1 // SPDX-License-Identifier: GPL-2.0-only
3  * Copyright 2002-2005, Instant802 Networks, Inc.
4  * Copyright 2005-2006, Devicescape Software, Inc.
5  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
6  * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2013-2014  Intel Mobile Communications GmbH
8  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9  * Copyright (C) 2018-2025 Intel Corporation
28 #include "driver-ops.h"
47 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_clean_skb()  local
53 		__pskb_trim(skb, skb->len - present_fcs_len);  in ieee80211_clean_skb()
57 	 * info in skb->data.  in ieee80211_clean_skb()
59 	status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |  in ieee80211_clean_skb()
64 	hdr = (void *)skb->data;  in ieee80211_clean_skb()
65 	fc = hdr->frame_control;  in ieee80211_clean_skb()
68 	 * Remove the HT-Control field (if present) on management  in ieee80211_clean_skb()
78 	hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);  in ieee80211_clean_skb()
85 	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,  in ieee80211_clean_skb()
86 		hdrlen - IEEE80211_HT_CTL_LEN);  in ieee80211_clean_skb()
95 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in should_drop_frame()  local
98 	hdr = (void *)(skb->data + rtap_space);  in should_drop_frame()
100 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |  in should_drop_frame()
106 	if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))  in should_drop_frame()
109 	if (ieee80211_is_ctl(hdr->frame_control) &&  in should_drop_frame()
110 	    !ieee80211_is_pspoll(hdr->frame_control) &&  in should_drop_frame()
111 	    !ieee80211_is_back_req(hdr->frame_control))  in should_drop_frame()
119 			     struct ieee80211_rx_status *status,  in ieee80211_rx_radiotap_hdrlen()  argument
122 	int len;  in ieee80211_rx_radiotap_hdrlen()  local
125 	len = sizeof(struct ieee80211_radiotap_header) + 8;  in ieee80211_rx_radiotap_hdrlen()
128 	if (status->chains)  in ieee80211_rx_radiotap_hdrlen()
129 		len += 4 * hweight8(status->chains);  in ieee80211_rx_radiotap_hdrlen()
131 	if (ieee80211_have_rx_timestamp(status)) {  in ieee80211_rx_radiotap_hdrlen()
132 		len = ALIGN(len, 8);  in ieee80211_rx_radiotap_hdrlen()
133 		len += 8;  in ieee80211_rx_radiotap_hdrlen()
135 	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))  in ieee80211_rx_radiotap_hdrlen()
136 		len += 1;  in ieee80211_rx_radiotap_hdrlen()
138 	/* antenna field, if we don't have per-chain info */  in ieee80211_rx_radiotap_hdrlen()
139 	if (!status->chains)  in ieee80211_rx_radiotap_hdrlen()
140 		len += 1;  in ieee80211_rx_radiotap_hdrlen()
143 	len = ALIGN(len, 2);  in ieee80211_rx_radiotap_hdrlen()
145 	if (status->encoding == RX_ENC_HT) /* HT info */  in ieee80211_rx_radiotap_hdrlen()
146 		len += 3;  in ieee80211_rx_radiotap_hdrlen()
148 	if (status->flag & RX_FLAG_AMPDU_DETAILS) {  in ieee80211_rx_radiotap_hdrlen()
149 		len = ALIGN(len, 4);  in ieee80211_rx_radiotap_hdrlen()
150 		len += 8;  in ieee80211_rx_radiotap_hdrlen()
153 	if (status->encoding == RX_ENC_VHT) {  in ieee80211_rx_radiotap_hdrlen()
154 		len = ALIGN(len, 2);  in ieee80211_rx_radiotap_hdrlen()
155 		len += 12;  in ieee80211_rx_radiotap_hdrlen()
158 	if (local->hw.radiotap_timestamp.units_pos >= 0) {  in ieee80211_rx_radiotap_hdrlen()
159 		len = ALIGN(len, 8);  in ieee80211_rx_radiotap_hdrlen()
160 		len += 12;  in ieee80211_rx_radiotap_hdrlen()
163 	if (status->encoding == RX_ENC_HE &&  in ieee80211_rx_radiotap_hdrlen()
164 	    status->flag & RX_FLAG_RADIOTAP_HE) {  in ieee80211_rx_radiotap_hdrlen()
165 		len = ALIGN(len, 2);  in ieee80211_rx_radiotap_hdrlen()
166 		len += 12;  in ieee80211_rx_radiotap_hdrlen()
170 	if (status->encoding == RX_ENC_HE &&  in ieee80211_rx_radiotap_hdrlen()
171 	    status->flag & RX_FLAG_RADIOTAP_HE_MU) {  in ieee80211_rx_radiotap_hdrlen()
172 		len = ALIGN(len, 2);  in ieee80211_rx_radiotap_hdrlen()
173 		len += 12;  in ieee80211_rx_radiotap_hdrlen()
177 	if (status->flag & RX_FLAG_NO_PSDU)  in ieee80211_rx_radiotap_hdrlen()
178 		len += 1;  in ieee80211_rx_radiotap_hdrlen()
180 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {  in ieee80211_rx_radiotap_hdrlen()
181 		len = ALIGN(len, 2);  in ieee80211_rx_radiotap_hdrlen()
182 		len += 4;  in ieee80211_rx_radiotap_hdrlen()
186 	if (status->chains) {  in ieee80211_rx_radiotap_hdrlen()
188 		len += 2 * hweight8(status->chains);  in ieee80211_rx_radiotap_hdrlen()
191 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {  in ieee80211_rx_radiotap_hdrlen()
195 		 * The position to look at depends on the existence (or non-  in ieee80211_rx_radiotap_hdrlen()
198 		if (status->flag & RX_FLAG_RADIOTAP_HE)  in ieee80211_rx_radiotap_hdrlen()
201 		if (status->flag & RX_FLAG_RADIOTAP_HE_MU)  in ieee80211_rx_radiotap_hdrlen()
204 		if (status->flag & RX_FLAG_RADIOTAP_LSIG)  in ieee80211_rx_radiotap_hdrlen()
209 		len = ALIGN(len, 4);  in ieee80211_rx_radiotap_hdrlen()
212 		len += skb_mac_header(skb) - &skb->data[tlv_offset];  in ieee80211_rx_radiotap_hdrlen()
215 	return len;  in ieee80211_rx_radiotap_hdrlen()
223 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in __ieee80211_queue_skb_to_iface()  local
226 		status->link_valid = 1;  in __ieee80211_queue_skb_to_iface()
227 		status->link_id = link_id;  in __ieee80211_queue_skb_to_iface()
229 		status->link_valid = 0;  in __ieee80211_queue_skb_to_iface()
232 	skb_queue_tail(&sdata->skb_queue, skb);  in __ieee80211_queue_skb_to_iface()
233 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);  in __ieee80211_queue_skb_to_iface()
238 			link_sta_info = rcu_dereference(sta->link[link_id]);  in __ieee80211_queue_skb_to_iface()
242 			link_sta_info = &sta->deflink;  in __ieee80211_queue_skb_to_iface()
245 		link_sta_info->rx_stats.packets++;  in __ieee80211_queue_skb_to_iface()
254 	skb->protocol = 0;  in ieee80211_queue_skb_to_iface()
273 	if (skb->len < rtap_space + sizeof(action) +  in ieee80211_handle_mu_mimo_mon()
277 	if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))  in ieee80211_handle_mu_mimo_mon()
291 	if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))  in ieee80211_handle_mu_mimo_mon()
298 	ieee80211_queue_skb_to_iface(sdata, -1, NULL, skb);  in ieee80211_handle_mu_mimo_mon()
302  * ieee80211_add_rx_radiotap_header - add radiotap header
312 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_add_rx_radiotap_header()  local
321 	unsigned long chains = status->chains;  in ieee80211_add_rx_radiotap_header()
326 	if (status->flag & RX_FLAG_RADIOTAP_HE) {  in ieee80211_add_rx_radiotap_header()
327 		he = *(struct ieee80211_radiotap_he *)skb->data;  in ieee80211_add_rx_radiotap_header()
329 		WARN_ON_ONCE(status->encoding != RX_ENC_HE);  in ieee80211_add_rx_radiotap_header()
332 	if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {  in ieee80211_add_rx_radiotap_header()
333 		he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;  in ieee80211_add_rx_radiotap_header()
337 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {  in ieee80211_add_rx_radiotap_header()
338 		lsig = *(struct ieee80211_radiotap_lsig *)skb->data;  in ieee80211_add_rx_radiotap_header()
342 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {  in ieee80211_add_rx_radiotap_header()
344 		tlvs_len = skb_mac_header(skb) - skb->data;  in ieee80211_add_rx_radiotap_header()
347 	mpdulen = skb->len;  in ieee80211_add_rx_radiotap_header()
348 	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))  in ieee80211_add_rx_radiotap_header()
351 	rthdr = skb_push(skb, rtap_len - tlvs_len);  in ieee80211_add_rx_radiotap_header()
352 	memset(rthdr, 0, rtap_len - tlvs_len);  in ieee80211_add_rx_radiotap_header()
353 	it_present = &rthdr->it_present;  in ieee80211_add_rx_radiotap_header()
356 	rthdr->it_len = cpu_to_le16(rtap_len);  in ieee80211_add_rx_radiotap_header()
361 	if (!status->chains)  in ieee80211_add_rx_radiotap_header()
374 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)  in ieee80211_add_rx_radiotap_header()
384 	pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];  in ieee80211_add_rx_radiotap_header()
389 	if (ieee80211_have_rx_timestamp(status)) {  in ieee80211_add_rx_radiotap_header()
391 		while ((pos - (u8 *)rthdr) & 7)  in ieee80211_add_rx_radiotap_header()
394 			ieee80211_calculate_rx_timestamp(local, status,  in ieee80211_add_rx_radiotap_header()
397 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));  in ieee80211_add_rx_radiotap_header()
402 	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))  in ieee80211_add_rx_radiotap_header()
404 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))  in ieee80211_add_rx_radiotap_header()
406 	if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)  in ieee80211_add_rx_radiotap_header()
411 	if (!rate || status->encoding != RX_ENC_LEGACY) {  in ieee80211_add_rx_radiotap_header()
421 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));  in ieee80211_add_rx_radiotap_header()
422 		if (status->bw == RATE_INFO_BW_10)  in ieee80211_add_rx_radiotap_header()
424 		else if (status->bw == RATE_INFO_BW_5)  in ieee80211_add_rx_radiotap_header()
426 		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));  in ieee80211_add_rx_radiotap_header()
432 	put_unaligned_le16(status->freq, pos);  in ieee80211_add_rx_radiotap_header()
434 	if (status->bw == RATE_INFO_BW_10)  in ieee80211_add_rx_radiotap_header()
436 	else if (status->bw == RATE_INFO_BW_5)  in ieee80211_add_rx_radiotap_header()
439 	if (status->band == NL80211_BAND_5GHZ ||  in ieee80211_add_rx_radiotap_header()
440 	    status->band == NL80211_BAND_6GHZ)  in ieee80211_add_rx_radiotap_header()
442 	else if (status->encoding != RX_ENC_LEGACY)  in ieee80211_add_rx_radiotap_header()
444 	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)  in ieee80211_add_rx_radiotap_header()
454 	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&  in ieee80211_add_rx_radiotap_header()
455 	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {  in ieee80211_add_rx_radiotap_header()
456 		*pos = status->signal;  in ieee80211_add_rx_radiotap_header()
457 		rthdr->it_present |=  in ieee80211_add_rx_radiotap_header()
464 	if (!status->chains) {  in ieee80211_add_rx_radiotap_header()
466 		*pos = status->antenna;  in ieee80211_add_rx_radiotap_header()
474 	if ((pos - (u8 *)rthdr) & 1)  in ieee80211_add_rx_radiotap_header()
476 	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)  in ieee80211_add_rx_radiotap_header()
481 	if (status->encoding == RX_ENC_HT) {  in ieee80211_add_rx_radiotap_header()
484 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));  in ieee80211_add_rx_radiotap_header()
485 		*pos = local->hw.radiotap_mcs_details;  in ieee80211_add_rx_radiotap_header()
486 		if (status->enc_flags & RX_ENC_FLAG_HT_GF)  in ieee80211_add_rx_radiotap_header()
488 		if (status->enc_flags & RX_ENC_FLAG_LDPC)  in ieee80211_add_rx_radiotap_header()
492 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)  in ieee80211_add_rx_radiotap_header()
494 		if (status->bw == RATE_INFO_BW_40)  in ieee80211_add_rx_radiotap_header()
496 		if (status->enc_flags & RX_ENC_FLAG_HT_GF)  in ieee80211_add_rx_radiotap_header()
498 		if (status->enc_flags & RX_ENC_FLAG_LDPC)  in ieee80211_add_rx_radiotap_header()
500 		stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;  in ieee80211_add_rx_radiotap_header()
503 		*pos++ = status->rate_idx;  in ieee80211_add_rx_radiotap_header()
506 	if (status->flag & RX_FLAG_AMPDU_DETAILS) {  in ieee80211_add_rx_radiotap_header()
510 		while ((pos - (u8 *)rthdr) & 3)  in ieee80211_add_rx_radiotap_header()
512 		rthdr->it_present |=  in ieee80211_add_rx_radiotap_header()
514 		put_unaligned_le32(status->ampdu_reference, pos);  in ieee80211_add_rx_radiotap_header()
516 		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)  in ieee80211_add_rx_radiotap_header()
518 		if (status->flag & RX_FLAG_AMPDU_IS_LAST)  in ieee80211_add_rx_radiotap_header()
520 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)  in ieee80211_add_rx_radiotap_header()
522 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)  in ieee80211_add_rx_radiotap_header()
524 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT)  in ieee80211_add_rx_radiotap_header()
532 	if (status->encoding == RX_ENC_VHT) {  in ieee80211_add_rx_radiotap_header()
533 		u16 known = local->hw.radiotap_vht_details;  in ieee80211_add_rx_radiotap_header()
535 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));  in ieee80211_add_rx_radiotap_header()
539 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)  in ieee80211_add_rx_radiotap_header()
542 		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)  in ieee80211_add_rx_radiotap_header()
544 		if (status->enc_flags & RX_ENC_FLAG_BF)  in ieee80211_add_rx_radiotap_header()
548 		switch (status->bw) {  in ieee80211_add_rx_radiotap_header()
562 		*pos = (status->rate_idx << 4) | status->nss;  in ieee80211_add_rx_radiotap_header()
565 		if (status->enc_flags & RX_ENC_FLAG_LDPC)  in ieee80211_add_rx_radiotap_header()
574 	if (local->hw.radiotap_timestamp.units_pos >= 0) {  in ieee80211_add_rx_radiotap_header()
579 		rthdr->it_present |=  in ieee80211_add_rx_radiotap_header()
583 		while ((pos - (u8 *)rthdr) & 7)  in ieee80211_add_rx_radiotap_header()
586 		if (status->flag & RX_FLAG_MACTIME_IS_RTAP_TS64) {  in ieee80211_add_rx_radiotap_header()
588 			ts = status->mactime;  in ieee80211_add_rx_radiotap_header()
591 			ts = status->device_timestamp;  in ieee80211_add_rx_radiotap_header()
597 		if (local->hw.radiotap_timestamp.accuracy >= 0) {  in ieee80211_add_rx_radiotap_header()
598 			accuracy = local->hw.radiotap_timestamp.accuracy;  in ieee80211_add_rx_radiotap_header()
604 		*pos++ = local->hw.radiotap_timestamp.units_pos;  in ieee80211_add_rx_radiotap_header()
608 	if (status->encoding == RX_ENC_HE &&  in ieee80211_add_rx_radiotap_header()
609 	    status->flag & RX_FLAG_RADIOTAP_HE) {  in ieee80211_add_rx_radiotap_header()
612 		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {  in ieee80211_add_rx_radiotap_header()
615 						      status->enc_flags));  in ieee80211_add_rx_radiotap_header()
618 			he.data6 |= HE_PREP(DATA6_NSTS, status->nss);  in ieee80211_add_rx_radiotap_header()
629 		he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);  in ieee80211_add_rx_radiotap_header()
630 		he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);  in ieee80211_add_rx_radiotap_header()
632 				    !!(status->enc_flags & RX_ENC_FLAG_LDPC));  in ieee80211_add_rx_radiotap_header()
634 		he.data5 |= HE_PREP(DATA5_GI, status->he_gi);  in ieee80211_add_rx_radiotap_header()
636 		switch (status->bw) {  in ieee80211_add_rx_radiotap_header()
667 					    status->he_ru + 4);  in ieee80211_add_rx_radiotap_header()
670 			WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);  in ieee80211_add_rx_radiotap_header()
674 		while ((pos - (u8 *)rthdr) & 1)  in ieee80211_add_rx_radiotap_header()
676 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));  in ieee80211_add_rx_radiotap_header()
681 	if (status->encoding == RX_ENC_HE &&  in ieee80211_add_rx_radiotap_header()
682 	    status->flag & RX_FLAG_RADIOTAP_HE_MU) {  in ieee80211_add_rx_radiotap_header()
684 		while ((pos - (u8 *)rthdr) & 1)  in ieee80211_add_rx_radiotap_header()
686 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));  in ieee80211_add_rx_radiotap_header()
691 	if (status->flag & RX_FLAG_NO_PSDU) {  in ieee80211_add_rx_radiotap_header()
692 		rthdr->it_present |=  in ieee80211_add_rx_radiotap_header()
694 		*pos++ = status->zero_length_psdu_type;  in ieee80211_add_rx_radiotap_header()
697 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {  in ieee80211_add_rx_radiotap_header()
699 		while ((pos - (u8 *)rthdr) & 1)  in ieee80211_add_rx_radiotap_header()
701 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));  in ieee80211_add_rx_radiotap_header()
707 		*pos++ = status->chain_signal[chain];  in ieee80211_add_rx_radiotap_header()
718 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);  in ieee80211_make_monitor_skb()  local
723 	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);  in ieee80211_make_monitor_skb()
724 	needed_headroom = rt_hdrlen - rtap_space;  in ieee80211_make_monitor_skb()
733 		 * RX header they pull before we get here, and that should  in ieee80211_make_monitor_skb()
759 	skb->ip_summed = CHECKSUM_UNNECESSARY;  in ieee80211_make_monitor_skb()
760 	skb->pkt_type = PACKET_OTHERHOST;  in ieee80211_make_monitor_skb()
761 	skb->protocol = htons(ETH_P_802_2);  in ieee80211_make_monitor_skb()
768  * returns a cleaned-up SKB that no longer includes the FCS nor the
775 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);  in ieee80211_rx_monitor()  local
781 		rcu_dereference(local->monitor_sdata);  in ieee80211_rx_monitor()
785 	if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&  in ieee80211_rx_monitor()
792 	if (status->flag & RX_FLAG_RADIOTAP_HE)  in ieee80211_rx_monitor()
795 	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)  in ieee80211_rx_monitor()
798 	if (status->flag & RX_FLAG_RADIOTAP_LSIG)  in ieee80211_rx_monitor()
801 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)  in ieee80211_rx_monitor()
