1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 * 12 * Transmit and frame generation functions. 13 */ 14 15 #include <linux/kernel.h> 16 #include <linux/slab.h> 17 #include <linux/skbuff.h> 18 #include <linux/etherdevice.h> 19 #include <linux/bitmap.h> 20 #include <linux/rcupdate.h> 21 #include <linux/export.h> 22 #include <net/net_namespace.h> 23 #include <net/ieee80211_radiotap.h> 24 #include <net/cfg80211.h> 25 #include <net/mac80211.h> 26 #include <asm/unaligned.h> 27 28 #include "ieee80211_i.h" 29 #include "driver-ops.h" 30 #include "led.h" 31 #include "mesh.h" 32 #include "wep.h" 33 #include "wpa.h" 34 #include "wme.h" 35 #include "rate.h" 36 37 /* misc utils */ 38 39 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, 40 struct sk_buff *skb, int group_addr, 41 int next_frag_len) 42 { 43 int rate, mrate, erp, dur, i; 44 struct ieee80211_rate *txrate; 45 struct ieee80211_local *local = tx->local; 46 struct ieee80211_supported_band *sband; 47 struct ieee80211_hdr *hdr; 48 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 49 50 /* assume HW handles this */ 51 if (tx->rate.flags & IEEE80211_TX_RC_MCS) 52 return 0; 53 54 /* uh huh? */ 55 if (WARN_ON_ONCE(tx->rate.idx < 0)) 56 return 0; 57 58 sband = local->hw.wiphy->bands[info->band]; 59 txrate = &sband->bitrates[tx->rate.idx]; 60 61 erp = txrate->flags & IEEE80211_RATE_ERP_G; 62 63 /* 64 * data and mgmt (except PS Poll): 65 * - during CFP: 32768 66 * - during contention period: 67 * if addr1 is group address: 0 68 * if more fragments = 0 and addr1 is individual address: time to 69 * transmit one ACK plus SIFS 70 * if more fragments = 1 and addr1 is individual address: time to 71 * transmit next fragment plus 2 x ACK plus 3 x SIFS 72 * 73 * IEEE 802.11, 9.6: 74 * - control response frame (CTS or ACK) shall be transmitted using the 75 * same rate as the immediately previous frame in the frame exchange 76 * sequence, if this rate belongs to the PHY mandatory rates, or else 77 * at the highest possible rate belonging to the PHY rates in the 78 * BSSBasicRateSet 79 */ 80 hdr = (struct ieee80211_hdr *)skb->data; 81 if (ieee80211_is_ctl(hdr->frame_control)) { 82 /* TODO: These control frames are not currently sent by 83 * mac80211, but should they be implemented, this function 84 * needs to be updated to support duration field calculation. 85 * 86 * RTS: time needed to transmit pending data/mgmt frame plus 87 * one CTS frame plus one ACK frame plus 3 x SIFS 88 * CTS: duration of immediately previous RTS minus time 89 * required to transmit CTS and its SIFS 90 * ACK: 0 if immediately previous directed data/mgmt had 91 * more=0, with more=1 duration in ACK frame is duration 92 * from previous frame minus time needed to transmit ACK 93 * and its SIFS 94 * PS Poll: BIT(15) | BIT(14) | aid 95 */ 96 return 0; 97 } 98 99 /* data/mgmt */ 100 if (0 /* FIX: data/mgmt during CFP */) 101 return cpu_to_le16(32768); 102 103 if (group_addr) /* Group address as the destination - no ACK */ 104 return 0; 105 106 /* Individual destination address: 107 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes) 108 * CTS and ACK frames shall be transmitted using the highest rate in 109 * basic rate set that is less than or equal to the rate of the 110 * immediately previous frame and that is using the same modulation 111 * (CCK or OFDM). If no basic rate set matches with these requirements, 112 * the highest mandatory rate of the PHY that is less than or equal to 113 * the rate of the previous frame is used. 114 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps 115 */ 116 rate = -1; 117 /* use lowest available if everything fails */ 118 mrate = sband->bitrates[0].bitrate; 119 for (i = 0; i < sband->n_bitrates; i++) { 120 struct ieee80211_rate *r = &sband->bitrates[i]; 121 122 if (r->bitrate > txrate->bitrate) 123 break; 124 125 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i)) 126 rate = r->bitrate; 127 128 switch (sband->band) { 129 case IEEE80211_BAND_2GHZ: { 130 u32 flag; 131 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) 132 flag = IEEE80211_RATE_MANDATORY_G; 133 else 134 flag = IEEE80211_RATE_MANDATORY_B; 135 if (r->flags & flag) 136 mrate = r->bitrate; 137 break; 138 } 139 case IEEE80211_BAND_5GHZ: 140 if (r->flags & IEEE80211_RATE_MANDATORY_A) 141 mrate = r->bitrate; 142 break; 143 case IEEE80211_BAND_60GHZ: 144 /* TODO, for now fall through */ 145 case IEEE80211_NUM_BANDS: 146 WARN_ON(1); 147 break; 148 } 149 } 150 if (rate == -1) { 151 /* No matching basic rate found; use highest suitable mandatory 152 * PHY rate */ 153 rate = mrate; 154 } 155 156 /* Don't calculate ACKs for QoS Frames with NoAck Policy set */ 157 if (ieee80211_is_data_qos(hdr->frame_control) && 158 *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK) 159 dur = 0; 160 else 161 /* Time needed to transmit ACK 162 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up 163 * to closest integer */ 164 dur = ieee80211_frame_duration(sband->band, 10, rate, erp, 165 tx->sdata->vif.bss_conf.use_short_preamble); 166 167 if (next_frag_len) { 168 /* Frame is fragmented: duration increases with time needed to 169 * transmit next fragment plus ACK and 2 x SIFS. */ 170 dur *= 2; /* ACK + SIFS */ 171 /* next fragment */ 172 dur += ieee80211_frame_duration(sband->band, next_frag_len, 173 txrate->bitrate, erp, 174 tx->sdata->vif.bss_conf.use_short_preamble); 175 } 176 177 return cpu_to_le16(dur); 178 } 179 180 /* tx handlers */ 181 static ieee80211_tx_result debug_noinline 182 ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx) 183 { 184 struct ieee80211_local *local = tx->local; 185 struct ieee80211_if_managed *ifmgd; 186 187 /* driver doesn't support power save */ 188 if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) 189 return TX_CONTINUE; 190 191 /* hardware does dynamic power save */ 192 if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS) 193 return TX_CONTINUE; 194 195 /* dynamic power save disabled */ 196 if (local->hw.conf.dynamic_ps_timeout <= 0) 197 return TX_CONTINUE; 198 199 /* we are scanning, don't enable power save */ 200 if (local->scanning) 201 return TX_CONTINUE; 202 203 if (!local->ps_sdata) 204 return TX_CONTINUE; 205 206 /* No point if we're going to suspend */ 207 if (local->quiescing) 208 return TX_CONTINUE; 209 210 /* dynamic ps is supported only in managed mode */ 211 if (tx->sdata->vif.type != NL80211_IFTYPE_STATION) 212 return TX_CONTINUE; 213 214 ifmgd = &tx->sdata->u.mgd; 215 216 /* 217 * Don't wakeup from power save if u-apsd is enabled, voip ac has 218 * u-apsd enabled and the frame is in voip class. This effectively 219 * means that even if all access categories have u-apsd enabled, in 220 * practise u-apsd is only used with the voip ac. This is a 221 * workaround for the case when received voip class packets do not 222 * have correct qos tag for some reason, due the network or the 223 * peer application. 224 * 225 * Note: ifmgd->uapsd_queues access is racy here. If the value is 226 * changed via debugfs, user needs to reassociate manually to have 227 * everything in sync. 228 */ 229 if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) && 230 (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) && 231 skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO) 232 return TX_CONTINUE; 233 234 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 235 ieee80211_stop_queues_by_reason(&local->hw, 236 IEEE80211_MAX_QUEUE_MAP, 237 IEEE80211_QUEUE_STOP_REASON_PS); 238 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED; 239 ieee80211_queue_work(&local->hw, 240 &local->dynamic_ps_disable_work); 241 } 242 243 /* Don't restart the timer if we're not disassociated */ 244 if (!ifmgd->associated) 245 return TX_CONTINUE; 246 247 mod_timer(&local->dynamic_ps_timer, jiffies + 248 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 249 250 return TX_CONTINUE; 251 } 252 253 static ieee80211_tx_result debug_noinline 254 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx) 255 { 256 257 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 258 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 259 bool assoc = false; 260 261 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) 262 return TX_CONTINUE; 263 264 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) && 265 test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) && 266 !ieee80211_is_probe_req(hdr->frame_control) && 267 !ieee80211_is_nullfunc(hdr->frame_control)) 268 /* 269 * When software scanning only nullfunc frames (to notify 270 * the sleep state to the AP) and probe requests (for the 271 * active scan) are allowed, all other frames should not be 272 * sent and we should not get here, but if we do 273 * nonetheless, drop them to avoid sending them 274 * off-channel. See the link below and 275 * ieee80211_start_scan() for more. 276 * 277 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089 278 */ 279 return TX_DROP; 280 281 if (tx->sdata->vif.type == NL80211_IFTYPE_WDS) 282 return TX_CONTINUE; 283 284 if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 285 return TX_CONTINUE; 286 287 if (tx->flags & IEEE80211_TX_PS_BUFFERED) 288 return TX_CONTINUE; 289 290 if (tx->sta) 291 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC); 292 293 if (likely(tx->flags & IEEE80211_TX_UNICAST)) { 294 if (unlikely(!assoc && 295 ieee80211_is_data(hdr->frame_control))) { 296 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 297 sdata_info(tx->sdata, 298 "dropped data frame to not associated station %pM\n", 299 hdr->addr1); 300 #endif 301 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc); 302 return TX_DROP; 303 } 304 } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP && 305 ieee80211_is_data(hdr->frame_control) && 306 !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) { 307 /* 308 * No associated STAs - no need to send multicast 309 * frames. 