1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright 2002-2005, Instant802 Networks, Inc.
4 * Copyright 2005-2006, Devicescape Software, Inc.
5 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
6 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
7 * Copyright 2013-2014 Intel Mobile Communications GmbH
8 * Copyright (C) 2018-2021 Intel Corporation
9 *
10 * Transmit and frame generation functions.
11 */
12
13 #include <linux/kernel.h>
14 #include <linux/slab.h>
15 #include <linux/skbuff.h>
16 #include <linux/if_vlan.h>
17 #include <linux/etherdevice.h>
18 #include <linux/bitmap.h>
19 #include <linux/rcupdate.h>
20 #include <linux/export.h>
21 #include <net/net_namespace.h>
22 #include <net/ieee80211_radiotap.h>
23 #include <net/cfg80211.h>
24 #include <net/mac80211.h>
25 #include <net/codel.h>
26 #include <net/codel_impl.h>
27 #include <asm/unaligned.h>
28 #include <net/fq_impl.h>
29
30 #include "ieee80211_i.h"
31 #include "driver-ops.h"
32 #include "led.h"
33 #include "mesh.h"
34 #include "wep.h"
35 #include "wpa.h"
36 #include "wme.h"
37 #include "rate.h"
38
39 /* misc utils */
40
ieee80211_duration(struct ieee80211_tx_data * tx,struct sk_buff * skb,int group_addr,int next_frag_len)41 static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
42 struct sk_buff *skb, int group_addr,
43 int next_frag_len)
44 {
45 int rate, mrate, erp, dur, i, shift = 0;
46 struct ieee80211_rate *txrate;
47 struct ieee80211_local *local = tx->local;
48 struct ieee80211_supported_band *sband;
49 struct ieee80211_hdr *hdr;
50 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
51 struct ieee80211_chanctx_conf *chanctx_conf;
52 u32 rate_flags = 0;
53
54 /* assume HW handles this */
55 if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
56 return 0;
57
58 rcu_read_lock();
59 chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
60 if (chanctx_conf) {
61 shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
62 rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
63 }
64 rcu_read_unlock();
65
66 /* uh huh? */
67 if (WARN_ON_ONCE(tx->rate.idx < 0))
68 return 0;
69
70 sband = local->hw.wiphy->bands[info->band];
71 txrate = &sband->bitrates[tx->rate.idx];
72
73 erp = txrate->flags & IEEE80211_RATE_ERP_G;
74
75 /* device is expected to do this */
76 if (sband->band == NL80211_BAND_S1GHZ)
77 return 0;
78
79 /*
80 * data and mgmt (except PS Poll):
81 * - during CFP: 32768
82 * - during contention period:
83 * if addr1 is group address: 0
84 * if more fragments = 0 and addr1 is individual address: time to
85 * transmit one ACK plus SIFS
86 * if more fragments = 1 and addr1 is individual address: time to
87 * transmit next fragment plus 2 x ACK plus 3 x SIFS
88 *
89 * IEEE 802.11, 9.6:
90 * - control response frame (CTS or ACK) shall be transmitted using the
91 * same rate as the immediately previous frame in the frame exchange
92 * sequence, if this rate belongs to the PHY mandatory rates, or else
93 * at the highest possible rate belonging to the PHY rates in the
94 * BSSBasicRateSet
95 */
96 hdr = (struct ieee80211_hdr *)skb->data;
97 if (ieee80211_is_ctl(hdr->frame_control)) {
98 /* TODO: These control frames are not currently sent by
99 * mac80211, but should they be implemented, this function
100 * needs to be updated to support duration field calculation.
101 *
102 * RTS: time needed to transmit pending data/mgmt frame plus
103 * one CTS frame plus one ACK frame plus 3 x SIFS
104 * CTS: duration of immediately previous RTS minus time
105 * required to transmit CTS and its SIFS
106 * ACK: 0 if immediately previous directed data/mgmt had
107 * more=0, with more=1 duration in ACK frame is duration
108 * from previous frame minus time needed to transmit ACK
109 * and its SIFS
110 * PS Poll: BIT(15) | BIT(14) | aid
111 */
112 return 0;
113 }
114
115 /* data/mgmt */
116 if (0 /* FIX: data/mgmt during CFP */)
117 return cpu_to_le16(32768);
118
119 if (group_addr) /* Group address as the destination - no ACK */
120 return 0;
121
122 /* Individual destination address:
123 * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
124 * CTS and ACK frames shall be transmitted using the highest rate in
125 * basic rate set that is less than or equal to the rate of the
126 * immediately previous frame and that is using the same modulation
127 * (CCK or OFDM). If no basic rate set matches with these requirements,
128 * the highest mandatory rate of the PHY that is less than or equal to
129 * the rate of the previous frame is used.
130 * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
131 */
132 rate = -1;
133 /* use lowest available if everything fails */
134 mrate = sband->bitrates[0].bitrate;
135 for (i = 0; i < sband->n_bitrates; i++) {
136 struct ieee80211_rate *r = &sband->bitrates[i];
137
138 if (r->bitrate > txrate->bitrate)
139 break;
140
141 if ((rate_flags & r->flags) != rate_flags)
142 continue;
143
144 if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
145 rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
146
147 switch (sband->band) {
148 case NL80211_BAND_2GHZ: {
149 u32 flag;
150 if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
151 flag = IEEE80211_RATE_MANDATORY_G;
152 else
153 flag = IEEE80211_RATE_MANDATORY_B;
154 if (r->flags & flag)
155 mrate = r->bitrate;
156 break;
157 }
158 case NL80211_BAND_5GHZ:
159 case NL80211_BAND_6GHZ:
160 if (r->flags & IEEE80211_RATE_MANDATORY_A)
161 mrate = r->bitrate;
162 break;
163 case NL80211_BAND_S1GHZ:
164 case NL80211_BAND_60GHZ:
165 /* TODO, for now fall through */
166 case NUM_NL80211_BANDS:
167 WARN_ON(1);
168 break;
169 }
170 }
171 if (rate == -1) {
172 /* No matching basic rate found; use highest suitable mandatory
173 * PHY rate */
174 rate = DIV_ROUND_UP(mrate, 1 << shift);
175 }
176
177 /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
178 if (ieee80211_is_data_qos(hdr->frame_control) &&
179 *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
180 dur = 0;
181 else
182 /* Time needed to transmit ACK
183 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
184 * to closest integer */
185 dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
186 tx->sdata->vif.bss_conf.use_short_preamble,
187 shift);
188
189 if (next_frag_len) {
190 /* Frame is fragmented: duration increases with time needed to
191 * transmit next fragment plus ACK and 2 x SIFS. */
192 dur *= 2; /* ACK + SIFS */
193 /* next fragment */
194 dur += ieee80211_frame_duration(sband->band, next_frag_len,
195 txrate->bitrate, erp,
196 tx->sdata->vif.bss_conf.use_short_preamble,
197 shift);
198 }
199
200 return cpu_to_le16(dur);
201 }
202
203 /* tx handlers */
204 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data * tx)205 ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
206 {
207 struct ieee80211_local *local = tx->local;
208 struct ieee80211_if_managed *ifmgd;
209 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
210
211 /* driver doesn't support power save */
212 if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS))
213 return TX_CONTINUE;
214
215 /* hardware does dynamic power save */
216 if (ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
217 return TX_CONTINUE;
218
219 /* dynamic power save disabled */
220 if (local->hw.conf.dynamic_ps_timeout <= 0)
221 return TX_CONTINUE;
222
223 /* we are scanning, don't enable power save */
224 if (local->scanning)
225 return TX_CONTINUE;
226
227 if (!local->ps_sdata)
228 return TX_CONTINUE;
229
230 /* No point if we're going to suspend */
231 if (local->quiescing)
232 return TX_CONTINUE;
233
234 /* dynamic ps is supported only in managed mode */
235 if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
236 return TX_CONTINUE;
237
238 if (unlikely(info->flags & IEEE80211_TX_INTFL_OFFCHAN_TX_OK))
239 return TX_CONTINUE;
240
241 ifmgd = &tx->sdata->u.mgd;
242
243 /*
244 * Don't wakeup from power save if u-apsd is enabled, voip ac has
245 * u-apsd enabled and the frame is in voip class. This effectively
246 * means that even if all access categories have u-apsd enabled, in
247 * practise u-apsd is only used with the voip ac. This is a
248 * workaround for the case when received voip class packets do not
249 * have correct qos tag for some reason, due the network or the
250 * peer application.
251 *
252 * Note: ifmgd->uapsd_queues access is racy here. If the value is
253 * changed via debugfs, user needs to reassociate manually to have
254 * everything in sync.
255 */
256 if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
257 (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
258 skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
259 return TX_CONTINUE;
260
261 if (local->hw.conf.flags & IEEE80211_CONF_PS) {
262 ieee80211_stop_queues_by_reason(&local->hw,
263 IEEE80211_MAX_QUEUE_MAP,
264 IEEE80211_QUEUE_STOP_REASON_PS,
265 false);
266 ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
267 ieee80211_queue_work(&local->hw,
268 &local->dynamic_ps_disable_work);
269 }
270
271 /* Don't restart the timer if we're not disassociated */
272 if (!ifmgd->associated)
273 return TX_CONTINUE;
274
275 mod_timer(&local->dynamic_ps_timer, jiffies +
276 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
277
278 return TX_CONTINUE;
279 }
280
281 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_check_assoc(struct ieee80211_tx_data * tx)282 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
283 {
284
285 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
286 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
287 bool assoc = false;
288
289 if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
290 return TX_CONTINUE;
291
292 if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
293 test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
294 !ieee80211_is_probe_req(hdr->frame_control) &&
295 !ieee80211_is_any_nullfunc(hdr->frame_control))
296 /*
297 * When software scanning only nullfunc frames (to notify
298 * the sleep state to the AP) and probe requests (for the
299 * active scan) are allowed, all other frames should not be
300 * sent and we should not get here, but if we do
301 * nonetheless, drop them to avoid sending them
302 * off-channel. See the link below and
303 * ieee80211_start_scan() for more.
304 *
305 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
306 */
307 return TX_DROP;
308
309 if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
310 return TX_CONTINUE;
311
312 if (tx->flags & IEEE80211_TX_PS_BUFFERED)
313 return TX_CONTINUE;
314
315 if (tx->sta)
316 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
317
318 if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
319 if (unlikely(!assoc &&
320 ieee80211_is_data(hdr->frame_control))) {
321 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
322 sdata_info(tx->sdata,
323 "dropped data frame to not associated station %pM\n",
324 hdr->addr1);
325 #endif
326 I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
327 return TX_DROP;
328 }
329 } else if (unlikely(ieee80211_is_data(hdr->frame_control) &&
330 ieee80211_vif_get_num_mcast_if(tx->sdata) == 0)) {
331 /*
332 * No associated STAs - no need to send multicast
333 * frames.
334 */
335 return TX_DROP;
336 }
337
338 return TX_CONTINUE;
339 }
340
341 /* This function is called whenever the AP is about to exceed the maximum limit
342 * of buffered frames for power saving STAs. This situation should not really
343 * happen often during normal operation, so dropping the oldest buffered packet
344 * from each queue should be OK to make some room for new frames. */
purge_old_ps_buffers(struct ieee80211_local * local)345 static void purge_old_ps_buffers(struct ieee80211_local *local)
346 {
347 int total = 0, purged = 0;
348 struct sk_buff *skb;
349 struct ieee80211_sub_if_data *sdata;
350 struct sta_info *sta;
351
352 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
353 struct ps_data *ps;
354
355 if (sdata->vif.type == NL80211_IFTYPE_AP)
356 ps = &sdata->u.ap.ps;
357 else if (ieee80211_vif_is_mesh(&sdata->vif))
358 ps = &sdata->u.mesh.ps;
359 else
360 continue;
361
362 skb = skb_dequeue(&ps->bc_buf);
363 if (skb) {
364 purged++;
365 ieee80211_free_txskb(&local->hw, skb);
366 }
367 total += skb_queue_len(&ps->bc_buf);
368 }
369
370 /*
371 * Drop one frame from each station from the lowest-priority
372 * AC that has frames at all.
373 */
374 list_for_each_entry_rcu(sta, &local->sta_list, list) {
375 int ac;
376
377 for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
378 skb = skb_dequeue(&sta->ps_tx_buf[ac]);
379 total += skb_queue_len(&sta->ps_tx_buf[ac]);
380 if (skb) {
381 purged++;
382 ieee80211_free_txskb(&local->hw, skb);
383 break;
384 }
385 }
386 }
387
388 local->total_ps_buffered = total;
389 ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
390 }
391
392 static ieee80211_tx_result
ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data * tx)393 ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
394 {
395 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
396 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
397 struct ps_data *ps;
398
399 /*
400 * broadcast/multicast frame
401 *
402 * If any of the associated/peer stations is in power save mode,
403 * the frame is buffered to be sent after DTIM beacon frame.
404 * This is done either by the hardware or us.
405 */
406
407 /* powersaving STAs currently only in AP/VLAN/mesh mode */
408 if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
409 tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
410 if (!tx->sdata->bss)
411 return TX_CONTINUE;
412
413 ps = &tx->sdata->bss->ps;
414 } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
415 ps = &tx->sdata->u.mesh.ps;
416 } else {
417 return TX_CONTINUE;
418 }
419
420
421 /* no buffering for ordered frames */
422 if (ieee80211_has_order(hdr->frame_control))
423 return TX_CONTINUE;
424
425 if (ieee80211_is_probe_req(hdr->frame_control))
426 return TX_CONTINUE;
427
428 if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
429 info->hw_queue = tx->sdata->vif.cab_queue;
430
431 /* no stations in PS mode and no buffered packets */
432 if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
433 return TX_CONTINUE;
434
435 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
436
437 /* device releases frame after DTIM beacon */
438 if (!ieee80211_hw_check(&tx->local->hw, HOST_BROADCAST_PS_BUFFERING))
439 return TX_CONTINUE;
440
441 /* buffered in mac80211 */
442 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
443 purge_old_ps_buffers(tx->local);
444
445 if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
446 ps_dbg(tx->sdata,
447 "BC TX buffer full - dropping the oldest frame\n");
448 ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
449 } else
450 tx->local->total_ps_buffered++;
451
452 skb_queue_tail(&ps->bc_buf, tx->skb);
453
454 return TX_QUEUED;
455 }
456
ieee80211_use_mfp(__le16 fc,struct sta_info * sta,struct sk_buff * skb)457 static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
458 struct sk_buff *skb)
459 {
460 if (!ieee80211_is_mgmt(fc))
461 return 0;
462
463 if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
464 return 0;
465
466 if (!ieee80211_is_robust_mgmt_frame(skb))
467 return 0;
468
469 return 1;
470 }
471
472 static ieee80211_tx_result
ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data * tx)473 ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
474 {
475 struct sta_info *sta = tx->sta;
476 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
477 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
478 struct ieee80211_local *local = tx->local;
479
480 if (unlikely(!sta))
481 return TX_CONTINUE;
482
483 if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
484 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
485 test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
486 !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
487 int ac = skb_get_queue_mapping(tx->skb);
488
489 if (ieee80211_is_mgmt(hdr->frame_control) &&
490 !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
491 info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
492 return TX_CONTINUE;
493 }
494
495 ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
496 sta->sta.addr, sta->sta.aid, ac);
497 if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
498 purge_old_ps_buffers(tx->local);
499
500 /* sync with ieee80211_sta_ps_deliver_wakeup */
501 spin_lock(&sta->ps_lock);
502 /*
503 * STA woke up the meantime and all the frames on ps_tx_buf have
504 * been queued to pending queue. No reordering can happen, go
505 * ahead and Tx the packet.
506 */
507 if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
508 !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
509 !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
510 spin_unlock(&sta->ps_lock);
511 return TX_CONTINUE;
512 }
513
514 if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
515 struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
516 ps_dbg(tx->sdata,
517 "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
518 sta->sta.addr, ac);
519 ieee80211_free_txskb(&local->hw, old);
520 } else
521 tx->local->total_ps_buffered++;
522
523 info->control.jiffies = jiffies;
524 info->control.vif = &tx->sdata->vif;
525 info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
526 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
527 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
528 spin_unlock(&sta->ps_lock);
529
530 if (!timer_pending(&local->sta_cleanup))
531 mod_timer(&local->sta_cleanup,
532 round_jiffies(jiffies +
533 STA_INFO_CLEANUP_INTERVAL));
534
535 /*
536 * We queued up some frames, so the TIM bit might
537 * need to be set, recalculate it.
538 */
539 sta_info_recalc_tim(sta);
540
541 return TX_QUEUED;
542 } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
543 ps_dbg(tx->sdata,
544 "STA %pM in PS mode, but polling/in SP -> send frame\n",
545 sta->sta.addr);
546 }
547
548 return TX_CONTINUE;
549 }
550
551 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_ps_buf(struct ieee80211_tx_data * tx)552 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
553 {
554 if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
555 return TX_CONTINUE;
556
557 if (tx->flags & IEEE80211_TX_UNICAST)
558 return ieee80211_tx_h_unicast_ps_buf(tx);
559 else
560 return ieee80211_tx_h_multicast_ps_buf(tx);
561 }
562
563 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data * tx)564 ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
565 {
566 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
567
568 if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
569 if (tx->sdata->control_port_no_encrypt)
570 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
571 info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
572 info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
573 }
574
575 return TX_CONTINUE;
576 }
577
578 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_select_key(struct ieee80211_tx_data * tx)579 ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
580 {
581 struct ieee80211_key *key;
582 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
583 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
584
585 if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
586 tx->key = NULL;
587 return TX_CONTINUE;
588 }
589
590 if (tx->sta &&
591 (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
592 tx->key = key;
593 else if (ieee80211_is_group_privacy_action(tx->skb) &&
594 (key = rcu_dereference(tx->sdata->default_multicast_key)))
595 tx->key = key;
596 else if (ieee80211_is_mgmt(hdr->frame_control) &&
597 is_multicast_ether_addr(hdr->addr1) &&
598 ieee80211_is_robust_mgmt_frame(tx->skb) &&
599 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
600 tx->key = key;
601 else if (is_multicast_ether_addr(hdr->addr1) &&
602 (key = rcu_dereference(tx->sdata->default_multicast_key)))
603 tx->key = key;
604 else if (!is_multicast_ether_addr(hdr->addr1) &&
605 (key = rcu_dereference(tx->sdata->default_unicast_key)))
606 tx->key = key;
607 else
608 tx->key = NULL;
609
610 if (tx->key) {
611 bool skip_hw = false;
612
613 /* TODO: add threshold stuff again */
614
615 switch (tx->key->conf.cipher) {
616 case WLAN_CIPHER_SUITE_WEP40:
617 case WLAN_CIPHER_SUITE_WEP104:
618 case WLAN_CIPHER_SUITE_TKIP:
619 if (!ieee80211_is_data_present(hdr->frame_control))
620 tx->key = NULL;
621 break;
622 case WLAN_CIPHER_SUITE_CCMP:
623 case WLAN_CIPHER_SUITE_CCMP_256:
624 case WLAN_CIPHER_SUITE_GCMP:
625 case WLAN_CIPHER_SUITE_GCMP_256:
626 if (!ieee80211_is_data_present(hdr->frame_control) &&
627 !ieee80211_use_mfp(hdr->frame_control, tx->sta,
628 tx->skb) &&
629 !ieee80211_is_group_privacy_action(tx->skb))
630 tx->key = NULL;
631 else
632 skip_hw = (tx->key->conf.flags &
633 IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
634 ieee80211_is_mgmt(hdr->frame_control);
635 break;
636 case WLAN_CIPHER_SUITE_AES_CMAC:
637 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
638 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
639 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
640 if (!ieee80211_is_mgmt(hdr->frame_control))
641 tx->key = NULL;
642 break;
643 }
644
645 if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
646 !ieee80211_is_deauth(hdr->frame_control)))
647 return TX_DROP;
648
649 if (!skip_hw && tx->key &&
650 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
651 info->control.hw_key = &tx->key->conf;
652 } else if (ieee80211_is_data_present(hdr->frame_control) && tx->sta &&
653 test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
654 return TX_DROP;
655 }
656
657 return TX_CONTINUE;
658 }
659
660 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data * tx)661 ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
662 {
663 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
664 struct ieee80211_hdr *hdr = (void *)tx->skb->data;
665 struct ieee80211_supported_band *sband;
666 u32 len;
667 struct ieee80211_tx_rate_control txrc;
668 struct ieee80211_sta_rates *ratetbl = NULL;
669 bool assoc = false;
670
671 memset(&txrc, 0, sizeof(txrc));
672
673 sband = tx->local->hw.wiphy->bands[info->band];
674
675 len = min_t(u32, tx->skb->len + FCS_LEN,
676 tx->local->hw.wiphy->frag_threshold);
677
678 /* set up the tx rate control struct we give the RC algo */
679 txrc.hw = &tx->local->hw;
680 txrc.sband = sband;
681 txrc.bss_conf = &tx->sdata->vif.bss_conf;
682 txrc.skb = tx->skb;
683 txrc.reported_rate.idx = -1;
684 txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
685
686 if (tx->sdata->rc_has_mcs_mask[info->band])
687 txrc.rate_idx_mcs_mask =
688 tx->sdata->rc_rateidx_mcs_mask[info->band];
689
690 txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
691 tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
692 tx->sdata->vif.type == NL80211_IFTYPE_ADHOC ||
693 tx->sdata->vif.type == NL80211_IFTYPE_OCB);
694
695 /* set up RTS protection if desired */
696 if (len > tx->local->hw.wiphy->rts_threshold) {
697 txrc.rts = true;
698 }
699
700 info->control.use_rts = txrc.rts;
701 info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
702
703 /*
704 * Use short preamble if the BSS can handle it, but not for
705 * management frames unless we know the receiver can handle
706 * that -- the management frame might be to a station that
707 * just wants a probe response.
708 */
709 if (tx->sdata->vif.bss_conf.use_short_preamble &&
710 (ieee80211_is_data(hdr->frame_control) ||
711 (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
712 txrc.short_preamble = true;
713
714 info->control.short_preamble = txrc.short_preamble;
715
716 /* don't ask rate control when rate already injected via radiotap */
717 if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
718 return TX_CONTINUE;
719
720 if (tx->sta)
721 assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
722
723 /*
724 * Lets not bother rate control if we're associated and cannot
725 * talk to the sta. This should not happen.
726 */
727 if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
728 !rate_usable_index_exists(sband, &tx->sta->sta),
729 "%s: Dropped data frame as no usable bitrate found while "
730 "scanning and associated. Target station: "
731 "%pM on %d GHz band\n",
732 tx->sdata->name, hdr->addr1,
733 info->band ? 5 : 2))
734 return TX_DROP;
735
736 /*
737 * If we're associated with the sta at this point we know we can at
738 * least send the frame at the lowest bit rate.
739 */
740 rate_control_get_rate(tx->sdata, tx->sta, &txrc);
741
742 if (tx->sta && !info->control.skip_table)
743 ratetbl = rcu_dereference(tx->sta->sta.rates);
744
745 if (unlikely(info->control.rates[0].idx < 0)) {
746 if (ratetbl) {
747 struct ieee80211_tx_rate rate = {
748 .idx = ratetbl->rate[0].idx,
749 .flags = ratetbl->rate[0].flags,
750 .count = ratetbl->rate[0].count
751 };
752
753 if (ratetbl->rate[0].idx < 0)
754 return TX_DROP;
755
756 tx->rate = rate;
757 } else {
758 return TX_DROP;
759 }
760 } else {
761 tx->rate = info->control.rates[0];
762 }
763
764 if (txrc.reported_rate.idx < 0) {
765 txrc.reported_rate = tx->rate;
766 if (tx->sta && ieee80211_is_data(hdr->frame_control))
767 tx->sta->tx_stats.last_rate = txrc.reported_rate;
768 } else if (tx->sta)
769 tx->sta->tx_stats.last_rate = txrc.reported_rate;
770
771 if (ratetbl)
772 return TX_CONTINUE;
773
774 if (unlikely(!info->control.rates[0].count))
775 info->control.rates[0].count = 1;
776
777 if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
778 (info->flags & IEEE80211_TX_CTL_NO_ACK)))
779 info->control.rates[0].count = 1;
780
781 return TX_CONTINUE;
782 }
783
ieee80211_tx_next_seq(struct sta_info * sta,int tid)784 static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
785 {
786 u16 *seq = &sta->tid_seq[tid];
787 __le16 ret = cpu_to_le16(*seq);
788
789 /* Increase the sequence number. */
790 *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
791
792 return ret;
793 }
794
795 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_sequence(struct ieee80211_tx_data * tx)796 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
797 {
798 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
799 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
800 int tid;
801
802 /*
803 * Packet injection may want to control the sequence
804 * number, if we have no matching interface then we
805 * neither assign one ourselves nor ask the driver to.