802 		rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];  in ieee80211_rx_monitor()
809 	 *  (2) the other RX handlers will modify the skb we got.  in ieee80211_rx_monitor()
815 	if (!(status->flag & RX_FLAG_NO_PSDU)) {  in ieee80211_rx_monitor()
816 		if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {  in ieee80211_rx_monitor()
817 			if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {  in ieee80211_rx_monitor()
826 		/* also consider the hdr->frame_control */  in ieee80211_rx_monitor()
838 	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {  in ieee80211_rx_monitor()
850 	list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {  in ieee80211_rx_monitor()
853 		chandef = &sdata->vif.bss_conf.chanreq.oper;  in ieee80211_rx_monitor()
854 		if (chandef->chan &&  in ieee80211_rx_monitor()
855 		    chandef->chan->center_freq != status->freq)  in ieee80211_rx_monitor()
863 		if (ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR))  in ieee80211_rx_monitor()
877 		skb->dev = prev_sdata->dev;  in ieee80211_rx_monitor()
878 		dev_sw_netstats_rx_add(skb->dev, skb->len);  in ieee80211_rx_monitor()
891 			skb->dev = prev_sdata->dev;  in ieee80211_rx_monitor()
892 			dev_sw_netstats_rx_add(skb->dev, skb->len);  in ieee80211_rx_monitor()
903 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)  in ieee80211_parse_qos()  argument
905 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_parse_qos()
906 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_parse_qos()  local
910 	if (ieee80211_is_data_qos(hdr->frame_control)) {  in ieee80211_parse_qos()
915 			status->rx_flags |= IEEE80211_RX_AMSDU;  in ieee80211_parse_qos()
921 		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):  in ieee80211_parse_qos()
925 		 *	Address 1 field, and all non-QoS data frames sent  in ieee80211_parse_qos()
927 		 *	modulo-4096 counter, [...]  in ieee80211_parse_qos()
929 		 * We also use that counter for non-QoS STAs.  in ieee80211_parse_qos()
933 		if (ieee80211_is_mgmt(hdr->frame_control))  in ieee80211_parse_qos()
938 	rx->seqno_idx = seqno_idx;  in ieee80211_parse_qos()
939 	rx->security_idx = security_idx;  in ieee80211_parse_qos()
940 	/* Set skb->priority to 1d tag if highest order bit of TID is not set.  in ieee80211_parse_qos()
941 	 * For now, set skb->priority to 0 for other cases. */  in ieee80211_parse_qos()
942 	rx->skb->priority = (tid > 7) ? 0 : tid;  in ieee80211_parse_qos()
948  * Drivers always need to pass packets that are aligned to two-byte boundaries
952  * guarantees that the contained IP header is aligned to a four-byte
954  * payload to a four-byte boundary (because either the IP header is directly
960  * With A-MSDU frames, however, the payload data address must yield two modulo
961  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
963  * specs were sane enough this time around to require padding each A-MSDU
970 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)  in ieee80211_verify_alignment()  argument
973 	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);  in ieee80211_verify_alignment()
978 /* rx handlers */
982 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;  in ieee80211_is_unicast_robust_mgmt_frame()
984 	if (is_multicast_ether_addr(hdr->addr1))  in ieee80211_is_unicast_robust_mgmt_frame()
993 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;  in ieee80211_is_multicast_robust_mgmt_frame()
995 	if (!is_multicast_ether_addr(hdr->addr1))  in ieee80211_is_multicast_robust_mgmt_frame()
1002 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
1005 	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;  in ieee80211_get_mmie_keyidx()
1009 	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))  in ieee80211_get_mmie_keyidx()
1010 		return -1;  in ieee80211_get_mmie_keyidx()
1013 	    !ieee80211_is_beacon(hdr->frame_control))  in ieee80211_get_mmie_keyidx()
1014 		return -1; /* not a robust management frame */  in ieee80211_get_mmie_keyidx()
1017 		(skb->data + skb->len - sizeof(*mmie));  in ieee80211_get_mmie_keyidx()
1018 	if (mmie->element_id == WLAN_EID_MMIE &&  in ieee80211_get_mmie_keyidx()
1019 	    mmie->length == sizeof(*mmie) - 2)  in ieee80211_get_mmie_keyidx()
1020 		return le16_to_cpu(mmie->key_id);  in ieee80211_get_mmie_keyidx()
1023 		(skb->data + skb->len - sizeof(*mmie16));  in ieee80211_get_mmie_keyidx()
1024 	if (skb->len >= 24 + sizeof(*mmie16) &&  in ieee80211_get_mmie_keyidx()
1025 	    mmie16->element_id == WLAN_EID_MMIE &&  in ieee80211_get_mmie_keyidx()
1026 	    mmie16->length == sizeof(*mmie16) - 2)  in ieee80211_get_mmie_keyidx()
1027 		return le16_to_cpu(mmie16->key_id);  in ieee80211_get_mmie_keyidx()
1029 	return -1;  in ieee80211_get_mmie_keyidx()
1034 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;  in ieee80211_get_keyid()
1035 	__le16 fc = hdr->frame_control;  in ieee80211_get_keyid()
1040 	if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))  in ieee80211_get_keyid()
1041 		return -EINVAL;  in ieee80211_get_keyid()
1050 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)  in ieee80211_rx_mesh_check()  argument
1052 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_rx_mesh_check()
1053 	char *dev_addr = rx->sdata->vif.addr;  in ieee80211_rx_mesh_check()
1055 	if (ieee80211_is_data(hdr->frame_control)) {  in ieee80211_rx_mesh_check()
1056 		if (is_multicast_ether_addr(hdr->addr1)) {  in ieee80211_rx_mesh_check()
1057 			if (ieee80211_has_tods(hdr->frame_control) ||  in ieee80211_rx_mesh_check()
1058 			    !ieee80211_has_fromds(hdr->frame_control))  in ieee80211_rx_mesh_check()
1060 			if (ether_addr_equal(hdr->addr3, dev_addr))  in ieee80211_rx_mesh_check()
1063 			if (!ieee80211_has_a4(hdr->frame_control))  in ieee80211_rx_mesh_check()
1065 			if (ether_addr_equal(hdr->addr4, dev_addr))  in ieee80211_rx_mesh_check()
1074 	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {  in ieee80211_rx_mesh_check()
1077 		if (!ieee80211_is_mgmt(hdr->frame_control))  in ieee80211_rx_mesh_check()
1080 		if (ieee80211_is_action(hdr->frame_control)) {  in ieee80211_rx_mesh_check()
1084 			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)  in ieee80211_rx_mesh_check()
1088 			category = mgmt->u.action.category;  in ieee80211_rx_mesh_check()
1095 		if (ieee80211_is_probe_req(hdr->frame_control) ||  in ieee80211_rx_mesh_check()
1096 		    ieee80211_is_probe_resp(hdr->frame_control) ||  in ieee80211_rx_mesh_check()
1097 		    ieee80211_is_beacon(hdr->frame_control) ||  in ieee80211_rx_mesh_check()
1098 		    ieee80211_is_auth(hdr->frame_control))  in ieee80211_rx_mesh_check()
1110 	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];  in ieee80211_rx_reorder_ready()
1112 	struct ieee80211_rx_status *status;  in ieee80211_rx_reorder_ready()  local
1114 	if (tid_agg_rx->reorder_buf_filtered &&  in ieee80211_rx_reorder_ready()
1115 	    tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))  in ieee80211_rx_reorder_ready()
1121 	status = IEEE80211_SKB_RXCB(tail);  in ieee80211_rx_reorder_ready()
1122 	if (status->flag & RX_FLAG_AMSDU_MORE)  in ieee80211_rx_reorder_ready()
1133 	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];  in ieee80211_release_reorder_frame()
1135 	struct ieee80211_rx_status *status;  in ieee80211_release_reorder_frame()  local
1137 	lockdep_assert_held(&tid_agg_rx->reorder_lock);  in ieee80211_release_reorder_frame()
1148 	tid_agg_rx->stored_mpdu_num--;  in ieee80211_release_reorder_frame()
1150 		status = IEEE80211_SKB_RXCB(skb);  in ieee80211_release_reorder_frame()
1151 		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;  in ieee80211_release_reorder_frame()
1156 	if (tid_agg_rx->reorder_buf_filtered)  in ieee80211_release_reorder_frame()
1157 		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);  in ieee80211_release_reorder_frame()
1158 	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);  in ieee80211_release_reorder_frame()
1168 	lockdep_assert_held(&tid_agg_rx->reorder_lock);  in ieee80211_release_reorder_frames()
1170 	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {  in ieee80211_release_reorder_frames()
1171 		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;  in ieee80211_release_reorder_frames()
1178  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1184  * Callers must hold tid_agg_rx->reorder_lock.
1194 	lockdep_assert_held(&tid_agg_rx->reorder_lock);  in ieee80211_sta_reorder_release()
1197 	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;  in ieee80211_sta_reorder_release()
1199 	    tid_agg_rx->stored_mpdu_num) {  in ieee80211_sta_reorder_release()
1205 		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;  in ieee80211_sta_reorder_release()
1206 		     j = (j + 1) % tid_agg_rx->buf_size) {  in ieee80211_sta_reorder_release()
1212 			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +  in ieee80211_sta_reorder_release()
1216 			/* don't leave incomplete A-MSDUs around */  in ieee80211_sta_reorder_release()
1217 			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;  in ieee80211_sta_reorder_release()
1218 			     i = (i + 1) % tid_agg_rx->buf_size)  in ieee80211_sta_reorder_release()
1219 				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);  in ieee80211_sta_reorder_release()
1222 					   "release an RX reorder frame due to timeout on earlier frames\n");  in ieee80211_sta_reorder_release()
1229 			tid_agg_rx->head_seq_num =  in ieee80211_sta_reorder_release()
1230 				(tid_agg_rx->head_seq_num +  in ieee80211_sta_reorder_release()
1237 		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;  in ieee80211_sta_reorder_release()
1240 	if (tid_agg_rx->stored_mpdu_num) {  in ieee80211_sta_reorder_release()
1241 		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;  in ieee80211_sta_reorder_release()
1243 		for (; j != (index - 1) % tid_agg_rx->buf_size;  in ieee80211_sta_reorder_release()
1244 		     j = (j + 1) % tid_agg_rx->buf_size) {  in ieee80211_sta_reorder_release()
1251 		if (!tid_agg_rx->removed)  in ieee80211_sta_reorder_release()
1252 			mod_timer(&tid_agg_rx->reorder_timer,  in ieee80211_sta_reorder_release()
1253 				  tid_agg_rx->reorder_time[j] + 1 +  in ieee80211_sta_reorder_release()
1256 		timer_delete(&tid_agg_rx->reorder_timer);  in ieee80211_sta_reorder_release()
1261  * As this function belongs to the RX path it must be under
1270 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;  in ieee80211_sta_manage_reorder_buf()
1271 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_sta_manage_reorder_buf()  local
1277 	spin_lock(&tid_agg_rx->reorder_lock);  in ieee80211_sta_manage_reorder_buf()
1283 	if (unlikely(tid_agg_rx->auto_seq)) {  in ieee80211_sta_manage_reorder_buf()
1284 		tid_agg_rx->auto_seq = false;  in ieee80211_sta_manage_reorder_buf()
1285 		tid_agg_rx->ssn = mpdu_seq_num;  in ieee80211_sta_manage_reorder_buf()
1286 		tid_agg_rx->head_seq_num = mpdu_seq_num;  in ieee80211_sta_manage_reorder_buf()
1289 	buf_size = tid_agg_rx->buf_size;  in ieee80211_sta_manage_reorder_buf()
1290 	head_seq_num = tid_agg_rx->head_seq_num;  in ieee80211_sta_manage_reorder_buf()
1296 	if (unlikely(!tid_agg_rx->started)) {  in ieee80211_sta_manage_reorder_buf()
1301 		tid_agg_rx->started = true;  in ieee80211_sta_manage_reorder_buf()
1324 	index = mpdu_seq_num % tid_agg_rx->buf_size;  in ieee80211_sta_manage_reorder_buf()
1338 	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&  in ieee80211_sta_manage_reorder_buf()
1339 	    tid_agg_rx->stored_mpdu_num == 0) {  in ieee80211_sta_manage_reorder_buf()
1340 		if (!(status->flag & RX_FLAG_AMSDU_MORE))  in ieee80211_sta_manage_reorder_buf()
1341 			tid_agg_rx->head_seq_num =  in ieee80211_sta_manage_reorder_buf()
1342 				ieee80211_sn_inc(tid_agg_rx->head_seq_num);  in ieee80211_sta_manage_reorder_buf()
1348 	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);  in ieee80211_sta_manage_reorder_buf()
1349 	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {  in ieee80211_sta_manage_reorder_buf()
1350 		tid_agg_rx->reorder_time[index] = jiffies;  in ieee80211_sta_manage_reorder_buf()
1351 		tid_agg_rx->stored_mpdu_num++;  in ieee80211_sta_manage_reorder_buf()
1356 	spin_unlock(&tid_agg_rx->reorder_lock);  in ieee80211_sta_manage_reorder_buf()
1361  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1364 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,  in ieee80211_rx_reorder_ampdu()  argument
1367 	struct sk_buff *skb = rx->skb;  in ieee80211_rx_reorder_ampdu()
1368 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;  in ieee80211_rx_reorder_ampdu()
1369 	struct sta_info *sta = rx->sta;  in ieee80211_rx_reorder_ampdu()
1374 	if (!ieee80211_is_data_qos(hdr->frame_control) ||  in ieee80211_rx_reorder_ampdu()
1375 	    is_multicast_ether_addr(hdr->addr1))  in ieee80211_rx_reorder_ampdu()
1379 	 * filter the QoS data rx stream according to  in ieee80211_rx_reorder_ampdu()
1390 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);  in ieee80211_rx_reorder_ampdu()
1393 		    !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&  in ieee80211_rx_reorder_ampdu()
1394 		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))  in ieee80211_rx_reorder_ampdu()
1395 			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,  in ieee80211_rx_reorder_ampdu()
1402 	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))  in ieee80211_rx_reorder_ampdu()
1409 	/* new, potentially un-ordered, ampdu frame - process it */  in ieee80211_rx_reorder_ampdu()
1412 	if (tid_agg_rx->timeout)  in ieee80211_rx_reorder_ampdu()
1413 		tid_agg_rx->last_rx = jiffies;  in ieee80211_rx_reorder_ampdu()
1415 	/* if this mpdu is fragmented - terminate rx aggregation session */  in ieee80211_rx_reorder_ampdu()
1416 	sc = le16_to_cpu(hdr->seq_ctrl);  in ieee80211_rx_reorder_ampdu()
1418 		ieee80211_queue_skb_to_iface(rx->sdata, rx->link_id, NULL, skb);  in ieee80211_rx_reorder_ampdu()
1423 	 * No locking needed -- we will only ever process one  in ieee80211_rx_reorder_ampdu()
1424 	 * RX packet at a time, and thus own tid_agg_rx. All  in ieee80211_rx_reorder_ampdu()
1429 	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,  in ieee80211_rx_reorder_ampdu()
1438 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_check_dup()  argument
1440 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_rx_h_check_dup()
1441 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_check_dup()  local
1443 	if (status->flag & RX_FLAG_DUP_VALIDATED)  in ieee80211_rx_h_check_dup()
1448 	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")  in ieee80211_rx_h_check_dup()
1451 	if (rx->skb->len < 24)  in ieee80211_rx_h_check_dup()
1454 	if (ieee80211_is_ctl(hdr->frame_control) ||  in ieee80211_rx_h_check_dup()
1455 	    ieee80211_is_any_nullfunc(hdr->frame_control))  in ieee80211_rx_h_check_dup()
1458 	if (!rx->sta)  in ieee80211_rx_h_check_dup()
1461 	if (unlikely(is_multicast_ether_addr(hdr->addr1))) {  in ieee80211_rx_h_check_dup()
1462 		struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_check_dup()
1465 		if (!ieee80211_is_data_present(hdr->frame_control))  in ieee80211_rx_h_check_dup()
1468 		if (!ieee80211_vif_is_mld(&sdata->vif) ||  in ieee80211_rx_h_check_dup()
1469 		    sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_check_dup()
1472 		if (sdata->u.mgd.mcast_seq_last != IEEE80211_SN_MODULO &&  in ieee80211_rx_h_check_dup()
1473 		    ieee80211_sn_less_eq(sn, sdata->u.mgd.mcast_seq_last))  in ieee80211_rx_h_check_dup()
1476 		sdata->u.mgd.mcast_seq_last = sn;  in ieee80211_rx_h_check_dup()
1480 	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&  in ieee80211_rx_h_check_dup()
1481 		     rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {  in ieee80211_rx_h_check_dup()
1482 		I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);  in ieee80211_rx_h_check_dup()
1483 		rx->link_sta->rx_stats.num_duplicates++;  in ieee80211_rx_h_check_dup()
1485 	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {  in ieee80211_rx_h_check_dup()
1486 		rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;  in ieee80211_rx_h_check_dup()
1493 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_check()  argument
1495 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_rx_h_check()
1506 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))  in ieee80211_rx_h_check()
1507 		return ieee80211_rx_mesh_check(rx);  in ieee80211_rx_h_check()
1509 	if (unlikely((ieee80211_is_data(hdr->frame_control) ||  in ieee80211_rx_h_check()
1510 		      ieee80211_is_pspoll(hdr->frame_control)) &&  in ieee80211_rx_h_check()
1511 		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&  in ieee80211_rx_h_check()
1512 		     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&  in ieee80211_rx_h_check()
1513 		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {  in ieee80211_rx_h_check()
1519 		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&  in ieee80211_rx_h_check()
1520 		    ieee80211_is_data_present(hdr->frame_control)) {  in ieee80211_rx_h_check()
1524 			hdrlen = ieee80211_hdrlen(hdr->frame_control);  in ieee80211_rx_h_check()
1526 			if (rx->skb->len < hdrlen + 8)  in ieee80211_rx_h_check()
1529 			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);  in ieee80211_rx_h_check()
