1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* Copyright 2002-2005, Instant802 Networks, Inc.
4	* Copyright 2005-2006, Devicescape Software, Inc.
5	* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
6	* Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
7	* Copyright 2013-2014 Intel Mobile Communications GmbH
8	* Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9	* Copyright (C) 2018-2024 Intel Corporation
10	*/
11
12	#include <linux/jiffies.h>
13	#include <linux/slab.h>
14	#include <linux/kernel.h>
15	#include <linux/skbuff.h>
16	#include <linux/netdevice.h>
17	#include <linux/etherdevice.h>
18	#include <linux/rcupdate.h>
19	#include <linux/export.h>
20	#include <linux/kcov.h>
21	#include <linux/bitops.h>
22	#include <kunit/visibility.h>
23	#include <net/mac80211.h>
24	#include <net/ieee80211_radiotap.h>
25	#include <asm/unaligned.h>
26
27	#include "ieee80211_i.h"
28	#include "driver-ops.h"
29	#include "led.h"
30	#include "mesh.h"
31	#include "wep.h"
32	#include "wpa.h"
33	#include "tkip.h"
34	#include "wme.h"
35	#include "rate.h"
36
37	/*
38	* monitor mode reception
39	*
40	* This function cleans up the SKB, i.e. it removes all the stuff
41	* only useful for monitoring.
42	*/
43	static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
44	unsigned int present_fcs_len,
45	unsigned int rtap_space)
46	{
47	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
48	struct ieee80211_hdr *hdr;
49	unsigned int hdrlen;
50	__le16 fc;
51
52	if (present_fcs_len)
53	__pskb_trim(skb, len: skb->len - present_fcs_len);
54	pskb_pull(skb, len: rtap_space);
55
56	/* After pulling radiotap header, clear all flags that indicate
57	* info in skb->data.
58	*/
59	status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |
60	RX_FLAG_RADIOTAP_LSIG |
61	RX_FLAG_RADIOTAP_HE_MU |
62	RX_FLAG_RADIOTAP_HE);
63
64	hdr = (void *)skb->data;
65	fc = hdr->frame_control;
66
67	/*
68	* Remove the HT-Control field (if present) on management
69	* frames after we've sent the frame to monitoring. We
70	* (currently) don't need it, and don't properly parse
71	* frames with it present, due to the assumption of a
72	* fixed management header length.
73	*/
74	if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
75	return skb;
76
77	hdrlen = ieee80211_hdrlen(fc);
78	hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
79
80	if (!pskb_may_pull(skb, len: hdrlen)) {
81	dev_kfree_skb(skb);
82	return NULL;
83	}
84
85	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
86	hdrlen - IEEE80211_HT_CTL_LEN);
87	pskb_pull(skb, IEEE80211_HT_CTL_LEN);
88
89	return skb;
90	}
91
92	static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
93	unsigned int rtap_space)
94	{
95	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
96	struct ieee80211_hdr *hdr;
97
98	hdr = (void *)(skb->data + rtap_space);
99
100	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
101	RX_FLAG_FAILED_PLCP_CRC |
102	RX_FLAG_ONLY_MONITOR |
103	RX_FLAG_NO_PSDU))
104	return true;
105
106	if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
107	return true;
108
109	if (ieee80211_is_ctl(fc: hdr->frame_control) &&
110	!ieee80211_is_pspoll(fc: hdr->frame_control) &&
111	!ieee80211_is_back_req(fc: hdr->frame_control))
112	return true;
113
114	return false;
115	}
116
117	static int
118	ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
119	struct ieee80211_rx_status *status,
120	struct sk_buff *skb)
121	{
122	int len;
123
124	/* always present fields */
125	len = sizeof(struct ieee80211_radiotap_header) + 8;
126
127	/* allocate extra bitmaps */
128	if (status->chains)
129	len += 4 * hweight8(status->chains);
130
131	if (ieee80211_have_rx_timestamp(status)) {
132	len = ALIGN(len, 8);
133	len += 8;
134	}
135	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
136	len += 1;
137
138	/* antenna field, if we don't have per-chain info */
139	if (!status->chains)
140	len += 1;
141
142	/* padding for RX_FLAGS if necessary */
143	len = ALIGN(len, 2);
144
145	if (status->encoding == RX_ENC_HT) /* HT info */
146	len += 3;
147
148	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
149	len = ALIGN(len, 4);
150	len += 8;
151	}
152
153	if (status->encoding == RX_ENC_VHT) {
154	len = ALIGN(len, 2);
155	len += 12;
156	}
157
158	if (local->hw.radiotap_timestamp.units_pos >= 0) {
159	len = ALIGN(len, 8);
160	len += 12;
161	}
162
163	if (status->encoding == RX_ENC_HE &&
164	status->flag & RX_FLAG_RADIOTAP_HE) {
165	len = ALIGN(len, 2);
166	len += 12;
167	BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
168	}
169
170	if (status->encoding == RX_ENC_HE &&
171	status->flag & RX_FLAG_RADIOTAP_HE_MU) {
172	len = ALIGN(len, 2);
173	len += 12;
174	BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
175	}
176
177	if (status->flag & RX_FLAG_NO_PSDU)
178	len += 1;
179
180	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
181	len = ALIGN(len, 2);
182	len += 4;
183	BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
184	}
185
186	if (status->chains) {
187	/* antenna and antenna signal fields */
188	len += 2 * hweight8(status->chains);
189	}
190
191	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
192	int tlv_offset = 0;
193
194	/*
195	* The position to look at depends on the existence (or non-
196	* existence) of other elements, so take that into account...
197	*/
198	if (status->flag & RX_FLAG_RADIOTAP_HE)
199	tlv_offset +=
200	sizeof(struct ieee80211_radiotap_he);
201	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
202	tlv_offset +=
203	sizeof(struct ieee80211_radiotap_he_mu);
204	if (status->flag & RX_FLAG_RADIOTAP_LSIG)
205	tlv_offset +=
206	sizeof(struct ieee80211_radiotap_lsig);
207
208	/* ensure 4 byte alignment for TLV */
209	len = ALIGN(len, 4);
210
211	/* TLVs until the mac header */
212	len += skb_mac_header(skb) - &skb->data[tlv_offset];
213	}
214
215	return len;
216	}
217
218	static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
219	int link_id,
220	struct sta_info *sta,
221	struct sk_buff *skb)
222	{
223	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
224
225	if (link_id >= 0) {
226	status->link_valid = 1;
227	status->link_id = link_id;
228	} else {
229	status->link_valid = 0;
230	}
231
232	skb_queue_tail(list: &sdata->skb_queue, newsk: skb);
233	wiphy_work_queue(wiphy: sdata->local->hw.wiphy, work: &sdata->work);
234	if (sta)
235	sta->deflink.rx_stats.packets++;
236	}
237
238	static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
239	int link_id,
240	struct sta_info *sta,
241	struct sk_buff *skb)
242	{
243	skb->protocol = 0;
244	__ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
245	}
246
247	static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
248	struct sk_buff *skb,
249	int rtap_space)
250	{
251	struct {
252	struct ieee80211_hdr_3addr hdr;
253	u8 category;
254	u8 action_code;
255	} __packed __aligned(2) action;
256
257	if (!sdata)
258	return;
259
260	BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
261
262	if (skb->len < rtap_space + sizeof(action) +
263	VHT_MUMIMO_GROUPS_DATA_LEN)
264	return;
265
266	if (!is_valid_ether_addr(addr: sdata->u.mntr.mu_follow_addr))
267	return;
268
269	skb_copy_bits(skb, offset: rtap_space, to: &action, len: sizeof(action));
270
271	if (!ieee80211_is_action(fc: action.hdr.frame_control))
272	return;
273
274	if (action.category != WLAN_CATEGORY_VHT)
275	return;
276
277	if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
278	return;
279
280	if (!ether_addr_equal(addr1: action.hdr.addr1, addr2: sdata->u.mntr.mu_follow_addr))
281	return;
282
283	skb = skb_copy(skb, GFP_ATOMIC);
284	if (!skb)
285	return;
286
287	ieee80211_queue_skb_to_iface(sdata, link_id: -1, NULL, skb);
288	}
289
290	/*
291	* ieee80211_add_rx_radiotap_header - add radiotap header
292	*
293	* add a radiotap header containing all the fields which the hardware provided.
294	*/
295	static void
296	ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
297	struct sk_buff *skb,
298	struct ieee80211_rate *rate,
299	int rtap_len, bool has_fcs)
300	{
301	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
302	struct ieee80211_radiotap_header *rthdr;
303	unsigned char *pos;
304	__le32 *it_present;
305	u32 it_present_val;
306	u16 rx_flags = 0;
307	u16 channel_flags = 0;
308	u32 tlvs_len = 0;
309	int mpdulen, chain;
310	unsigned long chains = status->chains;
311	struct ieee80211_radiotap_he he = {};
312	struct ieee80211_radiotap_he_mu he_mu = {};
313	struct ieee80211_radiotap_lsig lsig = {};
314
315	if (status->flag & RX_FLAG_RADIOTAP_HE) {
316	he = *(struct ieee80211_radiotap_he *)skb->data;
317	skb_pull(skb, len: sizeof(he));
318	WARN_ON_ONCE(status->encoding != RX_ENC_HE);
319	}
320
321	if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
322	he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
323	skb_pull(skb, len: sizeof(he_mu));
324	}
325
326	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
327	lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
328	skb_pull(skb, len: sizeof(lsig));
329	}
330
331	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
332	/* data is pointer at tlv all other info was pulled off */
333	tlvs_len = skb_mac_header(skb) - skb->data;
334	}
335
336	mpdulen = skb->len;
337	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
338	mpdulen += FCS_LEN;
339
340	rthdr = skb_push(skb, len: rtap_len - tlvs_len);
341	memset(rthdr, 0, rtap_len - tlvs_len);
342	it_present = &rthdr->it_present;
343
344	/* radiotap header, set always present flags */
345	rthdr->it_len = cpu_to_le16(rtap_len);
346	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
347	BIT(IEEE80211_RADIOTAP_CHANNEL) |
348	BIT(IEEE80211_RADIOTAP_RX_FLAGS);
349
350	if (!status->chains)
351	it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
352
353	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
354	it_present_val |=
355	BIT(IEEE80211_RADIOTAP_EXT) |
356	BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
357	put_unaligned_le32(val: it_present_val, p: it_present);
358	it_present++;
359	it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
360	BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
361	}
362
363	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
364	it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
365
366	put_unaligned_le32(val: it_present_val, p: it_present);
367
368	/* This references through an offset into it_optional[] rather
369	* than via it_present otherwise later uses of pos will cause
370	* the compiler to think we have walked past the end of the
371	* struct member.
372	*/
373	pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
374
375	/* the order of the following fields is important */
376
377	/* IEEE80211_RADIOTAP_TSFT */
378	if (ieee80211_have_rx_timestamp(status)) {
379	/* padding */
380	while ((pos - (u8 *)rthdr) & 7)
381	*pos++ = 0;
382	put_unaligned_le64(
383	val: ieee80211_calculate_rx_timestamp(local, status,
384	mpdu_len: mpdulen, mpdu_offset: 0),
385	p: pos);
386	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
387	pos += 8;
388	}
389
390	/* IEEE80211_RADIOTAP_FLAGS */
391	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
392	*pos |= IEEE80211_RADIOTAP_F_FCS;
393	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
394	*pos |= IEEE80211_RADIOTAP_F_BADFCS;
395	if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
396	*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
397	pos++;
398
399	/* IEEE80211_RADIOTAP_RATE */
400	if (!rate || status->encoding != RX_ENC_LEGACY) {
401	/*
402	* Without rate information don't add it. If we have,
403	* MCS information is a separate field in radiotap,
404	* added below. The byte here is needed as padding
405	* for the channel though, so initialise it to 0.
406	*/
407	*pos = 0;
408	} else {
409	int shift = 0;
410	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
411	if (status->bw == RATE_INFO_BW_10)
412	shift = 1;
413	else if (status->bw == RATE_INFO_BW_5)
414	shift = 2;
415	*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
416	}
417	pos++;
418
419	/* IEEE80211_RADIOTAP_CHANNEL */
420	/* TODO: frequency offset in KHz */
421	put_unaligned_le16(val: status->freq, p: pos);
422	pos += 2;
423	if (status->bw == RATE_INFO_BW_10)
424	channel_flags |= IEEE80211_CHAN_HALF;
425	else if (status->bw == RATE_INFO_BW_5)
426	channel_flags |= IEEE80211_CHAN_QUARTER;
427
428	if (status->band == NL80211_BAND_5GHZ ||
429	status->band == NL80211_BAND_6GHZ)
430	channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
431	else if (status->encoding != RX_ENC_LEGACY)
432	channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
433	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
434	channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
435	else if (rate)
436	channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
437	else
438	channel_flags |= IEEE80211_CHAN_2GHZ;
439	put_unaligned_le16(val: channel_flags, p: pos);
440	pos += 2;
441
442	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
443	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
444	!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
445	*pos = status->signal;
446	rthdr->it_present |=
447	cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
448	pos++;
449	}
450
451	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
452
453	if (!status->chains) {
454	/* IEEE80211_RADIOTAP_ANTENNA */
455	*pos = status->antenna;
456	pos++;
457	}
458
459	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
460
461	/* IEEE80211_RADIOTAP_RX_FLAGS */
462	/* ensure 2 byte alignment for the 2 byte field as required */
463	if ((pos - (u8 *)rthdr) & 1)
464	*pos++ = 0;
465	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
466	rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
467	put_unaligned_le16(val: rx_flags, p: pos);
468	pos += 2;
469
470	if (status->encoding == RX_ENC_HT) {
471	unsigned int stbc;
472
473	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
474	*pos = local->hw.radiotap_mcs_details;
475	if (status->enc_flags & RX_ENC_FLAG_HT_GF)
476	*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
477	if (status->enc_flags & RX_ENC_FLAG_LDPC)
478	*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
479	pos++;
480	*pos = 0;
481	if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
482	*pos |= IEEE80211_RADIOTAP_MCS_SGI;
483	if (status->bw == RATE_INFO_BW_40)
484	*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
485	if (status->enc_flags & RX_ENC_FLAG_HT_GF)
486	*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
487	if (status->enc_flags & RX_ENC_FLAG_LDPC)
488	*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
489	stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
490	*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
491	pos++;
492	*pos++ = status->rate_idx;
493	}
494
495	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
496	u16 flags = 0;
497
498	/* ensure 4 byte alignment */
499	while ((pos - (u8 *)rthdr) & 3)
500	pos++;
501	rthdr->it_present |=
502	cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
503	put_unaligned_le32(val: status->ampdu_reference, p: pos);
504	pos += 4;
505	if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
506	flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
507	if (status->flag & RX_FLAG_AMPDU_IS_LAST)
508	flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
509	if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
510	flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
511	if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
512	flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
513	if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
514	flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
515	if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
516	flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
517	put_unaligned_le16(val: flags, p: pos);
518	pos += 2;
519	if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
520	*pos++ = status->ampdu_delimiter_crc;
521	else
522	*pos++ = 0;
523	*pos++ = 0;
524	}
525
526	if (status->encoding == RX_ENC_VHT) {
527	u16 known = local->hw.radiotap_vht_details;
528
529	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
530	put_unaligned_le16(val: known, p: pos);
531	pos += 2;
532	/* flags */
533	if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
534	*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
535	/* in VHT, STBC is binary */
536	if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
537	*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
538	if (status->enc_flags & RX_ENC_FLAG_BF)
539	*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
540	pos++;
541	/* bandwidth */
542	switch (status->bw) {
543	case RATE_INFO_BW_80:
544	*pos++ = 4;
545	break;
546	case RATE_INFO_BW_160:
547	*pos++ = 11;
548	break;
549	case RATE_INFO_BW_40:
550	*pos++ = 1;
551	break;
552	default:
553	*pos++ = 0;
554	}
555	/* MCS/NSS */
556	*pos = (status->rate_idx << 4) | status->nss;
557	pos += 4;
558	/* coding field */
559	if (status->enc_flags & RX_ENC_FLAG_LDPC)
560	*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
561	pos++;
562	/* group ID */
563	pos++;
564	/* partial_aid */
565	pos += 2;
566	}
567
568	if (local->hw.radiotap_timestamp.units_pos >= 0) {
569	u16 accuracy = 0;
570	u8 flags;
571	u64 ts;
572
573	rthdr->it_present |=
574	cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
575
576	/* ensure 8 byte alignment */
577	while ((pos - (u8 *)rthdr) & 7)
578	pos++;
579
580	if (status->flag & RX_FLAG_MACTIME_IS_RTAP_TS64) {
581	flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT;
582	ts = status->mactime;
583	} else {
584	flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
585	ts = status->device_timestamp;
586	}
587
588	put_unaligned_le64(val: ts, p: pos);
589	pos += sizeof(u64);
590
591	if (local->hw.radiotap_timestamp.accuracy >= 0) {
592	accuracy = local->hw.radiotap_timestamp.accuracy;
593	flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
594	}
595	put_unaligned_le16(val: accuracy, p: pos);
596	pos += sizeof(u16);
597
598	*pos++ = local->hw.radiotap_timestamp.units_pos;
599	*pos++ = flags;
600	}
601
602	if (status->encoding == RX_ENC_HE &&
603	status->flag & RX_FLAG_RADIOTAP_HE) {
604	#define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
605
606	if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
607	he.data6 |= HE_PREP(DATA6_NSTS,
608	FIELD_GET(RX_ENC_FLAG_STBC_MASK,
609	status->enc_flags));
610	he.data3 |= HE_PREP(DATA3_STBC, 1);
611	} else {
612	he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
613	}
614
615	#define CHECK_GI(s) \
616	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
617	(int)NL80211_RATE_INFO_HE_GI_##s)
618
619	CHECK_GI(0_8);
620	CHECK_GI(1_6);
621	CHECK_GI(3_2);
622
623	he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
624	he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
625	he.data3 |= HE_PREP(DATA3_CODING,
626	!!(status->enc_flags & RX_ENC_FLAG_LDPC));
627
628	he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
629
630	switch (status->bw) {
631	case RATE_INFO_BW_20:
632	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
633	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
634	break;
635	case RATE_INFO_BW_40:
636	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
637	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
638	break;
639	case RATE_INFO_BW_80:
640	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
641	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
642	break;
643	case RATE_INFO_BW_160:
644	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
645	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
646	break;
647	case RATE_INFO_BW_HE_RU:
648	#define CHECK_RU_ALLOC(s) \
649	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
650	NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
651
652	CHECK_RU_ALLOC(26);
653	CHECK_RU_ALLOC(52);
654	CHECK_RU_ALLOC(106);
655	CHECK_RU_ALLOC(242);
656	CHECK_RU_ALLOC(484);
657	CHECK_RU_ALLOC(996);
658	CHECK_RU_ALLOC(2x996);
659
660	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
661	status->he_ru + 4);
662	break;
663	default:
664	WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
665	}
666
667	/* ensure 2 byte alignment */
668	while ((pos - (u8 *)rthdr) & 1)
669	pos++;
670	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
671	memcpy(pos, &he, sizeof(he));
672	pos += sizeof(he);
673	}
674
675	if (status->encoding == RX_ENC_HE &&
676	status->flag & RX_FLAG_RADIOTAP_HE_MU) {
677	/* ensure 2 byte alignment */
678	while ((pos - (u8 *)rthdr) & 1)
679	pos++;
680	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
681	memcpy(pos, &he_mu, sizeof(he_mu));
682	pos += sizeof(he_mu);
683	}
684
685	if (status->flag & RX_FLAG_NO_PSDU) {
686	rthdr->it_present |=
687	cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
688	*pos++ = status->zero_length_psdu_type;
689	}
690
691	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
692	/* ensure 2 byte alignment */
693	while ((pos - (u8 *)rthdr) & 1)
694	pos++;
695	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
696	memcpy(pos, &lsig, sizeof(lsig));
697	pos += sizeof(lsig);
698	}
699
700	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
701	*pos++ = status->chain_signal[chain];
702	*pos++ = chain;
703	}
704	}
705
706	static struct sk_buff *
707	ieee80211_make_monitor_skb(struct ieee80211_local *local,
708	struct sk_buff **origskb,
709	struct ieee80211_rate *rate,
710	int rtap_space, bool use_origskb)
711	{
712	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: *origskb);
713	int rt_hdrlen, needed_headroom;
714	struct sk_buff *skb;
715
716	/* room for the radiotap header based on driver features */
717	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, skb: *origskb);
718	needed_headroom = rt_hdrlen - rtap_space;
719
720	if (use_origskb) {
721	/* only need to expand headroom if necessary */
722	skb = *origskb;
723	*origskb = NULL;
724
725	/*
726	* This shouldn't trigger often because most devices have an
727	* RX header they pull before we get here, and that should
728	* be big enough for our radiotap information. We should
729	* probably export the length to drivers so that we can have
730	* them allocate enough headroom to start with.
731	*/
732	if (skb_headroom(skb) < needed_headroom &&
733	pskb_expand_head(skb, nhead: needed_headroom, ntail: 0, GFP_ATOMIC)) {
734	dev_kfree_skb(skb);
735	return NULL;
736	}
737	} else {
738	/*
739	* Need to make a copy and possibly remove radiotap header
740	* and FCS from the original.
741	*/
742	skb = skb_copy_expand(skb: *origskb, newheadroom: needed_headroom + NET_SKB_PAD,
743	newtailroom: 0, GFP_ATOMIC);
744
745	if (!skb)
746	return NULL;
747	}
748
749	/* prepend radiotap information */
750	ieee80211_add_rx_radiotap_header(local, skb, rate, rtap_len: rt_hdrlen, has_fcs: true);
751
752	skb_reset_mac_header(skb);
753	skb->ip_summed = CHECKSUM_UNNECESSARY;
754	skb->pkt_type = PACKET_OTHERHOST;
755	skb->protocol = htons(ETH_P_802_2);
756
757	return skb;
758	}
759
760	/*
761	* This function copies a received frame to all monitor interfaces and
762	* returns a cleaned-up SKB that no longer includes the FCS nor the
763	* radiotap header the driver might have added.
764	*/
765	static struct sk_buff *
766	ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
767	struct ieee80211_rate *rate)
768	{
769	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: origskb);
770	struct ieee80211_sub_if_data *sdata;
771	struct sk_buff *monskb = NULL;
772	int present_fcs_len = 0;
773	unsigned int rtap_space = 0;
774	struct ieee80211_sub_if_data *monitor_sdata =
775	rcu_dereference(local->monitor_sdata);
776	bool only_monitor = false;
777	unsigned int min_head_len;
778
779	if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&
780	!skb_mac_header_was_set(origskb))) {
781	/* with this skb no way to know where frame payload starts */
782	dev_kfree_skb(origskb);
783	return NULL;
784	}
785
786	if (status->flag & RX_FLAG_RADIOTAP_HE)
787	rtap_space += sizeof(struct ieee80211_radiotap_he);
788
789	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
790	rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
791
792	if (status->flag & RX_FLAG_RADIOTAP_LSIG)
793	rtap_space += sizeof(struct ieee80211_radiotap_lsig);
794
795	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
796	rtap_space += skb_mac_header(skb: origskb) - &origskb->data[rtap_space];
797
798	min_head_len = rtap_space;
799
800	/*
801	* First, we may need to make a copy of the skb because
802	* (1) we need to modify it for radiotap (if not present), and
803	* (2) the other RX handlers will modify the skb we got.
