// SPDX-License-Identifier: GPL-2.0-only

/*

* Copyright 2002-2005, Instant802 Networks, Inc.

* Copyright 2005-2006, Devicescape Software, Inc.

* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>

* Copyright 2007 Johannes Berg <johannes@sipsolutions.net>

* Copyright 2013-2014 Intel Mobile Communications GmbH

* Copyright (C) 2018-2024 Intel Corporation

*

* Transmit and frame generation functions.

*/

#include <linux/kernel.h>

#include <linux/slab.h>

#include <linux/skbuff.h>

#include <linux/if_vlan.h>

#include <linux/etherdevice.h>

#include <linux/bitmap.h>

#include <linux/rcupdate.h>

#include <linux/export.h>

#include <net/net_namespace.h>

#include <net/ieee80211_radiotap.h>

#include <net/cfg80211.h>

#include <net/mac80211.h>

#include <net/codel.h>

#include <net/codel_impl.h>

#include <linux/unaligned.h>

#include <net/fq_impl.h>

#include <net/gso.h>

#include "ieee80211_i.h"

#include "driver-ops.h"

#include "led.h"

#include "mesh.h"

#include "wep.h"

#include "wpa.h"

#include "wme.h"

#include "rate.h"

/* misc utils */

static __le16 ieee80211_duration(struct ieee80211_tx_data *tx,

struct sk_buff *skb, int group_addr,

int next_frag_len)

{

int rate, mrate, erp, dur, i;

struct ieee80211_rate *txrate;

struct ieee80211_local *local = tx->local;

struct ieee80211_supported_band *sband;

struct ieee80211_hdr *hdr;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

struct ieee80211_chanctx_conf *chanctx_conf;

u32 rate_flags = 0;

/* assume HW handles this */

if (tx->rate.flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))

return 0;

rcu_read_lock();

chanctx_conf = rcu_dereference(tx->sdata->vif.bss_conf.chanctx_conf);

if (chanctx_conf)

rate_flags = ieee80211_chandef_rate_flags(&chanctx_conf->def);

rcu_read_unlock();

/* uh huh? */

if (WARN_ON_ONCE(tx->rate.idx < 0))

return 0;

sband = local->hw.wiphy->bands[info->band];

txrate = &sband->bitrates[tx->rate.idx];

erp = txrate->flags & IEEE80211_RATE_ERP_G;

/* device is expected to do this */

if (sband->band == NL80211_BAND_S1GHZ)

return 0;

/*

* data and mgmt (except PS Poll):

* - during CFP: 32768

* - during contention period:

* if addr1 is group address: 0

* if more fragments = 0 and addr1 is individual address: time to

* transmit one ACK plus SIFS

* if more fragments = 1 and addr1 is individual address: time to

* transmit next fragment plus 2 x ACK plus 3 x SIFS

*

* IEEE 802.11, 9.6:

* - control response frame (CTS or ACK) shall be transmitted using the

* same rate as the immediately previous frame in the frame exchange

* sequence, if this rate belongs to the PHY mandatory rates, or else

* at the highest possible rate belonging to the PHY rates in the

* BSSBasicRateSet

*/

hdr = (struct ieee80211_hdr *)skb->data;

if (ieee80211_is_ctl(hdr->frame_control)) {

/* TODO: These control frames are not currently sent by

* mac80211, but should they be implemented, this function

* needs to be updated to support duration field calculation.

*

* RTS: time needed to transmit pending data/mgmt frame plus

* one CTS frame plus one ACK frame plus 3 x SIFS

* CTS: duration of immediately previous RTS minus time

* required to transmit CTS and its SIFS

* ACK: 0 if immediately previous directed data/mgmt had

* more=0, with more=1 duration in ACK frame is duration

* from previous frame minus time needed to transmit ACK

* and its SIFS

* PS Poll: BIT(15) | BIT(14) | aid

*/

return 0;

}

/* data/mgmt */

if (0 /* FIX: data/mgmt during CFP */)

return cpu_to_le16(32768);

if (group_addr) /* Group address as the destination - no ACK */

return 0;

/* Individual destination address:

* IEEE 802.11, Ch. 9.6 (after IEEE 802.11g changes)

* CTS and ACK frames shall be transmitted using the highest rate in

* basic rate set that is less than or equal to the rate of the

* immediately previous frame and that is using the same modulation

* (CCK or OFDM). If no basic rate set matches with these requirements,

* the highest mandatory rate of the PHY that is less than or equal to

* the rate of the previous frame is used.