1530 			if (ethertype == rx->sdata->control_port_protocol)  in ieee80211_rx_h_check()
1534 		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&  in ieee80211_rx_h_check()
1535 		    cfg80211_rx_spurious_frame(rx->sdata->dev, hdr->addr2,  in ieee80211_rx_h_check()
1536 					       rx->link_id, GFP_ATOMIC))  in ieee80211_rx_h_check()
1547 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_check_more_data()  argument
1553 	local = rx->local;  in ieee80211_rx_h_check_more_data()
1554 	skb = rx->skb;  in ieee80211_rx_h_check_more_data()
1555 	hdr = (struct ieee80211_hdr *) skb->data;  in ieee80211_rx_h_check_more_data()
1557 	if (!local->pspolling)  in ieee80211_rx_h_check_more_data()
1560 	if (!ieee80211_has_fromds(hdr->frame_control))  in ieee80211_rx_h_check_more_data()
1564 	if (!ieee80211_is_data(hdr->frame_control))  in ieee80211_rx_h_check_more_data()
1567 	if (!ieee80211_has_moredata(hdr->frame_control)) {  in ieee80211_rx_h_check_more_data()
1569 		local->pspolling = false;  in ieee80211_rx_h_check_more_data()
1574 	ieee80211_send_pspoll(local, rx->sdata);  in ieee80211_rx_h_check_more_data()
1581 	struct ieee80211_sub_if_data *sdata = sta->sdata;  in sta_ps_start()
1582 	struct ieee80211_local *local = sdata->local;  in sta_ps_start()
1586 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||  in sta_ps_start()
1587 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)  in sta_ps_start()
1588 		ps = &sdata->bss->ps;  in sta_ps_start()
1592 	atomic_inc(&ps->num_sta_ps);  in sta_ps_start()
1594 	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))  in sta_ps_start()
1595 		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);  in sta_ps_start()
1597 	       sta->sta.addr, sta->sta.aid);  in sta_ps_start()
1602 		struct ieee80211_txq *txq = sta->sta.txq[tid];  in sta_ps_start()
1605 		spin_lock(&local->active_txq_lock[txq->ac]);  in sta_ps_start()
1606 		if (!list_empty(&txqi->schedule_order))  in sta_ps_start()
1607 			list_del_init(&txqi->schedule_order);  in sta_ps_start()
1608 		spin_unlock(&local->active_txq_lock[txq->ac]);  in sta_ps_start()
1611 			set_bit(tid, &sta->txq_buffered_tids);  in sta_ps_start()
1613 			clear_bit(tid, &sta->txq_buffered_tids);  in sta_ps_start()
1619 	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",  in sta_ps_end()
1620 	       sta->sta.addr, sta->sta.aid);  in sta_ps_end()
1630 		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",  in sta_ps_end()
1631 		       sta->sta.addr, sta->sta.aid);  in sta_ps_end()
1645 	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));  in ieee80211_sta_ps_transition()
1650 		return -EINVAL;  in ieee80211_sta_ps_transition()
1681 	 * If this AC is not trigger-enabled do nothing unless the  in ieee80211_sta_uapsd_trigger()
1684 	 * NB: This could/should check a separate bitmap of trigger-  in ieee80211_sta_uapsd_trigger()
1688 	if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&  in ieee80211_sta_uapsd_trigger()
1704 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_uapsd_and_pspoll()  argument
1706 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_uapsd_and_pspoll()
1707 	struct ieee80211_hdr *hdr = (void *)rx->skb->data;  in ieee80211_rx_h_uapsd_and_pspoll()
1708 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_uapsd_and_pspoll()  local
1710 	if (!rx->sta)  in ieee80211_rx_h_uapsd_and_pspoll()
1713 	if (sdata->vif.type != NL80211_IFTYPE_AP &&  in ieee80211_rx_h_uapsd_and_pspoll()
1714 	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)  in ieee80211_rx_h_uapsd_and_pspoll()
1719 	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from  in ieee80211_rx_h_uapsd_and_pspoll()
1722 	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))  in ieee80211_rx_h_uapsd_and_pspoll()
1728 	 * in the PS-Poll case the station must be confused ...  in ieee80211_rx_h_uapsd_and_pspoll()
1730 	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))  in ieee80211_rx_h_uapsd_and_pspoll()
1733 	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {  in ieee80211_rx_h_uapsd_and_pspoll()
1734 		ieee80211_sta_pspoll(&rx->sta->sta);  in ieee80211_rx_h_uapsd_and_pspoll()
1738 		dev_kfree_skb(rx->skb);  in ieee80211_rx_h_uapsd_and_pspoll()
1741 	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&  in ieee80211_rx_h_uapsd_and_pspoll()
1742 		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&  in ieee80211_rx_h_uapsd_and_pspoll()
1743 		   ieee80211_has_pm(hdr->frame_control) &&  in ieee80211_rx_h_uapsd_and_pspoll()
1744 		   (ieee80211_is_data_qos(hdr->frame_control) ||  in ieee80211_rx_h_uapsd_and_pspoll()
1745 		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {  in ieee80211_rx_h_uapsd_and_pspoll()
1748 		ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);  in ieee80211_rx_h_uapsd_and_pspoll()
1755 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_sta_process()  argument
1757 	struct sta_info *sta = rx->sta;  in ieee80211_rx_h_sta_process()
1758 	struct link_sta_info *link_sta = rx->link_sta;  in ieee80211_rx_h_sta_process()
1759 	struct sk_buff *skb = rx->skb;  in ieee80211_rx_h_sta_process()
1760 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_rx_h_sta_process()  local
1761 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;  in ieee80211_rx_h_sta_process()
1775 	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {  in ieee80211_rx_h_sta_process()
1776 		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,  in ieee80211_rx_h_sta_process()
1778 		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&  in ieee80211_rx_h_sta_process()
1780 			link_sta->rx_stats.last_rx = jiffies;  in ieee80211_rx_h_sta_process()
1781 			if (ieee80211_is_data_present(hdr->frame_control) &&  in ieee80211_rx_h_sta_process()
1782 			    !is_multicast_ether_addr(hdr->addr1))  in ieee80211_rx_h_sta_process()
1783 				link_sta->rx_stats.last_rate =  in ieee80211_rx_h_sta_process()
1784 					sta_stats_encode_rate(status);  in ieee80211_rx_h_sta_process()
1786 	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {  in ieee80211_rx_h_sta_process()
1787 		link_sta->rx_stats.last_rx = jiffies;  in ieee80211_rx_h_sta_process()
1788 	} else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&  in ieee80211_rx_h_sta_process()
1789 		   !is_multicast_ether_addr(hdr->addr1)) {  in ieee80211_rx_h_sta_process()
1794 		link_sta->rx_stats.last_rx = jiffies;  in ieee80211_rx_h_sta_process()
1795 		if (ieee80211_is_data_present(hdr->frame_control))  in ieee80211_rx_h_sta_process()
1796 			link_sta->rx_stats.last_rate = sta_stats_encode_rate(status);  in ieee80211_rx_h_sta_process()
1799 	link_sta->rx_stats.fragments++;  in ieee80211_rx_h_sta_process()
1801 	u64_stats_update_begin(&link_sta->rx_stats.syncp);  in ieee80211_rx_h_sta_process()
1802 	link_sta->rx_stats.bytes += rx->skb->len;  in ieee80211_rx_h_sta_process()
1803 	u64_stats_update_end(&link_sta->rx_stats.syncp);  in ieee80211_rx_h_sta_process()
1805 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {  in ieee80211_rx_h_sta_process()
1806 		link_sta->rx_stats.last_signal = status->signal;  in ieee80211_rx_h_sta_process()
1807 		ewma_signal_add(&link_sta->rx_stats_avg.signal,  in ieee80211_rx_h_sta_process()
1808 				-status->signal);  in ieee80211_rx_h_sta_process()
1811 	if (status->chains) {  in ieee80211_rx_h_sta_process()
1812 		link_sta->rx_stats.chains = status->chains;  in ieee80211_rx_h_sta_process()
1813 		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {  in ieee80211_rx_h_sta_process()
1814 			int signal = status->chain_signal[i];  in ieee80211_rx_h_sta_process()
1816 			if (!(status->chains & BIT(i)))  in ieee80211_rx_h_sta_process()
1819 			link_sta->rx_stats.chain_signal_last[i] = signal;  in ieee80211_rx_h_sta_process()
1820 			ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],  in ieee80211_rx_h_sta_process()
1821 					-signal);  in ieee80211_rx_h_sta_process()
1825 	if (ieee80211_is_s1g_beacon(hdr->frame_control))  in ieee80211_rx_h_sta_process()
1831 	 * frame as specified in IEEE 802.11-2016 11.2.3.2  in ieee80211_rx_h_sta_process()
1833 	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&  in ieee80211_rx_h_sta_process()
1834 	    !ieee80211_has_morefrags(hdr->frame_control) &&  in ieee80211_rx_h_sta_process()
1835 	    !is_multicast_ether_addr(hdr->addr1) &&  in ieee80211_rx_h_sta_process()
1836 	    (ieee80211_is_mgmt(hdr->frame_control) ||  in ieee80211_rx_h_sta_process()
1837 	     ieee80211_is_data(hdr->frame_control)) &&  in ieee80211_rx_h_sta_process()
1838 	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&  in ieee80211_rx_h_sta_process()
1839 	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||  in ieee80211_rx_h_sta_process()
1840 	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {  in ieee80211_rx_h_sta_process()
1842 			if (!ieee80211_has_pm(hdr->frame_control))  in ieee80211_rx_h_sta_process()
1845 			if (ieee80211_has_pm(hdr->frame_control))  in ieee80211_rx_h_sta_process()
1851 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))  in ieee80211_rx_h_sta_process()
1855 	 * Drop (qos-)data::nullfunc frames silently, since they  in ieee80211_rx_h_sta_process()
1858 	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {  in ieee80211_rx_h_sta_process()
1859 		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);  in ieee80211_rx_h_sta_process()
1862 		 * If we receive a 4-addr nullfunc frame from a STA  in ieee80211_rx_h_sta_process()
1863 		 * that was not moved to a 4-addr STA vlan yet send  in ieee80211_rx_h_sta_process()
1867 		if (ieee80211_has_a4(hdr->frame_control) &&  in ieee80211_rx_h_sta_process()
1868 		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||  in ieee80211_rx_h_sta_process()
1869 		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&  in ieee80211_rx_h_sta_process()
1870 		      !rx->sdata->u.vlan.sta))) {  in ieee80211_rx_h_sta_process()
1873 					rx->sdata->dev, sta->sta.addr,  in ieee80211_rx_h_sta_process()
1874 					rx->link_id, GFP_ATOMIC);  in ieee80211_rx_h_sta_process()
1881 		link_sta->rx_stats.packets++;  in ieee80211_rx_h_sta_process()
1882 		dev_kfree_skb(rx->skb);  in ieee80211_rx_h_sta_process()
1890 ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)  in ieee80211_rx_get_bigtk()  argument
1908 			idx2 = idx - 1;  in ieee80211_rx_get_bigtk()
1911 	if (rx->link_sta)  in ieee80211_rx_get_bigtk()
1912 		key = rcu_dereference(rx->link_sta->gtk[idx]);  in ieee80211_rx_get_bigtk()
1914 		key = rcu_dereference(rx->link->gtk[idx]);  in ieee80211_rx_get_bigtk()
1915 	if (!key && rx->link_sta)  in ieee80211_rx_get_bigtk()
1916 		key = rcu_dereference(rx->link_sta->gtk[idx2]);  in ieee80211_rx_get_bigtk()
1918 		key = rcu_dereference(rx->link->gtk[idx2]);  in ieee80211_rx_get_bigtk()
1924 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_decrypt()  argument
1926 	struct sk_buff *skb = rx->skb;  in ieee80211_rx_h_decrypt()
1927 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_rx_h_decrypt()  local
1928 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;  in ieee80211_rx_h_decrypt()
1933 	int mmie_keyidx = -1;  in ieee80211_rx_h_decrypt()
1936 	if (ieee80211_is_ext(hdr->frame_control))  in ieee80211_rx_h_decrypt()
1943 	 *  - GTK (group keys)  in ieee80211_rx_h_decrypt()
1944 	 *  - IGTK (group keys for management frames)  in ieee80211_rx_h_decrypt()
1945 	 *  - BIGTK (group keys for Beacon frames)  in ieee80211_rx_h_decrypt()
1946 	 *  - PTK (pairwise keys)  in ieee80211_rx_h_decrypt()
1947 	 *  - STK (station-to-station pairwise keys)  in ieee80211_rx_h_decrypt()
1952 	 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,  in ieee80211_rx_h_decrypt()
1968 	rx->key = NULL;  in ieee80211_rx_h_decrypt()
1969 	fc = hdr->frame_control;  in ieee80211_rx_h_decrypt()
1971 	if (rx->sta) {  in ieee80211_rx_h_decrypt()
1972 		int keyid = rx->sta->ptk_idx;  in ieee80211_rx_h_decrypt()
1973 		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);  in ieee80211_rx_h_decrypt()
1976 		    !(status->flag & RX_FLAG_IV_STRIPPED)) {  in ieee80211_rx_h_decrypt()
1977 			keyid = ieee80211_get_keyid(rx->skb);  in ieee80211_rx_h_decrypt()
1982 			ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);  in ieee80211_rx_h_decrypt()
1987 		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);  in ieee80211_rx_h_decrypt()
1989 	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {  in ieee80211_rx_h_decrypt()
1990 		rx->key = ptk_idx ? ptk_idx : sta_ptk;  in ieee80211_rx_h_decrypt()
1991 		if ((status->flag & RX_FLAG_DECRYPTED) &&  in ieee80211_rx_h_decrypt()
1992 		    (status->flag & RX_FLAG_IV_STRIPPED))  in ieee80211_rx_h_decrypt()
1999 		if ((status->flag & RX_FLAG_DECRYPTED) &&  in ieee80211_rx_h_decrypt()
2000 		    (status->flag & RX_FLAG_IV_STRIPPED))  in ieee80211_rx_h_decrypt()
2006 			if (rx->sdata->dev)  in ieee80211_rx_h_decrypt()
2007 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,  in ieee80211_rx_h_decrypt()
2008 							     skb->data,  in ieee80211_rx_h_decrypt()
2009 							     skb->len);  in ieee80211_rx_h_decrypt()
2013 		rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);  in ieee80211_rx_h_decrypt()
2014 		if (!rx->key)  in ieee80211_rx_h_decrypt()
2018 		if ((status->flag & RX_FLAG_DECRYPTED) &&  in ieee80211_rx_h_decrypt()
2019 		    (status->flag & RX_FLAG_IV_STRIPPED))  in ieee80211_rx_h_decrypt()
2025 		if (rx->link_sta) {  in ieee80211_rx_h_decrypt()
2027 			    test_sta_flag(rx->sta, WLAN_STA_MFP))  in ieee80211_rx_h_decrypt()
2030 			rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);  in ieee80211_rx_h_decrypt()
2032 		if (!rx->key)  in ieee80211_rx_h_decrypt()
2033 			rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);  in ieee80211_rx_h_decrypt()
2037 		 * need to set rx->key if there is a key that could have been  in ieee80211_rx_h_decrypt()
2045 			key = ieee80211_rx_get_bigtk(rx, -1);  in ieee80211_rx_h_decrypt()
2047 			   is_multicast_ether_addr(hdr->addr1)) {  in ieee80211_rx_h_decrypt()
2048 			key = rcu_dereference(rx->link->default_mgmt_key);  in ieee80211_rx_h_decrypt()
2050 			if (rx->link_sta) {  in ieee80211_rx_h_decrypt()
2052 					key = rcu_dereference(rx->link_sta->gtk[i]);  in ieee80211_rx_h_decrypt()
2059 					key = rcu_dereference(rx->link->gtk[i]);  in ieee80211_rx_h_decrypt()
2066 			rx->key = key;  in ieee80211_rx_h_decrypt()
2078 		if ((status->flag & RX_FLAG_DECRYPTED) &&  in ieee80211_rx_h_decrypt()
2079 		    (status->flag & RX_FLAG_IV_STRIPPED))  in ieee80211_rx_h_decrypt()
2082 		keyidx = ieee80211_get_keyid(rx->skb);  in ieee80211_rx_h_decrypt()
2087 		/* check per-station GTK first, if multicast packet */  in ieee80211_rx_h_decrypt()
2088 		if (is_multicast_ether_addr(hdr->addr1) && rx->link_sta)  in ieee80211_rx_h_decrypt()
2089 			rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);  in ieee80211_rx_h_decrypt()
2092 		if (!rx->key) {  in ieee80211_rx_h_decrypt()
2093 			if (is_multicast_ether_addr(hdr->addr1))  in ieee80211_rx_h_decrypt()
2094 				rx->key = rcu_dereference(rx->link->gtk[keyidx]);  in ieee80211_rx_h_decrypt()
2095 			if (!rx->key)  in ieee80211_rx_h_decrypt()
2096 				rx->key = rcu_dereference(rx->sdata->keys[keyidx]);  in ieee80211_rx_h_decrypt()
2099 			 * RSNA-protected unicast frames should always be  in ieee80211_rx_h_decrypt()
2100 			 * sent with pairwise or station-to-station keys,  in ieee80211_rx_h_decrypt()
2103 			if (rx->key &&  in ieee80211_rx_h_decrypt()
2104 			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&  in ieee80211_rx_h_decrypt()
2105 			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&  in ieee80211_rx_h_decrypt()
2106 			    !is_multicast_ether_addr(hdr->addr1))  in ieee80211_rx_h_decrypt()
2107 				rx->key = NULL;  in ieee80211_rx_h_decrypt()
2111 	if (rx->key) {  in ieee80211_rx_h_decrypt()
2112 		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))  in ieee80211_rx_h_decrypt()
2120 	switch (rx->key->conf.cipher) {  in ieee80211_rx_h_decrypt()
2123 		result = ieee80211_crypto_wep_decrypt(rx);  in ieee80211_rx_h_decrypt()
2126 		result = ieee80211_crypto_tkip_decrypt(rx);  in ieee80211_rx_h_decrypt()
2130 			rx, IEEE80211_CCMP_MIC_LEN);  in ieee80211_rx_h_decrypt()
2134 			rx, IEEE80211_CCMP_256_MIC_LEN);  in ieee80211_rx_h_decrypt()
2137 		result = ieee80211_crypto_aes_cmac_decrypt(rx);  in ieee80211_rx_h_decrypt()
2140 		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);  in ieee80211_rx_h_decrypt()
2144 		result = ieee80211_crypto_aes_gmac_decrypt(rx);  in ieee80211_rx_h_decrypt()
2148 		result = ieee80211_crypto_gcmp_decrypt(rx);  in ieee80211_rx_h_decrypt()
2157 	status->flag |= RX_FLAG_DECRYPTED;  in ieee80211_rx_h_decrypt()
2160 		     rx->sdata->dev))  in ieee80211_rx_h_decrypt()
2161 		cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,  in ieee80211_rx_h_decrypt()
2162 					     skb->data, skb->len);  in ieee80211_rx_h_decrypt()
2171 	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)  in ieee80211_init_frag_cache()
2172 		skb_queue_head_init(&cache->entries[i].skb_list);  in ieee80211_init_frag_cache()
2179 	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)  in ieee80211_destroy_frag_cache()
2180 		__skb_queue_purge(&cache->entries[i].skb_list);  in ieee80211_destroy_frag_cache()
2190 	entry = &cache->entries[cache->next++];  in ieee80211_reassemble_add()
