net/mac80211/tdls.c

   1 /*
   2  * mac80211 TDLS handling code
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2014, Intel Corporation
   6  * Copyright 2014  Intel Mobile Communications GmbH
   7  *
   8  * This file is GPLv2 as found in COPYING.
   9  */
  10
  11 #include <linux/ieee80211.h>
  12 #include <linux/log2.h>
  13 #include <net/cfg80211.h>
  14 #include "ieee80211_i.h"
  15 #include "driver-ops.h"
  16
  17 /* give usermode some time for retries in setting up the TDLS session */
  18 #define TDLS_PEER_SETUP_TIMEOUT (15 * HZ)
  19
  20 void ieee80211_tdls_peer_del_work(struct work_struct *wk)
  21 {
  22         struct ieee80211_sub_if_data *sdata;
  23         struct ieee80211_local *local;
  24
  25         sdata = container_of(wk, struct ieee80211_sub_if_data,
  26                              u.mgd.tdls_peer_del_work.work);
  27         local = sdata->local;
  28
  29         mutex_lock(&local->mtx);
  30         if (!is_zero_ether_addr(sdata->u.mgd.tdls_peer)) {
  31                 tdls_dbg(sdata, "TDLS del peer %pM\n", sdata->u.mgd.tdls_peer);
  32                 sta_info_destroy_addr(sdata, sdata->u.mgd.tdls_peer);
  33                 eth_zero_addr(sdata->u.mgd.tdls_peer);
  34         }
  35         mutex_unlock(&local->mtx);
  36 }
  37
  38 static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
  39 {
  40         u8 *pos = (void *)skb_put(skb, 7);
  41
  42         *pos++ = WLAN_EID_EXT_CAPABILITY;
  43         *pos++ = 5; /* len */
  44         *pos++ = 0x0;
  45         *pos++ = 0x0;
  46         *pos++ = 0x0;
  47         *pos++ = 0x0;
  48         *pos++ = WLAN_EXT_CAPA5_TDLS_ENABLED;
  49 }
  50
  51 static u16 ieee80211_get_tdls_sta_capab(struct ieee80211_sub_if_data *sdata,
  52                                         u16 status_code)
  53 {
  54         struct ieee80211_local *local = sdata->local;
  55         u16 capab;
  56
  57         /* The capability will be 0 when sending a failure code */
  58         if (status_code != 0)
  59                 return 0;
  60
  61         capab = 0;
  62         if (ieee80211_get_sdata_band(sdata) != IEEE80211_BAND_2GHZ)
  63                 return capab;
  64
  65         if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
  66                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
  67         if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
  68                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
  69
  70         return capab;
  71 }
  72
  73 static void ieee80211_tdls_add_link_ie(struct ieee80211_sub_if_data *sdata,
  74                                        struct sk_buff *skb, const u8 *peer,
  75                                        bool initiator)
  76 {
  77         struct ieee80211_tdls_lnkie *lnkid;
  78         const u8 *init_addr, *rsp_addr;
  79
  80         if (initiator) {
  81                 init_addr = sdata->vif.addr;
  82                 rsp_addr = peer;
  83         } else {
  84                 init_addr = peer;
  85                 rsp_addr = sdata->vif.addr;
  86         }
  87
  88         lnkid = (void *)skb_put(skb, sizeof(struct ieee80211_tdls_lnkie));
  89
  90         lnkid->ie_type = WLAN_EID_LINK_ID;
  91         lnkid->ie_len = sizeof(struct ieee80211_tdls_lnkie) - 2;
  92
  93         memcpy(lnkid->bssid, sdata->u.mgd.bssid, ETH_ALEN);
  94         memcpy(lnkid->init_sta, init_addr, ETH_ALEN);
  95         memcpy(lnkid->resp_sta, rsp_addr, ETH_ALEN);
  96 }
  97
  98 /* translate numbering in the WMM parameter IE to the mac80211 notation */
  99 static enum ieee80211_ac_numbers ieee80211_ac_from_wmm(int ac)
 100 {
 101         switch (ac) {
 102         default:
 103                 WARN_ON_ONCE(1);
 104         case 0:
 105                 return IEEE80211_AC_BE;
 106         case 1:
 107                 return IEEE80211_AC_BK;
 108         case 2:
 109                 return IEEE80211_AC_VI;
 110         case 3:
 111                 return IEEE80211_AC_VO;
 112         }
 113 }
 114
 115 static u8 ieee80211_wmm_aci_aifsn(int aifsn, bool acm, int aci)
 116 {
 117         u8 ret;
 118
 119         ret = aifsn & 0x0f;
 120         if (acm)
 121                 ret |= 0x10;
 122         ret |= (aci << 5) & 0x60;
 123         return ret;
 124 }
 125
 126 static u8 ieee80211_wmm_ecw(u16 cw_min, u16 cw_max)
 127 {
 128         return ((ilog2(cw_min + 1) << 0x0) & 0x0f) |
 129                ((ilog2(cw_max + 1) << 0x4) & 0xf0);
 130 }
 131
 132 static void ieee80211_tdls_add_wmm_param_ie(struct ieee80211_sub_if_data *sdata,
 133                                             struct sk_buff *skb)
 134 {
 135         struct ieee80211_wmm_param_ie *wmm;
 136         struct ieee80211_tx_queue_params *txq;
 137         int i;
 138
 139         wmm = (void *)skb_put(skb, sizeof(*wmm));
 140         memset(wmm, 0, sizeof(*wmm));
 141
 142         wmm->element_id = WLAN_EID_VENDOR_SPECIFIC;
