tx.c
Go to the documentation of this file.
00001 /*
00002  * Copyright 2002-2005, Instant802 Networks, Inc.
00003  * Copyright 2005-2006, Devicescape Software, Inc.
00004  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
00005  * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
00006  *
00007  * This program is free software; you can redistribute it and/or modify
00008  * it under the terms of the GNU General Public License version 2 as
00009  * published by the Free Software Foundation.
00010  *
00011  *
00012  * Transmit and frame generation functions.
00013  */
00014 
00015 #include <linux/kernel.h>
00016 #include <linux/slab.h>
00017 #include <linux/skbuff.h>
00018 #include <linux/etherdevice.h>
00019 #include <linux/bitmap.h>
00020 #include <linux/rcupdate.h>
00021 #include <linux/export.h>
00022 #include <net/net_namespace.h>
00023 #include <net/ieee80211_radiotap.h>
00024 #include <net/cfg80211.h>
00025 #include <net/mac80211.h>
00026 #include <asm/unaligned.h>
00027 
00028 #include "ieee80211_i.h"
00029 #include "driver-ops.h"
00030 #include "led.h"
00031 #include "mesh.h"
00032 #include "wep.h"
00033 #include "wpa.h"
00034 #include "wme.h"
00035 #include "rate.h"
00036 
00037 /* misc utils */
00038 
00039 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
00040                                  struct sk_buff *skb, int group_addr,
00041                                  int next_frag_len)
00042 {
00043         int rate, mrate, erp, dur, i;
00044         struct ieee80211_rate *txrate;
00045         struct ieee80211_local *local = tx->local;
00046         struct ieee80211_supported_band *sband;
00047         struct ieee80211_hdr *hdr;
00048         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
00049 
00050         /* assume HW handles this */
00051         if (info->control.rates[0].flags & IEEE80211_TX_RC_MCS)
00052                 return 0;
00053 
00054         /* uh huh? */
00055         if (WARN_ON_ONCE(info->control.rates[0].idx < 0))
00056                 return 0;
00057 
00058         sband = local->hw.wiphy->bands[tx->channel->band];
00059         txrate = &sband->bitrates[info->control.rates[0].idx];
00060 
00061         erp = txrate->flags & IEEE80211_RATE_ERP_G;
00062 
00063         /*
00064          * data and mgmt (except PS Poll):
00065          * - during CFP: 32768
00066          * - during contention period:
00067          *   if addr1 is group address: 0
00068          *   if more fragments = 0 and addr1 is individual address: time to
00069          *      transmit one ACK plus SIFS
00070          *   if more fragments = 1 and addr1 is individual address: time to
00071          *      transmit next fragment plus 2 x ACK plus 3 x SIFS
00072          *
00073          * IEEE 802.11, 9.6:
00074          * - control response frame (CTS or ACK) shall be transmitted using the
00075          *   same rate as the immediately previous frame in the frame exchange
00076          *   sequence, if this rate belongs to the PHY mandatory rates, or else
00077          *   at the highest possible rate belonging to the PHY rates in the
00078          *   BSSBasicRateSet
00079          */
00080         hdr = (struct ieee80211_hdr *)skb->data;
00081         if (ieee80211_is_ctl(hdr->frame_control)) {
00082                 /* TODO: These control frames are not currently sent by
00083                  * mac80211, but should they be implemented, this function
00084                  * needs to be updated to support duration field calculation.
00085                  *
00086                  * RTS: time needed to transmit pending data/mgmt frame plus
00087                  *    one CTS frame plus one ACK frame plus 3 x SIFS
00088                  * CTS: duration of immediately previous RTS minus time
00089                  *    required to transmit CTS and its SIFS
00090                  * ACK: 0 if immediately previous directed data/mgmt had
00091                  *    more=0, with more=1 duration in ACK frame is duration
00092                  *    from previous frame minus time needed to transmit ACK
00093                  *    and its SIFS
00094                  * PS Poll: BIT(15) | BIT(14) | aid
00095                  */
00096                 return 0;
00097         }
00098 
00099         /* data/mgmt */
00100         if (0 /* FIX: data/mgmt during CFP */)
00101                 return cpu_to_le16(32768);
00102 
00103         if (group_addr) /* Group address as the destination - no ACK */
00104                 return 0;
00105 
00106         /* Individual destination address:
00107          * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
00108          * CTS and ACK frames shall be transmitted using the highest rate in
00109          * basic rate set that is less than or equal to the rate of the
00110          * immediately previous frame and that is using the same modulation
00111          * (CCK or OFDM). If no basic rate set matches with these requirements,
00112          * the highest mandatory rate of the PHY that is less than or equal to
00113          * the rate of the previous frame is used.
00114          * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
00115          */
00116         rate = -1;
00117         /* use lowest available if everything fails */
00118         mrate = sband->bitrates[0].bitrate;
00119         for (i = 0; i < sband->n_bitrates; i++) {
00120                 struct ieee80211_rate *r = &sband->bitrates[i];
00121 
00122                 if (r->bitrate > txrate->bitrate)
00123                         break;
00124 
00125                 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
00126                         rate = r->bitrate;
00127 
00128                 switch (sband->band) {
00129                 case IEEE80211_BAND_2GHZ: {
00130                         u32 flag;
00131                         if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
00132                                 flag = IEEE80211_RATE_MANDATORY_G;
00133                         else
00134                                 flag = IEEE80211_RATE_MANDATORY_B;
00135                         if (r->flags & flag)
00136                                 mrate = r->bitrate;
00137                         break;
00138                 }
00139                 case IEEE80211_BAND_5GHZ:
00140                         if (r->flags & IEEE80211_RATE_MANDATORY_A)
00141                                 mrate = r->bitrate;
00142                         break;
00143                 case IEEE80211_NUM_BANDS:
00144                         WARN_ON(1);
00145                         break;
00146                 }
00147         }
00148         if (rate == -1) {
00149                 /* No matching basic rate found; use highest suitable mandatory
00150                  * PHY rate */
00151                 rate = mrate;
00152         }
00153 
00154         /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
00155         if (ieee80211_is_data_qos(hdr->frame_control) &&
00156             *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
00157                 dur = 0;
00158         else
00159                 /* Time needed to transmit ACK
00160                  * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
00161                  * to closest integer */
00162                 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
00163                                 tx->sdata->vif.bss_conf.use_short_preamble);
00164 
00165         if (next_frag_len) {
00166                 /* Frame is fragmented: duration increases with time needed to
00167                  * transmit next fragment plus ACK and 2 x SIFS. */
00168                 dur *= 2; /* ACK + SIFS */
00169                 /* next fragment */
00170                 dur += ieee80211_frame_duration(sband->band, next_frag_len,
00171                                 txrate->bitrate, erp,
00172                                 tx->sdata->vif.bss_conf.use_short_preamble);
00173         }
00174 
00175         return cpu_to_le16(dur);
00176 }
00177 
00178 static inline int is_ieee80211_device(struct ieee80211_local *local,
00179                                       struct net_device *dev)
00180 {
00181         return local == wdev_priv(dev->ieee80211_ptr);
00182 }
00183 
00184 /* tx handlers */
00185 static ieee80211_tx_result debug_noinline
00186 ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
00187 {
00188         struct ieee80211_local *local = tx->local;
00189         struct ieee80211_if_managed *ifmgd;
00190 
00191         /* driver doesn't support power save */
00192         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
00193                 return TX_CONTINUE;
00194 
00195         /* hardware does dynamic power save */
00196         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
00197                 return TX_CONTINUE;
00198 
00199         /* dynamic power save disabled */
00200         if (local->hw.conf.dynamic_ps_timeout <= 0)
00201                 return TX_CONTINUE;
00202 
00203         /* we are scanning, don't enable power save */
00204         if (local->scanning)
00205                 return TX_CONTINUE;
00206 
00207         if (!local->ps_sdata)
00208                 return TX_CONTINUE;
00209 
00210         /* No point if we're going to suspend */
00211         if (local->quiescing)
00212                 return TX_CONTINUE;
00213 
00214         /* dynamic ps is supported only in managed mode */
00215         if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
00216                 return TX_CONTINUE;
00217 
00218         ifmgd = &tx->sdata->u.mgd;
00219 
00220         /*
00221          * Don't wakeup from power save if u-apsd is enabled, voip ac has
00222          * u-apsd enabled and the frame is in voip class. This effectively
00223          * means that even if all access categories have u-apsd enabled, in
00224          * practise u-apsd is only used with the voip ac. This is a
00225          * workaround for the case when received voip class packets do not
00226          * have correct qos tag for some reason, due the network or the
00227          * peer application.
00228          *
00229          * Note: ifmgd->uapsd_queues access is racy here. If the value is
00230          * changed via debugfs, user needs to reassociate manually to have
00231          * everything in sync.
00232          */
00233         if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
00234             (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
00235             skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
00236                 return TX_CONTINUE;
00237 
00238         if (local->hw.conf.flags & IEEE80211_CONF_PS) {
00239                 ieee80211_stop_queues_by_reason(&local->hw,
00240                                                 IEEE80211_QUEUE_STOP_REASON_PS);
00241                 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
00242                 ieee80211_queue_work(&local->hw,
00243                                      &local->dynamic_ps_disable_work);
00244         }
00245 
00246         /* Don't restart the timer if we're not disassociated */
00247         if (!ifmgd->associated)
00248                 return TX_CONTINUE;
00249 
00250         mod_timer(&local->dynamic_ps_timer, jiffies +
00251                   msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
00252 
00253         return TX_CONTINUE;
00254 }
00255 
00256 static ieee80211_tx_result debug_noinline
00257 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
00258 {
00259 
00260         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
00261         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00262         bool assoc = false;
00263 
00264         if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
00265                 return TX_CONTINUE;
00266 
00267         if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
00268             test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
00269             !ieee80211_is_probe_req(hdr->frame_control) &&
00270             !ieee80211_is_nullfunc(hdr->frame_control))
00271                 /*
00272                  * When software scanning only nullfunc frames (to notify
00273                  * the sleep state to the AP) and probe requests (for the
00274                  * active scan) are allowed, all other frames should not be
00275                  * sent and we should not get here, but if we do
00276                  * nonetheless, drop them to avoid sending them
00277                  * off-channel. See the link below and
00278                  * ieee80211_start_scan() for more.
00279                  *
00280                  * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
00281                  */
00282                 return TX_DROP;
00283 
00284         if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
00285                 return TX_CONTINUE;
00286 
00287         if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
00288                 return TX_CONTINUE;
00289 
00290         if (tx->flags & IEEE80211_TX_PS_BUFFERED)
00291                 return TX_CONTINUE;
00292 
00293         if (tx->sta)
00294                 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
00295 
00296         if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
00297                 if (unlikely(!assoc &&
00298                              ieee80211_is_data(hdr->frame_control))) {
00299 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
00300                         printk(KERN_DEBUG "%s: dropped data frame to not "
00301                                "associated station %pM\n",
00302                                tx->sdata->name, hdr->addr1);
00303 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
00304                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
00305                         return TX_DROP;
00306                 }
00307         } else if (unlikely(tx->sdata->vif.type == NL80211_IFTYPE_AP &&
00308                             ieee80211_is_data(hdr->frame_control) &&
00309                             !atomic_read(&tx->sdata->u.ap.num_mcast_sta))) {
00310                 /*
00311                  * No associated STAs - no need to send multicast
00312                  * frames.
