xref: /linux/net/mac80211/rx.c (revision 7f71507851fc7764b36a3221839607d3a45c2025)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright 2002-2005, Instant802 Networks, Inc.
4  * Copyright 2005-2006, Devicescape Software, Inc.
5  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
6  * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
7  * Copyright 2013-2014  Intel Mobile Communications GmbH
8  * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
9  * Copyright (C) 2018-2024 Intel Corporation
10  */
11 
12 #include <linux/jiffies.h>
13 #include <linux/slab.h>
14 #include <linux/kernel.h>
15 #include <linux/skbuff.h>
16 #include <linux/netdevice.h>
17 #include <linux/etherdevice.h>
18 #include <linux/rcupdate.h>
19 #include <linux/export.h>
20 #include <linux/kcov.h>
21 #include <linux/bitops.h>
22 #include <kunit/visibility.h>
23 #include <net/mac80211.h>
24 #include <net/ieee80211_radiotap.h>
25 #include <linux/unaligned.h>
26 
27 #include "ieee80211_i.h"
28 #include "driver-ops.h"
29 #include "led.h"
30 #include "mesh.h"
31 #include "wep.h"
32 #include "wpa.h"
33 #include "tkip.h"
34 #include "wme.h"
35 #include "rate.h"
36 
37 /*
38  * monitor mode reception
39  *
40  * This function cleans up the SKB, i.e. it removes all the stuff
41  * only useful for monitoring.
42  */
43 static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb,
44 					   unsigned int present_fcs_len,
45 					   unsigned int rtap_space)
46 {
47 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
48 	struct ieee80211_hdr *hdr;
49 	unsigned int hdrlen;
50 	__le16 fc;
51 
52 	if (present_fcs_len)
53 		__pskb_trim(skb, skb->len - present_fcs_len);
54 	pskb_pull(skb, rtap_space);
55 
56 	/* After pulling radiotap header, clear all flags that indicate
57 	 * info in skb->data.
58 	 */
59 	status->flag &= ~(RX_FLAG_RADIOTAP_TLV_AT_END |
60 			  RX_FLAG_RADIOTAP_LSIG |
61 			  RX_FLAG_RADIOTAP_HE_MU |
62 			  RX_FLAG_RADIOTAP_HE);
63 
64 	hdr = (void *)skb->data;
65 	fc = hdr->frame_control;
66 
67 	/*
68 	 * Remove the HT-Control field (if present) on management
69 	 * frames after we've sent the frame to monitoring. We
70 	 * (currently) don't need it, and don't properly parse
71 	 * frames with it present, due to the assumption of a
72 	 * fixed management header length.
73 	 */
74 	if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc)))
75 		return skb;
76 
77 	hdrlen = ieee80211_hdrlen(fc);
78 	hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER);
79 
80 	if (!pskb_may_pull(skb, hdrlen)) {
81 		dev_kfree_skb(skb);
82 		return NULL;
83 	}
84 
85 	memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data,
86 		hdrlen - IEEE80211_HT_CTL_LEN);
87 	pskb_pull(skb, IEEE80211_HT_CTL_LEN);
88 
89 	return skb;
90 }
91 
92 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
93 				     unsigned int rtap_space)
94 {
95 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
96 	struct ieee80211_hdr *hdr;
97 
98 	hdr = (void *)(skb->data + rtap_space);
99 
100 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
101 			    RX_FLAG_FAILED_PLCP_CRC |
102 			    RX_FLAG_ONLY_MONITOR |
103 			    RX_FLAG_NO_PSDU))
104 		return true;
105 
106 	if (unlikely(skb->len < 16 + present_fcs_len + rtap_space))
107 		return true;
108 
109 	if (ieee80211_is_ctl(hdr->frame_control) &&
110 	    !ieee80211_is_pspoll(hdr->frame_control) &&
111 	    !ieee80211_is_back_req(hdr->frame_control))
112 		return true;
113 
114 	return false;
115 }
116 
117 static int
118 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
119 			     struct ieee80211_rx_status *status,
120 			     struct sk_buff *skb)
121 {
122 	int len;
123 
124 	/* always present fields */
125 	len = sizeof(struct ieee80211_radiotap_header) + 8;
126 
127 	/* allocate extra bitmaps */
128 	if (status->chains)
129 		len += 4 * hweight8(status->chains);
130 
131 	if (ieee80211_have_rx_timestamp(status)) {
132 		len = ALIGN(len, 8);
133 		len += 8;
134 	}
135 	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
136 		len += 1;
137 
138 	/* antenna field, if we don't have per-chain info */
139 	if (!status->chains)
140 		len += 1;
141 
142 	/* padding for RX_FLAGS if necessary */
143 	len = ALIGN(len, 2);
144 
145 	if (status->encoding == RX_ENC_HT) /* HT info */
146 		len += 3;
147 
148 	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
149 		len = ALIGN(len, 4);
150 		len += 8;
151 	}
152 
153 	if (status->encoding == RX_ENC_VHT) {
154 		len = ALIGN(len, 2);
155 		len += 12;
156 	}
157 
158 	if (local->hw.radiotap_timestamp.units_pos >= 0) {
159 		len = ALIGN(len, 8);
160 		len += 12;
161 	}
162 
163 	if (status->encoding == RX_ENC_HE &&
164 	    status->flag & RX_FLAG_RADIOTAP_HE) {
165 		len = ALIGN(len, 2);
166 		len += 12;
167 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12);
168 	}
169 
170 	if (status->encoding == RX_ENC_HE &&
171 	    status->flag & RX_FLAG_RADIOTAP_HE_MU) {
172 		len = ALIGN(len, 2);
173 		len += 12;
174 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12);
175 	}
176 
177 	if (status->flag & RX_FLAG_NO_PSDU)
178 		len += 1;
179 
180 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
181 		len = ALIGN(len, 2);
182 		len += 4;
183 		BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4);
184 	}
185 
186 	if (status->chains) {
187 		/* antenna and antenna signal fields */
188 		len += 2 * hweight8(status->chains);
189 	}
190 
191 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
192 		int tlv_offset = 0;
193 
194 		/*
195 		 * The position to look at depends on the existence (or non-
196 		 * existence) of other elements, so take that into account...
197 		 */
198 		if (status->flag & RX_FLAG_RADIOTAP_HE)
199 			tlv_offset +=
200 				sizeof(struct ieee80211_radiotap_he);
201 		if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
202 			tlv_offset +=
203 				sizeof(struct ieee80211_radiotap_he_mu);
204 		if (status->flag & RX_FLAG_RADIOTAP_LSIG)
205 			tlv_offset +=
206 				sizeof(struct ieee80211_radiotap_lsig);
207 
208 		/* ensure 4 byte alignment for TLV */
209 		len = ALIGN(len, 4);
210 
211 		/* TLVs until the mac header */
212 		len += skb_mac_header(skb) - &skb->data[tlv_offset];
213 	}
214 
215 	return len;
216 }
217 
218 static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
219 					   int link_id,
220 					   struct sta_info *sta,
221 					   struct sk_buff *skb)
222 {
223 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
224 
225 	if (link_id >= 0) {
226 		status->link_valid = 1;
227 		status->link_id = link_id;
228 	} else {
229 		status->link_valid = 0;
230 	}
231 
232 	skb_queue_tail(&sdata->skb_queue, skb);
233 	wiphy_work_queue(sdata->local->hw.wiphy, &sdata->work);
234 	if (sta)
235 		sta->deflink.rx_stats.packets++;
236 }
237 
238 static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata,
239 					 int link_id,
240 					 struct sta_info *sta,
241 					 struct sk_buff *skb)
242 {
243 	skb->protocol = 0;
244 	__ieee80211_queue_skb_to_iface(sdata, link_id, sta, skb);
245 }
246 
247 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
248 					 struct sk_buff *skb,
249 					 int rtap_space)
250 {
251 	struct {
252 		struct ieee80211_hdr_3addr hdr;
253 		u8 category;
254 		u8 action_code;
255 	} __packed __aligned(2) action;
256 
257 	if (!sdata)
258 		return;
259 
260 	BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
261 
262 	if (skb->len < rtap_space + sizeof(action) +
263 		       VHT_MUMIMO_GROUPS_DATA_LEN)
264 		return;
265 
266 	if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
267 		return;
268 
269 	skb_copy_bits(skb, rtap_space, &action, sizeof(action));
270 
271 	if (!ieee80211_is_action(action.hdr.frame_control))
272 		return;
273 
274 	if (action.category != WLAN_CATEGORY_VHT)
275 		return;
276 
277 	if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
278 		return;
279 
280 	if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
281 		return;
282 
283 	skb = skb_copy(skb, GFP_ATOMIC);
284 	if (!skb)
285 		return;
286 
287 	ieee80211_queue_skb_to_iface(sdata, -1, NULL, skb);
288 }
289 
290 /*
291  * ieee80211_add_rx_radiotap_header - add radiotap header
292  *
293  * add a radiotap header containing all the fields which the hardware provided.
294  */
295 static void
296 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
297 				 struct sk_buff *skb,
298 				 struct ieee80211_rate *rate,
299 				 int rtap_len, bool has_fcs)
300 {
301 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
302 	struct ieee80211_radiotap_header *rthdr;
303 	unsigned char *pos;
304 	__le32 *it_present;
305 	u32 it_present_val;
306 	u16 rx_flags = 0;
307 	u16 channel_flags = 0;
308 	u32 tlvs_len = 0;
309 	int mpdulen, chain;
310 	unsigned long chains = status->chains;
311 	struct ieee80211_radiotap_he he = {};
312 	struct ieee80211_radiotap_he_mu he_mu = {};
313 	struct ieee80211_radiotap_lsig lsig = {};
314 
315 	if (status->flag & RX_FLAG_RADIOTAP_HE) {
316 		he = *(struct ieee80211_radiotap_he *)skb->data;
317 		skb_pull(skb, sizeof(he));
318 		WARN_ON_ONCE(status->encoding != RX_ENC_HE);
319 	}
320 
321 	if (status->flag & RX_FLAG_RADIOTAP_HE_MU) {
322 		he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data;
323 		skb_pull(skb, sizeof(he_mu));
324 	}
325 
326 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
327 		lsig = *(struct ieee80211_radiotap_lsig *)skb->data;
328 		skb_pull(skb, sizeof(lsig));
329 	}
330 
331 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END) {
332 		/* data is pointer at tlv all other info was pulled off */
333 		tlvs_len = skb_mac_header(skb) - skb->data;
334 	}
335 
336 	mpdulen = skb->len;
337 	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
338 		mpdulen += FCS_LEN;
339 
340 	rthdr = skb_push(skb, rtap_len - tlvs_len);
341 	memset(rthdr, 0, rtap_len - tlvs_len);
342 	it_present = &rthdr->it_present;
343 
344 	/* radiotap header, set always present flags */
345 	rthdr->it_len = cpu_to_le16(rtap_len);
346 	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
347 			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
348 			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
349 
350 	if (!status->chains)
351 		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
352 
353 	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
354 		it_present_val |=
355 			BIT(IEEE80211_RADIOTAP_EXT) |
356 			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
357 		put_unaligned_le32(it_present_val, it_present);
358 		it_present++;
359 		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
360 				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
361 	}
362 
363 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
364 		it_present_val |= BIT(IEEE80211_RADIOTAP_TLV);
365 
366 	put_unaligned_le32(it_present_val, it_present);
367 
368 	/* This references through an offset into it_optional[] rather
369 	 * than via it_present otherwise later uses of pos will cause
370 	 * the compiler to think we have walked past the end of the
371 	 * struct member.
372 	 */
373 	pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional];
374 
375 	/* the order of the following fields is important */
376 
377 	/* IEEE80211_RADIOTAP_TSFT */
378 	if (ieee80211_have_rx_timestamp(status)) {
379 		/* padding */
380 		while ((pos - (u8 *)rthdr) & 7)
381 			*pos++ = 0;
382 		put_unaligned_le64(
383 			ieee80211_calculate_rx_timestamp(local, status,
384 							 mpdulen, 0),
385 			pos);
386 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT));
387 		pos += 8;
388 	}
389 
390 	/* IEEE80211_RADIOTAP_FLAGS */
391 	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
392 		*pos |= IEEE80211_RADIOTAP_F_FCS;
393 	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
394 		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
395 	if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
396 		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
397 	pos++;
398 
399 	/* IEEE80211_RADIOTAP_RATE */
400 	if (!rate || status->encoding != RX_ENC_LEGACY) {
401 		/*
402 		 * Without rate information don't add it. If we have,
403 		 * MCS information is a separate field in radiotap,
404 		 * added below. The byte here is needed as padding
405 		 * for the channel though, so initialise it to 0.
406 		 */
407 		*pos = 0;
408 	} else {
409 		int shift = 0;
410 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE));
411 		if (status->bw == RATE_INFO_BW_10)
412 			shift = 1;
413 		else if (status->bw == RATE_INFO_BW_5)
414 			shift = 2;
415 		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
416 	}
417 	pos++;
418 
419 	/* IEEE80211_RADIOTAP_CHANNEL */
420 	/* TODO: frequency offset in KHz */
421 	put_unaligned_le16(status->freq, pos);
422 	pos += 2;
423 	if (status->bw == RATE_INFO_BW_10)
424 		channel_flags |= IEEE80211_CHAN_HALF;
425 	else if (status->bw == RATE_INFO_BW_5)
426 		channel_flags |= IEEE80211_CHAN_QUARTER;
427 
428 	if (status->band == NL80211_BAND_5GHZ ||
429 	    status->band == NL80211_BAND_6GHZ)
430 		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
431 	else if (status->encoding != RX_ENC_LEGACY)
432 		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
433 	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
434 		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
435 	else if (rate)
436 		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
437 	else
438 		channel_flags |= IEEE80211_CHAN_2GHZ;
439 	put_unaligned_le16(channel_flags, pos);
440 	pos += 2;
441 
442 	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
443 	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
444 	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
445 		*pos = status->signal;
446 		rthdr->it_present |=
447 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL));
448 		pos++;
449 	}
450 
451 	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
452 
453 	if (!status->chains) {
454 		/* IEEE80211_RADIOTAP_ANTENNA */
455 		*pos = status->antenna;
456 		pos++;
457 	}
458 
459 	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
460 
461 	/* IEEE80211_RADIOTAP_RX_FLAGS */
462 	/* ensure 2 byte alignment for the 2 byte field as required */
463 	if ((pos - (u8 *)rthdr) & 1)
464 		*pos++ = 0;
465 	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
466 		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
467 	put_unaligned_le16(rx_flags, pos);
468 	pos += 2;
469 
470 	if (status->encoding == RX_ENC_HT) {
471 		unsigned int stbc;
472 
473 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS));
474 		*pos = local->hw.radiotap_mcs_details;
475 		if (status->enc_flags & RX_ENC_FLAG_HT_GF)
476 			*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT;
477 		if (status->enc_flags & RX_ENC_FLAG_LDPC)
478 			*pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC;
479 		pos++;
480 		*pos = 0;
481 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
482 			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
483 		if (status->bw == RATE_INFO_BW_40)
484 			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
485 		if (status->enc_flags & RX_ENC_FLAG_HT_GF)
486 			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
487 		if (status->enc_flags & RX_ENC_FLAG_LDPC)
488 			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
489 		stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
490 		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
491 		pos++;
492 		*pos++ = status->rate_idx;
493 	}
494 
495 	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
496 		u16 flags = 0;
497 
498 		/* ensure 4 byte alignment */
499 		while ((pos - (u8 *)rthdr) & 3)
500 			pos++;
501 		rthdr->it_present |=
502 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS));
503 		put_unaligned_le32(status->ampdu_reference, pos);
504 		pos += 4;
505 		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
506 			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
507 		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
508 			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
509 		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
510 			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
511 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN)
512 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN;
513 		if (status->flag & RX_FLAG_AMPDU_EOF_BIT)
514 			flags |= IEEE80211_RADIOTAP_AMPDU_EOF;
515 		put_unaligned_le16(flags, pos);
516 		pos += 2;
517 		*pos++ = 0;
518 		*pos++ = 0;
519 	}
520 
521 	if (status->encoding == RX_ENC_VHT) {
522 		u16 known = local->hw.radiotap_vht_details;
523 
524 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT));
525 		put_unaligned_le16(known, pos);
526 		pos += 2;
527 		/* flags */
528 		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
529 			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
530 		/* in VHT, STBC is binary */
531 		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
532 			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
533 		if (status->enc_flags & RX_ENC_FLAG_BF)
534 			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
535 		pos++;
536 		/* bandwidth */
537 		switch (status->bw) {
538 		case RATE_INFO_BW_80:
539 			*pos++ = 4;
540 			break;
541 		case RATE_INFO_BW_160:
542 			*pos++ = 11;
543 			break;
544 		case RATE_INFO_BW_40:
545 			*pos++ = 1;
546 			break;
547 		default:
548 			*pos++ = 0;
549 		}
550 		/* MCS/NSS */
551 		*pos = (status->rate_idx << 4) | status->nss;
552 		pos += 4;
553 		/* coding field */
554 		if (status->enc_flags & RX_ENC_FLAG_LDPC)
555 			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
556 		pos++;
557 		/* group ID */
558 		pos++;
559 		/* partial_aid */
560 		pos += 2;
561 	}
562 
563 	if (local->hw.radiotap_timestamp.units_pos >= 0) {
564 		u16 accuracy = 0;
565 		u8 flags;
566 		u64 ts;
567 
568 		rthdr->it_present |=
569 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP));
570 
571 		/* ensure 8 byte alignment */
572 		while ((pos - (u8 *)rthdr) & 7)
573 			pos++;
574 
575 		if (status->flag & RX_FLAG_MACTIME_IS_RTAP_TS64) {
576 			flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_64BIT;
577 			ts = status->mactime;
578 		} else {
579 			flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
580 			ts = status->device_timestamp;
581 		}
582 
583 		put_unaligned_le64(ts, pos);
584 		pos += sizeof(u64);
585 
586 		if (local->hw.radiotap_timestamp.accuracy >= 0) {
587 			accuracy = local->hw.radiotap_timestamp.accuracy;
588 			flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
589 		}
590 		put_unaligned_le16(accuracy, pos);
591 		pos += sizeof(u16);
592 
593 		*pos++ = local->hw.radiotap_timestamp.units_pos;
594 		*pos++ = flags;
595 	}
596 
597 	if (status->encoding == RX_ENC_HE &&
598 	    status->flag & RX_FLAG_RADIOTAP_HE) {
599 #define HE_PREP(f, val)	le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f)
600 
601 		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) {
602 			he.data6 |= HE_PREP(DATA6_NSTS,
603 					    FIELD_GET(RX_ENC_FLAG_STBC_MASK,
604 						      status->enc_flags));
605 			he.data3 |= HE_PREP(DATA3_STBC, 1);
606 		} else {
607 			he.data6 |= HE_PREP(DATA6_NSTS, status->nss);
608 		}
609 
610 #define CHECK_GI(s) \
611 	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \
612 		     (int)NL80211_RATE_INFO_HE_GI_##s)
613 
614 		CHECK_GI(0_8);
615 		CHECK_GI(1_6);
616 		CHECK_GI(3_2);
617 
618 		he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx);
619 		he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm);
620 		he.data3 |= HE_PREP(DATA3_CODING,
621 				    !!(status->enc_flags & RX_ENC_FLAG_LDPC));
622 
623 		he.data5 |= HE_PREP(DATA5_GI, status->he_gi);
624 
625 		switch (status->bw) {
626 		case RATE_INFO_BW_20:
627 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
628 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ);
629 			break;
630 		case RATE_INFO_BW_40:
631 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
632 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ);
633 			break;
634 		case RATE_INFO_BW_80:
635 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
636 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ);
637 			break;
638 		case RATE_INFO_BW_160:
639 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
640 					    IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ);
641 			break;
642 		case RATE_INFO_BW_HE_RU:
643 #define CHECK_RU_ALLOC(s) \
644 	BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \
645 		     NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4)
646 
647 			CHECK_RU_ALLOC(26);
648 			CHECK_RU_ALLOC(52);
649 			CHECK_RU_ALLOC(106);
650 			CHECK_RU_ALLOC(242);
651 			CHECK_RU_ALLOC(484);
652 			CHECK_RU_ALLOC(996);
653 			CHECK_RU_ALLOC(2x996);
654 
655 			he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC,
656 					    status->he_ru + 4);
657 			break;
658 		default:
659 			WARN_ONCE(1, "Invalid SU BW %d\n", status->bw);
660 		}
661 
662 		/* ensure 2 byte alignment */
663 		while ((pos - (u8 *)rthdr) & 1)
664 			pos++;
665 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE));
666 		memcpy(pos, &he, sizeof(he));
667 		pos += sizeof(he);
668 	}
669 
670 	if (status->encoding == RX_ENC_HE &&
671 	    status->flag & RX_FLAG_RADIOTAP_HE_MU) {
672 		/* ensure 2 byte alignment */
673 		while ((pos - (u8 *)rthdr) & 1)
674 			pos++;
675 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU));
676 		memcpy(pos, &he_mu, sizeof(he_mu));
677 		pos += sizeof(he_mu);
678 	}
679 
680 	if (status->flag & RX_FLAG_NO_PSDU) {
681 		rthdr->it_present |=
682 			cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU));
683 		*pos++ = status->zero_length_psdu_type;
684 	}
685 
686 	if (status->flag & RX_FLAG_RADIOTAP_LSIG) {
687 		/* ensure 2 byte alignment */
688 		while ((pos - (u8 *)rthdr) & 1)
689 			pos++;
690 		rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG));
691 		memcpy(pos, &lsig, sizeof(lsig));
692 		pos += sizeof(lsig);
693 	}
694 
695 	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
696 		*pos++ = status->chain_signal[chain];
697 		*pos++ = chain;
698 	}
699 }
700 
701 static struct sk_buff *
702 ieee80211_make_monitor_skb(struct ieee80211_local *local,
703 			   struct sk_buff **origskb,
704 			   struct ieee80211_rate *rate,
705 			   int rtap_space, bool use_origskb)
706 {
707 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
708 	int rt_hdrlen, needed_headroom;
709 	struct sk_buff *skb;
710 
711 	/* room for the radiotap header based on driver features */
712 	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
713 	needed_headroom = rt_hdrlen - rtap_space;
714 
715 	if (use_origskb) {
716 		/* only need to expand headroom if necessary */
717 		skb = *origskb;
718 		*origskb = NULL;
719 
720 		/*
721 		 * This shouldn't trigger often because most devices have an
722 		 * RX header they pull before we get here, and that should
723 		 * be big enough for our radiotap information. We should
724 		 * probably export the length to drivers so that we can have
725 		 * them allocate enough headroom to start with.
726 		 */
727 		if (skb_headroom(skb) < needed_headroom &&
728 		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
729 			dev_kfree_skb(skb);
730 			return NULL;
731 		}
732 	} else {
733 		/*
734 		 * Need to make a copy and possibly remove radiotap header
735 		 * and FCS from the original.
736 		 */
737 		skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD,
738 				      0, GFP_ATOMIC);
739 
740 		if (!skb)
741 			return NULL;
742 	}
743 
744 	/* prepend radiotap information */
745 	ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
746 
747 	skb_reset_mac_header(skb);
748 	skb->ip_summed = CHECKSUM_UNNECESSARY;
749 	skb->pkt_type = PACKET_OTHERHOST;
750 	skb->protocol = htons(ETH_P_802_2);
751 
752 	return skb;
753 }
754 
755 /*
756  * This function copies a received frame to all monitor interfaces and
757  * returns a cleaned-up SKB that no longer includes the FCS nor the
758  * radiotap header the driver might have added.
