[PATCH] ieee80211: Fixed a kernel oops on module unload
[linux-2.6/btrfs-unstable.git] / net / ieee80211 / ieee80211_tx.c
blob435ef5a73d75b224d8636d5a74d297a20a94a732
1 /******************************************************************************
3 Copyright(c) 2003 - 2004 Intel Corporation. All rights reserved.
5 This program is free software; you can redistribute it and/or modify it
6 under the terms of version 2 of the GNU General Public License as
7 published by the Free Software Foundation.
9 This program is distributed in the hope that it will be useful, but WITHOUT
10 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
12 more details.
14 You should have received a copy of the GNU General Public License along with
15 this program; if not, write to the Free Software Foundation, Inc., 59
16 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
18 The full GNU General Public License is included in this distribution in the
19 file called LICENSE.
21 Contact Information:
22 James P. Ketrenos <ipw2100-admin@linux.intel.com>
23 Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
25 ******************************************************************************/
26 #include <linux/compiler.h>
27 #include <linux/config.h>
28 #include <linux/errno.h>
29 #include <linux/if_arp.h>
30 #include <linux/in6.h>
31 #include <linux/in.h>
32 #include <linux/ip.h>
33 #include <linux/kernel.h>
34 #include <linux/module.h>
35 #include <linux/netdevice.h>
36 #include <linux/proc_fs.h>
37 #include <linux/skbuff.h>
38 #include <linux/slab.h>
39 #include <linux/tcp.h>
40 #include <linux/types.h>
41 #include <linux/version.h>
42 #include <linux/wireless.h>
43 #include <linux/etherdevice.h>
44 #include <asm/uaccess.h>
46 #include <net/ieee80211.h>
50 802.11 Data Frame
52 ,-------------------------------------------------------------------.
53 Bytes | 2 | 2 | 6 | 6 | 6 | 2 | 0..2312 | 4 |
54 |------|------|---------|---------|---------|------|---------|------|
55 Desc. | ctrl | dura | DA/RA | TA | SA | Sequ | Frame | fcs |
56 | | tion | (BSSID) | | | ence | data | |
57 `--------------------------------------------------| |------'
58 Total: 28 non-data bytes `----.----'
60 .- 'Frame data' expands to <---------------------------'
63 ,---------------------------------------------------.
64 Bytes | 1 | 1 | 1 | 3 | 2 | 0-2304 |
65 |------|------|---------|----------|------|---------|
66 Desc. | SNAP | SNAP | Control |Eth Tunnel| Type | IP |
67 | DSAP | SSAP | | | | Packet |
68 | 0xAA | 0xAA |0x03 (UI)|0x00-00-F8| | |
69 `-----------------------------------------| |
70 Total: 8 non-data bytes `----.----'
72 .- 'IP Packet' expands, if WEP enabled, to <--'
75 ,-----------------------.
76 Bytes | 4 | 0-2296 | 4 |
77 |-----|-----------|-----|
78 Desc. | IV | Encrypted | ICV |
79 | | IP Packet | |
80 `-----------------------'
81 Total: 8 non-data bytes
83 802.3 Ethernet Data Frame
85 ,-----------------------------------------.
86 Bytes | 6 | 6 | 2 | Variable | 4 |
87 |-------|-------|------|-----------|------|
88 Desc. | Dest. | Source| Type | IP Packet | fcs |
89 | MAC | MAC | | | |
90 `-----------------------------------------'
91 Total: 18 non-data bytes
93 In the event that fragmentation is required, the incoming payload is split into
94 N parts of size ieee->fts. The first fragment contains the SNAP header and the
95 remaining packets are just data.
97 If encryption is enabled, each fragment payload size is reduced by enough space
98 to add the prefix and postfix (IV and ICV totalling 8 bytes in the case of WEP)
99 So if you have 1500 bytes of payload with ieee->fts set to 500 without
100 encryption it will take 3 frames. With WEP it will take 4 frames as the
101 payload of each frame is reduced to 492 bytes.
