mac80211: sequence number micro-optimisation
[linux-2.6-block.git] / net / mac80211 / tx.c
CommitLineData
e2ebc74d
JB
1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 *
12 * Transmit and frame generation functions.
13 */
14
15#include <linux/kernel.h>
16#include <linux/slab.h>
17#include <linux/skbuff.h>
18#include <linux/etherdevice.h>
19#include <linux/bitmap.h>
d4e46a3d 20#include <linux/rcupdate.h>
881d966b 21#include <net/net_namespace.h>
e2ebc74d
JB
22#include <net/ieee80211_radiotap.h>
23#include <net/cfg80211.h>
24#include <net/mac80211.h>
25#include <asm/unaligned.h>
26
27#include "ieee80211_i.h"
24487981 28#include "driver-ops.h"
2c8dccc7 29#include "led.h"
33b64eb2 30#include "mesh.h"
e2ebc74d
JB
31#include "wep.h"
32#include "wpa.h"
33#include "wme.h"
2c8dccc7 34#include "rate.h"
e2ebc74d
JB
35
36#define IEEE80211_TX_OK 0
37#define IEEE80211_TX_AGAIN 1
2de8e0d9 38#define IEEE80211_TX_PENDING 2
e2ebc74d
JB
39
40/* misc utils */
41
03f93c3d
JB
42static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr,
43 int next_frag_len)
e2ebc74d
JB
44{
45 int rate, mrate, erp, dur, i;
2e92e6f2 46 struct ieee80211_rate *txrate;
e2ebc74d 47 struct ieee80211_local *local = tx->local;
8318d78a 48 struct ieee80211_supported_band *sband;
358c8d9d 49 struct ieee80211_hdr *hdr;
e6a9854b
JB
50 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
51
52 /* assume HW handles this */
53 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
54 return 0;
55
56 /* uh huh? */
57 if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
58 return 0;
e2ebc74d 59
2e92e6f2 60 sband = local->hw.wiphy->bands[tx->channel->band];
e6a9854b 61 txrate = &sband->bitrates[info->control.rates[0].idx];
8318d78a 62
e6a9854b 63 erp = txrate->flags & IEEE80211_RATE_ERP_G;
e2ebc74d
JB
64
65 /*
66 * data and mgmt (except PS Poll):
67 * - during CFP: 32768
68 * - during contention period:
69 * if addr1 is group address: 0
70 * if more fragments = 0 and addr1 is individual address: time to
71 * transmit one ACK plus SIFS
72 * if more fragments = 1 and addr1 is individual address: time to
73 * transmit next fragment plus 2 x ACK plus 3 x SIFS
74 *
75 * IEEE 802.11, 9.6:
76 * - control response frame (CTS or ACK) shall be transmitted using the
77 * same rate as the immediately previous frame in the frame exchange
78 * sequence, if this rate belongs to the PHY mandatory rates, or else
79 * at the highest possible rate belonging to the PHY rates in the
80 * BSSBasicRateSet
81 */
358c8d9d
HH
82 hdr = (struct ieee80211_hdr *)tx->skb->data;
83 if (ieee80211_is_ctl(hdr->frame_control)) {
e2ebc74d 84 /* TODO: These control frames are not currently sent by
ccd7b362 85 * mac80211, but should they be implemented, this function
e2ebc74d
JB
86 * needs to be updated to support duration field calculation.
87 *
88 * RTS: time needed to transmit pending data/mgmt frame plus
89 * one CTS frame plus one ACK frame plus 3 x SIFS
90 * CTS: duration of immediately previous RTS minus time
91 * required to transmit CTS and its SIFS
92 * ACK: 0 if immediately previous directed data/mgmt had
93 * more=0, with more=1 duration in ACK frame is duration
94 * from previous frame minus time needed to transmit ACK
95 * and its SIFS
96 * PS Poll: BIT(15) | BIT(14) | aid
97 */
98 return 0;
99 }
100
101 /* data/mgmt */
102 if (0 /* FIX: data/mgmt during CFP */)
03f93c3d 103 return cpu_to_le16(32768);
e2ebc74d
JB
104
105 if (group_addr) /* Group address as the destination - no ACK */
106 return 0;
107
108 /* Individual destination address:
109 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
110 * CTS and ACK frames shall be transmitted using the highest rate in
111 * basic rate set that is less than or equal to the rate of the
112 * immediately previous frame and that is using the same modulation
113 * (CCK or OFDM). If no basic rate set matches with these requirements,
114 * the highest mandatory rate of the PHY that is less than or equal to
115 * the rate of the previous frame is used.
116 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
117 */
118 rate = -1;
8318d78a
JB
119 /* use lowest available if everything fails */
120 mrate = sband->bitrates[0].bitrate;
121 for (i = 0; i < sband->n_bitrates; i++) {
122 struct ieee80211_rate *r = &sband->bitrates[i];
e2ebc74d 123
8318d78a
JB
124 if (r->bitrate > txrate->bitrate)
125 break;
e2ebc74d 126
bda3933a 127 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
8318d78a
JB
128 rate = r->bitrate;
129
130 switch (sband->band) {
131 case IEEE80211_BAND_2GHZ: {
132 u32 flag;
133 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
134 flag = IEEE80211_RATE_MANDATORY_G;
135 else
136 flag = IEEE80211_RATE_MANDATORY_B;
137 if (r->flags & flag)
138 mrate = r->bitrate;
139 break;
140 }
141 case IEEE80211_BAND_5GHZ:
142 if (r->flags & IEEE80211_RATE_MANDATORY_A)
143 mrate = r->bitrate;
144 break;
145 case IEEE80211_NUM_BANDS:
146 WARN_ON(1);
147 break;
148 }
e2ebc74d
JB
149 }
150 if (rate == -1) {
151 /* No matching basic rate found; use highest suitable mandatory
152 * PHY rate */
153 rate = mrate;
154 }
155
156 /* Time needed to transmit ACK
157 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
158 * to closest integer */
159
160 dur = ieee80211_frame_duration(local, 10, rate, erp,
bda3933a 161 tx->sdata->vif.bss_conf.use_short_preamble);
e2ebc74d
JB
162
163 if (next_frag_len) {
164 /* Frame is fragmented: duration increases with time needed to
165 * transmit next fragment plus ACK and 2 x SIFS. */
166 dur *= 2; /* ACK + SIFS */
167 /* next fragment */
168 dur += ieee80211_frame_duration(local, next_frag_len,
8318d78a 169 txrate->bitrate, erp,
bda3933a 170 tx->sdata->vif.bss_conf.use_short_preamble);
e2ebc74d
JB
171 }
172
03f93c3d 173 return cpu_to_le16(dur);
e2ebc74d
JB
174}
175
133b8226
JB
176static int inline is_ieee80211_device(struct ieee80211_local *local,
177 struct net_device *dev)
e2ebc74d 178{
133b8226 179 return local == wdev_priv(dev->ieee80211_ptr);
e2ebc74d
JB
180}
181
182/* tx handlers */
183
d9e8a70f 184static ieee80211_tx_result debug_noinline
5cf121c3 185ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
e2ebc74d 186{
358c8d9d 187
e039fa4a 188 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
e039fa4a 189 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
e2ebc74d
JB
190 u32 sta_flags;
191
e039fa4a 192 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
9ae54c84 193 return TX_CONTINUE;
58d4185e 194
142b9f50 195 if (unlikely(test_bit(SCAN_OFF_CHANNEL, &tx->local->scanning)) &&
a9a6ffff
KV
196 !ieee80211_is_probe_req(hdr->frame_control) &&
197 !ieee80211_is_nullfunc(hdr->frame_control))
198 /*
199 * When software scanning only nullfunc frames (to notify
200 * the sleep state to the AP) and probe requests (for the
201 * active scan) are allowed, all other frames should not be
202 * sent and we should not get here, but if we do
203 * nonetheless, drop them to avoid sending them
204 * off-channel. See the link below and
205 * ieee80211_start_scan() for more.
206 *
207 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
208 */
9ae54c84 209 return TX_DROP;
e2ebc74d 210
05c914fe 211 if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
33b64eb2
LCC
212 return TX_CONTINUE;
213
5cf121c3 214 if (tx->flags & IEEE80211_TX_PS_BUFFERED)
9ae54c84 215 return TX_CONTINUE;
e2ebc74d 216
07346f81 217 sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
e2ebc74d 218
5cf121c3 219 if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
e2ebc74d 220 if (unlikely(!(sta_flags & WLAN_STA_ASSOC) &&
05c914fe 221 tx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
358c8d9d 222 ieee80211_is_data(hdr->frame_control))) {
e2ebc74d
JB
223#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
224 printk(KERN_DEBUG "%s: dropped data frame to not "
0c68ae26
JB
225 "associated station %pM\n",
226 tx->dev->name, hdr->addr1);
e2ebc74d
JB
227#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
228 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
9ae54c84 229 return TX_DROP;
e2ebc74d
JB
230 }
231 } else {
358c8d9d 232 if (unlikely(ieee80211_is_data(hdr->frame_control) &&
e2ebc74d 233 tx->local->num_sta == 0 &&
05c914fe 234 tx->sdata->vif.type != NL80211_IFTYPE_ADHOC)) {
e2ebc74d
JB
235 /*
236 * No associated STAs - no need to send multicast
237 * frames.
238 */
9ae54c84 239 return TX_DROP;
e2ebc74d 240 }
9ae54c84 241 return TX_CONTINUE;
e2ebc74d
JB
242 }
243
9ae54c84 244 return TX_CONTINUE;
e2ebc74d
JB
245}
246
e2ebc74d
JB
247/* This function is called whenever the AP is about to exceed the maximum limit
248 * of buffered frames for power saving STAs. This situation should not really
249 * happen often during normal operation, so dropping the oldest buffered packet
250 * from each queue should be OK to make some room for new frames. */
251static void purge_old_ps_buffers(struct ieee80211_local *local)
252{
253 int total = 0, purged = 0;
254 struct sk_buff *skb;
255 struct ieee80211_sub_if_data *sdata;
256 struct sta_info *sta;
257
79010420
JB
258 /*
259 * virtual interfaces are protected by RCU
260 */
261 rcu_read_lock();
262
263 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
e2ebc74d 264 struct ieee80211_if_ap *ap;
05c914fe 265 if (sdata->vif.type != NL80211_IFTYPE_AP)
e2ebc74d
JB
266 continue;
267 ap = &sdata->u.ap;
268 skb = skb_dequeue(&ap->ps_bc_buf);
269 if (skb) {
270 purged++;
271 dev_kfree_skb(skb);
272 }
273 total += skb_queue_len(&ap->ps_bc_buf);
274 }
e2ebc74d 275
d0709a65 276 list_for_each_entry_rcu(sta, &local->sta_list, list) {
e2ebc74d
JB
277 skb = skb_dequeue(&sta->ps_tx_buf);
278 if (skb) {
279 purged++;
280 dev_kfree_skb(skb);
281 }
282 total += skb_queue_len(&sta->ps_tx_buf);
283 }
d0709a65
JB
284
285 rcu_read_unlock();
e2ebc74d
JB
286
287 local->total_ps_buffered = total;
54223995 288#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
e2ebc74d 289 printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n",
dd1cd4c6 290 wiphy_name(local->hw.wiphy), purged);
f4ea83dd 291#endif
e2ebc74d
JB
292}
293
9ae54c84 294static ieee80211_tx_result
5cf121c3 295ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 296{
e039fa4a 297 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 298 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
e039fa4a 299
7d54d0dd
JB
300 /*
301 * broadcast/multicast frame
302 *
303 * If any of the associated stations is in power save mode,
304 * the frame is buffered to be sent after DTIM beacon frame.