759  */
760 static struct sk_buff *
761 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
762 		     struct ieee80211_rate *rate)
763 {
764 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
765 	struct ieee80211_sub_if_data *sdata, *prev_sdata = NULL;
766 	struct sk_buff *skb, *monskb = NULL;
767 	int present_fcs_len = 0;
768 	unsigned int rtap_space = 0;
769 	struct ieee80211_sub_if_data *monitor_sdata =
770 		rcu_dereference(local->monitor_sdata);
771 	bool only_monitor = false;
772 	unsigned int min_head_len;
773 
774 	if (WARN_ON_ONCE(status->flag & RX_FLAG_RADIOTAP_TLV_AT_END &&
775 			 !skb_mac_header_was_set(origskb))) {
776 		/* with this skb no way to know where frame payload starts */
777 		dev_kfree_skb(origskb);
778 		return NULL;
779 	}
780 
781 	if (status->flag & RX_FLAG_RADIOTAP_HE)
782 		rtap_space += sizeof(struct ieee80211_radiotap_he);
783 
784 	if (status->flag & RX_FLAG_RADIOTAP_HE_MU)
785 		rtap_space += sizeof(struct ieee80211_radiotap_he_mu);
786 
787 	if (status->flag & RX_FLAG_RADIOTAP_LSIG)
788 		rtap_space += sizeof(struct ieee80211_radiotap_lsig);
789 
790 	if (status->flag & RX_FLAG_RADIOTAP_TLV_AT_END)
791 		rtap_space += skb_mac_header(origskb) - &origskb->data[rtap_space];
792 
793 	min_head_len = rtap_space;
794 
795 	/*
796 	 * First, we may need to make a copy of the skb because
797 	 *  (1) we need to modify it for radiotap (if not present), and
798 	 *  (2) the other RX handlers will modify the skb we got.
799 	 *
800 	 * We don't need to, of course, if we aren't going to return
801 	 * the SKB because it has a bad FCS/PLCP checksum.
802 	 */
803 
804 	if (!(status->flag & RX_FLAG_NO_PSDU)) {
805 		if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
806 			if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
807 				/* driver bug */
808 				WARN_ON(1);
809 				dev_kfree_skb(origskb);
810 				return NULL;
811 			}
812 			present_fcs_len = FCS_LEN;
813 		}
814 
815 		/* also consider the hdr->frame_control */
816 		min_head_len += 2;
817 	}
818 
819 	/* ensure that the expected data elements are in skb head */
820 	if (!pskb_may_pull(origskb, min_head_len)) {
821 		dev_kfree_skb(origskb);
822 		return NULL;
823 	}
824 
825 	only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space);
826 
827 	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
828 		if (only_monitor) {
829 			dev_kfree_skb(origskb);
830 			return NULL;
831 		}
832 
833 		return ieee80211_clean_skb(origskb, present_fcs_len,
834 					   rtap_space);
835 	}
836 
837 	ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space);
838 
839 	list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
840 		struct cfg80211_chan_def *chandef;
841 
842 		chandef = &sdata->vif.bss_conf.chanreq.oper;
843 		if (chandef->chan &&
844 		    chandef->chan->center_freq != status->freq)
845 			continue;
846 
847 		if (!prev_sdata) {
848 			prev_sdata = sdata;
849 			continue;
850 		}
851 
852 		if (ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR))
853 			ieee80211_handle_mu_mimo_mon(sdata, origskb, rtap_space);
854 
855 		if (!monskb)
856 			monskb = ieee80211_make_monitor_skb(local, &origskb,
857 							    rate, rtap_space,
858 							    false);
859 		if (!monskb)
860 			continue;
861 
862 		skb = skb_clone(monskb, GFP_ATOMIC);
863 		if (!skb)
864 			continue;
865 
866 		skb->dev = prev_sdata->dev;
867 		dev_sw_netstats_rx_add(skb->dev, skb->len);
868 		netif_receive_skb(skb);
869 		prev_sdata = sdata;
870 	}
871 
872 	if (prev_sdata) {
873 		if (monskb)
874 			skb = monskb;
875 		else
876 			skb = ieee80211_make_monitor_skb(local, &origskb,
877 							 rate, rtap_space,
878 							 only_monitor);
879 		if (skb) {
880 			skb->dev = prev_sdata->dev;
881 			dev_sw_netstats_rx_add(skb->dev, skb->len);
882 			netif_receive_skb(skb);
883 		}
884 	}
885 
886 	if (!origskb)
887 		return NULL;
888 
889 	return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space);
890 }
891 
892 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
893 {
894 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
895 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
896 	int tid, seqno_idx, security_idx;
897 
898 	/* does the frame have a qos control field? */
899 	if (ieee80211_is_data_qos(hdr->frame_control)) {
900 		u8 *qc = ieee80211_get_qos_ctl(hdr);
901 		/* frame has qos control */
902 		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
903 		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
904 			status->rx_flags |= IEEE80211_RX_AMSDU;
905 
906 		seqno_idx = tid;
907 		security_idx = tid;
908 	} else {
909 		/*
910 		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
911 		 *
912 		 *	Sequence numbers for management frames, QoS data
913 		 *	frames with a broadcast/multicast address in the
914 		 *	Address 1 field, and all non-QoS data frames sent
915 		 *	by QoS STAs are assigned using an additional single
916 		 *	modulo-4096 counter, [...]
917 		 *
918 		 * We also use that counter for non-QoS STAs.
919 		 */
920 		seqno_idx = IEEE80211_NUM_TIDS;
921 		security_idx = 0;
922 		if (ieee80211_is_mgmt(hdr->frame_control))
923 			security_idx = IEEE80211_NUM_TIDS;
924 		tid = 0;
925 	}
926 
927 	rx->seqno_idx = seqno_idx;
928 	rx->security_idx = security_idx;
929 	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
930 	 * For now, set skb->priority to 0 for other cases. */
931 	rx->skb->priority = (tid > 7) ? 0 : tid;
932 }
933 
934 /**
935  * DOC: Packet alignment
936  *
937  * Drivers always need to pass packets that are aligned to two-byte boundaries
938  * to the stack.
939  *
940  * Additionally, they should, if possible, align the payload data in a way that
941  * guarantees that the contained IP header is aligned to a four-byte
942  * boundary. In the case of regular frames, this simply means aligning the
943  * payload to a four-byte boundary (because either the IP header is directly
944  * contained, or IV/RFC1042 headers that have a length divisible by four are
945  * in front of it).  If the payload data is not properly aligned and the
946  * architecture doesn't support efficient unaligned operations, mac80211
947  * will align the data.
948  *
949  * With A-MSDU frames, however, the payload data address must yield two modulo
950  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
951  * push the IP header further back to a multiple of four again. Thankfully, the
952  * specs were sane enough this time around to require padding each A-MSDU
953  * subframe to a length that is a multiple of four.
954  *
955  * Padding like Atheros hardware adds which is between the 802.11 header and
956  * the payload is not supported; the driver is required to move the 802.11
957  * header to be directly in front of the payload in that case.
958  */
959 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
960 {
961 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
962 	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
963 #endif
964 }
965 
966 
967 /* rx handlers */
968 
969 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
970 {
971 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
972 
973 	if (is_multicast_ether_addr(hdr->addr1))
974 		return 0;
975 
976 	return ieee80211_is_robust_mgmt_frame(skb);
977 }
978 
979 
980 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
981 {
982 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
983 
984 	if (!is_multicast_ether_addr(hdr->addr1))
985 		return 0;
986 
987 	return ieee80211_is_robust_mgmt_frame(skb);
988 }
989 
990 
991 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
992 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
993 {
994 	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
995 	struct ieee80211_mmie *mmie;
996 	struct ieee80211_mmie_16 *mmie16;
997 
998 	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
999 		return -1;
1000 
1001 	if (!ieee80211_is_robust_mgmt_frame(skb) &&
1002 	    !ieee80211_is_beacon(hdr->frame_control))
1003 		return -1; /* not a robust management frame */
1004 
1005 	mmie = (struct ieee80211_mmie *)
1006 		(skb->data + skb->len - sizeof(*mmie));
1007 	if (mmie->element_id == WLAN_EID_MMIE &&
1008 	    mmie->length == sizeof(*mmie) - 2)
1009 		return le16_to_cpu(mmie->key_id);
1010 
1011 	mmie16 = (struct ieee80211_mmie_16 *)
1012 		(skb->data + skb->len - sizeof(*mmie16));
1013 	if (skb->len >= 24 + sizeof(*mmie16) &&
1014 	    mmie16->element_id == WLAN_EID_MMIE &&
1015 	    mmie16->length == sizeof(*mmie16) - 2)
1016 		return le16_to_cpu(mmie16->key_id);
1017 
1018 	return -1;
1019 }
1020 
1021 static int ieee80211_get_keyid(struct sk_buff *skb)
1022 {
1023 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1024 	__le16 fc = hdr->frame_control;
1025 	int hdrlen = ieee80211_hdrlen(fc);
1026 	u8 keyid;
1027 
1028 	/* WEP, TKIP, CCMP and GCMP */
1029 	if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN))
1030 		return -EINVAL;
1031 
1032 	skb_copy_bits(skb, hdrlen + 3, &keyid, 1);
1033 
1034 	keyid >>= 6;
1035 
1036 	return keyid;
1037 }
1038 
1039 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
1040 {
1041 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1042 	char *dev_addr = rx->sdata->vif.addr;
1043 
1044 	if (ieee80211_is_data(hdr->frame_control)) {
1045 		if (is_multicast_ether_addr(hdr->addr1)) {
1046 			if (ieee80211_has_tods(hdr->frame_control) ||
1047 			    !ieee80211_has_fromds(hdr->frame_control))
1048 				return RX_DROP_MONITOR;
1049 			if (ether_addr_equal(hdr->addr3, dev_addr))
1050 				return RX_DROP_MONITOR;
1051 		} else {
1052 			if (!ieee80211_has_a4(hdr->frame_control))
1053 				return RX_DROP_MONITOR;
1054 			if (ether_addr_equal(hdr->addr4, dev_addr))
1055 				return RX_DROP_MONITOR;
1056 		}
1057 	}
1058 
1059 	/* If there is not an established peer link and this is not a peer link
1060 	 * establisment frame, beacon or probe, drop the frame.
1061 	 */
1062 
1063 	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
1064 		struct ieee80211_mgmt *mgmt;
1065 
1066 		if (!ieee80211_is_mgmt(hdr->frame_control))
1067 			return RX_DROP_MONITOR;
1068 
1069 		if (ieee80211_is_action(hdr->frame_control)) {
1070 			u8 category;
1071 
1072 			/* make sure category field is present */
1073 			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
1074 				return RX_DROP_MONITOR;
1075 
1076 			mgmt = (struct ieee80211_mgmt *)hdr;
1077 			category = mgmt->u.action.category;
1078 			if (category != WLAN_CATEGORY_MESH_ACTION &&
1079 			    category != WLAN_CATEGORY_SELF_PROTECTED)
1080 				return RX_DROP_MONITOR;
1081 			return RX_CONTINUE;
1082 		}
1083 
1084 		if (ieee80211_is_probe_req(hdr->frame_control) ||
1085 		    ieee80211_is_probe_resp(hdr->frame_control) ||
1086 		    ieee80211_is_beacon(hdr->frame_control) ||
1087 		    ieee80211_is_auth(hdr->frame_control))
1088 			return RX_CONTINUE;
1089 
1090 		return RX_DROP_MONITOR;
1091 	}
1092 
1093 	return RX_CONTINUE;
1094 }
1095 
1096 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
1097 					      int index)
1098 {
1099 	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
1100 	struct sk_buff *tail = skb_peek_tail(frames);
1101 	struct ieee80211_rx_status *status;
1102 
1103 	if (tid_agg_rx->reorder_buf_filtered &&
1104 	    tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
1105 		return true;
1106 
1107 	if (!tail)
1108 		return false;
1109 
1110 	status = IEEE80211_SKB_RXCB(tail);
1111 	if (status->flag & RX_FLAG_AMSDU_MORE)
1112 		return false;
1113 
1114 	return true;
1115 }
1116 
1117 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1118 					    struct tid_ampdu_rx *tid_agg_rx,
1119 					    int index,
1120 					    struct sk_buff_head *frames)
1121 {
1122 	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
1123 	struct sk_buff *skb;
1124 	struct ieee80211_rx_status *status;
1125 
1126 	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1127 
1128 	if (skb_queue_empty(skb_list))
1129 		goto no_frame;
1130 
1131 	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1132 		__skb_queue_purge(skb_list);
1133 		goto no_frame;
1134 	}
1135 
1136 	/* release frames from the reorder ring buffer */
1137 	tid_agg_rx->stored_mpdu_num--;
1138 	while ((skb = __skb_dequeue(skb_list))) {
1139 		status = IEEE80211_SKB_RXCB(skb);
1140 		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
1141 		__skb_queue_tail(frames, skb);
1142 	}
1143 
1144 no_frame:
1145 	if (tid_agg_rx->reorder_buf_filtered)
1146 		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
1147 	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1148 }
1149 
1150 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1151 					     struct tid_ampdu_rx *tid_agg_rx,
1152 					     u16 head_seq_num,
1153 					     struct sk_buff_head *frames)
1154 {
1155 	int index;
1156 
1157 	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1158 
1159 	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
1160 		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1161 		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1162 						frames);
1163 	}
1164 }
1165 
1166 /*
1167  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
1168  * the skb was added to the buffer longer than this time ago, the earlier
1169  * frames that have not yet been received are assumed to be lost and the skb
1170  * can be released for processing. This may also release other skb's from the
1171  * reorder buffer if there are no additional gaps between the frames.
1172  *
1173  * Callers must hold tid_agg_rx->reorder_lock.
1174  */
1175 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
1176 
1177 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
1178 					  struct tid_ampdu_rx *tid_agg_rx,
1179 					  struct sk_buff_head *frames)
1180 {
1181 	int index, i, j;
1182 
1183 	lockdep_assert_held(&tid_agg_rx->reorder_lock);
1184 
1185 	/* release the buffer until next missing frame */
1186 	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1187 	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
1188 	    tid_agg_rx->stored_mpdu_num) {
1189 		/*
1190 		 * No buffers ready to be released, but check whether any
1191 		 * frames in the reorder buffer have timed out.
1192 		 */
1193 		int skipped = 1;
1194 		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
1195 		     j = (j + 1) % tid_agg_rx->buf_size) {
1196 			if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
1197 				skipped++;
1198 				continue;
1199 			}
1200 			if (skipped &&
1201 			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
1202 					HT_RX_REORDER_BUF_TIMEOUT))
1203 				goto set_release_timer;
1204 
1205 			/* don't leave incomplete A-MSDUs around */
1206 			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
1207 			     i = (i + 1) % tid_agg_rx->buf_size)
1208 				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
1209 
1210 			ht_dbg_ratelimited(sdata,
1211 					   "release an RX reorder frame due to timeout on earlier frames\n");
1212 			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
1213 							frames);
1214 
1215 			/*
1216 			 * Increment the head seq# also for the skipped slots.
1217 			 */
1218 			tid_agg_rx->head_seq_num =
1219 				(tid_agg_rx->head_seq_num +
1220 				 skipped) & IEEE80211_SN_MASK;
1221 			skipped = 0;
1222 		}
1223 	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1224 		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1225 						frames);
1226 		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1227 	}
1228 
1229 	if (tid_agg_rx->stored_mpdu_num) {
1230 		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1231 
1232 		for (; j != (index - 1) % tid_agg_rx->buf_size;
1233 		     j = (j + 1) % tid_agg_rx->buf_size) {
1234 			if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
1235 				break;
1236 		}
1237 
1238  set_release_timer:
1239 
1240 		if (!tid_agg_rx->removed)
1241 			mod_timer(&tid_agg_rx->reorder_timer,
1242 				  tid_agg_rx->reorder_time[j] + 1 +
1243 				  HT_RX_REORDER_BUF_TIMEOUT);
1244 	} else {
1245 		del_timer(&tid_agg_rx->reorder_timer);
1246 	}
1247 }
1248 
1249 /*
1250  * As this function belongs to the RX path it must be under
1251  * rcu_read_lock protection. It returns false if the frame
1252  * can be processed immediately, true if it was consumed.
1253  */
1254 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1255 					     struct tid_ampdu_rx *tid_agg_rx,
1256 					     struct sk_buff *skb,
1257 					     struct sk_buff_head *frames)
1258 {
1259 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1260 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1261 	u16 mpdu_seq_num = ieee80211_get_sn(hdr);
1262 	u16 head_seq_num, buf_size;
1263 	int index;
1264 	bool ret = true;
1265 
1266 	spin_lock(&tid_agg_rx->reorder_lock);
1267 
1268 	/*
1269 	 * Offloaded BA sessions have no known starting sequence number so pick
1270 	 * one from first Rxed frame for this tid after BA was started.
1271 	 */
1272 	if (unlikely(tid_agg_rx->auto_seq)) {
1273 		tid_agg_rx->auto_seq = false;
1274 		tid_agg_rx->ssn = mpdu_seq_num;
1275 		tid_agg_rx->head_seq_num = mpdu_seq_num;
1276 	}
1277 
1278 	buf_size = tid_agg_rx->buf_size;
1279 	head_seq_num = tid_agg_rx->head_seq_num;
1280 
1281 	/*
1282 	 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1283 	 * be reordered.
1284 	 */
1285 	if (unlikely(!tid_agg_rx->started)) {
1286 		if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1287 			ret = false;
1288 			goto out;
1289 		}
1290 		tid_agg_rx->started = true;
1291 	}
1292 
1293 	/* frame with out of date sequence number */
1294 	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1295 		dev_kfree_skb(skb);
1296 		goto out;
1297 	}
1298 
1299 	/*
1300 	 * If frame the sequence number exceeds our buffering window
1301 	 * size release some previous frames to make room for this one.
1302 	 */
1303 	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1304 		head_seq_num = ieee80211_sn_inc(
1305 				ieee80211_sn_sub(mpdu_seq_num, buf_size));
1306 		/* release stored frames up to new head to stack */
1307 		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1308 						 head_seq_num, frames);
1309 	}
1310 
1311 	/* Now the new frame is always in the range of the reordering buffer */
1312 
1313 	index = mpdu_seq_num % tid_agg_rx->buf_size;
1314 
1315 	/* check if we already stored this frame */
1316 	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1317 		dev_kfree_skb(skb);
1318 		goto out;
1319 	}
1320 
1321 	/*
1322 	 * If the current MPDU is in the right order and nothing else
1323 	 * is stored we can process it directly, no need to buffer it.
1324 	 * If it is first but there's something stored, we may be able
1325 	 * to release frames after this one.
1326 	 */
1327 	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1328 	    tid_agg_rx->stored_mpdu_num == 0) {
1329 		if (!(status->flag & RX_FLAG_AMSDU_MORE))
1330 			tid_agg_rx->head_seq_num =
1331 				ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1332 		ret = false;
1333 		goto out;
1334 	}
1335 
1336 	/* put the frame in the reordering buffer */
1337 	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1338 	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1339 		tid_agg_rx->reorder_time[index] = jiffies;
1340 		tid_agg_rx->stored_mpdu_num++;
1341 		ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1342 	}
1343 
1344  out:
1345 	spin_unlock(&tid_agg_rx->reorder_lock);
1346 	return ret;
1347 }
1348 
1349 /*
1350  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1351  * true if the MPDU was buffered, false if it should be processed.
1352  */
1353 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1354 				       struct sk_buff_head *frames)
1355 {
1356 	struct sk_buff *skb = rx->skb;
1357 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1358 	struct sta_info *sta = rx->sta;
1359 	struct tid_ampdu_rx *tid_agg_rx;
1360 	u16 sc;
1361 	u8 tid, ack_policy;
1362 
1363 	if (!ieee80211_is_data_qos(hdr->frame_control) ||
1364 	    is_multicast_ether_addr(hdr->addr1))
1365 		goto dont_reorder;
1366 
1367 	/*
1368 	 * filter the QoS data rx stream according to
1369 	 * STA/TID and check if this STA/TID is on aggregation
1370 	 */
1371 
1372 	if (!sta)
1373 		goto dont_reorder;
1374 
1375 	ack_policy = *ieee80211_get_qos_ctl(hdr) &
1376 		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1377 	tid = ieee80211_get_tid(hdr);
1378 
1379 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1380 	if (!tid_agg_rx) {
1381 		if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1382 		    !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1383 		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1384 			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1385 					     WLAN_BACK_RECIPIENT,
1386 					     WLAN_REASON_QSTA_REQUIRE_SETUP);
1387 		goto dont_reorder;
1388 	}
1389 
1390 	/* qos null data frames are excluded */
1391 	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1392 		goto dont_reorder;
1393 
1394 	/* not part of a BA session */
1395 	if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK)
1396 		goto dont_reorder;
1397 
1398 	/* new, potentially un-ordered, ampdu frame - process it */
1399 
1400 	/* reset session timer */
1401 	if (tid_agg_rx->timeout)
1402 		tid_agg_rx->last_rx = jiffies;
1403 
1404 	/* if this mpdu is fragmented - terminate rx aggregation session */
1405 	sc = le16_to_cpu(hdr->seq_ctrl);
1406 	if (sc & IEEE80211_SCTL_FRAG) {
1407 		ieee80211_queue_skb_to_iface(rx->sdata, rx->link_id, NULL, skb);
1408 		return;
1409 	}
1410 
1411 	/*
1412 	 * No locking needed -- we will only ever process one
1413 	 * RX packet at a time, and thus own tid_agg_rx. All
1414 	 * other code manipulating it needs to (and does) make
1415 	 * sure that we cannot get to it any more before doing
1416 	 * anything with it.
1417 	 */
1418 	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1419 					     frames))
1420 		return;
1421 
1422  dont_reorder:
1423 	__skb_queue_tail(frames, skb);
1424 }
1425 
1426 static ieee80211_rx_result debug_noinline
1427 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1428 {
1429 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1430 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1431 
1432 	if (status->flag & RX_FLAG_DUP_VALIDATED)
1433 		return RX_CONTINUE;
1434 
1435 	/*
1436 	 * Drop duplicate 802.11 retransmissions
1437 	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1438 	 */
1439 
1440 	if (rx->skb->len < 24)
1441 		return RX_CONTINUE;
1442 
1443 	if (ieee80211_is_ctl(hdr->frame_control) ||
1444 	    ieee80211_is_any_nullfunc(hdr->frame_control))
1445 		return RX_CONTINUE;
1446 
1447 	if (!rx->sta)
1448 		return RX_CONTINUE;
1449 
1450 	if (unlikely(is_multicast_ether_addr(hdr->addr1))) {
1451 		struct ieee80211_sub_if_data *sdata = rx->sdata;
1452 		u16 sn = ieee80211_get_sn(hdr);
1453 
1454 		if (!ieee80211_is_data_present(hdr->frame_control))
1455 			return RX_CONTINUE;
1456 
1457 		if (!ieee80211_vif_is_mld(&sdata->vif) ||
1458 		    sdata->vif.type != NL80211_IFTYPE_STATION)
1459 			return RX_CONTINUE;
1460 
1461 		if (sdata->u.mgd.mcast_seq_last != IEEE80211_SN_MODULO &&
1462 		    ieee80211_sn_less_eq(sn, sdata->u.mgd.mcast_seq_last))
1463 			return RX_DROP_U_DUP;
1464 
1465 		sdata->u.mgd.mcast_seq_last = sn;
1466 		return RX_CONTINUE;
1467 	}
1468 
1469 	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1470 		     rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1471 		I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1472 		rx->link_sta->rx_stats.num_duplicates++;
1473 		return RX_DROP_U_DUP;
1474 	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1475 		rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1476 	}
1477 
1478 	return RX_CONTINUE;
1479 }
1480 
1481 static ieee80211_rx_result debug_noinline
1482 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1483 {
1484 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1485 
1486 	/* Drop disallowed frame classes based on STA auth/assoc state;
1487 	 * IEEE 802.11, Chap 5.5.
