net/mac80211/rx.c

   1 /*
   2  * Copyright 2002-2005, Instant802 Networks, Inc.
   3  * Copyright 2005-2006, Devicescape Software, Inc.
   4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   5  * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/jiffies.h>
  14 #include <linux/slab.h>
  15 #include <linux/kernel.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/etherdevice.h>
  19 #include <linux/rcupdate.h>
  20 #include <linux/export.h>
  21 #include <net/mac80211.h>
  22 #include <net/ieee80211_radiotap.h>
  23 #include <asm/unaligned.h>
  24
  25 #include "ieee80211_i.h"
  26 #include "driver-ops.h"
  27 #include "led.h"
  28 #include "mesh.h"
  29 #include "wep.h"
  30 #include "wpa.h"
  31 #include "tkip.h"
  32 #include "wme.h"
  33 #include "rate.h"
  34
  35 static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
  36 {
  37         struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
  38
  39         u64_stats_update_begin(&tstats->syncp);
  40         tstats->rx_packets++;
  41         tstats->rx_bytes += len;
  42         u64_stats_update_end(&tstats->syncp);
  43 }
  44
  45 static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
  46                                enum nl80211_iftype type)
  47 {
  48         __le16 fc = hdr->frame_control;
  49
  50         if (ieee80211_is_data(fc)) {
  51                 if (len < 24) /* drop incorrect hdr len (data) */
  52                         return NULL;
  53
  54                 if (ieee80211_has_a4(fc))
  55                         return NULL;
  56                 if (ieee80211_has_tods(fc))
  57                         return hdr->addr1;
  58                 if (ieee80211_has_fromds(fc))
  59                         return hdr->addr2;
  60
  61                 return hdr->addr3;
  62         }
  63
  64         if (ieee80211_is_mgmt(fc)) {
  65                 if (len < 24) /* drop incorrect hdr len (mgmt) */
  66                         return NULL;
  67                 return hdr->addr3;
  68         }
  69
  70         if (ieee80211_is_ctl(fc)) {
  71                 if (ieee80211_is_pspoll(fc))
  72                         return hdr->addr1;
  73
  74                 if (ieee80211_is_back_req(fc)) {
  75                         switch (type) {
  76                         case NL80211_IFTYPE_STATION:
  77                                 return hdr->addr2;
  78                         case NL80211_IFTYPE_AP:
  79                         case NL80211_IFTYPE_AP_VLAN:
  80                                 return hdr->addr1;
  81                         default:
  82                                 break; /* fall through to the return */
  83                         }
  84                 }
  85         }
  86
  87         return NULL;
  88 }
  89
  90 /*
  91  * monitor mode reception
  92  *
  93  * This function cleans up the SKB, i.e. it removes all the stuff
  94  * only useful for monitoring.
  95  */
  96 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  97                                            struct sk_buff *skb,
  98                                            unsigned int rtap_vendor_space)
  99 {
 100         if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
 101                 if (likely(skb->len > FCS_LEN))
 102                         __pskb_trim(skb, skb->len - FCS_LEN);
 103                 else {
 104                         /* driver bug */
 105                         WARN_ON(1);
 106                         dev_kfree_skb(skb);
 107                         return NULL;
 108                 }
 109         }
 110
 111         __pskb_pull(skb, rtap_vendor_space);
 112
 113         return skb;
 114 }
 115
 116 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
 117                                      unsigned int rtap_vendor_space)
 118 {
 119         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 120         struct ieee80211_hdr *hdr;
 121
 122         hdr = (void *)(skb->data + rtap_vendor_space);
 123
 124         if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
 125                             RX_FLAG_FAILED_PLCP_CRC))
 126                 return true;
 127
 128         if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
 129                 return true;
 130
 131         if (ieee80211_is_ctl(hdr->frame_control) &&
 132             !ieee80211_is_pspoll(hdr->frame_control) &&
 133             !ieee80211_is_back_req(hdr->frame_control))
 134                 return true;
 135
 136         return false;
 137 }
 138
 139 static int
 140 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
 141                              struct ieee80211_rx_status *status,
 142                              struct sk_buff *skb)
 143 {
 144         int len;
 145
 146         /* always present fields */
 147         len = sizeof(struct ieee80211_radiotap_header) + 8;
 148
 149         /* allocate extra bitmaps */
 150         if (status->chains)
 151                 len += 4 * hweight8(status->chains);
 152         /* vendor presence bitmap */
 153         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)
 154                 len += 4;
 155
 156         if (ieee80211_have_rx_timestamp(status)) {
 157                 len = ALIGN(len, 8);
 158                 len += 8;
 159         }
 160         if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
 161                 len += 1;
 162
 163         /* antenna field, if we don't have per-chain info */
 164         if (!status->chains)
 165                 len += 1;
 166
 167         /* padding for RX_FLAGS if necessary */
 168         len = ALIGN(len, 2);
 169
 170         if (status->flag & RX_FLAG_HT) /* HT info */
 171                 len += 3;
 172
 173         if (status->flag & RX_FLAG_AMPDU_DETAILS) {
 174                 len = ALIGN(len, 4);
 175                 len += 8;
 176         }
 177
 178         if (status->flag & RX_FLAG_VHT) {
 179                 len = ALIGN(len, 2);
 180                 len += 12;
 181         }
 182
 183         if (status->chains) {
 184                 /* antenna and antenna signal fields */
 185                 len += 2 * hweight8(status->chains);
 186         }
 187
 188         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 189                 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
 190
 191                 /* alignment for fixed 6-byte vendor data header */
 192                 len = ALIGN(len, 2);
 193                 /* vendor data header */
 194                 len += 6;
 195                 if (WARN_ON(rtap->align == 0))
 196                         rtap->align = 1;
 197                 len = ALIGN(len, rtap->align);
 198                 len += rtap->len + rtap->pad;
 199         }
 200
 201         return len;
 202 }
 203
 204 /*
 205  * ieee80211_add_rx_radiotap_header - add radiotap header
 206  *
 207  * add a radiotap header containing all the fields which the hardware provided.