305 * This is done either by the hardware or us.
306 */
307
3e122be0
JB
308 /* powersaving STAs only in AP/VLAN mode */
309 if (!tx->sdata->bss)
310 return TX_CONTINUE;
311
312 /* no buffering for ordered frames */
358c8d9d 313 if (ieee80211_has_order(hdr->frame_control))
9ae54c84 314 return TX_CONTINUE;
7d54d0dd
JB
315
316 /* no stations in PS mode */
317 if (!atomic_read(&tx->sdata->bss->num_sta_ps))
9ae54c84 318 return TX_CONTINUE;
7d54d0dd
JB
319
320 /* buffered in mac80211 */
321 if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) {
e2ebc74d
JB
322 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
323 purge_old_ps_buffers(tx->local);
324 if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >=
325 AP_MAX_BC_BUFFER) {
54223995 326#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
e2ebc74d
JB
327 if (net_ratelimit()) {
328 printk(KERN_DEBUG "%s: BC TX buffer full - "
329 "dropping the oldest frame\n",
330 tx->dev->name);
331 }
f4ea83dd 332#endif
e2ebc74d
JB
333 dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
334 } else
335 tx->local->total_ps_buffered++;
336 skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
9ae54c84 337 return TX_QUEUED;
e2ebc74d
JB
338 }
339
7d54d0dd 340 /* buffered in hardware */
e039fa4a 341 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
7d54d0dd 342
9ae54c84 343 return TX_CONTINUE;
e2ebc74d
JB
344}
345
fb733336
JM
346static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
347 struct sk_buff *skb)
348{
349 if (!ieee80211_is_mgmt(fc))
350 return 0;
351
352 if (sta == NULL || !test_sta_flags(sta, WLAN_STA_MFP))
353 return 0;
354
355 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
356 skb->data))
357 return 0;
358
359 return 1;
360}
361
9ae54c84 362static ieee80211_tx_result
5cf121c3 363ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d
JB
364{
365 struct sta_info *sta = tx->sta;
e039fa4a 366 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 367 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
07346f81 368 u32 staflags;
e2ebc74d 369
358c8d9d 370 if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control)))
9ae54c84 371 return TX_CONTINUE;
e2ebc74d 372
07346f81
JB
373 staflags = get_sta_flags(sta);
374
375 if (unlikely((staflags & WLAN_STA_PS) &&
3fa52056 376 !(info->flags & IEEE80211_TX_CTL_PSPOLL_RESPONSE))) {
e2ebc74d 377#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
0c68ae26 378 printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries "
e2ebc74d 379 "before %d)\n",
0c68ae26 380 sta->sta.addr, sta->sta.aid,
e2ebc74d
JB
381 skb_queue_len(&sta->ps_tx_buf));
382#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
e2ebc74d
JB
383 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
384 purge_old_ps_buffers(tx->local);
385 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) {
386 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf);
54223995 387#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
e2ebc74d 388 if (net_ratelimit()) {
0c68ae26 389 printk(KERN_DEBUG "%s: STA %pM TX "
e2ebc74d 390 "buffer full - dropping oldest frame\n",
0c68ae26 391 tx->dev->name, sta->sta.addr);
e2ebc74d 392 }
f4ea83dd 393#endif
e2ebc74d
JB
394 dev_kfree_skb(old);
395 } else
396 tx->local->total_ps_buffered++;
004c872e 397
e2ebc74d 398 /* Queue frame to be sent after STA sends an PS Poll frame */
004c872e
JB
399 if (skb_queue_empty(&sta->ps_tx_buf))
400 sta_info_set_tim_bit(sta);
401
e039fa4a 402 info->control.jiffies = jiffies;
5061b0c2 403 info->control.vif = &tx->sdata->vif;
8f77f384 404 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
e2ebc74d 405 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
9ae54c84 406 return TX_QUEUED;
e2ebc74d
JB
407 }
408#ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
07346f81 409 else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) {
0c68ae26 410 printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
e2ebc74d 411 "set -> send frame\n", tx->dev->name,
0c68ae26 412 sta->sta.addr);
e2ebc74d
JB
413 }
414#endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
e2ebc74d 415
9ae54c84 416 return TX_CONTINUE;
e2ebc74d
JB
417}
418
d9e8a70f 419static ieee80211_tx_result debug_noinline
5cf121c3 420ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
e2ebc74d 421{
5cf121c3 422 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
9ae54c84 423 return TX_CONTINUE;
e2ebc74d 424
5cf121c3 425 if (tx->flags & IEEE80211_TX_UNICAST)
e2ebc74d
JB
426 return ieee80211_tx_h_unicast_ps_buf(tx);
427 else
428 return ieee80211_tx_h_multicast_ps_buf(tx);
429}
430
d9e8a70f 431static ieee80211_tx_result debug_noinline
5cf121c3 432ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
e2ebc74d 433{
d3feaf5a 434 struct ieee80211_key *key = NULL;
e039fa4a 435 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
358c8d9d 436 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
d4e46a3d 437
3b8d81e0 438 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
e2ebc74d 439 tx->key = NULL;
d4e46a3d
JB
440 else if (tx->sta && (key = rcu_dereference(tx->sta->key)))
441 tx->key = key;
3cfcf6ac
JM
442 else if (ieee80211_is_mgmt(hdr->frame_control) &&
443 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
444 tx->key = key;
d4e46a3d
JB
445 else if ((key = rcu_dereference(tx->sdata->default_key)))
446 tx->key = key;
e2ebc74d 447 else if (tx->sdata->drop_unencrypted &&
d0f09804 448 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) &&
e0463f50
JM
449 !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
450 (!ieee80211_is_robust_mgmt_frame(hdr) ||
451 (ieee80211_is_action(hdr->frame_control) &&
452 tx->sta && test_sta_flags(tx->sta, WLAN_STA_MFP)))) {
e2ebc74d 453 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
9ae54c84 454 return TX_DROP;
176e4f84 455 } else
e2ebc74d
JB
456 tx->key = NULL;
457
458 if (tx->key) {
459 tx->key->tx_rx_count++;
011bfcc4 460 /* TODO: add threshold stuff again */
176e4f84
JB
461
462 switch (tx->key->conf.alg) {
463 case ALG_WEP:
358c8d9d 464 if (ieee80211_is_auth(hdr->frame_control))
176e4f84
JB
465 break;
466 case ALG_TKIP:
358c8d9d 467 if (!ieee80211_is_data_present(hdr->frame_control))
176e4f84
JB
468 tx->key = NULL;
469 break;
fb733336
JM
470 case ALG_CCMP:
471 if (!ieee80211_is_data_present(hdr->frame_control) &&
472 !ieee80211_use_mfp(hdr->frame_control, tx->sta,
473 tx->skb))
474 tx->key = NULL;
475 break;
3cfcf6ac
JM
476 case ALG_AES_CMAC:
477 if (!ieee80211_is_mgmt(hdr->frame_control))
478 tx->key = NULL;
479 break;
176e4f84 480 }
e2ebc74d
JB
481 }
482
176e4f84 483 if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
3b8d81e0 484 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
176e4f84 485
9ae54c84 486 return TX_CONTINUE;
e2ebc74d
JB
487}
488
d9e8a70f 489static ieee80211_tx_result debug_noinline
5cf121c3 490ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
e2ebc74d 491{
e039fa4a 492 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
e6a9854b
JB
493 struct ieee80211_hdr *hdr = (void *)tx->skb->data;
494 struct ieee80211_supported_band *sband;
495 struct ieee80211_rate *rate;
496 int i, len;
497 bool inval = false, rts = false, short_preamble = false;
498 struct ieee80211_tx_rate_control txrc;
b770b43e 499 u32 sta_flags;
8318d78a 500
e6a9854b 501 memset(&txrc, 0, sizeof(txrc));
e2ebc74d 502
e6a9854b 503 sband = tx->local->hw.wiphy->bands[tx->channel->band];
58d4185e 504
e6a9854b 505 len = min_t(int, tx->skb->len + FCS_LEN,
b9a5f8ca 506 tx->local->hw.wiphy->frag_threshold);
e6a9854b
JB
507
508 /* set up the tx rate control struct we give the RC algo */
509 txrc.hw = local_to_hw(tx->local);
510 txrc.sband = sband;
511 txrc.bss_conf = &tx->sdata->vif.bss_conf;
512 txrc.skb = tx->skb;
513 txrc.reported_rate.idx = -1;
514 txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
515
516 /* set up RTS protection if desired */
b9a5f8ca 517 if (len > tx->local->hw.wiphy->rts_threshold) {
e6a9854b 518 txrc.rts = rts = true;
e2ebc74d 519 }
e2ebc74d 520
e6a9854b
JB
521 /*
522 * Use short preamble if the BSS can handle it, but not for
523 * management frames unless we know the receiver can handle
524 * that -- the management frame might be to a station that
525 * just wants a probe response.
526 */
527 if (tx->sdata->vif.bss_conf.use_short_preamble &&
528 (ieee80211_is_data(hdr->frame_control) ||
529 (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
530 txrc.short_preamble = short_preamble = true;
e2ebc74d 531
b770b43e
LR
532 sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0;
533
534 /*
535 * Lets not bother rate control if we're associated and cannot
536 * talk to the sta. This should not happen.
537 */
fbe9c429 538 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) &&
b770b43e
LR
539 (sta_flags & WLAN_STA_ASSOC) &&
540 !rate_usable_index_exists(sband, &tx->sta->sta),
541 "%s: Dropped data frame as no usable bitrate found while "
542 "scanning and associated. Target station: "
543 "%pM on %d GHz band\n",
544 tx->dev->name, hdr->addr1,
545 tx->channel->band ? 5 : 2))
546 return TX_DROP;
2e92e6f2 547
b770b43e
LR
548 /*
549 * If we're associated with the sta at this point we know we can at
550 * least send the frame at the lowest bit rate.