1488 	 *
1489 	 * mac80211 filters only based on association state, i.e. it drops
1490 	 * Class 3 frames from not associated stations. hostapd sends
1491 	 * deauth/disassoc frames when needed. In addition, hostapd is
1492 	 * responsible for filtering on both auth and assoc states.
1493 	 */
1494 
1495 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1496 		return ieee80211_rx_mesh_check(rx);
1497 
1498 	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1499 		      ieee80211_is_pspoll(hdr->frame_control)) &&
1500 		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1501 		     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1502 		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1503 		/*
1504 		 * accept port control frames from the AP even when it's not
1505 		 * yet marked ASSOC to prevent a race where we don't set the
1506 		 * assoc bit quickly enough before it sends the first frame
1507 		 */
1508 		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1509 		    ieee80211_is_data_present(hdr->frame_control)) {
1510 			unsigned int hdrlen;
1511 			__be16 ethertype;
1512 
1513 			hdrlen = ieee80211_hdrlen(hdr->frame_control);
1514 
1515 			if (rx->skb->len < hdrlen + 8)
1516 				return RX_DROP_MONITOR;
1517 
1518 			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1519 			if (ethertype == rx->sdata->control_port_protocol)
1520 				return RX_CONTINUE;
1521 		}
1522 
1523 		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1524 		    cfg80211_rx_spurious_frame(rx->sdata->dev,
1525 					       hdr->addr2,
1526 					       GFP_ATOMIC))
1527 			return RX_DROP_U_SPURIOUS;
1528 
1529 		return RX_DROP_MONITOR;
1530 	}
1531 
1532 	return RX_CONTINUE;
1533 }
1534 
1535 
1536 static ieee80211_rx_result debug_noinline
1537 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1538 {
1539 	struct ieee80211_local *local;
1540 	struct ieee80211_hdr *hdr;
1541 	struct sk_buff *skb;
1542 
1543 	local = rx->local;
1544 	skb = rx->skb;
1545 	hdr = (struct ieee80211_hdr *) skb->data;
1546 
1547 	if (!local->pspolling)
1548 		return RX_CONTINUE;
1549 
1550 	if (!ieee80211_has_fromds(hdr->frame_control))
1551 		/* this is not from AP */
1552 		return RX_CONTINUE;
1553 
1554 	if (!ieee80211_is_data(hdr->frame_control))
1555 		return RX_CONTINUE;
1556 
1557 	if (!ieee80211_has_moredata(hdr->frame_control)) {
1558 		/* AP has no more frames buffered for us */
1559 		local->pspolling = false;
1560 		return RX_CONTINUE;
1561 	}
1562 
1563 	/* more data bit is set, let's request a new frame from the AP */
1564 	ieee80211_send_pspoll(local, rx->sdata);
1565 
1566 	return RX_CONTINUE;
1567 }
1568 
1569 static void sta_ps_start(struct sta_info *sta)
1570 {
1571 	struct ieee80211_sub_if_data *sdata = sta->sdata;
1572 	struct ieee80211_local *local = sdata->local;
1573 	struct ps_data *ps;
1574 	int tid;
1575 
1576 	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1577 	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1578 		ps = &sdata->bss->ps;
1579 	else
1580 		return;
1581 
1582 	atomic_inc(&ps->num_sta_ps);
1583 	set_sta_flag(sta, WLAN_STA_PS_STA);
1584 	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1585 		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1586 	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1587 	       sta->sta.addr, sta->sta.aid);
1588 
1589 	ieee80211_clear_fast_xmit(sta);
1590 
1591 	for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) {
1592 		struct ieee80211_txq *txq = sta->sta.txq[tid];
1593 		struct txq_info *txqi = to_txq_info(txq);
1594 
1595 		spin_lock(&local->active_txq_lock[txq->ac]);
1596 		if (!list_empty(&txqi->schedule_order))
1597 			list_del_init(&txqi->schedule_order);
1598 		spin_unlock(&local->active_txq_lock[txq->ac]);
1599 
1600 		if (txq_has_queue(txq))
1601 			set_bit(tid, &sta->txq_buffered_tids);
1602 		else
1603 			clear_bit(tid, &sta->txq_buffered_tids);
1604 	}
1605 }
1606 
1607 static void sta_ps_end(struct sta_info *sta)
1608 {
1609 	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1610 	       sta->sta.addr, sta->sta.aid);
1611 
1612 	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1613 		/*
1614 		 * Clear the flag only if the other one is still set
1615 		 * so that the TX path won't start TX'ing new frames
1616 		 * directly ... In the case that the driver flag isn't
1617 		 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1618 		 */
1619 		clear_sta_flag(sta, WLAN_STA_PS_STA);
1620 		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1621 		       sta->sta.addr, sta->sta.aid);
1622 		return;
1623 	}
1624 
1625 	set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1626 	clear_sta_flag(sta, WLAN_STA_PS_STA);
1627 	ieee80211_sta_ps_deliver_wakeup(sta);
1628 }
1629 
1630 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1631 {
1632 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1633 	bool in_ps;
1634 
1635 	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1636 
1637 	/* Don't let the same PS state be set twice */
1638 	in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1639 	if ((start && in_ps) || (!start && !in_ps))
1640 		return -EINVAL;
1641 
1642 	if (start)
1643 		sta_ps_start(sta);
1644 	else
1645 		sta_ps_end(sta);
1646 
1647 	return 0;
1648 }
1649 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1650 
1651 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1652 {
1653 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1654 
1655 	if (test_sta_flag(sta, WLAN_STA_SP))
1656 		return;
1657 
1658 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1659 		ieee80211_sta_ps_deliver_poll_response(sta);
1660 	else
1661 		set_sta_flag(sta, WLAN_STA_PSPOLL);
1662 }
1663 EXPORT_SYMBOL(ieee80211_sta_pspoll);
1664 
1665 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1666 {
1667 	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1668 	int ac = ieee80211_ac_from_tid(tid);
1669 
1670 	/*
1671 	 * If this AC is not trigger-enabled do nothing unless the
1672 	 * driver is calling us after it already checked.
1673 	 *
1674 	 * NB: This could/should check a separate bitmap of trigger-
1675 	 * enabled queues, but for now we only implement uAPSD w/o
1676 	 * TSPEC changes to the ACs, so they're always the same.
1677 	 */
1678 	if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
1679 	    tid != IEEE80211_NUM_TIDS)
1680 		return;
1681 
1682 	/* if we are in a service period, do nothing */
1683 	if (test_sta_flag(sta, WLAN_STA_SP))
1684 		return;
1685 
1686 	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1687 		ieee80211_sta_ps_deliver_uapsd(sta);
1688 	else
1689 		set_sta_flag(sta, WLAN_STA_UAPSD);
1690 }
1691 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1692 
1693 static ieee80211_rx_result debug_noinline
1694 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1695 {
1696 	struct ieee80211_sub_if_data *sdata = rx->sdata;
1697 	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1698 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1699 
1700 	if (!rx->sta)
1701 		return RX_CONTINUE;
1702 
1703 	if (sdata->vif.type != NL80211_IFTYPE_AP &&
1704 	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1705 		return RX_CONTINUE;
1706 
1707 	/*
1708 	 * The device handles station powersave, so don't do anything about
1709 	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1710 	 * it to mac80211 since they're handled.)
1711 	 */
1712 	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1713 		return RX_CONTINUE;
1714 
1715 	/*
1716 	 * Don't do anything if the station isn't already asleep. In
1717 	 * the uAPSD case, the station will probably be marked asleep,
1718 	 * in the PS-Poll case the station must be confused ...
1719 	 */
1720 	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1721 		return RX_CONTINUE;
1722 
1723 	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1724 		ieee80211_sta_pspoll(&rx->sta->sta);
1725 
1726 		/* Free PS Poll skb here instead of returning RX_DROP that would
1727 		 * count as an dropped frame. */
1728 		dev_kfree_skb(rx->skb);
1729 
1730 		return RX_QUEUED;
1731 	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1732 		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1733 		   ieee80211_has_pm(hdr->frame_control) &&
1734 		   (ieee80211_is_data_qos(hdr->frame_control) ||
1735 		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1736 		u8 tid = ieee80211_get_tid(hdr);
1737 
1738 		ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
1739 	}
1740 
1741 	return RX_CONTINUE;
1742 }
1743 
1744 static ieee80211_rx_result debug_noinline
1745 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1746 {
1747 	struct sta_info *sta = rx->sta;
1748 	struct link_sta_info *link_sta = rx->link_sta;
1749 	struct sk_buff *skb = rx->skb;
1750 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1751 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1752 	int i;
1753 
1754 	if (!sta || !link_sta)
1755 		return RX_CONTINUE;
1756 
1757 	/*
1758 	 * Update last_rx only for IBSS packets which are for the current
1759 	 * BSSID and for station already AUTHORIZED to avoid keeping the
1760 	 * current IBSS network alive in cases where other STAs start
1761 	 * using different BSSID. This will also give the station another
1762 	 * chance to restart the authentication/authorization in case
1763 	 * something went wrong the first time.
1764 	 */
1765 	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1766 		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1767 						NL80211_IFTYPE_ADHOC);
1768 		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1769 		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1770 			link_sta->rx_stats.last_rx = jiffies;
1771 			if (ieee80211_is_data_present(hdr->frame_control) &&
1772 			    !is_multicast_ether_addr(hdr->addr1))
1773 				link_sta->rx_stats.last_rate =
1774 					sta_stats_encode_rate(status);
1775 		}
1776 	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1777 		link_sta->rx_stats.last_rx = jiffies;
1778 	} else if (!ieee80211_is_s1g_beacon(hdr->frame_control) &&
1779 		   !is_multicast_ether_addr(hdr->addr1)) {
1780 		/*
1781 		 * Mesh beacons will update last_rx when if they are found to
1782 		 * match the current local configuration when processed.
1783 		 */
1784 		link_sta->rx_stats.last_rx = jiffies;
1785 		if (ieee80211_is_data_present(hdr->frame_control))
1786 			link_sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1787 	}
1788 
1789 	link_sta->rx_stats.fragments++;
1790 
1791 	u64_stats_update_begin(&link_sta->rx_stats.syncp);
1792 	link_sta->rx_stats.bytes += rx->skb->len;
1793 	u64_stats_update_end(&link_sta->rx_stats.syncp);
1794 
1795 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1796 		link_sta->rx_stats.last_signal = status->signal;
1797 		ewma_signal_add(&link_sta->rx_stats_avg.signal,
1798 				-status->signal);
1799 	}
1800 
1801 	if (status->chains) {
1802 		link_sta->rx_stats.chains = status->chains;
1803 		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1804 			int signal = status->chain_signal[i];
1805 
1806 			if (!(status->chains & BIT(i)))
1807 				continue;
1808 
1809 			link_sta->rx_stats.chain_signal_last[i] = signal;
1810 			ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
1811 					-signal);
1812 		}
1813 	}
1814 
1815 	if (ieee80211_is_s1g_beacon(hdr->frame_control))
1816 		return RX_CONTINUE;
1817 
1818 	/*
1819 	 * Change STA power saving mode only at the end of a frame
1820 	 * exchange sequence, and only for a data or management
1821 	 * frame as specified in IEEE 802.11-2016 11.2.3.2
1822 	 */
1823 	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1824 	    !ieee80211_has_morefrags(hdr->frame_control) &&
1825 	    !is_multicast_ether_addr(hdr->addr1) &&
1826 	    (ieee80211_is_mgmt(hdr->frame_control) ||
1827 	     ieee80211_is_data(hdr->frame_control)) &&
1828 	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1829 	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1830 	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
1831 		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1832 			if (!ieee80211_has_pm(hdr->frame_control))
1833 				sta_ps_end(sta);
1834 		} else {
1835 			if (ieee80211_has_pm(hdr->frame_control))
1836 				sta_ps_start(sta);
1837 		}
1838 	}
1839 
1840 	/* mesh power save support */
1841 	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1842 		ieee80211_mps_rx_h_sta_process(sta, hdr);
1843 
1844 	/*
1845 	 * Drop (qos-)data::nullfunc frames silently, since they
1846 	 * are used only to control station power saving mode.
1847 	 */
1848 	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
1849 		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1850 
1851 		/*
1852 		 * If we receive a 4-addr nullfunc frame from a STA
1853 		 * that was not moved to a 4-addr STA vlan yet send
1854 		 * the event to userspace and for older hostapd drop
1855 		 * the frame to the monitor interface.
1856 		 */
1857 		if (ieee80211_has_a4(hdr->frame_control) &&
1858 		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1859 		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1860 		      !rx->sdata->u.vlan.sta))) {
1861 			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1862 				cfg80211_rx_unexpected_4addr_frame(
1863 					rx->sdata->dev, sta->sta.addr,
1864 					GFP_ATOMIC);
1865 			return RX_DROP_M_UNEXPECTED_4ADDR_FRAME;
1866 		}
1867 		/*
1868 		 * Update counter and free packet here to avoid
1869 		 * counting this as a dropped packed.
1870 		 */
1871 		link_sta->rx_stats.packets++;
1872 		dev_kfree_skb(rx->skb);
1873 		return RX_QUEUED;
1874 	}
1875 
1876 	return RX_CONTINUE;
1877 } /* ieee80211_rx_h_sta_process */
1878 
1879 static struct ieee80211_key *
1880 ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx)
1881 {
1882 	struct ieee80211_key *key = NULL;
1883 	int idx2;
1884 
1885 	/* Make sure key gets set if either BIGTK key index is set so that
1886 	 * ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected
1887 	 * Beacon frames and Beacon frames that claim to use another BIGTK key
1888 	 * index (i.e., a key that we do not have).
1889 	 */
1890 
1891 	if (idx < 0) {
1892 		idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS;
1893 		idx2 = idx + 1;
1894 	} else {
1895 		if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1896 			idx2 = idx + 1;
1897 		else
1898 			idx2 = idx - 1;
1899 	}
1900 
1901 	if (rx->link_sta)
1902 		key = rcu_dereference(rx->link_sta->gtk[idx]);
1903 	if (!key)
1904 		key = rcu_dereference(rx->link->gtk[idx]);
1905 	if (!key && rx->link_sta)
1906 		key = rcu_dereference(rx->link_sta->gtk[idx2]);
1907 	if (!key)
1908 		key = rcu_dereference(rx->link->gtk[idx2]);
1909 
1910 	return key;
1911 }
1912 
1913 static ieee80211_rx_result debug_noinline
1914 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1915 {
1916 	struct sk_buff *skb = rx->skb;
1917 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1918 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1919 	int keyidx;
1920 	ieee80211_rx_result result = RX_DROP_U_DECRYPT_FAIL;
1921 	struct ieee80211_key *sta_ptk = NULL;
1922 	struct ieee80211_key *ptk_idx = NULL;
1923 	int mmie_keyidx = -1;
1924 	__le16 fc;
1925 
1926 	if (ieee80211_is_ext(hdr->frame_control))
1927 		return RX_CONTINUE;
1928 
1929 	/*
1930 	 * Key selection 101
1931 	 *
1932 	 * There are five types of keys:
1933 	 *  - GTK (group keys)
1934 	 *  - IGTK (group keys for management frames)
1935 	 *  - BIGTK (group keys for Beacon frames)
1936 	 *  - PTK (pairwise keys)
1937 	 *  - STK (station-to-station pairwise keys)
1938 	 *
1939 	 * When selecting a key, we have to distinguish between multicast
1940 	 * (including broadcast) and unicast frames, the latter can only
1941 	 * use PTKs and STKs while the former always use GTKs, IGTKs, and
1942 	 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used,
1943 	 * then unicast frames can also use key indices like GTKs. Hence, if we
1944 	 * don't have a PTK/STK we check the key index for a WEP key.
1945 	 *
1946 	 * Note that in a regular BSS, multicast frames are sent by the
1947 	 * AP only, associated stations unicast the frame to the AP first
1948 	 * which then multicasts it on their behalf.
1949 	 *
1950 	 * There is also a slight problem in IBSS mode: GTKs are negotiated
1951 	 * with each station, that is something we don't currently handle.
1952 	 * The spec seems to expect that one negotiates the same key with
1953 	 * every station but there's no such requirement; VLANs could be
1954 	 * possible.
1955 	 */
1956 
1957 	/* start without a key */
1958 	rx->key = NULL;
1959 	fc = hdr->frame_control;
1960 
1961 	if (rx->sta) {
1962 		int keyid = rx->sta->ptk_idx;
1963 		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1964 
1965 		if (ieee80211_has_protected(fc) &&
1966 		    !(status->flag & RX_FLAG_IV_STRIPPED)) {
1967 			keyid = ieee80211_get_keyid(rx->skb);
1968 
1969 			if (unlikely(keyid < 0))
1970 				return RX_DROP_U_NO_KEY_ID;
1971 
1972 			ptk_idx = rcu_dereference(rx->sta->ptk[keyid]);
1973 		}
1974 	}
1975 
1976 	if (!ieee80211_has_protected(fc))
1977 		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1978 
1979 	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1980 		rx->key = ptk_idx ? ptk_idx : sta_ptk;
1981 		if ((status->flag & RX_FLAG_DECRYPTED) &&
1982 		    (status->flag & RX_FLAG_IV_STRIPPED))
1983 			return RX_CONTINUE;
1984 		/* Skip decryption if the frame is not protected. */
1985 		if (!ieee80211_has_protected(fc))
1986 			return RX_CONTINUE;
1987 	} else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) {
1988 		/* Broadcast/multicast robust management frame / BIP */
1989 		if ((status->flag & RX_FLAG_DECRYPTED) &&
1990 		    (status->flag & RX_FLAG_IV_STRIPPED))
1991 			return RX_CONTINUE;
1992 
1993 		if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
1994 		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
1995 				   NUM_DEFAULT_BEACON_KEYS) {
1996 			if (rx->sdata->dev)
1997 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
1998 							     skb->data,
1999 							     skb->len);
2000 			return RX_DROP_M_BAD_BCN_KEYIDX;
2001 		}
2002 
2003 		rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx);
2004 		if (!rx->key)
2005 			return RX_CONTINUE; /* Beacon protection not in use */
2006 	} else if (mmie_keyidx >= 0) {
2007 		/* Broadcast/multicast robust management frame / BIP */
2008 		if ((status->flag & RX_FLAG_DECRYPTED) &&
2009 		    (status->flag & RX_FLAG_IV_STRIPPED))
2010 			return RX_CONTINUE;
2011 
2012 		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
2013 		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
2014 			return RX_DROP_M_BAD_MGMT_KEYIDX; /* unexpected BIP keyidx */
2015 		if (rx->link_sta) {
2016 			if (ieee80211_is_group_privacy_action(skb) &&
2017 			    test_sta_flag(rx->sta, WLAN_STA_MFP))
2018 				return RX_DROP_MONITOR;
2019 
2020 			rx->key = rcu_dereference(rx->link_sta->gtk[mmie_keyidx]);
2021 		}
2022 		if (!rx->key)
2023 			rx->key = rcu_dereference(rx->link->gtk[mmie_keyidx]);
2024 	} else if (!ieee80211_has_protected(fc)) {
2025 		/*
2026 		 * The frame was not protected, so skip decryption. However, we
2027 		 * need to set rx->key if there is a key that could have been
2028 		 * used so that the frame may be dropped if encryption would
2029 		 * have been expected.
2030 		 */
2031 		struct ieee80211_key *key = NULL;
2032 		int i;
2033 
2034 		if (ieee80211_is_beacon(fc)) {
2035 			key = ieee80211_rx_get_bigtk(rx, -1);
2036 		} else if (ieee80211_is_mgmt(fc) &&
2037 			   is_multicast_ether_addr(hdr->addr1)) {
2038 			key = rcu_dereference(rx->link->default_mgmt_key);
2039 		} else {
2040 			if (rx->link_sta) {
2041 				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2042 					key = rcu_dereference(rx->link_sta->gtk[i]);
2043 					if (key)
2044 						break;
2045 				}
2046 			}
2047 			if (!key) {
2048 				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
2049 					key = rcu_dereference(rx->link->gtk[i]);
2050 					if (key)
2051 						break;
2052 				}
2053 			}
2054 		}
2055 		if (key)
2056 			rx->key = key;
2057 		return RX_CONTINUE;
2058 	} else {
2059 		/*
2060 		 * The device doesn't give us the IV so we won't be
2061 		 * able to look up the key. That's ok though, we
2062 		 * don't need to decrypt the frame, we just won't
2063 		 * be able to keep statistics accurate.
2064 		 * Except for key threshold notifications, should
2065 		 * we somehow allow the driver to tell us which key
2066 		 * the hardware used if this flag is set?
2067 		 */
2068 		if ((status->flag & RX_FLAG_DECRYPTED) &&
2069 		    (status->flag & RX_FLAG_IV_STRIPPED))
2070 			return RX_CONTINUE;
2071 
2072 		keyidx = ieee80211_get_keyid(rx->skb);
2073 
2074 		if (unlikely(keyidx < 0))
2075 			return RX_DROP_U_NO_KEY_ID;
2076 
2077 		/* check per-station GTK first, if multicast packet */
2078 		if (is_multicast_ether_addr(hdr->addr1) && rx->link_sta)
2079 			rx->key = rcu_dereference(rx->link_sta->gtk[keyidx]);
2080 
2081 		/* if not found, try default key */
2082 		if (!rx->key) {
2083 			if (is_multicast_ether_addr(hdr->addr1))
2084 				rx->key = rcu_dereference(rx->link->gtk[keyidx]);
2085 			if (!rx->key)
2086 				rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
2087 
2088 			/*
2089 			 * RSNA-protected unicast frames should always be
2090 			 * sent with pairwise or station-to-station keys,
2091 			 * but for WEP we allow using a key index as well.