806 */
807 if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
808 return TX_CONTINUE;
809
810 if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
811 return TX_CONTINUE;
812
813 if (ieee80211_hdrlen(hdr->frame_control) < 24)
814 return TX_CONTINUE;
815
816 if (ieee80211_is_qos_nullfunc(hdr->frame_control))
817 return TX_CONTINUE;
818
819 if (info->control.flags & IEEE80211_TX_CTRL_NO_SEQNO)
820 return TX_CONTINUE;
821
822 /*
823 * Anything but QoS data that has a sequence number field
824 * (is long enough) gets a sequence number from the global
825 * counter. QoS data frames with a multicast destination
826 * also use the global counter (802.11-2012 9.3.2.10).
827 */
828 if (!ieee80211_is_data_qos(hdr->frame_control) ||
829 is_multicast_ether_addr(hdr->addr1)) {
830 /* driver should assign sequence number */
831 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
832 /* for pure STA mode without beacons, we can do it */
833 hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
834 tx->sdata->sequence_number += 0x10;
835 if (tx->sta)
836 tx->sta->tx_stats.msdu[IEEE80211_NUM_TIDS]++;
837 return TX_CONTINUE;
838 }
839
840 /*
841 * This should be true for injected/management frames only, for
842 * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
843 * above since they are not QoS-data frames.
844 */
845 if (!tx->sta)
846 return TX_CONTINUE;
847
848 /* include per-STA, per-TID sequence counter */
849 tid = ieee80211_get_tid(hdr);
850 tx->sta->tx_stats.msdu[tid]++;
851
852 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
853
854 return TX_CONTINUE;
855 }
856
ieee80211_fragment(struct ieee80211_tx_data * tx,struct sk_buff * skb,int hdrlen,int frag_threshold)857 static int ieee80211_fragment(struct ieee80211_tx_data *tx,
858 struct sk_buff *skb, int hdrlen,
859 int frag_threshold)
860 {
861 struct ieee80211_local *local = tx->local;
862 struct ieee80211_tx_info *info;
863 struct sk_buff *tmp;
864 int per_fragm = frag_threshold - hdrlen - FCS_LEN;
865 int pos = hdrlen + per_fragm;
866 int rem = skb->len - hdrlen - per_fragm;
867
868 if (WARN_ON(rem < 0))
869 return -EINVAL;
870
871 /* first fragment was already added to queue by caller */
872
873 while (rem) {
874 int fraglen = per_fragm;
875
876 if (fraglen > rem)
877 fraglen = rem;
878 rem -= fraglen;
879 tmp = dev_alloc_skb(local->tx_headroom +
880 frag_threshold +
881 tx->sdata->encrypt_headroom +
882 IEEE80211_ENCRYPT_TAILROOM);
883 if (!tmp)
884 return -ENOMEM;
885
886 __skb_queue_tail(&tx->skbs, tmp);
887
888 skb_reserve(tmp,
889 local->tx_headroom + tx->sdata->encrypt_headroom);
890
891 /* copy control information */
892 memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
893
894 info = IEEE80211_SKB_CB(tmp);
895 info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
896 IEEE80211_TX_CTL_FIRST_FRAGMENT);
897
898 if (rem)
899 info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
900
901 skb_copy_queue_mapping(tmp, skb);
902 tmp->priority = skb->priority;
903 tmp->dev = skb->dev;
904
905 /* copy header and data */
906 skb_put_data(tmp, skb->data, hdrlen);
907 skb_put_data(tmp, skb->data + pos, fraglen);
908
909 pos += fraglen;
910 }
911
912 /* adjust first fragment's length */
913 skb_trim(skb, hdrlen + per_fragm);
914 return 0;
915 }
916
917 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_fragment(struct ieee80211_tx_data * tx)918 ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
919 {
920 struct sk_buff *skb = tx->skb;
921 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
922 struct ieee80211_hdr *hdr = (void *)skb->data;
923 int frag_threshold = tx->local->hw.wiphy->frag_threshold;
924 int hdrlen;
925 int fragnum;
926
927 /* no matter what happens, tx->skb moves to tx->skbs */
928 __skb_queue_tail(&tx->skbs, skb);
929 tx->skb = NULL;
930
931 if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
932 return TX_CONTINUE;
933
934 if (ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG))
935 return TX_CONTINUE;
936
937 /*
938 * Warn when submitting a fragmented A-MPDU frame and drop it.
939 * This scenario is handled in ieee80211_tx_prepare but extra
940 * caution taken here as fragmented ampdu may cause Tx stop.
941 */
942 if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
943 return TX_DROP;
944
945 hdrlen = ieee80211_hdrlen(hdr->frame_control);
946
947 /* internal error, why isn't DONTFRAG set? */
948 if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
949 return TX_DROP;
950
951 /*
952 * Now fragment the frame. This will allocate all the fragments and
953 * chain them (using skb as the first fragment) to skb->next.
954 * During transmission, we will remove the successfully transmitted
955 * fragments from this list. When the low-level driver rejects one
956 * of the fragments then we will simply pretend to accept the skb
957 * but store it away as pending.
958 */
959 if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
960 return TX_DROP;
961
962 /* update duration/seq/flags of fragments */
963 fragnum = 0;
964
965 skb_queue_walk(&tx->skbs, skb) {
966 const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
967
968 hdr = (void *)skb->data;
969 info = IEEE80211_SKB_CB(skb);
970
971 if (!skb_queue_is_last(&tx->skbs, skb)) {
972 hdr->frame_control |= morefrags;
973 /*
974 * No multi-rate retries for fragmented frames, that
975 * would completely throw off the NAV at other STAs.
976 */
977 info->control.rates[1].idx = -1;
978 info->control.rates[2].idx = -1;
979 info->control.rates[3].idx = -1;
980 BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
981 info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
982 } else {
983 hdr->frame_control &= ~morefrags;
984 }
985 hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
986 fragnum++;
987 }
988
989 return TX_CONTINUE;
990 }
991
992 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_stats(struct ieee80211_tx_data * tx)993 ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
994 {
995 struct sk_buff *skb;
996 int ac = -1;
997
998 if (!tx->sta)
999 return TX_CONTINUE;
1000
1001 skb_queue_walk(&tx->skbs, skb) {
1002 ac = skb_get_queue_mapping(skb);
1003 tx->sta->tx_stats.bytes[ac] += skb->len;
1004 }
1005 if (ac >= 0)
1006 tx->sta->tx_stats.packets[ac]++;
1007
1008 return TX_CONTINUE;
1009 }
1010
1011 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_encrypt(struct ieee80211_tx_data * tx)1012 ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
1013 {
1014 if (!tx->key)
1015 return TX_CONTINUE;
1016
1017 switch (tx->key->conf.cipher) {
1018 case WLAN_CIPHER_SUITE_WEP40:
1019 case WLAN_CIPHER_SUITE_WEP104:
1020 return ieee80211_crypto_wep_encrypt(tx);
1021 case WLAN_CIPHER_SUITE_TKIP:
1022 return ieee80211_crypto_tkip_encrypt(tx);
1023 case WLAN_CIPHER_SUITE_CCMP:
1024 return ieee80211_crypto_ccmp_encrypt(
1025 tx, IEEE80211_CCMP_MIC_LEN);
1026 case WLAN_CIPHER_SUITE_CCMP_256:
1027 return ieee80211_crypto_ccmp_encrypt(
1028 tx, IEEE80211_CCMP_256_MIC_LEN);
1029 case WLAN_CIPHER_SUITE_AES_CMAC:
1030 return ieee80211_crypto_aes_cmac_encrypt(tx);
1031 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1032 return ieee80211_crypto_aes_cmac_256_encrypt(tx);
1033 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1034 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1035 return ieee80211_crypto_aes_gmac_encrypt(tx);
1036 case WLAN_CIPHER_SUITE_GCMP:
1037 case WLAN_CIPHER_SUITE_GCMP_256:
1038 return ieee80211_crypto_gcmp_encrypt(tx);
1039 default:
1040 return ieee80211_crypto_hw_encrypt(tx);
1041 }
1042
1043 return TX_DROP;
1044 }
1045
1046 static ieee80211_tx_result debug_noinline
ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data * tx)1047 ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
1048 {
1049 struct sk_buff *skb;
1050 struct ieee80211_hdr *hdr;
1051 int next_len;
1052 bool group_addr;
1053
1054 skb_queue_walk(&tx->skbs, skb) {
1055 hdr = (void *) skb->data;
1056 if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
1057 break; /* must not overwrite AID */
1058 if (!skb_queue_is_last(&tx->skbs, skb)) {
1059 struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
1060 next_len = next->len;
1061 } else
1062 next_len = 0;
1063 group_addr = is_multicast_ether_addr(hdr->addr1);
1064
1065 hdr->duration_id =
1066 ieee80211_duration(tx, skb, group_addr, next_len);
1067 }
1068
1069 return TX_CONTINUE;
1070 }
1071
1072 /* actual transmit path */
1073
ieee80211_tx_prep_agg(struct ieee80211_tx_data * tx,struct sk_buff * skb,struct ieee80211_tx_info * info,struct tid_ampdu_tx * tid_tx,int tid)1074 static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
1075 struct sk_buff *skb,
1076 struct ieee80211_tx_info *info,
1077 struct tid_ampdu_tx *tid_tx,
1078 int tid)
1079 {
1080 bool queued = false;
1081 bool reset_agg_timer = false;
1082 struct sk_buff *purge_skb = NULL;
1083
1084 if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1085 info->flags |= IEEE80211_TX_CTL_AMPDU;
1086 reset_agg_timer = true;
1087 } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
1088 /*
1089 * nothing -- this aggregation session is being started
1090 * but that might still fail with the driver
1091 */
1092 } else if (!tx->sta->sta.txq[tid]) {
1093 spin_lock(&tx->sta->lock);
1094 /*
1095 * Need to re-check now, because we may get here
1096 *
1097 * 1) in the window during which the setup is actually
1098 * already done, but not marked yet because not all
1099 * packets are spliced over to the driver pending
1100 * queue yet -- if this happened we acquire the lock
1101 * either before or after the splice happens, but
1102 * need to recheck which of these cases happened.
1103 *
1104 * 2) during session teardown, if the OPERATIONAL bit
1105 * was cleared due to the teardown but the pointer
1106 * hasn't been assigned NULL yet (or we loaded it
1107 * before it was assigned) -- in this case it may
1108 * now be NULL which means we should just let the
1109 * packet pass through because splicing the frames
1110 * back is already done.
1111 */
1112 tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
1113
1114 if (!tid_tx) {
1115 /* do nothing, let packet pass through */
1116 } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1117 info->flags |= IEEE80211_TX_CTL_AMPDU;
1118 reset_agg_timer = true;
1119 } else {
1120 queued = true;
1121 if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER) {
1122 clear_sta_flag(tx->sta, WLAN_STA_SP);
1123 ps_dbg(tx->sta->sdata,
1124 "STA %pM aid %d: SP frame queued, close the SP w/o telling the peer\n",
1125 tx->sta->sta.addr, tx->sta->sta.aid);
1126 }
1127 info->control.vif = &tx->sdata->vif;
1128 info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
1129 info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
1130 __skb_queue_tail(&tid_tx->pending, skb);
1131 if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
1132 purge_skb = __skb_dequeue(&tid_tx->pending);
1133 }
1134 spin_unlock(&tx->sta->lock);
1135
1136 if (purge_skb)
1137 ieee80211_free_txskb(&tx->local->hw, purge_skb);
1138 }
1139
1140 /* reset session timer */
1141 if (reset_agg_timer)
1142 tid_tx->last_tx = jiffies;
1143
1144 return queued;
1145 }
1146
1147 /*
1148 * initialises @tx
1149 * pass %NULL for the station if unknown, a valid pointer if known
1150 * or an ERR_PTR() if the station is known not to exist
1151 */
1152 static ieee80211_tx_result
ieee80211_tx_prepare(struct ieee80211_sub_if_data * sdata,struct ieee80211_tx_data * tx,struct sta_info * sta,struct sk_buff * skb)1153 ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1154 struct ieee80211_tx_data *tx,
1155 struct sta_info *sta, struct sk_buff *skb)
1156 {
1157 struct ieee80211_local *local = sdata->local;
1158 struct ieee80211_hdr *hdr;
1159 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1160 int tid;
1161
1162 memset(tx, 0, sizeof(*tx));
1163 tx->skb = skb;
1164 tx->local = local;
1165 tx->sdata = sdata;
1166 __skb_queue_head_init(&tx->skbs);
1167
1168 /*
1169 * If this flag is set to true anywhere, and we get here,
1170 * we are doing the needed processing, so remove the flag
1171 * now.
1172 */
1173 info->control.flags &= ~IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
1174
1175 hdr = (struct ieee80211_hdr *) skb->data;
1176
1177 if (likely(sta)) {
1178 if (!IS_ERR(sta))
1179 tx->sta = sta;
1180 } else {
1181 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1182 tx->sta = rcu_dereference(sdata->u.vlan.sta);
1183 if (!tx->sta && sdata->wdev.use_4addr)
1184 return TX_DROP;
1185 } else if (tx->sdata->control_port_protocol == tx->skb->protocol) {
1186 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1187 }
1188 if (!tx->sta && !is_multicast_ether_addr(hdr->addr1))
1189 tx->sta = sta_info_get(sdata, hdr->addr1);
1190 }
1191
1192 if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
1193 !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
1194 ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
1195 !ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW)) {
1196 struct tid_ampdu_tx *tid_tx;
1197
1198 tid = ieee80211_get_tid(hdr);
1199
1200 tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1201 if (tid_tx) {
1202 bool queued;
1203
1204 queued = ieee80211_tx_prep_agg(tx, skb, info,
1205 tid_tx, tid);
1206
1207 if (unlikely(queued))
1208 return TX_QUEUED;
1209 }
1210 }
1211
1212 if (is_multicast_ether_addr(hdr->addr1)) {
1213 tx->flags &= ~IEEE80211_TX_UNICAST;
1214 info->flags |= IEEE80211_TX_CTL_NO_ACK;
1215 } else
1216 tx->flags |= IEEE80211_TX_UNICAST;
1217
1218 if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
1219 if (!(tx->flags & IEEE80211_TX_UNICAST) ||
1220 skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
1221 info->flags & IEEE80211_TX_CTL_AMPDU)
1222 info->flags |= IEEE80211_TX_CTL_DONTFRAG;
1223 }
1224
1225 if (!tx->sta)
1226 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1227 else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) {
1228 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1229 ieee80211_check_fast_xmit(tx->sta);
1230 }
1231
1232 info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
1233
1234 return TX_CONTINUE;
1235 }
1236
ieee80211_get_txq(struct ieee80211_local * local,struct ieee80211_vif * vif,struct sta_info * sta,struct sk_buff * skb)1237 static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
1238 struct ieee80211_vif *vif,
1239 struct sta_info *sta,
1240 struct sk_buff *skb)
1241 {
1242 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1243 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1244 struct ieee80211_txq *txq = NULL;
1245
1246 if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
1247 (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
1248 return NULL;
1249
1250 if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
1251 unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
1252 if ((!ieee80211_is_mgmt(hdr->frame_control) ||
1253 ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
1254 vif->type == NL80211_IFTYPE_STATION) &&
1255 sta && sta->uploaded) {
1256 /*
1257 * This will be NULL if the driver didn't set the
1258 * opt-in hardware flag.
1259 */
1260 txq = sta->sta.txq[IEEE80211_NUM_TIDS];
1261 }
1262 } else if (sta) {
1263 u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1264
1265 if (!sta->uploaded)
1266 return NULL;
1267
1268 txq = sta->sta.txq[tid];
1269 } else if (vif) {
1270 txq = vif->txq;
1271 }
1272
1273 if (!txq)
1274 return NULL;
1275
1276 return to_txq_info(txq);
1277 }
1278
ieee80211_set_skb_enqueue_time(struct sk_buff * skb)1279 static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
1280 {
1281 IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
1282 }
1283
codel_skb_len_func(const struct sk_buff * skb)1284 static u32 codel_skb_len_func(const struct sk_buff *skb)
1285 {
1286 return skb->len;
1287 }
1288
codel_skb_time_func(const struct sk_buff * skb)1289 static codel_time_t codel_skb_time_func(const struct sk_buff *skb)
1290 {
1291 const struct ieee80211_tx_info *info;
1292
1293 info = (const struct ieee80211_tx_info *)skb->cb;
1294 return info->control.enqueue_time;
1295 }
1296
codel_dequeue_func(struct codel_vars * cvars,void * ctx)1297 static struct sk_buff *codel_dequeue_func(struct codel_vars *cvars,
1298 void *ctx)
1299 {
1300 struct ieee80211_local *local;
1301 struct txq_info *txqi;
1302 struct fq *fq;
1303 struct fq_flow *flow;
1304
1305 txqi = ctx;
1306 local = vif_to_sdata(txqi->txq.vif)->local;
1307 fq = &local->fq;
1308
1309 if (cvars == &txqi->def_cvars)
1310 flow = &txqi->tin.default_flow;
1311 else
1312 flow = &fq->flows[cvars - local->cvars];
1313
1314 return fq_flow_dequeue(fq, flow);
1315 }
1316
codel_drop_func(struct sk_buff * skb,void * ctx)1317 static void codel_drop_func(struct sk_buff *skb,
1318 void *ctx)
1319 {
1320 struct ieee80211_local *local;
1321 struct ieee80211_hw *hw;
1322 struct txq_info *txqi;
1323
1324 txqi = ctx;
1325 local = vif_to_sdata(txqi->txq.vif)->local;
1326 hw = &local->hw;
1327
1328 ieee80211_free_txskb(hw, skb);
1329 }
1330
fq_tin_dequeue_func(struct fq * fq,struct fq_tin * tin,struct fq_flow * flow)1331 static struct sk_buff *fq_tin_dequeue_func(struct fq *fq,
1332 struct fq_tin *tin,
1333 struct fq_flow *flow)
1334 {
1335 struct ieee80211_local *local;
1336 struct txq_info *txqi;
1337 struct codel_vars *cvars;
1338 struct codel_params *cparams;
1339 struct codel_stats *cstats;
1340
1341 local = container_of(fq, struct ieee80211_local, fq);
1342 txqi = container_of(tin, struct txq_info, tin);
1343 cstats = &txqi->cstats;
1344
1345 if (txqi->txq.sta) {
1346 struct sta_info *sta = container_of(txqi->txq.sta,
1347 struct sta_info, sta);
1348 cparams = &sta->cparams;
1349 } else {
1350 cparams = &local->cparams;
1351 }
1352
1353 if (flow == &tin->default_flow)
1354 cvars = &txqi->def_cvars;
1355 else
1356 cvars = &local->cvars[flow - fq->flows];
1357
1358 return codel_dequeue(txqi,
1359 &flow->backlog,
1360 cparams,
1361 cvars,
1362 cstats,
1363 codel_skb_len_func,
1364 codel_skb_time_func,
1365 codel_drop_func,
1366 codel_dequeue_func);
1367 }
1368
fq_skb_free_func(struct fq * fq,struct fq_tin * tin,struct fq_flow * flow,struct sk_buff * skb)1369 static void fq_skb_free_func(struct fq *fq,
1370 struct fq_tin *tin,
1371 struct fq_flow *flow,
1372 struct sk_buff *skb)
1373 {
1374 struct ieee80211_local *local;
1375
1376 local = container_of(fq, struct ieee80211_local, fq);
1377 ieee80211_free_txskb(&local->hw, skb);
1378 }
1379
ieee80211_txq_enqueue(struct ieee80211_local * local,struct txq_info * txqi,struct sk_buff * skb)1380 static void ieee80211_txq_enqueue(struct ieee80211_local *local,
1381 struct txq_info *txqi,
1382 struct sk_buff *skb)
1383 {
1384 struct fq *fq = &local->fq;
1385 struct fq_tin *tin = &txqi->tin;
1386 u32 flow_idx = fq_flow_idx(fq, skb);
1387
1388 ieee80211_set_skb_enqueue_time(skb);
1389
1390 spin_lock_bh(&fq->lock);
1391 /*
1392 * For management frames, don't really apply codel etc.,
1393 * we don't want to apply any shaping or anything we just
1394 * want to simplify the driver API by having them on the
1395 * txqi.
1396 */
1397 if (unlikely(txqi->txq.tid == IEEE80211_NUM_TIDS)) {
1398 IEEE80211_SKB_CB(skb)->control.flags |=
1399 IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
1400 __skb_queue_tail(&txqi->frags, skb);
1401 } else {
1402 fq_tin_enqueue(fq, tin, flow_idx, skb,
1403 fq_skb_free_func);
1404 }
1405 spin_unlock_bh(&fq->lock);
1406 }
1407
fq_vlan_filter_func(struct fq * fq,struct fq_tin * tin,struct fq_flow * flow,struct sk_buff * skb,void * data)1408 static bool fq_vlan_filter_func(struct fq *fq, struct fq_tin *tin,
1409 struct fq_flow *flow, struct sk_buff *skb,
1410 void *data)
1411 {
1412 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1413
1414 return info->control.vif == data;
1415 }
1416
ieee80211_txq_remove_vlan(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)1417 void ieee80211_txq_remove_vlan(struct ieee80211_local *local,
1418 struct ieee80211_sub_if_data *sdata)
1419 {
1420 struct fq *fq = &local->fq;
1421 struct txq_info *txqi;
1422 struct fq_tin *tin;
1423 struct ieee80211_sub_if_data *ap;
1424
1425 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1426 return;
1427
1428 ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
1429
1430 if (!ap->vif.txq)
1431 return;
1432
1433 txqi = to_txq_info(ap->vif.txq);
1434 tin = &txqi->tin;
1435
1436 spin_lock_bh(&fq->lock);
1437 fq_tin_filter(fq, tin, fq_vlan_filter_func, &sdata->vif,
1438 fq_skb_free_func);
1439 spin_unlock_bh(&fq->lock);
1440 }
1441
ieee80211_txq_init(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct txq_info * txqi,int tid)1442 void ieee80211_txq_init(struct ieee80211_sub_if_data *sdata,
1443 struct sta_info *sta,
1444 struct txq_info *txqi, int tid)
1445 {
1446 fq_tin_init(&txqi->tin);
1447 codel_vars_init(&txqi->def_cvars);
1448 codel_stats_init(&txqi->cstats);
1449 __skb_queue_head_init(&txqi->frags);
1450 INIT_LIST_HEAD(&txqi->schedule_order);
1451
1452 txqi->txq.vif = &sdata->vif;
1453
1454 if (!sta) {
1455 sdata->vif.txq = &txqi->txq;
1456 txqi->txq.tid = 0;
1457 txqi->txq.ac = IEEE80211_AC_BE;
1458
1459 return;
1460 }
1461
1462 if (tid == IEEE80211_NUM_TIDS) {
1463 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1464 /* Drivers need to opt in to the management MPDU TXQ */
1465 if (!ieee80211_hw_check(&sdata->local->hw,
1466 STA_MMPDU_TXQ))
1467 return;
1468 } else if (!ieee80211_hw_check(&sdata->local->hw,
1469 BUFF_MMPDU_TXQ)) {
1470 /* Drivers need to opt in to the bufferable MMPDU TXQ */
1471 return;
1472 }
1473 txqi->txq.ac = IEEE80211_AC_VO;
1474 } else {
1475 txqi->txq.ac = ieee80211_ac_from_tid(tid);
1476 }
1477
1478 txqi->txq.sta = &sta->sta;
1479 txqi->txq.tid = tid;
1480 sta->sta.txq[tid] = &txqi->txq;
1481 }
1482
ieee80211_txq_purge(struct ieee80211_local * local,struct txq_info * txqi)1483 void ieee80211_txq_purge(struct ieee80211_local *local,
1484 struct txq_info *txqi)
1485 {
1486 struct fq *fq = &local->fq;
1487 struct fq_tin *tin = &txqi->tin;
1488
1489 spin_lock_bh(&fq->lock);
1490 fq_tin_reset(fq, tin, fq_skb_free_func);
1491 ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
1492 spin_unlock_bh(&fq->lock);
1493
1494 spin_lock_bh(&local->active_txq_lock[txqi->txq.ac]);
1495 list_del_init(&txqi->schedule_order);
1496 spin_unlock_bh(&local->active_txq_lock[txqi->txq.ac]);
1497 }
1498
ieee80211_txq_set_params(struct ieee80211_local * local)1499 void ieee80211_txq_set_params(struct ieee80211_local *local)
1500 {
1501 if (local->hw.wiphy->txq_limit)
1502 local->fq.limit = local->hw.wiphy->txq_limit;
1503 else
1504 local->hw.wiphy->txq_limit = local->fq.limit;
1505
1506 if (local->hw.wiphy->txq_memory_limit)
1507 local->fq.memory_limit = local->hw.wiphy->txq_memory_limit;
1508 else
1509 local->hw.wiphy->txq_memory_limit = local->fq.memory_limit;
1510
1511 if (local->hw.wiphy->txq_quantum)
1512 local->fq.quantum = local->hw.wiphy->txq_quantum;
1513 else
1514 local->hw.wiphy->txq_quantum = local->fq.quantum;
1515 }
1516
ieee80211_txq_setup_flows(struct ieee80211_local * local)1517 int ieee80211_txq_setup_flows(struct ieee80211_local *local)
1518 {
1519 struct fq *fq = &local->fq;
1520 int ret;
1521 int i;
1522 bool supp_vht = false;
1523 enum nl80211_band band;
1524
1525 if (!local->ops->wake_tx_queue)
1526 return 0;
1527
1528 ret = fq_init(fq, 4096);
1529 if (ret)
1530 return ret;
1531
1532 /*
1533 * If the hardware doesn't support VHT, it is safe to limit the maximum
1534 * queue size. 4 Mbytes is 64 max-size aggregates in 802.11n.