310 */ 311 return TX_DROP; 312 } 313 314 return TX_CONTINUE; 315 } 316 317 /* This function is called whenever the AP is about to exceed the maximum limit 318 * of buffered frames for power saving STAs. This situation should not really 319 * happen often during normal operation, so dropping the oldest buffered packet 320 * from each queue should be OK to make some room for new frames. */ 321 static void purge_old_ps_buffers(struct ieee80211_local *local) 322 { 323 int total = 0, purged = 0; 324 struct sk_buff *skb; 325 struct ieee80211_sub_if_data *sdata; 326 struct sta_info *sta; 327 328 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 329 struct ps_data *ps; 330 331 if (sdata->vif.type == NL80211_IFTYPE_AP) 332 ps = &sdata->u.ap.ps; 333 else if (ieee80211_vif_is_mesh(&sdata->vif)) 334 ps = &sdata->u.mesh.ps; 335 else 336 continue; 337 338 skb = skb_dequeue(&ps->bc_buf); 339 if (skb) { 340 purged++; 341 dev_kfree_skb(skb); 342 } 343 total += skb_queue_len(&ps->bc_buf); 344 } 345 346 /* 347 * Drop one frame from each station from the lowest-priority 348 * AC that has frames at all. 349 */ 350 list_for_each_entry_rcu(sta, &local->sta_list, list) { 351 int ac; 352 353 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) { 354 skb = skb_dequeue(&sta->ps_tx_buf[ac]); 355 total += skb_queue_len(&sta->ps_tx_buf[ac]); 356 if (skb) { 357 purged++; 358 ieee80211_free_txskb(&local->hw, skb); 359 break; 360 } 361 } 362 } 363 364 local->total_ps_buffered = total; 365 ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged); 366 } 367 368 static ieee80211_tx_result 369 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) 370 { 371 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 372 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 373 struct ps_data *ps; 374 375 /* 376 * broadcast/multicast frame 377 * 378 * If any of the associated/peer stations is in power save mode, 379 * the frame is buffered to be sent after DTIM beacon frame. 380 * This is done either by the hardware or us. 381 */ 382 383 /* powersaving STAs currently only in AP/VLAN/mesh mode */ 384 if (tx->sdata->vif.type == NL80211_IFTYPE_AP || 385 tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) { 386 if (!tx->sdata->bss) 387 return TX_CONTINUE; 388 389 ps = &tx->sdata->bss->ps; 390 } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) { 391 ps = &tx->sdata->u.mesh.ps; 392 } else { 393 return TX_CONTINUE; 394 } 395 396 397 /* no buffering for ordered frames */ 398 if (ieee80211_has_order(hdr->frame_control)) 399 return TX_CONTINUE; 400 401 /* no stations in PS mode */ 402 if (!atomic_read(&ps->num_sta_ps)) 403 return TX_CONTINUE; 404 405 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM; 406 if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) 407 info->hw_queue = tx->sdata->vif.cab_queue; 408 409 /* device releases frame after DTIM beacon */ 410 if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING)) 411 return TX_CONTINUE; 412 413 /* buffered in mac80211 */ 414 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) 415 purge_old_ps_buffers(tx->local); 416 417 if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) { 418 ps_dbg(tx->sdata, 419 "BC TX buffer full - dropping the oldest frame\n"); 420 dev_kfree_skb(skb_dequeue(&ps->bc_buf)); 421 } else 422 tx->local->total_ps_buffered++; 423 424 skb_queue_tail(&ps->bc_buf, tx->skb); 425 426 return TX_QUEUED; 427 } 428 429 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta, 430 struct sk_buff *skb) 431 { 432 if (!ieee80211_is_mgmt(fc)) 433 return 0; 434 435 if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP)) 436 return 0; 437 438 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) 439 skb->data)) 440 return 0; 441 442 return 1; 443 } 444 445 static ieee80211_tx_result 446 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx) 447 { 448 struct sta_info *sta = tx->sta; 449 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 450 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 451 struct ieee80211_local *local = tx->local; 452 453 if (unlikely(!sta)) 454 return TX_CONTINUE; 455 456 if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) || 457 test_sta_flag(sta, WLAN_STA_PS_DRIVER)) && 458 !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) { 459 int ac = skb_get_queue_mapping(tx->skb); 460 461 /* only deauth, disassoc and action are bufferable MMPDUs */ 462 if (ieee80211_is_mgmt(hdr->frame_control) && 463 !ieee80211_is_deauth(hdr->frame_control) && 464 !ieee80211_is_disassoc(hdr->frame_control) && 465 !ieee80211_is_action(hdr->frame_control)) { 466 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER; 467 return TX_CONTINUE; 468 } 469 470 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n", 471 sta->sta.addr, sta->sta.aid, ac); 472 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) 473 purge_old_ps_buffers(tx->local); 474 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) { 475 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]); 476 ps_dbg(tx->sdata, 477 "STA %pM TX buffer for AC %d full - dropping oldest frame\n", 478 sta->sta.addr, ac); 479 ieee80211_free_txskb(&local->hw, old); 480 } else 481 tx->local->total_ps_buffered++; 482 483 info->control.jiffies = jiffies; 484 info->control.vif = &tx->sdata->vif; 485 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 486 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb); 487 488 if (!timer_pending(&local->sta_cleanup)) 489 mod_timer(&local->sta_cleanup, 490 round_jiffies(jiffies + 491 STA_INFO_CLEANUP_INTERVAL)); 492 493 /* 494 * We queued up some frames, so the TIM bit might 495 * need to be set, recalculate it. 496 */ 497 sta_info_recalc_tim(sta); 498 499 return TX_QUEUED; 500 } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) { 501 ps_dbg(tx->sdata, 502 "STA %pM in PS mode, but polling/in SP -> send frame\n", 503 sta->sta.addr); 504 } 505 506 return TX_CONTINUE; 507 } 508 509 static ieee80211_tx_result debug_noinline 510 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx) 511 { 512 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED)) 513 return TX_CONTINUE; 514 515 if (tx->flags & IEEE80211_TX_UNICAST) 516 return ieee80211_tx_h_unicast_ps_buf(tx); 517 else 518 return ieee80211_tx_h_multicast_ps_buf(tx); 519 } 520 521 static ieee80211_tx_result debug_noinline 522 ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx) 523 { 524 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 525 526 if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol && 527 tx->sdata->control_port_no_encrypt)) 528 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 529 530 return TX_CONTINUE; 531 } 532 533 static ieee80211_tx_result debug_noinline 534 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) 535 { 536 struct ieee80211_key *key; 537 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 538 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 539 540 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) 541 tx->key = NULL; 542 else if (tx->sta && (key = rcu_dereference(tx->sta->ptk))) 543 tx->key = key; 544 else if (ieee80211_is_mgmt(hdr->frame_control) && 545 is_multicast_ether_addr(hdr->addr1) && 546 ieee80211_is_robust_mgmt_frame(hdr) && 547 (key = rcu_dereference(tx->sdata->default_mgmt_key))) 548 tx->key = key; 549 else if (is_multicast_ether_addr(hdr->addr1) && 550 (key = rcu_dereference(tx->sdata->default_multicast_key))) 551 tx->key = key; 552 else if (!is_multicast_ether_addr(hdr->addr1) && 553 (key = rcu_dereference(tx->sdata->default_unicast_key))) 554 tx->key = key; 555 else if (info->flags & IEEE80211_TX_CTL_INJECTED) 556 tx->key = NULL; 557 else if (!tx->sdata->drop_unencrypted) 558 tx->key = NULL; 559 else if (tx->skb->protocol == tx->sdata->control_port_protocol) 560 tx->key = NULL; 561 else if (ieee80211_is_robust_mgmt_frame(hdr) && 562 !(ieee80211_is_action(hdr->frame_control) && 563 tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP))) 564 tx->key = NULL; 565 else if (ieee80211_is_mgmt(hdr->frame_control) && 566 !ieee80211_is_robust_mgmt_frame(hdr)) 567 tx->key = NULL; 568 else { 569 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted); 570 return TX_DROP; 571 } 572 573 if (tx->key) { 574 bool skip_hw = false; 575 576 tx->key->tx_rx_count++; 577 /* TODO: add threshold stuff again */ 578 579 switch (tx->key->conf.cipher) { 580 case WLAN_CIPHER_SUITE_WEP40: 581 case WLAN_CIPHER_SUITE_WEP104: 582 case WLAN_CIPHER_SUITE_TKIP: 583 if (!ieee80211_is_data_present(hdr->frame_control)) 584 tx->key = NULL; 585 break; 586 case WLAN_CIPHER_SUITE_CCMP: 587 if (!ieee80211_is_data_present(hdr->frame_control) && 588 !ieee80211_use_mfp(hdr->frame_control, tx->sta, 589 tx->skb)) 590 tx->key = NULL; 591 else 592 skip_hw = (tx->key->conf.flags & 593 IEEE80211_KEY_FLAG_SW_MGMT_TX) && 594 ieee80211_is_mgmt(hdr->frame_control); 595 break; 596 case WLAN_CIPHER_SUITE_AES_CMAC: 597 if (!ieee80211_is_mgmt(hdr->frame_control)) 598 tx->key = NULL; 599 break; 600 } 601 602 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED && 603 !ieee80211_is_deauth(hdr->frame_control))) 604 return TX_DROP; 605 606 if (!skip_hw && tx->key && 607 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) 608 info->control.hw_key = &tx->key->conf; 609 } 610 611 return TX_CONTINUE; 612 } 613 614 static ieee80211_tx_result debug_noinline 615 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx) 616 { 617 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 618 struct ieee80211_hdr *hdr = (void *)tx->skb->data; 619 struct ieee80211_supported_band *sband; 620 u32 len; 621 struct ieee80211_tx_rate_control txrc; 622 struct ieee80211_sta_rates *ratetbl = NULL; 623 bool assoc = false; 624 625 memset(&txrc, 0, sizeof(txrc)); 626 627 sband = tx->local->hw.wiphy->bands[info->band]; 628 629 len = min_t(u32, tx->skb->len + FCS_LEN, 630 tx->local->hw.wiphy->frag_threshold); 631 632 /* set up the tx rate control struct we give the RC algo */ 633 txrc.hw = &tx->local->hw; 634 txrc.sband = sband; 635 txrc.bss_conf = &tx->sdata->vif.bss_conf; 636 txrc.skb = tx->skb; 637 txrc.reported_rate.idx = -1; 638 txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band]; 639 if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1) 640 txrc.max_rate_idx = -1; 641 else 642 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1; 643 644 if (tx->sdata->rc_has_mcs_mask[info->band]) 645 txrc.rate_idx_mcs_mask = 646 tx->sdata->rc_rateidx_mcs_mask[info->band]; 647 648 txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP || 649 tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT || 650 tx->sdata->vif.type == NL80211_IFTYPE_ADHOC); 651 652 /* set up RTS protection if desired */ 653 if (len > tx->local->hw.wiphy->rts_threshold) { 654 txrc.rts = true; 655 } 656 657 info->control.use_rts = txrc.rts; 658 info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot; 659 660 /* 661 * Use short preamble if the BSS can handle it, but not for 662 * management frames unless we know the receiver can handle 663 * that -- the management frame might be to a station that 664 * just wants a probe response. 