linux/net/mac80211/tx.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright 2002-2005, Instant802 Networks, Inc.
   4 * Copyright 2005-2006, Devicescape Software, Inc.
   5 * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   6 * Copyright 2007       Johannes Berg <johannes@sipsolutions.net>
   7 * Copyright 2013-2014  Intel Mobile Communications GmbH
   8 * Copyright (C) 2018-2021 Intel Corporation
   9 *
  10 * Transmit and frame generation functions.
  11 */
  12
  13#include <linux/kernel.h>
  14#include <linux/slab.h>
  15#include <linux/skbuff.h>
  16#include <linux/if_vlan.h>
  17#include <linux/etherdevice.h>
  18#include <linux/bitmap.h>
  19#include <linux/rcupdate.h>
  20#include <linux/export.h>
  21#include <linux/timekeeping.h>
  22#include <net/net_namespace.h>
  23#include <net/ieee80211_radiotap.h>
  24#include <net/cfg80211.h>
  25#include <net/mac80211.h>
  26#include <net/codel.h>
  27#include <net/codel_impl.h>
  28#include <asm/unaligned.h>
  29#include <net/fq_impl.h>
  30
  31#include "ieee80211_i.h"
  32#include "driver-ops.h"
  33#include "led.h"
  34#include "mesh.h"
  35#include "wep.h"
  36#include "wpa.h"
  37#include "wme.h"
  38#include "rate.h"
  39
  40/* misc utils */
  41
  42static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,
  43                                 struct sk_buff *skb, int group_addr,
  44                                 int next_frag_len)
  45{
  46        int rate, mrate, erp, dur, i, shift = 0;
  47        struct ieee80211_rate *txrate;
  48        struct ieee80211_local *local = tx->local;
  49        struct ieee80211_supported_band *sband;
  50        struct ieee80211_hdr *hdr;
  51        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
  52        struct ieee80211_chanctx_conf *chanctx_conf;
  53        u32 rate_flags = 0;
  54
  55        /* assume HW handles this */
  56        if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))
  57                return 0;
  58
  59        rcu_read_lock();
  60        chanctx_conf = rcu_dereference(tx->sdata->vif.chanctx_conf);
  61        if (chanctx_conf) {
  62                shift = ieee80211_chandef_get_shift(&chanctx_conf->def);
  63                rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);
  64        }
  65        rcu_read_unlock();
  66
  67        /* uh huh? */
  68        if (WARN_ON_ONCE(tx->rate.idx < 0))
  69                return 0;
  70
  71        sband = local->hw.wiphy->bands[info->band];
  72        txrate = &sband->bitrates[tx->rate.idx];
  73
  74        erp = txrate->flags & IEEE80211_RATE_ERP_G;
  75
  76        /* device is expected to do this */
  77        if (sband->band == NL80211_BAND_S1GHZ)
  78                return 0;
  79
  80        /*
  81         * data and mgmt (except PS Poll):
  82         * - during CFP: 32768
  83         * - during contention period:
  84         *   if addr1 is group address: 0
  85         *   if more fragments = 0 and addr1 is individual address: time to
  86         *      transmit one ACK plus SIFS
  87         *   if more fragments = 1 and addr1 is individual address: time to
  88         *      transmit next fragment plus 2 x ACK plus 3 x SIFS
  89         *
  90         * IEEE 802.11, 9.6:
  91         * - control response frame (CTS or ACK) shall be transmitted using the
  92         *   same rate as the immediately previous frame in the frame exchange
  93         *   sequence, if this rate belongs to the PHY mandatory rates, or else
  94         *   at the highest possible rate belonging to the PHY rates in the
  95         *   BSSBasicRateSet
  96         */
  97        hdr = (struct ieee80211_hdr *)skb->data;
  98        if (ieee80211_is_ctl(hdr->frame_control)) {
  99                /* TODO: These control frames are not currently sent by
 100                 * mac80211, but should they be implemented, this function
 101                 * needs to be updated to support duration field calculation.
 102                 *
 103                 * RTS: time needed to transmit pending data/mgmt frame plus
 104                 *    one CTS frame plus one ACK frame plus 3 x SIFS
 105                 * CTS: duration of immediately previous RTS minus time
 106                 *    required to transmit CTS and its SIFS
 107                 * ACK: 0 if immediately previous directed data/mgmt had
 108                 *    more=0, with more=1 duration in ACK frame is duration
 109                 *    from previous frame minus time needed to transmit ACK
 110                 *    and its SIFS
 111                 * PS Poll: BIT(15) | BIT(14) | aid
 112                 */
 113                return 0;
 114        }
 115
 116        /* data/mgmt */
 117        if (0 /* FIX: data/mgmt during CFP */)
 118                return cpu_to_le16(32768);
 119
 120        if (group_addr) /* Group address as the destination - no ACK */
 121                return 0;
 122
 123        /* Individual destination address:
 124         * IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)
 125         * CTS and ACK frames shall be transmitted using the highest rate in
 126         * basic rate set that is less than or equal to the rate of the
 127         * immediately previous frame and that is using the same modulation
 128         * (CCK or OFDM). If no basic rate set matches with these requirements,
 129         * the highest mandatory rate of the PHY that is less than or equal to
 130         * the rate of the previous frame is used.
 131         * Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps
 132         */
 133        rate = -1;
 134        /* use lowest available if everything fails */
 135        mrate = sband->bitrates[0].bitrate;
 136        for (i = 0; i < sband->n_bitrates; i++) {
 137                struct ieee80211_rate *r = &sband->bitrates[i];
 138
 139                if (r->bitrate > txrate->bitrate)
 140                        break;
 141
 142                if ((rate_flags & r->flags) != rate_flags)
 143                        continue;
 144
 145                if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))
 146                        rate = DIV_ROUND_UP(r->bitrate, 1 << shift);
 147
 148                switch (sband->band) {
 149                case NL80211_BAND_2GHZ: {
 150                        u32 flag;
 151                        if (tx->sdata->flags & IEEE80211_SDATA_OPERATING_GMODE)
 152                                flag = IEEE80211_RATE_MANDATORY_G;
 153                        else
 154                                flag = IEEE80211_RATE_MANDATORY_B;
 155                        if (r->flags & flag)
 156                                mrate = r->bitrate;
 157                        break;
 158                }
 159                case NL80211_BAND_5GHZ:
 160                case NL80211_BAND_6GHZ:
 161                        if (r->flags & IEEE80211_RATE_MANDATORY_A)
 162                                mrate = r->bitrate;
 163                        break;
 164                case NL80211_BAND_S1GHZ:
 165                case NL80211_BAND_60GHZ:
 166                        /* TODO, for now fall through */
 167                case NUM_NL80211_BANDS:
 168                        WARN_ON(1);
 169                        break;
 170                }
 171        }
 172        if (rate == -1) {
 173                /* No matching basic rate found; use highest suitable mandatory
 174                 * PHY rate */
 175                rate = DIV_ROUND_UP(mrate, 1 << shift);
 176        }
 177
 178        /* Don't calculate ACKs for QoS Frames with NoAck Policy set */
 179        if (ieee80211_is_data_qos(hdr->frame_control) &&
 180            *(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
 181                dur = 0;
 182        else
 183                /* Time needed to transmit ACK
 184                 * (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up
 185                 * to closest integer */
 186                dur = ieee80211_frame_duration(sband->band, 10, rate, erp,
 187                                tx->sdata->vif.bss_conf.use_short_preamble,
 188                                shift);
 189
 190        if (next_frag_len) {
 191                /* Frame is fragmented: duration increases with time needed to
 192                 * transmit next fragment plus ACK and 2 x SIFS. */
 193                dur *= 2; /* ACK + SIFS */
 194                /* next fragment */
 195                dur += ieee80211_frame_duration(sband->band, next_frag_len,
 196                                txrate->bitrate, erp,
 197                                tx->sdata->vif.bss_conf.use_short_preamble,
 198                                shift);
 199        }
 200
 201        return cpu_to_le16(dur);
 202}
 203
 204/* tx handlers */
 205static ieee80211_tx_result debug_noinline
 206ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
 207{
 208        struct ieee80211_local *local = tx->local;
 209        struct ieee80211_if_managed *ifmgd;
 210        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 211
 212        /* driver doesn't support power save */
 213        if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS))
 214                return TX_CONTINUE;
 215
 216        /* hardware does dynamic power save */
 217        if (ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
 218                return TX_CONTINUE;
 219
 220        /* dynamic power save disabled */
 221        if (local->hw.conf.dynamic_ps_timeout <= 0)
 222                return TX_CONTINUE;
 223
 224        /* we are scanning, don't enable power save */
 225        if (local->scanning)
 226                return TX_CONTINUE;
 227
 228        if (!local->ps_sdata)
 229                return TX_CONTINUE;
 230
 231        /* No point if we're going to suspend */
 232        if (local->quiescing)
 233                return TX_CONTINUE;
 234
 235        /* dynamic ps is supported only in managed mode */
 236        if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
 237                return TX_CONTINUE;
 238
 239        if (unlikely(info->flags & IEEE80211_TX_INTFL_OFFCHAN_TX_OK))
 240                return TX_CONTINUE;
 241
 242        ifmgd = &tx->sdata->u.mgd;
 243
 244        /*
 245         * Don't wakeup from power save if u-apsd is enabled, voip ac has
 246         * u-apsd enabled and the frame is in voip class. This effectively
 247         * means that even if all access categories have u-apsd enabled, in
 248         * practise u-apsd is only used with the voip ac. This is a
 249         * workaround for the case when received voip class packets do not
 250         * have correct qos tag for some reason, due the network or the
 251         * peer application.
 252         *
 253         * Note: ifmgd->uapsd_queues access is racy here. If the value is
 254         * changed via debugfs, user needs to reassociate manually to have
 255         * everything in sync.
 256         */
 257        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&
 258            (ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&
 259            skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)
 260                return TX_CONTINUE;
 261
 262        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
 263                ieee80211_stop_queues_by_reason(&local->hw,
 264                                                IEEE80211_MAX_QUEUE_MAP,
 265                                                IEEE80211_QUEUE_STOP_REASON_PS,
 266                                                false);
 267                ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;
 268                ieee80211_queue_work(&local->hw,
 269                                     &local->dynamic_ps_disable_work);
 270        }
 271
 272        /* Don't restart the timer if we're not disassociated */
 273        if (!ifmgd->associated)
 274                return TX_CONTINUE;
 275
 276        mod_timer(&local->dynamic_ps_timer, jiffies +
 277                  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
 278
 279        return TX_CONTINUE;
 280}
 281
 282static ieee80211_tx_result debug_noinline
 283ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 284{
 285
 286        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 287        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 288        bool assoc = false;
 289
 290        if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))
 291                return TX_CONTINUE;
 292
 293        if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
 294            test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
 295            !ieee80211_is_probe_req(hdr->frame_control) &&
 296            !ieee80211_is_any_nullfunc(hdr->frame_control))
 297                /*
 298                 * When software scanning only nullfunc frames (to notify
 299                 * the sleep state to the AP) and probe requests (for the
 300                 * active scan) are allowed, all other frames should not be
 301                 * sent and we should not get here, but if we do
 302                 * nonetheless, drop them to avoid sending them
 303                 * off-channel. See the link below and
 304                 * ieee80211_start_scan() for more.
 305                 *
 306                 * http://article.gmane.org/gmane.linux.kernel.wireless.general/30089
 307                 */
 308                return TX_DROP;
 309
 310        if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)
 311                return TX_CONTINUE;
 312
 313        if (tx->flags & IEEE80211_TX_PS_BUFFERED)
 314                return TX_CONTINUE;
 315
 316        if (tx->sta)
 317                assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
 318
 319        if (likely(tx->flags & IEEE80211_TX_UNICAST)) {
 320                if (unlikely(!assoc &&
 321                             ieee80211_is_data(hdr->frame_control))) {
 322#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 323                        sdata_info(tx->sdata,
 324                                   "dropped data frame to not associated station %pM\n",
 325                                   hdr->addr1);
 326#endif
 327                        I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
 328                        return TX_DROP;
 329                }
 330        } else if (unlikely(ieee80211_is_data(hdr->frame_control) &&
 331                            ieee80211_vif_get_num_mcast_if(tx->sdata) == 0)) {
 332                /*
 333                 * No associated STAs - no need to send multicast
 334                 * frames.
 335                 */
 336                return TX_DROP;
 337        }
 338
 339        return TX_CONTINUE;
 340}
 341
 342/* This function is called whenever the AP is about to exceed the maximum limit
 343 * of buffered frames for power saving STAs. This situation should not really
 344 * happen often during normal operation, so dropping the oldest buffered packet
 345 * from each queue should be OK to make some room for new frames. */
 346static void purge_old_ps_buffers(struct ieee80211_local *local)
 347{
 348        int total = 0, purged = 0;
 349        struct sk_buff *skb;
 350        struct ieee80211_sub_if_data *sdata;
 351        struct sta_info *sta;
 352
 353        list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 354                struct ps_data *ps;
 355
 356                if (sdata->vif.type == NL80211_IFTYPE_AP)
 357                        ps = &sdata->u.ap.ps;
 358                else if (ieee80211_vif_is_mesh(&sdata->vif))
 359                        ps = &sdata->u.mesh.ps;
 360                else
 361                        continue;
 362
 363                skb = skb_dequeue(&ps->bc_buf);
 364                if (skb) {
 365                        purged++;
 366                        ieee80211_free_txskb(&local->hw, skb);
 367                }
 368                total += skb_queue_len(&ps->bc_buf);
 369        }
 370
 371        /*
 372         * Drop one frame from each station from the lowest-priority
 373         * AC that has frames at all.
 374         */
 375        list_for_each_entry_rcu(sta, &local->sta_list, list) {
 376                int ac;
 377
 378                for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {
 379                        skb = skb_dequeue(&sta->ps_tx_buf[ac]);
 380                        total += skb_queue_len(&sta->ps_tx_buf[ac]);
 381                        if (skb) {
 382                                purged++;
 383                                ieee80211_free_txskb(&local->hw, skb);
 384                                break;
 385                        }
 386                }
 387        }
 388
 389        local->total_ps_buffered = total;
 390        ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);
 391}
 392
 393static ieee80211_tx_result
 394ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 395{
 396        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 397        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 398        struct ps_data *ps;
 399
 400        /*
 401         * broadcast/multicast frame
 402         *
 403         * If any of the associated/peer stations is in power save mode,
 404         * the frame is buffered to be sent after DTIM beacon frame.
 405         * This is done either by the hardware or us.
 406         */
 407
 408        /* powersaving STAs currently only in AP/VLAN/mesh mode */
 409        if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
 410            tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
 411                if (!tx->sdata->bss)
 412                        return TX_CONTINUE;
 413
 414                ps = &tx->sdata->bss->ps;
 415        } else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {
 416                ps = &tx->sdata->u.mesh.ps;
 417        } else {
 418                return TX_CONTINUE;
 419        }
 420
 421
 422        /* no buffering for ordered frames */
 423        if (ieee80211_has_order(hdr->frame_control))
 424                return TX_CONTINUE;
 425
 426        if (ieee80211_is_probe_req(hdr->frame_control))
 427                return TX_CONTINUE;
 428
 429        if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
 430                info->hw_queue = tx->sdata->vif.cab_queue;
 431
 432        /* no stations in PS mode and no buffered packets */
 433        if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
 434                return TX_CONTINUE;
 435
 436        info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
 437
 438        /* device releases frame after DTIM beacon */
 439        if (!ieee80211_hw_check(&tx->local->hw, HOST_BROADCAST_PS_BUFFERING))
 440                return TX_CONTINUE;
 441
 442        /* buffered in mac80211 */
 443        if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
 444                purge_old_ps_buffers(tx->local);
 445
 446        if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
 447                ps_dbg(tx->sdata,
 448                       "BC TX buffer full - dropping the oldest frame\n");
 449                ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
 450        } else
 451                tx->local->total_ps_buffered++;
 452
 453        skb_queue_tail(&ps->bc_buf, tx->skb);
 454
 455        return TX_QUEUED;
 456}
 457
 458static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,
 459                             struct sk_buff *skb)
 460{
 461        if (!ieee80211_is_mgmt(fc))
 462                return 0;
 463
 464        if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))
 465                return 0;
 466
 467        if (!ieee80211_is_robust_mgmt_frame(skb))
 468                return 0;
 469
 470        return 1;
 471}
 472
 473static ieee80211_tx_result
 474ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 475{
 476        struct sta_info *sta = tx->sta;
 477        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 478        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 479        struct ieee80211_local *local = tx->local;
 480
 481        if (unlikely(!sta))
 482                return TX_CONTINUE;
 483
 484        if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||
 485                      test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
 486                      test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&
 487                     !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
 488                int ac = skb_get_queue_mapping(tx->skb);
 489
 490                if (ieee80211_is_mgmt(hdr->frame_control) &&
 491                    !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) {
 492                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
 493                        return TX_CONTINUE;
 494                }
 495
 496                ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
 497                       sta->sta.addr, sta->sta.aid, ac);
 498                if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
 499                        purge_old_ps_buffers(tx->local);
 500
 501                /* sync with ieee80211_sta_ps_deliver_wakeup */
 502                spin_lock(&sta->ps_lock);
 503                /*
 504                 * STA woke up the meantime and all the frames on ps_tx_buf have
 505                 * been queued to pending queue. No reordering can happen, go
 506                 * ahead and Tx the packet.
 507                 */
 508                if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&
 509                    !test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&
 510                    !test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {
 511                        spin_unlock(&sta->ps_lock);
 512                        return TX_CONTINUE;
 513                }
 514
 515                if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {
 516                        struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);
 517                        ps_dbg(tx->sdata,
 518                               "STA %pM TX buffer for AC %d full - dropping oldest frame\n",
 519                               sta->sta.addr, ac);
 520                        ieee80211_free_txskb(&local->hw, old);
 521                } else
 522                        tx->local->total_ps_buffered++;
 523
 524                info->control.jiffies = jiffies;
 525                info->control.vif = &tx->sdata->vif;
 526                info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
 527                info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
 528                skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
 529                spin_unlock(&sta->ps_lock);
 530
 531                if (!timer_pending(&local->sta_cleanup))
 532                        mod_timer(&local->sta_cleanup,
 533                                  round_jiffies(jiffies +
 534                                                STA_INFO_CLEANUP_INTERVAL));
 535
 536                /*
 537                 * We queued up some frames, so the TIM bit might
 538                 * need to be set, recalculate it.
