1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 * 12 * Transmit and frame generation functions. 13 */ 14 15 #include <linux/kernel.h> 16 #include <linux/slab.h> 17 #include <linux/skbuff.h> 18 #include <linux/etherdevice.h> 19 #include <linux/bitmap.h> 20 #include <linux/rcupdate.h> 21 #include <net/net_namespace.h> 22 #include <net/ieee80211_radiotap.h> 23 #include <net/cfg80211.h> 24 #include <net/mac80211.h> 25 #include <asm/unaligned.h> 26 27 #include "ieee80211_i.h" 28 #include "led.h" 29 #include "mesh.h" 30 #include "wep.h" 31 #include "wpa.h" 32 #include "wme.h" 33 #include "rate.h" 34 35 #define IEEE80211_TX_OK 0 36 #define IEEE80211_TX_AGAIN 1 37 #define IEEE80211_TX_FRAG_AGAIN 2 38 39 /* misc utils */ 40 41 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx, int group_addr, 42 int next_frag_len) 43 { 44 int rate, mrate, erp, dur, i; 45 struct ieee80211_rate *txrate; 46 struct ieee80211_local *local = tx->local; 47 struct ieee80211_supported_band *sband; 48 struct ieee80211_hdr *hdr; 49 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 50 51 /* assume HW handles this */ 52 if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS) 53 return 0; 54 55 /* uh huh? */ 56 if (WARN_ON_ONCE(info->control.rates[0].idx < 0)) 57 return 0; 58 59 sband = local->hw.wiphy->bands[tx->channel->band]; 60 txrate = &sband->bitrates[info->control.rates[0].idx]; 61 62 erp = txrate->flags & IEEE80211_RATE_ERP_G; 63 64 /* 65 * data and mgmt (except PS Poll): 66 * - during CFP: 32768 67 * - during contention period: 68 * if addr1 is group address: 0 69 * if more fragments = 0 and addr1 is individual address: time to 70 * transmit one ACK plus SIFS 71 * if more fragments = 1 and addr1 is individual address: time to 72 * transmit next fragment plus 2 x ACK plus 3 x SIFS 73 * 74 * IEEE 802.11, 9.6: 75 * - control response frame (CTS or ACK) shall be transmitted using the 76 * same rate as the immediately previous frame in the frame exchange 77 * sequence, if this rate belongs to the PHY mandatory rates, or else 78 * at the highest possible rate belonging to the PHY rates in the 79 * BSSBasicRateSet 80 */ 81 hdr = (struct ieee80211_hdr *)tx->skb->data; 82 if (ieee80211_is_ctl(hdr->frame_control)) { 83 /* TODO: These control frames are not currently sent by 84 * mac80211, but should they be implemented, this function 85 * needs to be updated to support duration field calculation. 86 * 87 * RTS: time needed to transmit pending data/mgmt frame plus 88 * one CTS frame plus one ACK frame plus 3 x SIFS 89 * CTS: duration of immediately previous RTS minus time 90 * required to transmit CTS and its SIFS 91 * ACK: 0 if immediately previous directed data/mgmt had 92 * more=0, with more=1 duration in ACK frame is duration 93 * from previous frame minus time needed to transmit ACK 94 * and its SIFS 95 * PS Poll: BIT(15) | BIT(14) | aid 96 */ 97 return 0; 98 } 99 100 /* data/mgmt */ 101 if (0 /* FIX: data/mgmt during CFP */) 102 return cpu_to_le16(32768); 103 104 if (group_addr) /* Group address as the destination - no ACK */ 105 return 0; 106 107 /* Individual destination address: 108 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes) 109 * CTS and ACK frames shall be transmitted using the highest rate in 110 * basic rate set that is less than or equal to the rate of the 111 * immediately previous frame and that is using the same modulation 112 * (CCK or OFDM). If no basic rate set matches with these requirements, 113 * the highest mandatory rate of the PHY that is less than or equal to 114 * the rate of the previous frame is used. 115 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps 116 */ 117 rate = -1; 118 /* use lowest available if everything fails */ 119 mrate = sband->bitrates[0].bitrate; 120 for (i = 0; i < sband->n_bitrates; i++) { 121 struct ieee80211_rate *r = &sband->bitrates[i]; 122 123 if (r->bitrate > txrate->bitrate) 124 break; 125 126 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i)) 127 rate = r->bitrate; 128 129 switch (sband->band) { 130 case IEEE80211_BAND_2GHZ: { 131 u32 flag; 132 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE) 133 flag = IEEE80211_RATE_MANDATORY_G; 134 else 135 flag = IEEE80211_RATE_MANDATORY_B; 136 if (r->flags & flag) 137 mrate = r->bitrate; 138 break; 139 } 140 case IEEE80211_BAND_5GHZ: 141 if (r->flags & IEEE80211_RATE_MANDATORY_A) 142 mrate = r->bitrate; 143 break; 144 case IEEE80211_NUM_BANDS: 145 WARN_ON(1); 146 break; 147 } 148 } 149 if (rate == -1) { 150 /* No matching basic rate found; use highest suitable mandatory 151 * PHY rate */ 152 rate = mrate; 153 } 154 155 /* Time needed to transmit ACK 156 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up 157 * to closest integer */ 158 159 dur = ieee80211_frame_duration(local, 10, rate, erp, 160 tx->sdata->vif.bss_conf.use_short_preamble); 161 162 if (next_frag_len) { 163 /* Frame is fragmented: duration increases with time needed to 164 * transmit next fragment plus ACK and 2 x SIFS. */ 165 dur *= 2; /* ACK + SIFS */ 166 /* next fragment */ 167 dur += ieee80211_frame_duration(local, next_frag_len, 168 txrate->bitrate, erp, 169 tx->sdata->vif.bss_conf.use_short_preamble); 170 } 171 172 return cpu_to_le16(dur); 173 } 174 175 static int inline is_ieee80211_device(struct ieee80211_local *local, 176 struct net_device *dev) 177 { 178 return local == wdev_priv(dev->ieee80211_ptr); 179 } 180 181 /* tx handlers */ 182 183 static ieee80211_tx_result debug_noinline 184 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx) 185 { 186 187 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 188 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 189 u32 sta_flags; 190 191 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) 192 return TX_CONTINUE; 193 194 if (unlikely(tx->local->sw_scanning) && 195 !ieee80211_is_probe_req(hdr->frame_control)) 196 return TX_DROP; 197 198 if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 199 return TX_CONTINUE; 200 201 if (tx->flags & IEEE80211_TX_PS_BUFFERED) 202 return TX_CONTINUE; 203 204 sta_flags = tx->sta ? get_sta_flags(tx->sta) : 0; 205 206 if (likely(tx->flags & IEEE80211_TX_UNICAST)) { 207 if (unlikely(!(sta_flags & WLAN_STA_ASSOC) && 208 tx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 209 ieee80211_is_data(hdr->frame_control))) { 210 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 211 printk(KERN_DEBUG "%s: dropped data frame to not " 212 "associated station %pM\n", 213 tx->dev->name, hdr->addr1); 214 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */ 215 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc); 216 return TX_DROP; 217 } 218 } else { 219 if (unlikely(ieee80211_is_data(hdr->frame_control) && 220 tx->local->num_sta == 0 && 221 tx->sdata->vif.type != NL80211_IFTYPE_ADHOC)) { 222 /* 223 * No associated STAs - no need to send multicast 224 * frames. 225 */ 226 return TX_DROP; 227 } 228 return TX_CONTINUE; 229 } 230 231 return TX_CONTINUE; 232 } 233 234 /* This function is called whenever the AP is about to exceed the maximum limit 235 * of buffered frames for power saving STAs. This situation should not really 236 * happen often during normal operation, so dropping the oldest buffered packet 237 * from each queue should be OK to make some room for new frames. */ 238 static void purge_old_ps_buffers(struct ieee80211_local *local) 239 { 240 int total = 0, purged = 0; 241 struct sk_buff *skb; 242 struct ieee80211_sub_if_data *sdata; 243 struct sta_info *sta; 244 245 /* 246 * virtual interfaces are protected by RCU 247 */ 248 rcu_read_lock(); 249 250 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 251 struct ieee80211_if_ap *ap; 252 if (sdata->vif.type != NL80211_IFTYPE_AP) 253 continue; 254 ap = &sdata->u.ap; 255 skb = skb_dequeue(&ap->ps_bc_buf); 256 if (skb) { 257 purged++; 258 dev_kfree_skb(skb); 259 } 260 total += skb_queue_len(&ap->ps_bc_buf); 261 } 262 263 list_for_each_entry_rcu(sta, &local->sta_list, list) { 264 skb = skb_dequeue(&sta->ps_tx_buf); 265 if (skb) { 266 purged++; 267 dev_kfree_skb(skb); 268 } 269 total += skb_queue_len(&sta->ps_tx_buf); 270 } 271 272 rcu_read_unlock(); 273 274 local->total_ps_buffered = total; 275 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 276 printk(KERN_DEBUG "%s: PS buffers full - purged %d frames\n", 277 wiphy_name(local->hw.wiphy), purged); 278 #endif 279 } 280 281 static ieee80211_tx_result 282 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) 283 { 284 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 285 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 286 287 /* 288 * broadcast/multicast frame 289 * 290 * If any of the associated stations is in power save mode, 291 * the frame is buffered to be sent after DTIM beacon frame. 