2191 	if (cache->next >= IEEE80211_FRAGMENT_MAX)  in ieee80211_reassemble_add()
2192 		cache->next = 0;  in ieee80211_reassemble_add()
2194 	__skb_queue_purge(&entry->skb_list);  in ieee80211_reassemble_add()
2196 	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */  in ieee80211_reassemble_add()
2198 	entry->first_frag_time = jiffies;  in ieee80211_reassemble_add()
2199 	entry->seq = seq;  in ieee80211_reassemble_add()
2200 	entry->rx_queue = rx_queue;  in ieee80211_reassemble_add()
2201 	entry->last_frag = frag;  in ieee80211_reassemble_add()
2202 	entry->check_sequential_pn = false;  in ieee80211_reassemble_add()
2203 	entry->extra_len = 0;  in ieee80211_reassemble_add()
2216 	idx = cache->next;  in ieee80211_reassemble_find()
2221 		idx--;  in ieee80211_reassemble_find()
2223 			idx = IEEE80211_FRAGMENT_MAX - 1;  in ieee80211_reassemble_find()
2225 		entry = &cache->entries[idx];  in ieee80211_reassemble_find()
2226 		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||  in ieee80211_reassemble_find()
2227 		    entry->rx_queue != rx_queue ||  in ieee80211_reassemble_find()
2228 		    entry->last_frag + 1 != frag)  in ieee80211_reassemble_find()
2231 		f_skb = __skb_peek(&entry->skb_list);  in ieee80211_reassemble_find()
2232 		f_hdr = (struct ieee80211_hdr *) f_skb->data;  in ieee80211_reassemble_find()
2237 		if (((hdr->frame_control ^ f_hdr->frame_control) &  in ieee80211_reassemble_find()
2239 		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||  in ieee80211_reassemble_find()
2240 		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))  in ieee80211_reassemble_find()
2243 		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {  in ieee80211_reassemble_find()
2244 			__skb_queue_purge(&entry->skb_list);  in ieee80211_reassemble_find()
2253 static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)  in requires_sequential_pn()  argument
2255 	return rx->key &&  in requires_sequential_pn()
2256 		(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||  in requires_sequential_pn()
2257 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||  in requires_sequential_pn()
2258 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||  in requires_sequential_pn()
2259 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&  in requires_sequential_pn()
2264 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_defragment()  argument
2266 	struct ieee80211_fragment_cache *cache = &rx->sdata->frags;  in ieee80211_rx_h_defragment()
2273 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_defragment()  local
2275 	hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_rx_h_defragment()
2276 	fc = hdr->frame_control;  in ieee80211_rx_h_defragment()
2281 	sc = le16_to_cpu(hdr->seq_ctrl);  in ieee80211_rx_h_defragment()
2284 	if (rx->sta)  in ieee80211_rx_h_defragment()
2285 		cache = &rx->sta->frags;  in ieee80211_rx_h_defragment()
2290 	if (is_multicast_ether_addr(hdr->addr1))  in ieee80211_rx_h_defragment()
2293 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);  in ieee80211_rx_h_defragment()
2295 	if (skb_linearize(rx->skb))  in ieee80211_rx_h_defragment()
2299 	 *  skb_linearize() might change the skb->data and  in ieee80211_rx_h_defragment()
2303 	hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_rx_h_defragment()
2309 						 rx->seqno_idx, &(rx->skb));  in ieee80211_rx_h_defragment()
2310 		if (requires_sequential_pn(rx, fc)) {  in ieee80211_rx_h_defragment()
2311 			int queue = rx->security_idx;  in ieee80211_rx_h_defragment()
2316 			entry->check_sequential_pn = true;  in ieee80211_rx_h_defragment()
2317 			entry->is_protected = true;  in ieee80211_rx_h_defragment()
2318 			entry->key_color = rx->key->color;  in ieee80211_rx_h_defragment()
2319 			memcpy(entry->last_pn,  in ieee80211_rx_h_defragment()
2320 			       rx->key->u.ccmp.rx_pn[queue],  in ieee80211_rx_h_defragment()
2326 			BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=  in ieee80211_rx_h_defragment()
2327 				     sizeof(rx->key->u.gcmp.rx_pn[queue]));  in ieee80211_rx_h_defragment()
2330 		} else if (rx->key &&  in ieee80211_rx_h_defragment()
2332 			    (status->flag & RX_FLAG_DECRYPTED))) {  in ieee80211_rx_h_defragment()
2333 			entry->is_protected = true;  in ieee80211_rx_h_defragment()
2334 			entry->key_color = rx->key->color;  in ieee80211_rx_h_defragment()
2343 					  rx->seqno_idx, hdr);  in ieee80211_rx_h_defragment()
2345 		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);  in ieee80211_rx_h_defragment()
2351 	 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)  in ieee80211_rx_h_defragment()
2352 	 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)  in ieee80211_rx_h_defragment()
2354 	if (entry->check_sequential_pn) {  in ieee80211_rx_h_defragment()
2358 		if (!requires_sequential_pn(rx, fc))  in ieee80211_rx_h_defragment()
2362 		if (entry->key_color != rx->key->color)  in ieee80211_rx_h_defragment()
2365 		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);  in ieee80211_rx_h_defragment()
2366 		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {  in ieee80211_rx_h_defragment()
2372 		rpn = rx->ccm_gcm.pn;  in ieee80211_rx_h_defragment()
2375 		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);  in ieee80211_rx_h_defragment()
2376 	} else if (entry->is_protected &&  in ieee80211_rx_h_defragment()
2377 		   (!rx->key ||  in ieee80211_rx_h_defragment()
2379 		     !(status->flag & RX_FLAG_DECRYPTED)) ||  in ieee80211_rx_h_defragment()
2380 		    rx->key->color != entry->key_color)) {  in ieee80211_rx_h_defragment()
2386 	} else if (entry->is_protected && rx->key &&  in ieee80211_rx_h_defragment()
2387 		   entry->key_color != rx->key->color &&  in ieee80211_rx_h_defragment()
2388 		   (status->flag & RX_FLAG_DECRYPTED)) {  in ieee80211_rx_h_defragment()
2392 	skb_pull(rx->skb, ieee80211_hdrlen(fc));  in ieee80211_rx_h_defragment()
2393 	__skb_queue_tail(&entry->skb_list, rx->skb);  in ieee80211_rx_h_defragment()
2394 	entry->last_frag = frag;  in ieee80211_rx_h_defragment()
2395 	entry->extra_len += rx->skb->len;  in ieee80211_rx_h_defragment()
2397 		rx->skb = NULL;  in ieee80211_rx_h_defragment()
2401 	rx->skb = __skb_dequeue(&entry->skb_list);  in ieee80211_rx_h_defragment()
2402 	if (skb_tailroom(rx->skb) < entry->extra_len) {  in ieee80211_rx_h_defragment()
2403 		I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);  in ieee80211_rx_h_defragment()
2404 		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,  in ieee80211_rx_h_defragment()
2406 			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);  in ieee80211_rx_h_defragment()
2407 			__skb_queue_purge(&entry->skb_list);  in ieee80211_rx_h_defragment()
2411 	while ((skb = __skb_dequeue(&entry->skb_list))) {  in ieee80211_rx_h_defragment()
2412 		skb_put_data(rx->skb, skb->data, skb->len);  in ieee80211_rx_h_defragment()
2417 	ieee80211_led_rx(rx->local);  in ieee80211_rx_h_defragment()
2418 	if (rx->sta)  in ieee80211_rx_h_defragment()
2419 		rx->link_sta->rx_stats.packets++;  in ieee80211_rx_h_defragment()
2423 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)  in ieee80211_802_1x_port_control()  argument
2425 	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))  in ieee80211_802_1x_port_control()
2426 		return -EACCES;  in ieee80211_802_1x_port_control()
2431 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)  in ieee80211_drop_unencrypted()  argument
2433 	struct sk_buff *skb = rx->skb;  in ieee80211_drop_unencrypted()
2434 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_drop_unencrypted()  local
2440 	if (status->flag & RX_FLAG_DECRYPTED)  in ieee80211_drop_unencrypted()
2446 		     ieee80211_is_data(fc) && rx->key))  in ieee80211_drop_unencrypted()
2447 		return -EACCES;  in ieee80211_drop_unencrypted()
2453 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)  in ieee80211_drop_unencrypted_mgmt()  argument
2455 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_drop_unencrypted_mgmt()  local
2456 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;  in ieee80211_drop_unencrypted_mgmt()
2457 	__le16 fc = mgmt->frame_control;  in ieee80211_drop_unencrypted_mgmt()
2463 	if (status->flag & RX_FLAG_DECRYPTED)  in ieee80211_drop_unencrypted_mgmt()
2468 	    mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)  in ieee80211_drop_unencrypted_mgmt()
2471 	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {  in ieee80211_drop_unencrypted_mgmt()
2473 			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {  in ieee80211_drop_unencrypted_mgmt()
2478 				 * during 4-way-HS (key is installed after HS).  in ieee80211_drop_unencrypted_mgmt()
2480 				if (!rx->key)  in ieee80211_drop_unencrypted_mgmt()
2483 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,  in ieee80211_drop_unencrypted_mgmt()
2484 							     rx->skb->data,  in ieee80211_drop_unencrypted_mgmt()
2485 							     rx->skb->len);  in ieee80211_drop_unencrypted_mgmt()
2490 		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&  in ieee80211_drop_unencrypted_mgmt()
2491 			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {  in ieee80211_drop_unencrypted_mgmt()
2494 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,  in ieee80211_drop_unencrypted_mgmt()
2495 							     rx->skb->data,  in ieee80211_drop_unencrypted_mgmt()
2496 							     rx->skb->len);  in ieee80211_drop_unencrypted_mgmt()
2499 		if (unlikely(ieee80211_is_beacon(fc) && rx->key &&  in ieee80211_drop_unencrypted_mgmt()
2500 			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {  in ieee80211_drop_unencrypted_mgmt()
2501 			cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,  in ieee80211_drop_unencrypted_mgmt()
2502 						     rx->skb->data,  in ieee80211_drop_unencrypted_mgmt()
2503 						     rx->skb->len);  in ieee80211_drop_unencrypted_mgmt()
2510 		if (unlikely(ieee80211_is_action(fc) && !rx->key &&  in ieee80211_drop_unencrypted_mgmt()
2511 			     ieee80211_is_robust_mgmt_frame(rx->skb)))  in ieee80211_drop_unencrypted_mgmt()
2515 		if (is_unicast_ether_addr(mgmt->da) &&  in ieee80211_drop_unencrypted_mgmt()
2516 		    ieee80211_is_protected_dual_of_public_action(rx->skb))  in ieee80211_drop_unencrypted_mgmt()
2525 	    ieee80211_is_robust_mgmt_frame(rx->skb) &&  in ieee80211_drop_unencrypted_mgmt()
2526 	    (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))  in ieee80211_drop_unencrypted_mgmt()
2534 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)  in __ieee80211_data_to_8023()  argument
2536 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in __ieee80211_data_to_8023()
2537 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;  in __ieee80211_data_to_8023()
2543 	if (ieee80211_has_a4(hdr->frame_control) &&  in __ieee80211_data_to_8023()
2544 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)  in __ieee80211_data_to_8023()
2547 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&  in __ieee80211_data_to_8023()
2548 	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {  in __ieee80211_data_to_8023()
2549 		if (!sdata->u.mgd.use_4addr)  in __ieee80211_data_to_8023()
2551 		else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))  in __ieee80211_data_to_8023()
2555 	if (is_multicast_ether_addr(hdr->addr1) &&  in __ieee80211_data_to_8023()
2556 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)  in __ieee80211_data_to_8023()
2559 	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);  in __ieee80211_data_to_8023()
2563 	ehdr = (struct ethhdr *) rx->skb->data;  in __ieee80211_data_to_8023()
2564 	if (ehdr->h_proto == rx->sdata->control_port_protocol)  in __ieee80211_data_to_8023()
2577 	/* non-MLO, or MLD address replaced by hardware */  in ieee80211_is_our_addr()
2578 	if (ether_addr_equal(sdata->vif.addr, addr))  in ieee80211_is_our_addr()
2581 	if (!ieee80211_vif_is_mld(&sdata->vif))  in ieee80211_is_our_addr()
2584 	for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {  in ieee80211_is_our_addr()
2587 		conf = rcu_dereference(sdata->vif.link_conf[link_id]);  in ieee80211_is_our_addr()
2591 		if (ether_addr_equal(conf->addr, addr)) {  in ieee80211_is_our_addr()
2602  * requires that rx->skb is a frame with ethernet header
2604 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)  in ieee80211_frame_allowed()  argument
2608 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;  in ieee80211_frame_allowed()
2615 	if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))  in ieee80211_frame_allowed()
2616 		return ieee80211_is_our_addr(rx->sdata, ehdr->h_dest, NULL) ||  in ieee80211_frame_allowed()
2617 		       ether_addr_equal(ehdr->h_dest, pae_group_addr);  in ieee80211_frame_allowed()
2619 	if (ieee80211_802_1x_port_control(rx) ||  in ieee80211_frame_allowed()
2620 	    ieee80211_drop_unencrypted(rx, fc))  in ieee80211_frame_allowed()
2627 						 struct ieee80211_rx_data *rx)  in ieee80211_deliver_skb_to_local_stack()  argument
2629 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_deliver_skb_to_local_stack()
2630 	struct net_device *dev = sdata->dev;  in ieee80211_deliver_skb_to_local_stack()
2632 	if (unlikely((skb->protocol == sdata->control_port_protocol ||  in ieee80211_deliver_skb_to_local_stack()
2633 		     (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&  in ieee80211_deliver_skb_to_local_stack()
2634 		      !sdata->control_port_no_preauth)) &&  in ieee80211_deliver_skb_to_local_stack()
2635 		     sdata->control_port_over_nl80211)) {  in ieee80211_deliver_skb_to_local_stack()
2636 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_deliver_skb_to_local_stack()  local
2637 		bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);  in ieee80211_deliver_skb_to_local_stack()
2639 		cfg80211_rx_control_port(dev, skb, noencrypt, rx->link_id);  in ieee80211_deliver_skb_to_local_stack()
2644 		memset(skb->cb, 0, sizeof(skb->cb));  in ieee80211_deliver_skb_to_local_stack()
2661 		if (unlikely(skb->protocol == sdata->control_port_protocol &&  in ieee80211_deliver_skb_to_local_stack()
2662 			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))  in ieee80211_deliver_skb_to_local_stack()
2663 			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);  in ieee80211_deliver_skb_to_local_stack()
2666 		if (rx->list)  in ieee80211_deliver_skb_to_local_stack()
2667 			list_add_tail(&skb->list, rx->list);  in ieee80211_deliver_skb_to_local_stack()
2674  * requires that rx->skb is a frame with ethernet header
2677 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)  in ieee80211_deliver_skb()  argument
2679 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_deliver_skb()
2680 	struct net_device *dev = sdata->dev;  in ieee80211_deliver_skb()
2682 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;  in ieee80211_deliver_skb()
2685 	skb = rx->skb;  in ieee80211_deliver_skb()
2688 	dev_sw_netstats_rx_add(dev, skb->len);  in ieee80211_deliver_skb()
2690 	if (rx->sta) {  in ieee80211_deliver_skb()
2693 		 * for non-QoS-data frames. Here we know it's a data  in ieee80211_deliver_skb()
2696 		u64_stats_update_begin(&rx->link_sta->rx_stats.syncp);  in ieee80211_deliver_skb()
2697 		rx->link_sta->rx_stats.msdu[rx->seqno_idx]++;  in ieee80211_deliver_skb()
2698 		u64_stats_update_end(&rx->link_sta->rx_stats.syncp);  in ieee80211_deliver_skb()
2701 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||  in ieee80211_deliver_skb()
2702 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&  in ieee80211_deliver_skb()
2703 	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&  in ieee80211_deliver_skb()
2704 	    ehdr->h_proto != rx->sdata->control_port_protocol &&  in ieee80211_deliver_skb()
2705 	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {  in ieee80211_deliver_skb()
2706 		if (is_multicast_ether_addr(ehdr->h_dest) &&  in ieee80211_deliver_skb()
2715 						    dev->name);  in ieee80211_deliver_skb()
2716 		} else if (!is_multicast_ether_addr(ehdr->h_dest) &&  in ieee80211_deliver_skb()
2717 			   !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {  in ieee80211_deliver_skb()
2718 			dsta = sta_info_get(sdata, ehdr->h_dest);  in ieee80211_deliver_skb()
2735 		 * frames are required to be aligned to 2-byte boundaries  in ieee80211_deliver_skb()
2738 		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)  in ieee80211_deliver_skb()
2742 		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;  in ieee80211_deliver_skb()
2748 				u8 *data = skb->data;  in ieee80211_deliver_skb()
2749 				size_t len = skb_headlen(skb);  in ieee80211_deliver_skb()  local
2750 				skb->data -= align;  in ieee80211_deliver_skb()
2751 				memmove(skb->data, data, len);  in ieee80211_deliver_skb()
2752 				skb_set_tail_pointer(skb, len);  in ieee80211_deliver_skb()
2759 		skb->protocol = eth_type_trans(skb, dev);  in ieee80211_deliver_skb()
2760 		ieee80211_deliver_skb_to_local_stack(skb, rx);  in ieee80211_deliver_skb()
2769 		xmit_skb->priority += 256;  in ieee80211_deliver_skb()
2770 		xmit_skb->protocol = htons(ETH_P_802_3);  in ieee80211_deliver_skb()
2782 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;  in ieee80211_rx_mesh_fast_forward()
2793 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));  in ieee80211_rx_mesh_fast_forward()