1535 */
1536 for (band = 0; band < NUM_NL80211_BANDS; band++) {
1537 struct ieee80211_supported_band *sband;
1538
1539 sband = local->hw.wiphy->bands[band];
1540 if (!sband)
1541 continue;
1542
1543 supp_vht = supp_vht || sband->vht_cap.vht_supported;
1544 }
1545
1546 if (!supp_vht)
1547 fq->memory_limit = 4 << 20; /* 4 Mbytes */
1548
1549 codel_params_init(&local->cparams);
1550 local->cparams.interval = MS2TIME(100);
1551 local->cparams.target = MS2TIME(20);
1552 local->cparams.ecn = true;
1553
1554 local->cvars = kcalloc(fq->flows_cnt, sizeof(local->cvars[0]),
1555 GFP_KERNEL);
1556 if (!local->cvars) {
1557 spin_lock_bh(&fq->lock);
1558 fq_reset(fq, fq_skb_free_func);
1559 spin_unlock_bh(&fq->lock);
1560 return -ENOMEM;
1561 }
1562
1563 for (i = 0; i < fq->flows_cnt; i++)
1564 codel_vars_init(&local->cvars[i]);
1565
1566 ieee80211_txq_set_params(local);
1567
1568 return 0;
1569 }
1570
ieee80211_txq_teardown_flows(struct ieee80211_local * local)1571 void ieee80211_txq_teardown_flows(struct ieee80211_local *local)
1572 {
1573 struct fq *fq = &local->fq;
1574
1575 if (!local->ops->wake_tx_queue)
1576 return;
1577
1578 kfree(local->cvars);
1579 local->cvars = NULL;
1580
1581 spin_lock_bh(&fq->lock);
1582 fq_reset(fq, fq_skb_free_func);
1583 spin_unlock_bh(&fq->lock);
1584 }
1585
ieee80211_queue_skb(struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct sk_buff * skb)1586 static bool ieee80211_queue_skb(struct ieee80211_local *local,
1587 struct ieee80211_sub_if_data *sdata,
1588 struct sta_info *sta,
1589 struct sk_buff *skb)
1590 {
1591 struct ieee80211_vif *vif;
1592 struct txq_info *txqi;
1593
1594 if (!local->ops->wake_tx_queue ||
1595 sdata->vif.type == NL80211_IFTYPE_MONITOR)
1596 return false;
1597
1598 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1599 sdata = container_of(sdata->bss,
1600 struct ieee80211_sub_if_data, u.ap);
1601
1602 vif = &sdata->vif;
1603 txqi = ieee80211_get_txq(local, vif, sta, skb);
1604
1605 if (!txqi)
1606 return false;
1607
1608 ieee80211_txq_enqueue(local, txqi, skb);
1609
1610 schedule_and_wake_txq(local, txqi);
1611
1612 return true;
1613 }
1614
ieee80211_tx_frags(struct ieee80211_local * local,struct ieee80211_vif * vif,struct sta_info * sta,struct sk_buff_head * skbs,bool txpending)1615 static bool ieee80211_tx_frags(struct ieee80211_local *local,
1616 struct ieee80211_vif *vif,
1617 struct sta_info *sta,
1618 struct sk_buff_head *skbs,
1619 bool txpending)
1620 {
1621 struct ieee80211_tx_control control = {};
1622 struct sk_buff *skb, *tmp;
1623 unsigned long flags;
1624
1625 skb_queue_walk_safe(skbs, skb, tmp) {
1626 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1627 int q = info->hw_queue;
1628
1629 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1630 if (WARN_ON_ONCE(q >= local->hw.queues)) {
1631 __skb_unlink(skb, skbs);
1632 ieee80211_free_txskb(&local->hw, skb);
1633 continue;
1634 }
1635 #endif
1636
1637 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1638 if (local->queue_stop_reasons[q] ||
1639 (!txpending && !skb_queue_empty(&local->pending[q]))) {
1640 if (unlikely(info->flags &
1641 IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
1642 if (local->queue_stop_reasons[q] &
1643 ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
1644 /*
1645 * Drop off-channel frames if queues
1646 * are stopped for any reason other
1647 * than off-channel operation. Never
1648 * queue them.
1649 */
1650 spin_unlock_irqrestore(
1651 &local->queue_stop_reason_lock,
1652 flags);
1653 ieee80211_purge_tx_queue(&local->hw,
1654 skbs);
1655 return true;
1656 }
1657 } else {
1658
1659 /*
1660 * Since queue is stopped, queue up frames for
1661 * later transmission from the tx-pending
1662 * tasklet when the queue is woken again.
1663 */
1664 if (txpending)
1665 skb_queue_splice_init(skbs,
1666 &local->pending[q]);
1667 else
1668 skb_queue_splice_tail_init(skbs,
1669 &local->pending[q]);
1670
1671 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1672 flags);
1673 return false;
1674 }
1675 }
1676 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1677
1678 info->control.vif = vif;
1679 control.sta = sta ? &sta->sta : NULL;
1680
1681 __skb_unlink(skb, skbs);
1682 drv_tx(local, &control, skb);
1683 }
1684
1685 return true;
1686 }
1687
1688 /*
1689 * Returns false if the frame couldn't be transmitted but was queued instead.
1690 */
__ieee80211_tx(struct ieee80211_local * local,struct sk_buff_head * skbs,int led_len,struct sta_info * sta,bool txpending)1691 static bool __ieee80211_tx(struct ieee80211_local *local,
1692 struct sk_buff_head *skbs, int led_len,
1693 struct sta_info *sta, bool txpending)
1694 {
1695 struct ieee80211_tx_info *info;
1696 struct ieee80211_sub_if_data *sdata;
1697 struct ieee80211_vif *vif;
1698 struct sk_buff *skb;
1699 bool result;
1700 __le16 fc;
1701
1702 if (WARN_ON(skb_queue_empty(skbs)))
1703 return true;
1704
1705 skb = skb_peek(skbs);
1706 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
1707 info = IEEE80211_SKB_CB(skb);
1708 sdata = vif_to_sdata(info->control.vif);
1709 if (sta && !sta->uploaded)
1710 sta = NULL;
1711
1712 switch (sdata->vif.type) {
1713 case NL80211_IFTYPE_MONITOR:
1714 if (sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
1715 vif = &sdata->vif;
1716 break;
1717 }
1718 sdata = rcu_dereference(local->monitor_sdata);
1719 if (sdata) {
1720 vif = &sdata->vif;
1721 info->hw_queue =
1722 vif->hw_queue[skb_get_queue_mapping(skb)];
1723 } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
1724 ieee80211_purge_tx_queue(&local->hw, skbs);
1725 return true;
1726 } else
1727 vif = NULL;
1728 break;
1729 case NL80211_IFTYPE_AP_VLAN:
1730 sdata = container_of(sdata->bss,
1731 struct ieee80211_sub_if_data, u.ap);
1732 fallthrough;
1733 default:
1734 vif = &sdata->vif;
1735 break;
1736 }
1737
1738 result = ieee80211_tx_frags(local, vif, sta, skbs, txpending);
1739
1740 ieee80211_tpt_led_trig_tx(local, fc, led_len);
1741
1742 WARN_ON_ONCE(!skb_queue_empty(skbs));
1743
1744 return result;
1745 }
1746
1747 /*
1748 * Invoke TX handlers, return 0 on success and non-zero if the
1749 * frame was dropped or queued.
1750 *
1751 * The handlers are split into an early and late part. The latter is everything
1752 * that can be sensitive to reordering, and will be deferred to after packets
1753 * are dequeued from the intermediate queues (when they are enabled).
1754 */
invoke_tx_handlers_early(struct ieee80211_tx_data * tx)1755 static int invoke_tx_handlers_early(struct ieee80211_tx_data *tx)
1756 {
1757 ieee80211_tx_result res = TX_DROP;
1758
1759 #define CALL_TXH(txh) \
1760 do { \
1761 res = txh(tx); \
1762 if (res != TX_CONTINUE) \
1763 goto txh_done; \
1764 } while (0)
1765
1766 CALL_TXH(ieee80211_tx_h_dynamic_ps);
1767 CALL_TXH(ieee80211_tx_h_check_assoc);
1768 CALL_TXH(ieee80211_tx_h_ps_buf);
1769 CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
1770 CALL_TXH(ieee80211_tx_h_select_key);
1771 if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
1772 CALL_TXH(ieee80211_tx_h_rate_ctrl);
1773
1774 txh_done:
1775 if (unlikely(res == TX_DROP)) {
1776 I802_DEBUG_INC(tx->local->tx_handlers_drop);
1777 if (tx->skb)
1778 ieee80211_free_txskb(&tx->local->hw, tx->skb);
1779 else
1780 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1781 return -1;
1782 } else if (unlikely(res == TX_QUEUED)) {
1783 I802_DEBUG_INC(tx->local->tx_handlers_queued);
1784 return -1;
1785 }
1786
1787 return 0;
1788 }
1789
1790 /*
1791 * Late handlers can be called while the sta lock is held. Handlers that can
1792 * cause packets to be generated will cause deadlock!
1793 */
invoke_tx_handlers_late(struct ieee80211_tx_data * tx)1794 static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
1795 {
1796 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
1797 ieee80211_tx_result res = TX_CONTINUE;
1798
1799 if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
1800 __skb_queue_tail(&tx->skbs, tx->skb);
1801 tx->skb = NULL;
1802 goto txh_done;
1803 }
1804
1805 CALL_TXH(ieee80211_tx_h_michael_mic_add);
1806 CALL_TXH(ieee80211_tx_h_sequence);
1807 CALL_TXH(ieee80211_tx_h_fragment);
1808 /* handlers after fragment must be aware of tx info fragmentation! */
1809 CALL_TXH(ieee80211_tx_h_stats);
1810 CALL_TXH(ieee80211_tx_h_encrypt);
1811 if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
1812 CALL_TXH(ieee80211_tx_h_calculate_duration);
1813 #undef CALL_TXH
1814
1815 txh_done:
1816 if (unlikely(res == TX_DROP)) {
1817 I802_DEBUG_INC(tx->local->tx_handlers_drop);
1818 if (tx->skb)
1819 ieee80211_free_txskb(&tx->local->hw, tx->skb);
1820 else
1821 ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1822 return -1;
1823 } else if (unlikely(res == TX_QUEUED)) {
1824 I802_DEBUG_INC(tx->local->tx_handlers_queued);
1825 return -1;
1826 }
1827
1828 return 0;
1829 }
1830
invoke_tx_handlers(struct ieee80211_tx_data * tx)1831 static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1832 {
1833 int r = invoke_tx_handlers_early(tx);
1834
1835 if (r)
1836 return r;
1837 return invoke_tx_handlers_late(tx);
1838 }
1839
ieee80211_tx_prepare_skb(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct sk_buff * skb,int band,struct ieee80211_sta ** sta)1840 bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
1841 struct ieee80211_vif *vif, struct sk_buff *skb,
1842 int band, struct ieee80211_sta **sta)
1843 {
1844 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1845 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1846 struct ieee80211_tx_data tx;
1847 struct sk_buff *skb2;
1848
1849 if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
1850 return false;
1851
1852 info->band = band;
1853 info->control.vif = vif;
1854 info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];
1855
1856 if (invoke_tx_handlers(&tx))
1857 return false;
1858
1859 if (sta) {
1860 if (tx.sta)
1861 *sta = &tx.sta->sta;
1862 else
1863 *sta = NULL;
1864 }
1865
1866 /* this function isn't suitable for fragmented data frames */
1867 skb2 = __skb_dequeue(&tx.skbs);
1868 if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
1869 ieee80211_free_txskb(hw, skb2);
1870 ieee80211_purge_tx_queue(hw, &tx.skbs);
1871 return false;
1872 }
1873
1874 return true;
1875 }
1876 EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
1877
1878 /*
1879 * Returns false if the frame couldn't be transmitted but was queued instead.
1880 */
ieee80211_tx(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct sk_buff * skb,bool txpending)1881 static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
1882 struct sta_info *sta, struct sk_buff *skb,
1883 bool txpending)
1884 {
1885 struct ieee80211_local *local = sdata->local;
1886 struct ieee80211_tx_data tx;
1887 ieee80211_tx_result res_prepare;
1888 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1889 bool result = true;
1890 int led_len;
1891
1892 if (unlikely(skb->len < 10)) {
1893 dev_kfree_skb(skb);
1894 return true;
1895 }
1896
1897 /* initialises tx */
1898 led_len = skb->len;
1899 res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
1900
1901 if (unlikely(res_prepare == TX_DROP)) {
1902 ieee80211_free_txskb(&local->hw, skb);
1903 return true;
1904 } else if (unlikely(res_prepare == TX_QUEUED)) {
1905 return true;
1906 }
1907
1908 /* set up hw_queue value early */
1909 if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
1910 !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
1911 info->hw_queue =
1912 sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
1913
1914 if (invoke_tx_handlers_early(&tx))
1915 return true;
1916
1917 if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb))
1918 return true;
1919
1920 if (!invoke_tx_handlers_late(&tx))
1921 result = __ieee80211_tx(local, &tx.skbs, led_len,
1922 tx.sta, txpending);
1923
1924 return result;
1925 }
1926
1927 /* device xmit handlers */
1928
1929 enum ieee80211_encrypt {
1930 ENCRYPT_NO,
1931 ENCRYPT_MGMT,
1932 ENCRYPT_DATA,
1933 };
1934
ieee80211_skb_resize(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int head_need,enum ieee80211_encrypt encrypt)1935 static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
1936 struct sk_buff *skb,
1937 int head_need,
1938 enum ieee80211_encrypt encrypt)
1939 {
1940 struct ieee80211_local *local = sdata->local;
1941 bool enc_tailroom;
1942 int tail_need = 0;
1943
1944 enc_tailroom = encrypt == ENCRYPT_MGMT ||
1945 (encrypt == ENCRYPT_DATA &&
1946 sdata->crypto_tx_tailroom_needed_cnt);
1947
1948 if (enc_tailroom) {
1949 tail_need = IEEE80211_ENCRYPT_TAILROOM;
1950 tail_need -= skb_tailroom(skb);
1951 tail_need = max_t(int, tail_need, 0);
1952 }
1953
1954 if (skb_cloned(skb) &&
1955 (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
1956 !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
1957 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1958 else if (head_need || tail_need)
1959 I802_DEBUG_INC(local->tx_expand_skb_head);
1960 else
1961 return 0;
1962
1963 if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
1964 wiphy_debug(local->hw.wiphy,
1965 "failed to reallocate TX buffer\n");
1966 return -ENOMEM;
1967 }
1968
1969 return 0;
1970 }
1971
ieee80211_xmit(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct sk_buff * skb)1972 void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1973 struct sta_info *sta, struct sk_buff *skb)
1974 {
1975 struct ieee80211_local *local = sdata->local;
1976 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1977 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1978 int headroom;
1979 enum ieee80211_encrypt encrypt;
1980
1981 if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)
1982 encrypt = ENCRYPT_NO;
1983 else if (ieee80211_is_mgmt(hdr->frame_control))
1984 encrypt = ENCRYPT_MGMT;
1985 else
1986 encrypt = ENCRYPT_DATA;
1987
1988 headroom = local->tx_headroom;
1989 if (encrypt != ENCRYPT_NO)
1990 headroom += sdata->encrypt_headroom;
1991 headroom -= skb_headroom(skb);
1992 headroom = max_t(int, 0, headroom);
1993
1994 if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {
1995 ieee80211_free_txskb(&local->hw, skb);
1996 return;
1997 }
1998
1999 /* reload after potential resize */
2000 hdr = (struct ieee80211_hdr *) skb->data;
2001 info->control.vif = &sdata->vif;
2002
2003 if (ieee80211_vif_is_mesh(&sdata->vif)) {
2004 if (ieee80211_is_data(hdr->frame_control) &&
2005 is_unicast_ether_addr(hdr->addr1)) {
2006 if (mesh_nexthop_resolve(sdata, skb))
2007 return; /* skb queued: don't free */
2008 } else {
2009 ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
2010 }
2011 }
2012
2013 ieee80211_set_qos_hdr(sdata, skb);
2014 ieee80211_tx(sdata, sta, skb, false);
2015 }
2016
ieee80211_parse_tx_radiotap(struct sk_buff * skb,struct net_device * dev)2017 bool ieee80211_parse_tx_radiotap(struct sk_buff *skb,
2018 struct net_device *dev)
2019 {
2020 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2021 struct ieee80211_radiotap_iterator iterator;
2022 struct ieee80211_radiotap_header *rthdr =
2023 (struct ieee80211_radiotap_header *) skb->data;
2024 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2025 struct ieee80211_supported_band *sband =
2026 local->hw.wiphy->bands[info->band];
2027 int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
2028 NULL);
2029 u16 txflags;
2030 u16 rate = 0;
2031 bool rate_found = false;
2032 u8 rate_retries = 0;
2033 u16 rate_flags = 0;
2034 u8 mcs_known, mcs_flags, mcs_bw;
2035 u16 vht_known;
2036 u8 vht_mcs = 0, vht_nss = 0;
2037 int i;
2038
2039 /* check for not even having the fixed radiotap header part */
2040 if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
2041 return false; /* too short to be possibly valid */
2042
2043 /* is it a header version we can trust to find length from? */
2044 if (unlikely(rthdr->it_version))
2045 return false; /* only version 0 is supported */
2046
2047 /* does the skb contain enough to deliver on the alleged length? */
2048 if (unlikely(skb->len < ieee80211_get_radiotap_len(skb->data)))
2049 return false; /* skb too short for claimed rt header extent */
2050
2051 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
2052 IEEE80211_TX_CTL_DONTFRAG;
2053
2054 /*
2055 * for every radiotap entry that is present
2056 * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
2057 * entries present, or -EINVAL on error)
2058 */
2059
2060 while (!ret) {
2061 ret = ieee80211_radiotap_iterator_next(&iterator);
2062
2063 if (ret)
2064 continue;
2065
2066 /* see if this argument is something we can use */
2067 switch (iterator.this_arg_index) {
2068 /*
2069 * You must take care when dereferencing iterator.this_arg
2070 * for multibyte types... the pointer is not aligned. Use
2071 * get_unaligned((type *)iterator.this_arg) to dereference
2072 * iterator.this_arg for type "type" safely on all arches.
2073 */
2074 case IEEE80211_RADIOTAP_FLAGS:
2075 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
2076 /*
2077 * this indicates that the skb we have been
2078 * handed has the 32-bit FCS CRC at the end...
2079 * we should react to that by snipping it off
2080 * because it will be recomputed and added
2081 * on transmission
2082 */
2083 if (skb->len < (iterator._max_length + FCS_LEN))
2084 return false;
2085
2086 skb_trim(skb, skb->len - FCS_LEN);
2087 }
2088 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
2089 info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
2090 if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
2091 info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
2092 break;
2093
2094 case IEEE80211_RADIOTAP_TX_FLAGS:
2095 txflags = get_unaligned_le16(iterator.this_arg);
2096 if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
2097 info->flags |= IEEE80211_TX_CTL_NO_ACK;
2098 if (txflags & IEEE80211_RADIOTAP_F_TX_NOSEQNO)
2099 info->control.flags |= IEEE80211_TX_CTRL_NO_SEQNO;
2100 if (txflags & IEEE80211_RADIOTAP_F_TX_ORDER)
2101 info->control.flags |=
2102 IEEE80211_TX_CTRL_DONT_REORDER;
2103 break;
2104
2105 case IEEE80211_RADIOTAP_RATE:
2106 rate = *iterator.this_arg;
2107 rate_flags = 0;
2108 rate_found = true;
2109 break;
2110
2111 case IEEE80211_RADIOTAP_DATA_RETRIES:
2112 rate_retries = *iterator.this_arg;
2113 break;
2114
2115 case IEEE80211_RADIOTAP_MCS:
2116 mcs_known = iterator.this_arg[0];
2117 mcs_flags = iterator.this_arg[1];
2118 if (!(mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_MCS))
2119 break;
2120
2121 rate_found = true;
2122 rate = iterator.this_arg[2];
2123 rate_flags = IEEE80211_TX_RC_MCS;
2124
2125 if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_GI &&
2126 mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
2127 rate_flags |= IEEE80211_TX_RC_SHORT_GI;
2128
2129 mcs_bw = mcs_flags & IEEE80211_RADIOTAP_MCS_BW_MASK;
2130 if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
2131 mcs_bw == IEEE80211_RADIOTAP_MCS_BW_40)
2132 rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
2133
2134 if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_FEC &&
2135 mcs_flags & IEEE80211_RADIOTAP_MCS_FEC_LDPC)
2136 info->flags |= IEEE80211_TX_CTL_LDPC;
2137
2138 if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_STBC) {
2139 u8 stbc = u8_get_bits(mcs_flags,
2140 IEEE80211_RADIOTAP_MCS_STBC_MASK);
2141
2142 info->flags |=
2143 u32_encode_bits(stbc,
2144 IEEE80211_TX_CTL_STBC);
2145 }
2146 break;
2147
2148 case IEEE80211_RADIOTAP_VHT:
2149 vht_known = get_unaligned_le16(iterator.this_arg);
2150 rate_found = true;
2151
2152 rate_flags = IEEE80211_TX_RC_VHT_MCS;
2153 if ((vht_known & IEEE80211_RADIOTAP_VHT_KNOWN_GI) &&
2154 (iterator.this_arg[2] &
2155 IEEE80211_RADIOTAP_VHT_FLAG_SGI))
2156 rate_flags |= IEEE80211_TX_RC_SHORT_GI;
2157 if (vht_known &
2158 IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH) {
2159 if (iterator.this_arg[3] == 1)
2160 rate_flags |=
2161 IEEE80211_TX_RC_40_MHZ_WIDTH;
2162 else if (iterator.this_arg[3] == 4)
2163 rate_flags |=
2164 IEEE80211_TX_RC_80_MHZ_WIDTH;
2165 else if (iterator.this_arg[3] == 11)
2166 rate_flags |=
2167 IEEE80211_TX_RC_160_MHZ_WIDTH;
2168 }
2169
2170 vht_mcs = iterator.this_arg[4] >> 4;
2171 vht_nss = iterator.this_arg[4] & 0xF;
2172 break;
2173
2174 /*
2175 * Please update the file
2176 * Documentation/networking/mac80211-injection.rst
2177 * when parsing new fields here.
