1	// SPDX-License-Identifier: GPL-2.0-only
2	/*
3	* Copyright 2002-2005, Instant802 Networks, Inc.
4	* Copyright 2005-2006, Devicescape Software, Inc.
5	* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
6	* Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
7	* Copyright 2013-2014 Intel Mobile Communications GmbH
8	* Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9	* Copyright (C) 2018-2023 Intel Corporation
10	*/
11
12	#include <linux/jiffies.h>
13	#include <linux/slab.h>
14	#include <linux/kernel.h>
15	#include <linux/skbuff.h>
16	#include <linux/netdevice.h>
17	#include <linux/etherdevice.h>
18	#include <linux/rcupdate.h>
19	#include <linux/export.h>
20	#include <linux/kcov.h>
21	#include <linux/bitops.h>
22	#include <net/mac80211.h>
23	#include <net/ieee80211_radiotap.h>
24	#include <asm/unaligned.h>
25
26	#include "ieee80211_i.h"
27	#include "driver-ops.h"
28	#include "led.h"
29	#include "mesh.h"
30	#include "wep.h"
31	#include "wpa.h"
32	#include "tkip.h"
33	#include "wme.h"
34	#include "rate.h"
35
36	/*
37	* monitor mode reception
38	*
39	* This function cleans up the SKB, i.e. it removes all the stuff
40	* only useful for monitoring.
41	*/
42	static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
43	unsigned int present_fcs_len,
44	unsigned int rtap_space)
45	{
46	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
47	struct ieee80211_hdr *hdr;
48	unsigned int hdrlen;
49	__le16 fc;
50
51	if (present_fcs_len)
52	__pskb_trim(skb, len: skb->len - present_fcs_len);
53	pskb_pull(skb, len: rtap_space);
54
55	/* After pulling radiotap header, clear all flags that indicate
56	* info in skb->data.
57	*/
58	status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |
59	RX_FLAG_RADIOTAP_LSIG |
60	RX_FLAG_RADIOTAP_HE_MU |
61	RX_FLAG_RADIOTAP_HE);
62
63	hdr = (void *)skb->data;
64	fc = hdr->frame_control;
65
66	/*
67	* Remove the HT-Control field (if present) on management
68	* frames after we've sent the frame to monitoring. We
69	* (currently) don't need it, and don't properly parse
70	* frames with it present, due to the assumption of a
71	* fixed management header length.
72	*/
73	if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
74	return skb;
75
76	hdrlen = ieee80211_hdrlen(fc);
77	hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
78
79	if (!pskb_may_pull(skb, len: hdrlen)) {
80	dev_kfree_skb(skb);
81	return NULL;
82	}
83
84	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
85	hdrlen - IEEE80211_HT_CTL_LEN);
86	pskb_pull(skb, IEEE80211_HT_CTL_LEN);
87
88	return skb;
89	}
90
91	static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
92	unsigned int rtap_space)
93	{
94	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
95	struct ieee80211_hdr *hdr;
96
97	hdr = (void *)(skb->data + rtap_space);
98
99	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
100	RX_FLAG_FAILED_PLCP_CRC |
101	RX_FLAG_ONLY_MONITOR |
102	RX_FLAG_NO_PSDU))
103	return true;
104
105	if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
106	return true;
107
108	if (ieee80211_is_ctl(fc: hdr->frame_control) &&
109	!ieee80211_is_pspoll(fc: hdr->frame_control) &&
110	!ieee80211_is_back_req(fc: hdr->frame_control))
111	return true;
112
113	return false;
114	}
115
116	static int
117	ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
118	struct ieee80211_rx_status *status,
119	struct sk_buff *skb)
120	{
121	int len;
122
123	/* always present fields */
124	len = sizeof(struct ieee80211_radiotap_header) + 8;
125
126	/* allocate extra bitmaps */
127	if (status->chains)
128	len += 4 * hweight8(status->chains);
129
130	if (ieee80211_have_rx_timestamp(status)) {
131	len = ALIGN(len, 8);
132	len += 8;
133	}
134	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
135	len += 1;
136
137	/* antenna field, if we don't have per-chain info */
138	if (!status->chains)
139	len += 1;
140
141	/* padding for RX_FLAGS if necessary */
142	len = ALIGN(len, 2);
143
144	if (status->encoding == RX_ENC_HT) /* HT info */
145	len += 3;
146
147	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
148	len = ALIGN(len, 4);
149	len += 8;
150	}
151
152	if (status->encoding == RX_ENC_VHT) {
153	len = ALIGN(len, 2);
154	len += 12;
155	}
156
157	if (local->hw.radiotap_timestamp.units_pos >= 0) {
158	len = ALIGN(len, 8);
159	len += 12;
160	}
161
162	if (status->encoding == RX_ENC_HE &&
163	status->flag & RX_FLAG_RADIOTAP_HE) {
164	len = ALIGN(len, 2);
165	len += 12;
166	BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
167	}
168
169	if (status->encoding == RX_ENC_HE &&
170	status->flag & RX_FLAG_RADIOTAP_HE_MU) {
171	len = ALIGN(len, 2);
172	len += 12;
173	BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
174	}
175
176	if (status->flag & RX_FLAG_NO_PSDU)
177	len += 1;
178
179	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
180	len = ALIGN(len, 2);
181	len += 4;
182	BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
183	}
184
185	if (status->chains) {
186	/* antenna and antenna signal fields */
187	len += 2 * hweight8(status->chains);
188	}
189
190	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
191	int tlv_offset = 0;
192
193	/*
194	* The position to look at depends on the existence (or non-
195	* existence) of other elements, so take that into account...
196	*/
197	if (status->flag & RX_FLAG_RADIOTAP_HE)
198	tlv_offset +=
199	sizeof(struct ieee80211_radiotap_he);
200	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
201	tlv_offset +=
202	sizeof(struct ieee80211_radiotap_he_mu);
203	if (status->flag & RX_FLAG_RADIOTAP_LSIG)
204	tlv_offset +=
205	sizeof(struct ieee80211_radiotap_lsig);
206
207	/* ensure 4 byte alignment for TLV */
208	len = ALIGN(len, 4);
209
210	/* TLVs until the mac header */
211	len += skb_mac_header(skb) - &skb->data[tlv_offset];
212	}
213
214	return len;
215	}
216
217	static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
218	int link_id,
219	struct sta_info *sta,
220	struct sk_buff *skb)
221	{
222	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
223
224	if (link_id >= 0) {
225	status->link_valid = 1;
226	status->link_id = link_id;
227	} else {
228	status->link_valid = 0;
229	}
230
231	skb_queue_tail(list: &sdata->skb_queue, newsk: skb);
232	wiphy_work_queue(wiphy: sdata->local->hw.wiphy, work: &sdata->work);
233	if (sta)
234	sta->deflink.rx_stats.packets++;
235	}
236
237	static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
238	int link_id,
239	struct sta_info *sta,
240	struct sk_buff *skb)
241	{
242	skb->protocol = 0;
243	__ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
244	}
245
246	static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
247	struct sk_buff *skb,
248	int rtap_space)
249	{
250	struct {
251	struct ieee80211_hdr_3addr hdr;
252	u8 category;
253	u8 action_code;
254	} __packed __aligned(2) action;
255
256	if (!sdata)
257	return;
258
259	BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
260
261	if (skb->len < rtap_space + sizeof(action) +
262	VHT_MUMIMO_GROUPS_DATA_LEN)
263	return;
264
265	if (!is_valid_ether_addr(addr: sdata->u.mntr.mu_follow_addr))
266	return;
267
268	skb_copy_bits(skb, offset: rtap_space, to: &action, len: sizeof(action));
269
270	if (!ieee80211_is_action(fc: action.hdr.frame_control))
271	return;
272
273	if (action.category != WLAN_CATEGORY_VHT)
274	return;
275
276	if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
277	return;
278
279	if (!ether_addr_equal(addr1: action.hdr.addr1, addr2: sdata->u.mntr.mu_follow_addr))
280	return;
281
282	skb = skb_copy(skb, GFP_ATOMIC);
283	if (!skb)
284	return;
285
286	ieee80211_queue_skb_to_iface(sdata, link_id: -1, NULL, skb);
287	}
288
289	/*
290	* ieee80211_add_rx_radiotap_header - add radiotap header
291	*
292	* add a radiotap header containing all the fields which the hardware provided.
293	*/
294	static void
295	ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
296	struct sk_buff *skb,
297	struct ieee80211_rate *rate,
298	int rtap_len, bool has_fcs)
299	{
300	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
301	struct ieee80211_radiotap_header *rthdr;
302	unsigned char *pos;
303	__le32 *it_present;
304	u32 it_present_val;
305	u16 rx_flags = 0;
306	u16 channel_flags = 0;
307	u32 tlvs_len = 0;
308	int mpdulen, chain;
309	unsigned long chains = status->chains;
310	struct ieee80211_radiotap_he he = {};
311	struct ieee80211_radiotap_he_mu he_mu = {};
312	struct ieee80211_radiotap_lsig lsig = {};
313
314	if (status->flag & RX_FLAG_RADIOTAP_HE) {
315	he = *(struct ieee80211_radiotap_he *)skb->data;
316	skb_pull(skb, len: sizeof(he));
317	WARN_ON_ONCE(status->encoding != RX_ENC_HE);
318	}
319
320	if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
321	he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
322	skb_pull(skb, len: sizeof(he_mu));
323	}
324
325	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
326	lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
327	skb_pull(skb, len: sizeof(lsig));
328	}
329
330	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
331	/* data is pointer at tlv all other info was pulled off */
332	tlvs_len = skb_mac_header(skb) - skb->data;
333	}
334
335	mpdulen = skb->len;
336	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
337	mpdulen += FCS_LEN;
338
339	rthdr = skb_push(skb, len: rtap_len - tlvs_len);
340	memset(rthdr, 0, rtap_len - tlvs_len);
341	it_present = &rthdr->it_present;
342
343	/* radiotap header, set always present flags */
344	rthdr->it_len = cpu_to_le16(rtap_len);
345	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
346	BIT(IEEE80211_RADIOTAP_CHANNEL) |
347	BIT(IEEE80211_RADIOTAP_RX_FLAGS);
348
349	if (!status->chains)
350	it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
351
352	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
353	it_present_val |=
354	BIT(IEEE80211_RADIOTAP_EXT) |
355	BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
356	put_unaligned_le32(val: it_present_val, p: it_present);
357	it_present++;
358	it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
359	BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
360	}
361
362	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
363	it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
364
365	put_unaligned_le32(val: it_present_val, p: it_present);
366
367	/* This references through an offset into it_optional[] rather
368	* than via it_present otherwise later uses of pos will cause
369	* the compiler to think we have walked past the end of the
370	* struct member.
371	*/
372	pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
373
374	/* the order of the following fields is important */
375
376	/* IEEE80211_RADIOTAP_TSFT */
377	if (ieee80211_have_rx_timestamp(status)) {
378	/* padding */
379	while ((pos - (u8 *)rthdr) & 7)
380	*pos++ = 0;
381	put_unaligned_le64(
382	val: ieee80211_calculate_rx_timestamp(local, status,
383	mpdu_len: mpdulen, mpdu_offset: 0),
384	p: pos);
385	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
386	pos += 8;
387	}
388
389	/* IEEE80211_RADIOTAP_FLAGS */
390	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
391	*pos |= IEEE80211_RADIOTAP_F_FCS;
392	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
393	*pos |= IEEE80211_RADIOTAP_F_BADFCS;
394	if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
395	*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
396	pos++;
397
398	/* IEEE80211_RADIOTAP_RATE */
399	if (!rate || status->encoding != RX_ENC_LEGACY) {
400	/*
401	* Without rate information don't add it. If we have,
402	* MCS information is a separate field in radiotap,
403	* added below. The byte here is needed as padding
404	* for the channel though, so initialise it to 0.
405	*/
406	*pos = 0;
407	} else {
408	int shift = 0;
409	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
410	if (status->bw == RATE_INFO_BW_10)
411	shift = 1;
412	else if (status->bw == RATE_INFO_BW_5)
413	shift = 2;
414	*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
415	}
416	pos++;
417
418	/* IEEE80211_RADIOTAP_CHANNEL */
419	/* TODO: frequency offset in KHz */
420	put_unaligned_le16(val: status->freq, p: pos);
421	pos += 2;
422	if (status->bw == RATE_INFO_BW_10)
423	channel_flags |= IEEE80211_CHAN_HALF;
424	else if (status->bw == RATE_INFO_BW_5)
425	channel_flags |= IEEE80211_CHAN_QUARTER;
426
427	if (status->band == NL80211_BAND_5GHZ ||
428	status->band == NL80211_BAND_6GHZ)
429	channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
430	else if (status->encoding != RX_ENC_LEGACY)
431	channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
432	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
433	channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
434	else if (rate)
435	channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
436	else
437	channel_flags |= IEEE80211_CHAN_2GHZ;
438	put_unaligned_le16(val: channel_flags, p: pos);
439	pos += 2;
440
441	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
442	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
443	!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
444	*pos = status->signal;
445	rthdr->it_present |=
446	cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
447	pos++;
448	}
449
450	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
451
452	if (!status->chains) {
453	/* IEEE80211_RADIOTAP_ANTENNA */
454	*pos = status->antenna;
455	pos++;
456	}
457
458	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
459
460	/* IEEE80211_RADIOTAP_RX_FLAGS */
461	/* ensure 2 byte alignment for the 2 byte field as required */
462	if ((pos - (u8 *)rthdr) & 1)
463	*pos++ = 0;
464	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
465	rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
466	put_unaligned_le16(val: rx_flags, p: pos);
467	pos += 2;
468
469	if (status->encoding == RX_ENC_HT) {
470	unsigned int stbc;
471
472	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
473	*pos = local->hw.radiotap_mcs_details;
474	if (status->enc_flags & RX_ENC_FLAG_HT_GF)
475	*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
476	if (status->enc_flags & RX_ENC_FLAG_LDPC)
477	*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
478	pos++;
479	*pos = 0;
480	if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
481	*pos |= IEEE80211_RADIOTAP_MCS_SGI;
482	if (status->bw == RATE_INFO_BW_40)
483	*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
484	if (status->enc_flags & RX_ENC_FLAG_HT_GF)
485	*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
486	if (status->enc_flags & RX_ENC_FLAG_LDPC)
487	*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
488	stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
489	*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
490	pos++;
491	*pos++ = status->rate_idx;
492	}
493
494	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
495	u16 flags = 0;
496
497	/* ensure 4 byte alignment */
498	while ((pos - (u8 *)rthdr) & 3)
499	pos++;
500	rthdr->it_present |=
501	cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
502	put_unaligned_le32(val: status->ampdu_reference, p: pos);
503	pos += 4;
504	if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
505	flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
506	if (status->flag & RX_FLAG_AMPDU_IS_LAST)
507	flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
508	if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
509	flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
510	if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
511	flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
512	if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
513	flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
514	if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
515	flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
516	put_unaligned_le16(val: flags, p: pos);
517	pos += 2;
518	if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
519	*pos++ = status->ampdu_delimiter_crc;
520	else
521	*pos++ = 0;
522	*pos++ = 0;
523	}
524
525	if (status->encoding == RX_ENC_VHT) {
526	u16 known = local->hw.radiotap_vht_details;
527
528	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
529	put_unaligned_le16(val: known, p: pos);
530	pos += 2;
531	/* flags */
532	if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
533	*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
534	/* in VHT, STBC is binary */
535	if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
536	*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
537	if (status->enc_flags & RX_ENC_FLAG_BF)
538	*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
539	pos++;
540	/* bandwidth */
541	switch (status->bw) {
542	case RATE_INFO_BW_80:
543	*pos++ = 4;
544	break;
545	case RATE_INFO_BW_160:
546	*pos++ = 11;
547	break;
548	case RATE_INFO_BW_40:
549	*pos++ = 1;
550	break;
551	default:
552	*pos++ = 0;
553	}
554	/* MCS/NSS */
555	*pos = (status->rate_idx << 4) | status->nss;
556	pos += 4;
557	/* coding field */
558	if (status->enc_flags & RX_ENC_FLAG_LDPC)
559	*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
560	pos++;
561	/* group ID */
562	pos++;
563	/* partial_aid */
564	pos += 2;
565	}
566
567	if (local->hw.radiotap_timestamp.units_pos >= 0) {
568	u16 accuracy = 0;
569	u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
570
571	rthdr->it_present |=
572	cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
573
574	/* ensure 8 byte alignment */
575	while ((pos - (u8 *)rthdr) & 7)
576	pos++;
577
578	put_unaligned_le64(val: status->device_timestamp, p: pos);
579	pos += sizeof(u64);
580
581	if (local->hw.radiotap_timestamp.accuracy >= 0) {
582	accuracy = local->hw.radiotap_timestamp.accuracy;
583	flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
584	}
585	put_unaligned_le16(val: accuracy, p: pos);
586	pos += sizeof(u16);
587
588	*pos++ = local->hw.radiotap_timestamp.units_pos;
589	*pos++ = flags;
590	}
591
592	if (status->encoding == RX_ENC_HE &&
593	status->flag & RX_FLAG_RADIOTAP_HE) {
594	#define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
595
596	if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
597	he.data6 |= HE_PREP(DATA6_NSTS,
598	FIELD_GET(RX_ENC_FLAG_STBC_MASK,
599	status->enc_flags));
600	he.data3 |= HE_PREP(DATA3_STBC, 1);
601	} else {
602	he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
603	}
604
605	#define CHECK_GI(s) \
606	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
607	(int)NL80211_RATE_INFO_HE_GI_##s)
608
609	CHECK_GI(0_8);
610	CHECK_GI(1_6);
611	CHECK_GI(3_2);
612
613	he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
614	he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
615	he.data3 |= HE_PREP(DATA3_CODING,
616	!!(status->enc_flags & RX_ENC_FLAG_LDPC));
617
618	he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
619
620	switch (status->bw) {
621	case RATE_INFO_BW_20:
622	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
623	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
624	break;
625	case RATE_INFO_BW_40:
626	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
627	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
628	break;
629	case RATE_INFO_BW_80:
630	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
631	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
632	break;
633	case RATE_INFO_BW_160:
634	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
635	IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
636	break;
637	case RATE_INFO_BW_HE_RU:
638	#define CHECK_RU_ALLOC(s) \
639	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
640	NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
641
642	CHECK_RU_ALLOC(26);
643	CHECK_RU_ALLOC(52);
644	CHECK_RU_ALLOC(106);
645	CHECK_RU_ALLOC(242);
646	CHECK_RU_ALLOC(484);
647	CHECK_RU_ALLOC(996);
648	CHECK_RU_ALLOC(2x996);
649
650	he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
651	status->he_ru + 4);
652	break;
653	default:
654	WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
655	}
656
657	/* ensure 2 byte alignment */
658	while ((pos - (u8 *)rthdr) & 1)
659	pos++;
660	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
661	memcpy(pos, &he, sizeof(he));
662	pos += sizeof(he);
663	}
664
665	if (status->encoding == RX_ENC_HE &&
666	status->flag & RX_FLAG_RADIOTAP_HE_MU) {
667	/* ensure 2 byte alignment */
668	while ((pos - (u8 *)rthdr) & 1)
669	pos++;
670	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
671	memcpy(pos, &he_mu, sizeof(he_mu));
672	pos += sizeof(he_mu);
673	}
674
675	if (status->flag & RX_FLAG_NO_PSDU) {
676	rthdr->it_present |=
677	cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
678	*pos++ = status->zero_length_psdu_type;
679	}
680
681	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
682	/* ensure 2 byte alignment */
683	while ((pos - (u8 *)rthdr) & 1)
684	pos++;
685	rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
686	memcpy(pos, &lsig, sizeof(lsig));
687	pos += sizeof(lsig);
688	}
689
690	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
691	*pos++ = status->chain_signal[chain];
692	*pos++ = chain;
693	}
694	}
695
696	static struct sk_buff *
697	ieee80211_make_monitor_skb(struct ieee80211_local *local,
698	struct sk_buff **origskb,
699	struct ieee80211_rate *rate,
700	int rtap_space, bool use_origskb)
701	{
702	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: *origskb);
703	int rt_hdrlen, needed_headroom;
704	struct sk_buff *skb;
705
706	/* room for the radiotap header based on driver features */
707	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, skb: *origskb);
708	needed_headroom = rt_hdrlen - rtap_space;
709
710	if (use_origskb) {
711	/* only need to expand headroom if necessary */
712	skb = *origskb;
713	*origskb = NULL;
714
715	/*
716	* This shouldn't trigger often because most devices have an
717	* RX header they pull before we get here, and that should
718	* be big enough for our radiotap information. We should
719	* probably export the length to drivers so that we can have
720	* them allocate enough headroom to start with.
721	*/
722	if (skb_headroom(skb) < needed_headroom &&
723	pskb_expand_head(skb, nhead: needed_headroom, ntail: 0, GFP_ATOMIC)) {
724	dev_kfree_skb(skb);
725	return NULL;
726	}
727	} else {
728	/*
729	* Need to make a copy and possibly remove radiotap header
730	* and FCS from the original.
731	*/
732	skb = skb_copy_expand(skb: *origskb, newheadroom: needed_headroom + NET_SKB_PAD,
733	newtailroom: 0, GFP_ATOMIC);
734
735	if (!skb)
736	return NULL;
737	}
738
739	/* prepend radiotap information */
740	ieee80211_add_rx_radiotap_header(local, skb, rate, rtap_len: rt_hdrlen, has_fcs: true);
741
742	skb_reset_mac_header(skb);
743	skb->ip_summed = CHECKSUM_UNNECESSARY;
744	skb->pkt_type = PACKET_OTHERHOST;
745	skb->protocol = htons(ETH_P_802_2);
746
747	return skb;
748	}
749
750	/*
751	* This function copies a received frame to all monitor interfaces and
752	* returns a cleaned-up SKB that no longer includes the FCS nor the
753	* radiotap header the driver might have added.
754	*/
755	static struct sk_buff *
756	ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
757	struct ieee80211_rate *rate)
758	{
759	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: origskb);
760	struct ieee80211_sub_if_data *sdata;
761	struct sk_buff *monskb = NULL;
762	int present_fcs_len = 0;
763	unsigned int rtap_space = 0;
764	struct ieee80211_sub_if_data *monitor_sdata =
765	rcu_dereference(local->monitor_sdata);
766	bool only_monitor = false;
767	unsigned int min_head_len;
768
769	if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&
770	!skb_mac_header_was_set(origskb))) {
771	/* with this skb no way to know where frame payload starts */
772	dev_kfree_skb(origskb);
773	return NULL;
774	}
775
776	if (status->flag & RX_FLAG_RADIOTAP_HE)
777	rtap_space += sizeof(struct ieee80211_radiotap_he);
778
779	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
780	rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
781
782	if (status->flag & RX_FLAG_RADIOTAP_LSIG)
783	rtap_space += sizeof(struct ieee80211_radiotap_lsig);
784
785	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
786	rtap_space += skb_mac_header(skb: origskb) - &origskb->data[rtap_space];
787
788	min_head_len = rtap_space;
789
790	/*
791	* First, we may need to make a copy of the skb because
792	* (1) we need to modify it for radiotap (if not present), and
793	* (2) the other RX handlers will modify the skb we got.