804	*
805	* We don't need to, of course, if we aren't going to return
806	* the SKB because it has a bad FCS/PLCP checksum.
807	*/
808
809	if (!(status->flag & RX_FLAG_NO_PSDU)) {
810	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
811	if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
812	/* driver bug */
813	WARN_ON(1);
814	dev_kfree_skb(origskb);
815	return NULL;
816	}
817	present_fcs_len = FCS_LEN;
818	}
819
820	/* also consider the hdr->frame_control */
821	min_head_len += 2;
822	}
823
824	/* ensure that the expected data elements are in skb head */
825	if (!pskb_may_pull(skb: origskb, len: min_head_len)) {
826	dev_kfree_skb(origskb);
827	return NULL;
828	}
829
830	only_monitor = should_drop_frame(skb: origskb, present_fcs_len, rtap_space);
831
832	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
833	if (only_monitor) {
834	dev_kfree_skb(origskb);
835	return NULL;
836	}
837
838	return ieee80211_clean_skb(skb: origskb, present_fcs_len,
839	rtap_space);
840	}
841
842	ieee80211_handle_mu_mimo_mon(sdata: monitor_sdata, skb: origskb, rtap_space);
843
844	list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
845	bool last_monitor = list_is_last(list: &sdata->u.mntr.list,
846	head: &local->mon_list);
847
848	if (!monskb)
849	monskb = ieee80211_make_monitor_skb(local, origskb: &origskb,
850	rate, rtap_space,
851	use_origskb: only_monitor &&
852	last_monitor);
853
854	if (monskb) {
855	struct sk_buff *skb;
856
857	if (last_monitor) {
858	skb = monskb;
859	monskb = NULL;
860	} else {
861	skb = skb_clone(skb: monskb, GFP_ATOMIC);
862	}
863
864	if (skb) {
865	skb->dev = sdata->dev;
866	dev_sw_netstats_rx_add(dev: skb->dev, len: skb->len);
867	netif_receive_skb(skb);
868	}
869	}
870
871	if (last_monitor)
872	break;
873	}
874
875	/* this happens if last_monitor was erroneously false */
876	dev_kfree_skb(monskb);
877
878	/* ditto */
879	if (!origskb)
880	return NULL;
881
882	return ieee80211_clean_skb(skb: origskb, present_fcs_len, rtap_space);
883	}
884
885	static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
886	{
887	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
888	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
889	int tid, seqno_idx, security_idx;
890
891	/* does the frame have a qos control field? */
892	if (ieee80211_is_data_qos(fc: hdr->frame_control)) {
893	u8 *qc = ieee80211_get_qos_ctl(hdr);
894	/* frame has qos control */
895	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
896	if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
897	status->rx_flags |= IEEE80211_RX_AMSDU;
898
899	seqno_idx = tid;
900	security_idx = tid;
901	} else {
902	/*
903	* IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
904	*
905	* Sequence numbers for management frames, QoS data
906	* frames with a broadcast/multicast address in the
907	* Address 1 field, and all non-QoS data frames sent
908	* by QoS STAs are assigned using an additional single
909	* modulo-4096 counter, [...]
910	*
911	* We also use that counter for non-QoS STAs.
912	*/
913	seqno_idx = IEEE80211_NUM_TIDS;
914	security_idx = 0;
915	if (ieee80211_is_mgmt(fc: hdr->frame_control))
916	security_idx = IEEE80211_NUM_TIDS;
917	tid = 0;
918	}
919
920	rx->seqno_idx = seqno_idx;
921	rx->security_idx = security_idx;
922	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
923	* For now, set skb->priority to 0 for other cases. */
924	rx->skb->priority = (tid > 7) ? 0 : tid;
925	}
926
927	/**
928	* DOC: Packet alignment
929	*
930	* Drivers always need to pass packets that are aligned to two-byte boundaries
931	* to the stack.
932	*
933	* Additionally, they should, if possible, align the payload data in a way that
934	* guarantees that the contained IP header is aligned to a four-byte
935	* boundary. In the case of regular frames, this simply means aligning the
936	* payload to a four-byte boundary (because either the IP header is directly
937	* contained, or IV/RFC1042 headers that have a length divisible by four are
938	* in front of it). If the payload data is not properly aligned and the
939	* architecture doesn't support efficient unaligned operations, mac80211
940	* will align the data.
941	*
942	* With A-MSDU frames, however, the payload data address must yield two modulo
943	* four because there are 14-byte 802.3 headers within the A-MSDU frames that
944	* push the IP header further back to a multiple of four again. Thankfully, the
945	* specs were sane enough this time around to require padding each A-MSDU
946	* subframe to a length that is a multiple of four.
947	*
948	* Padding like Atheros hardware adds which is between the 802.11 header and
949	* the payload is not supported; the driver is required to move the 802.11
950	* header to be directly in front of the payload in that case.
951	*/
952	static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
953	{
954	#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
955	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
956	#endif
957	}
958
959
960	/* rx handlers */
961
962	static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
963	{
964	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
965
966	if (is_multicast_ether_addr(addr: hdr->addr1))
967	return 0;
968
969	return ieee80211_is_robust_mgmt_frame(skb);
970	}
971
972
973	static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
974	{
975	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
976
977	if (!is_multicast_ether_addr(addr: hdr->addr1))
978	return 0;
979
980	return ieee80211_is_robust_mgmt_frame(skb);
981	}
982
983
984	/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
985	static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
986	{
987	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
988	struct ieee80211_mmie *mmie;
989	struct ieee80211_mmie_16 *mmie16;
990
991	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(addr: hdr->da))
992	return -1;
993
994	if (!ieee80211_is_robust_mgmt_frame(skb) &&
995	!ieee80211_is_beacon(fc: hdr->frame_control))
996	return -1; /* not a robust management frame */
997
998	mmie = (struct ieee80211_mmie *)
999	(skb->data + skb->len - sizeof(*mmie));
1000	if (mmie->element_id == WLAN_EID_MMIE &&
1001	mmie->length == sizeof(*mmie) - 2)
1002	return le16_to_cpu(mmie->key_id);
1003
1004	mmie16 = (struct ieee80211_mmie_16 *)
1005	(skb->data + skb->len - sizeof(*mmie16));
1006	if (skb->len >= 24 + sizeof(*mmie16) &&
1007	mmie16->element_id == WLAN_EID_MMIE &&
1008	mmie16->length == sizeof(*mmie16) - 2)
1009	return le16_to_cpu(mmie16->key_id);
1010
1011	return -1;
1012	}
1013
1014	static int ieee80211_get_keyid(struct sk_buff *skb)
1015	{
1016	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1017	__le16 fc = hdr->frame_control;
1018	int hdrlen = ieee80211_hdrlen(fc);
1019	u8 keyid;
1020
1021	/* WEP, TKIP, CCMP and GCMP */
1022	if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
1023	return -EINVAL;
1024
1025	skb_copy_bits(skb, offset: hdrlen + 3, to: &keyid, len: 1);
1026
1027	keyid >>= 6;
1028
1029	return keyid;
1030	}
1031
1032	static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1033	{
1034	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1035	char *dev_addr = rx->sdata->vif.addr;
1036
1037	if (ieee80211_is_data(fc: hdr->frame_control)) {
1038	if (is_multicast_ether_addr(addr: hdr->addr1)) {
1039	if (ieee80211_has_tods(fc: hdr->frame_control) ||
1040	!ieee80211_has_fromds(fc: hdr->frame_control))
1041	return RX_DROP_MONITOR;
1042	if (ether_addr_equal(addr1: hdr->addr3, addr2: dev_addr))
1043	return RX_DROP_MONITOR;
1044	} else {
1045	if (!ieee80211_has_a4(fc: hdr->frame_control))
1046	return RX_DROP_MONITOR;
1047	if (ether_addr_equal(addr1: hdr->addr4, addr2: dev_addr))
1048	return RX_DROP_MONITOR;
1049	}
1050	}
1051
1052	/* If there is not an established peer link and this is not a peer link
1053	* establisment frame, beacon or probe, drop the frame.
1054	*/
1055
1056	if (!rx->sta || sta_plink_state(sta: rx->sta) != NL80211_PLINK_ESTAB) {
1057	struct ieee80211_mgmt *mgmt;
1058
1059	if (!ieee80211_is_mgmt(fc: hdr->frame_control))
1060	return RX_DROP_MONITOR;
1061
1062	if (ieee80211_is_action(fc: hdr->frame_control)) {
1063	u8 category;
1064
1065	/* make sure category field is present */
1066	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
1067	return RX_DROP_MONITOR;
1068
1069	mgmt = (struct ieee80211_mgmt *)hdr;
1070	category = mgmt->u.action.category;
1071	if (category != WLAN_CATEGORY_MESH_ACTION &&
1072	category != WLAN_CATEGORY_SELF_PROTECTED)
1073	return RX_DROP_MONITOR;
1074	return RX_CONTINUE;
1075	}
1076
1077	if (ieee80211_is_probe_req(fc: hdr->frame_control) ||
1078	ieee80211_is_probe_resp(fc: hdr->frame_control) ||
1079	ieee80211_is_beacon(fc: hdr->frame_control) ||
1080	ieee80211_is_auth(fc: hdr->frame_control))
1081	return RX_CONTINUE;
1082
1083	return RX_DROP_MONITOR;
1084	}
1085
1086	return RX_CONTINUE;
1087	}
1088
1089	static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1090	int index)
1091	{
1092	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1093	struct sk_buff *tail = skb_peek_tail(list_: frames);
1094	struct ieee80211_rx_status *status;
1095
1096	if (tid_agg_rx->reorder_buf_filtered &&
1097	tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1098	return true;
1099
1100	if (!tail)
1101	return false;
1102
1103	status = IEEE80211_SKB_RXCB(skb: tail);
1104	if (status->flag & RX_FLAG_AMSDU_MORE)
1105	return false;
1106
1107	return true;
1108	}
1109
1110	static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1111	struct tid_ampdu_rx *tid_agg_rx,
1112	int index,
1113	struct sk_buff_head *frames)
1114	{
1115	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1116	struct sk_buff *skb;
1117	struct ieee80211_rx_status *status;
1118
1119	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1120
1121	if (skb_queue_empty(list: skb_list))
1122	goto no_frame;
1123
1124	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1125	__skb_queue_purge(list: skb_list);
1126	goto no_frame;
1127	}
1128
1129	/* release frames from the reorder ring buffer */
1130	tid_agg_rx->stored_mpdu_num--;
1131	while ((skb = __skb_dequeue(list: skb_list))) {
1132	status = IEEE80211_SKB_RXCB(skb);
1133	status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1134	__skb_queue_tail(list: frames, newsk: skb);
1135	}
1136
1137	no_frame:
1138	if (tid_agg_rx->reorder_buf_filtered)
1139	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1140	tid_agg_rx->head_seq_num = ieee80211_sn_inc(sn: tid_agg_rx->head_seq_num);
1141	}
1142
1143	static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1144	struct tid_ampdu_rx *tid_agg_rx,
1145	u16 head_seq_num,
1146	struct sk_buff_head *frames)
1147	{
1148	int index;
1149
1150	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1151
1152	while (ieee80211_sn_less(sn1: tid_agg_rx->head_seq_num, sn2: head_seq_num)) {
1153	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1154	ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1155	frames);
1156	}
1157	}
1158
1159	/*
1160	* Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1161	* the skb was added to the buffer longer than this time ago, the earlier
1162	* frames that have not yet been received are assumed to be lost and the skb
1163	* can be released for processing. This may also release other skb's from the
1164	* reorder buffer if there are no additional gaps between the frames.
1165	*
1166	* Callers must hold tid_agg_rx->reorder_lock.
1167	*/
1168	#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1169
1170	static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1171	struct tid_ampdu_rx *tid_agg_rx,
1172	struct sk_buff_head *frames)
1173	{
1174	int index, i, j;
1175
1176	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1177
1178	/* release the buffer until next missing frame */
1179	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1180	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1181	tid_agg_rx->stored_mpdu_num) {
1182	/*
1183	* No buffers ready to be released, but check whether any
1184	* frames in the reorder buffer have timed out.
1185	*/
1186	int skipped = 1;
1187	for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1188	j = (j + 1) % tid_agg_rx->buf_size) {
1189	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index: j)) {
1190	skipped++;
1191	continue;
1192	}
1193	if (skipped &&
1194	!time_after(jiffies, tid_agg_rx->reorder_time[j] +
1195	HT_RX_REORDER_BUF_TIMEOUT))
1196	goto set_release_timer;
1197
1198	/* don't leave incomplete A-MSDUs around */
1199	for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1200	i = (i + 1) % tid_agg_rx->buf_size)
1201	__skb_queue_purge(list: &tid_agg_rx->reorder_buf[i]);
1202
1203	ht_dbg_ratelimited(sdata,
1204	"release an RX reorder frame due to timeout on earlier frames\n");
1205	ieee80211_release_reorder_frame(sdata, tid_agg_rx, index: j,
1206	frames);
1207
1208	/*
1209	* Increment the head seq# also for the skipped slots.
1210	*/
1211	tid_agg_rx->head_seq_num =
1212	(tid_agg_rx->head_seq_num +
1213	skipped) & IEEE80211_SN_MASK;
1214	skipped = 0;
1215	}
1216	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1217	ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1218	frames);
1219	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1220	}
1221
1222	if (tid_agg_rx->stored_mpdu_num) {
1223	j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1224
1225	for (; j != (index - 1) % tid_agg_rx->buf_size;
1226	j = (j + 1) % tid_agg_rx->buf_size) {
1227	if (ieee80211_rx_reorder_ready(tid_agg_rx, index: j))
1228	break;
1229	}
1230
1231	set_release_timer:
1232
1233	if (!tid_agg_rx->removed)
1234	mod_timer(timer: &tid_agg_rx->reorder_timer,
1235	expires: tid_agg_rx->reorder_time[j] + 1 +
1236	HT_RX_REORDER_BUF_TIMEOUT);
1237	} else {
1238	del_timer(timer: &tid_agg_rx->reorder_timer);
1239	}
1240	}
1241
1242	/*
1243	* As this function belongs to the RX path it must be under
1244	* rcu_read_lock protection. It returns false if the frame
1245	* can be processed immediately, true if it was consumed.
1246	*/
1247	static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1248	struct tid_ampdu_rx *tid_agg_rx,
1249	struct sk_buff *skb,
1250	struct sk_buff_head *frames)
1251	{
1252	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1253	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1254	u16 mpdu_seq_num = ieee80211_get_sn(hdr);
1255	u16 head_seq_num, buf_size;
1256	int index;
1257	bool ret = true;
1258
1259	spin_lock(lock: &tid_agg_rx->reorder_lock);
1260
1261	/*
1262	* Offloaded BA sessions have no known starting sequence number so pick
1263	* one from first Rxed frame for this tid after BA was started.
1264	*/
1265	if (unlikely(tid_agg_rx->auto_seq)) {
1266	tid_agg_rx->auto_seq = false;
1267	tid_agg_rx->ssn = mpdu_seq_num;
1268	tid_agg_rx->head_seq_num = mpdu_seq_num;
1269	}
1270
1271	buf_size = tid_agg_rx->buf_size;
1272	head_seq_num = tid_agg_rx->head_seq_num;
1273
1274	/*
1275	* If the current MPDU's SN is smaller than the SSN, it shouldn't
1276	* be reordered.
1277	*/
1278	if (unlikely(!tid_agg_rx->started)) {
1279	if (ieee80211_sn_less(sn1: mpdu_seq_num, sn2: head_seq_num)) {
1280	ret = false;
1281	goto out;
1282	}
1283	tid_agg_rx->started = true;
1284	}
1285
1286	/* frame with out of date sequence number */
1287	if (ieee80211_sn_less(sn1: mpdu_seq_num, sn2: head_seq_num)) {
1288	dev_kfree_skb(skb);
1289	goto out;
1290	}
1291
1292	/*
1293	* If frame the sequence number exceeds our buffering window
1294	* size release some previous frames to make room for this one.
1295	*/
1296	if (!ieee80211_sn_less(sn1: mpdu_seq_num, sn2: head_seq_num + buf_size)) {
1297	head_seq_num = ieee80211_sn_inc(
1298	sn: ieee80211_sn_sub(sn1: mpdu_seq_num, sn2: buf_size));
1299	/* release stored frames up to new head to stack */
1300	ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1301	head_seq_num, frames);
1302	}
1303
1304	/* Now the new frame is always in the range of the reordering buffer */
1305
1306	index = mpdu_seq_num % tid_agg_rx->buf_size;
1307
1308	/* check if we already stored this frame */
1309	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1310	dev_kfree_skb(skb);
1311	goto out;
1312	}
1313
1314	/*
1315	* If the current MPDU is in the right order and nothing else
1316	* is stored we can process it directly, no need to buffer it.
1317	* If it is first but there's something stored, we may be able
1318	* to release frames after this one.
1319	*/
1320	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1321	tid_agg_rx->stored_mpdu_num == 0) {
1322	if (!(status->flag & RX_FLAG_AMSDU_MORE))
1323	tid_agg_rx->head_seq_num =
1324	ieee80211_sn_inc(sn: tid_agg_rx->head_seq_num);
1325	ret = false;
1326	goto out;
1327	}
1328
1329	/* put the frame in the reordering buffer */
1330	__skb_queue_tail(list: &tid_agg_rx->reorder_buf[index], newsk: skb);
1331	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1332	tid_agg_rx->reorder_time[index] = jiffies;
1333	tid_agg_rx->stored_mpdu_num++;
1334	ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1335	}
1336
1337	out:
1338	spin_unlock(lock: &tid_agg_rx->reorder_lock);
1339	return ret;
1340	}
1341
1342	/*
1343	* Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1344	* true if the MPDU was buffered, false if it should be processed.
1345	*/
1346	static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1347	struct sk_buff_head *frames)
1348	{
1349	struct sk_buff *skb = rx->skb;
1350	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1351	struct sta_info *sta = rx->sta;
1352	struct tid_ampdu_rx *tid_agg_rx;
1353	u16 sc;
1354	u8 tid, ack_policy;
1355
1356	if (!ieee80211_is_data_qos(fc: hdr->frame_control) ||
1357	is_multicast_ether_addr(addr: hdr->addr1))
1358	goto dont_reorder;
1359
1360	/*
1361	* filter the QoS data rx stream according to
1362	* STA/TID and check if this STA/TID is on aggregation
1363	*/
1364
1365	if (!sta)
1366	goto dont_reorder;
1367
1368	ack_policy = *ieee80211_get_qos_ctl(hdr) &
1369	IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1370	tid = ieee80211_get_tid(hdr);
1371
1372	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1373	if (!tid_agg_rx) {
1374	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1375	!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1376	!test_and_set_bit(nr: tid, addr: rx->sta->ampdu_mlme.unexpected_agg))
1377	ieee80211_send_delba(sdata: rx->sdata, da: rx->sta->sta.addr, tid,
1378	initiator: WLAN_BACK_RECIPIENT,
1379	reason_code: WLAN_REASON_QSTA_REQUIRE_SETUP);
1380	goto dont_reorder;
1381	}
1382
1383	/* qos null data frames are excluded */
1384	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1385	goto dont_reorder;
1386
1387	/* not part of a BA session */
1388	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
1389	goto dont_reorder;
1390
1391	/* new, potentially un-ordered, ampdu frame - process it */
1392
1393	/* reset session timer */
1394	if (tid_agg_rx->timeout)
1395	tid_agg_rx->last_rx = jiffies;
1396
1397	/* if this mpdu is fragmented - terminate rx aggregation session */
1398	sc = le16_to_cpu(hdr->seq_ctrl);
1399	if (sc & IEEE80211_SCTL_FRAG) {
1400	ieee80211_queue_skb_to_iface(sdata: rx->sdata, link_id: rx->link_id, NULL, skb);
1401	return;
1402	}
1403
1404	/*
1405	* No locking needed -- we will only ever process one
1406	* RX packet at a time, and thus own tid_agg_rx. All
1407	* other code manipulating it needs to (and does) make
1408	* sure that we cannot get to it any more before doing
1409	* anything with it.
1410	*/
1411	if (ieee80211_sta_manage_reorder_buf(sdata: rx->sdata, tid_agg_rx, skb,
1412	frames))
1413	return;
1414
1415	dont_reorder:
1416	__skb_queue_tail(list: frames, newsk: skb);
1417	}
1418
1419	static ieee80211_rx_result debug_noinline
1420	ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1421	{
1422	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1423	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
1424
1425	if (status->flag & RX_FLAG_DUP_VALIDATED)
1426	return RX_CONTINUE;
1427
1428	/*
1429	* Drop duplicate 802.11 retransmissions
1430	* (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1431	*/
1432
1433	if (rx->skb->len < 24)
1434	return RX_CONTINUE;
1435
1436	if (ieee80211_is_ctl(fc: hdr->frame_control) ||
1437	ieee80211_is_any_nullfunc(fc: hdr->frame_control))
1438	return RX_CONTINUE;
1439
1440	if (!rx->sta)
1441	return RX_CONTINUE;
1442
1443	if (unlikely(is_multicast_ether_addr(hdr->addr1))) {
1444	struct ieee80211_sub_if_data *sdata = rx->sdata;
1445	u16 sn = ieee80211_get_sn(hdr);
1446
1447	if (!ieee80211_is_data_present(fc: hdr->frame_control))
1448	return RX_CONTINUE;
1449
1450	if (!ieee80211_vif_is_mld(vif: &sdata->vif) ||
1451	sdata->vif.type != NL80211_IFTYPE_STATION)
1452	return RX_CONTINUE;
1453
1454	if (sdata->u.mgd.mcast_seq_last != IEEE80211_SN_MODULO &&
1455	ieee80211_sn_less_eq(sn1: sn, sn2: sdata->u.mgd.mcast_seq_last))
1456	return RX_DROP_U_DUP;
1457
1458	sdata->u.mgd.mcast_seq_last = sn;
1459	return RX_CONTINUE;
1460	}
1461
1462	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1463	rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1464	I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1465	rx->link_sta->rx_stats.num_duplicates++;
1466	return RX_DROP_U_DUP;
1467	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1468	rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1469	}
1470
1471	return RX_CONTINUE;
1472	}
1473
1474	static ieee80211_rx_result debug_noinline
1475	ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1476	{
1477	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1478
1479	/* Drop disallowed frame classes based on STA auth/assoc state;
1480	* IEEE 802.11, Chap 5.5.
1481	*
1482	* mac80211 filters only based on association state, i.e. it drops
1483	* Class 3 frames from not associated stations. hostapd sends
1484	* deauth/disassoc frames when needed. In addition, hostapd is
1485	* responsible for filtering on both auth and assoc states.
