main.c 52.3 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/netdevice.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/skbuff.h>
#include <linux/etherdevice.h>
#include <linux/if_arp.h>
#include <linux/wireless.h>
#include <linux/rtnetlink.h>
#include <linux/bitmap.h>
24
#include <net/net_namespace.h>
25
26
27
#include <net/cfg80211.h>

#include "ieee80211_i.h"
Johannes Berg's avatar
Johannes Berg committed
28
#include "rate.h"
29
#include "mesh.h"
30
31
32
#include "wep.h"
#include "wme.h"
#include "aes_ccm.h"
Johannes Berg's avatar
Johannes Berg committed
33
#include "led.h"
34
#include "cfg.h"
35
36
#include "debugfs.h"
#include "debugfs_netdev.h"
37

38
39
#define SUPP_MCS_SET_LEN 16

40
41
42
43
44
45
46
47
48
49
/*
 * For seeing transmitted packets on monitor interfaces
 * we have a radiotap header too.
 */
struct ieee80211_tx_status_rtap_hdr {
	struct ieee80211_radiotap_header hdr;
	__le16 tx_flags;
	u8 data_retries;
} __attribute__ ((packed));

50
/* common interface routines */
51

52
static int header_parse_80211(const struct sk_buff *skb, unsigned char *haddr)
53
54
55
56
{
	memcpy(haddr, skb_mac_header(skb) + 10, ETH_ALEN); /* addr2 */
	return ETH_ALEN;
}
57

58
59
60
61
62
63
/* must be called under mdev tx lock */
static void ieee80211_configure_filter(struct ieee80211_local *local)
{
	unsigned int changed_flags;
	unsigned int new_flags = 0;

64
	if (atomic_read(&local->iff_promiscs))
65
66
		new_flags |= FIF_PROMISC_IN_BSS;

67
	if (atomic_read(&local->iff_allmultis))
68
69
70
		new_flags |= FIF_ALLMULTI;

	if (local->monitors)
71
72
73
74
75
76
77
78
79
80
81
82
83
		new_flags |= FIF_BCN_PRBRESP_PROMISC;

	if (local->fif_fcsfail)
		new_flags |= FIF_FCSFAIL;

	if (local->fif_plcpfail)
		new_flags |= FIF_PLCPFAIL;

	if (local->fif_control)
		new_flags |= FIF_CONTROL;

	if (local->fif_other_bss)
		new_flags |= FIF_OTHER_BSS;
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

	changed_flags = local->filter_flags ^ new_flags;

	/* be a bit nasty */
	new_flags |= (1<<31);

	local->ops->configure_filter(local_to_hw(local),
				     changed_flags, &new_flags,
				     local->mdev->mc_count,
				     local->mdev->mc_list);

	WARN_ON(new_flags & (1<<31));

	local->filter_flags = new_flags & ~(1<<31);
}

100
/* master interface */
101

102
103
104
105
106
static int ieee80211_master_open(struct net_device *dev)
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct ieee80211_sub_if_data *sdata;
	int res = -EOPNOTSUPP;
107

108
109
	/* we hold the RTNL here so can safely walk the list */
	list_for_each_entry(sdata, &local->interfaces, list) {
110
111
112
113
114
115
116
		if (sdata->dev != dev && netif_running(sdata->dev)) {
			res = 0;
			break;
		}
	}
	return res;
}
117

118
static int ieee80211_master_stop(struct net_device *dev)
119
{
120
121
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct ieee80211_sub_if_data *sdata;
122

123
124
	/* we hold the RTNL here so can safely walk the list */
	list_for_each_entry(sdata, &local->interfaces, list)
125
126
		if (sdata->dev != dev && netif_running(sdata->dev))
			dev_close(sdata->dev);
127

128
129
	return 0;
}
130

131
132
133
134
135
136
137
static void ieee80211_master_set_multicast_list(struct net_device *dev)
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);

	ieee80211_configure_filter(local);
}

138
/* regular interfaces */
139

140
static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
141
{
142
143
144
145
146
	int meshhdrlen;
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);

	meshhdrlen = (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT) ? 5 : 0;

147
148
	/* FIX: what would be proper limits for MTU?
	 * This interface uses 802.3 frames. */
149
150
	if (new_mtu < 256 ||
		new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
151
152
153
154
		printk(KERN_WARNING "%s: invalid MTU %d\n",
		       dev->name, new_mtu);
		return -EINVAL;
	}
155

156
157
158
159
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
	printk(KERN_DEBUG "%s: setting MTU %d\n", dev->name, new_mtu);
#endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
	dev->mtu = new_mtu;
160
161
162
	return 0;
}

163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
static inline int identical_mac_addr_allowed(int type1, int type2)
{
	return (type1 == IEEE80211_IF_TYPE_MNTR ||
		type2 == IEEE80211_IF_TYPE_MNTR ||
		(type1 == IEEE80211_IF_TYPE_AP &&
		 type2 == IEEE80211_IF_TYPE_WDS) ||
		(type1 == IEEE80211_IF_TYPE_WDS &&
		 (type2 == IEEE80211_IF_TYPE_WDS ||
		  type2 == IEEE80211_IF_TYPE_AP)) ||
		(type1 == IEEE80211_IF_TYPE_AP &&
		 type2 == IEEE80211_IF_TYPE_VLAN) ||
		(type1 == IEEE80211_IF_TYPE_VLAN &&
		 (type2 == IEEE80211_IF_TYPE_AP ||
		  type2 == IEEE80211_IF_TYPE_VLAN)));
}
178

179
static int ieee80211_open(struct net_device *dev)
180
{
181
182
183
184
	struct ieee80211_sub_if_data *sdata, *nsdata;
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct ieee80211_if_init_conf conf;
	int res;
185
	bool need_hw_reconfig = 0;
186
	struct sta_info *sta;
187