* Mandatory rates for IEEE 802.11g PHY: 1, 2, 5.5, 11, 6, 12, 24 Mbps

*/

rate = -1;

/* use lowest available if everything fails */

mrate = sband->bitrates[0].bitrate;

for (i = 0; i < sband->n_bitrates; i++) {

struct ieee80211_rate *r = &sband->bitrates[i];

u32 flag;

if (r->bitrate > txrate->bitrate)

break;

if ((rate_flags & r->flags) != rate_flags)

continue;

if (tx->sdata->vif.bss_conf.basic_rates & BIT(i))

rate = r->bitrate;

switch (sband->band) {

case NL80211_BAND_2GHZ:

case NL80211_BAND_LC:

if (tx->sdata->deflink.operating_11g_mode)

flag = IEEE80211_RATE_MANDATORY_G;

else

flag = IEEE80211_RATE_MANDATORY_B;

break;

case NL80211_BAND_5GHZ:

case NL80211_BAND_6GHZ:

flag = IEEE80211_RATE_MANDATORY_A;

break;

default:

flag = 0;

WARN_ON(1);

break;

}

if (r->flags & flag)

mrate = r->bitrate;

}

if (rate == -1) {

/* No matching basic rate found; use highest suitable mandatory

* PHY rate */

rate = mrate;

}

/* Don't calculate ACKs for QoS Frames with NoAck Policy set */

if (ieee80211_is_data_qos(hdr->frame_control) &&

*(ieee80211_get_qos_ctl(hdr)) & IEEE80211_QOS_CTL_ACK_POLICY_NOACK)

dur = 0;

else

/* Time needed to transmit ACK

* (10 bytes + 4-byte FCS = 112 bits) plus SIFS; rounded up

* to closest integer */

dur = ieee80211_frame_duration(sband->band, 10, rate, erp,

tx->sdata->vif.bss_conf.use_short_preamble);

if (next_frag_len) {

/* Frame is fragmented: duration increases with time needed to

* transmit next fragment plus ACK and 2 x SIFS. */

dur *= 2; /* ACK + SIFS */

/* next fragment */

dur += ieee80211_frame_duration(sband->band, next_frag_len,

txrate->bitrate, erp,

tx->sdata->vif.bss_conf.use_short_preamble);

}

return cpu_to_le16(dur);

}

/* tx handlers */

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)

{

struct ieee80211_local *local = tx->local;

struct ieee80211_if_managed *ifmgd;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

/* driver doesn't support power save */

if (!ieee80211_hw_check(&local->hw, SUPPORTS_PS))

return TX_CONTINUE;

/* hardware does dynamic power save */

if (ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))

return TX_CONTINUE;

/* dynamic power save disabled */

if (local->hw.conf.dynamic_ps_timeout <= 0)

return TX_CONTINUE;

/* we are scanning, don't enable power save */

if (local->scanning)

return TX_CONTINUE;

if (!local->ps_sdata)

return TX_CONTINUE;

/* No point if we're going to suspend */

if (local->quiescing)

return TX_CONTINUE;

/* dynamic ps is supported only in managed mode */

if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)

return TX_CONTINUE;

if (unlikely(info->flags & IEEE80211_TX_INTFL_OFFCHAN_TX_OK))

return TX_CONTINUE;

ifmgd = &tx->sdata->u.mgd;

/*

* Don't wakeup from power save if u-apsd is enabled, voip ac has

* u-apsd enabled and the frame is in voip class. This effectively

* means that even if all access categories have u-apsd enabled, in

* practise u-apsd is only used with the voip ac. This is a

* workaround for the case when received voip class packets do not

* have correct qos tag for some reason, due the network or the

* peer application.