292 * This is done either by the hardware or us. 293 */ 294 295 /* powersaving STAs only in AP/VLAN mode */ 296 if (!tx->sdata->bss) 297 return TX_CONTINUE; 298 299 /* no buffering for ordered frames */ 300 if (ieee80211_has_order(hdr->frame_control)) 301 return TX_CONTINUE; 302 303 /* no stations in PS mode */ 304 if (!atomic_read(&tx->sdata->bss->num_sta_ps)) 305 return TX_CONTINUE; 306 307 /* buffered in mac80211 */ 308 if (tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING) { 309 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) 310 purge_old_ps_buffers(tx->local); 311 if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= 312 AP_MAX_BC_BUFFER) { 313 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 314 if (net_ratelimit()) { 315 printk(KERN_DEBUG "%s: BC TX buffer full - " 316 "dropping the oldest frame\n", 317 tx->dev->name); 318 } 319 #endif 320 dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf)); 321 } else 322 tx->local->total_ps_buffered++; 323 skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb); 324 return TX_QUEUED; 325 } 326 327 /* buffered in hardware */ 328 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM; 329 330 return TX_CONTINUE; 331 } 332 333 static ieee80211_tx_result 334 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx) 335 { 336 struct sta_info *sta = tx->sta; 337 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 338 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 339 u32 staflags; 340 341 if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control))) 342 return TX_CONTINUE; 343 344 staflags = get_sta_flags(sta); 345 346 if (unlikely((staflags & WLAN_STA_PS) && 347 !(staflags & WLAN_STA_PSPOLL))) { 348 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 349 printk(KERN_DEBUG "STA %pM aid %d: PS buffer (entries " 350 "before %d)\n", 351 sta->sta.addr, sta->sta.aid, 352 skb_queue_len(&sta->ps_tx_buf)); 353 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 354 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER) 355 purge_old_ps_buffers(tx->local); 356 if (skb_queue_len(&sta->ps_tx_buf) >= STA_MAX_TX_BUFFER) { 357 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf); 358 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 359 if (net_ratelimit()) { 360 printk(KERN_DEBUG "%s: STA %pM TX " 361 "buffer full - dropping oldest frame\n", 362 tx->dev->name, sta->sta.addr); 363 } 364 #endif 365 dev_kfree_skb(old); 366 } else 367 tx->local->total_ps_buffered++; 368 369 /* Queue frame to be sent after STA sends an PS Poll frame */ 370 if (skb_queue_empty(&sta->ps_tx_buf)) 371 sta_info_set_tim_bit(sta); 372 373 info->control.jiffies = jiffies; 374 skb_queue_tail(&sta->ps_tx_buf, tx->skb); 375 return TX_QUEUED; 376 } 377 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG 378 else if (unlikely(test_sta_flags(sta, WLAN_STA_PS))) { 379 printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll " 380 "set -> send frame\n", tx->dev->name, 381 sta->sta.addr); 382 } 383 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */ 384 clear_sta_flags(sta, WLAN_STA_PSPOLL); 385 386 return TX_CONTINUE; 387 } 388 389 static ieee80211_tx_result debug_noinline 390 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx) 391 { 392 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED)) 393 return TX_CONTINUE; 394 395 if (tx->flags & IEEE80211_TX_UNICAST) 396 return ieee80211_tx_h_unicast_ps_buf(tx); 397 else 398 return ieee80211_tx_h_multicast_ps_buf(tx); 399 } 400 401 static ieee80211_tx_result debug_noinline 402 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx) 403 { 404 struct ieee80211_key *key; 405 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 406 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 407 408 if (unlikely(tx->skb->do_not_encrypt)) 409 tx->key = NULL; 410 else if (tx->sta && (key = rcu_dereference(tx->sta->key))) 411 tx->key = key; 412 else if ((key = rcu_dereference(tx->sdata->default_key))) 413 tx->key = key; 414 else if (tx->sdata->drop_unencrypted && 415 (tx->skb->protocol != cpu_to_be16(ETH_P_PAE)) && 416 !(info->flags & IEEE80211_TX_CTL_INJECTED)) { 417 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted); 418 return TX_DROP; 419 } else 420 tx->key = NULL; 421 422 if (tx->key) { 423 tx->key->tx_rx_count++; 424 /* TODO: add threshold stuff again */ 425 426 switch (tx->key->conf.alg) { 427 case ALG_WEP: 428 if (ieee80211_is_auth(hdr->frame_control)) 429 break; 430 case ALG_TKIP: 431 case ALG_CCMP: 432 if (!ieee80211_is_data_present(hdr->frame_control)) 433 tx->key = NULL; 434 break; 435 } 436 } 437 438 if (!tx->key || !(tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) 439 tx->skb->do_not_encrypt = 1; 440 441 return TX_CONTINUE; 442 } 443 444 static ieee80211_tx_result debug_noinline 445 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx) 446 { 447 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 448 struct ieee80211_hdr *hdr = (void *)tx->skb->data; 449 struct ieee80211_supported_band *sband; 450 struct ieee80211_rate *rate; 451 int i, len; 452 bool inval = false, rts = false, short_preamble = false; 453 struct ieee80211_tx_rate_control txrc; 454 455 memset(&txrc, 0, sizeof(txrc)); 456 457 sband = tx->local->hw.wiphy->bands[tx->channel->band]; 458 459 len = min_t(int, tx->skb->len + FCS_LEN, 460 tx->local->fragmentation_threshold); 461 462 /* set up the tx rate control struct we give the RC algo */ 463 txrc.hw = local_to_hw(tx->local); 464 txrc.sband = sband; 465 txrc.bss_conf = &tx->sdata->vif.bss_conf; 466 txrc.skb = tx->skb; 467 txrc.reported_rate.idx = -1; 468 txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx; 469 470 /* set up RTS protection if desired */ 471 if (tx->local->rts_threshold < IEEE80211_MAX_RTS_THRESHOLD && 472 len > tx->local->rts_threshold) { 473 txrc.rts = rts = true; 474 } 475 476 /* 477 * Use short preamble if the BSS can handle it, but not for 478 * management frames unless we know the receiver can handle 479 * that -- the management frame might be to a station that 480 * just wants a probe response. 481 */ 482 if (tx->sdata->vif.bss_conf.use_short_preamble && 483 (ieee80211_is_data(hdr->frame_control) || 484 (tx->sta && test_sta_flags(tx->sta, WLAN_STA_SHORT_PREAMBLE)))) 485 txrc.short_preamble = short_preamble = true; 486 487 488 rate_control_get_rate(tx->sdata, tx->sta, &txrc); 489 490 if (unlikely(info->control.rates[0].idx < 0)) 491 return TX_DROP; 492 493 if (txrc.reported_rate.idx < 0) 494 txrc.reported_rate = info->control.rates[0]; 495 496 if (tx->sta) 497 tx->sta->last_tx_rate = txrc.reported_rate; 498 499 if (unlikely(!info->control.rates[0].count)) 500 info->control.rates[0].count = 1; 501 502 if (is_multicast_ether_addr(hdr->addr1)) { 503 /* 504 * XXX: verify the rate is in the basic rateset 505 */ 506 return TX_CONTINUE; 507 } 508 509 /* 510 * set up the RTS/CTS rate as the fastest basic rate 511 * that is not faster than the data rate 512 * 513 * XXX: Should this check all retry rates? 