2178 */
2179
2180 default:
2181 break;
2182 }
2183 }
2184
2185 if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
2186 return false;
2187
2188 if (rate_found) {
2189 info->control.flags |= IEEE80211_TX_CTRL_RATE_INJECT;
2190
2191 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
2192 info->control.rates[i].idx = -1;
2193 info->control.rates[i].flags = 0;
2194 info->control.rates[i].count = 0;
2195 }
2196
2197 if (rate_flags & IEEE80211_TX_RC_MCS) {
2198 info->control.rates[0].idx = rate;
2199 } else if (rate_flags & IEEE80211_TX_RC_VHT_MCS) {
2200 ieee80211_rate_set_vht(info->control.rates, vht_mcs,
2201 vht_nss);
2202 } else {
2203 for (i = 0; i < sband->n_bitrates; i++) {
2204 if (rate * 5 != sband->bitrates[i].bitrate)
2205 continue;
2206
2207 info->control.rates[0].idx = i;
2208 break;
2209 }
2210 }
2211
2212 if (info->control.rates[0].idx < 0)
2213 info->control.flags &= ~IEEE80211_TX_CTRL_RATE_INJECT;
2214
2215 info->control.rates[0].flags = rate_flags;
2216 info->control.rates[0].count = min_t(u8, rate_retries + 1,
2217 local->hw.max_rate_tries);
2218 }
2219
2220 return true;
2221 }
2222
ieee80211_monitor_start_xmit(struct sk_buff * skb,struct net_device * dev)2223 netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
2224 struct net_device *dev)
2225 {
2226 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2227 struct ieee80211_chanctx_conf *chanctx_conf;
2228 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2229 struct ieee80211_hdr *hdr;
2230 struct ieee80211_sub_if_data *tmp_sdata, *sdata;
2231 struct cfg80211_chan_def *chandef;
2232 u16 len_rthdr;
2233 int hdrlen;
2234
2235 memset(info, 0, sizeof(*info));
2236 info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2237 IEEE80211_TX_CTL_INJECTED;
2238
2239 /* Sanity-check and process the injection radiotap header */
2240 if (!ieee80211_parse_tx_radiotap(skb, dev))
2241 goto fail;
2242
2243 /* we now know there is a radiotap header with a length we can use */
2244 len_rthdr = ieee80211_get_radiotap_len(skb->data);
2245
2246 /*
2247 * fix up the pointers accounting for the radiotap
2248 * header still being in there. We are being given
2249 * a precooked IEEE80211 header so no need for
2250 * normal processing
2251 */
2252 skb_set_mac_header(skb, len_rthdr);
2253 /*
2254 * these are just fixed to the end of the rt area since we
2255 * don't have any better information and at this point, nobody cares
2256 */
2257 skb_set_network_header(skb, len_rthdr);
2258 skb_set_transport_header(skb, len_rthdr);
2259
2260 if (skb->len < len_rthdr + 2)
2261 goto fail;
2262
2263 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
2264 hdrlen = ieee80211_hdrlen(hdr->frame_control);
2265
2266 if (skb->len < len_rthdr + hdrlen)
2267 goto fail;
2268
2269 /*
2270 * Initialize skb->protocol if the injected frame is a data frame
2271 * carrying a rfc1042 header
2272 */
2273 if (ieee80211_is_data(hdr->frame_control) &&
2274 skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
2275 u8 *payload = (u8 *)hdr + hdrlen;
2276
2277 if (ether_addr_equal(payload, rfc1042_header))
2278 skb->protocol = cpu_to_be16((payload[6] << 8) |
2279 payload[7]);
2280 }
2281
2282 rcu_read_lock();
2283
2284 /*
2285 * We process outgoing injected frames that have a local address
2286 * we handle as though they are non-injected frames.
2287 * This code here isn't entirely correct, the local MAC address
2288 * isn't always enough to find the interface to use; for proper
2289 * VLAN support we have an nl80211-based mechanism.
2290 *
2291 * This is necessary, for example, for old hostapd versions that
2292 * don't use nl80211-based management TX/RX.
2293 */
2294 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2295
2296 list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
2297 if (!ieee80211_sdata_running(tmp_sdata))
2298 continue;
2299 if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2300 tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2301 continue;
2302 if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
2303 sdata = tmp_sdata;
2304 break;
2305 }
2306 }
2307
2308 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2309 if (!chanctx_conf) {
2310 tmp_sdata = rcu_dereference(local->monitor_sdata);
2311 if (tmp_sdata)
2312 chanctx_conf =
2313 rcu_dereference(tmp_sdata->vif.chanctx_conf);
2314 }
2315
2316 if (chanctx_conf)
2317 chandef = &chanctx_conf->def;
2318 else if (!local->use_chanctx)
2319 chandef = &local->_oper_chandef;
2320 else
2321 goto fail_rcu;
2322
2323 /*
2324 * Frame injection is not allowed if beaconing is not allowed
2325 * or if we need radar detection. Beaconing is usually not allowed when
2326 * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
2327 * Passive scan is also used in world regulatory domains where
2328 * your country is not known and as such it should be treated as
2329 * NO TX unless the channel is explicitly allowed in which case
2330 * your current regulatory domain would not have the passive scan
2331 * flag.
2332 *
2333 * Since AP mode uses monitor interfaces to inject/TX management
2334 * frames we can make AP mode the exception to this rule once it
2335 * supports radar detection as its implementation can deal with
2336 * radar detection by itself. We can do that later by adding a
2337 * monitor flag interfaces used for AP support.
2338 */
2339 if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
2340 sdata->vif.type))
2341 goto fail_rcu;
2342
2343 info->band = chandef->chan->band;
2344
2345 /* Initialize skb->priority according to frame type and TID class,
2346 * with respect to the sub interface that the frame will actually
2347 * be transmitted on. If the DONT_REORDER flag is set, the original
2348 * skb-priority is preserved to assure frames injected with this
2349 * flag are not reordered relative to each other.
2350 */
2351 ieee80211_select_queue_80211(sdata, skb, hdr);
2352 skb_set_queue_mapping(skb, ieee80211_ac_from_tid(skb->priority));
2353
2354 /* remove the injection radiotap header */
2355 skb_pull(skb, len_rthdr);
2356
2357 ieee80211_xmit(sdata, NULL, skb);
2358 rcu_read_unlock();
2359
2360 return NETDEV_TX_OK;
2361
2362 fail_rcu:
2363 rcu_read_unlock();
2364 fail:
2365 dev_kfree_skb(skb);
2366 return NETDEV_TX_OK; /* meaning, we dealt with the skb */
2367 }
2368
ieee80211_is_tdls_setup(struct sk_buff * skb)2369 static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
2370 {
2371 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
2372
2373 return ethertype == ETH_P_TDLS &&
2374 skb->len > 14 &&
2375 skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
2376 }
2377
ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,struct sta_info ** sta_out)2378 int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
2379 struct sk_buff *skb,
2380 struct sta_info **sta_out)
2381 {
2382 struct sta_info *sta;
2383
2384 switch (sdata->vif.type) {
2385 case NL80211_IFTYPE_AP_VLAN:
2386 sta = rcu_dereference(sdata->u.vlan.sta);
2387 if (sta) {
2388 *sta_out = sta;
2389 return 0;
2390 } else if (sdata->wdev.use_4addr) {
2391 return -ENOLINK;
2392 }
2393 fallthrough;
2394 case NL80211_IFTYPE_AP:
2395 case NL80211_IFTYPE_OCB:
2396 case NL80211_IFTYPE_ADHOC:
2397 if (is_multicast_ether_addr(skb->data)) {
2398 *sta_out = ERR_PTR(-ENOENT);
2399 return 0;
2400 }
2401 sta = sta_info_get_bss(sdata, skb->data);
2402 break;
2403 #ifdef CONFIG_MAC80211_MESH
2404 case NL80211_IFTYPE_MESH_POINT:
2405 /* determined much later */
2406 *sta_out = NULL;
2407 return 0;
2408 #endif
2409 case NL80211_IFTYPE_STATION:
2410 if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2411 sta = sta_info_get(sdata, skb->data);
2412 if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2413 if (test_sta_flag(sta,
2414 WLAN_STA_TDLS_PEER_AUTH)) {
2415 *sta_out = sta;
2416 return 0;
2417 }
2418
2419 /*
2420 * TDLS link during setup - throw out frames to
2421 * peer. Allow TDLS-setup frames to unauthorized
2422 * peers for the special case of a link teardown
2423 * after a TDLS sta is removed due to being
2424 * unreachable.
2425 */
2426 if (!ieee80211_is_tdls_setup(skb))
2427 return -EINVAL;
2428 }
2429
2430 }
2431
2432 sta = sta_info_get(sdata, sdata->u.mgd.bssid);
2433 if (!sta)
2434 return -ENOLINK;
2435 break;
2436 default:
2437 return -EINVAL;
2438 }
2439
2440 *sta_out = sta ?: ERR_PTR(-ENOENT);
2441 return 0;
2442 }
2443
ieee80211_store_ack_skb(struct ieee80211_local * local,struct sk_buff * skb,u32 * info_flags,u64 * cookie)2444 static u16 ieee80211_store_ack_skb(struct ieee80211_local *local,
2445 struct sk_buff *skb,
2446 u32 *info_flags,
2447 u64 *cookie)
2448 {
2449 struct sk_buff *ack_skb;
2450 u16 info_id = 0;
2451
2452 if (skb->sk)
2453 ack_skb = skb_clone_sk(skb);
2454 else
2455 ack_skb = skb_clone(skb, GFP_ATOMIC);
2456
2457 if (ack_skb) {
2458 unsigned long flags;
2459 int id;
2460
2461 spin_lock_irqsave(&local->ack_status_lock, flags);
2462 id = idr_alloc(&local->ack_status_frames, ack_skb,
2463 1, 0x2000, GFP_ATOMIC);
2464 spin_unlock_irqrestore(&local->ack_status_lock, flags);
2465
2466 if (id >= 0) {
2467 info_id = id;
2468 *info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
2469 if (cookie) {
2470 *cookie = ieee80211_mgmt_tx_cookie(local);
2471 IEEE80211_SKB_CB(ack_skb)->ack.cookie = *cookie;
2472 }
2473 } else {
2474 kfree_skb(ack_skb);
2475 }
2476 }
2477
2478 return info_id;
2479 }
2480
2481 /**
2482 * ieee80211_build_hdr - build 802.11 header in the given frame
2483 * @sdata: virtual interface to build the header for
2484 * @skb: the skb to build the header in
2485 * @info_flags: skb flags to set
2486 * @sta: the station pointer
2487 * @ctrl_flags: info control flags to set
2488 * @cookie: cookie pointer to fill (if not %NULL)
2489 *
2490 * This function takes the skb with 802.3 header and reformats the header to
2491 * the appropriate IEEE 802.11 header based on which interface the packet is
2492 * being transmitted on.
2493 *
2494 * Note that this function also takes care of the TX status request and
2495 * potential unsharing of the SKB - this needs to be interleaved with the
2496 * header building.
2497 *
2498 * The function requires the read-side RCU lock held
2499 *
2500 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
2501 */
ieee80211_build_hdr(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,u32 info_flags,struct sta_info * sta,u32 ctrl_flags,u64 * cookie)2502 static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
2503 struct sk_buff *skb, u32 info_flags,
2504 struct sta_info *sta, u32 ctrl_flags,
2505 u64 *cookie)
2506 {
2507 struct ieee80211_local *local = sdata->local;
2508 struct ieee80211_tx_info *info;
2509 int head_need;
2510 u16 ethertype, hdrlen, meshhdrlen = 0;
2511 __le16 fc;
2512 struct ieee80211_hdr hdr;
2513 struct ieee80211s_hdr mesh_hdr __maybe_unused;
2514 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
2515 const u8 *encaps_data;
2516 int encaps_len, skip_header_bytes;
2517 bool wme_sta = false, authorized = false;
2518 bool tdls_peer;
2519 bool multicast;
2520 u16 info_id = 0;
2521 struct ieee80211_chanctx_conf *chanctx_conf;
2522 struct ieee80211_sub_if_data *ap_sdata;
2523 enum nl80211_band band;
2524 int ret;
2525
2526 if (IS_ERR(sta))
2527 sta = NULL;
2528
2529 #ifdef CONFIG_MAC80211_DEBUGFS
2530 if (local->force_tx_status)
2531 info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
2532 #endif
2533
2534 /* convert Ethernet header to proper 802.11 header (based on
2535 * operation mode) */
2536 ethertype = (skb->data[12] << 8) | skb->data[13];
2537 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2538
2539 switch (sdata->vif.type) {
2540 case NL80211_IFTYPE_AP_VLAN:
2541 if (sdata->wdev.use_4addr) {
2542 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2543 /* RA TA DA SA */
2544 memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
2545 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2546 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2547 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2548 hdrlen = 30;
2549 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2550 wme_sta = sta->sta.wme;
2551 }
2552 ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2553 u.ap);
2554 chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
2555 if (!chanctx_conf) {
2556 ret = -ENOTCONN;
2557 goto free;
2558 }
2559 band = chanctx_conf->def.chan->band;
2560 if (sdata->wdev.use_4addr)
2561 break;
2562 fallthrough;
2563 case NL80211_IFTYPE_AP:
2564 if (sdata->vif.type == NL80211_IFTYPE_AP)
2565 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2566 if (!chanctx_conf) {
2567 ret = -ENOTCONN;
2568 goto free;
2569 }
2570 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2571 /* DA BSSID SA */
2572 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2573 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2574 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
2575 hdrlen = 24;
2576 band = chanctx_conf->def.chan->band;
2577 break;
2578 #ifdef CONFIG_MAC80211_MESH
2579 case NL80211_IFTYPE_MESH_POINT:
2580 if (!is_multicast_ether_addr(skb->data)) {
2581 struct sta_info *next_hop;
2582 bool mpp_lookup = true;
2583
2584 mpath = mesh_path_lookup(sdata, skb->data);
2585 if (mpath) {
2586 mpp_lookup = false;
2587 next_hop = rcu_dereference(mpath->next_hop);
2588 if (!next_hop ||
2589 !(mpath->flags & (MESH_PATH_ACTIVE |
2590 MESH_PATH_RESOLVING)))
2591 mpp_lookup = true;
2592 }
2593
2594 if (mpp_lookup) {
2595 mppath = mpp_path_lookup(sdata, skb->data);
2596 if (mppath)
2597 mppath->exp_time = jiffies;
2598 }
2599
2600 if (mppath && mpath)
2601 mesh_path_del(sdata, mpath->dst);
2602 }
2603
2604 /*
2605 * Use address extension if it is a packet from
2606 * another interface or if we know the destination
2607 * is being proxied by a portal (i.e. portal address
2608 * differs from proxied address)
2609 */
2610 if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
2611 !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
2612 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2613 skb->data, skb->data + ETH_ALEN);
2614 meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
2615 NULL, NULL);
2616 } else {
2617 /* DS -> MBSS (802.11-2012 13.11.3.3).
2618 * For unicast with unknown forwarding information,
2619 * destination might be in the MBSS or if that fails
2620 * forwarded to another mesh gate. In either case
2621 * resolution will be handled in ieee80211_xmit(), so
2622 * leave the original DA. This also works for mcast */
2623 const u8 *mesh_da = skb->data;
2624
2625 if (mppath)
2626 mesh_da = mppath->mpp;
2627 else if (mpath)
2628 mesh_da = mpath->dst;
2629
2630 hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2631 mesh_da, sdata->vif.addr);
2632 if (is_multicast_ether_addr(mesh_da))
2633 /* DA TA mSA AE:SA */
2634 meshhdrlen = ieee80211_new_mesh_header(
2635 sdata, &mesh_hdr,
2636 skb->data + ETH_ALEN, NULL);
2637 else
2638 /* RA TA mDA mSA AE:DA SA */
2639 meshhdrlen = ieee80211_new_mesh_header(
2640 sdata, &mesh_hdr, skb->data,
2641 skb->data + ETH_ALEN);
2642
2643 }
2644 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2645 if (!chanctx_conf) {
2646 ret = -ENOTCONN;
2647 goto free;
2648 }
2649 band = chanctx_conf->def.chan->band;
2650
2651 /* For injected frames, fill RA right away as nexthop lookup
2652 * will be skipped.
2653 */
2654 if ((ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP) &&
2655 is_zero_ether_addr(hdr.addr1))
2656 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2657 break;
2658 #endif
2659 case NL80211_IFTYPE_STATION:
2660 /* we already did checks when looking up the RA STA */
2661 tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
2662
2663 if (tdls_peer) {
2664 /* DA SA BSSID */
2665 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2666 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2667 memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
2668 hdrlen = 24;
2669 } else if (sdata->u.mgd.use_4addr &&
2670 cpu_to_be16(ethertype) != sdata->control_port_protocol) {
2671 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2672 IEEE80211_FCTL_TODS);
2673 /* RA TA DA SA */
2674 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2675 memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2676 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2677 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2678 hdrlen = 30;
2679 } else {
2680 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2681 /* BSSID SA DA */
2682 memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2683 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2684 memcpy(hdr.addr3, skb->data, ETH_ALEN);
2685 hdrlen = 24;
2686 }
2687 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2688 if (!chanctx_conf) {
2689 ret = -ENOTCONN;
2690 goto free;
2691 }
2692 band = chanctx_conf->def.chan->band;
2693 break;
2694 case NL80211_IFTYPE_OCB:
2695 /* DA SA BSSID */
2696 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2697 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2698 eth_broadcast_addr(hdr.addr3);
2699 hdrlen = 24;
2700 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2701 if (!chanctx_conf) {
2702 ret = -ENOTCONN;
2703 goto free;
2704 }
2705 band = chanctx_conf->def.chan->band;
2706 break;
2707 case NL80211_IFTYPE_ADHOC:
2708 /* DA SA BSSID */
2709 memcpy(hdr.addr1, skb->data, ETH_ALEN);
2710 memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2711 memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
2712 hdrlen = 24;
2713 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2714 if (!chanctx_conf) {
2715 ret = -ENOTCONN;
2716 goto free;
2717 }
2718 band = chanctx_conf->def.chan->band;
2719 break;
2720 default:
2721 ret = -EINVAL;
2722 goto free;
2723 }
2724
2725 multicast = is_multicast_ether_addr(hdr.addr1);
2726
2727 /* sta is always NULL for mesh */
2728 if (sta) {
2729 authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2730 wme_sta = sta->sta.wme;
2731 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2732 /* For mesh, the use of the QoS header is mandatory */
2733 wme_sta = true;
2734 }
2735
2736 /* receiver does QoS (which also means we do) use it */
2737 if (wme_sta) {
2738 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2739 hdrlen += 2;
2740 }
2741
2742 /*
2743 * Drop unicast frames to unauthorised stations unless they are
2744 * EAPOL frames from the local station.
2745 */
2746 if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
2747 (sdata->vif.type != NL80211_IFTYPE_OCB) &&
2748 !multicast && !authorized &&
2749 (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
2750 !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
2751 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2752 net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
2753 sdata->name, hdr.addr1);
2754 #endif
2755
2756 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
2757
2758 ret = -EPERM;
2759 goto free;
2760 }
2761
2762 if (unlikely(!multicast && ((skb->sk &&
2763 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
2764 ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS)))
2765 info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
2766 cookie);
2767
2768 /*
2769 * If the skb is shared we need to obtain our own copy.
2770 */
2771 if (skb_shared(skb)) {
2772 struct sk_buff *tmp_skb = skb;
2773
2774 /* can't happen -- skb is a clone if info_id != 0 */
2775 WARN_ON(info_id);
2776
2777 skb = skb_clone(skb, GFP_ATOMIC);
2778 kfree_skb(tmp_skb);
2779
2780 if (!skb) {
2781 ret = -ENOMEM;
2782 goto free;
2783 }
2784 }
2785
2786 hdr.frame_control = fc;
2787 hdr.duration_id = 0;
2788 hdr.seq_ctrl = 0;
2789
2790 skip_header_bytes = ETH_HLEN;
2791 if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
2792 encaps_data = bridge_tunnel_header;
2793 encaps_len = sizeof(bridge_tunnel_header);
2794 skip_header_bytes -= 2;
2795 } else if (ethertype >= ETH_P_802_3_MIN) {
2796 encaps_data = rfc1042_header;
2797 encaps_len = sizeof(rfc1042_header);
2798 skip_header_bytes -= 2;
2799 } else {
2800 encaps_data = NULL;
2801 encaps_len = 0;
2802 }
2803
2804 skb_pull(skb, skip_header_bytes);
2805 head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
2806
2807 /*
2808 * So we need to modify the skb header and hence need a copy of
2809 * that. The head_need variable above doesn't, so far, include
2810 * the needed header space that we don't need right away. If we
2811 * can, then we don't reallocate right now but only after the
2812 * frame arrives at the master device (if it does...)
2813 *
2814 * If we cannot, however, then we will reallocate to include all
2815 * the ever needed space. Also, if we need to reallocate it anyway,
2816 * make it big enough for everything we may ever need.
2817 */
2818
2819 if (head_need > 0 || skb_cloned(skb)) {
2820 head_need += sdata->encrypt_headroom;
2821 head_need += local->tx_headroom;
2822 head_need = max_t(int, 0, head_need);
2823 if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
2824 ieee80211_free_txskb(&local->hw, skb);
2825 skb = NULL;
2826 return ERR_PTR(-ENOMEM);
2827 }
2828 }
2829
2830 if (encaps_data)
2831 memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
2832
2833 #ifdef CONFIG_MAC80211_MESH
2834 if (meshhdrlen > 0)
2835 memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
2836 #endif
2837
2838 if (ieee80211_is_data_qos(fc)) {
2839 __le16 *qos_control;
2840
2841 qos_control = skb_push(skb, 2);
2842 memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
2843 /*
2844 * Maybe we could actually set some fields here, for now just
2845 * initialise to zero to indicate no special operation.
2846 */
2847 *qos_control = 0;
2848 } else
2849 memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
2850
2851 skb_reset_mac_header(skb);
2852
2853 info = IEEE80211_SKB_CB(skb);
2854 memset(info, 0, sizeof(*info));
2855
2856 info->flags = info_flags;
2857 info->ack_frame_id = info_id;
2858 info->band = band;
2859 info->control.flags = ctrl_flags;
2860
2861 return skb;
2862 free:
2863 kfree_skb(skb);
2864 return ERR_PTR(ret);
2865 }
2866
2867 /*
2868 * fast-xmit overview
2869 *
2870 * The core idea of this fast-xmit is to remove per-packet checks by checking
2871 * them out of band. ieee80211_check_fast_xmit() implements the out-of-band
2872 * checks that are needed to get the sta->fast_tx pointer assigned, after which
2873 * much less work can be done per packet. For example, fragmentation must be
2874 * disabled or the fast_tx pointer will not be set. All the conditions are seen
2875 * in the code here.
2876 *
2877 * Once assigned, the fast_tx data structure also caches the per-packet 802.11
2878 * header and other data to aid packet processing in ieee80211_xmit_fast().