 208  */
 209 static void
 210 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 211                                  struct sk_buff *skb,
 212                                  struct ieee80211_rate *rate,
 213                                  int rtap_len, bool has_fcs)
 214 {
 215         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 216         struct ieee80211_radiotap_header *rthdr;
 217         unsigned char *pos;
 218         __le32 *it_present;
 219         u32 it_present_val;
 220         u16 rx_flags = 0;
 221         u16 channel_flags = 0;
 222         int mpdulen, chain;
 223         unsigned long chains = status->chains;
 224         struct ieee80211_vendor_radiotap rtap = {};
 225
 226         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 227                 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
 228                 /* rtap.len and rtap.pad are undone immediately */
 229                 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
 230         }
 231
 232         mpdulen = skb->len;
 233         if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
 234                 mpdulen += FCS_LEN;
 235
 236         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
 237         memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
 238         it_present = &rthdr->it_present;
 239
 240         /* radiotap header, set always present flags */
 241         rthdr->it_len = cpu_to_le16(rtap_len);
 242         it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
 243                          BIT(IEEE80211_RADIOTAP_CHANNEL) |
 244                          BIT(IEEE80211_RADIOTAP_RX_FLAGS);
 245
 246         if (!status->chains)
 247                 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
 248
 249         for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
 250                 it_present_val |=
 251                         BIT(IEEE80211_RADIOTAP_EXT) |
 252                         BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
 253                 put_unaligned_le32(it_present_val, it_present);
 254                 it_present++;
 255                 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
 256                                  BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
 257         }
 258
 259         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 260                 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
 261                                   BIT(IEEE80211_RADIOTAP_EXT);
 262                 put_unaligned_le32(it_present_val, it_present);
 263                 it_present++;
 264                 it_present_val = rtap.present;
 265         }
 266
 267         put_unaligned_le32(it_present_val, it_present);
 268
 269         pos = (void *)(it_present + 1);
 270
 271         /* the order of the following fields is important */
 272
 273         /* IEEE80211_RADIOTAP_TSFT */
 274         if (ieee80211_have_rx_timestamp(status)) {
 275                 /* padding */
 276                 while ((pos - (u8 *)rthdr) & 7)
 277                         *pos++ = 0;
 278                 put_unaligned_le64(
 279                         ieee80211_calculate_rx_timestamp(local, status,
 280                                                          mpdulen, 0),
 281                         pos);
 282                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
 283                 pos += 8;
 284         }
 285
 286         /* IEEE80211_RADIOTAP_FLAGS */
 287         if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
 288                 *pos |= IEEE80211_RADIOTAP_F_FCS;
 289         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
 290                 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
 291         if (status->flag & RX_FLAG_SHORTPRE)
 292                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
 293         pos++;
 294
 295         /* IEEE80211_RADIOTAP_RATE */
 296         if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
 297                 /*
 298                  * Without rate information don't add it. If we have,
 299                  * MCS information is a separate field in radiotap,
 300                  * added below. The byte here is needed as padding
 301                  * for the channel though, so initialise it to 0.
 302                  */
 303                 *pos = 0;
 304         } else {
 305                 int shift = 0;
 306                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
 307                 if (status->flag & RX_FLAG_10MHZ)
 308                         shift = 1;
 309                 else if (status->flag & RX_FLAG_5MHZ)
 310                         shift = 2;
 311                 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
 312         }
 313         pos++;
 314
 315         /* IEEE80211_RADIOTAP_CHANNEL */
 316         put_unaligned_le16(status->freq, pos);
 317         pos += 2;
 318         if (status->flag & RX_FLAG_10MHZ)
 319                 channel_flags |= IEEE80211_CHAN_HALF;
 320         else if (status->flag & RX_FLAG_5MHZ)
 321                 channel_flags |= IEEE80211_CHAN_QUARTER;
 322
 323         if (status->band == IEEE80211_BAND_5GHZ)
 324                 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
 325         else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
 326                 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
 327         else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
 328                 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
 329         else if (rate)
 330                 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
 331         else
 332                 channel_flags |= IEEE80211_CHAN_2GHZ;
 333         put_unaligned_le16(channel_flags, pos);
 334         pos += 2;
 335
 336         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
 337         if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
 338             !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
 339                 *pos = status->signal;
 340                 rthdr->it_present |=
 341                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
 342                 pos++;
 343         }
 344
 345         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 346
 347         if (!status->chains) {
 348                 /* IEEE80211_RADIOTAP_ANTENNA */
 349                 *pos = status->antenna;
 350                 pos++;
 351         }
 352
 353         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 354
 355         /* IEEE80211_RADIOTAP_RX_FLAGS */
 356         /* ensure 2 byte alignment for the 2 byte field as required */
 357         if ((pos - (u8 *)rthdr) & 1)
 358                 *pos++ = 0;
 359         if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
 360                 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
 361         put_unaligned_le16(rx_flags, pos);
 362         pos += 2;
 363
 364         if (status->flag & RX_FLAG_HT) {
 365                 unsigned int stbc;
 366
 367                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
 368                 *pos++ = local->hw.radiotap_mcs_details;
 369                 *pos = 0;
 370                 if (status->flag & RX_FLAG_SHORT_GI)
 371                         *pos |= IEEE80211_RADIOTAP_MCS_SGI;
 372                 if (status->flag & RX_FLAG_40MHZ)
 373                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
 374                 if (status->flag & RX_FLAG_HT_GF)
 375                         *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
 376                 if (status->flag & RX_FLAG_LDPC)
 377                         *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
 378                 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
 379                 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
 380                 pos++;
 381                 *pos++ = status->rate_idx;
 382         }
 383
 384         if (status->flag & RX_FLAG_AMPDU_DETAILS) {
 385                 u16 flags = 0;
 386
 387                 /* ensure 4 byte alignment */
 388                 while ((pos - (u8 *)rthdr) & 3)
 389                         pos++;
 390                 rthdr->it_present |=
 391                         cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
 392                 put_unaligned_le32(status->ampdu_reference, pos);
 393                 pos += 4;
 394                 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
 395                         flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
 396                 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
 397                         flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
 398                 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
 399                         flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
 400                 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
 401                         flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
 402                 put_unaligned_le16(flags, pos);
 403                 pos += 2;
 404                 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
 405                         *pos++ = status->ampdu_delimiter_crc;
 406                 else
 407                         *pos++ = 0;
 408                 *pos++ = 0;
 409         }
 410
 411         if (status->flag & RX_FLAG_VHT) {
 412                 u16 known = local->hw.radiotap_vht_details;
 413
 414                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
 415                 put_unaligned_le16(known, pos);
 416                 pos += 2;
 417                 /* flags */
 418                 if (status->flag & RX_FLAG_SHORT_GI)
 419                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
 420                 /* in VHT, STBC is binary */
 421                 if (status->flag & RX_FLAG_STBC_MASK)
 422                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
 423                 if (status->vht_flag & RX_VHT_FLAG_BF)
 424                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
 425                 pos++;
 426                 /* bandwidth */
 427                 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
 428                         *pos++ = 4;
 429                 else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
 430                         *pos++ = 11;
 431                 else if (status->flag & RX_FLAG_40MHZ)
 432                         *pos++ = 1;
 433                 else /* 20 MHz */
 434                         *pos++ = 0;
 435                 /* MCS/NSS */
 436                 *pos = (status->rate_idx << 4) | status->vht_nss;
 437                 pos += 4;
 438                 /* coding field */
 439                 if (status->flag & RX_FLAG_LDPC)
 440                         *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
 441                 pos++;
 442                 /* group ID */
 443                 pos++;
 444                 /* partial_aid */
 445                 pos += 2;
 446         }
 447
 448         for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
 449                 *pos++ = status->chain_signal[chain];
 450                 *pos++ = chain;
 451         }
 452
 453         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 454                 /* ensure 2 byte alignment for the vendor field as required */
 455                 if ((pos - (u8 *)rthdr) & 1)
 456                         *pos++ = 0;
 457                 *pos++ = rtap.oui[0];
 458                 *pos++ = rtap.oui[1];
 459                 *pos++ = rtap.oui[2];
 460                 *pos++ = rtap.subns;
 461                 put_unaligned_le16(rtap.len, pos);
 462                 pos += 2;
 463                 /* align the actual payload as requested */
 464                 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
 465                         *pos++ = 0;
 466                 /* data (and possible padding) already follows */
 467         }
 468 }
 469
 470 /*
 471  * This function copies a received frame to all monitor interfaces and
 472  * returns a cleaned-up SKB that no longer includes the FCS nor the
 473  * radiotap header the driver might have added.
 474  */
 475 static struct sk_buff *
 476 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 477                      struct ieee80211_rate *rate)
 478 {
 479         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
 480         struct ieee80211_sub_if_data *sdata;
 481         int rt_hdrlen, needed_headroom;
 482         struct sk_buff *skb, *skb2;
 483         struct net_device *prev_dev = NULL;
 484         int present_fcs_len = 0;
 485         unsigned int rtap_vendor_space = 0;
 486
 487         if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
 488                 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
 489
 490                 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
 491         }
 492
 493         /*
 494          * First, we may need to make a copy of the skb because
 495          *  (1) we need to modify it for radiotap (if not present), and
 496          *  (2) the other RX handlers will modify the skb we got.