514 */ 515 if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) { 516 s8 baserate = 0; 517 518 rate = &sband->bitrates[info->control.rates[0].idx]; 519 520 for (i = 0; i < sband->n_bitrates; i++) { 521 /* must be a basic rate */ 522 if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i))) 523 continue; 524 /* must not be faster than the data rate */ 525 if (sband->bitrates[i].bitrate > rate->bitrate) 526 continue; 527 /* maximum */ 528 if (sband->bitrates[baserate].bitrate < 529 sband->bitrates[i].bitrate) 530 baserate = i; 531 } 532 533 info->control.rts_cts_rate_idx = baserate; 534 } 535 536 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) { 537 /* 538 * make sure there's no valid rate following 539 * an invalid one, just in case drivers don't 540 * take the API seriously to stop at -1. 541 */ 542 if (inval) { 543 info->control.rates[i].idx = -1; 544 continue; 545 } 546 if (info->control.rates[i].idx < 0) { 547 inval = true; 548 continue; 549 } 550 551 /* 552 * For now assume MCS is already set up correctly, this 553 * needs to be fixed. 554 */ 555 if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) { 556 WARN_ON(info->control.rates[i].idx > 76); 557 continue; 558 } 559 560 /* set up RTS protection if desired */ 561 if (rts) 562 info->control.rates[i].flags |= 563 IEEE80211_TX_RC_USE_RTS_CTS; 564 565 /* RC is busted */ 566 if (WARN_ON_ONCE(info->control.rates[i].idx >= 567 sband->n_bitrates)) { 568 info->control.rates[i].idx = -1; 569 continue; 570 } 571 572 rate = &sband->bitrates[info->control.rates[i].idx]; 573 574 /* set up short preamble */ 575 if (short_preamble && 576 rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) 577 info->control.rates[i].flags |= 578 IEEE80211_TX_RC_USE_SHORT_PREAMBLE; 579 580 /* set up G protection */ 581 if (!rts && tx->sdata->vif.bss_conf.use_cts_prot && 582 rate->flags & IEEE80211_RATE_ERP_G) 583 info->control.rates[i].flags |= 584 IEEE80211_TX_RC_USE_CTS_PROTECT; 585 } 586 587 return TX_CONTINUE; 588 } 589 590 static ieee80211_tx_result debug_noinline 591 ieee80211_tx_h_misc(struct ieee80211_tx_data *tx) 592 { 593 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 594 595 if (tx->sta) 596 info->control.sta = &tx->sta->sta; 597 598 return TX_CONTINUE; 599 } 600 601 static ieee80211_tx_result debug_noinline 602 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx) 603 { 604 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 605 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 606 u16 *seq; 607 u8 *qc; 608 int tid; 609 610 /* 611 * Packet injection may want to control the sequence 612 * number, if we have no matching interface then we 613 * neither assign one ourselves nor ask the driver to. 614 */ 615 if (unlikely(!info->control.vif)) 616 return TX_CONTINUE; 617 618 if (unlikely(ieee80211_is_ctl(hdr->frame_control))) 619 return TX_CONTINUE; 620 621 if (ieee80211_hdrlen(hdr->frame_control) < 24) 622 return TX_CONTINUE; 623 624 /* 625 * Anything but QoS data that has a sequence number field 626 * (is long enough) gets a sequence number from the global 627 * counter. 628 */ 629 if (!ieee80211_is_data_qos(hdr->frame_control)) { 630 /* driver should assign sequence number */ 631 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ; 632 /* for pure STA mode without beacons, we can do it */ 633 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number); 634 tx->sdata->sequence_number += 0x10; 635 tx->sdata->sequence_number &= IEEE80211_SCTL_SEQ; 636 return TX_CONTINUE; 637 } 638 639 /* 640 * This should be true for injected/management frames only, for 641 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ 642 * above since they are not QoS-data frames. 643 */ 644 if (!tx->sta) 645 return TX_CONTINUE; 646 647 /* include per-STA, per-TID sequence counter */ 648 649 qc = ieee80211_get_qos_ctl(hdr); 650 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 651 seq = &tx->sta->tid_seq[tid]; 652 653 hdr->seq_ctrl = cpu_to_le16(*seq); 654 655 /* Increase the sequence number. */ 656 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ; 657 658 return TX_CONTINUE; 659 } 660 661 static ieee80211_tx_result debug_noinline 662 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx) 663 { 664 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb); 665 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 666 size_t hdrlen, per_fragm, num_fragm, payload_len, left; 667 struct sk_buff **frags, *first, *frag; 668 int i; 669 u16 seq; 670 u8 *pos; 671 int frag_threshold = tx->local->fragmentation_threshold; 672 673 if (!(tx->flags & IEEE80211_TX_FRAGMENTED)) 674 return TX_CONTINUE; 675 676 /* 677 * Warn when submitting a fragmented A-MPDU frame and drop it. 678 * This scenario is handled in __ieee80211_tx_prepare but extra 679 * caution taken here as fragmented ampdu may cause Tx stop. 680 */ 681 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU)) 682 return TX_DROP; 683 684 first = tx->skb; 685 686 hdrlen = ieee80211_hdrlen(hdr->frame_control); 687 payload_len = first->len - hdrlen; 688 per_fragm = frag_threshold - hdrlen - FCS_LEN; 689 num_fragm = DIV_ROUND_UP(payload_len, per_fragm); 690 691 frags = kzalloc(num_fragm * sizeof(struct sk_buff *), GFP_ATOMIC); 692 if (!frags) 693 goto fail; 694 695 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREFRAGS); 696 seq = le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ; 697 pos = first->data + hdrlen + per_fragm; 698 left = payload_len - per_fragm; 699 for (i = 0; i < num_fragm - 1; i++) { 700 struct ieee80211_hdr *fhdr; 701 size_t copylen; 702 703 if (left <= 0) 704 goto fail; 705 706 /* reserve enough extra head and tail room for possible 707 * encryption */ 708 frag = frags[i] = 709 dev_alloc_skb(tx->local->tx_headroom + 710 frag_threshold + 711 IEEE80211_ENCRYPT_HEADROOM + 712 IEEE80211_ENCRYPT_TAILROOM); 713 if (!frag) 714 goto fail; 715 716 /* Make sure that all fragments use the same priority so 717 * that they end up using the same TX queue */ 718 frag->priority = first->priority; 719 720 skb_reserve(frag, tx->local->tx_headroom + 721 IEEE80211_ENCRYPT_HEADROOM); 722 723 /* copy TX information */ 724 info = IEEE80211_SKB_CB(frag); 725 memcpy(info, first->cb, sizeof(frag->cb)); 726 727 /* copy/fill in 802.11 header */ 728 fhdr = (struct ieee80211_hdr *) skb_put(frag, hdrlen); 729 memcpy(fhdr, first->data, hdrlen); 730 fhdr->seq_ctrl = cpu_to_le16(seq | ((i + 1) & IEEE80211_SCTL_FRAG)); 731 732 if (i == num_fragm - 2) { 733 /* clear MOREFRAGS bit for the last fragment */ 734 fhdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREFRAGS); 735 } else { 736 /* 737 * No multi-rate retries for fragmented frames, that 738 * would completely throw off the NAV at other STAs. 739 */ 740 info->control.rates[1].idx = -1; 741 info->control.rates[2].idx = -1; 742 info->control.rates[3].idx = -1; 743 info->control.rates[4].idx = -1; 744 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5); 745 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE; 746 } 747 748 /* copy data */ 749 copylen = left > per_fragm ? per_fragm : left; 750 memcpy(skb_put(frag, copylen), pos, copylen); 751 752 skb_copy_queue_mapping(frag, first); 753 754 frag->do_not_encrypt = first->do_not_encrypt; 755 frag->dev = first->dev; 756 frag->iif = first->iif; 757 758 pos += copylen; 759 left -= copylen; 760 } 761 skb_trim(first, hdrlen + per_fragm); 762 763 tx->num_extra_frag = num_fragm - 1; 764 tx->extra_frag = frags; 765 766 return TX_CONTINUE; 767 768 fail: 769 if (frags) { 770 for (i = 0; i < num_fragm - 1; i++) 771 if (frags[i]) 772 dev_kfree_skb(frags[i]); 773 kfree(frags); 774 } 775 I802_DEBUG_INC(tx->local->tx_handlers_drop_fragment); 776 return TX_DROP; 777 } 778 779 static ieee80211_tx_result debug_noinline 780 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx) 781 { 782 if (!tx->key) 783 return TX_CONTINUE; 784 785 switch (tx->key->conf.alg) { 786 case ALG_WEP: 787 return ieee80211_crypto_wep_encrypt(tx); 788 case ALG_TKIP: 789 return ieee80211_crypto_tkip_encrypt(tx); 790 case ALG_CCMP: 791 return ieee80211_crypto_ccmp_encrypt(tx); 792 } 793 794 /* not reached */ 795 WARN_ON(1); 796 return TX_DROP; 797 } 798 799 static ieee80211_tx_result debug_noinline 800 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx) 801 { 802 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 803 int next_len, i; 804 int group_addr = is_multicast_ether_addr(hdr->addr1); 805 806 if (!