2092 			 */
2093 			if (rx->key &&
2094 			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
2095 			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
2096 			    !is_multicast_ether_addr(hdr->addr1))
2097 				rx->key = NULL;
2098 		}
2099 	}
2100 
2101 	if (rx->key) {
2102 		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
2103 			return RX_DROP_MONITOR;
2104 
2105 		/* TODO: add threshold stuff again */
2106 	} else {
2107 		return RX_DROP_MONITOR;
2108 	}
2109 
2110 	switch (rx->key->conf.cipher) {
2111 	case WLAN_CIPHER_SUITE_WEP40:
2112 	case WLAN_CIPHER_SUITE_WEP104:
2113 		result = ieee80211_crypto_wep_decrypt(rx);
2114 		break;
2115 	case WLAN_CIPHER_SUITE_TKIP:
2116 		result = ieee80211_crypto_tkip_decrypt(rx);
2117 		break;
2118 	case WLAN_CIPHER_SUITE_CCMP:
2119 		result = ieee80211_crypto_ccmp_decrypt(
2120 			rx, IEEE80211_CCMP_MIC_LEN);
2121 		break;
2122 	case WLAN_CIPHER_SUITE_CCMP_256:
2123 		result = ieee80211_crypto_ccmp_decrypt(
2124 			rx, IEEE80211_CCMP_256_MIC_LEN);
2125 		break;
2126 	case WLAN_CIPHER_SUITE_AES_CMAC:
2127 		result = ieee80211_crypto_aes_cmac_decrypt(rx);
2128 		break;
2129 	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
2130 		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
2131 		break;
2132 	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
2133 	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
2134 		result = ieee80211_crypto_aes_gmac_decrypt(rx);
2135 		break;
2136 	case WLAN_CIPHER_SUITE_GCMP:
2137 	case WLAN_CIPHER_SUITE_GCMP_256:
2138 		result = ieee80211_crypto_gcmp_decrypt(rx);
2139 		break;
2140 	default:
2141 		result = RX_DROP_U_BAD_CIPHER;
2142 	}
2143 
2144 	/* the hdr variable is invalid after the decrypt handlers */
2145 
2146 	/* either the frame has been decrypted or will be dropped */
2147 	status->flag |= RX_FLAG_DECRYPTED;
2148 
2149 	if (unlikely(ieee80211_is_beacon(fc) && RX_RES_IS_UNUSABLE(result) &&
2150 		     rx->sdata->dev))
2151 		cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2152 					     skb->data, skb->len);
2153 
2154 	return result;
2155 }
2156 
2157 void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
2158 {
2159 	int i;
2160 
2161 	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2162 		skb_queue_head_init(&cache->entries[i].skb_list);
2163 }
2164 
2165 void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
2166 {
2167 	int i;
2168 
2169 	for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
2170 		__skb_queue_purge(&cache->entries[i].skb_list);
2171 }
2172 
2173 static inline struct ieee80211_fragment_entry *
2174 ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
2175 			 unsigned int frag, unsigned int seq, int rx_queue,
2176 			 struct sk_buff **skb)
2177 {
2178 	struct ieee80211_fragment_entry *entry;
2179 
2180 	entry = &cache->entries[cache->next++];
2181 	if (cache->next >= IEEE80211_FRAGMENT_MAX)
2182 		cache->next = 0;
2183 
2184 	__skb_queue_purge(&entry->skb_list);
2185 
2186 	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
2187 	*skb = NULL;
2188 	entry->first_frag_time = jiffies;
2189 	entry->seq = seq;
2190 	entry->rx_queue = rx_queue;
2191 	entry->last_frag = frag;
2192 	entry->check_sequential_pn = false;
2193 	entry->extra_len = 0;
2194 
2195 	return entry;
2196 }
2197 
2198 static inline struct ieee80211_fragment_entry *
2199 ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
2200 			  unsigned int frag, unsigned int seq,
2201 			  int rx_queue, struct ieee80211_hdr *hdr)
2202 {
2203 	struct ieee80211_fragment_entry *entry;
2204 	int i, idx;
2205 
2206 	idx = cache->next;
2207 	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
2208 		struct ieee80211_hdr *f_hdr;
2209 		struct sk_buff *f_skb;
2210 
2211 		idx--;
2212 		if (idx < 0)
2213 			idx = IEEE80211_FRAGMENT_MAX - 1;
2214 
2215 		entry = &cache->entries[idx];
2216 		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
2217 		    entry->rx_queue != rx_queue ||
2218 		    entry->last_frag + 1 != frag)
2219 			continue;
2220 
2221 		f_skb = __skb_peek(&entry->skb_list);
2222 		f_hdr = (struct ieee80211_hdr *) f_skb->data;
2223 
2224 		/*
2225 		 * Check ftype and addresses are equal, else check next fragment
2226 		 */
2227 		if (((hdr->frame_control ^ f_hdr->frame_control) &
2228 		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
2229 		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
2230 		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
2231 			continue;
2232 
2233 		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
2234 			__skb_queue_purge(&entry->skb_list);
2235 			continue;
2236 		}
2237 		return entry;
2238 	}
2239 
2240 	return NULL;
2241 }
2242 
2243 static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
2244 {
2245 	return rx->key &&
2246 		(rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2247 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
2248 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
2249 		 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2250 		ieee80211_has_protected(fc);
2251 }
2252 
2253 static ieee80211_rx_result debug_noinline
2254 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
2255 {
2256 	struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
2257 	struct ieee80211_hdr *hdr;
2258 	u16 sc;
2259 	__le16 fc;
2260 	unsigned int frag, seq;
2261 	struct ieee80211_fragment_entry *entry;
2262 	struct sk_buff *skb;
2263 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2264 
2265 	hdr = (struct ieee80211_hdr *)rx->skb->data;
2266 	fc = hdr->frame_control;
2267 
2268 	if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc))
2269 		return RX_CONTINUE;
2270 
2271 	sc = le16_to_cpu(hdr->seq_ctrl);
2272 	frag = sc & IEEE80211_SCTL_FRAG;
2273 
2274 	if (rx->sta)
2275 		cache = &rx->sta->frags;
2276 
2277 	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
2278 		goto out;
2279 
2280 	if (is_multicast_ether_addr(hdr->addr1))
2281 		return RX_DROP_MONITOR;
2282 
2283 	I802_DEBUG_INC(rx->local->rx_handlers_fragments);
2284 
2285 	if (skb_linearize(rx->skb))
2286 		return RX_DROP_U_OOM;
2287 
2288 	/*
2289 	 *  skb_linearize() might change the skb->data and
2290 	 *  previously cached variables (in this case, hdr) need to
2291 	 *  be refreshed with the new data.
2292 	 */
2293 	hdr = (struct ieee80211_hdr *)rx->skb->data;
2294 	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
2295 
2296 	if (frag == 0) {
2297 		/* This is the first fragment of a new frame. */
2298 		entry = ieee80211_reassemble_add(cache, frag, seq,
2299 						 rx->seqno_idx, &(rx->skb));
2300 		if (requires_sequential_pn(rx, fc)) {
2301 			int queue = rx->security_idx;
2302 
2303 			/* Store CCMP/GCMP PN so that we can verify that the
2304 			 * next fragment has a sequential PN value.
2305 			 */
2306 			entry->check_sequential_pn = true;
2307 			entry->is_protected = true;
2308 			entry->key_color = rx->key->color;
2309 			memcpy(entry->last_pn,
2310 			       rx->key->u.ccmp.rx_pn[queue],
2311 			       IEEE80211_CCMP_PN_LEN);
2312 			BUILD_BUG_ON(offsetof(struct ieee80211_key,
2313 					      u.ccmp.rx_pn) !=
2314 				     offsetof(struct ieee80211_key,
2315 					      u.gcmp.rx_pn));
2316 			BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2317 				     sizeof(rx->key->u.gcmp.rx_pn[queue]));
2318 			BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2319 				     IEEE80211_GCMP_PN_LEN);
2320 		} else if (rx->key &&
2321 			   (ieee80211_has_protected(fc) ||
2322 			    (status->flag & RX_FLAG_DECRYPTED))) {
2323 			entry->is_protected = true;
2324 			entry->key_color = rx->key->color;
2325 		}
2326 		return RX_QUEUED;
2327 	}
2328 
2329 	/* This is a fragment for a frame that should already be pending in
2330 	 * fragment cache. Add this fragment to the end of the pending entry.
2331 	 */
2332 	entry = ieee80211_reassemble_find(cache, frag, seq,
2333 					  rx->seqno_idx, hdr);
2334 	if (!entry) {
2335 		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2336 		return RX_DROP_MONITOR;
2337 	}
2338 
2339 	/* "The receiver shall discard MSDUs and MMPDUs whose constituent
2340 	 *  MPDU PN values are not incrementing in steps of 1."
2341 	 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2342 	 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2343 	 */
2344 	if (entry->check_sequential_pn) {
2345 		int i;
2346 		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2347 
2348 		if (!requires_sequential_pn(rx, fc))
2349 			return RX_DROP_U_NONSEQ_PN;
2350 
2351 		/* Prevent mixed key and fragment cache attacks */
2352 		if (entry->key_color != rx->key->color)
2353 			return RX_DROP_U_BAD_KEY_COLOR;
2354 
2355 		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2356 		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2357 			pn[i]++;
2358 			if (pn[i])
2359 				break;
2360 		}
2361 
2362 		rpn = rx->ccm_gcm.pn;
2363 		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
2364 			return RX_DROP_U_REPLAY;
2365 		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2366 	} else if (entry->is_protected &&
2367 		   (!rx->key ||
2368 		    (!ieee80211_has_protected(fc) &&
2369 		     !(status->flag & RX_FLAG_DECRYPTED)) ||
2370 		    rx->key->color != entry->key_color)) {
2371 		/* Drop this as a mixed key or fragment cache attack, even
2372 		 * if for TKIP Michael MIC should protect us, and WEP is a
2373 		 * lost cause anyway.
2374 		 */
2375 		return RX_DROP_U_EXPECT_DEFRAG_PROT;
2376 	} else if (entry->is_protected && rx->key &&
2377 		   entry->key_color != rx->key->color &&
2378 		   (status->flag & RX_FLAG_DECRYPTED)) {
2379 		return RX_DROP_U_BAD_KEY_COLOR;
2380 	}
2381 
2382 	skb_pull(rx->skb, ieee80211_hdrlen(fc));
2383 	__skb_queue_tail(&entry->skb_list, rx->skb);
2384 	entry->last_frag = frag;
2385 	entry->extra_len += rx->skb->len;
2386 	if (ieee80211_has_morefrags(fc)) {
2387 		rx->skb = NULL;
2388 		return RX_QUEUED;
2389 	}
2390 
2391 	rx->skb = __skb_dequeue(&entry->skb_list);
2392 	if (skb_tailroom(rx->skb) < entry->extra_len) {
2393 		I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2394 		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2395 					      GFP_ATOMIC))) {
2396 			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2397 			__skb_queue_purge(&entry->skb_list);
2398 			return RX_DROP_U_OOM;
2399 		}
2400 	}
2401 	while ((skb = __skb_dequeue(&entry->skb_list))) {
2402 		skb_put_data(rx->skb, skb->data, skb->len);
2403 		dev_kfree_skb(skb);
2404 	}
2405 
2406  out:
2407 	ieee80211_led_rx(rx->local);
2408 	if (rx->sta)
2409 		rx->link_sta->rx_stats.packets++;
2410 	return RX_CONTINUE;
2411 }
2412 
2413 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2414 {
2415 	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2416 		return -EACCES;
2417 
2418 	return 0;
2419 }
2420 
2421 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2422 {
2423 	struct sk_buff *skb = rx->skb;
2424 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2425 
2426 	/*
2427 	 * Pass through unencrypted frames if the hardware has
2428 	 * decrypted them already.
2429 	 */
2430 	if (status->flag & RX_FLAG_DECRYPTED)
2431 		return 0;
2432 
2433 	/* Drop unencrypted frames if key is set. */
2434 	if (unlikely(!ieee80211_has_protected(fc) &&
2435 		     !ieee80211_is_any_nullfunc(fc) &&
2436 		     ieee80211_is_data(fc) && rx->key))
2437 		return -EACCES;
2438 
2439 	return 0;
2440 }
2441 
2442 VISIBLE_IF_MAC80211_KUNIT ieee80211_rx_result
2443 ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2444 {
2445 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2446 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2447 	__le16 fc = mgmt->frame_control;
2448 
2449 	/*
2450 	 * Pass through unencrypted frames if the hardware has
2451 	 * decrypted them already.
2452 	 */
2453 	if (status->flag & RX_FLAG_DECRYPTED)
2454 		return RX_CONTINUE;
2455 
2456 	/* drop unicast protected dual (that wasn't protected) */
2457 	if (ieee80211_is_action(fc) &&
2458 	    mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION)
2459 		return RX_DROP_U_UNPROT_DUAL;
2460 
2461 	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2462 		if (unlikely(!ieee80211_has_protected(fc) &&
2463 			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb))) {
2464 			if (ieee80211_is_deauth(fc) ||
2465 			    ieee80211_is_disassoc(fc)) {
2466 				/*
2467 				 * Permit unprotected deauth/disassoc frames
2468 				 * during 4-way-HS (key is installed after HS).
2469 				 */
2470 				if (!rx->key)
2471 					return RX_CONTINUE;
2472 
2473 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2474 							     rx->skb->data,
2475 							     rx->skb->len);
2476 			}
2477 			return RX_DROP_U_UNPROT_UCAST_MGMT;
2478 		}
2479 		/* BIP does not use Protected field, so need to check MMIE */
2480 		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2481 			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2482 			if (ieee80211_is_deauth(fc) ||
2483 			    ieee80211_is_disassoc(fc))
2484 				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2485 							     rx->skb->data,
2486 							     rx->skb->len);
2487 			return RX_DROP_U_UNPROT_MCAST_MGMT;
2488 		}
2489 		if (unlikely(ieee80211_is_beacon(fc) && rx->key &&
2490 			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2491 			cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2492 						     rx->skb->data,
2493 						     rx->skb->len);
2494 			return RX_DROP_U_UNPROT_BEACON;
2495 		}
2496 		/*
2497 		 * When using MFP, Action frames are not allowed prior to
2498 		 * having configured keys.
2499 		 */
2500 		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2501 			     ieee80211_is_robust_mgmt_frame(rx->skb)))
2502 			return RX_DROP_U_UNPROT_ACTION;
2503 
2504 		/* drop unicast public action frames when using MPF */
2505 		if (is_unicast_ether_addr(mgmt->da) &&
2506 		    ieee80211_is_protected_dual_of_public_action(rx->skb))
2507 			return RX_DROP_U_UNPROT_UNICAST_PUB_ACTION;
2508 	}
2509 
2510 	/*
2511 	 * Drop robust action frames before assoc regardless of MFP state,
2512 	 * after assoc we also have decided on MFP or not.
2513 	 */
2514 	if (ieee80211_is_action(fc) &&
2515 	    ieee80211_is_robust_mgmt_frame(rx->skb) &&
2516 	    (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))
2517 		return RX_DROP_U_UNPROT_ROBUST_ACTION;
2518 
2519 	return RX_CONTINUE;
2520 }
2521 EXPORT_SYMBOL_IF_MAC80211_KUNIT(ieee80211_drop_unencrypted_mgmt);
2522 
2523 static ieee80211_rx_result
2524 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2525 {
2526 	struct ieee80211_sub_if_data *sdata = rx->sdata;
2527 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2528 	bool check_port_control = false;
2529 	struct ethhdr *ehdr;
2530 	int ret;
2531 
2532 	*port_control = false;
2533 	if (ieee80211_has_a4(hdr->frame_control) &&
2534 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2535 		return RX_DROP_U_UNEXPECTED_VLAN_4ADDR;
2536 
2537 	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2538 	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2539 		if (!sdata->u.mgd.use_4addr)
2540 			return RX_DROP_U_UNEXPECTED_STA_4ADDR;
2541 		else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr))
2542 			check_port_control = true;
2543 	}
2544 
2545 	if (is_multicast_ether_addr(hdr->addr1) &&
2546 	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2547 		return RX_DROP_U_UNEXPECTED_VLAN_MCAST;
2548 
2549 	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2550 	if (ret < 0)
2551 		return RX_DROP_U_INVALID_8023;
2552 
2553 	ehdr = (struct ethhdr *) rx->skb->data;
2554 	if (ehdr->h_proto == rx->sdata->control_port_protocol)
2555 		*port_control = true;
2556 	else if (check_port_control)
2557 		return RX_DROP_U_NOT_PORT_CONTROL;
2558 
2559 	return RX_CONTINUE;
2560 }
2561 
2562 bool ieee80211_is_our_addr(struct ieee80211_sub_if_data *sdata,
2563 			   const u8 *addr, int *out_link_id)
2564 {
2565 	unsigned int link_id;
2566 
2567 	/* non-MLO, or MLD address replaced by hardware */
2568 	if (ether_addr_equal(sdata->vif.addr, addr))
2569 		return true;
2570 
2571 	if (!ieee80211_vif_is_mld(&sdata->vif))
2572 		return false;
2573 
2574 	for (link_id = 0; link_id < ARRAY_SIZE(sdata->vif.link_conf); link_id++) {
2575 		struct ieee80211_bss_conf *conf;
2576 
2577 		conf = rcu_dereference(sdata->vif.link_conf[link_id]);
2578 
2579 		if (!conf)
2580 			continue;
2581 		if (ether_addr_equal(conf->addr, addr)) {
2582 			if (out_link_id)
2583 				*out_link_id = link_id;
2584 			return true;
2585 		}
2586 	}
2587 
2588 	return false;
2589 }
2590 
2591 /*
2592  * requires that rx->skb is a frame with ethernet header
2593  */
2594 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2595 {
2596 	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2597 		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2598 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2599 
2600 	/*
2601 	 * Allow EAPOL frames to us/the PAE group address regardless of
2602 	 * whether the frame was encrypted or not, and always disallow
2603 	 * all other destination addresses for them.
2604 	 */
2605 	if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2606 		return ieee80211_is_our_addr(rx->sdata, ehdr->h_dest, NULL) ||
2607 		       ether_addr_equal(ehdr->h_dest, pae_group_addr);
2608 
2609 	if (ieee80211_802_1x_port_control(rx) ||
2610 	    ieee80211_drop_unencrypted(rx, fc))
2611 		return false;
2612 
2613 	return true;
2614 }
2615 
2616 static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb,
2617 						 struct ieee80211_rx_data *rx)
2618 {
2619 	struct ieee80211_sub_if_data *sdata = rx->sdata;
2620 	struct net_device *dev = sdata->dev;
2621 
2622 	if (unlikely((skb->protocol == sdata->control_port_protocol ||
2623 		     (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) &&
2624 		      !sdata->control_port_no_preauth)) &&
2625 		     sdata->control_port_over_nl80211)) {
2626 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2627 		bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED);
2628 
2629 		cfg80211_rx_control_port(dev, skb, noencrypt, rx->link_id);
2630 		dev_kfree_skb(skb);
2631 	} else {
2632 		struct ethhdr *ehdr = (void *)skb_mac_header(skb);
2633 
2634 		memset(skb->cb, 0, sizeof(skb->cb));
2635 
2636 		/*
2637 		 * 802.1X over 802.11 requires that the authenticator address
2638 		 * be used for EAPOL frames. However, 802.1X allows the use of
2639 		 * the PAE group address instead. If the interface is part of
2640 		 * a bridge and we pass the frame with the PAE group address,
2641 		 * then the bridge will forward it to the network (even if the
2642 		 * client was not associated yet), which isn't supposed to
2643 		 * happen.
2644 		 * To avoid that, rewrite the destination address to our own
2645 		 * address, so that the authenticator (e.g. hostapd) will see
2646 		 * the frame, but bridge won't forward it anywhere else. Note
2647 		 * that due to earlier filtering, the only other address can
2648 		 * be the PAE group address, unless the hardware allowed them
2649 		 * through in 802.3 offloaded mode.
2650 		 */
2651 		if (unlikely(skb->protocol == sdata->control_port_protocol &&
2652 			     !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2653 			ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
2654 
2655 		/* deliver to local stack */
2656 		if (rx->list)
2657 			list_add_tail(&skb->list, rx->list);
2658 		else
2659 			netif_receive_skb(skb);
2660 	}
2661 }
2662 
2663 /*
2664  * requires that rx->skb is a frame with ethernet header
2665  */
2666 static void
2667 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2668 {
2669 	struct ieee80211_sub_if_data *sdata = rx->sdata;
2670 	struct net_device *dev = sdata->dev;
2671 	struct sk_buff *skb, *xmit_skb;
2672 	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2673 	struct sta_info *dsta;
2674 
2675 	skb = rx->skb;
2676 	xmit_skb = NULL;
2677 
2678 	dev_sw_netstats_rx_add(dev, skb->len);
2679 
2680 	if (rx->sta) {
2681 		/* The seqno index has the same property as needed
2682 		 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2683 		 * for non-QoS-data frames. Here we know it's a data
2684 		 * frame, so count MSDUs.
2685 		 */
2686 		u64_stats_update_begin(&rx->link_sta->rx_stats.syncp);
2687 		rx->link_sta->rx_stats.msdu[rx->seqno_idx]++;
2688 		u64_stats_update_end(&rx->link_sta->rx_stats.syncp);
2689 	}
2690 
2691 	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2692 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2693 	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2694 	    ehdr->h_proto != rx->sdata->control_port_protocol &&
2695 	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2696 		if (is_multicast_ether_addr(ehdr->h_dest) &&
2697 		    ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2698 			/*
2699 			 * send multicast frames both to higher layers in
2700 			 * local net stack and back to the wireless medium
2701 			 */
2702 			xmit_skb = skb_copy(skb, GFP_ATOMIC);
2703 			if (!xmit_skb)
2704 				net_info_ratelimited("%s: failed to clone multicast frame\n",
2705 						    dev->name);
2706 		} else if (!is_multicast_ether_addr(ehdr->h_dest) &&
2707 			   !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) {
2708 			dsta = sta_info_get(sdata, ehdr->h_dest);
2709 			if (dsta) {
2710 				/*
2711 				 * The destination station is associated to
2712 				 * this AP (in this VLAN), so send the frame
2713 				 * directly to it and do not pass it to local
2714 				 * net stack.
2715 				 */
2716 				xmit_skb = skb;
2717 				skb = NULL;
2718 			}
2719 		}
2720 	}
2721 
2722 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2723 	if (skb) {
2724 		/* 'align' will only take the values 0 or 2 here since all
2725 		 * frames are required to be aligned to 2-byte boundaries
2726 		 * when being passed to mac80211; the code here works just
2727 		 * as well if that isn't true, but mac80211 assumes it can
2728 		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2729 		 */
2730 		int align;
2731 
2732 		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2733 		if (align) {
2734 			if (WARN_ON(skb_headroom(skb) < 3)) {
2735 				dev_kfree_skb(skb);
2736 				skb = NULL;
2737 			} else {
2738 				u8 *data = skb->data;
2739 				size_t len = skb_headlen(skb);
2740 				skb->data -= align;
2741 				memmove(skb->data, data, len);
2742 				skb_set_tail_pointer(skb, len);
2743 			}
2744 		}
2745 	}
2746 #endif
2747 
2748 	if (skb) {
2749 		skb->protocol = eth_type_trans(skb, dev);
2750 		ieee80211_deliver_skb_to_local_stack(skb, rx);
2751 	}
2752 
2753 	if (xmit_skb) {
2754 		/*
2755 		 * Send to wireless media and increase priority by 256 to
2756 		 * keep the received priority instead of reclassifying
2757 		 * the frame (see cfg80211_classify8021d).