551 */
e6a9854b
JB
552 rate_control_get_rate(tx->sdata, tx->sta, &txrc);
553
554 if (unlikely(info->control.rates[0].idx < 0))
555 return TX_DROP;
556
557 if (txrc.reported_rate.idx < 0)
558 txrc.reported_rate = info->control.rates[0];
e2ebc74d 559
e039fa4a 560 if (tx->sta)
e6a9854b 561 tx->sta->last_tx_rate = txrc.reported_rate;
e039fa4a 562
e6a9854b
JB
563 if (unlikely(!info->control.rates[0].count))
564 info->control.rates[0].count = 1;
e2ebc74d 565
9955151d
GS
566 if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
567 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
568 info->control.rates[0].count = 1;
569
e6a9854b
JB
570 if (is_multicast_ether_addr(hdr->addr1)) {
571 /*
572 * XXX: verify the rate is in the basic rateset
573 */
574 return TX_CONTINUE;
e2ebc74d
JB
575 }
576
e6a9854b
JB
577 /*
578 * set up the RTS/CTS rate as the fastest basic rate
579 * that is not faster than the data rate
580 *
581 * XXX: Should this check all retry rates?
582 */
583 if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
584 s8 baserate = 0;
585
586 rate = &sband->bitrates[info->control.rates[0].idx];
587
588 for (i = 0; i < sband->n_bitrates; i++) {
589 /* must be a basic rate */
590 if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
591 continue;
592 /* must not be faster than the data rate */
593 if (sband->bitrates[i].bitrate > rate->bitrate)
594 continue;
595 /* maximum */
596 if (sband->bitrates[baserate].bitrate <
597 sband->bitrates[i].bitrate)
598 baserate = i;
599 }
600
601 info->control.rts_cts_rate_idx = baserate;
7e9ed188
DD
602 }
603
e6a9854b
JB
604 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
605 /*
606 * make sure there's no valid rate following
607 * an invalid one, just in case drivers don't
608 * take the API seriously to stop at -1.
609 */
610 if (inval) {
611 info->control.rates[i].idx = -1;
612 continue;
613 }
614 if (info->control.rates[i].idx < 0) {
615 inval = true;
616 continue;
617 }
8318d78a 618
e6a9854b
JB
619 /*
620 * For now assume MCS is already set up correctly, this
621 * needs to be fixed.
622 */
623 if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
624 WARN_ON(info->control.rates[i].idx > 76);
625 continue;
626 }
e2ebc74d 627
e6a9854b
JB
628 /* set up RTS protection if desired */
629 if (rts)
630 info->control.rates[i].flags |=
631 IEEE80211_TX_RC_USE_RTS_CTS;
8318d78a 632
e6a9854b 633 /* RC is busted */
075cbc9e
S
634 if (WARN_ON_ONCE(info->control.rates[i].idx >=
635 sband->n_bitrates)) {
e6a9854b
JB
636 info->control.rates[i].idx = -1;
637 continue;
8318d78a 638 }
e2ebc74d 639
e6a9854b
JB
640 rate = &sband->bitrates[info->control.rates[i].idx];
641
642 /* set up short preamble */
643 if (short_preamble &&
644 rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
645 info->control.rates[i].flags |=
646 IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
647
648 /* set up G protection */
649 if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
650 rate->flags & IEEE80211_RATE_ERP_G)
651 info->control.rates[i].flags |=
652 IEEE80211_TX_RC_USE_CTS_PROTECT;
e2ebc74d
JB
653 }
654
e6a9854b
JB
655 return TX_CONTINUE;
656}
657
658static ieee80211_tx_result debug_noinline
659ieee80211_tx_h_misc(struct ieee80211_tx_data *tx)
660{
661 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
662
e2454948 663 if (tx->sta)
17741cdc 664 info->control.sta = &tx->sta->sta;
e2454948
JB
665
666 return TX_CONTINUE;
667}
668
f591fa5d
JB
669static ieee80211_tx_result debug_noinline
670ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
671{
672 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
673 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
674 u16 *seq;
675 u8 *qc;
676 int tid;
677
25d834e1
JB
678 /*
679 * Packet injection may want to control the sequence
680 * number, if we have no matching interface then we
681 * neither assign one ourselves nor ask the driver to.
682 */
5061b0c2 683 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
25d834e1
JB
684 return TX_CONTINUE;
685
f591fa5d
JB
686 if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
687 return TX_CONTINUE;
688
689 if (ieee80211_hdrlen(hdr->frame_control) < 24)
690 return TX_CONTINUE;
691
94778280
JB
692 /*
693 * Anything but QoS data that has a sequence number field
694 * (is long enough) gets a sequence number from the global
695 * counter.
696 */
f591fa5d 697 if (!ieee80211_is_data_qos(hdr->frame_control)) {
94778280 698 /* driver should assign sequence number */
f591fa5d 699 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
94778280
JB
700 /* for pure STA mode without beacons, we can do it */
701 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
702 tx->sdata->sequence_number += 0x10;
f591fa5d
JB
703 return TX_CONTINUE;
704 }
705
706 /*
707 * This should be true for injected/management frames only, for
708 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
709 * above since they are not QoS-data frames.
710 */
711 if (!tx->sta)
712 return TX_CONTINUE;
713
714 /* include per-STA, per-TID sequence counter */
715
716 qc = ieee80211_get_qos_ctl(hdr);
717 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
718 seq = &tx->sta->tid_seq[tid];
719
720 hdr->seq_ctrl = cpu_to_le16(*seq);
721
722 /* Increase the sequence number. */
723 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
724
725 return TX_CONTINUE;
726}
727
2de8e0d9
JB
728static int ieee80211_fragment(struct ieee80211_local *local,
729 struct sk_buff *skb, int hdrlen,
730 int frag_threshold)
731{
732 struct sk_buff *tail = skb, *tmp;
733 int per_fragm = frag_threshold - hdrlen - FCS_LEN;
734 int pos = hdrlen + per_fragm;
735 int rem = skb->len - hdrlen - per_fragm;
736
737 if (WARN_ON(rem < 0))
738 return -EINVAL;
739
740 while (rem) {
741 int fraglen = per_fragm;
742
743 if (fraglen > rem)
744 fraglen = rem;
745 rem -= fraglen;
746 tmp = dev_alloc_skb(local->tx_headroom +
747 frag_threshold +
748 IEEE80211_ENCRYPT_HEADROOM +
749 IEEE80211_ENCRYPT_TAILROOM);
750 if (!tmp)
751 return -ENOMEM;
752 tail->next = tmp;
753 tail = tmp;
754 skb_reserve(tmp, local->tx_headroom +
755 IEEE80211_ENCRYPT_HEADROOM);
756 /* copy control information */
757 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
758 skb_copy_queue_mapping(tmp, skb);
759 tmp->priority = skb->priority;
2de8e0d9 760 tmp->dev = skb->dev;
2de8e0d9
JB
761
762 /* copy header and data */
763 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
764 memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);
765
766 pos += fraglen;
767 }
768
769 skb->len = hdrlen + per_fragm;
770 return 0;
771}
772
d9e8a70f 773static ieee80211_tx_result debug_noinline
e2454948
JB
774ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
775{
2de8e0d9
JB
776 struct sk_buff *skb = tx->skb;
777 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
778 struct ieee80211_hdr *hdr = (void *)skb->data;
b9a5f8ca 779 int frag_threshold = tx->local->hw.wiphy->frag_threshold;
2de8e0d9
JB
780 int hdrlen;
781 int fragnum;
e2454948
JB
782
783 if (!(tx->flags & IEEE80211_TX_FRAGMENTED))
784 return TX_CONTINUE;
785
eefce91a
JB
786 /*
787 * Warn when submitting a fragmented A-MPDU frame and drop it.
3b8d81e0 788 * This scenario is handled in ieee80211_tx_prepare but extra
8d5e0d58 789 * caution taken here as fragmented ampdu may cause Tx stop.
eefce91a 790 */
8b30b1fe 791 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
eefce91a
JB
792 return TX_DROP;
793
065e9605 794 hdrlen = ieee80211_hdrlen(hdr->frame_control);
e2454948 795
2de8e0d9 796 /* internal error, why is TX_FRAGMENTED set? */
8ccd8f21 797 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
2de8e0d9 798 return TX_DROP;
e6a9854b 799
2de8e0d9
JB
800 /*
801 * Now fragment the frame. This will allocate all the fragments and
802 * chain them (using skb as the first fragment) to skb->next.
803 * During transmission, we will remove the successfully transmitted
804 * fragments from this list. When the low-level driver rejects one
805 * of the fragments then we will simply pretend to accept the skb
806 * but store it away as pending.
807 */
808 if (ieee80211_fragment(tx->local, skb, hdrlen, frag_threshold))
809 return TX_DROP;
e6a9854b 810
2de8e0d9
JB
811 /* update duration/seq/flags of fragments */
812 fragnum = 0;
813 do {
814 int next_len;
815 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
e6a9854b 816
2de8e0d9
JB
817 hdr = (void *)skb->data;
818 info = IEEE80211_SKB_CB(skb);
e6a9854b 819
2de8e0d9
JB
820 if (skb->next) {
821 hdr->frame_control |= morefrags;
822 next_len = skb->next->len;
e6a9854b
JB
823 /*
824 * No multi-rate retries for fragmented frames, that
825 * would completely throw off the NAV at other STAs.
826 */
827 info->control.rates[1].idx = -1;
828 info->control.rates[2].idx = -1;
829 info->control.rates[3].idx = -1;
830 info->control.rates[4].idx = -1;
831 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
832 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
2de8e0d9
JB
833 } else {
834 hdr->frame_control &= ~morefrags;
835 next_len = 0;
e6a9854b 836 }
2de8e0d9
JB
837 hdr->duration_id = ieee80211_duration(tx, 0, next_len);
838 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
839 fragnum++;
840 } while ((skb = skb->next));
e2ebc74d 841
9ae54c84 842 return TX_CONTINUE;
e2ebc74d
JB
843}
844
feff1f2f
JB
845static ieee80211_tx_result debug_noinline
846ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
847{
848 struct sk_buff *skb = tx->skb;
849
850 if (!tx->sta)
851 return TX_CONTINUE;
852
853 tx->sta->tx_packets++;
854 do {
855 tx->sta->tx_fragments++;
856 tx->sta->tx_bytes += skb->len;
857 } while ((skb = skb->next));
858
859 return TX_CONTINUE;
860}
861
d9e8a70f 862static ieee80211_tx_result debug_noinline
e2454948
JB
863ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
864{
865 if (!tx->key)
866 return TX_CONTINUE;
867
868 switch (tx->key->conf.alg) {
869 case ALG_WEP:
870 return ieee80211_crypto_wep_encrypt(tx);
871 case ALG_TKIP:
872 return ieee80211_crypto_tkip_encrypt(tx);
873 case ALG_CCMP:
874 return ieee80211_crypto_ccmp_encrypt(tx);
3cfcf6ac
JM
875 case ALG_AES_CMAC:
876 return ieee80211_crypto_aes_cmac_encrypt(tx);
e2454948
JB
877 }
878
879 /* not reached */
880 WARN_ON(1);
881 return TX_DROP;
882}
883
d9e8a70f 884static ieee80211_tx_result debug_noinline
03f93c3d
JB
885ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
886{
2de8e0d9
JB
887 struct sk_buff *skb = tx->skb;
888 struct ieee80211_hdr *hdr;
889 int next_len;
890 bool group_addr;
03f93c3d 891
2de8e0d9
JB
892 do {
893 hdr = (void *) skb->data;
7e0aae47
JM
894 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
895 break; /* must not overwrite AID */
2de8e0d9
JB
896 next_len = skb->next ? skb->next->len : 0;
897 group_addr = is_multicast_ether_addr(hdr->addr1);
03f93c3d 898
2de8e0d9
JB
899 hdr->duration_id =
900 ieee80211_duration(tx, group_addr, next_len);
901 } while ((skb = skb->next));
03f93c3d
JB
902
903 return TX_CONTINUE;
904}
905
e2ebc74d
JB
906/* actual transmit path */
907
908/*
909 * deal with packet injection down monitor interface
910 * with Radiotap Header -- only called for monitor mode interface
911 */
27004b10
JB
912static bool __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx,
913 struct sk_buff *skb)
e2ebc74d
JB
914{
915 /*
916 * this is the moment to interpret and discard the radiotap header that
917 * must be at the start of the packet injected in Monitor mode
918 *
919 * Need to take some care with endian-ness since radiotap
920 * args are little-endian
921 */
922
923 struct ieee80211_radiotap_iterator iterator;
924 struct ieee80211_radiotap_header *rthdr =
925 (struct ieee80211_radiotap_header *) skb->data;
8318d78a 926 struct ieee80211_supported_band *sband;
3b8d81e0 927 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
e2ebc74d
JB
928 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len);
929
2e92e6f2 930 sband = tx->local->hw.wiphy->bands[tx->channel->band];
8318d78a 931
3b8d81e0 932 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
5cf121c3 933 tx->flags &= ~IEEE80211_TX_FRAGMENTED;
e2ebc74d
JB
934
935 /*
936 * for every radiotap entry that is present
937 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
938 * entries present, or -EINVAL on error)
939 */
940
941 while (!ret) {
e2ebc74d
JB
942 ret = ieee80211_radiotap_iterator_next(&iterator);
943
944 if (ret)
945 continue;
946
947 /* see if this argument is something we can use */
948 switch (iterator.this_arg_index) {
949 /*
950 * You must take care when dereferencing iterator.this_arg
951 * for multibyte types... the pointer is not aligned. Use
952 * get_unaligned((type *)iterator.this_arg) to dereference
953 * iterator.this_arg for type "type" safely on all arches.