 143         wmm->len = sizeof(*wmm) - 2;
 144
 145         wmm->oui[0] = 0x00; /* Microsoft OUI 00:50:F2 */
 146         wmm->oui[1] = 0x50;
 147         wmm->oui[2] = 0xf2;
 148         wmm->oui_type = 2; /* WME */
 149         wmm->oui_subtype = 1; /* WME param */
 150         wmm->version = 1; /* WME ver */
 151         wmm->qos_info = 0; /* U-APSD not in use */
 152
 153         /*
 154          * Use the EDCA parameters defined for the BSS, or default if the AP
 155          * doesn't support it, as mandated by 802.11-2012 section 10.22.4
 156          */
 157         for (i = 0; i < IEEE80211_NUM_ACS; i++) {
 158                 txq = &sdata->tx_conf[ieee80211_ac_from_wmm(i)];
 159                 wmm->ac[i].aci_aifsn = ieee80211_wmm_aci_aifsn(txq->aifs,
 160                                                                txq->acm, i);
 161                 wmm->ac[i].cw = ieee80211_wmm_ecw(txq->cw_min, txq->cw_max);
 162                 wmm->ac[i].txop_limit = cpu_to_le16(txq->txop);
 163         }
 164 }
 165
 166 static void
 167 ieee80211_tdls_add_setup_start_ies(struct ieee80211_sub_if_data *sdata,
 168                                    struct sk_buff *skb, const u8 *peer,
 169                                    u8 action_code, bool initiator,
 170                                    const u8 *extra_ies, size_t extra_ies_len)
 171 {
 172         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
 173         struct ieee80211_local *local = sdata->local;
 174         struct ieee80211_supported_band *sband;
 175         struct ieee80211_sta_ht_cap ht_cap;
 176         struct sta_info *sta = NULL;
 177         size_t offset = 0, noffset;
 178         u8 *pos;
 179
 180         rcu_read_lock();
 181
 182         /* we should have the peer STA if we're already responding */
 183         if (action_code == WLAN_TDLS_SETUP_RESPONSE) {
 184                 sta = sta_info_get(sdata, peer);
 185                 if (WARN_ON_ONCE(!sta)) {
 186                         rcu_read_unlock();
 187                         return;
 188                 }
 189         }
 190
 191         ieee80211_add_srates_ie(sdata, skb, false, band);
 192         ieee80211_add_ext_srates_ie(sdata, skb, false, band);
 193
 194         /* add any custom IEs that go before Extended Capabilities */
 195         if (extra_ies_len) {
 196                 static const u8 before_ext_cap[] = {
 197                         WLAN_EID_SUPP_RATES,
 198                         WLAN_EID_COUNTRY,
 199                         WLAN_EID_EXT_SUPP_RATES,
 200                         WLAN_EID_SUPPORTED_CHANNELS,
 201                         WLAN_EID_RSN,
 202                 };
 203                 noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
 204                                              before_ext_cap,
 205                                              ARRAY_SIZE(before_ext_cap),
 206                                              offset);
 207                 pos = skb_put(skb, noffset - offset);
 208                 memcpy(pos, extra_ies + offset, noffset - offset);
 209                 offset = noffset;
 210         }
 211
 212         ieee80211_tdls_add_ext_capab(skb);
 213
 214         /* add the QoS element if we support it */
 215         if (local->hw.queues >= IEEE80211_NUM_ACS &&
 216             action_code != WLAN_PUB_ACTION_TDLS_DISCOVER_RES)
 217                 ieee80211_add_wmm_info_ie(skb_put(skb, 9), 0); /* no U-APSD */
 218
 219         /* add any custom IEs that go before HT capabilities */
 220         if (extra_ies_len) {
 221                 static const u8 before_ht_cap[] = {
 222                         WLAN_EID_SUPP_RATES,
 223                         WLAN_EID_COUNTRY,
 224                         WLAN_EID_EXT_SUPP_RATES,
 225                         WLAN_EID_SUPPORTED_CHANNELS,
 226                         WLAN_EID_RSN,
 227                         WLAN_EID_EXT_CAPABILITY,
 228                         WLAN_EID_QOS_CAPA,
 229                         WLAN_EID_FAST_BSS_TRANSITION,
 230                         WLAN_EID_TIMEOUT_INTERVAL,
 231                         WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
 232                 };
 233                 noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
 234                                              before_ht_cap,
 235                                              ARRAY_SIZE(before_ht_cap),
 236                                              offset);
 237                 pos = skb_put(skb, noffset - offset);
 238                 memcpy(pos, extra_ies + offset, noffset - offset);
 239                 offset = noffset;
 240         }
 241
 242         /*
 243          * with TDLS we can switch channels, and HT-caps are not necessarily
 244          * the same on all bands. The specification limits the setup to a
 245          * single HT-cap, so use the current band for now.