2879 *
2880 * The most difficult part of this is that when any of these assumptions
2881 * change, an external trigger (i.e. a call to ieee80211_clear_fast_xmit(),
2882 * ieee80211_check_fast_xmit() or friends) is required to reset the data,
2883 * since the per-packet code no longer checks the conditions. This is reflected
2884 * by the calls to these functions throughout the rest of the code, and must be
2885 * maintained if any of the TX path checks change.
2886 */
2887
ieee80211_check_fast_xmit(struct sta_info * sta)2888 void ieee80211_check_fast_xmit(struct sta_info *sta)
2889 {
2890 struct ieee80211_fast_tx build = {}, *fast_tx = NULL, *old;
2891 struct ieee80211_local *local = sta->local;
2892 struct ieee80211_sub_if_data *sdata = sta->sdata;
2893 struct ieee80211_hdr *hdr = (void *)build.hdr;
2894 struct ieee80211_chanctx_conf *chanctx_conf;
2895 __le16 fc;
2896
2897 if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
2898 return;
2899
2900 /* Locking here protects both the pointer itself, and against concurrent
2901 * invocations winning data access races to, e.g., the key pointer that
2902 * is used.
2903 * Without it, the invocation of this function right after the key
2904 * pointer changes wouldn't be sufficient, as another CPU could access
2905 * the pointer, then stall, and then do the cache update after the CPU
2906 * that invalidated the key.
2907 * With the locking, such scenarios cannot happen as the check for the
2908 * key and the fast-tx assignment are done atomically, so the CPU that
2909 * modifies the key will either wait or other one will see the key
2910 * cleared/changed already.
2911 */
2912 spin_lock_bh(&sta->lock);
2913 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
2914 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
2915 sdata->vif.type == NL80211_IFTYPE_STATION)
2916 goto out;
2917
2918 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2919 goto out;
2920
2921 if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
2922 test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
2923 test_sta_flag(sta, WLAN_STA_PS_DELIVER) ||
2924 test_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT))
2925 goto out;
2926
2927 if (sdata->noack_map)
2928 goto out;
2929
2930 /* fast-xmit doesn't handle fragmentation at all */
2931 if (local->hw.wiphy->frag_threshold != (u32)-1 &&
2932 !ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG))
2933 goto out;
2934
2935 rcu_read_lock();
2936 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2937 if (!chanctx_conf) {
2938 rcu_read_unlock();
2939 goto out;
2940 }
2941 build.band = chanctx_conf->def.chan->band;
2942 rcu_read_unlock();
2943
2944 fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2945
2946 switch (sdata->vif.type) {
2947 case NL80211_IFTYPE_ADHOC:
2948 /* DA SA BSSID */
2949 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2950 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2951 memcpy(hdr->addr3, sdata->u.ibss.bssid, ETH_ALEN);
2952 build.hdr_len = 24;
2953 break;
2954 case NL80211_IFTYPE_STATION:
2955 if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2956 /* DA SA BSSID */
2957 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
2958 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2959 memcpy(hdr->addr3, sdata->u.mgd.bssid, ETH_ALEN);
2960 build.hdr_len = 24;
2961 break;
2962 }
2963
2964 if (sdata->u.mgd.use_4addr) {
2965 /* non-regular ethertype cannot use the fastpath */
2966 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2967 IEEE80211_FCTL_TODS);
2968 /* RA TA DA SA */
2969 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2970 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2971 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2972 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2973 build.hdr_len = 30;
2974 break;
2975 }
2976 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2977 /* BSSID SA DA */
2978 memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
2979 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2980 build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
2981 build.hdr_len = 24;
2982 break;
2983 case NL80211_IFTYPE_AP_VLAN:
2984 if (sdata->wdev.use_4addr) {
2985 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2986 IEEE80211_FCTL_TODS);
2987 /* RA TA DA SA */
2988 memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
2989 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
2990 build.da_offs = offsetof(struct ieee80211_hdr, addr3);
2991 build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
2992 build.hdr_len = 30;
2993 break;
2994 }
2995 fallthrough;
2996 case NL80211_IFTYPE_AP:
2997 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2998 /* DA BSSID SA */
2999 build.da_offs = offsetof(struct ieee80211_hdr, addr1);
3000 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
3001 build.sa_offs = offsetof(struct ieee80211_hdr, addr3);
3002 build.hdr_len = 24;
3003 break;
3004 default:
3005 /* not handled on fast-xmit */
3006 goto out;
3007 }
3008
3009 if (sta->sta.wme) {
3010 build.hdr_len += 2;
3011 fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
3012 }
3013
3014 /* We store the key here so there's no point in using rcu_dereference()
3015 * but that's fine because the code that changes the pointers will call
3016 * this function after doing so. For a single CPU that would be enough,
3017 * for multiple see the comment above.
3018 */
3019 build.key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
3020 if (!build.key)
3021 build.key = rcu_access_pointer(sdata->default_unicast_key);
3022 if (build.key) {
3023 bool gen_iv, iv_spc, mmic;
3024
3025 gen_iv = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
3026 iv_spc = build.key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3027 mmic = build.key->conf.flags &
3028 (IEEE80211_KEY_FLAG_GENERATE_MMIC |
3029 IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
3030
3031 /* don't handle software crypto */
3032 if (!(build.key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
3033 goto out;
3034
3035 /* Key is being removed */
3036 if (build.key->flags & KEY_FLAG_TAINTED)
3037 goto out;
3038
3039 switch (build.key->conf.cipher) {
3040 case WLAN_CIPHER_SUITE_CCMP:
3041 case WLAN_CIPHER_SUITE_CCMP_256:
3042 if (gen_iv)
3043 build.pn_offs = build.hdr_len;
3044 if (gen_iv || iv_spc)
3045 build.hdr_len += IEEE80211_CCMP_HDR_LEN;
3046 break;
3047 case WLAN_CIPHER_SUITE_GCMP:
3048 case WLAN_CIPHER_SUITE_GCMP_256:
3049 if (gen_iv)
3050 build.pn_offs = build.hdr_len;
3051 if (gen_iv || iv_spc)
3052 build.hdr_len += IEEE80211_GCMP_HDR_LEN;
3053 break;
3054 case WLAN_CIPHER_SUITE_TKIP:
3055 /* cannot handle MMIC or IV generation in xmit-fast */
3056 if (mmic || gen_iv)
3057 goto out;
3058 if (iv_spc)
3059 build.hdr_len += IEEE80211_TKIP_IV_LEN;
3060 break;
3061 case WLAN_CIPHER_SUITE_WEP40:
3062 case WLAN_CIPHER_SUITE_WEP104:
3063 /* cannot handle IV generation in fast-xmit */
3064 if (gen_iv)
3065 goto out;
3066 if (iv_spc)
3067 build.hdr_len += IEEE80211_WEP_IV_LEN;
3068 break;
3069 case WLAN_CIPHER_SUITE_AES_CMAC:
3070 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
3071 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3072 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3073 WARN(1,
3074 "management cipher suite 0x%x enabled for data\n",
3075 build.key->conf.cipher);
3076 goto out;
3077 default:
3078 /* we don't know how to generate IVs for this at all */
3079 if (WARN_ON(gen_iv))
3080 goto out;
3081 /* pure hardware keys are OK, of course */
3082 if (!(build.key->flags & KEY_FLAG_CIPHER_SCHEME))
3083 break;
3084 /* cipher scheme might require space allocation */
3085 if (iv_spc &&
3086 build.key->conf.iv_len > IEEE80211_FAST_XMIT_MAX_IV)
3087 goto out;
3088 if (iv_spc)
3089 build.hdr_len += build.key->conf.iv_len;
3090 }
3091
3092 fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
3093 }
3094
3095 hdr->frame_control = fc;
3096
3097 memcpy(build.hdr + build.hdr_len,
3098 rfc1042_header, sizeof(rfc1042_header));
3099 build.hdr_len += sizeof(rfc1042_header);
3100
3101 fast_tx = kmemdup(&build, sizeof(build), GFP_ATOMIC);
3102 /* if the kmemdup fails, continue w/o fast_tx */
3103 if (!fast_tx)
3104 goto out;
3105
3106 out:
3107 /* we might have raced against another call to this function */
3108 old = rcu_dereference_protected(sta->fast_tx,
3109 lockdep_is_held(&sta->lock));
3110 rcu_assign_pointer(sta->fast_tx, fast_tx);
3111 if (old)
3112 kfree_rcu(old, rcu_head);
3113 spin_unlock_bh(&sta->lock);
3114 }
3115
ieee80211_check_fast_xmit_all(struct ieee80211_local * local)3116 void ieee80211_check_fast_xmit_all(struct ieee80211_local *local)
3117 {
3118 struct sta_info *sta;
3119
3120 rcu_read_lock();
3121 list_for_each_entry_rcu(sta, &local->sta_list, list)
3122 ieee80211_check_fast_xmit(sta);
3123 rcu_read_unlock();
3124 }
3125
ieee80211_check_fast_xmit_iface(struct ieee80211_sub_if_data * sdata)3126 void ieee80211_check_fast_xmit_iface(struct ieee80211_sub_if_data *sdata)
3127 {
3128 struct ieee80211_local *local = sdata->local;
3129 struct sta_info *sta;
3130
3131 rcu_read_lock();
3132
3133 list_for_each_entry_rcu(sta, &local->sta_list, list) {
3134 if (sdata != sta->sdata &&
3135 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
3136 continue;
3137 ieee80211_check_fast_xmit(sta);
3138 }
3139
3140 rcu_read_unlock();
3141 }
3142
ieee80211_clear_fast_xmit(struct sta_info * sta)3143 void ieee80211_clear_fast_xmit(struct sta_info *sta)
3144 {
3145 struct ieee80211_fast_tx *fast_tx;
3146
3147 spin_lock_bh(&sta->lock);
3148 fast_tx = rcu_dereference_protected(sta->fast_tx,
3149 lockdep_is_held(&sta->lock));
3150 RCU_INIT_POINTER(sta->fast_tx, NULL);
3151 spin_unlock_bh(&sta->lock);
3152
3153 if (fast_tx)
3154 kfree_rcu(fast_tx, rcu_head);
3155 }
3156
ieee80211_amsdu_realloc_pad(struct ieee80211_local * local,struct sk_buff * skb,int headroom)3157 static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
3158 struct sk_buff *skb, int headroom)
3159 {
3160 if (skb_headroom(skb) < headroom) {
3161 I802_DEBUG_INC(local->tx_expand_skb_head);
3162
3163 if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
3164 wiphy_debug(local->hw.wiphy,
3165 "failed to reallocate TX buffer\n");
3166 return false;
3167 }
3168 }
3169
3170 return true;
3171 }
3172
ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data * sdata,struct ieee80211_fast_tx * fast_tx,struct sk_buff * skb)3173 static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
3174 struct ieee80211_fast_tx *fast_tx,
3175 struct sk_buff *skb)
3176 {
3177 struct ieee80211_local *local = sdata->local;
3178 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3179 struct ieee80211_hdr *hdr;
3180 struct ethhdr *amsdu_hdr;
3181 int hdr_len = fast_tx->hdr_len - sizeof(rfc1042_header);
3182 int subframe_len = skb->len - hdr_len;
3183 void *data;
3184 u8 *qc, *h_80211_src, *h_80211_dst;
3185 const u8 *bssid;
3186
3187 if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
3188 return false;
3189
3190 if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
3191 return true;
3192
3193 if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
3194 return false;
3195
3196 data = skb_push(skb, sizeof(*amsdu_hdr));
3197 memmove(data, data + sizeof(*amsdu_hdr), hdr_len);
3198 hdr = data;
3199 amsdu_hdr = data + hdr_len;
3200 /* h_80211_src/dst is addr* field within hdr */
3201 h_80211_src = data + fast_tx->sa_offs;
3202 h_80211_dst = data + fast_tx->da_offs;
3203
3204 amsdu_hdr->h_proto = cpu_to_be16(subframe_len);
3205 ether_addr_copy(amsdu_hdr->h_source, h_80211_src);
3206 ether_addr_copy(amsdu_hdr->h_dest, h_80211_dst);
3207
3208 /* according to IEEE 802.11-2012 8.3.2 table 8-19, the outer SA/DA
3209 * fields needs to be changed to BSSID for A-MSDU frames depending
3210 * on FromDS/ToDS values.
3211 */
3212 switch (sdata->vif.type) {
3213 case NL80211_IFTYPE_STATION:
3214 bssid = sdata->u.mgd.bssid;
3215 break;
3216 case NL80211_IFTYPE_AP:
3217 case NL80211_IFTYPE_AP_VLAN:
3218 bssid = sdata->vif.addr;
3219 break;
3220 default:
3221 bssid = NULL;
3222 }
3223
3224 if (bssid && ieee80211_has_fromds(hdr->frame_control))
3225 ether_addr_copy(h_80211_src, bssid);
3226
3227 if (bssid && ieee80211_has_tods(hdr->frame_control))
3228 ether_addr_copy(h_80211_dst, bssid);
3229
3230 qc = ieee80211_get_qos_ctl(hdr);
3231 *qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
3232
3233 info->control.flags |= IEEE80211_TX_CTRL_AMSDU;
3234
3235 return true;
3236 }
3237
ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct ieee80211_fast_tx * fast_tx,struct sk_buff * skb)3238 static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
3239 struct sta_info *sta,
3240 struct ieee80211_fast_tx *fast_tx,
3241 struct sk_buff *skb)
3242 {
3243 struct ieee80211_local *local = sdata->local;
3244 struct fq *fq = &local->fq;
3245 struct fq_tin *tin;
3246 struct fq_flow *flow;
3247 u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3248 struct ieee80211_txq *txq = sta->sta.txq[tid];
3249 struct txq_info *txqi;
3250 struct sk_buff **frag_tail, *head;
3251 int subframe_len = skb->len - ETH_ALEN;
3252 u8 max_subframes = sta->sta.max_amsdu_subframes;
3253 int max_frags = local->hw.max_tx_fragments;
3254 int max_amsdu_len = sta->sta.max_amsdu_len;
3255 int orig_truesize;
3256 u32 flow_idx;
3257 __be16 len;
3258 void *data;
3259 bool ret = false;
3260 unsigned int orig_len;
3261 int n = 2, nfrags, pad = 0;
3262 u16 hdrlen;
3263
3264 if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
3265 return false;
3266
3267 if (skb_is_gso(skb))
3268 return false;
3269
3270 if (!txq)
3271 return false;
3272
3273 txqi = to_txq_info(txq);
3274 if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
3275 return false;
3276
3277 if (sta->sta.max_rc_amsdu_len)
3278 max_amsdu_len = min_t(int, max_amsdu_len,
3279 sta->sta.max_rc_amsdu_len);
3280
3281 if (sta->sta.max_tid_amsdu_len[tid])
3282 max_amsdu_len = min_t(int, max_amsdu_len,
3283 sta->sta.max_tid_amsdu_len[tid]);
3284
3285 flow_idx = fq_flow_idx(fq, skb);
3286
3287 spin_lock_bh(&fq->lock);
3288
3289 /* TODO: Ideally aggregation should be done on dequeue to remain
3290 * responsive to environment changes.
3291 */
3292
3293 tin = &txqi->tin;
3294 flow = fq_flow_classify(fq, tin, flow_idx, skb);
3295 head = skb_peek_tail(&flow->queue);
3296 if (!head || skb_is_gso(head))
3297 goto out;
3298
3299 orig_truesize = head->truesize;
3300 orig_len = head->len;
3301
3302 if (skb->len + head->len > max_amsdu_len)
3303 goto out;
3304
3305 nfrags = 1 + skb_shinfo(skb)->nr_frags;
3306 nfrags += 1 + skb_shinfo(head)->nr_frags;
3307 frag_tail = &skb_shinfo(head)->frag_list;
3308 while (*frag_tail) {
3309 nfrags += 1 + skb_shinfo(*frag_tail)->nr_frags;
3310 frag_tail = &(*frag_tail)->next;
3311 n++;
3312 }
3313
3314 if (max_subframes && n > max_subframes)
3315 goto out;
3316
3317 if (max_frags && nfrags > max_frags)
3318 goto out;
3319
3320 if (!drv_can_aggregate_in_amsdu(local, head, skb))
3321 goto out;
3322
3323 if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
3324 goto out;
3325
3326 /*
3327 * Pad out the previous subframe to a multiple of 4 by adding the
3328 * padding to the next one, that's being added. Note that head->len
3329 * is the length of the full A-MSDU, but that works since each time
3330 * we add a new subframe we pad out the previous one to a multiple
3331 * of 4 and thus it no longer matters in the next round.
3332 */
3333 hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
3334 if ((head->len - hdrlen) & 3)
3335 pad = 4 - ((head->len - hdrlen) & 3);
3336
3337 if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
3338 2 + pad))
3339 goto out_recalc;
3340
3341 ret = true;
3342 data = skb_push(skb, ETH_ALEN + 2);
3343 memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
3344
3345 data += 2 * ETH_ALEN;
3346 len = cpu_to_be16(subframe_len);
3347 memcpy(data, &len, 2);
3348 memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
3349
3350 memset(skb_push(skb, pad), 0, pad);
3351
3352 head->len += skb->len;
3353 head->data_len += skb->len;
3354 *frag_tail = skb;
3355
3356 out_recalc:
3357 fq->memory_usage += head->truesize - orig_truesize;
3358 if (head->len != orig_len) {
3359 flow->backlog += head->len - orig_len;
3360 tin->backlog_bytes += head->len - orig_len;
3361 }
3362 out:
3363 spin_unlock_bh(&fq->lock);
3364
3365 return ret;
3366 }
3367
3368 /*
3369 * Can be called while the sta lock is held. Anything that can cause packets to
3370 * be generated will cause deadlock!
3371 */
ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,u8 pn_offs,struct ieee80211_key * key,struct sk_buff * skb)3372 static void ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
3373 struct sta_info *sta, u8 pn_offs,
3374 struct ieee80211_key *key,
3375 struct sk_buff *skb)
3376 {
3377 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3378 struct ieee80211_hdr *hdr = (void *)skb->data;
3379 u8 tid = IEEE80211_NUM_TIDS;
3380
3381 if (key)
3382 info->control.hw_key = &key->conf;
3383
3384 dev_sw_netstats_tx_add(skb->dev, 1, skb->len);
3385
3386 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3387 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3388 hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
3389 } else {
3390 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
3391 hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
3392 sdata->sequence_number += 0x10;
3393 }
3394
3395 if (skb_shinfo(skb)->gso_size)
3396 sta->tx_stats.msdu[tid] +=
3397 DIV_ROUND_UP(skb->len, skb_shinfo(skb)->gso_size);
3398 else
3399 sta->tx_stats.msdu[tid]++;
3400
3401 info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
3402
3403 /* statistics normally done by ieee80211_tx_h_stats (but that
3404 * has to consider fragmentation, so is more complex)
3405 */
3406 sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
3407 sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
3408
3409 if (pn_offs) {
3410 u64 pn;
3411 u8 *crypto_hdr = skb->data + pn_offs;
3412
3413 switch (key->conf.cipher) {
3414 case WLAN_CIPHER_SUITE_CCMP:
3415 case WLAN_CIPHER_SUITE_CCMP_256:
3416 case WLAN_CIPHER_SUITE_GCMP:
3417 case WLAN_CIPHER_SUITE_GCMP_256:
3418 pn = atomic64_inc_return(&key->conf.tx_pn);
3419 crypto_hdr[0] = pn;
3420 crypto_hdr[1] = pn >> 8;
3421 crypto_hdr[3] = 0x20 | (key->conf.keyidx << 6);
3422 crypto_hdr[4] = pn >> 16;
3423 crypto_hdr[5] = pn >> 24;
3424 crypto_hdr[6] = pn >> 32;
3425 crypto_hdr[7] = pn >> 40;
3426 break;
3427 }
3428 }
3429 }
3430
ieee80211_xmit_fast(struct ieee80211_sub_if_data * sdata,struct sta_info * sta,struct ieee80211_fast_tx * fast_tx,struct sk_buff * skb)3431 static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
3432 struct sta_info *sta,
3433 struct ieee80211_fast_tx *fast_tx,
3434 struct sk_buff *skb)
3435 {
3436 struct ieee80211_local *local = sdata->local;
3437 u16 ethertype = (skb->data[12] << 8) | skb->data[13];
3438 int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
3439 int hw_headroom = sdata->local->hw.extra_tx_headroom;
3440 struct ethhdr eth;
3441 struct ieee80211_tx_info *info;
3442 struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
3443 struct ieee80211_tx_data tx;
3444 ieee80211_tx_result r;
3445 struct tid_ampdu_tx *tid_tx = NULL;
3446 u8 tid = IEEE80211_NUM_TIDS;
3447
3448 /* control port protocol needs a lot of special handling */
3449 if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
3450 return false;
3451
3452 /* only RFC 1042 SNAP */
3453 if (ethertype < ETH_P_802_3_MIN)
3454 return false;
3455
3456 /* don't handle TX status request here either */
3457 if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
3458 return false;
3459
3460 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3461 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3462 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
3463 if (tid_tx) {
3464 if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
3465 return false;
3466 if (tid_tx->timeout)
3467 tid_tx->last_tx = jiffies;
3468 }
3469 }
3470
3471 /* after this point (skb is modified) we cannot return false */
3472
3473 if (skb_shared(skb)) {
3474 struct sk_buff *tmp_skb = skb;
3475
3476 skb = skb_clone(skb, GFP_ATOMIC);
3477 kfree_skb(tmp_skb);
3478
3479 if (!skb)
3480 return true;
3481 }
3482
3483 if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
3484 ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
3485 return true;
3486
3487 /* will not be crypto-handled beyond what we do here, so use false
3488 * as the may-encrypt argument for the resize to not account for
3489 * more room than we already have in 'extra_head'
3490 */
3491 if (unlikely(ieee80211_skb_resize(sdata, skb,
3492 max_t(int, extra_head + hw_headroom -
3493 skb_headroom(skb), 0),
3494 ENCRYPT_NO))) {
3495 kfree_skb(skb);
3496 return true;
3497 }
3498
3499 memcpy(ð, skb->data, ETH_HLEN - 2);
3500 hdr = skb_push(skb, extra_head);
3501 memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
3502 memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
3503 memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
3504
3505 info = IEEE80211_SKB_CB(skb);
3506 memset(info, 0, sizeof(*info));
3507 info->band = fast_tx->band;
3508 info->control.vif = &sdata->vif;
3509 info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
3510 IEEE80211_TX_CTL_DONTFRAG |
3511 (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
3512 info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
3513
3514 #ifdef CONFIG_MAC80211_DEBUGFS
3515 if (local->force_tx_status)
3516 info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
3517 #endif
3518
3519 if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3520 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3521 *ieee80211_get_qos_ctl(hdr) = tid;
3522 }
3523
3524 __skb_queue_head_init(&tx.skbs);
3525
3526 tx.flags = IEEE80211_TX_UNICAST;
3527 tx.local = local;
3528 tx.sdata = sdata;
3529 tx.sta = sta;
3530 tx.key = fast_tx->key;
3531
3532 if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
3533 tx.skb = skb;
3534 r = ieee80211_tx_h_rate_ctrl(&tx);
3535 skb = tx.skb;
3536 tx.skb = NULL;
3537
3538 if (r != TX_CONTINUE) {
3539 if (r != TX_QUEUED)
3540 kfree_skb(skb);
3541 return true;
3542 }
3543 }
3544
3545 if (ieee80211_queue_skb(local, sdata, sta, skb))
3546 return true;
3547
3548 ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
3549 fast_tx->key, skb);
3550
3551 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3552 sdata = container_of(sdata->bss,
3553 struct ieee80211_sub_if_data, u.ap);
3554
3555 __skb_queue_tail(&tx.skbs, skb);
3556 ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
3557 return true;
3558 }
3559
ieee80211_tx_dequeue(struct ieee80211_hw * hw,struct ieee80211_txq * txq)3560 struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
3561 struct ieee80211_txq *txq)
3562 {
3563 struct ieee80211_local *local = hw_to_local(hw);
3564 struct txq_info *txqi = container_of(txq, struct txq_info, txq);
3565 struct ieee80211_hdr *hdr;
3566 struct sk_buff *skb = NULL;
3567 struct fq *fq = &local->fq;
3568 struct fq_tin *tin = &txqi->tin;
3569 struct ieee80211_tx_info *info;
3570 struct ieee80211_tx_data tx;
3571 ieee80211_tx_result r;
3572 struct ieee80211_vif *vif = txq->vif;
3573
3574 WARN_ON_ONCE(softirq_count() == 0);
3575
3576 if (!ieee80211_txq_airtime_check(hw, txq))
3577 return NULL;
3578
3579 begin:
3580 spin_lock_bh(&fq->lock);
3581
3582 if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ||
3583 test_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags))
3584 goto out;
3585
3586 if (vif->txqs_stopped[txq->ac]) {
3587 set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags);
3588 goto out;
3589 }
3590
3591 /* Make sure fragments stay together. */
3592 skb = __skb_dequeue(&txqi->frags);
3593 if (unlikely(skb)) {
3594 if (!(IEEE80211_SKB_CB(skb)->control.flags &
3595 IEEE80211_TX_INTCFL_NEED_TXPROCESSING))
3596 goto out;
3597 IEEE80211_SKB_CB(skb)->control.flags &=
3598 ~IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
3599 } else {
3600 skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func);
3601 }
3602
3603 if (!skb)
3604 goto out;
3605
3606 spin_unlock_bh(&fq->lock);
3607
3608 hdr = (struct ieee80211_hdr *)skb->data;
3609 info = IEEE80211_SKB_CB(skb);
3610
3611 memset(&tx, 0, sizeof(tx));
3612 __skb_queue_head_init(&tx.skbs);
3613 tx.local = local;
3614 tx.skb = skb;
3615 tx.sdata = vif_to_sdata(info->control.vif);
3616
3617 if (txq->sta) {
3618 tx.sta = container_of(txq->sta, struct sta_info, sta);
3619 /*
3620 * Drop unicast frames to unauthorised stations unless they are
3621 * injected frames or EAPOL frames from the local station.