954 */
e2ebc74d
JB
955 case IEEE80211_RADIOTAP_FLAGS:
956 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
957 /*
958 * this indicates that the skb we have been
959 * handed has the 32-bit FCS CRC at the end...
960 * we should react to that by snipping it off
961 * because it will be recomputed and added
962 * on transmission
963 */
964 if (skb->len < (iterator.max_length + FCS_LEN))
27004b10 965 return false;
e2ebc74d
JB
966
967 skb_trim(skb, skb->len - FCS_LEN);
968 }
58d4185e 969 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
3b8d81e0 970 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
58d4185e 971 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
5cf121c3 972 tx->flags |= IEEE80211_TX_FRAGMENTED;
e2ebc74d
JB
973 break;
974
58d4185e
JB
975 /*
976 * Please update the file
977 * Documentation/networking/mac80211-injection.txt
978 * when parsing new fields here.
979 */
980
e2ebc74d
JB
981 default:
982 break;
983 }
984 }
985
986 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
27004b10 987 return false;
e2ebc74d
JB
988
989 /*
990 * remove the radiotap header
991 * iterator->max_length was sanity-checked against
992 * skb->len by iterator init
993 */
994 skb_pull(skb, iterator.max_length);
995
27004b10 996 return true;
e2ebc74d
JB
997}
998
58d4185e
JB
999/*
1000 * initialises @tx
1001 */
9ae54c84 1002static ieee80211_tx_result
3b8d81e0
JB
1003ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1004 struct ieee80211_tx_data *tx,
1005 struct sk_buff *skb)
e2ebc74d 1006{
3b8d81e0 1007 struct ieee80211_local *local = sdata->local;
58d4185e 1008 struct ieee80211_hdr *hdr;
e039fa4a 1009 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
8b30b1fe
S
1010 int hdrlen, tid;
1011 u8 *qc, *state;
cd8ffc80 1012 bool queued = false;
e2ebc74d
JB
1013
1014 memset(tx, 0, sizeof(*tx));
1015 tx->skb = skb;
3b8d81e0 1016 tx->dev = sdata->dev; /* use original interface */
e2ebc74d 1017 tx->local = local;
3b8d81e0 1018 tx->sdata = sdata;
e039fa4a 1019 tx->channel = local->hw.conf.channel;
e2ebc74d 1020 /*
58d4185e
JB
1021 * Set this flag (used below to indicate "automatic fragmentation"),
1022 * it will be cleared/left by radiotap as desired.
e2ebc74d 1023 */
5cf121c3 1024 tx->flags |= IEEE80211_TX_FRAGMENTED;
e2ebc74d
JB
1025
1026 /* process and remove the injection radiotap header */
25d834e1 1027 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
27004b10 1028 if (!__ieee80211_parse_tx_radiotap(tx, skb))
9ae54c84 1029 return TX_DROP;
58d4185e 1030
e2ebc74d 1031 /*
58d4185e
JB
1032 * __ieee80211_parse_tx_radiotap has now removed
1033 * the radiotap header that was present and pre-filled
1034 * 'tx' with tx control information.
e2ebc74d 1035 */
e2ebc74d
JB
1036 }
1037
cd8ffc80
JB
1038 /*
1039 * If this flag is set to true anywhere, and we get here,
1040 * we are doing the needed processing, so remove the flag
1041 * now.
1042 */
1043 info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1044
58d4185e
JB
1045 hdr = (struct ieee80211_hdr *) skb->data;
1046
24338793 1047 tx->sta = sta_info_get(local, hdr->addr1);
58d4185e 1048
cd8ffc80
JB
1049 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
1050 (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
96f5e66e 1051 unsigned long flags;
cd8ffc80
JB
1052 struct tid_ampdu_tx *tid_tx;
1053
8b30b1fe
S
1054 qc = ieee80211_get_qos_ctl(hdr);
1055 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
1056
96f5e66e 1057 spin_lock_irqsave(&tx->sta->lock, flags);
cd8ffc80
JB
1058 /*
1059 * XXX: This spinlock could be fairly expensive, but see the
1060 * comment in agg-tx.c:ieee80211_agg_tx_operational().
1061 * One way to solve this would be to do something RCU-like
1062 * for managing the tid_tx struct and using atomic bitops
1063 * for the actual state -- by introducing an actual
1064 * 'operational' bit that would be possible. It would
1065 * require changing ieee80211_agg_tx_operational() to
1066 * set that bit, and changing the way tid_tx is managed
1067 * everywhere, including races between that bit and
1068 * tid_tx going away (tid_tx being added can be easily
1069 * committed to memory before the 'operational' bit).
1070 */
1071 tid_tx = tx->sta->ampdu_mlme.tid_tx[tid];
8b30b1fe 1072 state = &tx->sta->ampdu_mlme.tid_state_tx[tid];
cd8ffc80 1073 if (*state == HT_AGG_STATE_OPERATIONAL) {
8b30b1fe 1074 info->flags |= IEEE80211_TX_CTL_AMPDU;
cd8ffc80
JB
1075 } else if (*state != HT_AGG_STATE_IDLE) {
1076 /* in progress */
1077 queued = true;
5061b0c2 1078 info->control.vif = &sdata->vif;
cd8ffc80
JB
1079 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
1080 __skb_queue_tail(&tid_tx->pending, skb);
1081 }
96f5e66e 1082 spin_unlock_irqrestore(&tx->sta->lock, flags);
cd8ffc80
JB
1083
1084 if (unlikely(queued))
1085 return TX_QUEUED;
8b30b1fe
S
1086 }
1087
badffb72 1088 if (is_multicast_ether_addr(hdr->addr1)) {
5cf121c3 1089 tx->flags &= ~IEEE80211_TX_UNICAST;
e039fa4a 1090 info->flags |= IEEE80211_TX_CTL_NO_ACK;
badffb72 1091 } else {
5cf121c3 1092 tx->flags |= IEEE80211_TX_UNICAST;
d3707d99
JB
1093 if (unlikely(local->wifi_wme_noack_test))
1094 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1095 else
1096 info->flags &= ~IEEE80211_TX_CTL_NO_ACK;
badffb72 1097 }
58d4185e 1098
5cf121c3
JB
1099 if (tx->flags & IEEE80211_TX_FRAGMENTED) {
1100 if ((tx->flags & IEEE80211_TX_UNICAST) &&
b9a5f8ca 1101 skb->len + FCS_LEN > local->hw.wiphy->frag_threshold &&
8d5e0d58 1102 !(info->flags & IEEE80211_TX_CTL_AMPDU))
5cf121c3 1103 tx->flags |= IEEE80211_TX_FRAGMENTED;
58d4185e 1104 else
5cf121c3 1105 tx->flags &= ~IEEE80211_TX_FRAGMENTED;
58d4185e
JB
1106 }
1107
e2ebc74d 1108 if (!tx->sta)
e039fa4a 1109 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
07346f81 1110 else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT))
e039fa4a 1111 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
58d4185e 1112
b73d70ad 1113 hdrlen = ieee80211_hdrlen(hdr->frame_control);
e2ebc74d
JB
1114 if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) {
1115 u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)];
1116 tx->ethertype = (pos[0] << 8) | pos[1];
1117 }
e039fa4a 1118 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
e2ebc74d 1119
9ae54c84 1120 return TX_CONTINUE;
e2ebc74d
JB
1121}
1122
2de8e0d9 1123static int __ieee80211_tx(struct ieee80211_local *local,
1870cd71 1124 struct sk_buff **skbp,
3b8d81e0
JB
1125 struct sta_info *sta,
1126 bool txpending)
e2ebc74d 1127{
1870cd71 1128 struct sk_buff *skb = *skbp, *next;
f8e79ddd 1129 struct ieee80211_tx_info *info;
5061b0c2 1130 struct ieee80211_sub_if_data *sdata;
3b8d81e0 1131 unsigned long flags;
a220858d 1132 int ret, len;
2de8e0d9 1133 bool fragm = false;
e2ebc74d 1134
2de8e0d9 1135 while (skb) {
3b8d81e0
JB
1136 int q = skb_get_queue_mapping(skb);
1137
1138 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1139 ret = IEEE80211_TX_OK;
1140 if (local->queue_stop_reasons[q] ||
1141 (!txpending && !skb_queue_empty(&local->pending[q])))
1142 ret = IEEE80211_TX_PENDING;
1143 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1144 if (ret != IEEE80211_TX_OK)
1145 return ret;
f8e79ddd 1146
f0e72851
JB
1147 info = IEEE80211_SKB_CB(skb);
1148
1149 if (fragm)
e6a9854b 1150 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
e039fa4a 1151 IEEE80211_TX_CTL_FIRST_FRAGMENT);
f0e72851 1152
2de8e0d9 1153 next = skb->next;
a220858d 1154 len = skb->len;
5061b0c2 1155
ad5351db
JB
1156 if (next)
1157 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
1158
5061b0c2
JB
1159 sdata = vif_to_sdata(info->control.vif);
1160
1161 switch (sdata->vif.type) {
1162 case NL80211_IFTYPE_MONITOR:
1163 info->control.vif = NULL;
1164 break;
1165 case NL80211_IFTYPE_AP_VLAN:
1166 info->control.vif = &container_of(sdata->bss,
1167 struct ieee80211_sub_if_data, u.ap)->vif;
1168 break;
1169 default:
1170 /* keep */
1171 break;
1172 }
1173
24487981 1174 ret = drv_tx(local, skb);
a220858d
JB
1175 if (WARN_ON(ret != NETDEV_TX_OK && skb->len != len)) {
1176 dev_kfree_skb(skb);
1177 ret = NETDEV_TX_OK;
1178 }
21f5fc75
LR
1179 if (ret != NETDEV_TX_OK) {
1180 info->control.vif = &sdata->vif;
2de8e0d9 1181 return IEEE80211_TX_AGAIN;
21f5fc75
LR
1182 }
1183
1870cd71 1184 *skbp = skb = next;
2de8e0d9
JB
1185 ieee80211_led_tx(local, 1);
1186 fragm = true;
e2ebc74d 1187 }
2de8e0d9 1188
e2ebc74d
JB
1189 return IEEE80211_TX_OK;
1190}
1191
97b045d6
JB
1192/*
1193 * Invoke TX handlers, return 0 on success and non-zero if the
1194 * frame was dropped or queued.