2758 		 */
2759 		xmit_skb->priority += 256;
2760 		xmit_skb->protocol = htons(ETH_P_802_3);
2761 		skb_reset_network_header(xmit_skb);
2762 		skb_reset_mac_header(xmit_skb);
2763 		dev_queue_xmit(xmit_skb);
2764 	}
2765 }
2766 
2767 #ifdef CONFIG_MAC80211_MESH
2768 static bool
2769 ieee80211_rx_mesh_fast_forward(struct ieee80211_sub_if_data *sdata,
2770 			       struct sk_buff *skb, int hdrlen)
2771 {
2772 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2773 	struct ieee80211_mesh_fast_tx_key key = {
2774 		.type = MESH_FAST_TX_TYPE_FORWARDED
2775 	};
2776 	struct ieee80211_mesh_fast_tx *entry;
2777 	struct ieee80211s_hdr *mesh_hdr;
2778 	struct tid_ampdu_tx *tid_tx;
2779 	struct sta_info *sta;
2780 	struct ethhdr eth;
2781 	u8 tid;
2782 
2783 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(eth));
2784 	if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2785 		ether_addr_copy(key.addr, mesh_hdr->eaddr1);
2786 	else if (!(mesh_hdr->flags & MESH_FLAGS_AE))
2787 		ether_addr_copy(key.addr, skb->data);
2788 	else
2789 		return false;
2790 
2791 	entry = mesh_fast_tx_get(sdata, &key);
2792 	if (!entry)
2793 		return false;
2794 
2795 	sta = rcu_dereference(entry->mpath->next_hop);
2796 	if (!sta)
2797 		return false;
2798 
2799 	if (skb_linearize(skb))
2800 		return false;
2801 
2802 	tid = skb->priority & IEEE80211_QOS_CTL_TAG1D_MASK;
2803 	tid_tx = rcu_dereference(sta->ampdu_mlme.tid_tx[tid]);
2804 	if (tid_tx) {
2805 		if (!test_bit(HT_AGG_STATE_OPERATIONAL, &tid_tx->state))
2806 			return false;
2807 
2808 		if (tid_tx->timeout)
2809 			tid_tx->last_tx = jiffies;
2810 	}
2811 
2812 	ieee80211_aggr_check(sdata, sta, skb);
2813 
2814 	if (ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
2815 					    &skb->protocol))
2816 		hdrlen += ETH_ALEN;
2817 	else
2818 		skb->protocol = htons(skb->len - hdrlen);
2819 	skb_set_network_header(skb, hdrlen + 2);
2820 
2821 	skb->dev = sdata->dev;
2822 	memcpy(&eth, skb->data, ETH_HLEN - 2);
2823 	skb_pull(skb, 2);
2824 	__ieee80211_xmit_fast(sdata, sta, &entry->fast_tx, skb, tid_tx,
2825 			      eth.h_dest, eth.h_source);
2826 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2827 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2828 
2829 	return true;
2830 }
2831 #endif
2832 
2833 static ieee80211_rx_result
2834 ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
2835 		       struct sk_buff *skb)
2836 {
2837 #ifdef CONFIG_MAC80211_MESH
2838 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2839 	struct ieee80211_local *local = sdata->local;
2840 	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
2841 	struct ieee80211_hdr hdr = {
2842 		.frame_control = cpu_to_le16(fc)
2843 	};
2844 	struct ieee80211_hdr *fwd_hdr;
2845 	struct ieee80211s_hdr *mesh_hdr;
2846 	struct ieee80211_tx_info *info;
2847 	struct sk_buff *fwd_skb;
2848 	struct ethhdr *eth;
2849 	bool multicast;
2850 	int tailroom = 0;
2851 	int hdrlen, mesh_hdrlen;
2852 	u8 *qos;
2853 
2854 	if (!ieee80211_vif_is_mesh(&sdata->vif))
2855 		return RX_CONTINUE;
2856 
2857 	if (!pskb_may_pull(skb, sizeof(*eth) + 6))
2858 		return RX_DROP_MONITOR;
2859 
2860 	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
2861 	mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
2862 
2863 	if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
2864 		return RX_DROP_MONITOR;
2865 
2866 	eth = (struct ethhdr *)skb->data;
2867 	multicast = is_multicast_ether_addr(eth->h_dest);
2868 
2869 	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
2870 	if (!mesh_hdr->ttl)
2871 		return RX_DROP_MONITOR;
2872 
2873 	/* frame is in RMC, don't forward */
2874 	if (is_multicast_ether_addr(eth->h_dest) &&
2875 	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
2876 		return RX_DROP_MONITOR;
2877 
2878 	/* forward packet */
2879 	if (sdata->crypto_tx_tailroom_needed_cnt)
2880 		tailroom = IEEE80211_ENCRYPT_TAILROOM;
2881 
2882 	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2883 		struct mesh_path *mppath;
2884 		char *proxied_addr;
2885 		bool update = false;
2886 
2887 		if (multicast)
2888 			proxied_addr = mesh_hdr->eaddr1;
2889 		else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
2890 			/* has_a4 already checked in ieee80211_rx_mesh_check */
2891 			proxied_addr = mesh_hdr->eaddr2;
2892 		else
2893 			return RX_DROP_MONITOR;
2894 
2895 		rcu_read_lock();
2896 		mppath = mpp_path_lookup(sdata, proxied_addr);
2897 		if (!mppath) {
2898 			mpp_path_add(sdata, proxied_addr, eth->h_source);
2899 		} else {
2900 			spin_lock_bh(&mppath->state_lock);
2901 			if (!ether_addr_equal(mppath->mpp, eth->h_source)) {
2902 				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
2903 				update = true;
2904 			}
2905 			mppath->exp_time = jiffies;
2906 			spin_unlock_bh(&mppath->state_lock);
2907 		}
2908 
2909 		/* flush fast xmit cache if the address path changed */
2910 		if (update)
2911 			mesh_fast_tx_flush_addr(sdata, proxied_addr);
2912 
2913 		rcu_read_unlock();
2914 	}
2915 
2916 	/* Frame has reached destination.  Don't forward */
2917 	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
2918 		goto rx_accept;
2919 
2920 	if (!--mesh_hdr->ttl) {
2921 		if (multicast)
2922 			goto rx_accept;
2923 
2924 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2925 		return RX_DROP_MONITOR;
2926 	}
2927 
2928 	if (!ifmsh->mshcfg.dot11MeshForwarding) {
2929 		if (is_multicast_ether_addr(eth->h_dest))
2930 			goto rx_accept;
2931 
2932 		return RX_DROP_MONITOR;
2933 	}
2934 
2935 	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
2936 
2937 	if (!multicast &&
2938 	    ieee80211_rx_mesh_fast_forward(sdata, skb, mesh_hdrlen))
2939 		return RX_QUEUED;
2940 
2941 	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
2942 				      eth->h_dest, eth->h_source);
2943 	hdrlen = ieee80211_hdrlen(hdr.frame_control);
2944 	if (multicast) {
2945 		int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
2946 
2947 		fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
2948 					       IEEE80211_ENCRYPT_HEADROOM,
2949 					  tailroom, GFP_ATOMIC);
2950 		if (!fwd_skb)
2951 			goto rx_accept;
2952 	} else {
2953 		fwd_skb = skb;
2954 		skb = NULL;
2955 
2956 		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
2957 			return RX_DROP_U_OOM;
2958 
2959 		if (skb_linearize(fwd_skb))
2960 			return RX_DROP_U_OOM;
2961 	}
2962 
2963 	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
2964 	memcpy(fwd_hdr, &hdr, hdrlen - 2);
2965 	qos = ieee80211_get_qos_ctl(fwd_hdr);
2966 	qos[0] = qos[1] = 0;
2967 
2968 	skb_reset_mac_header(fwd_skb);
2969 	hdrlen += mesh_hdrlen;
2970 	if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
2971 					    &fwd_skb->protocol))
2972 		hdrlen += ETH_ALEN;
2973 	else
2974 		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
2975 	skb_set_network_header(fwd_skb, hdrlen + 2);
2976 
2977 	info = IEEE80211_SKB_CB(fwd_skb);
2978 	memset(info, 0, sizeof(*info));
2979 	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
2980 	info->control.vif = &sdata->vif;
2981 	info->control.jiffies = jiffies;
2982 	fwd_skb->dev = sdata->dev;
2983 	if (multicast) {
2984 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2985 		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2986 		/* update power mode indication when forwarding */
2987 		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2988 	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2989 		/* mesh power mode flags updated in mesh_nexthop_lookup */
2990 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2991 	} else {
2992 		/* unable to resolve next hop */
2993 		if (sta)
2994 			mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2995 					   hdr.addr3, 0,
2996 					   WLAN_REASON_MESH_PATH_NOFORWARD,
2997 					   sta->sta.addr);
2998 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2999 		kfree_skb(fwd_skb);
3000 		goto rx_accept;
3001 	}
3002 
3003 	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
3004 	ieee80211_add_pending_skb(local, fwd_skb);
3005 
3006 rx_accept:
3007 	if (!skb)
3008 		return RX_QUEUED;
3009 
3010 	ieee80211_strip_8023_mesh_hdr(skb);
3011 #endif
3012 
3013 	return RX_CONTINUE;
3014 }
3015 
3016 static ieee80211_rx_result debug_noinline
3017 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
3018 {
3019 	struct net_device *dev = rx->sdata->dev;
3020 	struct sk_buff *skb = rx->skb;
3021 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3022 	__le16 fc = hdr->frame_control;
3023 	struct sk_buff_head frame_list;
3024 	ieee80211_rx_result res;
3025 	struct ethhdr ethhdr;
3026 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
3027 
3028 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3029 		check_da = NULL;
3030 		check_sa = NULL;
3031 	} else switch (rx->sdata->vif.type) {
3032 		case NL80211_IFTYPE_AP:
3033 		case NL80211_IFTYPE_AP_VLAN:
3034 			check_da = NULL;
3035 			break;
3036 		case NL80211_IFTYPE_STATION:
3037 			if (!rx->sta ||
3038 			    !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
3039 				check_sa = NULL;
3040 			break;
3041 		case NL80211_IFTYPE_MESH_POINT:
3042 			check_sa = NULL;
3043 			check_da = NULL;
3044 			break;
3045 		default:
3046 			break;
3047 	}
3048 
3049 	skb->dev = dev;
3050 	__skb_queue_head_init(&frame_list);
3051 
3052 	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
3053 					  rx->sdata->vif.addr,
3054 					  rx->sdata->vif.type,
3055 					  data_offset, true))
3056 		return RX_DROP_U_BAD_AMSDU;
3057 
3058 	if (rx->sta->amsdu_mesh_control < 0) {
3059 		s8 valid = -1;
3060 		int i;
3061 
3062 		for (i = 0; i <= 2; i++) {
3063 			if (!ieee80211_is_valid_amsdu(skb, i))
3064 				continue;
3065 
3066 			if (valid >= 0) {
3067 				/* ambiguous */
3068 				valid = -1;
3069 				break;
3070 			}
3071 
3072 			valid = i;
3073 		}
3074 
3075 		rx->sta->amsdu_mesh_control = valid;
3076 	}
3077 
3078 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
3079 				 rx->sdata->vif.type,
3080 				 rx->local->hw.extra_tx_headroom,
3081 				 check_da, check_sa,
3082 				 rx->sta->amsdu_mesh_control);
3083 
3084 	while (!skb_queue_empty(&frame_list)) {
3085 		rx->skb = __skb_dequeue(&frame_list);
3086 
3087 		res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
3088 		switch (res) {
3089 		case RX_QUEUED:
3090 			continue;
3091 		case RX_CONTINUE:
3092 			break;
3093 		default:
3094 			goto free;
3095 		}
3096 
3097 		if (!ieee80211_frame_allowed(rx, fc))
3098 			goto free;
3099 
3100 		ieee80211_deliver_skb(rx);
3101 		continue;
3102 
3103 free:
3104 		dev_kfree_skb(rx->skb);
3105 	}
3106 
3107 	return RX_QUEUED;
3108 }
3109 
3110 static ieee80211_rx_result debug_noinline
3111 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
3112 {
3113 	struct sk_buff *skb = rx->skb;
3114 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3115 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3116 	__le16 fc = hdr->frame_control;
3117 
3118 	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
3119 		return RX_CONTINUE;
3120 
3121 	if (unlikely(!ieee80211_is_data(fc)))
3122 		return RX_CONTINUE;
3123 
3124 	if (unlikely(!ieee80211_is_data_present(fc)))
3125 		return RX_DROP_MONITOR;
3126 
3127 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
3128 		switch (rx->sdata->vif.type) {
3129 		case NL80211_IFTYPE_AP_VLAN:
3130 			if (!rx->sdata->u.vlan.sta)
3131 				return RX_DROP_U_BAD_4ADDR;
3132 			break;
3133 		case NL80211_IFTYPE_STATION:
3134 			if (!rx->sdata->u.mgd.use_4addr)
3135 				return RX_DROP_U_BAD_4ADDR;
3136 			break;
3137 		case NL80211_IFTYPE_MESH_POINT:
3138 			break;
3139 		default:
3140 			return RX_DROP_U_BAD_4ADDR;
3141 		}
3142 	}
3143 
3144 	if (is_multicast_ether_addr(hdr->addr1) || !rx->sta)
3145 		return RX_DROP_U_BAD_AMSDU;
3146 
3147 	if (rx->key) {
3148 		/*
3149 		 * We should not receive A-MSDUs on pre-HT connections,
3150 		 * and HT connections cannot use old ciphers. Thus drop
3151 		 * them, as in those cases we couldn't even have SPP
3152 		 * A-MSDUs or such.
3153 		 */
3154 		switch (rx->key->conf.cipher) {
3155 		case WLAN_CIPHER_SUITE_WEP40:
3156 		case WLAN_CIPHER_SUITE_WEP104:
3157 		case WLAN_CIPHER_SUITE_TKIP:
3158 			return RX_DROP_U_BAD_AMSDU_CIPHER;
3159 		default:
3160 			break;
3161 		}
3162 	}
3163 
3164 	return __ieee80211_rx_h_amsdu(rx, 0);
3165 }
3166 
3167 static ieee80211_rx_result debug_noinline
3168 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
3169 {
3170 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3171 	struct ieee80211_local *local = rx->local;
3172 	struct net_device *dev = sdata->dev;
3173 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
3174 	__le16 fc = hdr->frame_control;
3175 	ieee80211_rx_result res;
3176 	bool port_control;
3177 
3178 	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
3179 		return RX_CONTINUE;
3180 
3181 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3182 		return RX_DROP_MONITOR;
3183 
3184 	/*
3185 	 * Send unexpected-4addr-frame event to hostapd. For older versions,
3186 	 * also drop the frame to cooked monitor interfaces.
3187 	 */
3188 	if (ieee80211_has_a4(hdr->frame_control) &&
3189 	    sdata->vif.type == NL80211_IFTYPE_AP) {
3190 		if (rx->sta &&
3191 		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
3192 			cfg80211_rx_unexpected_4addr_frame(
3193 				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
3194 		return RX_DROP_MONITOR;
3195 	}
3196 
3197 	res = __ieee80211_data_to_8023(rx, &port_control);
3198 	if (unlikely(res != RX_CONTINUE))
3199 		return res;
3200 
3201 	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
3202 	if (res != RX_CONTINUE)
3203 		return res;
3204 
3205 	if (!ieee80211_frame_allowed(rx, fc))
3206 		return RX_DROP_MONITOR;
3207 
3208 	/* directly handle TDLS channel switch requests/responses */
3209 	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
3210 						cpu_to_be16(ETH_P_TDLS))) {
3211 		struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
3212 
3213 		if (pskb_may_pull(rx->skb,
3214 				  offsetof(struct ieee80211_tdls_data, u)) &&
3215 		    tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
3216 		    tf->category == WLAN_CATEGORY_TDLS &&
3217 		    (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
3218 		     tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
3219 			rx->skb->protocol = cpu_to_be16(ETH_P_TDLS);
3220 			__ieee80211_queue_skb_to_iface(sdata, rx->link_id,
3221 						       rx->sta, rx->skb);
3222 			return RX_QUEUED;
3223 		}
3224 	}
3225 
3226 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
3227 	    unlikely(port_control) && sdata->bss) {
3228 		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
3229 				     u.ap);
3230 		dev = sdata->dev;
3231 		rx->sdata = sdata;
3232 	}
3233 
3234 	rx->skb->dev = dev;
3235 
3236 	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
3237 	    local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
3238 	    !is_multicast_ether_addr(
3239 		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
3240 	    (!local->scanning &&
3241 	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
3242 		mod_timer(&local->dynamic_ps_timer, jiffies +
3243 			  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
3244 
3245 	ieee80211_deliver_skb(rx);
3246 
3247 	return RX_QUEUED;
3248 }
3249 
3250 static ieee80211_rx_result debug_noinline
3251 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
3252 {
3253 	struct sk_buff *skb = rx->skb;
3254 	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
3255 	struct tid_ampdu_rx *tid_agg_rx;
3256 	u16 start_seq_num;
3257 	u16 tid;
3258 
3259 	if (likely(!ieee80211_is_ctl(bar->frame_control)))
3260 		return RX_CONTINUE;
3261 
3262 	if (ieee80211_is_back_req(bar->frame_control)) {
3263 		struct {
3264 			__le16 control, start_seq_num;
3265 		} __packed bar_data;
3266 		struct ieee80211_event event = {
3267 			.type = BAR_RX_EVENT,
3268 		};
3269 
3270 		if (!rx->sta)
3271 			return RX_DROP_MONITOR;
3272 
3273 		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
3274 				  &bar_data, sizeof(bar_data)))
3275 			return RX_DROP_MONITOR;
3276 
3277 		tid = le16_to_cpu(bar_data.control) >> 12;
3278 
3279 		if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
3280 		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
3281 			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
3282 					     WLAN_BACK_RECIPIENT,
3283 					     WLAN_REASON_QSTA_REQUIRE_SETUP);
3284 
3285 		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
3286 		if (!tid_agg_rx)
3287 			return RX_DROP_MONITOR;
3288 
3289 		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
3290 		event.u.ba.tid = tid;
3291 		event.u.ba.ssn = start_seq_num;
3292 		event.u.ba.sta = &rx->sta->sta;
3293 
3294 		/* reset session timer */
3295 		if (tid_agg_rx->timeout)
3296 			mod_timer(&tid_agg_rx->session_timer,
3297 				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
3298 
3299 		spin_lock(&tid_agg_rx->reorder_lock);
3300 		/* release stored frames up to start of BAR */
3301 		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
3302 						 start_seq_num, frames);
3303 		spin_unlock(&tid_agg_rx->reorder_lock);
3304 
3305 		drv_event_callback(rx->local, rx->sdata, &event);
3306 
3307 		kfree_skb(skb);
3308 		return RX_QUEUED;
3309 	}
3310 
3311 	/*
3312 	 * After this point, we only want management frames,
3313 	 * so we can drop all remaining control frames to
3314 	 * cooked monitor interfaces.
3315 	 */
3316 	return RX_DROP_MONITOR;
3317 }
3318 
3319 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
3320 					   struct ieee80211_mgmt *mgmt,
3321 					   size_t len)
3322 {
3323 	struct ieee80211_local *local = sdata->local;
3324 	struct sk_buff *skb;
3325 	struct ieee80211_mgmt *resp;
3326 
3327 	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
3328 		/* Not to own unicast address */
3329 		return;
3330 	}
3331 
3332 	if (!ether_addr_equal(mgmt->sa, sdata->deflink.u.mgd.bssid) ||
3333 	    !ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid)) {
3334 		/* Not from the current AP or not associated yet. */
3335 		return;
3336 	}
3337 
3338 	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
3339 		/* Too short SA Query request frame */
3340 		return;
3341 	}
3342 
3343 	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
3344 	if (skb == NULL)
3345 		return;
3346 
3347 	skb_reserve(skb, local->hw.extra_tx_headroom);
3348 	resp = skb_put_zero(skb, 24);
3349 	memcpy(resp->da, mgmt->sa, ETH_ALEN);
3350 	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
3351 	memcpy(resp->bssid, sdata->deflink.u.mgd.bssid, ETH_ALEN);
3352 	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
3353 					  IEEE80211_STYPE_ACTION);
3354 	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
3355 	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
3356 	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
3357 	memcpy(resp->u.action.u.sa_query.trans_id,
3358 	       mgmt->u.action.u.sa_query.trans_id,
3359 	       WLAN_SA_QUERY_TR_ID_LEN);
3360 
3361 	ieee80211_tx_skb(sdata, skb);
3362 }
3363 
3364 static void
3365 ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx)
3366 {
3367 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3368 	struct ieee80211_bss_conf *bss_conf;
3369 	const struct element *ie;
3370 	size_t baselen;
3371 
3372 	if (!wiphy_ext_feature_isset(rx->local->hw.wiphy,
3373 				     NL80211_EXT_FEATURE_BSS_COLOR))
3374 		return;
3375 
3376 	if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION))
3377 		return;
3378 
3379 	bss_conf = rx->link->conf;
3380 	if (bss_conf->csa_active || bss_conf->color_change_active ||
3381 	    !bss_conf->he_bss_color.enabled)
3382 		return;
3383 
3384 	baselen = mgmt->u.beacon.variable - rx->skb->data;
3385 	if (baselen > rx->skb->len)
3386 		return;
3387 
3388 	ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION,
3389 				    mgmt->u.beacon.variable,
3390 				    rx->skb->len - baselen);
3391 	if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) &&
3392 	    ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) {
3393 		const struct ieee80211_he_operation *he_oper;
3394 		u8 color;
3395 
3396 		he_oper = (void *)(ie->data + 1);
3397 		if (le32_get_bits(he_oper->he_oper_params,
3398 				  IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED))
3399 			return;
3400 
3401 		color = le32_get_bits(he_oper->he_oper_params,
3402 				      IEEE80211_HE_OPERATION_BSS_COLOR_MASK);
3403 		if (color == bss_conf->he_bss_color.color)
3404 			ieee80211_obss_color_collision_notify(&rx->sdata->vif,
3405 							      BIT_ULL(color),
3406 							      bss_conf->link_id);
3407 	}
3408 }
3409 
3410 static ieee80211_rx_result debug_noinline
3411 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
3412 {
3413 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3414 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3415 
3416 	if (ieee80211_is_s1g_beacon(mgmt->frame_control))
3417 		return RX_CONTINUE;
3418 
3419 	/*
3420 	 * From here on, look only at management frames.
3421 	 * Data and control frames are already handled,
3422 	 * and unknown (reserved) frames are useless.