00313                  */
00314                 return TX_DROP;
00315         }
00316 
00317         return TX_CONTINUE;
00318 }
00319 
00320 /* This function is called whenever the AP is about to exceed the maximum limit
00321  * of buffered frames for power saving STAs. This situation should not really
00322  * happen often during normal operation, so dropping the oldest buffered packet
00323  * from each queue should be OK to make some room for new frames. */
00324 static void purge_old_ps_buffers(struct ieee80211_local *local)
00325 {
00326         int total = 0, purged = 0;
00327         struct sk_buff *skb;
00328         struct ieee80211_sub_if_data *sdata;
00329         struct sta_info *sta;
00330 
00331         /*
00332          * virtual interfaces are protected by RCU
00333          */
00334         rcu_read_lock();
00335 
00336         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
00337                 struct ieee80211_if_ap *ap;
00338                 if (sdata->vif.type != NL80211_IFTYPE_AP)
00339                         continue;
00340                 ap = &sdata->u.ap;
00341                 skb = skb_dequeue(&ap->ps_bc_buf);
00342                 if (skb) {
00343                         purged++;
00344                         dev_kfree_skb(skb);
00345                 }
00346                 total += skb_queue_len(&ap->ps_bc_buf);
00347         }
00348 
00349         /*
00350          * Drop one frame from each station from the lowest-priority
00351          * AC that has frames at all.
00352          */
00353         list_for_each_entry_rcu(sta, &local->sta_list, list) {
00354                 int ac;
00355 
00356                 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
00357                         skb = skb_dequeue(&sta->ps_tx_buf[ac]);
00358                         total += skb_queue_len(&sta->ps_tx_buf[ac]);
00359                         if (skb) {
00360                                 purged++;
00361                                 dev_kfree_skb(skb);
00362                                 break;
00363                         }
00364                 }
00365         }
00366 
00367         rcu_read_unlock();
00368 
00369         local->total_ps_buffered = total;
00370 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
00371         wiphy_debug(local->hw.wiphy, "PS buffers full - purged %d frames\n",
00372                     purged);
00373 #endif
00374 }
00375 
00376 static ieee80211_tx_result
00377 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
00378 {
00379         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00380         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
00381 
00382         /*
00383          * broadcast/multicast frame
00384          *
00385          * If any of the associated stations is in power save mode,
00386          * the frame is buffered to be sent after DTIM beacon frame.
00387          * This is done either by the hardware or us.
00388          */
00389 
00390         /* powersaving STAs only in AP/VLAN mode */
00391         if (!tx->sdata->bss)
00392                 return TX_CONTINUE;
00393 
00394         /* no buffering for ordered frames */
00395         if (ieee80211_has_order(hdr->frame_control))
00396                 return TX_CONTINUE;
00397 
00398         /* no stations in PS mode */
00399         if (!atomic_read(&tx->sdata->bss->num_sta_ps))
00400                 return TX_CONTINUE;
00401 
00402         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
00403         if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
00404                 info->hw_queue = tx->sdata->vif.cab_queue;
00405 
00406         /* device releases frame after DTIM beacon */
00407         if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
00408                 return TX_CONTINUE;
00409 
00410         /* buffered in mac80211 */
00411         if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
00412                 purge_old_ps_buffers(tx->local);
00413 
00414         if (skb_queue_len(&tx->sdata->bss->ps_bc_buf) >= AP_MAX_BC_BUFFER) {
00415 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
00416                 net_dbg_ratelimited("%s: BC TX buffer full - dropping the oldest frame\n",
00417                                     tx->sdata->name);
00418 #endif
00419                 dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
00420         } else
00421                 tx->local->total_ps_buffered++;
00422 
00423         skb_queue_tail(&tx->sdata->bss->ps_bc_buf, tx->skb);
00424 
00425         return TX_QUEUED;
00426 }
00427 
00428 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
00429                              struct sk_buff *skb)
00430 {
00431         if (!ieee80211_is_mgmt(fc))
00432                 return 0;
00433 
00434         if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
00435                 return 0;
00436 
00437         if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *)
00438                                             skb->data))
00439                 return 0;
00440 
00441         return 1;
00442 }
00443 
00444 static ieee80211_tx_result
00445 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
00446 {
00447         struct sta_info *sta = tx->sta;
00448         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00449         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
00450         struct ieee80211_local *local = tx->local;
00451 
00452         if (unlikely(!sta))
00453                 return TX_CONTINUE;
00454 
00455         if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
00456                       test_sta_flag(sta, WLAN_STA_PS_DRIVER)) &&
00457                      !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
00458                 int ac = skb_get_queue_mapping(tx->skb);
00459 
00460                 /* only deauth, disassoc and action are bufferable MMPDUs */
00461                 if (ieee80211_is_mgmt(hdr->frame_control) &&
00462                     !ieee80211_is_deauth(hdr->frame_control) &&
00463                     !ieee80211_is_disassoc(hdr->frame_control) &&
00464                     !ieee80211_is_action(hdr->frame_control)) {
00465                         info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
00466                         return TX_CONTINUE;
00467                 }
00468 
00469 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
00470                 printk(KERN_DEBUG "STA %pM aid %d: PS buffer for AC %d\n",
00471                        sta->sta.addr, sta->sta.aid, ac);
00472 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
00473                 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
00474                         purge_old_ps_buffers(tx->local);
00475                 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
00476                         struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
00477 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
00478                         net_dbg_ratelimited("%s: STA %pM TX buffer for AC %d full - dropping oldest frame\n",
00479                                             tx->sdata->name, sta->sta.addr, ac);
00480 #endif
00481                         dev_kfree_skb(old);
00482                 } else
00483                         tx->local->total_ps_buffered++;
00484 
00485                 info->control.jiffies = jiffies;
00486                 info->control.vif = &tx->sdata->vif;
00487                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
00488                 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
00489 
00490                 if (!timer_pending(&local->sta_cleanup))
00491                         mod_timer(&local->sta_cleanup,
00492                                   round_jiffies(jiffies +
00493                                                 STA_INFO_CLEANUP_INTERVAL));
00494 
00495                 /*
00496                  * We queued up some frames, so the TIM bit might
00497                  * need to be set, recalculate it.
00498                  */
00499                 sta_info_recalc_tim(sta);
00500 
00501                 return TX_QUEUED;
00502         }
00503 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
00504         else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
00505                 printk(KERN_DEBUG
00506                        "%s: STA %pM in PS mode, but polling/in SP -> send frame\n",
00507                        tx->sdata->name, sta->sta.addr);
00508         }
00509 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
00510 
00511         return TX_CONTINUE;
00512 }
00513 
00514 static ieee80211_tx_result debug_noinline
00515 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
00516 {
00517         if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
00518                 return TX_CONTINUE;
00519 
00520         if (tx->flags & IEEE80211_TX_UNICAST)
00521                 return ieee80211_tx_h_unicast_ps_buf(tx);
00522         else
00523                 return ieee80211_tx_h_multicast_ps_buf(tx);
00524 }
00525 
00526 static ieee80211_tx_result debug_noinline
00527 ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
00528 {
00529         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00530 
00531         if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol &&
00532                      tx->sdata->control_port_no_encrypt))
00533                 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
00534 
00535         return TX_CONTINUE;
00536 }
00537 
00538 static ieee80211_tx_result debug_noinline
00539 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
00540 {
00541         struct ieee80211_key *key = NULL;
00542         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00543         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
00544 
00545         if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT))
00546                 tx->key = NULL;
00547         else if (tx->sta && (key = rcu_dereference(tx->sta->ptk)))
00548                 tx->key = key;
00549         else if (ieee80211_is_mgmt(hdr->frame_control) &&
00550                  is_multicast_ether_addr(hdr->addr1) &&
00551                  ieee80211_is_robust_mgmt_frame(hdr) &&
00552                  (key = rcu_dereference(tx->sdata->default_mgmt_key)))
00553                 tx->key = key;
00554         else if (is_multicast_ether_addr(hdr->addr1) &&
00555                  (key = rcu_dereference(tx->sdata->default_multicast_key)))
00556                 tx->key = key;
00557         else if (!is_multicast_ether_addr(hdr->addr1) &&
00558                  (key = rcu_dereference(tx->sdata->default_unicast_key)))
00559                 tx->key = key;
00560         else if (tx->sdata->drop_unencrypted &&
00561                  (tx->skb->protocol != tx->sdata->control_port_protocol) &&
00562                  !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
00563                  (!ieee80211_is_robust_mgmt_frame(hdr) ||
00564                   (ieee80211_is_action(hdr->frame_control) &&
00565                    tx->sta && test_sta_flag(tx->sta, WLAN_STA_MFP)))) {
00566                 I802_DEBUG_INC(tx->local->tx_handlers_drop_unencrypted);
00567                 return TX_DROP;
00568         } else
00569                 tx->key = NULL;
00570 
00571         if (tx->key) {
00572                 bool skip_hw = false;
00573 
00574                 tx->key->tx_rx_count++;
00575                 /* TODO: add threshold stuff again */
00576 
00577                 switch (tx->key->conf.cipher) {
00578                 case WLAN_CIPHER_SUITE_WEP40:
00579                 case WLAN_CIPHER_SUITE_WEP104:
00580                 case WLAN_CIPHER_SUITE_TKIP:
00581                         if (!ieee80211_is_data_present(hdr->frame_control))
00582                                 tx->key = NULL;
00583                         break;
00584                 case WLAN_CIPHER_SUITE_CCMP:
00585                         if (!ieee80211_is_data_present(hdr->frame_control) &&
00586                             !ieee80211_use_mfp(hdr->frame_control, tx->sta,
00587                                                tx->skb))
00588                                 tx->key = NULL;
00589                         else
00590                                 skip_hw = (tx->key->conf.flags &
00591                                            IEEE80211_KEY_FLAG_SW_MGMT) &&
00592                                         ieee80211_is_mgmt(hdr->frame_control);
00593                         break;
00594                 case WLAN_CIPHER_SUITE_AES_CMAC:
00595                         if (!ieee80211_is_mgmt(hdr->frame_control))
00596                                 tx->key = NULL;
00597                         break;
00598                 }
00599 
00600                 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED))
00601                         return TX_DROP;
00602 
00603                 if (!skip_hw && tx->key &&
00604                     tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
00605                         info->control.hw_key = &tx->key->conf;
00606         }
00607 
00608         return TX_CONTINUE;
00609 }
00610 
00611 static ieee80211_tx_result debug_noinline
00612 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
00613 {
00614         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00615         struct ieee80211_hdr *hdr = (void *)tx->skb->data;
00616         struct ieee80211_supported_band *sband;
00617         struct ieee80211_rate *rate;
00618         int i;
00619         u32 len;
00620         bool inval = false, rts = false, short_preamble = false;
00621         struct ieee80211_tx_rate_control txrc;
00622         bool assoc = false;
00623 
00624         memset(&txrc, 0, sizeof(txrc));
00625 
00626         sband = tx->local->hw.wiphy->bands[tx->channel->band];
00627 
00628         len = min_t(u32, tx->skb->len + FCS_LEN,
00629                          tx->local->hw.wiphy->frag_threshold);
00630 
00631         /* set up the tx rate control struct we give the RC algo */
00632         txrc.hw = &tx->local->hw;
00633         txrc.sband = sband;
00634         txrc.bss_conf = &tx->sdata->vif.bss_conf;
00635         txrc.skb = tx->skb;
00636         txrc.reported_rate.idx = -1;
00637         txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[tx->channel->band];
00638         if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
00639                 txrc.max_rate_idx = -1;
00640         else
00641                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
00642         memcpy(txrc.rate_idx_mcs_mask,
00643                tx->sdata->rc_rateidx_mcs_mask[tx->channel->band],
00644                sizeof(txrc.rate_idx_mcs_mask));
00645         txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
00646                     tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
00647                     tx->sdata->vif.type == NL80211_IFTYPE_ADHOC);
00648 
00649         /* set up RTS protection if desired */
00650         if (len > tx->local->hw.wiphy->rts_threshold) {
00651                 txrc.rts = rts = true;
00652         }
00653 
00654         /*
00655          * Use short preamble if the BSS can handle it, but not for
00656          * management frames unless we know the receiver can handle
00657          * that -- the management frame might be to a station that
00658          * just wants a probe response.
00659          */
00660         if (tx->sdata->vif.bss_conf.use_short_preamble &&
00661             (ieee80211_is_data(hdr->frame_control) ||
00662              (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
00663                 txrc.short_preamble = short_preamble = true;
00664 
00665         if (tx->sta)
00666                 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
00667 
00668         /*
00669          * Lets not bother rate control if we're associated and cannot
00670          * talk to the sta. This should not happen.