794	*
795	* We don't need to, of course, if we aren't going to return
796	* the SKB because it has a bad FCS/PLCP checksum.
797	*/
798
799	if (!(status->flag & RX_FLAG_NO_PSDU)) {
800	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
801	if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
802	/* driver bug */
803	WARN_ON(1);
804	dev_kfree_skb(origskb);
805	return NULL;
806	}
807	present_fcs_len = FCS_LEN;
808	}
809
810	/* also consider the hdr->frame_control */
811	min_head_len += 2;
812	}
813
814	/* ensure that the expected data elements are in skb head */
815	if (!pskb_may_pull(skb: origskb, len: min_head_len)) {
816	dev_kfree_skb(origskb);
817	return NULL;
818	}
819
820	only_monitor = should_drop_frame(skb: origskb, present_fcs_len, rtap_space);
821
822	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
823	if (only_monitor) {
824	dev_kfree_skb(origskb);
825	return NULL;
826	}
827
828	return ieee80211_clean_skb(skb: origskb, present_fcs_len,
829	rtap_space);
830	}
831
832	ieee80211_handle_mu_mimo_mon(sdata: monitor_sdata, skb: origskb, rtap_space);
833
834	list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
835	bool last_monitor = list_is_last(list: &sdata->u.mntr.list,
836	head: &local->mon_list);
837
838	if (!monskb)
839	monskb = ieee80211_make_monitor_skb(local, origskb: &origskb,
840	rate, rtap_space,
841	use_origskb: only_monitor &&
842	last_monitor);
843
844	if (monskb) {
845	struct sk_buff *skb;
846
847	if (last_monitor) {
848	skb = monskb;
849	monskb = NULL;
850	} else {
851	skb = skb_clone(skb: monskb, GFP_ATOMIC);
852	}
853
854	if (skb) {
855	skb->dev = sdata->dev;
856	dev_sw_netstats_rx_add(dev: skb->dev, len: skb->len);
857	netif_receive_skb(skb);
858	}
859	}
860
861	if (last_monitor)
862	break;
863	}
864
865	/* this happens if last_monitor was erroneously false */
866	dev_kfree_skb(monskb);
867
868	/* ditto */
869	if (!origskb)
870	return NULL;
871
872	return ieee80211_clean_skb(skb: origskb, present_fcs_len, rtap_space);
873	}
874
875	static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
876	{
877	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
878	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
879	int tid, seqno_idx, security_idx;
880
881	/* does the frame have a qos control field? */
882	if (ieee80211_is_data_qos(fc: hdr->frame_control)) {
883	u8 *qc = ieee80211_get_qos_ctl(hdr);
884	/* frame has qos control */
885	tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
886	if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
887	status->rx_flags |= IEEE80211_RX_AMSDU;
888
889	seqno_idx = tid;
890	security_idx = tid;
891	} else {
892	/*
893	* IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
894	*
895	* Sequence numbers for management frames, QoS data
896	* frames with a broadcast/multicast address in the
897	* Address 1 field, and all non-QoS data frames sent
898	* by QoS STAs are assigned using an additional single
899	* modulo-4096 counter, [...]
900	*
901	* We also use that counter for non-QoS STAs.
902	*/
903	seqno_idx = IEEE80211_NUM_TIDS;
904	security_idx = 0;
905	if (ieee80211_is_mgmt(fc: hdr->frame_control))
906	security_idx = IEEE80211_NUM_TIDS;
907	tid = 0;
908	}
909
910	rx->seqno_idx = seqno_idx;
911	rx->security_idx = security_idx;
912	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
913	* For now, set skb->priority to 0 for other cases. */
914	rx->skb->priority = (tid > 7) ? 0 : tid;
915	}
916
917	/**
918	* DOC: Packet alignment
919	*
920	* Drivers always need to pass packets that are aligned to two-byte boundaries
921	* to the stack.
922	*
923	* Additionally, should, if possible, align the payload data in a way that
924	* guarantees that the contained IP header is aligned to a four-byte
925	* boundary. In the case of regular frames, this simply means aligning the
926	* payload to a four-byte boundary (because either the IP header is directly
927	* contained, or IV/RFC1042 headers that have a length divisible by four are
928	* in front of it). If the payload data is not properly aligned and the
929	* architecture doesn't support efficient unaligned operations, mac80211
930	* will align the data.
931	*
932	* With A-MSDU frames, however, the payload data address must yield two modulo
933	* four because there are 14-byte 802.3 headers within the A-MSDU frames that
934	* push the IP header further back to a multiple of four again. Thankfully, the
935	* specs were sane enough this time around to require padding each A-MSDU
936	* subframe to a length that is a multiple of four.
937	*
938	* Padding like Atheros hardware adds which is between the 802.11 header and
939	* the payload is not supported, the driver is required to move the 802.11
940	* header to be directly in front of the payload in that case.
941	*/
942	static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
943	{
944	#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
945	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
946	#endif
947	}
948
949
950	/* rx handlers */
951
952	static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
953	{
954	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
955
956	if (is_multicast_ether_addr(addr: hdr->addr1))
957	return 0;
958
959	return ieee80211_is_robust_mgmt_frame(skb);
960	}
961
962
963	static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
964	{
965	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
966
967	if (!is_multicast_ether_addr(addr: hdr->addr1))
968	return 0;
969
970	return ieee80211_is_robust_mgmt_frame(skb);
971	}
972
973
974	/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
975	static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
976	{
977	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
978	struct ieee80211_mmie *mmie;
979	struct ieee80211_mmie_16 *mmie16;
980
981	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(addr: hdr->da))
982	return -1;
983
984	if (!ieee80211_is_robust_mgmt_frame(skb) &&
985	!ieee80211_is_beacon(fc: hdr->frame_control))
986	return -1; /* not a robust management frame */
987
988	mmie = (struct ieee80211_mmie *)
989	(skb->data + skb->len - sizeof(*mmie));
990	if (mmie->element_id == WLAN_EID_MMIE &&
991	mmie->length == sizeof(*mmie) - 2)
992	return le16_to_cpu(mmie->key_id);
993
994	mmie16 = (struct ieee80211_mmie_16 *)
995	(skb->data + skb->len - sizeof(*mmie16));
996	if (skb->len >= 24 + sizeof(*mmie16) &&
997	mmie16->element_id == WLAN_EID_MMIE &&
998	mmie16->length == sizeof(*mmie16) - 2)
999	return le16_to_cpu(mmie16->key_id);
1000
1001	return -1;
1002	}
1003
1004	static int ieee80211_get_keyid(struct sk_buff *skb)
1005	{
1006	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1007	__le16 fc = hdr->frame_control;
1008	int hdrlen = ieee80211_hdrlen(fc);
1009	u8 keyid;
1010
1011	/* WEP, TKIP, CCMP and GCMP */
1012	if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
1013	return -EINVAL;
1014
1015	skb_copy_bits(skb, offset: hdrlen + 3, to: &keyid, len: 1);
1016
1017	keyid >>= 6;
1018
1019	return keyid;
1020	}
1021
1022	static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1023	{
1024	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1025	char *dev_addr = rx->sdata->vif.addr;
1026
1027	if (ieee80211_is_data(fc: hdr->frame_control)) {
1028	if (is_multicast_ether_addr(addr: hdr->addr1)) {
1029	if (ieee80211_has_tods(fc: hdr->frame_control) ||
1030	!ieee80211_has_fromds(fc: hdr->frame_control))
1031	return RX_DROP_MONITOR;
1032	if (ether_addr_equal(addr1: hdr->addr3, addr2: dev_addr))
1033	return RX_DROP_MONITOR;
1034	} else {
1035	if (!ieee80211_has_a4(fc: hdr->frame_control))
1036	return RX_DROP_MONITOR;
1037	if (ether_addr_equal(addr1: hdr->addr4, addr2: dev_addr))
1038	return RX_DROP_MONITOR;
1039	}
1040	}
1041
1042	/* If there is not an established peer link and this is not a peer link
1043	* establisment frame, beacon or probe, drop the frame.
1044	*/
1045
1046	if (!rx->sta || sta_plink_state(sta: rx->sta) != NL80211_PLINK_ESTAB) {
1047	struct ieee80211_mgmt *mgmt;
1048
1049	if (!ieee80211_is_mgmt(fc: hdr->frame_control))
1050	return RX_DROP_MONITOR;
1051
1052	if (ieee80211_is_action(fc: hdr->frame_control)) {
1053	u8 category;
1054
1055	/* make sure category field is present */
1056	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
1057	return RX_DROP_MONITOR;
1058
1059	mgmt = (struct ieee80211_mgmt *)hdr;
1060	category = mgmt->u.action.category;
1061	if (category != WLAN_CATEGORY_MESH_ACTION &&
1062	category != WLAN_CATEGORY_SELF_PROTECTED)
1063	return RX_DROP_MONITOR;
1064	return RX_CONTINUE;
1065	}
1066
1067	if (ieee80211_is_probe_req(fc: hdr->frame_control) ||
1068	ieee80211_is_probe_resp(fc: hdr->frame_control) ||
1069	ieee80211_is_beacon(fc: hdr->frame_control) ||
1070	ieee80211_is_auth(fc: hdr->frame_control))
1071	return RX_CONTINUE;
1072
1073	return RX_DROP_MONITOR;
1074	}
1075
1076	return RX_CONTINUE;
1077	}
1078
1079	static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1080	int index)
1081	{
1082	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1083	struct sk_buff *tail = skb_peek_tail(list_: frames);
1084	struct ieee80211_rx_status *status;
1085
1086	if (tid_agg_rx->reorder_buf_filtered &&
1087	tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1088	return true;
1089
1090	if (!tail)
1091	return false;
1092
1093	status = IEEE80211_SKB_RXCB(skb: tail);
1094	if (status->flag & RX_FLAG_AMSDU_MORE)
1095	return false;
1096
1097	return true;
1098	}
1099
1100	static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1101	struct tid_ampdu_rx *tid_agg_rx,
1102	int index,
1103	struct sk_buff_head *frames)
1104	{
1105	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1106	struct sk_buff *skb;
1107	struct ieee80211_rx_status *status;
1108
1109	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1110
1111	if (skb_queue_empty(list: skb_list))
1112	goto no_frame;
1113
1114	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1115	__skb_queue_purge(list: skb_list);
1116	goto no_frame;
1117	}
1118
1119	/* release frames from the reorder ring buffer */
1120	tid_agg_rx->stored_mpdu_num--;
1121	while ((skb = __skb_dequeue(list: skb_list))) {
1122	status = IEEE80211_SKB_RXCB(skb);
1123	status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1124	__skb_queue_tail(list: frames, newsk: skb);
1125	}
1126
1127	no_frame:
1128	if (tid_agg_rx->reorder_buf_filtered)
1129	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1130	tid_agg_rx->head_seq_num = ieee80211_sn_inc(sn: tid_agg_rx->head_seq_num);
1131	}
1132
1133	static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1134	struct tid_ampdu_rx *tid_agg_rx,
1135	u16 head_seq_num,
1136	struct sk_buff_head *frames)
1137	{
1138	int index;
1139
1140	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1141
1142	while (ieee80211_sn_less(sn1: tid_agg_rx->head_seq_num, sn2: head_seq_num)) {
1143	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1144	ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1145	frames);
1146	}
1147	}
1148
1149	/*
1150	* Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1151	* the skb was added to the buffer longer than this time ago, the earlier
1152	* frames that have not yet been received are assumed to be lost and the skb
1153	* can be released for processing. This may also release other skb's from the
1154	* reorder buffer if there are no additional gaps between the frames.
1155	*
1156	* Callers must hold tid_agg_rx->reorder_lock.
1157	*/
1158	#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1159
1160	static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1161	struct tid_ampdu_rx *tid_agg_rx,
1162	struct sk_buff_head *frames)
1163	{
1164	int index, i, j;
1165
1166	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1167
1168	/* release the buffer until next missing frame */
1169	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1170	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1171	tid_agg_rx->stored_mpdu_num) {
1172	/*
1173	* No buffers ready to be released, but check whether any
1174	* frames in the reorder buffer have timed out.
1175	*/
1176	int skipped = 1;
1177	for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1178	j = (j + 1) % tid_agg_rx->buf_size) {
1179	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index: j)) {
1180	skipped++;
1181	continue;
1182	}
1183	if (skipped &&
1184	!time_after(jiffies, tid_agg_rx->reorder_time[j] +
1185	HT_RX_REORDER_BUF_TIMEOUT))
1186	goto set_release_timer;
1187
1188	/* don't leave incomplete A-MSDUs around */
1189	for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1190	i = (i + 1) % tid_agg_rx->buf_size)
1191	__skb_queue_purge(list: &tid_agg_rx->reorder_buf[i]);
1192
1193	ht_dbg_ratelimited(sdata,
1194	"release an RX reorder frame due to timeout on earlier frames\n");
1195	ieee80211_release_reorder_frame(sdata, tid_agg_rx, index: j,
1196	frames);
1197
1198	/*
1199	* Increment the head seq# also for the skipped slots.
1200	*/
1201	tid_agg_rx->head_seq_num =
1202	(tid_agg_rx->head_seq_num +
1203	skipped) & IEEE80211_SN_MASK;
1204	skipped = 0;
1205	}
1206	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1207	ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1208	frames);
1209	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1210	}
1211
1212	if (tid_agg_rx->stored_mpdu_num) {
1213	j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1214
1215	for (; j != (index - 1) % tid_agg_rx->buf_size;
1216	j = (j + 1) % tid_agg_rx->buf_size) {
1217	if (ieee80211_rx_reorder_ready(tid_agg_rx, index: j))
1218	break;
1219	}
1220
1221	set_release_timer:
1222
1223	if (!tid_agg_rx->removed)
1224	mod_timer(timer: &tid_agg_rx->reorder_timer,
1225	expires: tid_agg_rx->reorder_time[j] + 1 +
1226	HT_RX_REORDER_BUF_TIMEOUT);
1227	} else {
1228	del_timer(timer: &tid_agg_rx->reorder_timer);
1229	}
1230	}
1231
1232	/*
1233	* As this function belongs to the RX path it must be under
1234	* rcu_read_lock protection. It returns false if the frame
1235	* can be processed immediately, true if it was consumed.
1236	*/
1237	static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1238	struct tid_ampdu_rx *tid_agg_rx,
1239	struct sk_buff *skb,
1240	struct sk_buff_head *frames)
1241	{
1242	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1243	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1244	u16 sc = le16_to_cpu(hdr->seq_ctrl);
1245	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1246	u16 head_seq_num, buf_size;
1247	int index;
1248	bool ret = true;
1249
1250	spin_lock(lock: &tid_agg_rx->reorder_lock);
1251
1252	/*
1253	* Offloaded BA sessions have no known starting sequence number so pick
1254	* one from first Rxed frame for this tid after BA was started.
1255	*/
1256	if (unlikely(tid_agg_rx->auto_seq)) {
1257	tid_agg_rx->auto_seq = false;
1258	tid_agg_rx->ssn = mpdu_seq_num;
1259	tid_agg_rx->head_seq_num = mpdu_seq_num;
1260	}
1261
1262	buf_size = tid_agg_rx->buf_size;
1263	head_seq_num = tid_agg_rx->head_seq_num;
1264
1265	/*
1266	* If the current MPDU's SN is smaller than the SSN, it shouldn't
1267	* be reordered.
1268	*/
1269	if (unlikely(!tid_agg_rx->started)) {
1270	if (ieee80211_sn_less(sn1: mpdu_seq_num, sn2: head_seq_num)) {
1271	ret = false;
1272	goto out;
1273	}
1274	tid_agg_rx->started = true;
1275	}
1276
1277	/* frame with out of date sequence number */
1278	if (ieee80211_sn_less(sn1: mpdu_seq_num, sn2: head_seq_num)) {
1279	dev_kfree_skb(skb);
1280	goto out;
1281	}
1282
1283	/*
1284	* If frame the sequence number exceeds our buffering window
1285	* size release some previous frames to make room for this one.
1286	*/
1287	if (!ieee80211_sn_less(sn1: mpdu_seq_num, sn2: head_seq_num + buf_size)) {
1288	head_seq_num = ieee80211_sn_inc(
1289	sn: ieee80211_sn_sub(sn1: mpdu_seq_num, sn2: buf_size));
1290	/* release stored frames up to new head to stack */
1291	ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1292	head_seq_num, frames);
1293	}
1294
1295	/* Now the new frame is always in the range of the reordering buffer */
1296
1297	index = mpdu_seq_num % tid_agg_rx->buf_size;
1298
1299	/* check if we already stored this frame */
1300	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1301	dev_kfree_skb(skb);
1302	goto out;
1303	}
1304
1305	/*
1306	* If the current MPDU is in the right order and nothing else
1307	* is stored we can process it directly, no need to buffer it.
1308	* If it is first but there's something stored, we may be able
1309	* to release frames after this one.
1310	*/
1311	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1312	tid_agg_rx->stored_mpdu_num == 0) {
1313	if (!(status->flag & RX_FLAG_AMSDU_MORE))
1314	tid_agg_rx->head_seq_num =
1315	ieee80211_sn_inc(sn: tid_agg_rx->head_seq_num);
1316	ret = false;
1317	goto out;
1318	}
1319
1320	/* put the frame in the reordering buffer */
1321	__skb_queue_tail(list: &tid_agg_rx->reorder_buf[index], newsk: skb);
1322	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1323	tid_agg_rx->reorder_time[index] = jiffies;
1324	tid_agg_rx->stored_mpdu_num++;
1325	ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1326	}
1327
1328	out:
1329	spin_unlock(lock: &tid_agg_rx->reorder_lock);
1330	return ret;
1331	}
1332
1333	/*
1334	* Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1335	* true if the MPDU was buffered, false if it should be processed.
1336	*/
1337	static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1338	struct sk_buff_head *frames)
1339	{
1340	struct sk_buff *skb = rx->skb;
1341	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1342	struct sta_info *sta = rx->sta;
1343	struct tid_ampdu_rx *tid_agg_rx;
1344	u16 sc;
1345	u8 tid, ack_policy;
1346
1347	if (!ieee80211_is_data_qos(fc: hdr->frame_control) ||
1348	is_multicast_ether_addr(addr: hdr->addr1))
1349	goto dont_reorder;
1350
1351	/*
1352	* filter the QoS data rx stream according to
1353	* STA/TID and check if this STA/TID is on aggregation
1354	*/
1355
1356	if (!sta)
1357	goto dont_reorder;
1358
1359	ack_policy = *ieee80211_get_qos_ctl(hdr) &
1360	IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1361	tid = ieee80211_get_tid(hdr);
1362
1363	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1364	if (!tid_agg_rx) {
1365	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1366	!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1367	!test_and_set_bit(nr: tid, addr: rx->sta->ampdu_mlme.unexpected_agg))
1368	ieee80211_send_delba(sdata: rx->sdata, da: rx->sta->sta.addr, tid,
1369	initiator: WLAN_BACK_RECIPIENT,
1370	reason_code: WLAN_REASON_QSTA_REQUIRE_SETUP);
1371	goto dont_reorder;
1372	}
1373
1374	/* qos null data frames are excluded */
1375	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1376	goto dont_reorder;
1377
1378	/* not part of a BA session */
1379	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
1380	goto dont_reorder;
1381
1382	/* new, potentially un-ordered, ampdu frame - process it */
1383
1384	/* reset session timer */
1385	if (tid_agg_rx->timeout)
1386	tid_agg_rx->last_rx = jiffies;
1387
1388	/* if this mpdu is fragmented - terminate rx aggregation session */
1389	sc = le16_to_cpu(hdr->seq_ctrl);
1390	if (sc & IEEE80211_SCTL_FRAG) {
1391	ieee80211_queue_skb_to_iface(sdata: rx->sdata, link_id: rx->link_id, NULL, skb);
1392	return;
1393	}
1394
1395	/*
1396	* No locking needed -- we will only ever process one
1397	* RX packet at a time, and thus own tid_agg_rx. All
1398	* other code manipulating it needs to (and does) make
1399	* sure that we cannot get to it any more before doing
1400	* anything with it.
1401	*/
1402	if (ieee80211_sta_manage_reorder_buf(sdata: rx->sdata, tid_agg_rx, skb,
1403	frames))
1404	return;
1405
1406	dont_reorder:
1407	__skb_queue_tail(list: frames, newsk: skb);
1408	}
1409
1410	static ieee80211_rx_result debug_noinline
1411	ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1412	{
1413	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1414	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
1415
1416	if (status->flag & RX_FLAG_DUP_VALIDATED)
1417	return RX_CONTINUE;
1418
1419	/*
1420	* Drop duplicate 802.11 retransmissions
1421	* (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1422	*/
1423
1424	if (rx->skb->len < 24)
1425	return RX_CONTINUE;
1426
1427	if (ieee80211_is_ctl(fc: hdr->frame_control) ||
1428	ieee80211_is_any_nullfunc(fc: hdr->frame_control) ||
1429	is_multicast_ether_addr(addr: hdr->addr1))
1430	return RX_CONTINUE;
1431
1432	if (!rx->sta)
1433	return RX_CONTINUE;
1434
1435	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1436	rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1437	I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1438	rx->link_sta->rx_stats.num_duplicates++;
1439	return RX_DROP_U_DUP;
1440	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1441	rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1442	}
1443
1444	return RX_CONTINUE;
1445	}
1446
1447	static ieee80211_rx_result debug_noinline
1448	ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1449	{
1450	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1451
1452	/* Drop disallowed frame classes based on STA auth/assoc state;
1453	* IEEE 802.11, Chap 5.5.
1454	*
1455	* mac80211 filters only based on association state, i.e. it drops
1456	* Class 3 frames from not associated stations. hostapd sends
1457	* deauth/disassoc frames when needed. In addition, hostapd is
1458	* responsible for filtering on both auth and assoc states.