*

* Note: ifmgd->uapsd_queues access is racy here. If the value is

* changed via debugfs, user needs to reassociate manually to have

* everything in sync.

*/

if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED) &&

(ifmgd->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO) &&

skb_get_queue_mapping(tx->skb) == IEEE80211_AC_VO)

return TX_CONTINUE;

if (local->hw.conf.flags & IEEE80211_CONF_PS) {

ieee80211_stop_queues_by_reason(&local->hw,

IEEE80211_MAX_QUEUE_MAP,

IEEE80211_QUEUE_STOP_REASON_PS,

false);

ifmgd->flags &= ~IEEE80211_STA_NULLFUNC_ACKED;

wiphy_work_queue(local->hw.wiphy,

&local->dynamic_ps_disable_work);

}

/* Don't restart the timer if we're not disassociated */

if (!ifmgd->associated)

return TX_CONTINUE;

mod_timer(&local->dynamic_ps_timer, jiffies +

msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));

return TX_CONTINUE;

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)

{

struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

bool assoc = false;

if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED))

return TX_CONTINUE;

if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&

test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&

!ieee80211_is_probe_req(hdr->frame_control) &&

!ieee80211_is_any_nullfunc(hdr->frame_control))

/*

* When software scanning only nullfunc frames (to notify

* the sleep state to the AP) and probe requests (for the

* active scan) are allowed, all other frames should not be

* sent and we should not get here, but if we do

* nonetheless, drop them to avoid sending them

* off-channel. See the link below and

* ieee80211_start_scan() for more.

*

* http://article.gmane.org/gmane.linux.kernel.wireless.general/30089

*/

return TX_DROP;

if (tx->sdata->vif.type == NL80211_IFTYPE_OCB)

return TX_CONTINUE;

if (tx->flags & IEEE80211_TX_PS_BUFFERED)

return TX_CONTINUE;

if (tx->sta)

assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);

if (likely(tx->flags & IEEE80211_TX_UNICAST)) {

if (unlikely(!assoc &&

ieee80211_is_data(hdr->frame_control))) {

#ifdef CONFIG_MAC80211_VERBOSE_DEBUG

sdata_info(tx->sdata,

"dropped data frame to not associated station %pM\n",

hdr->addr1);

#endif

I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);

return TX_DROP;

}

} else if (unlikely(ieee80211_is_data(hdr->frame_control) &&

ieee80211_vif_get_num_mcast_if(tx->sdata) == 0)) {

/*

* No associated STAs - no need to send multicast

* frames.

*/

return TX_DROP;

}

return TX_CONTINUE;

}

/* This function is called whenever the AP is about to exceed the maximum limit

* of buffered frames for power saving STAs. This situation should not really

* happen often during normal operation, so dropping the oldest buffered packet

* from each queue should be OK to make some room for new frames. */

static void purge_old_ps_buffers(struct ieee80211_local *local)

{

int total = 0, purged = 0;

struct sk_buff *skb;

struct ieee80211_sub_if_data *sdata;

struct sta_info *sta;

list_for_each_entry_rcu(sdata, &local->interfaces, list) {

struct ps_data *ps;

if (sdata->vif.type == NL80211_IFTYPE_AP)

ps = &sdata->u.ap.ps;

else if (ieee80211_vif_is_mesh(&sdata->vif))

ps = &sdata->u.mesh.ps;

else

continue;

skb = skb_dequeue(&ps->bc_buf);

if (skb) {

purged++;

ieee80211_free_txskb(&local->hw, skb);

}

total += skb_queue_len(&ps->bc_buf);

}

/*

* Drop one frame from each station from the lowest-priority

* AC that has frames at all.