00671          */
00672         if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
00673                  !rate_usable_index_exists(sband, &tx->sta->sta),
00674                  "%s: Dropped data frame as no usable bitrate found while "
00675                  "scanning and associated. Target station: "
00676                  "%pM on %d GHz band\n",
00677                  tx->sdata->name, hdr->addr1,
00678                  tx->channel->band ? 5 : 2))
00679                 return TX_DROP;
00680 
00681         /*
00682          * If we're associated with the sta at this point we know we can at
00683          * least send the frame at the lowest bit rate.
00684          */
00685         rate_control_get_rate(tx->sdata, tx->sta, &txrc);
00686 
00687         if (unlikely(info->control.rates[0].idx < 0))
00688                 return TX_DROP;
00689 
00690         if (txrc.reported_rate.idx < 0) {
00691                 txrc.reported_rate = info->control.rates[0];
00692                 if (tx->sta && ieee80211_is_data(hdr->frame_control))
00693                         tx->sta->last_tx_rate = txrc.reported_rate;
00694         } else if (tx->sta)
00695                 tx->sta->last_tx_rate = txrc.reported_rate;
00696 
00697         if (unlikely(!info->control.rates[0].count))
00698                 info->control.rates[0].count = 1;
00699 
00700         if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
00701                          (info->flags & IEEE80211_TX_CTL_NO_ACK)))
00702                 info->control.rates[0].count = 1;
00703 
00704         if (is_multicast_ether_addr(hdr->addr1)) {
00705                 /*
00706                  * XXX: verify the rate is in the basic rateset
00707                  */
00708                 return TX_CONTINUE;
00709         }
00710 
00711         /*
00712          * set up the RTS/CTS rate as the fastest basic rate
00713          * that is not faster than the data rate
00714          *
00715          * XXX: Should this check all retry rates?
00716          */
00717         if (!(info->control.rates[0].flags & IEEE80211_TX_RC_MCS)) {
00718                 s8 baserate = 0;
00719 
00720                 rate = &sband->bitrates[info->control.rates[0].idx];
00721 
00722                 for (i = 0; i < sband->n_bitrates; i++) {
00723                         /* must be a basic rate */
00724                         if (!(tx->sdata->vif.bss_conf.basic_rates & BIT(i)))
00725                                 continue;
00726                         /* must not be faster than the data rate */
00727                         if (sband->bitrates[i].bitrate > rate->bitrate)
00728                                 continue;
00729                         /* maximum */
00730                         if (sband->bitrates[baserate].bitrate <
00731                              sband->bitrates[i].bitrate)
00732                                 baserate = i;
00733                 }
00734 
00735                 info->control.rts_cts_rate_idx = baserate;
00736         }
00737 
00738         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
00739                 /*
00740                  * make sure there's no valid rate following
00741                  * an invalid one, just in case drivers don't
00742                  * take the API seriously to stop at -1.
00743                  */
00744                 if (inval) {
00745                         info->control.rates[i].idx = -1;
00746                         continue;
00747                 }
00748                 if (info->control.rates[i].idx < 0) {
00749                         inval = true;
00750                         continue;
00751                 }
00752 
00753                 /*
00754                  * For now assume MCS is already set up correctly, this
00755                  * needs to be fixed.
00756                  */
00757                 if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS) {
00758                         WARN_ON(info->control.rates[i].idx > 76);
00759                         continue;
00760                 }
00761 
00762                 /* set up RTS protection if desired */
00763                 if (rts)
00764                         info->control.rates[i].flags |=
00765                                 IEEE80211_TX_RC_USE_RTS_CTS;
00766 
00767                 /* RC is busted */
00768                 if (WARN_ON_ONCE(info->control.rates[i].idx >=
00769                                  sband->n_bitrates)) {
00770                         info->control.rates[i].idx = -1;
00771                         continue;
00772                 }
00773 
00774                 rate = &sband->bitrates[info->control.rates[i].idx];
00775 
00776                 /* set up short preamble */
00777                 if (short_preamble &&
00778                     rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
00779                         info->control.rates[i].flags |=
00780                                 IEEE80211_TX_RC_USE_SHORT_PREAMBLE;
00781 
00782                 /* set up G protection */
00783                 if (!rts && tx->sdata->vif.bss_conf.use_cts_prot &&
00784                     rate->flags & IEEE80211_RATE_ERP_G)
00785                         info->control.rates[i].flags |=
00786                                 IEEE80211_TX_RC_USE_CTS_PROTECT;
00787         }
00788 
00789         return TX_CONTINUE;
00790 }
00791 
00792 static ieee80211_tx_result debug_noinline
00793 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
00794 {
00795         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
00796         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
00797         u16 *seq;
00798         u8 *qc;
00799         int tid;
00800 
00801         /*
00802          * Packet injection may want to control the sequence
00803          * number, if we have no matching interface then we
00804          * neither assign one ourselves nor ask the driver to.
00805          */
00806         if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
00807                 return TX_CONTINUE;
00808 
00809         if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
00810                 return TX_CONTINUE;
00811 
00812         if (ieee80211_hdrlen(hdr->frame_control) < 24)
00813                 return TX_CONTINUE;
00814 
00815         if (ieee80211_is_qos_nullfunc(hdr->frame_control))
00816                 return TX_CONTINUE;
00817 
00818         /*
00819          * Anything but QoS data that has a sequence number field
00820          * (is long enough) gets a sequence number from the global
00821          * counter.
00822          */
00823         if (!ieee80211_is_data_qos(hdr->frame_control)) {
00824                 /* driver should assign sequence number */
00825                 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
00826                 /* for pure STA mode without beacons, we can do it */
00827                 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
00828                 tx->sdata->sequence_number += 0x10;
00829                 return TX_CONTINUE;
00830         }
00831 
00832         /*
00833          * This should be true for injected/management frames only, for
00834          * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
00835          * above since they are not QoS-data frames.
00836          */
00837         if (!tx->sta)
00838                 return TX_CONTINUE;
00839 
00840         /* include per-STA, per-TID sequence counter */
00841 
00842         qc = ieee80211_get_qos_ctl(hdr);
00843         tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
00844         seq = &tx->sta->tid_seq[tid];
00845 
00846         hdr->seq_ctrl = cpu_to_le16(*seq);
00847 
00848         /* Increase the sequence number. */
00849         *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
00850 
00851         return TX_CONTINUE;
00852 }
00853 
00854 static int ieee80211_fragment(struct ieee80211_tx_data *tx,
00855                               struct sk_buff *skb, int hdrlen,
00856                               int frag_threshold)
00857 {
00858         struct ieee80211_local *local = tx->local;
00859         struct ieee80211_tx_info *info;
00860         struct sk_buff *tmp;
00861         int per_fragm = frag_threshold - hdrlen - FCS_LEN;
00862         int pos = hdrlen + per_fragm;
00863         int rem = skb->len - hdrlen - per_fragm;
00864 
00865         if (WARN_ON(rem < 0))
00866                 return -EINVAL;
00867 
00868         /* first fragment was already added to queue by caller */
00869 
00870         while (rem) {
00871                 int fraglen = per_fragm;
00872 
00873                 if (fraglen > rem)
00874                         fraglen = rem;
00875                 rem -= fraglen;
00876                 tmp = dev_alloc_skb(local->tx_headroom +
00877                                     frag_threshold +
00878                                     IEEE80211_ENCRYPT_HEADROOM +
00879                                     IEEE80211_ENCRYPT_TAILROOM);
00880                 if (!tmp)
00881                         return -ENOMEM;
00882 
00883                 __skb_queue_tail(&tx->skbs, tmp);
00884 
00885                 skb_reserve(tmp, local->tx_headroom +
00886                                  IEEE80211_ENCRYPT_HEADROOM);
00887                 /* copy control information */
00888                 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
00889 
00890                 info = IEEE80211_SKB_CB(tmp);
00891                 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
00892                                  IEEE80211_TX_CTL_FIRST_FRAGMENT);
00893 
00894                 if (rem)
00895                         info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
00896 
00897                 skb_copy_queue_mapping(tmp, skb);
00898                 tmp->priority = skb->priority;
00899                 tmp->dev = skb->dev;
00900 
00901                 /* copy header and data */
00902                 memcpy(skb_put(tmp, hdrlen), skb->data, hdrlen);
00903                 memcpy(skb_put(tmp, fraglen), skb->data + pos, fraglen);
00904 
00905                 pos += fraglen;
00906         }
00907 
00908         /* adjust first fragment's length */
00909         skb->len = hdrlen + per_fragm;
00910         return 0;
00911 }
00912 
00913 static ieee80211_tx_result debug_noinline
00914 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
00915 {
00916         struct sk_buff *skb = tx->skb;
00917         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
00918         struct ieee80211_hdr *hdr = (void *)skb->data;
00919         int frag_threshold = tx->local->hw.wiphy->frag_threshold;
00920         int hdrlen;
00921         int fragnum;
00922 
00923         /* no matter what happens, tx->skb moves to tx->skbs */
00924         __skb_queue_tail(&tx->skbs, skb);
00925         tx->skb = NULL;
00926 
00927         if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
00928                 return TX_CONTINUE;
00929 
00930         if (tx->local->ops->set_frag_threshold)
00931                 return TX_CONTINUE;
00932 
00933         /*
00934          * Warn when submitting a fragmented A-MPDU frame and drop it.
00935          * This scenario is handled in ieee80211_tx_prepare but extra
00936          * caution taken here as fragmented ampdu may cause Tx stop.
00937          */
00938         if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
00939                 return TX_DROP;
00940 
00941         hdrlen = ieee80211_hdrlen(hdr->frame_control);
00942 
00943         /* internal error, why isn't DONTFRAG set? */
00944         if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
00945                 return TX_DROP;
00946 
00947         /*
00948          * Now fragment the frame. This will allocate all the fragments and
00949          * chain them (using skb as the first fragment) to skb->next.
00950          * During transmission, we will remove the successfully transmitted
00951          * fragments from this list. When the low-level driver rejects one
00952          * of the fragments then we will simply pretend to accept the skb
00953          * but store it away as pending.
00954          */
00955         if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
00956                 return TX_DROP;
00957 
00958         /* update duration/seq/flags of fragments */
00959         fragnum = 0;
00960 
00961         skb_queue_walk(&tx->skbs, skb) {
00962                 int next_len;
00963                 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
00964 
00965                 hdr = (void *)skb->data;
00966                 info = IEEE80211_SKB_CB(skb);
00967 
00968                 if (!skb_queue_is_last(&tx->skbs, skb)) {
00969                         hdr->frame_control |= morefrags;
00970                         /*
00971                          * No multi-rate retries for fragmented frames, that
00972                          * would completely throw off the NAV at other STAs.