 497          *
 498          * We don't need to, of course, if we aren't going to return
 499          * the SKB because it has a bad FCS/PLCP checksum.
 500          */
 501
 502         if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
 503                 present_fcs_len = FCS_LEN;
 504
 505         /* ensure hdr->frame_control and vendor radiotap data are in skb head */
 506         if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
 507                 dev_kfree_skb(origskb);
 508                 return NULL;
 509         }
 510
 511         if (!local->monitors) {
 512                 if (should_drop_frame(origskb, present_fcs_len,
 513                                       rtap_vendor_space)) {
 514                         dev_kfree_skb(origskb);
 515                         return NULL;
 516                 }
 517
 518                 return remove_monitor_info(local, origskb, rtap_vendor_space);
 519         }
 520
 521         /* room for the radiotap header based on driver features */
 522         rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
 523         needed_headroom = rt_hdrlen - rtap_vendor_space;
 524
 525         if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
 526                 /* only need to expand headroom if necessary */
 527                 skb = origskb;
 528                 origskb = NULL;
 529
 530                 /*
 531                  * This shouldn't trigger often because most devices have an
 532                  * RX header they pull before we get here, and that should
 533                  * be big enough for our radiotap information. We should
 534                  * probably export the length to drivers so that we can have
 535                  * them allocate enough headroom to start with.
 536                  */
 537                 if (skb_headroom(skb) < needed_headroom &&
 538                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
 539                         dev_kfree_skb(skb);
 540                         return NULL;
 541                 }
 542         } else {
 543                 /*
 544                  * Need to make a copy and possibly remove radiotap header
 545                  * and FCS from the original.
 546                  */
 547                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
 548
 549                 origskb = remove_monitor_info(local, origskb,
 550                                               rtap_vendor_space);
 551
 552                 if (!skb)
 553                         return origskb;
 554         }
 555
 556         /* prepend radiotap information */
 557         ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
 558
 559         skb_reset_mac_header(skb);
 560         skb->ip_summed = CHECKSUM_UNNECESSARY;
 561         skb->pkt_type = PACKET_OTHERHOST;
 562         skb->protocol = htons(ETH_P_802_2);
 563
 564         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 565                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 566                         continue;
 567
 568                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
 569                         continue;
 570
 571                 if (!ieee80211_sdata_running(sdata))
 572                         continue;
 573
 574                 if (prev_dev) {
 575                         skb2 = skb_clone(skb, GFP_ATOMIC);
 576                         if (skb2) {
 577                                 skb2->dev = prev_dev;
 578                                 netif_receive_skb(skb2);
 579                         }
 580                 }
 581
 582                 prev_dev = sdata->dev;
 583                 ieee80211_rx_stats(sdata->dev, skb->len);
 584         }
 585
 586         if (prev_dev) {
 587                 skb->dev = prev_dev;
 588                 netif_receive_skb(skb);
 589         } else
 590                 dev_kfree_skb(skb);
 591
 592         return origskb;
 593 }
 594
 595 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
 596 {
 597         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 598         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 599         int tid, seqno_idx, security_idx;
 600
 601         /* does the frame have a qos control field? */
 602         if (ieee80211_is_data_qos(hdr->frame_control)) {
 603                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 604                 /* frame has qos control */
 605                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 606                 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
 607                         status->rx_flags |= IEEE80211_RX_AMSDU;
 608
 609                 seqno_idx = tid;
 610                 security_idx = tid;
 611         } else {
 612                 /*
 613                  * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
 614                  *
 615                  *      Sequence numbers for management frames, QoS data
 616                  *      frames with a broadcast/multicast address in the
 617                  *      Address 1 field, and all non-QoS data frames sent
 618                  *      by QoS STAs are assigned using an additional single
 619                  *      modulo-4096 counter, [...]
 620                  *
 621                  * We also use that counter for non-QoS STAs.
 622                  */
 623                 seqno_idx = IEEE80211_NUM_TIDS;
 624                 security_idx = 0;
 625                 if (ieee80211_is_mgmt(hdr->frame_control))
 626                         security_idx = IEEE80211_NUM_TIDS;
 627                 tid = 0;
 628         }
 629
 630         rx->seqno_idx = seqno_idx;
 631         rx->security_idx = security_idx;
 632         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
 633          * For now, set skb->priority to 0 for other cases. */
 634         rx->skb->priority = (tid > 7) ? 0 : tid;
 635 }
 636
 637 /**
 638  * DOC: Packet alignment
 639  *
 640  * Drivers always need to pass packets that are aligned to two-byte boundaries
 641  * to the stack.
 642  *
 643  * Additionally, should, if possible, align the payload data in a way that
 644  * guarantees that the contained IP header is aligned to a four-byte
 645  * boundary. In the case of regular frames, this simply means aligning the
 646  * payload to a four-byte boundary (because either the IP header is directly
 647  * contained, or IV/RFC1042 headers that have a length divisible by four are
 648  * in front of it).  If the payload data is not properly aligned and the
 649  * architecture doesn't support efficient unaligned operations, mac80211
 650  * will align the data.
 651  *
 652  * With A-MSDU frames, however, the payload data address must yield two modulo
 653  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 654  * push the IP header further back to a multiple of four again. Thankfully, the
 655  * specs were sane enough this time around to require padding each A-MSDU
 656  * subframe to a length that is a multiple of four.
 657  *
 658  * Padding like Atheros hardware adds which is between the 802.11 header and
 659  * the payload is not supported, the driver is required to move the 802.11
 660  * header to be directly in front of the payload in that case.