 539                 */
 540                sta_info_recalc_tim(sta);
 541
 542                return TX_QUEUED;
 543        } else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {
 544                ps_dbg(tx->sdata,
 545                       "STA %pM in PS mode, but polling/in SP -> send frame\n",
 546                       sta->sta.addr);
 547        }
 548
 549        return TX_CONTINUE;
 550}
 551
 552static ieee80211_tx_result debug_noinline
 553ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 554{
 555        if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
 556                return TX_CONTINUE;
 557
 558        if (tx->flags & IEEE80211_TX_UNICAST)
 559                return ieee80211_tx_h_unicast_ps_buf(tx);
 560        else
 561                return ieee80211_tx_h_multicast_ps_buf(tx);
 562}
 563
 564static ieee80211_tx_result debug_noinline
 565ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
 566{
 567        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 568
 569        if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
 570                if (tx->sdata->control_port_no_encrypt)
 571                        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
 572                info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;
 573                info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
 574        }
 575
 576        return TX_CONTINUE;
 577}
 578
 579static ieee80211_tx_result debug_noinline
 580ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
 581{
 582        struct ieee80211_key *key;
 583        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 584        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 585
 586        if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {
 587                tx->key = NULL;
 588                return TX_CONTINUE;
 589        }
 590
 591        if (tx->sta &&
 592            (key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))
 593                tx->key = key;
 594        else if (ieee80211_is_group_privacy_action(tx->skb) &&
 595                (key = rcu_dereference(tx->sdata->default_multicast_key)))
 596                tx->key = key;
 597        else if (ieee80211_is_mgmt(hdr->frame_control) &&
 598                 is_multicast_ether_addr(hdr->addr1) &&
 599                 ieee80211_is_robust_mgmt_frame(tx->skb) &&
 600                 (key = rcu_dereference(tx->sdata->default_mgmt_key)))
 601                tx->key = key;
 602        else if (is_multicast_ether_addr(hdr->addr1) &&
 603                 (key = rcu_dereference(tx->sdata->default_multicast_key)))
 604                tx->key = key;
 605        else if (!is_multicast_ether_addr(hdr->addr1) &&
 606                 (key = rcu_dereference(tx->sdata->default_unicast_key)))
 607                tx->key = key;
 608        else
 609                tx->key = NULL;
 610
 611        if (tx->key) {
 612                bool skip_hw = false;
 613
 614                /* TODO: add threshold stuff again */
 615
 616                switch (tx->key->conf.cipher) {
 617                case WLAN_CIPHER_SUITE_WEP40:
 618                case WLAN_CIPHER_SUITE_WEP104:
 619                case WLAN_CIPHER_SUITE_TKIP:
 620                        if (!ieee80211_is_data_present(hdr->frame_control))
 621                                tx->key = NULL;
 622                        break;
 623                case WLAN_CIPHER_SUITE_CCMP:
 624                case WLAN_CIPHER_SUITE_CCMP_256:
 625                case WLAN_CIPHER_SUITE_GCMP:
 626                case WLAN_CIPHER_SUITE_GCMP_256:
 627                        if (!ieee80211_is_data_present(hdr->frame_control) &&
 628                            !ieee80211_use_mfp(hdr->frame_control, tx->sta,
 629                                               tx->skb) &&
 630                            !ieee80211_is_group_privacy_action(tx->skb))
 631                                tx->key = NULL;
 632                        else
 633                                skip_hw = (tx->key->conf.flags &
 634                                           IEEE80211_KEY_FLAG_SW_MGMT_TX) &&
 635                                        ieee80211_is_mgmt(hdr->frame_control);
 636                        break;
 637                case WLAN_CIPHER_SUITE_AES_CMAC:
 638                case WLAN_CIPHER_SUITE_BIP_CMAC_256:
 639                case WLAN_CIPHER_SUITE_BIP_GMAC_128:
 640                case WLAN_CIPHER_SUITE_BIP_GMAC_256:
 641                        if (!ieee80211_is_mgmt(hdr->frame_control))
 642                                tx->key = NULL;
 643                        break;
 644                }
 645
 646                if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
 647                             !ieee80211_is_deauth(hdr->frame_control)))
 648                        return TX_DROP;
 649
 650                if (!skip_hw && tx->key &&
 651                    tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
 652                        info->control.hw_key = &tx->key->conf;
 653        } else if (ieee80211_is_data_present(hdr->frame_control) && tx->sta &&
 654                   test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
 655                return TX_DROP;
 656        }
 657
 658        return TX_CONTINUE;
 659}
 660
 661static ieee80211_tx_result debug_noinline
 662ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 663{
 664        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 665        struct ieee80211_hdr *hdr = (void *)tx->skb->data;
 666        struct ieee80211_supported_band *sband;
 667        u32 len;
 668        struct ieee80211_tx_rate_control txrc;
 669        struct ieee80211_sta_rates *ratetbl = NULL;
 670        bool encap = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
 671        bool assoc = false;
 672
 673        memset(&txrc, 0, sizeof(txrc));
 674
 675        sband = tx->local->hw.wiphy->bands[info->band];
 676
 677        len = min_t(u32, tx->skb->len + FCS_LEN,
 678                         tx->local->hw.wiphy->frag_threshold);
 679
 680        /* set up the tx rate control struct we give the RC algo */
 681        txrc.hw = &tx->local->hw;
 682        txrc.sband = sband;
 683        txrc.bss_conf = &tx->sdata->vif.bss_conf;
 684        txrc.skb = tx->skb;
 685        txrc.reported_rate.idx = -1;
 686        txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];
 687
 688        if (tx->sdata->rc_has_mcs_mask[info->band])
 689                txrc.rate_idx_mcs_mask =
 690                        tx->sdata->rc_rateidx_mcs_mask[info->band];
 691
 692        txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||
 693                    tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
 694                    tx->sdata->vif.type == NL80211_IFTYPE_ADHOC ||
 695                    tx->sdata->vif.type == NL80211_IFTYPE_OCB);
 696
 697        /* set up RTS protection if desired */
 698        if (len > tx->local->hw.wiphy->rts_threshold) {
 699                txrc.rts = true;
 700        }
 701
 702        info->control.use_rts = txrc.rts;
 703        info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;
 704
 705        /*
 706         * Use short preamble if the BSS can handle it, but not for
 707         * management frames unless we know the receiver can handle
 708         * that -- the management frame might be to a station that
 709         * just wants a probe response.
 710         */
 711        if (tx->sdata->vif.bss_conf.use_short_preamble &&
 712            (ieee80211_is_tx_data(tx->skb) ||
 713             (tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))
 714                txrc.short_preamble = true;
 715
 716        info->control.short_preamble = txrc.short_preamble;
 717
 718        /* don't ask rate control when rate already injected via radiotap */
 719        if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)
 720                return TX_CONTINUE;
 721
 722        if (tx->sta)
 723                assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);
 724
 725        /*
 726         * Lets not bother rate control if we're associated and cannot
 727         * talk to the sta. This should not happen.
 728         */
 729        if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&
 730                 !rate_usable_index_exists(sband, &tx->sta->sta),
 731                 "%s: Dropped data frame as no usable bitrate found while "
 732                 "scanning and associated. Target station: "
 733                 "%pM on %d GHz band\n",
 734                 tx->sdata->name,
 735                 encap ? ((struct ethhdr *)hdr)->h_dest : hdr->addr1,
 736                 info->band ? 5 : 2))
 737                return TX_DROP;
 738
 739        /*
 740         * If we're associated with the sta at this point we know we can at
 741         * least send the frame at the lowest bit rate.
 742         */
 743        rate_control_get_rate(tx->sdata, tx->sta, &txrc);
 744
 745        if (tx->sta && !info->control.skip_table)
 746                ratetbl = rcu_dereference(tx->sta->sta.rates);
 747
 748        if (unlikely(info->control.rates[0].idx < 0)) {
 749                if (ratetbl) {
 750                        struct ieee80211_tx_rate rate = {
 751                                .idx = ratetbl->rate[0].idx,
 752                                .flags = ratetbl->rate[0].flags,
 753                                .count = ratetbl->rate[0].count
 754                        };
 755
 756                        if (ratetbl->rate[0].idx < 0)
 757                                return TX_DROP;
 758
 759                        tx->rate = rate;
 760                } else {
 761                        return TX_DROP;
 762                }
 763        } else {
 764                tx->rate = info->control.rates[0];
 765        }
 766
 767        if (txrc.reported_rate.idx < 0) {
 768                txrc.reported_rate = tx->rate;
 769                if (tx->sta && ieee80211_is_tx_data(tx->skb))
 770                        tx->sta->tx_stats.last_rate = txrc.reported_rate;
 771        } else if (tx->sta)
 772                tx->sta->tx_stats.last_rate = txrc.reported_rate;
 773
 774        if (ratetbl)
 775                return TX_CONTINUE;
 776
 777        if (unlikely(!info->control.rates[0].count))
 778                info->control.rates[0].count = 1;
 779
 780        if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&
 781                         (info->flags & IEEE80211_TX_CTL_NO_ACK)))
 782                info->control.rates[0].count = 1;
 783
 784        return TX_CONTINUE;
 785}
 786
 787static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
 788{
 789        u16 *seq = &sta->tid_seq[tid];
 790        __le16 ret = cpu_to_le16(*seq);
 791
 792        /* Increase the sequence number. */
 793        *seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;
 794
 795        return ret;
 796}
 797
 798static ieee80211_tx_result debug_noinline
 799ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 800{
 801        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
 802        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
 803        int tid;
 804
 805        /*
 806         * Packet injection may want to control the sequence
 807         * number, if we have no matching interface then we
 808         * neither assign one ourselves nor ask the driver to.
 809         */
 810        if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
 811                return TX_CONTINUE;
 812
 813        if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
 814                return TX_CONTINUE;
 815
 816        if (ieee80211_hdrlen(hdr->frame_control) < 24)
 817                return TX_CONTINUE;
 818
 819        if (ieee80211_is_qos_nullfunc(hdr->frame_control))
 820                return TX_CONTINUE;
 821
 822        if (info->control.flags & IEEE80211_TX_CTRL_NO_SEQNO)
 823                return TX_CONTINUE;
 824
 825        /*
 826         * Anything but QoS data that has a sequence number field
 827         * (is long enough) gets a sequence number from the global
 828         * counter.  QoS data frames with a multicast destination
 829         * also use the global counter (802.11-2012 9.3.2.10).
 830         */
 831        if (!ieee80211_is_data_qos(hdr->frame_control) ||
 832            is_multicast_ether_addr(hdr->addr1)) {
 833                /* driver should assign sequence number */
 834                info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
 835                /* for pure STA mode without beacons, we can do it */
 836                hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);
 837                tx->sdata->sequence_number += 0x10;
 838                if (tx->sta)
 839                        tx->sta->tx_stats.msdu[IEEE80211_NUM_TIDS]++;
 840                return TX_CONTINUE;
 841        }
 842
 843        /*
 844         * This should be true for injected/management frames only, for
 845         * management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ
 846         * above since they are not QoS-data frames.
 847         */
 848        if (!tx->sta)
 849                return TX_CONTINUE;
 850
 851        /* include per-STA, per-TID sequence counter */
 852        tid = ieee80211_get_tid(hdr);
 853        tx->sta->tx_stats.msdu[tid]++;
 854
 855        hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
 856
 857        return TX_CONTINUE;
 858}
 859
 860static int ieee80211_fragment(struct ieee80211_tx_data *tx,
 861                              struct sk_buff *skb, int hdrlen,
 862                              int frag_threshold)
 863{
 864        struct ieee80211_local *local = tx->local;
 865        struct ieee80211_tx_info *info;
 866        struct sk_buff *tmp;
 867        int per_fragm = frag_threshold - hdrlen - FCS_LEN;
 868        int pos = hdrlen + per_fragm;
 869        int rem = skb->len - hdrlen - per_fragm;
 870
 871        if (WARN_ON(rem < 0))
 872                return -EINVAL;
 873
 874        /* first fragment was already added to queue by caller */
 875
 876        while (rem) {
 877                int fraglen = per_fragm;
 878
 879                if (fraglen > rem)
 880                        fraglen = rem;
 881                rem -= fraglen;
 882                tmp = dev_alloc_skb(local->tx_headroom +
 883                                    frag_threshold +
 884                                    tx->sdata->encrypt_headroom +
 885                                    IEEE80211_ENCRYPT_TAILROOM);
 886                if (!tmp)
 887                        return -ENOMEM;
 888
 889                __skb_queue_tail(&tx->skbs, tmp);
 890
 891                skb_reserve(tmp,
 892                            local->tx_headroom + tx->sdata->encrypt_headroom);
 893
 894                /* copy control information */
 895                memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));
 896
 897                info = IEEE80211_SKB_CB(tmp);
 898                info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |
 899                                 IEEE80211_TX_CTL_FIRST_FRAGMENT);
 900
 901                if (rem)
 902                        info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;
 903
 904                skb_copy_queue_mapping(tmp, skb);
 905                tmp->priority = skb->priority;
 906                tmp->dev = skb->dev;
 907
 908                /* copy header and data */
 909                skb_put_data(tmp, skb->data, hdrlen);
 910                skb_put_data(tmp, skb->data + pos, fraglen);
 911
 912                pos += fraglen;
 913        }
 914
 915        /* adjust first fragment's length */
 916        skb_trim(skb, hdrlen + per_fragm);
 917        return 0;
 918}
 919
 920static ieee80211_tx_result debug_noinline
 921ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
 922{
 923        struct sk_buff *skb = tx->skb;
 924        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 925        struct ieee80211_hdr *hdr = (void *)skb->data;
 926        int frag_threshold = tx->local->hw.wiphy->frag_threshold;
 927        int hdrlen;
 928        int fragnum;
 929
 930        /* no matter what happens, tx->skb moves to tx->skbs */
 931        __skb_queue_tail(&tx->skbs, skb);
 932        tx->skb = NULL;
 933
 934        if (info->flags & IEEE80211_TX_CTL_DONTFRAG)
 935                return TX_CONTINUE;
 936
 937        if (ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG))
 938                return TX_CONTINUE;
 939
 940        /*
 941         * Warn when submitting a fragmented A-MPDU frame and drop it.
 942         * This scenario is handled in ieee80211_tx_prepare but extra
 943         * caution taken here as fragmented ampdu may cause Tx stop.
 944         */
 945        if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))
 946                return TX_DROP;
 947
 948        hdrlen = ieee80211_hdrlen(hdr->frame_control);
 949
 950        /* internal error, why isn't DONTFRAG set? */
 951        if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
 952                return TX_DROP;
 953
 954        /*
 955         * Now fragment the frame. This will allocate all the fragments and
 956         * chain them (using skb as the first fragment) to skb->next.
 957         * During transmission, we will remove the successfully transmitted
 958         * fragments from this list. When the low-level driver rejects one
 959         * of the fragments then we will simply pretend to accept the skb
 960         * but store it away as pending.
 961         */
 962        if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))
 963                return TX_DROP;
 964
 965        /* update duration/seq/flags of fragments */
 966        fragnum = 0;
 967
 968        skb_queue_walk(&tx->skbs, skb) {
 969                const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);
 970
 971                hdr = (void *)skb->data;
 972                info = IEEE80211_SKB_CB(skb);
 973
 974                if (!skb_queue_is_last(&tx->skbs, skb)) {
 975                        hdr->frame_control |= morefrags;
 976                        /*
 977                         * No multi-rate retries for fragmented frames, that
 978                         * would completely throw off the NAV at other STAs.
 979                         */
 980                        info->control.rates[1].idx = -1;
 981                        info->control.rates[2].idx = -1;
 982                        info->control.rates[3].idx = -1;
 983                        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 4);
 984                        info->flags &= ~IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 985                } else {
 986                        hdr->frame_control &= ~morefrags;
 987                }
 988                hdr->seq_ctrl |= cpu_to_le16(fragnum & IEEE80211_SCTL_FRAG);
 989                fragnum++;
 990        }
 991
 992        return TX_CONTINUE;
 993}
 994
 995static ieee80211_tx_result debug_noinline
 996ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
 997{
 998        struct sk_buff *skb;
 999        int ac = -1;
1000
1001        if (!tx->sta)
1002                return TX_CONTINUE;
1003
1004        skb_queue_walk(&tx->skbs, skb) {
1005                ac = skb_get_queue_mapping(skb);
1006                tx->sta->tx_stats.bytes[ac] += skb->len;
1007        }
1008        if (ac >= 0)
1009                tx->sta->tx_stats.packets[ac]++;
1010
1011        return TX_CONTINUE;
1012}
1013
1014static ieee80211_tx_result debug_noinline
1015ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
1016{
1017        if (!tx->key)
1018                return TX_CONTINUE;
1019
1020        switch (tx->key->conf.cipher) {
1021        case WLAN_CIPHER_SUITE_WEP40:
1022        case WLAN_CIPHER_SUITE_WEP104:
1023                return ieee80211_crypto_wep_encrypt(tx);
1024        case WLAN_CIPHER_SUITE_TKIP:
1025                return ieee80211_crypto_tkip_encrypt(tx);
1026        case WLAN_CIPHER_SUITE_CCMP:
1027                return ieee80211_crypto_ccmp_encrypt(
1028                        tx, IEEE80211_CCMP_MIC_LEN);
1029        case WLAN_CIPHER_SUITE_CCMP_256:
1030                return ieee80211_crypto_ccmp_encrypt(
1031                        tx, IEEE80211_CCMP_256_MIC_LEN);
1032        case WLAN_CIPHER_SUITE_AES_CMAC:
1033                return ieee80211_crypto_aes_cmac_encrypt(tx);
1034        case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1035                return ieee80211_crypto_aes_cmac_256_encrypt(tx);
1036        case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1037        case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1038                return ieee80211_crypto_aes_gmac_encrypt(tx);
1039        case WLAN_CIPHER_SUITE_GCMP:
1040        case WLAN_CIPHER_SUITE_GCMP_256:
1041                return ieee80211_crypto_gcmp_encrypt(tx);
1042        default:
1043                return ieee80211_crypto_hw_encrypt(tx);
1044        }
1045
1046        return TX_DROP;
1047}
1048
1049static ieee80211_tx_result debug_noinline
1050ieee80211_tx_h_calculate_duration(struct ieee80211_tx_data *tx)
1051{
1052        struct sk_buff *skb;
1053        struct ieee80211_hdr *hdr;
1054        int next_len;
1055        bool group_addr;
1056
1057        skb_queue_walk(&tx->skbs, skb) {
1058                hdr = (void *) skb->data;
1059                if (unlikely(ieee80211_is_pspoll(hdr->frame_control)))
1060                        break; /* must not overwrite AID */
1061                if (!skb_queue_is_last(&tx->skbs, skb)) {
1062                        struct sk_buff *next = skb_queue_next(&tx->skbs, skb);
1063                        next_len = next->len;
1064                } else
1065                        next_len = 0;
1066                group_addr = is_multicast_ether_addr(hdr->addr1);
1067
1068                hdr->duration_id =
1069                        ieee80211_duration(tx, skb, group_addr, next_len);
1070        }
1071
1072        return TX_CONTINUE;
1073}
1074
1075/* actual transmit path */
1076
1077static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
1078                                  struct sk_buff *skb,
1079                                  struct ieee80211_tx_info *info,
1080                                  struct tid_ampdu_tx *tid_tx,
1081                                  int tid)
1082{
1083        bool queued = false;
1084        bool reset_agg_timer = false;
1085        struct sk_buff *purge_skb = NULL;
1086
1087        if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1088                info->flags |= IEEE80211_TX_CTL_AMPDU;
1089                reset_agg_timer = true;
1090        } else if (test_bit(HT_AGG_STATE_WANT_START, &tid_tx->state)) {
1091                /*
1092                 * nothing -- this aggregation session is being started
1093                 * but that might still fail with the driver
1094                 */
1095        } else if (!tx->sta->sta.txq[tid]) {
1096                spin_lock(&tx->sta->lock);
1097                /*
1098                 * Need to re-check now, because we may get here
1099                 *
1100                 *  1) in the window during which the setup is actually
1101                 *     already done, but not marked yet because not all
1102                 *     packets are spliced over to the driver pending
1103                 *     queue yet -- if this happened we acquire the lock
1104                 *     either before or after the splice happens, but
1105                 *     need to recheck which of these cases happened.
1106                 *
1107                 *  2) during session teardown, if the OPERATIONAL bit
1108                 *     was cleared due to the teardown but the pointer
1109                 *     hasn't been assigned NULL yet (or we loaded it
1110                 *     before it was assigned) -- in this case it may
1111                 *     now be NULL which means we should just let the
1112                 *     packet pass through because splicing the frames
1113                 *     back is already done.