3622 */
3623 if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
3624 ieee80211_is_data(hdr->frame_control) &&
3625 !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
3626 tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
3627 !is_multicast_ether_addr(hdr->addr1) &&
3628 !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) &&
3629 (!(info->control.flags &
3630 IEEE80211_TX_CTRL_PORT_CTRL_PROTO) ||
3631 !ether_addr_equal(tx.sdata->vif.addr,
3632 hdr->addr2)))) {
3633 I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
3634 ieee80211_free_txskb(&local->hw, skb);
3635 goto begin;
3636 }
3637 }
3638
3639 /*
3640 * The key can be removed while the packet was queued, so need to call
3641 * this here to get the current key.
3642 */
3643 r = ieee80211_tx_h_select_key(&tx);
3644 if (r != TX_CONTINUE) {
3645 ieee80211_free_txskb(&local->hw, skb);
3646 goto begin;
3647 }
3648
3649 if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
3650 info->flags |= IEEE80211_TX_CTL_AMPDU;
3651 else
3652 info->flags &= ~IEEE80211_TX_CTL_AMPDU;
3653
3654 if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)
3655 goto encap_out;
3656
3657 if (info->control.flags & IEEE80211_TX_CTRL_FAST_XMIT) {
3658 struct sta_info *sta = container_of(txq->sta, struct sta_info,
3659 sta);
3660 u8 pn_offs = 0;
3661
3662 if (tx.key &&
3663 (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
3664 pn_offs = ieee80211_hdrlen(hdr->frame_control);
3665
3666 ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
3667 tx.key, skb);
3668 } else {
3669 if (invoke_tx_handlers_late(&tx))
3670 goto begin;
3671
3672 skb = __skb_dequeue(&tx.skbs);
3673
3674 if (!skb_queue_empty(&tx.skbs)) {
3675 spin_lock_bh(&fq->lock);
3676 skb_queue_splice_tail(&tx.skbs, &txqi->frags);
3677 spin_unlock_bh(&fq->lock);
3678 }
3679 }
3680
3681 if (skb_has_frag_list(skb) &&
3682 !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
3683 if (skb_linearize(skb)) {
3684 ieee80211_free_txskb(&local->hw, skb);
3685 goto begin;
3686 }
3687 }
3688
3689 switch (tx.sdata->vif.type) {
3690 case NL80211_IFTYPE_MONITOR:
3691 if (tx.sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
3692 vif = &tx.sdata->vif;
3693 break;
3694 }
3695 tx.sdata = rcu_dereference(local->monitor_sdata);
3696 if (tx.sdata) {
3697 vif = &tx.sdata->vif;
3698 info->hw_queue =
3699 vif->hw_queue[skb_get_queue_mapping(skb)];
3700 } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
3701 ieee80211_free_txskb(&local->hw, skb);
3702 goto begin;
3703 } else {
3704 vif = NULL;
3705 }
3706 break;
3707 case NL80211_IFTYPE_AP_VLAN:
3708 tx.sdata = container_of(tx.sdata->bss,
3709 struct ieee80211_sub_if_data, u.ap);
3710 fallthrough;
3711 default:
3712 vif = &tx.sdata->vif;
3713 break;
3714 }
3715
3716 encap_out:
3717 IEEE80211_SKB_CB(skb)->control.vif = vif;
3718
3719 if (vif &&
3720 wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
3721 bool ampdu = txq->ac != IEEE80211_AC_VO;
3722 u32 airtime;
3723
3724 airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
3725 skb->len, ampdu);
3726 if (airtime) {
3727 airtime = ieee80211_info_set_tx_time_est(info, airtime);
3728 ieee80211_sta_update_pending_airtime(local, tx.sta,
3729 txq->ac,
3730 airtime,
3731 false);
3732 }
3733 }
3734
3735 return skb;
3736
3737 out:
3738 spin_unlock_bh(&fq->lock);
3739
3740 return skb;
3741 }
3742 EXPORT_SYMBOL(ieee80211_tx_dequeue);
3743
ieee80211_next_txq(struct ieee80211_hw * hw,u8 ac)3744 struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
3745 {
3746 struct ieee80211_local *local = hw_to_local(hw);
3747 struct ieee80211_txq *ret = NULL;
3748 struct txq_info *txqi = NULL, *head = NULL;
3749 bool found_eligible_txq = false;
3750
3751 spin_lock_bh(&local->active_txq_lock[ac]);
3752
3753 begin:
3754 txqi = list_first_entry_or_null(&local->active_txqs[ac],
3755 struct txq_info,
3756 schedule_order);
3757 if (!txqi)
3758 goto out;
3759
3760 if (txqi == head) {
3761 if (!found_eligible_txq)
3762 goto out;
3763 else
3764 found_eligible_txq = false;
3765 }
3766
3767 if (!head)
3768 head = txqi;
3769
3770 if (txqi->txq.sta) {
3771 struct sta_info *sta = container_of(txqi->txq.sta,
3772 struct sta_info, sta);
3773 bool aql_check = ieee80211_txq_airtime_check(hw, &txqi->txq);
3774 s64 deficit = sta->airtime[txqi->txq.ac].deficit;
3775
3776 if (aql_check)
3777 found_eligible_txq = true;
3778
3779 if (deficit < 0)
3780 sta->airtime[txqi->txq.ac].deficit +=
3781 sta->airtime_weight;
3782
3783 if (deficit < 0 || !aql_check) {
3784 list_move_tail(&txqi->schedule_order,
3785 &local->active_txqs[txqi->txq.ac]);
3786 goto begin;
3787 }
3788 }
3789
3790
3791 if (txqi->schedule_round == local->schedule_round[ac])
3792 goto out;
3793
3794 list_del_init(&txqi->schedule_order);
3795 txqi->schedule_round = local->schedule_round[ac];
3796 ret = &txqi->txq;
3797
3798 out:
3799 spin_unlock_bh(&local->active_txq_lock[ac]);
3800 return ret;
3801 }
3802 EXPORT_SYMBOL(ieee80211_next_txq);
3803
__ieee80211_schedule_txq(struct ieee80211_hw * hw,struct ieee80211_txq * txq,bool force)3804 void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
3805 struct ieee80211_txq *txq,
3806 bool force)
3807 {
3808 struct ieee80211_local *local = hw_to_local(hw);
3809 struct txq_info *txqi = to_txq_info(txq);
3810
3811 spin_lock_bh(&local->active_txq_lock[txq->ac]);
3812
3813 if (list_empty(&txqi->schedule_order) &&
3814 (force || !skb_queue_empty(&txqi->frags) ||
3815 txqi->tin.backlog_packets)) {
3816 /* If airtime accounting is active, always enqueue STAs at the
3817 * head of the list to ensure that they only get moved to the
3818 * back by the airtime DRR scheduler once they have a negative
3819 * deficit. A station that already has a negative deficit will
3820 * get immediately moved to the back of the list on the next
3821 * call to ieee80211_next_txq().
3822 */
3823 if (txqi->txq.sta && local->airtime_flags &&
3824 wiphy_ext_feature_isset(local->hw.wiphy,
3825 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
3826 list_add(&txqi->schedule_order,
3827 &local->active_txqs[txq->ac]);
3828 else
3829 list_add_tail(&txqi->schedule_order,
3830 &local->active_txqs[txq->ac]);
3831 }
3832
3833 spin_unlock_bh(&local->active_txq_lock[txq->ac]);
3834 }
3835 EXPORT_SYMBOL(__ieee80211_schedule_txq);
3836
3837 DEFINE_STATIC_KEY_FALSE(aql_disable);
3838
ieee80211_txq_airtime_check(struct ieee80211_hw * hw,struct ieee80211_txq * txq)3839 bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
3840 struct ieee80211_txq *txq)
3841 {
3842 struct sta_info *sta;
3843 struct ieee80211_local *local = hw_to_local(hw);
3844
3845 if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
3846 return true;
3847
3848 if (static_branch_unlikely(&aql_disable))
3849 return true;
3850
3851 if (!txq->sta)
3852 return true;
3853
3854 if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
3855 return true;
3856
3857 sta = container_of(txq->sta, struct sta_info, sta);
3858 if (atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
3859 sta->airtime[txq->ac].aql_limit_low)
3860 return true;
3861
3862 if (atomic_read(&local->aql_total_pending_airtime) <
3863 local->aql_threshold &&
3864 atomic_read(&sta->airtime[txq->ac].aql_tx_pending) <
3865 sta->airtime[txq->ac].aql_limit_high)
3866 return true;
3867
3868 return false;
3869 }
3870 EXPORT_SYMBOL(ieee80211_txq_airtime_check);
3871
ieee80211_txq_may_transmit(struct ieee80211_hw * hw,struct ieee80211_txq * txq)3872 bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
3873 struct ieee80211_txq *txq)
3874 {
3875 struct ieee80211_local *local = hw_to_local(hw);
3876 struct txq_info *iter, *tmp, *txqi = to_txq_info(txq);
3877 struct sta_info *sta;
3878 u8 ac = txq->ac;
3879
3880 spin_lock_bh(&local->active_txq_lock[ac]);
3881
3882 if (!txqi->txq.sta)
3883 goto out;
3884
3885 if (list_empty(&txqi->schedule_order))
3886 goto out;
3887
3888 list_for_each_entry_safe(iter, tmp, &local->active_txqs[ac],
3889 schedule_order) {
3890 if (iter == txqi)
3891 break;
3892
3893 if (!iter->txq.sta) {
3894 list_move_tail(&iter->schedule_order,
3895 &local->active_txqs[ac]);
3896 continue;
3897 }
3898 sta = container_of(iter->txq.sta, struct sta_info, sta);
3899 if (sta->airtime[ac].deficit < 0)
3900 sta->airtime[ac].deficit += sta->airtime_weight;
3901 list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
3902 }
3903
3904 sta = container_of(txqi->txq.sta, struct sta_info, sta);
3905 if (sta->airtime[ac].deficit >= 0)
3906 goto out;
3907
3908 sta->airtime[ac].deficit += sta->airtime_weight;
3909 list_move_tail(&txqi->schedule_order, &local->active_txqs[ac]);
3910 spin_unlock_bh(&local->active_txq_lock[ac]);
3911
3912 return false;
3913 out:
3914 if (!list_empty(&txqi->schedule_order))
3915 list_del_init(&txqi->schedule_order);
3916 spin_unlock_bh(&local->active_txq_lock[ac]);
3917
3918 return true;
3919 }
3920 EXPORT_SYMBOL(ieee80211_txq_may_transmit);
3921
ieee80211_txq_schedule_start(struct ieee80211_hw * hw,u8 ac)3922 void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
3923 {
3924 struct ieee80211_local *local = hw_to_local(hw);
3925
3926 spin_lock_bh(&local->active_txq_lock[ac]);
3927 local->schedule_round[ac]++;
3928 spin_unlock_bh(&local->active_txq_lock[ac]);
3929 }
3930 EXPORT_SYMBOL(ieee80211_txq_schedule_start);
3931
__ieee80211_subif_start_xmit(struct sk_buff * skb,struct net_device * dev,u32 info_flags,u32 ctrl_flags,u64 * cookie)3932 void __ieee80211_subif_start_xmit(struct sk_buff *skb,
3933 struct net_device *dev,
3934 u32 info_flags,
3935 u32 ctrl_flags,
3936 u64 *cookie)
3937 {
3938 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
3939 struct ieee80211_local *local = sdata->local;
3940 struct sta_info *sta;
3941 struct sk_buff *next;
3942
3943 if (unlikely(skb->len < ETH_HLEN)) {
3944 kfree_skb(skb);
3945 return;
3946 }
3947
3948 rcu_read_lock();
3949
3950 if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
3951 goto out_free;
3952
3953 if (IS_ERR(sta))
3954 sta = NULL;
3955
3956 if (local->ops->wake_tx_queue) {
3957 u16 queue = __ieee80211_select_queue(sdata, sta, skb);
3958 skb_set_queue_mapping(skb, queue);
3959 skb_get_hash(skb);
3960 }
3961
3962 if (sta) {
3963 struct ieee80211_fast_tx *fast_tx;
3964
3965 sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
3966
3967 fast_tx = rcu_dereference(sta->fast_tx);
3968
3969 if (fast_tx &&
3970 ieee80211_xmit_fast(sdata, sta, fast_tx, skb))
3971 goto out;
3972 }
3973
3974 if (skb_is_gso(skb)) {
3975 struct sk_buff *segs;
3976
3977 segs = skb_gso_segment(skb, 0);
3978 if (IS_ERR(segs)) {
3979 goto out_free;
3980 } else if (segs) {
3981 consume_skb(skb);
3982 skb = segs;
3983 }
3984 } else {
3985 /* we cannot process non-linear frames on this path */
3986 if (skb_linearize(skb)) {
3987 kfree_skb(skb);
3988 goto out;
3989 }
3990
3991 /* the frame could be fragmented, software-encrypted, and other
3992 * things so we cannot really handle checksum offload with it -
3993 * fix it up in software before we handle anything else.
3994 */
3995 if (skb->ip_summed == CHECKSUM_PARTIAL) {
3996 skb_set_transport_header(skb,
3997 skb_checksum_start_offset(skb));
3998 if (skb_checksum_help(skb))
3999 goto out_free;
4000 }
4001 }
4002
4003 skb_list_walk_safe(skb, skb, next) {
4004 skb_mark_not_on_list(skb);
4005
4006 if (skb->protocol == sdata->control_port_protocol)
4007 ctrl_flags |= IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP;
4008
4009 skb = ieee80211_build_hdr(sdata, skb, info_flags,
4010 sta, ctrl_flags, cookie);
4011 if (IS_ERR(skb)) {
4012 kfree_skb_list(next);
4013 goto out;
4014 }
4015
4016 dev_sw_netstats_tx_add(dev, 1, skb->len);
4017
4018 ieee80211_xmit(sdata, sta, skb);
4019 }
4020 goto out;
4021 out_free:
4022 kfree_skb(skb);
4023 out:
4024 rcu_read_unlock();
4025 }
4026
ieee80211_change_da(struct sk_buff * skb,struct sta_info * sta)4027 static int ieee80211_change_da(struct sk_buff *skb, struct sta_info *sta)
4028 {
4029 struct ethhdr *eth;
4030 int err;
4031
4032 err = skb_ensure_writable(skb, ETH_HLEN);
4033 if (unlikely(err))
4034 return err;
4035
4036 eth = (void *)skb->data;
4037 ether_addr_copy(eth->h_dest, sta->sta.addr);
4038
4039 return 0;
4040 }
4041
ieee80211_multicast_to_unicast(struct sk_buff * skb,struct net_device * dev)4042 static bool ieee80211_multicast_to_unicast(struct sk_buff *skb,
4043 struct net_device *dev)
4044 {
4045 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4046 const struct ethhdr *eth = (void *)skb->data;
4047 const struct vlan_ethhdr *ethvlan = (void *)skb->data;
4048 __be16 ethertype;
4049
4050 if (likely(!is_multicast_ether_addr(eth->h_dest)))
4051 return false;
4052
4053 switch (sdata->vif.type) {
4054 case NL80211_IFTYPE_AP_VLAN:
4055 if (sdata->u.vlan.sta)
4056 return false;
4057 if (sdata->wdev.use_4addr)
4058 return false;
4059 fallthrough;
4060 case NL80211_IFTYPE_AP:
4061 /* check runtime toggle for this bss */
4062 if (!sdata->bss->multicast_to_unicast)
4063 return false;
4064 break;
4065 default:
4066 return false;
4067 }
4068
4069 /* multicast to unicast conversion only for some payload */
4070 ethertype = eth->h_proto;
4071 if (ethertype == htons(ETH_P_8021Q) && skb->len >= VLAN_ETH_HLEN)
4072 ethertype = ethvlan->h_vlan_encapsulated_proto;
4073 switch (ethertype) {
4074 case htons(ETH_P_ARP):
4075 case htons(ETH_P_IP):
4076 case htons(ETH_P_IPV6):
4077 break;
4078 default:
4079 return false;
4080 }
4081
4082 return true;
4083 }
4084
4085 static void
ieee80211_convert_to_unicast(struct sk_buff * skb,struct net_device * dev,struct sk_buff_head * queue)4086 ieee80211_convert_to_unicast(struct sk_buff *skb, struct net_device *dev,
4087 struct sk_buff_head *queue)
4088 {
4089 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4090 struct ieee80211_local *local = sdata->local;
4091 const struct ethhdr *eth = (struct ethhdr *)skb->data;
4092 struct sta_info *sta, *first = NULL;
4093 struct sk_buff *cloned_skb;
4094
4095 rcu_read_lock();
4096
4097 list_for_each_entry_rcu(sta, &local->sta_list, list) {
4098 if (sdata != sta->sdata)
4099 /* AP-VLAN mismatch */
4100 continue;
4101 if (unlikely(ether_addr_equal(eth->h_source, sta->sta.addr)))
4102 /* do not send back to source */
4103 continue;
4104 if (!first) {
4105 first = sta;
4106 continue;
4107 }
4108 cloned_skb = skb_clone(skb, GFP_ATOMIC);
4109 if (!cloned_skb)
4110 goto multicast;
4111 if (unlikely(ieee80211_change_da(cloned_skb, sta))) {
4112 dev_kfree_skb(cloned_skb);
4113 goto multicast;
4114 }
4115 __skb_queue_tail(queue, cloned_skb);
4116 }
4117
4118 if (likely(first)) {
4119 if (unlikely(ieee80211_change_da(skb, first)))
4120 goto multicast;
4121 __skb_queue_tail(queue, skb);
4122 } else {
4123 /* no STA connected, drop */
4124 kfree_skb(skb);
4125 skb = NULL;
4126 }
4127
4128 goto out;
4129 multicast:
4130 __skb_queue_purge(queue);
4131 __skb_queue_tail(queue, skb);
4132 out:
4133 rcu_read_unlock();
4134 }
4135
4136 /**
4137 * ieee80211_subif_start_xmit - netif start_xmit function for 802.3 vifs
4138 * @skb: packet to be sent
4139 * @dev: incoming interface
4140 *
4141 * On failure skb will be freed.
4142 */
ieee80211_subif_start_xmit(struct sk_buff * skb,struct net_device * dev)4143 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
4144 struct net_device *dev)
4145 {
4146 if (unlikely(ieee80211_multicast_to_unicast(skb, dev))) {
4147 struct sk_buff_head queue;
4148
4149 __skb_queue_head_init(&queue);
4150 ieee80211_convert_to_unicast(skb, dev, &queue);
4151 while ((skb = __skb_dequeue(&queue)))
4152 __ieee80211_subif_start_xmit(skb, dev, 0, 0, NULL);
4153 } else {
4154 __ieee80211_subif_start_xmit(skb, dev, 0, 0, NULL);
4155 }
4156
4157 return NETDEV_TX_OK;
4158 }
4159
ieee80211_tx_8023(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int led_len,struct sta_info * sta,bool txpending)4160 static bool ieee80211_tx_8023(struct ieee80211_sub_if_data *sdata,
4161 struct sk_buff *skb, int led_len,
4162 struct sta_info *sta,
4163 bool txpending)
4164 {
4165 struct ieee80211_local *local = sdata->local;
4166 struct ieee80211_tx_control control = {};
4167 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
4168 struct ieee80211_sta *pubsta = NULL;
4169 unsigned long flags;
4170 int q = info->hw_queue;
4171
4172 if (sta)
4173 sk_pacing_shift_update(skb->sk, local->hw.tx_sk_pacing_shift);
4174
4175 if (ieee80211_queue_skb(local, sdata, sta, skb))
4176 return true;
4177
4178 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
4179
4180 if (local->queue_stop_reasons[q] ||
4181 (!txpending && !skb_queue_empty(&local->pending[q]))) {
4182 if (txpending)
4183 skb_queue_head(&local->pending[q], skb);
4184 else
4185 skb_queue_tail(&local->pending[q], skb);
4186
4187 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
4188
4189 return false;
4190 }
4191
4192 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
4193
4194 if (sta && sta->uploaded)
4195 pubsta = &sta->sta;
4196
4197 control.sta = pubsta;
4198
4199 drv_tx(local, &control, skb);
4200
4201 return true;
4202 }
4203
ieee80211_8023_xmit(struct ieee80211_sub_if_data * sdata,struct net_device * dev,struct sta_info * sta,struct ieee80211_key * key,struct sk_buff * skb)4204 static void ieee80211_8023_xmit(struct ieee80211_sub_if_data *sdata,
4205 struct net_device *dev, struct sta_info *sta,
4206 struct ieee80211_key *key, struct sk_buff *skb)
4207 {
4208 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
4209 struct ieee80211_local *local = sdata->local;
4210 struct tid_ampdu_tx *tid_tx;
4211 u8 tid;
4212
4213 if (local->ops->wake_tx_queue) {
4214 u16 queue = __ieee80211_select_queue(sdata, sta, skb);
4215 skb_set_queue_mapping(skb, queue);
4216 skb_get_hash(skb);
4217 }
4218
4219 if (unlikely(test_bit(SCAN_SW_SCANNING, &local->scanning)) &&
4220 test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))
4221 goto out_free;
4222
4223 memset(info, 0, sizeof(*info));
4224
4225 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
4226 tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
4227 if (tid_tx) {
4228 if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
4229 /* fall back to non-offload slow path */
4230 __ieee80211_subif_start_xmit(skb, dev, 0, 0, NULL);
4231 return;
4232 }
4233
4234 info->flags |= IEEE80211_TX_CTL_AMPDU;
4235 if (tid_tx->timeout)
4236 tid_tx->last_tx = jiffies;
4237 }
4238
4239 if (unlikely(skb->sk &&
4240 skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS))
4241 info->ack_frame_id = ieee80211_store_ack_skb(local, skb,
4242 &info->flags, NULL);
4243
4244 info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
4245
4246 dev_sw_netstats_tx_add(dev, 1, skb->len);
4247
4248 sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
4249 sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
4250
4251 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
4252 sdata = container_of(sdata->bss,
4253 struct ieee80211_sub_if_data, u.ap);
4254
4255 info->flags |= IEEE80211_TX_CTL_HW_80211_ENCAP;
4256 info->control.vif = &sdata->vif;
4257
4258 if (key)
4259 info->control.hw_key = &key->conf;
4260
4261 ieee80211_tx_8023(sdata, skb, skb->len, sta, false);
4262
4263 return;
4264
4265 out_free:
4266 kfree_skb(skb);
4267 }
4268
ieee80211_subif_start_xmit_8023(struct sk_buff * skb,struct net_device * dev)4269 netdev_tx_t ieee80211_subif_start_xmit_8023(struct sk_buff *skb,
4270 struct net_device *dev)
4271 {
4272 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4273 struct ethhdr *ehdr = (struct ethhdr *)skb->data;
4274 struct ieee80211_key *key;
4275 struct sta_info *sta;
4276
4277 if (unlikely(skb->len < ETH_HLEN)) {
4278 kfree_skb(skb);
4279 return NETDEV_TX_OK;
4280 }
4281
4282 rcu_read_lock();
4283
4284 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
4285 kfree_skb(skb);
4286 goto out;
4287 }
4288
4289 if (unlikely(IS_ERR_OR_NULL(sta) || !sta->uploaded ||
4290 !test_sta_flag(sta, WLAN_STA_AUTHORIZED) ||
4291 sdata->control_port_protocol == ehdr->h_proto))
4292 goto skip_offload;
4293
4294 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4295 if (!key)
4296 key = rcu_dereference(sdata->default_unicast_key);
4297
4298 if (key && (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) ||
4299 key->conf.cipher == WLAN_CIPHER_SUITE_TKIP))
4300 goto skip_offload;
4301
4302 ieee80211_8023_xmit(sdata, dev, sta, key, skb);
4303 goto out;
4304
4305 skip_offload:
4306 ieee80211_subif_start_xmit(skb, dev);
4307 out:
4308 rcu_read_unlock();
4309
4310 return NETDEV_TX_OK;
4311 }
4312
4313 struct sk_buff *
ieee80211_build_data_template(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,u32 info_flags)4314 ieee80211_build_data_template(struct ieee80211_sub_if_data *sdata,
4315 struct sk_buff *skb, u32 info_flags)
4316 {
4317 struct ieee80211_hdr *hdr;
4318 struct ieee80211_tx_data tx = {
4319 .local = sdata->local,
4320 .sdata = sdata,
4321 };
4322 struct sta_info *sta;
4323
4324 rcu_read_lock();
4325
4326 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
4327 kfree_skb(skb);
4328 skb = ERR_PTR(-EINVAL);
4329 goto out;
4330 }
4331
4332 skb = ieee80211_build_hdr(sdata, skb, info_flags, sta, 0, NULL);
4333 if (IS_ERR(skb))
4334 goto out;
4335
4336 hdr = (void *)skb->data;
4337 tx.sta = sta_info_get(sdata, hdr->addr1);
4338 tx.skb = skb;
4339
4340 if (ieee80211_tx_h_select_key(&tx) != TX_CONTINUE) {
4341 rcu_read_unlock();
4342 kfree_skb(skb);
4343 return ERR_PTR(-EINVAL);
4344 }
4345
4346 out:
4347 rcu_read_unlock();
4348 return skb;
4349 }
4350
4351 /*
4352 * ieee80211_clear_tx_pending may not be called in a context where
4353 * it is possible that it packets could come in again.