 661  */
 662 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 663 {
 664 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 665         WARN_ONCE((unsigned long)rx->skb->data & 1,
 666                   "unaligned packet at 0x%p\n", rx->skb->data);
 667 #endif
 668 }
 669
 670
 671 /* rx handlers */
 672
 673 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
 674 {
 675         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 676
 677         if (is_multicast_ether_addr(hdr->addr1))
 678                 return 0;
 679
 680         return ieee80211_is_robust_mgmt_frame(skb);
 681 }
 682
 683
 684 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
 685 {
 686         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 687
 688         if (!is_multicast_ether_addr(hdr->addr1))
 689                 return 0;
 690
 691         return ieee80211_is_robust_mgmt_frame(skb);
 692 }
 693
 694
 695 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
 696 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
 697 {
 698         struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
 699         struct ieee80211_mmie *mmie;
 700         struct ieee80211_mmie_16 *mmie16;
 701
 702         if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
 703                 return -1;
 704
 705         if (!ieee80211_is_robust_mgmt_frame(skb))
 706                 return -1; /* not a robust management frame */
 707
 708         mmie = (struct ieee80211_mmie *)
 709                 (skb->data + skb->len - sizeof(*mmie));
 710         if (mmie->element_id == WLAN_EID_MMIE &&
 711             mmie->length == sizeof(*mmie) - 2)
 712                 return le16_to_cpu(mmie->key_id);
 713
 714         mmie16 = (struct ieee80211_mmie_16 *)
 715                 (skb->data + skb->len - sizeof(*mmie16));
 716         if (skb->len >= 24 + sizeof(*mmie16) &&
 717             mmie16->element_id == WLAN_EID_MMIE &&
 718             mmie16->length == sizeof(*mmie16) - 2)
 719                 return le16_to_cpu(mmie16->key_id);
 720
 721         return -1;
 722 }
 723
 724 static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
 725                                  struct sk_buff *skb)
 726 {
 727         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 728         __le16 fc;
 729         int hdrlen;
 730         u8 keyid;
 731
 732         fc = hdr->frame_control;
 733         hdrlen = ieee80211_hdrlen(fc);
 734
 735         if (skb->len < hdrlen + cs->hdr_len)
 736                 return -EINVAL;
 737
 738         skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
 739         keyid &= cs->key_idx_mask;
 740         keyid >>= cs->key_idx_shift;
 741
 742         return keyid;
 743 }
 744
 745 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 746 {
 747         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 748         char *dev_addr = rx->sdata->vif.addr;
 749
 750         if (ieee80211_is_data(hdr->frame_control)) {
 751                 if (is_multicast_ether_addr(hdr->addr1)) {
 752                         if (ieee80211_has_tods(hdr->frame_control) ||
 753                             !ieee80211_has_fromds(hdr->frame_control))
 754                                 return RX_DROP_MONITOR;
 755                         if (ether_addr_equal(hdr->addr3, dev_addr))
 756                                 return RX_DROP_MONITOR;
 757                 } else {
 758                         if (!ieee80211_has_a4(hdr->frame_control))
 759                                 return RX_DROP_MONITOR;
 760                         if (ether_addr_equal(hdr->addr4, dev_addr))
 761                                 return RX_DROP_MONITOR;
 762                 }
 763         }
 764
 765         /* If there is not an established peer link and this is not a peer link
 766          * establisment frame, beacon or probe, drop the frame.
 767          */
 768
 769         if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
 770                 struct ieee80211_mgmt *mgmt;
 771
 772                 if (!ieee80211_is_mgmt(hdr->frame_control))
 773                         return RX_DROP_MONITOR;
 774
 775                 if (ieee80211_is_action(hdr->frame_control)) {
 776                         u8 category;
 777
 778                         /* make sure category field is present */
 779                         if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
 780                                 return RX_DROP_MONITOR;
 781
 782                         mgmt = (struct ieee80211_mgmt *)hdr;
 783                         category = mgmt->u.action.category;
 784                         if (category != WLAN_CATEGORY_MESH_ACTION &&
 785                             category != WLAN_CATEGORY_SELF_PROTECTED)
 786                                 return RX_DROP_MONITOR;
 787                         return RX_CONTINUE;
 788                 }
 789
 790                 if (ieee80211_is_probe_req(hdr->frame_control) ||
 791                     ieee80211_is_probe_resp(hdr->frame_control) ||
 792                     ieee80211_is_beacon(hdr->frame_control) ||
 793                     ieee80211_is_auth(hdr->frame_control))
 794                         return RX_CONTINUE;
 795
 796                 return RX_DROP_MONITOR;
 797         }
 798
 799         return RX_CONTINUE;
 800 }
 801
 802 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
 803                                             struct tid_ampdu_rx *tid_agg_rx,
 804                                             int index,
 805                                             struct sk_buff_head *frames)
 806 {
 807         struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
 808         struct sk_buff *skb;
 809         struct ieee80211_rx_status *status;
 810
 811         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 812
 813         if (skb_queue_empty(skb_list))
 814                 goto no_frame;
 815
 816         if (!ieee80211_rx_reorder_ready(skb_list)) {
 817                 __skb_queue_purge(skb_list);
 818                 goto no_frame;
 819         }
 820
 821         /* release frames from the reorder ring buffer */
 822         tid_agg_rx->stored_mpdu_num--;
 823         while ((skb = __skb_dequeue(skb_list))) {
 824                 status = IEEE80211_SKB_RXCB(skb);
 825                 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
 826                 __skb_queue_tail(frames, skb);
 827         }
 828
 829 no_frame:
 830         tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
 831 }
 832
 833 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
 834                                              struct tid_ampdu_rx *tid_agg_rx,
 835                                              u16 head_seq_num,
 836                                              struct sk_buff_head *frames)
 837 {
 838         int index;
 839
 840         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 841
 842         while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
 843                 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 844                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
 845                                                 frames);
 846         }
 847 }
 848
 849 /*
 850  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 851  * the skb was added to the buffer longer than this time ago, the earlier
 852  * frames that have not yet been received are assumed to be lost and the skb
 853  * can be released for processing. This may also release other skb's from the
 854  * reorder buffer if there are no additional gaps between the frames.
 855  *
 856  * Callers must hold tid_agg_rx->reorder_lock.
 857  */
 858 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 859
 860 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 861                                           struct tid_ampdu_rx *tid_agg_rx,
 862                                           struct sk_buff_head *frames)
 863 {
 864         int index, i, j;
 865
 866         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 867
 868         /* release the buffer until next missing frame */
 869         index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 870         if (!ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index]) &&
 871             tid_agg_rx->stored_mpdu_num) {
 872                 /*
 873                  * No buffers ready to be released, but check whether any
 874                  * frames in the reorder buffer have timed out.
 875                  */
 876                 int skipped = 1;
 877                 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
 878                      j = (j + 1) % tid_agg_rx->buf_size) {
 879                         if (!ieee80211_rx_reorder_ready(
 880                                         &tid_agg_rx->reorder_buf[j])) {
 881                                 skipped++;
 882                                 continue;
 883                         }
 884                         if (skipped &&
 885                             !time_after(jiffies, tid_agg_rx->reorder_time[j] +
 886                                         HT_RX_REORDER_BUF_TIMEOUT))
 887                                 goto set_release_timer;
 888
 889                         /* don't leave incomplete A-MSDUs around */
 890                         for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
 891                              i = (i + 1) % tid_agg_rx->buf_size)
 892                                 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
 893
 894                         ht_dbg_ratelimited(sdata,
 895                                            "release an RX reorder frame due to timeout on earlier frames\n");
 896                         ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
 897                                                         frames);
 898
 899                         /*
 900                          * Increment the head seq# also for the skipped slots.
 901                          */
 902                         tid_agg_rx->head_seq_num =
 903                                 (tid_agg_rx->head_seq_num +
 904                                  skipped) & IEEE80211_SN_MASK;
 905                         skipped = 0;
 906                 }
 907         } else while (ieee80211_rx_reorder_ready(
 908                                 &tid_agg_rx->reorder_buf[index])) {
 909                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
 910                                                 frames);
 911                 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 912         }
 913
 914         if (tid_agg_rx->stored_mpdu_num) {
 915                 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 916
 917                 for (; j != (index - 1) % tid_agg_rx->buf_size;
 918                      j = (j + 1) % tid_agg_rx->buf_size) {
 919                         if (ieee80211_rx_reorder_ready(
 920                                         &tid_agg_rx->reorder_buf[j]))
 921                                 break;
 922                 }
 923
 924  set_release_timer:
 925
 926                 if (!tid_agg_rx->removed)
 927                         mod_timer(&tid_agg_rx->reorder_timer,
 928                                   tid_agg_rx->reorder_time[j] + 1 +
 929                                   HT_RX_REORDER_BUF_TIMEOUT);
 930         } else {
 931                 del_timer(&tid_agg_rx->reorder_timer);
 932         }
 933 }
 934
 935 /*
 936  * As this function belongs to the RX path it must be under
 937  * rcu_read_lock protection. It returns false if the frame
 938  * can be processed immediately, true if it was consumed.