1486	*/
1487
1488	if (ieee80211_vif_is_mesh(vif: &rx->sdata->vif))
1489	return ieee80211_rx_mesh_check(rx);
1490
1491	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1492	ieee80211_is_pspoll(hdr->frame_control)) &&
1493	rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1494	rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1495	(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1496	/*
1497	* accept port control frames from the AP even when it's not
1498	* yet marked ASSOC to prevent a race where we don't set the
1499	* assoc bit quickly enough before it sends the first frame
1500	*/
1501	if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1502	ieee80211_is_data_present(fc: hdr->frame_control)) {
1503	unsigned int hdrlen;
1504	__be16 ethertype;
1505
1506	hdrlen = ieee80211_hdrlen(fc: hdr->frame_control);
1507
1508	if (rx->skb->len < hdrlen + 8)
1509	return RX_DROP_MONITOR;
1510
1511	skb_copy_bits(skb: rx->skb, offset: hdrlen + 6, to: &ethertype, len: 2);
1512	if (ethertype == rx->sdata->control_port_protocol)
1513	return RX_CONTINUE;
1514	}
1515
1516	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1517	cfg80211_rx_spurious_frame(dev: rx->sdata->dev,
1518	addr: hdr->addr2,
1519	GFP_ATOMIC))
1520	return RX_DROP_U_SPURIOUS;
1521
1522	return RX_DROP_MONITOR;
1523	}
1524
1525	return RX_CONTINUE;
1526	}
1527
1528
1529	static ieee80211_rx_result debug_noinline
1530	ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1531	{
1532	struct ieee80211_local *local;
1533	struct ieee80211_hdr *hdr;
1534	struct sk_buff *skb;
1535
1536	local = rx->local;
1537	skb = rx->skb;
1538	hdr = (struct ieee80211_hdr *) skb->data;
1539
1540	if (!local->pspolling)
1541	return RX_CONTINUE;
1542
1543	if (!ieee80211_has_fromds(fc: hdr->frame_control))
1544	/* this is not from AP */
1545	return RX_CONTINUE;
1546
1547	if (!ieee80211_is_data(fc: hdr->frame_control))
1548	return RX_CONTINUE;
1549
1550	if (!ieee80211_has_moredata(fc: hdr->frame_control)) {
1551	/* AP has no more frames buffered for us */
1552	local->pspolling = false;
1553	return RX_CONTINUE;
1554	}
1555
1556	/* more data bit is set, let's request a new frame from the AP */
1557	ieee80211_send_pspoll(local, sdata: rx->sdata);
1558
1559	return RX_CONTINUE;
1560	}
1561
1562	static void sta_ps_start(struct sta_info *sta)
1563	{
1564	struct ieee80211_sub_if_data *sdata = sta->sdata;
1565	struct ieee80211_local *local = sdata->local;
1566	struct ps_data *ps;
1567	int tid;
1568
1569	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1570	sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1571	ps = &sdata->bss->ps;
1572	else
1573	return;
1574
1575	atomic_inc(v: &ps->num_sta_ps);
1576	set_sta_flag(sta, flag: WLAN_STA_PS_STA);
1577	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1578	drv_sta_notify(local, sdata, cmd: STA_NOTIFY_SLEEP, sta: &sta->sta);
1579	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1580	sta->sta.addr, sta->sta.aid);
1581
1582	ieee80211_clear_fast_xmit(sta);
1583
1584	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1585	struct ieee80211_txq *txq = sta->sta.txq[tid];
1586	struct txq_info *txqi = to_txq_info(txq);
1587
1588	spin_lock(lock: &local->active_txq_lock[txq->ac]);
1589	if (!list_empty(head: &txqi->schedule_order))
1590	list_del_init(entry: &txqi->schedule_order);
1591	spin_unlock(lock: &local->active_txq_lock[txq->ac]);
1592
1593	if (txq_has_queue(txq))
1594	set_bit(nr: tid, addr: &sta->txq_buffered_tids);
1595	else
1596	clear_bit(nr: tid, addr: &sta->txq_buffered_tids);
1597	}
1598	}
1599
1600	static void sta_ps_end(struct sta_info *sta)
1601	{
1602	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1603	sta->sta.addr, sta->sta.aid);
1604
1605	if (test_sta_flag(sta, flag: WLAN_STA_PS_DRIVER)) {
1606	/*
1607	* Clear the flag only if the other one is still set
1608	* so that the TX path won't start TX'ing new frames
1609	* directly ... In the case that the driver flag isn't
1610	* set ieee80211_sta_ps_deliver_wakeup() will clear it.
1611	*/
1612	clear_sta_flag(sta, flag: WLAN_STA_PS_STA);
1613	ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1614	sta->sta.addr, sta->sta.aid);
1615	return;
1616	}
1617
1618	set_sta_flag(sta, flag: WLAN_STA_PS_DELIVER);
1619	clear_sta_flag(sta, flag: WLAN_STA_PS_STA);
1620	ieee80211_sta_ps_deliver_wakeup(sta);
1621	}
1622
1623	int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1624	{
1625	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1626	bool in_ps;
1627
1628	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1629
1630	/* Don't let the same PS state be set twice */
1631	in_ps = test_sta_flag(sta, flag: WLAN_STA_PS_STA);
1632	if ((start && in_ps) || (!start && !in_ps))
1633	return -EINVAL;
1634
1635	if (start)
1636	sta_ps_start(sta);
1637	else
1638	sta_ps_end(sta);
1639
1640	return 0;
1641	}
1642	EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1643
1644	void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1645	{
1646	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1647
1648	if (test_sta_flag(sta, flag: WLAN_STA_SP))
1649	return;
1650
1651	if (!test_sta_flag(sta, flag: WLAN_STA_PS_DRIVER))
1652	ieee80211_sta_ps_deliver_poll_response(sta);
1653	else
1654	set_sta_flag(sta, flag: WLAN_STA_PSPOLL);
1655	}
1656	EXPORT_SYMBOL(ieee80211_sta_pspoll);
1657
1658	void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1659	{
1660	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1661	int ac = ieee80211_ac_from_tid(tid);
1662
1663	/*
1664	* If this AC is not trigger-enabled do nothing unless the
1665	* driver is calling us after it already checked.
1666	*
1667	* NB: This could/should check a separate bitmap of trigger-
1668	* enabled queues, but for now we only implement uAPSD w/o
1669	* TSPEC changes to the ACs, so they're always the same.
1670	*/
1671	if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1672	tid != IEEE80211_NUM_TIDS)
1673	return;
1674
1675	/* if we are in a service period, do nothing */
1676	if (test_sta_flag(sta, flag: WLAN_STA_SP))
1677	return;
1678
1679	if (!test_sta_flag(sta, flag: WLAN_STA_PS_DRIVER))
1680	ieee80211_sta_ps_deliver_uapsd(sta);
1681	else
1682	set_sta_flag(sta, flag: WLAN_STA_UAPSD);
1683	}
1684	EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1685
1686	static ieee80211_rx_result debug_noinline
1687	ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1688	{
1689	struct ieee80211_sub_if_data *sdata = rx->sdata;
1690	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1691	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
1692
1693	if (!rx->sta)
1694	return RX_CONTINUE;
1695
1696	if (sdata->vif.type != NL80211_IFTYPE_AP &&
1697	sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1698	return RX_CONTINUE;
1699
1700	/*
1701	* The device handles station powersave, so don't do anything about
1702	* uAPSD and PS-Poll frames (the latter shouldn't even come up from
1703	* it to mac80211 since they're handled.)
1704	*/
1705	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1706	return RX_CONTINUE;
1707
1708	/*
1709	* Don't do anything if the station isn't already asleep. In
1710	* the uAPSD case, the station will probably be marked asleep,
1711	* in the PS-Poll case the station must be confused ...
1712	*/
1713	if (!test_sta_flag(sta: rx->sta, flag: WLAN_STA_PS_STA))
1714	return RX_CONTINUE;
1715
1716	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1717	ieee80211_sta_pspoll(&rx->sta->sta);
1718
1719	/* Free PS Poll skb here instead of returning RX_DROP that would
1720	* count as an dropped frame. */
1721	dev_kfree_skb(rx->skb);
1722
1723	return RX_QUEUED;
1724	} else if (!ieee80211_has_morefrags(fc: hdr->frame_control) &&
1725	!(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1726	ieee80211_has_pm(fc: hdr->frame_control) &&
1727	(ieee80211_is_data_qos(fc: hdr->frame_control) ||
1728	ieee80211_is_qos_nullfunc(fc: hdr->frame_control))) {
1729	u8 tid = ieee80211_get_tid(hdr);
1730
1731	ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1732	}
1733
1734	return RX_CONTINUE;
1735	}
1736
1737	static ieee80211_rx_result debug_noinline
1738	ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1739	{
1740	struct sta_info *sta = rx->sta;
1741	struct link_sta_info *link_sta = rx->link_sta;
1742	struct sk_buff *skb = rx->skb;
1743	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1744	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1745	int i;
1746
1747	if (!sta || !link_sta)
1748	return RX_CONTINUE;
1749
1750	/*
1751	* Update last_rx only for IBSS packets which are for the current
1752	* BSSID and for station already AUTHORIZED to avoid keeping the
1753	* current IBSS network alive in cases where other STAs start
1754	* using different BSSID. This will also give the station another
1755	* chance to restart the authentication/authorization in case
1756	* something went wrong the first time.
1757	*/
1758	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1759	u8 *bssid = ieee80211_get_bssid(hdr, len: rx->skb->len,
1760	type: NL80211_IFTYPE_ADHOC);
1761	if (ether_addr_equal(addr1: bssid, addr2: rx->sdata->u.ibss.bssid) &&
1762	test_sta_flag(sta, flag: WLAN_STA_AUTHORIZED)) {
1763	link_sta->rx_stats.last_rx = jiffies;
1764	if (ieee80211_is_data_present(fc: hdr->frame_control) &&
1765	!is_multicast_ether_addr(addr: hdr->addr1))
1766	link_sta->rx_stats.last_rate =
1767	sta_stats_encode_rate(s: status);
1768	}
1769	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1770	link_sta->rx_stats.last_rx = jiffies;
1771	} else if (!ieee80211_is_s1g_beacon(fc: hdr->frame_control) &&
1772	!is_multicast_ether_addr(addr: hdr->addr1)) {
1773	/*
1774	* Mesh beacons will update last_rx when if they are found to
1775	* match the current local configuration when processed.
1776	*/
1777	link_sta->rx_stats.last_rx = jiffies;
1778	if (ieee80211_is_data_present(fc: hdr->frame_control))
1779	link_sta->rx_stats.last_rate = sta_stats_encode_rate(s: status);
1780	}
1781
1782	link_sta->rx_stats.fragments++;
1783
1784	u64_stats_update_begin(syncp: &link_sta->rx_stats.syncp);
1785	link_sta->rx_stats.bytes += rx->skb->len;
1786	u64_stats_update_end(syncp: &link_sta->rx_stats.syncp);
1787
1788	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1789	link_sta->rx_stats.last_signal = status->signal;
1790	ewma_signal_add(e: &link_sta->rx_stats_avg.signal,
1791	val: -status->signal);
1792	}
1793
1794	if (status->chains) {
1795	link_sta->rx_stats.chains = status->chains;
1796	for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1797	int signal = status->chain_signal[i];
1798
1799	if (!(status->chains & BIT(i)))
1800	continue;
1801
1802	link_sta->rx_stats.chain_signal_last[i] = signal;
1803	ewma_signal_add(e: &link_sta->rx_stats_avg.chain_signal[i],
1804	val: -signal);
1805	}
1806	}
1807
1808	if (ieee80211_is_s1g_beacon(fc: hdr->frame_control))
1809	return RX_CONTINUE;
1810
1811	/*
1812	* Change STA power saving mode only at the end of a frame
1813	* exchange sequence, and only for a data or management
1814	* frame as specified in IEEE 802.11-2016 11.2.3.2
1815	*/
1816	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1817	!ieee80211_has_morefrags(fc: hdr->frame_control) &&
1818	!is_multicast_ether_addr(addr: hdr->addr1) &&
1819	(ieee80211_is_mgmt(fc: hdr->frame_control) ||
1820	ieee80211_is_data(fc: hdr->frame_control)) &&
1821	!(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1822	(rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1823	rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1824	if (test_sta_flag(sta, flag: WLAN_STA_PS_STA)) {
1825	if (!ieee80211_has_pm(fc: hdr->frame_control))
1826	sta_ps_end(sta);
1827	} else {
1828	if (ieee80211_has_pm(fc: hdr->frame_control))
1829	sta_ps_start(sta);
1830	}
1831	}
1832
1833	/* mesh power save support */
1834	if (ieee80211_vif_is_mesh(vif: &rx->sdata->vif))
1835	ieee80211_mps_rx_h_sta_process(sta, hdr);
1836
1837	/*
1838	* Drop (qos-)data::nullfunc frames silently, since they
1839	* are used only to control station power saving mode.
1840	*/
1841	if (ieee80211_is_any_nullfunc(fc: hdr->frame_control)) {
1842	I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1843
1844	/*
1845	* If we receive a 4-addr nullfunc frame from a STA
1846	* that was not moved to a 4-addr STA vlan yet send
1847	* the event to userspace and for older hostapd drop
1848	* the frame to the monitor interface.
1849	*/
1850	if (ieee80211_has_a4(fc: hdr->frame_control) &&
1851	(rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1852	(rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1853	!rx->sdata->u.vlan.sta))) {
1854	if (!test_and_set_sta_flag(sta, flag: WLAN_STA_4ADDR_EVENT))
1855	cfg80211_rx_unexpected_4addr_frame(
1856	dev: rx->sdata->dev, addr: sta->sta.addr,
1857	GFP_ATOMIC);
1858	return RX_DROP_M_UNEXPECTED_4ADDR_FRAME;
1859	}
1860	/*
1861	* Update counter and free packet here to avoid
1862	* counting this as a dropped packed.
1863	*/
1864	link_sta->rx_stats.packets++;
1865	dev_kfree_skb(rx->skb);
1866	return RX_QUEUED;
1867	}
1868
1869	return RX_CONTINUE;
1870	} /* ieee80211_rx_h_sta_process */
1871
1872	static struct ieee80211_key *
1873	ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1874	{
1875	struct ieee80211_key *key = NULL;
1876	int idx2;
1877
1878	/* Make sure key gets set if either BIGTK key index is set so that
1879	* ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
1880	* Beacon frames and Beacon frames that claim to use another BIGTK key
1881	* index (i.e., a key that we do not have).
1882	*/
1883
1884	if (idx < 0) {
1885	idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
1886	idx2 = idx + 1;
1887	} else {
1888	if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1889	idx2 = idx + 1;
1890	else
1891	idx2 = idx - 1;
1892	}
1893
1894	if (rx->link_sta)
1895	key = rcu_dereference(rx->link_sta->gtk[idx]);
1896	if (!key)
1897	key = rcu_dereference(rx->link->gtk[idx]);
1898	if (!key && rx->link_sta)
1899	key = rcu_dereference(rx->link_sta->gtk[idx2]);
1900	if (!key)
1901	key = rcu_dereference(rx->link->gtk[idx2]);
1902
1903	return key;
1904	}
1905
1906	static ieee80211_rx_result debug_noinline
1907	ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1908	{
1909	struct sk_buff *skb = rx->skb;
1910	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1911	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1912	int keyidx;
1913	ieee80211_rx_result result = RX_DROP_U_DECRYPT_FAIL;
1914	struct ieee80211_key *sta_ptk = NULL;
1915	struct ieee80211_key *ptk_idx = NULL;
1916	int mmie_keyidx = -1;
1917	__le16 fc;
1918
1919	if (ieee80211_is_ext(fc: hdr->frame_control))
1920	return RX_CONTINUE;
1921
1922	/*
1923	* Key selection 101
1924	*
1925	* There are five types of keys:
1926	* - GTK (group keys)
1927	* - IGTK (group keys for management frames)
1928	* - BIGTK (group keys for Beacon frames)
1929	* - PTK (pairwise keys)
1930	* - STK (station-to-station pairwise keys)
1931	*
1932	* When selecting a key, we have to distinguish between multicast
1933	* (including broadcast) and unicast frames, the latter can only
1934	* use PTKs and STKs while the former always use GTKs, IGTKs, and
1935	* BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
1936	* then unicast frames can also use key indices like GTKs. Hence, if we
1937	* don't have a PTK/STK we check the key index for a WEP key.
1938	*
1939	* Note that in a regular BSS, multicast frames are sent by the
1940	* AP only, associated stations unicast the frame to the AP first
1941	* which then multicasts it on their behalf.
1942	*
1943	* There is also a slight problem in IBSS mode: GTKs are negotiated
1944	* with each station, that is something we don't currently handle.
1945	* The spec seems to expect that one negotiates the same key with
1946	* every station but there's no such requirement; VLANs could be
1947	* possible.
1948	*/
1949
1950	/* start without a key */
1951	rx->key = NULL;
1952	fc = hdr->frame_control;
1953
1954	if (rx->sta) {
1955	int keyid = rx->sta->ptk_idx;
1956	sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1957
1958	if (ieee80211_has_protected(fc) &&
1959	!(status->flag & RX_FLAG_IV_STRIPPED)) {
1960	keyid = ieee80211_get_keyid(skb: rx->skb);
1961
1962	if (unlikely(keyid < 0))
1963	return RX_DROP_U_NO_KEY_ID;
1964
1965	ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
1966	}
1967	}
1968
1969	if (!ieee80211_has_protected(fc))
1970	mmie_keyidx = ieee80211_get_mmie_keyidx(skb: rx->skb);
1971
1972	if (!is_multicast_ether_addr(addr: hdr->addr1) && sta_ptk) {
1973	rx->key = ptk_idx ? ptk_idx : sta_ptk;
1974	if ((status->flag & RX_FLAG_DECRYPTED) &&
1975	(status->flag & RX_FLAG_IV_STRIPPED))
1976	return RX_CONTINUE;
1977	/* Skip decryption if the frame is not protected. */
1978	if (!ieee80211_has_protected(fc))
1979	return RX_CONTINUE;
1980	} else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
1981	/* Broadcast/multicast robust management frame / BIP */
1982	if ((status->flag & RX_FLAG_DECRYPTED) &&
1983	(status->flag & RX_FLAG_IV_STRIPPED))
1984	return RX_CONTINUE;
1985
1986	if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
1987	mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
1988	NUM_DEFAULT_BEACON_KEYS) {
1989	if (rx->sdata->dev)
1990	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
1991	buf: skb->data,
1992	len: skb->len);
1993	return RX_DROP_M_BAD_BCN_KEYIDX;
1994	}
1995
1996	rx->key = ieee80211_rx_get_bigtk(rx, idx: mmie_keyidx);
1997	if (!rx->key)
1998	return RX_CONTINUE; /* Beacon protection not in use */
1999	} else if (mmie_keyidx >= 0) {
2000	/* Broadcast/multicast robust management frame / BIP */
2001	if ((status->flag & RX_FLAG_DECRYPTED) &&
2002	(status->flag & RX_FLAG_IV_STRIPPED))
2003	return RX_CONTINUE;
2004
2005	if (mmie_keyidx < NUM_DEFAULT_KEYS ||
2006	mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2007	return RX_DROP_M_BAD_MGMT_KEYIDX; /* unexpected BIP keyidx */
2008	if (rx->link_sta) {
2009	if (ieee80211_is_group_privacy_action(skb) &&
2010	test_sta_flag(sta: rx->sta, flag: WLAN_STA_MFP))
2011	return RX_DROP_MONITOR;
2012
2013	rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);
2014	}
2015	if (!rx->key)
2016	rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);
2017	} else if (!ieee80211_has_protected(fc)) {
2018	/*
2019	* The frame was not protected, so skip decryption. However, we
2020	* need to set rx->key if there is a key that could have been
2021	* used so that the frame may be dropped if encryption would
2022	* have been expected.
2023	*/
2024	struct ieee80211_key *key = NULL;
2025	int i;
2026
2027	if (ieee80211_is_beacon(fc)) {
2028	key = ieee80211_rx_get_bigtk(rx, idx: -1);
2029	} else if (ieee80211_is_mgmt(fc) &&
2030	is_multicast_ether_addr(addr: hdr->addr1)) {
2031	key = rcu_dereference(rx->link->default_mgmt_key);
2032	} else {
2033	if (rx->link_sta) {
2034	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2035	key = rcu_dereference(rx->link_sta->gtk[i]);
2036	if (key)
2037	break;
2038	}
2039	}
2040	if (!key) {
2041	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2042	key = rcu_dereference(rx->link->gtk[i]);
2043	if (key)
2044	break;
2045	}
2046	}
2047	}
2048	if (key)
2049	rx->key = key;
2050	return RX_CONTINUE;
2051	} else {
2052	/*
2053	* The device doesn't give us the IV so we won't be
2054	* able to look up the key. That's ok though, we
2055	* don't need to decrypt the frame, we just won't
2056	* be able to keep statistics accurate.
2057	* Except for key threshold notifications, should
2058	* we somehow allow the driver to tell us which key
2059	* the hardware used if this flag is set?
2060	*/
2061	if ((status->flag & RX_FLAG_DECRYPTED) &&
2062	(status->flag & RX_FLAG_IV_STRIPPED))
2063	return RX_CONTINUE;
2064
2065	keyidx = ieee80211_get_keyid(skb: rx->skb);
2066
2067	if (unlikely(keyidx < 0))
2068	return RX_DROP_U_NO_KEY_ID;
2069
2070	/* check per-station GTK first, if multicast packet */
2071	if (is_multicast_ether_addr(addr: hdr->addr1) && rx->link_sta)
2072	rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);
2073
2074	/* if not found, try default key */
2075	if (!rx->key) {
2076	if (is_multicast_ether_addr(addr: hdr->addr1))
2077	rx->key = rcu_dereference(rx->link->gtk[keyidx]);
2078	if (!rx->key)
2079	rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2080
2081	/*
2082	* RSNA-protected unicast frames should always be
2083	* sent with pairwise or station-to-station keys,
2084	* but for WEP we allow using a key index as well.