1195 */
1196static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1197{
97b045d6 1198 struct sk_buff *skb = tx->skb;
97b045d6 1199 ieee80211_tx_result res = TX_DROP;
97b045d6 1200
d9e8a70f
JB
1201#define CALL_TXH(txh) \
1202 res = txh(tx); \
1203 if (res != TX_CONTINUE) \
1204 goto txh_done;
1205
1206 CALL_TXH(ieee80211_tx_h_check_assoc)
d9e8a70f
JB
1207 CALL_TXH(ieee80211_tx_h_ps_buf)
1208 CALL_TXH(ieee80211_tx_h_select_key)
1209 CALL_TXH(ieee80211_tx_h_michael_mic_add)
1210 CALL_TXH(ieee80211_tx_h_rate_ctrl)
1211 CALL_TXH(ieee80211_tx_h_misc)
f591fa5d 1212 CALL_TXH(ieee80211_tx_h_sequence)
d9e8a70f
JB
1213 CALL_TXH(ieee80211_tx_h_fragment)
1214 /* handlers after fragment must be aware of tx info fragmentation! */
feff1f2f 1215 CALL_TXH(ieee80211_tx_h_stats)
d9e8a70f
JB
1216 CALL_TXH(ieee80211_tx_h_encrypt)
1217 CALL_TXH(ieee80211_tx_h_calculate_duration)
d9e8a70f 1218#undef CALL_TXH
97b045d6 1219
d9e8a70f 1220 txh_done:
97b045d6 1221 if (unlikely(res == TX_DROP)) {
5479d0e7 1222 I802_DEBUG_INC(tx->local->tx_handlers_drop);
2de8e0d9
JB
1223 while (skb) {
1224 struct sk_buff *next;
1225
1226 next = skb->next;
1227 dev_kfree_skb(skb);
1228 skb = next;
1229 }
97b045d6
JB
1230 return -1;
1231 } else if (unlikely(res == TX_QUEUED)) {
5479d0e7 1232 I802_DEBUG_INC(tx->local->tx_handlers_queued);
97b045d6
JB
1233 return -1;
1234 }
1235
1236 return 0;
1237}
1238
3b8d81e0
JB
1239static void ieee80211_tx(struct ieee80211_sub_if_data *sdata,
1240 struct sk_buff *skb, bool txpending)
e2ebc74d 1241{
3b8d81e0 1242 struct ieee80211_local *local = sdata->local;
5cf121c3 1243 struct ieee80211_tx_data tx;
97b045d6 1244 ieee80211_tx_result res_prepare;
e039fa4a 1245 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2a577d98
JB
1246 struct sk_buff *next;
1247 unsigned long flags;
1248 int ret, retries;
e2530083 1249 u16 queue;
e2ebc74d 1250
e2530083
JB
1251 queue = skb_get_queue_mapping(skb);
1252
e2ebc74d
JB
1253 if (unlikely(skb->len < 10)) {
1254 dev_kfree_skb(skb);
cd8ffc80 1255 return;
e2ebc74d
JB
1256 }
1257
d0709a65
JB
1258 rcu_read_lock();
1259
58d4185e 1260 /* initialises tx */
3b8d81e0 1261 res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
e2ebc74d 1262
cd8ffc80 1263 if (unlikely(res_prepare == TX_DROP)) {
e2ebc74d 1264 dev_kfree_skb(skb);
d0709a65 1265 rcu_read_unlock();
cd8ffc80
JB
1266 return;
1267 } else if (unlikely(res_prepare == TX_QUEUED)) {
1268 rcu_read_unlock();
1269 return;
e2ebc74d
JB
1270 }
1271
5cf121c3 1272 tx.channel = local->hw.conf.channel;
e039fa4a 1273 info->band = tx.channel->band;
e2ebc74d 1274
97b045d6
JB
1275 if (invoke_tx_handlers(&tx))
1276 goto out;
e2ebc74d 1277
2a577d98
JB
1278 retries = 0;
1279 retry:
3b8d81e0 1280 ret = __ieee80211_tx(local, &tx.skb, tx.sta, txpending);
2a577d98
JB
1281 switch (ret) {
1282 case IEEE80211_TX_OK:
1283 break;
1284 case IEEE80211_TX_AGAIN:
eefce91a
JB
1285 /*
1286 * Since there are no fragmented frames on A-MPDU
1287 * queues, there's no reason for a driver to reject
1288 * a frame there, warn and drop it.
1289 */
2a577d98
JB
1290 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
1291 goto drop;
1292 /* fall through */
1293 case IEEE80211_TX_PENDING:
1294 skb = tx.skb;
eefce91a 1295
2a577d98 1296 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
e2ebc74d 1297
3b8d81e0
JB
1298 if (local->queue_stop_reasons[queue] ||
1299 !skb_queue_empty(&local->pending[queue])) {
1300 /*
1301 * if queue is stopped, queue up frames for later
1302 * transmission from the tasklet
1303 */
2a577d98
JB
1304 do {
1305 next = skb->next;
1306 skb->next = NULL;
cd8ffc80 1307 if (unlikely(txpending))
3b8d81e0
JB
1308 __skb_queue_head(&local->pending[queue],
1309 skb);
cd8ffc80 1310 else
3b8d81e0
JB
1311 __skb_queue_tail(&local->pending[queue],
1312 skb);
2a577d98
JB
1313 } while ((skb = next));
1314
2a577d98
JB
1315 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1316 flags);
1317 } else {
3b8d81e0
JB
1318 /*
1319 * otherwise retry, but this is a race condition or
1320 * a driver bug (which we warn about if it persists)
1321 */
2a577d98
JB
1322 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1323 flags);
1324
1325 retries++;
3b8d81e0 1326 if (WARN(retries > 10, "tx refused but queue active\n"))
2a577d98 1327 goto drop;
e2ebc74d
JB
1328 goto retry;
1329 }
e2ebc74d 1330 }
97b045d6 1331 out:
d4e46a3d 1332 rcu_read_unlock();
cd8ffc80 1333 return;
e2ebc74d
JB
1334
1335 drop:
d4e46a3d 1336 rcu_read_unlock();
2de8e0d9
JB
1337
1338 skb = tx.skb;
1339 while (skb) {
2de8e0d9
JB
1340 next = skb->next;
1341 dev_kfree_skb(skb);
1342 skb = next;
1343 }
e2ebc74d
JB
1344}
1345
1346/* device xmit handlers */
1347
23c0752a
JB
1348static int ieee80211_skb_resize(struct ieee80211_local *local,
1349 struct sk_buff *skb,
1350 int head_need, bool may_encrypt)
1351{
1352 int tail_need = 0;
1353
1354 /*
1355 * This could be optimised, devices that do full hardware
1356 * crypto (including TKIP MMIC) need no tailroom... But we
1357 * have no drivers for such devices currently.
1358 */
1359 if (may_encrypt) {
1360 tail_need = IEEE80211_ENCRYPT_TAILROOM;
1361 tail_need -= skb_tailroom(skb);
1362 tail_need = max_t(int, tail_need, 0);
1363 }
1364
1365 if (head_need || tail_need) {
1366 /* Sorry. Can't account for this any more */
1367 skb_orphan(skb);
1368 }
1369
1370 if (skb_header_cloned(skb))
1371 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1372 else
1373 I802_DEBUG_INC(local->tx_expand_skb_head);
1374
1375 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
1376 printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n",
1377 wiphy_name(local->hw.wiphy));
1378 return -ENOMEM;
1379 }
1380
1381 /* update truesize too */
1382 skb->truesize += head_need + tail_need;
1383
1384 return 0;
1385}
1386
3b8d81e0
JB
1387static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1388 struct sk_buff *skb)
e2ebc74d 1389{
3b8d81e0 1390 struct ieee80211_local *local = sdata->local;
e039fa4a 1391 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
e32f85f7 1392 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
3b8d81e0 1393 struct ieee80211_sub_if_data *tmp_sdata;
e2ebc74d 1394 int headroom;
23c0752a 1395 bool may_encrypt;
e2ebc74d 1396
3b8d81e0 1397 dev_hold(sdata->dev);
e039fa4a 1398
4be8c387 1399 if ((local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK) &&
43f78531 1400 local->hw.conf.dynamic_ps_timeout > 0 &&
fbe9c429 1401 !(local->scanning) && local->ps_sdata) {
d063ed0f
VN
1402 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
1403 ieee80211_stop_queues_by_reason(&local->hw,
1404 IEEE80211_QUEUE_STOP_REASON_PS);
42935eca 1405 ieee80211_queue_work(&local->hw,
d063ed0f
VN
1406 &local->dynamic_ps_disable_work);
1407 }
1408
1409 mod_timer(&local->dynamic_ps_timer, jiffies +
46f2c4bd 1410 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
d063ed0f
VN
1411 }
1412
d0f09804
JB
1413 info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
1414
3b8d81e0 1415 if (ieee80211_vif_is_mesh(&sdata->vif) &&
e32f85f7 1416 ieee80211_is_data(hdr->frame_control)) {
f74b6a54
RR
1417 if (is_multicast_ether_addr(hdr->addr3))
1418 memcpy(hdr->addr1, hdr->addr3, ETH_ALEN);
1419 else
3b8d81e0
JB
1420 if (mesh_nexthop_lookup(skb, sdata)) {
1421 dev_put(sdata->dev);
1422 return;
5dc306f3 1423 }
3b8d81e0 1424 } else if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
25d834e1
JB
1425 int hdrlen;
1426 u16 len_rthdr;
1427
1428 info->flags |= IEEE80211_TX_CTL_INJECTED;
25d834e1
JB
1429
1430 len_rthdr = ieee80211_get_radiotap_len(skb->data);
8ef86c7b 1431 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
25d834e1
JB
1432 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1433
1434 /* check the header is complete in the frame */
1435 if (likely(skb->len >= len_rthdr + hdrlen)) {
1436 /*
1437 * We process outgoing injected frames that have a
1438 * local address we handle as though they are our
1439 * own frames.