1459	*/
1460
1461	if (ieee80211_vif_is_mesh(vif: &rx->sdata->vif))
1462	return ieee80211_rx_mesh_check(rx);
1463
1464	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1465	ieee80211_is_pspoll(hdr->frame_control)) &&
1466	rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1467	rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1468	(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1469	/*
1470	* accept port control frames from the AP even when it's not
1471	* yet marked ASSOC to prevent a race where we don't set the
1472	* assoc bit quickly enough before it sends the first frame
1473	*/
1474	if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1475	ieee80211_is_data_present(fc: hdr->frame_control)) {
1476	unsigned int hdrlen;
1477	__be16 ethertype;
1478
1479	hdrlen = ieee80211_hdrlen(fc: hdr->frame_control);
1480
1481	if (rx->skb->len < hdrlen + 8)
1482	return RX_DROP_MONITOR;
1483
1484	skb_copy_bits(skb: rx->skb, offset: hdrlen + 6, to: &ethertype, len: 2);
1485	if (ethertype == rx->sdata->control_port_protocol)
1486	return RX_CONTINUE;
1487	}
1488
1489	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1490	cfg80211_rx_spurious_frame(dev: rx->sdata->dev,
1491	addr: hdr->addr2,
1492	GFP_ATOMIC))
1493	return RX_DROP_U_SPURIOUS;
1494
1495	return RX_DROP_MONITOR;
1496	}
1497
1498	return RX_CONTINUE;
1499	}
1500
1501
1502	static ieee80211_rx_result debug_noinline
1503	ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1504	{
1505	struct ieee80211_local *local;
1506	struct ieee80211_hdr *hdr;
1507	struct sk_buff *skb;
1508
1509	local = rx->local;
1510	skb = rx->skb;
1511	hdr = (struct ieee80211_hdr *) skb->data;
1512
1513	if (!local->pspolling)
1514	return RX_CONTINUE;
1515
1516	if (!ieee80211_has_fromds(fc: hdr->frame_control))
1517	/* this is not from AP */
1518	return RX_CONTINUE;
1519
1520	if (!ieee80211_is_data(fc: hdr->frame_control))
1521	return RX_CONTINUE;
1522
1523	if (!ieee80211_has_moredata(fc: hdr->frame_control)) {
1524	/* AP has no more frames buffered for us */
1525	local->pspolling = false;
1526	return RX_CONTINUE;
1527	}
1528
1529	/* more data bit is set, let's request a new frame from the AP */
1530	ieee80211_send_pspoll(local, sdata: rx->sdata);
1531
1532	return RX_CONTINUE;
1533	}
1534
1535	static void sta_ps_start(struct sta_info *sta)
1536	{
1537	struct ieee80211_sub_if_data *sdata = sta->sdata;
1538	struct ieee80211_local *local = sdata->local;
1539	struct ps_data *ps;
1540	int tid;
1541
1542	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1543	sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1544	ps = &sdata->bss->ps;
1545	else
1546	return;
1547
1548	atomic_inc(v: &ps->num_sta_ps);
1549	set_sta_flag(sta, flag: WLAN_STA_PS_STA);
1550	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1551	drv_sta_notify(local, sdata, cmd: STA_NOTIFY_SLEEP, sta: &sta->sta);
1552	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1553	sta->sta.addr, sta->sta.aid);
1554
1555	ieee80211_clear_fast_xmit(sta);
1556
1557	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1558	struct ieee80211_txq *txq = sta->sta.txq[tid];
1559	struct txq_info *txqi = to_txq_info(txq);
1560
1561	spin_lock(lock: &local->active_txq_lock[txq->ac]);
1562	if (!list_empty(head: &txqi->schedule_order))
1563	list_del_init(entry: &txqi->schedule_order);
1564	spin_unlock(lock: &local->active_txq_lock[txq->ac]);
1565
1566	if (txq_has_queue(txq))
1567	set_bit(nr: tid, addr: &sta->txq_buffered_tids);
1568	else
1569	clear_bit(nr: tid, addr: &sta->txq_buffered_tids);
1570	}
1571	}
1572
1573	static void sta_ps_end(struct sta_info *sta)
1574	{
1575	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1576	sta->sta.addr, sta->sta.aid);
1577
1578	if (test_sta_flag(sta, flag: WLAN_STA_PS_DRIVER)) {
1579	/*
1580	* Clear the flag only if the other one is still set
1581	* so that the TX path won't start TX'ing new frames
1582	* directly ... In the case that the driver flag isn't
1583	* set ieee80211_sta_ps_deliver_wakeup() will clear it.
1584	*/
1585	clear_sta_flag(sta, flag: WLAN_STA_PS_STA);
1586	ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1587	sta->sta.addr, sta->sta.aid);
1588	return;
1589	}
1590
1591	set_sta_flag(sta, flag: WLAN_STA_PS_DELIVER);
1592	clear_sta_flag(sta, flag: WLAN_STA_PS_STA);
1593	ieee80211_sta_ps_deliver_wakeup(sta);
1594	}
1595
1596	int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1597	{
1598	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1599	bool in_ps;
1600
1601	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1602
1603	/* Don't let the same PS state be set twice */
1604	in_ps = test_sta_flag(sta, flag: WLAN_STA_PS_STA);
1605	if ((start && in_ps) || (!start && !in_ps))
1606	return -EINVAL;
1607
1608	if (start)
1609	sta_ps_start(sta);
1610	else
1611	sta_ps_end(sta);
1612
1613	return 0;
1614	}
1615	EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1616
1617	void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1618	{
1619	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1620
1621	if (test_sta_flag(sta, flag: WLAN_STA_SP))
1622	return;
1623
1624	if (!test_sta_flag(sta, flag: WLAN_STA_PS_DRIVER))
1625	ieee80211_sta_ps_deliver_poll_response(sta);
1626	else
1627	set_sta_flag(sta, flag: WLAN_STA_PSPOLL);
1628	}
1629	EXPORT_SYMBOL(ieee80211_sta_pspoll);
1630
1631	void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1632	{
1633	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1634	int ac = ieee80211_ac_from_tid(tid);
1635
1636	/*
1637	* If this AC is not trigger-enabled do nothing unless the
1638	* driver is calling us after it already checked.
1639	*
1640	* NB: This could/should check a separate bitmap of trigger-
1641	* enabled queues, but for now we only implement uAPSD w/o
1642	* TSPEC changes to the ACs, so they're always the same.
1643	*/
1644	if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1645	tid != IEEE80211_NUM_TIDS)
1646	return;
1647
1648	/* if we are in a service period, do nothing */
1649	if (test_sta_flag(sta, flag: WLAN_STA_SP))
1650	return;
1651
1652	if (!test_sta_flag(sta, flag: WLAN_STA_PS_DRIVER))
1653	ieee80211_sta_ps_deliver_uapsd(sta);
1654	else
1655	set_sta_flag(sta, flag: WLAN_STA_UAPSD);
1656	}
1657	EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1658
1659	static ieee80211_rx_result debug_noinline
1660	ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1661	{
1662	struct ieee80211_sub_if_data *sdata = rx->sdata;
1663	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1664	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
1665
1666	if (!rx->sta)
1667	return RX_CONTINUE;
1668
1669	if (sdata->vif.type != NL80211_IFTYPE_AP &&
1670	sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1671	return RX_CONTINUE;
1672
1673	/*
1674	* The device handles station powersave, so don't do anything about
1675	* uAPSD and PS-Poll frames (the latter shouldn't even come up from
1676	* it to mac80211 since they're handled.)
1677	*/
1678	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1679	return RX_CONTINUE;
1680
1681	/*
1682	* Don't do anything if the station isn't already asleep. In
1683	* the uAPSD case, the station will probably be marked asleep,
1684	* in the PS-Poll case the station must be confused ...
1685	*/
1686	if (!test_sta_flag(sta: rx->sta, flag: WLAN_STA_PS_STA))
1687	return RX_CONTINUE;
1688
1689	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1690	ieee80211_sta_pspoll(&rx->sta->sta);
1691
1692	/* Free PS Poll skb here instead of returning RX_DROP that would
1693	* count as an dropped frame. */
1694	dev_kfree_skb(rx->skb);
1695
1696	return RX_QUEUED;
1697	} else if (!ieee80211_has_morefrags(fc: hdr->frame_control) &&
1698	!(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1699	ieee80211_has_pm(fc: hdr->frame_control) &&
1700	(ieee80211_is_data_qos(fc: hdr->frame_control) ||
1701	ieee80211_is_qos_nullfunc(fc: hdr->frame_control))) {
1702	u8 tid = ieee80211_get_tid(hdr);
1703
1704	ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1705	}
1706
1707	return RX_CONTINUE;
1708	}
1709
1710	static ieee80211_rx_result debug_noinline
1711	ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1712	{
1713	struct sta_info *sta = rx->sta;
1714	struct link_sta_info *link_sta = rx->link_sta;
1715	struct sk_buff *skb = rx->skb;
1716	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1717	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1718	int i;
1719
1720	if (!sta || !link_sta)
1721	return RX_CONTINUE;
1722
1723	/*
1724	* Update last_rx only for IBSS packets which are for the current
1725	* BSSID and for station already AUTHORIZED to avoid keeping the
1726	* current IBSS network alive in cases where other STAs start
1727	* using different BSSID. This will also give the station another
1728	* chance to restart the authentication/authorization in case
1729	* something went wrong the first time.
1730	*/
1731	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1732	u8 *bssid = ieee80211_get_bssid(hdr, len: rx->skb->len,
1733	type: NL80211_IFTYPE_ADHOC);
1734	if (ether_addr_equal(addr1: bssid, addr2: rx->sdata->u.ibss.bssid) &&
1735	test_sta_flag(sta, flag: WLAN_STA_AUTHORIZED)) {
1736	link_sta->rx_stats.last_rx = jiffies;
1737	if (ieee80211_is_data_present(fc: hdr->frame_control) &&
1738	!is_multicast_ether_addr(addr: hdr->addr1))
1739	link_sta->rx_stats.last_rate =
1740	sta_stats_encode_rate(s: status);
1741	}
1742	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1743	link_sta->rx_stats.last_rx = jiffies;
1744	} else if (!ieee80211_is_s1g_beacon(fc: hdr->frame_control) &&
1745	!is_multicast_ether_addr(addr: hdr->addr1)) {
1746	/*
1747	* Mesh beacons will update last_rx when if they are found to
1748	* match the current local configuration when processed.
1749	*/
1750	link_sta->rx_stats.last_rx = jiffies;
1751	if (ieee80211_is_data_present(fc: hdr->frame_control))
1752	link_sta->rx_stats.last_rate = sta_stats_encode_rate(s: status);
1753	}
1754
1755	link_sta->rx_stats.fragments++;
1756
1757	u64_stats_update_begin(syncp: &link_sta->rx_stats.syncp);
1758	link_sta->rx_stats.bytes += rx->skb->len;
1759	u64_stats_update_end(syncp: &link_sta->rx_stats.syncp);
1760
1761	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1762	link_sta->rx_stats.last_signal = status->signal;
1763	ewma_signal_add(e: &link_sta->rx_stats_avg.signal,
1764	val: -status->signal);
1765	}
1766
1767	if (status->chains) {
1768	link_sta->rx_stats.chains = status->chains;
1769	for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1770	int signal = status->chain_signal[i];
1771
1772	if (!(status->chains & BIT(i)))
1773	continue;
1774
1775	link_sta->rx_stats.chain_signal_last[i] = signal;
1776	ewma_signal_add(e: &link_sta->rx_stats_avg.chain_signal[i],
1777	val: -signal);
1778	}
1779	}
1780
1781	if (ieee80211_is_s1g_beacon(fc: hdr->frame_control))
1782	return RX_CONTINUE;
1783
1784	/*
1785	* Change STA power saving mode only at the end of a frame
1786	* exchange sequence, and only for a data or management
1787	* frame as specified in IEEE 802.11-2016 11.2.3.2
1788	*/
1789	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1790	!ieee80211_has_morefrags(fc: hdr->frame_control) &&
1791	!is_multicast_ether_addr(addr: hdr->addr1) &&
1792	(ieee80211_is_mgmt(fc: hdr->frame_control) ||
1793	ieee80211_is_data(fc: hdr->frame_control)) &&
1794	!(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1795	(rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1796	rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1797	if (test_sta_flag(sta, flag: WLAN_STA_PS_STA)) {
1798	if (!ieee80211_has_pm(fc: hdr->frame_control))
1799	sta_ps_end(sta);
1800	} else {
1801	if (ieee80211_has_pm(fc: hdr->frame_control))
1802	sta_ps_start(sta);
1803	}
1804	}
1805
1806	/* mesh power save support */
1807	if (ieee80211_vif_is_mesh(vif: &rx->sdata->vif))
1808	ieee80211_mps_rx_h_sta_process(sta, hdr);
1809
1810	/*
1811	* Drop (qos-)data::nullfunc frames silently, since they
1812	* are used only to control station power saving mode.
1813	*/
1814	if (ieee80211_is_any_nullfunc(fc: hdr->frame_control)) {
1815	I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1816
1817	/*
1818	* If we receive a 4-addr nullfunc frame from a STA
1819	* that was not moved to a 4-addr STA vlan yet send
1820	* the event to userspace and for older hostapd drop
1821	* the frame to the monitor interface.
1822	*/
1823	if (ieee80211_has_a4(fc: hdr->frame_control) &&
1824	(rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1825	(rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1826	!rx->sdata->u.vlan.sta))) {
1827	if (!test_and_set_sta_flag(sta, flag: WLAN_STA_4ADDR_EVENT))
1828	cfg80211_rx_unexpected_4addr_frame(
1829	dev: rx->sdata->dev, addr: sta->sta.addr,
1830	GFP_ATOMIC);
1831	return RX_DROP_M_UNEXPECTED_4ADDR_FRAME;
1832	}
1833	/*
1834	* Update counter and free packet here to avoid
1835	* counting this as a dropped packed.
1836	*/
1837	link_sta->rx_stats.packets++;
1838	dev_kfree_skb(rx->skb);
1839	return RX_QUEUED;
1840	}
1841
1842	return RX_CONTINUE;
1843	} /* ieee80211_rx_h_sta_process */
1844
1845	static struct ieee80211_key *
1846	ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1847	{
1848	struct ieee80211_key *key = NULL;
1849	int idx2;
1850
1851	/* Make sure key gets set if either BIGTK key index is set so that
1852	* ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
1853	* Beacon frames and Beacon frames that claim to use another BIGTK key
1854	* index (i.e., a key that we do not have).
1855	*/
1856
1857	if (idx < 0) {
1858	idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
1859	idx2 = idx + 1;
1860	} else {
1861	if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1862	idx2 = idx + 1;
1863	else
1864	idx2 = idx - 1;
1865	}
1866
1867	if (rx->link_sta)
1868	key = rcu_dereference(rx->link_sta->gtk[idx]);
1869	if (!key)
1870	key = rcu_dereference(rx->link->gtk[idx]);
1871	if (!key && rx->link_sta)
1872	key = rcu_dereference(rx->link_sta->gtk[idx2]);
1873	if (!key)
1874	key = rcu_dereference(rx->link->gtk[idx2]);
1875
1876	return key;
1877	}
1878
1879	static ieee80211_rx_result debug_noinline
1880	ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1881	{
1882	struct sk_buff *skb = rx->skb;
1883	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1884	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1885	int keyidx;
1886	ieee80211_rx_result result = RX_DROP_U_DECRYPT_FAIL;
1887	struct ieee80211_key *sta_ptk = NULL;
1888	struct ieee80211_key *ptk_idx = NULL;
1889	int mmie_keyidx = -1;
1890	__le16 fc;
1891
1892	if (ieee80211_is_ext(fc: hdr->frame_control))
1893	return RX_CONTINUE;
1894
1895	/*
1896	* Key selection 101
1897	*
1898	* There are five types of keys:
1899	* - GTK (group keys)
1900	* - IGTK (group keys for management frames)
1901	* - BIGTK (group keys for Beacon frames)
1902	* - PTK (pairwise keys)
1903	* - STK (station-to-station pairwise keys)
1904	*
1905	* When selecting a key, we have to distinguish between multicast
1906	* (including broadcast) and unicast frames, the latter can only
1907	* use PTKs and STKs while the former always use GTKs, IGTKs, and
1908	* BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
1909	* then unicast frames can also use key indices like GTKs. Hence, if we
1910	* don't have a PTK/STK we check the key index for a WEP key.
1911	*
1912	* Note that in a regular BSS, multicast frames are sent by the
1913	* AP only, associated stations unicast the frame to the AP first
1914	* which then multicasts it on their behalf.
1915	*
1916	* There is also a slight problem in IBSS mode: GTKs are negotiated
1917	* with each station, that is something we don't currently handle.
1918	* The spec seems to expect that one negotiates the same key with
1919	* every station but there's no such requirement; VLANs could be
1920	* possible.
1921	*/
1922
1923	/* start without a key */
1924	rx->key = NULL;
1925	fc = hdr->frame_control;
1926
1927	if (rx->sta) {
1928	int keyid = rx->sta->ptk_idx;
1929	sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1930
1931	if (ieee80211_has_protected(fc) &&
1932	!(status->flag & RX_FLAG_IV_STRIPPED)) {
1933	keyid = ieee80211_get_keyid(skb: rx->skb);
1934
1935	if (unlikely(keyid < 0))
1936	return RX_DROP_U_NO_KEY_ID;
1937
1938	ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
1939	}
1940	}
1941
1942	if (!ieee80211_has_protected(fc))
1943	mmie_keyidx = ieee80211_get_mmie_keyidx(skb: rx->skb);
1944
1945	if (!is_multicast_ether_addr(addr: hdr->addr1) && sta_ptk) {
1946	rx->key = ptk_idx ? ptk_idx : sta_ptk;
1947	if ((status->flag & RX_FLAG_DECRYPTED) &&
1948	(status->flag & RX_FLAG_IV_STRIPPED))
1949	return RX_CONTINUE;
1950	/* Skip decryption if the frame is not protected. */
1951	if (!ieee80211_has_protected(fc))
1952	return RX_CONTINUE;
1953	} else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
1954	/* Broadcast/multicast robust management frame / BIP */
1955	if ((status->flag & RX_FLAG_DECRYPTED) &&
1956	(status->flag & RX_FLAG_IV_STRIPPED))
1957	return RX_CONTINUE;
1958
1959	if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
1960	mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
1961	NUM_DEFAULT_BEACON_KEYS) {
1962	if (rx->sdata->dev)
1963	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
1964	buf: skb->data,
1965	len: skb->len);
1966	return RX_DROP_M_BAD_BCN_KEYIDX;
1967	}
1968
1969	rx->key = ieee80211_rx_get_bigtk(rx, idx: mmie_keyidx);
1970	if (!rx->key)
1971	return RX_CONTINUE; /* Beacon protection not in use */
1972	} else if (mmie_keyidx >= 0) {
1973	/* Broadcast/multicast robust management frame / BIP */
1974	if ((status->flag & RX_FLAG_DECRYPTED) &&
1975	(status->flag & RX_FLAG_IV_STRIPPED))
1976	return RX_CONTINUE;
1977
1978	if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1979	mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1980	return RX_DROP_M_BAD_MGMT_KEYIDX; /* unexpected BIP keyidx */
1981	if (rx->link_sta) {
1982	if (ieee80211_is_group_privacy_action(skb) &&
1983	test_sta_flag(sta: rx->sta, flag: WLAN_STA_MFP))
1984	return RX_DROP_MONITOR;
1985
1986	rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);
1987	}
1988	if (!rx->key)
1989	rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);
1990	} else if (!ieee80211_has_protected(fc)) {
1991	/*
1992	* The frame was not protected, so skip decryption. However, we
1993	* need to set rx->key if there is a key that could have been
1994	* used so that the frame may be dropped if encryption would
1995	* have been expected.
1996	*/
1997	struct ieee80211_key *key = NULL;
1998	int i;
1999
2000	if (ieee80211_is_beacon(fc)) {
2001	key = ieee80211_rx_get_bigtk(rx, idx: -1);
2002	} else if (ieee80211_is_mgmt(fc) &&
2003	is_multicast_ether_addr(addr: hdr->addr1)) {
2004	key = rcu_dereference(rx->link->default_mgmt_key);
2005	} else {
2006	if (rx->link_sta) {
2007	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2008	key = rcu_dereference(rx->link_sta->gtk[i]);
2009	if (key)
2010	break;
2011	}
2012	}
2013	if (!key) {
2014	for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2015	key = rcu_dereference(rx->link->gtk[i]);
2016	if (key)
2017	break;
2018	}
2019	}
2020	}
2021	if (key)
2022	rx->key = key;
2023	return RX_CONTINUE;
2024	} else {
2025	/*
2026	* The device doesn't give us the IV so we won't be
2027	* able to look up the key. That's ok though, we
2028	* don't need to decrypt the frame, we just won't
2029	* be able to keep statistics accurate.
2030	* Except for key threshold notifications, should
2031	* we somehow allow the driver to tell us which key
2032	* the hardware used if this flag is set?
2033	*/
2034	if ((status->flag & RX_FLAG_DECRYPTED) &&
2035	(status->flag & RX_FLAG_IV_STRIPPED))
2036	return RX_CONTINUE;
2037
2038	keyidx = ieee80211_get_keyid(skb: rx->skb);
2039
2040	if (unlikely(keyidx < 0))
2041	return RX_DROP_U_NO_KEY_ID;
2042
2043	/* check per-station GTK first, if multicast packet */
2044	if (is_multicast_ether_addr(addr: hdr->addr1) && rx->link_sta)
2045	rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);
2046
2047	/* if not found, try default key */
2048	if (!rx->key) {
2049	if (is_multicast_ether_addr(addr: hdr->addr1))
2050	rx->key = rcu_dereference(rx->link->gtk[keyidx]);
2051	if (!rx->key)
2052	rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2053
2054	/*
2055	* RSNA-protected unicast frames should always be
2056	* sent with pairwise or station-to-station keys,
2057	* but for WEP we allow using a key index as well.