00973                          */
00974                         info->control.rates[1].idx = -1;
00975                         info->control.rates[2].idx = -1;
00976                         info->control.rates[3].idx = -1;
00977                         info->control.rates[4].idx = -1;
00978                         BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
00979                         info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
00980                 } else {
00981                         hdr->frame_control &= ~morefrags;
00982                         next_len = 0;
00983                 }
00984                 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
00985                 fragnum++;
00986         }
00987 
00988         return TX_CONTINUE;
00989 }
00990 
00991 static ieee80211_tx_result debug_noinline
00992 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
00993 {
00994         struct sk_buff *skb;
00995 
00996         if (!tx->sta)
00997                 return TX_CONTINUE;
00998 
00999         tx->sta->tx_packets++;
01000         skb_queue_walk(&tx->skbs, skb) {
01001                 tx->sta->tx_fragments++;
01002                 tx->sta->tx_bytes += skb->len;
01003         }
01004 
01005         return TX_CONTINUE;
01006 }
01007 
01008 static ieee80211_tx_result debug_noinline
01009 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
01010 {
01011         if (!tx->key)
01012                 return TX_CONTINUE;
01013 
01014         switch (tx->key->conf.cipher) {
01015         case WLAN_CIPHER_SUITE_WEP40:
01016         case WLAN_CIPHER_SUITE_WEP104:
01017                 return ieee80211_crypto_wep_encrypt(tx);
01018         case WLAN_CIPHER_SUITE_TKIP:
01019                 return ieee80211_crypto_tkip_encrypt(tx);
01020         case WLAN_CIPHER_SUITE_CCMP:
01021                 return ieee80211_crypto_ccmp_encrypt(tx);
01022         case WLAN_CIPHER_SUITE_AES_CMAC:
01023                 return ieee80211_crypto_aes_cmac_encrypt(tx);
01024         default:
01025                 return ieee80211_crypto_hw_encrypt(tx);
01026         }
01027 
01028         return TX_DROP;
01029 }
01030 
01031 static ieee80211_tx_result debug_noinline
01032 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
01033 {
01034         struct sk_buff *skb;
01035         struct ieee80211_hdr *hdr;
01036         int next_len;
01037         bool group_addr;
01038 
01039         skb_queue_walk(&tx->skbs, skb) {
01040                 hdr = (void *) skb->data;
01041                 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
01042                         break; /* must not overwrite AID */
01043                 if (!skb_queue_is_last(&tx->skbs, skb)) {
01044                         struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
01045                         next_len = next->len;
01046                 } else
01047                         next_len = 0;
01048                 group_addr = is_multicast_ether_addr(hdr->addr1);
01049 
01050                 hdr->duration_id =
01051                         ieee80211_duration(tx, skb, group_addr, next_len);
01052         }
01053 
01054         return TX_CONTINUE;
01055 }
01056 
01057 /* actual transmit path */
01058 
01059 static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
01060                                   struct sk_buff *skb,
01061                                   struct ieee80211_tx_info *info,
01062                                   struct tid_ampdu_tx *tid_tx,
01063                                   int tid)
01064 {
01065         bool queued = false;
01066         bool reset_agg_timer = false;
01067         struct sk_buff *purge_skb = NULL;
01068 
01069         if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
01070                 info->flags |= IEEE80211_TX_CTL_AMPDU;
01071                 reset_agg_timer = true;
01072         } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
01073                 /*
01074                  * nothing -- this aggregation session is being started
01075                  * but that might still fail with the driver
01076                  */
01077         } else {
01078                 spin_lock(&tx->sta->lock);
01079                 /*
01080                  * Need to re-check now, because we may get here
01081                  *
01082                  *  1) in the window during which the setup is actually
01083                  *     already done, but not marked yet because not all
01084                  *     packets are spliced over to the driver pending
01085                  *     queue yet -- if this happened we acquire the lock
01086                  *     either before or after the splice happens, but
01087                  *     need to recheck which of these cases happened.
01088                  *
01089                  *  2) during session teardown, if the OPERATIONAL bit
01090                  *     was cleared due to the teardown but the pointer
01091                  *     hasn't been assigned NULL yet (or we loaded it
01092                  *     before it was assigned) -- in this case it may
01093                  *     now be NULL which means we should just let the
01094                  *     packet pass through because splicing the frames
01095                  *     back is already done.
01096                  */
01097                 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
01098 
01099                 if (!tid_tx) {
01100                         /* do nothing, let packet pass through */
01101                 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
01102                         info->flags |= IEEE80211_TX_CTL_AMPDU;
01103                         reset_agg_timer = true;
01104                 } else {
01105                         queued = true;
01106                         info->control.vif = &tx->sdata->vif;
01107                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
01108                         __skb_queue_tail(&tid_tx->pending, skb);
01109                         if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
01110                                 purge_skb = __skb_dequeue(&tid_tx->pending);
01111                 }
01112                 spin_unlock(&tx->sta->lock);
01113 
01114                 if (purge_skb)
01115                         dev_kfree_skb(purge_skb);
01116         }
01117 
01118         /* reset session timer */
01119         if (reset_agg_timer && tid_tx->timeout)
01120                 tid_tx->last_tx = jiffies;
01121 
01122         return queued;
01123 }
01124 
01125 /*
01126  * initialises @tx
01127  */
01128 static ieee80211_tx_result
01129 ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
01130                      struct ieee80211_tx_data *tx,
01131                      struct sk_buff *skb)
01132 {
01133         struct ieee80211_local *local = sdata->local;
01134         struct ieee80211_hdr *hdr;
01135         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
01136         int tid;
01137         u8 *qc;
01138 
01139         memset(tx, 0, sizeof(*tx));
01140         tx->skb = skb;
01141         tx->local = local;
01142         tx->sdata = sdata;
01143         tx->channel = local->hw.conf.channel;
01144         __skb_queue_head_init(&tx->skbs);
01145 
01146         /*
01147          * If this flag is set to true anywhere, and we get here,
01148          * we are doing the needed processing, so remove the flag
01149          * now.
01150          */
01151         info->flags &= ~IEEE80211_TX_INTFL_NEED_TXPROCESSING;
01152 
01153         hdr = (struct ieee80211_hdr *) skb->data;
01154 
01155         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
01156                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
01157                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
01158                         return TX_DROP;
01159         } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
01160                    tx->sdata->control_port_protocol == tx->skb->protocol) {
01161                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
01162         }
01163         if (!tx->sta)
01164                 tx->sta = sta_info_get(sdata, hdr->addr1);
01165 
01166         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
01167             !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
01168             (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION) &&
01169             !(local->hw.flags & IEEE80211_HW_TX_AMPDU_SETUP_IN_HW)) {
01170                 struct tid_ampdu_tx *tid_tx;
01171 
01172                 qc = ieee80211_get_qos_ctl(hdr);
01173                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
01174 
01175                 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
01176                 if (tid_tx) {
01177                         bool queued;
01178 
01179                         queued = ieee80211_tx_prep_agg(tx, skb, info,
01180                                                        tid_tx, tid);
01181 
01182                         if (unlikely(queued))
01183                                 return TX_QUEUED;
01184                 }
01185         }
01186 
01187         if (is_multicast_ether_addr(hdr->addr1)) {
01188                 tx->flags &= ~IEEE80211_TX_UNICAST;
01189                 info->flags |= IEEE80211_TX_CTL_NO_ACK;
01190         } else
01191                 tx->flags |= IEEE80211_TX_UNICAST;
01192 
01193         if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
01194                 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
01195                     skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
01196                     info->flags & IEEE80211_TX_CTL_AMPDU)
01197                         info->flags |= IEEE80211_TX_CTL_DONTFRAG;
01198         }
01199 
01200         if (!tx->sta)
01201                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
01202         else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT))
01203                 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
01204 
01205         info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
01206 
01207         return TX_CONTINUE;
01208 }
01209 
01210 static bool ieee80211_tx_frags(struct ieee80211_local *local,
01211                                struct ieee80211_vif *vif,
01212                                struct ieee80211_sta *sta,
01213                                struct sk_buff_head *skbs,
01214                                bool txpending)
01215 {
01216         struct sk_buff *skb, *tmp;
01217         unsigned long flags;
01218 
01219         skb_queue_walk_safe(skbs, skb, tmp) {
01220                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
01221                 int q = info->hw_queue;
01222 
01223 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
01224                 if (WARN_ON_ONCE(q >= local->hw.queues)) {
01225                         __skb_unlink(skb, skbs);
01226                         dev_kfree_skb(skb);
01227                         continue;
01228                 }
01229 #endif
01230 
01231                 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
01232                 if (local->queue_stop_reasons[q] ||
01233                     (!txpending && !skb_queue_empty(&local->pending[q]))) {
01234                         /*
01235                          * Since queue is stopped, queue up frames for later
01236                          * transmission from the tx-pending tasklet when the
01237                          * queue is woken again.
01238                          */
01239                         if (txpending)
01240                                 skb_queue_splice_init(skbs, &local->pending[q]);
01241                         else
01242                                 skb_queue_splice_tail_init(skbs,
01243                                                            &local->pending[q]);
01244 
01245                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
01246                                                flags);
01247                         return false;
01248                 }
01249                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
01250 
01251                 info->control.vif = vif;
01252                 info->control.sta = sta;
01253 
01254                 __skb_unlink(skb, skbs);
01255                 drv_tx(local, skb);
01256         }
01257 
01258         return true;
01259 }
01260 
01261 /*
01262  * Returns false if the frame couldn't be transmitted but was queued instead.
01263  */
01264 static bool __ieee80211_tx(struct ieee80211_local *local,
01265                            struct sk_buff_head *skbs, int led_len,
01266                            struct sta_info *sta, bool txpending)
01267 {
01268         struct ieee80211_tx_info *info;
01269         struct ieee80211_sub_if_data *sdata;
01270         struct ieee80211_vif *vif;
01271         struct ieee80211_sta *pubsta;
01272         struct sk_buff *skb;
01273         bool result = true;
01274         __le16 fc;
01275 
01276         if (WARN_ON(skb_queue_empty(skbs)))
01277                 return true;
01278 
01279         skb = skb_peek(skbs);
01280         fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
01281         info = IEEE80211_SKB_CB(skb);
01282         sdata = vif_to_sdata(info->control.vif);
01283         if (sta && !sta->uploaded)
01284                 sta = NULL;
01285 
01286         if (sta)
01287                 pubsta = &sta->sta;
01288         else
01289                 pubsta = NULL;
01290 
01291         switch (sdata->vif.type) {
01292         case NL80211_IFTYPE_MONITOR:
01293                 sdata = rcu_dereference(local->monitor_sdata);
01294                 if (sdata) {
01295                         vif = &sdata->vif;
01296                         info->hw_queue =
01297                                 vif->hw_queue[skb_get_queue_mapping(skb)];
01298                 } else if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) {
01299                         dev_kfree_skb(skb);
01300                         return true;
01301                 } else
01302                         vif = NULL;
01303                 break;
01304         case NL80211_IFTYPE_AP_VLAN:
01305                 sdata = container_of(sdata->bss,
01306                                      struct ieee80211_sub_if_data, u.ap);
01307                 /* fall through */
01308         default:
01309                 vif = &sdata->vif;
01310                 break;
01311         }
01312 
01313         if (local->ops->tx_frags)
01314                 drv_tx_frags(local, vif, pubsta, skbs);
01315         else
01316                 result = ieee80211_tx_frags(local, vif, pubsta, skbs,
01317                                             txpending);
01318 
01319         ieee80211_tpt_led_trig_tx(local, fc, led_len);
01320         ieee80211_led_tx(local, 1);
01321 
01322         WARN_ON_ONCE(!skb_queue_empty(skbs));
01323 
01324         return result;
01325 }
01326 
01327 /*
01328  * Invoke TX handlers, return 0 on success and non-zero if the
01329  * frame was dropped or queued.
01330  */
01331 static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
01332 {
01333         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
01334         ieee80211_tx_result res = TX_DROP;
01335 
01336 #define CALL_TXH(txh) \
01337         do {                            \
01338                 res = txh(tx);          \
01339                 if (res != TX_CONTINUE) \
01340                         goto txh_done;  \
01341         } while (0)
01342 
01343         CALL_TXH(ieee80211_tx_h_dynamic_ps);
01344         CALL_TXH(ieee80211_tx_h_check_assoc);
01345         CALL_TXH(ieee80211_tx_h_ps_buf);
01346         CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
01347         CALL_TXH(ieee80211_tx_h_select_key);
01348         if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
01349                 CALL_TXH(ieee80211_tx_h_rate_ctrl);
01350 
01351         if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
01352                 __skb_queue_tail(&tx->skbs, tx->skb);
01353                 tx->skb = NULL;
01354                 goto txh_done;
01355         }
01356 
01357         CALL_TXH(ieee80211_tx_h_michael_mic_add);
01358         CALL_TXH(ieee80211_tx_h_sequence);
01359         CALL_TXH(ieee80211_tx_h_fragment);
01360         /* handlers after fragment must be aware of tx info fragmentation! */
01361         CALL_TXH(ieee80211_tx_h_stats);
01362         CALL_TXH(ieee80211_tx_h_encrypt);
01363         if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
01364                 CALL_TXH(ieee80211_tx_h_calculate_duration);
01365 #undef CALL_TXH
01366 
01367  txh_done:
01368         if (unlikely(res == TX_DROP)) {
01369                 I802_DEBUG_INC(tx->local->tx_handlers_drop);
01370                 if (tx->skb)
01371                         dev_kfree_skb(tx->skb);
01372                 else
01373                         __skb_queue_purge(&tx->skbs);
01374                 return -1;
01375         } else if (unlikely(res == TX_QUEUED)) {
01376                 I802_DEBUG_INC(tx->local->tx_handlers_queued);
01377                 return -1;
01378         }
01379 
01380         return 0;
01381 }
01382 
01383 /*
01384  * Returns false if the frame couldn't be transmitted but was queued instead.