103 * SKB visualization
105 * ,- skb->data
107 * | ETHERNET HEADER ,-<-- PAYLOAD
108 * | | 14 bytes from skb->data
109 * | 2 bytes for Type --> ,T. | (sizeof ethhdr)
110 * | | | |
111 * |,-Dest.--. ,--Src.---. | | |
112 * | 6 bytes| | 6 bytes | | | |
113 * v | | | | | |
114 * 0 | v 1 | v | v 2
115 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
116 * ^ | ^ | ^ |
117 * | | | | | |
118 * | | | | `T' <---- 2 bytes for Type
119 * | | | |
120 * | | '---SNAP--' <-------- 6 bytes for SNAP
121 * | |
122 * `-IV--' <-------------------- 4 bytes for IV (WEP)
124 * SNAP HEADER
128 static u8 P802_1H_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0xf8 };
129 static u8 RFC1042_OUI[P80211_OUI_LEN] = { 0x00, 0x00, 0x00 };
131 static inline int ieee80211_put_snap(u8 * data, u16 h_proto)
133 struct ieee80211_snap_hdr *snap;
134 u8 *oui;
136 snap = (struct ieee80211_snap_hdr *)data;
137 snap->dsap = 0xaa;
138 snap->ssap = 0xaa;
139 snap->ctrl = 0x03;
141 if (h_proto == 0x8137 || h_proto == 0x80f3)
142 oui = P802_1H_OUI;
143 else
144 oui = RFC1042_OUI;
145 snap->oui[0] = oui[0];
146 snap->oui[1] = oui[1];
147 snap->oui[2] = oui[2];
149 *(u16 *) (data + SNAP_SIZE) = htons(h_proto);
151 return SNAP_SIZE + sizeof(u16);
154 static inline int ieee80211_encrypt_fragment(struct ieee80211_device *ieee,
155 struct sk_buff *frag, int hdr_len)
157 struct ieee80211_crypt_data *crypt = ieee->crypt[ieee->tx_keyidx];
158 int res;
160 /* To encrypt, frame format is:
161 * IV (4 bytes), clear payload (including SNAP), ICV (4 bytes) */
163 // PR: FIXME: Copied from hostap. Check fragmentation/MSDU/MPDU encryption.
164 /* Host-based IEEE 802.11 fragmentation for TX is not yet supported, so
165 * call both MSDU and MPDU encryption functions from here. */
166 atomic_inc(&crypt->refcnt);
167 res = 0;
168 if (crypt->ops->encrypt_msdu)
169 res = crypt->ops->encrypt_msdu(frag, hdr_len, crypt->priv);
170 if (res == 0 && crypt->ops->encrypt_mpdu)
171 res = crypt->ops->encrypt_mpdu(frag, hdr_len, crypt->priv);
173 atomic_dec(&crypt->refcnt);
174 if (res < 0) {
175 printk(KERN_INFO "%s: Encryption failed: len=%d.\n",
176 ieee->dev->name, frag->len);
177 ieee->ieee_stats.tx_discards++;
178 return -1;
181 return 0;
184 void ieee80211_txb_free(struct ieee80211_txb *txb)
186 int i;
187 if (unlikely(!txb))
188 return;
189 for (i = 0; i < txb->nr_frags; i++)
190 if (txb->fragments[i])
191 dev_kfree_skb_any(txb->fragments[i]);
192 kfree(txb);
195 static struct ieee80211_txb *ieee80211_alloc_txb(int nr_frags, int txb_size,
196 int gfp_mask)
198 struct ieee80211_txb *txb;
199 int i;
200 txb = kmalloc(sizeof(struct ieee80211_txb) + (sizeof(u8 *) * nr_frags),
201 gfp_mask);
202 if (!txb)
203 return NULL;
205 memset(txb, 0, sizeof(struct ieee80211_txb));
206 txb->nr_frags = nr_frags;
207 txb->frag_size = txb_size;
209 for (i = 0; i < nr_frags; i++) {
210 txb->fragments[i] = dev_alloc_skb(txb_size);
211 if (unlikely(!txb->fragments[i])) {