1114                 */
1115                tid_tx = rcu_dereference_protected_tid_tx(tx->sta, tid);
1116
1117                if (!tid_tx) {
1118                        /* do nothing, let packet pass through */
1119                } else if (test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state)) {
1120                        info->flags |= IEEE80211_TX_CTL_AMPDU;
1121                        reset_agg_timer = true;
1122                } else {
1123                        queued = true;
1124                        if (info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER) {
1125                                clear_sta_flag(tx->sta, WLAN_STA_SP);
1126                                ps_dbg(tx->sta->sdata,
1127                                       "STA %pM aid %d: SP frame queued, close the SP w/o telling the peer\n",
1128                                       tx->sta->sta.addr, tx->sta->sta.aid);
1129                        }
1130                        info->control.vif = &tx->sdata->vif;
1131                        info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
1132                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
1133                        __skb_queue_tail(&tid_tx->pending, skb);
1134                        if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
1135                                purge_skb = __skb_dequeue(&tid_tx->pending);
1136                }
1137                spin_unlock(&tx->sta->lock);
1138
1139                if (purge_skb)
1140                        ieee80211_free_txskb(&tx->local->hw, purge_skb);
1141        }
1142
1143        /* reset session timer */
1144        if (reset_agg_timer)
1145                tid_tx->last_tx = jiffies;
1146
1147        return queued;
1148}
1149
1150static void
1151ieee80211_aggr_check(struct ieee80211_sub_if_data *sdata,
1152                     struct sta_info *sta,
1153                     struct sk_buff *skb)
1154{
1155        struct rate_control_ref *ref = sdata->local->rate_ctrl;
1156        u16 tid;
1157
1158        if (!ref || !(ref->ops->capa & RATE_CTRL_CAPA_AMPDU_TRIGGER))
1159                return;
1160
1161        if (!sta || !sta->sta.ht_cap.ht_supported ||
1162            !sta->sta.wme || skb_get_queue_mapping(skb) == IEEE80211_AC_VO ||
1163            skb->protocol == sdata->control_port_protocol)
1164                return;
1165
1166        tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1167        if (likely(sta->ampdu_mlme.tid_tx[tid]))
1168                return;
1169
1170        ieee80211_start_tx_ba_session(&sta->sta, tid, 0);
1171}
1172
1173/*
1174 * initialises @tx
1175 * pass %NULL for the station if unknown, a valid pointer if known
1176 * or an ERR_PTR() if the station is known not to exist
1177 */
1178static ieee80211_tx_result
1179ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
1180                     struct ieee80211_tx_data *tx,
1181                     struct sta_info *sta, struct sk_buff *skb)
1182{
1183        struct ieee80211_local *local = sdata->local;
1184        struct ieee80211_hdr *hdr;
1185        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1186        bool aggr_check = false;
1187        int tid;
1188
1189        memset(tx, 0, sizeof(*tx));
1190        tx->skb = skb;
1191        tx->local = local;
1192        tx->sdata = sdata;
1193        __skb_queue_head_init(&tx->skbs);
1194
1195        /*
1196         * If this flag is set to true anywhere, and we get here,
1197         * we are doing the needed processing, so remove the flag
1198         * now.
1199         */
1200        info->control.flags &= ~IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
1201
1202        hdr = (struct ieee80211_hdr *) skb->data;
1203
1204        if (likely(sta)) {
1205                if (!IS_ERR(sta))
1206                        tx->sta = sta;
1207        } else {
1208                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
1209                        tx->sta = rcu_dereference(sdata->u.vlan.sta);
1210                        if (!tx->sta && sdata->wdev.use_4addr)
1211                                return TX_DROP;
1212                } else if (tx->sdata->control_port_protocol == tx->skb->protocol) {
1213                        tx->sta = sta_info_get_bss(sdata, hdr->addr1);
1214                }
1215                if (!tx->sta && !is_multicast_ether_addr(hdr->addr1)) {
1216                        tx->sta = sta_info_get(sdata, hdr->addr1);
1217                        aggr_check = true;
1218                }
1219        }
1220
1221        if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
1222            !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
1223            ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
1224            !ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW)) {
1225                struct tid_ampdu_tx *tid_tx;
1226
1227                tid = ieee80211_get_tid(hdr);
1228                tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1229                if (!tid_tx && aggr_check) {
1230                        ieee80211_aggr_check(sdata, tx->sta, skb);
1231                        tid_tx = rcu_dereference(tx->sta->ampdu_mlme.tid_tx[tid]);
1232                }
1233
1234                if (tid_tx) {
1235                        bool queued;
1236
1237                        queued = ieee80211_tx_prep_agg(tx, skb, info,
1238                                                       tid_tx, tid);
1239
1240                        if (unlikely(queued))
1241                                return TX_QUEUED;
1242                }
1243        }
1244
1245        if (is_multicast_ether_addr(hdr->addr1)) {
1246                tx->flags &= ~IEEE80211_TX_UNICAST;
1247                info->flags |= IEEE80211_TX_CTL_NO_ACK;
1248        } else
1249                tx->flags |= IEEE80211_TX_UNICAST;
1250
1251        if (!(info->flags & IEEE80211_TX_CTL_DONTFRAG)) {
1252                if (!(tx->flags & IEEE80211_TX_UNICAST) ||
1253                    skb->len + FCS_LEN <= local->hw.wiphy->frag_threshold ||
1254                    info->flags & IEEE80211_TX_CTL_AMPDU)
1255                        info->flags |= IEEE80211_TX_CTL_DONTFRAG;
1256        }
1257
1258        if (!tx->sta)
1259                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1260        else if (test_and_clear_sta_flag(tx->sta, WLAN_STA_CLEAR_PS_FILT)) {
1261                info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
1262                ieee80211_check_fast_xmit(tx->sta);
1263        }
1264
1265        info->flags |= IEEE80211_TX_CTL_FIRST_FRAGMENT;
1266
1267        return TX_CONTINUE;
1268}
1269
1270static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
1271                                          struct ieee80211_vif *vif,
1272                                          struct sta_info *sta,
1273                                          struct sk_buff *skb)
1274{
1275        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1276        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1277        struct ieee80211_txq *txq = NULL;
1278
1279        if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
1280            (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
1281                return NULL;
1282
1283        if (!(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) &&
1284            unlikely(!ieee80211_is_data_present(hdr->frame_control))) {
1285                if ((!ieee80211_is_mgmt(hdr->frame_control) ||
1286                     ieee80211_is_bufferable_mmpdu(hdr->frame_control) ||
1287                     vif->type == NL80211_IFTYPE_STATION) &&
1288                    sta && sta->uploaded) {
1289                        /*
1290                         * This will be NULL if the driver didn't set the
1291                         * opt-in hardware flag.
1292                         */
1293                        txq = sta->sta.txq[IEEE80211_NUM_TIDS];
1294                }
1295        } else if (sta) {
1296                u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
1297
1298                if (!sta->uploaded)
1299                        return NULL;
1300
1301                txq = sta->sta.txq[tid];
1302        } else if (vif) {
1303                txq = vif->txq;
1304        }
1305
1306        if (!txq)
1307                return NULL;
1308
1309        return to_txq_info(txq);
1310}
1311
1312static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
1313{
1314        IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
1315}
1316
1317static u32 codel_skb_len_func(const struct sk_buff *skb)
1318{
1319        return skb->len;
1320}
1321
1322static codel_time_t codel_skb_time_func(const struct sk_buff *skb)
1323{
1324        const struct ieee80211_tx_info *info;
1325
1326        info = (const struct ieee80211_tx_info *)skb->cb;
1327        return info->control.enqueue_time;
1328}
1329
1330static struct sk_buff *codel_dequeue_func(struct codel_vars *cvars,
1331                                          void *ctx)
1332{
1333        struct ieee80211_local *local;
1334        struct txq_info *txqi;
1335        struct fq *fq;
1336        struct fq_flow *flow;
1337
1338        txqi = ctx;
1339        local = vif_to_sdata(txqi->txq.vif)->local;
1340        fq = &local->fq;
1341
1342        if (cvars == &txqi->def_cvars)
1343                flow = &txqi->tin.default_flow;
1344        else
1345                flow = &fq->flows[cvars - local->cvars];
1346
1347        return fq_flow_dequeue(fq, flow);
1348}
1349
1350static void codel_drop_func(struct sk_buff *skb,
1351                            void *ctx)
1352{
1353        struct ieee80211_local *local;
1354        struct ieee80211_hw *hw;
1355        struct txq_info *txqi;
1356
1357        txqi = ctx;
1358        local = vif_to_sdata(txqi->txq.vif)->local;
1359        hw = &local->hw;
1360
1361        ieee80211_free_txskb(hw, skb);
1362}
1363
1364static struct sk_buff *fq_tin_dequeue_func(struct fq *fq,
1365                                           struct fq_tin *tin,
1366                                           struct fq_flow *flow)
1367{
1368        struct ieee80211_local *local;
1369        struct txq_info *txqi;
1370        struct codel_vars *cvars;
1371        struct codel_params *cparams;
1372        struct codel_stats *cstats;
1373
1374        local = container_of(fq, struct ieee80211_local, fq);
1375        txqi = container_of(tin, struct txq_info, tin);
1376        cstats = &txqi->cstats;
1377
1378        if (txqi->txq.sta) {
1379                struct sta_info *sta = container_of(txqi->txq.sta,
1380                                                    struct sta_info, sta);
1381                cparams = &sta->cparams;
1382        } else {
1383                cparams = &local->cparams;
1384        }
1385
1386        if (flow == &tin->default_flow)
1387                cvars = &txqi->def_cvars;
1388        else
1389                cvars = &local->cvars[flow - fq->flows];
1390
1391        return codel_dequeue(txqi,
1392                             &flow->backlog,
1393                             cparams,
1394                             cvars,
1395                             cstats,
1396                             codel_skb_len_func,
1397                             codel_skb_time_func,
1398                             codel_drop_func,
1399                             codel_dequeue_func);
1400}
1401
1402static void fq_skb_free_func(struct fq *fq,
1403                             struct fq_tin *tin,
1404                             struct fq_flow *flow,
1405                             struct sk_buff *skb)
1406{
1407        struct ieee80211_local *local;
1408
1409        local = container_of(fq, struct ieee80211_local, fq);
1410        ieee80211_free_txskb(&local->hw, skb);
1411}
1412
1413static void ieee80211_txq_enqueue(struct ieee80211_local *local,
1414                                  struct txq_info *txqi,
1415                                  struct sk_buff *skb)
1416{
1417        struct fq *fq = &local->fq;
1418        struct fq_tin *tin = &txqi->tin;
1419        u32 flow_idx = fq_flow_idx(fq, skb);
1420
1421        ieee80211_set_skb_enqueue_time(skb);
1422
1423        spin_lock_bh(&fq->lock);
1424        /*
1425         * For management frames, don't really apply codel etc.,
1426         * we don't want to apply any shaping or anything we just
1427         * want to simplify the driver API by having them on the
1428         * txqi.
1429         */
1430        if (unlikely(txqi->txq.tid == IEEE80211_NUM_TIDS)) {
1431                IEEE80211_SKB_CB(skb)->control.flags |=
1432                        IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
1433                __skb_queue_tail(&txqi->frags, skb);
1434        } else {
1435                fq_tin_enqueue(fq, tin, flow_idx, skb,
1436                               fq_skb_free_func);
1437        }
1438        spin_unlock_bh(&fq->lock);
1439}
1440
1441static bool fq_vlan_filter_func(struct fq *fq, struct fq_tin *tin,
1442                                struct fq_flow *flow, struct sk_buff *skb,
1443                                void *data)
1444{
1445        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1446
1447        return info->control.vif == data;
1448}
1449
1450void ieee80211_txq_remove_vlan(struct ieee80211_local *local,
1451                               struct ieee80211_sub_if_data *sdata)
1452{
1453        struct fq *fq = &local->fq;
1454        struct txq_info *txqi;
1455        struct fq_tin *tin;
1456        struct ieee80211_sub_if_data *ap;
1457
1458        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN))
1459                return;
1460
1461        ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
1462
1463        if (!ap->vif.txq)
1464                return;
1465
1466        txqi = to_txq_info(ap->vif.txq);
1467        tin = &txqi->tin;
1468
1469        spin_lock_bh(&fq->lock);
1470        fq_tin_filter(fq, tin, fq_vlan_filter_func, &sdata->vif,
1471                      fq_skb_free_func);
1472        spin_unlock_bh(&fq->lock);
1473}
1474
1475void ieee80211_txq_init(struct ieee80211_sub_if_data *sdata,
1476                        struct sta_info *sta,
1477                        struct txq_info *txqi, int tid)
1478{
1479        fq_tin_init(&txqi->tin);
1480        codel_vars_init(&txqi->def_cvars);
1481        codel_stats_init(&txqi->cstats);
1482        __skb_queue_head_init(&txqi->frags);
1483        RB_CLEAR_NODE(&txqi->schedule_order);
1484
1485        txqi->txq.vif = &sdata->vif;
1486
1487        if (!sta) {
1488                sdata->vif.txq = &txqi->txq;
1489                txqi->txq.tid = 0;
1490                txqi->txq.ac = IEEE80211_AC_BE;
1491
1492                return;
1493        }
1494
1495        if (tid == IEEE80211_NUM_TIDS) {
1496                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
1497                        /* Drivers need to opt in to the management MPDU TXQ */
1498                        if (!ieee80211_hw_check(&sdata->local->hw,
1499                                                STA_MMPDU_TXQ))
1500                                return;
1501                } else if (!ieee80211_hw_check(&sdata->local->hw,
1502                                               BUFF_MMPDU_TXQ)) {
1503                        /* Drivers need to opt in to the bufferable MMPDU TXQ */
1504                        return;
1505                }
1506                txqi->txq.ac = IEEE80211_AC_VO;
1507        } else {
1508                txqi->txq.ac = ieee80211_ac_from_tid(tid);
1509        }
1510
1511        txqi->txq.sta = &sta->sta;
1512        txqi->txq.tid = tid;
1513        sta->sta.txq[tid] = &txqi->txq;
1514}
1515
1516void ieee80211_txq_purge(struct ieee80211_local *local,
1517                         struct txq_info *txqi)
1518{
1519        struct fq *fq = &local->fq;
1520        struct fq_tin *tin = &txqi->tin;
1521
1522        spin_lock_bh(&fq->lock);
1523        fq_tin_reset(fq, tin, fq_skb_free_func);
1524        ieee80211_purge_tx_queue(&local->hw, &txqi->frags);
1525        spin_unlock_bh(&fq->lock);
1526
1527        ieee80211_unschedule_txq(&local->hw, &txqi->txq, true);
1528}
1529
1530void ieee80211_txq_set_params(struct ieee80211_local *local)
1531{
1532        if (local->hw.wiphy->txq_limit)
1533                local->fq.limit = local->hw.wiphy->txq_limit;
1534        else
1535                local->hw.wiphy->txq_limit = local->fq.limit;
1536
1537        if (local->hw.wiphy->txq_memory_limit)
1538                local->fq.memory_limit = local->hw.wiphy->txq_memory_limit;
1539        else
1540                local->hw.wiphy->txq_memory_limit = local->fq.memory_limit;
1541
1542        if (local->hw.wiphy->txq_quantum)
1543                local->fq.quantum = local->hw.wiphy->txq_quantum;
1544        else
1545                local->hw.wiphy->txq_quantum = local->fq.quantum;
1546}
1547
1548int ieee80211_txq_setup_flows(struct ieee80211_local *local)
1549{
1550        struct fq *fq = &local->fq;
1551        int ret;
1552        int i;
1553        bool supp_vht = false;
1554        enum nl80211_band band;
1555
1556        if (!local->ops->wake_tx_queue)
1557                return 0;
1558
1559        ret = fq_init(fq, 4096);
1560        if (ret)
1561                return ret;
1562
1563        /*
1564         * If the hardware doesn't support VHT, it is safe to limit the maximum
1565         * queue size. 4 Mbytes is 64 max-size aggregates in 802.11n.
1566         */
1567        for (band = 0; band < NUM_NL80211_BANDS; band++) {
1568                struct ieee80211_supported_band *sband;
1569
1570                sband = local->hw.wiphy->bands[band];
1571                if (!sband)
1572                        continue;
1573
1574                supp_vht = supp_vht || sband->vht_cap.vht_supported;
1575        }
1576
1577        if (!supp_vht)
1578                fq->memory_limit = 4 << 20; /* 4 Mbytes */
1579
1580        codel_params_init(&local->cparams);
1581        local->cparams.interval = MS2TIME(100);
1582        local->cparams.target = MS2TIME(20);
1583        local->cparams.ecn = true;
1584
1585        local->cvars = kcalloc(fq->flows_cnt, sizeof(local->cvars[0]),
1586                               GFP_KERNEL);
1587        if (!local->cvars) {
1588                spin_lock_bh(&fq->lock);
1589                fq_reset(fq, fq_skb_free_func);
1590                spin_unlock_bh(&fq->lock);
1591                return -ENOMEM;
1592        }
1593
1594        for (i = 0; i < fq->flows_cnt; i++)
1595                codel_vars_init(&local->cvars[i]);
1596
1597        ieee80211_txq_set_params(local);
1598
1599        return 0;
1600}
1601
1602void ieee80211_txq_teardown_flows(struct ieee80211_local *local)
1603{
1604        struct fq *fq = &local->fq;
1605
1606        if (!local->ops->wake_tx_queue)
1607                return;
1608
1609        kfree(local->cvars);
1610        local->cvars = NULL;
1611
1612        spin_lock_bh(&fq->lock);
1613        fq_reset(fq, fq_skb_free_func);
1614        spin_unlock_bh(&fq->lock);
1615}
1616
1617static bool ieee80211_queue_skb(struct ieee80211_local *local,
1618                                struct ieee80211_sub_if_data *sdata,
1619                                struct sta_info *sta,
1620                                struct sk_buff *skb)
1621{
1622        struct ieee80211_vif *vif;
1623        struct txq_info *txqi;
1624
1625        if (!local->ops->wake_tx_queue ||
1626            sdata->vif.type == NL80211_IFTYPE_MONITOR)
1627                return false;
1628
1629        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1630                sdata = container_of(sdata->bss,
1631                                     struct ieee80211_sub_if_data, u.ap);
1632
1633        vif = &sdata->vif;
1634        txqi = ieee80211_get_txq(local, vif, sta, skb);
1635
1636        if (!txqi)
1637                return false;
1638
1639        ieee80211_txq_enqueue(local, txqi, skb);
1640
1641        schedule_and_wake_txq(local, txqi);
1642
1643        return true;
1644}
1645
1646static bool ieee80211_tx_frags(struct ieee80211_local *local,
1647                               struct ieee80211_vif *vif,
1648                               struct sta_info *sta,
1649                               struct sk_buff_head *skbs,
1650                               bool txpending)
1651{
1652        struct ieee80211_tx_control control = {};
1653        struct sk_buff *skb, *tmp;
1654        unsigned long flags;
1655
1656        skb_queue_walk_safe(skbs, skb, tmp) {
1657                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1658                int q = info->hw_queue;
1659
1660#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
1661                if (WARN_ON_ONCE(q >= local->hw.queues)) {
1662                        __skb_unlink(skb, skbs);
1663                        ieee80211_free_txskb(&local->hw, skb);
1664                        continue;
1665                }
1666#endif
1667
1668                spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
1669                if (local->queue_stop_reasons[q] ||
1670                    (!txpending && !skb_queue_empty(&local->pending[q]))) {
1671                        if (unlikely(info->flags &
1672                                     IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
1673                                if (local->queue_stop_reasons[q] &
1674                                    ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
1675                                        /*
1676                                         * Drop off-channel frames if queues
1677                                         * are stopped for any reason other
1678                                         * than off-channel operation. Never
1679                                         * queue them.
1680                                         */
1681                                        spin_unlock_irqrestore(
1682                                                &local->queue_stop_reason_lock,
1683                                                flags);
1684                                        ieee80211_purge_tx_queue(&local->hw,
1685                                                                 skbs);
1686                                        return true;
1687                                }
1688                        } else {
1689
1690                                /*
1691                                 * Since queue is stopped, queue up frames for
1692                                 * later transmission from the tx-pending
1693                                 * tasklet when the queue is woken again.