 246          */
 247         sband = local->hw.wiphy->bands[band];
 248         memcpy(&ht_cap, &sband->ht_cap, sizeof(ht_cap));
 249         if ((action_code == WLAN_TDLS_SETUP_REQUEST ||
 250              action_code == WLAN_TDLS_SETUP_RESPONSE) &&
 251             ht_cap.ht_supported && (!sta || sta->sta.ht_cap.ht_supported)) {
 252                 if (action_code == WLAN_TDLS_SETUP_REQUEST) {
 253                         ieee80211_apply_htcap_overrides(sdata, &ht_cap);
 254
 255                         /* disable SMPS in TDLS initiator */
 256                         ht_cap.cap |= (WLAN_HT_CAP_SM_PS_DISABLED
 257                                        << IEEE80211_HT_CAP_SM_PS_SHIFT);
 258                 } else {
 259                         /* disable SMPS in TDLS responder */
 260                         sta->sta.ht_cap.cap |=
 261                                 (WLAN_HT_CAP_SM_PS_DISABLED
 262                                  << IEEE80211_HT_CAP_SM_PS_SHIFT);
 263
 264                         /* the peer caps are already intersected with our own */
 265                         memcpy(&ht_cap, &sta->sta.ht_cap, sizeof(ht_cap));
 266                 }
 267
 268                 pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
 269                 ieee80211_ie_build_ht_cap(pos, &ht_cap, ht_cap.cap);
 270         }
 271
 272         rcu_read_unlock();
 273
 274         /* add any remaining IEs */
 275         if (extra_ies_len) {
 276                 noffset = extra_ies_len;
 277                 pos = skb_put(skb, noffset - offset);
 278                 memcpy(pos, extra_ies + offset, noffset - offset);
 279         }
 280
 281         ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
 282 }
 283
 284 static void
 285 ieee80211_tdls_add_setup_cfm_ies(struct ieee80211_sub_if_data *sdata,
 286                                  struct sk_buff *skb, const u8 *peer,
 287                                  bool initiator, const u8 *extra_ies,
 288                                  size_t extra_ies_len)
 289 {
 290         struct ieee80211_local *local = sdata->local;
 291         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 292         size_t offset = 0, noffset;
 293         struct sta_info *sta, *ap_sta;
 294         u8 *pos;
 295
 296         rcu_read_lock();
 297
 298         sta = sta_info_get(sdata, peer);
 299         ap_sta = sta_info_get(sdata, ifmgd->bssid);
 300         if (WARN_ON_ONCE(!sta || !ap_sta)) {
 301                 rcu_read_unlock();
 302                 return;
 303         }
 304
 305         /* add any custom IEs that go before the QoS IE */
 306         if (extra_ies_len) {
 307                 static const u8 before_qos[] = {
 308                         WLAN_EID_RSN,
 309                 };
 310                 noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
 311                                              before_qos,
 312                                              ARRAY_SIZE(before_qos),
 313                                              offset);
 314                 pos = skb_put(skb, noffset - offset);
 315                 memcpy(pos, extra_ies + offset, noffset - offset);
 316                 offset = noffset;
 317         }
 318
 319         /* add the QoS param IE if both the peer and we support it */
 320         if (local->hw.queues >= IEEE80211_NUM_ACS && sta->sta.wme)
 321                 ieee80211_tdls_add_wmm_param_ie(sdata, skb);
 322
 323         /* add any custom IEs that go before HT operation */
 324         if (extra_ies_len) {
 325                 static const u8 before_ht_op[] = {
 326                         WLAN_EID_RSN,
 327                         WLAN_EID_QOS_CAPA,
 328                         WLAN_EID_FAST_BSS_TRANSITION,
 329                         WLAN_EID_TIMEOUT_INTERVAL,
 330                 };
 331                 noffset = ieee80211_ie_split(extra_ies, extra_ies_len,
 332                                              before_ht_op,
 333                                              ARRAY_SIZE(before_ht_op),
 334                                              offset);
 335                 pos = skb_put(skb, noffset - offset);
 336                 memcpy(pos, extra_ies + offset, noffset - offset);
 337                 offset = noffset;
 338         }
 339
 340         /* if HT support is only added in TDLS, we need an HT-operation IE */
 341         if (!ap_sta->sta.ht_cap.ht_supported && sta->sta.ht_cap.ht_supported) {
 342                 struct ieee80211_chanctx_conf *chanctx_conf =
 343                                 rcu_dereference(sdata->vif.chanctx_conf);
 344                 if (!WARN_ON(!chanctx_conf)) {
 345                         pos = skb_put(skb, 2 +
 346                                       sizeof(struct ieee80211_ht_operation));
 347                         /* send an empty HT operation IE */
 348                         ieee80211_ie_build_ht_oper(pos, &sta->sta.ht_cap,
 349                                                    &chanctx_conf->def, 0);
 350                 }
 351         }
 352
 353         rcu_read_unlock();
 354
 355         /* add any remaining IEs */
 356         if (extra_ies_len) {