665 */ 666 if (tx->sdata->vif.bss_conf.use_short_preamble && 667 (ieee80211_is_data(hdr->frame_control) || 668 (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE)))) 669 txrc.short_preamble = true; 670 671 info->control.short_preamble = txrc.short_preamble; 672 673 if (tx->sta) 674 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC); 675 676 /* 677 * Lets not bother rate control if we're associated and cannot 678 * talk to the sta. This should not happen. 679 */ 680 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc && 681 !rate_usable_index_exists(sband, &tx->sta->sta), 682 "%s: Dropped data frame as no usable bitrate found while " 683 "scanning and associated. Target station: " 684 "%pM on %d GHz band\n", 685 tx->sdata->name, hdr->addr1, 686 info->band ? 5 : 2)) 687 return TX_DROP; 688 689 /* 690 * If we're associated with the sta at this point we know we can at 691 * least send the frame at the lowest bit rate. 692 */ 693 rate_control_get_rate(tx->sdata, tx->sta, &txrc); 694 695 if (tx->sta && !info->control.skip_table) 696 ratetbl = rcu_dereference(tx->sta->sta.rates); 697 698 if (unlikely(info->control.rates[0].idx < 0)) { 699 if (ratetbl) { 700 struct ieee80211_tx_rate rate = { 701 .idx = ratetbl->rate[0].idx, 702 .flags = ratetbl->rate[0].flags, 703 .count = ratetbl->rate[0].count 704 }; 705 706 if (ratetbl->rate[0].idx < 0) 707 return TX_DROP; 708 709 tx->rate = rate; 710 } else { 711 return TX_DROP; 712 } 713 } else { 714 tx->rate = info->control.rates[0]; 715 } 716 717 if (txrc.reported_rate.idx < 0) { 718 txrc.reported_rate = tx->rate; 719 if (tx->sta && ieee80211_is_data(hdr->frame_control)) 720 tx->sta->last_tx_rate = txrc.reported_rate; 721 } else if (tx->sta) 722 tx->sta->last_tx_rate = txrc.reported_rate; 723 724 if (ratetbl) 725 return TX_CONTINUE; 726 727 if (unlikely(!info->control.rates[0].count)) 728 info->control.rates[0].count = 1; 729 730 if (WARN_ON_ONCE((info->control.rates[0].count > 1) && 731 (info->flags & IEEE80211_TX_CTL_NO_ACK))) 732 info->control.rates[0].count = 1; 733 734 return TX_CONTINUE; 735 } 736 737 static ieee80211_tx_result debug_noinline 738 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx) 739 { 740 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 741 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 742 u16 *seq; 743 u8 *qc; 744 int tid; 745 746 /* 747 * Packet injection may want to control the sequence 748 * number, if we have no matching interface then we 749 * neither assign one ourselves nor ask the driver to. 750 */ 751 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR)) 752 return TX_CONTINUE; 753 754 if (unlikely(ieee80211_is_ctl(hdr->frame_control))) 755 return TX_CONTINUE; 756 757 if (ieee80211_hdrlen(hdr->frame_control) < 24) 758 return TX_CONTINUE; 759 760 if (ieee80211_is_qos_nullfunc(hdr->frame_control)) 761 return TX_CONTINUE; 762 763 /* 764 * Anything but QoS data that has a sequence number field 765 * (is long enough) gets a sequence number from the global 766 * counter. 767 */ 768 if (!ieee80211_is_data_qos(hdr->frame_control)) { 769 /* driver should assign sequence number */ 770 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ; 771 /* for pure STA mode without beacons, we can do it */ 772 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number); 773 tx->sdata->sequence_number += 0x10; 774 return TX_CONTINUE; 775 } 776 777 /* 778 * This should be true for injected/management frames only, for 779 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ 780 * above since they are not QoS-data frames. 781 */ 782 if (!tx->sta) 783 return TX_CONTINUE; 784 785 /* include per-STA, per-TID sequence counter */ 786 787 qc = ieee80211_get_qos_ctl(hdr); 788 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 789 seq = &tx->sta->tid_seq[tid]; 790 791 hdr->seq_ctrl = cpu_to_le16(*seq); 792 793 /* Increase the sequence number. */ 794 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ; 795 796 return TX_CONTINUE; 797 } 798 799 static int ieee80211_fragment(struct ieee80211_tx_data *tx, 800 struct sk_buff *skb, int hdrlen, 801 int frag_threshold) 802 { 803 struct ieee80211_local *local = tx->local; 804 struct ieee80211_tx_info *info; 805 struct sk_buff *tmp; 806 int per_fragm = frag_threshold - hdrlen - FCS_LEN; 807 int pos = hdrlen + per_fragm; 808 int rem = skb->len - hdrlen - per_fragm; 809 810 if (WARN_ON(rem < 0)) 811 return -EINVAL; 812 813 /* first fragment was already added to queue by caller */ 814 815 while (rem) { 816 int fraglen = per_fragm; 817 818 if (fraglen > rem) 819 fraglen = rem; 820 rem -= fraglen; 821 tmp = dev_alloc_skb(local->tx_headroom + 822 frag_threshold + 823 IEEE80211_ENCRYPT_HEADROOM + 824 IEEE80211_ENCRYPT_TAILROOM); 825 if (!tmp) 826 return -ENOMEM; 827 828 __skb_queue_tail(&tx->skbs, tmp); 829 830 skb_reserve(tmp, local->tx_headroom + 831 IEEE80211_ENCRYPT_HEADROOM); 832 /* copy control information */ 833 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb)); 834 835 info = IEEE80211_SKB_CB(tmp); 836 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT | 837 IEEE80211_TX_CTL_FIRST_FRAGMENT); 838 839 if (rem) 840 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES; 841 842 skb_copy_queue_mapping(tmp, skb); 843 tmp->priority = skb->priority; 844 tmp->dev = skb->dev; 845 846 /* copy header and data */ 847 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen); 848 memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen); 849 850 pos += fraglen; 851 } 852 853 /* adjust first fragment's length */ 854 skb->len = hdrlen + per_fragm; 855 return 0; 856 } 857 858 static ieee80211_tx_result debug_noinline 859 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx) 860 { 861 struct sk_buff *skb = tx->skb; 862 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 863 struct ieee80211_hdr *hdr = (void *)skb->data; 864 int frag_threshold = tx->local->hw.wiphy->frag_threshold; 865 int hdrlen; 866 int fragnum; 867 868 /* no matter what happens, tx->skb moves to tx->skbs */ 869 __skb_queue_tail(&tx->skbs, skb); 870 tx->skb = NULL; 871 872 if (info->flags & IEEE80211_TX_CTL_DONTFRAG) 873 return TX_CONTINUE; 874 875 if (tx->local->ops->set_frag_threshold) 876 return TX_CONTINUE; 877 878 /* 879 * Warn when submitting a fragmented A-MPDU frame and drop it. 880 * This scenario is handled in ieee80211_tx_prepare but extra 881 * caution taken here as fragmented ampdu may cause Tx stop. 882 */ 883 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU)) 884 return TX_DROP; 885 886 hdrlen = ieee80211_hdrlen(hdr->frame_control); 887 888 /* internal error, why isn't DONTFRAG set? */ 889 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold)) 890 return TX_DROP; 891 892 /* 893 * Now fragment the frame. This will allocate all the fragments and 894 * chain them (using skb as the first fragment) to skb->next. 895 * During transmission, we will remove the successfully transmitted 896 * fragments from this list. When the low-level driver rejects one 897 * of the fragments then we will simply pretend to accept the skb 898 * but store it away as pending. 899 */ 900 if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold)) 901 return TX_DROP; 902 903 /* update duration/seq/flags of fragments */ 904 fragnum = 0; 905 906 skb_queue_walk(&tx->skbs, skb) { 907 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS); 908 909 hdr = (void *)skb->data; 910 info = IEEE80211_SKB_CB(skb); 911 912 if (!skb_queue_is_last(&tx->skbs, skb)) { 913 hdr->frame_control |= morefrags; 914 /* 915 * No multi-rate retries for fragmented frames, that 916 * would completely throw off the NAV at other STAs. 917 */ 918 info->control.rates[1].idx = -1; 919 info->control.rates[2].idx = -1; 920 info->control.rates[3].idx = -1; 921 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4); 922 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE; 923 } else { 924 hdr->frame_control &= ~morefrags; 925 } 926 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG); 927 fragnum++; 928 } 929 930 return TX_CONTINUE; 931 } 932 933 static ieee80211_tx_result debug_noinline 934 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx) 935 { 936 struct sk_buff *skb; 937 int ac = -1; 938 939 if (!tx->sta) 940 return TX_CONTINUE; 941 942 skb_queue_walk(&tx->skbs, skb) { 943 ac = skb_get_queue_mapping(skb); 944 tx->sta->tx_fragments++; 945 tx->sta->tx_bytes[ac] += skb->len; 946 } 947 if (ac >= 0) 948 tx->sta->tx_packets[ac]++; 949 950 return TX_CONTINUE; 951 } 952 953 static ieee80211_tx_result debug_noinline 954 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx) 955 { 956 if (!tx->key) 957 return TX_CONTINUE; 958 959 switch (tx->key->conf.cipher) { 960 case WLAN_CIPHER_SUITE_WEP40: 961 case WLAN_CIPHER_SUITE_WEP104: 962 return ieee80211_crypto_wep_encrypt(tx); 963 case WLAN_CIPHER_SUITE_TKIP: 964 return ieee80211_crypto_tkip_encrypt(tx); 965 case WLAN_CIPHER_SUITE_CCMP: 966 return ieee80211_crypto_ccmp_encrypt(tx); 967 case WLAN_CIPHER_SUITE_AES_CMAC: 968 return ieee80211_crypto_aes_cmac_encrypt(tx); 969 default: 970 return ieee80211_crypto_hw_encrypt(tx); 971 } 972 973 return TX_DROP; 974 } 975 976 static ieee80211_tx_result debug_noinline 977 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx) 978 { 979 struct sk_buff *skb; 980 struct ieee80211_hdr *hdr; 981 int next_len; 982 bool group_addr; 983 984 skb_queue_walk(&tx->skbs, skb) { 985 hdr = (void *) skb->data; 986 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) 987 break; /* must not overwrite AID */ 988 if (!skb_queue_is_last(&tx->skbs, skb)) { 989 struct sk_buff *next = skb_queue_next(&tx->skbs, skb); 990 next_len = next->len; 991 } else 992 next_len = 0; 993 group_addr = is_multicast_ether_addr(hdr->addr1); 994 995 hdr->duration_id = 996 ieee80211_duration(tx, skb, group_addr, next_len); 997 } 998 999 return TX_CONTINUE; 1000 } 1001 1002 /* actual transmit path */ 1003 1004 static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx, 1005 struct sk_buff *skb, 1006 struct ieee80211_tx_info *info, 1007 struct tid_ampdu_tx *tid_tx, 1008 int tid) 1009 { 1010 bool queued = false; 1011 bool reset_agg_timer = false; 1012 struct sk_buff *purge_skb = NULL; 1013 1014 if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) { 1015 info->flags |= IEEE80211_TX_CTL_AMPDU; 1016 reset_agg_timer = true; 1017 } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) { 1018 /* 1019 * nothing -- this aggregation session is being started 1020 * but that might still fail with the driver 1021 */ 1022 } else { 1023 spin_lock(&tx->sta->lock); 1024 /* 1025 * Need to re-check now, because we may get here 1026 * 1027 * 1) in the window during which the setup is actually 1028 * already done, but not marked yet because not all 1029 * packets are spliced over to the driver pending 1030 * queue yet -- if this happened we acquire the lock 1031 * either before or after the splice happens, but 1032 * need to recheck which of these cases happened. 