188
	sdata = IEEE80211_DEV_TO_SUB_IF(dev);
189

190
191
	/* we hold the RTNL here so can safely walk the list */
	list_for_each_entry(nsdata, &local->interfaces, list) {
192
		struct net_device *ndev = nsdata->dev;
193

194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
		if (ndev != dev && ndev != local->mdev && netif_running(ndev)) {
			/*
			 * Allow only a single IBSS interface to be up at any
			 * time. This is restricted because beacon distribution
			 * cannot work properly if both are in the same IBSS.
			 *
			 * To remove this restriction we'd have to disallow them
			 * from setting the same SSID on different IBSS interfaces
			 * belonging to the same hardware. Then, however, we're
			 * faced with having to adopt two different TSF timers...
			 */
			if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
			    nsdata->vif.type == IEEE80211_IF_TYPE_IBSS)
				return -EBUSY;

			/*
			 * Disallow multiple IBSS/STA mode interfaces.
			 *
			 * This is a technical restriction, it is possible although
			 * most likely not IEEE 802.11 compliant to have multiple
			 * STAs with just a single hardware (the TSF timer will not
			 * be adjusted properly.)
			 *
			 * However, because mac80211 uses the master device's BSS
			 * information for each STA/IBSS interface, doing this will
			 * currently corrupt that BSS information completely, unless,
			 * a not very useful case, both STAs are associated to the
			 * same BSS.
			 *
			 * To remove this restriction, the BSS information needs to
			 * be embedded in the STA/IBSS mode sdata instead of using
			 * the master device's BSS structure.
			 */
			if ((sdata->vif.type == IEEE80211_IF_TYPE_STA ||
			     sdata->vif.type == IEEE80211_IF_TYPE_IBSS) &&
			    (nsdata->vif.type == IEEE80211_IF_TYPE_STA ||
			     nsdata->vif.type == IEEE80211_IF_TYPE_IBSS))
				return -EBUSY;

			/*
			 * The remaining checks are only performed for interfaces
			 * with the same MAC address.
			 */
			if (compare_ether_addr(dev->dev_addr, ndev->dev_addr))
				continue;

240
241
242
			/*
			 * check whether it may have the same address
			 */
243
244
			if (!identical_mac_addr_allowed(sdata->vif.type,
							nsdata->vif.type))
245
246
247
248
249
				return -ENOTUNIQ;

			/*
			 * can only add VLANs to enabled APs
			 */
250
			if (sdata->vif.type == IEEE80211_IF_TYPE_VLAN &&
251
			    nsdata->vif.type == IEEE80211_IF_TYPE_AP)
252
				sdata->u.vlan.ap = nsdata;
253
254
		}
	}
255

256
	switch (sdata->vif.type) {
257
258
259
	case IEEE80211_IF_TYPE_WDS:
		if (is_zero_ether_addr(sdata->u.wds.remote_addr))
			return -ENOLINK;
260
261
262
263
264
265
266
267
268
269
270

		/* Create STA entry for the WDS peer */
		sta = sta_info_alloc(sdata, sdata->u.wds.remote_addr,
				     GFP_KERNEL);
		if (!sta)
			return -ENOMEM;

		sta->flags |= WLAN_STA_AUTHORIZED;

		res = sta_info_insert(sta);
		if (res) {
271
			/* STA has been freed */
272
273
			return res;
		}
274
275
276
277
278
		break;
	case IEEE80211_IF_TYPE_VLAN:
		if (!sdata->u.vlan.ap)
			return -ENOLINK;
		break;
Johannes Berg's avatar
Johannes Berg committed
279
280
281
282
	case IEEE80211_IF_TYPE_AP:
	case IEEE80211_IF_TYPE_STA:
	case IEEE80211_IF_TYPE_MNTR:
	case IEEE80211_IF_TYPE_IBSS:
283
	case IEEE80211_IF_TYPE_MESH_POINT:
Johannes Berg's avatar
Johannes Berg committed
284
285
		/* no special treatment */
		break;
286
287
288
289
	case IEEE80211_IF_TYPE_INVALID:
		/* cannot happen */
		WARN_ON(1);
		break;
290
	}
291

292
293
	if (local->open_count == 0) {
		res = 0;
294
295
296
		if (local->ops->start)
			res = local->ops->start(local_to_hw(local));
		if (res)
297
			return res;
298
		need_hw_reconfig = 1;
299
		ieee80211_led_radio(local, local->hw.conf.radio_enabled);
300
	}
301

302
	switch (sdata->vif.type) {
303
304
305
306
	case IEEE80211_IF_TYPE_VLAN:
		list_add(&sdata->u.vlan.list, &sdata->u.vlan.ap->u.ap.vlans);
		/* no need to tell driver */
		break;
307
	case IEEE80211_IF_TYPE_MNTR:
308
309
310
311
312
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
			local->cooked_mntrs++;
			break;
		}

313
		/* must be before the call to ieee80211_configure_filter */
314
		local->monitors++;
315
		if (local->monitors == 1)
316
			local->hw.conf.flags |= IEEE80211_CONF_RADIOTAP;
317
318
319
320
321
322
323
324
325
326
327
328
329

		if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
			local->fif_fcsfail++;
		if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
			local->fif_plcpfail++;
		if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
			local->fif_control++;
		if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
			local->fif_other_bss++;

		netif_tx_lock_bh(local->mdev);
		ieee80211_configure_filter(local);
		netif_tx_unlock_bh(local->mdev);
330
331
332
333
334
335
		break;
	case IEEE80211_IF_TYPE_STA:
	case IEEE80211_IF_TYPE_IBSS:
		sdata->u.sta.flags &= ~IEEE80211_STA_PREV_BSSID_SET;
		/* fall through */
	default:
336
		conf.vif = &sdata->vif;
337
		conf.type = sdata->vif.type;
338
339
340
341
342
343
344
		conf.mac_addr = dev->dev_addr;
		res = local->ops->add_interface(local_to_hw(local), &conf);
		if (res && !local->open_count && local->ops->stop)
			local->ops->stop(local_to_hw(local));
		if (res)
			return res;