1694                                 */
1695                                if (txpending)
1696                                        skb_queue_splice_init(skbs,
1697                                                              &local->pending[q]);
1698                                else
1699                                        skb_queue_splice_tail_init(skbs,
1700                                                                   &local->pending[q]);
1701
1702                                spin_unlock_irqrestore(&local->queue_stop_reason_lock,
1703                                                       flags);
1704                                return false;
1705                        }
1706                }
1707                spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
1708
1709                info->control.vif = vif;
1710                control.sta = sta ? &sta->sta : NULL;
1711
1712                __skb_unlink(skb, skbs);
1713                drv_tx(local, &control, skb);
1714        }
1715
1716        return true;
1717}
1718
1719/*
1720 * Returns false if the frame couldn't be transmitted but was queued instead.
1721 */
1722static bool __ieee80211_tx(struct ieee80211_local *local,
1723                           struct sk_buff_head *skbs, int led_len,
1724                           struct sta_info *sta, bool txpending)
1725{
1726        struct ieee80211_tx_info *info;
1727        struct ieee80211_sub_if_data *sdata;
1728        struct ieee80211_vif *vif;
1729        struct sk_buff *skb;
1730        bool result;
1731        __le16 fc;
1732
1733        if (WARN_ON(skb_queue_empty(skbs)))
1734                return true;
1735
1736        skb = skb_peek(skbs);
1737        fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
1738        info = IEEE80211_SKB_CB(skb);
1739        sdata = vif_to_sdata(info->control.vif);
1740        if (sta && !sta->uploaded)
1741                sta = NULL;
1742
1743        switch (sdata->vif.type) {
1744        case NL80211_IFTYPE_MONITOR:
1745                if (sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
1746                        vif = &sdata->vif;
1747                        break;
1748                }
1749                sdata = rcu_dereference(local->monitor_sdata);
1750                if (sdata) {
1751                        vif = &sdata->vif;
1752                        info->hw_queue =
1753                                vif->hw_queue[skb_get_queue_mapping(skb)];
1754                } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
1755                        ieee80211_purge_tx_queue(&local->hw, skbs);
1756                        return true;
1757                } else
1758                        vif = NULL;
1759                break;
1760        case NL80211_IFTYPE_AP_VLAN:
1761                sdata = container_of(sdata->bss,
1762                                     struct ieee80211_sub_if_data, u.ap);
1763                fallthrough;
1764        default:
1765                vif = &sdata->vif;
1766                break;
1767        }
1768
1769        result = ieee80211_tx_frags(local, vif, sta, skbs, txpending);
1770
1771        ieee80211_tpt_led_trig_tx(local, fc, led_len);
1772
1773        WARN_ON_ONCE(!skb_queue_empty(skbs));
1774
1775        return result;
1776}
1777
1778/*
1779 * Invoke TX handlers, return 0 on success and non-zero if the
1780 * frame was dropped or queued.
1781 *
1782 * The handlers are split into an early and late part. The latter is everything
1783 * that can be sensitive to reordering, and will be deferred to after packets
1784 * are dequeued from the intermediate queues (when they are enabled).
1785 */
1786static int invoke_tx_handlers_early(struct ieee80211_tx_data *tx)
1787{
1788        ieee80211_tx_result res = TX_DROP;
1789
1790#define CALL_TXH(txh) \
1791        do {                            \
1792                res = txh(tx);          \
1793                if (res != TX_CONTINUE) \
1794                        goto txh_done;  \
1795        } while (0)
1796
1797        CALL_TXH(ieee80211_tx_h_dynamic_ps);
1798        CALL_TXH(ieee80211_tx_h_check_assoc);
1799        CALL_TXH(ieee80211_tx_h_ps_buf);
1800        CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
1801        CALL_TXH(ieee80211_tx_h_select_key);
1802
1803 txh_done:
1804        if (unlikely(res == TX_DROP)) {
1805                I802_DEBUG_INC(tx->local->tx_handlers_drop);
1806                if (tx->skb)
1807                        ieee80211_free_txskb(&tx->local->hw, tx->skb);
1808                else
1809                        ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1810                return -1;
1811        } else if (unlikely(res == TX_QUEUED)) {
1812                I802_DEBUG_INC(tx->local->tx_handlers_queued);
1813                return -1;
1814        }
1815
1816        return 0;
1817}
1818
1819/*
1820 * Late handlers can be called while the sta lock is held. Handlers that can
1821 * cause packets to be generated will cause deadlock!
1822 */
1823static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)
1824{
1825        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
1826        ieee80211_tx_result res = TX_CONTINUE;
1827
1828        if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION)) {
1829                __skb_queue_tail(&tx->skbs, tx->skb);
1830                tx->skb = NULL;
1831                goto txh_done;
1832        }
1833
1834        if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
1835                CALL_TXH(ieee80211_tx_h_rate_ctrl);
1836
1837        CALL_TXH(ieee80211_tx_h_michael_mic_add);
1838        CALL_TXH(ieee80211_tx_h_sequence);
1839        CALL_TXH(ieee80211_tx_h_fragment);
1840        /* handlers after fragment must be aware of tx info fragmentation! */
1841        CALL_TXH(ieee80211_tx_h_stats);
1842        CALL_TXH(ieee80211_tx_h_encrypt);
1843        if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL))
1844                CALL_TXH(ieee80211_tx_h_calculate_duration);
1845#undef CALL_TXH
1846
1847 txh_done:
1848        if (unlikely(res == TX_DROP)) {
1849                I802_DEBUG_INC(tx->local->tx_handlers_drop);
1850                if (tx->skb)
1851                        ieee80211_free_txskb(&tx->local->hw, tx->skb);
1852                else
1853                        ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
1854                return -1;
1855        } else if (unlikely(res == TX_QUEUED)) {
1856                I802_DEBUG_INC(tx->local->tx_handlers_queued);
1857                return -1;
1858        }
1859
1860        return 0;
1861}
1862
1863static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
1864{
1865        int r = invoke_tx_handlers_early(tx);
1866
1867        if (r)
1868                return r;
1869        return invoke_tx_handlers_late(tx);
1870}
1871
1872bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,
1873                              struct ieee80211_vif *vif, struct sk_buff *skb,
1874                              int band, struct ieee80211_sta **sta)
1875{
1876        struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
1877        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1878        struct ieee80211_tx_data tx;
1879        struct sk_buff *skb2;
1880
1881        if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP)
1882                return false;
1883
1884        info->band = band;
1885        info->control.vif = vif;
1886        info->hw_queue = vif->hw_queue[skb_get_queue_mapping(skb)];
1887
1888        if (invoke_tx_handlers(&tx))
1889                return false;
1890
1891        if (sta) {
1892                if (tx.sta)
1893                        *sta = &tx.sta->sta;
1894                else
1895                        *sta = NULL;
1896        }
1897
1898        /* this function isn't suitable for fragmented data frames */
1899        skb2 = __skb_dequeue(&tx.skbs);
1900        if (WARN_ON(skb2 != skb || !skb_queue_empty(&tx.skbs))) {
1901                ieee80211_free_txskb(hw, skb2);
1902                ieee80211_purge_tx_queue(hw, &tx.skbs);
1903                return false;
1904        }
1905
1906        return true;
1907}
1908EXPORT_SYMBOL(ieee80211_tx_prepare_skb);
1909
1910/*
1911 * Returns false if the frame couldn't be transmitted but was queued instead.
1912 */
1913static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,
1914                         struct sta_info *sta, struct sk_buff *skb,
1915                         bool txpending)
1916{
1917        struct ieee80211_local *local = sdata->local;
1918        struct ieee80211_tx_data tx;
1919        ieee80211_tx_result res_prepare;
1920        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
1921        bool result = true;
1922        int led_len;
1923
1924        if (unlikely(skb->len < 10)) {
1925                dev_kfree_skb(skb);
1926                return true;
1927        }
1928
1929        /* initialises tx */
1930        led_len = skb->len;
1931        res_prepare = ieee80211_tx_prepare(sdata, &tx, sta, skb);
1932
1933        if (unlikely(res_prepare == TX_DROP)) {
1934                ieee80211_free_txskb(&local->hw, skb);
1935                return true;
1936        } else if (unlikely(res_prepare == TX_QUEUED)) {
1937                return true;
1938        }
1939
1940        /* set up hw_queue value early */
1941        if (!(info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
1942            !ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
1943                info->hw_queue =
1944                        sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
1945
1946        if (invoke_tx_handlers_early(&tx))
1947                return true;
1948
1949        if (ieee80211_queue_skb(local, sdata, tx.sta, tx.skb))
1950                return true;
1951
1952        if (!invoke_tx_handlers_late(&tx))
1953                result = __ieee80211_tx(local, &tx.skbs, led_len,
1954                                        tx.sta, txpending);
1955
1956        return result;
1957}
1958
1959/* device xmit handlers */
1960
1961enum ieee80211_encrypt {
1962        ENCRYPT_NO,
1963        ENCRYPT_MGMT,
1964        ENCRYPT_DATA,
1965};
1966
1967static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
1968                                struct sk_buff *skb,
1969                                int head_need,
1970                                enum ieee80211_encrypt encrypt)
1971{
1972        struct ieee80211_local *local = sdata->local;
1973        bool enc_tailroom;
1974        int tail_need = 0;
1975
1976        enc_tailroom = encrypt == ENCRYPT_MGMT ||
1977                       (encrypt == ENCRYPT_DATA &&
1978                        sdata->crypto_tx_tailroom_needed_cnt);
1979
1980        if (enc_tailroom) {
1981                tail_need = IEEE80211_ENCRYPT_TAILROOM;
1982                tail_need -= skb_tailroom(skb);
1983                tail_need = max_t(int, tail_need, 0);
1984        }
1985
1986        if (skb_cloned(skb) &&
1987            (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
1988             !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
1989                I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1990        else if (head_need || tail_need)
1991                I802_DEBUG_INC(local->tx_expand_skb_head);
1992        else
1993                return 0;
1994
1995        if (pskb_expand_head(skb, head_need, tail_need, GFP_ATOMIC)) {
1996                wiphy_debug(local->hw.wiphy,
1997                            "failed to reallocate TX buffer\n");
1998                return -ENOMEM;
1999        }
2000
2001        return 0;
2002}
2003
2004void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
2005                    struct sta_info *sta, struct sk_buff *skb)
2006{
2007        struct ieee80211_local *local = sdata->local;
2008        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2009        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
2010        int headroom;
2011        enum ieee80211_encrypt encrypt;
2012
2013        if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)
2014                encrypt = ENCRYPT_NO;
2015        else if (ieee80211_is_mgmt(hdr->frame_control))
2016                encrypt = ENCRYPT_MGMT;
2017        else
2018                encrypt = ENCRYPT_DATA;
2019
2020        headroom = local->tx_headroom;
2021        if (encrypt != ENCRYPT_NO)
2022                headroom += sdata->encrypt_headroom;
2023        headroom -= skb_headroom(skb);
2024        headroom = max_t(int, 0, headroom);
2025
2026        if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {
2027                ieee80211_free_txskb(&local->hw, skb);
2028                return;
2029        }
2030
2031        /* reload after potential resize */
2032        hdr = (struct ieee80211_hdr *) skb->data;
2033        info->control.vif = &sdata->vif;
2034
2035        if (ieee80211_vif_is_mesh(&sdata->vif)) {
2036                if (ieee80211_is_data(hdr->frame_control) &&
2037                    is_unicast_ether_addr(hdr->addr1)) {
2038                        if (mesh_nexthop_resolve(sdata, skb))
2039                                return; /* skb queued: don't free */
2040                } else {
2041                        ieee80211_mps_set_frame_flags(sdata, NULL, hdr);
2042                }
2043        }
2044
2045        ieee80211_set_qos_hdr(sdata, skb);
2046        ieee80211_tx(sdata, sta, skb, false);
2047}
2048
2049static bool ieee80211_validate_radiotap_len(struct sk_buff *skb)
2050{
2051        struct ieee80211_radiotap_header *rthdr =
2052                (struct ieee80211_radiotap_header *)skb->data;
2053
2054        /* check for not even having the fixed radiotap header part */
2055        if (unlikely(skb->len < sizeof(struct ieee80211_radiotap_header)))
2056                return false; /* too short to be possibly valid */
2057
2058        /* is it a header version we can trust to find length from? */
2059        if (unlikely(rthdr->it_version))
2060                return false; /* only version 0 is supported */
2061
2062        /* does the skb contain enough to deliver on the alleged length? */
2063        if (unlikely(skb->len < ieee80211_get_radiotap_len(skb->data)))
2064                return false; /* skb too short for claimed rt header extent */
2065
2066        return true;
2067}
2068
2069bool ieee80211_parse_tx_radiotap(struct sk_buff *skb,
2070                                 struct net_device *dev)
2071{
2072        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2073        struct ieee80211_radiotap_iterator iterator;
2074        struct ieee80211_radiotap_header *rthdr =
2075                (struct ieee80211_radiotap_header *) skb->data;
2076        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2077        int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
2078                                                   NULL);
2079        u16 txflags;
2080        u16 rate = 0;
2081        bool rate_found = false;
2082        u8 rate_retries = 0;
2083        u16 rate_flags = 0;
2084        u8 mcs_known, mcs_flags, mcs_bw;
2085        u16 vht_known;
2086        u8 vht_mcs = 0, vht_nss = 0;
2087        int i;
2088
2089        if (!ieee80211_validate_radiotap_len(skb))
2090                return false;
2091
2092        info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT |
2093                       IEEE80211_TX_CTL_DONTFRAG;
2094
2095        /*
2096         * for every radiotap entry that is present
2097         * (ieee80211_radiotap_iterator_next returns -ENOENT when no more
2098         * entries present, or -EINVAL on error)
2099         */
2100
2101        while (!ret) {
2102                ret = ieee80211_radiotap_iterator_next(&iterator);
2103
2104                if (ret)
2105                        continue;
2106
2107                /* see if this argument is something we can use */
2108                switch (iterator.this_arg_index) {
2109                /*
2110                 * You must take care when dereferencing iterator.this_arg
2111                 * for multibyte types... the pointer is not aligned.  Use
2112                 * get_unaligned((type *)iterator.this_arg) to dereference
2113                 * iterator.this_arg for type "type" safely on all arches.
2114                */
2115                case IEEE80211_RADIOTAP_FLAGS:
2116                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FCS) {
2117                                /*
2118                                 * this indicates that the skb we have been
2119                                 * handed has the 32-bit FCS CRC at the end...
2120                                 * we should react to that by snipping it off
2121                                 * because it will be recomputed and added
2122                                 * on transmission
2123                                 */
2124                                if (skb->len < (iterator._max_length + FCS_LEN))
2125                                        return false;
2126
2127                                skb_trim(skb, skb->len - FCS_LEN);
2128                        }
2129                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_WEP)
2130                                info->flags &= ~IEEE80211_TX_INTFL_DONT_ENCRYPT;
2131                        if (*iterator.this_arg & IEEE80211_RADIOTAP_F_FRAG)
2132                                info->flags &= ~IEEE80211_TX_CTL_DONTFRAG;
2133                        break;
2134
2135                case IEEE80211_RADIOTAP_TX_FLAGS:
2136                        txflags = get_unaligned_le16(iterator.this_arg);
2137                        if (txflags & IEEE80211_RADIOTAP_F_TX_NOACK)
2138                                info->flags |= IEEE80211_TX_CTL_NO_ACK;
2139                        if (txflags & IEEE80211_RADIOTAP_F_TX_NOSEQNO)
2140                                info->control.flags |= IEEE80211_TX_CTRL_NO_SEQNO;
2141                        if (txflags & IEEE80211_RADIOTAP_F_TX_ORDER)
2142                                info->control.flags |=
2143                                        IEEE80211_TX_CTRL_DONT_REORDER;
2144                        break;
2145
2146                case IEEE80211_RADIOTAP_RATE:
2147                        rate = *iterator.this_arg;
2148                        rate_flags = 0;
2149                        rate_found = true;
2150                        break;
2151
2152                case IEEE80211_RADIOTAP_DATA_RETRIES:
2153                        rate_retries = *iterator.this_arg;
2154                        break;
2155
2156                case IEEE80211_RADIOTAP_MCS:
2157                        mcs_known = iterator.this_arg[0];
2158                        mcs_flags = iterator.this_arg[1];
2159                        if (!(mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_MCS))
2160                                break;
2161
2162                        rate_found = true;
2163                        rate = iterator.this_arg[2];
2164                        rate_flags = IEEE80211_TX_RC_MCS;
2165
2166                        if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_GI &&
2167                            mcs_flags & IEEE80211_RADIOTAP_MCS_SGI)
2168                                rate_flags |= IEEE80211_TX_RC_SHORT_GI;
2169
2170                        mcs_bw = mcs_flags & IEEE80211_RADIOTAP_MCS_BW_MASK;
2171                        if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_BW &&
2172                            mcs_bw == IEEE80211_RADIOTAP_MCS_BW_40)
2173                                rate_flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
2174
2175                        if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_FEC &&
2176                            mcs_flags & IEEE80211_RADIOTAP_MCS_FEC_LDPC)
2177                                info->flags |= IEEE80211_TX_CTL_LDPC;
2178
2179                        if (mcs_known & IEEE80211_RADIOTAP_MCS_HAVE_STBC) {
2180                                u8 stbc = u8_get_bits(mcs_flags,
2181                                                      IEEE80211_RADIOTAP_MCS_STBC_MASK);
2182
2183                                info->flags |=
2184                                        u32_encode_bits(stbc,
2185                                                        IEEE80211_TX_CTL_STBC);
2186                        }
2187                        break;
2188
2189                case IEEE80211_RADIOTAP_VHT:
2190                        vht_known = get_unaligned_le16(iterator.this_arg);
2191                        rate_found = true;
2192
2193                        rate_flags = IEEE80211_TX_RC_VHT_MCS;
2194                        if ((vht_known & IEEE80211_RADIOTAP_VHT_KNOWN_GI) &&
2195                            (iterator.this_arg[2] &
2196                             IEEE80211_RADIOTAP_VHT_FLAG_SGI))
2197                                rate_flags |= IEEE80211_TX_RC_SHORT_GI;
2198                        if (vht_known &
2199                            IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH) {
2200                                if (iterator.this_arg[3] == 1)
2201                                        rate_flags |=
2202                                                IEEE80211_TX_RC_40_MHZ_WIDTH;
2203                                else if (iterator.this_arg[3] == 4)
2204                                        rate_flags |=
2205                                                IEEE80211_TX_RC_80_MHZ_WIDTH;
2206                                else if (iterator.this_arg[3] == 11)
2207                                        rate_flags |=
2208                                                IEEE80211_TX_RC_160_MHZ_WIDTH;
2209                        }
2210
2211                        vht_mcs = iterator.this_arg[4] >> 4;
2212                        vht_nss = iterator.this_arg[4] & 0xF;
2213                        break;
2214
2215                /*
2216                 * Please update the file
2217                 * Documentation/networking/mac80211-injection.rst
2218                 * when parsing new fields here.