01385  */
01386 static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
01387                          struct sk_buff *skb, bool txpending)
01388 {
01389         struct ieee80211_local *local = sdata->local;
01390         struct ieee80211_tx_data tx;
01391         ieee80211_tx_result res_prepare;
01392         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
01393         bool result = true;
01394         int led_len;
01395 
01396         if (unlikely(skb->len < 10)) {
01397                 dev_kfree_skb(skb);
01398                 return true;
01399         }
01400 
01401         rcu_read_lock();
01402 
01403         /* initialises tx */
01404         led_len = skb->len;
01405         res_prepare = ieee80211_tx_prepare(sdata, &tx, skb);
01406 
01407         if (unlikely(res_prepare == TX_DROP)) {
01408                 dev_kfree_skb(skb);
01409                 goto out;
01410         } else if (unlikely(res_prepare == TX_QUEUED)) {
01411                 goto out;
01412         }
01413 
01414         tx.channel = local->hw.conf.channel;
01415         info->band = tx.channel->band;
01416 
01417         /* set up hw_queue value early */
01418         if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
01419             !(local->hw.flags & IEEE80211_HW_QUEUE_CONTROL))
01420                 info->hw_queue =
01421                         sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
01422 
01423         if (!invoke_tx_handlers(&tx))
01424                 result = __ieee80211_tx(local, &tx.skbs, led_len,
01425                                         tx.sta, txpending);
01426  out:
01427         rcu_read_unlock();
01428         return result;
01429 }
01430 
01431 /* device xmit handlers */
01432 
01433 static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
01434                                 struct sk_buff *skb,
01435                                 int head_need, bool may_encrypt)
01436 {
01437         struct ieee80211_local *local = sdata->local;
01438         int tail_need = 0;
01439 
01440         if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
01441                 tail_need = IEEE80211_ENCRYPT_TAILROOM;
01442                 tail_need -= skb_tailroom(skb);
01443                 tail_need = max_t(int, tail_need, 0);
01444         }
01445 
01446         if (skb_cloned(skb))
01447                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
01448         else if (head_need || tail_need)
01449                 I802_DEBUG_INC(local->tx_expand_skb_head);
01450         else
01451                 return 0;
01452 
01453         if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
01454                 wiphy_debug(local->hw.wiphy,
01455                             "failed to reallocate TX buffer\n");
01456                 return -ENOMEM;
01457         }
01458 
01459         return 0;
01460 }
01461 
01462 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
01463 {
01464         struct ieee80211_local *local = sdata->local;
01465         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
01466         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
01467         int headroom;
01468         bool may_encrypt;
01469 
01470         rcu_read_lock();
01471 
01472         may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT);
01473 
01474         headroom = local->tx_headroom;
01475         if (may_encrypt)
01476                 headroom += IEEE80211_ENCRYPT_HEADROOM;
01477         headroom -= skb_headroom(skb);
01478         headroom = max_t(int, 0, headroom);
01479 
01480         if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) {
01481                 dev_kfree_skb(skb);
01482                 rcu_read_unlock();
01483                 return;
01484         }
01485 
01486         hdr = (struct ieee80211_hdr *) skb->data;
01487         info->control.vif = &sdata->vif;
01488 
01489         if (ieee80211_vif_is_mesh(&sdata->vif) &&
01490             ieee80211_is_data(hdr->frame_control) &&
01491             !is_multicast_ether_addr(hdr->addr1) &&
01492             mesh_nexthop_resolve(skb, sdata)) {
01493                 /* skb queued: don't free */
01494                 rcu_read_unlock();
01495                 return;
01496         }
01497 
01498         ieee80211_set_qos_hdr(sdata, skb);
01499         ieee80211_tx(sdata, skb, false);
01500         rcu_read_unlock();
01501 }
01502 
01503 static bool ieee80211_parse_tx_radiotap(struct sk_buff *skb)
01504 {
01505         struct ieee80211_radiotap_iterator iterator;
01506         struct ieee80211_radiotap_header *rthdr =
01507                 (struct ieee80211_radiotap_header *) skb->data;
01508         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
01509         int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
01510                                                    NULL);
01511         u16 txflags;
01512 
01513         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
01514                        IEEE80211_TX_CTL_DONTFRAG;
01515 
01516         /*
01517          * for every radiotap entry that is present
01518          * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
01519          * entries present, or -EINVAL on error)
01520          */
01521 
01522         while (!ret) {
01523                 ret = ieee80211_radiotap_iterator_next(&iterator);
01524 
01525                 if (ret)
01526                         continue;
01527 
01528                 /* see if this argument is something we can use */
01529                 switch (iterator.this_arg_index) {
01530                 /*
01531                  * You must take care when dereferencing iterator.this_arg
01532                  * for multibyte types... the pointer is not aligned.  Use
01533                  * get_unaligned((type *)iterator.this_arg) to dereference
01534                  * iterator.this_arg for type "type" safely on all arches.
01535                 */
01536                 case IEEE80211_RADIOTAP_FLAGS:
01537                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
01538                                 /*
01539                                  * this indicates that the skb we have been
01540                                  * handed has the 32-bit FCS CRC at the end...
01541                                  * we should react to that by snipping it off
01542                                  * because it will be recomputed and added
01543                                  * on transmission
01544                                  */
01545                                 if (skb->len < (iterator._max_length + FCS_LEN))
01546                                         return false;
01547 
01548                                 skb_trim(skb, skb->len - FCS_LEN);
01549                         }
01550                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
01551                                 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
01552                         if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
01553                                 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
01554                         break;
01555 
01556                 case IEEE80211_RADIOTAP_TX_FLAGS:
01557                         txflags = get_unaligned_le16(iterator.this_arg);
01558                         if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
01559                                 info->flags |= IEEE80211_TX_CTL_NO_ACK;
01560                         break;
01561 
01562                 /*
01563                  * Please update the file
01564                  * Documentation/networking/mac80211-injection.txt
01565                  * when parsing new fields here.
01566                  */
01567 
01568                 default:
01569                         break;
01570                 }
01571         }
01572 
01573         if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
01574                 return false;
01575 
01576         /*
01577          * remove the radiotap header
01578          * iterator->_max_length was sanity-checked against
01579          * skb->len by iterator init
01580          */
01581         skb_pull(skb, iterator._max_length);
01582 
01583         return true;
01584 }
01585 
01586 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
01587                                          struct net_device *dev)
01588 {
01589         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
01590         struct ieee80211_channel *chan = local->hw.conf.channel;
01591         struct ieee80211_radiotap_header *prthdr =
01592                 (struct ieee80211_radiotap_header *)skb->data;
01593         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
01594         struct ieee80211_hdr *hdr;
01595         struct ieee80211_sub_if_data *tmp_sdata, *sdata;
01596         u16 len_rthdr;
01597         int hdrlen;
01598 
01599         /*
01600          * Frame injection is not allowed if beaconing is not allowed
01601          * or if we need radar detection. Beaconing is usually not allowed when
01602          * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
01603          * Passive scan is also used in world regulatory domains where
01604          * your country is not known and as such it should be treated as
01605          * NO TX unless the channel is explicitly allowed in which case
01606          * your current regulatory domain would not have the passive scan
01607          * flag.
01608          *
01609          * Since AP mode uses monitor interfaces to inject/TX management
01610          * frames we can make AP mode the exception to this rule once it
01611          * supports radar detection as its implementation can deal with
01612          * radar detection by itself. We can do that later by adding a
01613          * monitor flag interfaces used for AP support.
01614          */
01615         if ((chan->flags & (IEEE80211_CHAN_NO_IBSS | IEEE80211_CHAN_RADAR |
01616              IEEE80211_CHAN_PASSIVE_SCAN)))
01617                 goto fail;
01618 
01619         /* check for not even having the fixed radiotap header part */
01620         if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
01621                 goto fail; /* too short to be possibly valid */
01622 
01623         /* is it a header version we can trust to find length from? */
01624         if (unlikely(prthdr->it_version))
01625                 goto fail; /* only version 0 is supported */
01626 
01627         /* then there must be a radiotap header with a length we can use */
01628         len_rthdr = ieee80211_get_radiotap_len(skb->data);
01629 
01630         /* does the skb contain enough to deliver on the alleged length? */
01631         if (unlikely(skb->len < len_rthdr))
01632                 goto fail; /* skb too short for claimed rt header extent */
01633 
01634         /*
01635          * fix up the pointers accounting for the radiotap
01636          * header still being in there.  We are being given
01637          * a precooked IEEE80211 header so no need for
01638          * normal processing
01639          */
01640         skb_set_mac_header(skb, len_rthdr);
01641         /*
01642          * these are just fixed to the end of the rt area since we
01643          * don't have any better information and at this point, nobody cares
01644          */
01645         skb_set_network_header(skb, len_rthdr);
01646         skb_set_transport_header(skb, len_rthdr);
01647 
01648         if (skb->len < len_rthdr + 2)
01649                 goto fail;
01650 
01651         hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
01652         hdrlen = ieee80211_hdrlen(hdr->frame_control);
01653 
01654         if (skb->len < len_rthdr + hdrlen)
01655                 goto fail;
01656 
01657         /*
01658          * Initialize skb->protocol if the injected frame is a data frame
01659          * carrying a rfc1042 header
01660          */
01661         if (ieee80211_is_data(hdr->frame_control) &&
01662             skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
01663                 u8 *payload = (u8 *)hdr + hdrlen;
01664 
01665                 if (ether_addr_equal(payload, rfc1042_header))
01666                         skb->protocol = cpu_to_be16((payload[6] << 8) |
01667                                                     payload[7]);
01668         }
01669 
01670         memset(info, 0, sizeof(*info));
01671 
01672         info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
01673                       IEEE80211_TX_CTL_INJECTED;
01674 
01675         /* process and remove the injection radiotap header */
01676         if (!ieee80211_parse_tx_radiotap(skb))
01677                 goto fail;
01678 
01679         rcu_read_lock();
01680 
01681         /*
01682          * We process outgoing injected frames that have a local address
01683          * we handle as though they are non-injected frames.
01684          * This code here isn't entirely correct, the local MAC address
01685          * isn't always enough to find the interface to use; for proper
01686          * VLAN/WDS support we will need a different mechanism (which
01687          * likely isn't going to be monitor interfaces).
