187
065e9605
HH		 3188 cts->frame_control =
3189 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
32bfd35d
JB		 3190 cts->duration = ieee80211_ctstoself_duration(hw, vif,
3191 frame_len, frame_txctl);
e2ebc74d
JB		 3192 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
3193}
3194EXPORT_SYMBOL(ieee80211_ctstoself_get);
3195
3196struct sk_buff *
32bfd35d 3197ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
e039fa4a 3198 struct ieee80211_vif *vif)
e2ebc74d
JB		 3199{
3200 struct ieee80211_local *local = hw_to_local(hw);
747cf5e9 3201 struct sk_buff *skb = NULL;
5cf121c3 3202 struct ieee80211_tx_data tx;
e2ebc74d 3203 struct ieee80211_sub_if_data *sdata;
d012a605 3204 struct ps_data *ps;
e039fa4a 3205 struct ieee80211_tx_info *info;
55de908a 3206 struct ieee80211_chanctx_conf *chanctx_conf;
e2ebc74d 3207
32bfd35d 3208 sdata = vif_to_sdata(vif);
5dfdaf58 3209
5dfdaf58 3210 rcu_read_lock();
55de908a 3211 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
5dfdaf58 3212
d012a605
MP		 3213 if (!chanctx_conf)
3214 goto out;
3215
3216 if (sdata->vif.type == NL80211_IFTYPE_AP) {
3217 struct beacon_data *beacon =
3218 rcu_dereference(sdata->u.ap.beacon);
3219
3220 if (!beacon || !beacon->head)
3221 goto out;
3222
3223 ps = &sdata->u.ap.ps;
3f52b7e3
MP		 3224 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
3225 ps = &sdata->u.mesh.ps;
d012a605 3226 } else {
747cf5e9 3227 goto out;
d012a605 3228 }
5dfdaf58 3229
d012a605 3230 if (ps->dtim_count != 0 || !ps->dtim_bc_mc)
747cf5e9 3231 goto out; /* send buffered bc/mc only after DTIM beacon */
e039fa4a 3232
e2ebc74d 3233 while (1) {
d012a605 3234 skb = skb_dequeue(&ps->bc_buf);
e2ebc74d 3235 if (!skb)
747cf5e9 3236 goto out;
e2ebc74d
JB		 3237 local->total_ps_buffered--;
3238
d012a605 3239 if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) {
e2ebc74d
JB		 3240 struct ieee80211_hdr *hdr =
3241 (struct ieee80211_hdr *) skb->data;
3242 /* more buffered multicast/broadcast frames ==> set
3243 * MoreData flag in IEEE 802.11 header to inform PS
3244 * STAs */
3245 hdr->frame_control |=
3246 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
3247 }
3248
112c44b2 3249 if (sdata->vif.type == NL80211_IFTYPE_AP)
7cbf9d01 3250 sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
7c10770f 3251 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
e2ebc74d
JB		 3252 break;
3253 dev_kfree_skb_any(skb);
3254 }
e039fa4a
JB		 3255
3256 info = IEEE80211_SKB_CB(skb);
3257
5cf121c3 3258 tx.flags |= IEEE80211_TX_PS_BUFFERED;
4bf88530 3259 info->band = chanctx_conf->def.chan->band;
e2ebc74d 3260
97b045d6 3261 if (invoke_tx_handlers(&tx))
e2ebc74d 3262 skb = NULL;
97b045d6 3263 out:
d0709a65 3264 rcu_read_unlock();
e2ebc74d
JB		 3265
3266 return skb;
3267}
3268EXPORT_SYMBOL(ieee80211_get_buffered_bc);
3b8d81e0 3269
b6da911b
LK		 3270int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
3271{
3272 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
3273 struct ieee80211_sub_if_data *sdata = sta->sdata;
3274 struct ieee80211_local *local = sdata->local;
3275 int ret;
3276 u32 queues;
3277
3278 lockdep_assert_held(&local->sta_mtx);
3279