2794 	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)  in ieee80211_rx_mesh_fast_forward()
2795 		ether_addr_copy(key.addr, mesh_hdr->eaddr1);  in ieee80211_rx_mesh_fast_forward()
2796 	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))  in ieee80211_rx_mesh_fast_forward()
2797 		ether_addr_copy(key.addr, skb->data);  in ieee80211_rx_mesh_fast_forward()
2805 	sta = rcu_dereference(entry->mpath->next_hop);  in ieee80211_rx_mesh_fast_forward()
2812 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;  in ieee80211_rx_mesh_fast_forward()
2813 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);  in ieee80211_rx_mesh_fast_forward()
2815 		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))  in ieee80211_rx_mesh_fast_forward()
2818 		if (tid_tx->timeout)  in ieee80211_rx_mesh_fast_forward()
2819 			tid_tx->last_tx = jiffies;  in ieee80211_rx_mesh_fast_forward()
2824 	if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,  in ieee80211_rx_mesh_fast_forward()
2825 					    &skb->protocol))  in ieee80211_rx_mesh_fast_forward()
2828 		skb->protocol = htons(skb->len - hdrlen);  in ieee80211_rx_mesh_fast_forward()
2831 	skb->dev = sdata->dev;  in ieee80211_rx_mesh_fast_forward()
2832 	memcpy(&eth, skb->data, ETH_HLEN - 2);  in ieee80211_rx_mesh_fast_forward()
2834 	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,  in ieee80211_rx_mesh_fast_forward()
2848 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;  in ieee80211_rx_mesh_data()
2849 	struct ieee80211_local *local = sdata->local;  in ieee80211_rx_mesh_data()
2864 	if (!ieee80211_vif_is_mesh(&sdata->vif))  in ieee80211_rx_mesh_data()
2870 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));  in ieee80211_rx_mesh_data()
2876 	eth = (struct ethhdr *)skb->data;  in ieee80211_rx_mesh_data()
2877 	multicast = is_multicast_ether_addr(eth->h_dest);  in ieee80211_rx_mesh_data()
2880 	if (!mesh_hdr->ttl)  in ieee80211_rx_mesh_data()
2884 	if (is_multicast_ether_addr(eth->h_dest) &&  in ieee80211_rx_mesh_data()
2885 	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))  in ieee80211_rx_mesh_data()
2889 	if (sdata->crypto_tx_tailroom_needed_cnt)  in ieee80211_rx_mesh_data()
2892 	if (mesh_hdr->flags & MESH_FLAGS_AE) {  in ieee80211_rx_mesh_data()
2898 			proxied_addr = mesh_hdr->eaddr1;  in ieee80211_rx_mesh_data()
2899 		else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)  in ieee80211_rx_mesh_data()
2901 			proxied_addr = mesh_hdr->eaddr2;  in ieee80211_rx_mesh_data()
2908 			mpp_path_add(sdata, proxied_addr, eth->h_source);  in ieee80211_rx_mesh_data()
2910 			spin_lock_bh(&mppath->state_lock);  in ieee80211_rx_mesh_data()
2911 			if (!ether_addr_equal(mppath->mpp, eth->h_source)) {  in ieee80211_rx_mesh_data()
2912 				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);  in ieee80211_rx_mesh_data()
2915 			mppath->exp_time = jiffies;  in ieee80211_rx_mesh_data()
2916 			spin_unlock_bh(&mppath->state_lock);  in ieee80211_rx_mesh_data()
2927 	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))  in ieee80211_rx_mesh_data()
2930 	if (!--mesh_hdr->ttl) {  in ieee80211_rx_mesh_data()
2938 	if (!ifmsh->mshcfg.dot11MeshForwarding) {  in ieee80211_rx_mesh_data()
2939 		if (is_multicast_ether_addr(eth->h_dest))  in ieee80211_rx_mesh_data()
2945 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);  in ieee80211_rx_mesh_data()
2952 				      eth->h_dest, eth->h_source);  in ieee80211_rx_mesh_data()
2955 		int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);  in ieee80211_rx_mesh_data()
2957 		fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +  in ieee80211_rx_mesh_data()
2966 		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))  in ieee80211_rx_mesh_data()
2973 	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));  in ieee80211_rx_mesh_data()
2974 	memcpy(fwd_hdr, &hdr, hdrlen - 2);  in ieee80211_rx_mesh_data()
2980 	if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,  in ieee80211_rx_mesh_data()
2981 					    &fwd_skb->protocol))  in ieee80211_rx_mesh_data()
2984 		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);  in ieee80211_rx_mesh_data()
2989 	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;  in ieee80211_rx_mesh_data()
2990 	info->control.vif = &sdata->vif;  in ieee80211_rx_mesh_data()
2991 	info->control.jiffies = jiffies;  in ieee80211_rx_mesh_data()
2992 	fwd_skb->dev = sdata->dev;  in ieee80211_rx_mesh_data()
2995 		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);  in ieee80211_rx_mesh_data()
3004 			mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,  in ieee80211_rx_mesh_data()
3007 					   sta->sta.addr);  in ieee80211_rx_mesh_data()
3028 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)  in __ieee80211_rx_h_amsdu()  argument
3030 	struct net_device *dev = rx->sdata->dev;  in __ieee80211_rx_h_amsdu()
3031 	struct sk_buff *skb = rx->skb;  in __ieee80211_rx_h_amsdu()
3032 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;  in __ieee80211_rx_h_amsdu()
3033 	__le16 fc = hdr->frame_control;  in __ieee80211_rx_h_amsdu()
3038 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {  in __ieee80211_rx_h_amsdu()
3041 	} else switch (rx->sdata->vif.type) {  in __ieee80211_rx_h_amsdu()
3047 			if (!test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))  in __ieee80211_rx_h_amsdu()
3058 	skb->dev = dev;  in __ieee80211_rx_h_amsdu()
3062 					  rx->sdata->vif.addr,  in __ieee80211_rx_h_amsdu()
3063 					  rx->sdata->vif.type,  in __ieee80211_rx_h_amsdu()
3067 	if (rx->sta->amsdu_mesh_control < 0) {  in __ieee80211_rx_h_amsdu()
3068 		s8 valid = -1;  in __ieee80211_rx_h_amsdu()
3077 				valid = -1;  in __ieee80211_rx_h_amsdu()
3084 		rx->sta->amsdu_mesh_control = valid;  in __ieee80211_rx_h_amsdu()
3087 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,  in __ieee80211_rx_h_amsdu()
3088 				 rx->sdata->vif.type,  in __ieee80211_rx_h_amsdu()
3089 				 rx->local->hw.extra_tx_headroom,  in __ieee80211_rx_h_amsdu()
3091 				 rx->sta->amsdu_mesh_control);  in __ieee80211_rx_h_amsdu()
3094 		rx->skb = __skb_dequeue(&frame_list);  in __ieee80211_rx_h_amsdu()
3096 		switch (ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb)) {  in __ieee80211_rx_h_amsdu()
3100 			if (ieee80211_frame_allowed(rx, fc)) {  in __ieee80211_rx_h_amsdu()
3101 				ieee80211_deliver_skb(rx);  in __ieee80211_rx_h_amsdu()
3106 			dev_kfree_skb(rx->skb);  in __ieee80211_rx_h_amsdu()
3114 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_amsdu()  argument
3116 	struct sk_buff *skb = rx->skb;  in ieee80211_rx_h_amsdu()
3117 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_rx_h_amsdu()  local
3118 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;  in ieee80211_rx_h_amsdu()
3119 	__le16 fc = hdr->frame_control;  in ieee80211_rx_h_amsdu()
3121 	if (!(status->rx_flags & IEEE80211_RX_AMSDU))  in ieee80211_rx_h_amsdu()
3130 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {  in ieee80211_rx_h_amsdu()
3131 		switch (rx->sdata->vif.type) {  in ieee80211_rx_h_amsdu()
3133 			if (!rx->sdata->u.vlan.sta)  in ieee80211_rx_h_amsdu()
3137 			if (!rx->sdata->u.mgd.use_4addr)  in ieee80211_rx_h_amsdu()
3147 	if (is_multicast_ether_addr(hdr->addr1) || !rx->sta)  in ieee80211_rx_h_amsdu()
3150 	if (rx->key) {  in ieee80211_rx_h_amsdu()
3152 		 * We should not receive A-MSDUs on pre-HT connections,  in ieee80211_rx_h_amsdu()
3155 		 * A-MSDUs or such.  in ieee80211_rx_h_amsdu()
3157 		switch (rx->key->conf.cipher) {  in ieee80211_rx_h_amsdu()
3167 	return __ieee80211_rx_h_amsdu(rx, 0);  in ieee80211_rx_h_amsdu()
3171 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_data()  argument
3173 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_data()
3174 	struct ieee80211_local *local = rx->local;  in ieee80211_rx_h_data()
3175 	struct net_device *dev = sdata->dev;  in ieee80211_rx_h_data()
3176 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_rx_h_data()
3177 	__le16 fc = hdr->frame_control;  in ieee80211_rx_h_data()
3181 	if (unlikely(!ieee80211_is_data(hdr->frame_control)))  in ieee80211_rx_h_data()
3184 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))  in ieee80211_rx_h_data()
3187 	/* Send unexpected-4addr-frame event to hostapd */  in ieee80211_rx_h_data()
3188 	if (ieee80211_has_a4(hdr->frame_control) &&  in ieee80211_rx_h_data()
3189 	    sdata->vif.type == NL80211_IFTYPE_AP) {  in ieee80211_rx_h_data()
3190 		if (rx->sta &&  in ieee80211_rx_h_data()
3191 		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))  in ieee80211_rx_h_data()
3193 				rx->sdata->dev, rx->sta->sta.addr, rx->link_id,  in ieee80211_rx_h_data()
3198 	res = __ieee80211_data_to_8023(rx, &port_control);  in ieee80211_rx_h_data()
3202 	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);  in ieee80211_rx_h_data()
3206 	if (!ieee80211_frame_allowed(rx, fc))  in ieee80211_rx_h_data()
3210 	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==  in ieee80211_rx_h_data()
3212 		struct ieee80211_tdls_data *tf = (void *)rx->skb->data;  in ieee80211_rx_h_data()
3214 		if (pskb_may_pull(rx->skb,  in ieee80211_rx_h_data()
3216 		    tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&  in ieee80211_rx_h_data()
3217 		    tf->category == WLAN_CATEGORY_TDLS &&  in ieee80211_rx_h_data()
3218 		    (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||  in ieee80211_rx_h_data()
3219 		     tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {  in ieee80211_rx_h_data()
3220 			rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);  in ieee80211_rx_h_data()
3221 			__ieee80211_queue_skb_to_iface(sdata, rx->link_id,  in ieee80211_rx_h_data()
3222 						       rx->sta, rx->skb);  in ieee80211_rx_h_data()
3227 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&  in ieee80211_rx_h_data()
3228 	    unlikely(port_control) && sdata->bss) {  in ieee80211_rx_h_data()
3229 		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,  in ieee80211_rx_h_data()
3231 		dev = sdata->dev;  in ieee80211_rx_h_data()
3232 		rx->sdata = sdata;  in ieee80211_rx_h_data()
3235 	rx->skb->dev = dev;  in ieee80211_rx_h_data()
3237 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&  in ieee80211_rx_h_data()
3238 	    local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&  in ieee80211_rx_h_data()
3240 		    ((struct ethhdr *)rx->skb->data)->h_dest) &&  in ieee80211_rx_h_data()
3241 	    (!local->scanning &&  in ieee80211_rx_h_data()
3242 	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))  in ieee80211_rx_h_data()
3243 		mod_timer(&local->dynamic_ps_timer, jiffies +  in ieee80211_rx_h_data()
3244 			  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));  in ieee80211_rx_h_data()
3246 	ieee80211_deliver_skb(rx);  in ieee80211_rx_h_data()
3252 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)  in ieee80211_rx_h_ctrl()  argument
3254 	struct sk_buff *skb = rx->skb;  in ieee80211_rx_h_ctrl()
3255 	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;  in ieee80211_rx_h_ctrl()
3260 	if (likely(!ieee80211_is_ctl(bar->frame_control)))  in ieee80211_rx_h_ctrl()
3263 	if (ieee80211_is_back_req(bar->frame_control)) {  in ieee80211_rx_h_ctrl()
3271 		if (!rx->sta)  in ieee80211_rx_h_ctrl()
3280 		if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&  in ieee80211_rx_h_ctrl()
3281 		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))  in ieee80211_rx_h_ctrl()
3282 			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,  in ieee80211_rx_h_ctrl()
3286 		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);  in ieee80211_rx_h_ctrl()
3293 		event.u.ba.sta = &rx->sta->sta;  in ieee80211_rx_h_ctrl()
3296 		if (tid_agg_rx->timeout)  in ieee80211_rx_h_ctrl()
3297 			mod_timer(&tid_agg_rx->session_timer,  in ieee80211_rx_h_ctrl()
3298 				  TU_TO_EXP_TIME(tid_agg_rx->timeout));  in ieee80211_rx_h_ctrl()
3300 		spin_lock(&tid_agg_rx->reorder_lock);  in ieee80211_rx_h_ctrl()
3302 		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,  in ieee80211_rx_h_ctrl()
3304 		spin_unlock(&tid_agg_rx->reorder_lock);  in ieee80211_rx_h_ctrl()
3306 		drv_event_callback(rx->local, rx->sdata, &event);  in ieee80211_rx_h_ctrl()
3317 					   size_t len)  in ieee80211_process_sa_query_req()  argument
3319 	struct ieee80211_local *local = sdata->local;  in ieee80211_process_sa_query_req()
3323 	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {  in ieee80211_process_sa_query_req()
3328 	if (!ether_addr_equal(mgmt->sa, sdata->vif.cfg.ap_addr) ||  in ieee80211_process_sa_query_req()
3329 	    !ether_addr_equal(mgmt->bssid, sdata->vif.cfg.ap_addr)) {  in ieee80211_process_sa_query_req()
3334 	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {  in ieee80211_process_sa_query_req()
3339 	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);  in ieee80211_process_sa_query_req()
3343 	skb_reserve(skb, local->hw.extra_tx_headroom);  in ieee80211_process_sa_query_req()
3345 	memcpy(resp->da, sdata->vif.cfg.ap_addr, ETH_ALEN);  in ieee80211_process_sa_query_req()
3346 	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);  in ieee80211_process_sa_query_req()
3347 	memcpy(resp->bssid, sdata->vif.cfg.ap_addr, ETH_ALEN);  in ieee80211_process_sa_query_req()
3348 	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |  in ieee80211_process_sa_query_req()
3350 	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));  in ieee80211_process_sa_query_req()
3351 	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;  in ieee80211_process_sa_query_req()
3352 	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;  in ieee80211_process_sa_query_req()
3353 	memcpy(resp->u.action.u.sa_query.trans_id,  in ieee80211_process_sa_query_req()
3354 	       mgmt->u.action.u.sa_query.trans_id,  in ieee80211_process_sa_query_req()
3361 ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)  in ieee80211_rx_check_bss_color_collision()  argument
3363 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;  in ieee80211_rx_check_bss_color_collision()
3368 	if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,  in ieee80211_rx_check_bss_color_collision()
3372 	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))  in ieee80211_rx_check_bss_color_collision()
3375 	bss_conf = rx->link->conf;  in ieee80211_rx_check_bss_color_collision()
3376 	if (bss_conf->csa_active || bss_conf->color_change_active ||  in ieee80211_rx_check_bss_color_collision()
3377 	    !bss_conf->he_bss_color.enabled)  in ieee80211_rx_check_bss_color_collision()
3380 	baselen = mgmt->u.beacon.variable - rx->skb->data;  in ieee80211_rx_check_bss_color_collision()
3381 	if (baselen > rx->skb->len)  in ieee80211_rx_check_bss_color_collision()
3385 				    mgmt->u.beacon.variable,  in ieee80211_rx_check_bss_color_collision()
3386 				    rx->skb->len - baselen);  in ieee80211_rx_check_bss_color_collision()
3387 	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&  in ieee80211_rx_check_bss_color_collision()
3388 	    ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {  in ieee80211_rx_check_bss_color_collision()
3392 		he_oper = (void *)(ie->data + 1);  in ieee80211_rx_check_bss_color_collision()
3393 		if (le32_get_bits(he_oper->he_oper_params,  in ieee80211_rx_check_bss_color_collision()
3397 		color = le32_get_bits(he_oper->he_oper_params,  in ieee80211_rx_check_bss_color_collision()
3399 		if (color == bss_conf->he_bss_color.color)  in ieee80211_rx_check_bss_color_collision()
3400 			ieee80211_obss_color_collision_notify(&rx->sdata->vif,  in ieee80211_rx_check_bss_color_collision()
3402 							      bss_conf->link_id);  in ieee80211_rx_check_bss_color_collision()
3407 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_mgmt_check()  argument
3409 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;  in ieee80211_rx_h_mgmt_check()
3410 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_mgmt_check()  local
3412 	if (ieee80211_is_s1g_beacon(mgmt->frame_control))  in ieee80211_rx_h_mgmt_check()
3420 	if (rx->skb->len < 24)  in ieee80211_rx_h_mgmt_check()
3423 	if (!ieee80211_is_mgmt(mgmt->frame_control))  in ieee80211_rx_h_mgmt_check()
3427 	if (ieee80211_is_action(mgmt->frame_control) &&  in ieee80211_rx_h_mgmt_check()
3428 	    rx->skb->len < IEEE80211_MIN_ACTION_SIZE)  in ieee80211_rx_h_mgmt_check()
3431 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&  in ieee80211_rx_h_mgmt_check()
3432 	    ieee80211_is_beacon(mgmt->frame_control) &&  in ieee80211_rx_h_mgmt_check()
3433 	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {  in ieee80211_rx_h_mgmt_check()
3437 		ieee80211_rx_check_bss_color_collision(rx);  in ieee80211_rx_h_mgmt_check()
3439 		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&  in ieee80211_rx_h_mgmt_check()
3440 		    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))  in ieee80211_rx_h_mgmt_check()
3441 			sig = status->signal;  in ieee80211_rx_h_mgmt_check()
3443 		cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,  in ieee80211_rx_h_mgmt_check()
3444 						rx->skb->data, rx->skb->len,  in ieee80211_rx_h_mgmt_check()
3445 						ieee80211_rx_status_to_khz(status),  in ieee80211_rx_h_mgmt_check()
3447 		rx->flags |= IEEE80211_RX_BEACON_REPORTED;  in ieee80211_rx_h_mgmt_check()
3450 	return ieee80211_drop_unencrypted_mgmt(rx);  in ieee80211_rx_h_mgmt_check()