 357                 noffset = extra_ies_len;
 358                 pos = skb_put(skb, noffset - offset);
 359                 memcpy(pos, extra_ies + offset, noffset - offset);
 360         }
 361
 362         ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
 363 }
 364
 365 static void ieee80211_tdls_add_ies(struct ieee80211_sub_if_data *sdata,
 366                                    struct sk_buff *skb, const u8 *peer,
 367                                    u8 action_code, u16 status_code,
 368                                    bool initiator, const u8 *extra_ies,
 369                                    size_t extra_ies_len)
 370 {
 371         switch (action_code) {
 372         case WLAN_TDLS_SETUP_REQUEST:
 373         case WLAN_TDLS_SETUP_RESPONSE:
 374         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
 375                 if (status_code == 0)
 376                         ieee80211_tdls_add_setup_start_ies(sdata, skb, peer,
 377                                                            action_code,
 378                                                            initiator,
 379                                                            extra_ies,
 380                                                            extra_ies_len);
 381                 break;
 382         case WLAN_TDLS_SETUP_CONFIRM:
 383                 if (status_code == 0)
 384                         ieee80211_tdls_add_setup_cfm_ies(sdata, skb, peer,
 385                                                          initiator, extra_ies,
 386                                                          extra_ies_len);
 387                 break;
 388         case WLAN_TDLS_TEARDOWN:
 389         case WLAN_TDLS_DISCOVERY_REQUEST:
 390                 if (extra_ies_len)
 391                         memcpy(skb_put(skb, extra_ies_len), extra_ies,
 392                                extra_ies_len);
 393                 if (status_code == 0 || action_code == WLAN_TDLS_TEARDOWN)
 394                         ieee80211_tdls_add_link_ie(sdata, skb, peer, initiator);
 395                 break;
 396         }
 397
 398 }
 399
 400 static int
 401 ieee80211_prep_tdls_encap_data(struct wiphy *wiphy, struct net_device *dev,
 402                                const u8 *peer, u8 action_code, u8 dialog_token,
 403                                u16 status_code, struct sk_buff *skb)
 404 {
 405         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 406         struct ieee80211_tdls_data *tf;
 407
 408         tf = (void *)skb_put(skb, offsetof(struct ieee80211_tdls_data, u));
 409
 410         memcpy(tf->da, peer, ETH_ALEN);
 411         memcpy(tf->sa, sdata->vif.addr, ETH_ALEN);
 412         tf->ether_type = cpu_to_be16(ETH_P_TDLS);
 413         tf->payload_type = WLAN_TDLS_SNAP_RFTYPE;
 414
 415         /* network header is after the ethernet header */
 416         skb_set_network_header(skb, ETH_HLEN);
 417
 418         switch (action_code) {
 419         case WLAN_TDLS_SETUP_REQUEST:
 420                 tf->category = WLAN_CATEGORY_TDLS;
 421                 tf->action_code = WLAN_TDLS_SETUP_REQUEST;
 422
 423                 skb_put(skb, sizeof(tf->u.setup_req));
 424                 tf->u.setup_req.dialog_token = dialog_token;
 425                 tf->u.setup_req.capability =
 426                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata,
 427                                                                  status_code));
 428                 break;
 429         case WLAN_TDLS_SETUP_RESPONSE:
 430                 tf->category = WLAN_CATEGORY_TDLS;
 431                 tf->action_code = WLAN_TDLS_SETUP_RESPONSE;
 432
 433                 skb_put(skb, sizeof(tf->u.setup_resp));
 434                 tf->u.setup_resp.status_code = cpu_to_le16(status_code);
 435                 tf->u.setup_resp.dialog_token = dialog_token;
 436                 tf->u.setup_resp.capability =
 437                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata,
 438                                                                  status_code));
 439                 break;
 440         case WLAN_TDLS_SETUP_CONFIRM:
 441                 tf->category = WLAN_CATEGORY_TDLS;
 442                 tf->action_code = WLAN_TDLS_SETUP_CONFIRM;
 443
 444                 skb_put(skb, sizeof(tf->u.setup_cfm));
 445                 tf->u.setup_cfm.status_code = cpu_to_le16(status_code);
 446                 tf->u.setup_cfm.dialog_token = dialog_token;
 447                 break;
 448         case WLAN_TDLS_TEARDOWN:
 449                 tf->category = WLAN_CATEGORY_TDLS;
 450                 tf->action_code = WLAN_TDLS_TEARDOWN;
 451
 452                 skb_put(skb, sizeof(tf->u.teardown));
 453                 tf->u.teardown.reason_code = cpu_to_le16(status_code);
 454                 break;
 455         case WLAN_TDLS_DISCOVERY_REQUEST:
 456                 tf->category = WLAN_CATEGORY_TDLS;
 457                 tf->action_code = WLAN_TDLS_DISCOVERY_REQUEST;
 458
 459                 skb_put(skb, sizeof(tf->u.discover_req));
 460                 tf->u.discover_req.dialog_token = dialog_token;
 461                 break;
 462         default:
 463                 return -EINVAL;
 464         }
 465
 466         return 0;
 467 }
 468
 469 static int
 470 ieee80211_prep_tdls_direct(struct wiphy *wiphy, struct net_device *dev,
 471                            const u8 *peer, u8 action_code, u8 dialog_token,
 472                            u16 status_code, struct sk_buff *skb)
 473 {
 474         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 475         struct ieee80211_mgmt *mgmt;
 476
 477         mgmt = (void *)skb_put(skb, 24);
 478         memset(mgmt, 0, 24);
 479         memcpy(mgmt->da, peer, ETH_ALEN);
 480         memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
 481         memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 482
 483         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
 484                                           IEEE80211_STYPE_ACTION);
 485
 486         switch (action_code) {
 487         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
 488                 skb_put(skb, 1 + sizeof(mgmt->u.action.u.tdls_discover_resp));
 489                 mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
 490                 mgmt->u.action.u.tdls_discover_resp.action_code =
 491                         WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
 492                 mgmt->u.action.u.tdls_discover_resp.dialog_token =
 493                         dialog_token;
 494                 mgmt->u.action.u.tdls_discover_resp.capability =
 495                         cpu_to_le16(ieee80211_get_tdls_sta_capab(sdata,
 496                                                                  status_code));
 497                 break;
 498         default:
 499                 return -EINVAL;
 500         }
 501
 502         return 0;
 503 }
 504
 505 static int
 506 ieee80211_tdls_prep_mgmt_packet(struct wiphy *wiphy, struct net_device *dev,
 507                                 const u8 *peer, u8 action_code,
 508                                 u8 dialog_token, u16 status_code,
 509                                 u32 peer_capability, bool initiator,
 510                                 const u8 *extra_ies, size_t extra_ies_len)
 511 {
 512         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 513         struct ieee80211_local *local = sdata->local;
 514         struct sk_buff *skb = NULL;
 515         u32 flags = 0;
 516         bool send_direct;
 517         struct sta_info *sta;
 518         int ret;
 519
 520         skb = netdev_alloc_skb(dev,
 521                                local->hw.extra_tx_headroom +
 522                                max(sizeof(struct ieee80211_mgmt),
 523                                    sizeof(struct ieee80211_tdls_data)) +
 524                                50 + /* supported rates */
 525                                7 + /* ext capab */
 526                                26 + /* max(WMM-info, WMM-param) */
 527                                2 + max(sizeof(struct ieee80211_ht_cap),
 528                                        sizeof(struct ieee80211_ht_operation)) +
 529                                extra_ies_len +
 530                                sizeof(struct ieee80211_tdls_lnkie));
 531         if (!skb)
 532                 return -ENOMEM;
 533
 534         skb_reserve(skb, local->hw.extra_tx_headroom);
 535
 536         switch (action_code) {
 537         case WLAN_TDLS_SETUP_REQUEST:
 538         case WLAN_TDLS_SETUP_RESPONSE:
 539         case WLAN_TDLS_SETUP_CONFIRM:
 540         case WLAN_TDLS_TEARDOWN:
 541         case WLAN_TDLS_DISCOVERY_REQUEST:
 542                 ret = ieee80211_prep_tdls_encap_data(wiphy, dev, peer,
 543                                                      action_code, dialog_token,
 544                                                      status_code, skb);
 545                 send_direct = false;
 546                 break;
 547         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
 548                 ret = ieee80211_prep_tdls_direct(wiphy, dev, peer, action_code,
 549                                                  dialog_token, status_code,
 550                                                  skb);
 551                 send_direct = true;
 552                 break;
 553         default:
 554                 ret = -ENOTSUPP;
 555                 break;
 556         }
 557
 558         if (ret < 0)
 559                 goto fail;
 560
 561         rcu_read_lock();
 562         sta = sta_info_get(sdata, peer);
 563
 564         /* infer the initiator if we can, to support old userspace */
 565         switch (action_code) {
 566         case WLAN_TDLS_SETUP_REQUEST:
 567                 if (sta) {
 568                         set_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
 569                         sta->sta.tdls_initiator = false;
 570                 }
 571                 /* fall-through */
 572         case WLAN_TDLS_SETUP_CONFIRM:
 573         case WLAN_TDLS_DISCOVERY_REQUEST:
 574                 initiator = true;
 575                 break;
 576         case WLAN_TDLS_SETUP_RESPONSE:
 577                 /*
 578                  * In some testing scenarios, we send a request and response.