345
		ieee80211_if_config(dev);
346
		ieee80211_reset_erp_info(dev);
347
		ieee80211_enable_keys(sdata);
348

349
		if (sdata->vif.type == IEEE80211_IF_TYPE_STA &&
350
		    !(sdata->flags & IEEE80211_SDATA_USERSPACE_MLME))
351
352
353
			netif_carrier_off(dev);
		else
			netif_carrier_on(dev);
354
	}
355

356
357
358
359
360
361
362
	if (local->open_count == 0) {
		res = dev_open(local->mdev);
		WARN_ON(res);
		tasklet_enable(&local->tx_pending_tasklet);
		tasklet_enable(&local->tasklet);
	}

363
364
365
366
367
368
369
370
371
372
373
	/*
	 * set_multicast_list will be invoked by the networking core
	 * which will check whether any increments here were done in
	 * error and sync them down to the hardware as filter flags.
	 */
	if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
		atomic_inc(&local->iff_allmultis);

	if (sdata->flags & IEEE80211_SDATA_PROMISC)
		atomic_inc(&local->iff_promiscs);

374
	local->open_count++;
375
376
	if (need_hw_reconfig)
		ieee80211_hw_config(local);
377

378
379
380
381
382
383
384
385
386
387
388
389
	/*
	 * ieee80211_sta_work is disabled while network interface
	 * is down. Therefore, some configuration changes may not
	 * yet be effective. Trigger execution of ieee80211_sta_work
	 * to fix this.
	 */
	if(sdata->vif.type == IEEE80211_IF_TYPE_STA ||
	   sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
		struct ieee80211_if_sta *ifsta = &sdata->u.sta;
		queue_work(local->hw.workqueue, &ifsta->work);
	}

390
	netif_start_queue(dev);
391

392
	return 0;
393
394
}

395
static int ieee80211_stop(struct net_device *dev)
396
{
397
398
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
	struct ieee80211_local *local = sdata->local;
399
	struct ieee80211_if_init_conf conf;
400
	struct sta_info *sta;
401

402
403
404
405
	/*
	 * Stop TX on this interface first.
	 */
	netif_stop_queue(dev);
406

407
408
409
	/*
	 * Now delete all active aggregation sessions.
	 */
410
411
412
413
	rcu_read_lock();

	list_for_each_entry_rcu(sta, &local->sta_list, list) {
		if (sta->sdata == sdata)
414
			ieee80211_sta_tear_down_BA_sessions(dev, sta->addr);
415
416
	}

417
418
	rcu_read_unlock();

419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
	/*
	 * Remove all stations associated with this interface.
	 *
	 * This must be done before calling ops->remove_interface()
	 * because otherwise we can later invoke ops->sta_notify()
	 * whenever the STAs are removed, and that invalidates driver
	 * assumptions about always getting a vif pointer that is valid
	 * (because if we remove a STA after ops->remove_interface()
	 * the driver will have removed the vif info already!)
	 *
	 * We could relax this and only unlink the stations from the
	 * hash table and list but keep them on a per-sdata list that
	 * will be inserted back again when the interface is brought
	 * up again, but I don't currently see a use case for that,
	 * except with WDS which gets a STA entry created when it is
	 * brought up.
	 */
	sta_info_flush(local, sdata);
437

438
439
440
441
442
443
444
445
446
447
448
449
	/*
	 * Don't count this interface for promisc/allmulti while it
	 * is down. dev_mc_unsync() will invoke set_multicast_list
	 * on the master interface which will sync these down to the
	 * hardware as filter flags.
	 */
	if (sdata->flags & IEEE80211_SDATA_ALLMULTI)
		atomic_dec(&local->iff_allmultis);

	if (sdata->flags & IEEE80211_SDATA_PROMISC)
		atomic_dec(&local->iff_promiscs);

450
451
	dev_mc_unsync(local->mdev, dev);

452
	/* APs need special treatment */
453
	if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
454
		struct ieee80211_sub_if_data *vlan, *tmp;
455
		struct beacon_data *old_beacon = sdata->u.ap.beacon;
456

457
458
459
460
461
462
		/* remove beacon */
		rcu_assign_pointer(sdata->u.ap.beacon, NULL);
		synchronize_rcu();
		kfree(old_beacon);

		/* down all dependent devices, that is VLANs */
463
464
465
466
467
468
		list_for_each_entry_safe(vlan, tmp, &sdata->u.ap.vlans,
					 u.vlan.list)
			dev_close(vlan->dev);
		WARN_ON(!list_empty(&sdata->u.ap.vlans));
	}

469
	local->open_count--;
470

471
	switch (sdata->vif.type) {
472
473
474
475
476
	case IEEE80211_IF_TYPE_VLAN:
		list_del(&sdata->u.vlan.list);
		sdata->u.vlan.ap = NULL;
		/* no need to tell driver */
		break;
477
	case IEEE80211_IF_TYPE_MNTR:
478
479
480
481
482
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
			local->cooked_mntrs--;
			break;
		}