*/

list_for_each_entry_rcu(sta, &local->sta_list, list) {

int ac;

for (ac = IEEE80211_AC_BK; ac >= IEEE80211_AC_VO; ac--) {

skb = skb_dequeue(&sta->ps_tx_buf[ac]);

total += skb_queue_len(&sta->ps_tx_buf[ac]);

if (skb) {

purged++;

ieee80211_free_txskb(&local->hw, skb);

break;

}

}

}

local->total_ps_buffered = total;

ps_dbg_hw(&local->hw, "PS buffers full - purged %d frames\n", purged);

}

static ieee80211_tx_result

ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)

{

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;

struct ps_data *ps;

/*

* broadcast/multicast frame

*

* If any of the associated/peer stations is in power save mode,

* the frame is buffered to be sent after DTIM beacon frame.

* This is done either by the hardware or us.

*/

/* powersaving STAs currently only in AP/VLAN/mesh mode */

if (tx->sdata->vif.type == NL80211_IFTYPE_AP ||

tx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {

if (!tx->sdata->bss)

return TX_CONTINUE;

ps = &tx->sdata->bss->ps;

} else if (ieee80211_vif_is_mesh(&tx->sdata->vif)) {

ps = &tx->sdata->u.mesh.ps;

} else {

return TX_CONTINUE;

}

/* no buffering for ordered frames */

if (ieee80211_has_order(hdr->frame_control))

return TX_CONTINUE;

if (ieee80211_is_probe_req(hdr->frame_control))

return TX_CONTINUE;

if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))

info->hw_queue = tx->sdata->vif.cab_queue;

/* no stations in PS mode and no buffered packets */

if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))

return TX_CONTINUE;

info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;

/* device releases frame after DTIM beacon */

if (!ieee80211_hw_check(&tx->local->hw, HOST_BROADCAST_PS_BUFFERING))

return TX_CONTINUE;

/* buffered in mac80211 */

if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)

purge_old_ps_buffers(tx->local);

if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {

ps_dbg(tx->sdata,

"BC TX buffer full - dropping the oldest frame\n");

ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));

} else

tx->local->total_ps_buffered++;

skb_queue_tail(&ps->bc_buf, tx->skb);

return TX_QUEUED;

}

static int ieee80211_use_mfp(__le16 fc, struct sta_info *sta,

struct sk_buff *skb)

{

if (!ieee80211_is_mgmt(fc))

return 0;

if (sta == NULL || !test_sta_flag(sta, WLAN_STA_MFP))

return 0;

if (!ieee80211_is_robust_mgmt_frame(skb))

return 0;

return 1;

}

static ieee80211_tx_result

ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)

{

struct sta_info *sta = tx->sta;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;

struct ieee80211_local *local = tx->local;

if (unlikely(!sta))

return TX_CONTINUE;

if (unlikely((test_sta_flag(sta, WLAN_STA_PS_STA) ||

test_sta_flag(sta, WLAN_STA_PS_DRIVER) ||

test_sta_flag(sta, WLAN_STA_PS_DELIVER)) &&

!(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {

int ac = skb_get_queue_mapping(tx->skb);

if (ieee80211_is_mgmt(hdr->frame_control) &&

!ieee80211_is_bufferable_mmpdu(tx->skb)) {

info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;

return TX_CONTINUE;

}

ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",

sta->sta.addr, sta->sta.aid, ac);

if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)

purge_old_ps_buffers(tx->local);

/* sync with ieee80211_sta_ps_deliver_wakeup */

spin_lock(&sta->ps_lock);

/*

* STA woke up the meantime and all the frames on ps_tx_buf have

* been queued to pending queue. No reordering can happen, go

* ahead and Tx the packet.