2219                 */
2220
2221                default:
2222                        break;
2223                }
2224        }
2225
2226        if (ret != -ENOENT) /* ie, if we didn't simply run out of fields */
2227                return false;
2228
2229        if (rate_found) {
2230                struct ieee80211_supported_band *sband =
2231                        local->hw.wiphy->bands[info->band];
2232
2233                info->control.flags |= IEEE80211_TX_CTRL_RATE_INJECT;
2234
2235                for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
2236                        info->control.rates[i].idx = -1;
2237                        info->control.rates[i].flags = 0;
2238                        info->control.rates[i].count = 0;
2239                }
2240
2241                if (rate_flags & IEEE80211_TX_RC_MCS) {
2242                        info->control.rates[0].idx = rate;
2243                } else if (rate_flags & IEEE80211_TX_RC_VHT_MCS) {
2244                        ieee80211_rate_set_vht(info->control.rates, vht_mcs,
2245                                               vht_nss);
2246                } else if (sband) {
2247                        for (i = 0; i < sband->n_bitrates; i++) {
2248                                if (rate * 5 != sband->bitrates[i].bitrate)
2249                                        continue;
2250
2251                                info->control.rates[0].idx = i;
2252                                break;
2253                        }
2254                }
2255
2256                if (info->control.rates[0].idx < 0)
2257                        info->control.flags &= ~IEEE80211_TX_CTRL_RATE_INJECT;
2258
2259                info->control.rates[0].flags = rate_flags;
2260                info->control.rates[0].count = min_t(u8, rate_retries + 1,
2261                                                     local->hw.max_rate_tries);
2262        }
2263
2264        return true;
2265}
2266
2267netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
2268                                         struct net_device *dev)
2269{
2270        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2271        struct ieee80211_chanctx_conf *chanctx_conf;
2272        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
2273        struct ieee80211_hdr *hdr;
2274        struct ieee80211_sub_if_data *tmp_sdata, *sdata;
2275        struct cfg80211_chan_def *chandef;
2276        u16 len_rthdr;
2277        int hdrlen;
2278
2279        memset(info, 0, sizeof(*info));
2280        info->flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
2281                      IEEE80211_TX_CTL_INJECTED;
2282
2283        /* Sanity-check the length of the radiotap header */
2284        if (!ieee80211_validate_radiotap_len(skb))
2285                goto fail;
2286
2287        /* we now know there is a radiotap header with a length we can use */
2288        len_rthdr = ieee80211_get_radiotap_len(skb->data);
2289
2290        /*
2291         * fix up the pointers accounting for the radiotap
2292         * header still being in there.  We are being given
2293         * a precooked IEEE80211 header so no need for
2294         * normal processing
2295         */
2296        skb_set_mac_header(skb, len_rthdr);
2297        /*
2298         * these are just fixed to the end of the rt area since we
2299         * don't have any better information and at this point, nobody cares
2300         */
2301        skb_set_network_header(skb, len_rthdr);
2302        skb_set_transport_header(skb, len_rthdr);
2303
2304        if (skb->len < len_rthdr + 2)
2305                goto fail;
2306
2307        hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
2308        hdrlen = ieee80211_hdrlen(hdr->frame_control);
2309
2310        if (skb->len < len_rthdr + hdrlen)
2311                goto fail;
2312
2313        /*
2314         * Initialize skb->protocol if the injected frame is a data frame
2315         * carrying a rfc1042 header
2316         */
2317        if (ieee80211_is_data(hdr->frame_control) &&
2318            skb->len >= len_rthdr + hdrlen + sizeof(rfc1042_header) + 2) {
2319                u8 *payload = (u8 *)hdr + hdrlen;
2320
2321                if (ether_addr_equal(payload, rfc1042_header))
2322                        skb->protocol = cpu_to_be16((payload[6] << 8) |
2323                                                    payload[7]);
2324        }
2325
2326        rcu_read_lock();
2327
2328        /*
2329         * We process outgoing injected frames that have a local address
2330         * we handle as though they are non-injected frames.
2331         * This code here isn't entirely correct, the local MAC address
2332         * isn't always enough to find the interface to use; for proper
2333         * VLAN support we have an nl80211-based mechanism.
2334         *
2335         * This is necessary, for example, for old hostapd versions that
2336         * don't use nl80211-based management TX/RX.
2337         */
2338        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
2339
2340        list_for_each_entry_rcu(tmp_sdata, &local->interfaces, list) {
2341                if (!ieee80211_sdata_running(tmp_sdata))
2342                        continue;
2343                if (tmp_sdata->vif.type == NL80211_IFTYPE_MONITOR ||
2344                    tmp_sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
2345                        continue;
2346                if (ether_addr_equal(tmp_sdata->vif.addr, hdr->addr2)) {
2347                        sdata = tmp_sdata;
2348                        break;
2349                }
2350        }
2351
2352        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2353        if (!chanctx_conf) {
2354                tmp_sdata = rcu_dereference(local->monitor_sdata);
2355                if (tmp_sdata)
2356                        chanctx_conf =
2357                                rcu_dereference(tmp_sdata->vif.chanctx_conf);
2358        }
2359
2360        if (chanctx_conf)
2361                chandef = &chanctx_conf->def;
2362        else if (!local->use_chanctx)
2363                chandef = &local->_oper_chandef;
2364        else
2365                goto fail_rcu;
2366
2367        /*
2368         * Frame injection is not allowed if beaconing is not allowed
2369         * or if we need radar detection. Beaconing is usually not allowed when
2370         * the mode or operation (Adhoc, AP, Mesh) does not support DFS.
2371         * Passive scan is also used in world regulatory domains where
2372         * your country is not known and as such it should be treated as
2373         * NO TX unless the channel is explicitly allowed in which case
2374         * your current regulatory domain would not have the passive scan
2375         * flag.
2376         *
2377         * Since AP mode uses monitor interfaces to inject/TX management
2378         * frames we can make AP mode the exception to this rule once it
2379         * supports radar detection as its implementation can deal with
2380         * radar detection by itself. We can do that later by adding a
2381         * monitor flag interfaces used for AP support.
2382         */
2383        if (!cfg80211_reg_can_beacon(local->hw.wiphy, chandef,
2384                                     sdata->vif.type))
2385                goto fail_rcu;
2386
2387        info->band = chandef->chan->band;
2388
2389        /* Initialize skb->priority according to frame type and TID class,
2390         * with respect to the sub interface that the frame will actually
2391         * be transmitted on. If the DONT_REORDER flag is set, the original
2392         * skb-priority is preserved to assure frames injected with this
2393         * flag are not reordered relative to each other.
2394         */
2395        ieee80211_select_queue_80211(sdata, skb, hdr);
2396        skb_set_queue_mapping(skb, ieee80211_ac_from_tid(skb->priority));
2397
2398        /*
2399         * Process the radiotap header. This will now take into account the
2400         * selected chandef above to accurately set injection rates and
2401         * retransmissions.
2402         */
2403        if (!ieee80211_parse_tx_radiotap(skb, dev))
2404                goto fail_rcu;
2405
2406        /* remove the injection radiotap header */
2407        skb_pull(skb, len_rthdr);
2408
2409        ieee80211_xmit(sdata, NULL, skb);
2410        rcu_read_unlock();
2411
2412        return NETDEV_TX_OK;
2413
2414fail_rcu:
2415        rcu_read_unlock();
2416fail:
2417        dev_kfree_skb(skb);
2418        return NETDEV_TX_OK; /* meaning, we dealt with the skb */
2419}
2420
2421static inline bool ieee80211_is_tdls_setup(struct sk_buff *skb)
2422{
2423        u16 ethertype = (skb->data[12] << 8) | skb->data[13];
2424
2425        return ethertype == ETH_P_TDLS &&
2426               skb->len > 14 &&
2427               skb->data[14] == WLAN_TDLS_SNAP_RFTYPE;
2428}
2429
2430int ieee80211_lookup_ra_sta(struct ieee80211_sub_if_data *sdata,
2431                            struct sk_buff *skb,
2432                            struct sta_info **sta_out)
2433{
2434        struct sta_info *sta;
2435
2436        switch (sdata->vif.type) {
2437        case NL80211_IFTYPE_AP_VLAN:
2438                sta = rcu_dereference(sdata->u.vlan.sta);
2439                if (sta) {
2440                        *sta_out = sta;
2441                        return 0;
2442                } else if (sdata->wdev.use_4addr) {
2443                        return -ENOLINK;
2444                }
2445                fallthrough;
2446        case NL80211_IFTYPE_AP:
2447        case NL80211_IFTYPE_OCB:
2448        case NL80211_IFTYPE_ADHOC:
2449                if (is_multicast_ether_addr(skb->data)) {
2450                        *sta_out = ERR_PTR(-ENOENT);
2451                        return 0;
2452                }
2453                sta = sta_info_get_bss(sdata, skb->data);
2454                break;
2455#ifdef CONFIG_MAC80211_MESH
2456        case NL80211_IFTYPE_MESH_POINT:
2457                /* determined much later */
2458                *sta_out = NULL;
2459                return 0;
2460#endif
2461        case NL80211_IFTYPE_STATION:
2462                if (sdata->wdev.wiphy->flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2463                        sta = sta_info_get(sdata, skb->data);
2464                        if (sta && test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
2465                                if (test_sta_flag(sta,
2466                                                  WLAN_STA_TDLS_PEER_AUTH)) {
2467                                        *sta_out = sta;
2468                                        return 0;
2469                                }
2470
2471                                /*
2472                                 * TDLS link during setup - throw out frames to
2473                                 * peer. Allow TDLS-setup frames to unauthorized
2474                                 * peers for the special case of a link teardown
2475                                 * after a TDLS sta is removed due to being
2476                                 * unreachable.
2477                                 */
2478                                if (!ieee80211_is_tdls_setup(skb))
2479                                        return -EINVAL;
2480                        }
2481
2482                }
2483
2484                sta = sta_info_get(sdata, sdata->u.mgd.bssid);
2485                if (!sta)
2486                        return -ENOLINK;
2487                break;
2488        default:
2489                return -EINVAL;
2490        }
2491
2492        *sta_out = sta ?: ERR_PTR(-ENOENT);
2493        return 0;
2494}
2495
2496static u16 ieee80211_store_ack_skb(struct ieee80211_local *local,
2497                                   struct sk_buff *skb,
2498                                   u32 *info_flags,
2499                                   u64 *cookie)
2500{
2501        struct sk_buff *ack_skb;
2502        u16 info_id = 0;
2503
2504        if (skb->sk)
2505                ack_skb = skb_clone_sk(skb);
2506        else
2507                ack_skb = skb_clone(skb, GFP_ATOMIC);
2508
2509        if (ack_skb) {
2510                unsigned long flags;
2511                int id;
2512
2513                spin_lock_irqsave(&local->ack_status_lock, flags);
2514                id = idr_alloc(&local->ack_status_frames, ack_skb,
2515                               1, 0x2000, GFP_ATOMIC);
2516                spin_unlock_irqrestore(&local->ack_status_lock, flags);
2517
2518                if (id >= 0) {
2519                        info_id = id;
2520                        *info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
2521                        if (cookie) {
2522                                *cookie = ieee80211_mgmt_tx_cookie(local);
2523                                IEEE80211_SKB_CB(ack_skb)->ack.cookie = *cookie;
2524                        }
2525                } else {
2526                        kfree_skb(ack_skb);
2527                }
2528        }
2529
2530        return info_id;
2531}
2532
2533/**
2534 * ieee80211_build_hdr - build 802.11 header in the given frame
2535 * @sdata: virtual interface to build the header for
2536 * @skb: the skb to build the header in
2537 * @info_flags: skb flags to set
2538 * @sta: the station pointer
2539 * @ctrl_flags: info control flags to set
2540 * @cookie: cookie pointer to fill (if not %NULL)
2541 *
2542 * This function takes the skb with 802.3 header and reformats the header to
2543 * the appropriate IEEE 802.11 header based on which interface the packet is
2544 * being transmitted on.
2545 *
2546 * Note that this function also takes care of the TX status request and
2547 * potential unsharing of the SKB - this needs to be interleaved with the
2548 * header building.
2549 *
2550 * The function requires the read-side RCU lock held
2551 *
2552 * Returns: the (possibly reallocated) skb or an ERR_PTR() code
2553 */
2554static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,
2555                                           struct sk_buff *skb, u32 info_flags,
2556                                           struct sta_info *sta, u32 ctrl_flags,
2557                                           u64 *cookie)
2558{
2559        struct ieee80211_local *local = sdata->local;
2560        struct ieee80211_tx_info *info;
2561        int head_need;
2562        u16 ethertype, hdrlen,  meshhdrlen = 0;
2563        __le16 fc;
2564        struct ieee80211_hdr hdr;
2565        struct ieee80211s_hdr mesh_hdr __maybe_unused;
2566        struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
2567        const u8 *encaps_data;
2568        int encaps_len, skip_header_bytes;
2569        bool wme_sta = false, authorized = false;
2570        bool tdls_peer;
2571        bool multicast;
2572        u16 info_id = 0;
2573        struct ieee80211_chanctx_conf *chanctx_conf;
2574        struct ieee80211_sub_if_data *ap_sdata;
2575        enum nl80211_band band;
2576        int ret;
2577
2578        if (IS_ERR(sta))
2579                sta = NULL;
2580
2581#ifdef CONFIG_MAC80211_DEBUGFS
2582        if (local->force_tx_status)
2583                info_flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
2584#endif
2585
2586        /* convert Ethernet header to proper 802.11 header (based on
2587         * operation mode) */
2588        ethertype = (skb->data[12] << 8) | skb->data[13];
2589        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2590
2591        switch (sdata->vif.type) {
2592        case NL80211_IFTYPE_AP_VLAN:
2593                if (sdata->wdev.use_4addr) {
2594                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
2595                        /* RA TA DA SA */
2596                        memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
2597                        memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2598                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
2599                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2600                        hdrlen = 30;
2601                        authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2602                        wme_sta = sta->sta.wme;
2603                }
2604                ap_sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2605                                        u.ap);
2606                chanctx_conf = rcu_dereference(ap_sdata->vif.chanctx_conf);
2607                if (!chanctx_conf) {
2608                        ret = -ENOTCONN;
2609                        goto free;
2610                }
2611                band = chanctx_conf->def.chan->band;
2612                if (sdata->wdev.use_4addr)
2613                        break;
2614                fallthrough;
2615        case NL80211_IFTYPE_AP:
2616                if (sdata->vif.type == NL80211_IFTYPE_AP)
2617                        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2618                if (!chanctx_conf) {
2619                        ret = -ENOTCONN;
2620                        goto free;
2621                }
2622                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
2623                /* DA BSSID SA */
2624                memcpy(hdr.addr1, skb->data, ETH_ALEN);
2625                memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2626                memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
2627                hdrlen = 24;
2628                band = chanctx_conf->def.chan->band;
2629                break;
2630#ifdef CONFIG_MAC80211_MESH
2631        case NL80211_IFTYPE_MESH_POINT:
2632                if (!is_multicast_ether_addr(skb->data)) {
2633                        struct sta_info *next_hop;
2634                        bool mpp_lookup = true;
2635
2636                        mpath = mesh_path_lookup(sdata, skb->data);
2637                        if (mpath) {
2638                                mpp_lookup = false;
2639                                next_hop = rcu_dereference(mpath->next_hop);
2640                                if (!next_hop ||
2641                                    !(mpath->flags & (MESH_PATH_ACTIVE |
2642                                                      MESH_PATH_RESOLVING)))
2643                                        mpp_lookup = true;
2644                        }
2645
2646                        if (mpp_lookup) {
2647                                mppath = mpp_path_lookup(sdata, skb->data);
2648                                if (mppath)
2649                                        mppath->exp_time = jiffies;
2650                        }
2651
2652                        if (mppath && mpath)
2653                                mesh_path_del(sdata, mpath->dst);
2654                }
2655
2656                /*
2657                 * Use address extension if it is a packet from
2658                 * another interface or if we know the destination
2659                 * is being proxied by a portal (i.e. portal address
2660                 * differs from proxied address)
2661                 */
2662                if (ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN) &&
2663                    !(mppath && !ether_addr_equal(mppath->mpp, skb->data))) {
2664                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2665                                        skb->data, skb->data + ETH_ALEN);
2666                        meshhdrlen = ieee80211_new_mesh_header(sdata, &mesh_hdr,
2667                                                               NULL, NULL);
2668                } else {
2669                        /* DS -> MBSS (802.11-2012 13.11.3.3).
2670                         * For unicast with unknown forwarding information,
2671                         * destination might be in the MBSS or if that fails
2672                         * forwarded to another mesh gate. In either case
2673                         * resolution will be handled in ieee80211_xmit(), so
2674                         * leave the original DA. This also works for mcast */
2675                        const u8 *mesh_da = skb->data;
2676
2677                        if (mppath)
2678                                mesh_da = mppath->mpp;
2679                        else if (mpath)
2680                                mesh_da = mpath->dst;
2681
2682                        hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
2683                                        mesh_da, sdata->vif.addr);
2684                        if (is_multicast_ether_addr(mesh_da))
2685                                /* DA TA mSA AE:SA */
2686                                meshhdrlen = ieee80211_new_mesh_header(
2687                                                sdata, &mesh_hdr,
2688                                                skb->data + ETH_ALEN, NULL);
2689                        else
2690                                /* RA TA mDA mSA AE:DA SA */
2691                                meshhdrlen = ieee80211_new_mesh_header(
2692                                                sdata, &mesh_hdr, skb->data,
2693                                                skb->data + ETH_ALEN);
2694
2695                }
2696                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2697                if (!chanctx_conf) {
2698                        ret = -ENOTCONN;
2699                        goto free;
2700                }
2701                band = chanctx_conf->def.chan->band;
2702
2703                /* For injected frames, fill RA right away as nexthop lookup
2704                 * will be skipped.
2705                 */
2706                if ((ctrl_flags & IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP) &&
2707                    is_zero_ether_addr(hdr.addr1))
2708                        memcpy(hdr.addr1, skb->data, ETH_ALEN);
2709                break;
2710#endif
2711        case NL80211_IFTYPE_STATION:
2712                /* we already did checks when looking up the RA STA */
2713                tdls_peer = test_sta_flag(sta, WLAN_STA_TDLS_PEER);
2714
2715                if (tdls_peer) {
2716                        /* DA SA BSSID */
2717                        memcpy(hdr.addr1, skb->data, ETH_ALEN);
2718                        memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2719                        memcpy(hdr.addr3, sdata->u.mgd.bssid, ETH_ALEN);
2720                        hdrlen = 24;
2721                }  else if (sdata->u.mgd.use_4addr &&
2722                            cpu_to_be16(ethertype) != sdata->control_port_protocol) {
2723                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
2724                                          IEEE80211_FCTL_TODS);
2725                        /* RA TA DA SA */
2726                        memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2727                        memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
2728                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
2729                        memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
2730                        hdrlen = 30;
2731                } else {
2732                        fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
2733                        /* BSSID SA DA */
2734                        memcpy(hdr.addr1, sdata->u.mgd.bssid, ETH_ALEN);
2735                        memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2736                        memcpy(hdr.addr3, skb->data, ETH_ALEN);
2737                        hdrlen = 24;
2738                }
2739                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2740                if (!chanctx_conf) {
2741                        ret = -ENOTCONN;
2742                        goto free;
2743                }
2744                band = chanctx_conf->def.chan->band;
2745                break;
2746        case NL80211_IFTYPE_OCB:
2747                /* DA SA BSSID */
2748                memcpy(hdr.addr1, skb->data, ETH_ALEN);
2749                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2750                eth_broadcast_addr(hdr.addr3);
2751                hdrlen = 24;
2752                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2753                if (!chanctx_conf) {
2754                        ret = -ENOTCONN;
2755                        goto free;
2756                }
2757                band = chanctx_conf->def.chan->band;
2758                break;
2759        case NL80211_IFTYPE_ADHOC:
2760                /* DA SA BSSID */
2761                memcpy(hdr.addr1, skb->data, ETH_ALEN);
2762                memcpy(hdr.addr2, skb->data + ETH_ALEN, ETH_ALEN);
2763                memcpy(hdr.addr3, sdata->u.ibss.bssid, ETH_ALEN);
2764                hdrlen = 24;
2765                chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2766                if (!chanctx_conf) {
2767                        ret = -ENOTCONN;
2768                        goto free;
2769                }
2770                band = chanctx_conf->def.chan->band;
2771                break;
2772        default:
2773                ret = -EINVAL;
2774                goto free;
2775        }
2776
2777        multicast = is_multicast_ether_addr(hdr.addr1);
2778
2779        /* sta is always NULL for mesh */
2780        if (sta) {
2781                authorized = test_sta_flag(sta, WLAN_STA_AUTHORIZED);
2782                wme_sta = sta->sta.wme;
2783        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
2784                /* For mesh, the use of the QoS header is mandatory */
2785                wme_sta = true;
2786        }
2787
2788        /* receiver does QoS (which also means we do) use it */
2789        if (wme_sta) {
2790                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
2791                hdrlen += 2;
2792        }
2793
2794        /*
2795         * Drop unicast frames to unauthorised stations unless they are
2796         * EAPOL frames from the local station.