4354 */
ieee80211_clear_tx_pending(struct ieee80211_local * local)4355 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
4356 {
4357 struct sk_buff *skb;
4358 int i;
4359
4360 for (i = 0; i < local->hw.queues; i++) {
4361 while ((skb = skb_dequeue(&local->pending[i])) != NULL)
4362 ieee80211_free_txskb(&local->hw, skb);
4363 }
4364 }
4365
4366 /*
4367 * Returns false if the frame couldn't be transmitted but was queued instead,
4368 * which in this case means re-queued -- take as an indication to stop sending
4369 * more pending frames.
4370 */
ieee80211_tx_pending_skb(struct ieee80211_local * local,struct sk_buff * skb)4371 static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
4372 struct sk_buff *skb)
4373 {
4374 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
4375 struct ieee80211_sub_if_data *sdata;
4376 struct sta_info *sta;
4377 struct ieee80211_hdr *hdr;
4378 bool result;
4379 struct ieee80211_chanctx_conf *chanctx_conf;
4380
4381 sdata = vif_to_sdata(info->control.vif);
4382
4383 if (info->control.flags & IEEE80211_TX_INTCFL_NEED_TXPROCESSING) {
4384 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4385 if (unlikely(!chanctx_conf)) {
4386 dev_kfree_skb(skb);
4387 return true;
4388 }
4389 info->band = chanctx_conf->def.chan->band;
4390 result = ieee80211_tx(sdata, NULL, skb, true);
4391 } else if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
4392 if (ieee80211_lookup_ra_sta(sdata, skb, &sta)) {
4393 dev_kfree_skb(skb);
4394 return true;
4395 }
4396
4397 if (IS_ERR(sta) || (sta && !sta->uploaded))
4398 sta = NULL;
4399
4400 result = ieee80211_tx_8023(sdata, skb, skb->len, sta, true);
4401 } else {
4402 struct sk_buff_head skbs;
4403
4404 __skb_queue_head_init(&skbs);
4405 __skb_queue_tail(&skbs, skb);
4406
4407 hdr = (struct ieee80211_hdr *)skb->data;
4408 sta = sta_info_get(sdata, hdr->addr1);
4409
4410 result = __ieee80211_tx(local, &skbs, skb->len, sta, true);
4411 }
4412
4413 return result;
4414 }
4415
4416 /*
4417 * Transmit all pending packets. Called from tasklet.
4418 */
ieee80211_tx_pending(struct tasklet_struct * t)4419 void ieee80211_tx_pending(struct tasklet_struct *t)
4420 {
4421 struct ieee80211_local *local = from_tasklet(local, t,
4422 tx_pending_tasklet);
4423 unsigned long flags;
4424 int i;
4425 bool txok;
4426
4427 rcu_read_lock();
4428
4429 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
4430 for (i = 0; i < local->hw.queues; i++) {
4431 /*
4432 * If queue is stopped by something other than due to pending
4433 * frames, or we have no pending frames, proceed to next queue.
4434 */
4435 if (local->queue_stop_reasons[i] ||
4436 skb_queue_empty(&local->pending[i]))
4437 continue;
4438
4439 while (!skb_queue_empty(&local->pending[i])) {
4440 struct sk_buff *skb = __skb_dequeue(&local->pending[i]);
4441 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
4442
4443 if (WARN_ON(!info->control.vif)) {
4444 ieee80211_free_txskb(&local->hw, skb);
4445 continue;
4446 }
4447
4448 spin_unlock_irqrestore(&local->queue_stop_reason_lock,
4449 flags);
4450
4451 txok = ieee80211_tx_pending_skb(local, skb);
4452 spin_lock_irqsave(&local->queue_stop_reason_lock,
4453 flags);
4454 if (!txok)
4455 break;
4456 }
4457
4458 if (skb_queue_empty(&local->pending[i]))
4459 ieee80211_propagate_queue_wake(local, i);
4460 }
4461 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
4462
4463 rcu_read_unlock();
4464 }
4465
4466 /* functions for drivers to get certain frames */
4467
__ieee80211_beacon_add_tim(struct ieee80211_sub_if_data * sdata,struct ps_data * ps,struct sk_buff * skb,bool is_template)4468 static void __ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
4469 struct ps_data *ps, struct sk_buff *skb,
4470 bool is_template)
4471 {
4472 u8 *pos, *tim;
4473 int aid0 = 0;
4474 int i, have_bits = 0, n1, n2;
4475
4476 /* Generate bitmap for TIM only if there are any STAs in power save
4477 * mode. */
4478 if (atomic_read(&ps->num_sta_ps) > 0)
4479 /* in the hope that this is faster than
4480 * checking byte-for-byte */
4481 have_bits = !bitmap_empty((unsigned long *)ps->tim,
4482 IEEE80211_MAX_AID+1);
4483 if (!is_template) {
4484 if (ps->dtim_count == 0)
4485 ps->dtim_count = sdata->vif.bss_conf.dtim_period - 1;
4486 else
4487 ps->dtim_count--;
4488 }
4489
4490 tim = pos = skb_put(skb, 6);
4491 *pos++ = WLAN_EID_TIM;
4492 *pos++ = 4;
4493 *pos++ = ps->dtim_count;
4494 *pos++ = sdata->vif.bss_conf.dtim_period;
4495
4496 if (ps->dtim_count == 0 && !skb_queue_empty(&ps->bc_buf))
4497 aid0 = 1;
4498
4499 ps->dtim_bc_mc = aid0 == 1;
4500
4501 if (have_bits) {
4502 /* Find largest even number N1 so that bits numbered 1 through
4503 * (N1 x 8) - 1 in the bitmap are 0 and number N2 so that bits
4504 * (N2 + 1) x 8 through 2007 are 0. */
4505 n1 = 0;
4506 for (i = 0; i < IEEE80211_MAX_TIM_LEN; i++) {
4507 if (ps->tim[i]) {
4508 n1 = i & 0xfe;
4509 break;
4510 }
4511 }
4512 n2 = n1;
4513 for (i = IEEE80211_MAX_TIM_LEN - 1; i >= n1; i--) {
4514 if (ps->tim[i]) {
4515 n2 = i;
4516 break;
4517 }
4518 }
4519
4520 /* Bitmap control */
4521 *pos++ = n1 | aid0;
4522 /* Part Virt Bitmap */
4523 skb_put(skb, n2 - n1);
4524 memcpy(pos, ps->tim + n1, n2 - n1 + 1);
4525
4526 tim[1] = n2 - n1 + 4;
4527 } else {
4528 *pos++ = aid0; /* Bitmap control */
4529 *pos++ = 0; /* Part Virt Bitmap */
4530 }
4531 }
4532
ieee80211_beacon_add_tim(struct ieee80211_sub_if_data * sdata,struct ps_data * ps,struct sk_buff * skb,bool is_template)4533 static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
4534 struct ps_data *ps, struct sk_buff *skb,
4535 bool is_template)
4536 {
4537 struct ieee80211_local *local = sdata->local;
4538
4539 /*
4540 * Not very nice, but we want to allow the driver to call
4541 * ieee80211_beacon_get() as a response to the set_tim()
4542 * callback. That, however, is already invoked under the
4543 * sta_lock to guarantee consistent and race-free update
4544 * of the tim bitmap in mac80211 and the driver.
4545 */
4546 if (local->tim_in_locked_section) {
4547 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
4548 } else {
4549 spin_lock_bh(&local->tim_lock);
4550 __ieee80211_beacon_add_tim(sdata, ps, skb, is_template);
4551 spin_unlock_bh(&local->tim_lock);
4552 }
4553
4554 return 0;
4555 }
4556
ieee80211_set_beacon_cntdwn(struct ieee80211_sub_if_data * sdata,struct beacon_data * beacon)4557 static void ieee80211_set_beacon_cntdwn(struct ieee80211_sub_if_data *sdata,
4558 struct beacon_data *beacon)
4559 {
4560 struct probe_resp *resp;
4561 u8 *beacon_data;
4562 size_t beacon_data_len;
4563 int i;
4564 u8 count = beacon->cntdwn_current_counter;
4565
4566 switch (sdata->vif.type) {
4567 case NL80211_IFTYPE_AP:
4568 beacon_data = beacon->tail;
4569 beacon_data_len = beacon->tail_len;
4570 break;
4571 case NL80211_IFTYPE_ADHOC:
4572 beacon_data = beacon->head;
4573 beacon_data_len = beacon->head_len;
4574 break;
4575 case NL80211_IFTYPE_MESH_POINT:
4576 beacon_data = beacon->head;
4577 beacon_data_len = beacon->head_len;
4578 break;
4579 default:
4580 return;
4581 }
4582
4583 rcu_read_lock();
4584 for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; ++i) {
4585 resp = rcu_dereference(sdata->u.ap.probe_resp);
4586
4587 if (beacon->cntdwn_counter_offsets[i]) {
4588 if (WARN_ON_ONCE(beacon->cntdwn_counter_offsets[i] >=
4589 beacon_data_len)) {
4590 rcu_read_unlock();
4591 return;
4592 }
4593
4594 beacon_data[beacon->cntdwn_counter_offsets[i]] = count;
4595 }
4596
4597 if (sdata->vif.type == NL80211_IFTYPE_AP && resp)
4598 resp->data[resp->cntdwn_counter_offsets[i]] = count;
4599 }
4600 rcu_read_unlock();
4601 }
4602
__ieee80211_beacon_update_cntdwn(struct beacon_data * beacon)4603 static u8 __ieee80211_beacon_update_cntdwn(struct beacon_data *beacon)
4604 {
4605 beacon->cntdwn_current_counter--;
4606
4607 /* the counter should never reach 0 */
4608 WARN_ON_ONCE(!beacon->cntdwn_current_counter);
4609
4610 return beacon->cntdwn_current_counter;
4611 }
4612
ieee80211_beacon_update_cntdwn(struct ieee80211_vif * vif)4613 u8 ieee80211_beacon_update_cntdwn(struct ieee80211_vif *vif)
4614 {
4615 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4616 struct beacon_data *beacon = NULL;
4617 u8 count = 0;
4618
4619 rcu_read_lock();
4620
4621 if (sdata->vif.type == NL80211_IFTYPE_AP)
4622 beacon = rcu_dereference(sdata->u.ap.beacon);
4623 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
4624 beacon = rcu_dereference(sdata->u.ibss.presp);
4625 else if (ieee80211_vif_is_mesh(&sdata->vif))
4626 beacon = rcu_dereference(sdata->u.mesh.beacon);
4627
4628 if (!beacon)
4629 goto unlock;
4630
4631 count = __ieee80211_beacon_update_cntdwn(beacon);
4632
4633 unlock:
4634 rcu_read_unlock();
4635 return count;
4636 }
4637 EXPORT_SYMBOL(ieee80211_beacon_update_cntdwn);
4638
ieee80211_beacon_set_cntdwn(struct ieee80211_vif * vif,u8 counter)4639 void ieee80211_beacon_set_cntdwn(struct ieee80211_vif *vif, u8 counter)
4640 {
4641 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4642 struct beacon_data *beacon = NULL;
4643
4644 rcu_read_lock();
4645
4646 if (sdata->vif.type == NL80211_IFTYPE_AP)
4647 beacon = rcu_dereference(sdata->u.ap.beacon);
4648 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
4649 beacon = rcu_dereference(sdata->u.ibss.presp);
4650 else if (ieee80211_vif_is_mesh(&sdata->vif))
4651 beacon = rcu_dereference(sdata->u.mesh.beacon);
4652
4653 if (!beacon)
4654 goto unlock;
4655
4656 if (counter < beacon->cntdwn_current_counter)
4657 beacon->cntdwn_current_counter = counter;
4658
4659 unlock:
4660 rcu_read_unlock();
4661 }
4662 EXPORT_SYMBOL(ieee80211_beacon_set_cntdwn);
4663
ieee80211_beacon_cntdwn_is_complete(struct ieee80211_vif * vif)4664 bool ieee80211_beacon_cntdwn_is_complete(struct ieee80211_vif *vif)
4665 {
4666 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4667 struct beacon_data *beacon = NULL;
4668 u8 *beacon_data;
4669 size_t beacon_data_len;
4670 int ret = false;
4671
4672 if (!ieee80211_sdata_running(sdata))
4673 return false;
4674
4675 rcu_read_lock();
4676 if (vif->type == NL80211_IFTYPE_AP) {
4677 struct ieee80211_if_ap *ap = &sdata->u.ap;
4678
4679 beacon = rcu_dereference(ap->beacon);
4680 if (WARN_ON(!beacon || !beacon->tail))
4681 goto out;
4682 beacon_data = beacon->tail;
4683 beacon_data_len = beacon->tail_len;
4684 } else if (vif->type == NL80211_IFTYPE_ADHOC) {
4685 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
4686
4687 beacon = rcu_dereference(ifibss->presp);
4688 if (!beacon)
4689 goto out;
4690
4691 beacon_data = beacon->head;
4692 beacon_data_len = beacon->head_len;
4693 } else if (vif->type == NL80211_IFTYPE_MESH_POINT) {
4694 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
4695
4696 beacon = rcu_dereference(ifmsh->beacon);
4697 if (!beacon)
4698 goto out;
4699
4700 beacon_data = beacon->head;
4701 beacon_data_len = beacon->head_len;
4702 } else {
4703 WARN_ON(1);
4704 goto out;
4705 }
4706
4707 if (!beacon->cntdwn_counter_offsets[0])
4708 goto out;
4709
4710 if (WARN_ON_ONCE(beacon->cntdwn_counter_offsets[0] > beacon_data_len))
4711 goto out;
4712
4713 if (beacon_data[beacon->cntdwn_counter_offsets[0]] == 1)
4714 ret = true;
4715
4716 out:
4717 rcu_read_unlock();
4718
4719 return ret;
4720 }
4721 EXPORT_SYMBOL(ieee80211_beacon_cntdwn_is_complete);
4722
ieee80211_beacon_protect(struct sk_buff * skb,struct ieee80211_local * local,struct ieee80211_sub_if_data * sdata)4723 static int ieee80211_beacon_protect(struct sk_buff *skb,
4724 struct ieee80211_local *local,
4725 struct ieee80211_sub_if_data *sdata)
4726 {
4727 ieee80211_tx_result res;
4728 struct ieee80211_tx_data tx;
4729 struct sk_buff *check_skb;
4730
4731 memset(&tx, 0, sizeof(tx));
4732 tx.key = rcu_dereference(sdata->default_beacon_key);
4733 if (!tx.key)
4734 return 0;
4735 tx.local = local;
4736 tx.sdata = sdata;
4737 __skb_queue_head_init(&tx.skbs);
4738 __skb_queue_tail(&tx.skbs, skb);
4739 res = ieee80211_tx_h_encrypt(&tx);
4740 check_skb = __skb_dequeue(&tx.skbs);
4741 /* we may crash after this, but it'd be a bug in crypto */
4742 WARN_ON(check_skb != skb);
4743 if (WARN_ON_ONCE(res != TX_CONTINUE))
4744 return -EINVAL;
4745
4746 return 0;
4747 }
4748
4749 static struct sk_buff *
__ieee80211_beacon_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_mutable_offsets * offs,bool is_template)4750 __ieee80211_beacon_get(struct ieee80211_hw *hw,
4751 struct ieee80211_vif *vif,
4752 struct ieee80211_mutable_offsets *offs,
4753 bool is_template)
4754 {
4755 struct ieee80211_local *local = hw_to_local(hw);
4756 struct beacon_data *beacon = NULL;
4757 struct sk_buff *skb = NULL;
4758 struct ieee80211_tx_info *info;
4759 struct ieee80211_sub_if_data *sdata = NULL;
4760 enum nl80211_band band;
4761 struct ieee80211_tx_rate_control txrc;
4762 struct ieee80211_chanctx_conf *chanctx_conf;
4763 int csa_off_base = 0;
4764
4765 rcu_read_lock();
4766
4767 sdata = vif_to_sdata(vif);
4768 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
4769
4770 if (!ieee80211_sdata_running(sdata) || !chanctx_conf)
4771 goto out;
4772
4773 if (offs)
4774 memset(offs, 0, sizeof(*offs));
4775
4776 if (sdata->vif.type == NL80211_IFTYPE_AP) {
4777 struct ieee80211_if_ap *ap = &sdata->u.ap;
4778
4779 beacon = rcu_dereference(ap->beacon);
4780 if (beacon) {
4781 if (beacon->cntdwn_counter_offsets[0]) {
4782 if (!is_template)
4783 ieee80211_beacon_update_cntdwn(vif);
4784
4785 ieee80211_set_beacon_cntdwn(sdata, beacon);
4786 }
4787
4788 /*
4789 * headroom, head length,
4790 * tail length and maximum TIM length
4791 */
4792 skb = dev_alloc_skb(local->tx_headroom +
4793 beacon->head_len +
4794 beacon->tail_len + 256 +
4795 local->hw.extra_beacon_tailroom);
4796 if (!skb)
4797 goto out;
4798
4799 skb_reserve(skb, local->tx_headroom);
4800 skb_put_data(skb, beacon->head, beacon->head_len);
4801
4802 ieee80211_beacon_add_tim(sdata, &ap->ps, skb,
4803 is_template);
4804
4805 if (offs) {
4806 offs->tim_offset = beacon->head_len;
4807 offs->tim_length = skb->len - beacon->head_len;
4808
4809 /* for AP the csa offsets are from tail */
4810 csa_off_base = skb->len;
4811 }
4812
4813 if (beacon->tail)
4814 skb_put_data(skb, beacon->tail,
4815 beacon->tail_len);
4816
4817 if (ieee80211_beacon_protect(skb, local, sdata) < 0)
4818 goto out;
4819 } else
4820 goto out;
4821 } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) {
4822 struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
4823 struct ieee80211_hdr *hdr;
4824
4825 beacon = rcu_dereference(ifibss->presp);
4826 if (!beacon)
4827 goto out;
4828
4829 if (beacon->cntdwn_counter_offsets[0]) {
4830 if (!is_template)
4831 __ieee80211_beacon_update_cntdwn(beacon);
4832
4833 ieee80211_set_beacon_cntdwn(sdata, beacon);
4834 }
4835
4836 skb = dev_alloc_skb(local->tx_headroom + beacon->head_len +
4837 local->hw.extra_beacon_tailroom);
4838 if (!skb)
4839 goto out;
4840 skb_reserve(skb, local->tx_headroom);
4841 skb_put_data(skb, beacon->head, beacon->head_len);
4842
4843 hdr = (struct ieee80211_hdr *) skb->data;
4844 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
4845 IEEE80211_STYPE_BEACON);
4846 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
4847 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
4848
4849 beacon = rcu_dereference(ifmsh->beacon);
4850 if (!beacon)
4851 goto out;
4852
4853 if (beacon->cntdwn_counter_offsets[0]) {
4854 if (!is_template)
4855 /* TODO: For mesh csa_counter is in TU, so
4856 * decrementing it by one isn't correct, but
4857 * for now we leave it consistent with overall
4858 * mac80211's behavior.