01688          */
01689         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
01690 
01691         list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
01692                 if (!ieee80211_sdata_running(tmp_sdata))
01693                         continue;
01694                 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
01695                     tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
01696                     tmp_sdata->vif.type == NL80211_IFTYPE_WDS)
01697                         continue;
01698                 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
01699                         sdata = tmp_sdata;
01700                         break;
01701                 }
01702         }
01703 
01704         ieee80211_xmit(sdata, skb);
01705         rcu_read_unlock();
01706 
01707         return NETDEV_TX_OK;
01708 
01709 fail:
01710         dev_kfree_skb(skb);
01711         return NETDEV_TX_OK; /* meaning, we dealt with the skb */
01712 }
01713 
01729 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
01730                                     struct net_device *dev)
01731 {
01732         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
01733         struct ieee80211_local *local = sdata->local;
01734         struct ieee80211_tx_info *info;
01735         int ret = NETDEV_TX_BUSY, head_need;
01736         u16 ethertype, hdrlen,  meshhdrlen = 0;
01737         __le16 fc;
01738         struct ieee80211_hdr hdr;
01739         struct ieee80211s_hdr mesh_hdr __maybe_unused;
01740         struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
01741         const u8 *encaps_data;
01742         int encaps_len, skip_header_bytes;
01743         int nh_pos, h_pos;
01744         struct sta_info *sta = NULL;
01745         bool wme_sta = false, authorized = false, tdls_auth = false;
01746         bool tdls_direct = false;
01747         bool multicast;
01748         u32 info_flags = 0;
01749         u16 info_id = 0;
01750 
01751         if (unlikely(skb->len < ETH_HLEN)) {
01752                 ret = NETDEV_TX_OK;
01753                 goto fail;
01754         }
01755 
01756         /* convert Ethernet header to proper 802.11 header (based on
01757          * operation mode) */
01758         ethertype = (skb->data[12] << 8) | skb->data[13];
01759         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
01760 
01761         switch (sdata->vif.type) {
01762         case NL80211_IFTYPE_AP_VLAN:
01763                 rcu_read_lock();
01764                 sta = rcu_dereference(sdata->u.vlan.sta);
01765                 if (sta) {
01766                         fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
01767                         /* RA TA DA SA */
01768                         memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
01769                         memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
01770                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
01771                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
01772                         hdrlen = 30;
01773                         authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
01774                         wme_sta = test_sta_flag(sta, WLAN_STA_WME);
01775                 }
01776                 rcu_read_unlock();
01777                 if (sta)
01778                         break;
01779                 /* fall through */
01780         case NL80211_IFTYPE_AP:
01781                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
01782                 /* DA BSSID SA */
01783                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
01784                 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
01785                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
01786                 hdrlen = 24;
01787                 break;
01788         case NL80211_IFTYPE_WDS:
01789                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
01790                 /* RA TA DA SA */
01791                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
01792                 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
01793                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
01794                 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
01795                 hdrlen = 30;
01796                 break;
01797 #ifdef CONFIG_MAC80211_MESH
01798         case NL80211_IFTYPE_MESH_POINT:
01799                 if (!sdata->u.mesh.mshcfg.dot11MeshTTL) {
01800                         /* Do not send frames with mesh_ttl == 0 */
01801                         sdata->u.mesh.mshstats.dropped_frames_ttl++;
01802                         ret = NETDEV_TX_OK;
01803                         goto fail;
01804                 }
01805                 rcu_read_lock();
01806                 if (!is_multicast_ether_addr(skb->data)) {
01807                         mpath = mesh_path_lookup(skb->data, sdata);
01808                         if (!mpath)
01809                                 mppath = mpp_path_lookup(skb->data, sdata);
01810                 }
01811 
01812                 /*
01813                  * Use address extension if it is a packet from
01814                  * another interface or if we know the destination
01815                  * is being proxied by a portal (i.e. portal address
01816                  * differs from proxied address)
01817                  */
01818                 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
01819                     !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
01820                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
01821                                         skb->data, skb->data + ETH_ALEN);
01822                         rcu_read_unlock();
01823                         meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
01824                                         sdata, NULL, NULL);
01825                 } else {
01826                         int is_mesh_mcast = 1;
01827                         const u8 *mesh_da;
01828 
01829                         if (is_multicast_ether_addr(skb->data))
01830                                 /* DA TA mSA AE:SA */
01831                                 mesh_da = skb->data;
01832                         else {
01833                                 static const u8 bcast[ETH_ALEN] =
01834                                         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
01835                                 if (mppath) {
01836                                         /* RA TA mDA mSA AE:DA SA */
01837                                         mesh_da = mppath->mpp;
01838                                         is_mesh_mcast = 0;
01839                                 } else {
01840                                         /* DA TA mSA AE:SA */
01841                                         mesh_da = bcast;
01842                                 }
01843                         }
01844                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
01845                                         mesh_da, sdata->vif.addr);
01846                         rcu_read_unlock();
01847                         if (is_mesh_mcast)
01848                                 meshhdrlen =
01849                                         ieee80211_new_mesh_header(&mesh_hdr,
01850                                                         sdata,
01851                                                         skb->data + ETH_ALEN,
01852                                                         NULL);
01853                         else
01854                                 meshhdrlen =
01855                                         ieee80211_new_mesh_header(&mesh_hdr,
01856                                                         sdata,
01857                                                         skb->data,
01858                                                         skb->data + ETH_ALEN);
01859 
01860                 }
01861                 break;
01862 #endif
01863         case NL80211_IFTYPE_STATION:
01864                 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
01865                         bool tdls_peer = false;
01866 
01867                         rcu_read_lock();
01868                         sta = sta_info_get(sdata, skb->data);
01869                         if (sta) {
01870                                 authorized = test_sta_flag(sta,
01871                                                         WLAN_STA_AUTHORIZED);
01872                                 wme_sta = test_sta_flag(sta, WLAN_STA_WME);
01873                                 tdls_peer = test_sta_flag(sta,
01874                                                          WLAN_STA_TDLS_PEER);
01875                                 tdls_auth = test_sta_flag(sta,
01876                                                 WLAN_STA_TDLS_PEER_AUTH);
01877                         }
01878                         rcu_read_unlock();
01879 
01880                         /*
01881                          * If the TDLS link is enabled, send everything
01882                          * directly. Otherwise, allow TDLS setup frames
01883                          * to be transmitted indirectly.
01884                          */
01885                         tdls_direct = tdls_peer && (tdls_auth ||
01886                                  !(ethertype == ETH_P_TDLS && skb->len > 14 &&
01887                                    skb->data[14] == WLAN_TDLS_SNAP_RFTYPE));
01888                 }
01889 
01890                 if (tdls_direct) {
01891                         /* link during setup - throw out frames to peer */
01892                         if (!tdls_auth) {
01893                                 ret = NETDEV_TX_OK;
01894                                 goto fail;
01895                         }
01896 
01897                         /* DA SA BSSID */
01898                         memcpy(hdr.addr1, skb->data, ETH_ALEN);
01899                         memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
01900                         memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
01901                         hdrlen = 24;
01902                 }  else if (sdata->u.mgd.use_4addr &&
01903                             cpu_to_be16(ethertype) != sdata->control_port_protocol) {
01904                         fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
01905                                           IEEE80211_FCTL_TODS);
01906                         /* RA TA DA SA */
01907                         memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
01908                         memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
01909                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
01910                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
01911                         hdrlen = 30;
01912                 } else {
01913                         fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
01914                         /* BSSID SA DA */
01915                         memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
01916                         memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
01917                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
01918                         hdrlen = 24;
01919                 }
01920                 break;
01921         case NL80211_IFTYPE_ADHOC:
01922                 /* DA SA BSSID */
01923                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
01924                 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
01925                 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
01926                 hdrlen = 24;
01927                 break;
01928         default:
01929                 ret = NETDEV_TX_OK;
01930                 goto fail;
01931         }
01932 
01933         /*
01934          * There's no need to try to look up the destination
01935          * if it is a multicast address (which can only happen
01936          * in AP mode)
01937          */
01938         multicast = is_multicast_ether_addr(hdr.addr1);
01939         if (!multicast) {
01940                 rcu_read_lock();
01941                 sta = sta_info_get(sdata, hdr.addr1);
01942                 if (sta) {
01943                         authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
01944                         wme_sta = test_sta_flag(sta, WLAN_STA_WME);
01945                 }
01946                 rcu_read_unlock();
01947         }
01948 
01949         /* For mesh, the use of the QoS header is mandatory */
01950         if (ieee80211_vif_is_mesh(&sdata->vif))
01951                 wme_sta = true;
01952 
01953         /* receiver and we are QoS enabled, use a QoS type frame */
01954         if (wme_sta && local->hw.queues >= IEEE80211_NUM_ACS) {
01955                 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
01956                 hdrlen += 2;
01957         }
01958 
01959         /*
01960          * Drop unicast frames to unauthorised stations unless they are
01961          * EAPOL frames from the local station.
01962          */
01963         if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
01964                      !is_multicast_ether_addr(hdr.addr1) && !authorized &&
01965                      (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
01966                       !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
01967 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
01968                 net_dbg_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
01969                                     dev->name, hdr.addr1);
01970 #endif
01971 
01972                 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
01973 
01974                 ret = NETDEV_TX_OK;
01975                 goto fail;
01976         }
01977 
01978         if (unlikely(!multicast && skb->sk &&
01979                      skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)) {
01980                 struct sk_buff *orig_skb = skb;
01981 
01982                 skb = skb_clone(skb, GFP_ATOMIC);
01983                 if (skb) {
01984                         unsigned long flags;
01985                         int id, r;
01986 
01987                         spin_lock_irqsave(&local->ack_status_lock, flags);
01988                         r = idr_get_new_above(&local->ack_status_frames,
01989                                               orig_skb, 1, &id);
01990                         if (r == -EAGAIN) {
01991                                 idr_pre_get(&local->ack_status_frames,
01992                                             GFP_ATOMIC);
01993                                 r = idr_get_new_above(&local->ack_status_frames,
01994                                                       orig_skb, 1, &id);
01995                         }
01996                         if (WARN_ON(!id) || id > 0xffff) {
01997                                 idr_remove(&local->ack_status_frames, id);
01998                                 r = -ERANGE;
01999                         }
02000                         spin_unlock_irqrestore(&local->ack_status_lock, flags);
02001 
02002                         if (!r) {
02003                                 info_id = id;
02004                                 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
02005                         } else if (skb_shared(skb)) {
02006                                 kfree_skb(orig_skb);
02007                         } else {
02008                                 kfree_skb(skb);
02009                                 skb = orig_skb;
02010                         }
02011                 } else {
02012                         /* couldn't clone -- lose tx status ... */
02013                         skb = orig_skb;
02014                 }
02015         }
02016 
02017         /*
02018          * If the skb is shared we need to obtain our own copy.
02019          */
02020         if (skb_shared(skb)) {
02021                 struct sk_buff *tmp_skb = skb;
02022 
02023                 /* can't happen -- skb is a clone if info_id != 0 */
02024                 WARN_ON(info_id);
02025 
02026                 skb = skb_clone(skb, GFP_ATOMIC);
02027                 kfree_skb(tmp_skb);
02028 
02029                 if (!skb) {
02030                         ret = NETDEV_TX_OK;
02031                         goto fail;
02032                 }
02033         }
02034 
02035         hdr.frame_control = fc;
02036         hdr.duration_id = 0;
02037         hdr.seq_ctrl = 0;
02038 
02039         skip_header_bytes = ETH_HLEN;
02040         if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
02041                 encaps_data = bridge_tunnel_header;
02042                 encaps_len = sizeof(bridge_tunnel_header);
02043                 skip_header_bytes -= 2;
02044         } else if (ethertype >= 0x600) {
02045                 encaps_data = rfc1042_header;
02046                 encaps_len = sizeof(rfc1042_header);
02047                 skip_header_bytes -= 2;
02048         } else {
02049                 encaps_data = NULL;
02050                 encaps_len = 0;
02051         }
02052 
02053         nh_pos = skb_network_header(skb) - skb->data;
02054         h_pos = skb_transport_header(skb) - skb->data;
02055 
02056         skb_pull(skb, skip_header_bytes);
02057         nh_pos -= skip_header_bytes;
02058         h_pos -= skip_header_bytes;
02059 
02060         head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
02061 
02062         /*
02063          * So we need to modify the skb header and hence need a copy of
02064          * that. The head_need variable above doesn't, so far, include
02065          * the needed header space that we don't need right away. If we
02066          * can, then we don't reallocate right now but only after the
02067          * frame arrives at the master device (if it does...)
02068          *
02069          * If we cannot, however, then we will reallocate to include all
02070          * the ever needed space. Also, if we need to reallocate it anyway,
02071          * make it big enough for everything we may ever need.