212 i--;
213 break;
216 if (unlikely(i != nr_frags)) {
217 while (i >= 0)
218 dev_kfree_skb_any(txb->fragments[i--]);
219 kfree(txb);
220 return NULL;
222 return txb;
225 /* SKBs are added to the ieee->tx_queue. */
226 int ieee80211_xmit(struct sk_buff *skb, struct net_device *dev)
228 struct ieee80211_device *ieee = netdev_priv(dev);
229 struct ieee80211_txb *txb = NULL;
230 struct ieee80211_hdr *frag_hdr;
231 int i, bytes_per_frag, nr_frags, bytes_last_frag, frag_size;
232 unsigned long flags;
233 struct net_device_stats *stats = &ieee->stats;
234 int ether_type, encrypt;
235 int bytes, fc, hdr_len;
236 struct sk_buff *skb_frag;
237 struct ieee80211_hdr header = { /* Ensure zero initialized */
238 .duration_id = 0,
239 .seq_ctl = 0
241 u8 dest[ETH_ALEN], src[ETH_ALEN];
243 struct ieee80211_crypt_data *crypt;
245 spin_lock_irqsave(&ieee->lock, flags);
247 /* If there is no driver handler to take the TXB, dont' bother
248 * creating it... */
249 if (!ieee->hard_start_xmit) {
250 printk(KERN_WARNING "%s: No xmit handler.\n", ieee->dev->name);
251 goto success;
254 if (unlikely(skb->len < SNAP_SIZE + sizeof(u16))) {
255 printk(KERN_WARNING "%s: skb too small (%d).\n",
256 ieee->dev->name, skb->len);
257 goto success;
260 ether_type = ntohs(((struct ethhdr *)skb->data)->h_proto);
262 crypt = ieee->crypt[ieee->tx_keyidx];
264 encrypt = !(ether_type == ETH_P_PAE && ieee->ieee802_1x) &&
265 ieee->host_encrypt && crypt && crypt->ops;
267 if (!encrypt && ieee->ieee802_1x &&
268 ieee->drop_unencrypted && ether_type != ETH_P_PAE) {
269 stats->tx_dropped++;
270 goto success;
273 /* Save source and destination addresses */
274 memcpy(dest, skb->data, ETH_ALEN);
275 memcpy(src, skb->data + ETH_ALEN, ETH_ALEN);
277 /* Advance the SKB to the start of the payload */
278 skb_pull(skb, sizeof(struct ethhdr));
280 /* Determine total amount of storage required for TXB packets */
281 bytes = skb->len + SNAP_SIZE + sizeof(u16);
283 if (encrypt)
284 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA |
285 IEEE80211_FCTL_PROTECTED;
286 else
287 fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA;
289 if (ieee->iw_mode == IW_MODE_INFRA) {
290 fc |= IEEE80211_FCTL_TODS;
291 /* To DS: Addr1 = BSSID, Addr2 = SA,
292 Addr3 = DA */
293 memcpy(header.addr1, ieee->bssid, ETH_ALEN);
294 memcpy(header.addr2, src, ETH_ALEN);
295 memcpy(header.addr3, dest, ETH_ALEN);
296 } else if (ieee->iw_mode == IW_MODE_ADHOC) {
297 /* not From/To DS: Addr1 = DA, Addr2 = SA,
298 Addr3 = BSSID */
299 memcpy(header.addr1, dest, ETH_ALEN);
300 memcpy(header.addr2, src, ETH_ALEN);
301 memcpy(header.addr3, ieee->bssid, ETH_ALEN);
303 header.frame_ctl = cpu_to_le16(fc);
304 hdr_len = IEEE80211_3ADDR_LEN;
306 /* Determine fragmentation size based on destination (multicast
307 * and broadcast are not fragmented) */
308 if (is_multicast_ether_addr(dest) || is_broadcast_ether_addr(dest))
309 frag_size = MAX_FRAG_THRESHOLD;
310 else
311 frag_size = ieee->fts;