(tx->flags & IEEE80211_TX_FRAGMENTED)) { 807 hdr->duration_id = ieee80211_duration(tx, group_addr, 0); 808 return TX_CONTINUE; 809 } 810 811 hdr->duration_id = ieee80211_duration(tx, group_addr, 812 tx->extra_frag[0]->len); 813 814 for (i = 0; i < tx->num_extra_frag; i++) { 815 if (i + 1 < tx->num_extra_frag) 816 next_len = tx->extra_frag[i + 1]->len; 817 else 818 next_len = 0; 819 820 hdr = (struct ieee80211_hdr *)tx->extra_frag[i]->data; 821 hdr->duration_id = ieee80211_duration(tx, 0, next_len); 822 } 823 824 return TX_CONTINUE; 825 } 826 827 static ieee80211_tx_result debug_noinline 828 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx) 829 { 830 int i; 831 832 if (!tx->sta) 833 return TX_CONTINUE; 834 835 tx->sta->tx_packets++; 836 tx->sta->tx_fragments++; 837 tx->sta->tx_bytes += tx->skb->len; 838 if (tx->extra_frag) { 839 tx->sta->tx_fragments += tx->num_extra_frag; 840 for (i = 0; i < tx->num_extra_frag; i++) 841 tx->sta->tx_bytes += tx->extra_frag[i]->len; 842 } 843 844 return TX_CONTINUE; 845 } 846 847 848 /* actual transmit path */ 849 850 /* 851 * deal with packet injection down monitor interface 852 * with Radiotap Header -- only called for monitor mode interface 853 */ 854 static ieee80211_tx_result 855 __ieee80211_parse_tx_radiotap(struct ieee80211_tx_data *tx, 856 struct sk_buff *skb) 857 { 858 /* 859 * this is the moment to interpret and discard the radiotap header that 860 * must be at the start of the packet injected in Monitor mode 861 * 862 * Need to take some care with endian-ness since radiotap 863 * args are little-endian 864 */ 865 866 struct ieee80211_radiotap_iterator iterator; 867 struct ieee80211_radiotap_header *rthdr = 868 (struct ieee80211_radiotap_header *) skb->data; 869 struct ieee80211_supported_band *sband; 870 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len); 871 872 sband = tx->local->hw.wiphy->bands[tx->channel->band]; 873 874 skb->do_not_encrypt = 1; 875 tx->flags &= ~IEEE80211_TX_FRAGMENTED; 876 877 /* 878 * for every radiotap entry that is present 879 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more 880 * entries present, or -EINVAL on error) 881 */ 882 883 while (!ret) { 884 ret = ieee80211_radiotap_iterator_next(&iterator); 885 886 if (ret) 887 continue; 888 889 /* see if this argument is something we can use */ 890 switch (iterator.this_arg_index) { 891 /* 892 * You must take care when dereferencing iterator.this_arg 893 * for multibyte types... the pointer is not aligned. Use 894 * get_unaligned((type *)iterator.this_arg) to dereference 895 * iterator.this_arg for type "type" safely on all arches. 896 */ 897 case IEEE80211_RADIOTAP_FLAGS: 898 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) { 899 /* 900 * this indicates that the skb we have been 901 * handed has the 32-bit FCS CRC at the end... 902 * we should react to that by snipping it off 903 * because it will be recomputed and added 904 * on transmission 905 */ 906 if (skb->len < (iterator.max_length + FCS_LEN)) 907 return TX_DROP; 908 909 skb_trim(skb, skb->len - FCS_LEN); 910 } 911 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP) 912 tx->skb->do_not_encrypt = 0; 913 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG) 914 tx->flags |= IEEE80211_TX_FRAGMENTED; 915 break; 916 917 /* 918 * Please update the file 919 * Documentation/networking/mac80211-injection.txt 920 * when parsing new fields here. 921 */ 922 923 default: 924 break; 925 } 926 } 927 928 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */ 929 return TX_DROP; 930 931 /* 932 * remove the radiotap header 933 * iterator->max_length was sanity-checked against 934 * skb->len by iterator init 935 */ 936 skb_pull(skb, iterator.max_length); 937 938 return TX_CONTINUE; 939 } 940 941 /* 942 * initialises @tx 943 */ 944 static ieee80211_tx_result 945 __ieee80211_tx_prepare(struct ieee80211_tx_data *tx, 946 struct sk_buff *skb, 947 struct net_device *dev) 948 { 949 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); 950 struct ieee80211_hdr *hdr; 951 struct ieee80211_sub_if_data *sdata; 952 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 953 954 int hdrlen, tid; 955 u8 *qc, *state; 956 957 memset(tx, 0, sizeof(*tx)); 958 tx->skb = skb; 959 tx->dev = dev; /* use original interface */ 960 tx->local = local; 961 tx->sdata = IEEE80211_DEV_TO_SUB_IF(dev); 962 tx->channel = local->hw.conf.channel; 963 /* 964 * Set this flag (used below to indicate "automatic fragmentation"), 965 * it will be cleared/left by radiotap as desired. 966 */ 967 tx->flags |= IEEE80211_TX_FRAGMENTED; 968 969 /* process and remove the injection radiotap header */ 970 sdata = IEEE80211_DEV_TO_SUB_IF(dev); 971 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) { 972 if (__ieee80211_parse_tx_radiotap(tx, skb) == TX_DROP) 973 return TX_DROP; 974 975 /* 976 * __ieee80211_parse_tx_radiotap has now removed 977 * the radiotap header that was present and pre-filled 978 * 'tx' with tx control information. 979 */ 980 } 981 982 hdr = (struct ieee80211_hdr *) skb->data; 983 984 tx->sta = sta_info_get(local, hdr->addr1); 985 986 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control)) { 987 qc = ieee80211_get_qos_ctl(hdr); 988 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 989 990 state = &tx->sta->ampdu_mlme.tid_state_tx[tid]; 991 if (*state == HT_AGG_STATE_OPERATIONAL) 992 info->flags |= IEEE80211_TX_CTL_AMPDU; 993 } 994 995 if (is_multicast_ether_addr(hdr->addr1)) { 996 tx->flags &= ~IEEE80211_TX_UNICAST; 997 info->flags |= IEEE80211_TX_CTL_NO_ACK; 998 } else { 999 tx->flags |= IEEE80211_TX_UNICAST; 1000 info->flags &= ~IEEE80211_TX_CTL_NO_ACK; 1001 } 1002 1003 if (tx->flags & IEEE80211_TX_FRAGMENTED) { 1004 if ((tx->flags & IEEE80211_TX_UNICAST) && 1005 skb->len + FCS_LEN > local->fragmentation_threshold && 1006 !(info->flags & IEEE80211_TX_CTL_AMPDU)) 1007 tx->flags |= IEEE80211_TX_FRAGMENTED; 1008 else 1009 tx->flags &= ~IEEE80211_TX_FRAGMENTED; 1010 } 1011 1012 if (!tx->sta) 1013 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT; 1014 else if (test_and_clear_sta_flags(tx->sta, WLAN_STA_CLEAR_PS_FILT)) 1015 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT; 1016 1017 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1018 if (skb->len > hdrlen + sizeof(rfc1042_header) + 2) { 1019 u8 *pos = &skb->data[hdrlen + sizeof(rfc1042_header)]; 1020 tx->ethertype = (pos[0] << 8) | pos[1]; 1021 } 1022 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT; 1023 1024 return TX_CONTINUE; 1025 } 1026 1027 /* 1028 * NB: @tx is uninitialised when passed in here 1029 */ 1030 static int ieee80211_tx_prepare(struct ieee80211_local *local, 1031 struct ieee80211_tx_data *tx, 1032 struct sk_buff *skb) 1033 { 1034 struct net_device *dev; 1035 1036 dev = dev_get_by_index(&init_net, skb->iif); 1037 if (unlikely(dev && !is_ieee80211_device(local, dev))) { 1038 dev_put(dev); 1039 dev = NULL; 1040 } 1041 if (unlikely(!dev)) 1042 return -ENODEV; 1043 /* initialises tx with control */ 1044 __ieee80211_tx_prepare(tx, skb, dev); 1045 dev_put(dev); 1046 return 0; 1047 } 1048 1049 static int __ieee80211_tx(struct ieee80211_local *local, struct sk_buff *skb, 1050 struct ieee80211_tx_data *tx) 1051 { 1052 struct ieee80211_tx_info *info; 1053 int ret, i; 1054 1055 if (skb) { 1056 if (netif_subqueue_stopped(local->mdev, skb)) 1057 return IEEE80211_TX_AGAIN; 1058 info = IEEE80211_SKB_CB(skb); 1059 1060 ret = local->ops->tx(local_to_hw(local), skb); 1061 if (ret) 1062 return IEEE80211_TX_AGAIN; 1063 local->mdev->trans_start = jiffies; 1064 ieee80211_led_tx(local, 1); 1065 } 1066 if (tx->extra_frag) { 1067 for (i = 0; i < tx->num_extra_frag; i++) { 1068 if (!tx->extra_frag[i]) 1069 continue; 1070 info = IEEE80211_SKB_CB(tx->extra_frag[i]); 1071 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT | 1072 IEEE80211_TX_CTL_FIRST_FRAGMENT); 1073 if (netif_subqueue_stopped(local->mdev, 1074 tx->extra_frag[i])) 1075 return IEEE80211_TX_FRAG_AGAIN; 1076 1077 ret = local->ops->tx(local_to_hw(local), 1078 tx->extra_frag[i]); 1079 if (ret) 1080 return IEEE80211_TX_FRAG_AGAIN; 1081 local->mdev->trans_start = jiffies; 1082 ieee80211_led_tx(local, 1); 1083 tx->extra_frag[i] = NULL; 1084 } 1085 kfree(tx->extra_frag); 1086 tx->extra_frag = NULL; 1087 } 1088 return IEEE80211_TX_OK; 1089 } 1090 1091 /* 1092 * Invoke TX handlers, return 0 on success and non-zero if the 1093 * frame was dropped or queued. 