*/

if (!test_sta_flag(sta, WLAN_STA_PS_STA) &&

!test_sta_flag(sta, WLAN_STA_PS_DRIVER) &&

!test_sta_flag(sta, WLAN_STA_PS_DELIVER)) {

spin_unlock(&sta->ps_lock);

return TX_CONTINUE;

}

if (skb_queue_len(&sta->ps_tx_buf[ac]) >= STA_MAX_TX_BUFFER) {

struct sk_buff *old = skb_dequeue(&sta->ps_tx_buf[ac]);

ps_dbg(tx->sdata,

"STA %pM TX buffer for AC %d full - dropping oldest frame\n",

sta->sta.addr, ac);

ieee80211_free_txskb(&local->hw, old);

} else

tx->local->total_ps_buffered++;

info->control.jiffies = jiffies;

info->control.vif = &tx->sdata->vif;

info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;

info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;

skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);

spin_unlock(&sta->ps_lock);

if (!timer_pending(&local->sta_cleanup))

mod_timer(&local->sta_cleanup,

round_jiffies(jiffies +

STA_INFO_CLEANUP_INTERVAL));

/*

* We queued up some frames, so the TIM bit might

* need to be set, recalculate it.

*/

sta_info_recalc_tim(sta);

return TX_QUEUED;

} else if (unlikely(test_sta_flag(sta, WLAN_STA_PS_STA))) {

ps_dbg(tx->sdata,

"STA %pM in PS mode, but polling/in SP -> send frame\n",

sta->sta.addr);

}

return TX_CONTINUE;

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)

{

if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))

return TX_CONTINUE;

if (tx->flags & IEEE80211_TX_UNICAST)

return ieee80211_tx_h_unicast_ps_buf(tx);

else

return ieee80211_tx_h_multicast_ps_buf(tx);

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)

{

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {

if (tx->sdata->control_port_no_encrypt)

info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;

info->control.flags |= IEEE80211_TX_CTRL_PORT_CTRL_PROTO;

info->flags |= IEEE80211_TX_CTL_USE_MINRATE;

}

return TX_CONTINUE;

}

static struct ieee80211_key *

ieee80211_select_link_key(struct ieee80211_tx_data *tx)

{

struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

struct ieee80211_link_data *link;

unsigned int link_id;

link_id = u32_get_bits(info->control.flags, IEEE80211_TX_CTRL_MLO_LINK);

if (link_id == IEEE80211_LINK_UNSPECIFIED) {

link = &tx->sdata->deflink;

} else {

link = rcu_dereference(tx->sdata->link[link_id]);

if (!link)

return NULL;

}

if (ieee80211_is_group_privacy_action(tx->skb))

return rcu_dereference(link->default_multicast_key);

else if (ieee80211_is_mgmt(hdr->frame_control) &&

is_multicast_ether_addr(hdr->addr1) &&

ieee80211_is_robust_mgmt_frame(tx->skb))

return rcu_dereference(link->default_mgmt_key);

else if (is_multicast_ether_addr(hdr->addr1))

return rcu_dereference(link->default_multicast_key);

return NULL;

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)

{

struct ieee80211_key *key;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;

if (unlikely(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT)) {

tx->key = NULL;

return TX_CONTINUE;

}

if (tx->sta &&

(key = rcu_dereference(tx->sta->ptk[tx->sta->ptk_idx])))

tx->key = key;

else if ((key = ieee80211_select_link_key(tx)))

tx->key = key;

else if (!is_multicast_ether_addr(hdr->addr1) &&

(key = rcu_dereference(tx->sdata->default_unicast_key)))

tx->key = key;

else

tx->key = NULL;

if (tx->key) {

bool skip_hw = false;

/* TODO: add threshold stuff again */

switch (tx->key->conf.cipher) {

case WLAN_CIPHER_SUITE_WEP40:

case WLAN_CIPHER_SUITE_WEP104:

case WLAN_CIPHER_SUITE_TKIP:

if (!ieee80211_is_data_present(hdr->frame_control))

tx->key = NULL;

break;

case WLAN_CIPHER_SUITE_CCMP:

case WLAN_CIPHER_SUITE_CCMP_256:

case WLAN_CIPHER_SUITE_GCMP:

case WLAN_CIPHER_SUITE_GCMP_256:

if (!ieee80211_is_data_present(hdr->frame_control) &&

!ieee80211_use_mfp(hdr->frame_control, tx->sta,

tx->skb) &&

!ieee80211_is_group_privacy_action(tx->skb))

tx->key = NULL;

else

skip_hw = (tx->key->conf.flags &

IEEE80211_KEY_FLAG_SW_MGMT_TX) &&

ieee80211_is_mgmt(hdr->frame_control);

break;

case WLAN_CIPHER_SUITE_AES_CMAC:

case WLAN_CIPHER_SUITE_BIP_CMAC_256:

case WLAN_CIPHER_SUITE_BIP_GMAC_128:

case WLAN_CIPHER_SUITE_BIP_GMAC_256:

if (!ieee80211_is_mgmt(hdr->frame_control))

tx->key = NULL;

break;

}

if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&

!ieee80211_is_deauth(hdr->frame_control)) &&

tx->skb->protocol != tx->sdata->control_port_protocol)

return TX_DROP;

if (!skip_hw && tx->key &&

tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)

info->control.hw_key = &tx->key->conf;

} else if (ieee80211_is_data_present(hdr->frame_control) && tx->sta &&

test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {

return TX_DROP;

}

return TX_CONTINUE;

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)

{

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

struct ieee80211_hdr *hdr = (void *)tx->skb->data;

struct ieee80211_supported_band *sband;

u32 len;

struct ieee80211_tx_rate_control txrc;

struct ieee80211_sta_rates *ratetbl = NULL;

bool encap = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;

bool assoc = false;

memset(&txrc, 0, sizeof(txrc));

sband = tx->local->hw.wiphy->bands[info->band];

len = min_t(u32, tx->skb->len + FCS_LEN,

tx->local->hw.wiphy->frag_threshold);

/* set up the tx rate control struct we give the RC algo */

txrc.hw = &tx->local->hw;

txrc.sband = sband;

txrc.bss_conf = &tx->sdata->vif.bss_conf;

txrc.skb = tx->skb;

txrc.reported_rate.idx = -1;

if (unlikely(info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK)) {

txrc.rate_idx_mask = ~0;

} else {

txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[info->band];

if (tx->sdata->rc_has_mcs_mask[info->band])

txrc.rate_idx_mcs_mask =

tx->sdata->rc_rateidx_mcs_mask[info->band];

}

txrc.bss = (tx->sdata->vif.type == NL80211_IFTYPE_AP ||

tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||

tx->sdata->vif.type == NL80211_IFTYPE_ADHOC ||

tx->sdata->vif.type == NL80211_IFTYPE_OCB);

/* set up RTS protection if desired */

if (len > tx->local->hw.wiphy->rts_threshold) {

txrc.rts = true;

}

info->control.use_rts = txrc.rts;

info->control.use_cts_prot = tx->sdata->vif.bss_conf.use_cts_prot;

/*

* Use short preamble if the BSS can handle it, but not for

* management frames unless we know the receiver can handle

* that -- the management frame might be to a station that

* just wants a probe response.

*/

if (tx->sdata->vif.bss_conf.use_short_preamble &&

(ieee80211_is_tx_data(tx->skb) ||

(tx->sta && test_sta_flag(tx->sta, WLAN_STA_SHORT_PREAMBLE))))

txrc.short_preamble = true;

info->control.short_preamble = txrc.short_preamble;

/* don't ask rate control when rate already injected via radiotap */

if (info->control.flags & IEEE80211_TX_CTRL_RATE_INJECT)

return TX_CONTINUE;

if (tx->sta)

assoc = test_sta_flag(tx->sta, WLAN_STA_ASSOC);

/*

* Lets not bother rate control if we're associated and cannot

* talk to the sta. This should not happen.