1033 * 1034 * 2) during session teardown, if the OPERATIONAL bit 1035 * was cleared due to the teardown but the pointer 1036 * hasn't been assigned NULL yet (or we loaded it 1037 * before it was assigned) -- in this case it may 1038 * now be NULL which means we should just let the 1039 * packet pass through because splicing the frames 1040 * back is already done. 1041 */ 1042 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid); 1043 1044 if (!tid_tx) { 1045 /* do nothing, let packet pass through */ 1046 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) { 1047 info->flags |= IEEE80211_TX_CTL_AMPDU; 1048 reset_agg_timer = true; 1049 } else { 1050 queued = true; 1051 info->control.vif = &tx->sdata->vif; 1052 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 1053 __skb_queue_tail(&tid_tx->pending, skb); 1054 if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER) 1055 purge_skb = __skb_dequeue(&tid_tx->pending); 1056 } 1057 spin_unlock(&tx->sta->lock); 1058 1059 if (purge_skb) 1060 ieee80211_free_txskb(&tx->local->hw, purge_skb); 1061 } 1062 1063 /* reset session timer */ 1064 if (reset_agg_timer && tid_tx->timeout) 1065 tid_tx->last_tx = jiffies; 1066 1067 return queued; 1068 } 1069 1070 /* 1071 * initialises @tx 1072 */ 1073 static ieee80211_tx_result 1074 ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata, 1075 struct ieee80211_tx_data *tx, 1076 struct sk_buff *skb) 1077 { 1078 struct ieee80211_local *local = sdata->local; 1079 struct ieee80211_hdr *hdr; 1080 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1081 int tid; 1082 u8 *qc; 1083 1084 memset(tx, 0, sizeof(*tx)); 1085 tx->skb = skb; 1086 tx->local = local; 1087 tx->sdata = sdata; 1088 __skb_queue_head_init(&tx->skbs); 1089 1090 /* 1091 * If this flag is set to true anywhere, and we get here, 1092 * we are doing the needed processing, so remove the flag 1093 * now. 1094 */ 1095 info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING; 1096 1097 hdr = (struct ieee80211_hdr *) skb->data; 1098 1099 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) { 1100 tx->sta = rcu_dereference(sdata->u.vlan.sta); 1101 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr) 1102 return TX_DROP; 1103 } else if (info->flags & IEEE80211_TX_CTL_INJECTED || 1104 tx->sdata->control_port_protocol == tx->skb->protocol) { 1105 tx->sta = sta_info_get_bss(sdata, hdr->addr1); 1106 } 1107 if (!tx->sta) 1108 tx->sta = sta_info_get(sdata, hdr->addr1); 1109 1110 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) && 1111 !ieee80211_is_qos_nullfunc(hdr->frame_control) && 1112 (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) && 1113 !(local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) { 1114 struct tid_ampdu_tx *tid_tx; 1115 1116 qc = ieee80211_get_qos_ctl(hdr); 1117 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 1118 1119 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]); 1120 if (tid_tx) { 1121 bool queued; 1122 1123 queued = ieee80211_tx_prep_agg(tx, skb, info, 1124 tid_tx, tid); 1125 1126 if (unlikely(queued)) 1127 return TX_QUEUED; 1128 } 1129 } 1130 1131 if (is_multicast_ether_addr(hdr->addr1)) { 1132 tx->flags &= ~IEEE80211_TX_UNICAST; 1133 info->flags |= IEEE80211_TX_CTL_NO_ACK; 1134 } else 1135 tx->flags |= IEEE80211_TX_UNICAST; 1136 1137 if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) { 1138 if (!(tx->flags & IEEE80211_TX_UNICAST) || 1139 skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold || 1140 info->flags & IEEE80211_TX_CTL_AMPDU) 1141 info->flags |= IEEE80211_TX_CTL_DONTFRAG; 1142 } 1143 1144 if (!tx->sta) 1145 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT; 1146 else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) 1147 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT; 1148 1149 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT; 1150 1151 return TX_CONTINUE; 1152 } 1153 1154 static bool ieee80211_tx_frags(struct ieee80211_local *local, 1155 struct ieee80211_vif *vif, 1156 struct ieee80211_sta *sta, 1157 struct sk_buff_head *skbs, 1158 bool txpending) 1159 { 1160 struct ieee80211_tx_control control; 1161 struct sk_buff *skb, *tmp; 1162 unsigned long flags; 1163 1164 skb_queue_walk_safe(skbs, skb, tmp) { 1165 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1166 int q = info->hw_queue; 1167 1168 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 1169 if (WARN_ON_ONCE(q >= local->hw.queues)) { 1170 __skb_unlink(skb, skbs); 1171 ieee80211_free_txskb(&local->hw, skb); 1172 continue; 1173 } 1174 #endif 1175 1176 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 1177 if (local->queue_stop_reasons[q] || 1178 (!txpending && !skb_queue_empty(&local->pending[q]))) { 1179 if (unlikely(info->flags & 1180 IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) { 1181 if (local->queue_stop_reasons[q] & 1182 ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) { 1183 /* 1184 * Drop off-channel frames if queues 1185 * are stopped for any reason other 1186 * than off-channel operation. Never 1187 * queue them. 1188 */ 1189 spin_unlock_irqrestore( 1190 &local->queue_stop_reason_lock, 1191 flags); 1192 ieee80211_purge_tx_queue(&local->hw, 1193 skbs); 1194 return true; 1195 } 1196 } else { 1197 1198 /* 1199 * Since queue is stopped, queue up frames for 1200 * later transmission from the tx-pending 1201 * tasklet when the queue is woken again. 1202 */ 1203 if (txpending) 1204 skb_queue_splice_init(skbs, 1205 &local->pending[q]); 1206 else 1207 skb_queue_splice_tail_init(skbs, 1208 &local->pending[q]); 1209 1210 spin_unlock_irqrestore(&local->queue_stop_reason_lock, 1211 flags); 1212 return false; 1213 } 1214 } 1215 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); 1216 1217 info->control.vif = vif; 1218 control.sta = sta; 1219 1220 __skb_unlink(skb, skbs); 1221 drv_tx(local, &control, skb); 1222 } 1223 1224 return true; 1225 } 1226 1227 /* 1228 * Returns false if the frame couldn't be transmitted but was queued instead. 1229 */ 1230 static bool __ieee80211_tx(struct ieee80211_local *local, 1231 struct sk_buff_head *skbs, int led_len, 1232 struct sta_info *sta, bool txpending) 1233 { 1234 struct ieee80211_tx_info *info; 1235 struct ieee80211_sub_if_data *sdata; 1236 struct ieee80211_vif *vif; 1237 struct ieee80211_sta *pubsta; 1238 struct sk_buff *skb; 1239 bool result = true; 1240 __le16 fc; 1241 1242 if (WARN_ON(skb_queue_empty(skbs))) 1243 return true; 1244 1245 skb = skb_peek(skbs); 1246 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 1247 info = IEEE80211_SKB_CB(skb); 1248 sdata = vif_to_sdata(info->control.vif); 1249 if (sta && !sta->uploaded) 1250 sta = NULL; 1251 1252 if (sta) 1253 pubsta = &sta->sta; 1254 else 1255 pubsta = NULL; 1256 1257 switch (sdata->vif.type) { 1258 case NL80211_IFTYPE_MONITOR: 1259 sdata = rcu_dereference(local->monitor_sdata); 1260 if (sdata) { 1261 vif = &sdata->vif; 1262 info->hw_queue = 1263 vif->hw_queue[skb_get_queue_mapping(skb)]; 1264 } else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) { 1265 dev_kfree_skb(skb); 1266 return true; 1267 } else 1268 vif = NULL; 1269 break; 1270 case NL80211_IFTYPE_AP_VLAN: 1271 sdata = container_of(sdata->bss, 1272 struct ieee80211_sub_if_data, u.ap); 1273 /* fall through */ 1274 default: 1275 vif = &sdata->vif; 1276 break; 1277 } 1278 1279 result = ieee80211_tx_frags(local, vif, pubsta, skbs, 1280 txpending); 1281 1282 ieee80211_tpt_led_trig_tx(local, fc, led_len); 1283 ieee80211_led_tx(local, 1); 1284 1285 WARN_ON_ONCE(!skb_queue_empty(skbs)); 1286 1287 return result; 1288 } 1289 1290 /* 1291 * Invoke TX handlers, return 0 on success and non-zero if the 1292 * frame was dropped or queued. 1293 */ 1294 static int invoke_tx_handlers(struct ieee80211_tx_data *tx) 1295 { 1296 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 1297 ieee80211_tx_result res = TX_DROP; 1298 1299 #define CALL_TXH(txh) \ 1300 do { \ 1301 res = txh(tx); \ 1302 if (res != TX_CONTINUE) \ 1303 goto txh_done; \ 1304 } while (0) 1305 1306 CALL_TXH(ieee80211_tx_h_dynamic_ps); 1307 CALL_TXH(ieee80211_tx_h_check_assoc); 1308 CALL_TXH(ieee80211_tx_h_ps_buf); 1309 CALL_TXH(ieee80211_tx_h_check_control_port_protocol); 1310 CALL_TXH(ieee80211_tx_h_select_key); 1311 if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)) 1312 CALL_TXH(ieee80211_tx_h_rate_ctrl); 1313 1314 if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) { 1315 __skb_queue_tail(&tx->skbs, tx->skb); 1316 tx->skb = NULL; 1317 goto txh_done; 1318 } 1319 1320 CALL_TXH(ieee80211_tx_h_michael_mic_add); 1321 CALL_TXH(ieee80211_tx_h_sequence); 1322 CALL_TXH(ieee80211_tx_h_fragment); 1323 /* handlers after fragment must be aware of tx info fragmentation! */ 1324 CALL_TXH(ieee80211_tx_h_stats); 1325 CALL_TXH(ieee80211_tx_h_encrypt); 1326 if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)) 1327 CALL_TXH(ieee80211_tx_h_calculate_duration); 1328 #undef CALL_TXH 1329 1330 txh_done: 1331 if (unlikely(res == TX_DROP)) { 1332 I802_DEBUG_INC(tx->local->tx_handlers_drop); 1333 if (tx->skb) 1334 ieee80211_free_txskb(&tx->local->hw, tx->skb); 1335 else 1336 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs); 1337 return -1; 1338 } else if (unlikely(res == TX_QUEUED)) { 1339 I802_DEBUG_INC(tx->local->tx_handlers_queued); 1340 return -1; 1341 } 1342 1343 return 0; 1344 } 1345 1346 /* 1347 * Returns false if the frame couldn't be transmitted but was queued instead. 1348 */ 1349 static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, 1350 struct sk_buff *skb, bool txpending, 1351 enum ieee80211_band band) 1352 { 1353 struct ieee80211_local *local = sdata->local; 1354 struct ieee80211_tx_data tx; 1355 ieee80211_tx_result res_prepare; 1356 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1357 bool result = true; 1358 int led_len; 1359 1360 if (unlikely(skb->len < 10)) { 1361 dev_kfree_skb(skb); 1362 return true; 1363 } 1364 1365 /* initialises tx */ 1366 led_len = skb->len; 1367 res_prepare = ieee80211_tx_prepare(sdata, &tx, skb); 1368 1369 if (unlikely(res_prepare == TX_DROP)) { 1370 ieee80211_free_txskb(&local->hw, skb); 1371 return true; 1372 } else if (unlikely(res_prepare == TX_QUEUED)) { 1373 return true; 1374 } 1375 1376 info->band = band; 1377 1378 /* set up hw_queue value early */ 1379 if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) || 1380 !