483
		local->monitors--;
484
		if (local->monitors == 0)
485
			local->hw.conf.flags &= ~IEEE80211_CONF_RADIOTAP;
486
487
488
489
490
491
492
493
494
495
496
497
498

		if (sdata->u.mntr_flags & MONITOR_FLAG_FCSFAIL)
			local->fif_fcsfail--;
		if (sdata->u.mntr_flags & MONITOR_FLAG_PLCPFAIL)
			local->fif_plcpfail--;
		if (sdata->u.mntr_flags & MONITOR_FLAG_CONTROL)
			local->fif_control--;
		if (sdata->u.mntr_flags & MONITOR_FLAG_OTHER_BSS)
			local->fif_other_bss--;

		netif_tx_lock_bh(local->mdev);
		ieee80211_configure_filter(local);
		netif_tx_unlock_bh(local->mdev);
499
		break;
500
	case IEEE80211_IF_TYPE_MESH_POINT:
501
502
503
504
	case IEEE80211_IF_TYPE_STA:
	case IEEE80211_IF_TYPE_IBSS:
		sdata->u.sta.state = IEEE80211_DISABLED;
		del_timer_sync(&sdata->u.sta.timer);
505
		/*
506
507
508
509
		 * When we get here, the interface is marked down.
		 * Call synchronize_rcu() to wait for the RX path
		 * should it be using the interface and enqueuing
		 * frames at this very time on another CPU.
510
		 */
511
		synchronize_rcu();
512
		skb_queue_purge(&sdata->u.sta.skb_queue);
513

Zhu Yi's avatar
Zhu Yi committed
514
515
516
517
518
519
		if (local->scan_dev == sdata->dev) {
			if (!local->ops->hw_scan) {
				local->sta_sw_scanning = 0;
				cancel_delayed_work(&local->scan_work);
			} else
				local->sta_hw_scanning = 0;
520
		}
Zhu Yi's avatar
Zhu Yi committed
521

522
		flush_workqueue(local->hw.workqueue);
523
524
525
526
527

		sdata->u.sta.flags &= ~IEEE80211_STA_PRIVACY_INVOKED;
		kfree(sdata->u.sta.extra_ie);
		sdata->u.sta.extra_ie = NULL;
		sdata->u.sta.extra_ie_len = 0;
528
529
		/* fall through */
	default:
530
		conf.vif = &sdata->vif;
531
		conf.type = sdata->vif.type;
532
		conf.mac_addr = dev->dev_addr;
533
534
		/* disable all keys for as long as this netdev is down */
		ieee80211_disable_keys(sdata);
535
		local->ops->remove_interface(local_to_hw(local), &conf);
536
537
	}

538
539
540
	if (local->open_count == 0) {
		if (netif_running(local->mdev))
			dev_close(local->mdev);
541

542
543
		if (local->ops->stop)
			local->ops->stop(local_to_hw(local));
544

545
546
		ieee80211_led_radio(local, 0);

547
548
549
550
		tasklet_disable(&local->tx_pending_tasklet);
		tasklet_disable(&local->tasklet);
	}

551
552
553
	return 0;
}

554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
int ieee80211_start_tx_ba_session(struct ieee80211_hw *hw, u8 *ra, u16 tid)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct sta_info *sta;
	struct ieee80211_sub_if_data *sdata;
	u16 start_seq_num = 0;
	u8 *state;
	int ret;
	DECLARE_MAC_BUF(mac);

	if (tid >= STA_TID_NUM)
		return -EINVAL;

#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Open BA session requested for %s tid %u\n",
				print_mac(mac, ra), tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */

572
573
	rcu_read_lock();

574
575
576
	sta = sta_info_get(local, ra);
	if (!sta) {
		printk(KERN_DEBUG "Could not find the station\n");
577
		rcu_read_unlock();
578
579
580
581
582
583
		return -ENOENT;
	}

	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);

	/* we have tried too many times, receiver does not want A-MPDU */
584
	if (sta->ampdu_mlme.addba_req_num[tid] > HT_AGG_MAX_RETRIES) {
585
586
587
588
		ret = -EBUSY;
		goto start_ba_exit;
	}

589
	state = &sta->ampdu_mlme.tid_state_tx[tid];
590
591
592
593
594
595
596
597
598
599
	/* check if the TID is not in aggregation flow already */
	if (*state != HT_AGG_STATE_IDLE) {
#ifdef CONFIG_MAC80211_HT_DEBUG
		printk(KERN_DEBUG "BA request denied - session is not "
				 "idle on tid %u\n", tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */
		ret = -EAGAIN;
		goto start_ba_exit;
	}

600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
	/* prepare A-MPDU MLME for Tx aggregation */
	sta->ampdu_mlme.tid_tx[tid] =
			kmalloc(sizeof(struct tid_ampdu_tx), GFP_ATOMIC);
	if (!sta->ampdu_mlme.tid_tx[tid]) {
		if (net_ratelimit())
			printk(KERN_ERR "allocate tx mlme to tid %d failed\n",
					tid);
		ret = -ENOMEM;
		goto start_ba_exit;
	}
	/* Tx timer */
	sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.function =
			sta_addba_resp_timer_expired;
	sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.data =
			(unsigned long)&sta->timer_to_tid[tid];
	init_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);

617
618
619
620
621
	/* ensure that TX flow won't interrupt us
	 * until the end of the call to requeue function */
	spin_lock_bh(&local->mdev->queue_lock);

	/* create a new queue for this aggregation */
622
	ret = ieee80211_ht_agg_queue_add(local, sta, tid);
623
624
625
626
627

	/* case no queue is available to aggregation
	 * don't switch to aggregation */
	if (ret) {
#ifdef CONFIG_MAC80211_HT_DEBUG
628
		printk(KERN_DEBUG "BA request denied - queue unavailable for"
629
630
					" tid %d\n", tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */
631
		goto start_ba_err;
632
	}
633
	sdata = sta->sdata;
634
635
636
637
638
639
640
641
642
643
644
645
646