1440 * This code here isn't entirely correct, the local
1441 * MAC address is not necessarily enough to find
1442 * the interface to use; for that proper VLAN/WDS
1443 * support we will need a different mechanism.
1444 */
1445
1446 rcu_read_lock();
3b8d81e0 1447 list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
25d834e1 1448 list) {
3b8d81e0 1449 if (!netif_running(tmp_sdata->dev))
25d834e1 1450 continue;
3b8d81e0 1451 if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
f1b33cb1 1452 continue;
3b8d81e0 1453 if (compare_ether_addr(tmp_sdata->dev->dev_addr,
25d834e1 1454 hdr->addr2)) {
3b8d81e0
JB
1455 dev_hold(tmp_sdata->dev);
1456 dev_put(sdata->dev);
1457 sdata = tmp_sdata;
25d834e1
JB
1458 break;
1459 }
1460 }
1461 rcu_read_unlock();
1462 }
e32f85f7
LCC
1463 }
1464
3b8d81e0 1465 may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
23c0752a 1466
3b8d81e0 1467 headroom = local->tx_headroom;
23c0752a
JB
1468 if (may_encrypt)
1469 headroom += IEEE80211_ENCRYPT_HEADROOM;
1470 headroom -= skb_headroom(skb);
1471 headroom = max_t(int, 0, headroom);
1472
3b8d81e0 1473 if (ieee80211_skb_resize(local, skb, headroom, may_encrypt)) {
23c0752a 1474 dev_kfree_skb(skb);
3b8d81e0
JB
1475 dev_put(sdata->dev);
1476 return;
e2ebc74d
JB
1477 }
1478
5061b0c2 1479 info->control.vif = &sdata->vif;
e2ebc74d 1480
3b8d81e0
JB
1481 ieee80211_select_queue(local, skb);
1482 ieee80211_tx(sdata, skb, false);
1483 dev_put(sdata->dev);
e2ebc74d
JB
1484}
1485
1486int ieee80211_monitor_start_xmit(struct sk_buff *skb,
1487 struct net_device *dev)
1488{
1489 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
47f4d887 1490 struct ieee80211_channel *chan = local->hw.conf.channel;
e2ebc74d
JB
1491 struct ieee80211_radiotap_header *prthdr =
1492 (struct ieee80211_radiotap_header *)skb->data;
3b8d81e0 1493 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
9b8a74e3 1494 u16 len_rthdr;
e2ebc74d 1495
47f4d887
LR
1496 /*
1497 * Frame injection is not allowed if beaconing is not allowed
1498 * or if we need radar detection. Beaconing is usually not allowed when
1499 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
1500 * Passive scan is also used in world regulatory domains where
1501 * your country is not known and as such it should be treated as
1502 * NO TX unless the channel is explicitly allowed in which case
1503 * your current regulatory domain would not have the passive scan
1504 * flag.
1505 *
1506 * Since AP mode uses monitor interfaces to inject/TX management
1507 * frames we can make AP mode the exception to this rule once it
1508 * supports radar detection as its implementation can deal with
1509 * radar detection by itself. We can do that later by adding a
1510 * monitor flag interfaces used for AP support.
1511 */
1512 if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR |
1513 IEEE80211_CHAN_PASSIVE_SCAN)))
1514 goto fail;
1515
9b8a74e3
AG
1516 /* check for not even having the fixed radiotap header part */
1517 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
1518 goto fail; /* too short to be possibly valid */
1519
1520 /* is it a header version we can trust to find length from? */
1521 if (unlikely(prthdr->it_version))
1522 goto fail; /* only version 0 is supported */
1523
1524 /* then there must be a radiotap header with a length we can use */
1525 len_rthdr = ieee80211_get_radiotap_len(skb->data);
1526
1527 /* does the skb contain enough to deliver on the alleged length? */
1528 if (unlikely(skb->len < len_rthdr))
1529 goto fail; /* skb too short for claimed rt header extent */
e2ebc74d 1530
e2ebc74d
JB
1531 /*
1532 * fix up the pointers accounting for the radiotap
1533 * header still being in there. We are being given
1534 * a precooked IEEE80211 header so no need for
1535 * normal processing
1536 */
9b8a74e3 1537 skb_set_mac_header(skb, len_rthdr);
e2ebc74d 1538 /*
9b8a74e3
AG
1539 * these are just fixed to the end of the rt area since we
1540 * don't have any better information and at this point, nobody cares
e2ebc74d 1541 */
9b8a74e3
AG
1542 skb_set_network_header(skb, len_rthdr);
1543 skb_set_transport_header(skb, len_rthdr);
e2ebc74d 1544
3b8d81e0
JB
1545 memset(info, 0, sizeof(*info));
1546
1547 /* pass the radiotap header up to xmit */
1548 ieee80211_xmit(IEEE80211_DEV_TO_SUB_IF(dev), skb);
e2ebc74d 1549 return NETDEV_TX_OK;
9b8a74e3
AG
1550
1551fail:
1552 dev_kfree_skb(skb);
1553 return NETDEV_TX_OK; /* meaning, we dealt with the skb */
e2ebc74d
JB
1554}
1555
1556/**
1557 * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type
1558 * subinterfaces (wlan#, WDS, and VLAN interfaces)
1559 * @skb: packet to be sent
1560 * @dev: incoming interface
1561 *
1562 * Returns: 0 on success (and frees skb in this case) or 1 on failure (skb will
1563 * not be freed, and caller is responsible for either retrying later or freeing
1564 * skb).
1565 *
1566 * This function takes in an Ethernet header and encapsulates it with suitable
1567 * IEEE 802.11 header based on which interface the packet is coming in. The
1568 * encapsulated packet will then be passed to master interface, wlan#.11, for
1569 * transmission (through low-level driver).
1570 */
1571int ieee80211_subif_start_xmit(struct sk_buff *skb,
1572 struct net_device *dev)
1573{
133b8226
JB
1574 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1575 struct ieee80211_local *local = sdata->local;
3b8d81e0 1576 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
5b548140 1577 int ret = NETDEV_TX_BUSY, head_need;
065e9605
HH
1578 u16 ethertype, hdrlen, meshhdrlen = 0;
1579 __le16 fc;
e2ebc74d 1580 struct ieee80211_hdr hdr;
33b64eb2 1581 struct ieee80211s_hdr mesh_hdr;
e2ebc74d
JB
1582 const u8 *encaps_data;
1583 int encaps_len, skip_header_bytes;
e8bf9649 1584 int nh_pos, h_pos;
e2ebc74d 1585 struct sta_info *sta;
ce3edf6d 1586 u32 sta_flags = 0;
e2ebc74d 1587
e2ebc74d 1588 if (unlikely(skb->len < ETH_HLEN)) {
ec634fe3 1589 ret = NETDEV_TX_OK;
e2ebc74d
JB
1590 goto fail;
1591 }
1592
1593 nh_pos = skb_network_header(skb) - skb->data;
1594 h_pos = skb_transport_header(skb) - skb->data;
1595
1596 /* convert Ethernet header to proper 802.11 header (based on
1597 * operation mode) */
1598 ethertype = (skb->data[12] << 8) | skb->data[13];
065e9605 1599 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
e2ebc74d 1600
51fb61e7 1601 switch (sdata->vif.type) {
05c914fe
JB
1602 case NL80211_IFTYPE_AP:
1603 case NL80211_IFTYPE_AP_VLAN:
065e9605 1604 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
e2ebc74d
JB
1605 /* DA BSSID SA */
1606 memcpy(hdr.addr1, skb->data, ETH_ALEN);
1607 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
1608 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
1609 hdrlen = 24;
cf966838 1610 break;
05c914fe 1611 case NL80211_IFTYPE_WDS:
065e9605 1612 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
e2ebc74d
JB
1613 /* RA TA DA SA */
1614 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
1615 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
1616 memcpy(hdr.addr3, skb->data, ETH_ALEN);
1617 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
1618 hdrlen = 30;
cf966838 1619 break;
33b64eb2 1620#ifdef CONFIG_MAC80211_MESH
05c914fe 1621 case NL80211_IFTYPE_MESH_POINT:
065e9605 1622 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
472dbc45 1623 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
e32f85f7 1624 /* Do not send frames with mesh_ttl == 0 */
472dbc45 1625 sdata->u.mesh.mshstats.dropped_frames_ttl++;
ec634fe3 1626 ret = NETDEV_TX_OK;
e32f85f7 1627 goto fail;
33b64eb2 1628 }
79617dee
Y
1629 memset(&mesh_hdr, 0, sizeof(mesh_hdr));
1630
1631 if (compare_ether_addr(dev->dev_addr,
1632 skb->data + ETH_ALEN) == 0) {
1633 /* RA TA DA SA */
1634 memset(hdr.addr1, 0, ETH_ALEN);
1635 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
1636 memcpy(hdr.addr3, skb->data, ETH_ALEN);
1637 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
1638 meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata);
1639 } else {
1640 /* packet from other interface */
1641 struct mesh_path *mppath;
1642
1643 memset(hdr.addr1, 0, ETH_ALEN);
1644 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
1645 memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN);
1646
1647 if (is_multicast_ether_addr(skb->data))
1648 memcpy(hdr.addr3, skb->data, ETH_ALEN);
1649 else {
1650 rcu_read_lock();
1651 mppath = mpp_path_lookup(skb->data, sdata);
1652 if (mppath)
1653 memcpy(hdr.addr3, mppath->mpp, ETH_ALEN);
1654 else
1655 memset(hdr.addr3, 0xff, ETH_ALEN);
1656 rcu_read_unlock();
1657 }
1658
1659 mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6;
1660 mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL;
1661 put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum);
1662 memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN);
1663 memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN);
1664 sdata->u.mesh.mesh_seqnum++;
1665 meshhdrlen = 18;
1666 }
33b64eb2
LCC
1667 hdrlen = 30;
1668 break;
1669#endif
05c914fe 1670 case NL80211_IFTYPE_STATION:
065e9605 1671 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
e2ebc74d 1672 /* BSSID SA DA */
46900298 1673 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
e2ebc74d
JB
1674 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
1675 memcpy(hdr.addr3, skb->data, ETH_ALEN);
1676 hdrlen = 24;
cf966838 1677 break;
05c914fe 1678 case NL80211_IFTYPE_ADHOC:
e2ebc74d
JB
1679 /* DA SA BSSID */
1680 memcpy(hdr.addr1, skb->data, ETH_ALEN);
1681 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
46900298 1682 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
e2ebc74d 1683 hdrlen = 24;
cf966838
JB
1684 break;
1685 default:
ec634fe3 1686 ret = NETDEV_TX_OK;
e2ebc74d
JB
1687 goto fail;
1688 }
1689
7d185b8b
JB
1690 /*
1691 * There's no need to try to look up the destination
1692 * if it is a multicast address (which can only happen
1693 * in AP mode)
1694 */
1695 if (!is_multicast_ether_addr(hdr.addr1)) {
d0709a65 1696 rcu_read_lock();
7d185b8b 1697 sta = sta_info_get(local, hdr.addr1);
d0709a65 1698 if (sta)
07346f81 1699 sta_flags = get_sta_flags(sta);
d0709a65 1700 rcu_read_unlock();
e2ebc74d
JB
1701 }
1702
3434fbd3 1703 /* receiver and we are QoS enabled, use a QoS type frame */
176be728 1704 if ((sta_flags & WLAN_STA_WME) && local->hw.queues >= 4) {
065e9605 1705 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
ce3edf6d
JB
1706 hdrlen += 2;
1707 }
1708
1709 /*
238814fd
JB
1710 * Drop unicast frames to unauthorised stations unless they are
1711 * EAPOL frames from the local station.