3423 	 */
3424 	if (rx->skb->len < 24)
3425 		return RX_DROP_MONITOR;
3426 
3427 	if (!ieee80211_is_mgmt(mgmt->frame_control))
3428 		return RX_DROP_MONITOR;
3429 
3430 	/* drop too small action frames */
3431 	if (ieee80211_is_action(mgmt->frame_control) &&
3432 	    rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
3433 		return RX_DROP_U_RUNT_ACTION;
3434 
3435 	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
3436 	    ieee80211_is_beacon(mgmt->frame_control) &&
3437 	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
3438 		int sig = 0;
3439 
3440 		/* sw bss color collision detection */
3441 		ieee80211_rx_check_bss_color_collision(rx);
3442 
3443 		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3444 		    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3445 			sig = status->signal;
3446 
3447 		cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy,
3448 						rx->skb->data, rx->skb->len,
3449 						ieee80211_rx_status_to_khz(status),
3450 						sig);
3451 		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
3452 	}
3453 
3454 	return ieee80211_drop_unencrypted_mgmt(rx);
3455 }
3456 
3457 static bool
3458 ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx)
3459 {
3460 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data;
3461 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3462 
3463 	/* TWT actions are only supported in AP for the moment */
3464 	if (sdata->vif.type != NL80211_IFTYPE_AP)
3465 		return false;
3466 
3467 	if (!rx->local->ops->add_twt_setup)
3468 		return false;
3469 
3470 	if (!sdata->vif.bss_conf.twt_responder)
3471 		return false;
3472 
3473 	if (!rx->sta)
3474 		return false;
3475 
3476 	switch (mgmt->u.action.u.s1g.action_code) {
3477 	case WLAN_S1G_TWT_SETUP: {
3478 		struct ieee80211_twt_setup *twt;
3479 
3480 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3481 				   1 + /* action code */
3482 				   sizeof(struct ieee80211_twt_setup) +
3483 				   2 /* TWT req_type agrt */)
3484 			break;
3485 
3486 		twt = (void *)mgmt->u.action.u.s1g.variable;
3487 		if (twt->element_id != WLAN_EID_S1G_TWT)
3488 			break;
3489 
3490 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE +
3491 				   4 + /* action code + token + tlv */
3492 				   twt->length)
3493 			break;
3494 
3495 		return true; /* queue the frame */
3496 	}
3497 	case WLAN_S1G_TWT_TEARDOWN:
3498 		if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2)
3499 			break;
3500 
3501 		return true; /* queue the frame */
3502 	default:
3503 		break;
3504 	}
3505 
3506 	return false;
3507 }
3508 
3509 static ieee80211_rx_result debug_noinline
3510 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
3511 {
3512 	struct ieee80211_local *local = rx->local;
3513 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3514 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3515 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3516 	int len = rx->skb->len;
3517 
3518 	if (!ieee80211_is_action(mgmt->frame_control))
3519 		return RX_CONTINUE;
3520 
3521 	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
3522 	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
3523 	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
3524 		return RX_DROP_U_ACTION_UNKNOWN_SRC;
3525 
3526 	switch (mgmt->u.action.category) {
3527 	case WLAN_CATEGORY_HT:
3528 		/* reject HT action frames from stations not supporting HT */
3529 		if (!rx->link_sta->pub->ht_cap.ht_supported)
3530 			goto invalid;
3531 
3532 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3533 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3534 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3535 		    sdata->vif.type != NL80211_IFTYPE_AP &&
3536 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3537 			break;
3538 
3539 		/* verify action & smps_control/chanwidth are present */
3540 		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3541 			goto invalid;
3542 
3543 		switch (mgmt->u.action.u.ht_smps.action) {
3544 		case WLAN_HT_ACTION_SMPS: {
3545 			struct ieee80211_supported_band *sband;
3546 			enum ieee80211_smps_mode smps_mode;
3547 			struct sta_opmode_info sta_opmode = {};
3548 
3549 			if (sdata->vif.type != NL80211_IFTYPE_AP &&
3550 			    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
3551 				goto handled;
3552 
3553 			/* convert to HT capability */
3554 			switch (mgmt->u.action.u.ht_smps.smps_control) {
3555 			case WLAN_HT_SMPS_CONTROL_DISABLED:
3556 				smps_mode = IEEE80211_SMPS_OFF;
3557 				break;
3558 			case WLAN_HT_SMPS_CONTROL_STATIC:
3559 				smps_mode = IEEE80211_SMPS_STATIC;
3560 				break;
3561 			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
3562 				smps_mode = IEEE80211_SMPS_DYNAMIC;
3563 				break;
3564 			default:
3565 				goto invalid;
3566 			}
3567 
3568 			/* if no change do nothing */
3569 			if (rx->link_sta->pub->smps_mode == smps_mode)
3570 				goto handled;
3571 			rx->link_sta->pub->smps_mode = smps_mode;
3572 			sta_opmode.smps_mode =
3573 				ieee80211_smps_mode_to_smps_mode(smps_mode);
3574 			sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
3575 
3576 			sband = rx->local->hw.wiphy->bands[status->band];
3577 
3578 			rate_control_rate_update(local, sband, rx->link_sta,
3579 						 IEEE80211_RC_SMPS_CHANGED);
3580 			cfg80211_sta_opmode_change_notify(sdata->dev,
3581 							  rx->sta->addr,
3582 							  &sta_opmode,
3583 							  GFP_ATOMIC);
3584 			goto handled;
3585 		}
3586 		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
3587 			struct ieee80211_supported_band *sband;
3588 			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
3589 			enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
3590 			struct sta_opmode_info sta_opmode = {};
3591 
3592 			/* If it doesn't support 40 MHz it can't change ... */
3593 			if (!(rx->link_sta->pub->ht_cap.cap &
3594 					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
3595 				goto handled;
3596 
3597 			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
3598 				max_bw = IEEE80211_STA_RX_BW_20;
3599 			else
3600 				max_bw = ieee80211_sta_cap_rx_bw(rx->link_sta);
3601 
3602 			/* set cur_max_bandwidth and recalc sta bw */
3603 			rx->link_sta->cur_max_bandwidth = max_bw;
3604 			new_bw = ieee80211_sta_cur_vht_bw(rx->link_sta);
3605 
3606 			if (rx->link_sta->pub->bandwidth == new_bw)
3607 				goto handled;
3608 
3609 			rx->link_sta->pub->bandwidth = new_bw;
3610 			sband = rx->local->hw.wiphy->bands[status->band];
3611 			sta_opmode.bw =
3612 				ieee80211_sta_rx_bw_to_chan_width(rx->link_sta);
3613 			sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
3614 
3615 			rate_control_rate_update(local, sband, rx->link_sta,
3616 						 IEEE80211_RC_BW_CHANGED);
3617 			cfg80211_sta_opmode_change_notify(sdata->dev,
3618 							  rx->sta->addr,
3619 							  &sta_opmode,
3620 							  GFP_ATOMIC);
3621 			goto handled;
3622 		}
3623 		default:
3624 			goto invalid;
3625 		}
3626 
3627 		break;
3628 	case WLAN_CATEGORY_PUBLIC:
3629 	case WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION:
3630 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3631 			goto invalid;
3632 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
3633 			break;
3634 		if (!rx->sta)
3635 			break;
3636 		if (!ether_addr_equal(mgmt->bssid, sdata->deflink.u.mgd.bssid))
3637 			break;
3638 		if (mgmt->u.action.u.ext_chan_switch.action_code !=
3639 				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
3640 			break;
3641 		if (len < offsetof(struct ieee80211_mgmt,
3642 				   u.action.u.ext_chan_switch.variable))
3643 			goto invalid;
3644 		goto queue;
3645 	case WLAN_CATEGORY_VHT:
3646 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3647 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3648 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3649 		    sdata->vif.type != NL80211_IFTYPE_AP &&
3650 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3651 			break;
3652 
3653 		/* verify action code is present */
3654 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3655 			goto invalid;
3656 
3657 		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
3658 		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
3659 			/* verify opmode is present */
3660 			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
3661 				goto invalid;
3662 			goto queue;
3663 		}
3664 		case WLAN_VHT_ACTION_GROUPID_MGMT: {
3665 			if (len < IEEE80211_MIN_ACTION_SIZE + 25)
3666 				goto invalid;
3667 			goto queue;
3668 		}
3669 		default:
3670 			break;
3671 		}
3672 		break;
3673 	case WLAN_CATEGORY_BACK:
3674 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3675 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
3676 		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
3677 		    sdata->vif.type != NL80211_IFTYPE_AP &&
3678 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
3679 			break;
3680 
3681 		/* verify action_code is present */
3682 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3683 			break;
3684 
3685 		switch (mgmt->u.action.u.addba_req.action_code) {
3686 		case WLAN_ACTION_ADDBA_REQ:
3687 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3688 				   sizeof(mgmt->u.action.u.addba_req)))
3689 				goto invalid;
3690 			break;
3691 		case WLAN_ACTION_ADDBA_RESP:
3692 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3693 				   sizeof(mgmt->u.action.u.addba_resp)))
3694 				goto invalid;
3695 			break;
3696 		case WLAN_ACTION_DELBA:
3697 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3698 				   sizeof(mgmt->u.action.u.delba)))
3699 				goto invalid;
3700 			break;
3701 		default:
3702 			goto invalid;
3703 		}
3704 
3705 		goto queue;
3706 	case WLAN_CATEGORY_SPECTRUM_MGMT:
3707 		/* verify action_code is present */
3708 		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
3709 			break;
3710 
3711 		switch (mgmt->u.action.u.measurement.action_code) {
3712 		case WLAN_ACTION_SPCT_MSR_REQ:
3713 			if (status->band != NL80211_BAND_5GHZ)
3714 				break;
3715 
3716 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3717 				   sizeof(mgmt->u.action.u.measurement)))
3718 				break;
3719 
3720 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3721 				break;
3722 
3723 			ieee80211_process_measurement_req(sdata, mgmt, len);
3724 			goto handled;
3725 		case WLAN_ACTION_SPCT_CHL_SWITCH: {
3726 			u8 *bssid;
3727 			if (len < (IEEE80211_MIN_ACTION_SIZE +
3728 				   sizeof(mgmt->u.action.u.chan_switch)))
3729 				break;
3730 
3731 			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3732 			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3733 			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3734 				break;
3735 
3736 			if (sdata->vif.type == NL80211_IFTYPE_STATION)
3737 				bssid = sdata->deflink.u.mgd.bssid;
3738 			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3739 				bssid = sdata->u.ibss.bssid;
3740 			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3741 				bssid = mgmt->sa;
3742 			else
3743 				break;
3744 
3745 			if (!ether_addr_equal(mgmt->bssid, bssid))
3746 				break;
3747 
3748 			goto queue;
3749 			}
3750 		}
3751 		break;
3752 	case WLAN_CATEGORY_SELF_PROTECTED:
3753 		if (len < (IEEE80211_MIN_ACTION_SIZE +
3754 			   sizeof(mgmt->u.action.u.self_prot.action_code)))
3755 			break;
3756 
3757 		switch (mgmt->u.action.u.self_prot.action_code) {
3758 		case WLAN_SP_MESH_PEERING_OPEN:
3759 		case WLAN_SP_MESH_PEERING_CLOSE:
3760 		case WLAN_SP_MESH_PEERING_CONFIRM:
3761 			if (!ieee80211_vif_is_mesh(&sdata->vif))
3762 				goto invalid;
3763 			if (sdata->u.mesh.user_mpm)
3764 				/* userspace handles this frame */
3765 				break;
3766 			goto queue;
3767 		case WLAN_SP_MGK_INFORM:
3768 		case WLAN_SP_MGK_ACK:
3769 			if (!ieee80211_vif_is_mesh(&sdata->vif))
3770 				goto invalid;
3771 			break;
3772 		}
3773 		break;
3774 	case WLAN_CATEGORY_MESH_ACTION:
3775 		if (len < (IEEE80211_MIN_ACTION_SIZE +
3776 			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
3777 			break;
3778 
3779 		if (!ieee80211_vif_is_mesh(&sdata->vif))
3780 			break;
3781 		if (mesh_action_is_path_sel(mgmt) &&
3782 		    !mesh_path_sel_is_hwmp(sdata))
3783 			break;
3784 		goto queue;
3785 	case WLAN_CATEGORY_S1G:
3786 		if (len < offsetofend(typeof(*mgmt),
3787 				      u.action.u.s1g.action_code))
3788 			break;
3789 
3790 		switch (mgmt->u.action.u.s1g.action_code) {
3791 		case WLAN_S1G_TWT_SETUP:
3792 		case WLAN_S1G_TWT_TEARDOWN:
3793 			if (ieee80211_process_rx_twt_action(rx))
3794 				goto queue;
3795 			break;
3796 		default:
3797 			break;
3798 		}
3799 		break;
3800 	case WLAN_CATEGORY_PROTECTED_EHT:
3801 		if (len < offsetofend(typeof(*mgmt),
3802 				      u.action.u.ttlm_req.action_code))
3803 			break;
3804 
3805 		switch (mgmt->u.action.u.ttlm_req.action_code) {
3806 		case WLAN_PROTECTED_EHT_ACTION_TTLM_REQ:
3807 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3808 				break;
3809 
3810 			if (len < offsetofend(typeof(*mgmt),
3811 					      u.action.u.ttlm_req))
3812 				goto invalid;
3813 			goto queue;
3814 		case WLAN_PROTECTED_EHT_ACTION_TTLM_RES:
3815 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3816 				break;
3817 
3818 			if (len < offsetofend(typeof(*mgmt),
3819 					      u.action.u.ttlm_res))
3820 				goto invalid;
3821 			goto queue;
3822 		default:
3823 			break;
3824 		}
3825 		break;
3826 	}
3827 
3828 	return RX_CONTINUE;
3829 
3830  invalid:
3831 	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3832 	/* will return in the next handlers */
3833 	return RX_CONTINUE;
3834 
3835  handled:
3836 	if (rx->sta)
3837 		rx->link_sta->rx_stats.packets++;
3838 	dev_kfree_skb(rx->skb);
3839 	return RX_QUEUED;
3840 
3841  queue:
3842 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
3843 	return RX_QUEUED;
3844 }
3845 
3846 static ieee80211_rx_result debug_noinline
3847 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3848 {
3849 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3850 	struct cfg80211_rx_info info = {
3851 		.freq = ieee80211_rx_status_to_khz(status),
3852 		.buf = rx->skb->data,
3853 		.len = rx->skb->len,
3854 		.link_id = rx->link_id,
3855 		.have_link_id = rx->link_id >= 0,
3856 	};
3857 
3858 	/* skip known-bad action frames and return them in the next handler */
3859 	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3860 		return RX_CONTINUE;
3861 
3862 	/*
3863 	 * Getting here means the kernel doesn't know how to handle
3864 	 * it, but maybe userspace does ... include returned frames
3865 	 * so userspace can register for those to know whether ones
3866 	 * it transmitted were processed or returned.
3867 	 */
3868 
3869 	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) &&
3870 	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL))
3871 		info.sig_dbm = status->signal;
3872 
3873 	if (ieee80211_is_timing_measurement(rx->skb) ||
3874 	    ieee80211_is_ftm(rx->skb)) {
3875 		info.rx_tstamp = ktime_to_ns(skb_hwtstamps(rx->skb)->hwtstamp);
3876 		info.ack_tstamp = ktime_to_ns(status->ack_tx_hwtstamp);
3877 	}
3878 
3879 	if (cfg80211_rx_mgmt_ext(&rx->sdata->wdev, &info)) {
3880 		if (rx->sta)
3881 			rx->link_sta->rx_stats.packets++;
3882 		dev_kfree_skb(rx->skb);
3883 		return RX_QUEUED;
3884 	}
3885 
3886 	return RX_CONTINUE;
3887 }
3888 
3889 static ieee80211_rx_result debug_noinline
3890 ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx)
3891 {
3892 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3893 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3894 	int len = rx->skb->len;
3895 
3896 	if (!ieee80211_is_action(mgmt->frame_control))
3897 		return RX_CONTINUE;
3898 
3899 	switch (mgmt->u.action.category) {
3900 	case WLAN_CATEGORY_SA_QUERY:
3901 		if (len < (IEEE80211_MIN_ACTION_SIZE +
3902 			   sizeof(mgmt->u.action.u.sa_query)))
3903 			break;
3904 
3905 		switch (mgmt->u.action.u.sa_query.action) {
3906 		case WLAN_ACTION_SA_QUERY_REQUEST:
3907 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3908 				break;
3909 			ieee80211_process_sa_query_req(sdata, mgmt, len);
3910 			goto handled;
3911 		}
3912 		break;
3913 	}
3914 
3915 	return RX_CONTINUE;
3916 
3917  handled:
3918 	if (rx->sta)
3919 		rx->link_sta->rx_stats.packets++;
3920 	dev_kfree_skb(rx->skb);
3921 	return RX_QUEUED;
3922 }
3923 
3924 static ieee80211_rx_result debug_noinline
3925 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3926 {
3927 	struct ieee80211_local *local = rx->local;
3928 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3929 	struct sk_buff *nskb;
3930 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3931 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3932 
3933 	if (!ieee80211_is_action(mgmt->frame_control))
3934 		return RX_CONTINUE;
3935 
3936 	/*
3937 	 * For AP mode, hostapd is responsible for handling any action
3938 	 * frames that we didn't handle, including returning unknown
3939 	 * ones. For all other modes we will return them to the sender,
3940 	 * setting the 0x80 bit in the action category, as required by
3941 	 * 802.11-2012 9.24.4.
3942 	 * Newer versions of hostapd shall also use the management frame
3943 	 * registration mechanisms, but older ones still use cooked
3944 	 * monitor interfaces so push all frames there.
3945 	 */
3946 	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3947 	    (sdata->vif.type == NL80211_IFTYPE_AP ||
3948 	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3949 		return RX_DROP_MONITOR;
3950 
3951 	if (is_multicast_ether_addr(mgmt->da))
3952 		return RX_DROP_MONITOR;
3953 
3954 	/* do not return rejected action frames */
3955 	if (mgmt->u.action.category & 0x80)
3956 		return RX_DROP_U_REJECTED_ACTION_RESPONSE;
3957 
3958 	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3959 			       GFP_ATOMIC);
3960 	if (nskb) {
3961 		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3962 
3963 		nmgmt->u.action.category |= 0x80;
3964 		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3965 		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3966 
3967 		memset(nskb->cb, 0, sizeof(nskb->cb));
3968 
3969 		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3970 			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3971 
3972 			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3973 				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3974 				      IEEE80211_TX_CTL_NO_CCK_RATE;
3975 			if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3976 				info->hw_queue =
3977 					local->hw.offchannel_tx_hw_queue;
3978 		}
3979 
3980 		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, -1,
3981 					    status->band);
3982 	}
3983 
3984 	return RX_DROP_U_UNKNOWN_ACTION_REJECTED;
3985 }
3986 
3987 static ieee80211_rx_result debug_noinline
3988 ieee80211_rx_h_ext(struct ieee80211_rx_data *rx)
3989 {
3990 	struct ieee80211_sub_if_data *sdata = rx->sdata;
3991 	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
3992 
3993 	if (!ieee80211_is_ext(hdr->frame_control))
3994 		return RX_CONTINUE;
3995 
3996 	if (sdata->vif.type != NL80211_IFTYPE_STATION)
3997 		return RX_DROP_MONITOR;
3998 
3999 	/* for now only beacons are ext, so queue them */
4000 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4001 
4002 	return RX_QUEUED;
4003 }
4004 
4005 static ieee80211_rx_result debug_noinline
4006 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
4007 {
4008 	struct ieee80211_sub_if_data *sdata = rx->sdata;
4009 	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
4010 	__le16 stype;
4011 
4012 	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
4013 
4014 	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
4015 	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4016 	    sdata->vif.type != NL80211_IFTYPE_OCB &&
4017 	    sdata->vif.type != NL80211_IFTYPE_STATION)
4018 		return RX_DROP_MONITOR;
4019 
4020 	switch (stype) {
4021 	case cpu_to_le16(IEEE80211_STYPE_AUTH):
4022 	case cpu_to_le16(IEEE80211_STYPE_BEACON):
4023 	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
4024 		/* process for all: mesh, mlme, ibss */
4025 		break;
4026 	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
4027 		if (is_multicast_ether_addr(mgmt->da) &&
4028 		    !is_broadcast_ether_addr(mgmt->da))
4029 			return RX_DROP_MONITOR;
4030 
4031 		/* process only for station/IBSS */
4032 		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
4033 		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
4034 			return RX_DROP_MONITOR;
4035 		break;
4036 	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
4037 	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
4038 	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
4039 		if (is_multicast_ether_addr(mgmt->da) &&
4040 		    !is_broadcast_ether_addr(mgmt->da))
4041 			return RX_DROP_MONITOR;
4042 
4043 		/* process only for station */
4044 		if (sdata->vif.type != NL80211_IFTYPE_STATION)
4045 			return RX_DROP_MONITOR;
4046 		break;
4047 	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
4048 		/* process only for ibss and mesh */
4049 		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
4050 		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
4051 			return RX_DROP_MONITOR;
4052 		break;
4053 	default:
4054 		return RX_DROP_MONITOR;
4055 	}
4056 
4057 	ieee80211_queue_skb_to_iface(sdata, rx->link_id, rx->sta, rx->skb);
4058 
4059 	return RX_QUEUED;
4060 }
4061 
4062 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
4063 					struct ieee80211_rate *rate,
4064 					ieee80211_rx_result reason)
4065 {
4066 	struct ieee80211_sub_if_data *sdata;
4067 	struct ieee80211_local *local = rx->local;
4068 	struct sk_buff *skb = rx->skb, *skb2;
4069 	struct net_device *prev_dev = NULL;
4070 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4071 	int needed_headroom;
4072 
4073 	/*
4074 	 * If cooked monitor has been processed already, then
4075 	 * don't do it again. If not, set the flag.
4076 	 */
4077 	if (rx->flags & IEEE80211_RX_CMNTR)
4078 		goto out_free_skb;
4079 	rx->flags |= IEEE80211_RX_CMNTR;
4080 
4081 	/* If there are no cooked monitor interfaces, just free the SKB */
4082 	if (!local->cooked_mntrs)
4083 		goto out_free_skb;
4084 
4085 	/* room for the radiotap header based on driver features */
4086 	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
4087 
4088 	if (skb_headroom(skb) < needed_headroom &&
4089 	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
4090 		goto out_free_skb;
4091 
4092 	/* prepend radiotap information */
4093 	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
4094 					 false);
4095 
4096 	skb_reset_mac_header(skb);
4097 	skb->ip_summed = CHECKSUM_UNNECESSARY;
4098 	skb->pkt_type = PACKET_OTHERHOST;
4099 	skb->protocol = htons(ETH_P_802_2);
4100 
4101 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4102 		if (!ieee80211_sdata_running(sdata))
4103 			continue;
4104 
4105 		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
4106 		    !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
4107 			continue;
4108 
4109 		if (prev_dev) {
4110 			skb2 = skb_clone(skb, GFP_ATOMIC);
4111 			if (skb2) {
4112 				skb2->dev = prev_dev;
4113 				netif_receive_skb(skb2);
4114 			}
4115 		}
4116 
4117 		prev_dev = sdata->dev;
4118 		dev_sw_netstats_rx_add(sdata->dev, skb->len);
4119 	}
4120 
4121 	if (prev_dev) {
4122 		skb->dev = prev_dev;
4123 		netif_receive_skb(skb);
4124 		return;
4125 	}
4126 
4127  out_free_skb:
4128 	kfree_skb_reason(skb, (__force u32)reason);
4129 }
4130 
4131 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
4132 					 ieee80211_rx_result res)
4133 {
4134 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4135 	struct ieee80211_supported_band *sband;
4136 	struct ieee80211_rate *rate = NULL;
4137 
4138 	if (res == RX_QUEUED) {
4139 		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
4140 		return;
4141 	}
4142 
4143 	if (res != RX_CONTINUE) {
4144 		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
4145 		if (rx->sta)
4146 			rx->link_sta->rx_stats.dropped++;
4147 	}
4148 
4149 	if (u32_get_bits((__force u32)res, SKB_DROP_REASON_SUBSYS_MASK) ==
4150 			SKB_DROP_REASON_SUBSYS_MAC80211_UNUSABLE) {
4151 		kfree_skb_reason(rx->skb, (__force u32)res);
4152 		return;
4153 	}
4154 
4155 	sband = rx->local->hw.wiphy->bands[status->band];
4156 	if (status->encoding == RX_ENC_LEGACY)
4157 		rate = &sband->bitrates[status->rate_idx];
4158 
4159 	ieee80211_rx_cooked_monitor(rx, rate, res);
4160 }
4161 
4162 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
4163 				  struct sk_buff_head *frames)
4164 {
4165 	ieee80211_rx_result res = RX_DROP_MONITOR;
4166 	struct sk_buff *skb;
4167 
4168 #define CALL_RXH(rxh)			\
4169 	do {				\
4170 		res = rxh(rx);		\
4171 		if (res != RX_CONTINUE)	\
4172 			goto rxh_next;  \
4173 	} while (0)
4174 
4175 	/* Lock here to avoid hitting all of the data used in the RX
4176 	 * path (e.g. key data, station data, ...) concurrently when
4177 	 * a frame is released from the reorder buffer due to timeout
4178 	 * from the timer, potentially concurrently with RX from the
4179 	 * driver.