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)) 1381 info->hw_queue = 1382 sdata->vif.hw_queue[skb_get_queue_mapping(skb)]; 1383 1384 if (!invoke_tx_handlers(&tx)) 1385 result = __ieee80211_tx(local, &tx.skbs, led_len, 1386 tx.sta, txpending); 1387 1388 return result; 1389 } 1390 1391 /* device xmit handlers */ 1392 1393 static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, 1394 struct sk_buff *skb, 1395 int head_need, bool may_encrypt) 1396 { 1397 struct ieee80211_local *local = sdata->local; 1398 int tail_need = 0; 1399 1400 if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) { 1401 tail_need = IEEE80211_ENCRYPT_TAILROOM; 1402 tail_need -= skb_tailroom(skb); 1403 tail_need = max_t(int, tail_need, 0); 1404 } 1405 1406 if (skb_cloned(skb)) 1407 I802_DEBUG_INC(local->tx_expand_skb_head_cloned); 1408 else if (head_need || tail_need) 1409 I802_DEBUG_INC(local->tx_expand_skb_head); 1410 else 1411 return 0; 1412 1413 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) { 1414 wiphy_debug(local->hw.wiphy, 1415 "failed to reallocate TX buffer\n"); 1416 return -ENOMEM; 1417 } 1418 1419 return 0; 1420 } 1421 1422 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb, 1423 enum ieee80211_band band) 1424 { 1425 struct ieee80211_local *local = sdata->local; 1426 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1427 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1428 int headroom; 1429 bool may_encrypt; 1430 1431 may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT); 1432 1433 headroom = local->tx_headroom; 1434 if (may_encrypt) 1435 headroom += IEEE80211_ENCRYPT_HEADROOM; 1436 headroom -= skb_headroom(skb); 1437 headroom = max_t(int, 0, headroom); 1438 1439 if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) { 1440 ieee80211_free_txskb(&local->hw, skb); 1441 return; 1442 } 1443 1444 hdr = (struct ieee80211_hdr *) skb->data; 1445 info->control.vif = &sdata->vif; 1446 1447 if (ieee80211_vif_is_mesh(&sdata->vif)) { 1448 if (ieee80211_is_data(hdr->frame_control) && 1449 is_unicast_ether_addr(hdr->addr1)) { 1450 if (mesh_nexthop_resolve(sdata, skb)) 1451 return; /* skb queued: don't free */ 1452 } else { 1453 ieee80211_mps_set_frame_flags(sdata, NULL, hdr); 1454 } 1455 } 1456 1457 ieee80211_set_qos_hdr(sdata, skb); 1458 ieee80211_tx(sdata, skb, false, band); 1459 } 1460 1461 static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb) 1462 { 1463 struct ieee80211_radiotap_iterator iterator; 1464 struct ieee80211_radiotap_header *rthdr = 1465 (struct ieee80211_radiotap_header *) skb->data; 1466 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1467 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len, 1468 NULL); 1469 u16 txflags; 1470 1471 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT | 1472 IEEE80211_TX_CTL_DONTFRAG; 1473 1474 /* 1475 * for every radiotap entry that is present 1476 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more 1477 * entries present, or -EINVAL on error) 1478 */ 1479 1480 while (!ret) { 1481 ret = ieee80211_radiotap_iterator_next(&iterator); 1482 1483 if (ret) 1484 continue; 1485 1486 /* see if this argument is something we can use */ 1487 switch (iterator.this_arg_index) { 1488 /* 1489 * You must take care when dereferencing iterator.this_arg 1490 * for multibyte types... the pointer is not aligned. Use 1491 * get_unaligned((type *)iterator.this_arg) to dereference 1492 * iterator.this_arg for type "type" safely on all arches. 1493 */ 1494 case IEEE80211_RADIOTAP_FLAGS: 1495 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) { 1496 /* 1497 * this indicates that the skb we have been 1498 * handed has the 32-bit FCS CRC at the end... 1499 * we should react to that by snipping it off 1500 * because it will be recomputed and added 1501 * on transmission 1502 */ 1503 if (skb->len < (iterator._max_length + FCS_LEN)) 1504 return false; 1505 1506 skb_trim(skb, skb->len - FCS_LEN); 1507 } 1508 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP) 1509 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT; 1510 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG) 1511 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG; 1512 break; 1513 1514 case IEEE80211_RADIOTAP_TX_FLAGS: 1515 txflags = get_unaligned_le16(iterator.this_arg); 1516 if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK) 1517 info->flags |= IEEE80211_TX_CTL_NO_ACK; 1518 break; 1519 1520 /* 1521 * Please update the file 1522 * Documentation/networking/mac80211-injection.txt 1523 * when parsing new fields here. 1524 */ 1525 1526 default: 1527 break; 1528 } 1529 } 1530 1531 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */ 1532 return false; 1533 1534 /* 1535 * remove the radiotap header 1536 * iterator->_max_length was sanity-checked against 1537 * skb->len by iterator init 1538 */ 1539 skb_pull(skb, iterator._max_length); 1540 1541 return true; 1542 } 1543 1544 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb, 1545 struct net_device *dev) 1546 { 1547 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); 1548 struct ieee80211_chanctx_conf *chanctx_conf; 1549 struct ieee80211_channel *chan; 1550 struct ieee80211_radiotap_header *prthdr = 1551 (struct ieee80211_radiotap_header *)skb->data; 1552 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1553 struct ieee80211_hdr *hdr; 1554 struct ieee80211_sub_if_data *tmp_sdata, *sdata; 1555 u16 len_rthdr; 1556 int hdrlen; 1557 1558 /* check for not even having the fixed radiotap header part */ 1559 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header))) 1560 goto fail; /* too short to be possibly valid */ 1561 1562 /* is it a header version we can trust to find length from? */ 1563 if (unlikely(prthdr->it_version)) 1564 goto fail; /* only version 0 is supported */ 1565 1566 /* then there must be a radiotap header with a length we can use */ 1567 len_rthdr = ieee80211_get_radiotap_len(skb->data); 1568 1569 /* does the skb contain enough to deliver on the alleged length? */ 1570 if (unlikely(skb->len < len_rthdr)) 1571 goto fail; /* skb too short for claimed rt header extent */ 1572 1573 /* 1574 * fix up the pointers accounting for the radiotap 1575 * header still being in there. We are being given 1576 * a precooked IEEE80211 header so no need for 1577 * normal processing 1578 */ 1579 skb_set_mac_header(skb, len_rthdr); 1580 /* 1581 * these are just fixed to the end of the rt area since we 1582 * don't have any better information and at this point, nobody cares 1583 */ 1584 skb_set_network_header(skb, len_rthdr); 1585 skb_set_transport_header(skb, len_rthdr); 1586 1587 if (skb->len < len_rthdr + 2) 1588 goto fail; 1589 1590 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr); 1591 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1592 1593 if (skb->len < len_rthdr + hdrlen) 1594 goto fail; 1595 1596 /* 1597 * Initialize skb->protocol if the injected frame is a data frame 1598 * carrying a rfc1042 header 1599 */ 1600 if (ieee80211_is_data(hdr->frame_control) && 1601 skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) { 1602 u8 *payload = (u8 *)hdr + hdrlen; 1603 1604 if (ether_addr_equal(payload, rfc1042_header)) 1605 skb->protocol = cpu_to_be16((payload[6] << 8) | 1606 payload[7]); 1607 } 1608 1609 memset(info, 0, sizeof(*info)); 1610 1611 info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS | 1612 IEEE80211_TX_CTL_INJECTED; 1613 1614 /* process and remove the injection radiotap header */ 1615 if (!ieee80211_parse_tx_radiotap(skb)) 1616 goto fail; 1617 1618 rcu_read_lock(); 1619 1620 /* 1621 * We process outgoing injected frames that have a local address 1622 * we handle as though they are non-injected frames. 1623 * This code here isn't entirely correct, the local MAC address 1624 * isn't always enough to find the interface to use; for proper 1625 * VLAN/WDS support we will need a different mechanism (which 1626 * likely isn't going to be monitor interfaces). 1627 */ 1628 sdata = IEEE80211_DEV_TO_SUB_IF(dev); 1629 1630 list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) { 1631 if (!ieee80211_sdata_running(tmp_sdata)) 1632 continue; 1633 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR || 1634 tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN || 1635 tmp_sdata->vif.type == NL80211_IFTYPE_WDS) 1636 continue; 1637 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) { 1638 sdata = tmp_sdata; 1639 break; 1640 } 1641 } 1642 1643 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 1644 if (!chanctx_conf) { 1645 tmp_sdata = rcu_dereference(local->monitor_sdata); 1646 if (tmp_sdata) 1647 chanctx_conf = 1648 rcu_dereference(tmp_sdata->vif.chanctx_conf); 1649 } 1650 1651 if (chanctx_conf) 1652 chan = chanctx_conf->def.chan; 1653 else if (!local->use_chanctx) 1654 chan = local->_oper_chandef.chan; 1655 else 1656 goto fail_rcu; 1657 1658 /* 1659 * Frame injection is not allowed if beaconing is not allowed 1660 * or if we need radar detection. Beaconing is usually not allowed when 1661 * the mode or operation (Adhoc, AP, Mesh) does not support DFS. 1662 * Passive scan is also used in world regulatory domains where 1663 * your country is not known and as such it should be treated as 1664 * NO TX unless the channel is explicitly allowed in which case 1665 * your current regulatory domain would not have the passive scan 1666 * flag. 1667 * 1668 * Since AP mode uses monitor interfaces to inject/TX management 1669 * frames we can make AP mode the exception to this rule once it 1670 * supports radar detection as its implementation can deal with 1671 * radar detection by itself. We can do that later by adding a 1672 * monitor flag interfaces used for AP support. 1673 */ 1674 if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR | 1675 IEEE80211_CHAN_PASSIVE_SCAN))) 1676 goto fail_rcu; 1677 1678 ieee80211_xmit(sdata, skb, chan->band); 1679 rcu_read_unlock(); 1680 1681 return NETDEV_TX_OK; 1682 1683 fail_rcu: 1684 rcu_read_unlock(); 1685 fail: 1686 dev_kfree_skb(skb); 1687 return NETDEV_TX_OK; /* meaning, we dealt with the skb */ 1688 } 1689 1690 /** 1691 * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type 1692 * subinterfaces (wlan#, WDS, and VLAN interfaces) 1693 * @skb: packet to be sent 1694 * @dev: incoming interface 1695 * 1696 * Returns: 0 on success (and frees skb in this case) or 1 on failure (skb will 1697 * not be freed, and caller is responsible for either retrying later or freeing 1698 * skb). 1699 * 1700 * This function takes in an Ethernet header and encapsulates it with suitable 1701 * IEEE 802.11 header based on which interface the packet is coming in. The 1702 * encapsulated packet will then be passed to master interface, wlan#.11, for 1703 * transmission (through low-level driver). 