4859 */
4860 __ieee80211_beacon_update_cntdwn(beacon);
4861
4862 ieee80211_set_beacon_cntdwn(sdata, beacon);
4863 }
4864
4865 if (ifmsh->sync_ops)
4866 ifmsh->sync_ops->adjust_tsf(sdata, beacon);
4867
4868 skb = dev_alloc_skb(local->tx_headroom +
4869 beacon->head_len +
4870 256 + /* TIM IE */
4871 beacon->tail_len +
4872 local->hw.extra_beacon_tailroom);
4873 if (!skb)
4874 goto out;
4875 skb_reserve(skb, local->tx_headroom);
4876 skb_put_data(skb, beacon->head, beacon->head_len);
4877 ieee80211_beacon_add_tim(sdata, &ifmsh->ps, skb, is_template);
4878
4879 if (offs) {
4880 offs->tim_offset = beacon->head_len;
4881 offs->tim_length = skb->len - beacon->head_len;
4882 }
4883
4884 skb_put_data(skb, beacon->tail, beacon->tail_len);
4885 } else {
4886 WARN_ON(1);
4887 goto out;
4888 }
4889
4890 /* CSA offsets */
4891 if (offs && beacon) {
4892 int i;
4893
4894 for (i = 0; i < IEEE80211_MAX_CNTDWN_COUNTERS_NUM; i++) {
4895 u16 csa_off = beacon->cntdwn_counter_offsets[i];
4896
4897 if (!csa_off)
4898 continue;
4899
4900 offs->cntdwn_counter_offs[i] = csa_off_base + csa_off;
4901 }
4902 }
4903
4904 band = chanctx_conf->def.chan->band;
4905
4906 info = IEEE80211_SKB_CB(skb);
4907
4908 info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
4909 info->flags |= IEEE80211_TX_CTL_NO_ACK;
4910 info->band = band;
4911
4912 memset(&txrc, 0, sizeof(txrc));
4913 txrc.hw = hw;
4914 txrc.sband = local->hw.wiphy->bands[band];
4915 txrc.bss_conf = &sdata->vif.bss_conf;
4916 txrc.skb = skb;
4917 txrc.reported_rate.idx = -1;
4918 if (sdata->beacon_rate_set && sdata->beacon_rateidx_mask[band])
4919 txrc.rate_idx_mask = sdata->beacon_rateidx_mask[band];
4920 else
4921 txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
4922 txrc.bss = true;
4923 rate_control_get_rate(sdata, NULL, &txrc);
4924
4925 info->control.vif = vif;
4926
4927 info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT |
4928 IEEE80211_TX_CTL_ASSIGN_SEQ |
4929 IEEE80211_TX_CTL_FIRST_FRAGMENT;
4930 out:
4931 rcu_read_unlock();
4932 return skb;
4933
4934 }
4935
4936 struct sk_buff *
ieee80211_beacon_get_template(struct ieee80211_hw * hw,struct ieee80211_vif * vif,struct ieee80211_mutable_offsets * offs)4937 ieee80211_beacon_get_template(struct ieee80211_hw *hw,
4938 struct ieee80211_vif *vif,
4939 struct ieee80211_mutable_offsets *offs)
4940 {
4941 return __ieee80211_beacon_get(hw, vif, offs, true);
4942 }
4943 EXPORT_SYMBOL(ieee80211_beacon_get_template);
4944
ieee80211_beacon_get_tim(struct ieee80211_hw * hw,struct ieee80211_vif * vif,u16 * tim_offset,u16 * tim_length)4945 struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
4946 struct ieee80211_vif *vif,
4947 u16 *tim_offset, u16 *tim_length)
4948 {
4949 struct ieee80211_mutable_offsets offs = {};
4950 struct sk_buff *bcn = __ieee80211_beacon_get(hw, vif, &offs, false);
4951 struct sk_buff *copy;
4952 struct ieee80211_supported_band *sband;
4953 int shift;
4954
4955 if (!bcn)
4956 return bcn;
4957
4958 if (tim_offset)
4959 *tim_offset = offs.tim_offset;
4960
4961 if (tim_length)
4962 *tim_length = offs.tim_length;
4963
4964 if (ieee80211_hw_check(hw, BEACON_TX_STATUS) ||
4965 !hw_to_local(hw)->monitors)
4966 return bcn;
4967
4968 /* send a copy to monitor interfaces */
4969 copy = skb_copy(bcn, GFP_ATOMIC);
4970 if (!copy)
4971 return bcn;
4972
4973 shift = ieee80211_vif_get_shift(vif);
4974 sband = ieee80211_get_sband(vif_to_sdata(vif));
4975 if (!sband)
4976 return bcn;
4977
4978 ieee80211_tx_monitor(hw_to_local(hw), copy, sband, 1, shift, false,
4979 NULL);
4980
4981 return bcn;
4982 }
4983 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
4984
ieee80211_proberesp_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif)4985 struct sk_buff *ieee80211_proberesp_get(struct ieee80211_hw *hw,
4986 struct ieee80211_vif *vif)
4987 {
4988 struct ieee80211_if_ap *ap = NULL;
4989 struct sk_buff *skb = NULL;
4990 struct probe_resp *presp = NULL;
4991 struct ieee80211_hdr *hdr;
4992 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
4993
4994 if (sdata->vif.type != NL80211_IFTYPE_AP)
4995 return NULL;
4996
4997 rcu_read_lock();
4998
4999 ap = &sdata->u.ap;
5000 presp = rcu_dereference(ap->probe_resp);
5001 if (!presp)
5002 goto out;
5003
5004 skb = dev_alloc_skb(presp->len);
5005 if (!skb)
5006 goto out;
5007
5008 skb_put_data(skb, presp->data, presp->len);
5009
5010 hdr = (struct ieee80211_hdr *) skb->data;
5011 memset(hdr->addr1, 0, sizeof(hdr->addr1));
5012
5013 out:
5014 rcu_read_unlock();
5015 return skb;
5016 }
5017 EXPORT_SYMBOL(ieee80211_proberesp_get);
5018
ieee80211_get_fils_discovery_tmpl(struct ieee80211_hw * hw,struct ieee80211_vif * vif)5019 struct sk_buff *ieee80211_get_fils_discovery_tmpl(struct ieee80211_hw *hw,
5020 struct ieee80211_vif *vif)
5021 {
5022 struct sk_buff *skb = NULL;
5023 struct fils_discovery_data *tmpl = NULL;
5024 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5025
5026 if (sdata->vif.type != NL80211_IFTYPE_AP)
5027 return NULL;
5028
5029 rcu_read_lock();
5030 tmpl = rcu_dereference(sdata->u.ap.fils_discovery);
5031 if (!tmpl) {
5032 rcu_read_unlock();
5033 return NULL;
5034 }
5035
5036 skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom + tmpl->len);
5037 if (skb) {
5038 skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
5039 skb_put_data(skb, tmpl->data, tmpl->len);
5040 }
5041
5042 rcu_read_unlock();
5043 return skb;
5044 }
5045 EXPORT_SYMBOL(ieee80211_get_fils_discovery_tmpl);
5046
5047 struct sk_buff *
ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw * hw,struct ieee80211_vif * vif)5048 ieee80211_get_unsol_bcast_probe_resp_tmpl(struct ieee80211_hw *hw,
5049 struct ieee80211_vif *vif)
5050 {
5051 struct sk_buff *skb = NULL;
5052 struct unsol_bcast_probe_resp_data *tmpl = NULL;
5053 struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
5054
5055 if (sdata->vif.type != NL80211_IFTYPE_AP)
5056 return NULL;
5057
5058 rcu_read_lock();
5059 tmpl = rcu_dereference(sdata->u.ap.unsol_bcast_probe_resp);
5060 if (!tmpl) {
5061 rcu_read_unlock();
5062 return NULL;
5063 }
5064
5065 skb = dev_alloc_skb(sdata->local->hw.extra_tx_headroom + tmpl->len);
5066 if (skb) {
5067 skb_reserve(skb, sdata->local->hw.extra_tx_headroom);
5068 skb_put_data(skb, tmpl->data, tmpl->len);
5069 }
5070
5071 rcu_read_unlock();
5072 return skb;
5073 }
5074 EXPORT_SYMBOL(ieee80211_get_unsol_bcast_probe_resp_tmpl);
5075
ieee80211_pspoll_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif)5076 struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
5077 struct ieee80211_vif *vif)
5078 {
5079 struct ieee80211_sub_if_data *sdata;
5080 struct ieee80211_if_managed *ifmgd;
5081 struct ieee80211_pspoll *pspoll;
5082 struct ieee80211_local *local;
5083 struct sk_buff *skb;
5084
5085 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
5086 return NULL;
5087
5088 sdata = vif_to_sdata(vif);
5089 ifmgd = &sdata->u.mgd;
5090 local = sdata->local;
5091
5092 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
5093 if (!skb)
5094 return NULL;
5095
5096 skb_reserve(skb, local->hw.extra_tx_headroom);
5097
5098 pspoll = skb_put_zero(skb, sizeof(*pspoll));
5099 pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
5100 IEEE80211_STYPE_PSPOLL);
5101 pspoll->aid = cpu_to_le16(sdata->vif.bss_conf.aid);
5102
5103 /* aid in PS-Poll has its two MSBs each set to 1 */
5104 pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
5105
5106 memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
5107 memcpy(pspoll->ta, vif->addr, ETH_ALEN);
5108
5109 return skb;
5110 }
5111 EXPORT_SYMBOL(ieee80211_pspoll_get);
5112
ieee80211_nullfunc_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif,bool qos_ok)5113 struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
5114 struct ieee80211_vif *vif,
5115 bool qos_ok)
5116 {
5117 struct ieee80211_hdr_3addr *nullfunc;
5118 struct ieee80211_sub_if_data *sdata;
5119 struct ieee80211_if_managed *ifmgd;
5120 struct ieee80211_local *local;
5121 struct sk_buff *skb;
5122 bool qos = false;
5123
5124 if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
5125 return NULL;
5126
5127 sdata = vif_to_sdata(vif);
5128 ifmgd = &sdata->u.mgd;
5129 local = sdata->local;
5130
5131 if (qos_ok) {
5132 struct sta_info *sta;
5133
5134 rcu_read_lock();
5135 sta = sta_info_get(sdata, ifmgd->bssid);
5136 qos = sta && sta->sta.wme;
5137 rcu_read_unlock();
5138 }
5139
5140 skb = dev_alloc_skb(local->hw.extra_tx_headroom +
5141 sizeof(*nullfunc) + 2);
5142 if (!skb)
5143 return NULL;
5144
5145 skb_reserve(skb, local->hw.extra_tx_headroom);
5146
5147 nullfunc = skb_put_zero(skb, sizeof(*nullfunc));
5148 nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
5149 IEEE80211_STYPE_NULLFUNC |
5150 IEEE80211_FCTL_TODS);
5151 if (qos) {
5152 __le16 qoshdr = cpu_to_le16(7);
5153
5154 BUILD_BUG_ON((IEEE80211_STYPE_QOS_NULLFUNC |
5155 IEEE80211_STYPE_NULLFUNC) !=
5156 IEEE80211_STYPE_QOS_NULLFUNC);
5157 nullfunc->frame_control |=
5158 cpu_to_le16(IEEE80211_STYPE_QOS_NULLFUNC);
5159 skb->priority = 7;
5160 skb_set_queue_mapping(skb, IEEE80211_AC_VO);
5161 skb_put_data(skb, &qoshdr, sizeof(qoshdr));
5162 }
5163
5164 memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
5165 memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
5166 memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
5167
5168 return skb;
5169 }
5170 EXPORT_SYMBOL(ieee80211_nullfunc_get);
5171
ieee80211_probereq_get(struct ieee80211_hw * hw,const u8 * src_addr,const u8 * ssid,size_t ssid_len,size_t tailroom)5172 struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
5173 const u8 *src_addr,
5174 const u8 *ssid, size_t ssid_len,
5175 size_t tailroom)
5176 {
5177 struct ieee80211_local *local = hw_to_local(hw);
5178 struct ieee80211_hdr_3addr *hdr;
5179 struct sk_buff *skb;
5180 size_t ie_ssid_len;
5181 u8 *pos;
5182
5183 ie_ssid_len = 2 + ssid_len;
5184
5185 skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
5186 ie_ssid_len + tailroom);
5187 if (!skb)
5188 return NULL;
5189
5190 skb_reserve(skb, local->hw.extra_tx_headroom);
5191
5192 hdr = skb_put_zero(skb, sizeof(*hdr));
5193 hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
5194 IEEE80211_STYPE_PROBE_REQ);
5195 eth_broadcast_addr(hdr->addr1);
5196 memcpy(hdr->addr2, src_addr, ETH_ALEN);
5197 eth_broadcast_addr(hdr->addr3);
5198
5199 pos = skb_put(skb, ie_ssid_len);
5200 *pos++ = WLAN_EID_SSID;
5201 *pos++ = ssid_len;
5202 if (ssid_len)
5203 memcpy(pos, ssid, ssid_len);
5204 pos += ssid_len;
5205
5206 return skb;
5207 }
5208 EXPORT_SYMBOL(ieee80211_probereq_get);
5209
ieee80211_rts_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif,const void * frame,size_t frame_len,const struct ieee80211_tx_info * frame_txctl,struct ieee80211_rts * rts)5210 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5211 const void *frame, size_t frame_len,
5212 const struct ieee80211_tx_info *frame_txctl,
5213 struct ieee80211_rts *rts)
5214 {
5215 const struct ieee80211_hdr *hdr = frame;
5216
5217 rts->frame_control =
5218 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_RTS);
5219 rts->duration = ieee80211_rts_duration(hw, vif, frame_len,
5220 frame_txctl);
5221 memcpy(rts->ra, hdr->addr1, sizeof(rts->ra));
5222 memcpy(rts->ta, hdr->addr2, sizeof(rts->ta));
5223 }
5224 EXPORT_SYMBOL(ieee80211_rts_get);
5225
ieee80211_ctstoself_get(struct ieee80211_hw * hw,struct ieee80211_vif * vif,const void * frame,size_t frame_len,const struct ieee80211_tx_info * frame_txctl,struct ieee80211_cts * cts)5226 void ieee80211_ctstoself_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
5227 const void *frame, size_t frame_len,
5228 const struct ieee80211_tx_info *frame_txctl,
5229 struct ieee80211_cts *cts)
5230 {
5231 const struct ieee80211_hdr *hdr = frame;
5232
5233 cts->frame_control =
5234 cpu_to_le16(IEEE80211_FTYPE_CTL | IEEE80211_STYPE_CTS);
5235 cts->duration = ieee80211_ctstoself_duration(hw, vif,
5236 frame_len, frame_txctl);
5237 memcpy(cts->ra, hdr->addr1, sizeof(cts->ra));
5238 }
5239 EXPORT_SYMBOL(ieee80211_ctstoself_get);
5240
5241 struct sk_buff *
ieee80211_get_buffered_bc(struct ieee80211_hw * hw,struct ieee80211_vif * vif)5242 ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
5243 struct ieee80211_vif *vif)
5244 {
5245 struct ieee80211_local *local = hw_to_local(hw);
5246 struct sk_buff *skb = NULL;
5247 struct ieee80211_tx_data tx;
5248 struct ieee80211_sub_if_data *sdata;
5249 struct ps_data *ps;
5250 struct ieee80211_tx_info *info;
5251 struct ieee80211_chanctx_conf *chanctx_conf;
5252
5253 sdata = vif_to_sdata(vif);
5254
5255 rcu_read_lock();
5256 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
5257
5258 if (!chanctx_conf)
5259 goto out;
5260
5261 if (sdata->vif.type == NL80211_IFTYPE_AP) {
5262 struct beacon_data *beacon =
5263 rcu_dereference(sdata->u.ap.beacon);
5264
5265 if (!beacon || !beacon->head)
5266 goto out;
5267
5268 ps = &sdata->u.ap.ps;
5269 } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
5270 ps = &sdata->u.mesh.ps;
5271 } else {
5272 goto out;
5273 }
5274
5275 if (ps->dtim_count != 0 || !ps->dtim_bc_mc)
5276 goto out; /* send buffered bc/mc only after DTIM beacon */
5277
5278 while (1) {
5279 skb = skb_dequeue(&ps->bc_buf);
5280 if (!skb)
5281 goto out;
5282 local->total_ps_buffered--;
5283
5284 if (!skb_queue_empty(&ps->bc_buf) && skb->len >= 2) {
5285 struct ieee80211_hdr *hdr =
5286 (struct ieee80211_hdr *) skb->data;
5287 /* more buffered multicast/broadcast frames ==> set
5288 * MoreData flag in IEEE 802.11 header to inform PS
5289 * STAs */
5290 hdr->frame_control |=
5291 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
5292 }
5293
5294 if (sdata->vif.type == NL80211_IFTYPE_AP)
5295 sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
5296 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
5297 break;
5298 ieee80211_free_txskb(hw, skb);
5299 }
5300
5301 info = IEEE80211_SKB_CB(skb);
5302
5303 tx.flags |= IEEE80211_TX_PS_BUFFERED;
5304 info->band = chanctx_conf->def.chan->band;
5305
5306 if (invoke_tx_handlers(&tx))
5307 skb = NULL;
5308 out:
5309 rcu_read_unlock();
5310
5311 return skb;
5312 }
5313 EXPORT_SYMBOL(ieee80211_get_buffered_bc);
5314
ieee80211_reserve_tid(struct ieee80211_sta * pubsta,u8 tid)5315 int ieee80211_reserve_tid(struct ieee80211_sta *pubsta, u8 tid)
5316 {
5317 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
5318 struct ieee80211_sub_if_data *sdata = sta->sdata;
5319 struct ieee80211_local *local = sdata->local;
5320 int ret;
5321 u32 queues;
5322
5323 lockdep_assert_held(&local->sta_mtx);
5324
5325 /* only some cases are supported right now */
5326 switch (sdata->vif.type) {
5327 case NL80211_IFTYPE_STATION:
5328 case NL80211_IFTYPE_AP:
5329 case NL80211_IFTYPE_AP_VLAN:
5330 break;
5331 default:
5332 WARN_ON(1);
5333 return -EINVAL;
5334 }
5335
5336 if (WARN_ON(tid >= IEEE80211_NUM_UPS))
5337 return -EINVAL;
5338
5339 if (sta->reserved_tid == tid) {
5340 ret = 0;
5341 goto out;
5342 }
5343
5344 if (sta->reserved_tid != IEEE80211_TID_UNRESERVED) {
5345 sdata_err(sdata, "TID reservation already active\n");
5346 ret = -EALREADY;
5347 goto out;
5348 }
5349
5350 ieee80211_stop_vif_queues(sdata->local, sdata,
5351 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
5352
5353 synchronize_net();
5354
5355 /* Tear down BA sessions so we stop aggregating on this TID */
5356 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION)) {
5357 set_sta_flag(sta, WLAN_STA_BLOCK_BA);
5358 __ieee80211_stop_tx_ba_session(sta, tid,
5359 AGG_STOP_LOCAL_REQUEST);
5360 }
5361
5362 queues = BIT(sdata->vif.hw_queue[ieee802_1d_to_ac[tid]]);
5363 __ieee80211_flush_queues(local, sdata, queues, false);
5364
5365 sta->reserved_tid = tid;
5366
5367 ieee80211_wake_vif_queues(local, sdata,
5368 IEEE80211_QUEUE_STOP_REASON_RESERVE_TID);
5369
5370 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION))
5371 clear_sta_flag(sta, WLAN_STA_BLOCK_BA);
5372
5373 ret = 0;
5374 out:
5375 return ret;
5376 }
5377 EXPORT_SYMBOL(ieee80211_reserve_tid);
5378
ieee80211_unreserve_tid(struct ieee80211_sta * pubsta,u8 tid)5379 void ieee80211_unreserve_tid(struct ieee80211_sta *pubsta, u8 tid)
5380 {
5381 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
5382 struct ieee80211_sub_if_data *sdata = sta->sdata;
5383
5384 lockdep_assert_held(&sdata->local->sta_mtx);
5385
5386 /* only some cases are supported right now */
5387 switch (sdata->vif.type) {
5388 case NL80211_IFTYPE_STATION:
5389 case NL80211_IFTYPE_AP:
5390 case NL80211_IFTYPE_AP_VLAN:
5391 break;
5392 default:
5393 WARN_ON(1);
5394 return;
5395 }
5396
5397 if (tid != sta->reserved_tid) {
5398 sdata_err(sdata, "TID to unreserve (%d) isn't reserved\n", tid);
5399 return;
5400 }
5401
5402 sta->reserved_tid = IEEE80211_TID_UNRESERVED;
5403 }
5404 EXPORT_SYMBOL(ieee80211_unreserve_tid);
5405
__ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data * sdata,struct sk_buff * skb,int tid,enum nl80211_band band)5406 void __ieee80211_tx_skb_tid_band(struct ieee80211_sub_if_data *sdata,
5407 struct sk_buff *skb, int tid,
5408 enum nl80211_band band)
5409 {
5410 int ac = ieee80211_ac_from_tid(tid);
5411
5412 skb_reset_mac_header(skb);
5413 skb_set_queue_mapping(skb, ac);
5414 skb->priority = tid;
5415
5416 skb->dev = sdata->dev;
5417
5418 /*
5419 * The other path calling ieee80211_xmit is from the tasklet,
5420 * and while we can handle concurrent transmissions locking
5421 * requirements are that we do not come into tx with bhs on.
5422 */
5423 local_bh_disable();
5424 IEEE80211_SKB_CB(skb)->band = band;
5425 ieee80211_xmit(sdata, NULL, skb);
5426 local_bh_enable();
5427 }
5428
ieee80211_tx_control_port(struct wiphy * wiphy,struct net_device * dev,const u8 * buf,size_t len,const u8 * dest,__be16 proto,bool unencrypted,u64 * cookie)5429 int ieee80211_tx_control_port(struct wiphy *wiphy, struct net_device *dev,
5430 const u8 *buf, size_t len,
5431 const u8 *dest, __be16 proto, bool unencrypted,
5432 u64 *cookie)
5433 {
5434 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
5435 struct ieee80211_local *local = sdata->local;
5436 struct sta_info *sta;
5437 struct sk_buff *skb;
5438 struct ethhdr *ehdr;
5439 u32 ctrl_flags = 0;
5440 u32 flags = 0;
5441
5442 /* Only accept CONTROL_PORT_PROTOCOL configured in CONNECT/ASSOCIATE
5443 * or Pre-Authentication
5444 */
5445 if (proto != sdata->control_port_protocol &&
5446 proto != cpu_to_be16(ETH_P_PREAUTH))
5447 return -EINVAL;
5448
5449 if (proto == sdata->control_port_protocol)
5450 ctrl_flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO |
5451 IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP;
5452
5453 if (unencrypted)
5454 flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
5455
5456 if (cookie)
5457 ctrl_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
5458
5459 flags |= IEEE80211_TX_INTFL_NL80211_FRAME_TX;
5460
5461 skb = dev_alloc_skb(local->hw.extra_tx_headroom +
5462 sizeof(struct ethhdr) + len);
5463 if (!skb)
5464 return -ENOMEM;
5465
5466 skb_reserve(skb, local->hw.extra_tx_headroom + sizeof(struct ethhdr));
5467
5468 skb_put_data(skb, buf, len);
5469
5470 ehdr = skb_push(skb, sizeof(struct ethhdr));
5471 memcpy(ehdr->h_dest, dest, ETH_ALEN);
5472 memcpy(ehdr->h_source, sdata->vif.addr, ETH_ALEN);
5473 ehdr->h_proto = proto;
5474
5475 skb->dev = dev;
5476 skb->protocol = proto;
5477 skb_reset_network_header(skb);
5478 skb_reset_mac_header(skb);
5479
5480 /* update QoS header to prioritize control port frames if possible,
5481 * priorization also happens for control port frames send over
5482 * AF_PACKET
5483 */
5484 rcu_read_lock();
5485
5486 if (ieee80211_lookup_ra_sta(sdata, skb, &sta) == 0 && !IS_ERR(sta)) {
5487 u16 queue = __ieee80211_select_queue(sdata, sta, skb);
5488
5489 skb_set_queue_mapping(skb, queue);
5490 skb_get_hash(skb);
5491 }
5492
5493 rcu_read_unlock();
5494
5495 /* mutex lock is only needed for incrementing the cookie counter */
5496 mutex_lock(&local->mtx);
5497
5498 local_bh_disable();
5499 __ieee80211_subif_start_xmit(skb, skb->dev, flags, ctrl_flags, cookie);
5500 local_bh_enable();
5501
5502 mutex_unlock(&local->mtx);
5503
5504 return 0;
5505 }
5506
ieee80211_probe_mesh_link(struct wiphy * wiphy,struct net_device * dev,const u8 * buf,size_t len)5507 int ieee80211_probe_mesh_link(struct wiphy *wiphy, struct net_device *dev,
5508 const u8 *buf, size_t len)
5509 {
5510 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
5511 struct ieee80211_local *local = sdata->local;
5512 struct sk_buff *skb;
5513
5514 skb = dev_alloc_skb(local->hw.extra_tx_headroom + len +
5515 30 + /* header size */
5516 18); /* 11s header size */
5517 if (!skb)
5518 return -ENOMEM;
5519
5520 skb_reserve(skb, local->hw.extra_tx_headroom);
5521 skb_put_data(skb, buf, len);
5522
5523 skb->dev = dev;
5524 skb->protocol = htons(ETH_P_802_3);
5525 skb_reset_network_header(skb);
5526 skb_reset_mac_header(skb);
5527
5528 local_bh_disable();
5529 __ieee80211_subif_start_xmit(skb, skb->dev, 0,
5530 IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP,
5531 NULL);
5532 local_bh_enable();
5533
5534 return 0;
5535 }
5536