4180 	 */
4181 	spin_lock_bh(&rx->local->rx_path_lock);
4182 
4183 	while ((skb = __skb_dequeue(frames))) {
4184 		/*
4185 		 * all the other fields are valid across frames
4186 		 * that belong to an aMPDU since they are on the
4187 		 * same TID from the same station
4188 		 */
4189 		rx->skb = skb;
4190 
4191 		if (WARN_ON_ONCE(!rx->link))
4192 			goto rxh_next;
4193 
4194 		CALL_RXH(ieee80211_rx_h_check_more_data);
4195 		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
4196 		CALL_RXH(ieee80211_rx_h_sta_process);
4197 		CALL_RXH(ieee80211_rx_h_decrypt);
4198 		CALL_RXH(ieee80211_rx_h_defragment);
4199 		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
4200 		/* must be after MMIC verify so header is counted in MPDU mic */
4201 		CALL_RXH(ieee80211_rx_h_amsdu);
4202 		CALL_RXH(ieee80211_rx_h_data);
4203 
4204 		/* special treatment -- needs the queue */
4205 		res = ieee80211_rx_h_ctrl(rx, frames);
4206 		if (res != RX_CONTINUE)
4207 			goto rxh_next;
4208 
4209 		CALL_RXH(ieee80211_rx_h_mgmt_check);
4210 		CALL_RXH(ieee80211_rx_h_action);
4211 		CALL_RXH(ieee80211_rx_h_userspace_mgmt);
4212 		CALL_RXH(ieee80211_rx_h_action_post_userspace);
4213 		CALL_RXH(ieee80211_rx_h_action_return);
4214 		CALL_RXH(ieee80211_rx_h_ext);
4215 		CALL_RXH(ieee80211_rx_h_mgmt);
4216 
4217  rxh_next:
4218 		ieee80211_rx_handlers_result(rx, res);
4219 
4220 #undef CALL_RXH
4221 	}
4222 
4223 	spin_unlock_bh(&rx->local->rx_path_lock);
4224 }
4225 
4226 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
4227 {
4228 	struct sk_buff_head reorder_release;
4229 	ieee80211_rx_result res = RX_DROP_MONITOR;
4230 
4231 	__skb_queue_head_init(&reorder_release);
4232 
4233 #define CALL_RXH(rxh)			\
4234 	do {				\
4235 		res = rxh(rx);		\
4236 		if (res != RX_CONTINUE)	\
4237 			goto rxh_next;  \
4238 	} while (0)
4239 
4240 	CALL_RXH(ieee80211_rx_h_check_dup);
4241 	CALL_RXH(ieee80211_rx_h_check);
4242 
4243 	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
4244 
4245 	ieee80211_rx_handlers(rx, &reorder_release);
4246 	return;
4247 
4248  rxh_next:
4249 	ieee80211_rx_handlers_result(rx, res);
4250 
4251 #undef CALL_RXH
4252 }
4253 
4254 static bool
4255 ieee80211_rx_is_valid_sta_link_id(struct ieee80211_sta *sta, u8 link_id)
4256 {
4257 	return !!(sta->valid_links & BIT(link_id));
4258 }
4259 
4260 static bool ieee80211_rx_data_set_link(struct ieee80211_rx_data *rx,
4261 				       u8 link_id)
4262 {
4263 	rx->link_id = link_id;
4264 	rx->link = rcu_dereference(rx->sdata->link[link_id]);
4265 
4266 	if (!rx->sta)
4267 		return rx->link;
4268 
4269 	if (!ieee80211_rx_is_valid_sta_link_id(&rx->sta->sta, link_id))
4270 		return false;
4271 
4272 	rx->link_sta = rcu_dereference(rx->sta->link[link_id]);
4273 
4274 	return rx->link && rx->link_sta;
4275 }
4276 
4277 static bool ieee80211_rx_data_set_sta(struct ieee80211_rx_data *rx,
4278 				      struct sta_info *sta, int link_id)
4279 {
4280 	rx->link_id = link_id;
4281 	rx->sta = sta;
4282 
4283 	if (sta) {
4284 		rx->local = sta->sdata->local;
4285 		if (!rx->sdata)
4286 			rx->sdata = sta->sdata;
4287 		rx->link_sta = &sta->deflink;
4288 	} else {
4289 		rx->link_sta = NULL;
4290 	}
4291 
4292 	if (link_id < 0)
4293 		rx->link = &rx->sdata->deflink;
4294 	else if (!ieee80211_rx_data_set_link(rx, link_id))
4295 		return false;
4296 
4297 	return true;
4298 }
4299 
4300 /*
4301  * This function makes calls into the RX path, therefore
4302  * it has to be invoked under RCU read lock.
4303  */
4304 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
4305 {
4306 	struct sk_buff_head frames;
4307 	struct ieee80211_rx_data rx = {
4308 		/* This is OK -- must be QoS data frame */
4309 		.security_idx = tid,
4310 		.seqno_idx = tid,
4311 	};
4312 	struct tid_ampdu_rx *tid_agg_rx;
4313 	int link_id = -1;
4314 
4315 	/* FIXME: statistics won't be right with this */
4316 	if (sta->sta.valid_links)
4317 		link_id = ffs(sta->sta.valid_links) - 1;
4318 
4319 	if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
4320 		return;
4321 
4322 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4323 	if (!tid_agg_rx)
4324 		return;
4325 
4326 	__skb_queue_head_init(&frames);
4327 
4328 	spin_lock(&tid_agg_rx->reorder_lock);
4329 	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4330 	spin_unlock(&tid_agg_rx->reorder_lock);
4331 
4332 	if (!skb_queue_empty(&frames)) {
4333 		struct ieee80211_event event = {
4334 			.type = BA_FRAME_TIMEOUT,
4335 			.u.ba.tid = tid,
4336 			.u.ba.sta = &sta->sta,
4337 		};
4338 		drv_event_callback(rx.local, rx.sdata, &event);
4339 	}
4340 
4341 	ieee80211_rx_handlers(&rx, &frames);
4342 }
4343 
4344 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
4345 					  u16 ssn, u64 filtered,
4346 					  u16 received_mpdus)
4347 {
4348 	struct ieee80211_local *local;
4349 	struct sta_info *sta;
4350 	struct tid_ampdu_rx *tid_agg_rx;
4351 	struct sk_buff_head frames;
4352 	struct ieee80211_rx_data rx = {
4353 		/* This is OK -- must be QoS data frame */
4354 		.security_idx = tid,
4355 		.seqno_idx = tid,
4356 	};
4357 	int i, diff;
4358 
4359 	if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
4360 		return;
4361 
4362 	__skb_queue_head_init(&frames);
4363 
4364 	sta = container_of(pubsta, struct sta_info, sta);
4365 
4366 	local = sta->sdata->local;
4367 	WARN_ONCE(local->hw.max_rx_aggregation_subframes > 64,
4368 		  "RX BA marker can't support max_rx_aggregation_subframes %u > 64\n",
4369 		  local->hw.max_rx_aggregation_subframes);
4370 
4371 	if (!ieee80211_rx_data_set_sta(&rx, sta, -1))
4372 		return;
4373 
4374 	rcu_read_lock();
4375 	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
4376 	if (!tid_agg_rx)
4377 		goto out;
4378 
4379 	spin_lock_bh(&tid_agg_rx->reorder_lock);
4380 
4381 	if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
4382 		int release;
4383 
4384 		/* release all frames in the reorder buffer */
4385 		release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
4386 			   IEEE80211_SN_MODULO;
4387 		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
4388 						 release, &frames);
4389 		/* update ssn to match received ssn */
4390 		tid_agg_rx->head_seq_num = ssn;
4391 	} else {
4392 		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
4393 						 &frames);
4394 	}
4395 
4396 	/* handle the case that received ssn is behind the mac ssn.
4397 	 * it can be tid_agg_rx->buf_size behind and still be valid */
4398 	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
4399 	if (diff >= tid_agg_rx->buf_size) {
4400 		tid_agg_rx->reorder_buf_filtered = 0;
4401 		goto release;
4402 	}
4403 	filtered = filtered >> diff;
4404 	ssn += diff;
4405 
4406 	/* update bitmap */
4407 	for (i = 0; i < tid_agg_rx->buf_size; i++) {
4408 		int index = (ssn + i) % tid_agg_rx->buf_size;
4409 
4410 		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
4411 		if (filtered & BIT_ULL(i))
4412 			tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
4413 	}
4414 
4415 	/* now process also frames that the filter marking released */
4416 	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
4417 
4418 release:
4419 	spin_unlock_bh(&tid_agg_rx->reorder_lock);
4420 
4421 	ieee80211_rx_handlers(&rx, &frames);
4422 
4423  out:
4424 	rcu_read_unlock();
4425 }
4426 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
4427 
4428 /* main receive path */
4429 
4430 static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
4431 {
4432 	return ether_addr_equal(raddr, addr) ||
4433 	       is_broadcast_ether_addr(raddr);
4434 }
4435 
4436 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
4437 {
4438 	struct ieee80211_sub_if_data *sdata = rx->sdata;
4439 	struct sk_buff *skb = rx->skb;
4440 	struct ieee80211_hdr *hdr = (void *)skb->data;
4441 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4442 	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
4443 	bool multicast = is_multicast_ether_addr(hdr->addr1) ||
4444 			 ieee80211_is_s1g_beacon(hdr->frame_control);
4445 
4446 	switch (sdata->vif.type) {
4447 	case NL80211_IFTYPE_STATION:
4448 		if (!bssid && !sdata->u.mgd.use_4addr)
4449 			return false;
4450 		if (ieee80211_is_first_frag(hdr->seq_ctrl) &&
4451 		    ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
4452 			return false;
4453 		if (multicast)
4454 			return true;
4455 		return ieee80211_is_our_addr(sdata, hdr->addr1, &rx->link_id);
4456 	case NL80211_IFTYPE_ADHOC:
4457 		if (!bssid)
4458 			return false;
4459 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
4460 		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
4461 		    !is_valid_ether_addr(hdr->addr2))
4462 			return false;
4463 		if (ieee80211_is_beacon(hdr->frame_control))
4464 			return true;
4465 		if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
4466 			return false;
4467 		if (!multicast &&
4468 		    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
4469 			return false;
4470 		if (!rx->sta) {
4471 			int rate_idx;
4472 			if (status->encoding != RX_ENC_LEGACY)
4473 				rate_idx = 0; /* TODO: HT/VHT rates */
4474 			else
4475 				rate_idx = status->rate_idx;
4476 			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
4477 						 BIT(rate_idx));
4478 		}
4479 		return true;
4480 	case NL80211_IFTYPE_OCB:
4481 		if (!bssid)
4482 			return false;
4483 		if (!ieee80211_is_data_present(hdr->frame_control))
4484 			return false;
4485 		if (!is_broadcast_ether_addr(bssid))
4486 			return false;
4487 		if (!multicast &&
4488 		    !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
4489 			return false;
4490 		if (!rx->sta) {
4491 			int rate_idx;
4492 			if (status->encoding != RX_ENC_LEGACY)
4493 				rate_idx = 0; /* TODO: HT rates */
4494 			else
4495 				rate_idx = status->rate_idx;
4496 			ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
4497 						BIT(rate_idx));
4498 		}
4499 		return true;
4500 	case NL80211_IFTYPE_MESH_POINT:
4501 		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
4502 			return false;
4503 		if (multicast)
4504 			return true;
4505 		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
4506 	case NL80211_IFTYPE_AP_VLAN:
4507 	case NL80211_IFTYPE_AP:
4508 		if (!bssid)
4509 			return ieee80211_is_our_addr(sdata, hdr->addr1,
4510 						     &rx->link_id);
4511 
4512 		if (!is_broadcast_ether_addr(bssid) &&
4513 		    !ieee80211_is_our_addr(sdata, bssid, NULL)) {
4514 			/*
4515 			 * Accept public action frames even when the
4516 			 * BSSID doesn't match, this is used for P2P
4517 			 * and location updates. Note that mac80211
4518 			 * itself never looks at these frames.
4519 			 */
4520 			if (!multicast &&
4521 			    !ieee80211_is_our_addr(sdata, hdr->addr1,
4522 						   &rx->link_id))
4523 				return false;
4524 			if (ieee80211_is_public_action(hdr, skb->len))
4525 				return true;
4526 			return ieee80211_is_beacon(hdr->frame_control);
4527 		}
4528 
4529 		if (!ieee80211_has_tods(hdr->frame_control)) {
4530 			/* ignore data frames to TDLS-peers */
4531 			if (ieee80211_is_data(hdr->frame_control))
4532 				return false;
4533 			/* ignore action frames to TDLS-peers */
4534 			if (ieee80211_is_action(hdr->frame_control) &&
4535 			    !is_broadcast_ether_addr(bssid) &&
4536 			    !ether_addr_equal(bssid, hdr->addr1))
4537 				return false;
4538 		}
4539 
4540 		/*
4541 		 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
4542 		 * the BSSID - we've checked that already but may have accepted
4543 		 * the wildcard (ff:ff:ff:ff:ff:ff).
4544 		 *
4545 		 * It also says:
4546 		 *	The BSSID of the Data frame is determined as follows:
4547 		 *	a) If the STA is contained within an AP or is associated
4548 		 *	   with an AP, the BSSID is the address currently in use
4549 		 *	   by the STA contained in the AP.
4550 		 *
4551 		 * So we should not accept data frames with an address that's
4552 		 * multicast.
4553 		 *
4554 		 * Accepting it also opens a security problem because stations
4555 		 * could encrypt it with the GTK and inject traffic that way.
4556 		 */
4557 		if (ieee80211_is_data(hdr->frame_control) && multicast)
4558 			return false;
4559 
4560 		return true;
4561 	case NL80211_IFTYPE_P2P_DEVICE:
4562 		return ieee80211_is_public_action(hdr, skb->len) ||
4563 		       ieee80211_is_probe_req(hdr->frame_control) ||
4564 		       ieee80211_is_probe_resp(hdr->frame_control) ||
4565 		       ieee80211_is_beacon(hdr->frame_control);
4566 	case NL80211_IFTYPE_NAN:
4567 		/* Currently no frames on NAN interface are allowed */
4568 		return false;
4569 	default:
4570 		break;
4571 	}
4572 
4573 	WARN_ON_ONCE(1);
4574 	return false;
4575 }
4576 
4577 void ieee80211_check_fast_rx(struct sta_info *sta)
4578 {
4579 	struct ieee80211_sub_if_data *sdata = sta->sdata;
4580 	struct ieee80211_local *local = sdata->local;
4581 	struct ieee80211_key *key;
4582 	struct ieee80211_fast_rx fastrx = {
4583 		.dev = sdata->dev,
4584 		.vif_type = sdata->vif.type,
4585 		.control_port_protocol = sdata->control_port_protocol,
4586 	}, *old, *new = NULL;
4587 	u32 offload_flags;
4588 	bool set_offload = false;
4589 	bool assign = false;
4590 	bool offload;
4591 
4592 	/* use sparse to check that we don't return without updating */
4593 	__acquire(check_fast_rx);
4594 
4595 	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
4596 	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
4597 	ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
4598 	ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
4599 
4600 	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
4601 
4602 	/* fast-rx doesn't do reordering */
4603 	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
4604 	    !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
4605 		goto clear;
4606 
4607 	switch (sdata->vif.type) {
4608 	case NL80211_IFTYPE_STATION:
4609 		if (sta->sta.tdls) {
4610 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4611 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4612 			fastrx.expected_ds_bits = 0;
4613 		} else {
4614 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
4615 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
4616 			fastrx.expected_ds_bits =
4617 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
4618 		}
4619 
4620 		if (sdata->u.mgd.use_4addr && !sta->sta.tdls) {
4621 			fastrx.expected_ds_bits |=
4622 				cpu_to_le16(IEEE80211_FCTL_TODS);
4623 			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4624 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4625 		}
4626 
4627 		if (!sdata->u.mgd.powersave)
4628 			break;
4629 
4630 		/* software powersave is a huge mess, avoid all of it */
4631 		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
4632 			goto clear;
4633 		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
4634 		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
4635 			goto clear;
4636 		break;
4637 	case NL80211_IFTYPE_AP_VLAN:
4638 	case NL80211_IFTYPE_AP:
4639 		/* parallel-rx requires this, at least with calls to
4640 		 * ieee80211_sta_ps_transition()
4641 		 */
4642 		if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
4643 			goto clear;
4644 		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4645 		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
4646 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
4647 
4648 		fastrx.internal_forward =
4649 			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
4650 			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
4651 			 !sdata->u.vlan.sta);
4652 
4653 		if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
4654 		    sdata->u.vlan.sta) {
4655 			fastrx.expected_ds_bits |=
4656 				cpu_to_le16(IEEE80211_FCTL_FROMDS);
4657 			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4658 			fastrx.internal_forward = 0;
4659 		}
4660 
4661 		break;
4662 	case NL80211_IFTYPE_MESH_POINT:
4663 		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_FROMDS |
4664 						      IEEE80211_FCTL_TODS);
4665 		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
4666 		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4);
4667 		break;
4668 	default:
4669 		goto clear;
4670 	}
4671 
4672 	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
4673 		goto clear;
4674 
4675 	rcu_read_lock();
4676 	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
4677 	if (!key)
4678 		key = rcu_dereference(sdata->default_unicast_key);
4679 	if (key) {
4680 		switch (key->conf.cipher) {
4681 		case WLAN_CIPHER_SUITE_TKIP:
4682 			/* we don't want to deal with MMIC in fast-rx */
4683 			goto clear_rcu;
4684 		case WLAN_CIPHER_SUITE_CCMP:
4685 		case WLAN_CIPHER_SUITE_CCMP_256:
4686 		case WLAN_CIPHER_SUITE_GCMP:
4687 		case WLAN_CIPHER_SUITE_GCMP_256:
4688 			break;
4689 		default:
4690 			/* We also don't want to deal with
4691 			 * WEP or cipher scheme.
4692 			 */
4693 			goto clear_rcu;
4694 		}
4695 
4696 		fastrx.key = true;
4697 		fastrx.icv_len = key->conf.icv_len;
4698 	}
4699 
4700 	assign = true;
4701  clear_rcu:
4702 	rcu_read_unlock();
4703  clear:
4704 	__release(check_fast_rx);
4705 
4706 	if (assign)
4707 		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
4708 
4709 	offload_flags = get_bss_sdata(sdata)->vif.offload_flags;
4710 	offload = offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED;
4711 
4712 	if (assign && offload)
4713 		set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4714 	else
4715 		set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD);
4716 
4717 	if (set_offload)
4718 		drv_sta_set_decap_offload(local, sdata, &sta->sta, assign);
4719 
4720 	spin_lock_bh(&sta->lock);
4721 	old = rcu_dereference_protected(sta->fast_rx, true);
4722 	rcu_assign_pointer(sta->fast_rx, new);
4723 	spin_unlock_bh(&sta->lock);
4724 
4725 	if (old)
4726 		kfree_rcu(old, rcu_head);
4727 }
4728 
4729 void ieee80211_clear_fast_rx(struct sta_info *sta)
4730 {
4731 	struct ieee80211_fast_rx *old;
4732 
4733 	spin_lock_bh(&sta->lock);
4734 	old = rcu_dereference_protected(sta->fast_rx, true);
4735 	RCU_INIT_POINTER(sta->fast_rx, NULL);
4736 	spin_unlock_bh(&sta->lock);
4737 
4738 	if (old)
4739 		kfree_rcu(old, rcu_head);
4740 }
4741 
4742 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4743 {
4744 	struct ieee80211_local *local = sdata->local;
4745 	struct sta_info *sta;
4746 
4747 	lockdep_assert_wiphy(local->hw.wiphy);
4748 
4749 	list_for_each_entry(sta, &local->sta_list, list) {
4750 		if (sdata != sta->sdata &&
4751 		    (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
4752 			continue;
4753 		ieee80211_check_fast_rx(sta);
4754 	}
4755 }
4756 
4757 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
4758 {
4759 	struct ieee80211_local *local = sdata->local;
4760 
4761 	lockdep_assert_wiphy(local->hw.wiphy);
4762 
4763 	__ieee80211_check_fast_rx_iface(sdata);
4764 }
4765 
4766 static void ieee80211_rx_8023(struct ieee80211_rx_data *rx,
4767 			      struct ieee80211_fast_rx *fast_rx,
4768 			      int orig_len)
4769 {
4770 	struct ieee80211_sta_rx_stats *stats;
4771 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
4772 	struct sta_info *sta = rx->sta;
4773 	struct link_sta_info *link_sta;
4774 	struct sk_buff *skb = rx->skb;
4775 	void *sa = skb->data + ETH_ALEN;
4776 	void *da = skb->data;
4777 
4778 	if (rx->link_id >= 0) {
4779 		link_sta = rcu_dereference(sta->link[rx->link_id]);
4780 		if (WARN_ON_ONCE(!link_sta)) {
4781 			dev_kfree_skb(rx->skb);
4782 			return;
4783 		}
4784 	} else {
4785 		link_sta = &sta->deflink;
4786 	}
4787 
4788 	stats = &link_sta->rx_stats;
4789 	if (fast_rx->uses_rss)
4790 		stats = this_cpu_ptr(link_sta->pcpu_rx_stats);
4791 
4792 	/* statistics part of ieee80211_rx_h_sta_process() */
4793 	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
4794 		stats->last_signal = status->signal;
4795 		if (!fast_rx->uses_rss)
4796 			ewma_signal_add(&link_sta->rx_stats_avg.signal,
4797 					-status->signal);
4798 	}
4799 
4800 	if (status->chains) {
4801 		int i;
4802 
4803 		stats->chains = status->chains;
4804 		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
4805 			int signal = status->chain_signal[i];
4806 
4807 			if (!(status->chains & BIT(i)))
4808 				continue;
4809 
4810 			stats->chain_signal_last[i] = signal;
4811 			if (!fast_rx->uses_rss)
4812 				ewma_signal_add(&link_sta->rx_stats_avg.chain_signal[i],
4813 						-signal);
4814 		}
4815 	}
4816 	/* end of statistics */
4817 
4818 	stats->last_rx = jiffies;
4819 	stats->last_rate = sta_stats_encode_rate(status);
4820 
4821 	stats->fragments++;
4822 	stats->packets++;
4823 
4824 	skb->dev = fast_rx->dev;
4825 
4826 	dev_sw_netstats_rx_add(fast_rx->dev, skb->len);
4827 
4828 	/* The seqno index has the same property as needed
4829 	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
4830 	 * for non-QoS-data frames. Here we know it's a data
4831 	 * frame, so count MSDUs.
4832 	 */
4833 	u64_stats_update_begin(&stats->syncp);
4834 	stats->msdu[rx->seqno_idx]++;
4835 	stats->bytes += orig_len;
4836 	u64_stats_update_end(&stats->syncp);
4837 
4838 	if (fast_rx->internal_forward) {
4839 		struct sk_buff *xmit_skb = NULL;
4840 		if (is_multicast_ether_addr(da)) {
4841 			xmit_skb = skb_copy(skb, GFP_ATOMIC);
4842 		} else if (!ether_addr_equal(da, sa) &&
4843 			   sta_info_get(rx->sdata, da)) {
4844 			xmit_skb = skb;
4845 			skb = NULL;
4846 		}
4847 
4848 		if (xmit_skb) {
4849 			/*
4850 			 * Send to wireless media and increase priority by 256
4851 			 * to keep the received priority instead of
4852 			 * reclassifying the frame (see cfg80211_classify8021d).