 939  */
 940 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
 941                                              struct tid_ampdu_rx *tid_agg_rx,
 942                                              struct sk_buff *skb,
 943                                              struct sk_buff_head *frames)
 944 {
 945         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 946         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 947         u16 sc = le16_to_cpu(hdr->seq_ctrl);
 948         u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
 949         u16 head_seq_num, buf_size;
 950         int index;
 951         bool ret = true;
 952
 953         spin_lock(&tid_agg_rx->reorder_lock);
 954
 955         /*
 956          * Offloaded BA sessions have no known starting sequence number so pick
 957          * one from first Rxed frame for this tid after BA was started.
 958          */
 959         if (unlikely(tid_agg_rx->auto_seq)) {
 960                 tid_agg_rx->auto_seq = false;
 961                 tid_agg_rx->ssn = mpdu_seq_num;
 962                 tid_agg_rx->head_seq_num = mpdu_seq_num;
 963         }
 964
 965         buf_size = tid_agg_rx->buf_size;
 966         head_seq_num = tid_agg_rx->head_seq_num;
 967
 968         /* frame with out of date sequence number */
 969         if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
 970                 dev_kfree_skb(skb);
 971                 goto out;
 972         }
 973
 974         /*
 975          * If frame the sequence number exceeds our buffering window
 976          * size release some previous frames to make room for this one.
 977          */
 978         if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
 979                 head_seq_num = ieee80211_sn_inc(
 980                                 ieee80211_sn_sub(mpdu_seq_num, buf_size));
 981                 /* release stored frames up to new head to stack */
 982                 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
 983                                                  head_seq_num, frames);
 984         }
 985
 986         /* Now the new frame is always in the range of the reordering buffer */
 987
 988         index = mpdu_seq_num % tid_agg_rx->buf_size;
 989
 990         /* check if we already stored this frame */
 991         if (ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index])) {
 992                 dev_kfree_skb(skb);
 993                 goto out;
 994         }
 995
 996         /*
 997          * If the current MPDU is in the right order and nothing else
 998          * is stored we can process it directly, no need to buffer it.
 999          * If it is first but there's something stored, we may be able
1000          * to release frames after this one.
1001          */
1002         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1003             tid_agg_rx->stored_mpdu_num == 0) {
1004                 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1005                         tid_agg_rx->head_seq_num =
1006                                 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1007                 ret = false;
1008                 goto out;
1009         }
1010
1011         /* put the frame in the reordering buffer */
1012         __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1013         if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1014                 tid_agg_rx->reorder_time[index] = jiffies;
1015                 tid_agg_rx->stored_mpdu_num++;
1016                 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1017         }
1018
1019  out:
1020         spin_unlock(&tid_agg_rx->reorder_lock);
1021         return ret;
1022 }
1023
1024 /*
1025  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1026  * true if the MPDU was buffered, false if it should be processed.
1027  */
1028 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1029                                        struct sk_buff_head *frames)
1030 {
1031         struct sk_buff *skb = rx->skb;
1032         struct ieee80211_local *local = rx->local;
1033         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1034         struct sta_info *sta = rx->sta;
1035         struct tid_ampdu_rx *tid_agg_rx;
1036         u16 sc;
1037         u8 tid, ack_policy;
1038
1039         if (!ieee80211_is_data_qos(hdr->frame_control) ||
1040             is_multicast_ether_addr(hdr->addr1))
1041                 goto dont_reorder;
1042
1043         /*
1044          * filter the QoS data rx stream according to
1045          * STA/TID and check if this STA/TID is on aggregation
1046          */
1047
1048         if (!sta)
1049                 goto dont_reorder;
1050
1051         ack_policy = *ieee80211_get_qos_ctl(hdr) &
1052                      IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1053         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1054
1055         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1056         if (!tid_agg_rx)
1057                 goto dont_reorder;
1058
1059         /* qos null data frames are excluded */
1060         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1061                 goto dont_reorder;
1062
1063         /* not part of a BA session */
1064         if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1065             ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1066                 goto dont_reorder;
1067
1068         /* new, potentially un-ordered, ampdu frame - process it */
1069
1070         /* reset session timer */
1071         if (tid_agg_rx->timeout)
1072                 tid_agg_rx->last_rx = jiffies;
1073
1074         /* if this mpdu is fragmented - terminate rx aggregation session */
1075         sc = le16_to_cpu(hdr->seq_ctrl);
1076         if (sc & IEEE80211_SCTL_FRAG) {
1077                 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
1078                 skb_queue_tail(&rx->sdata->skb_queue, skb);
1079                 ieee80211_queue_work(&local->hw, &rx->sdata->work);
1080                 return;
1081         }
1082
1083         /*
1084          * No locking needed -- we will only ever process one
1085          * RX packet at a time, and thus own tid_agg_rx. All
1086          * other code manipulating it needs to (and does) make
1087          * sure that we cannot get to it any more before doing
1088          * anything with it.
1089          */
1090         if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1091                                              frames))
1092                 return;
1093
1094  dont_reorder:
1095         __skb_queue_tail(frames, skb);
1096 }
1097
1098 static ieee80211_rx_result debug_noinline
1099 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1100 {
1101         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1102         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1103
1104         /*
1105          * Drop duplicate 802.11 retransmissions
1106          * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1107          */
1108
1109         if (rx->skb->len < 24)
1110                 return RX_CONTINUE;
1111
1112         if (ieee80211_is_ctl(hdr->frame_control) ||
1113             ieee80211_is_nullfunc(hdr->frame_control) ||
1114             ieee80211_is_qos_nullfunc(hdr->frame_control) ||
1115             is_multicast_ether_addr(hdr->addr1))
1116                 return RX_CONTINUE;
1117
1118         if (!rx->sta)
1119                 return RX_CONTINUE;
1120
1121         if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1122                      rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1123                 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1124                 rx->sta->rx_stats.num_duplicates++;
1125                 return RX_DROP_UNUSABLE;
1126         } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1127                 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1128         }
1129
1130         return RX_CONTINUE;
1131 }
1132
1133 static ieee80211_rx_result debug_noinline
1134 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1135 {
1136         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1137
1138         /* Drop disallowed frame classes based on STA auth/assoc state;
1139          * IEEE 802.11, Chap 5.5.
1140          *
1141          * mac80211 filters only based on association state, i.e. it drops
1142          * Class 3 frames from not associated stations. hostapd sends
1143          * deauth/disassoc frames when needed. In addition, hostapd is
1144          * responsible for filtering on both auth and assoc states.