2797         */
2798        if (unlikely(!ieee80211_vif_is_mesh(&sdata->vif) &&
2799                     (sdata->vif.type != NL80211_IFTYPE_OCB) &&
2800                     !multicast && !authorized &&
2801                     (cpu_to_be16(ethertype) != sdata->control_port_protocol ||
2802                      !ether_addr_equal(sdata->vif.addr, skb->data + ETH_ALEN)))) {
2803#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
2804                net_info_ratelimited("%s: dropped frame to %pM (unauthorized port)\n",
2805                                    sdata->name, hdr.addr1);
2806#endif
2807
2808                I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
2809
2810                ret = -EPERM;
2811                goto free;
2812        }
2813
2814        if (unlikely(!multicast && ((skb->sk &&
2815                     skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS) ||
2816                     ctrl_flags & IEEE80211_TX_CTL_REQ_TX_STATUS)))
2817                info_id = ieee80211_store_ack_skb(local, skb, &info_flags,
2818                                                  cookie);
2819
2820        /*
2821         * If the skb is shared we need to obtain our own copy.
2822         */
2823        if (skb_shared(skb)) {
2824                struct sk_buff *tmp_skb = skb;
2825
2826                /* can't happen -- skb is a clone if info_id != 0 */
2827                WARN_ON(info_id);
2828
2829                skb = skb_clone(skb, GFP_ATOMIC);
2830                kfree_skb(tmp_skb);
2831
2832                if (!skb) {
2833                        ret = -ENOMEM;
2834                        goto free;
2835                }
2836        }
2837
2838        hdr.frame_control = fc;
2839        hdr.duration_id = 0;
2840        hdr.seq_ctrl = 0;
2841
2842        skip_header_bytes = ETH_HLEN;
2843        if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) {
2844                encaps_data = bridge_tunnel_header;
2845                encaps_len = sizeof(bridge_tunnel_header);
2846                skip_header_bytes -= 2;
2847        } else if (ethertype >= ETH_P_802_3_MIN) {
2848                encaps_data = rfc1042_header;
2849                encaps_len = sizeof(rfc1042_header);
2850                skip_header_bytes -= 2;
2851        } else {
2852                encaps_data = NULL;
2853                encaps_len = 0;
2854        }
2855
2856        skb_pull(skb, skip_header_bytes);
2857        head_need = hdrlen + encaps_len + meshhdrlen - skb_headroom(skb);
2858
2859        /*
2860         * So we need to modify the skb header and hence need a copy of
2861         * that. The head_need variable above doesn't, so far, include
2862         * the needed header space that we don't need right away. If we
2863         * can, then we don't reallocate right now but only after the
2864         * frame arrives at the master device (if it does...)
2865         *
2866         * If we cannot, however, then we will reallocate to include all
2867         * the ever needed space. Also, if we need to reallocate it anyway,
2868         * make it big enough for everything we may ever need.
2869         */
2870
2871        if (head_need > 0 || skb_cloned(skb)) {
2872                head_need += sdata->encrypt_headroom;
2873                head_need += local->tx_headroom;
2874                head_need = max_t(int, 0, head_need);
2875                if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
2876                        ieee80211_free_txskb(&local->hw, skb);
2877                        skb = NULL;
2878                        return ERR_PTR(-ENOMEM);
2879                }
2880        }
2881
2882        if (encaps_data)
2883                memcpy(skb_push(skb, encaps_len), encaps_data, encaps_len);
2884
2885#ifdef CONFIG_MAC80211_MESH
2886        if (meshhdrlen > 0)
2887                memcpy(skb_push(skb, meshhdrlen), &mesh_hdr, meshhdrlen);
2888#endif
2889
2890        if (ieee80211_is_data_qos(fc)) {
2891                __le16 *qos_control;
2892
2893                qos_control = skb_push(skb, 2);
2894                memcpy(skb_push(skb, hdrlen - 2), &hdr, hdrlen - 2);
2895                /*
2896                 * Maybe we could actually set some fields here, for now just
2897                 * initialise to zero to indicate no special operation.
2898                 */
2899                *qos_control = 0;
2900        } else
2901                memcpy(skb_push(skb, hdrlen), &hdr, hdrlen);
2902
2903        skb_reset_mac_header(skb);
2904
2905        info = IEEE80211_SKB_CB(skb);
2906        memset(info, 0, sizeof(*info));
2907
2908        info->flags = info_flags;
2909        info->ack_frame_id = info_id;
2910        info->band = band;
2911        info->control.flags = ctrl_flags;
2912
2913        return skb;
2914 free:
2915        kfree_skb(skb);
2916        return ERR_PTR(ret);
2917}
2918
2919/*
2920 * fast-xmit overview
2921 *
2922 * The core idea of this fast-xmit is to remove per-packet checks by checking
2923 * them out of band. ieee80211_check_fast_xmit() implements the out-of-band
2924 * checks that are needed to get the sta->fast_tx pointer assigned, after which
2925 * much less work can be done per packet. For example, fragmentation must be
2926 * disabled or the fast_tx pointer will not be set. All the conditions are seen
2927 * in the code here.
2928 *
2929 * Once assigned, the fast_tx data structure also caches the per-packet 802.11
2930 * header and other data to aid packet processing in ieee80211_xmit_fast().
2931 *
2932 * The most difficult part of this is that when any of these assumptions
2933 * change, an external trigger (i.e. a call to ieee80211_clear_fast_xmit(),
2934 * ieee80211_check_fast_xmit() or friends) is required to reset the data,
2935 * since the per-packet code no longer checks the conditions. This is reflected
2936 * by the calls to these functions throughout the rest of the code, and must be
2937 * maintained if any of the TX path checks change.
2938 */
2939
2940void ieee80211_check_fast_xmit(struct sta_info *sta)
2941{
2942        struct ieee80211_fast_tx build = {}, *fast_tx = NULL, *old;
2943        struct ieee80211_local *local = sta->local;
2944        struct ieee80211_sub_if_data *sdata = sta->sdata;
2945        struct ieee80211_hdr *hdr = (void *)build.hdr;
2946        struct ieee80211_chanctx_conf *chanctx_conf;
2947        __le16 fc;
2948
2949        if (!ieee80211_hw_check(&local->hw, SUPPORT_FAST_XMIT))
2950                return;
2951
2952        /* Locking here protects both the pointer itself, and against concurrent
2953         * invocations winning data access races to, e.g., the key pointer that
2954         * is used.
2955         * Without it, the invocation of this function right after the key
2956         * pointer changes wouldn't be sufficient, as another CPU could access
2957         * the pointer, then stall, and then do the cache update after the CPU
2958         * that invalidated the key.
2959         * With the locking, such scenarios cannot happen as the check for the
2960         * key and the fast-tx assignment are done atomically, so the CPU that
2961         * modifies the key will either wait or other one will see the key
2962         * cleared/changed already.
2963         */
2964        spin_lock_bh(&sta->lock);
2965        if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
2966            !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
2967            sdata->vif.type == NL80211_IFTYPE_STATION)
2968                goto out;
2969
2970        if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
2971                goto out;
2972
2973        if (test_sta_flag(sta, WLAN_STA_PS_STA) ||
2974            test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||
2975            test_sta_flag(sta, WLAN_STA_PS_DELIVER) ||
2976            test_sta_flag(sta, WLAN_STA_CLEAR_PS_FILT))
2977                goto out;
2978
2979        if (sdata->noack_map)
2980                goto out;
2981
2982        /* fast-xmit doesn't handle fragmentation at all */
2983        if (local->hw.wiphy->frag_threshold != (u32)-1 &&
2984            !ieee80211_hw_check(&local->hw, SUPPORTS_TX_FRAG))
2985                goto out;
2986
2987        rcu_read_lock();
2988        chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
2989        if (!chanctx_conf) {
2990                rcu_read_unlock();
2991                goto out;
2992        }
2993        build.band = chanctx_conf->def.chan->band;
2994        rcu_read_unlock();
2995
2996        fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA);
2997
2998        switch (sdata->vif.type) {
2999        case NL80211_IFTYPE_ADHOC:
3000                /* DA SA BSSID */
3001                build.da_offs = offsetof(struct ieee80211_hdr, addr1);
3002                build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3003                memcpy(hdr->addr3, sdata->u.ibss.bssid, ETH_ALEN);
3004                build.hdr_len = 24;
3005                break;
3006        case NL80211_IFTYPE_STATION:
3007                if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
3008                        /* DA SA BSSID */
3009                        build.da_offs = offsetof(struct ieee80211_hdr, addr1);
3010                        build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3011                        memcpy(hdr->addr3, sdata->u.mgd.bssid, ETH_ALEN);
3012                        build.hdr_len = 24;
3013                        break;
3014                }
3015
3016                if (sdata->u.mgd.use_4addr) {
3017                        /* non-regular ethertype cannot use the fastpath */
3018                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
3019                                          IEEE80211_FCTL_TODS);
3020                        /* RA TA DA SA */
3021                        memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
3022                        memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
3023                        build.da_offs = offsetof(struct ieee80211_hdr, addr3);
3024                        build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
3025                        build.hdr_len = 30;
3026                        break;
3027                }
3028                fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
3029                /* BSSID SA DA */
3030                memcpy(hdr->addr1, sdata->u.mgd.bssid, ETH_ALEN);
3031                build.da_offs = offsetof(struct ieee80211_hdr, addr3);
3032                build.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3033                build.hdr_len = 24;
3034                break;
3035        case NL80211_IFTYPE_AP_VLAN:
3036                if (sdata->wdev.use_4addr) {
3037                        fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS |
3038                                          IEEE80211_FCTL_TODS);
3039                        /* RA TA DA SA */
3040                        memcpy(hdr->addr1, sta->sta.addr, ETH_ALEN);
3041                        memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
3042                        build.da_offs = offsetof(struct ieee80211_hdr, addr3);
3043                        build.sa_offs = offsetof(struct ieee80211_hdr, addr4);
3044                        build.hdr_len = 30;
3045                        break;
3046                }
3047                fallthrough;
3048        case NL80211_IFTYPE_AP:
3049                fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
3050                /* DA BSSID SA */
3051                build.da_offs = offsetof(struct ieee80211_hdr, addr1);
3052                memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
3053                build.sa_offs = offsetof(struct ieee80211_hdr, addr3);
3054                build.hdr_len = 24;
3055                break;
3056        default:
3057                /* not handled on fast-xmit */
3058                goto out;
3059        }
3060
3061        if (sta->sta.wme) {
3062                build.hdr_len += 2;
3063                fc |= cpu_to_le16(IEEE80211_STYPE_QOS_DATA);
3064        }
3065
3066        /* We store the key here so there's no point in using rcu_dereference()
3067         * but that's fine because the code that changes the pointers will call
3068         * this function after doing so. For a single CPU that would be enough,
3069         * for multiple see the comment above.
3070         */
3071        build.key = rcu_access_pointer(sta->ptk[sta->ptk_idx]);
3072        if (!build.key)
3073                build.key = rcu_access_pointer(sdata->default_unicast_key);
3074        if (build.key) {
3075                bool gen_iv, iv_spc, mmic;
3076
3077                gen_iv = build.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV;
3078                iv_spc = build.key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE;
3079                mmic = build.key->conf.flags &
3080                        (IEEE80211_KEY_FLAG_GENERATE_MMIC |
3081                         IEEE80211_KEY_FLAG_PUT_MIC_SPACE);
3082
3083                /* don't handle software crypto */
3084                if (!(build.key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
3085                        goto out;
3086
3087                /* Key is being removed */
3088                if (build.key->flags & KEY_FLAG_TAINTED)
3089                        goto out;
3090
3091                switch (build.key->conf.cipher) {
3092                case WLAN_CIPHER_SUITE_CCMP:
3093                case WLAN_CIPHER_SUITE_CCMP_256:
3094                        if (gen_iv)
3095                                build.pn_offs = build.hdr_len;
3096                        if (gen_iv || iv_spc)
3097                                build.hdr_len += IEEE80211_CCMP_HDR_LEN;
3098                        break;
3099                case WLAN_CIPHER_SUITE_GCMP:
3100                case WLAN_CIPHER_SUITE_GCMP_256:
3101                        if (gen_iv)
3102                                build.pn_offs = build.hdr_len;
3103                        if (gen_iv || iv_spc)
3104                                build.hdr_len += IEEE80211_GCMP_HDR_LEN;
3105                        break;
3106                case WLAN_CIPHER_SUITE_TKIP:
3107                        /* cannot handle MMIC or IV generation in xmit-fast */
3108                        if (mmic || gen_iv)
3109                                goto out;
3110                        if (iv_spc)
3111                                build.hdr_len += IEEE80211_TKIP_IV_LEN;
3112                        break;
3113                case WLAN_CIPHER_SUITE_WEP40:
3114                case WLAN_CIPHER_SUITE_WEP104:
3115                        /* cannot handle IV generation in fast-xmit */
3116                        if (gen_iv)
3117                                goto out;
3118                        if (iv_spc)
3119                                build.hdr_len += IEEE80211_WEP_IV_LEN;
3120                        break;
3121                case WLAN_CIPHER_SUITE_AES_CMAC:
3122                case WLAN_CIPHER_SUITE_BIP_CMAC_256:
3123                case WLAN_CIPHER_SUITE_BIP_GMAC_128:
3124                case WLAN_CIPHER_SUITE_BIP_GMAC_256:
3125                        WARN(1,
3126                             "management cipher suite 0x%x enabled for data\n",
3127                             build.key->conf.cipher);
3128                        goto out;
3129                default:
3130                        /* we don't know how to generate IVs for this at all */
3131                        if (WARN_ON(gen_iv))
3132                                goto out;
3133                        /* pure hardware keys are OK, of course */
3134                        if (!(build.key->flags & KEY_FLAG_CIPHER_SCHEME))
3135                                break;
3136                        /* cipher scheme might require space allocation */
3137                        if (iv_spc &&
3138                            build.key->conf.iv_len > IEEE80211_FAST_XMIT_MAX_IV)
3139                                goto out;
3140                        if (iv_spc)
3141                                build.hdr_len += build.key->conf.iv_len;
3142                }
3143
3144                fc |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
3145        }
3146
3147        hdr->frame_control = fc;
3148
3149        memcpy(build.hdr + build.hdr_len,
3150               rfc1042_header,  sizeof(rfc1042_header));
3151        build.hdr_len += sizeof(rfc1042_header);
3152
3153        fast_tx = kmemdup(&build, sizeof(build), GFP_ATOMIC);
3154        /* if the kmemdup fails, continue w/o fast_tx */
3155        if (!fast_tx)
3156                goto out;
3157
3158 out:
3159        /* we might have raced against another call to this function */
3160        old = rcu_dereference_protected(sta->fast_tx,
3161                                        lockdep_is_held(&sta->lock));
3162        rcu_assign_pointer(sta->fast_tx, fast_tx);
3163        if (old)
3164                kfree_rcu(old, rcu_head);
3165        spin_unlock_bh(&sta->lock);
3166}
3167
3168void ieee80211_check_fast_xmit_all(struct ieee80211_local *local)
3169{
3170        struct sta_info *sta;
3171
3172        rcu_read_lock();
3173        list_for_each_entry_rcu(sta, &local->sta_list, list)
3174                ieee80211_check_fast_xmit(sta);
3175        rcu_read_unlock();
3176}
3177
3178void ieee80211_check_fast_xmit_iface(struct ieee80211_sub_if_data *sdata)
3179{
3180        struct ieee80211_local *local = sdata->local;
3181        struct sta_info *sta;
3182
3183        rcu_read_lock();
3184
3185        list_for_each_entry_rcu(sta, &local->sta_list, list) {
3186                if (sdata != sta->sdata &&
3187                    (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
3188                        continue;
3189                ieee80211_check_fast_xmit(sta);
3190        }
3191
3192        rcu_read_unlock();
3193}
3194
3195void ieee80211_clear_fast_xmit(struct sta_info *sta)
3196{
3197        struct ieee80211_fast_tx *fast_tx;
3198
3199        spin_lock_bh(&sta->lock);
3200        fast_tx = rcu_dereference_protected(sta->fast_tx,
3201                                            lockdep_is_held(&sta->lock));
3202        RCU_INIT_POINTER(sta->fast_tx, NULL);
3203        spin_unlock_bh(&sta->lock);
3204
3205        if (fast_tx)
3206                kfree_rcu(fast_tx, rcu_head);
3207}
3208
3209static bool ieee80211_amsdu_realloc_pad(struct ieee80211_local *local,
3210                                        struct sk_buff *skb, int headroom)
3211{
3212        if (skb_headroom(skb) < headroom) {
3213                I802_DEBUG_INC(local->tx_expand_skb_head);
3214
3215                if (pskb_expand_head(skb, headroom, 0, GFP_ATOMIC)) {
3216                        wiphy_debug(local->hw.wiphy,
3217                                    "failed to reallocate TX buffer\n");
3218                        return false;
3219                }
3220        }
3221
3222        return true;
3223}
3224
3225static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
3226                                         struct ieee80211_fast_tx *fast_tx,
3227                                         struct sk_buff *skb)
3228{
3229        struct ieee80211_local *local = sdata->local;
3230        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3231        struct ieee80211_hdr *hdr;
3232        struct ethhdr *amsdu_hdr;
3233        int hdr_len = fast_tx->hdr_len - sizeof(rfc1042_header);
3234        int subframe_len = skb->len - hdr_len;
3235        void *data;
3236        u8 *qc, *h_80211_src, *h_80211_dst;
3237        const u8 *bssid;
3238
3239        if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)
3240                return false;
3241
3242        if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
3243                return true;
3244
3245        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
3246                return false;
3247
3248        data = skb_push(skb, sizeof(*amsdu_hdr));
3249        memmove(data, data + sizeof(*amsdu_hdr), hdr_len);
3250        hdr = data;
3251        amsdu_hdr = data + hdr_len;
3252        /* h_80211_src/dst is addr* field within hdr */
3253        h_80211_src = data + fast_tx->sa_offs;
3254        h_80211_dst = data + fast_tx->da_offs;
3255
3256        amsdu_hdr->h_proto = cpu_to_be16(subframe_len);
3257        ether_addr_copy(amsdu_hdr->h_source, h_80211_src);
3258        ether_addr_copy(amsdu_hdr->h_dest, h_80211_dst);
3259
3260        /* according to IEEE 802.11-2012 8.3.2 table 8-19, the outer SA/DA
3261         * fields needs to be changed to BSSID for A-MSDU frames depending
3262         * on FromDS/ToDS values.