1704 */ 1705 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb, 1706 struct net_device *dev) 1707 { 1708 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); 1709 struct ieee80211_local *local = sdata->local; 1710 struct ieee80211_tx_info *info; 1711 int head_need; 1712 u16 ethertype, hdrlen, meshhdrlen = 0; 1713 __le16 fc; 1714 struct ieee80211_hdr hdr; 1715 struct ieee80211s_hdr mesh_hdr __maybe_unused; 1716 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL; 1717 const u8 *encaps_data; 1718 int encaps_len, skip_header_bytes; 1719 int nh_pos, h_pos; 1720 struct sta_info *sta = NULL; 1721 bool wme_sta = false, authorized = false, tdls_auth = false; 1722 bool tdls_direct = false; 1723 bool multicast; 1724 u32 info_flags = 0; 1725 u16 info_id = 0; 1726 struct ieee80211_chanctx_conf *chanctx_conf; 1727 struct ieee80211_sub_if_data *ap_sdata; 1728 enum ieee80211_band band; 1729 1730 if (unlikely(skb->len < ETH_HLEN)) 1731 goto fail; 1732 1733 /* convert Ethernet header to proper 802.11 header (based on 1734 * operation mode) */ 1735 ethertype = (skb->data[12] << 8) | skb->data[13]; 1736 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA); 1737 1738 rcu_read_lock(); 1739 1740 switch (sdata->vif.type) { 1741 case NL80211_IFTYPE_AP_VLAN: 1742 sta = rcu_dereference(sdata->u.vlan.sta); 1743 if (sta) { 1744 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); 1745 /* RA TA DA SA */ 1746 memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN); 1747 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN); 1748 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1749 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN); 1750 hdrlen = 30; 1751 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED); 1752 wme_sta = test_sta_flag(sta, WLAN_STA_WME); 1753 } 1754 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 1755 u.ap); 1756 chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf); 1757 if (!chanctx_conf) 1758 goto fail_rcu; 1759 band = chanctx_conf->def.chan->band; 1760 if (sta) 1761 break; 1762 /* fall through */ 1763 case NL80211_IFTYPE_AP: 1764 if (sdata->vif.type == NL80211_IFTYPE_AP) 1765 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 1766 if (!chanctx_conf) 1767 goto fail_rcu; 1768 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS); 1769 /* DA BSSID SA */ 1770 memcpy(hdr.addr1, skb->data, ETH_ALEN); 1771 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN); 1772 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN); 1773 hdrlen = 24; 1774 band = chanctx_conf->def.chan->band; 1775 break; 1776 case NL80211_IFTYPE_WDS: 1777 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); 1778 /* RA TA DA SA */ 1779 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN); 1780 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN); 1781 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1782 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN); 1783 hdrlen = 30; 1784 /* 1785 * This is the exception! WDS style interfaces are prohibited 1786 * when channel contexts are in used so this must be valid 1787 */ 1788 band = local->hw.conf.chandef.chan->band; 1789 break; 1790 #ifdef CONFIG_MAC80211_MESH 1791 case NL80211_IFTYPE_MESH_POINT: 1792 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) { 1793 /* Do not send frames with mesh_ttl == 0 */ 1794 sdata->u.mesh.mshstats.dropped_frames_ttl++; 1795 goto fail_rcu; 1796 } 1797 1798 if (!is_multicast_ether_addr(skb->data)) { 1799 struct sta_info *next_hop; 1800 bool mpp_lookup = true; 1801 1802 mpath = mesh_path_lookup(sdata, skb->data); 1803 if (mpath) { 1804 mpp_lookup = false; 1805 next_hop = rcu_dereference(mpath->next_hop); 1806 if (!next_hop || 1807 !(mpath->flags & (MESH_PATH_ACTIVE | 1808 MESH_PATH_RESOLVING))) 1809 mpp_lookup = true; 1810 } 1811 1812 if (mpp_lookup) 1813 mppath = mpp_path_lookup(sdata, skb->data); 1814 1815 if (mppath && mpath) 1816 mesh_path_del(mpath->sdata, mpath->dst); 1817 } 1818 1819 /* 1820 * Use address extension if it is a packet from 1821 * another interface or if we know the destination 1822 * is being proxied by a portal (i.e. portal address 1823 * differs from proxied address) 1824 */ 1825 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) && 1826 !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) { 1827 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc, 1828 skb->data, skb->data + ETH_ALEN); 1829 meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr, 1830 NULL, NULL); 1831 } else { 1832 /* DS -> MBSS (802.11-2012 13.11.3.3). 1833 * For unicast with unknown forwarding information, 1834 * destination might be in the MBSS or if that fails 1835 * forwarded to another mesh gate. In either case 1836 * resolution will be handled in ieee80211_xmit(), so 1837 * leave the original DA. This also works for mcast */ 1838 const u8 *mesh_da = skb->data; 1839 1840 if (mppath) 1841 mesh_da = mppath->mpp; 1842 else if (mpath) 1843 mesh_da = mpath->dst; 1844 1845 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc, 1846 mesh_da, sdata->vif.addr); 1847 if (is_multicast_ether_addr(mesh_da)) 1848 /* DA TA mSA AE:SA */ 1849 meshhdrlen = ieee80211_new_mesh_header( 1850 sdata, &mesh_hdr, 1851 skb->data + ETH_ALEN, NULL); 1852 else 1853 /* RA TA mDA mSA AE:DA SA */ 1854 meshhdrlen = ieee80211_new_mesh_header( 1855 sdata, &mesh_hdr, skb->data, 1856 skb->data + ETH_ALEN); 1857 1858 } 1859 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 1860 if (!chanctx_conf) 1861 goto fail_rcu; 1862 band = chanctx_conf->def.chan->band; 1863 break; 1864 #endif 1865 case NL80211_IFTYPE_STATION: 1866 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1867 bool tdls_peer = false; 1868 1869 sta = sta_info_get(sdata, skb->data); 1870 if (sta) { 1871 authorized = test_sta_flag(sta, 1872 WLAN_STA_AUTHORIZED); 1873 wme_sta = test_sta_flag(sta, WLAN_STA_WME); 1874 tdls_peer = test_sta_flag(sta, 1875 WLAN_STA_TDLS_PEER); 1876 tdls_auth = test_sta_flag(sta, 1877 WLAN_STA_TDLS_PEER_AUTH); 1878 } 1879 1880 /* 1881 * If the TDLS link is enabled, send everything 1882 * directly. Otherwise, allow TDLS setup frames 1883 * to be transmitted indirectly. 1884 */ 1885 tdls_direct = tdls_peer && (tdls_auth || 1886 !(ethertype == ETH_P_TDLS && skb->len > 14 && 1887 skb->data[14] == WLAN_TDLS_SNAP_RFTYPE)); 1888 } 1889 1890 if (tdls_direct) { 1891 /* link during setup - throw out frames to peer */ 1892 if (!tdls_auth) 1893 goto fail_rcu; 1894 1895 /* DA SA BSSID */ 1896 memcpy(hdr.addr1, skb->data, ETH_ALEN); 1897 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN); 1898 memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN); 1899 hdrlen = 24; 1900 } else if (sdata->u.mgd.use_4addr && 1901 cpu_to_be16(ethertype) != sdata->control_port_protocol) { 1902 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | 1903 IEEE80211_FCTL_TODS); 1904 /* RA TA DA SA */ 1905 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN); 1906 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN); 1907 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1908 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN); 1909 hdrlen = 30; 1910 } else { 1911 fc |= cpu_to_le16(IEEE80211_FCTL_TODS); 1912 /* BSSID SA DA */ 1913 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN); 1914 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN); 1915 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1916 hdrlen = 24; 1917 } 1918 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 1919 if (!chanctx_conf) 1920 goto fail_rcu; 1921 band = chanctx_conf->def.chan->band; 1922 break; 1923 case NL80211_IFTYPE_ADHOC: 1924 /* DA SA BSSID */ 1925 memcpy(hdr.addr1, skb->data, ETH_ALEN); 1926 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN); 1927 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN); 1928 hdrlen = 24; 1929 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 1930 if (!chanctx_conf) 1931 goto fail_rcu; 1932 band = chanctx_conf->def.chan->band; 1933 break; 1934 default: 1935 goto fail_rcu; 1936 } 1937 1938 /* 1939 * There's no need to try to look up the destination 1940 * if it is a multicast address (which can only happen 1941 * in AP mode) 1942 */ 1943 multicast = is_multicast_ether_addr(hdr.addr1); 1944 if (!multicast) { 1945 sta = sta_info_get(sdata, hdr.addr1); 1946 if (sta) { 1947 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED); 1948 wme_sta = test_sta_flag(sta, WLAN_STA_WME); 1949 } 1950 } 1951 1952 /* For mesh, the use of the QoS header is mandatory */ 1953 if (ieee80211_vif_is_mesh(&sdata->vif)) 1954 wme_sta = true; 1955 1956 /* receiver and we are QoS enabled, use a QoS type frame */ 1957 if (wme_sta && local->hw.queues >= IEEE80211_NUM_ACS) { 1958 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA); 1959 hdrlen += 2; 1960 } 1961 1962 /* 1963 * Drop unicast frames to unauthorised stations unless they are 1964 * EAPOL frames from the local station. 1965 */ 1966 if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) && 1967 !is_multicast_ether_addr(hdr.addr1) && !authorized && 1968 (cpu_to_be16(ethertype) != sdata->control_port_protocol || 1969 !