3454 ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)  in ieee80211_process_rx_twt_action()  argument
3456 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;  in ieee80211_process_rx_twt_action()
3457 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_process_rx_twt_action()
3460 	if (sdata->vif.type != NL80211_IFTYPE_AP)  in ieee80211_process_rx_twt_action()
3463 	if (!rx->local->ops->add_twt_setup)  in ieee80211_process_rx_twt_action()
3466 	if (!sdata->vif.bss_conf.twt_responder)  in ieee80211_process_rx_twt_action()
3469 	if (!rx->sta)  in ieee80211_process_rx_twt_action()
3472 	switch (mgmt->u.action.u.s1g.action_code) {  in ieee80211_process_rx_twt_action()
3476 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +  in ieee80211_process_rx_twt_action()
3482 		twt = (void *)mgmt->u.action.u.s1g.variable;  in ieee80211_process_rx_twt_action()
3483 		if (twt->element_id != WLAN_EID_S1G_TWT)  in ieee80211_process_rx_twt_action()
3486 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +  in ieee80211_process_rx_twt_action()
3488 				   twt->length)  in ieee80211_process_rx_twt_action()
3494 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)  in ieee80211_process_rx_twt_action()
3506 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_action()  argument
3508 	struct ieee80211_local *local = rx->local;  in ieee80211_rx_h_action()
3509 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_action()
3510 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;  in ieee80211_rx_h_action()
3511 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_action()  local
3512 	int len = rx->skb->len;  in ieee80211_rx_h_action()  local
3514 	if (!ieee80211_is_action(mgmt->frame_control))  in ieee80211_rx_h_action()
3517 	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&  in ieee80211_rx_h_action()
3518 	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&  in ieee80211_rx_h_action()
3519 	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)  in ieee80211_rx_h_action()
3522 	switch (mgmt->u.action.category) {  in ieee80211_rx_h_action()
3525 		if (!rx->link_sta->pub->ht_cap.ht_supported)  in ieee80211_rx_h_action()
3528 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&  in ieee80211_rx_h_action()
3529 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&  in ieee80211_rx_h_action()
3530 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&  in ieee80211_rx_h_action()
3531 		    sdata->vif.type != NL80211_IFTYPE_AP &&  in ieee80211_rx_h_action()
3532 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)  in ieee80211_rx_h_action()
3536 		if (len < IEEE80211_MIN_ACTION_SIZE + 2)  in ieee80211_rx_h_action()
3539 		switch (mgmt->u.action.u.ht_smps.action) {  in ieee80211_rx_h_action()
3545 			if (sdata->vif.type != NL80211_IFTYPE_AP &&  in ieee80211_rx_h_action()
3546 			    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)  in ieee80211_rx_h_action()
3550 			switch (mgmt->u.action.u.ht_smps.smps_control) {  in ieee80211_rx_h_action()
3565 			if (rx->link_sta->pub->smps_mode == smps_mode)  in ieee80211_rx_h_action()
3567 			rx->link_sta->pub->smps_mode = smps_mode;  in ieee80211_rx_h_action()
3572 			sband = rx->local->hw.wiphy->bands[status->band];  in ieee80211_rx_h_action()
3574 			rate_control_rate_update(local, sband, rx->link_sta,  in ieee80211_rx_h_action()
3576 			cfg80211_sta_opmode_change_notify(sdata->dev,  in ieee80211_rx_h_action()
3577 							  rx->sta->addr,  in ieee80211_rx_h_action()
3583 			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;  in ieee80211_rx_h_action()
3590 			if (!(rx->link_sta->pub->ht_cap.cap &  in ieee80211_rx_h_action()
3603 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)  in ieee80211_rx_h_action()
3605 		if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3607 		if (!rx->sta)  in ieee80211_rx_h_action()
3609 		if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))  in ieee80211_rx_h_action()
3611 		if (mgmt->u.action.u.ext_chan_switch.action_code !=  in ieee80211_rx_h_action()
3614 		if (len < offsetof(struct ieee80211_mgmt,  in ieee80211_rx_h_action()
3619 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&  in ieee80211_rx_h_action()
3620 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&  in ieee80211_rx_h_action()
3621 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&  in ieee80211_rx_h_action()
3622 		    sdata->vif.type != NL80211_IFTYPE_AP &&  in ieee80211_rx_h_action()
3623 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)  in ieee80211_rx_h_action()
3627 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)  in ieee80211_rx_h_action()
3630 		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {  in ieee80211_rx_h_action()
3633 			if (len < IEEE80211_MIN_ACTION_SIZE + 2)  in ieee80211_rx_h_action()
3638 			if (len < IEEE80211_MIN_ACTION_SIZE + 25)  in ieee80211_rx_h_action()
3647 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&  in ieee80211_rx_h_action()
3648 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&  in ieee80211_rx_h_action()
3649 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&  in ieee80211_rx_h_action()
3650 		    sdata->vif.type != NL80211_IFTYPE_AP &&  in ieee80211_rx_h_action()
3651 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)  in ieee80211_rx_h_action()
3655 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)  in ieee80211_rx_h_action()
3658 		switch (mgmt->u.action.u.addba_req.action_code) {  in ieee80211_rx_h_action()
3660 			if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3661 				   sizeof(mgmt->u.action.u.addba_req)))  in ieee80211_rx_h_action()
3665 			if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3666 				   sizeof(mgmt->u.action.u.addba_resp)))  in ieee80211_rx_h_action()
3670 			if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3671 				   sizeof(mgmt->u.action.u.delba)))  in ieee80211_rx_h_action()
3681 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)  in ieee80211_rx_h_action()
3684 		switch (mgmt->u.action.u.measurement.action_code) {  in ieee80211_rx_h_action()
3686 			if (status->band != NL80211_BAND_5GHZ)  in ieee80211_rx_h_action()
3689 			if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3690 				   sizeof(mgmt->u.action.u.measurement)))  in ieee80211_rx_h_action()
3693 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3696 			ieee80211_process_measurement_req(sdata, mgmt, len);  in ieee80211_rx_h_action()
3700 			if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3701 				   sizeof(mgmt->u.action.u.chan_switch)))  in ieee80211_rx_h_action()
3704 			if (sdata->vif.type != NL80211_IFTYPE_STATION &&  in ieee80211_rx_h_action()
3705 			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&  in ieee80211_rx_h_action()
3706 			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)  in ieee80211_rx_h_action()
3709 			if (sdata->vif.type == NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3710 				bssid = sdata->deflink.u.mgd.bssid;  in ieee80211_rx_h_action()
3711 			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)  in ieee80211_rx_h_action()
3712 				bssid = sdata->u.ibss.bssid;  in ieee80211_rx_h_action()
3713 			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)  in ieee80211_rx_h_action()
3714 				bssid = mgmt->sa;  in ieee80211_rx_h_action()
3718 			if (!ether_addr_equal(mgmt->bssid, bssid))  in ieee80211_rx_h_action()
3726 		if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3727 			   sizeof(mgmt->u.action.u.self_prot.action_code)))  in ieee80211_rx_h_action()
3730 		switch (mgmt->u.action.u.self_prot.action_code) {  in ieee80211_rx_h_action()
3734 			if (!ieee80211_vif_is_mesh(&sdata->vif))  in ieee80211_rx_h_action()
3736 			if (sdata->u.mesh.user_mpm)  in ieee80211_rx_h_action()
3742 			if (!ieee80211_vif_is_mesh(&sdata->vif))  in ieee80211_rx_h_action()
3748 		if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action()
3749 			   sizeof(mgmt->u.action.u.mesh_action.action_code)))  in ieee80211_rx_h_action()
3752 		if (!ieee80211_vif_is_mesh(&sdata->vif))  in ieee80211_rx_h_action()
3759 		if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3763 		switch (mgmt->u.action.u.s1g.action_code) {  in ieee80211_rx_h_action()
3766 			if (ieee80211_process_rx_twt_action(rx))  in ieee80211_rx_h_action()
3774 		if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3778 		switch (mgmt->u.action.u.ttlm_req.action_code) {  in ieee80211_rx_h_action()
3780 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3783 			if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3788 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3791 			if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3796 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3799 			if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3804 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3808 			 * least one 'Status Duple' entry (3 octets)  in ieee80211_rx_h_action()
3810 			if (len <  in ieee80211_rx_h_action()
3816 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3819 			if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3825 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action()
3828 			if (len < offsetofend(typeof(*mgmt),  in ieee80211_rx_h_action()
3841 	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;  in ieee80211_rx_h_action()
3846 	if (rx->sta)  in ieee80211_rx_h_action()
3847 		rx->link_sta->rx_stats.packets++;  in ieee80211_rx_h_action()
3848 	dev_kfree_skb(rx->skb);  in ieee80211_rx_h_action()
3852 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);  in ieee80211_rx_h_action()
3857 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_userspace_mgmt()  argument
3859 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_userspace_mgmt()  local
3861 		.freq = ieee80211_rx_status_to_khz(status),  in ieee80211_rx_h_userspace_mgmt()
3862 		.buf = rx->skb->data,  in ieee80211_rx_h_userspace_mgmt()
3863 		.len = rx->skb->len,  in ieee80211_rx_h_userspace_mgmt()
3864 		.link_id = rx->link_id,  in ieee80211_rx_h_userspace_mgmt()
3865 		.have_link_id = rx->link_id >= 0,  in ieee80211_rx_h_userspace_mgmt()
3868 	/* skip known-bad action frames and return them in the next handler */  in ieee80211_rx_h_userspace_mgmt()
3869 	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)  in ieee80211_rx_h_userspace_mgmt()
3879 	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&  in ieee80211_rx_h_userspace_mgmt()
3880 	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))  in ieee80211_rx_h_userspace_mgmt()
3881 		info.sig_dbm = status->signal;  in ieee80211_rx_h_userspace_mgmt()
3883 	if (ieee80211_is_timing_measurement(rx->skb) ||  in ieee80211_rx_h_userspace_mgmt()
3884 	    ieee80211_is_ftm(rx->skb)) {  in ieee80211_rx_h_userspace_mgmt()
3885 		info.rx_tstamp = ktime_to_ns(skb_hwtstamps(rx->skb)->hwtstamp);  in ieee80211_rx_h_userspace_mgmt()
3886 		info.ack_tstamp = ktime_to_ns(status->ack_tx_hwtstamp);  in ieee80211_rx_h_userspace_mgmt()
3889 	if (cfg80211_rx_mgmt_ext(&rx->sdata->wdev, &info)) {  in ieee80211_rx_h_userspace_mgmt()
3890 		if (rx->sta)  in ieee80211_rx_h_userspace_mgmt()
3891 			rx->link_sta->rx_stats.packets++;  in ieee80211_rx_h_userspace_mgmt()
3892 		dev_kfree_skb(rx->skb);  in ieee80211_rx_h_userspace_mgmt()
3900 ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_action_post_userspace()  argument
3902 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_action_post_userspace()
3903 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;  in ieee80211_rx_h_action_post_userspace()
3904 	int len = rx->skb->len;  in ieee80211_rx_h_action_post_userspace()  local
3906 	if (!ieee80211_is_action(mgmt->frame_control))  in ieee80211_rx_h_action_post_userspace()
3909 	switch (mgmt->u.action.category) {  in ieee80211_rx_h_action_post_userspace()
3911 		if (len < (IEEE80211_MIN_ACTION_SIZE +  in ieee80211_rx_h_action_post_userspace()
3912 			   sizeof(mgmt->u.action.u.sa_query)))  in ieee80211_rx_h_action_post_userspace()
3915 		switch (mgmt->u.action.u.sa_query.action) {  in ieee80211_rx_h_action_post_userspace()
3917 			if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_action_post_userspace()
3919 			ieee80211_process_sa_query_req(sdata, mgmt, len);  in ieee80211_rx_h_action_post_userspace()
3928 	if (rx->sta)  in ieee80211_rx_h_action_post_userspace()
3929 		rx->link_sta->rx_stats.packets++;  in ieee80211_rx_h_action_post_userspace()
3930 	dev_kfree_skb(rx->skb);  in ieee80211_rx_h_action_post_userspace()
3935 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_action_return()  argument
3937 	struct ieee80211_local *local = rx->local;  in ieee80211_rx_h_action_return()
3938 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;  in ieee80211_rx_h_action_return()
3940 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_action_return()
3941 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_h_action_return()  local
3943 	if (!ieee80211_is_action(mgmt->frame_control))  in ieee80211_rx_h_action_return()
3951 	 * 802.11-2012 9.24.4.  in ieee80211_rx_h_action_return()
3955 	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&  in ieee80211_rx_h_action_return()
3956 	    (sdata->vif.type == NL80211_IFTYPE_AP ||  in ieee80211_rx_h_action_return()
3957 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))  in ieee80211_rx_h_action_return()
3960 	if (is_multicast_ether_addr(mgmt->da))  in ieee80211_rx_h_action_return()
3964 	if (mgmt->u.action.category & 0x80)  in ieee80211_rx_h_action_return()
3967 	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,  in ieee80211_rx_h_action_return()
3970 		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;  in ieee80211_rx_h_action_return()
3972 		nmgmt->u.action.category |= 0x80;  in ieee80211_rx_h_action_return()
3973 		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);  in ieee80211_rx_h_action_return()
3974 		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);  in ieee80211_rx_h_action_return()
3976 		memset(nskb->cb, 0, sizeof(nskb->cb));  in ieee80211_rx_h_action_return()
3978 		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {  in ieee80211_rx_h_action_return()
3981 			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |  in ieee80211_rx_h_action_return()
3984 			if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))  in ieee80211_rx_h_action_return()
3985 				info->hw_queue =  in ieee80211_rx_h_action_return()
3986 					local->hw.offchannel_tx_hw_queue;  in ieee80211_rx_h_action_return()
3989 		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, -1,  in ieee80211_rx_h_action_return()
3990 					    status->band);  in ieee80211_rx_h_action_return()
3997 ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_ext()  argument
3999 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_ext()
4000 	struct ieee80211_hdr *hdr = (void *)rx->skb->data;  in ieee80211_rx_h_ext()
4002 	if (!ieee80211_is_ext(hdr->frame_control))  in ieee80211_rx_h_ext()
4005 	if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_ext()
4009 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);  in ieee80211_rx_h_ext()
4015 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)  in ieee80211_rx_h_mgmt()  argument
4017 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_rx_h_mgmt()
4018 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;  in ieee80211_rx_h_mgmt()
4021 	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);  in ieee80211_rx_h_mgmt()
4023 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&  in ieee80211_rx_h_mgmt()
4024 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&  in ieee80211_rx_h_mgmt()
4025 	    sdata->vif.type != NL80211_IFTYPE_OCB &&  in ieee80211_rx_h_mgmt()
4026 	    sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_mgmt()
4036 		if (is_multicast_ether_addr(mgmt->da) &&  in ieee80211_rx_h_mgmt()
4037 		    !is_broadcast_ether_addr(mgmt->da))  in ieee80211_rx_h_mgmt()
4041 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&  in ieee80211_rx_h_mgmt()
4042 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)  in ieee80211_rx_h_mgmt()
4048 		if (is_multicast_ether_addr(mgmt->da) &&  in ieee80211_rx_h_mgmt()
4049 		    !is_broadcast_ether_addr(mgmt->da))  in ieee80211_rx_h_mgmt()
4053 		if (sdata->vif.type != NL80211_IFTYPE_STATION)  in ieee80211_rx_h_mgmt()
4058 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&  in ieee80211_rx_h_mgmt()
4059 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)  in ieee80211_rx_h_mgmt()
4066 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);  in ieee80211_rx_h_mgmt()
4071 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,  in ieee80211_rx_handlers_result()  argument
4075 		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);  in ieee80211_rx_handlers_result()
4080 		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);  in ieee80211_rx_handlers_result()
4081 		if (rx->sta)  in ieee80211_rx_handlers_result()
4082 			rx->link_sta->rx_stats.dropped++;  in ieee80211_rx_handlers_result()
4085 	kfree_skb_reason(rx->skb, (__force u32)res);  in ieee80211_rx_handlers_result()
4088 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,  in ieee80211_rx_handlers()  argument
4096 		res = rxh(rx);		\  in ieee80211_rx_handlers()