02072          */
02073 
02074         if (head_need > 0 || skb_cloned(skb)) {
02075                 head_need += IEEE80211_ENCRYPT_HEADROOM;
02076                 head_need += local->tx_headroom;
02077                 head_need = max_t(int, 0, head_need);
02078                 if (ieee80211_skb_resize(sdata, skb, head_need, true))
02079                         goto fail;
02080         }
02081 
02082         if (encaps_data) {
02083                 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
02084                 nh_pos += encaps_len;
02085                 h_pos += encaps_len;
02086         }
02087 
02088 #ifdef CONFIG_MAC80211_MESH
02089         if (meshhdrlen > 0) {
02090                 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
02091                 nh_pos += meshhdrlen;
02092                 h_pos += meshhdrlen;
02093         }
02094 #endif
02095 
02096         if (ieee80211_is_data_qos(fc)) {
02097                 __le16 *qos_control;
02098 
02099                 qos_control = (__le16*) skb_push(skb, 2);
02100                 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
02101                 /*
02102                  * Maybe we could actually set some fields here, for now just
02103                  * initialise to zero to indicate no special operation.
02104                  */
02105                 *qos_control = 0;
02106         } else
02107                 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
02108 
02109         nh_pos += hdrlen;
02110         h_pos += hdrlen;
02111 
02112         dev->stats.tx_packets++;
02113         dev->stats.tx_bytes += skb->len;
02114 
02115         /* Update skb pointers to various headers since this modified frame
02116          * is going to go through Linux networking code that may potentially
02117          * need things like pointer to IP header. */
02118         skb_set_mac_header(skb, 0);
02119         skb_set_network_header(skb, nh_pos);
02120         skb_set_transport_header(skb, h_pos);
02121 
02122         info = IEEE80211_SKB_CB(skb);
02123         memset(info, 0, sizeof(*info));
02124 
02125         dev->trans_start = jiffies;
02126 
02127         info->flags = info_flags;
02128         info->ack_frame_id = info_id;
02129 
02130         ieee80211_xmit(sdata, skb);
02131 
02132         return NETDEV_TX_OK;
02133 
02134  fail:
02135         if (ret == NETDEV_TX_OK)
02136                 dev_kfree_skb(skb);
02137 
02138         return ret;
02139 }
02140 
02141 
02142 /*
02143  * ieee80211_clear_tx_pending may not be called in a context where
02144  * it is possible that it packets could come in again.
02145  */
02146 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
02147 {
02148         int i;
02149 
02150         for (i = 0; i < local->hw.queues; i++)
02151                 skb_queue_purge(&local->pending[i]);
02152 }
02153 
02154 /*
02155  * Returns false if the frame couldn't be transmitted but was queued instead,
02156  * which in this case means re-queued -- take as an indication to stop sending
02157  * more pending frames.
02158  */
02159 static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
02160                                      struct sk_buff *skb)
02161 {
02162         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
02163         struct ieee80211_sub_if_data *sdata;
02164         struct sta_info *sta;
02165         struct ieee80211_hdr *hdr;
02166         bool result;
02167 
02168         sdata = vif_to_sdata(info->control.vif);
02169 
02170         if (info->flags & IEEE80211_TX_INTFL_NEED_TXPROCESSING) {
02171                 result = ieee80211_tx(sdata, skb, true);
02172         } else {
02173                 struct sk_buff_head skbs;
02174 
02175                 __skb_queue_head_init(&skbs);
02176                 __skb_queue_tail(&skbs, skb);
02177 
02178                 hdr = (struct ieee80211_hdr *)skb->data;
02179                 sta = sta_info_get(sdata, hdr->addr1);
02180 
02181                 result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
02182         }
02183 
02184         return result;
02185 }
02186 
02187 /*
02188  * Transmit all pending packets. Called from tasklet.
02189  */
02190 void ieee80211_tx_pending(unsigned long data)
02191 {
02192         struct ieee80211_local *local = (struct ieee80211_local *)data;
02193         unsigned long flags;
02194         int i;
02195         bool txok;
02196 
02197         rcu_read_lock();
02198 
02199         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
02200         for (i = 0; i < local->hw.queues; i++) {
02201                 /*
02202                  * If queue is stopped by something other than due to pending
02203                  * frames, or we have no pending frames, proceed to next queue.
02204                  */
02205                 if (local->queue_stop_reasons[i] ||
02206                     skb_queue_empty(&local->pending[i]))
02207                         continue;
02208 
02209                 while (!skb_queue_empty(&local->pending[i])) {
02210                         struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
02211                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
02212 
02213                         if (WARN_ON(!info->control.vif)) {
02214                                 kfree_skb(skb);
02215                                 continue;
02216                         }
02217 
02218                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
02219                                                 flags);
02220 
02221                         txok = ieee80211_tx_pending_skb(local, skb);
02222                         spin_lock_irqsave(&local->queue_stop_reason_lock,
02223                                           flags);
02224                         if (!txok)
02225                                 break;
02226                 }
02227 
02228                 if (skb_queue_empty(&local->pending[i]))
02229                         ieee80211_propagate_queue_wake(local, i);
02230         }
02231         spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
02232 
02233         rcu_read_unlock();
02234 }
02235 
02236 /* functions for drivers to get certain frames */
02237 
02238 static void ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
02239                                      struct ieee80211_if_ap *bss,
02240                                      struct sk_buff *skb,
02241                                      struct beacon_data *beacon)
02242 {
02243         u8 *pos, *tim;
02244         int aid0 = 0;
02245         int i, have_bits = 0, n1, n2;
02246 
02247         /* Generate bitmap for TIM only if there are any STAs in power save
02248          * mode. */
02249         if (atomic_read(&bss->num_sta_ps) > 0)
02250                 /* in the hope that this is faster than
02251                  * checking byte-for-byte */
02252                 have_bits = !bitmap_empty((unsigned long*)bss->tim,
02253                                           IEEE80211_MAX_AID+1);
02254 
02255         if (bss->dtim_count == 0)
02256                 bss->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
02257         else
02258                 bss->dtim_count--;
02259 
02260         tim = pos = (u8 *) skb_put(skb, 6);
02261         *pos++ = WLAN_EID_TIM;
02262         *pos++ = 4;
02263         *pos++ = bss->dtim_count;
02264         *pos++ = sdata->vif.bss_conf.dtim_period;
02265 
02266         if (bss->dtim_count == 0 && !skb_queue_empty(&bss->ps_bc_buf))
02267                 aid0 = 1;
02268 
02269         bss->dtim_bc_mc = aid0 == 1;
02270 
02271         if (have_bits) {
02272                 /* Find largest even number N1 so that bits numbered 1 through
02273                  * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
02274                  * (N2 + 1) x 8 through 2007 are 0. */
02275                 n1 = 0;
02276                 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
02277                         if (bss->tim[i]) {
02278                                 n1 = i & 0xfe;
02279                                 break;
02280                         }
02281                 }
02282                 n2 = n1;
02283                 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
02284                         if (bss->tim[i]) {
02285                                 n2 = i;
02286                                 break;
02287                         }
02288                 }
02289 
02290                 /* Bitmap control */
02291                 *pos++ = n1 | aid0;
02292                 /* Part Virt Bitmap */
02293                 skb_put(skb, n2 - n1);
02294                 memcpy(pos, bss->tim + n1, n2 - n1 + 1);
02295 
02296                 tim[1] = n2 - n1 + 4;
02297         } else {
02298                 *pos++ = aid0; /* Bitmap control */
02299                 *pos++ = 0; /* Part Virt Bitmap */
02300         }
02301 }
02302 
02303 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
02304                                          struct ieee80211_vif *vif,
02305                                          u16 *tim_offset, u16 *tim_length)
02306 {
02307         struct ieee80211_local *local = hw_to_local(hw);
02308         struct sk_buff *skb = NULL;
02309         struct ieee80211_tx_info *info;
02310         struct ieee80211_sub_if_data *sdata = NULL;
02311         struct ieee80211_if_ap *ap = NULL;
02312         struct beacon_data *beacon;
02313         struct ieee80211_supported_band *sband;
02314         enum ieee80211_band band = local->hw.conf.channel->band;
02315         struct ieee80211_tx_rate_control txrc;
02316 
02317         sband = local->hw.wiphy->bands[band];
02318 
02319         rcu_read_lock();
02320 
02321         sdata = vif_to_sdata(vif);
02322 
02323         if (!ieee80211_sdata_running(sdata))
02324                 goto out;
02325 
02326         if (tim_offset)
02327                 *tim_offset = 0;
02328         if (tim_length)
02329                 *tim_length = 0;
02330 
02331         if (sdata->vif.type == NL80211_IFTYPE_AP) {
02332                 ap = &sdata->u.ap;
02333                 beacon = rcu_dereference(ap->beacon);
02334                 if (beacon) {
02335                         /*
02336                          * headroom, head length,
02337                          * tail length and maximum TIM length
02338                          */
02339                         skb = dev_alloc_skb(local->tx_headroom +
02340                                             beacon->head_len +
02341                                             beacon->tail_len + 256);
02342                         if (!skb)
02343                                 goto out;
02344 
02345                         skb_reserve(skb, local->tx_headroom);
02346                         memcpy(skb_put(skb, beacon->head_len), beacon->head,
02347                                beacon->head_len);
02348 
02349                         /*
02350                          * Not very nice, but we want to allow the driver to call
02351                          * ieee80211_beacon_get() as a response to the set_tim()
02352                          * callback. That, however, is already invoked under the
02353                          * sta_lock to guarantee consistent and race-free update
02354                          * of the tim bitmap in mac80211 and the driver.