2058	*/
2059	if (rx->key &&
2060	rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2061	rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2062	!is_multicast_ether_addr(addr: hdr->addr1))
2063	rx->key = NULL;
2064	}
2065	}
2066
2067	if (rx->key) {
2068	if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2069	return RX_DROP_MONITOR;
2070
2071	/* TODO: add threshold stuff again */
2072	} else {
2073	return RX_DROP_MONITOR;
2074	}
2075
2076	switch (rx->key->conf.cipher) {
2077	case WLAN_CIPHER_SUITE_WEP40:
2078	case WLAN_CIPHER_SUITE_WEP104:
2079	result = ieee80211_crypto_wep_decrypt(rx);
2080	break;
2081	case WLAN_CIPHER_SUITE_TKIP:
2082	result = ieee80211_crypto_tkip_decrypt(rx);
2083	break;
2084	case WLAN_CIPHER_SUITE_CCMP:
2085	result = ieee80211_crypto_ccmp_decrypt(
2086	rx, IEEE80211_CCMP_MIC_LEN);
2087	break;
2088	case WLAN_CIPHER_SUITE_CCMP_256:
2089	result = ieee80211_crypto_ccmp_decrypt(
2090	rx, IEEE80211_CCMP_256_MIC_LEN);
2091	break;
2092	case WLAN_CIPHER_SUITE_AES_CMAC:
2093	result = ieee80211_crypto_aes_cmac_decrypt(rx);
2094	break;
2095	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2096	result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
2097	break;
2098	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2099	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2100	result = ieee80211_crypto_aes_gmac_decrypt(rx);
2101	break;
2102	case WLAN_CIPHER_SUITE_GCMP:
2103	case WLAN_CIPHER_SUITE_GCMP_256:
2104	result = ieee80211_crypto_gcmp_decrypt(rx);
2105	break;
2106	default:
2107	result = RX_DROP_U_BAD_CIPHER;
2108	}
2109
2110	/* the hdr variable is invalid after the decrypt handlers */
2111
2112	/* either the frame has been decrypted or will be dropped */
2113	status->flag |= RX_FLAG_DECRYPTED;
2114
2115	if (unlikely(ieee80211_is_beacon(fc) && RX_RES_IS_UNUSABLE(result) &&
2116	rx->sdata->dev))
2117	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2118	buf: skb->data, len: skb->len);
2119
2120	return result;
2121	}
2122
2123	void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2124	{
2125	int i;
2126
2127	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2128	skb_queue_head_init(list: &cache->entries[i].skb_list);
2129	}
2130
2131	void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2132	{
2133	int i;
2134
2135	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2136	__skb_queue_purge(list: &cache->entries[i].skb_list);
2137	}
2138
2139	static inline struct ieee80211_fragment_entry *
2140	ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
2141	unsigned int frag, unsigned int seq, int rx_queue,
2142	struct sk_buff **skb)
2143	{
2144	struct ieee80211_fragment_entry *entry;
2145
2146	entry = &cache->entries[cache->next++];
2147	if (cache->next >= IEEE80211_FRAGMENT_MAX)
2148	cache->next = 0;
2149
2150	__skb_queue_purge(list: &entry->skb_list);
2151
2152	__skb_queue_tail(list: &entry->skb_list, newsk: *skb); /* no need for locking */
2153	*skb = NULL;
2154	entry->first_frag_time = jiffies;
2155	entry->seq = seq;
2156	entry->rx_queue = rx_queue;
2157	entry->last_frag = frag;
2158	entry->check_sequential_pn = false;
2159	entry->extra_len = 0;
2160
2161	return entry;
2162	}
2163
2164	static inline struct ieee80211_fragment_entry *
2165	ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
2166	unsigned int frag, unsigned int seq,
2167	int rx_queue, struct ieee80211_hdr *hdr)
2168	{
2169	struct ieee80211_fragment_entry *entry;
2170	int i, idx;
2171
2172	idx = cache->next;
2173	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2174	struct ieee80211_hdr *f_hdr;
2175	struct sk_buff *f_skb;
2176
2177	idx--;
2178	if (idx < 0)
2179	idx = IEEE80211_FRAGMENT_MAX - 1;
2180
2181	entry = &cache->entries[idx];
2182	if (skb_queue_empty(list: &entry->skb_list) || entry->seq != seq ||
2183	entry->rx_queue != rx_queue ||
2184	entry->last_frag + 1 != frag)
2185	continue;
2186
2187	f_skb = __skb_peek(list_: &entry->skb_list);
2188	f_hdr = (struct ieee80211_hdr *) f_skb->data;
2189
2190	/*
2191	* Check ftype and addresses are equal, else check next fragment
2192	*/
2193	if (((hdr->frame_control ^ f_hdr->frame_control) &
2194	cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2195	!ether_addr_equal(addr1: hdr->addr1, addr2: f_hdr->addr1) ||
2196	!ether_addr_equal(addr1: hdr->addr2, addr2: f_hdr->addr2))
2197	continue;
2198
2199	if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2200	__skb_queue_purge(list: &entry->skb_list);
2201	continue;
2202	}
2203	return entry;
2204	}
2205
2206	return NULL;
2207	}
2208
2209	static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2210	{
2211	return rx->key &&
2212	(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2213	rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2214	rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2215	rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2216	ieee80211_has_protected(fc);
2217	}
2218
2219	static ieee80211_rx_result debug_noinline
2220	ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2221	{
2222	struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
2223	struct ieee80211_hdr *hdr;
2224	u16 sc;
2225	__le16 fc;
2226	unsigned int frag, seq;
2227	struct ieee80211_fragment_entry *entry;
2228	struct sk_buff *skb;
2229	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
2230
2231	hdr = (struct ieee80211_hdr *)rx->skb->data;
2232	fc = hdr->frame_control;
2233
2234	if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
2235	return RX_CONTINUE;
2236
2237	sc = le16_to_cpu(hdr->seq_ctrl);
2238	frag = sc & IEEE80211_SCTL_FRAG;
2239
2240	if (rx->sta)
2241	cache = &rx->sta->frags;
2242
2243	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2244	goto out;
2245
2246	if (is_multicast_ether_addr(addr: hdr->addr1))
2247	return RX_DROP_MONITOR;
2248
2249	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2250
2251	if (skb_linearize(skb: rx->skb))
2252	return RX_DROP_U_OOM;
2253
2254	/*
2255	* skb_linearize() might change the skb->data and
2256	* previously cached variables (in this case, hdr) need to
2257	* be refreshed with the new data.
2258	*/
2259	hdr = (struct ieee80211_hdr *)rx->skb->data;
2260	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2261
2262	if (frag == 0) {
2263	/* This is the first fragment of a new frame. */
2264	entry = ieee80211_reassemble_add(cache, frag, seq,
2265	rx_queue: rx->seqno_idx, skb: &(rx->skb));
2266	if (requires_sequential_pn(rx, fc)) {
2267	int queue = rx->security_idx;
2268
2269	/* Store CCMP/GCMP PN so that we can verify that the
2270	* next fragment has a sequential PN value.
2271	*/
2272	entry->check_sequential_pn = true;
2273	entry->is_protected = true;
2274	entry->key_color = rx->key->color;
2275	memcpy(entry->last_pn,
2276	rx->key->u.ccmp.rx_pn[queue],
2277	IEEE80211_CCMP_PN_LEN);
2278	BUILD_BUG_ON(offsetof(struct ieee80211_key,
2279	u.ccmp.rx_pn) !=
2280	offsetof(struct ieee80211_key,
2281	u.gcmp.rx_pn));
2282	BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2283	sizeof(rx->key->u.gcmp.rx_pn[queue]));
2284	BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2285	IEEE80211_GCMP_PN_LEN);
2286	} else if (rx->key &&
2287	(ieee80211_has_protected(fc) ||
2288	(status->flag & RX_FLAG_DECRYPTED))) {
2289	entry->is_protected = true;
2290	entry->key_color = rx->key->color;
2291	}
2292	return RX_QUEUED;
2293	}
2294
2295	/* This is a fragment for a frame that should already be pending in
2296	* fragment cache. Add this fragment to the end of the pending entry.
2297	*/
2298	entry = ieee80211_reassemble_find(cache, frag, seq,
2299	rx_queue: rx->seqno_idx, hdr);
2300	if (!entry) {
2301	I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2302	return RX_DROP_MONITOR;
2303	}
2304
2305	/* "The receiver shall discard MSDUs and MMPDUs whose constituent
2306	* MPDU PN values are not incrementing in steps of 1."
2307	* see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2308	* and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2309	*/
2310	if (entry->check_sequential_pn) {
2311	int i;
2312	u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2313
2314	if (!requires_sequential_pn(rx, fc))
2315	return RX_DROP_U_NONSEQ_PN;
2316
2317	/* Prevent mixed key and fragment cache attacks */
2318	if (entry->key_color != rx->key->color)
2319	return RX_DROP_U_BAD_KEY_COLOR;
2320
2321	memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2322	for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2323	pn[i]++;
2324	if (pn[i])
2325	break;
2326	}
2327
2328	rpn = rx->ccm_gcm.pn;
2329	if (memcmp(p: pn, q: rpn, IEEE80211_CCMP_PN_LEN))
2330	return RX_DROP_U_REPLAY;
2331	memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2332	} else if (entry->is_protected &&
2333	(!rx->key ||
2334	(!ieee80211_has_protected(fc) &&
2335	!(status->flag & RX_FLAG_DECRYPTED)) ||
2336	rx->key->color != entry->key_color)) {
2337	/* Drop this as a mixed key or fragment cache attack, even
2338	* if for TKIP Michael MIC should protect us, and WEP is a
2339	* lost cause anyway.
2340	*/
2341	return RX_DROP_U_EXPECT_DEFRAG_PROT;
2342	} else if (entry->is_protected && rx->key &&
2343	entry->key_color != rx->key->color &&
2344	(status->flag & RX_FLAG_DECRYPTED)) {
2345	return RX_DROP_U_BAD_KEY_COLOR;
2346	}
2347
2348	skb_pull(skb: rx->skb, len: ieee80211_hdrlen(fc));
2349	__skb_queue_tail(list: &entry->skb_list, newsk: rx->skb);
2350	entry->last_frag = frag;
2351	entry->extra_len += rx->skb->len;
2352	if (ieee80211_has_morefrags(fc)) {
2353	rx->skb = NULL;
2354	return RX_QUEUED;
2355	}
2356
2357	rx->skb = __skb_dequeue(list: &entry->skb_list);
2358	if (skb_tailroom(skb: rx->skb) < entry->extra_len) {
2359	I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2360	if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2361	GFP_ATOMIC))) {
2362	I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2363	__skb_queue_purge(list: &entry->skb_list);
2364	return RX_DROP_U_OOM;
2365	}
2366	}
2367	while ((skb = __skb_dequeue(list: &entry->skb_list))) {
2368	skb_put_data(skb: rx->skb, data: skb->data, len: skb->len);
2369	dev_kfree_skb(skb);
2370	}
2371
2372	out:
2373	ieee80211_led_rx(local: rx->local);
2374	if (rx->sta)
2375	rx->link_sta->rx_stats.packets++;
2376	return RX_CONTINUE;
2377	}
2378
2379	static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2380	{
2381	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2382	return -EACCES;
2383
2384	return 0;
2385	}
2386
2387	static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2388	{
2389	struct sk_buff *skb = rx->skb;
2390	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2391
2392	/*
2393	* Pass through unencrypted frames if the hardware has
2394	* decrypted them already.
2395	*/
2396	if (status->flag & RX_FLAG_DECRYPTED)
2397	return 0;
2398
2399	/* Drop unencrypted frames if key is set. */
2400	if (unlikely(!ieee80211_has_protected(fc) &&
2401	!ieee80211_is_any_nullfunc(fc) &&
2402	ieee80211_is_data(fc) && rx->key))
2403	return -EACCES;
2404
2405	return 0;
2406	}
2407
2408	static ieee80211_rx_result
2409	ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2410	{
2411	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
2412	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2413	__le16 fc = mgmt->frame_control;
2414
2415	/*
2416	* Pass through unencrypted frames if the hardware has
2417	* decrypted them already.
2418	*/
2419	if (status->flag & RX_FLAG_DECRYPTED)
2420	return RX_CONTINUE;
2421
2422	/* drop unicast protected dual (that wasn't protected) */
2423	if (ieee80211_is_action(fc) &&
2424	mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
2425	return RX_DROP_U_UNPROT_DUAL;
2426
2427	if (rx->sta && test_sta_flag(sta: rx->sta, flag: WLAN_STA_MFP)) {
2428	if (unlikely(!ieee80211_has_protected(fc) &&
2429	ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {
2430	if (ieee80211_is_deauth(fc) ||
2431	ieee80211_is_disassoc(fc)) {
2432	/*
2433	* Permit unprotected deauth/disassoc frames
2434	* during 4-way-HS (key is installed after HS).
2435	*/
2436	if (!rx->key)
2437	return RX_CONTINUE;
2438
2439	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2440	buf: rx->skb->data,
2441	len: rx->skb->len);
2442	}
2443	return RX_DROP_U_UNPROT_UCAST_MGMT;
2444	}
2445	/* BIP does not use Protected field, so need to check MMIE */
2446	if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2447	ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2448	if (ieee80211_is_deauth(fc) ||
2449	ieee80211_is_disassoc(fc))
2450	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2451	buf: rx->skb->data,
2452	len: rx->skb->len);
2453	return RX_DROP_U_UNPROT_MCAST_MGMT;
2454	}
2455	if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2456	ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2457	cfg80211_rx_unprot_mlme_mgmt(dev: rx->sdata->dev,
2458	buf: rx->skb->data,
2459	len: rx->skb->len);
2460	return RX_DROP_U_UNPROT_BEACON;
2461	}
2462	/*
2463	* When using MFP, Action frames are not allowed prior to
2464	* having configured keys.
2465	*/
2466	if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2467	ieee80211_is_robust_mgmt_frame(rx->skb)))
2468	return RX_DROP_U_UNPROT_ACTION;
2469
2470	/* drop unicast public action frames when using MPF */
2471	if (is_unicast_ether_addr(addr: mgmt->da) &&
2472	ieee80211_is_protected_dual_of_public_action(skb: rx->skb))
2473	return RX_DROP_U_UNPROT_UNICAST_PUB_ACTION;
2474	}
2475
2476	/*
2477	* Drop robust action frames before assoc regardless of MFP state,
2478	* after assoc we also have decided on MFP or not.
2479	*/
2480	if (ieee80211_is_action(fc) &&
2481	ieee80211_is_robust_mgmt_frame(skb: rx->skb) &&
2482	(!rx->sta || !test_sta_flag(sta: rx->sta, flag: WLAN_STA_ASSOC)))
2483	return RX_DROP_U_UNPROT_ROBUST_ACTION;
2484
2485	return RX_CONTINUE;
2486	}
2487
2488	static ieee80211_rx_result
2489	__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2490	{
2491	struct ieee80211_sub_if_data *sdata = rx->sdata;
2492	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2493	bool check_port_control = false;
2494	struct ethhdr *ehdr;
2495	int ret;
2496
2497	*port_control = false;
2498	if (ieee80211_has_a4(fc: hdr->frame_control) &&
2499	sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2500	return RX_DROP_U_UNEXPECTED_VLAN_4ADDR;
2501
2502	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2503	!!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(fc: hdr->frame_control)) {
2504	if (!sdata->u.mgd.use_4addr)
2505	return RX_DROP_U_UNEXPECTED_STA_4ADDR;
2506	else if (!ether_addr_equal(addr1: hdr->addr1, addr2: sdata->vif.addr))
2507	check_port_control = true;
2508	}
2509
2510	if (is_multicast_ether_addr(addr: hdr->addr1) &&
2511	sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2512	return RX_DROP_U_UNEXPECTED_VLAN_MCAST;
2513
2514	ret = ieee80211_data_to_8023(skb: rx->skb, addr: sdata->vif.addr, iftype: sdata->vif.type);
2515	if (ret < 0)
2516	return RX_DROP_U_INVALID_8023;
2517
2518	ehdr = (struct ethhdr *) rx->skb->data;
2519	if (ehdr->h_proto == rx->sdata->control_port_protocol)
2520	*port_control = true;
2521	else if (check_port_control)
2522	return RX_DROP_U_NOT_PORT_CONTROL;
2523
2524	return RX_CONTINUE;
2525	}
2526
2527	bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
2528	const u8 *addr, int *out_link_id)
2529	{
2530	unsigned int link_id;
2531
2532	/* non-MLO, or MLD address replaced by hardware */
2533	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: addr))
2534	return true;
2535
2536	if (!ieee80211_vif_is_mld(vif: &sdata->vif))
2537	return false;
2538
2539	for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
2540	struct ieee80211_bss_conf *conf;
2541
2542	conf = rcu_dereference(sdata->vif.link_conf[link_id]);
2543
2544	if (!conf)
2545	continue;
2546	if (ether_addr_equal(addr1: conf->addr, addr2: addr)) {
2547	if (out_link_id)
2548	*out_link_id = link_id;
2549	return true;
2550	}
2551	}
2552
2553	return false;
2554	}
2555
2556	/*
2557	* requires that rx->skb is a frame with ethernet header
2558	*/
2559	static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2560	{
2561	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2562	= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2563	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2564
2565	/*
2566	* Allow EAPOL frames to us/the PAE group address regardless of
2567	* whether the frame was encrypted or not, and always disallow
2568	* all other destination addresses for them.
2569	*/
2570	if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2571	return ieee80211_is_our_addr(sdata: rx->sdata, addr: ehdr->h_dest, NULL) ||
2572	ether_addr_equal(addr1: ehdr->h_dest, addr2: pae_group_addr);
2573
2574	if (ieee80211_802_1x_port_control(rx) ||
2575	ieee80211_drop_unencrypted(rx, fc))
2576	return false;
2577
2578	return true;
2579	}
2580
2581	static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2582	struct ieee80211_rx_data *rx)
2583	{
2584	struct ieee80211_sub_if_data *sdata = rx->sdata;
2585	struct net_device *dev = sdata->dev;
2586
2587	if (unlikely((skb->protocol == sdata->control_port_protocol ||
2588	(skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2589	!sdata->control_port_no_preauth)) &&
2590	sdata->control_port_over_nl80211)) {
2591	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2592	bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2593
2594	cfg80211_rx_control_port(dev, skb, unencrypted: noencrypt, link_id: rx->link_id);
2595	dev_kfree_skb(skb);
2596	} else {
2597	struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2598
2599	memset(skb->cb, 0, sizeof(skb->cb));
2600
2601	/*
2602	* 802.1X over 802.11 requires that the authenticator address
2603	* be used for EAPOL frames. However, 802.1X allows the use of
2604	* the PAE group address instead. If the interface is part of
2605	* a bridge and we pass the frame with the PAE group address,
2606	* then the bridge will forward it to the network (even if the
2607	* client was not associated yet), which isn't supposed to
2608	* happen.
2609	* To avoid that, rewrite the destination address to our own
2610	* address, so that the authenticator (e.g. hostapd) will see
2611	* the frame, but bridge won't forward it anywhere else. Note
2612	* that due to earlier filtering, the only other address can
2613	* be the PAE group address, unless the hardware allowed them
2614	* through in 802.3 offloaded mode.
2615	*/
2616	if (unlikely(skb->protocol == sdata->control_port_protocol &&
2617	!ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2618	ether_addr_copy(dst: ehdr->h_dest, src: sdata->vif.addr);
2619
2620	/* deliver to local stack */
2621	if (rx->list)
2622	list_add_tail(new: &skb->list, head: rx->list);
2623	else
2624	netif_receive_skb(skb);
2625	}
2626	}
2627
2628	/*
2629	* requires that rx->skb is a frame with ethernet header
2630	*/
2631	static void
2632	ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2633	{
2634	struct ieee80211_sub_if_data *sdata = rx->sdata;
2635	struct net_device *dev = sdata->dev;
2636	struct sk_buff *skb, *xmit_skb;
2637	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2638	struct sta_info *dsta;
2639
2640	skb = rx->skb;
2641	xmit_skb = NULL;
2642
2643	dev_sw_netstats_rx_add(dev, len: skb->len);
2644
2645	if (rx->sta) {
2646	/* The seqno index has the same property as needed
2647	* for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2648	* for non-QoS-data frames. Here we know it's a data
2649	* frame, so count MSDUs.
2650	*/
2651	u64_stats_update_begin(syncp: &rx->link_sta->rx_stats.syncp);
2652	rx->link_sta->rx_stats.msdu[rx->seqno_idx]++;
2653	u64_stats_update_end(syncp: &rx->link_sta->rx_stats.syncp);
2654	}
2655
2656	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2657	sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2658	!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2659	ehdr->h_proto != rx->sdata->control_port_protocol &&
2660	(sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2661	if (is_multicast_ether_addr(addr: ehdr->h_dest) &&
2662	ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2663	/*
2664	* send multicast frames both to higher layers in
2665	* local net stack and back to the wireless medium
2666	*/
2667	xmit_skb = skb_copy(skb, GFP_ATOMIC);
2668	if (!xmit_skb)
2669	net_info_ratelimited("%s: failed to clone multicast frame\n",
2670	dev->name);
2671	} else if (!is_multicast_ether_addr(addr: ehdr->h_dest) &&
2672	!ether_addr_equal(addr1: ehdr->h_dest, addr2: ehdr->h_source)) {
2673	dsta = sta_info_get(sdata, addr: ehdr->h_dest);
2674	if (dsta) {
2675	/*
2676	* The destination station is associated to
2677	* this AP (in this VLAN), so send the frame
2678	* directly to it and do not pass it to local
2679	* net stack.
2680	*/
2681	xmit_skb = skb;
2682	skb = NULL;
2683	}
2684	}
2685	}
2686
2687	#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2688	if (skb) {
2689	/* 'align' will only take the values 0 or 2 here since all
2690	* frames are required to be aligned to 2-byte boundaries
2691	* when being passed to mac80211; the code here works just
2692	* as well if that isn't true, but mac80211 assumes it can
2693	* access fields as 2-byte aligned (e.g. for ether_addr_equal)
2694	*/
2695	int align;
2696
2697	align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2698	if (align) {
2699	if (WARN_ON(skb_headroom(skb) < 3)) {
2700	dev_kfree_skb(skb);
2701	skb = NULL;
2702	} else {
2703	u8 *data = skb->data;
2704	size_t len = skb_headlen(skb);
2705	skb->data -= align;
2706	memmove(skb->data, data, len);
2707	skb_set_tail_pointer(skb, len);
2708	}
2709	}
2710	}
2711	#endif
2712
2713	if (skb) {
2714	skb->protocol = eth_type_trans(skb, dev);
2715	ieee80211_deliver_skb_to_local_stack(skb, rx);
2716	}
2717
2718	if (xmit_skb) {
2719	/*
2720	* Send to wireless media and increase priority by 256 to
2721	* keep the received priority instead of reclassifying
2722	* the frame (see cfg80211_classify8021d).