2085	*/
2086	if (rx->key &&
2087	rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2088	rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2089	!is_multicast_ether_addr(addr: hdr->addr1))
2090	rx->key = NULL;
2091	}
2092	}
2093
2094	if (rx->key) {
2095	if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2096	return RX_DROP_MONITOR;
2097
2098	/* TODO: add threshold stuff again */
2099	} else {
2100	return RX_DROP_MONITOR;
2101	}
2102
2103	switch (rx->key->conf.cipher) {
2104	case WLAN_CIPHER_SUITE_WEP40:
2105	case WLAN_CIPHER_SUITE_WEP104:
2106	result = ieee80211_crypto_wep_decrypt(rx);
2107	break;
2108	case WLAN_CIPHER_SUITE_TKIP:
2109	result = ieee80211_crypto_tkip_decrypt(rx);
2110	break;
2111	case WLAN_CIPHER_SUITE_CCMP:
2112	result = ieee80211_crypto_ccmp_decrypt(
2113	rx, IEEE80211_CCMP_MIC_LEN);
2114	break;
2115	case WLAN_CIPHER_SUITE_CCMP_256:
2116	result = ieee80211_crypto_ccmp_decrypt(
2117	rx, IEEE80211_CCMP_256_MIC_LEN);
2118	break;
2119	case WLAN_CIPHER_SUITE_AES_CMAC:
2120	result = ieee80211_crypto_aes_cmac_decrypt(rx);
2121	break;
2122	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2123	result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
2124	break;
2125	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2126	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2127	result = ieee80211_crypto_aes_gmac_decrypt(rx);
2128	break;
2129	case WLAN_CIPHER_SUITE_GCMP:
2130	case WLAN_CIPHER_SUITE_GCMP_256:
2131	result = ieee80211_crypto_gcmp_decrypt(rx);
2132	break;
2133	default:
2134	result = RX_DROP_U_BAD_CIPHER;
2135	}
2136
2137	/* the hdr variable is invalid after the decrypt handlers */
2138
2139	/* either the frame has been decrypted or will be dropped */
2140	status->flag |= RX_FLAG_DECRYPTED;
2141
2142	if (unlikely(ieee80211_is_beacon(fc) && RX_RES_IS_UNUSABLE(result) &&
2143	rx->sdata->dev))
2144	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2145	buf: skb->data, len: skb->len);
2146
2147	return result;
2148	}
2149
2150	void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2151	{
2152	int i;
2153
2154	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2155	skb_queue_head_init(list: &cache->entries[i].skb_list);
2156	}
2157
2158	void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2159	{
2160	int i;
2161
2162	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2163	__skb_queue_purge(list: &cache->entries[i].skb_list);
2164	}
2165
2166	static inline struct ieee80211_fragment_entry *
2167	ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
2168	unsigned int frag, unsigned int seq, int rx_queue,
2169	struct sk_buff **skb)
2170	{
2171	struct ieee80211_fragment_entry *entry;
2172
2173	entry = &cache->entries[cache->next++];
2174	if (cache->next >= IEEE80211_FRAGMENT_MAX)
2175	cache->next = 0;
2176
2177	__skb_queue_purge(list: &entry->skb_list);
2178
2179	__skb_queue_tail(list: &entry->skb_list, newsk: *skb); /* no need for locking */
2180	*skb = NULL;
2181	entry->first_frag_time = jiffies;
2182	entry->seq = seq;
2183	entry->rx_queue = rx_queue;
2184	entry->last_frag = frag;
2185	entry->check_sequential_pn = false;
2186	entry->extra_len = 0;
2187
2188	return entry;
2189	}
2190
2191	static inline struct ieee80211_fragment_entry *
2192	ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
2193	unsigned int frag, unsigned int seq,
2194	int rx_queue, struct ieee80211_hdr *hdr)
2195	{
2196	struct ieee80211_fragment_entry *entry;
2197	int i, idx;
2198
2199	idx = cache->next;
2200	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2201	struct ieee80211_hdr *f_hdr;
2202	struct sk_buff *f_skb;
2203
2204	idx--;
2205	if (idx < 0)
2206	idx = IEEE80211_FRAGMENT_MAX - 1;
2207
2208	entry = &cache->entries[idx];
2209	if (skb_queue_empty(list: &entry->skb_list) || entry->seq != seq ||
2210	entry->rx_queue != rx_queue ||
2211	entry->last_frag + 1 != frag)
2212	continue;
2213
2214	f_skb = __skb_peek(list_: &entry->skb_list);
2215	f_hdr = (struct ieee80211_hdr *) f_skb->data;
2216
2217	/*
2218	* Check ftype and addresses are equal, else check next fragment
2219	*/
2220	if (((hdr->frame_control ^ f_hdr->frame_control) &
2221	cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2222	!ether_addr_equal(addr1: hdr->addr1, addr2: f_hdr->addr1) ||
2223	!ether_addr_equal(addr1: hdr->addr2, addr2: f_hdr->addr2))
2224	continue;
2225
2226	if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2227	__skb_queue_purge(list: &entry->skb_list);
2228	continue;
2229	}
2230	return entry;
2231	}
2232
2233	return NULL;
2234	}
2235
2236	static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2237	{
2238	return rx->key &&
2239	(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2240	rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2241	rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2242	rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2243	ieee80211_has_protected(fc);
2244	}
2245
2246	static ieee80211_rx_result debug_noinline
2247	ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2248	{
2249	struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
2250	struct ieee80211_hdr *hdr;
2251	u16 sc;
2252	__le16 fc;
2253	unsigned int frag, seq;
2254	struct ieee80211_fragment_entry *entry;
2255	struct sk_buff *skb;
2256	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
2257
2258	hdr = (struct ieee80211_hdr *)rx->skb->data;
2259	fc = hdr->frame_control;
2260
2261	if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
2262	return RX_CONTINUE;
2263
2264	sc = le16_to_cpu(hdr->seq_ctrl);
2265	frag = sc & IEEE80211_SCTL_FRAG;
2266
2267	if (rx->sta)
2268	cache = &rx->sta->frags;
2269
2270	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2271	goto out;
2272
2273	if (is_multicast_ether_addr(addr: hdr->addr1))
2274	return RX_DROP_MONITOR;
2275
2276	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2277
2278	if (skb_linearize(skb: rx->skb))
2279	return RX_DROP_U_OOM;
2280
2281	/*
2282	* skb_linearize() might change the skb->data and
2283	* previously cached variables (in this case, hdr) need to
2284	* be refreshed with the new data.
2285	*/
2286	hdr = (struct ieee80211_hdr *)rx->skb->data;
2287	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2288
2289	if (frag == 0) {
2290	/* This is the first fragment of a new frame. */
2291	entry = ieee80211_reassemble_add(cache, frag, seq,
2292	rx_queue: rx->seqno_idx, skb: &(rx->skb));
2293	if (requires_sequential_pn(rx, fc)) {
2294	int queue = rx->security_idx;
2295
2296	/* Store CCMP/GCMP PN so that we can verify that the
2297	* next fragment has a sequential PN value.
2298	*/
2299	entry->check_sequential_pn = true;
2300	entry->is_protected = true;
2301	entry->key_color = rx->key->color;
2302	memcpy(entry->last_pn,
2303	rx->key->u.ccmp.rx_pn[queue],
2304	IEEE80211_CCMP_PN_LEN);
2305	BUILD_BUG_ON(offsetof(struct ieee80211_key,
2306	u.ccmp.rx_pn) !=
2307	offsetof(struct ieee80211_key,
2308	u.gcmp.rx_pn));
2309	BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2310	sizeof(rx->key->u.gcmp.rx_pn[queue]));
2311	BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2312	IEEE80211_GCMP_PN_LEN);
2313	} else if (rx->key &&
2314	(ieee80211_has_protected(fc) ||
2315	(status->flag & RX_FLAG_DECRYPTED))) {
2316	entry->is_protected = true;
2317	entry->key_color = rx->key->color;
2318	}
2319	return RX_QUEUED;
2320	}
2321
2322	/* This is a fragment for a frame that should already be pending in
2323	* fragment cache. Add this fragment to the end of the pending entry.
2324	*/
2325	entry = ieee80211_reassemble_find(cache, frag, seq,
2326	rx_queue: rx->seqno_idx, hdr);
2327	if (!entry) {
2328	I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2329	return RX_DROP_MONITOR;
2330	}
2331
2332	/* "The receiver shall discard MSDUs and MMPDUs whose constituent
2333	* MPDU PN values are not incrementing in steps of 1."
2334	* see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2335	* and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2336	*/
2337	if (entry->check_sequential_pn) {
2338	int i;
2339	u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2340
2341	if (!requires_sequential_pn(rx, fc))
2342	return RX_DROP_U_NONSEQ_PN;
2343
2344	/* Prevent mixed key and fragment cache attacks */
2345	if (entry->key_color != rx->key->color)
2346	return RX_DROP_U_BAD_KEY_COLOR;
2347
2348	memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2349	for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2350	pn[i]++;
2351	if (pn[i])
2352	break;
2353	}
2354
2355	rpn = rx->ccm_gcm.pn;
2356	if (memcmp(p: pn, q: rpn, IEEE80211_CCMP_PN_LEN))
2357	return RX_DROP_U_REPLAY;
2358	memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2359	} else if (entry->is_protected &&
2360	(!rx->key ||
2361	(!ieee80211_has_protected(fc) &&
2362	!(status->flag & RX_FLAG_DECRYPTED)) ||
2363	rx->key->color != entry->key_color)) {
2364	/* Drop this as a mixed key or fragment cache attack, even
2365	* if for TKIP Michael MIC should protect us, and WEP is a
2366	* lost cause anyway.
2367	*/
2368	return RX_DROP_U_EXPECT_DEFRAG_PROT;
2369	} else if (entry->is_protected && rx->key &&
2370	entry->key_color != rx->key->color &&
2371	(status->flag & RX_FLAG_DECRYPTED)) {
2372	return RX_DROP_U_BAD_KEY_COLOR;
2373	}
2374
2375	skb_pull(skb: rx->skb, len: ieee80211_hdrlen(fc));
2376	__skb_queue_tail(list: &entry->skb_list, newsk: rx->skb);
2377	entry->last_frag = frag;
2378	entry->extra_len += rx->skb->len;
2379	if (ieee80211_has_morefrags(fc)) {
2380	rx->skb = NULL;
2381	return RX_QUEUED;
2382	}
2383
2384	rx->skb = __skb_dequeue(list: &entry->skb_list);
2385	if (skb_tailroom(skb: rx->skb) < entry->extra_len) {
2386	I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2387	if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2388	GFP_ATOMIC))) {
2389	I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2390	__skb_queue_purge(list: &entry->skb_list);
2391	return RX_DROP_U_OOM;
2392	}
2393	}
2394	while ((skb = __skb_dequeue(list: &entry->skb_list))) {
2395	skb_put_data(skb: rx->skb, data: skb->data, len: skb->len);
2396	dev_kfree_skb(skb);
2397	}
2398
2399	out:
2400	ieee80211_led_rx(local: rx->local);
2401	if (rx->sta)
2402	rx->link_sta->rx_stats.packets++;
2403	return RX_CONTINUE;
2404	}
2405
2406	static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2407	{
2408	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2409	return -EACCES;
2410
2411	return 0;
2412	}
2413
2414	static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2415	{
2416	struct sk_buff *skb = rx->skb;
2417	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2418
2419	/*
2420	* Pass through unencrypted frames if the hardware has
2421	* decrypted them already.
2422	*/
2423	if (status->flag & RX_FLAG_DECRYPTED)
2424	return 0;
2425
2426	/* Drop unencrypted frames if key is set. */
2427	if (unlikely(!ieee80211_has_protected(fc) &&
2428	!ieee80211_is_any_nullfunc(fc) &&
2429	ieee80211_is_data(fc) && rx->key))
2430	return -EACCES;
2431
2432	return 0;
2433	}
2434
2435	VISIBLE_IF_MAC80211_KUNIT ieee80211_rx_result
2436	ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2437	{
2438	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
2439	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2440	__le16 fc = mgmt->frame_control;
2441
2442	/*
2443	* Pass through unencrypted frames if the hardware has
2444	* decrypted them already.
2445	*/
2446	if (status->flag & RX_FLAG_DECRYPTED)
2447	return RX_CONTINUE;
2448
2449	/* drop unicast protected dual (that wasn't protected) */
2450	if (ieee80211_is_action(fc) &&
2451	mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
2452	return RX_DROP_U_UNPROT_DUAL;
2453
2454	if (rx->sta && test_sta_flag(sta: rx->sta, flag: WLAN_STA_MFP)) {
2455	if (unlikely(!ieee80211_has_protected(fc) &&
2456	ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {
2457	if (ieee80211_is_deauth(fc) ||
2458	ieee80211_is_disassoc(fc)) {
2459	/*
2460	* Permit unprotected deauth/disassoc frames
2461	* during 4-way-HS (key is installed after HS).
2462	*/
2463	if (!rx->key)
2464	return RX_CONTINUE;
2465
2466	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2467	buf: rx->skb->data,
2468	len: rx->skb->len);
2469	}
2470	return RX_DROP_U_UNPROT_UCAST_MGMT;
2471	}
2472	/* BIP does not use Protected field, so need to check MMIE */
2473	if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2474	ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2475	if (ieee80211_is_deauth(fc) ||
2476	ieee80211_is_disassoc(fc))
2477	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2478	buf: rx->skb->data,
2479	len: rx->skb->len);
2480	return RX_DROP_U_UNPROT_MCAST_MGMT;
2481	}
2482	if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2483	ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2484	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2485	buf: rx->skb->data,
2486	len: rx->skb->len);
2487	return RX_DROP_U_UNPROT_BEACON;
2488	}
2489	/*
2490	* When using MFP, Action frames are not allowed prior to
2491	* having configured keys.
2492	*/
2493	if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2494	ieee80211_is_robust_mgmt_frame(rx->skb)))
2495	return RX_DROP_U_UNPROT_ACTION;
2496
2497	/* drop unicast public action frames when using MPF */
2498	if (is_unicast_ether_addr(addr: mgmt->da) &&
2499	ieee80211_is_protected_dual_of_public_action(skb: rx->skb))
2500	return RX_DROP_U_UNPROT_UNICAST_PUB_ACTION;
2501	}
2502
2503	/*
2504	* Drop robust action frames before assoc regardless of MFP state,
2505	* after assoc we also have decided on MFP or not.
2506	*/
2507	if (ieee80211_is_action(fc) &&
2508	ieee80211_is_robust_mgmt_frame(skb: rx->skb) &&
2509	(!rx->sta || !test_sta_flag(sta: rx->sta, flag: WLAN_STA_ASSOC)))
2510	return RX_DROP_U_UNPROT_ROBUST_ACTION;
2511
2512	return RX_CONTINUE;
2513	}
2514	EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_drop_unencrypted_mgmt);
2515
2516	static ieee80211_rx_result
2517	__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2518	{
2519	struct ieee80211_sub_if_data *sdata = rx->sdata;
2520	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2521	bool check_port_control = false;
2522	struct ethhdr *ehdr;
2523	int ret;
2524
2525	*port_control = false;
2526	if (ieee80211_has_a4(fc: hdr->frame_control) &&
2527	sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2528	return RX_DROP_U_UNEXPECTED_VLAN_4ADDR;
2529
2530	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2531	!!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(fc: hdr->frame_control)) {
2532	if (!sdata->u.mgd.use_4addr)
2533	return RX_DROP_U_UNEXPECTED_STA_4ADDR;
2534	else if (!ether_addr_equal(addr1: hdr->addr1, addr2: sdata->vif.addr))
2535	check_port_control = true;
2536	}
2537
2538	if (is_multicast_ether_addr(addr: hdr->addr1) &&
2539	sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2540	return RX_DROP_U_UNEXPECTED_VLAN_MCAST;
2541
2542	ret = ieee80211_data_to_8023(skb: rx->skb, addr: sdata->vif.addr, iftype: sdata->vif.type);
2543	if (ret < 0)
2544	return RX_DROP_U_INVALID_8023;
2545
2546	ehdr = (struct ethhdr *) rx->skb->data;
2547	if (ehdr->h_proto == rx->sdata->control_port_protocol)
2548	*port_control = true;
2549	else if (check_port_control)
2550	return RX_DROP_U_NOT_PORT_CONTROL;
2551
2552	return RX_CONTINUE;
2553	}
2554
2555	bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
2556	const u8 *addr, int *out_link_id)
2557	{
2558	unsigned int link_id;
2559
2560	/* non-MLO, or MLD address replaced by hardware */
2561	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: addr))
2562	return true;
2563
2564	if (!ieee80211_vif_is_mld(vif: &sdata->vif))
2565	return false;
2566
2567	for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
2568	struct ieee80211_bss_conf *conf;
2569
2570	conf = rcu_dereference(sdata->vif.link_conf[link_id]);
2571
2572	if (!conf)
2573	continue;
2574	if (ether_addr_equal(addr1: conf->addr, addr2: addr)) {
2575	if (out_link_id)
2576	*out_link_id = link_id;
2577	return true;
2578	}
2579	}
2580
2581	return false;
2582	}
2583
2584	/*
2585	* requires that rx->skb is a frame with ethernet header
2586	*/
2587	static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2588	{
2589	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2590	= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2591	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2592
2593	/*
2594	* Allow EAPOL frames to us/the PAE group address regardless of
2595	* whether the frame was encrypted or not, and always disallow
2596	* all other destination addresses for them.
2597	*/
2598	if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2599	return ieee80211_is_our_addr(sdata: rx->sdata, addr: ehdr->h_dest, NULL) ||
2600	ether_addr_equal(addr1: ehdr->h_dest, addr2: pae_group_addr);
2601
2602	if (ieee80211_802_1x_port_control(rx) ||
2603	ieee80211_drop_unencrypted(rx, fc))
2604	return false;
2605
2606	return true;
2607	}
2608
2609	static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2610	struct ieee80211_rx_data *rx)
2611	{
2612	struct ieee80211_sub_if_data *sdata = rx->sdata;
2613	struct net_device *dev = sdata->dev;
2614
2615	if (unlikely((skb->protocol == sdata->control_port_protocol ||
2616	(skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2617	!sdata->control_port_no_preauth)) &&
2618	sdata->control_port_over_nl80211)) {
2619	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2620	bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2621
2622	cfg80211_rx_control_port(dev, skb, unencrypted: noencrypt, link_id: rx->link_id);
2623	dev_kfree_skb(skb);
2624	} else {
2625	struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2626
2627	memset(skb->cb, 0, sizeof(skb->cb));
2628
2629	/*
2630	* 802.1X over 802.11 requires that the authenticator address
2631	* be used for EAPOL frames. However, 802.1X allows the use of
2632	* the PAE group address instead. If the interface is part of
2633	* a bridge and we pass the frame with the PAE group address,
2634	* then the bridge will forward it to the network (even if the
2635	* client was not associated yet), which isn't supposed to
2636	* happen.
2637	* To avoid that, rewrite the destination address to our own
2638	* address, so that the authenticator (e.g. hostapd) will see
2639	* the frame, but bridge won't forward it anywhere else. Note
2640	* that due to earlier filtering, the only other address can
2641	* be the PAE group address, unless the hardware allowed them
2642	* through in 802.3 offloaded mode.
2643	*/
2644	if (unlikely(skb->protocol == sdata->control_port_protocol &&
2645	!ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2646	ether_addr_copy(dst: ehdr->h_dest, src: sdata->vif.addr);
2647
2648	/* deliver to local stack */
2649	if (rx->list)
2650	list_add_tail(new: &skb->list, head: rx->list);
2651	else
2652	netif_receive_skb(skb);
2653	}
2654	}
2655
2656	/*
2657	* requires that rx->skb is a frame with ethernet header
2658	*/
2659	static void
2660	ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2661	{
2662	struct ieee80211_sub_if_data *sdata = rx->sdata;
2663	struct net_device *dev = sdata->dev;
2664	struct sk_buff *skb, *xmit_skb;
2665	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2666	struct sta_info *dsta;
2667
2668	skb = rx->skb;
2669	xmit_skb = NULL;
2670
2671	dev_sw_netstats_rx_add(dev, len: skb->len);
2672
2673	if (rx->sta) {
2674	/* The seqno index has the same property as needed
2675	* for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2676	* for non-QoS-data frames. Here we know it's a data
2677	* frame, so count MSDUs.
2678	*/
2679	u64_stats_update_begin(syncp: &rx->link_sta->rx_stats.syncp);
2680	rx->link_sta->rx_stats.msdu[rx->seqno_idx]++;
2681	u64_stats_update_end(syncp: &rx->link_sta->rx_stats.syncp);
2682	}
2683
2684	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2685	sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2686	!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2687	ehdr->h_proto != rx->sdata->control_port_protocol &&
2688	(sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2689	if (is_multicast_ether_addr(addr: ehdr->h_dest) &&
2690	ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2691	/*
2692	* send multicast frames both to higher layers in
2693	* local net stack and back to the wireless medium
2694	*/
2695	xmit_skb = skb_copy(skb, GFP_ATOMIC);
2696	if (!xmit_skb)
2697	net_info_ratelimited("%s: failed to clone multicast frame\n",
2698	dev->name);
2699	} else if (!is_multicast_ether_addr(addr: ehdr->h_dest) &&
2700	!ether_addr_equal(addr1: ehdr->h_dest, addr2: ehdr->h_source)) {
2701	dsta = sta_info_get(sdata, addr: ehdr->h_dest);
2702	if (dsta) {
2703	/*
2704	* The destination station is associated to
2705	* this AP (in this VLAN), so send the frame
2706	* directly to it and do not pass it to local
2707	* net stack.
2708	*/
2709	xmit_skb = skb;
2710	skb = NULL;
2711	}
2712	}
2713	}
2714
2715	#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2716	if (skb) {
2717	/* 'align' will only take the values 0 or 2 here since all
2718	* frames are required to be aligned to 2-byte boundaries
2719	* when being passed to mac80211; the code here works just
2720	* as well if that isn't true, but mac80211 assumes it can
2721	* access fields as 2-byte aligned (e.g. for ether_addr_equal)
2722	*/
2723	int align;
2724
2725	align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2726	if (align) {
2727	if (WARN_ON(skb_headroom(skb) < 3)) {
2728	dev_kfree_skb(skb);
2729	skb = NULL;
2730	} else {
2731	u8 *data = skb->data;
2732	size_t len = skb_headlen(skb);
2733	skb->data -= align;
2734	memmove(skb->data, data, len);
2735	skb_set_tail_pointer(skb, len);
2736	}
2737	}
2738	}
2739	#endif
2740
2741	if (skb) {
2742	skb->protocol = eth_type_trans(skb, dev);
2743	ieee80211_deliver_skb_to_local_stack(skb, rx);
2744	}
2745
2746	if (xmit_skb) {
2747	/*
2748	* Send to wireless media and increase priority by 256 to
2749	* keep the received priority instead of reclassifying
2750	* the frame (see cfg80211_classify8021d).