*/

if (WARN(test_bit(SCAN_SW_SCANNING, &tx->local->scanning) && assoc &&

!rate_usable_index_exists(sband, &tx->sta->sta),

"%s: Dropped data frame as no usable bitrate found while "

"scanning and associated. Target station: "

"%pM on %d GHz band\n",

tx->sdata->name,

encap ? ((struct ethhdr *)hdr)->h_dest : hdr->addr1,

info->band ? 5 : 2))

return TX_DROP;

/*

* If we're associated with the sta at this point we know we can at

* least send the frame at the lowest bit rate.

*/

rate_control_get_rate(tx->sdata, tx->sta, &txrc);

if (tx->sta && !info->control.skip_table)

ratetbl = rcu_dereference(tx->sta->sta.rates);

if (unlikely(info->control.rates[0].idx < 0)) {

if (ratetbl) {

struct ieee80211_tx_rate rate = {

.idx = ratetbl->rate[0].idx,

.flags = ratetbl->rate[0].flags,

.count = ratetbl->rate[0].count

};

if (ratetbl->rate[0].idx < 0)

return TX_DROP;

tx->rate = rate;

} else {

return TX_DROP;

}

} else {

tx->rate = info->control.rates[0];

}

if (txrc.reported_rate.idx < 0) {

txrc.reported_rate = tx->rate;

if (tx->sta && ieee80211_is_tx_data(tx->skb))

tx->sta->deflink.tx_stats.last_rate = txrc.reported_rate;

} else if (tx->sta)

tx->sta->deflink.tx_stats.last_rate = txrc.reported_rate;

if (ratetbl)

return TX_CONTINUE;

if (unlikely(!info->control.rates[0].count))

info->control.rates[0].count = 1;

if (WARN_ON_ONCE((info->control.rates[0].count > 1) &&

(info->flags & IEEE80211_TX_CTL_NO_ACK)))

info->control.rates[0].count = 1;

return TX_CONTINUE;

}

static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)

{

u16 *seq = &sta->tid_seq[tid];

__le16 ret = cpu_to_le16(*seq);

/* Increase the sequence number. */

*seq = (*seq + 0x10) & IEEE80211_SCTL_SEQ;

return ret;

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)

{

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);

struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;

int tid;

/*

* Packet injection may want to control the sequence

* number, if we have no matching interface then we

* neither assign one ourselves nor ask the driver to.

*/

if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))

return TX_CONTINUE;

if (unlikely(ieee80211_is_ctl(hdr->frame_control)))

return TX_CONTINUE;

if (ieee80211_hdrlen(hdr->frame_control) < 24)

return TX_CONTINUE;

if (ieee80211_is_qos_nullfunc(hdr->frame_control))

return TX_CONTINUE;

if (info->control.flags & IEEE80211_TX_CTRL_NO_SEQNO)

return TX_CONTINUE;

/* SNS11 from 802.11be 10.3.2.14 */

if (unlikely(is_multicast_ether_addr(hdr->addr1) &&

ieee80211_vif_is_mld(info->control.vif) &&

info->control.vif->type == NL80211_IFTYPE_AP)) {

if (info->control.flags & IEEE80211_TX_CTRL_MCAST_MLO_FIRST_TX)

tx->sdata->mld_mcast_seq += 0x10;

hdr->seq_ctrl = cpu_to_le16(tx->sdata->mld_mcast_seq);

return TX_CONTINUE;

}

/*

* Anything but QoS data that has a sequence number field

* (is long enough) gets a sequence number from the global

* counter. QoS data frames with a multicast destination

* also use the global counter (802.11-2012 9.3.2.10).

*/

if (!ieee80211_is_data_qos(hdr->frame_control) ||

is_multicast_ether_addr(hdr->addr1)) {

/* driver should assign sequence number */

info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;

/* for pure STA mode without beacons, we can do it */

hdr->seq_ctrl = cpu_to_le16(tx->sdata->sequence_number);

tx->sdata->sequence_number += 0x10;

if (tx->sta)

tx->sta->deflink.tx_stats.msdu[IEEE80211_NUM_TIDS]++;

return TX_CONTINUE;

}

/*

* This should be true for injected/management frames only, for

* management frames we have set the IEEE80211_TX_CTL_ASSIGN_SEQ

* above since they are not QoS-data frames.