 579                  * Make the last packet sent take effect for the initiator
 580                  * value.
 581                  */
 582                 if (sta) {
 583                         clear_sta_flag(sta, WLAN_STA_TDLS_INITIATOR);
 584                         sta->sta.tdls_initiator = true;
 585                 }
 586                 /* fall-through */
 587         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
 588                 initiator = false;
 589                 break;
 590         case WLAN_TDLS_TEARDOWN:
 591                 /* any value is ok */
 592                 break;
 593         default:
 594                 ret = -ENOTSUPP;
 595                 break;
 596         }
 597
 598         if (sta && test_sta_flag(sta, WLAN_STA_TDLS_INITIATOR))
 599                 initiator = true;
 600
 601         rcu_read_unlock();
 602         if (ret < 0)
 603                 goto fail;
 604
 605         ieee80211_tdls_add_ies(sdata, skb, peer, action_code, status_code,
 606                                initiator, extra_ies, extra_ies_len);
 607         if (send_direct) {
 608                 ieee80211_tx_skb(sdata, skb);
 609                 return 0;
 610         }
 611
 612         /*
 613          * According to 802.11z: Setup req/resp are sent in AC_BK, otherwise
 614          * we should default to AC_VI.
 615          */
 616         switch (action_code) {
 617         case WLAN_TDLS_SETUP_REQUEST:
 618         case WLAN_TDLS_SETUP_RESPONSE:
 619                 skb_set_queue_mapping(skb, IEEE80211_AC_BK);
 620                 skb->priority = 2;
 621                 break;
 622         default:
 623                 skb_set_queue_mapping(skb, IEEE80211_AC_VI);
 624                 skb->priority = 5;
 625                 break;
 626         }
 627
 628         /*
 629          * Set the WLAN_TDLS_TEARDOWN flag to indicate a teardown in progress.
 630          * Later, if no ACK is returned from peer, we will re-send the teardown
 631          * packet through the AP.
 632          */
 633         if ((action_code == WLAN_TDLS_TEARDOWN) &&
 634             (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
 635                 struct sta_info *sta = NULL;
 636                 bool try_resend; /* Should we keep skb for possible resend */
 637
 638                 /* If not sending directly to peer - no point in keeping skb */
 639                 rcu_read_lock();
 640                 sta = sta_info_get(sdata, peer);
 641                 try_resend = sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
 642                 rcu_read_unlock();
 643
 644                 spin_lock_bh(&sdata->u.mgd.teardown_lock);
 645                 if (try_resend && !sdata->u.mgd.teardown_skb) {
 646                         /* Mark it as requiring TX status callback  */
 647                         flags |= IEEE80211_TX_CTL_REQ_TX_STATUS |
 648                                  IEEE80211_TX_INTFL_MLME_CONN_TX;
 649
 650                         /*
 651                          * skb is copied since mac80211 will later set
 652                          * properties that might not be the same as the AP,
 653                          * such as encryption, QoS, addresses, etc.
 654                          *
 655                          * No problem if skb_copy() fails, so no need to check.
 656                          */
 657                         sdata->u.mgd.teardown_skb = skb_copy(skb, GFP_ATOMIC);
 658                         sdata->u.mgd.orig_teardown_skb = skb;
 659                 }
 660                 spin_unlock_bh(&sdata->u.mgd.teardown_lock);
 661         }
 662
 663         /* disable bottom halves when entering the Tx path */
 664         local_bh_disable();
 665         __ieee80211_subif_start_xmit(skb, dev, flags);
 666         local_bh_enable();
 667
 668         return ret;
 669
 670 fail:
 671         dev_kfree_skb(skb);
 672         return ret;
 673 }
 674
 675 static int
 676 ieee80211_tdls_mgmt_setup(struct wiphy *wiphy, struct net_device *dev,
 677                           const u8 *peer, u8 action_code, u8 dialog_token,
 678                           u16 status_code, u32 peer_capability, bool initiator,
 679                           const u8 *extra_ies, size_t extra_ies_len)
 680 {
 681         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 682         struct ieee80211_local *local = sdata->local;
 683         int ret;
 684
 685         mutex_lock(&local->mtx);
 686
 687         /* we don't support concurrent TDLS peer setups */
 688         if (!is_zero_ether_addr(sdata->u.mgd.tdls_peer) &&
 689             !ether_addr_equal(sdata->u.mgd.tdls_peer, peer)) {
 690                 ret = -EBUSY;
 691                 goto exit;
 692         }
 693
 694         /*
 695          * make sure we have a STA representing the peer so we drop or buffer
 696          * non-TDLS-setup frames to the peer. We can't send other packets
 697          * during setup through the AP path.