2723	*/
2724	xmit_skb->priority += 256;
2725	xmit_skb->protocol = htons(ETH_P_802_3);
2726	skb_reset_network_header(skb: xmit_skb);
2727	skb_reset_mac_header(skb: xmit_skb);
2728	dev_queue_xmit(skb: xmit_skb);
2729	}
2730	}
2731
2732	#ifdef CONFIG_MAC80211_MESH
2733	static bool
2734	ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
2735	struct sk_buff *skb, int hdrlen)
2736	{
2737	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2738	struct ieee80211_mesh_fast_tx *entry = NULL;
2739	struct ieee80211s_hdr *mesh_hdr;
2740	struct tid_ampdu_tx *tid_tx;
2741	struct sta_info *sta;
2742	struct ethhdr eth;
2743	u8 tid;
2744
2745	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
2746	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2747	entry = mesh_fast_tx_get(sdata, addr: mesh_hdr->eaddr1);
2748	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
2749	entry = mesh_fast_tx_get(sdata, addr: skb->data);
2750	if (!entry)
2751	return false;
2752
2753	sta = rcu_dereference(entry->mpath->next_hop);
2754	if (!sta)
2755	return false;
2756
2757	if (skb_linearize(skb))
2758	return false;
2759
2760	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2761	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2762	if (tid_tx) {
2763	if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2764	return false;
2765
2766	if (tid_tx->timeout)
2767	tid_tx->last_tx = jiffies;
2768	}
2769
2770	ieee80211_aggr_check(sdata, sta, skb);
2771
2772	if (ieee80211_get_8023_tunnel_proto(hdr: skb->data + hdrlen,
2773	proto: &skb->protocol))
2774	hdrlen += ETH_ALEN;
2775	else
2776	skb->protocol = htons(skb->len - hdrlen);
2777	skb_set_network_header(skb, offset: hdrlen + 2);
2778
2779	skb->dev = sdata->dev;
2780	memcpy(&eth, skb->data, ETH_HLEN - 2);
2781	skb_pull(skb, len: 2);
2782	__ieee80211_xmit_fast(sdata, sta, fast_tx: &entry->fast_tx, skb, ampdu: tid_tx,
2783	da: eth.h_dest, sa: eth.h_source);
2784	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2785	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2786
2787	return true;
2788	}
2789	#endif
2790
2791	static ieee80211_rx_result
2792	ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
2793	struct sk_buff *skb)
2794	{
2795	#ifdef CONFIG_MAC80211_MESH
2796	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2797	struct ieee80211_local *local = sdata->local;
2798	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
2799	struct ieee80211_hdr hdr = {
2800	.frame_control = cpu_to_le16(fc)
2801	};
2802	struct ieee80211_hdr *fwd_hdr;
2803	struct ieee80211s_hdr *mesh_hdr;
2804	struct ieee80211_tx_info *info;
2805	struct sk_buff *fwd_skb;
2806	struct ethhdr *eth;
2807	bool multicast;
2808	int tailroom = 0;
2809	int hdrlen, mesh_hdrlen;
2810	u8 *qos;
2811
2812	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
2813	return RX_CONTINUE;
2814
2815	if (!pskb_may_pull(skb, len: sizeof(*eth) + 6))
2816	return RX_DROP_MONITOR;
2817
2818	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
2819	mesh_hdrlen = ieee80211_get_mesh_hdrlen(meshhdr: mesh_hdr);
2820
2821	if (!pskb_may_pull(skb, len: sizeof(*eth) + mesh_hdrlen))
2822	return RX_DROP_MONITOR;
2823
2824	eth = (struct ethhdr *)skb->data;
2825	multicast = is_multicast_ether_addr(addr: eth->h_dest);
2826
2827	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
2828	if (!mesh_hdr->ttl)
2829	return RX_DROP_MONITOR;
2830
2831	/* frame is in RMC, don't forward */
2832	if (is_multicast_ether_addr(addr: eth->h_dest) &&
2833	mesh_rmc_check(sdata, addr: eth->h_source, mesh_hdr))
2834	return RX_DROP_MONITOR;
2835
2836	/* forward packet */
2837	if (sdata->crypto_tx_tailroom_needed_cnt)
2838	tailroom = IEEE80211_ENCRYPT_TAILROOM;
2839
2840	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2841	struct mesh_path *mppath;
2842	char *proxied_addr;
2843	bool update = false;
2844
2845	if (multicast)
2846	proxied_addr = mesh_hdr->eaddr1;
2847	else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2848	/* has_a4 already checked in ieee80211_rx_mesh_check */
2849	proxied_addr = mesh_hdr->eaddr2;
2850	else
2851	return RX_DROP_MONITOR;
2852
2853	rcu_read_lock();
2854	mppath = mpp_path_lookup(sdata, dst: proxied_addr);
2855	if (!mppath) {
2856	mpp_path_add(sdata, dst: proxied_addr, mpp: eth->h_source);
2857	} else {
2858	spin_lock_bh(lock: &mppath->state_lock);
2859	if (!ether_addr_equal(addr1: mppath->mpp, addr2: eth->h_source)) {
2860	memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
2861	update = true;
2862	}
2863	mppath->exp_time = jiffies;
2864	spin_unlock_bh(lock: &mppath->state_lock);
2865	}
2866
2867	/* flush fast xmit cache if the address path changed */
2868	if (update)
2869	mesh_fast_tx_flush_addr(sdata, addr: proxied_addr);
2870
2871	rcu_read_unlock();
2872	}
2873
2874	/* Frame has reached destination. Don't forward */
2875	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: eth->h_dest))
2876	goto rx_accept;
2877
2878	if (!--mesh_hdr->ttl) {
2879	if (multicast)
2880	goto rx_accept;
2881
2882	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2883	return RX_DROP_MONITOR;
2884	}
2885
2886	if (!ifmsh->mshcfg.dot11MeshForwarding) {
2887	if (is_multicast_ether_addr(addr: eth->h_dest))
2888	goto rx_accept;
2889
2890	return RX_DROP_MONITOR;
2891	}
2892
2893	skb_set_queue_mapping(skb, queue_mapping: ieee802_1d_to_ac[skb->priority]);
2894
2895	if (!multicast &&
2896	ieee80211_rx_mesh_fast_forward(sdata, skb, hdrlen: mesh_hdrlen))
2897	return RX_QUEUED;
2898
2899	ieee80211_fill_mesh_addresses(hdr: &hdr, fc: &hdr.frame_control,
2900	da: eth->h_dest, sa: eth->h_source);
2901	hdrlen = ieee80211_hdrlen(fc: hdr.frame_control);
2902	if (multicast) {
2903	int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
2904
2905	fwd_skb = skb_copy_expand(skb, newheadroom: local->tx_headroom + extra_head +
2906	IEEE80211_ENCRYPT_HEADROOM,
2907	newtailroom: tailroom, GFP_ATOMIC);
2908	if (!fwd_skb)
2909	goto rx_accept;
2910	} else {
2911	fwd_skb = skb;
2912	skb = NULL;
2913
2914	if (skb_cow_head(skb: fwd_skb, headroom: hdrlen - sizeof(struct ethhdr)))
2915	return RX_DROP_U_OOM;
2916
2917	if (skb_linearize(skb: fwd_skb))
2918	return RX_DROP_U_OOM;
2919	}
2920
2921	fwd_hdr = skb_push(skb: fwd_skb, len: hdrlen - sizeof(struct ethhdr));
2922	memcpy(fwd_hdr, &hdr, hdrlen - 2);
2923	qos = ieee80211_get_qos_ctl(hdr: fwd_hdr);
2924	qos[0] = qos[1] = 0;
2925
2926	skb_reset_mac_header(skb: fwd_skb);
2927	hdrlen += mesh_hdrlen;
2928	if (ieee80211_get_8023_tunnel_proto(hdr: fwd_skb->data + hdrlen,
2929	proto: &fwd_skb->protocol))
2930	hdrlen += ETH_ALEN;
2931	else
2932	fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
2933	skb_set_network_header(skb: fwd_skb, offset: hdrlen + 2);
2934
2935	info = IEEE80211_SKB_CB(skb: fwd_skb);
2936	memset(info, 0, sizeof(*info));
2937	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
2938	info->control.vif = &sdata->vif;
2939	info->control.jiffies = jiffies;
2940	fwd_skb->dev = sdata->dev;
2941	if (multicast) {
2942	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2943	memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2944	/* update power mode indication when forwarding */
2945	ieee80211_mps_set_frame_flags(sdata, NULL, hdr: fwd_hdr);
2946	} else if (!mesh_nexthop_lookup(sdata, skb: fwd_skb)) {
2947	/* mesh power mode flags updated in mesh_nexthop_lookup */
2948	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2949	} else {
2950	/* unable to resolve next hop */
2951	if (sta)
2952	mesh_path_error_tx(sdata, ttl: ifmsh->mshcfg.element_ttl,
2953	target: hdr.addr3, target_sn: 0,
2954	target_rcode: WLAN_REASON_MESH_PATH_NOFORWARD,
2955	ra: sta->sta.addr);
2956	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2957	kfree_skb(skb: fwd_skb);
2958	goto rx_accept;
2959	}
2960
2961	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2962	ieee80211_add_pending_skb(local, skb: fwd_skb);
2963
2964	rx_accept:
2965	if (!skb)
2966	return RX_QUEUED;
2967
2968	ieee80211_strip_8023_mesh_hdr(skb);
2969	#endif
2970
2971	return RX_CONTINUE;
2972	}
2973
2974	static ieee80211_rx_result debug_noinline
2975	__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
2976	{
2977	struct net_device *dev = rx->sdata->dev;
2978	struct sk_buff *skb = rx->skb;
2979	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2980	__le16 fc = hdr->frame_control;
2981	struct sk_buff_head frame_list;
2982	ieee80211_rx_result res;
2983	struct ethhdr ethhdr;
2984	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
2985
2986	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2987	check_da = NULL;
2988	check_sa = NULL;
2989	} else switch (rx->sdata->vif.type) {
2990	case NL80211_IFTYPE_AP:
2991	case NL80211_IFTYPE_AP_VLAN:
2992	check_da = NULL;
2993	break;
2994	case NL80211_IFTYPE_STATION:
2995	if (!rx->sta ||
2996	!test_sta_flag(sta: rx->sta, flag: WLAN_STA_TDLS_PEER))
2997	check_sa = NULL;
2998	break;
2999	case NL80211_IFTYPE_MESH_POINT:
3000	check_sa = NULL;
3001	check_da = NULL;
3002	break;
3003	default:
3004	break;
3005	}
3006
3007	skb->dev = dev;
3008	__skb_queue_head_init(list: &frame_list);
3009
3010	if (ieee80211_data_to_8023_exthdr(skb, ehdr: &ethhdr,
3011	addr: rx->sdata->vif.addr,
3012	iftype: rx->sdata->vif.type,
3013	data_offset, is_amsdu: true))
3014	return RX_DROP_U_BAD_AMSDU;
3015
3016	if (rx->sta->amsdu_mesh_control < 0) {
3017	s8 valid = -1;
3018	int i;
3019
3020	for (i = 0; i <= 2; i++) {
3021	if (!ieee80211_is_valid_amsdu(skb, mesh_hdr: i))
3022	continue;
3023
3024	if (valid >= 0) {
3025	/* ambiguous */
3026	valid = -1;
3027	break;
3028	}
3029
3030	valid = i;
3031	}
3032
3033	rx->sta->amsdu_mesh_control = valid;
3034	}
3035
3036	ieee80211_amsdu_to_8023s(skb, list: &frame_list, addr: dev->dev_addr,
3037	iftype: rx->sdata->vif.type,
3038	extra_headroom: rx->local->hw.extra_tx_headroom,
3039	check_da, check_sa,
3040	mesh_control: rx->sta->amsdu_mesh_control);
3041
3042	while (!skb_queue_empty(list: &frame_list)) {
3043	rx->skb = __skb_dequeue(list: &frame_list);
3044
3045	res = ieee80211_rx_mesh_data(sdata: rx->sdata, sta: rx->sta, skb: rx->skb);
3046	switch (res) {
3047	case RX_QUEUED:
3048	continue;
3049	case RX_CONTINUE:
3050	break;
3051	default:
3052	goto free;
3053	}
3054
3055	if (!ieee80211_frame_allowed(rx, fc))
3056	goto free;
3057
3058	ieee80211_deliver_skb(rx);
3059	continue;
3060
3061	free:
3062	dev_kfree_skb(rx->skb);
3063	}
3064
3065	return RX_QUEUED;
3066	}
3067
3068	static ieee80211_rx_result debug_noinline
3069	ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
3070	{
3071	struct sk_buff *skb = rx->skb;
3072	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3073	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3074	__le16 fc = hdr->frame_control;
3075
3076	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
3077	return RX_CONTINUE;
3078
3079	if (unlikely(!ieee80211_is_data(fc)))
3080	return RX_CONTINUE;
3081
3082	if (unlikely(!ieee80211_is_data_present(fc)))
3083	return RX_DROP_MONITOR;
3084
3085	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3086	switch (rx->sdata->vif.type) {
3087	case NL80211_IFTYPE_AP_VLAN:
3088	if (!rx->sdata->u.vlan.sta)
3089	return RX_DROP_U_BAD_4ADDR;
3090	break;
3091	case NL80211_IFTYPE_STATION:
3092	if (!rx->sdata->u.mgd.use_4addr)
3093	return RX_DROP_U_BAD_4ADDR;
3094	break;
3095	case NL80211_IFTYPE_MESH_POINT:
3096	break;
3097	default:
3098	return RX_DROP_U_BAD_4ADDR;
3099	}
3100	}
3101
3102	if (is_multicast_ether_addr(addr: hdr->addr1) || !rx->sta)
3103	return RX_DROP_U_BAD_AMSDU;
3104
3105	if (rx->key) {
3106	/*
3107	* We should not receive A-MSDUs on pre-HT connections,
3108	* and HT connections cannot use old ciphers. Thus drop
3109	* them, as in those cases we couldn't even have SPP
3110	* A-MSDUs or such.
3111	*/
3112	switch (rx->key->conf.cipher) {
3113	case WLAN_CIPHER_SUITE_WEP40:
3114	case WLAN_CIPHER_SUITE_WEP104:
3115	case WLAN_CIPHER_SUITE_TKIP:
3116	return RX_DROP_U_BAD_AMSDU_CIPHER;
3117	default:
3118	break;
3119	}
3120	}
3121
3122	return __ieee80211_rx_h_amsdu(rx, data_offset: 0);
3123	}
3124
3125	static ieee80211_rx_result debug_noinline
3126	ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
3127	{
3128	struct ieee80211_sub_if_data *sdata = rx->sdata;
3129	struct ieee80211_local *local = rx->local;
3130	struct net_device *dev = sdata->dev;
3131	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3132	__le16 fc = hdr->frame_control;
3133	ieee80211_rx_result res;
3134	bool port_control;
3135
3136	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
3137	return RX_CONTINUE;
3138
3139	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3140	return RX_DROP_MONITOR;
3141
3142	/*
3143	* Send unexpected-4addr-frame event to hostapd. For older versions,
3144	* also drop the frame to cooked monitor interfaces.
3145	*/
3146	if (ieee80211_has_a4(fc: hdr->frame_control) &&
3147	sdata->vif.type == NL80211_IFTYPE_AP) {
3148	if (rx->sta &&
3149	!test_and_set_sta_flag(sta: rx->sta, flag: WLAN_STA_4ADDR_EVENT))
3150	cfg80211_rx_unexpected_4addr_frame(
3151	dev: rx->sdata->dev, addr: rx->sta->sta.addr, GFP_ATOMIC);
3152	return RX_DROP_MONITOR;
3153	}
3154
3155	res = __ieee80211_data_to_8023(rx, port_control: &port_control);
3156	if (unlikely(res != RX_CONTINUE))
3157	return res;
3158
3159	res = ieee80211_rx_mesh_data(sdata: rx->sdata, sta: rx->sta, skb: rx->skb);
3160	if (res != RX_CONTINUE)
3161	return res;
3162
3163	if (!ieee80211_frame_allowed(rx, fc))
3164	return RX_DROP_MONITOR;
3165
3166	/* directly handle TDLS channel switch requests/responses */
3167	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3168	cpu_to_be16(ETH_P_TDLS))) {
3169	struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3170
3171	if (pskb_may_pull(skb: rx->skb,
3172	offsetof(struct ieee80211_tdls_data, u)) &&
3173	tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3174	tf->category == WLAN_CATEGORY_TDLS &&
3175	(tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3176	tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
3177	rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3178	__ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id,
3179	sta: rx->sta, skb: rx->skb);
3180	return RX_QUEUED;
3181	}
3182	}
3183
3184	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3185	unlikely(port_control) && sdata->bss) {
3186	sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3187	u.ap);
3188	dev = sdata->dev;
3189	rx->sdata = sdata;
3190	}
3191
3192	rx->skb->dev = dev;
3193
3194	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3195	local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3196	!is_multicast_ether_addr(
3197	addr: ((struct ethhdr *)rx->skb->data)->h_dest) &&
3198	(!local->scanning &&
3199	!test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3200	mod_timer(timer: &local->dynamic_ps_timer, expires: jiffies +
3201	msecs_to_jiffies(m: local->hw.conf.dynamic_ps_timeout));
3202
3203	ieee80211_deliver_skb(rx);
3204
3205	return RX_QUEUED;
3206	}
3207
3208	static ieee80211_rx_result debug_noinline
3209	ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3210	{
3211	struct sk_buff *skb = rx->skb;
3212	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3213	struct tid_ampdu_rx *tid_agg_rx;
3214	u16 start_seq_num;
3215	u16 tid;
3216
3217	if (likely(!ieee80211_is_ctl(bar->frame_control)))
3218	return RX_CONTINUE;
3219
3220	if (ieee80211_is_back_req(fc: bar->frame_control)) {
3221	struct {
3222	__le16 control, start_seq_num;
3223	} __packed bar_data;
3224	struct ieee80211_event event = {
3225	.type = BAR_RX_EVENT,
3226	};
3227
3228	if (!rx->sta)
3229	return RX_DROP_MONITOR;
3230
3231	if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3232	to: &bar_data, len: sizeof(bar_data)))
3233	return RX_DROP_MONITOR;
3234
3235	tid = le16_to_cpu(bar_data.control) >> 12;
3236
3237	if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3238	!test_and_set_bit(nr: tid, addr: rx->sta->ampdu_mlme.unexpected_agg))
3239	ieee80211_send_delba(sdata: rx->sdata, da: rx->sta->sta.addr, tid,
3240	initiator: WLAN_BACK_RECIPIENT,
3241	reason_code: WLAN_REASON_QSTA_REQUIRE_SETUP);
3242
3243	tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3244	if (!tid_agg_rx)
3245	return RX_DROP_MONITOR;
3246
3247	start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3248	event.u.ba.tid = tid;
3249	event.u.ba.ssn = start_seq_num;
3250	event.u.ba.sta = &rx->sta->sta;
3251
3252	/* reset session timer */
3253	if (tid_agg_rx->timeout)
3254	mod_timer(timer: &tid_agg_rx->session_timer,
3255	TU_TO_EXP_TIME(tid_agg_rx->timeout));
3256
3257	spin_lock(lock: &tid_agg_rx->reorder_lock);
3258	/* release stored frames up to start of BAR */
3259	ieee80211_release_reorder_frames(sdata: rx->sdata, tid_agg_rx,
3260	head_seq_num: start_seq_num, frames);
3261	spin_unlock(lock: &tid_agg_rx->reorder_lock);
3262
3263	drv_event_callback(local: rx->local, sdata: rx->sdata, event: &event);
3264
3265	kfree_skb(skb);
3266	return RX_QUEUED;
3267	}
3268
3269	/*
3270	* After this point, we only want management frames,
3271	* so we can drop all remaining control frames to
3272	* cooked monitor interfaces.
3273	*/
3274	return RX_DROP_MONITOR;
3275	}
3276
3277	static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3278	struct ieee80211_mgmt *mgmt,
3279	size_t len)
3280	{
3281	struct ieee80211_local *local = sdata->local;
3282	struct sk_buff *skb;
3283	struct ieee80211_mgmt *resp;
3284
3285	if (!ether_addr_equal(addr1: mgmt->da, addr2: sdata->vif.addr)) {
3286	/* Not to own unicast address */
3287	return;
3288	}
3289
3290	if (!ether_addr_equal(addr1: mgmt->sa, addr2: sdata->deflink.u.mgd.bssid) ||
3291	!ether_addr_equal(addr1: mgmt->bssid, addr2: sdata->deflink.u.mgd.bssid)) {
3292	/* Not from the current AP or not associated yet. */
3293	return;
3294	}
3295
3296	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
3297	/* Too short SA Query request frame */
3298	return;
3299	}
3300
3301	skb = dev_alloc_skb(length: sizeof(*resp) + local->hw.extra_tx_headroom);
3302	if (skb == NULL)
3303	return;
3304
3305	skb_reserve(skb, len: local->hw.extra_tx_headroom);
3306	resp = skb_put_zero(skb, len: 24);
3307	memcpy(resp->da, mgmt->sa, ETH_ALEN);
3308	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3309	memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
3310	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3311	IEEE80211_STYPE_ACTION);
3312	skb_put(skb, len: 1 + sizeof(resp->u.action.u.sa_query));
3313	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3314	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
3315	memcpy(resp->u.action.u.sa_query.trans_id,
3316	mgmt->u.action.u.sa_query.trans_id,
3317	WLAN_SA_QUERY_TR_ID_LEN);
3318
3319	ieee80211_tx_skb(sdata, skb);
3320	}
3321
3322	static void
3323	ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3324	{
3325	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3326	const struct element *ie;
3327	size_t baselen;
3328
3329	if (!wiphy_ext_feature_isset(wiphy: rx->local->hw.wiphy,
3330	ftidx: NL80211_EXT_FEATURE_BSS_COLOR))
3331	return;
3332
3333	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3334	return;
3335
3336	if (rx->sdata->vif.bss_conf.csa_active)
3337	return;
3338
3339	baselen = mgmt->u.beacon.variable - rx->skb->data;
3340	if (baselen > rx->skb->len)
3341	return;
3342
3343	ie = cfg80211_find_ext_elem(ext_eid: WLAN_EID_EXT_HE_OPERATION,
3344	ies: mgmt->u.beacon.variable,
3345	len: rx->skb->len - baselen);
3346	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3347	ie->datalen >= ieee80211_he_oper_size(he_oper_ie: ie->data + 1)) {
3348	struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf;
3349	const struct ieee80211_he_operation *he_oper;
3350	u8 color;
3351
3352	he_oper = (void *)(ie->data + 1);
3353	if (le32_get_bits(v: he_oper->he_oper_params,
3354	IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3355	return;
3356
3357	color = le32_get_bits(v: he_oper->he_oper_params,
3358	IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3359	if (color == bss_conf->he_bss_color.color)
3360	ieee80211_obss_color_collision_notify(vif: &rx->sdata->vif,
3361	BIT_ULL(color),
3362	GFP_ATOMIC);
3363	}
3364	}
3365
3366	static ieee80211_rx_result debug_noinline
3367	ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3368	{
3369	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3370	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3371
3372	if (ieee80211_is_s1g_beacon(fc: mgmt->frame_control))
3373	return RX_CONTINUE;
3374
3375	/*
3376	* From here on, look only at management frames.
3377	* Data and control frames are already handled,
3378	* and unknown (reserved) frames are useless.