2751	*/
2752	xmit_skb->priority += 256;
2753	xmit_skb->protocol = htons(ETH_P_802_3);
2754	skb_reset_network_header(skb: xmit_skb);
2755	skb_reset_mac_header(skb: xmit_skb);
2756	dev_queue_xmit(skb: xmit_skb);
2757	}
2758	}
2759
2760	#ifdef CONFIG_MAC80211_MESH
2761	static bool
2762	ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
2763	struct sk_buff *skb, int hdrlen)
2764	{
2765	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2766	struct ieee80211_mesh_fast_tx *entry = NULL;
2767	struct ieee80211s_hdr *mesh_hdr;
2768	struct tid_ampdu_tx *tid_tx;
2769	struct sta_info *sta;
2770	struct ethhdr eth;
2771	u8 tid;
2772
2773	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
2774	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2775	entry = mesh_fast_tx_get(sdata, addr: mesh_hdr->eaddr1);
2776	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
2777	entry = mesh_fast_tx_get(sdata, addr: skb->data);
2778	if (!entry)
2779	return false;
2780
2781	sta = rcu_dereference(entry->mpath->next_hop);
2782	if (!sta)
2783	return false;
2784
2785	if (skb_linearize(skb))
2786	return false;
2787
2788	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2789	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2790	if (tid_tx) {
2791	if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2792	return false;
2793
2794	if (tid_tx->timeout)
2795	tid_tx->last_tx = jiffies;
2796	}
2797
2798	ieee80211_aggr_check(sdata, sta, skb);
2799
2800	if (ieee80211_get_8023_tunnel_proto(hdr: skb->data + hdrlen,
2801	proto: &skb->protocol))
2802	hdrlen += ETH_ALEN;
2803	else
2804	skb->protocol = htons(skb->len - hdrlen);
2805	skb_set_network_header(skb, offset: hdrlen + 2);
2806
2807	skb->dev = sdata->dev;
2808	memcpy(&eth, skb->data, ETH_HLEN - 2);
2809	skb_pull(skb, len: 2);
2810	__ieee80211_xmit_fast(sdata, sta, fast_tx: &entry->fast_tx, skb, ampdu: tid_tx,
2811	da: eth.h_dest, sa: eth.h_source);
2812	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2813	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2814
2815	return true;
2816	}
2817	#endif
2818
2819	static ieee80211_rx_result
2820	ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
2821	struct sk_buff *skb)
2822	{
2823	#ifdef CONFIG_MAC80211_MESH
2824	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2825	struct ieee80211_local *local = sdata->local;
2826	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
2827	struct ieee80211_hdr hdr = {
2828	.frame_control = cpu_to_le16(fc)
2829	};
2830	struct ieee80211_hdr *fwd_hdr;
2831	struct ieee80211s_hdr *mesh_hdr;
2832	struct ieee80211_tx_info *info;
2833	struct sk_buff *fwd_skb;
2834	struct ethhdr *eth;
2835	bool multicast;
2836	int tailroom = 0;
2837	int hdrlen, mesh_hdrlen;
2838	u8 *qos;
2839
2840	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
2841	return RX_CONTINUE;
2842
2843	if (!pskb_may_pull(skb, len: sizeof(*eth) + 6))
2844	return RX_DROP_MONITOR;
2845
2846	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
2847	mesh_hdrlen = ieee80211_get_mesh_hdrlen(meshhdr: mesh_hdr);
2848
2849	if (!pskb_may_pull(skb, len: sizeof(*eth) + mesh_hdrlen))
2850	return RX_DROP_MONITOR;
2851
2852	eth = (struct ethhdr *)skb->data;
2853	multicast = is_multicast_ether_addr(addr: eth->h_dest);
2854
2855	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
2856	if (!mesh_hdr->ttl)
2857	return RX_DROP_MONITOR;
2858
2859	/* frame is in RMC, don't forward */
2860	if (is_multicast_ether_addr(addr: eth->h_dest) &&
2861	mesh_rmc_check(sdata, addr: eth->h_source, mesh_hdr))
2862	return RX_DROP_MONITOR;
2863
2864	/* forward packet */
2865	if (sdata->crypto_tx_tailroom_needed_cnt)
2866	tailroom = IEEE80211_ENCRYPT_TAILROOM;
2867
2868	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2869	struct mesh_path *mppath;
2870	char *proxied_addr;
2871	bool update = false;
2872
2873	if (multicast)
2874	proxied_addr = mesh_hdr->eaddr1;
2875	else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2876	/* has_a4 already checked in ieee80211_rx_mesh_check */
2877	proxied_addr = mesh_hdr->eaddr2;
2878	else
2879	return RX_DROP_MONITOR;
2880
2881	rcu_read_lock();
2882	mppath = mpp_path_lookup(sdata, dst: proxied_addr);
2883	if (!mppath) {
2884	mpp_path_add(sdata, dst: proxied_addr, mpp: eth->h_source);
2885	} else {
2886	spin_lock_bh(lock: &mppath->state_lock);
2887	if (!ether_addr_equal(addr1: mppath->mpp, addr2: eth->h_source)) {
2888	memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
2889	update = true;
2890	}
2891	mppath->exp_time = jiffies;
2892	spin_unlock_bh(lock: &mppath->state_lock);
2893	}
2894
2895	/* flush fast xmit cache if the address path changed */
2896	if (update)
2897	mesh_fast_tx_flush_addr(sdata, addr: proxied_addr);
2898
2899	rcu_read_unlock();
2900	}
2901
2902	/* Frame has reached destination. Don't forward */
2903	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: eth->h_dest))
2904	goto rx_accept;
2905
2906	if (!--mesh_hdr->ttl) {
2907	if (multicast)
2908	goto rx_accept;
2909
2910	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2911	return RX_DROP_MONITOR;
2912	}
2913
2914	if (!ifmsh->mshcfg.dot11MeshForwarding) {
2915	if (is_multicast_ether_addr(addr: eth->h_dest))
2916	goto rx_accept;
2917
2918	return RX_DROP_MONITOR;
2919	}
2920
2921	skb_set_queue_mapping(skb, queue_mapping: ieee802_1d_to_ac[skb->priority]);
2922
2923	if (!multicast &&
2924	ieee80211_rx_mesh_fast_forward(sdata, skb, hdrlen: mesh_hdrlen))
2925	return RX_QUEUED;
2926
2927	ieee80211_fill_mesh_addresses(hdr: &hdr, fc: &hdr.frame_control,
2928	da: eth->h_dest, sa: eth->h_source);
2929	hdrlen = ieee80211_hdrlen(fc: hdr.frame_control);
2930	if (multicast) {
2931	int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
2932
2933	fwd_skb = skb_copy_expand(skb, newheadroom: local->tx_headroom + extra_head +
2934	IEEE80211_ENCRYPT_HEADROOM,
2935	newtailroom: tailroom, GFP_ATOMIC);
2936	if (!fwd_skb)
2937	goto rx_accept;
2938	} else {
2939	fwd_skb = skb;
2940	skb = NULL;
2941
2942	if (skb_cow_head(skb: fwd_skb, headroom: hdrlen - sizeof(struct ethhdr)))
2943	return RX_DROP_U_OOM;
2944
2945	if (skb_linearize(skb: fwd_skb))
2946	return RX_DROP_U_OOM;
2947	}
2948
2949	fwd_hdr = skb_push(skb: fwd_skb, len: hdrlen - sizeof(struct ethhdr));
2950	memcpy(fwd_hdr, &hdr, hdrlen - 2);
2951	qos = ieee80211_get_qos_ctl(hdr: fwd_hdr);
2952	qos[0] = qos[1] = 0;
2953
2954	skb_reset_mac_header(skb: fwd_skb);
2955	hdrlen += mesh_hdrlen;
2956	if (ieee80211_get_8023_tunnel_proto(hdr: fwd_skb->data + hdrlen,
2957	proto: &fwd_skb->protocol))
2958	hdrlen += ETH_ALEN;
2959	else
2960	fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
2961	skb_set_network_header(skb: fwd_skb, offset: hdrlen + 2);
2962
2963	info = IEEE80211_SKB_CB(skb: fwd_skb);
2964	memset(info, 0, sizeof(*info));
2965	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
2966	info->control.vif = &sdata->vif;
2967	info->control.jiffies = jiffies;
2968	fwd_skb->dev = sdata->dev;
2969	if (multicast) {
2970	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2971	memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2972	/* update power mode indication when forwarding */
2973	ieee80211_mps_set_frame_flags(sdata, NULL, hdr: fwd_hdr);
2974	} else if (!mesh_nexthop_lookup(sdata, skb: fwd_skb)) {
2975	/* mesh power mode flags updated in mesh_nexthop_lookup */
2976	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2977	} else {
2978	/* unable to resolve next hop */
2979	if (sta)
2980	mesh_path_error_tx(sdata, ttl: ifmsh->mshcfg.element_ttl,
2981	target: hdr.addr3, target_sn: 0,
2982	target_rcode: WLAN_REASON_MESH_PATH_NOFORWARD,
2983	ra: sta->sta.addr);
2984	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2985	kfree_skb(skb: fwd_skb);
2986	goto rx_accept;
2987	}
2988
2989	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2990	ieee80211_add_pending_skb(local, skb: fwd_skb);
2991
2992	rx_accept:
2993	if (!skb)
2994	return RX_QUEUED;
2995
2996	ieee80211_strip_8023_mesh_hdr(skb);
2997	#endif
2998
2999	return RX_CONTINUE;
3000	}
3001
3002	static ieee80211_rx_result debug_noinline
3003	__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
3004	{
3005	struct net_device *dev = rx->sdata->dev;
3006	struct sk_buff *skb = rx->skb;
3007	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3008	__le16 fc = hdr->frame_control;
3009	struct sk_buff_head frame_list;
3010	ieee80211_rx_result res;
3011	struct ethhdr ethhdr;
3012	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
3013
3014	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3015	check_da = NULL;
3016	check_sa = NULL;
3017	} else switch (rx->sdata->vif.type) {
3018	case NL80211_IFTYPE_AP:
3019	case NL80211_IFTYPE_AP_VLAN:
3020	check_da = NULL;
3021	break;
3022	case NL80211_IFTYPE_STATION:
3023	if (!rx->sta ||
3024	!test_sta_flag(sta: rx->sta, flag: WLAN_STA_TDLS_PEER))
3025	check_sa = NULL;
3026	break;
3027	case NL80211_IFTYPE_MESH_POINT:
3028	check_sa = NULL;
3029	check_da = NULL;
3030	break;
3031	default:
3032	break;
3033	}
3034
3035	skb->dev = dev;
3036	__skb_queue_head_init(list: &frame_list);
3037
3038	if (ieee80211_data_to_8023_exthdr(skb, ehdr: &ethhdr,
3039	addr: rx->sdata->vif.addr,
3040	iftype: rx->sdata->vif.type,
3041	data_offset, is_amsdu: true))
3042	return RX_DROP_U_BAD_AMSDU;
3043
3044	if (rx->sta->amsdu_mesh_control < 0) {
3045	s8 valid = -1;
3046	int i;
3047
3048	for (i = 0; i <= 2; i++) {
3049	if (!ieee80211_is_valid_amsdu(skb, mesh_hdr: i))
3050	continue;
3051
3052	if (valid >= 0) {
3053	/* ambiguous */
3054	valid = -1;
3055	break;
3056	}
3057
3058	valid = i;
3059	}
3060
3061	rx->sta->amsdu_mesh_control = valid;
3062	}
3063
3064	ieee80211_amsdu_to_8023s(skb, list: &frame_list, addr: dev->dev_addr,
3065	iftype: rx->sdata->vif.type,
3066	extra_headroom: rx->local->hw.extra_tx_headroom,
3067	check_da, check_sa,
3068	mesh_control: rx->sta->amsdu_mesh_control);
3069
3070	while (!skb_queue_empty(list: &frame_list)) {
3071	rx->skb = __skb_dequeue(list: &frame_list);
3072
3073	res = ieee80211_rx_mesh_data(sdata: rx->sdata, sta: rx->sta, skb: rx->skb);
3074	switch (res) {
3075	case RX_QUEUED:
3076	continue;
3077	case RX_CONTINUE:
3078	break;
3079	default:
3080	goto free;
3081	}
3082
3083	if (!ieee80211_frame_allowed(rx, fc))
3084	goto free;
3085
3086	ieee80211_deliver_skb(rx);
3087	continue;
3088
3089	free:
3090	dev_kfree_skb(rx->skb);
3091	}
3092
3093	return RX_QUEUED;
3094	}
3095
3096	static ieee80211_rx_result debug_noinline
3097	ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
3098	{
3099	struct sk_buff *skb = rx->skb;
3100	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3101	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3102	__le16 fc = hdr->frame_control;
3103
3104	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
3105	return RX_CONTINUE;
3106
3107	if (unlikely(!ieee80211_is_data(fc)))
3108	return RX_CONTINUE;
3109
3110	if (unlikely(!ieee80211_is_data_present(fc)))
3111	return RX_DROP_MONITOR;
3112
3113	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3114	switch (rx->sdata->vif.type) {
3115	case NL80211_IFTYPE_AP_VLAN:
3116	if (!rx->sdata->u.vlan.sta)
3117	return RX_DROP_U_BAD_4ADDR;
3118	break;
3119	case NL80211_IFTYPE_STATION:
3120	if (!rx->sdata->u.mgd.use_4addr)
3121	return RX_DROP_U_BAD_4ADDR;
3122	break;
3123	case NL80211_IFTYPE_MESH_POINT:
3124	break;
3125	default:
3126	return RX_DROP_U_BAD_4ADDR;
3127	}
3128	}
3129
3130	if (is_multicast_ether_addr(addr: hdr->addr1) || !rx->sta)
3131	return RX_DROP_U_BAD_AMSDU;
3132
3133	if (rx->key) {
3134	/*
3135	* We should not receive A-MSDUs on pre-HT connections,
3136	* and HT connections cannot use old ciphers. Thus drop
3137	* them, as in those cases we couldn't even have SPP
3138	* A-MSDUs or such.
3139	*/
3140	switch (rx->key->conf.cipher) {
3141	case WLAN_CIPHER_SUITE_WEP40:
3142	case WLAN_CIPHER_SUITE_WEP104:
3143	case WLAN_CIPHER_SUITE_TKIP:
3144	return RX_DROP_U_BAD_AMSDU_CIPHER;
3145	default:
3146	break;
3147	}
3148	}
3149
3150	return __ieee80211_rx_h_amsdu(rx, data_offset: 0);
3151	}
3152
3153	static ieee80211_rx_result debug_noinline
3154	ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
3155	{
3156	struct ieee80211_sub_if_data *sdata = rx->sdata;
3157	struct ieee80211_local *local = rx->local;
3158	struct net_device *dev = sdata->dev;
3159	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3160	__le16 fc = hdr->frame_control;
3161	ieee80211_rx_result res;
3162	bool port_control;
3163
3164	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
3165	return RX_CONTINUE;
3166
3167	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3168	return RX_DROP_MONITOR;
3169
3170	/*
3171	* Send unexpected-4addr-frame event to hostapd. For older versions,
3172	* also drop the frame to cooked monitor interfaces.
3173	*/
3174	if (ieee80211_has_a4(fc: hdr->frame_control) &&
3175	sdata->vif.type == NL80211_IFTYPE_AP) {
3176	if (rx->sta &&
3177	!test_and_set_sta_flag(sta: rx->sta, flag: WLAN_STA_4ADDR_EVENT))
3178	cfg80211_rx_unexpected_4addr_frame(
3179	dev: rx->sdata->dev, addr: rx->sta->sta.addr, GFP_ATOMIC);
3180	return RX_DROP_MONITOR;
3181	}
3182
3183	res = __ieee80211_data_to_8023(rx, port_control: &port_control);
3184	if (unlikely(res != RX_CONTINUE))
3185	return res;
3186
3187	res = ieee80211_rx_mesh_data(sdata: rx->sdata, sta: rx->sta, skb: rx->skb);
3188	if (res != RX_CONTINUE)
3189	return res;
3190
3191	if (!ieee80211_frame_allowed(rx, fc))
3192	return RX_DROP_MONITOR;
3193
3194	/* directly handle TDLS channel switch requests/responses */
3195	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3196	cpu_to_be16(ETH_P_TDLS))) {
3197	struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3198
3199	if (pskb_may_pull(skb: rx->skb,
3200	offsetof(struct ieee80211_tdls_data, u)) &&
3201	tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3202	tf->category == WLAN_CATEGORY_TDLS &&
3203	(tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3204	tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
3205	rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3206	__ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id,
3207	sta: rx->sta, skb: rx->skb);
3208	return RX_QUEUED;
3209	}
3210	}
3211
3212	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3213	unlikely(port_control) && sdata->bss) {
3214	sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3215	u.ap);
3216	dev = sdata->dev;
3217	rx->sdata = sdata;
3218	}
3219
3220	rx->skb->dev = dev;
3221
3222	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3223	local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3224	!is_multicast_ether_addr(
3225	addr: ((struct ethhdr *)rx->skb->data)->h_dest) &&
3226	(!local->scanning &&
3227	!test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3228	mod_timer(timer: &local->dynamic_ps_timer, expires: jiffies +
3229	msecs_to_jiffies(m: local->hw.conf.dynamic_ps_timeout));
3230
3231	ieee80211_deliver_skb(rx);
3232
3233	return RX_QUEUED;
3234	}
3235
3236	static ieee80211_rx_result debug_noinline
3237	ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3238	{
3239	struct sk_buff *skb = rx->skb;
3240	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3241	struct tid_ampdu_rx *tid_agg_rx;
3242	u16 start_seq_num;
3243	u16 tid;
3244
3245	if (likely(!ieee80211_is_ctl(bar->frame_control)))
3246	return RX_CONTINUE;
3247
3248	if (ieee80211_is_back_req(fc: bar->frame_control)) {
3249	struct {
3250	__le16 control, start_seq_num;
3251	} __packed bar_data;
3252	struct ieee80211_event event = {
3253	.type = BAR_RX_EVENT,
3254	};
3255
3256	if (!rx->sta)
3257	return RX_DROP_MONITOR;
3258
3259	if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3260	to: &bar_data, len: sizeof(bar_data)))
3261	return RX_DROP_MONITOR;
3262
3263	tid = le16_to_cpu(bar_data.control) >> 12;
3264
3265	if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3266	!test_and_set_bit(nr: tid, addr: rx->sta->ampdu_mlme.unexpected_agg))
3267	ieee80211_send_delba(sdata: rx->sdata, da: rx->sta->sta.addr, tid,
3268	initiator: WLAN_BACK_RECIPIENT,
3269	reason_code: WLAN_REASON_QSTA_REQUIRE_SETUP);
3270
3271	tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3272	if (!tid_agg_rx)
3273	return RX_DROP_MONITOR;
3274
3275	start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3276	event.u.ba.tid = tid;
3277	event.u.ba.ssn = start_seq_num;
3278	event.u.ba.sta = &rx->sta->sta;
3279
3280	/* reset session timer */
3281	if (tid_agg_rx->timeout)
3282	mod_timer(timer: &tid_agg_rx->session_timer,
3283	TU_TO_EXP_TIME(tid_agg_rx->timeout));
3284
3285	spin_lock(lock: &tid_agg_rx->reorder_lock);
3286	/* release stored frames up to start of BAR */
3287	ieee80211_release_reorder_frames(sdata: rx->sdata, tid_agg_rx,
3288	head_seq_num: start_seq_num, frames);
3289	spin_unlock(lock: &tid_agg_rx->reorder_lock);
3290
3291	drv_event_callback(local: rx->local, sdata: rx->sdata, event: &event);
3292
3293	kfree_skb(skb);
3294	return RX_QUEUED;
3295	}
3296
3297	/*
3298	* After this point, we only want management frames,
3299	* so we can drop all remaining control frames to
3300	* cooked monitor interfaces.
3301	*/
3302	return RX_DROP_MONITOR;
3303	}
3304
3305	static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3306	struct ieee80211_mgmt *mgmt,
3307	size_t len)
3308	{
3309	struct ieee80211_local *local = sdata->local;
3310	struct sk_buff *skb;
3311	struct ieee80211_mgmt *resp;
3312
3313	if (!ether_addr_equal(addr1: mgmt->da, addr2: sdata->vif.addr)) {
3314	/* Not to own unicast address */
3315	return;
3316	}
3317
3318	if (!ether_addr_equal(addr1: mgmt->sa, addr2: sdata->deflink.u.mgd.bssid) ||
3319	!ether_addr_equal(addr1: mgmt->bssid, addr2: sdata->deflink.u.mgd.bssid)) {
3320	/* Not from the current AP or not associated yet. */
3321	return;
3322	}
3323
3324	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
3325	/* Too short SA Query request frame */
3326	return;
3327	}
3328
3329	skb = dev_alloc_skb(length: sizeof(*resp) + local->hw.extra_tx_headroom);
3330	if (skb == NULL)
3331	return;
3332
3333	skb_reserve(skb, len: local->hw.extra_tx_headroom);
3334	resp = skb_put_zero(skb, len: 24);
3335	memcpy(resp->da, mgmt->sa, ETH_ALEN);
3336	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3337	memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
3338	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3339	IEEE80211_STYPE_ACTION);
3340	skb_put(skb, len: 1 + sizeof(resp->u.action.u.sa_query));
3341	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3342	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
3343	memcpy(resp->u.action.u.sa_query.trans_id,
3344	mgmt->u.action.u.sa_query.trans_id,
3345	WLAN_SA_QUERY_TR_ID_LEN);
3346
3347	ieee80211_tx_skb(sdata, skb);
3348	}
3349
3350	static void
3351	ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3352	{
3353	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3354	const struct element *ie;
3355	size_t baselen;
3356
3357	if (!wiphy_ext_feature_isset(wiphy: rx->local->hw.wiphy,
3358	ftidx: NL80211_EXT_FEATURE_BSS_COLOR))
3359	return;
3360
3361	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3362	return;
3363
3364	if (rx->sdata->vif.bss_conf.csa_active)
3365	return;
3366
3367	baselen = mgmt->u.beacon.variable - rx->skb->data;
3368	if (baselen > rx->skb->len)
3369	return;
3370
3371	ie = cfg80211_find_ext_elem(ext_eid: WLAN_EID_EXT_HE_OPERATION,
3372	ies: mgmt->u.beacon.variable,
3373	len: rx->skb->len - baselen);
3374	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3375	ie->datalen >= ieee80211_he_oper_size(he_oper_ie: ie->data + 1)) {
3376	struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
3377	const struct ieee80211_he_operation *he_oper;
3378	u8 color;
3379
3380	he_oper = (void *)(ie->data + 1);
3381	if (le32_get_bits(v: he_oper->he_oper_params,
3382	IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3383	return;
3384
3385	color = le32_get_bits(v: he_oper->he_oper_params,
3386	IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3387	if (color == bss_conf->he_bss_color.color)
3388	ieee80211_obss_color_collision_notify(vif: &rx->sdata->vif,
3389	BIT_ULL(color));
3390	}
3391	}
3392
3393	static ieee80211_rx_result debug_noinline
3394	ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3395	{
3396	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3397	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3398
3399	if (ieee80211_is_s1g_beacon(fc: mgmt->frame_control))
3400	return RX_CONTINUE;
3401
3402	/*
3403	* From here on, look only at management frames.
3404	* Data and control frames are already handled,
3405	* and unknown (reserved) frames are useless.