4853 			 */
4854 			xmit_skb->priority += 256;
4855 			xmit_skb->protocol = htons(ETH_P_802_3);
4856 			skb_reset_network_header(xmit_skb);
4857 			skb_reset_mac_header(xmit_skb);
4858 			dev_queue_xmit(xmit_skb);
4859 		}
4860 
4861 		if (!skb)
4862 			return;
4863 	}
4864 
4865 	/* deliver to local stack */
4866 	skb->protocol = eth_type_trans(skb, fast_rx->dev);
4867 	ieee80211_deliver_skb_to_local_stack(skb, rx);
4868 }
4869 
4870 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
4871 				     struct ieee80211_fast_rx *fast_rx)
4872 {
4873 	struct sk_buff *skb = rx->skb;
4874 	struct ieee80211_hdr *hdr = (void *)skb->data;
4875 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4876 	static ieee80211_rx_result res;
4877 	int orig_len = skb->len;
4878 	int hdrlen = ieee80211_hdrlen(hdr->frame_control);
4879 	int snap_offs = hdrlen;
4880 	struct {
4881 		u8 snap[sizeof(rfc1042_header)];
4882 		__be16 proto;
4883 	} *payload __aligned(2);
4884 	struct {
4885 		u8 da[ETH_ALEN];
4886 		u8 sa[ETH_ALEN];
4887 	} addrs __aligned(2);
4888 	struct ieee80211_sta_rx_stats *stats;
4889 
4890 	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
4891 	 * to a common data structure; drivers can implement that per queue
4892 	 * but we don't have that information in mac80211
4893 	 */
4894 	if (!(status->flag & RX_FLAG_DUP_VALIDATED))
4895 		return false;
4896 
4897 #define FAST_RX_CRYPT_FLAGS	(RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
4898 
4899 	/* If using encryption, we also need to have:
4900 	 *  - PN_VALIDATED: similar, but the implementation is tricky
4901 	 *  - DECRYPTED: necessary for PN_VALIDATED
4902 	 */
4903 	if (fast_rx->key &&
4904 	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
4905 		return false;
4906 
4907 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
4908 		return false;
4909 
4910 	if (unlikely(ieee80211_is_frag(hdr)))
4911 		return false;
4912 
4913 	/* Since our interface address cannot be multicast, this
4914 	 * implicitly also rejects multicast frames without the
4915 	 * explicit check.
4916 	 *
4917 	 * We shouldn't get any *data* frames not addressed to us
4918 	 * (AP mode will accept multicast *management* frames), but
4919 	 * punting here will make it go through the full checks in
4920 	 * ieee80211_accept_frame().
4921 	 */
4922 	if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
4923 		return false;
4924 
4925 	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
4926 					      IEEE80211_FCTL_TODS)) !=
4927 	    fast_rx->expected_ds_bits)
4928 		return false;
4929 
4930 	/* assign the key to drop unencrypted frames (later)
4931 	 * and strip the IV/MIC if necessary
4932 	 */
4933 	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
4934 		/* GCMP header length is the same */
4935 		snap_offs += IEEE80211_CCMP_HDR_LEN;
4936 	}
4937 
4938 	if (!ieee80211_vif_is_mesh(&rx->sdata->vif) &&
4939 	    !(status->rx_flags & IEEE80211_RX_AMSDU)) {
4940 		if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
4941 			return false;
4942 
4943 		payload = (void *)(skb->data + snap_offs);
4944 
4945 		if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
4946 			return false;
4947 
4948 		/* Don't handle these here since they require special code.
4949 		 * Accept AARP and IPX even though they should come with a
4950 		 * bridge-tunnel header - but if we get them this way then
4951 		 * there's little point in discarding them.
4952 		 */
4953 		if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
4954 			     payload->proto == fast_rx->control_port_protocol))
4955 			return false;
4956 	}
4957 
4958 	/* after this point, don't punt to the slowpath! */
4959 
4960 	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
4961 	    pskb_trim(skb, skb->len - fast_rx->icv_len))
4962 		goto drop;
4963 
4964 	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
4965 		goto drop;
4966 
4967 	if (status->rx_flags & IEEE80211_RX_AMSDU) {
4968 		if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) !=
4969 		    RX_QUEUED)
4970 			goto drop;
4971 
4972 		return true;
4973 	}
4974 
4975 	/* do the header conversion - first grab the addresses */
4976 	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
4977 	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
4978 	if (ieee80211_vif_is_mesh(&rx->sdata->vif)) {
4979 	    skb_pull(skb, snap_offs - 2);
4980 	    put_unaligned_be16(skb->len - 2, skb->data);
4981 	} else {
4982 	    skb_postpull_rcsum(skb, skb->data + snap_offs,
4983 			       sizeof(rfc1042_header) + 2);
4984 
4985 	    /* remove the SNAP but leave the ethertype */
4986 	    skb_pull(skb, snap_offs + sizeof(rfc1042_header));
4987 	}
4988 	/* push the addresses in front */
4989 	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
4990 
4991 	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
4992 	switch (res) {
4993 	case RX_QUEUED:
4994 		return true;
4995 	case RX_CONTINUE:
4996 		break;
4997 	default:
4998 		goto drop;
4999 	}
5000 
5001 	ieee80211_rx_8023(rx, fast_rx, orig_len);
5002 
5003 	return true;
5004  drop:
5005 	dev_kfree_skb(skb);
5006 
5007 	if (fast_rx->uses_rss)
5008 		stats = this_cpu_ptr(rx->link_sta->pcpu_rx_stats);
5009 	else
5010 		stats = &rx->link_sta->rx_stats;
5011 
5012 	stats->dropped++;
5013 	return true;
5014 }
5015 
5016 /*
5017  * This function returns whether or not the SKB
5018  * was destined for RX processing or not, which,
5019  * if consume is true, is equivalent to whether
5020  * or not the skb was consumed.
5021  */
5022 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
5023 					    struct sk_buff *skb, bool consume)
5024 {
5025 	struct ieee80211_local *local = rx->local;
5026 	struct ieee80211_sub_if_data *sdata = rx->sdata;
5027 	struct ieee80211_hdr *hdr = (void *)skb->data;
5028 	struct link_sta_info *link_sta = rx->link_sta;
5029 	struct ieee80211_link_data *link = rx->link;
5030 
5031 	rx->skb = skb;
5032 
5033 	/* See if we can do fast-rx; if we have to copy we already lost,
5034 	 * so punt in that case. We should never have to deliver a data
5035 	 * frame to multiple interfaces anyway.
5036 	 *
5037 	 * We skip the ieee80211_accept_frame() call and do the necessary
5038 	 * checking inside ieee80211_invoke_fast_rx().
5039 	 */
5040 	if (consume && rx->sta) {
5041 		struct ieee80211_fast_rx *fast_rx;
5042 
5043 		fast_rx = rcu_dereference(rx->sta->fast_rx);
5044 		if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
5045 			return true;
5046 	}
5047 
5048 	if (!ieee80211_accept_frame(rx))
5049 		return false;
5050 
5051 	if (!consume) {
5052 		struct skb_shared_hwtstamps *shwt;
5053 
5054 		rx->skb = skb_copy(skb, GFP_ATOMIC);
5055 		if (!rx->skb) {
5056 			if (net_ratelimit())
5057 				wiphy_debug(local->hw.wiphy,
5058 					"failed to copy skb for %s\n",
5059 					sdata->name);
5060 			return true;
5061 		}
5062 
5063 		/* skb_copy() does not copy the hw timestamps, so copy it
5064 		 * explicitly
5065 		 */
5066 		shwt = skb_hwtstamps(rx->skb);
5067 		shwt->hwtstamp = skb_hwtstamps(skb)->hwtstamp;
5068 
5069 		/* Update the hdr pointer to the new skb for translation below */
5070 		hdr = (struct ieee80211_hdr *)rx->skb->data;
5071 	}
5072 
5073 	if (unlikely(rx->sta && rx->sta->sta.mlo) &&
5074 	    is_unicast_ether_addr(hdr->addr1) &&
5075 	    !ieee80211_is_probe_resp(hdr->frame_control) &&
5076 	    !ieee80211_is_beacon(hdr->frame_control)) {
5077 		/* translate to MLD addresses */
5078 		if (ether_addr_equal(link->conf->addr, hdr->addr1))
5079 			ether_addr_copy(hdr->addr1, rx->sdata->vif.addr);
5080 		if (ether_addr_equal(link_sta->addr, hdr->addr2))
5081 			ether_addr_copy(hdr->addr2, rx->sta->addr);
5082 		/* translate A3 only if it's the BSSID */
5083 		if (!ieee80211_has_tods(hdr->frame_control) &&
5084 		    !ieee80211_has_fromds(hdr->frame_control)) {
5085 			if (ether_addr_equal(link_sta->addr, hdr->addr3))
5086 				ether_addr_copy(hdr->addr3, rx->sta->addr);
5087 			else if (ether_addr_equal(link->conf->addr, hdr->addr3))
5088 				ether_addr_copy(hdr->addr3, rx->sdata->vif.addr);
5089 		}
5090 		/* not needed for A4 since it can only carry the SA */
5091 	}
5092 
5093 	ieee80211_invoke_rx_handlers(rx);
5094 	return true;
5095 }
5096 
5097 static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw,
5098 				       struct ieee80211_sta *pubsta,
5099 				       struct sk_buff *skb,
5100 				       struct list_head *list)
5101 {
5102 	struct ieee80211_local *local = hw_to_local(hw);
5103 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5104 	struct ieee80211_fast_rx *fast_rx;
5105 	struct ieee80211_rx_data rx;
5106 	struct sta_info *sta;
5107 	int link_id = -1;
5108 
5109 	memset(&rx, 0, sizeof(rx));
5110 	rx.skb = skb;
5111 	rx.local = local;
5112 	rx.list = list;
5113 	rx.link_id = -1;
5114 
5115 	I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5116 
5117 	/* drop frame if too short for header */
5118 	if (skb->len < sizeof(struct ethhdr))
5119 		goto drop;
5120 
5121 	if (!pubsta)
5122 		goto drop;
5123 
5124 	if (status->link_valid)
5125 		link_id = status->link_id;
5126 
5127 	/*
5128 	 * TODO: Should the frame be dropped if the right link_id is not
5129 	 * available? Or may be it is fine in the current form to proceed with
5130 	 * the frame processing because with frame being in 802.3 format,
5131 	 * link_id is used only for stats purpose and updating the stats on
5132 	 * the deflink is fine?
5133 	 */
5134 	sta = container_of(pubsta, struct sta_info, sta);
5135 	if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5136 		goto drop;
5137 
5138 	fast_rx = rcu_dereference(rx.sta->fast_rx);
5139 	if (!fast_rx)
5140 		goto drop;
5141 
5142 	ieee80211_rx_8023(&rx, fast_rx, skb->len);
5143 	return;
5144 
5145 drop:
5146 	dev_kfree_skb(skb);
5147 }
5148 
5149 static bool ieee80211_rx_for_interface(struct ieee80211_rx_data *rx,
5150 				       struct sk_buff *skb, bool consume)
5151 {
5152 	struct link_sta_info *link_sta;
5153 	struct ieee80211_hdr *hdr = (void *)skb->data;
5154 	struct sta_info *sta;
5155 	int link_id = -1;
5156 
5157 	/*
5158 	 * Look up link station first, in case there's a
5159 	 * chance that they might have a link address that
5160 	 * is identical to the MLD address, that way we'll
5161 	 * have the link information if needed.
5162 	 */
5163 	link_sta = link_sta_info_get_bss(rx->sdata, hdr->addr2);
5164 	if (link_sta) {
5165 		sta = link_sta->sta;
5166 		link_id = link_sta->link_id;
5167 	} else {
5168 		struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5169 
5170 		sta = sta_info_get_bss(rx->sdata, hdr->addr2);
5171 		if (status->link_valid)
5172 			link_id = status->link_id;
5173 	}
5174 
5175 	if (!ieee80211_rx_data_set_sta(rx, sta, link_id))
5176 		return false;
5177 
5178 	return ieee80211_prepare_and_rx_handle(rx, skb, consume);
5179 }
5180 
5181 /*
5182  * This is the actual Rx frames handler. as it belongs to Rx path it must
5183  * be called with rcu_read_lock protection.
5184  */
5185 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
5186 					 struct ieee80211_sta *pubsta,
5187 					 struct sk_buff *skb,
5188 					 struct list_head *list)
5189 {
5190 	struct ieee80211_local *local = hw_to_local(hw);
5191 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5192 	struct ieee80211_sub_if_data *sdata;
5193 	struct ieee80211_hdr *hdr;
5194 	__le16 fc;
5195 	struct ieee80211_rx_data rx;
5196 	struct ieee80211_sub_if_data *prev;
5197 	struct rhlist_head *tmp;
5198 	int err = 0;
5199 
5200 	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
5201 	memset(&rx, 0, sizeof(rx));
5202 	rx.skb = skb;
5203 	rx.local = local;
5204 	rx.list = list;
5205 	rx.link_id = -1;
5206 
5207 	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
5208 		I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
5209 
5210 	if (ieee80211_is_mgmt(fc)) {
5211 		/* drop frame if too short for header */
5212 		if (skb->len < ieee80211_hdrlen(fc))
5213 			err = -ENOBUFS;
5214 		else
5215 			err = skb_linearize(skb);
5216 	} else {
5217 		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
5218 	}
5219 
5220 	if (err) {
5221 		dev_kfree_skb(skb);
5222 		return;
5223 	}
5224 
5225 	hdr = (struct ieee80211_hdr *)skb->data;
5226 	ieee80211_parse_qos(&rx);
5227 	ieee80211_verify_alignment(&rx);
5228 
5229 	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
5230 		     ieee80211_is_beacon(hdr->frame_control) ||
5231 		     ieee80211_is_s1g_beacon(hdr->frame_control)))
5232 		ieee80211_scan_rx(local, skb);
5233 
5234 	if (ieee80211_is_data(fc)) {
5235 		struct sta_info *sta, *prev_sta;
5236 		int link_id = -1;
5237 
5238 		if (status->link_valid)
5239 			link_id = status->link_id;
5240 
5241 		if (pubsta) {
5242 			sta = container_of(pubsta, struct sta_info, sta);
5243 			if (!ieee80211_rx_data_set_sta(&rx, sta, link_id))
5244 				goto out;
5245 
5246 			/*
5247 			 * In MLO connection, fetch the link_id using addr2
5248 			 * when the driver does not pass link_id in status.
5249 			 * When the address translation is already performed by
5250 			 * driver/hw, the valid link_id must be passed in
5251 			 * status.
5252 			 */
5253 
5254 			if (!status->link_valid && pubsta->mlo) {
5255 				struct link_sta_info *link_sta;
5256 
5257 				link_sta = link_sta_info_get_bss(rx.sdata,
5258 								 hdr->addr2);
5259 				if (!link_sta)
5260 					goto out;
5261 
5262 				ieee80211_rx_data_set_link(&rx, link_sta->link_id);
5263 			}
5264 
5265 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5266 				return;
5267 			goto out;
5268 		}
5269 
5270 		prev_sta = NULL;
5271 
5272 		for_each_sta_info(local, hdr->addr2, sta, tmp) {
5273 			if (!prev_sta) {
5274 				prev_sta = sta;
5275 				continue;
5276 			}
5277 
5278 			rx.sdata = prev_sta->sdata;
5279 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5280 				goto out;
5281 
5282 			if (!status->link_valid && prev_sta->sta.mlo)
5283 				continue;
5284 
5285 			ieee80211_prepare_and_rx_handle(&rx, skb, false);
5286 
5287 			prev_sta = sta;
5288 		}
5289 
5290 		if (prev_sta) {
5291 			rx.sdata = prev_sta->sdata;
5292 			if (!ieee80211_rx_data_set_sta(&rx, prev_sta, link_id))
5293 				goto out;
5294 
5295 			if (!status->link_valid && prev_sta->sta.mlo)
5296 				goto out;
5297 
5298 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
5299 				return;
5300 			goto out;
5301 		}
5302 	}
5303 
5304 	prev = NULL;
5305 
5306 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
5307 		if (!ieee80211_sdata_running(sdata))
5308 			continue;
5309 
5310 		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
5311 		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
5312 			continue;
5313 
5314 		/*
5315 		 * frame is destined for this interface, but if it's
5316 		 * not also for the previous one we handle that after
5317 		 * the loop to avoid copying the SKB once too much
5318 		 */
5319 
5320 		if (!prev) {
5321 			prev = sdata;
5322 			continue;
5323 		}
5324 
5325 		rx.sdata = prev;
5326 		ieee80211_rx_for_interface(&rx, skb, false);
5327 
5328 		prev = sdata;
5329 	}
5330 
5331 	if (prev) {
5332 		rx.sdata = prev;
5333 
5334 		if (ieee80211_rx_for_interface(&rx, skb, true))
5335 			return;
5336 	}
5337 
5338  out:
5339 	dev_kfree_skb(skb);
5340 }
5341 
5342 /*
5343  * This is the receive path handler. It is called by a low level driver when an
5344  * 802.11 MPDU is received from the hardware.
5345  */
5346 void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5347 		       struct sk_buff *skb, struct list_head *list)
5348 {
5349 	struct ieee80211_local *local = hw_to_local(hw);
5350 	struct ieee80211_rate *rate = NULL;
5351 	struct ieee80211_supported_band *sband;
5352 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
5353 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
5354 
5355 	WARN_ON_ONCE(softirq_count() == 0);
5356 
5357 	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
5358 		goto drop;
5359 
5360 	sband = local->hw.wiphy->bands[status->band];
5361 	if (WARN_ON(!sband))
5362 		goto drop;
5363 
5364 	/*
5365 	 * If we're suspending, it is possible although not too likely
5366 	 * that we'd be receiving frames after having already partially
5367 	 * quiesced the stack. We can't process such frames then since
5368 	 * that might, for example, cause stations to be added or other
5369 	 * driver callbacks be invoked.
5370 	 */
5371 	if (unlikely(local->quiescing || local->suspended))
5372 		goto drop;
5373 
5374 	/* We might be during a HW reconfig, prevent Rx for the same reason */
5375 	if (unlikely(local->in_reconfig))
5376 		goto drop;
5377 
5378 	/*
5379 	 * The same happens when we're not even started,
5380 	 * but that's worth a warning.
5381 	 */
5382 	if (WARN_ON(!local->started))
5383 		goto drop;
5384 
5385 	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
5386 		/*
5387 		 * Validate the rate, unless a PLCP error means that
5388 		 * we probably can't have a valid rate here anyway.
5389 		 */
5390 
5391 		switch (status->encoding) {
5392 		case RX_ENC_HT:
5393 			/*
5394 			 * rate_idx is MCS index, which can be [0-76]
5395 			 * as documented on:
5396 			 *
5397 			 * https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n
5398 			 *
5399 			 * Anything else would be some sort of driver or
5400 			 * hardware error. The driver should catch hardware
5401 			 * errors.
5402 			 */
5403 			if (WARN(status->rate_idx > 76,
5404 				 "Rate marked as an HT rate but passed "
5405 				 "status->rate_idx is not "
5406 				 "an MCS index [0-76]: %d (0x%02x)\n",
5407 				 status->rate_idx,
5408 				 status->rate_idx))
5409 				goto drop;
5410 			break;
5411 		case RX_ENC_VHT:
5412 			if (WARN_ONCE(status->rate_idx > 11 ||
5413 				      !status->nss ||
5414 				      status->nss > 8,
5415 				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
5416 				      status->rate_idx, status->nss))
5417 				goto drop;
5418 			break;
5419 		case RX_ENC_HE:
5420 			if (WARN_ONCE(status->rate_idx > 11 ||
5421 				      !status->nss ||
5422 				      status->nss > 8,
5423 				      "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n",
5424 				      status->rate_idx, status->nss))
5425 				goto drop;
5426 			break;
5427 		case RX_ENC_EHT:
5428 			if (WARN_ONCE(status->rate_idx > 15 ||
5429 				      !status->nss ||
5430 				      status->nss > 8 ||
5431 				      status->eht.gi > NL80211_RATE_INFO_EHT_GI_3_2,
5432 				      "Rate marked as an EHT rate but data is invalid: MCS:%d, NSS:%d, GI:%d\n",
5433 				      status->rate_idx, status->nss, status->eht.gi))
5434 				goto drop;
5435 			break;
5436 		default:
5437 			WARN_ON_ONCE(1);
5438 			fallthrough;
5439 		case RX_ENC_LEGACY:
5440 			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
5441 				goto drop;
5442 			rate = &sband->bitrates[status->rate_idx];
5443 		}
5444 	}
5445 
5446 	if (WARN_ON_ONCE(status->link_id >= IEEE80211_LINK_UNSPECIFIED))
5447 		goto drop;
5448 
5449 	status->rx_flags = 0;
5450 
5451 	kcov_remote_start_common(skb_get_kcov_handle(skb));
5452 
5453 	/*
5454 	 * Frames with failed FCS/PLCP checksum are not returned,
5455 	 * all other frames are returned without radiotap header
5456 	 * if it was previously present.
5457 	 * Also, frames with less than 16 bytes are dropped.
5458 	 */
5459 	if (!(status->flag & RX_FLAG_8023))
5460 		skb = ieee80211_rx_monitor(local, skb, rate);
5461 	if (skb) {
5462 		if ((status->flag & RX_FLAG_8023) ||
5463 			ieee80211_is_data_present(hdr->frame_control))
5464 			ieee80211_tpt_led_trig_rx(local, skb->len);
5465 
5466 		if (status->flag & RX_FLAG_8023)
5467 			__ieee80211_rx_handle_8023(hw, pubsta, skb, list);
5468 		else
5469 			__ieee80211_rx_handle_packet(hw, pubsta, skb, list);
5470 	}
5471 
5472 	kcov_remote_stop();
5473 	return;
5474  drop:
5475 	kfree_skb(skb);
5476 }
5477 EXPORT_SYMBOL(ieee80211_rx_list);
5478 
5479 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
5480 		       struct sk_buff *skb, struct napi_struct *napi)
5481 {
5482 	struct sk_buff *tmp;
5483 	LIST_HEAD(list);
5484 
5485 
5486 	/*
5487 	 * key references and virtual interfaces are protected using RCU
5488 	 * and this requires that we are in a read-side RCU section during
5489 	 * receive processing
5490 	 */
5491 	rcu_read_lock();
5492 	ieee80211_rx_list(hw, pubsta, skb, &list);
5493 	rcu_read_unlock();
5494 
5495 	if (!napi) {
5496 		netif_receive_skb_list(&list);
5497 		return;
5498 	}
5499 
5500 	list_for_each_entry_safe(skb, tmp, &list, list) {
5501 		skb_list_del_init(skb);
5502 		napi_gro_receive(napi, skb);
5503 	}
5504 }
5505 EXPORT_SYMBOL(ieee80211_rx_napi);
5506 
5507 /* This is a version of the rx handler that can be called from hard irq
5508  * context. Post the skb on the queue and schedule the tasklet */
5509 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
5510 {
5511 	struct ieee80211_local *local = hw_to_local(hw);
5512 
5513 	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
5514 
5515 	skb->pkt_type = IEEE80211_RX_MSG;
5516 	skb_queue_tail(&local->skb_queue, skb);
5517 	tasklet_schedule(&local->tasklet);
5518 }
5519 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
5520