1145          */
1146
1147         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1148                 return ieee80211_rx_mesh_check(rx);
1149
1150         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1151                       ieee80211_is_pspoll(hdr->frame_control)) &&
1152                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1153                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1154                      rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1155                      (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1156                 /*
1157                  * accept port control frames from the AP even when it's not
1158                  * yet marked ASSOC to prevent a race where we don't set the
1159                  * assoc bit quickly enough before it sends the first frame
1160                  */
1161                 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1162                     ieee80211_is_data_present(hdr->frame_control)) {
1163                         unsigned int hdrlen;
1164                         __be16 ethertype;
1165
1166                         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1167
1168                         if (rx->skb->len < hdrlen + 8)
1169                                 return RX_DROP_MONITOR;
1170
1171                         skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1172                         if (ethertype == rx->sdata->control_port_protocol)
1173                                 return RX_CONTINUE;
1174                 }
1175
1176                 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1177                     cfg80211_rx_spurious_frame(rx->sdata->dev,
1178                                                hdr->addr2,
1179                                                GFP_ATOMIC))
1180                         return RX_DROP_UNUSABLE;
1181
1182                 return RX_DROP_MONITOR;
1183         }
1184
1185         return RX_CONTINUE;
1186 }
1187
1188
1189 static ieee80211_rx_result debug_noinline
1190 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1191 {
1192         struct ieee80211_local *local;
1193         struct ieee80211_hdr *hdr;
1194         struct sk_buff *skb;
1195
1196         local = rx->local;
1197         skb = rx->skb;
1198         hdr = (struct ieee80211_hdr *) skb->data;
1199
1200         if (!local->pspolling)
1201                 return RX_CONTINUE;
1202
1203         if (!ieee80211_has_fromds(hdr->frame_control))
1204                 /* this is not from AP */
1205                 return RX_CONTINUE;
1206
1207         if (!ieee80211_is_data(hdr->frame_control))
1208                 return RX_CONTINUE;
1209
1210         if (!ieee80211_has_moredata(hdr->frame_control)) {
1211                 /* AP has no more frames buffered for us */
1212                 local->pspolling = false;
1213                 return RX_CONTINUE;
1214         }
1215
1216         /* more data bit is set, let's request a new frame from the AP */
1217         ieee80211_send_pspoll(local, rx->sdata);
1218
1219         return RX_CONTINUE;
1220 }
1221
1222 static void sta_ps_start(struct sta_info *sta)
1223 {
1224         struct ieee80211_sub_if_data *sdata = sta->sdata;
1225         struct ieee80211_local *local = sdata->local;
1226         struct ps_data *ps;
1227         int tid;
1228
1229         if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1230             sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1231                 ps = &sdata->bss->ps;
1232         else
1233                 return;
1234
1235         atomic_inc(&ps->num_sta_ps);
1236         set_sta_flag(sta, WLAN_STA_PS_STA);
1237         if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1238                 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1239         ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1240                sta->sta.addr, sta->sta.aid);
1241
1242         ieee80211_clear_fast_xmit(sta);
1243
1244         if (!sta->sta.txq[0])
1245                 return;
1246
1247         for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
1248                 struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
1249
1250                 if (!skb_queue_len(&txqi->queue))
1251                         set_bit(tid, &sta->txq_buffered_tids);
1252                 else
1253                         clear_bit(tid, &sta->txq_buffered_tids);
1254         }
1255 }
1256
1257 static void sta_ps_end(struct sta_info *sta)
1258 {
1259         ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1260                sta->sta.addr, sta->sta.aid);
1261
1262         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1263                 /*
1264                  * Clear the flag only if the other one is still set
1265                  * so that the TX path won't start TX'ing new frames
1266                  * directly ... In the case that the driver flag isn't
1267                  * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1268                  */
1269                 clear_sta_flag(sta, WLAN_STA_PS_STA);
1270                 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1271                        sta->sta.addr, sta->sta.aid);
1272                 return;
1273         }
1274
1275         set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1276         clear_sta_flag(sta, WLAN_STA_PS_STA);
1277         ieee80211_sta_ps_deliver_wakeup(sta);
1278 }
1279
1280 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1281 {
1282         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1283         bool in_ps;
1284
1285         WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1286
1287         /* Don't let the same PS state be set twice */
1288         in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1289         if ((start && in_ps) || (!start && !in_ps))
1290                 return -EINVAL;
1291
1292         if (start)
1293                 sta_ps_start(sta);
1294         else
1295                 sta_ps_end(sta);
1296
1297         return 0;
1298 }
1299 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1300
1301 static ieee80211_rx_result debug_noinline
1302 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1303 {
1304         struct ieee80211_sub_if_data *sdata = rx->sdata;
1305         struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1306         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1307         int tid, ac;
1308
1309         if (!rx->sta)
1310                 return RX_CONTINUE;
1311
1312         if (sdata->vif.type != NL80211_IFTYPE_AP &&
1313             sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1314                 return RX_CONTINUE;
1315
1316         /*
1317          * The device handles station powersave, so don't do anything about
1318          * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1319          * it to mac80211 since they're handled.)
1320          */
1321         if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1322                 return RX_CONTINUE;
1323
1324         /*
1325          * Don't do anything if the station isn't already asleep. In
1326          * the uAPSD case, the station will probably be marked asleep,
1327          * in the PS-Poll case the station must be confused ...
1328          */
1329         if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1330                 return RX_CONTINUE;
1331
1332         if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1333                 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
1334                         if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1335                                 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1336                         else
1337                                 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1338                 }
1339
1340                 /* Free PS Poll skb here instead of returning RX_DROP that would
1341                  * count as an dropped frame. */
1342                 dev_kfree_skb(rx->skb);
1343
1344                 return RX_QUEUED;
1345         } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1346                    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1347                    ieee80211_has_pm(hdr->frame_control) &&
1348                    (ieee80211_is_data_qos(hdr->frame_control) ||
1349                     ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1350                 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1351                 ac = ieee802_1d_to_ac[tid & 7];
1352
1353                 /*
1354                  * If this AC is not trigger-enabled do nothing.
1355                  *
1356                  * NB: This could/should check a separate bitmap of trigger-
1357                  * enabled queues, but for now we only implement uAPSD w/o
1358                  * TSPEC changes to the ACs, so they're always the same.
1359                  */
1360                 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
1361                         return RX_CONTINUE;
1362
1363                 /* if we are in a service period, do nothing */
1364                 if (test_sta_flag(rx->sta, WLAN_STA_SP))
1365                         return RX_CONTINUE;
1366
1367                 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1368                         ieee80211_sta_ps_deliver_uapsd(rx->sta);
1369                 else
1370                         set_sta_flag(rx->sta, WLAN_STA_UAPSD);
1371         }
1372
1373         return RX_CONTINUE;
1374 }
1375
1376 static ieee80211_rx_result debug_noinline
1377 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1378 {
1379         struct sta_info *sta = rx->sta;
1380         struct sk_buff *skb = rx->skb;
1381         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1382         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1383         int i;
1384
1385         if (!sta)
1386                 return RX_CONTINUE;
1387
1388         /*
1389          * Update last_rx only for IBSS packets which are for the current
1390          * BSSID and for station already AUTHORIZED to avoid keeping the
1391          * current IBSS network alive in cases where other STAs start
1392          * using different BSSID. This will also give the station another
1393          * chance to restart the authentication/authorization in case
1394          * something went wrong the first time.
1395          */
1396         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1397                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1398                                                 NL80211_IFTYPE_ADHOC);
1399                 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1400                     test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1401                         sta->rx_stats.last_rx = jiffies;
1402                         if (ieee80211_is_data(hdr->frame_control) &&
1403                             !is_multicast_ether_addr(hdr->addr1)) {
1404                                 sta->rx_stats.last_rate_idx =
1405                                         status->rate_idx;
1406                                 sta->rx_stats.last_rate_flag =
1407                                         status->flag;
1408                                 sta->rx_stats.last_rate_vht_flag =
1409                                         status->vht_flag;
1410                                 sta->rx_stats.last_rate_vht_nss =
1411                                         status->vht_nss;
1412                         }
1413                 }
1414         } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1415                 sta->rx_stats.last_rx = jiffies;
1416         } else if (!is_multicast_ether_addr(hdr->addr1)) {
1417                 /*
1418                  * Mesh beacons will update last_rx when if they are found to
1419                  * match the current local configuration when processed.