3406	*/
3407	if (rx->skb->len < 24)
3408	return RX_DROP_MONITOR;
3409
3410	if (!ieee80211_is_mgmt(fc: mgmt->frame_control))
3411	return RX_DROP_MONITOR;
3412
3413	/* drop too small action frames */
3414	if (ieee80211_is_action(fc: mgmt->frame_control) &&
3415	rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
3416	return RX_DROP_U_RUNT_ACTION;
3417
3418	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3419	ieee80211_is_beacon(fc: mgmt->frame_control) &&
3420	!(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3421	int sig = 0;
3422
3423	/* sw bss color collision detection */
3424	ieee80211_rx_check_bss_color_collision(rx);
3425
3426	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3427	!(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3428	sig = status->signal;
3429
3430	cfg80211_report_obss_beacon_khz(wiphy: rx->local->hw.wiphy,
3431	frame: rx->skb->data, len: rx->skb->len,
3432	freq: ieee80211_rx_status_to_khz(rx_status: status),
3433	sig_dbm: sig);
3434	rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3435	}
3436
3437	return ieee80211_drop_unencrypted_mgmt(rx);
3438	}
3439
3440	static bool
3441	ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3442	{
3443	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
3444	struct ieee80211_sub_if_data *sdata = rx->sdata;
3445
3446	/* TWT actions are only supported in AP for the moment */
3447	if (sdata->vif.type != NL80211_IFTYPE_AP)
3448	return false;
3449
3450	if (!rx->local->ops->add_twt_setup)
3451	return false;
3452
3453	if (!sdata->vif.bss_conf.twt_responder)
3454	return false;
3455
3456	if (!rx->sta)
3457	return false;
3458
3459	switch (mgmt->u.action.u.s1g.action_code) {
3460	case WLAN_S1G_TWT_SETUP: {
3461	struct ieee80211_twt_setup *twt;
3462
3463	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3464	1 + /* action code */
3465	sizeof(struct ieee80211_twt_setup) +
3466	2 /* TWT req_type agrt */)
3467	break;
3468
3469	twt = (void *)mgmt->u.action.u.s1g.variable;
3470	if (twt->element_id != WLAN_EID_S1G_TWT)
3471	break;
3472
3473	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3474	4 + /* action code + token + tlv */
3475	twt->length)
3476	break;
3477
3478	return true; /* queue the frame */
3479	}
3480	case WLAN_S1G_TWT_TEARDOWN:
3481	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
3482	break;
3483
3484	return true; /* queue the frame */
3485	default:
3486	break;
3487	}
3488
3489	return false;
3490	}
3491
3492	static ieee80211_rx_result debug_noinline
3493	ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3494	{
3495	struct ieee80211_local *local = rx->local;
3496	struct ieee80211_sub_if_data *sdata = rx->sdata;
3497	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3498	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3499	int len = rx->skb->len;
3500
3501	if (!ieee80211_is_action(fc: mgmt->frame_control))
3502	return RX_CONTINUE;
3503
3504	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3505	mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3506	mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3507	return RX_DROP_U_ACTION_UNKNOWN_SRC;
3508
3509	switch (mgmt->u.action.category) {
3510	case WLAN_CATEGORY_HT:
3511	/* reject HT action frames from stations not supporting HT */
3512	if (!rx->link_sta->pub->ht_cap.ht_supported)
3513	goto invalid;
3514
3515	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3516	sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3517	sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3518	sdata->vif.type != NL80211_IFTYPE_AP &&
3519	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3520	break;
3521
3522	/* verify action & smps_control/chanwidth are present */
3523	if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3524	goto invalid;
3525
3526	switch (mgmt->u.action.u.ht_smps.action) {
3527	case WLAN_HT_ACTION_SMPS: {
3528	struct ieee80211_supported_band *sband;
3529	enum ieee80211_smps_mode smps_mode;
3530	struct sta_opmode_info sta_opmode = {};
3531
3532	if (sdata->vif.type != NL80211_IFTYPE_AP &&
3533	sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3534	goto handled;
3535
3536	/* convert to HT capability */
3537	switch (mgmt->u.action.u.ht_smps.smps_control) {
3538	case WLAN_HT_SMPS_CONTROL_DISABLED:
3539	smps_mode = IEEE80211_SMPS_OFF;
3540	break;
3541	case WLAN_HT_SMPS_CONTROL_STATIC:
3542	smps_mode = IEEE80211_SMPS_STATIC;
3543	break;
3544	case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3545	smps_mode = IEEE80211_SMPS_DYNAMIC;
3546	break;
3547	default:
3548	goto invalid;
3549	}
3550
3551	/* if no change do nothing */
3552	if (rx->link_sta->pub->smps_mode == smps_mode)
3553	goto handled;
3554	rx->link_sta->pub->smps_mode = smps_mode;
3555	sta_opmode.smps_mode =
3556	ieee80211_smps_mode_to_smps_mode(smps: smps_mode);
3557	sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3558
3559	sband = rx->local->hw.wiphy->bands[status->band];
3560
3561	rate_control_rate_update(local, sband, sta: rx->sta, link_id: 0,
3562	changed: IEEE80211_RC_SMPS_CHANGED);
3563	cfg80211_sta_opmode_change_notify(dev: sdata->dev,
3564	mac: rx->sta->addr,
3565	sta_opmode: &sta_opmode,
3566	GFP_ATOMIC);
3567	goto handled;
3568	}
3569	case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3570	struct ieee80211_supported_band *sband;
3571	u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
3572	enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
3573	struct sta_opmode_info sta_opmode = {};
3574
3575	/* If it doesn't support 40 MHz it can't change ... */
3576	if (!(rx->link_sta->pub->ht_cap.cap &
3577	IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3578	goto handled;
3579
3580	if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
3581	max_bw = IEEE80211_STA_RX_BW_20;
3582	else
3583	max_bw = ieee80211_sta_cap_rx_bw(link_sta: rx->link_sta);
3584
3585	/* set cur_max_bandwidth and recalc sta bw */
3586	rx->link_sta->cur_max_bandwidth = max_bw;
3587	new_bw = ieee80211_sta_cur_vht_bw(link_sta: rx->link_sta);
3588
3589	if (rx->link_sta->pub->bandwidth == new_bw)
3590	goto handled;
3591
3592	rx->link_sta->pub->bandwidth = new_bw;
3593	sband = rx->local->hw.wiphy->bands[status->band];
3594	sta_opmode.bw =
3595	ieee80211_sta_rx_bw_to_chan_width(sta: rx->link_sta);
3596	sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
3597
3598	rate_control_rate_update(local, sband, sta: rx->sta, link_id: 0,
3599	changed: IEEE80211_RC_BW_CHANGED);
3600	cfg80211_sta_opmode_change_notify(dev: sdata->dev,
3601	mac: rx->sta->addr,
3602	sta_opmode: &sta_opmode,
3603	GFP_ATOMIC);
3604	goto handled;
3605	}
3606	default:
3607	goto invalid;
3608	}
3609
3610	break;
3611	case WLAN_CATEGORY_PUBLIC:
3612	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3613	goto invalid;
3614	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3615	break;
3616	if (!rx->sta)
3617	break;
3618	if (!ether_addr_equal(addr1: mgmt->bssid, addr2: sdata->deflink.u.mgd.bssid))
3619	break;
3620	if (mgmt->u.action.u.ext_chan_switch.action_code !=
3621	WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3622	break;
3623	if (len < offsetof(struct ieee80211_mgmt,
3624	u.action.u.ext_chan_switch.variable))
3625	goto invalid;
3626	goto queue;
3627	case WLAN_CATEGORY_VHT:
3628	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3629	sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3630	sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3631	sdata->vif.type != NL80211_IFTYPE_AP &&
3632	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3633	break;
3634
3635	/* verify action code is present */
3636	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3637	goto invalid;
3638
3639	switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
3640	case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3641	/* verify opmode is present */
3642	if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3643	goto invalid;
3644	goto queue;
3645	}
3646	case WLAN_VHT_ACTION_GROUPID_MGMT: {
3647	if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3648	goto invalid;
3649	goto queue;
3650	}
3651	default:
3652	break;
3653	}
3654	break;
3655	case WLAN_CATEGORY_BACK:
3656	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3657	sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3658	sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3659	sdata->vif.type != NL80211_IFTYPE_AP &&
3660	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3661	break;
3662
3663	/* verify action_code is present */
3664	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3665	break;
3666
3667	switch (mgmt->u.action.u.addba_req.action_code) {
3668	case WLAN_ACTION_ADDBA_REQ:
3669	if (len < (IEEE80211_MIN_ACTION_SIZE +
3670	sizeof(mgmt->u.action.u.addba_req)))
3671	goto invalid;
3672	break;
3673	case WLAN_ACTION_ADDBA_RESP:
3674	if (len < (IEEE80211_MIN_ACTION_SIZE +
3675	sizeof(mgmt->u.action.u.addba_resp)))
3676	goto invalid;
3677	break;
3678	case WLAN_ACTION_DELBA:
3679	if (len < (IEEE80211_MIN_ACTION_SIZE +
3680	sizeof(mgmt->u.action.u.delba)))
3681	goto invalid;
3682	break;
3683	default:
3684	goto invalid;
3685	}
3686
3687	goto queue;
3688	case WLAN_CATEGORY_SPECTRUM_MGMT:
3689	/* verify action_code is present */
3690	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3691	break;
3692
3693	switch (mgmt->u.action.u.measurement.action_code) {
3694	case WLAN_ACTION_SPCT_MSR_REQ:
3695	if (status->band != NL80211_BAND_5GHZ)
3696	break;
3697
3698	if (len < (IEEE80211_MIN_ACTION_SIZE +
3699	sizeof(mgmt->u.action.u.measurement)))
3700	break;
3701
3702	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3703	break;
3704
3705	ieee80211_process_measurement_req(sdata, mgmt, len);
3706	goto handled;
3707	case WLAN_ACTION_SPCT_CHL_SWITCH: {
3708	u8 *bssid;
3709	if (len < (IEEE80211_MIN_ACTION_SIZE +
3710	sizeof(mgmt->u.action.u.chan_switch)))
3711	break;
3712
3713	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3714	sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3715	sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3716	break;
3717
3718	if (sdata->vif.type == NL80211_IFTYPE_STATION)
3719	bssid = sdata->deflink.u.mgd.bssid;
3720	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3721	bssid = sdata->u.ibss.bssid;
3722	else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3723	bssid = mgmt->sa;
3724	else
3725	break;
3726
3727	if (!ether_addr_equal(addr1: mgmt->bssid, addr2: bssid))
3728	break;
3729
3730	goto queue;
3731	}
3732	}
3733	break;
3734	case WLAN_CATEGORY_SELF_PROTECTED:
3735	if (len < (IEEE80211_MIN_ACTION_SIZE +
3736	sizeof(mgmt->u.action.u.self_prot.action_code)))
3737	break;
3738
3739	switch (mgmt->u.action.u.self_prot.action_code) {
3740	case WLAN_SP_MESH_PEERING_OPEN:
3741	case WLAN_SP_MESH_PEERING_CLOSE:
3742	case WLAN_SP_MESH_PEERING_CONFIRM:
3743	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
3744	goto invalid;
3745	if (sdata->u.mesh.user_mpm)
3746	/* userspace handles this frame */
3747	break;
3748	goto queue;
3749	case WLAN_SP_MGK_INFORM:
3750	case WLAN_SP_MGK_ACK:
3751	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
3752	goto invalid;
3753	break;
3754	}
3755	break;
3756	case WLAN_CATEGORY_MESH_ACTION:
3757	if (len < (IEEE80211_MIN_ACTION_SIZE +
3758	sizeof(mgmt->u.action.u.mesh_action.action_code)))
3759	break;
3760
3761	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
3762	break;
3763	if (mesh_action_is_path_sel(mgmt) &&
3764	!mesh_path_sel_is_hwmp(sdata))
3765	break;
3766	goto queue;
3767	case WLAN_CATEGORY_S1G:
3768	if (len < offsetofend(typeof(*mgmt),
3769	u.action.u.s1g.action_code))
3770	break;
3771
3772	switch (mgmt->u.action.u.s1g.action_code) {
3773	case WLAN_S1G_TWT_SETUP:
3774	case WLAN_S1G_TWT_TEARDOWN:
3775	if (ieee80211_process_rx_twt_action(rx))
3776	goto queue;
3777	break;
3778	default:
3779	break;
3780	}
3781	break;
3782	case WLAN_CATEGORY_PROTECTED_EHT:
3783	switch (mgmt->u.action.u.ttlm_req.action_code) {
3784	case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
3785	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3786	break;
3787
3788	if (len < offsetofend(typeof(*mgmt),
3789	u.action.u.ttlm_req))
3790	goto invalid;
3791	goto queue;
3792	case WLAN_PROTECTED_EHT_ACTION_TTLM_RES:
3793	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3794	break;
3795
3796	if (len < offsetofend(typeof(*mgmt),
3797	u.action.u.ttlm_res))
3798	goto invalid;
3799	goto queue;
3800	default:
3801	break;
3802	}
3803	break;
3804	}
3805
3806	return RX_CONTINUE;
3807
3808	invalid:
3809	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3810	/* will return in the next handlers */
3811	return RX_CONTINUE;
3812
3813	handled:
3814	if (rx->sta)
3815	rx->link_sta->rx_stats.packets++;
3816	dev_kfree_skb(rx->skb);
3817	return RX_QUEUED;
3818
3819	queue:
3820	ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id, sta: rx->sta, skb: rx->skb);
3821	return RX_QUEUED;
3822	}
3823
3824	static ieee80211_rx_result debug_noinline
3825	ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3826	{
3827	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3828	struct cfg80211_rx_info info = {
3829	.freq = ieee80211_rx_status_to_khz(rx_status: status),
3830	.buf = rx->skb->data,
3831	.len = rx->skb->len,
3832	.link_id = rx->link_id,
3833	.have_link_id = rx->link_id >= 0,
3834	};
3835
3836	/* skip known-bad action frames and return them in the next handler */
3837	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3838	return RX_CONTINUE;
3839
3840	/*
3841	* Getting here means the kernel doesn't know how to handle
3842	* it, but maybe userspace does ... include returned frames
3843	* so userspace can register for those to know whether ones
3844	* it transmitted were processed or returned.
3845	*/
3846
3847	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3848	!(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3849	info.sig_dbm = status->signal;
3850
3851	if (ieee80211_is_timing_measurement(skb: rx->skb) ||
3852	ieee80211_is_ftm(skb: rx->skb)) {
3853	info.rx_tstamp = ktime_to_ns(kt: skb_hwtstamps(skb: rx->skb)->hwtstamp);
3854	info.ack_tstamp = ktime_to_ns(kt: status->ack_tx_hwtstamp);
3855	}
3856
3857	if (cfg80211_rx_mgmt_ext(wdev: &rx->sdata->wdev, info: &info)) {
3858	if (rx->sta)
3859	rx->link_sta->rx_stats.packets++;
3860	dev_kfree_skb(rx->skb);
3861	return RX_QUEUED;
3862	}
3863
3864	return RX_CONTINUE;
3865	}
3866
3867	static ieee80211_rx_result debug_noinline
3868	ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
3869	{
3870	struct ieee80211_sub_if_data *sdata = rx->sdata;
3871	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3872	int len = rx->skb->len;
3873
3874	if (!ieee80211_is_action(fc: mgmt->frame_control))
3875	return RX_CONTINUE;
3876
3877	switch (mgmt->u.action.category) {
3878	case WLAN_CATEGORY_SA_QUERY:
3879	if (len < (IEEE80211_MIN_ACTION_SIZE +
3880	sizeof(mgmt->u.action.u.sa_query)))
3881	break;
3882
3883	switch (mgmt->u.action.u.sa_query.action) {
3884	case WLAN_ACTION_SA_QUERY_REQUEST:
3885	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3886	break;
3887	ieee80211_process_sa_query_req(sdata, mgmt, len);
3888	goto handled;
3889	}
3890	break;
3891	}
3892
3893	return RX_CONTINUE;
3894
3895	handled:
3896	if (rx->sta)
3897	rx->link_sta->rx_stats.packets++;
3898	dev_kfree_skb(rx->skb);
3899	return RX_QUEUED;
3900	}
3901
3902	static ieee80211_rx_result debug_noinline
3903	ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3904	{
3905	struct ieee80211_local *local = rx->local;
3906	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3907	struct sk_buff *nskb;
3908	struct ieee80211_sub_if_data *sdata = rx->sdata;
3909	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3910
3911	if (!ieee80211_is_action(fc: mgmt->frame_control))
3912	return RX_CONTINUE;
3913
3914	/*
3915	* For AP mode, hostapd is responsible for handling any action
3916	* frames that we didn't handle, including returning unknown
3917	* ones. For all other modes we will return them to the sender,
3918	* setting the 0x80 bit in the action category, as required by
3919	* 802.11-2012 9.24.4.
3920	* Newer versions of hostapd shall also use the management frame
3921	* registration mechanisms, but older ones still use cooked
3922	* monitor interfaces so push all frames there.
3923	*/
3924	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3925	(sdata->vif.type == NL80211_IFTYPE_AP ||
3926	sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3927	return RX_DROP_MONITOR;
3928
3929	if (is_multicast_ether_addr(addr: mgmt->da))
3930	return RX_DROP_MONITOR;
3931
3932	/* do not return rejected action frames */
3933	if (mgmt->u.action.category & 0x80)
3934	return RX_DROP_U_REJECTED_ACTION_RESPONSE;
3935
3936	nskb = skb_copy_expand(skb: rx->skb, newheadroom: local->hw.extra_tx_headroom, newtailroom: 0,
3937	GFP_ATOMIC);
3938	if (nskb) {
3939	struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3940
3941	nmgmt->u.action.category |= 0x80;
3942	memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3943	memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3944
3945	memset(nskb->cb, 0, sizeof(nskb->cb));
3946
3947	if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3948	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb: nskb);
3949
3950	info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3951	IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3952	IEEE80211_TX_CTL_NO_CCK_RATE;
3953	if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3954	info->hw_queue =
3955	local->hw.offchannel_tx_hw_queue;
3956	}
3957
3958	__ieee80211_tx_skb_tid_band(sdata: rx->sdata, skb: nskb, tid: 7, link_id: -1,
3959	band: status->band);
3960	}
3961	dev_kfree_skb(rx->skb);
3962	return RX_QUEUED;
3963	}
3964
3965	static ieee80211_rx_result debug_noinline
3966	ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
3967	{
3968	struct ieee80211_sub_if_data *sdata = rx->sdata;
3969	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
3970
3971	if (!ieee80211_is_ext(fc: hdr->frame_control))
3972	return RX_CONTINUE;
3973
3974	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3975	return RX_DROP_MONITOR;
3976
3977	/* for now only beacons are ext, so queue them */
3978	ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id, sta: rx->sta, skb: rx->skb);
3979
3980	return RX_QUEUED;
3981	}
3982
3983	static ieee80211_rx_result debug_noinline
3984	ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3985	{
3986	struct ieee80211_sub_if_data *sdata = rx->sdata;
3987	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3988	__le16 stype;
3989
3990	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3991
3992	if (!ieee80211_vif_is_mesh(vif: &sdata->vif) &&
3993	sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3994	sdata->vif.type != NL80211_IFTYPE_OCB &&
3995	sdata->vif.type != NL80211_IFTYPE_STATION)
3996	return RX_DROP_MONITOR;
3997
3998	switch (stype) {
3999	case cpu_to_le16(IEEE80211_STYPE_AUTH):
4000	case cpu_to_le16(IEEE80211_STYPE_BEACON):
4001	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
4002	/* process for all: mesh, mlme, ibss */
4003	break;
4004	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
4005	if (is_multicast_ether_addr(addr: mgmt->da) &&
4006	!is_broadcast_ether_addr(addr: mgmt->da))
4007	return RX_DROP_MONITOR;
4008
4009	/* process only for station/IBSS */
4010	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
4011	sdata->vif.type != NL80211_IFTYPE_ADHOC)
4012	return RX_DROP_MONITOR;
4013	break;
4014	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
4015	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
4016	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
4017	if (is_multicast_ether_addr(addr: mgmt->da) &&
4018	!is_broadcast_ether_addr(addr: mgmt->da))
4019	return RX_DROP_MONITOR;
4020
4021	/* process only for station */
4022	if (sdata->vif.type != NL80211_IFTYPE_STATION)
4023	return RX_DROP_MONITOR;
4024	break;
4025	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
4026	/* process only for ibss and mesh */
4027	if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4028	sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
4029	return RX_DROP_MONITOR;
4030	break;
4031	default:
4032	return RX_DROP_MONITOR;
4033	}
4034
4035	ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id, sta: rx->sta, skb: rx->skb);
4036
4037	return RX_QUEUED;
4038	}
4039
4040	static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
4041	struct ieee80211_rate *rate,
4042	ieee80211_rx_result reason)
4043	{
4044	struct ieee80211_sub_if_data *sdata;
4045	struct ieee80211_local *local = rx->local;
4046	struct sk_buff *skb = rx->skb, *skb2;
4047	struct net_device *prev_dev = NULL;
4048	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4049	int needed_headroom;
4050
4051	/*
4052	* If cooked monitor has been processed already, then
4053	* don't do it again. If not, set the flag.
4054	*/
4055	if (rx->flags & IEEE80211_RX_CMNTR)
4056	goto out_free_skb;
4057	rx->flags |= IEEE80211_RX_CMNTR;
4058
4059	/* If there are no cooked monitor interfaces, just free the SKB */
4060	if (!local->cooked_mntrs)
4061	goto out_free_skb;
4062
4063	/* room for the radiotap header based on driver features */
4064	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
4065
4066	if (skb_headroom(skb) < needed_headroom &&
4067	pskb_expand_head(skb, nhead: needed_headroom, ntail: 0, GFP_ATOMIC))
4068	goto out_free_skb;
4069
4070	/* prepend radiotap information */
4071	ieee80211_add_rx_radiotap_header(local, skb, rate, rtap_len: needed_headroom,
4072	has_fcs: false);
4073
4074	skb_reset_mac_header(skb);
4075	skb->ip_summed = CHECKSUM_UNNECESSARY;
4076	skb->pkt_type = PACKET_OTHERHOST;
4077	skb->protocol = htons(ETH_P_802_2);
4078
4079	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4080	if (!ieee80211_sdata_running(sdata))
4081	continue;
4082
4083	if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
4084	!(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
4085	continue;
4086
4087	if (prev_dev) {
4088	skb2 = skb_clone(skb, GFP_ATOMIC);
4089	if (skb2) {
4090	skb2->dev = prev_dev;
4091	netif_receive_skb(skb: skb2);
4092	}
4093	}
4094
4095	prev_dev = sdata->dev;
4096	dev_sw_netstats_rx_add(dev: sdata->dev, len: skb->len);
4097	}
4098
4099	if (prev_dev) {
4100	skb->dev = prev_dev;
4101	netif_receive_skb(skb);
4102	return;
4103	}
4104
4105	out_free_skb:
4106	kfree_skb_reason(skb, reason: (__force u32)reason);
4107	}
4108
4109	static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
4110	ieee80211_rx_result res)
4111	{
4112	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
4113	struct ieee80211_supported_band *sband;
4114	struct ieee80211_rate *rate = NULL;
4115
4116	if (res == RX_QUEUED) {
4117	I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
4118	return;
4119	}
4120
4121	if (res != RX_CONTINUE) {
4122	I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
4123	if (rx->sta)
4124	rx->link_sta->rx_stats.dropped++;
4125	}
4126
4127	if (u32_get_bits(v: (__force u32)res, field: SKB_DROP_REASON_SUBSYS_MASK) ==
4128	SKB_DROP_REASON_SUBSYS_MAC80211_UNUSABLE) {
4129	kfree_skb_reason(skb: rx->skb, reason: (__force u32)res);
4130	return;
4131	}
4132
4133	sband = rx->local->hw.wiphy->bands[status->band];
4134	if (status->encoding == RX_ENC_LEGACY)
4135	rate = &sband->bitrates[status->rate_idx];
4136
4137	ieee80211_rx_cooked_monitor(rx, rate, reason: res);
4138	}
4139
4140	static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
4141	struct sk_buff_head *frames)
4142	{
4143	ieee80211_rx_result res = RX_DROP_MONITOR;
4144	struct sk_buff *skb;
4145
4146	#define CALL_RXH(rxh) \
4147	do { \
4148	res = rxh(rx); \
4149	if (res != RX_CONTINUE) \
4150	goto rxh_next; \
4151	} while (0)
4152
4153	/* Lock here to avoid hitting all of the data used in the RX
4154	* path (e.g. key data, station data, ...) concurrently when
4155	* a frame is released from the reorder buffer due to timeout
4156	* from the timer, potentially concurrently with RX from the
4157	* driver.