 698          * Allow error packets to be sent - sometimes we don't even add a STA
 699          * before failing the setup.
 700          */
 701         if (status_code == 0) {
 702                 rcu_read_lock();
 703                 if (!sta_info_get(sdata, peer)) {
 704                         rcu_read_unlock();
 705                         ret = -ENOLINK;
 706                         goto exit;
 707                 }
 708                 rcu_read_unlock();
 709         }
 710
 711         ieee80211_flush_queues(local, sdata);
 712
 713         ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer, action_code,
 714                                               dialog_token, status_code,
 715                                               peer_capability, initiator,
 716                                               extra_ies, extra_ies_len);
 717         if (ret < 0)
 718                 goto exit;
 719
 720         memcpy(sdata->u.mgd.tdls_peer, peer, ETH_ALEN);
 721         ieee80211_queue_delayed_work(&sdata->local->hw,
 722                                      &sdata->u.mgd.tdls_peer_del_work,
 723                                      TDLS_PEER_SETUP_TIMEOUT);
 724
 725 exit:
 726         mutex_unlock(&local->mtx);
 727         return ret;
 728 }
 729
 730 static int
 731 ieee80211_tdls_mgmt_teardown(struct wiphy *wiphy, struct net_device *dev,
 732                              const u8 *peer, u8 action_code, u8 dialog_token,
 733                              u16 status_code, u32 peer_capability,
 734                              bool initiator, const u8 *extra_ies,
 735                              size_t extra_ies_len)
 736 {
 737         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 738         struct ieee80211_local *local = sdata->local;
 739         struct sta_info *sta;
 740         int ret;
 741
 742         /*
 743          * No packets can be transmitted to the peer via the AP during setup -
 744          * the STA is set as a TDLS peer, but is not authorized.
 745          * During teardown, we prevent direct transmissions by stopping the
 746          * queues and flushing all direct packets.
 747          */
 748         ieee80211_stop_vif_queues(local, sdata,
 749                                   IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN);
 750         ieee80211_flush_queues(local, sdata);
 751
 752         ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer, action_code,
 753                                               dialog_token, status_code,
 754                                               peer_capability, initiator,
 755                                               extra_ies, extra_ies_len);
 756         if (ret < 0)
 757                 sdata_err(sdata, "Failed sending TDLS teardown packet %d\n",
 758                           ret);
 759
 760         /*
 761          * Remove the STA AUTH flag to force further traffic through the AP. If
 762          * the STA was unreachable, it was already removed.
 763          */
 764         rcu_read_lock();
 765         sta = sta_info_get(sdata, peer);
 766         if (sta)
 767                 clear_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
 768         rcu_read_unlock();
 769
 770         ieee80211_wake_vif_queues(local, sdata,
 771                                   IEEE80211_QUEUE_STOP_REASON_TDLS_TEARDOWN);
 772
 773         return 0;
 774 }
 775
 776 int ieee80211_tdls_mgmt(struct wiphy *wiphy, struct net_device *dev,
 777                         const u8 *peer, u8 action_code, u8 dialog_token,
 778                         u16 status_code, u32 peer_capability,
 779                         bool initiator, const u8 *extra_ies,
 780                         size_t extra_ies_len)
 781 {
 782         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 783         int ret;
 784
 785         if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
 786                 return -ENOTSUPP;
 787
 788         /* make sure we are in managed mode, and associated */
 789         if (sdata->vif.type != NL80211_IFTYPE_STATION ||
 790             !sdata->u.mgd.associated)
 791                 return -EINVAL;
 792
 793         switch (action_code) {
 794         case WLAN_TDLS_SETUP_REQUEST:
 795         case WLAN_TDLS_SETUP_RESPONSE:
 796                 ret = ieee80211_tdls_mgmt_setup(wiphy, dev, peer, action_code,
 797                                                 dialog_token, status_code,
 798                                                 peer_capability, initiator,
 799                                                 extra_ies, extra_ies_len);
 800                 break;
 801         case WLAN_TDLS_TEARDOWN:
 802                 ret = ieee80211_tdls_mgmt_teardown(wiphy, dev, peer,
 803                                                    action_code, dialog_token,
 804                                                    status_code,
 805                                                    peer_capability, initiator,
 806                                                    extra_ies, extra_ies_len);
 807                 break;
 808         case WLAN_TDLS_DISCOVERY_REQUEST:
 809                 /*
 810                  * Protect the discovery so we can hear the TDLS discovery
 811                  * response frame. It is transmitted directly and not buffered
 812                  * by the AP.