3379	*/
3380	if (rx->skb->len < 24)
3381	return RX_DROP_MONITOR;
3382
3383	if (!ieee80211_is_mgmt(fc: mgmt->frame_control))
3384	return RX_DROP_MONITOR;
3385
3386	/* drop too small action frames */
3387	if (ieee80211_is_action(fc: mgmt->frame_control) &&
3388	rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
3389	return RX_DROP_U_RUNT_ACTION;
3390
3391	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3392	ieee80211_is_beacon(fc: mgmt->frame_control) &&
3393	!(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3394	int sig = 0;
3395
3396	/* sw bss color collision detection */
3397	ieee80211_rx_check_bss_color_collision(rx);
3398
3399	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3400	!(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3401	sig = status->signal;
3402
3403	cfg80211_report_obss_beacon_khz(wiphy: rx->local->hw.wiphy,
3404	frame: rx->skb->data, len: rx->skb->len,
3405	freq: ieee80211_rx_status_to_khz(rx_status: status),
3406	sig_dbm: sig);
3407	rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3408	}
3409
3410	return ieee80211_drop_unencrypted_mgmt(rx);
3411	}
3412
3413	static bool
3414	ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3415	{
3416	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
3417	struct ieee80211_sub_if_data *sdata = rx->sdata;
3418
3419	/* TWT actions are only supported in AP for the moment */
3420	if (sdata->vif.type != NL80211_IFTYPE_AP)
3421	return false;
3422
3423	if (!rx->local->ops->add_twt_setup)
3424	return false;
3425
3426	if (!sdata->vif.bss_conf.twt_responder)
3427	return false;
3428
3429	if (!rx->sta)
3430	return false;
3431
3432	switch (mgmt->u.action.u.s1g.action_code) {
3433	case WLAN_S1G_TWT_SETUP: {
3434	struct ieee80211_twt_setup *twt;
3435
3436	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3437	1 + /* action code */
3438	sizeof(struct ieee80211_twt_setup) +
3439	2 /* TWT req_type agrt */)
3440	break;
3441
3442	twt = (void *)mgmt->u.action.u.s1g.variable;
3443	if (twt->element_id != WLAN_EID_S1G_TWT)
3444	break;
3445
3446	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3447	4 + /* action code + token + tlv */
3448	twt->length)
3449	break;
3450
3451	return true; /* queue the frame */
3452	}
3453	case WLAN_S1G_TWT_TEARDOWN:
3454	if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
3455	break;
3456
3457	return true; /* queue the frame */
3458	default:
3459	break;
3460	}
3461
3462	return false;
3463	}
3464
3465	static ieee80211_rx_result debug_noinline
3466	ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3467	{
3468	struct ieee80211_local *local = rx->local;
3469	struct ieee80211_sub_if_data *sdata = rx->sdata;
3470	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3471	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3472	int len = rx->skb->len;
3473
3474	if (!ieee80211_is_action(fc: mgmt->frame_control))
3475	return RX_CONTINUE;
3476
3477	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3478	mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3479	mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3480	return RX_DROP_U_ACTION_UNKNOWN_SRC;
3481
3482	switch (mgmt->u.action.category) {
3483	case WLAN_CATEGORY_HT:
3484	/* reject HT action frames from stations not supporting HT */
3485	if (!rx->link_sta->pub->ht_cap.ht_supported)
3486	goto invalid;
3487
3488	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3489	sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3490	sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3491	sdata->vif.type != NL80211_IFTYPE_AP &&
3492	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3493	break;
3494
3495	/* verify action & smps_control/chanwidth are present */
3496	if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3497	goto invalid;
3498
3499	switch (mgmt->u.action.u.ht_smps.action) {
3500	case WLAN_HT_ACTION_SMPS: {
3501	struct ieee80211_supported_band *sband;
3502	enum ieee80211_smps_mode smps_mode;
3503	struct sta_opmode_info sta_opmode = {};
3504
3505	if (sdata->vif.type != NL80211_IFTYPE_AP &&
3506	sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3507	goto handled;
3508
3509	/* convert to HT capability */
3510	switch (mgmt->u.action.u.ht_smps.smps_control) {
3511	case WLAN_HT_SMPS_CONTROL_DISABLED:
3512	smps_mode = IEEE80211_SMPS_OFF;
3513	break;
3514	case WLAN_HT_SMPS_CONTROL_STATIC:
3515	smps_mode = IEEE80211_SMPS_STATIC;
3516	break;
3517	case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3518	smps_mode = IEEE80211_SMPS_DYNAMIC;
3519	break;
3520	default:
3521	goto invalid;
3522	}
3523
3524	/* if no change do nothing */
3525	if (rx->link_sta->pub->smps_mode == smps_mode)
3526	goto handled;
3527	rx->link_sta->pub->smps_mode = smps_mode;
3528	sta_opmode.smps_mode =
3529	ieee80211_smps_mode_to_smps_mode(smps: smps_mode);
3530	sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3531
3532	sband = rx->local->hw.wiphy->bands[status->band];
3533
3534	rate_control_rate_update(local, sband, sta: rx->sta, link_id: 0,
3535	changed: IEEE80211_RC_SMPS_CHANGED);
3536	cfg80211_sta_opmode_change_notify(dev: sdata->dev,
3537	mac: rx->sta->addr,
3538	sta_opmode: &sta_opmode,
3539	GFP_ATOMIC);
3540	goto handled;
3541	}
3542	case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3543	struct ieee80211_supported_band *sband;
3544	u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
3545	enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
3546	struct sta_opmode_info sta_opmode = {};
3547
3548	/* If it doesn't support 40 MHz it can't change ... */
3549	if (!(rx->link_sta->pub->ht_cap.cap &
3550	IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3551	goto handled;
3552
3553	if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
3554	max_bw = IEEE80211_STA_RX_BW_20;
3555	else
3556	max_bw = ieee80211_sta_cap_rx_bw(link_sta: rx->link_sta);
3557
3558	/* set cur_max_bandwidth and recalc sta bw */
3559	rx->link_sta->cur_max_bandwidth = max_bw;
3560	new_bw = ieee80211_sta_cur_vht_bw(link_sta: rx->link_sta);
3561
3562	if (rx->link_sta->pub->bandwidth == new_bw)
3563	goto handled;
3564
3565	rx->link_sta->pub->bandwidth = new_bw;
3566	sband = rx->local->hw.wiphy->bands[status->band];
3567	sta_opmode.bw =
3568	ieee80211_sta_rx_bw_to_chan_width(sta: rx->link_sta);
3569	sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
3570
3571	rate_control_rate_update(local, sband, sta: rx->sta, link_id: 0,
3572	changed: IEEE80211_RC_BW_CHANGED);
3573	cfg80211_sta_opmode_change_notify(dev: sdata->dev,
3574	mac: rx->sta->addr,
3575	sta_opmode: &sta_opmode,
3576	GFP_ATOMIC);
3577	goto handled;
3578	}
3579	default:
3580	goto invalid;
3581	}
3582
3583	break;
3584	case WLAN_CATEGORY_PUBLIC:
3585	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3586	goto invalid;
3587	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3588	break;
3589	if (!rx->sta)
3590	break;
3591	if (!ether_addr_equal(addr1: mgmt->bssid, addr2: sdata->deflink.u.mgd.bssid))
3592	break;
3593	if (mgmt->u.action.u.ext_chan_switch.action_code !=
3594	WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3595	break;
3596	if (len < offsetof(struct ieee80211_mgmt,
3597	u.action.u.ext_chan_switch.variable))
3598	goto invalid;
3599	goto queue;
3600	case WLAN_CATEGORY_VHT:
3601	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3602	sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3603	sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3604	sdata->vif.type != NL80211_IFTYPE_AP &&
3605	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3606	break;
3607
3608	/* verify action code is present */
3609	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3610	goto invalid;
3611
3612	switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
3613	case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3614	/* verify opmode is present */
3615	if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3616	goto invalid;
3617	goto queue;
3618	}
3619	case WLAN_VHT_ACTION_GROUPID_MGMT: {
3620	if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3621	goto invalid;
3622	goto queue;
3623	}
3624	default:
3625	break;
3626	}
3627	break;
3628	case WLAN_CATEGORY_BACK:
3629	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3630	sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3631	sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3632	sdata->vif.type != NL80211_IFTYPE_AP &&
3633	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3634	break;
3635
3636	/* verify action_code is present */
3637	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3638	break;
3639
3640	switch (mgmt->u.action.u.addba_req.action_code) {
3641	case WLAN_ACTION_ADDBA_REQ:
3642	if (len < (IEEE80211_MIN_ACTION_SIZE +
3643	sizeof(mgmt->u.action.u.addba_req)))
3644	goto invalid;
3645	break;
3646	case WLAN_ACTION_ADDBA_RESP:
3647	if (len < (IEEE80211_MIN_ACTION_SIZE +
3648	sizeof(mgmt->u.action.u.addba_resp)))
3649	goto invalid;
3650	break;
3651	case WLAN_ACTION_DELBA:
3652	if (len < (IEEE80211_MIN_ACTION_SIZE +
3653	sizeof(mgmt->u.action.u.delba)))
3654	goto invalid;
3655	break;
3656	default:
3657	goto invalid;
3658	}
3659
3660	goto queue;
3661	case WLAN_CATEGORY_SPECTRUM_MGMT:
3662	/* verify action_code is present */
3663	if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3664	break;
3665
3666	switch (mgmt->u.action.u.measurement.action_code) {
3667	case WLAN_ACTION_SPCT_MSR_REQ:
3668	if (status->band != NL80211_BAND_5GHZ)
3669	break;
3670
3671	if (len < (IEEE80211_MIN_ACTION_SIZE +
3672	sizeof(mgmt->u.action.u.measurement)))
3673	break;
3674
3675	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3676	break;
3677
3678	ieee80211_process_measurement_req(sdata, mgmt, len);
3679	goto handled;
3680	case WLAN_ACTION_SPCT_CHL_SWITCH: {
3681	u8 *bssid;
3682	if (len < (IEEE80211_MIN_ACTION_SIZE +
3683	sizeof(mgmt->u.action.u.chan_switch)))
3684	break;
3685
3686	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3687	sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3688	sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3689	break;
3690
3691	if (sdata->vif.type == NL80211_IFTYPE_STATION)
3692	bssid = sdata->deflink.u.mgd.bssid;
3693	else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3694	bssid = sdata->u.ibss.bssid;
3695	else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3696	bssid = mgmt->sa;
3697	else
3698	break;
3699
3700	if (!ether_addr_equal(addr1: mgmt->bssid, addr2: bssid))
3701	break;
3702
3703	goto queue;
3704	}
3705	}
3706	break;
3707	case WLAN_CATEGORY_SELF_PROTECTED:
3708	if (len < (IEEE80211_MIN_ACTION_SIZE +
3709	sizeof(mgmt->u.action.u.self_prot.action_code)))
3710	break;
3711
3712	switch (mgmt->u.action.u.self_prot.action_code) {
3713	case WLAN_SP_MESH_PEERING_OPEN:
3714	case WLAN_SP_MESH_PEERING_CLOSE:
3715	case WLAN_SP_MESH_PEERING_CONFIRM:
3716	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
3717	goto invalid;
3718	if (sdata->u.mesh.user_mpm)
3719	/* userspace handles this frame */
3720	break;
3721	goto queue;
3722	case WLAN_SP_MGK_INFORM:
3723	case WLAN_SP_MGK_ACK:
3724	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
3725	goto invalid;
3726	break;
3727	}
3728	break;
3729	case WLAN_CATEGORY_MESH_ACTION:
3730	if (len < (IEEE80211_MIN_ACTION_SIZE +
3731	sizeof(mgmt->u.action.u.mesh_action.action_code)))
3732	break;
3733
3734	if (!ieee80211_vif_is_mesh(vif: &sdata->vif))
3735	break;
3736	if (mesh_action_is_path_sel(mgmt) &&
3737	!mesh_path_sel_is_hwmp(sdata))
3738	break;
3739	goto queue;
3740	case WLAN_CATEGORY_S1G:
3741	if (len < offsetofend(typeof(*mgmt),
3742	u.action.u.s1g.action_code))
3743	break;
3744
3745	switch (mgmt->u.action.u.s1g.action_code) {
3746	case WLAN_S1G_TWT_SETUP:
3747	case WLAN_S1G_TWT_TEARDOWN:
3748	if (ieee80211_process_rx_twt_action(rx))
3749	goto queue;
3750	break;
3751	default:
3752	break;
3753	}
3754	break;
3755	}
3756
3757	return RX_CONTINUE;
3758
3759	invalid:
3760	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3761	/* will return in the next handlers */
3762	return RX_CONTINUE;
3763
3764	handled:
3765	if (rx->sta)
3766	rx->link_sta->rx_stats.packets++;
3767	dev_kfree_skb(rx->skb);
3768	return RX_QUEUED;
3769
3770	queue:
3771	ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id, sta: rx->sta, skb: rx->skb);
3772	return RX_QUEUED;
3773	}
3774
3775	static ieee80211_rx_result debug_noinline
3776	ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3777	{
3778	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3779	struct cfg80211_rx_info info = {
3780	.freq = ieee80211_rx_status_to_khz(rx_status: status),
3781	.buf = rx->skb->data,
3782	.len = rx->skb->len,
3783	.link_id = rx->link_id,
3784	.have_link_id = rx->link_id >= 0,
3785	};
3786
3787	/* skip known-bad action frames and return them in the next handler */
3788	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3789	return RX_CONTINUE;
3790
3791	/*
3792	* Getting here means the kernel doesn't know how to handle
3793	* it, but maybe userspace does ... include returned frames
3794	* so userspace can register for those to know whether ones
3795	* it transmitted were processed or returned.
3796	*/
3797
3798	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3799	!(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3800	info.sig_dbm = status->signal;
3801
3802	if (ieee80211_is_timing_measurement(skb: rx->skb) ||
3803	ieee80211_is_ftm(skb: rx->skb)) {
3804	info.rx_tstamp = ktime_to_ns(kt: skb_hwtstamps(skb: rx->skb)->hwtstamp);
3805	info.ack_tstamp = ktime_to_ns(kt: status->ack_tx_hwtstamp);
3806	}
3807
3808	if (cfg80211_rx_mgmt_ext(wdev: &rx->sdata->wdev, info: &info)) {
3809	if (rx->sta)
3810	rx->link_sta->rx_stats.packets++;
3811	dev_kfree_skb(rx->skb);
3812	return RX_QUEUED;
3813	}
3814
3815	return RX_CONTINUE;
3816	}
3817
3818	static ieee80211_rx_result debug_noinline
3819	ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
3820	{
3821	struct ieee80211_sub_if_data *sdata = rx->sdata;
3822	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3823	int len = rx->skb->len;
3824
3825	if (!ieee80211_is_action(fc: mgmt->frame_control))
3826	return RX_CONTINUE;
3827
3828	switch (mgmt->u.action.category) {
3829	case WLAN_CATEGORY_SA_QUERY:
3830	if (len < (IEEE80211_MIN_ACTION_SIZE +
3831	sizeof(mgmt->u.action.u.sa_query)))
3832	break;
3833
3834	switch (mgmt->u.action.u.sa_query.action) {
3835	case WLAN_ACTION_SA_QUERY_REQUEST:
3836	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3837	break;
3838	ieee80211_process_sa_query_req(sdata, mgmt, len);
3839	goto handled;
3840	}
3841	break;
3842	}
3843
3844	return RX_CONTINUE;
3845
3846	handled:
3847	if (rx->sta)
3848	rx->link_sta->rx_stats.packets++;
3849	dev_kfree_skb(rx->skb);
3850	return RX_QUEUED;
3851	}
3852
3853	static ieee80211_rx_result debug_noinline
3854	ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3855	{
3856	struct ieee80211_local *local = rx->local;
3857	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3858	struct sk_buff *nskb;
3859	struct ieee80211_sub_if_data *sdata = rx->sdata;
3860	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
3861
3862	if (!ieee80211_is_action(fc: mgmt->frame_control))
3863	return RX_CONTINUE;
3864
3865	/*
3866	* For AP mode, hostapd is responsible for handling any action
3867	* frames that we didn't handle, including returning unknown
3868	* ones. For all other modes we will return them to the sender,
3869	* setting the 0x80 bit in the action category, as required by
3870	* 802.11-2012 9.24.4.
3871	* Newer versions of hostapd shall also use the management frame
3872	* registration mechanisms, but older ones still use cooked
3873	* monitor interfaces so push all frames there.
3874	*/
3875	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3876	(sdata->vif.type == NL80211_IFTYPE_AP ||
3877	sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3878	return RX_DROP_MONITOR;
3879
3880	if (is_multicast_ether_addr(addr: mgmt->da))
3881	return RX_DROP_MONITOR;
3882
3883	/* do not return rejected action frames */
3884	if (mgmt->u.action.category & 0x80)
3885	return RX_DROP_U_REJECTED_ACTION_RESPONSE;
3886
3887	nskb = skb_copy_expand(skb: rx->skb, newheadroom: local->hw.extra_tx_headroom, newtailroom: 0,
3888	GFP_ATOMIC);
3889	if (nskb) {
3890	struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3891
3892	nmgmt->u.action.category |= 0x80;
3893	memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3894	memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3895
3896	memset(nskb->cb, 0, sizeof(nskb->cb));
3897
3898	if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3899	struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb: nskb);
3900
3901	info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3902	IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3903	IEEE80211_TX_CTL_NO_CCK_RATE;
3904	if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3905	info->hw_queue =
3906	local->hw.offchannel_tx_hw_queue;
3907	}
3908
3909	__ieee80211_tx_skb_tid_band(sdata: rx->sdata, skb: nskb, tid: 7, link_id: -1,
3910	band: status->band);
3911	}
3912	dev_kfree_skb(rx->skb);
3913	return RX_QUEUED;
3914	}
3915
3916	static ieee80211_rx_result debug_noinline
3917	ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
3918	{
3919	struct ieee80211_sub_if_data *sdata = rx->sdata;
3920	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
3921
3922	if (!ieee80211_is_ext(fc: hdr->frame_control))
3923	return RX_CONTINUE;
3924
3925	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3926	return RX_DROP_MONITOR;
3927
3928	/* for now only beacons are ext, so queue them */
3929	ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id, sta: rx->sta, skb: rx->skb);
3930
3931	return RX_QUEUED;
3932	}
3933
3934	static ieee80211_rx_result debug_noinline
3935	ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3936	{
3937	struct ieee80211_sub_if_data *sdata = rx->sdata;
3938	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3939	__le16 stype;
3940
3941	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3942
3943	if (!ieee80211_vif_is_mesh(vif: &sdata->vif) &&
3944	sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3945	sdata->vif.type != NL80211_IFTYPE_OCB &&
3946	sdata->vif.type != NL80211_IFTYPE_STATION)
3947	return RX_DROP_MONITOR;
3948
3949	switch (stype) {
3950	case cpu_to_le16(IEEE80211_STYPE_AUTH):
3951	case cpu_to_le16(IEEE80211_STYPE_BEACON):
3952	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3953	/* process for all: mesh, mlme, ibss */
3954	break;
3955	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3956	if (is_multicast_ether_addr(addr: mgmt->da) &&
3957	!is_broadcast_ether_addr(addr: mgmt->da))
3958	return RX_DROP_MONITOR;
3959
3960	/* process only for station/IBSS */
3961	if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3962	sdata->vif.type != NL80211_IFTYPE_ADHOC)
3963	return RX_DROP_MONITOR;
3964	break;
3965	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3966	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3967	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3968	if (is_multicast_ether_addr(addr: mgmt->da) &&
3969	!is_broadcast_ether_addr(addr: mgmt->da))
3970	return RX_DROP_MONITOR;
3971
3972	/* process only for station */
3973	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3974	return RX_DROP_MONITOR;
3975	break;
3976	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3977	/* process only for ibss and mesh */
3978	if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3979	sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3980	return RX_DROP_MONITOR;
3981	break;
3982	default:
3983	return RX_DROP_MONITOR;
3984	}
3985
3986	ieee80211_queue_skb_to_iface(sdata, link_id: rx->link_id, sta: rx->sta, skb: rx->skb);
3987
3988	return RX_QUEUED;
3989	}
3990
3991	static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3992	struct ieee80211_rate *rate,
3993	ieee80211_rx_result reason)
3994	{
3995	struct ieee80211_sub_if_data *sdata;
3996	struct ieee80211_local *local = rx->local;
3997	struct sk_buff *skb = rx->skb, *skb2;
3998	struct net_device *prev_dev = NULL;
3999	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4000	int needed_headroom;
4001
4002	/*
4003	* If cooked monitor has been processed already, then
4004	* don't do it again. If not, set the flag.
4005	*/
4006	if (rx->flags & IEEE80211_RX_CMNTR)
4007	goto out_free_skb;
4008	rx->flags |= IEEE80211_RX_CMNTR;
4009
4010	/* If there are no cooked monitor interfaces, just free the SKB */
4011	if (!local->cooked_mntrs)
4012	goto out_free_skb;
4013
4014	/* room for the radiotap header based on driver features */
4015	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
4016
4017	if (skb_headroom(skb) < needed_headroom &&
4018	pskb_expand_head(skb, nhead: needed_headroom, ntail: 0, GFP_ATOMIC))
4019	goto out_free_skb;
4020
4021	/* prepend radiotap information */
4022	ieee80211_add_rx_radiotap_header(local, skb, rate, rtap_len: needed_headroom,
4023	has_fcs: false);
4024
4025	skb_reset_mac_header(skb);
4026	skb->ip_summed = CHECKSUM_UNNECESSARY;
4027	skb->pkt_type = PACKET_OTHERHOST;
4028	skb->protocol = htons(ETH_P_802_2);
4029
4030	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4031	if (!ieee80211_sdata_running(sdata))
4032	continue;
4033
4034	if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
4035	!(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
4036	continue;
4037
4038	if (prev_dev) {
4039	skb2 = skb_clone(skb, GFP_ATOMIC);
4040	if (skb2) {
4041	skb2->dev = prev_dev;
4042	netif_receive_skb(skb: skb2);
4043	}
4044	}
4045
4046	prev_dev = sdata->dev;
4047	dev_sw_netstats_rx_add(dev: sdata->dev, len: skb->len);
4048	}
4049
4050	if (prev_dev) {
4051	skb->dev = prev_dev;
4052	netif_receive_skb(skb);
4053	return;
4054	}
4055
4056	out_free_skb:
4057	kfree_skb_reason(skb, reason: (__force u32)reason);
4058	}
4059
4060	static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
4061	ieee80211_rx_result res)
4062	{
4063	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
4064	struct ieee80211_supported_band *sband;
4065	struct ieee80211_rate *rate = NULL;
4066
4067	if (res == RX_QUEUED) {
4068	I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
4069	return;
4070	}
4071
4072	if (res != RX_CONTINUE) {
4073	I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
4074	if (rx->sta)
4075	rx->link_sta->rx_stats.dropped++;
4076	}
4077
4078	if (u32_get_bits(v: (__force u32)res, field: SKB_DROP_REASON_SUBSYS_MASK) ==
4079	SKB_DROP_REASON_SUBSYS_MAC80211_UNUSABLE) {
4080	kfree_skb_reason(skb: rx->skb, reason: (__force u32)res);
4081	return;
4082	}
4083
4084	sband = rx->local->hw.wiphy->bands[status->band];
4085	if (status->encoding == RX_ENC_LEGACY)
4086	rate = &sband->bitrates[status->rate_idx];
4087
4088	ieee80211_rx_cooked_monitor(rx, rate, reason: res);
4089	}
4090
4091	static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
4092	struct sk_buff_head *frames)
4093	{
4094	ieee80211_rx_result res = RX_DROP_MONITOR;
4095	struct sk_buff *skb;
4096
4097	#define CALL_RXH(rxh) \
4098	do { \
4099	res = rxh(rx); \
4100	if (res != RX_CONTINUE) \
4101	goto rxh_next; \
4102	} while (0)
4103
4104	/* Lock here to avoid hitting all of the data used in the RX
4105	* path (e.g. key data, station data, ...) concurrently when
4106	* a frame is released from the reorder buffer due to timeout
4107	* from the timer, potentially concurrently with RX from the
4108	* driver.