4158	*/
4159	spin_lock_bh(lock: &rx->local->rx_path_lock);
4160
4161	while ((skb = __skb_dequeue(list: frames))) {
4162	/*
4163	* all the other fields are valid across frames
4164	* that belong to an aMPDU since they are on the
4165	* same TID from the same station
4166	*/
4167	rx->skb = skb;
4168
4169	if (WARN_ON_ONCE(!rx->link))
4170	goto rxh_next;
4171
4172	CALL_RXH(ieee80211_rx_h_check_more_data);
4173	CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
4174	CALL_RXH(ieee80211_rx_h_sta_process);
4175	CALL_RXH(ieee80211_rx_h_decrypt);
4176	CALL_RXH(ieee80211_rx_h_defragment);
4177	CALL_RXH(ieee80211_rx_h_michael_mic_verify);
4178	/* must be after MMIC verify so header is counted in MPDU mic */
4179	CALL_RXH(ieee80211_rx_h_amsdu);
4180	CALL_RXH(ieee80211_rx_h_data);
4181
4182	/* special treatment -- needs the queue */
4183	res = ieee80211_rx_h_ctrl(rx, frames);
4184	if (res != RX_CONTINUE)
4185	goto rxh_next;
4186
4187	CALL_RXH(ieee80211_rx_h_mgmt_check);
4188	CALL_RXH(ieee80211_rx_h_action);
4189	CALL_RXH(ieee80211_rx_h_userspace_mgmt);
4190	CALL_RXH(ieee80211_rx_h_action_post_userspace);
4191	CALL_RXH(ieee80211_rx_h_action_return);
4192	CALL_RXH(ieee80211_rx_h_ext);
4193	CALL_RXH(ieee80211_rx_h_mgmt);
4194
4195	rxh_next:
4196	ieee80211_rx_handlers_result(rx, res);
4197
4198	#undef CALL_RXH
4199	}
4200
4201	spin_unlock_bh(lock: &rx->local->rx_path_lock);
4202	}
4203
4204	static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
4205	{
4206	struct sk_buff_head reorder_release;
4207	ieee80211_rx_result res = RX_DROP_MONITOR;
4208
4209	__skb_queue_head_init(list: &reorder_release);
4210
4211	#define CALL_RXH(rxh) \
4212	do { \
4213	res = rxh(rx); \
4214	if (res != RX_CONTINUE) \
4215	goto rxh_next; \
4216	} while (0)
4217
4218	CALL_RXH(ieee80211_rx_h_check_dup);
4219	CALL_RXH(ieee80211_rx_h_check);
4220
4221	ieee80211_rx_reorder_ampdu(rx, frames: &reorder_release);
4222
4223	ieee80211_rx_handlers(rx, frames: &reorder_release);
4224	return;
4225
4226	rxh_next:
4227	ieee80211_rx_handlers_result(rx, res);
4228
4229	#undef CALL_RXH
4230	}
4231
4232	static bool
4233	ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
4234	{
4235	return !!(sta->valid_links & BIT(link_id));
4236	}
4237
4238	static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
4239	u8 link_id)
4240	{
4241	rx->link_id = link_id;
4242	rx->link = rcu_dereference(rx->sdata->link[link_id]);
4243
4244	if (!rx->sta)
4245	return rx->link;
4246
4247	if (!ieee80211_rx_is_valid_sta_link_id(sta: &rx->sta->sta, link_id))
4248	return false;
4249
4250	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
4251
4252	return rx->link && rx->link_sta;
4253	}
4254
4255	static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
4256	struct sta_info *sta, int link_id)
4257	{
4258	rx->link_id = link_id;
4259	rx->sta = sta;
4260
4261	if (sta) {
4262	rx->local = sta->sdata->local;
4263	if (!rx->sdata)
4264	rx->sdata = sta->sdata;
4265	rx->link_sta = &sta->deflink;
4266	} else {
4267	rx->link_sta = NULL;
4268	}
4269
4270	if (link_id < 0)
4271	rx->link = &rx->sdata->deflink;
4272	else if (!ieee80211_rx_data_set_link(rx, link_id))
4273	return false;
4274
4275	return true;
4276	}
4277
4278	/*
4279	* This function makes calls into the RX path, therefore
4280	* it has to be invoked under RCU read lock.
4281	*/
4282	void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4283	{
4284	struct sk_buff_head frames;
4285	struct ieee80211_rx_data rx = {
4286	/* This is OK -- must be QoS data frame */
4287	.security_idx = tid,
4288	.seqno_idx = tid,
4289	};
4290	struct tid_ampdu_rx *tid_agg_rx;
4291	int link_id = -1;
4292
4293	/* FIXME: statistics won't be right with this */
4294	if (sta->sta.valid_links)
4295	link_id = ffs(sta->sta.valid_links) - 1;
4296
4297	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id))
4298	return;
4299
4300	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4301	if (!tid_agg_rx)
4302	return;
4303
4304	__skb_queue_head_init(list: &frames);
4305
4306	spin_lock(lock: &tid_agg_rx->reorder_lock);
4307	ieee80211_sta_reorder_release(sdata: sta->sdata, tid_agg_rx, frames: &frames);
4308	spin_unlock(lock: &tid_agg_rx->reorder_lock);
4309
4310	if (!skb_queue_empty(list: &frames)) {
4311	struct ieee80211_event event = {
4312	.type = BA_FRAME_TIMEOUT,
4313	.u.ba.tid = tid,
4314	.u.ba.sta = &sta->sta,
4315	};
4316	drv_event_callback(local: rx.local, sdata: rx.sdata, event: &event);
4317	}
4318
4319	ieee80211_rx_handlers(rx: &rx, frames: &frames);
4320	}
4321
4322	void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4323	u16 ssn, u64 filtered,
4324	u16 received_mpdus)
4325	{
4326	struct ieee80211_local *local;
4327	struct sta_info *sta;
4328	struct tid_ampdu_rx *tid_agg_rx;
4329	struct sk_buff_head frames;
4330	struct ieee80211_rx_data rx = {
4331	/* This is OK -- must be QoS data frame */
4332	.security_idx = tid,
4333	.seqno_idx = tid,
4334	};
4335	int i, diff;
4336
4337	if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4338	return;
4339
4340	__skb_queue_head_init(list: &frames);
4341
4342	sta = container_of(pubsta, struct sta_info, sta);
4343
4344	local = sta->sdata->local;
4345	WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,
4346	"RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",
4347	local->hw.max_rx_aggregation_subframes);
4348
4349	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id: -1))
4350	return;
4351
4352	rcu_read_lock();
4353	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4354	if (!tid_agg_rx)
4355	goto out;
4356
4357	spin_lock_bh(lock: &tid_agg_rx->reorder_lock);
4358
4359	if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4360	int release;
4361
4362	/* release all frames in the reorder buffer */
4363	release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4364	IEEE80211_SN_MODULO;
4365	ieee80211_release_reorder_frames(sdata: sta->sdata, tid_agg_rx,
4366	head_seq_num: release, frames: &frames);
4367	/* update ssn to match received ssn */
4368	tid_agg_rx->head_seq_num = ssn;
4369	} else {
4370	ieee80211_release_reorder_frames(sdata: sta->sdata, tid_agg_rx, head_seq_num: ssn,
4371	frames: &frames);
4372	}
4373
4374	/* handle the case that received ssn is behind the mac ssn.
4375	* it can be tid_agg_rx->buf_size behind and still be valid */
4376	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4377	if (diff >= tid_agg_rx->buf_size) {
4378	tid_agg_rx->reorder_buf_filtered = 0;
4379	goto release;
4380	}
4381	filtered = filtered >> diff;
4382	ssn += diff;
4383
4384	/* update bitmap */
4385	for (i = 0; i < tid_agg_rx->buf_size; i++) {
4386	int index = (ssn + i) % tid_agg_rx->buf_size;
4387
4388	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4389	if (filtered & BIT_ULL(i))
4390	tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4391	}
4392
4393	/* now process also frames that the filter marking released */
4394	ieee80211_sta_reorder_release(sdata: sta->sdata, tid_agg_rx, frames: &frames);
4395
4396	release:
4397	spin_unlock_bh(lock: &tid_agg_rx->reorder_lock);
4398
4399	ieee80211_rx_handlers(rx: &rx, frames: &frames);
4400
4401	out:
4402	rcu_read_unlock();
4403	}
4404	EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4405
4406	/* main receive path */
4407
4408	static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4409	{
4410	return ether_addr_equal(addr1: raddr, addr2: addr) ||
4411	is_broadcast_ether_addr(addr: raddr);
4412	}
4413
4414	static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
4415	{
4416	struct ieee80211_sub_if_data *sdata = rx->sdata;
4417	struct sk_buff *skb = rx->skb;
4418	struct ieee80211_hdr *hdr = (void *)skb->data;
4419	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4420	u8 *bssid = ieee80211_get_bssid(hdr, len: skb->len, type: sdata->vif.type);
4421	bool multicast = is_multicast_ether_addr(addr: hdr->addr1) ||
4422	ieee80211_is_s1g_beacon(fc: hdr->frame_control);
4423
4424	switch (sdata->vif.type) {
4425	case NL80211_IFTYPE_STATION:
4426	if (!bssid && !sdata->u.mgd.use_4addr)
4427	return false;
4428	if (ieee80211_is_first_frag(seq_ctrl: hdr->seq_ctrl) &&
4429	ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4430	return false;
4431	if (multicast)
4432	return true;
4433	return ieee80211_is_our_addr(sdata, addr: hdr->addr1, out_link_id: &rx->link_id);
4434	case NL80211_IFTYPE_ADHOC:
4435	if (!bssid)
4436	return false;
4437	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr2) ||
4438	ether_addr_equal(addr1: sdata->u.ibss.bssid, addr2: hdr->addr2) ||
4439	!is_valid_ether_addr(addr: hdr->addr2))
4440	return false;
4441	if (ieee80211_is_beacon(fc: hdr->frame_control))
4442	return true;
4443	if (!ieee80211_bssid_match(raddr: bssid, addr: sdata->u.ibss.bssid))
4444	return false;
4445	if (!multicast &&
4446	!ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr1))
4447	return false;
4448	if (!rx->sta) {
4449	int rate_idx;
4450	if (status->encoding != RX_ENC_LEGACY)
4451	rate_idx = 0; /* TODO: HT/VHT rates */
4452	else
4453	rate_idx = status->rate_idx;
4454	ieee80211_ibss_rx_no_sta(sdata, bssid, addr: hdr->addr2,
4455	BIT(rate_idx));
4456	}
4457	return true;
4458	case NL80211_IFTYPE_OCB:
4459	if (!bssid)
4460	return false;
4461	if (!ieee80211_is_data_present(fc: hdr->frame_control))
4462	return false;
4463	if (!is_broadcast_ether_addr(addr: bssid))
4464	return false;
4465	if (!multicast &&
4466	!ether_addr_equal(addr1: sdata->dev->dev_addr, addr2: hdr->addr1))
4467	return false;
4468	if (!rx->sta) {
4469	int rate_idx;
4470	if (status->encoding != RX_ENC_LEGACY)
4471	rate_idx = 0; /* TODO: HT rates */
4472	else
4473	rate_idx = status->rate_idx;
4474	ieee80211_ocb_rx_no_sta(sdata, bssid, addr: hdr->addr2,
4475	BIT(rate_idx));
4476	}
4477	return true;
4478	case NL80211_IFTYPE_MESH_POINT:
4479	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr2))
4480	return false;
4481	if (multicast)
4482	return true;
4483	return ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr1);
4484	case NL80211_IFTYPE_AP_VLAN:
4485	case NL80211_IFTYPE_AP:
4486	if (!bssid)
4487	return ieee80211_is_our_addr(sdata, addr: hdr->addr1,
4488	out_link_id: &rx->link_id);
4489
4490	if (!is_broadcast_ether_addr(addr: bssid) &&
4491	!ieee80211_is_our_addr(sdata, addr: bssid, NULL)) {
4492	/*
4493	* Accept public action frames even when the
4494	* BSSID doesn't match, this is used for P2P
4495	* and location updates. Note that mac80211
4496	* itself never looks at these frames.
4497	*/
4498	if (!multicast &&
4499	!ieee80211_is_our_addr(sdata, addr: hdr->addr1,
4500	out_link_id: &rx->link_id))
4501	return false;
4502	if (ieee80211_is_public_action(hdr, len: skb->len))
4503	return true;
4504	return ieee80211_is_beacon(fc: hdr->frame_control);
4505	}
4506
4507	if (!ieee80211_has_tods(fc: hdr->frame_control)) {
4508	/* ignore data frames to TDLS-peers */
4509	if (ieee80211_is_data(fc: hdr->frame_control))
4510	return false;
4511	/* ignore action frames to TDLS-peers */
4512	if (ieee80211_is_action(fc: hdr->frame_control) &&
4513	!is_broadcast_ether_addr(addr: bssid) &&
4514	!ether_addr_equal(addr1: bssid, addr2: hdr->addr1))
4515	return false;
4516	}
4517
4518	/*
4519	* 802.11-2016 Table 9-26 says that for data frames, A1 must be
4520	* the BSSID - we've checked that already but may have accepted
4521	* the wildcard (ff:ff:ff:ff:ff:ff).
4522	*
4523	* It also says:
4524	* The BSSID of the Data frame is determined as follows:
4525	* a) If the STA is contained within an AP or is associated
4526	* with an AP, the BSSID is the address currently in use
4527	* by the STA contained in the AP.
4528	*
4529	* So we should not accept data frames with an address that's
4530	* multicast.
4531	*
4532	* Accepting it also opens a security problem because stations
4533	* could encrypt it with the GTK and inject traffic that way.
4534	*/
4535	if (ieee80211_is_data(fc: hdr->frame_control) && multicast)
4536	return false;
4537
4538	return true;
4539	case NL80211_IFTYPE_P2P_DEVICE:
4540	return ieee80211_is_public_action(hdr, len: skb->len) ||
4541	ieee80211_is_probe_req(fc: hdr->frame_control) ||
4542	ieee80211_is_probe_resp(fc: hdr->frame_control) ||
4543	ieee80211_is_beacon(fc: hdr->frame_control);
4544	case NL80211_IFTYPE_NAN:
4545	/* Currently no frames on NAN interface are allowed */
4546	return false;
4547	default:
4548	break;
4549	}
4550
4551	WARN_ON_ONCE(1);
4552	return false;
4553	}
4554
4555	void ieee80211_check_fast_rx(struct sta_info *sta)
4556	{
4557	struct ieee80211_sub_if_data *sdata = sta->sdata;
4558	struct ieee80211_local *local = sdata->local;
4559	struct ieee80211_key *key;
4560	struct ieee80211_fast_rx fastrx = {
4561	.dev = sdata->dev,
4562	.vif_type = sdata->vif.type,
4563	.control_port_protocol = sdata->control_port_protocol,
4564	}, *old, *new = NULL;
4565	u32 offload_flags;
4566	bool set_offload = false;
4567	bool assign = false;
4568	bool offload;
4569
4570	/* use sparse to check that we don't return without updating */
4571	__acquire(check_fast_rx);
4572
4573	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4574	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4575	ether_addr_copy(dst: fastrx.rfc1042_hdr, src: rfc1042_header);
4576	ether_addr_copy(dst: fastrx.vif_addr, src: sdata->vif.addr);
4577
4578	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4579
4580	/* fast-rx doesn't do reordering */
4581	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4582	!ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4583	goto clear;
4584
4585	switch (sdata->vif.type) {
4586	case NL80211_IFTYPE_STATION:
4587	if (sta->sta.tdls) {
4588	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4589	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4590	fastrx.expected_ds_bits = 0;
4591	} else {
4592	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4593	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4594	fastrx.expected_ds_bits =
4595	cpu_to_le16(IEEE80211_FCTL_FROMDS);
4596	}
4597
4598	if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4599	fastrx.expected_ds_bits |=
4600	cpu_to_le16(IEEE80211_FCTL_TODS);
4601	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4602	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4603	}
4604
4605	if (!sdata->u.mgd.powersave)
4606	break;
4607
4608	/* software powersave is a huge mess, avoid all of it */
4609	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4610	goto clear;
4611	if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4612	!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4613	goto clear;
4614	break;
4615	case NL80211_IFTYPE_AP_VLAN:
4616	case NL80211_IFTYPE_AP:
4617	/* parallel-rx requires this, at least with calls to
4618	* ieee80211_sta_ps_transition()
4619	*/
4620	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4621	goto clear;
4622	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4623	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4624	fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4625
4626	fastrx.internal_forward =
4627	!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4628	(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4629	!sdata->u.vlan.sta);
4630
4631	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4632	sdata->u.vlan.sta) {
4633	fastrx.expected_ds_bits |=
4634	cpu_to_le16(IEEE80211_FCTL_FROMDS);
4635	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4636	fastrx.internal_forward = 0;
4637	}
4638
4639	break;
4640	case NL80211_IFTYPE_MESH_POINT:
4641	fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
4642	IEEE80211_FCTL_TODS);
4643	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4644	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4645	break;
4646	default:
4647	goto clear;
4648	}
4649
4650	if (!test_sta_flag(sta, flag: WLAN_STA_AUTHORIZED))
4651	goto clear;
4652
4653	rcu_read_lock();
4654	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4655	if (!key)
4656	key = rcu_dereference(sdata->default_unicast_key);
4657	if (key) {
4658	switch (key->conf.cipher) {
4659	case WLAN_CIPHER_SUITE_TKIP:
4660	/* we don't want to deal with MMIC in fast-rx */
4661	goto clear_rcu;
4662	case WLAN_CIPHER_SUITE_CCMP:
4663	case WLAN_CIPHER_SUITE_CCMP_256:
4664	case WLAN_CIPHER_SUITE_GCMP:
4665	case WLAN_CIPHER_SUITE_GCMP_256:
4666	break;
4667	default:
4668	/* We also don't want to deal with
4669	* WEP or cipher scheme.
4670	*/
4671	goto clear_rcu;
4672	}
4673
4674	fastrx.key = true;
4675	fastrx.icv_len = key->conf.icv_len;
4676	}
4677
4678	assign = true;
4679	clear_rcu:
4680	rcu_read_unlock();
4681	clear:
4682	__release(check_fast_rx);
4683
4684	if (assign)
4685	new = kmemdup(p: &fastrx, size: sizeof(fastrx), GFP_KERNEL);
4686
4687	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
4688	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
4689
4690	if (assign && offload)
4691	set_offload = !test_and_set_sta_flag(sta, flag: WLAN_STA_DECAP_OFFLOAD);
4692	else
4693	set_offload = test_and_clear_sta_flag(sta, flag: WLAN_STA_DECAP_OFFLOAD);
4694
4695	if (set_offload)
4696	drv_sta_set_decap_offload(local, sdata, sta: &sta->sta, enabled: assign);
4697
4698	spin_lock_bh(lock: &sta->lock);
4699	old = rcu_dereference_protected(sta->fast_rx, true);
4700	rcu_assign_pointer(sta->fast_rx, new);
4701	spin_unlock_bh(lock: &sta->lock);
4702
4703	if (old)
4704	kfree_rcu(old, rcu_head);
4705	}
4706
4707	void ieee80211_clear_fast_rx(struct sta_info *sta)
4708	{
4709	struct ieee80211_fast_rx *old;
4710
4711	spin_lock_bh(lock: &sta->lock);
4712	old = rcu_dereference_protected(sta->fast_rx, true);
4713	RCU_INIT_POINTER(sta->fast_rx, NULL);
4714	spin_unlock_bh(lock: &sta->lock);
4715
4716	if (old)
4717	kfree_rcu(old, rcu_head);
4718	}
4719
4720	void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4721	{
4722	struct ieee80211_local *local = sdata->local;
4723	struct sta_info *sta;
4724
4725	lockdep_assert_wiphy(local->hw.wiphy);
4726
4727	list_for_each_entry(sta, &local->sta_list, list) {
4728	if (sdata != sta->sdata &&
4729	(!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4730	continue;
4731	ieee80211_check_fast_rx(sta);
4732	}
4733	}
4734
4735	void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4736	{
4737	struct ieee80211_local *local = sdata->local;
4738
4739	lockdep_assert_wiphy(local->hw.wiphy);
4740
4741	__ieee80211_check_fast_rx_iface(sdata);
4742	}
4743
4744	static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4745	struct ieee80211_fast_rx *fast_rx,
4746	int orig_len)
4747	{
4748	struct ieee80211_sta_rx_stats *stats;
4749	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
4750	struct sta_info *sta = rx->sta;
4751	struct link_sta_info *link_sta;
4752	struct sk_buff *skb = rx->skb;
4753	void *sa = skb->data + ETH_ALEN;
4754	void *da = skb->data;
4755
4756	if (rx->link_id >= 0) {
4757	link_sta = rcu_dereference(sta->link[rx->link_id]);
4758	if (WARN_ON_ONCE(!link_sta)) {
4759	dev_kfree_skb(rx->skb);
4760	return;
4761	}
4762	} else {
4763	link_sta = &sta->deflink;
4764	}
4765
4766	stats = &link_sta->rx_stats;
4767	if (fast_rx->uses_rss)
4768	stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
4769
4770	/* statistics part of ieee80211_rx_h_sta_process() */
4771	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4772	stats->last_signal = status->signal;
4773	if (!fast_rx->uses_rss)
4774	ewma_signal_add(e: &link_sta->rx_stats_avg.signal,
4775	val: -status->signal);
4776	}
4777
4778	if (status->chains) {
4779	int i;
4780
4781	stats->chains = status->chains;
4782	for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4783	int signal = status->chain_signal[i];
4784
4785	if (!(status->chains & BIT(i)))
4786	continue;
4787
4788	stats->chain_signal_last[i] = signal;
4789	if (!fast_rx->uses_rss)
4790	ewma_signal_add(e: &link_sta->rx_stats_avg.chain_signal[i],
4791	val: -signal);
4792	}
4793	}
4794	/* end of statistics */
4795
4796	stats->last_rx = jiffies;
4797	stats->last_rate = sta_stats_encode_rate(s: status);
4798
4799	stats->fragments++;
4800	stats->packets++;
4801
4802	skb->dev = fast_rx->dev;
4803
4804	dev_sw_netstats_rx_add(dev: fast_rx->dev, len: skb->len);
4805
4806	/* The seqno index has the same property as needed
4807	* for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4808	* for non-QoS-data frames. Here we know it's a data
4809	* frame, so count MSDUs.