*/

if (!tx->sta)

return TX_CONTINUE;

/* include per-STA, per-TID sequence counter */

tid = ieee80211_get_tid(hdr);

tx->sta->deflink.tx_stats.msdu[tid]++;

hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);

return TX_CONTINUE;

}

static int ieee80211_fragment(struct ieee80211_tx_data *tx,

struct sk_buff *skb, int hdrlen,

int frag_threshold)

{

struct ieee80211_local *local = tx->local;

struct ieee80211_tx_info *info;

struct sk_buff *tmp;

int per_fragm = frag_threshold - hdrlen - FCS_LEN;

int pos = hdrlen + per_fragm;

int rem = skb->len - hdrlen - per_fragm;

if (WARN_ON(rem < 0))

return -EINVAL;

/* first fragment was already added to queue by caller */

while (rem) {

int fraglen = per_fragm;

if (fraglen > rem)

fraglen = rem;

rem -= fraglen;

tmp = dev_alloc_skb(local->tx_headroom +

frag_threshold +

IEEE80211_ENCRYPT_HEADROOM +

IEEE80211_ENCRYPT_TAILROOM);

if (!tmp)

return -ENOMEM;

__skb_queue_tail(&tx->skbs, tmp);

skb_reserve(tmp,

local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);

/* copy control information */

memcpy(tmp->cb, skb->cb, sizeof(tmp->cb));

info = IEEE80211_SKB_CB(tmp);

info->flags &= ~(IEEE80211_TX_CTL_CLEAR_PS_FILT |

IEEE80211_TX_CTL_FIRST_FRAGMENT);

if (rem)

info->flags |= IEEE80211_TX_CTL_MORE_FRAMES;

skb_copy_queue_mapping(tmp, skb);

tmp->priority = skb->priority;

tmp->dev = skb->dev;

/* copy header and data */

skb_put_data(tmp, skb->data, hdrlen);

skb_put_data(tmp, skb->data + pos, fraglen);

pos += fraglen;

}

/* adjust first fragment's length */

skb_trim(skb, hdrlen + per_fragm);

return 0;

}

static ieee80211_tx_result debug_noinline

ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)

{

struct sk_buff *skb = tx->skb;

struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);

struct ieee80211_hdr *hdr = (void *)skb->data;

int frag_threshold = tx->local->hw.wiphy->frag_threshold;

int hdrlen;

int fragnum;

/* no matter what happens, tx->skb moves to tx->skbs */

__skb_queue_tail(&tx->skbs, skb);

tx->skb = NULL;

if (info->flags & IEEE80211_TX_CTL_DONTFRAG)

return TX_CONTINUE;

if (ieee80211_hw_check(&tx->local->hw, SUPPORTS_TX_FRAG))

return TX_CONTINUE;

/*

* Warn when submitting a fragmented A-MPDU frame and drop it.

* This scenario is handled in ieee80211_tx_prepare but extra

* caution taken here as fragmented ampdu may cause Tx stop.

*/

if (WARN_ON(info->flags & IEEE80211_TX_CTL_AMPDU))

return TX_DROP;

hdrlen = ieee80211_hdrlen(hdr->frame_control);

/* internal error, why isn't DONTFRAG set? */

if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))

return TX_DROP;

/*

* Now fragment the frame. This will allocate all the fragments and

* chain them (using skb as the first fragment) to skb->next.

* During transmission, we will remove the successfully transmitted

* fragments from this list. When the low-level driver rejects one

* of the fragments then we will simply pretend to accept the skb

* but store it away as pending.

*/

if (ieee80211_fragment(tx, skb, hdrlen, frag_threshold))

return TX_DROP;

/* update duration/seq/flags of fragments */

fragnum = 0;

skb_queue_walk(&tx->skbs, skb) {

const __le16 morefrags = cpu_to_le16(IEEE80211_FCTL_MOREFRAGS);