4101 	/* Lock here to avoid hitting all of the data used in the RX  in ieee80211_rx_handlers()
4104 	 * from the timer, potentially concurrently with RX from the  in ieee80211_rx_handlers()
4107 	spin_lock_bh(&rx->local->rx_path_lock);  in ieee80211_rx_handlers()
4115 		rx->skb = skb;  in ieee80211_rx_handlers()
4117 		if (WARN_ON_ONCE(!rx->link))  in ieee80211_rx_handlers()
4130 		/* special treatment -- needs the queue */  in ieee80211_rx_handlers()
4131 		res = ieee80211_rx_h_ctrl(rx, frames);  in ieee80211_rx_handlers()
4144 		ieee80211_rx_handlers_result(rx, res);  in ieee80211_rx_handlers()
4149 	spin_unlock_bh(&rx->local->rx_path_lock);  in ieee80211_rx_handlers()
4152 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)  in ieee80211_invoke_rx_handlers()  argument
4161 		res = rxh(rx);		\  in ieee80211_invoke_rx_handlers()
4169 	ieee80211_rx_reorder_ampdu(rx, &reorder_release);  in ieee80211_invoke_rx_handlers()
4171 	ieee80211_rx_handlers(rx, &reorder_release);  in ieee80211_invoke_rx_handlers()
4175 	ieee80211_rx_handlers_result(rx, res);  in ieee80211_invoke_rx_handlers()
4183 	return !!(sta->valid_links & BIT(link_id));  in ieee80211_rx_is_valid_sta_link_id()
4186 static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,  in ieee80211_rx_data_set_link()  argument
4189 	rx->link_id = link_id;  in ieee80211_rx_data_set_link()
4190 	rx->link = rcu_dereference(rx->sdata->link[link_id]);  in ieee80211_rx_data_set_link()
4192 	if (!rx->sta)  in ieee80211_rx_data_set_link()
4193 		return rx->link;  in ieee80211_rx_data_set_link()
4195 	if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))  in ieee80211_rx_data_set_link()
4198 	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);  in ieee80211_rx_data_set_link()
4200 	return rx->link && rx->link_sta;  in ieee80211_rx_data_set_link()
4203 static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,  in ieee80211_rx_data_set_sta()  argument
4206 	rx->link_id = link_id;  in ieee80211_rx_data_set_sta()
4207 	rx->sta = sta;  in ieee80211_rx_data_set_sta()
4210 		rx->local = sta->sdata->local;  in ieee80211_rx_data_set_sta()
4211 		if (!rx->sdata)  in ieee80211_rx_data_set_sta()
4212 			rx->sdata = sta->sdata;  in ieee80211_rx_data_set_sta()
4213 		rx->link_sta = &sta->deflink;  in ieee80211_rx_data_set_sta()
4215 		rx->link_sta = NULL;  in ieee80211_rx_data_set_sta()
4219 		if (ieee80211_vif_is_mld(&rx->sdata->vif) &&  in ieee80211_rx_data_set_sta()
4220 		    sta && !sta->sta.valid_links)  in ieee80211_rx_data_set_sta()
4221 			rx->link =  in ieee80211_rx_data_set_sta()
4222 				rcu_dereference(rx->sdata->link[sta->deflink.link_id]);  in ieee80211_rx_data_set_sta()
4224 			rx->link = &rx->sdata->deflink;  in ieee80211_rx_data_set_sta()
4225 	} else if (!ieee80211_rx_data_set_link(rx, link_id)) {  in ieee80211_rx_data_set_sta()
4233  * This function makes calls into the RX path, therefore
4239 	struct ieee80211_rx_data rx = {  in ieee80211_release_reorder_timeout()  local
4240 		/* This is OK -- must be QoS data frame */  in ieee80211_release_reorder_timeout()
4245 	int link_id = -1;  in ieee80211_release_reorder_timeout()
4248 	if (sta->sta.valid_links)  in ieee80211_release_reorder_timeout()
4249 		link_id = ffs(sta->sta.valid_links) - 1;  in ieee80211_release_reorder_timeout()
4251 	if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))  in ieee80211_release_reorder_timeout()
4254 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);  in ieee80211_release_reorder_timeout()
4260 	spin_lock(&tid_agg_rx->reorder_lock);  in ieee80211_release_reorder_timeout()
4261 	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);  in ieee80211_release_reorder_timeout()
4262 	spin_unlock(&tid_agg_rx->reorder_lock);  in ieee80211_release_reorder_timeout()
4268 			.u.ba.sta = &sta->sta,  in ieee80211_release_reorder_timeout()
4270 		drv_event_callback(rx.local, rx.sdata, &event);  in ieee80211_release_reorder_timeout()
4273 	ieee80211_rx_handlers(&rx, &frames);  in ieee80211_release_reorder_timeout()
4284 	struct ieee80211_rx_data rx = {  in ieee80211_mark_rx_ba_filtered_frames()  local
4285 		/* This is OK -- must be QoS data frame */  in ieee80211_mark_rx_ba_filtered_frames()
4298 	local = sta->sdata->local;  in ieee80211_mark_rx_ba_filtered_frames()
4299 	WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,  in ieee80211_mark_rx_ba_filtered_frames()
4300 		  "RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",  in ieee80211_mark_rx_ba_filtered_frames()
4301 		  local->hw.max_rx_aggregation_subframes);  in ieee80211_mark_rx_ba_filtered_frames()
4303 	if (!ieee80211_rx_data_set_sta(&rx, sta, -1))  in ieee80211_mark_rx_ba_filtered_frames()
4307 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);  in ieee80211_mark_rx_ba_filtered_frames()
4311 	spin_lock_bh(&tid_agg_rx->reorder_lock);  in ieee80211_mark_rx_ba_filtered_frames()
4317 		release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %  in ieee80211_mark_rx_ba_filtered_frames()
4319 		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,  in ieee80211_mark_rx_ba_filtered_frames()
4322 		tid_agg_rx->head_seq_num = ssn;  in ieee80211_mark_rx_ba_filtered_frames()
4324 		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,  in ieee80211_mark_rx_ba_filtered_frames()
4329 	 * it can be tid_agg_rx->buf_size behind and still be valid */  in ieee80211_mark_rx_ba_filtered_frames()
4330 	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;  in ieee80211_mark_rx_ba_filtered_frames()
4331 	if (diff >= tid_agg_rx->buf_size) {  in ieee80211_mark_rx_ba_filtered_frames()
4332 		tid_agg_rx->reorder_buf_filtered = 0;  in ieee80211_mark_rx_ba_filtered_frames()
4339 	for (i = 0; i < tid_agg_rx->buf_size; i++) {  in ieee80211_mark_rx_ba_filtered_frames()
4340 		int index = (ssn + i) % tid_agg_rx->buf_size;  in ieee80211_mark_rx_ba_filtered_frames()
4342 		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);  in ieee80211_mark_rx_ba_filtered_frames()
4344 			tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);  in ieee80211_mark_rx_ba_filtered_frames()
4348 	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);  in ieee80211_mark_rx_ba_filtered_frames()
4351 	spin_unlock_bh(&tid_agg_rx->reorder_lock);  in ieee80211_mark_rx_ba_filtered_frames()
4353 	ieee80211_rx_handlers(&rx, &frames);  in ieee80211_mark_rx_ba_filtered_frames()
4368 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)  in ieee80211_accept_frame()  argument
4370 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_accept_frame()
4371 	struct sk_buff *skb = rx->skb;  in ieee80211_accept_frame()
4372 	struct ieee80211_hdr *hdr = (void *)skb->data;  in ieee80211_accept_frame()
4373 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_accept_frame()  local
4374 	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);  in ieee80211_accept_frame()
4375 	bool multicast = is_multicast_ether_addr(hdr->addr1) ||  in ieee80211_accept_frame()
4376 			 ieee80211_is_s1g_beacon(hdr->frame_control);  in ieee80211_accept_frame()
4378 	switch (sdata->vif.type) {  in ieee80211_accept_frame()
4380 		if (!bssid && !sdata->u.mgd.use_4addr)  in ieee80211_accept_frame()
4382 		if (ieee80211_is_first_frag(hdr->seq_ctrl) &&  in ieee80211_accept_frame()
4383 		    ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)  in ieee80211_accept_frame()
4387 		return ieee80211_is_our_addr(sdata, hdr->addr1, &rx->link_id);  in ieee80211_accept_frame()
4391 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||  in ieee80211_accept_frame()
4392 		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||  in ieee80211_accept_frame()
4393 		    !is_valid_ether_addr(hdr->addr2))  in ieee80211_accept_frame()
4395 		if (ieee80211_is_beacon(hdr->frame_control))  in ieee80211_accept_frame()
4397 		if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))  in ieee80211_accept_frame()
4400 		    !ether_addr_equal(sdata->vif.addr, hdr->addr1))  in ieee80211_accept_frame()
4402 		if (!rx->sta) {  in ieee80211_accept_frame()
4404 			if (status->encoding != RX_ENC_LEGACY)  in ieee80211_accept_frame()
4407 				rate_idx = status->rate_idx;  in ieee80211_accept_frame()
4408 			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,  in ieee80211_accept_frame()
4415 		if (!ieee80211_is_data_present(hdr->frame_control))  in ieee80211_accept_frame()
4420 		    !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))  in ieee80211_accept_frame()
4423 		if (!is_valid_ether_addr(hdr->addr2) ||  in ieee80211_accept_frame()
4424 		    ether_addr_equal(sdata->dev->dev_addr, hdr->addr2))  in ieee80211_accept_frame()
4426 		if (!rx->sta) {  in ieee80211_accept_frame()
4428 			if (status->encoding != RX_ENC_LEGACY)  in ieee80211_accept_frame()
4431 				rate_idx = status->rate_idx;  in ieee80211_accept_frame()
4432 			ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,  in ieee80211_accept_frame()
4437 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))  in ieee80211_accept_frame()
4441 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);  in ieee80211_accept_frame()
4445 			return ieee80211_is_our_addr(sdata, hdr->addr1,  in ieee80211_accept_frame()
4446 						     &rx->link_id);  in ieee80211_accept_frame()
4457 			    !ieee80211_is_our_addr(sdata, hdr->addr1,  in ieee80211_accept_frame()
4458 						   &rx->link_id))  in ieee80211_accept_frame()
4460 			if (ieee80211_is_public_action(hdr, skb->len))  in ieee80211_accept_frame()
4462 			return ieee80211_is_beacon(hdr->frame_control);  in ieee80211_accept_frame()
4465 		if (!ieee80211_has_tods(hdr->frame_control)) {  in ieee80211_accept_frame()
4466 			/* ignore data frames to TDLS-peers */  in ieee80211_accept_frame()
4467 			if (ieee80211_is_data(hdr->frame_control))  in ieee80211_accept_frame()
4469 			/* ignore action frames to TDLS-peers */  in ieee80211_accept_frame()
4470 			if (ieee80211_is_action(hdr->frame_control) &&  in ieee80211_accept_frame()
4472 			    !ether_addr_equal(bssid, hdr->addr1))  in ieee80211_accept_frame()
4477 		 * 802.11-2016 Table 9-26 says that for data frames, A1 must be  in ieee80211_accept_frame()
4478 		 * the BSSID - we've checked that already but may have accepted  in ieee80211_accept_frame()
4493 		if (ieee80211_is_data(hdr->frame_control) && multicast)  in ieee80211_accept_frame()
4498 		return ieee80211_is_public_action(hdr, skb->len) ||  in ieee80211_accept_frame()
4499 		       ieee80211_is_probe_req(hdr->frame_control) ||  in ieee80211_accept_frame()
4500 		       ieee80211_is_probe_resp(hdr->frame_control) ||  in ieee80211_accept_frame()
4501 		       ieee80211_is_beacon(hdr->frame_control) ||  in ieee80211_accept_frame()
4502 		       (ieee80211_is_auth(hdr->frame_control) &&  in ieee80211_accept_frame()
4503 			ether_addr_equal(sdata->vif.addr, hdr->addr1));  in ieee80211_accept_frame()
4510 		return memcmp(sdata->wdev.u.nan.cluster_id,  in ieee80211_accept_frame()
4511 			      hdr->addr3, ETH_ALEN) == 0 &&  in ieee80211_accept_frame()
4512 			(ieee80211_is_public_action(hdr, skb->len) ||  in ieee80211_accept_frame()
4513 			 (ieee80211_is_auth(hdr->frame_control) &&  in ieee80211_accept_frame()
4514 			  ether_addr_equal(sdata->vif.addr, hdr->addr1)));  in ieee80211_accept_frame()
4525 	struct ieee80211_sub_if_data *sdata = sta->sdata;  in ieee80211_check_fast_rx()
4526 	struct ieee80211_local *local = sdata->local;  in ieee80211_check_fast_rx()
4529 		.dev = sdata->dev,  in ieee80211_check_fast_rx()
4530 		.vif_type = sdata->vif.type,  in ieee80211_check_fast_rx()
4531 		.control_port_protocol = sdata->control_port_protocol,  in ieee80211_check_fast_rx()
4544 	ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);  in ieee80211_check_fast_rx()
4546 	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);  in ieee80211_check_fast_rx()
4548 	/* fast-rx doesn't do reordering */  in ieee80211_check_fast_rx()
4549 	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&  in ieee80211_check_fast_rx()
4550 	    !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))  in ieee80211_check_fast_rx()
4553 	switch (sdata->vif.type) {  in ieee80211_check_fast_rx()
4555 		if (sta->sta.tdls) {  in ieee80211_check_fast_rx()
4566 		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {  in ieee80211_check_fast_rx()
4573 		if (!sdata->u.mgd.powersave)  in ieee80211_check_fast_rx()
4577 		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))  in ieee80211_check_fast_rx()
4579 		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&  in ieee80211_check_fast_rx()
4580 		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))  in ieee80211_check_fast_rx()
4585 		/* parallel-rx requires this, at least with calls to  in ieee80211_check_fast_rx()
4588 		if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))  in ieee80211_check_fast_rx()
4595 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&  in ieee80211_check_fast_rx()
4596 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||  in ieee80211_check_fast_rx()
4597 			 !sdata->u.vlan.sta);  in ieee80211_check_fast_rx()
4599 		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&  in ieee80211_check_fast_rx()
4600 		    sdata->u.vlan.sta) {  in ieee80211_check_fast_rx()
4622 	key = rcu_dereference(sta->ptk[sta->ptk_idx]);  in ieee80211_check_fast_rx()
4624 		key = rcu_dereference(sdata->default_unicast_key);  in ieee80211_check_fast_rx()
4626 		switch (key->conf.cipher) {  in ieee80211_check_fast_rx()
4628 			/* we don't want to deal with MMIC in fast-rx */  in ieee80211_check_fast_rx()
4643 		fastrx.icv_len = key->conf.icv_len;  in ieee80211_check_fast_rx()
4655 	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;  in ieee80211_check_fast_rx()
4664 		drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);  in ieee80211_check_fast_rx()
4666 	spin_lock_bh(&sta->lock);  in ieee80211_check_fast_rx()
4667 	old = rcu_dereference_protected(sta->fast_rx, true);  in ieee80211_check_fast_rx()
4668 	rcu_assign_pointer(sta->fast_rx, new);  in ieee80211_check_fast_rx()
4669 	spin_unlock_bh(&sta->lock);  in ieee80211_check_fast_rx()
4679 	spin_lock_bh(&sta->lock);  in ieee80211_clear_fast_rx()
4680 	old = rcu_dereference_protected(sta->fast_rx, true);  in ieee80211_clear_fast_rx()
4681 	RCU_INIT_POINTER(sta->fast_rx, NULL);  in ieee80211_clear_fast_rx()
4682 	spin_unlock_bh(&sta->lock);  in ieee80211_clear_fast_rx()
4690 	struct ieee80211_local *local = sdata->local;  in __ieee80211_check_fast_rx_iface()
4693 	lockdep_assert_wiphy(local->hw.wiphy);  in __ieee80211_check_fast_rx_iface()
4695 	list_for_each_entry(sta, &local->sta_list, list) {  in __ieee80211_check_fast_rx_iface()
4696 		if (sdata != sta->sdata &&  in __ieee80211_check_fast_rx_iface()
4697 		    (!sta->sdata->bss || sta->sdata->bss != sdata->bss))  in __ieee80211_check_fast_rx_iface()
4705 	struct ieee80211_local *local = sdata->local;  in ieee80211_check_fast_rx_iface()
4707 	lockdep_assert_wiphy(local->hw.wiphy);  in ieee80211_check_fast_rx_iface()
4712 static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,  in ieee80211_rx_8023()  argument
4717 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);  in ieee80211_rx_8023()  local
4718 	struct sta_info *sta = rx->sta;  in ieee80211_rx_8023()
4720 	struct sk_buff *skb = rx->skb;  in ieee80211_rx_8023()
4721 	void *sa = skb->data + ETH_ALEN;  in ieee80211_rx_8023()
4722 	void *da = skb->data;  in ieee80211_rx_8023()
4724 	if (rx->link_id >= 0) {  in ieee80211_rx_8023()
4725 		link_sta = rcu_dereference(sta->link[rx->link_id]);  in ieee80211_rx_8023()
4727 			dev_kfree_skb(rx->skb);  in ieee80211_rx_8023()
4731 		link_sta = &sta->deflink;  in ieee80211_rx_8023()
4734 	stats = &link_sta->rx_stats;  in ieee80211_rx_8023()
4735 	if (fast_rx->uses_rss)  in ieee80211_rx_8023()
4736 		stats = this_cpu_ptr(link_sta->pcpu_rx_stats);  in ieee80211_rx_8023()
4739 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {  in ieee80211_rx_8023()
4740 		stats->last_signal = status->signal;  in ieee80211_rx_8023()
4741 		if (!fast_rx->uses_rss)  in ieee80211_rx_8023()
4742 			ewma_signal_add(&link_sta->rx_stats_avg.signal,  in ieee80211_rx_8023()
4743 					-status->signal);  in ieee80211_rx_8023()
4746 	if (status->chains) {  in ieee80211_rx_8023()
4749 		stats->chains = status->chains;  in ieee80211_rx_8023()
4750 		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {  in ieee80211_rx_8023()
4751 			int signal = status->chain_signal[i];  in ieee80211_rx_8023()
4753 			if (!(status->chains & BIT(i)))  in ieee80211_rx_8023()
4756 			stats->chain_signal_last[i] = signal;  in ieee80211_rx_8023()
4757 			if (!fast_rx->uses_rss)  in ieee80211_rx_8023()
4758 				ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],  in ieee80211_rx_8023()
4759 						-signal);  in ieee80211_rx_8023()
4764 	stats->last_rx = jiffies;  in ieee80211_rx_8023()
4765 	stats->last_rate = sta_stats_encode_rate(status);  in ieee80211_rx_8023()
4767 	stats->fragments++;  in ieee80211_rx_8023()
4768 	stats->packets++;  in ieee80211_rx_8023()
4770 	skb->dev = fast_rx->dev;  in ieee80211_rx_8023()
4772 	dev_sw_netstats_rx_add(fast_rx->dev, skb->len);  in ieee80211_rx_8023()
4776 	 * for non-QoS-data frames. Here we know it's a data  in ieee80211_rx_8023()
4779 	u64_stats_update_begin(&stats->syncp);  in ieee80211_rx_8023()