3263         */
3264        switch (sdata->vif.type) {
3265        case NL80211_IFTYPE_STATION:
3266                bssid = sdata->u.mgd.bssid;
3267                break;
3268        case NL80211_IFTYPE_AP:
3269        case NL80211_IFTYPE_AP_VLAN:
3270                bssid = sdata->vif.addr;
3271                break;
3272        default:
3273                bssid = NULL;
3274        }
3275
3276        if (bssid && ieee80211_has_fromds(hdr->frame_control))
3277                ether_addr_copy(h_80211_src, bssid);
3278
3279        if (bssid && ieee80211_has_tods(hdr->frame_control))
3280                ether_addr_copy(h_80211_dst, bssid);
3281
3282        qc = ieee80211_get_qos_ctl(hdr);
3283        *qc |= IEEE80211_QOS_CTL_A_MSDU_PRESENT;
3284
3285        info->control.flags |= IEEE80211_TX_CTRL_AMSDU;
3286
3287        return true;
3288}
3289
3290static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,
3291                                      struct sta_info *sta,
3292                                      struct ieee80211_fast_tx *fast_tx,
3293                                      struct sk_buff *skb)
3294{
3295        struct ieee80211_local *local = sdata->local;
3296        struct fq *fq = &local->fq;
3297        struct fq_tin *tin;
3298        struct fq_flow *flow;
3299        u8 tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3300        struct ieee80211_txq *txq = sta->sta.txq[tid];
3301        struct txq_info *txqi;
3302        struct sk_buff **frag_tail, *head;
3303        int subframe_len = skb->len - ETH_ALEN;
3304        u8 max_subframes = sta->sta.max_amsdu_subframes;
3305        int max_frags = local->hw.max_tx_fragments;
3306        int max_amsdu_len = sta->sta.max_amsdu_len;
3307        int orig_truesize;
3308        u32 flow_idx;
3309        __be16 len;
3310        void *data;
3311        bool ret = false;
3312        unsigned int orig_len;
3313        int n = 2, nfrags, pad = 0;
3314        u16 hdrlen;
3315
3316        if (!ieee80211_hw_check(&local->hw, TX_AMSDU))
3317                return false;
3318
3319        if (sdata->vif.offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
3320                return false;
3321
3322        if (skb_is_gso(skb))
3323                return false;
3324
3325        if (!txq)
3326                return false;
3327
3328        txqi = to_txq_info(txq);
3329        if (test_bit(IEEE80211_TXQ_NO_AMSDU, &txqi->flags))
3330                return false;
3331
3332        if (sta->sta.max_rc_amsdu_len)
3333                max_amsdu_len = min_t(int, max_amsdu_len,
3334                                      sta->sta.max_rc_amsdu_len);
3335
3336        if (sta->sta.max_tid_amsdu_len[tid])
3337                max_amsdu_len = min_t(int, max_amsdu_len,
3338                                      sta->sta.max_tid_amsdu_len[tid]);
3339
3340        flow_idx = fq_flow_idx(fq, skb);
3341
3342        spin_lock_bh(&fq->lock);
3343
3344        /* TODO: Ideally aggregation should be done on dequeue to remain
3345         * responsive to environment changes.
3346         */
3347
3348        tin = &txqi->tin;
3349        flow = fq_flow_classify(fq, tin, flow_idx, skb);
3350        head = skb_peek_tail(&flow->queue);
3351        if (!head || skb_is_gso(head))
3352                goto out;
3353
3354        orig_truesize = head->truesize;
3355        orig_len = head->len;
3356
3357        if (skb->len + head->len > max_amsdu_len)
3358                goto out;
3359
3360        nfrags = 1 + skb_shinfo(skb)->nr_frags;
3361        nfrags += 1 + skb_shinfo(head)->nr_frags;
3362        frag_tail = &skb_shinfo(head)->frag_list;
3363        while (*frag_tail) {
3364                nfrags += 1 + skb_shinfo(*frag_tail)->nr_frags;
3365                frag_tail = &(*frag_tail)->next;
3366                n++;
3367        }
3368
3369        if (max_subframes && n > max_subframes)
3370                goto out;
3371
3372        if (max_frags && nfrags > max_frags)
3373                goto out;
3374
3375        if (!drv_can_aggregate_in_amsdu(local, head, skb))
3376                goto out;
3377
3378        if (!ieee80211_amsdu_prepare_head(sdata, fast_tx, head))
3379                goto out;
3380
3381        /*
3382         * Pad out the previous subframe to a multiple of 4 by adding the
3383         * padding to the next one, that's being added. Note that head->len
3384         * is the length of the full A-MSDU, but that works since each time
3385         * we add a new subframe we pad out the previous one to a multiple
3386         * of 4 and thus it no longer matters in the next round.
3387         */
3388        hdrlen = fast_tx->hdr_len - sizeof(rfc1042_header);
3389        if ((head->len - hdrlen) & 3)
3390                pad = 4 - ((head->len - hdrlen) & 3);
3391
3392        if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(rfc1042_header) +
3393                                                     2 + pad))
3394                goto out_recalc;
3395
3396        ret = true;
3397        data = skb_push(skb, ETH_ALEN + 2);
3398        memmove(data, data + ETH_ALEN + 2, 2 * ETH_ALEN);
3399
3400        data += 2 * ETH_ALEN;
3401        len = cpu_to_be16(subframe_len);
3402        memcpy(data, &len, 2);
3403        memcpy(data + 2, rfc1042_header, sizeof(rfc1042_header));
3404
3405        memset(skb_push(skb, pad), 0, pad);
3406
3407        head->len += skb->len;
3408        head->data_len += skb->len;
3409        *frag_tail = skb;
3410
3411out_recalc:
3412        fq->memory_usage += head->truesize - orig_truesize;
3413        if (head->len != orig_len) {
3414                flow->backlog += head->len - orig_len;
3415                tin->backlog_bytes += head->len - orig_len;
3416        }
3417out:
3418        spin_unlock_bh(&fq->lock);
3419
3420        return ret;
3421}
3422
3423/*
3424 * Can be called while the sta lock is held. Anything that can cause packets to
3425 * be generated will cause deadlock!
3426 */
3427static ieee80211_tx_result
3428ieee80211_xmit_fast_finish(struct ieee80211_sub_if_data *sdata,
3429                           struct sta_info *sta, u8 pn_offs,
3430                           struct ieee80211_key *key,
3431                           struct ieee80211_tx_data *tx)
3432{
3433        struct sk_buff *skb = tx->skb;
3434        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
3435        struct ieee80211_hdr *hdr = (void *)skb->data;
3436        u8 tid = IEEE80211_NUM_TIDS;
3437
3438        if (!ieee80211_hw_check(&tx->local->hw, HAS_RATE_CONTROL) &&
3439            ieee80211_tx_h_rate_ctrl(tx) != TX_CONTINUE)
3440                return TX_DROP;
3441
3442        if (key)
3443                info->control.hw_key = &key->conf;
3444
3445        dev_sw_netstats_tx_add(skb->dev, 1, skb->len);
3446
3447        if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3448                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3449                hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
3450        } else {
3451                info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
3452                hdr->seq_ctrl = cpu_to_le16(sdata->sequence_number);
3453                sdata->sequence_number += 0x10;
3454        }
3455
3456        if (skb_shinfo(skb)->gso_size)
3457                sta->tx_stats.msdu[tid] +=
3458                        DIV_ROUND_UP(skb->len, skb_shinfo(skb)->gso_size);
3459        else
3460                sta->tx_stats.msdu[tid]++;
3461
3462        info->hw_queue = sdata->vif.hw_queue[skb_get_queue_mapping(skb)];
3463
3464        /* statistics normally done by ieee80211_tx_h_stats (but that
3465         * has to consider fragmentation, so is more complex)
3466         */
3467        sta->tx_stats.bytes[skb_get_queue_mapping(skb)] += skb->len;
3468        sta->tx_stats.packets[skb_get_queue_mapping(skb)]++;
3469
3470        if (pn_offs) {
3471                u64 pn;
3472                u8 *crypto_hdr = skb->data + pn_offs;
3473
3474                switch (key->conf.cipher) {
3475                case WLAN_CIPHER_SUITE_CCMP:
3476                case WLAN_CIPHER_SUITE_CCMP_256:
3477                case WLAN_CIPHER_SUITE_GCMP:
3478                case WLAN_CIPHER_SUITE_GCMP_256:
3479                        pn = atomic64_inc_return(&key->conf.tx_pn);
3480                        crypto_hdr[0] = pn;
3481                        crypto_hdr[1] = pn >> 8;
3482                        crypto_hdr[3] = 0x20 | (key->conf.keyidx << 6);
3483                        crypto_hdr[4] = pn >> 16;
3484                        crypto_hdr[5] = pn >> 24;
3485                        crypto_hdr[6] = pn >> 32;
3486                        crypto_hdr[7] = pn >> 40;
3487                        break;
3488                }
3489        }
3490
3491        return TX_CONTINUE;
3492}
3493
3494static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
3495                                struct sta_info *sta,
3496                                struct ieee80211_fast_tx *fast_tx,
3497                                struct sk_buff *skb)
3498{
3499        struct ieee80211_local *local = sdata->local;
3500        u16 ethertype = (skb->data[12] << 8) | skb->data[13];
3501        int extra_head = fast_tx->hdr_len - (ETH_HLEN - 2);
3502        int hw_headroom = sdata->local->hw.extra_tx_headroom;
3503        struct ethhdr eth;
3504        struct ieee80211_tx_info *info;
3505        struct ieee80211_hdr *hdr = (void *)fast_tx->hdr;
3506        struct ieee80211_tx_data tx;
3507        ieee80211_tx_result r;
3508        struct tid_ampdu_tx *tid_tx = NULL;
3509        u8 tid = IEEE80211_NUM_TIDS;
3510
3511        /* control port protocol needs a lot of special handling */
3512        if (cpu_to_be16(ethertype) == sdata->control_port_protocol)
3513                return false;
3514
3515        /* only RFC 1042 SNAP */
3516        if (ethertype < ETH_P_802_3_MIN)
3517                return false;
3518
3519        /* don't handle TX status request here either */
3520        if (skb->sk && skb_shinfo(skb)->tx_flags & SKBTX_WIFI_STATUS)
3521                return false;
3522
3523        if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3524                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3525                tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
3526                if (tid_tx) {
3527                        if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
3528                                return false;
3529                        if (tid_tx->timeout)
3530                                tid_tx->last_tx = jiffies;
3531                }
3532        }
3533
3534        /* after this point (skb is modified) we cannot return false */
3535
3536        if (skb_shared(skb)) {
3537                struct sk_buff *tmp_skb = skb;
3538
3539                skb = skb_clone(skb, GFP_ATOMIC);
3540                kfree_skb(tmp_skb);
3541
3542                if (!skb)
3543                        return true;
3544        }
3545
3546        if ((hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) &&
3547            ieee80211_amsdu_aggregate(sdata, sta, fast_tx, skb))
3548                return true;
3549
3550        /* will not be crypto-handled beyond what we do here, so use false
3551         * as the may-encrypt argument for the resize to not account for
3552         * more room than we already have in 'extra_head'
3553         */
3554        if (unlikely(ieee80211_skb_resize(sdata, skb,
3555                                          max_t(int, extra_head + hw_headroom -
3556                                                     skb_headroom(skb), 0),
3557                                          ENCRYPT_NO))) {
3558                kfree_skb(skb);
3559                return true;
3560        }
3561
3562        memcpy(&eth, skb->data, ETH_HLEN - 2);
3563        hdr = skb_push(skb, extra_head);
3564        memcpy(skb->data, fast_tx->hdr, fast_tx->hdr_len);
3565        memcpy(skb->data + fast_tx->da_offs, eth.h_dest, ETH_ALEN);
3566        memcpy(skb->data + fast_tx->sa_offs, eth.h_source, ETH_ALEN);
3567
3568        info = IEEE80211_SKB_CB(skb);
3569        memset(info, 0, sizeof(*info));
3570        info->band = fast_tx->band;
3571        info->control.vif = &sdata->vif;
3572        info->flags = IEEE80211_TX_CTL_FIRST_FRAGMENT |
3573                      IEEE80211_TX_CTL_DONTFRAG |
3574                      (tid_tx ? IEEE80211_TX_CTL_AMPDU : 0);
3575        info->control.flags = IEEE80211_TX_CTRL_FAST_XMIT;
3576
3577#ifdef CONFIG_MAC80211_DEBUGFS
3578        if (local->force_tx_status)
3579                info->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
3580#endif
3581
3582        if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
3583                tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
3584                *ieee80211_get_qos_ctl(hdr) = tid;
3585        }
3586
3587        __skb_queue_head_init(&tx.skbs);
3588
3589        tx.flags = IEEE80211_TX_UNICAST;
3590        tx.local = local;
3591        tx.sdata = sdata;
3592        tx.sta = sta;
3593        tx.key = fast_tx->key;
3594
3595        if (ieee80211_queue_skb(local, sdata, sta, skb))
3596                return true;
3597
3598        tx.skb = skb;
3599        r = ieee80211_xmit_fast_finish(sdata, sta, fast_tx->pn_offs,
3600                                       fast_tx->key, &tx);
3601        tx.skb = NULL;
3602        if (r == TX_DROP) {
3603                kfree_skb(skb);
3604                return true;
3605        }
3606
3607        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3608                sdata = container_of(sdata->bss,
3609                                     struct ieee80211_sub_if_data, u.ap);
3610
3611        __skb_queue_tail(&tx.skbs, skb);
3612        ieee80211_tx_frags(local, &sdata->vif, sta, &tx.skbs, false);
3613        return true;
3614}
3615
3616struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,
3617                                     struct ieee80211_txq *txq)
3618{
3619        struct ieee80211_local *local = hw_to_local(hw);
3620        struct txq_info *txqi = container_of(txq, struct txq_info, txq);
3621        struct ieee80211_hdr *hdr;
3622        struct sk_buff *skb = NULL;
3623        struct fq *fq = &local->fq;
3624        struct fq_tin *tin = &txqi->tin;
3625        struct ieee80211_tx_info *info;
3626        struct ieee80211_tx_data tx;
3627        ieee80211_tx_result r;
3628        struct ieee80211_vif *vif = txq->vif;
3629
3630        WARN_ON_ONCE(softirq_count() == 0);
3631
3632        if (!ieee80211_txq_airtime_check(hw, txq))
3633                return NULL;
3634
3635begin:
3636        spin_lock_bh(&fq->lock);
3637
3638        if (test_bit(IEEE80211_TXQ_STOP, &txqi->flags) ||
3639            test_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags))
3640                goto out;
3641
3642        if (vif->txqs_stopped[txq->ac]) {
3643                set_bit(IEEE80211_TXQ_STOP_NETIF_TX, &txqi->flags);
3644                goto out;
3645        }
3646
3647        /* Make sure fragments stay together. */
3648        skb = __skb_dequeue(&txqi->frags);
3649        if (unlikely(skb)) {
3650                if (!(IEEE80211_SKB_CB(skb)->control.flags &
3651                                IEEE80211_TX_INTCFL_NEED_TXPROCESSING))
3652                        goto out;
3653                IEEE80211_SKB_CB(skb)->control.flags &=
3654                        ~IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
3655        } else {
3656                skb = fq_tin_dequeue(fq, tin, fq_tin_dequeue_func);
3657        }
3658
3659        if (!skb)
3660                goto out;
3661
3662        spin_unlock_bh(&fq->lock);
3663
3664        hdr = (struct ieee80211_hdr *)skb->data;
3665        info = IEEE80211_SKB_CB(skb);
3666
3667        memset(&tx, 0, sizeof(tx));
3668        __skb_queue_head_init(&tx.skbs);
3669        tx.local = local;
3670        tx.skb = skb;
3671        tx.sdata = vif_to_sdata(info->control.vif);
3672
3673        if (txq->sta) {
3674                tx.sta = container_of(txq->sta, struct sta_info, sta);
3675                /*
3676                 * Drop unicast frames to unauthorised stations unless they are
3677                 * injected frames or EAPOL frames from the local station.
3678                 */
3679                if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
3680                             ieee80211_is_data(hdr->frame_control) &&
3681                             !ieee80211_vif_is_mesh(&tx.sdata->vif) &&
3682                             tx.sdata->vif.type != NL80211_IFTYPE_OCB &&
3683                             !is_multicast_ether_addr(hdr->addr1) &&
3684                             !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) &&
3685                             (!(info->control.flags &
3686                                IEEE80211_TX_CTRL_PORT_CTRL_PROTO) ||
3687                              !ether_addr_equal(tx.sdata->vif.addr,
3688                                                hdr->addr2)))) {
3689                        I802_DEBUG_INC(local->tx_handlers_drop_unauth_port);
3690                        ieee80211_free_txskb(&local->hw, skb);
3691                        goto begin;
3692                }
3693        }
3694
3695        /*
3696         * The key can be removed while the packet was queued, so need to call
3697         * this here to get the current key.