ce3edf6d 1712 */
e32f85f7
LCC
1713 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
1714 unlikely(!is_multicast_ether_addr(hdr.addr1) &&
33b64eb2
LCC
1715 !(sta_flags & WLAN_STA_AUTHORIZED) &&
1716 !(ethertype == ETH_P_PAE &&
ce3edf6d
JB
1717 compare_ether_addr(dev->dev_addr,
1718 skb->data + ETH_ALEN) == 0))) {
1719#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
ce3edf6d 1720 if (net_ratelimit())
0c68ae26 1721 printk(KERN_DEBUG "%s: dropped frame to %pM"
ce3edf6d 1722 " (unauthorized port)\n", dev->name,
0c68ae26 1723 hdr.addr1);
ce3edf6d
JB
1724#endif
1725
1726 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
1727
ec634fe3 1728 ret = NETDEV_TX_OK;
ce3edf6d
JB
1729 goto fail;
1730 }
1731
065e9605 1732 hdr.frame_control = fc;
e2ebc74d
JB
1733 hdr.duration_id = 0;
1734 hdr.seq_ctrl = 0;
1735
1736 skip_header_bytes = ETH_HLEN;
1737 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
1738 encaps_data = bridge_tunnel_header;
1739 encaps_len = sizeof(bridge_tunnel_header);
1740 skip_header_bytes -= 2;
1741 } else if (ethertype >= 0x600) {
1742 encaps_data = rfc1042_header;
1743 encaps_len = sizeof(rfc1042_header);
1744 skip_header_bytes -= 2;
1745 } else {
1746 encaps_data = NULL;
1747 encaps_len = 0;
1748 }
1749
1750 skb_pull(skb, skip_header_bytes);
1751 nh_pos -= skip_header_bytes;
1752 h_pos -= skip_header_bytes;
1753
23c0752a 1754 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
e2ebc74d 1755
23c0752a
JB
1756 /*
1757 * So we need to modify the skb header and hence need a copy of
1758 * that. The head_need variable above doesn't, so far, include
1759 * the needed header space that we don't need right away. If we
1760 * can, then we don't reallocate right now but only after the
1761 * frame arrives at the master device (if it does...)
1762 *
1763 * If we cannot, however, then we will reallocate to include all
1764 * the ever needed space. Also, if we need to reallocate it anyway,
1765 * make it big enough for everything we may ever need.
1766 */
e2ebc74d 1767
3a5be7d4 1768 if (head_need > 0 || skb_cloned(skb)) {
23c0752a
JB
1769 head_need += IEEE80211_ENCRYPT_HEADROOM;
1770 head_need += local->tx_headroom;
1771 head_need = max_t(int, 0, head_need);
1772 if (ieee80211_skb_resize(local, skb, head_need, true))
e2ebc74d 1773 goto fail;
e2ebc74d
JB
1774 }
1775
1776 if (encaps_data) {
1777 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
1778 nh_pos += encaps_len;
1779 h_pos += encaps_len;
1780 }
c29b9b9b 1781
33b64eb2
LCC
1782 if (meshhdrlen > 0) {
1783 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
1784 nh_pos += meshhdrlen;
1785 h_pos += meshhdrlen;
1786 }
1787
065e9605 1788 if (ieee80211_is_data_qos(fc)) {
c29b9b9b
JB
1789 __le16 *qos_control;
1790
1791 qos_control = (__le16*) skb_push(skb, 2);
1792 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
1793 /*
1794 * Maybe we could actually set some fields here, for now just
1795 * initialise to zero to indicate no special operation.
1796 */
1797 *qos_control = 0;
1798 } else
1799 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
1800
e2ebc74d
JB
1801 nh_pos += hdrlen;
1802 h_pos += hdrlen;
1803
68aae116
SH
1804 dev->stats.tx_packets++;
1805 dev->stats.tx_bytes += skb->len;
e2ebc74d
JB
1806
1807 /* Update skb pointers to various headers since this modified frame
1808 * is going to go through Linux networking code that may potentially
1809 * need things like pointer to IP header. */
1810 skb_set_mac_header(skb, 0);
1811 skb_set_network_header(skb, nh_pos);
1812 skb_set_transport_header(skb, h_pos);
1813
3b8d81e0
JB
1814 memset(info, 0, sizeof(*info));
1815
e2ebc74d 1816 dev->trans_start = jiffies;
3b8d81e0 1817 ieee80211_xmit(sdata, skb);
e2ebc74d 1818
ec634fe3 1819 return NETDEV_TX_OK;
e2ebc74d
JB
1820
1821 fail:
ec634fe3 1822 if (ret == NETDEV_TX_OK)
e2ebc74d
JB
1823 dev_kfree_skb(skb);
1824
1825 return ret;
1826}
1827
e2ebc74d 1828
e2530083
JB
1829/*
1830 * ieee80211_clear_tx_pending may not be called in a context where
1831 * it is possible that it packets could come in again.
1832 */
e2ebc74d
JB
1833void ieee80211_clear_tx_pending(struct ieee80211_local *local)
1834{
2de8e0d9 1835 int i;
e2ebc74d 1836
2a577d98
JB
1837 for (i = 0; i < local->hw.queues; i++)
1838 skb_queue_purge(&local->pending[i]);
e2ebc74d
JB
1839}
1840
cd8ffc80
JB
1841static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
1842 struct sk_buff *skb)
1843{
1844 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1845 struct ieee80211_sub_if_data *sdata;
1846 struct sta_info *sta;
1847 struct ieee80211_hdr *hdr;
cd8ffc80
JB
1848 int ret;
1849 bool result = true;
1850
5061b0c2 1851 sdata = vif_to_sdata(info->control.vif);
cd8ffc80
JB
1852
1853 if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
5061b0c2 1854 ieee80211_tx(sdata, skb, true);
cd8ffc80
JB
1855 } else {
1856 hdr = (struct ieee80211_hdr *)skb->data;
1857 sta = sta_info_get(local, hdr->addr1);
1858
3b8d81e0 1859 ret = __ieee80211_tx(local, &skb, sta, true);
cd8ffc80
JB
1860 if (ret != IEEE80211_TX_OK)
1861 result = false;
1862 }
1863
cd8ffc80
JB
1864 return result;
1865}
1866
e2530083 1867/*
3b8d81e0 1868 * Transmit all pending packets. Called from tasklet.
e2530083 1869 */
e2ebc74d
JB
1870void ieee80211_tx_pending(unsigned long data)
1871{
1872 struct ieee80211_local *local = (struct ieee80211_local *)data;
2a577d98 1873 unsigned long flags;
cd8ffc80 1874 int i;
3b8d81e0 1875 bool txok;
e2ebc74d 1876
f0e72851 1877 rcu_read_lock();
e2530083 1878
3b8d81e0 1879 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
2a577d98
JB
1880 for (i = 0; i < local->hw.queues; i++) {
1881 /*
1882 * If queue is stopped by something other than due to pending
1883 * frames, or we have no pending frames, proceed to next queue.
1884 */
3b8d81e0 1885 if (local->queue_stop_reasons[i] ||
2a577d98 1886 skb_queue_empty(&local->pending[i]))
e2ebc74d 1887 continue;
e2530083 1888
2a577d98 1889 while (!skb_queue_empty(&local->pending[i])) {
3b8d81e0 1890 struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
5061b0c2
JB
1891 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1892 struct ieee80211_sub_if_data *sdata;
1893
a7bc376c
JB
1894 if (WARN_ON(!info->control.vif)) {
1895 kfree_skb(skb);
1896 continue;
1897 }
1898
5061b0c2
JB
1899 sdata = vif_to_sdata(info->control.vif);
1900 dev_hold(sdata->dev);
3b8d81e0
JB
1901 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1902 flags);
1903
1904 txok = ieee80211_tx_pending_skb(local, skb);
5061b0c2 1905 dev_put(sdata->dev);
3b8d81e0
JB
1906 if (!txok)
1907 __skb_queue_head(&local->pending[i], skb);
1908 spin_lock_irqsave(&local->queue_stop_reason_lock,
1909 flags);
1910 if (!txok)
2a577d98 1911 break;
e2ebc74d
JB
1912 }
1913 }
3b8d81e0 1914 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
2a577d98 1915
f0e72851 1916 rcu_read_unlock();
e2ebc74d
JB
1917}
1918
1919/* functions for drivers to get certain frames */
1920
8e7be8da 1921static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss,
5dfdaf58
JB
1922 struct sk_buff *skb,
1923 struct beacon_data *beacon)
e2ebc74d
JB
1924{
1925 u8 *pos, *tim;
1926 int aid0 = 0;
1927 int i, have_bits = 0, n1, n2;
1928
1929 /* Generate bitmap for TIM only if there are any STAs in power save
1930 * mode. */
e2ebc74d
JB
1931 if (atomic_read(&bss->num_sta_ps) > 0)
1932 /* in the hope that this is faster than
1933 * checking byte-for-byte */
1934 have_bits = !bitmap_empty((unsigned long*)bss->tim,
1935 IEEE80211_MAX_AID+1);
1936
1937 if (bss->dtim_count == 0)
5dfdaf58 1938 bss->dtim_count = beacon->dtim_period - 1;
e2ebc74d
JB
1939 else
1940 bss->dtim_count--;
1941
1942 tim = pos = (u8 *) skb_put(skb, 6);
1943 *pos++ = WLAN_EID_TIM;
1944 *pos++ = 4;
1945 *pos++ = bss->dtim_count;
5dfdaf58 1946 *pos++ = beacon->dtim_period;
e2ebc74d
JB
1947
1948 if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
1949 aid0 = 1;
1950
1951 if (have_bits) {
1952 /* Find largest even number N1 so that bits numbered 1 through
1953 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
1954 * (N2 + 1) x 8 through 2007 are 0. */
1955 n1 = 0;
1956 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
1957 if (bss->tim[i]) {
1958 n1 = i & 0xfe;
1959 break;
1960 }
1961 }
1962 n2 = n1;
1963 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
1964 if (bss->tim[i]) {
1965 n2 = i;
1966 break;
1967 }
1968 }
1969
1970 /* Bitmap control */
1971 *pos++ = n1 | aid0;
1972 /* Part Virt Bitmap */
1973 memcpy(pos, bss->tim + n1, n2 - n1 + 1);
1974
1975 tim[1] = n2 - n1 + 4;
1976 skb_put(skb, n2 - n1);
1977 } else {
1978 *pos++ = aid0; /* Bitmap control */
1979 *pos++ = 0; /* Part Virt Bitmap */
1980 }
e2ebc74d
JB
1981}
1982
32bfd35d 1983struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw,
e039fa4a 1984 struct ieee80211_vif *vif)
e2ebc74d
JB
1985{
1986 struct ieee80211_local *local = hw_to_local(hw);
9d139c81 1987 struct sk_buff *skb = NULL;
e039fa4a 1988 struct ieee80211_tx_info *info;
e2ebc74d
JB
1989 struct ieee80211_sub_if_data *sdata = NULL;
1990 struct ieee80211_if_ap *ap = NULL;
5dfdaf58 1991 struct beacon_data *beacon;
8318d78a 1992 struct ieee80211_supported_band *sband;
2e92e6f2 1993 enum ieee80211_band band = local->hw.conf.channel->band;
8318d78a 1994
2e92e6f2 1995 sband = local->hw.wiphy->bands[band];
5dfdaf58
JB
1996
1997 rcu_read_lock();
e2ebc74d 1998
32bfd35d 1999 sdata = vif_to_sdata(vif);
e2ebc74d 2000
05c914fe 2001 if (sdata->vif.type == NL80211_IFTYPE_AP) {
33b64eb2
LCC
2002 ap = &sdata->u.ap;
2003 beacon = rcu_dereference(ap->beacon);
902acc78
JB
2004 if (ap && beacon) {
2005 /*
2006 * headroom, head length,
2007 * tail length and maximum TIM length
2008 */
2009 skb = dev_alloc_skb(local->tx_headroom +
2010 beacon->head_len +
2011 beacon->tail_len + 256);
2012 if (!skb)
2013 goto out;
33b64eb2 2014
902acc78
JB
2015 skb_reserve(skb, local->tx_headroom);
2016 memcpy(skb_put(skb, beacon->head_len), beacon->head,
2017 beacon->head_len);
33b64eb2 2018
d0709a65
JB
2019 /*
2020 * Not very nice, but we want to allow the driver to call
2021 * ieee80211_beacon_get() as a response to the set_tim()
2022 * callback. That, however, is already invoked under the
2023 * sta_lock to guarantee consistent and race-free update
2024 * of the tim bitmap in mac80211 and the driver.