1094 */ 1095 static int invoke_tx_handlers(struct ieee80211_tx_data *tx) 1096 { 1097 struct sk_buff *skb = tx->skb; 1098 ieee80211_tx_result res = TX_DROP; 1099 int i; 1100 1101 #define CALL_TXH(txh) \ 1102 res = txh(tx); \ 1103 if (res != TX_CONTINUE) \ 1104 goto txh_done; 1105 1106 CALL_TXH(ieee80211_tx_h_check_assoc) 1107 CALL_TXH(ieee80211_tx_h_ps_buf) 1108 CALL_TXH(ieee80211_tx_h_select_key) 1109 CALL_TXH(ieee80211_tx_h_michael_mic_add) 1110 CALL_TXH(ieee80211_tx_h_rate_ctrl) 1111 CALL_TXH(ieee80211_tx_h_misc) 1112 CALL_TXH(ieee80211_tx_h_sequence) 1113 CALL_TXH(ieee80211_tx_h_fragment) 1114 /* handlers after fragment must be aware of tx info fragmentation! */ 1115 CALL_TXH(ieee80211_tx_h_encrypt) 1116 CALL_TXH(ieee80211_tx_h_calculate_duration) 1117 CALL_TXH(ieee80211_tx_h_stats) 1118 #undef CALL_TXH 1119 1120 txh_done: 1121 if (unlikely(res == TX_DROP)) { 1122 I802_DEBUG_INC(tx->local->tx_handlers_drop); 1123 dev_kfree_skb(skb); 1124 for (i = 0; i < tx->num_extra_frag; i++) 1125 if (tx->extra_frag[i]) 1126 dev_kfree_skb(tx->extra_frag[i]); 1127 kfree(tx->extra_frag); 1128 return -1; 1129 } else if (unlikely(res == TX_QUEUED)) { 1130 I802_DEBUG_INC(tx->local->tx_handlers_queued); 1131 return -1; 1132 } 1133 1134 return 0; 1135 } 1136 1137 static int ieee80211_tx(struct net_device *dev, struct sk_buff *skb) 1138 { 1139 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); 1140 struct sta_info *sta; 1141 struct ieee80211_tx_data tx; 1142 ieee80211_tx_result res_prepare; 1143 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1144 int ret, i; 1145 u16 queue; 1146 1147 queue = skb_get_queue_mapping(skb); 1148 1149 WARN_ON(test_bit(queue, local->queues_pending)); 1150 1151 if (unlikely(skb->len < 10)) { 1152 dev_kfree_skb(skb); 1153 return 0; 1154 } 1155 1156 rcu_read_lock(); 1157 1158 /* initialises tx */ 1159 res_prepare = __ieee80211_tx_prepare(&tx, skb, dev); 1160 1161 if (res_prepare == TX_DROP) { 1162 dev_kfree_skb(skb); 1163 rcu_read_unlock(); 1164 return 0; 1165 } 1166 1167 sta = tx.sta; 1168 tx.channel = local->hw.conf.channel; 1169 info->band = tx.channel->band; 1170 1171 if (invoke_tx_handlers(&tx)) 1172 goto out; 1173 1174 retry: 1175 ret = __ieee80211_tx(local, skb, &tx); 1176 if (ret) { 1177 struct ieee80211_tx_stored_packet *store; 1178 1179 /* 1180 * Since there are no fragmented frames on A-MPDU 1181 * queues, there's no reason for a driver to reject 1182 * a frame there, warn and drop it. 1183 */ 1184 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU)) 1185 goto drop; 1186 1187 store = &local->pending_packet[queue]; 1188 1189 if (ret == IEEE80211_TX_FRAG_AGAIN) 1190 skb = NULL; 1191 1192 set_bit(queue, local->queues_pending); 1193 smp_mb(); 1194 /* 1195 * When the driver gets out of buffers during sending of 1196 * fragments and calls ieee80211_stop_queue, the netif 1197 * subqueue is stopped. There is, however, a small window 1198 * in which the PENDING bit is not yet set. If a buffer 1199 * gets available in that window (i.e. driver calls 1200 * ieee80211_wake_queue), we would end up with ieee80211_tx 1201 * called with the PENDING bit still set. Prevent this by 1202 * continuing transmitting here when that situation is 1203 * possible to have happened. 1204 */ 1205 if (!__netif_subqueue_stopped(local->mdev, queue)) { 1206 clear_bit(queue, local->queues_pending); 1207 goto retry; 1208 } 1209 store->skb = skb; 1210 store->extra_frag = tx.extra_frag; 1211 store->num_extra_frag = tx.num_extra_frag; 1212 } 1213 out: 1214 rcu_read_unlock(); 1215 return 0; 1216 1217 drop: 1218 if (skb) 1219 dev_kfree_skb(skb); 1220 for (i = 0; i < tx.num_extra_frag; i++) 1221 if (tx.extra_frag[i]) 1222 dev_kfree_skb(tx.extra_frag[i]); 1223 kfree(tx.extra_frag); 1224 rcu_read_unlock(); 1225 return 0; 1226 } 1227 1228 /* device xmit handlers */ 1229 1230 static int ieee80211_skb_resize(struct ieee80211_local *local, 1231 struct sk_buff *skb, 1232 int head_need, bool may_encrypt) 1233 { 1234 int tail_need = 0; 1235 1236 /* 1237 * This could be optimised, devices that do full hardware 1238 * crypto (including TKIP MMIC) need no tailroom... But we 1239 * have no drivers for such devices currently. 1240 */ 1241 if (may_encrypt) { 1242 tail_need = IEEE80211_ENCRYPT_TAILROOM; 1243 tail_need -= skb_tailroom(skb); 1244 tail_need = max_t(int, tail_need, 0); 1245 } 1246 1247 if (head_need || tail_need) { 1248 /* Sorry. Can't account for this any more */ 1249 skb_orphan(skb); 1250 } 1251 1252 if (skb_header_cloned(skb)) 1253 I802_DEBUG_INC(local->tx_expand_skb_head_cloned); 1254 else 1255 I802_DEBUG_INC(local->tx_expand_skb_head); 1256 1257 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) { 1258 printk(KERN_DEBUG "%s: failed to reallocate TX buffer\n", 1259 wiphy_name(local->hw.wiphy)); 1260 return -ENOMEM; 1261 } 1262 1263 /* update truesize too */ 1264 skb->truesize += head_need + tail_need; 1265 1266 return 0; 1267 } 1268 1269 int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev) 1270 { 1271 struct ieee80211_master_priv *mpriv = netdev_priv(dev); 1272 struct ieee80211_local *local = mpriv->local; 1273 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 1274 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1275 struct net_device *odev = NULL; 1276 struct ieee80211_sub_if_data *osdata; 1277 int headroom; 1278 bool may_encrypt; 1279 enum { 1280 NOT_MONITOR, 1281 FOUND_SDATA, 1282 UNKNOWN_ADDRESS, 1283 } monitor_iface = NOT_MONITOR; 1284 int ret; 1285 1286 if (skb->iif) 1287 odev = dev_get_by_index(&init_net, skb->iif); 1288 if (unlikely(odev && !is_ieee80211_device(local, odev))) { 1289 dev_put(odev); 1290 odev = NULL; 1291 } 1292 if (unlikely(!odev)) { 1293 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 1294 printk(KERN_DEBUG "%s: Discarded packet with nonexistent " 1295 "originating device\n", dev->name); 1296 #endif 1297 dev_kfree_skb(skb); 1298 return 0; 1299 } 1300 1301 memset(info, 0, sizeof(*info)); 1302 1303 info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS; 1304 1305 osdata = IEEE80211_DEV_TO_SUB_IF(odev); 1306 1307 if (ieee80211_vif_is_mesh(&osdata->vif) && 1308 ieee80211_is_data(hdr->frame_control)) { 1309 if (is_multicast_ether_addr(hdr->addr3)) 1310 memcpy(hdr->addr1, hdr->addr3, ETH_ALEN); 1311 else 1312 if (mesh_nexthop_lookup(skb, osdata)) { 1313 dev_put(odev); 1314 return 0; 1315 } 1316 if (memcmp(odev->dev_addr, hdr->addr4, ETH_ALEN) != 0) 1317 IEEE80211_IFSTA_MESH_CTR_INC(&osdata->u.mesh, 1318 fwded_frames); 1319 } else if (unlikely(osdata->vif.type == NL80211_IFTYPE_MONITOR)) { 1320 struct ieee80211_sub_if_data *sdata; 1321 int hdrlen; 1322 u16 len_rthdr; 1323 1324 info->flags |= IEEE80211_TX_CTL_INJECTED; 1325 monitor_iface = UNKNOWN_ADDRESS; 1326 1327 len_rthdr = ieee80211_get_radiotap_len(skb->data); 1328 hdr = (struct ieee80211_hdr *)skb->data + len_rthdr; 1329 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1330 1331 /* check the header is complete in the frame */ 1332 if (likely(skb->len >= len_rthdr + hdrlen)) { 1333 /* 1334 * We process outgoing injected frames that have a 1335 * local address we handle as though they are our 1336 * own frames. 