1420                  */
1421                 sta->rx_stats.last_rx = jiffies;
1422                 if (ieee80211_is_data(hdr->frame_control)) {
1423                         sta->rx_stats.last_rate_idx = status->rate_idx;
1424                         sta->rx_stats.last_rate_flag = status->flag;
1425                         sta->rx_stats.last_rate_vht_flag = status->vht_flag;
1426                         sta->rx_stats.last_rate_vht_nss = status->vht_nss;
1427                 }
1428         }
1429
1430         if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1431                 ieee80211_sta_rx_notify(rx->sdata, hdr);
1432
1433         sta->rx_stats.fragments++;
1434         sta->rx_stats.bytes += rx->skb->len;
1435         if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1436                 sta->rx_stats.last_signal = status->signal;
1437                 ewma_signal_add(&sta->rx_stats.avg_signal, -status->signal);
1438         }
1439
1440         if (status->chains) {
1441                 sta->rx_stats.chains = status->chains;
1442                 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1443                         int signal = status->chain_signal[i];
1444
1445                         if (!(status->chains & BIT(i)))
1446                                 continue;
1447
1448                         sta->rx_stats.chain_signal_last[i] = signal;
1449                         ewma_signal_add(&sta->rx_stats.chain_signal_avg[i],
1450                                         -signal);
1451                 }
1452         }
1453
1454         /*
1455          * Change STA power saving mode only at the end of a frame
1456          * exchange sequence.
1457          */
1458         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1459             !ieee80211_has_morefrags(hdr->frame_control) &&
1460             !ieee80211_is_back_req(hdr->frame_control) &&
1461             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1462             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1463              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1464             /*
1465              * PM bit is only checked in frames where it isn't reserved,
1466              * in AP mode it's reserved in non-bufferable management frames
1467              * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
1468              * BAR frames should be ignored as specified in
1469              * IEEE 802.11-2012 10.2.1.2.
1470              */
1471             (!ieee80211_is_mgmt(hdr->frame_control) ||
1472              ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
1473                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1474                         if (!ieee80211_has_pm(hdr->frame_control))
1475                                 sta_ps_end(sta);
1476                 } else {
1477                         if (ieee80211_has_pm(hdr->frame_control))
1478                                 sta_ps_start(sta);
1479                 }
1480         }
1481
1482         /* mesh power save support */
1483         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1484                 ieee80211_mps_rx_h_sta_process(sta, hdr);
1485
1486         /*
1487          * Drop (qos-)data::nullfunc frames silently, since they
1488          * are used only to control station power saving mode.
1489          */
1490         if (ieee80211_is_nullfunc(hdr->frame_control) ||
1491             ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1492                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1493
1494                 /*
1495                  * If we receive a 4-addr nullfunc frame from a STA
1496                  * that was not moved to a 4-addr STA vlan yet send
1497                  * the event to userspace and for older hostapd drop
1498                  * the frame to the monitor interface.
1499                  */
1500                 if (ieee80211_has_a4(hdr->frame_control) &&
1501                     (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1502                      (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1503                       !rx->sdata->u.vlan.sta))) {
1504                         if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1505                                 cfg80211_rx_unexpected_4addr_frame(
1506                                         rx->sdata->dev, sta->sta.addr,
1507                                         GFP_ATOMIC);
1508                         return RX_DROP_MONITOR;
1509                 }
1510                 /*
1511                  * Update counter and free packet here to avoid
1512                  * counting this as a dropped packed.
1513                  */
1514                 sta->rx_stats.packets++;
1515                 dev_kfree_skb(rx->skb);
1516                 return RX_QUEUED;
1517         }
1518
1519         return RX_CONTINUE;
1520 } /* ieee80211_rx_h_sta_process */
1521
1522 static ieee80211_rx_result debug_noinline
1523 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1524 {
1525         struct sk_buff *skb = rx->skb;
1526         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1527         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1528         int keyidx;
1529         int hdrlen;
1530         ieee80211_rx_result result = RX_DROP_UNUSABLE;
1531         struct ieee80211_key *sta_ptk = NULL;
1532         int mmie_keyidx = -1;
1533         __le16 fc;
1534         const struct ieee80211_cipher_scheme *cs = NULL;
1535
1536         /*
1537          * Key selection 101
1538          *
1539          * There are four types of keys:
1540          *  - GTK (group keys)
1541          *  - IGTK (group keys for management frames)
1542          *  - PTK (pairwise keys)
1543          *  - STK (station-to-station pairwise keys)
1544          *
1545          * When selecting a key, we have to distinguish between multicast
1546          * (including broadcast) and unicast frames, the latter can only
1547          * use PTKs and STKs while the former always use GTKs and IGTKs.
1548          * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1549          * unicast frames can also use key indices like GTKs. Hence, if we
1550          * don't have a PTK/STK we check the key index for a WEP key.
1551          *
1552          * Note that in a regular BSS, multicast frames are sent by the
1553          * AP only, associated stations unicast the frame to the AP first
1554          * which then multicasts it on their behalf.
1555          *
1556          * There is also a slight problem in IBSS mode: GTKs are negotiated
1557          * with each station, that is something we don't currently handle.
1558          * The spec seems to expect that one negotiates the same key with
1559          * every station but there's no such requirement; VLANs could be
1560          * possible.
1561          */
1562
1563         /* start without a key */
1564         rx->key = NULL;
1565         fc = hdr->frame_control;
1566
1567         if (rx->sta) {
1568                 int keyid = rx->sta->ptk_idx;
1569
1570                 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1571                         cs = rx->sta->cipher_scheme;
1572                         keyid = iwl80211_get_cs_keyid(cs, rx->skb);
1573                         if (unlikely(keyid < 0))
1574                                 return RX_DROP_UNUSABLE;
1575                 }
1576                 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1577         }
1578
1579         if (!ieee80211_has_protected(fc))
1580                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1581
1582         if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1583                 rx->key = sta_ptk;
1584                 if ((status->flag & RX_FLAG_DECRYPTED) &&
1585                     (status->flag & RX_FLAG_IV_STRIPPED))
1586                         return RX_CONTINUE;
1587                 /* Skip decryption if the frame is not protected. */
1588                 if (!ieee80211_has_protected(fc))
1589                         return RX_CONTINUE;
1590         } else if (mmie_keyidx >= 0) {
1591                 /* Broadcast/multicast robust management frame / BIP */
1592                 if ((status->flag & RX_FLAG_DECRYPTED) &&
1593                     (status->flag & RX_FLAG_IV_STRIPPED))
1594                         return RX_CONTINUE;
1595
1596                 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1597                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1598                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
1599                 if (rx->sta)
1600                         rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1601                 if (!rx->key)
1602                         rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1603         } else if (!ieee80211_has_protected(fc)) {
1604                 /*
1605                  * The frame was not protected, so skip decryption. However, we
1606                  * need to set rx->key if there is a key that could have been
1607                  * used so that the frame may be dropped if encryption would
1608                  * have been expected.
1609                  */
1610                 struct ieee80211_key *key = NULL;
1611                 struct ieee80211_sub_if_data *sdata = rx->sdata;
1612                 int i;
1613
1614                 if (ieee80211_is_mgmt(fc) &&
1615                     is_multicast_ether_addr(hdr->addr1) &&
1616                     (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1617                         rx->key = key;
1618                 else {
1619                         if (rx->sta) {
1620                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1621                                         key = rcu_dereference(rx->sta->gtk[i]);
1622                                         if (key)
1623                                                 break;
1624                                 }
1625                         }
1626                         if (!key) {
1627                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1628                                         key = rcu_dereference(sdata->keys[i]);
1629                                         if (key)
1630                                                 break;
1631                                 }
1632                         }
1633                         if (key)
1634                                 rx->key = key;
1635                 }
1636                 return RX_CONTINUE;
1637         } else {
1638                 u8 keyid;
1639
1640                 /*
1641                  * The device doesn't give us the IV so we won't be
1642                  * able to look up the key. That's ok though, we
1643                  * don't need to decrypt the frame, we just won't
1644                  * be able to keep statistics accurate.