3698         */
3699        r = ieee80211_tx_h_select_key(&tx);
3700        if (r != TX_CONTINUE) {
3701                ieee80211_free_txskb(&local->hw, skb);
3702                goto begin;
3703        }
3704
3705        if (test_bit(IEEE80211_TXQ_AMPDU, &txqi->flags))
3706                info->flags |= IEEE80211_TX_CTL_AMPDU;
3707        else
3708                info->flags &= ~IEEE80211_TX_CTL_AMPDU;
3709
3710        if (info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP) {
3711                if (!ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
3712                        r = ieee80211_tx_h_rate_ctrl(&tx);
3713                        if (r != TX_CONTINUE) {
3714                                ieee80211_free_txskb(&local->hw, skb);
3715                                goto begin;
3716                        }
3717                }
3718                goto encap_out;
3719        }
3720
3721        if (info->control.flags & IEEE80211_TX_CTRL_FAST_XMIT) {
3722                struct sta_info *sta = container_of(txq->sta, struct sta_info,
3723                                                    sta);
3724                u8 pn_offs = 0;
3725
3726                if (tx.key &&
3727                    (tx.key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV))
3728                        pn_offs = ieee80211_hdrlen(hdr->frame_control);
3729
3730                r = ieee80211_xmit_fast_finish(sta->sdata, sta, pn_offs,
3731                                               tx.key, &tx);
3732                if (r != TX_CONTINUE) {
3733                        ieee80211_free_txskb(&local->hw, skb);
3734                        goto begin;
3735                }
3736        } else {
3737                if (invoke_tx_handlers_late(&tx))
3738                        goto begin;
3739
3740                skb = __skb_dequeue(&tx.skbs);
3741
3742                if (!skb_queue_empty(&tx.skbs)) {
3743                        spin_lock_bh(&fq->lock);
3744                        skb_queue_splice_tail(&tx.skbs, &txqi->frags);
3745                        spin_unlock_bh(&fq->lock);
3746                }
3747        }
3748
3749        if (skb_has_frag_list(skb) &&
3750            !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
3751                if (skb_linearize(skb)) {
3752                        ieee80211_free_txskb(&local->hw, skb);
3753                        goto begin;
3754                }
3755        }
3756
3757        switch (tx.sdata->vif.type) {
3758        case NL80211_IFTYPE_MONITOR:
3759                if (tx.sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE) {
3760                        vif = &tx.sdata->vif;
3761                        break;
3762                }
3763                tx.sdata = rcu_dereference(local->monitor_sdata);
3764                if (tx.sdata) {
3765                        vif = &tx.sdata->vif;
3766                        info->hw_queue =
3767                                vif->hw_queue[skb_get_queue_mapping(skb)];
3768                } else if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) {
3769                        ieee80211_free_txskb(&local->hw, skb);
3770                        goto begin;
3771                } else {
3772                        vif = NULL;
3773                }
3774                break;
3775        case NL80211_IFTYPE_AP_VLAN:
3776                tx.sdata = container_of(tx.sdata->bss,
3777                                        struct ieee80211_sub_if_data, u.ap);
3778                fallthrough;
3779        default:
3780                vif = &tx.sdata->vif;
3781                break;
3782        }
3783
3784encap_out:
3785        IEEE80211_SKB_CB(skb)->control.vif = vif;
3786
3787        if (vif &&
3788            wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
3789                bool ampdu = txq->ac != IEEE80211_AC_VO;
3790                u32 airtime;
3791
3792                airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
3793                                                             skb->len, ampdu);
3794                if (airtime) {
3795                        airtime = ieee80211_info_set_tx_time_est(info, airtime);
3796                        ieee80211_sta_update_pending_airtime(local, tx.sta,
3797                                                             txq->ac,
3798                                                             airtime,
3799                                                             false);
3800                }
3801        }
3802
3803        return skb;
3804
3805out:
3806        spin_unlock_bh(&fq->lock);
3807
3808        return skb;
3809}
3810EXPORT_SYMBOL(ieee80211_tx_dequeue);
3811
3812struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
3813{
3814        struct ieee80211_local *local = hw_to_local(hw);
3815        struct airtime_sched_info *air_sched;
3816        u64 now = ktime_get_boottime_ns();
3817        struct ieee80211_txq *ret = NULL;
3818        struct airtime_info *air_info;
3819        struct txq_info *txqi = NULL;
3820        struct rb_node *node;
3821        bool first = false;
3822
3823        air_sched = &local->airtime[ac];
3824        spin_lock_bh(&air_sched->lock);
3825
3826        node = air_sched->schedule_pos;
3827
3828begin:
3829        if (!node) {
3830                node = rb_first_cached(&air_sched->active_txqs);
3831                first = true;
3832        } else {
3833                node = rb_next(node);
3834        }
3835
3836        if (!node)
3837                goto out;
3838
3839        txqi = container_of(node, struct txq_info, schedule_order);
3840        air_info = to_airtime_info(&txqi->txq);
3841
3842        if (air_info->v_t > air_sched->v_t &&
3843            (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
3844                goto out;
3845
3846        if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
3847                first = false;
3848                goto begin;
3849        }
3850
3851        air_sched->schedule_pos = node;
3852        air_sched->last_schedule_activity = now;
3853        ret = &txqi->txq;
3854out:
3855        spin_unlock_bh(&air_sched->lock);
3856        return ret;
3857}
3858EXPORT_SYMBOL(ieee80211_next_txq);
3859
3860static void __ieee80211_insert_txq(struct rb_root_cached *root,
3861                                   struct txq_info *txqi)
3862{
3863        struct rb_node **new = &root->rb_root.rb_node;
3864        struct airtime_info *old_air, *new_air;
3865        struct rb_node *parent = NULL;
3866        struct txq_info *__txqi;
3867        bool leftmost = true;
3868
3869        while (*new) {
3870                parent = *new;
3871                __txqi = rb_entry(parent, struct txq_info, schedule_order);
3872                old_air = to_airtime_info(&__txqi->txq);
3873                new_air = to_airtime_info(&txqi->txq);
3874
3875                if (new_air->v_t <= old_air->v_t) {
3876                        new = &parent->rb_left;
3877                } else {
3878                        new = &parent->rb_right;
3879                        leftmost = false;
3880                }
3881        }
3882
3883        rb_link_node(&txqi->schedule_order, parent, new);
3884        rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
3885}
3886
3887void ieee80211_resort_txq(struct ieee80211_hw *hw,
3888                          struct ieee80211_txq *txq)
3889{
3890        struct airtime_info *air_info = to_airtime_info(txq);
3891        struct ieee80211_local *local = hw_to_local(hw);
3892        struct txq_info *txqi = to_txq_info(txq);
3893        struct airtime_sched_info *air_sched;
3894
3895        air_sched = &local->airtime[txq->ac];
3896
3897        lockdep_assert_held(&air_sched->lock);
3898
3899        if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
3900                struct airtime_info *a_prev = NULL, *a_next = NULL;
3901                struct txq_info *t_prev, *t_next;
3902                struct rb_node *n_prev, *n_next;
3903
3904                /* Erasing a node can cause an expensive rebalancing operation,
3905                 * so we check the previous and next nodes first and only remove
3906                 * and re-insert if the current node is not already in the
3907                 * correct position.
3908                 */
3909                if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
3910                        t_prev = container_of(n_prev, struct txq_info,
3911                                              schedule_order);
3912                        a_prev = to_airtime_info(&t_prev->txq);
3913                }
3914
3915                if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
3916                        t_next = container_of(n_next, struct txq_info,
3917                                              schedule_order);
3918                        a_next = to_airtime_info(&t_next->txq);
3919                }
3920
3921                if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
3922                    (!a_next || a_next->v_t > air_info->v_t))
3923                        return;
3924
3925                if (air_sched->schedule_pos == &txqi->schedule_order)
3926                        air_sched->schedule_pos = n_prev;
3927
3928                rb_erase_cached(&txqi->schedule_order,
3929                                &air_sched->active_txqs);
3930                RB_CLEAR_NODE(&txqi->schedule_order);
3931                __ieee80211_insert_txq(&air_sched->active_txqs, txqi);
3932        }
3933}
3934
3935void ieee80211_update_airtime_weight(struct ieee80211_local *local,
3936                                     struct airtime_sched_info *air_sched,
3937                                     u64 now, bool force)
3938{
3939        struct airtime_info *air_info, *tmp;
3940        u64 weight_sum = 0;
3941
3942        if (unlikely(!now))
3943                now = ktime_get_boottime_ns();
3944
3945        lockdep_assert_held(&air_sched->lock);
3946
3947        if (!force && (air_sched->last_weight_update <
3948                       now - AIRTIME_ACTIVE_DURATION))
3949                return;
3950
3951        list_for_each_entry_safe(air_info, tmp,
3952                                 &air_sched->active_list, list) {
3953                if (airtime_is_active(air_info, now))
3954                        weight_sum += air_info->weight;
3955                else
3956                        list_del_init(&air_info->list);
3957        }
3958        airtime_weight_sum_set(air_sched, weight_sum);
3959        air_sched->last_weight_update = now;
3960}
3961
3962void ieee80211_schedule_txq(struct ieee80211_hw *hw,
3963                            struct ieee80211_txq *txq)
3964        __acquires(txq_lock) __releases(txq_lock)
3965{
3966        struct ieee80211_local *local = hw_to_local(hw);
3967        struct txq_info *txqi = to_txq_info(txq);
3968        struct airtime_sched_info *air_sched;
3969        u64 now = ktime_get_boottime_ns();
3970        struct airtime_info *air_info;
3971        u8 ac = txq->ac;
3972        bool was_active;
3973
3974        air_sched = &local->airtime[ac];
3975        air_info = to_airtime_info(txq);
3976
3977        spin_lock_bh(&air_sched->lock);
3978        was_active = airtime_is_active(air_info, now);
3979        airtime_set_active(air_sched, air_info, now);
3980
3981        if (!RB_EMPTY_NODE(&txqi->schedule_order))
3982                goto out;
3983
3984        /* If the station has been inactive for a while, catch up its v_t so it
3985         * doesn't get indefinite priority; see comment above the definition of
3986         * AIRTIME_MAX_BEHIND.
3987         */
3988        if ((!was_active && air_info->v_t < air_sched->v_t) ||
3989            air_info->v_t < air_sched->v_t - AIRTIME_MAX_BEHIND)
3990                air_info->v_t = air_sched->v_t;
3991
3992        ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
3993        __ieee80211_insert_txq(&air_sched->active_txqs, txqi);
3994
3995out:
3996        spin_unlock_bh(&air_sched->lock);
3997}
3998EXPORT_SYMBOL(ieee80211_schedule_txq);
3999
4000static void __ieee80211_unschedule_txq(struct ieee80211_hw *hw,
4001                                       struct ieee80211_txq *txq,
4002                                       bool purge)
4003{
4004        struct ieee80211_local *local = hw_to_local(hw);
4005        struct txq_info *txqi = to_txq_info(txq);
4006        struct airtime_sched_info *air_sched;
4007        struct airtime_info *air_info;
4008
4009        air_sched = &local->airtime[txq->ac];
4010        air_info = to_airtime_info(&txqi->txq);
4011
4012        lockdep_assert_held(&air_sched->lock);
4013
4014        if (purge) {
4015                list_del_init(&air_info->list);
4016                ieee80211_update_airtime_weight(local, air_sched, 0, true);
4017        }
4018
4019        if (RB_EMPTY_NODE(&txqi->schedule_order))
4020                return;
4021
4022        if (air_sched->schedule_pos == &txqi->schedule_order)
4023                air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
4024
4025        if (!purge)
4026                airtime_set_active(air_sched, air_info,
4027                                   ktime_get_boottime_ns());
4028
4029        rb_erase_cached(&txqi->schedule_order,
4030                        &air_sched->active_txqs);
4031        RB_CLEAR_NODE(&txqi->schedule_order);
4032}
4033
4034void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
4035                              struct ieee80211_txq *txq,
4036                              bool purge)
4037        __acquires(txq_lock) __releases(txq_lock)
4038{
4039        struct ieee80211_local *local = hw_to_local(hw);
4040
4041        spin_lock_bh(&local->airtime[txq->ac].lock);
4042        __ieee80211_unschedule_txq(hw, txq, purge);
4043        spin_unlock_bh(&local->airtime[txq->ac].lock);
4044}
4045
4046void ieee80211_return_txq(struct ieee80211_hw *hw,
4047                          struct ieee80211_txq *txq, bool force)
4048{
4049        struct ieee80211_local *local = hw_to_local(hw);
4050        struct txq_info *txqi = to_txq_info(txq);
4051
4052        spin_lock_bh(&local->airtime[txq->ac].lock);
4053
4054        if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
4055            !txq_has_queue(txq))
4056                __ieee80211_unschedule_txq(hw, txq, false);
4057
4058        spin_unlock_bh(&local->airtime[txq->ac].lock);
4059}
4060EXPORT_SYMBOL(ieee80211_return_txq);
4061
4062DEFINE_STATIC_KEY_FALSE(aql_disable);
4063
4064bool ieee80211_txq_airtime_check(struct ieee80211_hw *hw,
4065                                 struct ieee80211_txq *txq)
4066{
4067        struct airtime_info *air_info = to_airtime_info(txq);
4068        struct ieee80211_local *local = hw_to_local(hw);
4069
4070        if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
4071                return true;
4072
4073        if (static_branch_unlikely(&aql_disable))
4074                return true;
4075
4076        if (!txq->sta)
4077                return true;
4078
4079        if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
4080                return true;
4081
4082        if (atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_low)
4083                return true;
4084
4085        if (atomic_read(&local->aql_total_pending_airtime) <
4086            local->aql_threshold &&
4087            atomic_read(&air_info->aql_tx_pending) < air_info->aql_limit_high)
4088                return true;
4089
4090        return false;
4091}
4092EXPORT_SYMBOL(ieee80211_txq_airtime_check);
4093
4094bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
4095                                struct ieee80211_txq *txq)
4096{
4097        struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
4098        struct ieee80211_local *local = hw_to_local(hw);
4099        struct airtime_sched_info *air_sched;
4100        struct airtime_info *air_info;
4101        struct rb_node *node = NULL;
4102        bool ret = false;
4103        u64 now;
4104
4105
4106        if (!ieee80211_txq_airtime_check(hw, txq))
4107                return false;
4108
4109        air_sched = &local->airtime[txq->ac];
4110        spin_lock_bh(&air_sched->lock);
4111
4112        if (RB_EMPTY_NODE(&txqi->schedule_order))
4113                goto out;
4114
4115        now = ktime_get_boottime_ns();
4116
4117        /* Like in ieee80211_next_txq(), make sure the first station in the
4118         * scheduling order is eligible for transmission to avoid starvation.
4119         */
4120        node = rb_first_cached(&air_sched->active_txqs);
4121        if (node) {
4122                first_txqi = container_of(node, struct txq_info,
4123                                          schedule_order);
4124                air_info = to_airtime_info(&first_txqi->txq);
4125
4126                if (air_sched->v_t < air_info->v_t)
4127                        airtime_catchup_v_t(air_sched, air_info->v_t, now);
4128        }
4129
4130        air_info = to_airtime_info(&txqi->txq);
4131        if (air_info->v_t <= air_sched->v_t) {
4132                air_sched->last_schedule_activity = now;
4133                ret = true;
4134        }
4135
4136out:
4137        spin_unlock_bh(&air_sched->lock);
4138        return ret;
4139}
4140EXPORT_SYMBOL(ieee80211_txq_may_transmit);
4141
4142void ieee80211_txq_schedule_start(struct ieee80211_hw *hw, u8 ac)
4143{
4144        struct ieee80211_local *local = hw_to_local(hw);
4145        struct airtime_sched_info *air_sched = &local->airtime[ac];
4146
4147        spin_lock_bh(&air_sched->lock);
4148        air_sched->schedule_pos = NULL;
4149        spin_unlock_bh(&air_sched->lock);
4150}
4151EXPORT_SYMBOL(ieee80211_txq_schedule_start);
4152
4153void __ieee80211_subif_start_xmit(struct sk_buff *skb,
4154                                  struct net_device *dev,
4155                                  u32 info_flags,
4156                                  u32 ctrl_flags,
4157                                  u64 *cookie)
4158{
4159        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4160        struct ieee80211_local *local = sdata->local;
4161        struct sta_info *sta;
4162        struct sk_buff *next;
4163
4164        if (unlikely(skb->len < ETH_HLEN)) {
4165                kfree_skb(skb);
4166                return;
4167        }
4168
4169        rcu_read_lock();
4170
4171        if (ieee80211_lookup_ra_sta(sdata, skb, &sta))
4172                goto out_free;
4173
4174        if (IS_ERR(sta))
4175                sta = NULL;
4176
4177        if (local->ops->wake_tx_queue) {
4178                u16 queue = __ieee80211_select_queue(sdata, sta, skb);
4179                skb_set_queue_mapping(skb, queue);
4180                skb_get_hash(skb);
4181        }
4182
4183        ieee80211_aggr_check(sdata, sta, skb);
4184
4185        if (sta) {
4186                struct ieee80211_fast_tx *fast_tx;
4187
4188                sk_pacing_shift_update(skb->sk, sdata->local->hw.tx_sk_pacing_shift);
4189
4190                fast_tx = rcu_dereference(sta->fast_tx);
4191
4192                if (fast_tx &&
4193                    ieee80211_xmit_fast(sdata, sta, fast_tx, skb))
4194                        goto out;
4195        }
4196
4197        if (skb_is_gso(skb)) {
4198                struct sk_buff *segs;
4199
4200                segs = skb_gso_segment(skb, 0);
4201                if (IS_ERR(segs)) {
4202                        goto out_free;
4203                } else if (segs) {
4204                        consume_skb(skb);
4205                        skb = segs;
4206                }
4207        } else {
4208                /* we cannot process non-linear frames on this path */
4209                if (skb_linearize(skb)) {
4210                        kfree_skb(skb);
4211                        goto out;
4212                }
4213
4214                /* the frame could be fragmented, software-encrypted, and other
4215                 * things so we cannot really handle checksum offload with it -
4216                 * fix it up in software before we handle anything else.
4217                 */
4218                if (skb->ip_summed == CHECKSUM_PARTIAL) {
4219                        skb_set_transport_header(skb,
4220                                                 skb_checksum_start_offset(skb));
4221                        if (skb_checksum_help(skb))
4222                                goto out_free;
4223                }
4224        }
4225
4226        skb_list_walk_safe(skb, skb, next) {
4227                skb_mark_not_on_list(skb);
4228
4229                if (skb->protocol == sdata->control_port_protocol)
4230                        ctrl_flags |= IEEE80211_TX_CTRL_SKIP_MPATH_LOOKUP;
4231
4232                skb = ieee80211_build_hdr(sdata, skb, info_flags,
4233                                          sta, ctrl_flags, cookie);
4234                if (IS_ERR(skb)) {
4235                        kfree_skb_list(next);
4236                        goto out;
4237                }
4238
4239                dev_sw_netstats_tx_add(dev, 1, skb->len);
4240
4241                ieee80211_xmit(sdata, sta, skb);
4242        }
4243        goto out;
4244 out_free:
4245        kfree_skb(skb);
4246 out:
4247        rcu_read_unlock();
4248}
4249
4250static int ieee80211_change_da(struct sk_buff *skb, struct sta_info *sta)
4251{
4252        struct ethhdr *eth;
4253        int err;
4254
4255        err = skb_ensure_writable(skb, ETH_HLEN);
4256        if (unlikely(err))
4257                return err;
4258
4259        eth = (void *)skb->data;
4260        ether_addr_copy(eth->h_dest, sta->sta.addr);
4261
4262        return 0;
4263}
4264
4265static bool ieee80211_multicast_to_unicast(struct sk_buff *skb,
4266                                           struct net_device *dev)
4267{
4268        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4269        const struct ethhdr *eth = (void *)skb->data;
4270        const struct vlan_ethhdr *ethvlan = (void *)skb->data;
4271        __be16 ethertype;
4272
4273        if (likely(!is_multicast_ether_addr(eth->h_dest)))
4274                return false;
4275
4276        switch (sdata->vif.type) {
4277        case NL80211_IFTYPE_AP_VLAN:
4278                if (sdata->u.vlan.sta)
4279                        return false;
4280                if (sdata->wdev.use_4addr)
4281                        return false;
4282                fallthrough;
4283        case NL80211_IFTYPE_AP:
4284                /* check runtime toggle for this bss */
4285                if (!sdata->bss->multicast_to_unicast)
4286                        return false;
4287                break;
4288        default:
4289                return false;
4290        }
4291
4292        /* multicast to unicast conversion only for some payload */
4293        ethertype = eth->h_proto;
4294        if (ethertype == htons(ETH_P_8021Q) && skb->len >= VLAN_ETH_HLEN)
4295                ethertype = ethvlan->h_vlan_encapsulated_proto;
4296        switch (ethertype) {
4297        case htons(ETH_P_ARP):
4298        case htons(ETH_P_IP):
4299        case htons(ETH_P_IPV6):
4300                break;
4301        default:
4302                return false;
4303        }
4304
4305        return true;
4306}
4307
4308static void
4309ieee80211_convert_to_unicast(struct sk_buff *skb, struct net_device *dev,
4310                             struct sk_buff_head *queue)
4311{
4312        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
4313        struct ieee80211_local *local = sdata->local;
4314        const struct ethhdr *eth = (struct ethhdr *)skb->data;
4315        struct sta_info *sta, *first = NULL;
4316        struct sk_buff *cloned_skb;
4317
4318        rcu_read_lock();
4319
4320        list_for_each_entry_rcu(sta, &local->sta_list, list) {
4321                if (sdata != sta->sdata)
4322                        /* AP-VLAN mismatch */
4323                        continue;
4324                if (unlikely(ether_addr_equal(eth->h_source, sta->sta.addr)))
4325                        /* do not send back to source */
4326                        continue;
4327                if (!first) {
4328                        first = sta;
4329                        continue;
4330                }
4331                cloned_skb = skb_clone(skb, GFP_ATOMIC);
4332                if (!cloned_skb)
4333                        goto multicast;
4334                if (unlikely(ieee80211_change_da(cloned_skb, sta))) {
4335                        dev_kfree_skb(cloned_skb);
4336                        goto multicast;
4337                }
4338                __skb_queue_tail(queue, cloned_skb);
4339        }
4340
4341        if (likely(first)) {
4342                if (unlikely(ieee80211_change_da(skb, first)))
4343                        goto multicast;
4344                __skb_queue_tail(queue, skb);
4345        } else {
4346                /* no STA connected, drop */
4347                kfree_skb(skb);
4348                skb = NULL;
4349        }
4350
4351        goto out;
4352multicast:
4353        __skb_queue_purge(queue);
4354        __skb_queue_tail(queue, skb);
4355out:
4356        rcu_read_unlock();
4357}
4358