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) { 1970 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 1971 net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n", 1972 dev->name, hdr.addr1); 1973 #endif 1974 1975 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port); 1976 1977 goto fail_rcu; 1978 } 1979 1980 if (unlikely(!multicast && skb->sk && 1981 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) { 1982 struct sk_buff *orig_skb = skb; 1983 1984 skb = skb_clone(skb, GFP_ATOMIC); 1985 if (skb) { 1986 unsigned long flags; 1987 int id; 1988 1989 spin_lock_irqsave(&local->ack_status_lock, flags); 1990 id = idr_alloc(&local->ack_status_frames, orig_skb, 1991 1, 0x10000, GFP_ATOMIC); 1992 spin_unlock_irqrestore(&local->ack_status_lock, flags); 1993 1994 if (id >= 0) { 1995 info_id = id; 1996 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS; 1997 } else if (skb_shared(skb)) { 1998 kfree_skb(orig_skb); 1999 } else { 2000 kfree_skb(skb); 2001 skb = orig_skb; 2002 } 2003 } else { 2004 /* couldn't clone -- lose tx status ... */ 2005 skb = orig_skb; 2006 } 2007 } 2008 2009 /* 2010 * If the skb is shared we need to obtain our own copy. 2011 */ 2012 if (skb_shared(skb)) { 2013 struct sk_buff *tmp_skb = skb; 2014 2015 /* can't happen -- skb is a clone if info_id != 0 */ 2016 WARN_ON(info_id); 2017 2018 skb = skb_clone(skb, GFP_ATOMIC); 2019 kfree_skb(tmp_skb); 2020 2021 if (!skb) 2022 goto fail_rcu; 2023 } 2024 2025 hdr.frame_control = fc; 2026 hdr.duration_id = 0; 2027 hdr.seq_ctrl = 0; 2028 2029 skip_header_bytes = ETH_HLEN; 2030 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) { 2031 encaps_data = bridge_tunnel_header; 2032 encaps_len = sizeof(bridge_tunnel_header); 2033 skip_header_bytes -= 2; 2034 } else if (ethertype >= ETH_P_802_3_MIN) { 2035 encaps_data = rfc1042_header; 2036 encaps_len = sizeof(rfc1042_header); 2037 skip_header_bytes -= 2; 2038 } else { 2039 encaps_data = NULL; 2040 encaps_len = 0; 2041 } 2042 2043 nh_pos = skb_network_header(skb) - skb->data; 2044 h_pos = skb_transport_header(skb) - skb->data; 2045 2046 skb_pull(skb, skip_header_bytes); 2047 nh_pos -= skip_header_bytes; 2048 h_pos -= skip_header_bytes; 2049 2050 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb); 2051 2052 /* 2053 * So we need to modify the skb header and hence need a copy of 2054 * that. The head_need variable above doesn't, so far, include 2055 * the needed header space that we don't need right away. If we 2056 * can, then we don't reallocate right now but only after the 2057 * frame arrives at the master device (if it does...) 2058 * 2059 * If we cannot, however, then we will reallocate to include all 2060 * the ever needed space. Also, if we need to reallocate it anyway, 2061 * make it big enough for everything we may ever need. 2062 */ 2063 2064 if (head_need > 0 || skb_cloned(skb)) { 2065 head_need += IEEE80211_ENCRYPT_HEADROOM; 2066 head_need += local->tx_headroom; 2067 head_need = max_t(int, 0, head_need); 2068 if (ieee80211_skb_resize(sdata, skb, head_need, true)) { 2069 ieee80211_free_txskb(&local->hw, skb); 2070 skb = NULL; 2071 goto fail_rcu; 2072 } 2073 } 2074 2075 if (encaps_data) { 2076 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len); 2077 nh_pos += encaps_len; 2078 h_pos += encaps_len; 2079 } 2080 2081 #ifdef CONFIG_MAC80211_MESH 2082 if (meshhdrlen > 0) { 2083 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen); 2084 nh_pos += meshhdrlen; 2085 h_pos += meshhdrlen; 2086 } 2087 #endif 2088 2089 if (ieee80211_is_data_qos(fc)) { 2090 __le16 *qos_control; 2091 2092 qos_control = (__le16*) skb_push(skb, 2); 2093 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2); 2094 /* 2095 * Maybe we could actually set some fields here, for now just 2096 * initialise to zero to indicate no special operation. 2097 */ 2098 *qos_control = 0; 2099 } else 2100 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen); 2101 2102 nh_pos += hdrlen; 2103 h_pos += hdrlen; 2104 2105 dev->stats.tx_packets++; 2106 dev->stats.tx_bytes += skb->len; 2107 2108 /* Update skb pointers to various headers since this modified frame 2109 * is going to go through Linux networking code that may potentially 2110 * need things like pointer to IP header. */ 2111 skb_set_mac_header(skb, 0); 2112 skb_set_network_header(skb, nh_pos); 2113 skb_set_transport_header(skb, h_pos); 2114 2115 info = IEEE80211_SKB_CB(skb); 2116 memset(info, 0, sizeof(*info)); 2117 2118 dev->trans_start = jiffies; 2119 2120 info->flags = info_flags; 2121 info->ack_frame_id = info_id; 2122 2123 ieee80211_xmit(sdata, skb, band); 2124 rcu_read_unlock(); 2125 2126 return NETDEV_TX_OK; 2127 2128 fail_rcu: 2129 rcu_read_unlock(); 2130 fail: 2131 dev_kfree_skb(skb); 2132 return NETDEV_TX_OK; 2133 } 2134 2135 2136 /* 2137 * ieee80211_clear_tx_pending may not be called in a context where 2138 * it is possible that it packets could come in again. 2139 */ 2140 void ieee80211_clear_tx_pending(struct ieee80211_local *local) 2141 { 2142 struct sk_buff *skb; 2143 int i; 2144 2145 for (i = 0; i < local->hw.queues; i++) { 2146 while ((skb = skb_dequeue(&local->pending[i])) != NULL) 2147 ieee80211_free_txskb(&local->hw, skb); 2148 } 2149 } 2150 2151 /* 2152 * Returns false if the frame couldn't be transmitted but was queued instead, 2153 * which in this case means re-queued -- take as an indication to stop sending 2154 * more pending frames. 2155 */ 2156 static bool ieee80211_tx_pending_skb(struct ieee80211_local *local, 2157 struct sk_buff *skb) 2158 { 2159 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 2160 struct ieee80211_sub_if_data *sdata; 2161 struct sta_info *sta; 2162 struct ieee80211_hdr *hdr; 2163 bool result; 2164 struct ieee80211_chanctx_conf *chanctx_conf; 2165 2166 sdata = vif_to_sdata(info->control.vif); 2167 2168 if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) { 2169 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 2170 if (unlikely(!chanctx_conf)) { 2171 dev_kfree_skb(skb); 2172 return true; 2173 } 2174 result = ieee80211_tx(sdata, skb, true, 2175 chanctx_conf->def.chan->band); 2176 } else { 2177 struct sk_buff_head skbs; 2178 2179 __skb_queue_head_init(&skbs); 2180 __skb_queue_tail(&skbs, skb); 2181 2182 hdr = (struct ieee80211_hdr *)skb->data; 2183 sta = sta_info_get(sdata, hdr->addr1); 2184 2185 result = __ieee80211_tx(local, &skbs, skb->len, sta, true); 2186 } 2187 2188 return result; 2189 } 2190 2191 /* 2192 * Transmit all pending packets. Called from tasklet. 2193 */ 2194 void ieee80211_tx_pending(unsigned long data) 2195 { 2196 struct ieee80211_local *local = (struct ieee80211_local *)data; 2197 unsigned long flags; 2198 int i; 2199 bool txok; 2200 2201 rcu_read_lock(); 2202 2203 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 2204 for (i = 0; i < local->hw.queues; i++) { 2205 /* 2206 * If queue is stopped by something other than due to pending 2207 * frames, or we have no pending frames, proceed to next queue. 2208 */ 2209 if (local->queue_stop_reasons[i] || 2210 skb_queue_empty(&local->pending[i])) 2211 continue; 2212 2213 while (!skb_queue_empty(&local->pending[i])) { 2214 struct sk_buff *skb = __skb_dequeue(&local->pending[i]); 2215 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 2216 2217 if (WARN_ON(!info->control.vif)) { 2218 ieee80211_free_txskb(&local->hw, skb); 2219 continue; 2220 } 2221 2222 spin_unlock_irqrestore(&local->queue_stop_reason_lock, 2223 flags); 2224 2225 txok = ieee80211_tx_pending_skb(local, skb); 2226 spin_lock_irqsave(&local->queue_stop_reason_lock, 2227 flags); 2228 if (!txok) 2229 break; 2230 } 2231 2232 if (skb_queue_empty(&local->pending[i])) 2233 ieee80211_propagate_queue_wake(local, i); 2234 } 2235 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); 2236 2237 rcu_read_unlock(); 2238 } 2239 2240 /* functions for drivers to get certain frames */ 2241 2242 static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata, 2243 struct ps_data *ps, struct sk_buff *skb) 2244 { 2245 u8 *pos, *tim; 2246 int aid0 = 0; 2247 int i, have_bits = 0, n1, n2; 2248 2249 /* Generate bitmap for TIM only if there are any STAs in power save 2250 * mode. */ 2251 if (atomic_read(&ps->num_sta_ps) > 0) 2252 /* in the hope that this is faster than 2253 * checking byte-for-byte */ 2254 have_bits = !bitmap_empty((unsigned long*)ps->tim, 2255 IEEE80211_MAX_AID+1); 2256 2257 if (ps->dtim_count == 0) 2258 ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1; 2259 else 2260 ps->dtim_count--; 2261 2262 tim = pos = (u8 *) skb_put(skb, 6); 2263 *pos++ = WLAN_EID_TIM; 2264 *pos++ = 4; 2265 *pos++ = ps->dtim_count; 2266 *pos++ = sdata->vif.bss_conf.dtim_period; 2267 2268 if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf)) 2269 aid0 = 1; 2270 2271 ps->dtim_bc_mc = aid0 == 1; 2272 2273 if (have_bits) { 2274 /* Find largest even number N1 so that bits numbered 1 through 2275 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits 2276 * (N2 + 1) x 8 through 2007 are 0. */ 2277 n1 = 0; 2278 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) { 2279 if (ps->tim[i]) { 2280 n1 = i & 0xfe; 2281 break; 2282 } 2283 } 2284 n2 = n1; 2285 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) { 2286 if (ps->tim[i]) { 2287 n2 = i; 2288 break; 2289 } 2290 } 2291 2292 /* Bitmap control */ 2293 *pos++ = n1 | aid0; 2294 /* Part Virt Bitmap */ 2295 skb_put(skb, n2 - n1); 2296 memcpy(pos, ps->tim + n1, n2 - n1 + 1); 2297 2298 tim[1] = n2 - n1 + 4; 2299 } else { 2300 *pos++ = aid0; /* Bitmap control */ 2301 *pos++ = 0; /* Part Virt Bitmap */ 2302 } 2303 } 2304 2305 static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata, 2306 struct ps_data *ps, struct sk_buff *skb) 2307 { 2308 struct ieee80211_local *local = sdata->local; 2309 2310 /* 2311 * Not very nice, but we want to allow the driver to call 2312 * ieee80211_beacon_get() as a response to the set_tim() 2313 * callback. That, however, is already invoked under the 2314 * sta_lock to guarantee consistent and race-free update 2315 * of the tim bitmap in mac80211 and the driver. 2316 */ 2317 if (local->tim_in_locked_section) { 2318 __ieee80211_beacon_add_tim(sdata, ps, skb); 2319 } else { 2320 spin_lock_bh(&local->tim_lock); 2321 __ieee80211_beacon_add_tim(sdata, ps, skb); 2322 spin_unlock_bh(&local->tim_lock); 2323 } 2324 2325 return 0; 2326 } 2327 2328 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw, 2329 struct ieee80211_vif *vif, 2330 u16 *tim_offset, u16 *tim_length) 2331 { 2332 struct ieee80211_local *local = hw_to_local(hw); 2333 struct sk_buff *skb = NULL; 2334 struct ieee80211_tx_info *info; 2335 struct ieee80211_sub_if_data *sdata = NULL; 2336 enum ieee80211_band band; 2337 struct ieee80211_tx_rate_control txrc; 2338 struct ieee80211_chanctx_conf *chanctx_conf; 2339 2340 rcu_read_lock(); 2341 2342 sdata = vif_to_sdata(vif); 2343 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 2344 2345 if (!ieee80211_sdata_running(sdata) || !chanctx_conf) 2346 goto out; 2347 2348 if (tim_offset) 2349 *tim_offset = 0; 2350 if (tim_length) 2351 *tim_length = 0; 2352 2353 if (sdata->vif.type == NL80211_IFTYPE_AP) { 2354 struct ieee80211_if_ap *ap = &sdata->u.ap; 2355 struct beacon_data *beacon = rcu_dereference(ap->beacon); 2356 2357 if (beacon) { 2358 /* 2359 * headroom, head length, 2360 * tail length and maximum TIM length 2361 */ 2362 skb = dev_alloc_skb(local->tx_headroom + 2363 beacon->head_len + 2364 beacon->tail_len + 256); 2365 if (!skb) 2366 goto out; 2367 2368 skb_reserve(skb, local->tx_headroom); 2369 memcpy(skb_put(skb, beacon->head_len), beacon->head, 2370 beacon->head_len); 2371 2372 ieee80211_beacon_add_tim(sdata, &ap->ps, skb); 2373 2374 if (tim_offset) 2375 *tim_offset = beacon->head_len; 2376 if (tim_length) 2377 *tim_length = skb->len - beacon->head_len; 2378 2379 if (beacon->tail) 2380 memcpy(skb_put(skb, beacon->tail_len), 2381 beacon->tail, beacon->tail_len); 2382 } else 2383 goto out; 2384 