 813                  */
 814                 drv_mgd_protect_tdls_discover(sdata->local, sdata);
 815                 /* fall-through */
 816         case WLAN_TDLS_SETUP_CONFIRM:
 817         case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
 818                 /* no special handling */
 819                 ret = ieee80211_tdls_prep_mgmt_packet(wiphy, dev, peer,
 820                                                       action_code,
 821                                                       dialog_token,
 822                                                       status_code,
 823                                                       peer_capability,
 824                                                       initiator, extra_ies,
 825                                                       extra_ies_len);
 826                 break;
 827         default:
 828                 ret = -EOPNOTSUPP;
 829                 break;
 830         }
 831
 832         tdls_dbg(sdata, "TDLS mgmt action %d peer %pM status %d\n",
 833                  action_code, peer, ret);
 834         return ret;
 835 }
 836
 837 int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
 838                         const u8 *peer, enum nl80211_tdls_operation oper)
 839 {
 840         struct sta_info *sta;
 841         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 842         struct ieee80211_local *local = sdata->local;
 843         int ret;
 844
 845         if (!(wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS))
 846                 return -ENOTSUPP;
 847
 848         if (sdata->vif.type != NL80211_IFTYPE_STATION)
 849                 return -EINVAL;
 850
 851         switch (oper) {
 852         case NL80211_TDLS_ENABLE_LINK:
 853         case NL80211_TDLS_DISABLE_LINK:
 854                 break;
 855         case NL80211_TDLS_TEARDOWN:
 856         case NL80211_TDLS_SETUP:
 857         case NL80211_TDLS_DISCOVERY_REQ:
 858                 /* We don't support in-driver setup/teardown/discovery */
 859                 return -ENOTSUPP;
 860         }
 861
 862         mutex_lock(&local->mtx);
 863         tdls_dbg(sdata, "TDLS oper %d peer %pM\n", oper, peer);
 864
 865         switch (oper) {
 866         case NL80211_TDLS_ENABLE_LINK:
 867                 rcu_read_lock();
 868                 sta = sta_info_get(sdata, peer);
 869                 if (!sta) {
 870                         rcu_read_unlock();
 871                         ret = -ENOLINK;
 872                         break;
 873                 }
 874
 875                 set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
 876                 rcu_read_unlock();
 877
 878                 WARN_ON_ONCE(is_zero_ether_addr(sdata->u.mgd.tdls_peer) ||
 879                              !ether_addr_equal(sdata->u.mgd.tdls_peer, peer));
 880                 ret = 0;
 881                 break;
 882         case NL80211_TDLS_DISABLE_LINK:
 883                 /*
 884                  * The teardown message in ieee80211_tdls_mgmt_teardown() was
 885                  * created while the queues were stopped, so it might still be
 886                  * pending. Before flushing the queues we need to be sure the
 887                  * message is handled by the tasklet handling pending messages,
 888                  * otherwise we might start destroying the station before
 889                  * sending the teardown packet.
 890                  * Note that this only forces the tasklet to flush pendings -
 891                  * not to stop the tasklet from rescheduling itself.
 892                  */
 893                 tasklet_kill(&local->tx_pending_tasklet);
 894                 /* flush a potentially queued teardown packet */
 895                 ieee80211_flush_queues(local, sdata);
 896
 897                 ret = sta_info_destroy_addr(sdata, peer);
 898                 break;
 899         default:
 900                 ret = -ENOTSUPP;
 901                 break;
 902         }
 903
 904         if (ret == 0 && ether_addr_equal(sdata->u.mgd.tdls_peer, peer)) {
 905                 cancel_delayed_work(&sdata->u.mgd.tdls_peer_del_work);
 906                 eth_zero_addr(sdata->u.mgd.tdls_peer);
 907         }
 908
 909         mutex_unlock(&local->mtx);
 910         return ret;
 911 }
 912
 913 void ieee80211_tdls_oper_request(struct ieee80211_vif *vif, const u8 *peer,
 914                                  enum nl80211_tdls_operation oper,
 915                                  u16 reason_code, gfp_t gfp)
 916 {
 917         struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
 918
 919         if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc) {
 920                 sdata_err(sdata, "Discarding TDLS oper %d - not STA or disconnected\n",
 921                           oper);
 922                 return;
 923         }
 924
 925         cfg80211_tdls_oper_request(sdata->dev, peer, oper, reason_code, gfp);
 926 }
 927 EXPORT_SYMBOL(ieee80211_tdls_oper_request);