	/* Ok, the Addba frame hasn't been sent yet, but if the driver calls the
	 * call back right away, it must see that the flow has begun */
	*state |= HT_ADDBA_REQUESTED_MSK;

	if (local->ops->ampdu_action)
		ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_START,
						ra, tid, &start_seq_num);

	if (ret) {
		/* No need to requeue the packets in the agg queue, since we
		 * held the tx lock: no packet could be enqueued to the newly
		 * allocated queue */
647
		 ieee80211_ht_agg_queue_remove(local, sta, tid, 0);
648
#ifdef CONFIG_MAC80211_HT_DEBUG
649
650
		printk(KERN_DEBUG "BA request denied - HW unavailable for"
					" tid %d\n", tid);
651
652
#endif /* CONFIG_MAC80211_HT_DEBUG */
		*state = HT_AGG_STATE_IDLE;
653
		goto start_ba_err;
654
655
656
	}

	/* Will put all the packets in the new SW queue */
657
	ieee80211_requeue(local, ieee802_1d_to_ac[tid]);
658
659
660
661
	spin_unlock_bh(&local->mdev->queue_lock);

	/* send an addBA request */
	sta->ampdu_mlme.dialog_token_allocator++;
662
	sta->ampdu_mlme.tid_tx[tid]->dialog_token =
663
			sta->ampdu_mlme.dialog_token_allocator;
664
	sta->ampdu_mlme.tid_tx[tid]->ssn = start_seq_num;
665

666
	ieee80211_send_addba_request(sta->sdata->dev, ra, tid,
667
668
			 sta->ampdu_mlme.tid_tx[tid]->dialog_token,
			 sta->ampdu_mlme.tid_tx[tid]->ssn,
669
670
671
			 0x40, 5000);

	/* activate the timer for the recipient's addBA response */
672
	sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer.expires =
673
				jiffies + ADDBA_RESP_INTERVAL;
674
	add_timer(&sta->ampdu_mlme.tid_tx[tid]->addba_resp_timer);
675
	printk(KERN_DEBUG "activated addBA response timer on tid %d\n", tid);
676
	goto start_ba_exit;
677

678
679
680
681
682
start_ba_err:
	kfree(sta->ampdu_mlme.tid_tx[tid]);
	sta->ampdu_mlme.tid_tx[tid] = NULL;
	spin_unlock_bh(&local->mdev->queue_lock);
	ret = -EBUSY;
683
684
start_ba_exit:
	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
685
	rcu_read_unlock();
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
	return ret;
}
EXPORT_SYMBOL(ieee80211_start_tx_ba_session);

int ieee80211_stop_tx_ba_session(struct ieee80211_hw *hw,
				 u8 *ra, u16 tid,
				 enum ieee80211_back_parties initiator)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct sta_info *sta;
	u8 *state;
	int ret = 0;
	DECLARE_MAC_BUF(mac);

	if (tid >= STA_TID_NUM)
		return -EINVAL;

703
	rcu_read_lock();
704
	sta = sta_info_get(local, ra);
705
706
	if (!sta) {
		rcu_read_unlock();
707
		return -ENOENT;
708
	}
709
710

	/* check if the TID is in aggregation */
711
	state = &sta->ampdu_mlme.tid_state_tx[tid];
712
713
714
715
716
717
718
	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);

	if (*state != HT_AGG_STATE_OPERATIONAL) {
		ret = -ENOENT;
		goto stop_BA_exit;
	}

719
720
721
722
723
#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Tx BA session stop requested for %s tid %u\n",
				print_mac(mac, ra), tid);
#endif /* CONFIG_MAC80211_HT_DEBUG */

724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
	ieee80211_stop_queue(hw, sta->tid_to_tx_q[tid]);

	*state = HT_AGG_STATE_REQ_STOP_BA_MSK |
		(initiator << HT_AGG_STATE_INITIATOR_SHIFT);

	if (local->ops->ampdu_action)
		ret = local->ops->ampdu_action(hw, IEEE80211_AMPDU_TX_STOP,
						ra, tid, NULL);

	/* case HW denied going back to legacy */
	if (ret) {
		WARN_ON(ret != -EBUSY);
		*state = HT_AGG_STATE_OPERATIONAL;
		ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
		goto stop_BA_exit;
	}

stop_BA_exit:
	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
743
	rcu_read_unlock();
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
	return ret;
}
EXPORT_SYMBOL(ieee80211_stop_tx_ba_session);

void ieee80211_start_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u16 tid)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct sta_info *sta;
	u8 *state;
	DECLARE_MAC_BUF(mac);

	if (tid >= STA_TID_NUM) {
		printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
				tid, STA_TID_NUM);
		return;
	}

761
	rcu_read_lock();
762
763
	sta = sta_info_get(local, ra);
	if (!sta) {
764
		rcu_read_unlock();
765
766
767
768
769
		printk(KERN_DEBUG "Could not find station: %s\n",
				print_mac(mac, ra));
		return;
	}

770
	state = &sta->ampdu_mlme.tid_state_tx[tid];
771
772
773
774
775
776
	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);

	if (!(*state & HT_ADDBA_REQUESTED_MSK)) {
		printk(KERN_DEBUG "addBA was not requested yet, state is %d\n",
				*state);
		spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
777
		rcu_read_unlock();
778
779
780
781
782
783
784
785
786
787
788
789
		return;
	}

	WARN_ON_ONCE(*state & HT_ADDBA_DRV_READY_MSK);

	*state |= HT_ADDBA_DRV_READY_MSK;

	if (*state == HT_AGG_STATE_OPERATIONAL) {
		printk(KERN_DEBUG "Aggregation is on for tid %d \n", tid);
		ieee80211_wake_queue(hw, sta->tid_to_tx_q[tid]);
	}
	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
790
	rcu_read_unlock();
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
}
EXPORT_SYMBOL(ieee80211_start_tx_ba_cb);

void ieee80211_stop_tx_ba_cb(struct ieee80211_hw *hw, u8 *ra, u8 tid)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct sta_info *sta;
	u8 *state;
	int agg_queue;
	DECLARE_MAC_BUF(mac);

	if (tid >= STA_TID_NUM) {
		printk(KERN_DEBUG "Bad TID value: tid = %d (>= %d)\n",
				tid, STA_TID_NUM);
		return;
	}