4780 	stats->msdu[rx->seqno_idx]++;  in ieee80211_rx_8023()
4781 	stats->bytes += orig_len;  in ieee80211_rx_8023()
4782 	u64_stats_update_end(&stats->syncp);  in ieee80211_rx_8023()
4784 	if (fast_rx->internal_forward) {  in ieee80211_rx_8023()
4789 			   sta_info_get(rx->sdata, da)) {  in ieee80211_rx_8023()
4800 			xmit_skb->priority += 256;  in ieee80211_rx_8023()
4801 			xmit_skb->protocol = htons(ETH_P_802_3);  in ieee80211_rx_8023()
4812 	skb->protocol = eth_type_trans(skb, fast_rx->dev);  in ieee80211_rx_8023()
4813 	ieee80211_deliver_skb_to_local_stack(skb, rx);  in ieee80211_rx_8023()
4816 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,  in ieee80211_invoke_fast_rx()  argument
4819 	struct sk_buff *skb = rx->skb;  in ieee80211_invoke_fast_rx()
4820 	struct ieee80211_hdr *hdr = (void *)skb->data;  in ieee80211_invoke_fast_rx()
4821 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_invoke_fast_rx()  local
4823 	int orig_len = skb->len;  in ieee80211_invoke_fast_rx()
4824 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);  in ieee80211_invoke_fast_rx()
4836 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write  in ieee80211_invoke_fast_rx()
4840 	if (!(status->flag & RX_FLAG_DUP_VALIDATED))  in ieee80211_invoke_fast_rx()
4846 	 *  - PN_VALIDATED: similar, but the implementation is tricky  in ieee80211_invoke_fast_rx()
4847 	 *  - DECRYPTED: necessary for PN_VALIDATED  in ieee80211_invoke_fast_rx()
4849 	if (fast_rx->key &&  in ieee80211_invoke_fast_rx()
4850 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)  in ieee80211_invoke_fast_rx()
4853 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))  in ieee80211_invoke_fast_rx()
4868 	if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))  in ieee80211_invoke_fast_rx()
4871 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |  in ieee80211_invoke_fast_rx()
4873 	    fast_rx->expected_ds_bits)  in ieee80211_invoke_fast_rx()
4879 	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {  in ieee80211_invoke_fast_rx()
4884 	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&  in ieee80211_invoke_fast_rx()
4885 	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {  in ieee80211_invoke_fast_rx()
4889 		payload = (void *)(skb->data + snap_offs);  in ieee80211_invoke_fast_rx()
4891 		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))  in ieee80211_invoke_fast_rx()
4896 		 * bridge-tunnel header - but if we get them this way then  in ieee80211_invoke_fast_rx()
4899 		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||  in ieee80211_invoke_fast_rx()
4900 			     payload->proto == fast_rx->control_port_protocol))  in ieee80211_invoke_fast_rx()
4906 	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&  in ieee80211_invoke_fast_rx()
4907 	    pskb_trim(skb, skb->len - fast_rx->icv_len))  in ieee80211_invoke_fast_rx()
4910 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))  in ieee80211_invoke_fast_rx()
4913 	if (status->rx_flags & IEEE80211_RX_AMSDU) {  in ieee80211_invoke_fast_rx()
4914 		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=  in ieee80211_invoke_fast_rx()
4921 	/* do the header conversion - first grab the addresses */  in ieee80211_invoke_fast_rx()
4922 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);  in ieee80211_invoke_fast_rx()
4923 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);  in ieee80211_invoke_fast_rx()
4924 	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {  in ieee80211_invoke_fast_rx()
4925 	    skb_pull(skb, snap_offs - 2);  in ieee80211_invoke_fast_rx()
4926 	    put_unaligned_be16(skb->len - 2, skb->data);  in ieee80211_invoke_fast_rx()
4928 	    skb_postpull_rcsum(skb, skb->data + snap_offs,  in ieee80211_invoke_fast_rx()
4937 	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);  in ieee80211_invoke_fast_rx()
4947 	ieee80211_rx_8023(rx, fast_rx, orig_len);  in ieee80211_invoke_fast_rx()
4953 	if (fast_rx->uses_rss)  in ieee80211_invoke_fast_rx()
4954 		stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);  in ieee80211_invoke_fast_rx()
4956 		stats = &rx->link_sta->rx_stats;  in ieee80211_invoke_fast_rx()
4958 	stats->dropped++;  in ieee80211_invoke_fast_rx()
4964  * was destined for RX processing or not, which,
4968 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,  in ieee80211_prepare_and_rx_handle()  argument
4971 	struct ieee80211_local *local = rx->local;  in ieee80211_prepare_and_rx_handle()
4972 	struct ieee80211_sub_if_data *sdata = rx->sdata;  in ieee80211_prepare_and_rx_handle()
4973 	struct ieee80211_hdr *hdr = (void *)skb->data;  in ieee80211_prepare_and_rx_handle()
4974 	struct link_sta_info *link_sta = rx->link_sta;  in ieee80211_prepare_and_rx_handle()
4975 	struct ieee80211_link_data *link = rx->link;  in ieee80211_prepare_and_rx_handle()
4977 	rx->skb = skb;  in ieee80211_prepare_and_rx_handle()
4979 	/* See if we can do fast-rx; if we have to copy we already lost,  in ieee80211_prepare_and_rx_handle()
4986 	if (consume && rx->sta) {  in ieee80211_prepare_and_rx_handle()
4989 		fast_rx = rcu_dereference(rx->sta->fast_rx);  in ieee80211_prepare_and_rx_handle()
4990 		if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))  in ieee80211_prepare_and_rx_handle()
4994 	if (!ieee80211_accept_frame(rx))  in ieee80211_prepare_and_rx_handle()
5000 		rx->skb = skb_copy(skb, GFP_ATOMIC);  in ieee80211_prepare_and_rx_handle()
5001 		if (!rx->skb) {  in ieee80211_prepare_and_rx_handle()
5003 				wiphy_debug(local->hw.wiphy,  in ieee80211_prepare_and_rx_handle()
5005 					sdata->name);  in ieee80211_prepare_and_rx_handle()
5012 		shwt = skb_hwtstamps(rx->skb);  in ieee80211_prepare_and_rx_handle()
5013 		shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;  in ieee80211_prepare_and_rx_handle()
5016 		hdr = (struct ieee80211_hdr *)rx->skb->data;  in ieee80211_prepare_and_rx_handle()
5019 	if (unlikely(rx->sta && rx->sta->sta.mlo) &&  in ieee80211_prepare_and_rx_handle()
5020 	    is_unicast_ether_addr(hdr->addr1) &&  in ieee80211_prepare_and_rx_handle()
5021 	    !ieee80211_is_probe_resp(hdr->frame_control) &&  in ieee80211_prepare_and_rx_handle()
5022 	    !ieee80211_is_beacon(hdr->frame_control)) {  in ieee80211_prepare_and_rx_handle()
5024 		if (ether_addr_equal(link->conf->addr, hdr->addr1))  in ieee80211_prepare_and_rx_handle()
5025 			ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);  in ieee80211_prepare_and_rx_handle()
5026 		if (ether_addr_equal(link_sta->addr, hdr->addr2))  in ieee80211_prepare_and_rx_handle()
5027 			ether_addr_copy(hdr->addr2, rx->sta->addr);  in ieee80211_prepare_and_rx_handle()
5029 		if (!ieee80211_has_tods(hdr->frame_control) &&  in ieee80211_prepare_and_rx_handle()
5030 		    !ieee80211_has_fromds(hdr->frame_control)) {  in ieee80211_prepare_and_rx_handle()
5031 			if (ether_addr_equal(link_sta->addr, hdr->addr3))  in ieee80211_prepare_and_rx_handle()
5032 				ether_addr_copy(hdr->addr3, rx->sta->addr);  in ieee80211_prepare_and_rx_handle()
5033 			else if (ether_addr_equal(link->conf->addr, hdr->addr3))  in ieee80211_prepare_and_rx_handle()
5034 				ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);  in ieee80211_prepare_and_rx_handle()
5039 	ieee80211_invoke_rx_handlers(rx);  in ieee80211_prepare_and_rx_handle()
5049 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in __ieee80211_rx_handle_8023()  local
5051 	struct ieee80211_rx_data rx;  in __ieee80211_rx_handle_8023()  local
5053 	int link_id = -1;  in __ieee80211_rx_handle_8023()
5055 	memset(&rx, 0, sizeof(rx));  in __ieee80211_rx_handle_8023()
5056 	rx.skb = skb;  in __ieee80211_rx_handle_8023()
5057 	rx.local = local;  in __ieee80211_rx_handle_8023()
5058 	rx.list = list;  in __ieee80211_rx_handle_8023()
5059 	rx.link_id = -1;  in __ieee80211_rx_handle_8023()
5061 	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);  in __ieee80211_rx_handle_8023()
5064 	if (skb->len < sizeof(struct ethhdr))  in __ieee80211_rx_handle_8023()
5070 	if (status->link_valid)  in __ieee80211_rx_handle_8023()
5071 		link_id = status->link_id;  in __ieee80211_rx_handle_8023()
5081 	if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))  in __ieee80211_rx_handle_8023()
5084 	fast_rx = rcu_dereference(rx.sta->fast_rx);  in __ieee80211_rx_handle_8023()
5088 	ieee80211_rx_8023(&rx, fast_rx, skb->len);  in __ieee80211_rx_handle_8023()
5095 static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,  in ieee80211_rx_for_interface()  argument
5099 	struct ieee80211_hdr *hdr = (void *)skb->data;  in ieee80211_rx_for_interface()
5101 	int link_id = -1;  in ieee80211_rx_for_interface()
5109 	link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);  in ieee80211_rx_for_interface()
5111 		sta = link_sta->sta;  in ieee80211_rx_for_interface()
5112 		link_id = link_sta->link_id;  in ieee80211_rx_for_interface()
5114 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_rx_for_interface()  local
5116 		sta = sta_info_get_bss(rx->sdata, hdr->addr2);  in ieee80211_rx_for_interface()
5117 		if (status->link_valid) {  in ieee80211_rx_for_interface()
5118 			link_id = status->link_id;  in ieee80211_rx_for_interface()
5119 		} else if (ieee80211_vif_is_mld(&rx->sdata->vif) &&  in ieee80211_rx_for_interface()
5120 			   status->freq) {  in ieee80211_rx_for_interface()
5124 			for_each_link_data_rcu(rx->sdata, link) {  in ieee80211_rx_for_interface()
5125 				conf = rcu_dereference(link->conf->chanctx_conf);  in ieee80211_rx_for_interface()
5126 				if (!conf || !conf->def.chan)  in ieee80211_rx_for_interface()
5129 				if (status->freq == conf->def.chan->center_freq) {  in ieee80211_rx_for_interface()
5130 					link_id = link->link_id;  in ieee80211_rx_for_interface()
5137 	if (!ieee80211_rx_data_set_sta(rx, sta, link_id))  in ieee80211_rx_for_interface()
5140 	return ieee80211_prepare_and_rx_handle(rx, skb, consume);  in ieee80211_rx_for_interface()
5144  * This is the actual Rx frames handler. as it belongs to Rx path it must
5153 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in __ieee80211_rx_handle_packet()  local
5157 	struct ieee80211_rx_data rx;  in __ieee80211_rx_handle_packet()  local
5162 	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;  in __ieee80211_rx_handle_packet()
5163 	memset(&rx, 0, sizeof(rx));  in __ieee80211_rx_handle_packet()
5164 	rx.skb = skb;  in __ieee80211_rx_handle_packet()
5165 	rx.local = local;  in __ieee80211_rx_handle_packet()
5166 	rx.list = list;  in __ieee80211_rx_handle_packet()
5167 	rx.link_id = -1;  in __ieee80211_rx_handle_packet()
5170 		I802_DEBUG_INC(local->dot11ReceivedFragmentCount);  in __ieee80211_rx_handle_packet()
5174 		if (skb->len < ieee80211_hdrlen(fc))  in __ieee80211_rx_handle_packet()
5175 			err = -ENOBUFS;  in __ieee80211_rx_handle_packet()
5187 	hdr = (struct ieee80211_hdr *)skb->data;  in __ieee80211_rx_handle_packet()
5188 	ieee80211_parse_qos(&rx);  in __ieee80211_rx_handle_packet()
5189 	ieee80211_verify_alignment(&rx);  in __ieee80211_rx_handle_packet()
5191 	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||  in __ieee80211_rx_handle_packet()
5192 		     ieee80211_is_beacon(hdr->frame_control) ||  in __ieee80211_rx_handle_packet()
5193 		     ieee80211_is_s1g_beacon(hdr->frame_control)))  in __ieee80211_rx_handle_packet()
5198 		int link_id = -1;  in __ieee80211_rx_handle_packet()
5200 		if (status->link_valid)  in __ieee80211_rx_handle_packet()
5201 			link_id = status->link_id;  in __ieee80211_rx_handle_packet()
5205 			if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))  in __ieee80211_rx_handle_packet()
5210 			 * when the driver does not pass link_id in status.  in __ieee80211_rx_handle_packet()
5213 			 * status.  in __ieee80211_rx_handle_packet()
5216 			if (!status->link_valid && pubsta->mlo) {  in __ieee80211_rx_handle_packet()
5219 				link_sta = link_sta_info_get_bss(rx.sdata,  in __ieee80211_rx_handle_packet()
5220 								 hdr->addr2);  in __ieee80211_rx_handle_packet()
5224 				ieee80211_rx_data_set_link(&rx, link_sta->link_id);  in __ieee80211_rx_handle_packet()
5227 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))  in __ieee80211_rx_handle_packet()
5234 		for_each_sta_info(local, hdr->addr2, sta, tmp) {  in __ieee80211_rx_handle_packet()
5240 			rx.sdata = prev_sta->sdata;  in __ieee80211_rx_handle_packet()
5241 			if (!status->link_valid && prev_sta->sta.mlo) {  in __ieee80211_rx_handle_packet()
5244 				link_sta = link_sta_info_get_bss(rx.sdata,  in __ieee80211_rx_handle_packet()
5245 								 hdr->addr2);  in __ieee80211_rx_handle_packet()
5249 				link_id = link_sta->link_id;  in __ieee80211_rx_handle_packet()
5252 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))  in __ieee80211_rx_handle_packet()
5255 			ieee80211_prepare_and_rx_handle(&rx, skb, false);  in __ieee80211_rx_handle_packet()
5261 			rx.sdata = prev_sta->sdata;  in __ieee80211_rx_handle_packet()
5262 			if (!status->link_valid && prev_sta->sta.mlo) {  in __ieee80211_rx_handle_packet()
5265 				link_sta = link_sta_info_get_bss(rx.sdata,  in __ieee80211_rx_handle_packet()
5266 								 hdr->addr2);  in __ieee80211_rx_handle_packet()
5270 				link_id = link_sta->link_id;  in __ieee80211_rx_handle_packet()
5273 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))  in __ieee80211_rx_handle_packet()
5276 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))  in __ieee80211_rx_handle_packet()
5284 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {  in __ieee80211_rx_handle_packet()
5288 		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||  in __ieee80211_rx_handle_packet()
5289 		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)  in __ieee80211_rx_handle_packet()
5303 		rx.sdata = prev;  in __ieee80211_rx_handle_packet()
5304 		ieee80211_rx_for_interface(&rx, skb, false);  in __ieee80211_rx_handle_packet()
5310 		rx.sdata = prev;  in __ieee80211_rx_handle_packet()
5312 		if (ieee80211_rx_for_interface(&rx, skb, true))  in __ieee80211_rx_handle_packet()
5330 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);  in ieee80211_rx_list()  local
5331 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;  in ieee80211_rx_list()
5335 	if (WARN_ON(status->band >= NUM_NL80211_BANDS))  in ieee80211_rx_list()
5338 	sband = local->hw.wiphy->bands[status->band];  in ieee80211_rx_list()
5349 	if (unlikely(local->quiescing || local->suspended))  in ieee80211_rx_list()
5352 	/* We might be during a HW reconfig, prevent Rx for the same reason */  in ieee80211_rx_list()
5353 	if (unlikely(local->in_reconfig))  in ieee80211_rx_list()
5360 	if (WARN_ON(!local->started))  in ieee80211_rx_list()
5363 	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC) &&  in ieee80211_rx_list()
5364 		   !(status->flag & RX_FLAG_NO_PSDU &&  in ieee80211_rx_list()
5365 		     status->zero_length_psdu_type ==  in ieee80211_rx_list()
5373 		switch (status->encoding) {  in ieee80211_rx_list()
5376 			 * rate_idx is MCS index, which can be [0-76]  in ieee80211_rx_list()
5385 			if (WARN(status->rate_idx > 76,  in ieee80211_rx_list()
5387 				 "status->rate_idx is not "  in ieee80211_rx_list()
5388 				 "an MCS index [0-76]: %d (0x%02x)\n",  in ieee80211_rx_list()
5389 				 status->rate_idx,  in ieee80211_rx_list()
5390 				 status->rate_idx))  in ieee80211_rx_list()
5394 			if (WARN_ONCE(status->rate_idx > 11 ||  in ieee80211_rx_list()
5395 				      !status->nss ||  in ieee80211_rx_list()
5396 				      status->nss > 8,  in ieee80211_rx_list()
5398 				      status->rate_idx, status->nss))  in ieee80211_rx_list()
5402 			if (WARN_ONCE(status->rate_idx > 11 ||  in ieee80211_rx_list()
5403 				      !status->nss ||  in ieee80211_rx_list()
5404 				      status->nss > 8,  in ieee80211_rx_list()
5406 				      status->rate_idx, status->nss))  in ieee80211_rx_list()
5410 			if (WARN_ONCE(status->rate_idx > 15 ||  in ieee80211_rx_list()
5411 				      !status->nss ||  in ieee80211_rx_list()
5412 				      status->nss > 8 ||  in ieee80211_rx_list()
5413 				      status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,  in ieee80211_rx_list()
5415 				      status->rate_idx, status->nss, status->eht.gi))  in ieee80211_rx_list()
5422 			if (WARN_ON(status->rate_idx >= sband->n_bitrates))  in ieee80211_rx_list()
5424 			rate = &sband->bitrates[status->rate_idx];  in ieee80211_rx_list()
5428 	if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))  in ieee80211_rx_list()
5431 	status->rx_flags = 0;  in ieee80211_rx_list()
5441 	if (!(status->flag & RX_FLAG_8023))  in ieee80211_rx_list()
5444 		if ((status->flag & RX_FLAG_8023) ||  in ieee80211_rx_list()
5445 			ieee80211_is_data_present(hdr->frame_control))  in ieee80211_rx_list()
5446 			ieee80211_tpt_led_trig_rx(local, skb->len);  in ieee80211_rx_list()
5448 		if (status->flag & RX_FLAG_8023)  in ieee80211_rx_list()
5470 	 * and this requires that we are in a read-side RCU section during  in ieee80211_rx_napi()
5489 /* This is a version of the rx handler that can be called from hard irq
5495 	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));  in ieee80211_rx_irqsafe()
5497 	skb->pkt_type = IEEE80211_RX_MSG;  in ieee80211_rx_irqsafe()
5498 	skb_queue_tail(&local->skb_queue, skb);  in ieee80211_rx_irqsafe()
5499 	tasklet_schedule(&local->tasklet);  in ieee80211_rx_irqsafe()