02355                          */
02356                         if (local->tim_in_locked_section) {
02357                                 ieee80211_beacon_add_tim(sdata, ap, skb,
02358                                                          beacon);
02359                         } else {
02360                                 unsigned long flags;
02361 
02362                                 spin_lock_irqsave(&local->tim_lock, flags);
02363                                 ieee80211_beacon_add_tim(sdata, ap, skb,
02364                                                          beacon);
02365                                 spin_unlock_irqrestore(&local->tim_lock, flags);
02366                         }
02367 
02368                         if (tim_offset)
02369                                 *tim_offset = beacon->head_len;
02370                         if (tim_length)
02371                                 *tim_length = skb->len - beacon->head_len;
02372 
02373                         if (beacon->tail)
02374                                 memcpy(skb_put(skb, beacon->tail_len),
02375                                        beacon->tail, beacon->tail_len);
02376                 } else
02377                         goto out;
02378         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
02379                 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
02380                 struct ieee80211_hdr *hdr;
02381                 struct sk_buff *presp = rcu_dereference(ifibss->presp);
02382 
02383                 if (!presp)
02384                         goto out;
02385 
02386                 skb = skb_copy(presp, GFP_ATOMIC);
02387                 if (!skb)
02388                         goto out;
02389 
02390                 hdr = (struct ieee80211_hdr *) skb->data;
02391                 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
02392                                                  IEEE80211_STYPE_BEACON);
02393         } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
02394                 struct ieee80211_mgmt *mgmt;
02395                 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
02396                 u8 *pos;
02397                 int hdr_len = offsetof(struct ieee80211_mgmt, u.beacon) +
02398                               sizeof(mgmt->u.beacon);
02399 
02400 #ifdef CONFIG_MAC80211_MESH
02401                 if (!sdata->u.mesh.mesh_id_len)
02402                         goto out;
02403 #endif
02404 
02405                 if (ifmsh->sync_ops)
02406                         ifmsh->sync_ops->adjust_tbtt(
02407                                                 sdata);
02408 
02409                 skb = dev_alloc_skb(local->tx_headroom +
02410                                     hdr_len +
02411                                     2 + /* NULL SSID */
02412                                     2 + 8 + /* supported rates */
02413                                     2 + 3 + /* DS params */
02414                                     2 + (IEEE80211_MAX_SUPP_RATES - 8) +
02415                                     2 + sizeof(struct ieee80211_ht_cap) +
02416                                     2 + sizeof(struct ieee80211_ht_operation) +
02417                                     2 + sdata->u.mesh.mesh_id_len +
02418                                     2 + sizeof(struct ieee80211_meshconf_ie) +
02419                                     sdata->u.mesh.ie_len);
02420                 if (!skb)
02421                         goto out;
02422 
02423                 skb_reserve(skb, local->hw.extra_tx_headroom);
02424                 mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
02425                 memset(mgmt, 0, hdr_len);
02426                 mgmt->frame_control =
02427                     cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
02428                 memset(mgmt->da, 0xff, ETH_ALEN);
02429                 memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
02430                 memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
02431                 mgmt->u.beacon.beacon_int =
02432                         cpu_to_le16(sdata->vif.bss_conf.beacon_int);
02433                 mgmt->u.beacon.capab_info |= cpu_to_le16(
02434                         sdata->u.mesh.security ? WLAN_CAPABILITY_PRIVACY : 0);
02435 
02436                 pos = skb_put(skb, 2);
02437                 *pos++ = WLAN_EID_SSID;
02438                 *pos++ = 0x0;
02439 
02440                 if (ieee80211_add_srates_ie(&sdata->vif, skb, true) ||
02441                     mesh_add_ds_params_ie(skb, sdata) ||
02442                     ieee80211_add_ext_srates_ie(&sdata->vif, skb, true) ||
02443                     mesh_add_rsn_ie(skb, sdata) ||
02444                     mesh_add_ht_cap_ie(skb, sdata) ||
02445                     mesh_add_ht_oper_ie(skb, sdata) ||
02446                     mesh_add_meshid_ie(skb, sdata) ||
02447                     mesh_add_meshconf_ie(skb, sdata) ||
02448                     mesh_add_vendor_ies(skb, sdata)) {
02449                         pr_err("o11s: couldn't add ies!\n");
02450                         goto out;
02451                 }
02452         } else {
02453                 WARN_ON(1);
02454                 goto out;
02455         }
02456 
02457         info = IEEE80211_SKB_CB(skb);
02458 
02459         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
02460         info->flags |= IEEE80211_TX_CTL_NO_ACK;
02461         info->band = band;
02462 
02463         memset(&txrc, 0, sizeof(txrc));
02464         txrc.hw = hw;
02465         txrc.sband = sband;
02466         txrc.bss_conf = &sdata->vif.bss_conf;
02467         txrc.skb = skb;
02468         txrc.reported_rate.idx = -1;
02469         txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
02470         if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
02471                 txrc.max_rate_idx = -1;
02472         else
02473                 txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
02474         memcpy(txrc.rate_idx_mcs_mask, sdata->rc_rateidx_mcs_mask[band],
02475                sizeof(txrc.rate_idx_mcs_mask));
02476         txrc.bss = true;
02477         rate_control_get_rate(sdata, NULL, &txrc);
02478 
02479         info->control.vif = vif;
02480 
02481         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
02482                         IEEE80211_TX_CTL_ASSIGN_SEQ |
02483                         IEEE80211_TX_CTL_FIRST_FRAGMENT;
02484  out:
02485         rcu_read_unlock();
02486         return skb;
02487 }
02488 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
02489 
02490 struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
02491                                         struct ieee80211_vif *vif)
02492 {
02493         struct ieee80211_if_ap *ap = NULL;
02494         struct sk_buff *presp = NULL, *skb = NULL;
02495         struct ieee80211_hdr *hdr;
02496         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
02497 
02498         if (sdata->vif.type != NL80211_IFTYPE_AP)
02499                 return NULL;
02500 
02501         rcu_read_lock();
02502 
02503         ap = &sdata->u.ap;
02504         presp = rcu_dereference(ap->probe_resp);
02505         if (!presp)
02506                 goto out;
02507 
02508         skb = skb_copy(presp, GFP_ATOMIC);
02509         if (!skb)
02510                 goto out;
02511 
02512         hdr = (struct ieee80211_hdr *) skb->data;
02513         memset(hdr->addr1, 0, sizeof(hdr->addr1));
02514 
02515 out:
02516         rcu_read_unlock();
02517         return skb;
02518 }
02519 EXPORT_SYMBOL(ieee80211_proberesp_get);
02520 
02521 struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
02522                                      struct ieee80211_vif *vif)
02523 {
02524         struct ieee80211_sub_if_data *sdata;
02525         struct ieee80211_if_managed *ifmgd;
02526         struct ieee80211_pspoll *pspoll;
02527         struct ieee80211_local *local;
02528         struct sk_buff *skb;
02529 
02530         if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
02531                 return NULL;
02532 
02533         sdata = vif_to_sdata(vif);
02534         ifmgd = &sdata->u.mgd;
02535         local = sdata->local;
02536 
02537         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
02538         if (!skb)
02539                 return NULL;
02540 
02541         skb_reserve(skb, local->hw.extra_tx_headroom);
02542 
02543         pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
02544         memset(pspoll, 0, sizeof(*pspoll));
02545         pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
02546                                             IEEE80211_STYPE_PSPOLL);
02547         pspoll->aid = cpu_to_le16(ifmgd->aid);
02548 
02549         /* aid in PS-Poll has its two MSBs each set to 1 */
02550         pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
02551 
02552         memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
02553         memcpy(pspoll->ta, vif->addr, ETH_ALEN);
02554 
02555         return skb;
02556 }
02557 EXPORT_SYMBOL(ieee80211_pspoll_get);
02558 
02559 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
02560                                        struct ieee80211_vif *vif)
02561 {
02562         struct ieee80211_hdr_3addr *nullfunc;
02563         struct ieee80211_sub_if_data *sdata;
02564         struct ieee80211_if_managed *ifmgd;
02565         struct ieee80211_local *local;
02566         struct sk_buff *skb;
02567 
02568         if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
02569                 return NULL;
02570 
02571         sdata = vif_to_sdata(vif);
02572         ifmgd = &sdata->u.mgd;
02573         local = sdata->local;
02574 
02575         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
02576         if (!skb)
02577                 return NULL;
02578 
02579         skb_reserve(skb, local->hw.extra_tx_headroom);
02580 
02581         nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
02582                                                           sizeof(*nullfunc));
02583         memset(nullfunc, 0, sizeof(*nullfunc));
02584         nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
02585                                               IEEE80211_STYPE_NULLFUNC |
02586                                               IEEE80211_FCTL_TODS);
02587         memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
02588         memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
02589         memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
02590 
02591         return skb;
02592 }
02593 EXPORT_SYMBOL(ieee80211_nullfunc_get);
02594 
02595 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
02596                                        struct ieee80211_vif *vif,
02597                                        const u8 *ssid, size_t ssid_len,
02598                                        const u8 *ie, size_t ie_len)
02599 {
02600         struct ieee80211_sub_if_data *sdata;
02601         struct ieee80211_local *local;
02602         struct ieee80211_hdr_3addr *hdr;
02603         struct sk_buff *skb;
02604         size_t ie_ssid_len;
02605         u8 *pos;
02606 
02607         sdata = vif_to_sdata(vif);
02608         local = sdata->local;
02609         ie_ssid_len = 2 + ssid_len;
02610 
02611         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
02612                             ie_ssid_len + ie_len);
02613         if (!skb)
02614                 return NULL;
02615 
02616         skb_reserve(skb, local->hw.extra_tx_headroom);
02617 
02618         hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
02619         memset(hdr, 0, sizeof(*hdr));
02620         hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
02621                                          IEEE80211_STYPE_PROBE_REQ);
02622         memset(hdr->addr1, 0xff, ETH_ALEN);
02623         memcpy(hdr->addr2, vif->addr, ETH_ALEN);
02624         memset(hdr->addr3, 0xff, ETH_ALEN);
02625 
02626         pos = skb_put(skb, ie_ssid_len);
02627         *pos++ = WLAN_EID_SSID;
02628         *pos++ = ssid_len;
02629         if (ssid_len)
02630                 memcpy(pos, ssid, ssid_len);
02631         pos += ssid_len;
02632 
02633         if (ie) {
02634                 pos = skb_put(skb, ie_len);
02635                 memcpy(pos, ie, ie_len);
02636         }
02637 
02638         return skb;
02639 }
02640 EXPORT_SYMBOL(ieee80211_probereq_get);
02641 
02642 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
02643                        const void *frame, size_t frame_len,
02644                        const struct ieee80211_tx_info *frame_txctl,
02645                        struct ieee80211_rts *rts)
02646 {
02647         const struct ieee80211_hdr *hdr = frame;
02648 
02649         rts->frame_control =
02650             cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
02651         rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
02652                                                frame_txctl);
02653         memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
02654         memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
02655 }
02656 EXPORT_SYMBOL(ieee80211_rts_get);
02657 
02658 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
02659                              const void *frame, size_t frame_len,
02660                              const struct ieee80211_tx_info *frame_txctl,
02661                              struct ieee80211_cts *cts)
02662 {
02663         const struct ieee80211_hdr *hdr = frame;
02664 
02665         cts->frame_control =
02666             cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
02667         cts->duration = ieee80211_ctstoself_duration(hw, vif,
02668                                                      frame_len, frame_txctl);
02669         memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
02670 }
02671 EXPORT_SYMBOL(ieee80211_ctstoself_get);
02672 
02673 struct sk_buff *
02674 ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
02675                           struct ieee80211_vif *vif)
02676 {
02677         struct ieee80211_local *local = hw_to_local(hw);
02678         struct sk_buff *skb = NULL;
02679         struct ieee80211_tx_data tx;
02680         struct ieee80211_sub_if_data *sdata;
02681         struct ieee80211_if_ap *bss = NULL;
02682         struct beacon_data *beacon;
02683         struct ieee80211_tx_info *info;
02684 
02685         sdata = vif_to_sdata(vif);
02686         bss = &sdata->u.ap;
02687 
02688         rcu_read_lock();
02689         beacon = rcu_dereference(bss->beacon);
02690 
02691         if (sdata->vif.type != NL80211_IFTYPE_AP || !beacon || !beacon->head)
02692                 goto out;
02693 
02694         if (bss->dtim_count != 0 || !bss->dtim_bc_mc)
02695                 goto out; /* send buffered bc/mc only after DTIM beacon */
02696 
02697         while (1) {
02698                 skb = skb_dequeue(&bss->ps_bc_buf);
02699                 if (!skb)
02700                         goto out;
02701                 local->total_ps_buffered--;
02702 
02703                 if (!skb_queue_empty(&bss->ps_bc_buf) && skb->len >= 2) {
02704                         struct ieee80211_hdr *hdr =
02705                                 (struct ieee80211_hdr *) skb->data;
02706                         /* more buffered multicast/broadcast frames ==> set
02707                          * MoreData flag in IEEE 802.11 header to inform PS
02708                          * STAs */
02709                         hdr->frame_control |=
02710                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
02711                 }
02712 
02713                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
02714                         break;
02715                 dev_kfree_skb_any(skb);
02716         }
02717 
02718         info = IEEE80211_SKB_CB(skb);
02719 
02720         tx.flags |= IEEE80211_TX_PS_BUFFERED;
02721         tx.channel = local->hw.conf.channel;
02722         info->band = tx.channel->band;
02723 
02724         if (invoke_tx_handlers(&tx))
02725                 skb = NULL;
02726  out:
02727         rcu_read_unlock();
02728 
02729         return skb;
02730 }
02731 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
02732 
02733 void ieee80211_tx_skb_tid(struct ieee80211_sub_if_data *sdata,
02734                           struct sk_buff *skb, int tid)
02735 {
02736         int ac = ieee802_1d_to_ac[tid & 7];
02737 
02738         skb_set_mac_header(skb, 0);
02739         skb_set_network_header(skb, 0);
02740         skb_set_transport_header(skb, 0);
02741 
02742         skb_set_queue_mapping(skb, ac);
02743         skb->priority = tid;
02744 
02745         /*
02746          * The other path calling ieee80211_xmit is from the tasklet,
02747          * and while we can handle concurrent transmissions locking
02748          * requirements are that we do not come into tx with bhs on.
02749          */
02750         local_bh_disable();
02751         ieee80211_xmit(sdata, skb);
02752         local_bh_enable();
02753 }


ros_rt_wmp
Author(s): Danilo Tardioli, dantard@unizar.es
autogenerated on Mon Oct 6 2014 08:27:11