808
809
#ifdef CONFIG_MAC80211_HT_DEBUG
	printk(KERN_DEBUG "Stopping Tx BA session for %s tid %d\n",
810
				print_mac(mac, ra), tid);
811
#endif /* CONFIG_MAC80211_HT_DEBUG */
812

813
	rcu_read_lock();
814
815
816
817
	sta = sta_info_get(local, ra);
	if (!sta) {
		printk(KERN_DEBUG "Could not find station: %s\n",
				print_mac(mac, ra));
818
		rcu_read_unlock();
819
820
		return;
	}
821
	state = &sta->ampdu_mlme.tid_state_tx[tid];
822
823
824
825
826

	spin_lock_bh(&sta->ampdu_mlme.ampdu_tx);
	if ((*state & HT_AGG_STATE_REQ_STOP_BA_MSK) == 0) {
		printk(KERN_DEBUG "unexpected callback to A-MPDU stop\n");
		spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);
827
		rcu_read_unlock();
828
829
830
831
		return;
	}

	if (*state & HT_AGG_STATE_INITIATOR_MSK)
832
		ieee80211_send_delba(sta->sdata->dev, ra, tid,
833
834
835
836
837
838
839
840
			WLAN_BACK_INITIATOR, WLAN_REASON_QSTA_NOT_USE);

	agg_queue = sta->tid_to_tx_q[tid];

	/* avoid ordering issues: we are the only one that can modify
	 * the content of the qdiscs */
	spin_lock_bh(&local->mdev->queue_lock);
	/* remove the queue for this aggregation */
841
	ieee80211_ht_agg_queue_remove(local, sta, tid, 1);
842
843
844
845
846
847
848
849
	spin_unlock_bh(&local->mdev->queue_lock);

	/* we just requeued the all the frames that were in the removed
	 * queue, and since we might miss a softirq we do netif_schedule.
	 * ieee80211_wake_queue is not used here as this queue is not
	 * necessarily stopped */
	netif_schedule(local->mdev);
	*state = HT_AGG_STATE_IDLE;
850
851
852
	sta->ampdu_mlme.addba_req_num[tid] = 0;
	kfree(sta->ampdu_mlme.tid_tx[tid]);
	sta->ampdu_mlme.tid_tx[tid] = NULL;
853
854
	spin_unlock_bh(&sta->ampdu_mlme.ampdu_tx);

855
	rcu_read_unlock();
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
}
EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb);

void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
				      const u8 *ra, u16 tid)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_ra_tid *ra_tid;
	struct sk_buff *skb = dev_alloc_skb(0);

	if (unlikely(!skb)) {
		if (net_ratelimit())
			printk(KERN_WARNING "%s: Not enough memory, "
			       "dropping start BA session", skb->dev->name);
		return;
	}
	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
	memcpy(&ra_tid->ra, ra, ETH_ALEN);
	ra_tid->tid = tid;

	skb->pkt_type = IEEE80211_ADDBA_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_start_tx_ba_cb_irqsafe);

void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_hw *hw,
				     const u8 *ra, u16 tid)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_ra_tid *ra_tid;
	struct sk_buff *skb = dev_alloc_skb(0);

	if (unlikely(!skb)) {
		if (net_ratelimit())
			printk(KERN_WARNING "%s: Not enough memory, "
			       "dropping stop BA session", skb->dev->name);
		return;
	}
	ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
	memcpy(&ra_tid->ra, ra, ETH_ALEN);
	ra_tid->tid = tid;

	skb->pkt_type = IEEE80211_DELBA_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_stop_tx_ba_cb_irqsafe);

905
906
907
908
static void ieee80211_set_multicast_list(struct net_device *dev)
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
909
	int allmulti, promisc, sdata_allmulti, sdata_promisc;
910

911
912
	allmulti = !!(dev->flags & IFF_ALLMULTI);
	promisc = !!(dev->flags & IFF_PROMISC);
913
914
	sdata_allmulti = !!(sdata->flags & IEEE80211_SDATA_ALLMULTI);
	sdata_promisc = !!(sdata->flags & IEEE80211_SDATA_PROMISC);
915
916
917

	if (allmulti != sdata_allmulti) {
		if (dev->flags & IFF_ALLMULTI)
918
			atomic_inc(&local->iff_allmultis);
919
		else
920
			atomic_dec(&local->iff_allmultis);
921
		sdata->flags ^= IEEE80211_SDATA_ALLMULTI;
922
	}
923
924
925

	if (promisc != sdata_promisc) {
		if (dev->flags & IFF_PROMISC)
926
			atomic_inc(&local->iff_promiscs);
927
		else
928
			atomic_dec(&local->iff_promiscs);
929
		sdata->flags ^= IEEE80211_SDATA_PROMISC;
930
	}
931
932

	dev_mc_sync(local->mdev, dev);
933
934
}

935
936
937
938
939
940
941
942
static const struct header_ops ieee80211_header_ops = {
	.create		= eth_header,
	.parse		= header_parse_80211,
	.rebuild	= eth_rebuild_header,
	.cache		= eth_header_cache,
	.cache_update	= eth_header_cache_update,
};