3280 /* only some cases are supported right now */
3281 switch (sdata->vif.type) {
3282 case NL80211_IFTYPE_STATION:
3283 case NL80211_IFTYPE_AP:
3284 case NL80211_IFTYPE_AP_VLAN:
3285 break;
3286 default:
3287 WARN_ON(1);
3288 return -EINVAL;
3289 }
3290
3291 if (WARN_ON(tid >= IEEE80211_NUM_UPS))
3292 return -EINVAL;
3293
3294 if (sta->reserved_tid == tid) {
3295 ret = 0;
3296 goto out;
3297 }
3298
3299 if (sta->reserved_tid != IEEE80211_TID_UNRESERVED) {
3300 sdata_err(sdata, "TID reservation already active\n");
3301 ret = -EALREADY;
3302 goto out;
3303 }
3304
3305 ieee80211_stop_vif_queues(sdata->local, sdata,
3306 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
3307
3308 synchronize_net();
3309
3310 /* Tear down BA sessions so we stop aggregating on this TID */
3311 if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) {
3312 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
3313 __ieee80211_stop_tx_ba_session(sta, tid,
3314 AGG_STOP_LOCAL_REQUEST);
3315 }
3316
3317 queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
3b24f4c6 3318 __ieee80211_flush_queues(local, sdata, queues, false);
b6da911b
LK		 3319
3320 sta->reserved_tid = tid;
3321
3322 ieee80211_wake_vif_queues(local, sdata,
3323 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
3324
3325 if (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)
3326 clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
3327
3328 ret = 0;
3329 out:
3330 return ret;
3331}
3332EXPORT_SYMBOL(ieee80211_reserve_tid);
3333
3334void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
3335{
3336 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
3337 struct ieee80211_sub_if_data *sdata = sta->sdata;
3338
3339 lockdep_assert_held(&sdata->local->sta_mtx);
3340
3341 /* only some cases are supported right now */
3342 switch (sdata->vif.type) {
3343 case NL80211_IFTYPE_STATION:
3344 case NL80211_IFTYPE_AP:
3345 case NL80211_IFTYPE_AP_VLAN:
3346 break;
3347 default:
3348 WARN_ON(1);
3349 return;
3350 }
3351
3352 if (tid != sta->reserved_tid) {
3353 sdata_err(sdata, "TID to unreserve (%d) isn't reserved\n", tid);
3354 return;
3355 }
3356
3357 sta->reserved_tid = IEEE80211_TID_UNRESERVED;
3358}
3359EXPORT_SYMBOL(ieee80211_unreserve_tid);
3360
55de908a
JB		 3361void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
3362 struct sk_buff *skb, int tid,
3363 enum ieee80211_band band)
3b8d81e0 3364{
353d09c6 3365 int ac = ieee802_1d_to_ac[tid & 7];
3a25a8c8 3366
3b8d81e0
JB		 3367 skb_set_mac_header(skb, 0);
3368 skb_set_network_header(skb, 0);
3369 skb_set_transport_header(skb, 0);
3370
3a25a8c8 3371 skb_set_queue_mapping(skb, ac);
cf6bb79a 3372 skb->priority = tid;
cf0277e7 3373
89afe614
JB		 3374 skb->dev = sdata->dev;
3375
3d34deb6
JB		 3376 /*
3377 * The other path calling ieee80211_xmit is from the tasklet,
3378 * and while we can handle concurrent transmissions locking
3379 * requirements are that we do not come into tx with bhs on.
3380 */
3381 local_bh_disable();
73c4e195 3382 IEEE80211_SKB_CB(skb)->band = band;
7c10770f 3383 ieee80211_xmit(sdata, NULL, skb);
3d34deb6 3384 local_bh_enable();
3b8d81e0 3385}
Linux 6.x block layer and io_uring tree(s)