2025 */
2026 if (local->tim_in_locked_section) {
8e7be8da 2027 ieee80211_beacon_add_tim(ap, skb, beacon);
d0709a65
JB
2028 } else {
2029 unsigned long flags;
2030
2031 spin_lock_irqsave(&local->sta_lock, flags);
8e7be8da 2032 ieee80211_beacon_add_tim(ap, skb, beacon);
d0709a65
JB
2033 spin_unlock_irqrestore(&local->sta_lock, flags);
2034 }
33b64eb2 2035
902acc78
JB
2036 if (beacon->tail)
2037 memcpy(skb_put(skb, beacon->tail_len),
2038 beacon->tail, beacon->tail_len);
9d139c81
JB
2039 } else
2040 goto out;
05c914fe 2041 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
46900298 2042 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
9d139c81 2043 struct ieee80211_hdr *hdr;
af8cdcd8 2044 struct sk_buff *presp = rcu_dereference(ifibss->presp);
33b64eb2 2045
af8cdcd8 2046 if (!presp)
9d139c81
JB
2047 goto out;
2048
af8cdcd8 2049 skb = skb_copy(presp, GFP_ATOMIC);
9d139c81
JB
2050 if (!skb)
2051 goto out;
2052
2053 hdr = (struct ieee80211_hdr *) skb->data;
e7827a70
HH
2054 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2055 IEEE80211_STYPE_BEACON);
902acc78 2056 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
472dbc45
JB
2057 struct ieee80211_mgmt *mgmt;
2058 u8 *pos;
2059
902acc78
JB
2060 /* headroom, head length, tail length and maximum TIM length */
2061 skb = dev_alloc_skb(local->tx_headroom + 400);
2062 if (!skb)
2063 goto out;
2064
2065 skb_reserve(skb, local->hw.extra_tx_headroom);
2066 mgmt = (struct ieee80211_mgmt *)
2067 skb_put(skb, 24 + sizeof(mgmt->u.beacon));
2068 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
065e9605
HH
2069 mgmt->frame_control =
2070 cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
902acc78
JB
2071 memset(mgmt->da, 0xff, ETH_ALEN);
2072 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
2073 /* BSSID is left zeroed, wildcard value */
2074 mgmt->u.beacon.beacon_int =
57c4d7b4 2075 cpu_to_le16(sdata->vif.bss_conf.beacon_int);
902acc78
JB
2076 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
2077
2078 pos = skb_put(skb, 2);
2079 *pos++ = WLAN_EID_SSID;
2080 *pos++ = 0x0;
2081
f698d856 2082 mesh_mgmt_ies_add(skb, sdata);
9d139c81
JB
2083 } else {
2084 WARN_ON(1);
5dfdaf58 2085 goto out;
e2ebc74d
JB
2086 }
2087
e039fa4a
JB
2088 info = IEEE80211_SKB_CB(skb);
2089
3b8d81e0 2090 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
e039fa4a 2091 info->band = band;
e6a9854b
JB
2092 /*
2093 * XXX: For now, always use the lowest rate
2094 */
2095 info->control.rates[0].idx = 0;
2096 info->control.rates[0].count = 1;
2097 info->control.rates[1].idx = -1;
2098 info->control.rates[2].idx = -1;
2099 info->control.rates[3].idx = -1;
2100 info->control.rates[4].idx = -1;
2101 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
e039fa4a
JB
2102
2103 info->control.vif = vif;
f591fa5d
JB
2104
2105 info->flags |= IEEE80211_TX_CTL_NO_ACK;
f591fa5d
JB
2106 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
2107 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
e6a9854b 2108 out:
5dfdaf58 2109 rcu_read_unlock();
e2ebc74d
JB
2110 return skb;
2111}
2112EXPORT_SYMBOL(ieee80211_beacon_get);
2113
32bfd35d 2114void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 2115 const void *frame, size_t frame_len,
e039fa4a 2116 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB
2117 struct ieee80211_rts *rts)
2118{
2119 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 2120
065e9605
HH
2121 rts->frame_control =
2122 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
32bfd35d
JB
2123 rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
2124 frame_txctl);
e2ebc74d
JB
2125 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
2126 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
2127}
2128EXPORT_SYMBOL(ieee80211_rts_get);
2129
32bfd35d 2130void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
e2ebc74d 2131 const void *frame, size_t frame_len,
e039fa4a 2132 const struct ieee80211_tx_info *frame_txctl,
e2ebc74d
JB
2133 struct ieee80211_cts *cts)
2134{
2135 const struct ieee80211_hdr *hdr = frame;
e2ebc74d 2136
065e9605
HH
2137 cts->frame_control =
2138 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
32bfd35d
JB
2139 cts->duration = ieee80211_ctstoself_duration(hw, vif,
2140 frame_len, frame_txctl);
e2ebc74d
JB
2141 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
2142}
2143EXPORT_SYMBOL(ieee80211_ctstoself_get);
2144
2145struct sk_buff *
32bfd35d 2146ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
e039fa4a 2147 struct ieee80211_vif *vif)
e2ebc74d
JB
2148{
2149 struct ieee80211_local *local = hw_to_local(hw);
747cf5e9 2150 struct sk_buff *skb = NULL;
e2ebc74d 2151 struct sta_info *sta;
5cf121c3 2152 struct ieee80211_tx_data tx;
e2ebc74d
JB
2153 struct ieee80211_sub_if_data *sdata;
2154 struct ieee80211_if_ap *bss = NULL;
5dfdaf58 2155 struct beacon_data *beacon;
e039fa4a 2156 struct ieee80211_tx_info *info;
e2ebc74d 2157
32bfd35d 2158 sdata = vif_to_sdata(vif);
747cf5e9 2159 bss = &sdata->u.ap;
5dfdaf58 2160
5dfdaf58
JB
2161 rcu_read_lock();
2162 beacon = rcu_dereference(bss->beacon);
2163
05c914fe 2164 if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
747cf5e9 2165 goto out;
5dfdaf58 2166
e2ebc74d 2167 if (bss->dtim_count != 0)
747cf5e9 2168 goto out; /* send buffered bc/mc only after DTIM beacon */
e039fa4a 2169
e2ebc74d
JB
2170 while (1) {
2171 skb = skb_dequeue(&bss->ps_bc_buf);
2172 if (!skb)
747cf5e9 2173 goto out;
e2ebc74d
JB
2174 local->total_ps_buffered--;
2175
2176 if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
2177 struct ieee80211_hdr *hdr =
2178 (struct ieee80211_hdr *) skb->data;
2179 /* more buffered multicast/broadcast frames ==> set
2180 * MoreData flag in IEEE 802.11 header to inform PS
2181 * STAs */
2182 hdr->frame_control |=
2183 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
2184 }
2185
3b8d81e0 2186 if (!ieee80211_tx_prepare(sdata, &tx, skb))
e2ebc74d
JB
2187 break;
2188 dev_kfree_skb_any(skb);
2189 }
e039fa4a
JB
2190
2191 info = IEEE80211_SKB_CB(skb);
2192
e2ebc74d 2193 sta = tx.sta;
5cf121c3
JB
2194 tx.flags |= IEEE80211_TX_PS_BUFFERED;
2195 tx.channel = local->hw.conf.channel;
e039fa4a 2196 info->band = tx.channel->band;
e2ebc74d 2197
97b045d6 2198 if (invoke_tx_handlers(&tx))
e2ebc74d 2199 skb = NULL;
97b045d6 2200 out:
d0709a65 2201 rcu_read_unlock();
e2ebc74d
JB
2202
2203 return skb;
2204}
2205EXPORT_SYMBOL(ieee80211_get_buffered_bc);
3b8d81e0
JB
2206
2207void ieee80211_tx_skb(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb,
2208 int encrypt)
2209{
2210 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2211 skb_set_mac_header(skb, 0);
2212 skb_set_network_header(skb, 0);
2213 skb_set_transport_header(skb, 0);
2214
3b8d81e0
JB
2215 if (!encrypt)
2216 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
2217
3d34deb6
JB
2218 /*
2219 * The other path calling ieee80211_xmit is from the tasklet,
2220 * and while we can handle concurrent transmissions locking
2221 * requirements are that we do not come into tx with bhs on.
2222 */
2223 local_bh_disable();
3b8d81e0 2224 ieee80211_xmit(sdata, skb);
3d34deb6 2225 local_bh_enable();
3b8d81e0 2226}