4810	*/
4811	u64_stats_update_begin(syncp: &stats->syncp);
4812	stats->msdu[rx->seqno_idx]++;
4813	stats->bytes += orig_len;
4814	u64_stats_update_end(syncp: &stats->syncp);
4815
4816	if (fast_rx->internal_forward) {
4817	struct sk_buff *xmit_skb = NULL;
4818	if (is_multicast_ether_addr(addr: da)) {
4819	xmit_skb = skb_copy(skb, GFP_ATOMIC);
4820	} else if (!ether_addr_equal(addr1: da, addr2: sa) &&
4821	sta_info_get(sdata: rx->sdata, addr: da)) {
4822	xmit_skb = skb;
4823	skb = NULL;
4824	}
4825
4826	if (xmit_skb) {
4827	/*
4828	* Send to wireless media and increase priority by 256
4829	* to keep the received priority instead of
4830	* reclassifying the frame (see cfg80211_classify8021d).
4831	*/
4832	xmit_skb->priority += 256;
4833	xmit_skb->protocol = htons(ETH_P_802_3);
4834	skb_reset_network_header(skb: xmit_skb);
4835	skb_reset_mac_header(skb: xmit_skb);
4836	dev_queue_xmit(skb: xmit_skb);
4837	}
4838
4839	if (!skb)
4840	return;
4841	}
4842
4843	/* deliver to local stack */
4844	skb->protocol = eth_type_trans(skb, dev: fast_rx->dev);
4845	ieee80211_deliver_skb_to_local_stack(skb, rx);
4846	}
4847
4848	static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4849	struct ieee80211_fast_rx *fast_rx)
4850	{
4851	struct sk_buff *skb = rx->skb;
4852	struct ieee80211_hdr *hdr = (void *)skb->data;
4853	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4854	static ieee80211_rx_result res;
4855	int orig_len = skb->len;
4856	int hdrlen = ieee80211_hdrlen(fc: hdr->frame_control);
4857	int snap_offs = hdrlen;
4858	struct {
4859	u8 snap[sizeof(rfc1042_header)];
4860	__be16 proto;
4861	} *payload __aligned(2);
4862	struct {
4863	u8 da[ETH_ALEN];
4864	u8 sa[ETH_ALEN];
4865	} addrs __aligned(2);
4866	struct ieee80211_sta_rx_stats *stats;
4867
4868	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
4869	* to a common data structure; drivers can implement that per queue
4870	* but we don't have that information in mac80211
4871	*/
4872	if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4873	return false;
4874
4875	#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4876
4877	/* If using encryption, we also need to have:
4878	* - PN_VALIDATED: similar, but the implementation is tricky
4879	* - DECRYPTED: necessary for PN_VALIDATED
4880	*/
4881	if (fast_rx->key &&
4882	(status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
4883	return false;
4884
4885	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
4886	return false;
4887
4888	if (unlikely(ieee80211_is_frag(hdr)))
4889	return false;
4890
4891	/* Since our interface address cannot be multicast, this
4892	* implicitly also rejects multicast frames without the
4893	* explicit check.
4894	*
4895	* We shouldn't get any *data* frames not addressed to us
4896	* (AP mode will accept multicast *management* frames), but
4897	* punting here will make it go through the full checks in
4898	* ieee80211_accept_frame().
4899	*/
4900	if (!ether_addr_equal(addr1: fast_rx->vif_addr, addr2: hdr->addr1))
4901	return false;
4902
4903	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
4904	IEEE80211_FCTL_TODS)) !=
4905	fast_rx->expected_ds_bits)
4906	return false;
4907
4908	/* assign the key to drop unencrypted frames (later)
4909	* and strip the IV/MIC if necessary
4910	*/
4911	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
4912	/* GCMP header length is the same */
4913	snap_offs += IEEE80211_CCMP_HDR_LEN;
4914	}
4915
4916	if (!ieee80211_vif_is_mesh(vif: &rx->sdata->vif) &&
4917	!(status->rx_flags & IEEE80211_RX_AMSDU)) {
4918	if (!pskb_may_pull(skb, len: snap_offs + sizeof(*payload)))
4919	return false;
4920
4921	payload = (void *)(skb->data + snap_offs);
4922
4923	if (!ether_addr_equal(addr1: payload->snap, addr2: fast_rx->rfc1042_hdr))
4924	return false;
4925
4926	/* Don't handle these here since they require special code.
4927	* Accept AARP and IPX even though they should come with a
4928	* bridge-tunnel header - but if we get them this way then
4929	* there's little point in discarding them.
4930	*/
4931	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4932	payload->proto == fast_rx->control_port_protocol))
4933	return false;
4934	}
4935
4936	/* after this point, don't punt to the slowpath! */
4937
4938	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4939	pskb_trim(skb, len: skb->len - fast_rx->icv_len))
4940	goto drop;
4941
4942	if (rx->key && !ieee80211_has_protected(fc: hdr->frame_control))
4943	goto drop;
4944
4945	if (status->rx_flags & IEEE80211_RX_AMSDU) {
4946	if (__ieee80211_rx_h_amsdu(rx, data_offset: snap_offs - hdrlen) !=
4947	RX_QUEUED)
4948	goto drop;
4949
4950	return true;
4951	}
4952
4953	/* do the header conversion - first grab the addresses */
4954	ether_addr_copy(dst: addrs.da, src: skb->data + fast_rx->da_offs);
4955	ether_addr_copy(dst: addrs.sa, src: skb->data + fast_rx->sa_offs);
4956	if (ieee80211_vif_is_mesh(vif: &rx->sdata->vif)) {
4957	skb_pull(skb, len: snap_offs - 2);
4958	put_unaligned_be16(val: skb->len - 2, p: skb->data);
4959	} else {
4960	skb_postpull_rcsum(skb, start: skb->data + snap_offs,
4961	len: sizeof(rfc1042_header) + 2);
4962
4963	/* remove the SNAP but leave the ethertype */
4964	skb_pull(skb, len: snap_offs + sizeof(rfc1042_header));
4965	}
4966	/* push the addresses in front */
4967	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4968
4969	res = ieee80211_rx_mesh_data(sdata: rx->sdata, sta: rx->sta, skb: rx->skb);
4970	switch (res) {
4971	case RX_QUEUED:
4972	return true;
4973	case RX_CONTINUE:
4974	break;
4975	default:
4976	goto drop;
4977	}
4978
4979	ieee80211_rx_8023(rx, fast_rx, orig_len);
4980
4981	return true;
4982	drop:
4983	dev_kfree_skb(skb);
4984
4985	if (fast_rx->uses_rss)
4986	stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
4987	else
4988	stats = &rx->link_sta->rx_stats;
4989
4990	stats->dropped++;
4991	return true;
4992	}
4993
4994	/*
4995	* This function returns whether or not the SKB
4996	* was destined for RX processing or not, which,
4997	* if consume is true, is equivalent to whether
4998	* or not the skb was consumed.
4999	*/
5000	static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
5001	struct sk_buff *skb, bool consume)
5002	{
5003	struct ieee80211_local *local = rx->local;
5004	struct ieee80211_sub_if_data *sdata = rx->sdata;
5005	struct ieee80211_hdr *hdr = (void *)skb->data;
5006	struct link_sta_info *link_sta = rx->link_sta;
5007	struct ieee80211_link_data *link = rx->link;
5008
5009	rx->skb = skb;
5010
5011	/* See if we can do fast-rx; if we have to copy we already lost,
5012	* so punt in that case. We should never have to deliver a data
5013	* frame to multiple interfaces anyway.
5014	*
5015	* We skip the ieee80211_accept_frame() call and do the necessary
5016	* checking inside ieee80211_invoke_fast_rx().
5017	*/
5018	if (consume && rx->sta) {
5019	struct ieee80211_fast_rx *fast_rx;
5020
5021	fast_rx = rcu_dereference(rx->sta->fast_rx);
5022	if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
5023	return true;
5024	}
5025
5026	if (!ieee80211_accept_frame(rx))
5027	return false;
5028
5029	if (!consume) {
5030	struct skb_shared_hwtstamps *shwt;
5031
5032	rx->skb = skb_copy(skb, GFP_ATOMIC);
5033	if (!rx->skb) {
5034	if (net_ratelimit())
5035	wiphy_debug(local->hw.wiphy,
5036	"failed to copy skb for %s\n",
5037	sdata->name);
5038	return true;
5039	}
5040
5041	/* skb_copy() does not copy the hw timestamps, so copy it
5042	* explicitly
5043	*/
5044	shwt = skb_hwtstamps(skb: rx->skb);
5045	shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
5046
5047	/* Update the hdr pointer to the new skb for translation below */
5048	hdr = (struct ieee80211_hdr *)rx->skb->data;
5049	}
5050
5051	if (unlikely(rx->sta && rx->sta->sta.mlo) &&
5052	is_unicast_ether_addr(addr: hdr->addr1) &&
5053	!ieee80211_is_probe_resp(fc: hdr->frame_control) &&
5054	!ieee80211_is_beacon(fc: hdr->frame_control)) {
5055	/* translate to MLD addresses */
5056	if (ether_addr_equal(addr1: link->conf->addr, addr2: hdr->addr1))
5057	ether_addr_copy(dst: hdr->addr1, src: rx->sdata->vif.addr);
5058	if (ether_addr_equal(addr1: link_sta->addr, addr2: hdr->addr2))
5059	ether_addr_copy(dst: hdr->addr2, src: rx->sta->addr);
5060	/* translate A3 only if it's the BSSID */
5061	if (!ieee80211_has_tods(fc: hdr->frame_control) &&
5062	!ieee80211_has_fromds(fc: hdr->frame_control)) {
5063	if (ether_addr_equal(addr1: link_sta->addr, addr2: hdr->addr3))
5064	ether_addr_copy(dst: hdr->addr3, src: rx->sta->addr);
5065	else if (ether_addr_equal(addr1: link->conf->addr, addr2: hdr->addr3))
5066	ether_addr_copy(dst: hdr->addr3, src: rx->sdata->vif.addr);
5067	}
5068	/* not needed for A4 since it can only carry the SA */
5069	}
5070
5071	ieee80211_invoke_rx_handlers(rx);
5072	return true;
5073	}
5074
5075	static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
5076	struct ieee80211_sta *pubsta,
5077	struct sk_buff *skb,
5078	struct list_head *list)
5079	{
5080	struct ieee80211_local *local = hw_to_local(hw);
5081	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5082	struct ieee80211_fast_rx *fast_rx;
5083	struct ieee80211_rx_data rx;
5084	struct sta_info *sta;
5085	int link_id = -1;
5086
5087	memset(&rx, 0, sizeof(rx));
5088	rx.skb = skb;
5089	rx.local = local;
5090	rx.list = list;
5091	rx.link_id = -1;
5092
5093	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5094
5095	/* drop frame if too short for header */
5096	if (skb->len < sizeof(struct ethhdr))
5097	goto drop;
5098
5099	if (!pubsta)
5100	goto drop;
5101
5102	if (status->link_valid)
5103	link_id = status->link_id;
5104
5105	/*
5106	* TODO: Should the frame be dropped if the right link_id is not
5107	* available? Or may be it is fine in the current form to proceed with
5108	* the frame processing because with frame being in 802.3 format,
5109	* link_id is used only for stats purpose and updating the stats on
5110	* the deflink is fine?
5111	*/
5112	sta = container_of(pubsta, struct sta_info, sta);
5113	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id))
5114	goto drop;
5115
5116	fast_rx = rcu_dereference(rx.sta->fast_rx);
5117	if (!fast_rx)
5118	goto drop;
5119
5120	ieee80211_rx_8023(rx: &rx, fast_rx, orig_len: skb->len);
5121	return;
5122
5123	drop:
5124	dev_kfree_skb(skb);
5125	}
5126
5127	static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
5128	struct sk_buff *skb, bool consume)
5129	{
5130	struct link_sta_info *link_sta;
5131	struct ieee80211_hdr *hdr = (void *)skb->data;
5132	struct sta_info *sta;
5133	int link_id = -1;
5134
5135	/*
5136	* Look up link station first, in case there's a
5137	* chance that they might have a link address that
5138	* is identical to the MLD address, that way we'll
5139	* have the link information if needed.
5140	*/
5141	link_sta = link_sta_info_get_bss(sdata: rx->sdata, addr: hdr->addr2);
5142	if (link_sta) {
5143	sta = link_sta->sta;
5144	link_id = link_sta->link_id;
5145	} else {
5146	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5147
5148	sta = sta_info_get_bss(sdata: rx->sdata, addr: hdr->addr2);
5149	if (status->link_valid)
5150	link_id = status->link_id;
5151	}
5152
5153	if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
5154	return false;
5155
5156	return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5157	}
5158
5159	/*
5160	* This is the actual Rx frames handler. as it belongs to Rx path it must
5161	* be called with rcu_read_lock protection.
5162	*/
5163	static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
5164	struct ieee80211_sta *pubsta,
5165	struct sk_buff *skb,
5166	struct list_head *list)
5167	{
5168	struct ieee80211_local *local = hw_to_local(hw);
5169	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5170	struct ieee80211_sub_if_data *sdata;
5171	struct ieee80211_hdr *hdr;
5172	__le16 fc;
5173	struct ieee80211_rx_data rx;
5174	struct ieee80211_sub_if_data *prev;
5175	struct rhlist_head *tmp;
5176	int err = 0;
5177
5178	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
5179	memset(&rx, 0, sizeof(rx));
5180	rx.skb = skb;
5181	rx.local = local;
5182	rx.list = list;
5183	rx.link_id = -1;
5184
5185	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
5186	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5187
5188	if (ieee80211_is_mgmt(fc)) {
5189	/* drop frame if too short for header */
5190	if (skb->len < ieee80211_hdrlen(fc))
5191	err = -ENOBUFS;
5192	else
5193	err = skb_linearize(skb);
5194	} else {
5195	err = !pskb_may_pull(skb, len: ieee80211_hdrlen(fc));
5196	}
5197
5198	if (err) {
5199	dev_kfree_skb(skb);
5200	return;
5201	}
5202
5203	hdr = (struct ieee80211_hdr *)skb->data;
5204	ieee80211_parse_qos(rx: &rx);
5205	ieee80211_verify_alignment(rx: &rx);
5206
5207	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
5208	ieee80211_is_beacon(hdr->frame_control) ||
5209	ieee80211_is_s1g_beacon(hdr->frame_control)))
5210	ieee80211_scan_rx(local, skb);
5211
5212	if (ieee80211_is_data(fc)) {
5213	struct sta_info *sta, *prev_sta;
5214	int link_id = -1;
5215
5216	if (status->link_valid)
5217	link_id = status->link_id;
5218
5219	if (pubsta) {
5220	sta = container_of(pubsta, struct sta_info, sta);
5221	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id))
5222	goto out;
5223
5224	/*
5225	* In MLO connection, fetch the link_id using addr2
5226	* when the driver does not pass link_id in status.
5227	* When the address translation is already performed by
5228	* driver/hw, the valid link_id must be passed in
5229	* status.
5230	*/
5231
5232	if (!status->link_valid && pubsta->mlo) {
5233	struct link_sta_info *link_sta;
5234
5235	link_sta = link_sta_info_get_bss(sdata: rx.sdata,
5236	addr: hdr->addr2);
5237	if (!link_sta)
5238	goto out;
5239
5240	ieee80211_rx_data_set_link(rx: &rx, link_id: link_sta->link_id);
5241	}
5242
5243	if (ieee80211_prepare_and_rx_handle(rx: &rx, skb, consume: true))
5244	return;
5245	goto out;
5246	}
5247
5248	prev_sta = NULL;
5249
5250	for_each_sta_info(local, hdr->addr2, sta, tmp) {
5251	if (!prev_sta) {
5252	prev_sta = sta;
5253	continue;
5254	}
5255
5256	rx.sdata = prev_sta->sdata;
5257	if (!ieee80211_rx_data_set_sta(rx: &rx, sta: prev_sta, link_id))
5258	goto out;
5259
5260	if (!status->link_valid && prev_sta->sta.mlo)
5261	continue;
5262
5263	ieee80211_prepare_and_rx_handle(rx: &rx, skb, consume: false);
5264
5265	prev_sta = sta;
5266	}
5267
5268	if (prev_sta) {
5269	rx.sdata = prev_sta->sdata;
5270	if (!ieee80211_rx_data_set_sta(rx: &rx, sta: prev_sta, link_id))
5271	goto out;
5272
5273	if (!status->link_valid && prev_sta->sta.mlo)
5274	goto out;
5275
5276	if (ieee80211_prepare_and_rx_handle(rx: &rx, skb, consume: true))
5277	return;
5278	goto out;
5279	}
5280	}
5281
5282	prev = NULL;
5283
5284	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
5285	if (!ieee80211_sdata_running(sdata))
5286	continue;
5287
5288	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
5289	sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
5290	continue;
5291
5292	/*
5293	* frame is destined for this interface, but if it's
5294	* not also for the previous one we handle that after
5295	* the loop to avoid copying the SKB once too much
5296	*/
5297
5298	if (!prev) {
5299	prev = sdata;
5300	continue;
5301	}
5302
5303	rx.sdata = prev;
5304	ieee80211_rx_for_interface(rx: &rx, skb, consume: false);
5305
5306	prev = sdata;
5307	}
5308
5309	if (prev) {
5310	rx.sdata = prev;
5311
5312	if (ieee80211_rx_for_interface(rx: &rx, skb, consume: true))
5313	return;
5314	}
5315
5316	out:
5317	dev_kfree_skb(skb);
5318	}
5319
5320	/*
5321	* This is the receive path handler. It is called by a low level driver when an
5322	* 802.11 MPDU is received from the hardware.
5323	*/
5324	void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5325	struct sk_buff *skb, struct list_head *list)
5326	{
5327	struct ieee80211_local *local = hw_to_local(hw);
5328	struct ieee80211_rate *rate = NULL;
5329	struct ieee80211_supported_band *sband;
5330	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5331	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
5332
5333	WARN_ON_ONCE(softirq_count() == 0);
5334
5335	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
5336	goto drop;
5337
5338	sband = local->hw.wiphy->bands[status->band];
5339	if (WARN_ON(!sband))
5340	goto drop;
5341
5342	/*
5343	* If we're suspending, it is possible although not too likely
5344	* that we'd be receiving frames after having already partially
5345	* quiesced the stack. We can't process such frames then since
5346	* that might, for example, cause stations to be added or other
5347	* driver callbacks be invoked.
5348	*/
5349	if (unlikely(local->quiescing || local->suspended))
5350	goto drop;
5351
5352	/* We might be during a HW reconfig, prevent Rx for the same reason */
5353	if (unlikely(local->in_reconfig))
5354	goto drop;
5355
5356	/*
5357	* The same happens when we're not even started,
5358	* but that's worth a warning.
5359	*/
5360	if (WARN_ON(!local->started))
5361	goto drop;
5362
5363	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
5364	/*
5365	* Validate the rate, unless a PLCP error means that
5366	* we probably can't have a valid rate here anyway.
5367	*/
5368
5369	switch (status->encoding) {
5370	case RX_ENC_HT:
5371	/*
5372	* rate_idx is MCS index, which can be [0-76]
5373	* as documented on:
5374	*
5375	* https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
5376	*
5377	* Anything else would be some sort of driver or
5378	* hardware error. The driver should catch hardware
5379	* errors.
5380	*/
5381	if (WARN(status->rate_idx > 76,
5382	"Rate marked as an HT rate but passed "
5383	"status->rate_idx is not "
5384	"an MCS index [0-76]: %d (0x%02x)\n",
5385	status->rate_idx,
5386	status->rate_idx))
5387	goto drop;
5388	break;
5389	case RX_ENC_VHT:
5390	if (WARN_ONCE(status->rate_idx > 11 ||
5391	!status->nss ||
5392	status->nss > 8,
5393	"Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
5394	status->rate_idx, status->nss))
5395	goto drop;
5396	break;
5397	case RX_ENC_HE:
5398	if (WARN_ONCE(status->rate_idx > 11 ||
5399	!status->nss ||
5400	status->nss > 8,
5401	"Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5402	status->rate_idx, status->nss))
5403	goto drop;
5404	break;
5405	case RX_ENC_EHT:
5406	if (WARN_ONCE(status->rate_idx > 15 ||
5407	!status->nss ||
5408	status->nss > 8 ||
5409	status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5410	"Rate marked as an EHT rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5411	status->rate_idx, status->nss, status->eht.gi))
5412	goto drop;
5413	break;
5414	default:
5415	WARN_ON_ONCE(1);
5416	fallthrough;
5417	case RX_ENC_LEGACY:
5418	if (WARN_ON(status->rate_idx >= sband->n_bitrates))
5419	goto drop;
5420	rate = &sband->bitrates[status->rate_idx];
5421	}
5422	}
5423
5424	if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
5425	goto drop;
5426
5427	status->rx_flags = 0;
5428
5429	kcov_remote_start_common(id: skb_get_kcov_handle(skb));
5430
5431	/*
5432	* Frames with failed FCS/PLCP checksum are not returned,
5433	* all other frames are returned without radiotap header
5434	* if it was previously present.
5435	* Also, frames with less than 16 bytes are dropped.
5436	*/
5437	if (!(status->flag & RX_FLAG_8023))
5438	skb = ieee80211_rx_monitor(local, origskb: skb, rate);
5439	if (skb) {
5440	if ((status->flag & RX_FLAG_8023) ||
5441	ieee80211_is_data_present(fc: hdr->frame_control))
5442	ieee80211_tpt_led_trig_rx(local, bytes: skb->len);
5443
5444	if (status->flag & RX_FLAG_8023)
5445	__ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5446	else
5447	__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
5448	}
5449
5450	kcov_remote_stop();
5451	return;
5452	drop:
5453	kfree_skb(skb);
5454	}
5455	EXPORT_SYMBOL(ieee80211_rx_list);
5456
5457	void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5458	struct sk_buff *skb, struct napi_struct *napi)
5459	{
5460	struct sk_buff *tmp;
5461	LIST_HEAD(list);
5462
5463
5464	/*
5465	* key references and virtual interfaces are protected using RCU
5466	* and this requires that we are in a read-side RCU section during
5467	* receive processing
5468	*/
5469	rcu_read_lock();
5470	ieee80211_rx_list(hw, pubsta, skb, &list);
5471	rcu_read_unlock();
5472
5473	if (!napi) {
5474	netif_receive_skb_list(head: &list);
5475	return;
5476	}
5477
5478	list_for_each_entry_safe(skb, tmp, &list, list) {
5479	skb_list_del_init(skb);
5480	napi_gro_receive(napi, skb);
5481	}
5482	}
5483	EXPORT_SYMBOL(ieee80211_rx_napi);
5484
5485	/* This is a version of the rx handler that can be called from hard irq
5486	* context. Post the skb on the queue and schedule the tasklet */
5487	void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
5488	{
5489	struct ieee80211_local *local = hw_to_local(hw);
5490
5491	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5492
5493	skb->pkt_type = IEEE80211_RX_MSG;
5494	skb_queue_tail(list: &local->skb_queue, newsk: skb);
5495	tasklet_schedule(t: &local->tasklet);
5496	}
5497	EXPORT_SYMBOL(ieee80211_rx_irqsafe);
5498