1337 * This code here isn't entirely correct, the local 1338 * MAC address is not necessarily enough to find 1339 * the interface to use; for that proper VLAN/WDS 1340 * support we will need a different mechanism. 1341 */ 1342 1343 rcu_read_lock(); 1344 list_for_each_entry_rcu(sdata, &local->interfaces, 1345 list) { 1346 if (!netif_running(sdata->dev)) 1347 continue; 1348 if (sdata->vif.type != NL80211_IFTYPE_AP) 1349 continue; 1350 if (compare_ether_addr(sdata->dev->dev_addr, 1351 hdr->addr2)) { 1352 dev_hold(sdata->dev); 1353 dev_put(odev); 1354 osdata = sdata; 1355 odev = osdata->dev; 1356 skb->iif = sdata->dev->ifindex; 1357 monitor_iface = FOUND_SDATA; 1358 break; 1359 } 1360 } 1361 rcu_read_unlock(); 1362 } 1363 } 1364 1365 may_encrypt = !skb->do_not_encrypt; 1366 1367 headroom = osdata->local->tx_headroom; 1368 if (may_encrypt) 1369 headroom += IEEE80211_ENCRYPT_HEADROOM; 1370 headroom -= skb_headroom(skb); 1371 headroom = max_t(int, 0, headroom); 1372 1373 if (ieee80211_skb_resize(osdata->local, skb, headroom, may_encrypt)) { 1374 dev_kfree_skb(skb); 1375 dev_put(odev); 1376 return 0; 1377 } 1378 1379 if (osdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1380 osdata = container_of(osdata->bss, 1381 struct ieee80211_sub_if_data, 1382 u.ap); 1383 if (likely(monitor_iface != UNKNOWN_ADDRESS)) 1384 info->control.vif = &osdata->vif; 1385 ret = ieee80211_tx(odev, skb); 1386 dev_put(odev); 1387 1388 return ret; 1389 } 1390 1391 int ieee80211_monitor_start_xmit(struct sk_buff *skb, 1392 struct net_device *dev) 1393 { 1394 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); 1395 struct ieee80211_radiotap_header *prthdr = 1396 (struct ieee80211_radiotap_header *)skb->data; 1397 u16 len_rthdr; 1398 1399 /* check for not even having the fixed radiotap header part */ 1400 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header))) 1401 goto fail; /* too short to be possibly valid */ 1402 1403 /* is it a header version we can trust to find length from? */ 1404 if (unlikely(prthdr->it_version)) 1405 goto fail; /* only version 0 is supported */ 1406 1407 /* then there must be a radiotap header with a length we can use */ 1408 len_rthdr = ieee80211_get_radiotap_len(skb->data); 1409 1410 /* does the skb contain enough to deliver on the alleged length? */ 1411 if (unlikely(skb->len < len_rthdr)) 1412 goto fail; /* skb too short for claimed rt header extent */ 1413 1414 skb->dev = local->mdev; 1415 1416 /* needed because we set skb device to master */ 1417 skb->iif = dev->ifindex; 1418 1419 /* sometimes we do encrypt injected frames, will be fixed 1420 * up in radiotap parser if not wanted */ 1421 skb->do_not_encrypt = 0; 1422 1423 /* 1424 * fix up the pointers accounting for the radiotap 1425 * header still being in there. We are being given 1426 * a precooked IEEE80211 header so no need for 1427 * normal processing 1428 */ 1429 skb_set_mac_header(skb, len_rthdr); 1430 /* 1431 * these are just fixed to the end of the rt area since we 1432 * don't have any better information and at this point, nobody cares 1433 */ 1434 skb_set_network_header(skb, len_rthdr); 1435 skb_set_transport_header(skb, len_rthdr); 1436 1437 /* pass the radiotap header up to the next stage intact */ 1438 dev_queue_xmit(skb); 1439 return NETDEV_TX_OK; 1440 1441 fail: 1442 dev_kfree_skb(skb); 1443 return NETDEV_TX_OK; /* meaning, we dealt with the skb */ 1444 } 1445 1446 /** 1447 * ieee80211_subif_start_xmit - netif start_xmit function for Ethernet-type 1448 * subinterfaces (wlan#, WDS, and VLAN interfaces) 1449 * @skb: packet to be sent 1450 * @dev: incoming interface 1451 * 1452 * Returns: 0 on success (and frees skb in this case) or 1 on failure (skb will 1453 * not be freed, and caller is responsible for either retrying later or freeing 1454 * skb). 1455 * 1456 * This function takes in an Ethernet header and encapsulates it with suitable 1457 * IEEE 802.11 header based on which interface the packet is coming in. The 1458 * encapsulated packet will then be passed to master interface, wlan#.11, for 1459 * transmission (through low-level driver). 1460 */ 1461 int ieee80211_subif_start_xmit(struct sk_buff *skb, 1462 struct net_device *dev) 1463 { 1464 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); 1465 struct ieee80211_local *local = sdata->local; 1466 int ret = 1, head_need; 1467 u16 ethertype, hdrlen, meshhdrlen = 0; 1468 __le16 fc; 1469 struct ieee80211_hdr hdr; 1470 struct ieee80211s_hdr mesh_hdr; 1471 const u8 *encaps_data; 1472 int encaps_len, skip_header_bytes; 1473 int nh_pos, h_pos; 1474 struct sta_info *sta; 1475 u32 sta_flags = 0; 1476 1477 if (unlikely(skb->len < ETH_HLEN)) { 1478 ret = 0; 1479 goto fail; 1480 } 1481 1482 if (!(local->hw.flags & IEEE80211_HW_NO_STACK_DYNAMIC_PS) && 1483 local->dynamic_ps_timeout > 0) { 1484 if (local->hw.conf.flags & IEEE80211_CONF_PS) { 1485 ieee80211_stop_queues_by_reason(&local->hw, 1486 IEEE80211_QUEUE_STOP_REASON_PS); 1487 queue_work(local->hw.workqueue, 1488 &local->dynamic_ps_disable_work); 1489 } 1490 1491 mod_timer(&local->dynamic_ps_timer, jiffies + 1492 msecs_to_jiffies(local->dynamic_ps_timeout)); 1493 } 1494 1495 nh_pos = skb_network_header(skb) - skb->data; 1496 h_pos = skb_transport_header(skb) - skb->data; 1497 1498 /* convert Ethernet header to proper 802.11 header (based on 1499 * operation mode) */ 1500 ethertype = (skb->data[12] << 8) | skb->data[13]; 1501 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA); 1502 1503 switch (sdata->vif.type) { 1504 case NL80211_IFTYPE_AP: 1505 case NL80211_IFTYPE_AP_VLAN: 1506 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS); 1507 /* DA BSSID SA */ 1508 memcpy(hdr.addr1, skb->data, ETH_ALEN); 1509 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN); 1510 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN); 1511 hdrlen = 24; 1512 break; 1513 case NL80211_IFTYPE_WDS: 1514 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); 1515 /* RA TA DA SA */ 1516 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN); 1517 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN); 1518 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1519 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN); 1520 hdrlen = 30; 1521 break; 1522 #ifdef CONFIG_MAC80211_MESH 1523 case NL80211_IFTYPE_MESH_POINT: 1524 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS); 1525 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) { 1526 /* Do not send frames with mesh_ttl == 0 */ 1527 sdata->u.mesh.mshstats.dropped_frames_ttl++; 1528 ret = 0; 1529 goto fail; 1530 } 1531 memset(&mesh_hdr, 0, sizeof(mesh_hdr)); 1532 1533 if (compare_ether_addr(dev->dev_addr, 1534 skb->data + ETH_ALEN) == 0) { 1535 /* RA TA DA SA */ 1536 memset(hdr.addr1, 0, ETH_ALEN); 1537 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN); 1538 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1539 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN); 1540 meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr, sdata); 1541 } else { 1542 /* packet from other interface */ 1543 struct mesh_path *mppath; 1544 1545 memset(hdr.addr1, 0, ETH_ALEN); 1546 memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN); 1547 memcpy(hdr.addr4, dev->dev_addr, ETH_ALEN); 1548 1549 if (is_multicast_ether_addr(skb->data)) 1550 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1551 else { 1552 rcu_read_lock(); 1553 mppath = mpp_path_lookup(skb->data, sdata); 1554 if (mppath) 1555 memcpy(hdr.addr3, mppath->mpp, ETH_ALEN); 1556 else 1557 memset(hdr.addr3, 0xff, ETH_ALEN); 1558 rcu_read_unlock(); 1559 } 1560 1561 mesh_hdr.flags |= MESH_FLAGS_AE_A5_A6; 1562 mesh_hdr.ttl = sdata->u.mesh.mshcfg.dot11MeshTTL; 1563 put_unaligned(cpu_to_le32(sdata->u.mesh.mesh_seqnum), &mesh_hdr.seqnum); 1564 memcpy(mesh_hdr.eaddr1, skb->data, ETH_ALEN); 1565 memcpy(mesh_hdr.eaddr2, skb->data + ETH_ALEN, ETH_ALEN); 1566 sdata->u.mesh.mesh_seqnum++; 1567 meshhdrlen = 18; 1568 } 1569 hdrlen = 30; 1570 break; 1571 #endif 1572 case NL80211_IFTYPE_STATION: 1573 fc |= cpu_to_le16(IEEE80211_FCTL_TODS); 1574 /* BSSID SA DA */ 1575 memcpy(hdr.addr1, sdata->u.sta.bssid, ETH_ALEN); 1576 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN); 1577 memcpy(hdr.addr3, skb->data, ETH_ALEN); 1578 hdrlen = 24; 1579 break; 1580 case NL80211_IFTYPE_ADHOC: 1581 /* DA SA BSSID */ 1582 memcpy(hdr.addr1, skb->data, ETH_ALEN); 1583 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN); 1584 memcpy(hdr.addr3, sdata->u.sta.bssid, ETH_ALEN); 1585 hdrlen = 24; 1586 break; 1587 default: 1588 ret = 0; 1589 goto fail; 1590 } 1591 1592 /* 1593 * There's no need to try to look up the destination 1594 * if it is a multicast address (which can only happen 1595 * in AP mode) 1596 */ 1597 if (!is_multicast_ether_addr(hdr.addr1)) { 1598 rcu_read_lock(); 1599 sta = sta_info_get(local, hdr.addr1); 1600 if (sta) 1601 sta_flags = get_sta_flags(sta); 1602 rcu_read_unlock(); 1603 } 1604 1605 /* receiver and we are QoS enabled, use a QoS type frame */ 1606 if (sta_flags & WLAN_STA_WME && 1607 ieee80211_num_regular_queues(&local->hw) >= 4) { 1608 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA); 1609 hdrlen += 2; 1610 } 1611 1612 /* 1613 * Drop unicast frames to unauthorised stations unless they are 1614 * EAPOL frames from the local station. 1615 */ 1616 if (!ieee80211_vif_is_mesh(&sdata->vif) && 1617 unlikely(!is_multicast_ether_addr(hdr.addr1) && 1618 !(sta_flags & WLAN_STA_AUTHORIZED) && 1619 !(ethertype == ETH_P_PAE && 1620 compare_ether_addr(dev->dev_addr, 1621 skb->data + ETH_ALEN) == 0))) { 1622 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 1623 if (net_ratelimit()) 1624 printk(KERN_DEBUG "%s: dropped frame to %pM" 1625 " (unauthorized port)\n", dev->name, 1626 hdr.addr1); 1627 #endif 1628 1629 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port); 1630 1631 ret = 0; 1632 goto fail; 1633 } 1634 1635 hdr.frame_control = fc; 1636 hdr.duration_id = 0; 1637 hdr.seq_ctrl = 0; 1638 1639 skip_header_bytes = ETH_HLEN; 1640 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) { 1641 encaps_data = bridge_tunnel_header; 1642 encaps_len = sizeof(bridge_tunnel_header); 1643 skip_header_bytes -= 2; 1644 } else if (ethertype >= 0x600) { 1645 encaps_data = rfc1042_header; 1646 encaps_len = sizeof(rfc1042_header); 1647 skip_header_bytes -= 2; 1648 } else { 1649 encaps_data = NULL; 1650 encaps_len = 0; 1651 } 1652 1653 skb_pull(skb, skip_header_bytes); 1654 nh_pos -= skip_header_bytes; 1655 h_pos -= skip_header_bytes; 1656 1657 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb); 1658 1659 /* 1660 * So we need to modify the skb header and hence need a copy of 1661 * that. The head_need variable above doesn't, so far, include 1662 * the needed header space that we don't need right away. If we 1663 * can, then we don't reallocate right now but only after the 1664 * frame arrives at the master device (if it does...) 1665 * 1666 * If we cannot, however, then we will reallocate to include all 1667 * the ever needed space. Also, if we need to reallocate it anyway, 1668 * make it big enough for everything we may ever need. 1669 */ 1670 1671 if (head_need > 0 || skb_cloned(skb)) { 1672 head_need += IEEE80211_ENCRYPT_HEADROOM; 1673 head_need += local->tx_headroom; 1674 head_need = max_t(int, 0, head_need); 1675 if (ieee80211_skb_resize(local, skb, head_need, true)) 1676 goto fail; 1677 } 1678 1679 if (encaps_data) { 1680 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len); 1681 nh_pos += encaps_len; 1682 h_pos += encaps_len; 1683 } 1684 1685 if (meshhdrlen > 0) { 1686 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen); 1687 nh_pos += meshhdrlen; 1688 h_pos += meshhdrlen; 1689 } 1690 1691 if (ieee80211_is_data_qos(fc)) { 1692 __le16 *qos_control; 1693 1694 qos_control = (__le16*) skb_push(skb, 2); 1695 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2); 1696 /* 1697 * Maybe we could actually set some fields here, for now just 1698 * initialise to zero to indicate no special operation. 1699 */ 1700 *qos_control = 0; 1701 } else 1702 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen); 1703 1704 nh_pos += hdrlen; 1705 h_pos += hdrlen; 1706 1707 skb->iif = dev->ifindex; 1708 1709 skb->dev = local->mdev; 1710 dev->stats.tx_packets++; 1711 dev->stats.tx_bytes += skb->len; 1712 1713 /* Update skb pointers to various headers since this modified frame 1714 * is going to go through Linux networking code that may potentially 1715 * need things like pointer to IP header. */ 1716 skb_set_mac_header(skb, 0); 1717 skb_set_network_header(skb, nh_pos); 1718 skb_set_transport_header(skb, h_pos); 1719 1720 dev->trans_start = jiffies; 1721 dev_queue_xmit(skb); 1722 1723 return 0; 1724 1725 fail: 1726 if (!ret) 1727 dev_kfree_skb(skb); 1728 1729 return ret; 1730 } 1731 1732 1733 /* 1734 * ieee80211_clear_tx_pending may not be called in a context where 1735 * it is possible that it packets could come in again. 1736 */ 1737 void ieee80211_clear_tx_pending(struct ieee80211_local *local) 1738 { 1739 int i, j; 1740 struct ieee80211_tx_stored_packet *store; 1741 1742 for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) { 1743 if (!test_bit(i, local->queues_pending)) 1744 continue; 1745 store = &local->pending_packet[i]; 1746 kfree_skb(store->skb); 1747 for (j = 0; j < store->num_extra_frag; j++) 1748 kfree_skb(store->extra_frag[j]); 1749 kfree(store->extra_frag); 1750 clear_bit(i, local->queues_pending); 1751 } 1752 } 1753 1754 /* 1755 * Transmit all pending packets. Called from tasklet, locks master device 1756 * TX lock so that no new packets can come in. 1757 */ 1758 void ieee80211_tx_pending(unsigned long data) 1759 { 1760 struct ieee80211_local *local = (struct ieee80211_local *)data; 1761 struct net_device *dev = local->mdev; 1762 struct ieee80211_tx_stored_packet *store; 1763 struct ieee80211_tx_data tx; 1764 int i, ret; 1765 1766 netif_tx_lock_bh(dev); 1767 for (i = 0; i < ieee80211_num_regular_queues(&local->hw); i++) { 1768 /* Check that this queue is ok */ 1769 if (__netif_subqueue_stopped(local->mdev, i) && 1770 !test_bit(i, local->queues_pending_run)) 1771 continue; 1772 1773 if (!test_bit(i, local->queues_pending)) { 1774 clear_bit(i, local->queues_pending_run); 1775 ieee80211_wake_queue(&local->hw, i); 1776 continue; 1777 } 1778 1779 clear_bit(i, local->queues_pending_run); 1780 netif_start_subqueue(local->mdev, i); 1781 1782 store = &local->pending_packet[i]; 1783 tx.extra_frag = store->extra_frag; 1784 tx.num_extra_frag = store->num_extra_frag; 1785 tx.flags = 0; 1786 ret = __ieee80211_tx(local, store->skb, &tx); 1787 if (ret) { 1788 if (ret == IEEE80211_TX_FRAG_AGAIN) 1789 store->skb = NULL; 1790 } else { 1791 clear_bit(i, local->queues_pending); 1792 ieee80211_wake_queue(&local->hw, i); 1793 } 1794 } 1795 netif_tx_unlock_bh(dev); 1796 } 1797 1798 /* functions for drivers to get certain frames */ 1799 1800 static void ieee80211_beacon_add_tim(struct ieee80211_if_ap *bss, 1801 struct sk_buff *skb, 1802 struct beacon_data *beacon) 1803 { 1804 u8 *pos, *tim; 1805 int aid0 = 0; 1806 int i, have_bits = 0, n1, n2; 1807 1808 /* Generate bitmap for TIM only if there are any STAs in power save 1809 * mode. */ 1810 if (atomic_read(&bss->num_sta_ps) > 0) 1811 /* in the hope that this is faster than 1812 * checking byte-for-byte */ 1813 have_bits = !bitmap_empty((unsigned long*)bss->tim, 1814 IEEE80211_MAX_AID+1); 1815 1816 if (bss->dtim_count == 0) 1817 bss->dtim_count = beacon->dtim_period - 1; 1818 else 1819 bss->dtim_count--; 1820 1821 tim = pos = (u8 *) skb_put(skb, 6); 1822 *pos++ = WLAN_EID_TIM; 1823 *pos++ = 4; 1824 *pos++ = bss->dtim_count; 1825 *pos++ = beacon->dtim_period; 1826 1827 if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf)) 1828 aid0 = 1; 1829 1830 if (have_bits) { 1831 /* Find largest even number N1 so that bits numbered 1 through 1832 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits 1833 * (N2 + 1) x 8 through 2007 are 0. */ 1834 n1 = 0; 1835 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) { 1836 if (bss->tim[i]) { 1837 n1 = i & 0xfe; 1838 break; 1839 } 1840 } 1841 n2 = n1; 1842 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) { 1843 if (bss->tim[i]) { 1844 n2 = i; 1845 break; 1846 } 1847 } 1848 1849 /* Bitmap control */ 1850 *pos++ = n1 | aid0; 1851 /* Part Virt Bitmap */ 1852 memcpy(pos, bss->tim + n1, n2 - n1 + 1); 1853 1854 tim[1] = n2 - n1 + 4; 1855 skb_put(skb, n2 - n1); 1856 } else { 1857 *pos++ = aid0; /* Bitmap control */ 1858 *pos++ = 0; /* Part Virt Bitmap */ 1859 } 1860 } 1861 1862 struct sk_buff *ieee80211_beacon_get(struct ieee80211_hw *hw, 1863 struct ieee80211_vif *vif) 1864 { 1865 struct ieee80211_local *local = hw_to_local(hw); 1866 struct sk_buff *skb = NULL; 1867 struct ieee80211_tx_info *info; 1868 struct ieee80211_sub_if_data *sdata = NULL; 1869 struct ieee80211_if_ap *ap = NULL; 1870 struct ieee80211_if_sta *ifsta = NULL; 1871 struct beacon_data *beacon; 1872 struct ieee80211_supported_band *sband; 1873 enum ieee80211_band band = local->hw.conf.channel->band; 1874 1875 sband = local->hw.wiphy->bands[band]; 1876 1877 rcu_read_lock(); 1878 1879 sdata = vif_to_sdata(vif); 1880 1881 if (sdata->vif.type == NL80211_IFTYPE_AP) { 1882 ap = &sdata->u.ap; 1883 beacon = rcu_dereference(ap->beacon); 1884 if (ap && beacon) { 1885 /* 1886 * headroom, head length, 1887 * tail length and maximum TIM length 1888 */ 1889 skb = dev_alloc_skb(local->tx_headroom + 1890 beacon->head_len + 1891 beacon->tail_len + 256); 1892 if (!skb) 1893 goto out; 1894 1895 skb_reserve(skb, local->tx_headroom); 1896 memcpy(skb_put(skb, beacon->head_len), beacon->head, 1897 beacon->head_len); 1898 1899 /* 1900 * Not very nice, but we want to allow the driver to call 1901 * ieee80211_beacon_get() as a response to the set_tim() 1902 * callback. That, however, is already invoked under the 1903 * sta_lock to guarantee consistent and race-free update 1904 * of the tim bitmap in mac80211 and the driver. 1905 */ 1906 if (local->tim_in_locked_section) { 1907 ieee80211_beacon_add_tim(ap, skb, beacon); 1908 } else { 1909 unsigned long flags; 1910 1911 spin_lock_irqsave(&local->sta_lock, flags); 1912 ieee80211_beacon_add_tim(ap, skb, beacon); 1913 spin_unlock_irqrestore(&local->sta_lock, flags); 1914 } 1915 1916 if (beacon->tail) 1917 memcpy(skb_put(skb, beacon->tail_len), 1918 beacon->tail, beacon->tail_len); 1919 } else 1920 goto out; 1921 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1922 struct ieee80211_hdr *hdr; 1923 ifsta = &sdata->u.sta; 1924 1925 if (!ifsta->probe_resp) 1926 goto out; 1927 1928 skb = skb_copy(ifsta->probe_resp, GFP_ATOMIC); 1929 if (!skb) 1930 goto out; 1931 1932 hdr = (struct ieee80211_hdr *) skb->data; 1933 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 1934 IEEE80211_STYPE_BEACON); 1935 1936 } else if (ieee80211_vif_is_mesh(&sdata->vif)) { 1937 struct ieee80211_mgmt *mgmt; 1938 u8 *pos; 1939 1940 /* headroom, head length, tail length and maximum TIM length */ 1941 skb = dev_alloc_skb(local->tx_headroom + 400); 1942 if (!skb) 1943 goto out; 1944 1945 skb_reserve(skb, local->hw.extra_tx_headroom); 1946 mgmt = (struct ieee80211_mgmt *) 1947 skb_put(skb, 24 + sizeof(mgmt->u.beacon)); 1948 memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon)); 1949 mgmt->frame_control = 1950 cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON); 1951 memset(mgmt->da, 0xff, ETH_ALEN); 1952 memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN); 1953 /* BSSID is left zeroed, wildcard value */ 1954 mgmt->u.beacon.beacon_int = 1955 cpu_to_le16(local->hw.conf.beacon_int); 1956 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */ 1957 1958 pos = skb_put(skb, 2); 1959 *pos++ = WLAN_EID_SSID; 1960 *pos++ = 0x0; 1961 1962 mesh_mgmt_ies_add(skb, sdata); 1963 } else { 1964 WARN_ON(1); 1965 goto out; 1966 } 1967 1968 info = IEEE80211_SKB_CB(skb); 1969 1970 skb->do_not_encrypt = 1; 1971 1972 info->band = band; 1973 /* 1974 * XXX: For now, always use the lowest rate 1975 */ 1976 info->control.rates[0].idx = 0; 1977 info->control.rates[0].count = 1; 1978 info->control.rates[1].idx = -1; 1979 info->control.rates[2].idx = -1; 1980 info->control.rates[3].idx = -1; 1981 info->control.rates[4].idx = -1; 1982 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5); 1983 1984 info->control.vif = vif; 1985 1986 info->flags |= IEEE80211_TX_CTL_NO_ACK; 1987 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT; 1988 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ; 1989 out: 1990 rcu_read_unlock(); 1991 return skb; 1992 } 1993 EXPORT_SYMBOL(ieee80211_beacon_get); 1994 1995 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 1996 const void *frame, size_t frame_len, 1997 const struct ieee80211_tx_info *frame_txctl, 1998 struct ieee80211_rts *rts) 1999 { 2000 const struct ieee80211_hdr *hdr = frame; 2001 2002 rts->frame_control = 2003 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS); 2004 rts->duration = ieee80211_rts_duration(hw, vif, frame_len, 2005 frame_txctl); 2006 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra)); 2007 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta)); 2008 } 2009 EXPORT_SYMBOL(ieee80211_rts_get); 2010 2011 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 2012 const void *frame, size_t frame_len, 2013 const struct ieee80211_tx_info *frame_txctl, 2014 struct ieee80211_cts *cts) 2015 { 2016 const struct ieee80211_hdr *hdr = frame; 2017 2018 cts->frame_control = 2019 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS); 2020 cts->duration = ieee80211_ctstoself_duration(hw, vif, 2021 frame_len, frame_txctl); 2022 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra)); 2023 } 2024 EXPORT_SYMBOL(ieee80211_ctstoself_get); 2025 2026 struct sk_buff * 2027 ieee80211_get_buffered_bc(struct ieee80211_hw *hw, 2028 struct ieee80211_vif *vif) 2029 { 2030 struct ieee80211_local *local = hw_to_local(hw); 2031 struct sk_buff *skb = NULL; 2032 struct sta_info *sta; 2033 struct ieee80211_tx_data tx; 2034 struct ieee80211_sub_if_data *sdata; 2035 struct ieee80211_if_ap *bss = NULL; 2036 struct beacon_data *beacon; 2037 struct ieee80211_tx_info *info; 2038 2039 sdata = vif_to_sdata(vif); 2040 bss = &sdata->u.ap; 2041 2042 if (!bss) 2043 return NULL; 2044 2045 rcu_read_lock(); 2046 beacon = rcu_dereference(bss->beacon); 2047 2048 if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head) 2049 goto out; 2050 2051 if (bss->dtim_count != 0) 2052 goto out; /* send buffered bc/mc only after DTIM beacon */ 2053 2054 while (1) { 2055 skb = skb_dequeue(&bss->ps_bc_buf); 2056 if (!skb) 2057 goto out; 2058 local->total_ps_buffered--; 2059 2060 if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) { 2061 struct ieee80211_hdr *hdr = 2062 (struct ieee80211_hdr *) skb->data; 2063 /* more buffered multicast/broadcast frames ==> set 2064 * MoreData flag in IEEE 802.11 header to inform PS 2065 * STAs */ 2066 hdr->frame_control |= 2067 cpu_to_le16(IEEE80211_FCTL_MOREDATA); 2068 } 2069 2070 if (!ieee80211_tx_prepare(local, &tx, skb)) 2071 break; 2072 dev_kfree_skb_any(skb); 2073 } 2074 2075 info = IEEE80211_SKB_CB(skb); 2076 2077 sta = tx.sta; 2078 tx.flags |= IEEE80211_TX_PS_BUFFERED; 2079 tx.channel = local->hw.conf.channel; 2080 info->band = tx.channel->band; 2081 2082 if (invoke_tx_handlers(&tx)) 2083 skb = NULL; 2084 out: 2085 rcu_read_unlock(); 2086 2087 return skb; 2088 } 2089 EXPORT_SYMBOL(ieee80211_get_buffered_bc); 2090