943
/* Must not be called for mdev */
944
void ieee80211_if_setup(struct net_device *dev)
945
{
946
947
948
949
950
951
952
953
954
	ether_setup(dev);
	dev->hard_start_xmit = ieee80211_subif_start_xmit;
	dev->wireless_handlers = &ieee80211_iw_handler_def;
	dev->set_multicast_list = ieee80211_set_multicast_list;
	dev->change_mtu = ieee80211_change_mtu;
	dev->open = ieee80211_open;
	dev->stop = ieee80211_stop;
	dev->destructor = ieee80211_if_free;
}
955

956
957
958
959
960
961
962
963
964
965
966
/* everything else */

static int __ieee80211_if_config(struct net_device *dev,
				 struct sk_buff *beacon,
				 struct ieee80211_tx_control *control)
{
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	struct ieee80211_if_conf conf;

	if (!local->ops->config_interface || !netif_running(dev))
967
968
		return 0;

969
	memset(&conf, 0, sizeof(conf));
970
971
972
	conf.type = sdata->vif.type;
	if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
	    sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
973
		conf.bssid = sdata->u.sta.bssid;
974
975
		conf.ssid = sdata->u.sta.ssid;
		conf.ssid_len = sdata->u.sta.ssid_len;
Johannes Berg's avatar
Johannes Berg committed
976
	} else if (ieee80211_vif_is_mesh(&sdata->vif)) {
977
978
		conf.beacon = beacon;
		ieee80211_start_mesh(dev);
979
	} else if (sdata->vif.type == IEEE80211_IF_TYPE_AP) {
980
981
982
983
		conf.ssid = sdata->u.ap.ssid;
		conf.ssid_len = sdata->u.ap.ssid_len;
		conf.beacon = beacon;
		conf.beacon_control = control;
984
	}
985
	return local->ops->config_interface(local_to_hw(local),
986
					    &sdata->vif, &conf);
987
988
}

989
990
int ieee80211_if_config(struct net_device *dev)
{
991
992
993
994
995
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
	if (sdata->vif.type == IEEE80211_IF_TYPE_MESH_POINT &&
	    (local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
		return ieee80211_if_config_beacon(dev);
996
997
	return __ieee80211_if_config(dev, NULL, NULL);
}
998

999
int ieee80211_if_config_beacon(struct net_device *dev)
1000
1001
{
	struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
1002
	struct ieee80211_tx_control control;
1003
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
1004
	struct sk_buff *skb;
1005

1006
	if (!(local->hw.flags & IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE))
1007
		return 0;
1008
1009
	skb = ieee80211_beacon_get(local_to_hw(local), &sdata->vif,
				   &control);
1010
1011
1012
1013
	if (!skb)
		return -ENOMEM;
	return __ieee80211_if_config(dev, skb, &control);
}
1014

1015
1016
1017
1018
int ieee80211_hw_config(struct ieee80211_local *local)
{
	struct ieee80211_channel *chan;
	int ret = 0;
1019

1020
	if (local->sta_sw_scanning)
1021
		chan = local->scan_channel;
1022
	else
1023
		chan = local->oper_channel;
1024

1025
1026
1027
1028
1029
1030
1031
1032
1033
	local->hw.conf.channel = chan;

	if (!local->hw.conf.power_level)
		local->hw.conf.power_level = chan->max_power;
	else
		local->hw.conf.power_level = min(chan->max_power,
					       local->hw.conf.power_level);

	local->hw.conf.max_antenna_gain = chan->max_antenna_gain;
1034

1035
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1036
1037
1038
	printk(KERN_DEBUG "%s: HW CONFIG: freq=%d\n",
	       wiphy_name(local->hw.wiphy), chan->center_freq);
#endif
1039

1040
	if (local->open_count)
1041
		ret = local->ops->config(local_to_hw(local), &local->hw.conf);
1042

1043
1044
	return ret;
}
1045

1046
/**
Tomas Winkler's avatar
Tomas Winkler committed
1047
1048
1049
 * ieee80211_handle_ht should be used only after legacy configuration
 * has been determined namely band, as ht configuration depends upon
 * the hardware's HT abilities for a _specific_ band.
1050
 */
Tomas Winkler's avatar
Tomas Winkler committed
1051
u32 ieee80211_handle_ht(struct ieee80211_local *local, int enable_ht,
1052
1053
1054
1055
			   struct ieee80211_ht_info *req_ht_cap,
			   struct ieee80211_ht_bss_info *req_bss_cap)
{
	struct ieee80211_conf *conf = &local->hw.conf;
1056
	struct ieee80211_supported_band *sband;
Tomas Winkler's avatar
Tomas Winkler committed
1057
1058
	struct ieee80211_ht_info ht_conf;
	struct ieee80211_ht_bss_info ht_bss_conf;
1059
	int i;
Tomas Winkler's avatar
Tomas Winkler committed
1060
	u32 changed = 0;
1061

1062
1063
	sband = local->hw.wiphy->bands[conf->channel->band];

1064
	/* HT is not supported */
1065
	if (!sband->ht_info.ht_supported) {
1066
		conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
Tomas Winkler's avatar
Tomas Winkler committed
1067
		return 0;
1068
1069
	}

Tomas Winkler's avatar
Tomas Winkler committed
1070
1071
1072
1073
1074
1075
1076
	memset(&ht_conf, 0, sizeof(struct ieee80211_ht_info));
	memset(&ht_bss_conf, 0, sizeof(struct ieee80211_ht_bss_info));

	if (enable_ht) {
		if (!(conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE))
			changed |= BSS_CHANGED_HT;

1077
		conf->flags |= IEEE80211_CONF_SUPPORT_HT_MODE;
Tomas Winkler's avatar
Tomas Winkler committed
1078
1079
1080
1081
1082
1083
		ht_conf.ht_supported = 1;

		ht_conf.cap = req_ht_cap->cap & sband->ht_info.cap;
		ht_conf.cap &= ~(IEEE80211_HT_CAP_MIMO_PS);
		ht_conf.cap |= sband->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS;