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) { 2385 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss; 2386 struct ieee80211_hdr *hdr; 2387 struct beacon_data *presp = rcu_dereference(ifibss->presp); 2388 2389 if (!presp) 2390 goto out; 2391 2392 skb = dev_alloc_skb(local->tx_headroom + presp->head_len); 2393 if (!skb) 2394 goto out; 2395 skb_reserve(skb, local->tx_headroom); 2396 memcpy(skb_put(skb, presp->head_len), presp->head, 2397 presp->head_len); 2398 2399 hdr = (struct ieee80211_hdr *) skb->data; 2400 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2401 IEEE80211_STYPE_BEACON); 2402 } else if (ieee80211_vif_is_mesh(&sdata->vif)) { 2403 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2404 struct beacon_data *bcn = rcu_dereference(ifmsh->beacon); 2405 2406 if (!bcn) 2407 goto out; 2408 2409 if (ifmsh->sync_ops) 2410 ifmsh->sync_ops->adjust_tbtt( 2411 sdata); 2412 2413 skb = dev_alloc_skb(local->tx_headroom + 2414 bcn->head_len + 2415 256 + /* TIM IE */ 2416 bcn->tail_len); 2417 if (!skb) 2418 goto out; 2419 skb_reserve(skb, local->tx_headroom); 2420 memcpy(skb_put(skb, bcn->head_len), bcn->head, bcn->head_len); 2421 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb); 2422 memcpy(skb_put(skb, bcn->tail_len), bcn->tail, bcn->tail_len); 2423 } else { 2424 WARN_ON(1); 2425 goto out; 2426 } 2427 2428 band = chanctx_conf->def.chan->band; 2429 2430 info = IEEE80211_SKB_CB(skb); 2431 2432 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT; 2433 info->flags |= IEEE80211_TX_CTL_NO_ACK; 2434 info->band = band; 2435 2436 memset(&txrc, 0, sizeof(txrc)); 2437 txrc.hw = hw; 2438 txrc.sband = local->hw.wiphy->bands[band]; 2439 txrc.bss_conf = &sdata->vif.bss_conf; 2440 txrc.skb = skb; 2441 txrc.reported_rate.idx = -1; 2442 txrc.rate_idx_mask = sdata->rc_rateidx_mask[band]; 2443 if (txrc.rate_idx_mask == (1 << txrc.sband->n_bitrates) - 1) 2444 txrc.max_rate_idx = -1; 2445 else 2446 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1; 2447 txrc.bss = true; 2448 rate_control_get_rate(sdata, NULL, &txrc); 2449 2450 info->control.vif = vif; 2451 2452 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT | 2453 IEEE80211_TX_CTL_ASSIGN_SEQ | 2454 IEEE80211_TX_CTL_FIRST_FRAGMENT; 2455 out: 2456 rcu_read_unlock(); 2457 return skb; 2458 } 2459 EXPORT_SYMBOL(ieee80211_beacon_get_tim); 2460 2461 struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw, 2462 struct ieee80211_vif *vif) 2463 { 2464 struct ieee80211_if_ap *ap = NULL; 2465 struct sk_buff *skb = NULL; 2466 struct probe_resp *presp = NULL; 2467 struct ieee80211_hdr *hdr; 2468 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif); 2469 2470 if (sdata->vif.type != NL80211_IFTYPE_AP) 2471 return NULL; 2472 2473 rcu_read_lock(); 2474 2475 ap = &sdata->u.ap; 2476 presp = rcu_dereference(ap->probe_resp); 2477 if (!presp) 2478 goto out; 2479 2480 skb = dev_alloc_skb(presp->len); 2481 if (!skb) 2482 goto out; 2483 2484 memcpy(skb_put(skb, presp->len), presp->data, presp->len); 2485 2486 hdr = (struct ieee80211_hdr *) skb->data; 2487 memset(hdr->addr1, 0, sizeof(hdr->addr1)); 2488 2489 out: 2490 rcu_read_unlock(); 2491 return skb; 2492 } 2493 EXPORT_SYMBOL(ieee80211_proberesp_get); 2494 2495 struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw, 2496 struct ieee80211_vif *vif) 2497 { 2498 struct ieee80211_sub_if_data *sdata; 2499 struct ieee80211_if_managed *ifmgd; 2500 struct ieee80211_pspoll *pspoll; 2501 struct ieee80211_local *local; 2502 struct sk_buff *skb; 2503 2504 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION)) 2505 return NULL; 2506 2507 sdata = vif_to_sdata(vif); 2508 ifmgd = &sdata->u.mgd; 2509 local = sdata->local; 2510 2511 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll)); 2512 if (!skb) 2513 return NULL; 2514 2515 skb_reserve(skb, local->hw.extra_tx_headroom); 2516 2517 pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll)); 2518 memset(pspoll, 0, sizeof(*pspoll)); 2519 pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL | 2520 IEEE80211_STYPE_PSPOLL); 2521 pspoll->aid = cpu_to_le16(ifmgd->aid); 2522 2523 /* aid in PS-Poll has its two MSBs each set to 1 */ 2524 pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14); 2525 2526 memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN); 2527 memcpy(pspoll->ta, vif->addr, ETH_ALEN); 2528 2529 return skb; 2530 } 2531 EXPORT_SYMBOL(ieee80211_pspoll_get); 2532 2533 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw, 2534 struct ieee80211_vif *vif) 2535 { 2536 struct ieee80211_hdr_3addr *nullfunc; 2537 struct ieee80211_sub_if_data *sdata; 2538 struct ieee80211_if_managed *ifmgd; 2539 struct ieee80211_local *local; 2540 struct sk_buff *skb; 2541 2542 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION)) 2543 return NULL; 2544 2545 sdata = vif_to_sdata(vif); 2546 ifmgd = &sdata->u.mgd; 2547 local = sdata->local; 2548 2549 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc)); 2550 if (!skb) 2551 return NULL; 2552 2553 skb_reserve(skb, local->hw.extra_tx_headroom); 2554 2555 nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb, 2556 sizeof(*nullfunc)); 2557 memset(nullfunc, 0, sizeof(*nullfunc)); 2558 nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA | 2559 IEEE80211_STYPE_NULLFUNC | 2560 IEEE80211_FCTL_TODS); 2561 memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN); 2562 memcpy(nullfunc->addr2, vif->addr, ETH_ALEN); 2563 memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN); 2564 2565 return skb; 2566 } 2567 EXPORT_SYMBOL(ieee80211_nullfunc_get); 2568 2569 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw, 2570 struct ieee80211_vif *vif, 2571 const u8 *ssid, size_t ssid_len, 2572 size_t tailroom) 2573 { 2574 struct ieee80211_sub_if_data *sdata; 2575 struct ieee80211_local *local; 2576 struct ieee80211_hdr_3addr *hdr; 2577 struct sk_buff *skb; 2578 size_t ie_ssid_len; 2579 u8 *pos; 2580 2581 sdata = vif_to_sdata(vif); 2582 local = sdata->local; 2583 ie_ssid_len = 2 + ssid_len; 2584 2585 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) + 2586 ie_ssid_len + tailroom); 2587 if (!skb) 2588 return NULL; 2589 2590 skb_reserve(skb, local->hw.extra_tx_headroom); 2591 2592 hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr)); 2593 memset(hdr, 0, sizeof(*hdr)); 2594 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2595 IEEE80211_STYPE_PROBE_REQ); 2596 eth_broadcast_addr(hdr->addr1); 2597 memcpy(hdr->addr2, vif->addr, ETH_ALEN); 2598 eth_broadcast_addr(hdr->addr3); 2599 2600 pos = skb_put(skb, ie_ssid_len); 2601 *pos++ = WLAN_EID_SSID; 2602 *pos++ = ssid_len; 2603 if (ssid_len) 2604 memcpy(pos, ssid, ssid_len); 2605 pos += ssid_len; 2606 2607 return skb; 2608 } 2609 EXPORT_SYMBOL(ieee80211_probereq_get); 2610 2611 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 2612 const void *frame, size_t frame_len, 2613 const struct ieee80211_tx_info *frame_txctl, 2614 struct ieee80211_rts *rts) 2615 { 2616 const struct ieee80211_hdr *hdr = frame; 2617 2618 rts->frame_control = 2619 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS); 2620 rts->duration = ieee80211_rts_duration(hw, vif, frame_len, 2621 frame_txctl); 2622 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra)); 2623 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta)); 2624 } 2625 EXPORT_SYMBOL(ieee80211_rts_get); 2626 2627 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 2628 const void *frame, size_t frame_len, 2629 const struct ieee80211_tx_info *frame_txctl, 2630 struct ieee80211_cts *cts) 2631 { 2632 const struct ieee80211_hdr *hdr = frame; 2633 2634 cts->frame_control = 2635 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS); 2636 cts->duration = ieee80211_ctstoself_duration(hw, vif, 2637 frame_len, frame_txctl); 2638 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra)); 2639 } 2640 EXPORT_SYMBOL(ieee80211_ctstoself_get); 2641 2642 struct sk_buff * 2643 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, 2644 struct ieee80211_vif *vif) 2645 { 2646 struct ieee80211_local *local = hw_to_local(hw); 2647 struct sk_buff *skb = NULL; 2648 struct ieee80211_tx_data tx; 2649 struct ieee80211_sub_if_data *sdata; 2650 struct ps_data *ps; 2651 struct ieee80211_tx_info *info; 2652 struct ieee80211_chanctx_conf *chanctx_conf; 2653 2654 sdata = vif_to_sdata(vif); 2655 2656 rcu_read_lock(); 2657 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf); 2658 2659 if (!chanctx_conf) 2660 goto out; 2661 2662 if (sdata->vif.type == NL80211_IFTYPE_AP) { 2663 struct beacon_data *beacon = 2664 rcu_dereference(sdata->u.ap.beacon); 2665 2666 if (!beacon || !beacon->head) 2667 goto out; 2668 2669 ps = &sdata->u.ap.ps; 2670 } else if (ieee80211_vif_is_mesh(&sdata->vif)) { 2671 ps = &sdata->u.mesh.ps; 2672 } else { 2673 goto out; 2674 } 2675 2676 if (ps->dtim_count != 0 || !ps->dtim_bc_mc) 2677 goto out; /* send buffered bc/mc only after DTIM beacon */ 2678 2679 while (1) { 2680 skb = skb_dequeue(&ps->bc_buf); 2681 if (!skb) 2682 goto out; 2683 local->total_ps_buffered--; 2684 2685 if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) { 2686 struct ieee80211_hdr *hdr = 2687 (struct ieee80211_hdr *) skb->data; 2688 /* more buffered multicast/broadcast frames ==> set 2689 * MoreData flag in IEEE 802.11 header to inform PS 2690 * STAs */ 2691 hdr->frame_control |= 2692 cpu_to_le16(IEEE80211_FCTL_MOREDATA); 2693 } 2694 2695 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 2696 sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev); 2697 if (!ieee80211_tx_prepare(sdata, &tx, skb)) 2698 break; 2699 dev_kfree_skb_any(skb); 2700 } 2701 2702 info = IEEE80211_SKB_CB(skb); 2703 2704 tx.flags |= IEEE80211_TX_PS_BUFFERED; 2705 info->band = chanctx_conf->def.chan->band; 2706 2707 if (invoke_tx_handlers(&tx)) 2708 skb = NULL; 2709 out: 2710 rcu_read_unlock(); 2711 2712 return skb; 2713 } 2714 EXPORT_SYMBOL(ieee80211_get_buffered_bc); 2715 2716 void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata, 2717 struct sk_buff *skb, int tid, 2718 enum ieee80211_band band) 2719 { 2720 int ac = ieee802_1d_to_ac[tid & 7]; 2721 2722 skb_set_mac_header(skb, 0); 2723 skb_set_network_header(skb, 0); 2724 skb_set_transport_header(skb, 0); 2725 2726 skb_set_queue_mapping(skb, ac); 2727 skb->priority = tid; 2728 2729 skb->dev = sdata->dev; 2730 2731 /* 2732 * The other path calling ieee80211_xmit is from the tasklet, 2733 * and while we can handle concurrent transmissions locking 2734 * requirements are that we do not come into tx with bhs on. 2735 */ 2736 local_bh_disable(); 2737 ieee80211_xmit(sdata, skb, band); 2738 local_bh_enable(); 2739 } 2740