313 /* Determine amount of payload per fragment. Regardless of if
314 * this stack is providing the full 802.11 header, one will
315 * eventually be affixed to this fragment -- so we must account for
316 * it when determining the amount of payload space. */
317 bytes_per_frag = frag_size - IEEE80211_3ADDR_LEN;
318 if (ieee->config &
319 (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
320 bytes_per_frag -= IEEE80211_FCS_LEN;
322 /* Each fragment may need to have room for encryptiong pre/postfix */
323 if (encrypt)
324 bytes_per_frag -= crypt->ops->extra_prefix_len +
325 crypt->ops->extra_postfix_len;
327 /* Number of fragments is the total bytes_per_frag /
328 * payload_per_fragment */
329 nr_frags = bytes / bytes_per_frag;
330 bytes_last_frag = bytes % bytes_per_frag;
331 if (bytes_last_frag)
332 nr_frags++;
333 else
334 bytes_last_frag = bytes_per_frag;
336 /* When we allocate the TXB we allocate enough space for the reserve
337 * and full fragment bytes (bytes_per_frag doesn't include prefix,
338 * postfix, header, FCS, etc.) */
339 txb = ieee80211_alloc_txb(nr_frags, frag_size, GFP_ATOMIC);
340 if (unlikely(!txb)) {
341 printk(KERN_WARNING "%s: Could not allocate TXB\n",
342 ieee->dev->name);
343 goto failed;
345 txb->encrypted = encrypt;
346 txb->payload_size = bytes;
348 for (i = 0; i < nr_frags; i++) {
349 skb_frag = txb->fragments[i];
351 if (encrypt)
352 skb_reserve(skb_frag, crypt->ops->extra_prefix_len);
354 frag_hdr = (struct ieee80211_hdr *)skb_put(skb_frag, hdr_len);
355 memcpy(frag_hdr, &header, hdr_len);
357 /* If this is not the last fragment, then add the MOREFRAGS
358 * bit to the frame control */
359 if (i != nr_frags - 1) {
360 frag_hdr->frame_ctl =
361 cpu_to_le16(fc | IEEE80211_FCTL_MOREFRAGS);
362 bytes = bytes_per_frag;
363 } else {
364 /* The last fragment takes the remaining length */
365 bytes = bytes_last_frag;
368 /* Put a SNAP header on the first fragment */
369 if (i == 0) {
370 ieee80211_put_snap(skb_put
371 (skb_frag, SNAP_SIZE + sizeof(u16)),
372 ether_type);
373 bytes -= SNAP_SIZE + sizeof(u16);
376 memcpy(skb_put(skb_frag, bytes), skb->data, bytes);
378 /* Advance the SKB... */
379 skb_pull(skb, bytes);
381 /* Encryption routine will move the header forward in order
382 * to insert the IV between the header and the payload */
383 if (encrypt)
384 ieee80211_encrypt_fragment(ieee, skb_frag, hdr_len);
385 if (ieee->config &
386 (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))
387 skb_put(skb_frag, 4);
390 success:
391 spin_unlock_irqrestore(&ieee->lock, flags);
393 dev_kfree_skb_any(skb);
395 if (txb) {
396 if ((*ieee->hard_start_xmit) (txb, dev) == 0) {
397 stats->tx_packets++;
398 stats->tx_bytes += txb->payload_size;
399 return 0;
401 ieee80211_txb_free(txb);
404 return 0;
406 failed:
407 spin_unlock_irqrestore(&ieee->lock, flags);
408 netif_stop_queue(dev);
409 stats->tx_errors++;
410 return 1;
414 EXPORT_SYMBOL(ieee80211_txb_free);