1084
		for (i = 0; i < SUPP_MCS_SET_LEN; i++)
Tomas Winkler's avatar
Tomas Winkler committed
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
			ht_conf.supp_mcs_set[i] =
					sband->ht_info.supp_mcs_set[i] &
					req_ht_cap->supp_mcs_set[i];

		ht_bss_conf.primary_channel = req_bss_cap->primary_channel;
		ht_bss_conf.bss_cap = req_bss_cap->bss_cap;
		ht_bss_conf.bss_op_mode = req_bss_cap->bss_op_mode;

		ht_conf.ampdu_factor = req_ht_cap->ampdu_factor;
		ht_conf.ampdu_density = req_ht_cap->ampdu_density;

		/* if bss configuration changed store the new one */
		if (memcmp(&conf->ht_conf, &ht_conf, sizeof(ht_conf)) ||
		    memcmp(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf))) {
			changed |= BSS_CHANGED_HT;
			memcpy(&conf->ht_conf, &ht_conf, sizeof(ht_conf));
			memcpy(&conf->ht_bss_conf, &ht_bss_conf, sizeof(ht_bss_conf));
		}
	} else {
		if (conf->flags & IEEE80211_CONF_SUPPORT_HT_MODE)
			changed |= BSS_CHANGED_HT;
		conf->flags &= ~IEEE80211_CONF_SUPPORT_HT_MODE;
1107
1108
	}

Tomas Winkler's avatar
Tomas Winkler committed
1109
	return changed;
1110
1111
}

1112
1113
void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
				      u32 changed)
1114
{
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
	struct ieee80211_local *local = sdata->local;

	if (!changed)
		return;

	if (local->ops->bss_info_changed)
		local->ops->bss_info_changed(local_to_hw(local),
					     &sdata->vif,
					     &sdata->bss_conf,
					     changed);
1125
1126
1127
1128
1129
1130
}

void ieee80211_reset_erp_info(struct net_device *dev)
{
	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);

1131
1132
1133
1134
1135
	sdata->bss_conf.use_cts_prot = 0;
	sdata->bss_conf.use_short_preamble = 0;
	ieee80211_bss_info_change_notify(sdata,
					 BSS_CHANGED_ERP_CTS_PROT |
					 BSS_CHANGED_ERP_PREAMBLE);
1136
1137
}

1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,
				 struct sk_buff *skb,
				 struct ieee80211_tx_status *status)
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_tx_status *saved;
	int tmp;

	skb->dev = local->mdev;
	saved = kmalloc(sizeof(struct ieee80211_tx_status), GFP_ATOMIC);
	if (unlikely(!saved)) {
		if (net_ratelimit())
			printk(KERN_WARNING "%s: Not enough memory, "
			       "dropping tx status", skb->dev->name);
		/* should be dev_kfree_skb_irq, but due to this function being
		 * named _irqsafe instead of just _irq we can't be sure that
		 * people won't call it from non-irq contexts */
		dev_kfree_skb_any(skb);
		return;
	}
	memcpy(saved, status, sizeof(struct ieee80211_tx_status));
	/* copy pointer to saved status into skb->cb for use by tasklet */
	memcpy(skb->cb, &saved, sizeof(saved));

	skb->pkt_type = IEEE80211_TX_STATUS_MSG;
	skb_queue_tail(status->control.flags & IEEE80211_TXCTL_REQ_TX_STATUS ?
		       &local->skb_queue : &local->skb_queue_unreliable, skb);
	tmp = skb_queue_len(&local->skb_queue) +
		skb_queue_len(&local->skb_queue_unreliable);
	while (tmp > IEEE80211_IRQSAFE_QUEUE_LIMIT &&
	       (skb = skb_dequeue(&local->skb_queue_unreliable))) {
		memcpy(&saved, skb->cb, sizeof(saved));
		kfree(saved);
		dev_kfree_skb_irq(skb);
		tmp--;
		I802_DEBUG_INC(local->tx_status_drop);
	}
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_tx_status_irqsafe);

static void ieee80211_tasklet_handler(unsigned long data)
{
	struct ieee80211_local *local = (struct ieee80211_local *) data;
	struct sk_buff *skb;
	struct ieee80211_rx_status rx_status;
	struct ieee80211_tx_status *tx_status;
1185
	struct ieee80211_ra_tid *ra_tid;
1186
1187
1188
1189
1190
1191
1192

	while ((skb = skb_dequeue(&local->skb_queue)) ||
	       (skb = skb_dequeue(&local->skb_queue_unreliable))) {
		switch (skb->pkt_type) {
		case IEEE80211_RX_MSG:
			/* status is in skb->cb */
			memcpy(&rx_status, skb->cb, sizeof(rx_status));
1193
			/* Clear skb->pkt_type in order to not confuse kernel
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
			 * netstack. */
			skb->pkt_type = 0;
			__ieee80211_rx(local_to_hw(local), skb, &rx_status);
			break;
		case IEEE80211_TX_STATUS_MSG:
			/* get pointer to saved status out of skb->cb */
			memcpy(&tx_status, skb->cb, sizeof(tx_status));
			skb->pkt_type = 0;
			ieee80211_tx_status(local_to_hw(local),
					    skb, tx_status);
			kfree(tx_status);
			break;
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
		case IEEE80211_DELBA_MSG:
			ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
			ieee80211_stop_tx_ba_cb(local_to_hw(local),
						ra_tid->ra, ra_tid->tid);
			dev_kfree_skb(skb);
			break;
		case IEEE80211_ADDBA_MSG:
			ra_tid = (struct ieee80211_ra_tid *) &skb->cb;
			ieee80211_start_tx_ba_cb(local_to_hw(local),
						 ra_tid->ra, ra_tid->tid);
			dev_kfree_skb(skb);
			break ;