4109	*/
4110	spin_lock_bh(lock: &rx->local->rx_path_lock);
4111
4112	while ((skb = __skb_dequeue(list: frames))) {
4113	/*
4114	* all the other fields are valid across frames
4115	* that belong to an aMPDU since they are on the
4116	* same TID from the same station
4117	*/
4118	rx->skb = skb;
4119
4120	if (WARN_ON_ONCE(!rx->link))
4121	goto rxh_next;
4122
4123	CALL_RXH(ieee80211_rx_h_check_more_data);
4124	CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
4125	CALL_RXH(ieee80211_rx_h_sta_process);
4126	CALL_RXH(ieee80211_rx_h_decrypt);
4127	CALL_RXH(ieee80211_rx_h_defragment);
4128	CALL_RXH(ieee80211_rx_h_michael_mic_verify);
4129	/* must be after MMIC verify so header is counted in MPDU mic */
4130	CALL_RXH(ieee80211_rx_h_amsdu);
4131	CALL_RXH(ieee80211_rx_h_data);
4132
4133	/* special treatment -- needs the queue */
4134	res = ieee80211_rx_h_ctrl(rx, frames);
4135	if (res != RX_CONTINUE)
4136	goto rxh_next;
4137
4138	CALL_RXH(ieee80211_rx_h_mgmt_check);
4139	CALL_RXH(ieee80211_rx_h_action);
4140	CALL_RXH(ieee80211_rx_h_userspace_mgmt);
4141	CALL_RXH(ieee80211_rx_h_action_post_userspace);
4142	CALL_RXH(ieee80211_rx_h_action_return);
4143	CALL_RXH(ieee80211_rx_h_ext);
4144	CALL_RXH(ieee80211_rx_h_mgmt);
4145
4146	rxh_next:
4147	ieee80211_rx_handlers_result(rx, res);
4148
4149	#undef CALL_RXH
4150	}
4151
4152	spin_unlock_bh(lock: &rx->local->rx_path_lock);
4153	}
4154
4155	static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
4156	{
4157	struct sk_buff_head reorder_release;
4158	ieee80211_rx_result res = RX_DROP_MONITOR;
4159
4160	__skb_queue_head_init(list: &reorder_release);
4161
4162	#define CALL_RXH(rxh) \
4163	do { \
4164	res = rxh(rx); \
4165	if (res != RX_CONTINUE) \
4166	goto rxh_next; \
4167	} while (0)
4168
4169	CALL_RXH(ieee80211_rx_h_check_dup);
4170	CALL_RXH(ieee80211_rx_h_check);
4171
4172	ieee80211_rx_reorder_ampdu(rx, frames: &reorder_release);
4173
4174	ieee80211_rx_handlers(rx, frames: &reorder_release);
4175	return;
4176
4177	rxh_next:
4178	ieee80211_rx_handlers_result(rx, res);
4179
4180	#undef CALL_RXH
4181	}
4182
4183	static bool
4184	ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
4185	{
4186	return !!(sta->valid_links & BIT(link_id));
4187	}
4188
4189	static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
4190	u8 link_id)
4191	{
4192	rx->link_id = link_id;
4193	rx->link = rcu_dereference(rx->sdata->link[link_id]);
4194
4195	if (!rx->sta)
4196	return rx->link;
4197
4198	if (!ieee80211_rx_is_valid_sta_link_id(sta: &rx->sta->sta, link_id))
4199	return false;
4200
4201	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
4202
4203	return rx->link && rx->link_sta;
4204	}
4205
4206	static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
4207	struct sta_info *sta, int link_id)
4208	{
4209	rx->link_id = link_id;
4210	rx->sta = sta;
4211
4212	if (sta) {
4213	rx->local = sta->sdata->local;
4214	if (!rx->sdata)
4215	rx->sdata = sta->sdata;
4216	rx->link_sta = &sta->deflink;
4217	} else {
4218	rx->link_sta = NULL;
4219	}
4220
4221	if (link_id < 0)
4222	rx->link = &rx->sdata->deflink;
4223	else if (!ieee80211_rx_data_set_link(rx, link_id))
4224	return false;
4225
4226	return true;
4227	}
4228
4229	/*
4230	* This function makes calls into the RX path, therefore
4231	* it has to be invoked under RCU read lock.
4232	*/
4233	void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4234	{
4235	struct sk_buff_head frames;
4236	struct ieee80211_rx_data rx = {
4237	/* This is OK -- must be QoS data frame */
4238	.security_idx = tid,
4239	.seqno_idx = tid,
4240	};
4241	struct tid_ampdu_rx *tid_agg_rx;
4242	int link_id = -1;
4243
4244	/* FIXME: statistics won't be right with this */
4245	if (sta->sta.valid_links)
4246	link_id = ffs(sta->sta.valid_links) - 1;
4247
4248	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id))
4249	return;
4250
4251	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4252	if (!tid_agg_rx)
4253	return;
4254
4255	__skb_queue_head_init(list: &frames);
4256
4257	spin_lock(lock: &tid_agg_rx->reorder_lock);
4258	ieee80211_sta_reorder_release(sdata: sta->sdata, tid_agg_rx, frames: &frames);
4259	spin_unlock(lock: &tid_agg_rx->reorder_lock);
4260
4261	if (!skb_queue_empty(list: &frames)) {
4262	struct ieee80211_event event = {
4263	.type = BA_FRAME_TIMEOUT,
4264	.u.ba.tid = tid,
4265	.u.ba.sta = &sta->sta,
4266	};
4267	drv_event_callback(local: rx.local, sdata: rx.sdata, event: &event);
4268	}
4269
4270	ieee80211_rx_handlers(rx: &rx, frames: &frames);
4271	}
4272
4273	void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4274	u16 ssn, u64 filtered,
4275	u16 received_mpdus)
4276	{
4277	struct ieee80211_local *local;
4278	struct sta_info *sta;
4279	struct tid_ampdu_rx *tid_agg_rx;
4280	struct sk_buff_head frames;
4281	struct ieee80211_rx_data rx = {
4282	/* This is OK -- must be QoS data frame */
4283	.security_idx = tid,
4284	.seqno_idx = tid,
4285	};
4286	int i, diff;
4287
4288	if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4289	return;
4290
4291	__skb_queue_head_init(list: &frames);
4292
4293	sta = container_of(pubsta, struct sta_info, sta);
4294
4295	local = sta->sdata->local;
4296	WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,
4297	"RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",
4298	local->hw.max_rx_aggregation_subframes);
4299
4300	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id: -1))
4301	return;
4302
4303	rcu_read_lock();
4304	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4305	if (!tid_agg_rx)
4306	goto out;
4307
4308	spin_lock_bh(lock: &tid_agg_rx->reorder_lock);
4309
4310	if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4311	int release;
4312
4313	/* release all frames in the reorder buffer */
4314	release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4315	IEEE80211_SN_MODULO;
4316	ieee80211_release_reorder_frames(sdata: sta->sdata, tid_agg_rx,
4317	head_seq_num: release, frames: &frames);
4318	/* update ssn to match received ssn */
4319	tid_agg_rx->head_seq_num = ssn;
4320	} else {
4321	ieee80211_release_reorder_frames(sdata: sta->sdata, tid_agg_rx, head_seq_num: ssn,
4322	frames: &frames);
4323	}
4324
4325	/* handle the case that received ssn is behind the mac ssn.
4326	* it can be tid_agg_rx->buf_size behind and still be valid */
4327	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4328	if (diff >= tid_agg_rx->buf_size) {
4329	tid_agg_rx->reorder_buf_filtered = 0;
4330	goto release;
4331	}
4332	filtered = filtered >> diff;
4333	ssn += diff;
4334
4335	/* update bitmap */
4336	for (i = 0; i < tid_agg_rx->buf_size; i++) {
4337	int index = (ssn + i) % tid_agg_rx->buf_size;
4338
4339	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4340	if (filtered & BIT_ULL(i))
4341	tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4342	}
4343
4344	/* now process also frames that the filter marking released */
4345	ieee80211_sta_reorder_release(sdata: sta->sdata, tid_agg_rx, frames: &frames);
4346
4347	release:
4348	spin_unlock_bh(lock: &tid_agg_rx->reorder_lock);
4349
4350	ieee80211_rx_handlers(rx: &rx, frames: &frames);
4351
4352	out:
4353	rcu_read_unlock();
4354	}
4355	EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4356
4357	/* main receive path */
4358
4359	static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4360	{
4361	return ether_addr_equal(addr1: raddr, addr2: addr) ||
4362	is_broadcast_ether_addr(addr: raddr);
4363	}
4364
4365	static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
4366	{
4367	struct ieee80211_sub_if_data *sdata = rx->sdata;
4368	struct sk_buff *skb = rx->skb;
4369	struct ieee80211_hdr *hdr = (void *)skb->data;
4370	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4371	u8 *bssid = ieee80211_get_bssid(hdr, len: skb->len, type: sdata->vif.type);
4372	bool multicast = is_multicast_ether_addr(addr: hdr->addr1) ||
4373	ieee80211_is_s1g_beacon(fc: hdr->frame_control);
4374
4375	switch (sdata->vif.type) {
4376	case NL80211_IFTYPE_STATION:
4377	if (!bssid && !sdata->u.mgd.use_4addr)
4378	return false;
4379	if (ieee80211_is_first_frag(seq_ctrl: hdr->seq_ctrl) &&
4380	ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4381	return false;
4382	if (multicast)
4383	return true;
4384	return ieee80211_is_our_addr(sdata, addr: hdr->addr1, out_link_id: &rx->link_id);
4385	case NL80211_IFTYPE_ADHOC:
4386	if (!bssid)
4387	return false;
4388	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr2) ||
4389	ether_addr_equal(addr1: sdata->u.ibss.bssid, addr2: hdr->addr2) ||
4390	!is_valid_ether_addr(addr: hdr->addr2))
4391	return false;
4392	if (ieee80211_is_beacon(fc: hdr->frame_control))
4393	return true;
4394	if (!ieee80211_bssid_match(raddr: bssid, addr: sdata->u.ibss.bssid))
4395	return false;
4396	if (!multicast &&
4397	!ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr1))
4398	return false;
4399	if (!rx->sta) {
4400	int rate_idx;
4401	if (status->encoding != RX_ENC_LEGACY)
4402	rate_idx = 0; /* TODO: HT/VHT rates */
4403	else
4404	rate_idx = status->rate_idx;
4405	ieee80211_ibss_rx_no_sta(sdata, bssid, addr: hdr->addr2,
4406	BIT(rate_idx));
4407	}
4408	return true;
4409	case NL80211_IFTYPE_OCB:
4410	if (!bssid)
4411	return false;
4412	if (!ieee80211_is_data_present(fc: hdr->frame_control))
4413	return false;
4414	if (!is_broadcast_ether_addr(addr: bssid))
4415	return false;
4416	if (!multicast &&
4417	!ether_addr_equal(addr1: sdata->dev->dev_addr, addr2: hdr->addr1))
4418	return false;
4419	if (!rx->sta) {
4420	int rate_idx;
4421	if (status->encoding != RX_ENC_LEGACY)
4422	rate_idx = 0; /* TODO: HT rates */
4423	else
4424	rate_idx = status->rate_idx;
4425	ieee80211_ocb_rx_no_sta(sdata, bssid, addr: hdr->addr2,
4426	BIT(rate_idx));
4427	}
4428	return true;
4429	case NL80211_IFTYPE_MESH_POINT:
4430	if (ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr2))
4431	return false;
4432	if (multicast)
4433	return true;
4434	return ether_addr_equal(addr1: sdata->vif.addr, addr2: hdr->addr1);
4435	case NL80211_IFTYPE_AP_VLAN:
4436	case NL80211_IFTYPE_AP:
4437	if (!bssid)
4438	return ieee80211_is_our_addr(sdata, addr: hdr->addr1,
4439	out_link_id: &rx->link_id);
4440
4441	if (!is_broadcast_ether_addr(addr: bssid) &&
4442	!ieee80211_is_our_addr(sdata, addr: bssid, NULL)) {
4443	/*
4444	* Accept public action frames even when the
4445	* BSSID doesn't match, this is used for P2P
4446	* and location updates. Note that mac80211
4447	* itself never looks at these frames.
4448	*/
4449	if (!multicast &&
4450	!ieee80211_is_our_addr(sdata, addr: hdr->addr1,
4451	out_link_id: &rx->link_id))
4452	return false;
4453	if (ieee80211_is_public_action(hdr, len: skb->len))
4454	return true;
4455	return ieee80211_is_beacon(fc: hdr->frame_control);
4456	}
4457
4458	if (!ieee80211_has_tods(fc: hdr->frame_control)) {
4459	/* ignore data frames to TDLS-peers */
4460	if (ieee80211_is_data(fc: hdr->frame_control))
4461	return false;
4462	/* ignore action frames to TDLS-peers */
4463	if (ieee80211_is_action(fc: hdr->frame_control) &&
4464	!is_broadcast_ether_addr(addr: bssid) &&
4465	!ether_addr_equal(addr1: bssid, addr2: hdr->addr1))
4466	return false;
4467	}
4468
4469	/*
4470	* 802.11-2016 Table 9-26 says that for data frames, A1 must be
4471	* the BSSID - we've checked that already but may have accepted
4472	* the wildcard (ff:ff:ff:ff:ff:ff).
4473	*
4474	* It also says:
4475	* The BSSID of the Data frame is determined as follows:
4476	* a) If the STA is contained within an AP or is associated
4477	* with an AP, the BSSID is the address currently in use
4478	* by the STA contained in the AP.
4479	*
4480	* So we should not accept data frames with an address that's
4481	* multicast.
4482	*
4483	* Accepting it also opens a security problem because stations
4484	* could encrypt it with the GTK and inject traffic that way.
4485	*/
4486	if (ieee80211_is_data(fc: hdr->frame_control) && multicast)
4487	return false;
4488
4489	return true;
4490	case NL80211_IFTYPE_P2P_DEVICE:
4491	return ieee80211_is_public_action(hdr, len: skb->len) ||
4492	ieee80211_is_probe_req(fc: hdr->frame_control) ||
4493	ieee80211_is_probe_resp(fc: hdr->frame_control) ||
4494	ieee80211_is_beacon(fc: hdr->frame_control);
4495	case NL80211_IFTYPE_NAN:
4496	/* Currently no frames on NAN interface are allowed */
4497	return false;
4498	default:
4499	break;
4500	}
4501
4502	WARN_ON_ONCE(1);
4503	return false;
4504	}
4505
4506	void ieee80211_check_fast_rx(struct sta_info *sta)
4507	{
4508	struct ieee80211_sub_if_data *sdata = sta->sdata;
4509	struct ieee80211_local *local = sdata->local;
4510	struct ieee80211_key *key;
4511	struct ieee80211_fast_rx fastrx = {
4512	.dev = sdata->dev,
4513	.vif_type = sdata->vif.type,
4514	.control_port_protocol = sdata->control_port_protocol,
4515	}, *old, *new = NULL;
4516	u32 offload_flags;
4517	bool set_offload = false;
4518	bool assign = false;
4519	bool offload;
4520
4521	/* use sparse to check that we don't return without updating */
4522	__acquire(check_fast_rx);
4523
4524	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4525	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4526	ether_addr_copy(dst: fastrx.rfc1042_hdr, src: rfc1042_header);
4527	ether_addr_copy(dst: fastrx.vif_addr, src: sdata->vif.addr);
4528
4529	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4530
4531	/* fast-rx doesn't do reordering */
4532	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4533	!ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4534	goto clear;
4535
4536	switch (sdata->vif.type) {
4537	case NL80211_IFTYPE_STATION:
4538	if (sta->sta.tdls) {
4539	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4540	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4541	fastrx.expected_ds_bits = 0;
4542	} else {
4543	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4544	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4545	fastrx.expected_ds_bits =
4546	cpu_to_le16(IEEE80211_FCTL_FROMDS);
4547	}
4548
4549	if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4550	fastrx.expected_ds_bits |=
4551	cpu_to_le16(IEEE80211_FCTL_TODS);
4552	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4553	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4554	}
4555
4556	if (!sdata->u.mgd.powersave)
4557	break;
4558
4559	/* software powersave is a huge mess, avoid all of it */
4560	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4561	goto clear;
4562	if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4563	!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4564	goto clear;
4565	break;
4566	case NL80211_IFTYPE_AP_VLAN:
4567	case NL80211_IFTYPE_AP:
4568	/* parallel-rx requires this, at least with calls to
4569	* ieee80211_sta_ps_transition()
4570	*/
4571	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4572	goto clear;
4573	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4574	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4575	fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4576
4577	fastrx.internal_forward =
4578	!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4579	(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4580	!sdata->u.vlan.sta);
4581
4582	if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4583	sdata->u.vlan.sta) {
4584	fastrx.expected_ds_bits |=
4585	cpu_to_le16(IEEE80211_FCTL_FROMDS);
4586	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4587	fastrx.internal_forward = 0;
4588	}
4589
4590	break;
4591	case NL80211_IFTYPE_MESH_POINT:
4592	fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
4593	IEEE80211_FCTL_TODS);
4594	fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4595	fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4596	break;
4597	default:
4598	goto clear;
4599	}
4600
4601	if (!test_sta_flag(sta, flag: WLAN_STA_AUTHORIZED))
4602	goto clear;
4603
4604	rcu_read_lock();
4605	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4606	if (!key)
4607	key = rcu_dereference(sdata->default_unicast_key);
4608	if (key) {
4609	switch (key->conf.cipher) {
4610	case WLAN_CIPHER_SUITE_TKIP:
4611	/* we don't want to deal with MMIC in fast-rx */
4612	goto clear_rcu;
4613	case WLAN_CIPHER_SUITE_CCMP:
4614	case WLAN_CIPHER_SUITE_CCMP_256:
4615	case WLAN_CIPHER_SUITE_GCMP:
4616	case WLAN_CIPHER_SUITE_GCMP_256:
4617	break;
4618	default:
4619	/* We also don't want to deal with
4620	* WEP or cipher scheme.
4621	*/
4622	goto clear_rcu;
4623	}
4624
4625	fastrx.key = true;
4626	fastrx.icv_len = key->conf.icv_len;
4627	}
4628
4629	assign = true;
4630	clear_rcu:
4631	rcu_read_unlock();
4632	clear:
4633	__release(check_fast_rx);
4634
4635	if (assign)
4636	new = kmemdup(p: &fastrx, size: sizeof(fastrx), GFP_KERNEL);
4637
4638	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
4639	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
4640
4641	if (assign && offload)
4642	set_offload = !test_and_set_sta_flag(sta, flag: WLAN_STA_DECAP_OFFLOAD);
4643	else
4644	set_offload = test_and_clear_sta_flag(sta, flag: WLAN_STA_DECAP_OFFLOAD);
4645
4646	if (set_offload)
4647	drv_sta_set_decap_offload(local, sdata, sta: &sta->sta, enabled: assign);
4648
4649	spin_lock_bh(lock: &sta->lock);
4650	old = rcu_dereference_protected(sta->fast_rx, true);
4651	rcu_assign_pointer(sta->fast_rx, new);
4652	spin_unlock_bh(lock: &sta->lock);
4653
4654	if (old)
4655	kfree_rcu(old, rcu_head);
4656	}
4657
4658	void ieee80211_clear_fast_rx(struct sta_info *sta)
4659	{
4660	struct ieee80211_fast_rx *old;
4661
4662	spin_lock_bh(lock: &sta->lock);
4663	old = rcu_dereference_protected(sta->fast_rx, true);
4664	RCU_INIT_POINTER(sta->fast_rx, NULL);
4665	spin_unlock_bh(lock: &sta->lock);
4666
4667	if (old)
4668	kfree_rcu(old, rcu_head);
4669	}
4670
4671	void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4672	{
4673	struct ieee80211_local *local = sdata->local;
4674	struct sta_info *sta;
4675
4676	lockdep_assert_wiphy(local->hw.wiphy);
4677
4678	list_for_each_entry(sta, &local->sta_list, list) {
4679	if (sdata != sta->sdata &&
4680	(!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4681	continue;
4682	ieee80211_check_fast_rx(sta);
4683	}
4684	}
4685
4686	void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4687	{
4688	struct ieee80211_local *local = sdata->local;
4689
4690	lockdep_assert_wiphy(local->hw.wiphy);
4691
4692	__ieee80211_check_fast_rx_iface(sdata);
4693	}
4694
4695	static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4696	struct ieee80211_fast_rx *fast_rx,
4697	int orig_len)
4698	{
4699	struct ieee80211_sta_rx_stats *stats;
4700	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb: rx->skb);
4701	struct sta_info *sta = rx->sta;
4702	struct link_sta_info *link_sta;
4703	struct sk_buff *skb = rx->skb;
4704	void *sa = skb->data + ETH_ALEN;
4705	void *da = skb->data;
4706
4707	if (rx->link_id >= 0) {
4708	link_sta = rcu_dereference(sta->link[rx->link_id]);
4709	if (WARN_ON_ONCE(!link_sta)) {
4710	dev_kfree_skb(rx->skb);
4711	return;
4712	}
4713	} else {
4714	link_sta = &sta->deflink;
4715	}
4716
4717	stats = &link_sta->rx_stats;
4718	if (fast_rx->uses_rss)
4719	stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
4720
4721	/* statistics part of ieee80211_rx_h_sta_process() */
4722	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4723	stats->last_signal = status->signal;
4724	if (!fast_rx->uses_rss)
4725	ewma_signal_add(e: &link_sta->rx_stats_avg.signal,
4726	val: -status->signal);
4727	}
4728
4729	if (status->chains) {
4730	int i;
4731
4732	stats->chains = status->chains;
4733	for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4734	int signal = status->chain_signal[i];
4735
4736	if (!(status->chains & BIT(i)))
4737	continue;
4738
4739	stats->chain_signal_last[i] = signal;
4740	if (!fast_rx->uses_rss)
4741	ewma_signal_add(e: &link_sta->rx_stats_avg.chain_signal[i],
4742	val: -signal);
4743	}
4744	}
4745	/* end of statistics */
4746
4747	stats->last_rx = jiffies;
4748	stats->last_rate = sta_stats_encode_rate(s: status);
4749
4750	stats->fragments++;
4751	stats->packets++;
4752
4753	skb->dev = fast_rx->dev;
4754
4755	dev_sw_netstats_rx_add(dev: fast_rx->dev, len: skb->len);
4756
4757	/* The seqno index has the same property as needed
4758	* for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4759	* for non-QoS-data frames. Here we know it's a data
4760	* frame, so count MSDUs.
4761	*/
4762	u64_stats_update_begin(syncp: &stats->syncp);
4763	stats->msdu[rx->seqno_idx]++;
4764	stats->bytes += orig_len;
4765	u64_stats_update_end(syncp: &stats->syncp);
4766
4767	if (fast_rx->internal_forward) {
4768	struct sk_buff *xmit_skb = NULL;
4769	if (is_multicast_ether_addr(addr: da)) {
4770	xmit_skb = skb_copy(skb, GFP_ATOMIC);
4771	} else if (!ether_addr_equal(addr1: da, addr2: sa) &&
4772	sta_info_get(sdata: rx->sdata, addr: da)) {
4773	xmit_skb = skb;
4774	skb = NULL;
4775	}
4776
4777	if (xmit_skb) {
4778	/*
4779	* Send to wireless media and increase priority by 256
4780	* to keep the received priority instead of
4781	* reclassifying the frame (see cfg80211_classify8021d).
4782	*/
4783	xmit_skb->priority += 256;
4784	xmit_skb->protocol = htons(ETH_P_802_3);
4785	skb_reset_network_header(skb: xmit_skb);
4786	skb_reset_mac_header(skb: xmit_skb);
4787	dev_queue_xmit(skb: xmit_skb);
4788	}
4789
4790	if (!skb)
4791	return;
4792	}
4793
4794	/* deliver to local stack */
4795	skb->protocol = eth_type_trans(skb, dev: fast_rx->dev);
4796	ieee80211_deliver_skb_to_local_stack(skb, rx);
4797	}
4798
4799	static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4800	struct ieee80211_fast_rx *fast_rx)
4801	{
4802	struct sk_buff *skb = rx->skb;
4803	struct ieee80211_hdr *hdr = (void *)skb->data;
4804	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4805	static ieee80211_rx_result res;
4806	int orig_len = skb->len;
4807	int hdrlen = ieee80211_hdrlen(fc: hdr->frame_control);
4808	int snap_offs = hdrlen;
4809	struct {
4810	u8 snap[sizeof(rfc1042_header)];
4811	__be16 proto;
4812	} *payload __aligned(2);
4813	struct {
4814	u8 da[ETH_ALEN];
4815	u8 sa[ETH_ALEN];
4816	} addrs __aligned(2);
4817	struct ieee80211_sta_rx_stats *stats;
4818
4819	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
4820	* to a common data structure; drivers can implement that per queue
4821	* but we don't have that information in mac80211
4822	*/
4823	if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4824	return false;
4825
4826	#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4827
4828	/* If using encryption, we also need to have:
4829	* - PN_VALIDATED: similar, but the implementation is tricky
4830	* - DECRYPTED: necessary for PN_VALIDATED
4831	*/
4832	if (fast_rx->key &&
4833	(status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
4834	return false;
4835
4836	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
4837	return false;
4838
4839	if (unlikely(ieee80211_is_frag(hdr)))
4840	return false;
4841
4842	/* Since our interface address cannot be multicast, this
4843	* implicitly also rejects multicast frames without the
4844	* explicit check.
4845	*
4846	* We shouldn't get any *data* frames not addressed to us
4847	* (AP mode will accept multicast *management* frames), but
4848	* punting here will make it go through the full checks in
4849	* ieee80211_accept_frame().
4850	*/
4851	if (!ether_addr_equal(addr1: fast_rx->vif_addr, addr2: hdr->addr1))
4852	return false;
4853
4854	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
4855	IEEE80211_FCTL_TODS)) !=
4856	fast_rx->expected_ds_bits)
4857	return false;
4858
4859	/* assign the key to drop unencrypted frames (later)
4860	* and strip the IV/MIC if necessary
4861	*/
4862	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
4863	/* GCMP header length is the same */
4864	snap_offs += IEEE80211_CCMP_HDR_LEN;
4865	}
4866
4867	if (!ieee80211_vif_is_mesh(vif: &rx->sdata->vif) &&
4868	!(status->rx_flags & IEEE80211_RX_AMSDU)) {
4869	if (!pskb_may_pull(skb, len: snap_offs + sizeof(*payload)))
4870	return false;
4871
4872	payload = (void *)(skb->data + snap_offs);
4873
4874	if (!ether_addr_equal(addr1: payload->snap, addr2: fast_rx->rfc1042_hdr))
4875	return false;
4876
4877	/* Don't handle these here since they require special code.
4878	* Accept AARP and IPX even though they should come with a
4879	* bridge-tunnel header - but if we get them this way then
4880	* there's little point in discarding them.
4881	*/
4882	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4883	payload->proto == fast_rx->control_port_protocol))
4884	return false;
4885	}
4886
4887	/* after this point, don't punt to the slowpath! */
4888
4889	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4890	pskb_trim(skb, len: skb->len - fast_rx->icv_len))
4891	goto drop;
4892
4893	if (rx->key && !ieee80211_has_protected(fc: hdr->frame_control))
4894	goto drop;
4895
4896	if (status->rx_flags & IEEE80211_RX_AMSDU) {
4897	if (__ieee80211_rx_h_amsdu(rx, data_offset: snap_offs - hdrlen) !=
4898	RX_QUEUED)
4899	goto drop;
4900
4901	return true;
4902	}
4903
4904	/* do the header conversion - first grab the addresses */
4905	ether_addr_copy(dst: addrs.da, src: skb->data + fast_rx->da_offs);
4906	ether_addr_copy(dst: addrs.sa, src: skb->data + fast_rx->sa_offs);
4907	if (ieee80211_vif_is_mesh(vif: &rx->sdata->vif)) {
4908	skb_pull(skb, len: snap_offs - 2);
4909	put_unaligned_be16(val: skb->len - 2, p: skb->data);
4910	} else {
4911	skb_postpull_rcsum(skb, start: skb->data + snap_offs,
4912	len: sizeof(rfc1042_header) + 2);
4913
4914	/* remove the SNAP but leave the ethertype */
4915	skb_pull(skb, len: snap_offs + sizeof(rfc1042_header));
4916	}
4917	/* push the addresses in front */
4918	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4919
4920	res = ieee80211_rx_mesh_data(sdata: rx->sdata, sta: rx->sta, skb: rx->skb);
4921	switch (res) {
4922	case RX_QUEUED:
4923	return true;
4924	case RX_CONTINUE:
4925	break;
4926	default:
4927	goto drop;
4928	}
4929
4930	ieee80211_rx_8023(rx, fast_rx, orig_len);
4931
4932	return true;
4933	drop:
4934	dev_kfree_skb(skb);
4935
4936	if (fast_rx->uses_rss)
4937	stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
4938	else
4939	stats = &rx->link_sta->rx_stats;
4940
4941	stats->dropped++;
4942	return true;
4943	}
4944
4945	/*
4946	* This function returns whether or not the SKB
4947	* was destined for RX processing or not, which,
4948	* if consume is true, is equivalent to whether
4949	* or not the skb was consumed.
4950	*/
4951	static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4952	struct sk_buff *skb, bool consume)
4953	{
4954	struct ieee80211_local *local = rx->local;
4955	struct ieee80211_sub_if_data *sdata = rx->sdata;
4956	struct ieee80211_hdr *hdr = (void *)skb->data;
4957	struct link_sta_info *link_sta = rx->link_sta;
4958	struct ieee80211_link_data *link = rx->link;
4959
4960	rx->skb = skb;
4961
4962	/* See if we can do fast-rx; if we have to copy we already lost,
4963	* so punt in that case. We should never have to deliver a data
4964	* frame to multiple interfaces anyway.
4965	*
4966	* We skip the ieee80211_accept_frame() call and do the necessary
4967	* checking inside ieee80211_invoke_fast_rx().
4968	*/
4969	if (consume && rx->sta) {
4970	struct ieee80211_fast_rx *fast_rx;
4971
4972	fast_rx = rcu_dereference(rx->sta->fast_rx);
4973	if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4974	return true;
4975	}
4976
4977	if (!ieee80211_accept_frame(rx))
4978	return false;
4979
4980	if (!consume) {
4981	struct skb_shared_hwtstamps *shwt;
4982
4983	rx->skb = skb_copy(skb, GFP_ATOMIC);
4984	if (!rx->skb) {
4985	if (net_ratelimit())
4986	wiphy_debug(local->hw.wiphy,
4987	"failed to copy skb for %s\n",
4988	sdata->name);
4989	return true;
4990	}
4991
4992	/* skb_copy() does not copy the hw timestamps, so copy it
4993	* explicitly
4994	*/
4995	shwt = skb_hwtstamps(skb: rx->skb);
4996	shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
4997
4998	/* Update the hdr pointer to the new skb for translation below */
4999	hdr = (struct ieee80211_hdr *)rx->skb->data;
5000	}
5001
5002	if (unlikely(rx->sta && rx->sta->sta.mlo) &&
5003	is_unicast_ether_addr(addr: hdr->addr1) &&
5004	!ieee80211_is_probe_resp(fc: hdr->frame_control) &&
5005	!ieee80211_is_beacon(fc: hdr->frame_control)) {
5006	/* translate to MLD addresses */
5007	if (ether_addr_equal(addr1: link->conf->addr, addr2: hdr->addr1))
5008	ether_addr_copy(dst: hdr->addr1, src: rx->sdata->vif.addr);
5009	if (ether_addr_equal(addr1: link_sta->addr, addr2: hdr->addr2))
5010	ether_addr_copy(dst: hdr->addr2, src: rx->sta->addr);
5011	/* translate A3 only if it's the BSSID */
5012	if (!ieee80211_has_tods(fc: hdr->frame_control) &&
5013	!ieee80211_has_fromds(fc: hdr->frame_control)) {
5014	if (ether_addr_equal(addr1: link_sta->addr, addr2: hdr->addr3))
5015	ether_addr_copy(dst: hdr->addr3, src: rx->sta->addr);
5016	else if (ether_addr_equal(addr1: link->conf->addr, addr2: hdr->addr3))
5017	ether_addr_copy(dst: hdr->addr3, src: rx->sdata->vif.addr);
5018	}
5019	/* not needed for A4 since it can only carry the SA */
5020	}
5021
5022	ieee80211_invoke_rx_handlers(rx);
5023	return true;
5024	}
5025
5026	static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
5027	struct ieee80211_sta *pubsta,
5028	struct sk_buff *skb,
5029	struct list_head *list)
5030	{
5031	struct ieee80211_local *local = hw_to_local(hw);
5032	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5033	struct ieee80211_fast_rx *fast_rx;
5034	struct ieee80211_rx_data rx;
5035	struct sta_info *sta;
5036	int link_id = -1;
5037
5038	memset(&rx, 0, sizeof(rx));
5039	rx.skb = skb;
5040	rx.local = local;
5041	rx.list = list;
5042	rx.link_id = -1;
5043
5044	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5045
5046	/* drop frame if too short for header */
5047	if (skb->len < sizeof(struct ethhdr))
5048	goto drop;
5049
5050	if (!pubsta)
5051	goto drop;
5052
5053	if (status->link_valid)
5054	link_id = status->link_id;
5055
5056	/*
5057	* TODO: Should the frame be dropped if the right link_id is not
5058	* available? Or may be it is fine in the current form to proceed with
5059	* the frame processing because with frame being in 802.3 format,
5060	* link_id is used only for stats purpose and updating the stats on
5061	* the deflink is fine?
5062	*/
5063	sta = container_of(pubsta, struct sta_info, sta);
5064	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id))
5065	goto drop;
5066
5067	fast_rx = rcu_dereference(rx.sta->fast_rx);
5068	if (!fast_rx)
5069	goto drop;
5070
5071	ieee80211_rx_8023(rx: &rx, fast_rx, orig_len: skb->len);
5072	return;
5073
5074	drop:
5075	dev_kfree_skb(skb);
5076	}
5077
5078	static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
5079	struct sk_buff *skb, bool consume)
5080	{
5081	struct link_sta_info *link_sta;
5082	struct ieee80211_hdr *hdr = (void *)skb->data;
5083	struct sta_info *sta;
5084	int link_id = -1;
5085
5086	/*
5087	* Look up link station first, in case there's a
5088	* chance that they might have a link address that
5089	* is identical to the MLD address, that way we'll
5090	* have the link information if needed.
5091	*/
5092	link_sta = link_sta_info_get_bss(sdata: rx->sdata, addr: hdr->addr2);
5093	if (link_sta) {
5094	sta = link_sta->sta;
5095	link_id = link_sta->link_id;
5096	} else {
5097	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5098
5099	sta = sta_info_get_bss(sdata: rx->sdata, addr: hdr->addr2);
5100	if (status->link_valid)
5101	link_id = status->link_id;
5102	}
5103
5104	if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
5105	return false;
5106
5107	return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5108	}
5109
5110	/*
5111	* This is the actual Rx frames handler. as it belongs to Rx path it must
5112	* be called with rcu_read_lock protection.
5113	*/
5114	static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
5115	struct ieee80211_sta *pubsta,
5116	struct sk_buff *skb,
5117	struct list_head *list)
5118	{
5119	struct ieee80211_local *local = hw_to_local(hw);
5120	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5121	struct ieee80211_sub_if_data *sdata;
5122	struct ieee80211_hdr *hdr;
5123	__le16 fc;
5124	struct ieee80211_rx_data rx;
5125	struct ieee80211_sub_if_data *prev;
5126	struct rhlist_head *tmp;
5127	int err = 0;
5128
5129	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
5130	memset(&rx, 0, sizeof(rx));
5131	rx.skb = skb;
5132	rx.local = local;
5133	rx.list = list;
5134	rx.link_id = -1;
5135
5136	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
5137	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5138
5139	if (ieee80211_is_mgmt(fc)) {
5140	/* drop frame if too short for header */
5141	if (skb->len < ieee80211_hdrlen(fc))
5142	err = -ENOBUFS;
5143	else
5144	err = skb_linearize(skb);
5145	} else {
5146	err = !pskb_may_pull(skb, len: ieee80211_hdrlen(fc));
5147	}
5148
5149	if (err) {
5150	dev_kfree_skb(skb);
5151	return;
5152	}
5153
5154	hdr = (struct ieee80211_hdr *)skb->data;
5155	ieee80211_parse_qos(rx: &rx);
5156	ieee80211_verify_alignment(rx: &rx);
5157
5158	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
5159	ieee80211_is_beacon(hdr->frame_control) ||
5160	ieee80211_is_s1g_beacon(hdr->frame_control)))
5161	ieee80211_scan_rx(local, skb);
5162
5163	if (ieee80211_is_data(fc)) {
5164	struct sta_info *sta, *prev_sta;
5165	int link_id = -1;
5166
5167	if (status->link_valid)
5168	link_id = status->link_id;
5169
5170	if (pubsta) {
5171	sta = container_of(pubsta, struct sta_info, sta);
5172	if (!ieee80211_rx_data_set_sta(rx: &rx, sta, link_id))
5173	goto out;
5174
5175	/*
5176	* In MLO connection, fetch the link_id using addr2
5177	* when the driver does not pass link_id in status.
5178	* When the address translation is already performed by
5179	* driver/hw, the valid link_id must be passed in
5180	* status.
5181	*/
5182
5183	if (!status->link_valid && pubsta->mlo) {
5184	struct ieee80211_hdr *hdr = (void *)skb->data;
5185	struct link_sta_info *link_sta;
5186
5187	link_sta = link_sta_info_get_bss(sdata: rx.sdata,
5188	addr: hdr->addr2);
5189	if (!link_sta)
5190	goto out;
5191
5192	ieee80211_rx_data_set_link(rx: &rx, link_id: link_sta->link_id);
5193	}
5194
5195	if (ieee80211_prepare_and_rx_handle(rx: &rx, skb, consume: true))
5196	return;
5197	goto out;
5198	}
5199
5200	prev_sta = NULL;
5201
5202	for_each_sta_info(local, hdr->addr2, sta, tmp) {
5203	if (!prev_sta) {
5204	prev_sta = sta;
5205	continue;
5206	}
5207
5208	rx.sdata = prev_sta->sdata;
5209	if (!ieee80211_rx_data_set_sta(rx: &rx, sta: prev_sta, link_id))
5210	goto out;
5211
5212	if (!status->link_valid && prev_sta->sta.mlo)
5213	continue;
5214
5215	ieee80211_prepare_and_rx_handle(rx: &rx, skb, consume: false);
5216
5217	prev_sta = sta;
5218	}
5219
5220	if (prev_sta) {
5221	rx.sdata = prev_sta->sdata;
5222	if (!ieee80211_rx_data_set_sta(rx: &rx, sta: prev_sta, link_id))
5223	goto out;
5224
5225	if (!status->link_valid && prev_sta->sta.mlo)
5226	goto out;
5227
5228	if (ieee80211_prepare_and_rx_handle(rx: &rx, skb, consume: true))
5229	return;
5230	goto out;
5231	}
5232	}
5233
5234	prev = NULL;
5235
5236	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
5237	if (!ieee80211_sdata_running(sdata))
5238	continue;
5239
5240	if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
5241	sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
5242	continue;
5243
5244	/*
5245	* frame is destined for this interface, but if it's
5246	* not also for the previous one we handle that after
5247	* the loop to avoid copying the SKB once too much
5248	*/
5249
5250	if (!prev) {
5251	prev = sdata;
5252	continue;
5253	}
5254
5255	rx.sdata = prev;
5256	ieee80211_rx_for_interface(rx: &rx, skb, consume: false);
5257
5258	prev = sdata;
5259	}
5260
5261	if (prev) {
5262	rx.sdata = prev;
5263
5264	if (ieee80211_rx_for_interface(rx: &rx, skb, consume: true))
5265	return;
5266	}
5267
5268	out:
5269	dev_kfree_skb(skb);
5270	}
5271
5272	/*
5273	* This is the receive path handler. It is called by a low level driver when an
5274	* 802.11 MPDU is received from the hardware.
5275	*/
5276	void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5277	struct sk_buff *skb, struct list_head *list)
5278	{
5279	struct ieee80211_local *local = hw_to_local(hw);
5280	struct ieee80211_rate *rate = NULL;
5281	struct ieee80211_supported_band *sband;
5282	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5283	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
5284
5285	WARN_ON_ONCE(softirq_count() == 0);
5286
5287	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
5288	goto drop;
5289
5290	sband = local->hw.wiphy->bands[status->band];
5291	if (WARN_ON(!sband))
5292	goto drop;
5293
5294	/*
5295	* If we're suspending, it is possible although not too likely
5296	* that we'd be receiving frames after having already partially
5297	* quiesced the stack. We can't process such frames then since
5298	* that might, for example, cause stations to be added or other
5299	* driver callbacks be invoked.
5300	*/
5301	if (unlikely(local->quiescing || local->suspended))
5302	goto drop;
5303
5304	/* We might be during a HW reconfig, prevent Rx for the same reason */
5305	if (unlikely(local->in_reconfig))
5306	goto drop;
5307
5308	/*
5309	* The same happens when we're not even started,
5310	* but that's worth a warning.
5311	*/
5312	if (WARN_ON(!local->started))
5313	goto drop;
5314
5315	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
5316	/*
5317	* Validate the rate, unless a PLCP error means that
5318	* we probably can't have a valid rate here anyway.
5319	*/
5320
5321	switch (status->encoding) {
5322	case RX_ENC_HT:
5323	/*
5324	* rate_idx is MCS index, which can be [0-76]
5325	* as documented on:
5326	*
5327	* https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
5328	*
5329	* Anything else would be some sort of driver or
5330	* hardware error. The driver should catch hardware
5331	* errors.
5332	*/
5333	if (WARN(status->rate_idx > 76,
5334	"Rate marked as an HT rate but passed "
5335	"status->rate_idx is not "
5336	"an MCS index [0-76]: %d (0x%02x)\n",
5337	status->rate_idx,
5338	status->rate_idx))
5339	goto drop;
5340	break;
5341	case RX_ENC_VHT:
5342	if (WARN_ONCE(status->rate_idx > 11 ||
5343	!status->nss ||
5344	status->nss > 8,
5345	"Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
5346	status->rate_idx, status->nss))
5347	goto drop;
5348	break;
5349	case RX_ENC_HE:
5350	if (WARN_ONCE(status->rate_idx > 11 ||
5351	!status->nss ||
5352	status->nss > 8,
5353	"Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5354	status->rate_idx, status->nss))
5355	goto drop;
5356	break;
5357	case RX_ENC_EHT:
5358	if (WARN_ONCE(status->rate_idx > 15 ||
5359	!status->nss ||
5360	status->nss > 8 ||
5361	status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5362	"Rate marked as an EHT rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5363	status->rate_idx, status->nss, status->eht.gi))
5364	goto drop;
5365	break;
5366	default:
5367	WARN_ON_ONCE(1);
5368	fallthrough;
5369	case RX_ENC_LEGACY:
5370	if (WARN_ON(status->rate_idx >= sband->n_bitrates))
5371	goto drop;
5372	rate = &sband->bitrates[status->rate_idx];
5373	}
5374	}
5375
5376	if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
5377	goto drop;
5378
5379	status->rx_flags = 0;
5380
5381	kcov_remote_start_common(id: skb_get_kcov_handle(skb));
5382
5383	/*
5384	* Frames with failed FCS/PLCP checksum are not returned,
5385	* all other frames are returned without radiotap header
5386	* if it was previously present.
5387	* Also, frames with less than 16 bytes are dropped.
5388	*/
5389	if (!(status->flag & RX_FLAG_8023))
5390	skb = ieee80211_rx_monitor(local, origskb: skb, rate);
5391	if (skb) {
5392	if ((status->flag & RX_FLAG_8023) ||
5393	ieee80211_is_data_present(fc: hdr->frame_control))
5394	ieee80211_tpt_led_trig_rx(local, bytes: skb->len);
5395
5396	if (status->flag & RX_FLAG_8023)
5397	__ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5398	else
5399	__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
5400	}
5401
5402	kcov_remote_stop();
5403	return;
5404	drop:
5405	kfree_skb(skb);
5406	}
5407	EXPORT_SYMBOL(ieee80211_rx_list);
5408
5409	void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5410	struct sk_buff *skb, struct napi_struct *napi)
5411	{
5412	struct sk_buff *tmp;
5413	LIST_HEAD(list);
5414
5415
5416	/*
5417	* key references and virtual interfaces are protected using RCU
5418	* and this requires that we are in a read-side RCU section during
5419	* receive processing
5420	*/
5421	rcu_read_lock();
5422	ieee80211_rx_list(hw, pubsta, skb, &list);
5423	rcu_read_unlock();
5424
5425	if (!napi) {
5426	netif_receive_skb_list(head: &list);
5427	return;
5428	}
5429
5430	list_for_each_entry_safe(skb, tmp, &list, list) {
5431	skb_list_del_init(skb);
5432	napi_gro_receive(napi, skb);
5433	}
5434	}
5435	EXPORT_SYMBOL(ieee80211_rx_napi);
5436
5437	/* This is a version of the rx handler that can be called from hard irq
5438	* context. Post the skb on the queue and schedule the tasklet */
5439	void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
5440	{
5441	struct ieee80211_local *local = hw_to_local(hw);
5442
5443	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5444
5445	skb->pkt_type = IEEE80211_RX_MSG;
5446	skb_queue_tail(list: &local->skb_queue, newsk: skb);
5447	tasklet_schedule(t: &local->tasklet);
5448	}
5449	EXPORT_SYMBOL(ieee80211_rx_irqsafe);
5450