1645                  * Except for key threshold notifications, should
1646                  * we somehow allow the driver to tell us which key
1647                  * the hardware used if this flag is set?
1648                  */
1649                 if ((status->flag & RX_FLAG_DECRYPTED) &&
1650                     (status->flag & RX_FLAG_IV_STRIPPED))
1651                         return RX_CONTINUE;
1652
1653                 hdrlen = ieee80211_hdrlen(fc);
1654
1655                 if (cs) {
1656                         keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
1657
1658                         if (unlikely(keyidx < 0))
1659                                 return RX_DROP_UNUSABLE;
1660                 } else {
1661                         if (rx->skb->len < 8 + hdrlen)
1662                                 return RX_DROP_UNUSABLE; /* TODO: count this? */
1663                         /*
1664                          * no need to call ieee80211_wep_get_keyidx,
1665                          * it verifies a bunch of things we've done already
1666                          */
1667                         skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1668                         keyidx = keyid >> 6;
1669                 }
1670
1671                 /* check per-station GTK first, if multicast packet */
1672                 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1673                         rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1674
1675                 /* if not found, try default key */
1676                 if (!rx->key) {
1677                         rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1678
1679                         /*
1680                          * RSNA-protected unicast frames should always be
1681                          * sent with pairwise or station-to-station keys,
1682                          * but for WEP we allow using a key index as well.
1683                          */
1684                         if (rx->key &&
1685                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1686                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1687                             !is_multicast_ether_addr(hdr->addr1))
1688                                 rx->key = NULL;
1689                 }
1690         }
1691
1692         if (rx->key) {
1693                 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1694                         return RX_DROP_MONITOR;
1695
1696                 /* TODO: add threshold stuff again */
1697         } else {
1698                 return RX_DROP_MONITOR;
1699         }
1700
1701         switch (rx->key->conf.cipher) {
1702         case WLAN_CIPHER_SUITE_WEP40:
1703         case WLAN_CIPHER_SUITE_WEP104:
1704                 result = ieee80211_crypto_wep_decrypt(rx);
1705                 break;
1706         case WLAN_CIPHER_SUITE_TKIP:
1707                 result = ieee80211_crypto_tkip_decrypt(rx);
1708                 break;
1709         case WLAN_CIPHER_SUITE_CCMP:
1710                 result = ieee80211_crypto_ccmp_decrypt(
1711                         rx, IEEE80211_CCMP_MIC_LEN);
1712                 break;
1713         case WLAN_CIPHER_SUITE_CCMP_256:
1714                 result = ieee80211_crypto_ccmp_decrypt(
1715                         rx, IEEE80211_CCMP_256_MIC_LEN);
1716                 break;
1717         case WLAN_CIPHER_SUITE_AES_CMAC:
1718                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1719                 break;
1720         case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1721                 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
1722                 break;
1723         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1724         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1725                 result = ieee80211_crypto_aes_gmac_decrypt(rx);
1726                 break;
1727         case WLAN_CIPHER_SUITE_GCMP:
1728         case WLAN_CIPHER_SUITE_GCMP_256:
1729                 result = ieee80211_crypto_gcmp_decrypt(rx);
1730                 break;
1731         default:
1732                 result = ieee80211_crypto_hw_decrypt(rx);
1733         }
1734
1735         /* the hdr variable is invalid after the decrypt handlers */
1736
1737         /* either the frame has been decrypted or will be dropped */
1738         status->flag |= RX_FLAG_DECRYPTED;
1739
1740         return result;
1741 }
1742
1743 static inline struct ieee80211_fragment_entry *
1744 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1745                          unsigned int frag, unsigned int seq, int rx_queue,
1746                          struct sk_buff **skb)
1747 {
1748         struct ieee80211_fragment_entry *entry;
1749
1750         entry = &sdata->fragments[sdata->fragment_next++];
1751         if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1752                 sdata->fragment_next = 0;
1753
1754         if (!skb_queue_empty(&entry->skb_list))
1755                 __skb_queue_purge(&entry->skb_list);
1756
1757         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1758         *skb = NULL;
1759         entry->first_frag_time = jiffies;
1760         entry->seq = seq;
1761         entry->rx_queue = rx_queue;
1762         entry->last_frag = frag;
1763         entry->check_sequential_pn = false;
1764         entry->extra_len = 0;
1765
1766         return entry;
1767 }
1768
1769 static inline struct ieee80211_fragment_entry *
1770 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1771                           unsigned int frag, unsigned int seq,
1772                           int rx_queue, struct ieee80211_hdr *hdr)
1773 {
1774         struct ieee80211_fragment_entry *entry;
1775         int i, idx;
1776
1777         idx = sdata->fragment_next;
1778         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1779                 struct ieee80211_hdr *f_hdr;
1780
1781                 idx--;
1782                 if (idx < 0)
1783                         idx = IEEE80211_FRAGMENT_MAX - 1;
1784
1785                 entry = &sdata->fragments[idx];
1786                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1787                     entry->rx_queue != rx_queue ||
1788                     entry->last_frag + 1 != frag)
1789                         continue;
1790
1791                 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1792
1793                 /*
1794                  * Check ftype and addresses are equal, else check next fragment
1795                  */
1796                 if (((hdr->frame_control ^ f_hdr->frame_control) &
1797                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1798                     !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1799                     !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1800                         continue;
1801
1802                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1803                         __skb_queue_purge(&entry->skb_list);
1804                         continue;
1805                 }
1806                 return entry;
1807         }
1808
1809         return NULL;
1810 }
1811
1812 static ieee80211_rx_result debug_noinline
1813 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1814 {
1815         struct ieee80211_hdr *hdr;
1816         u16 sc;
1817         __le16 fc;
1818         unsigned int frag, seq;
1819         struct ieee80211_fragment_entry *entry;
1820         struct sk_buff *skb;
1821         struct ieee80211_rx_status *status;
1822
1823         hdr = (struct ieee80211_hdr *)rx->skb->data;
1824         fc = hdr->frame_control;
1825
1826         if (ieee80211_is_ctl(fc))
1827                 return RX_CONTINUE;
1828
1829         sc = le16_to_cpu(hdr->seq_ctrl);
1830         frag = sc & IEEE80211_SCTL_FRAG;
1831
1832         if (is_multicast_ether_addr(hdr->addr1)) {
1833                 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
1834                 goto out_no_led;
1835         }
1836
1837         if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1838                 goto out;
1839
1840         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1841
1842         if (skb_linearize(rx->skb))
1843                 return RX_DROP_UNUSABLE;
1844
1845         /*
1846          *  skb_linearize() might change the skb->data and
1847          *  previously cached variables (in this case, hdr) need to
1848          *  be refreshed with the new data.
1849          */
1850         hdr = (struct ieee80211_hdr *)rx->skb->data;
1851         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1852
1853         if (frag == 0) {
1854                 /* This is the first fragment of a new frame. */
1855                 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1856                                                  rx->seqno_idx, &(rx->skb));
1857                 if (rx->key &&
1858                     (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
1859                      rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
1860                      rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
1861                      rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
1862                     ieee80211_has_protected(fc)) {
1863                         int queue = rx->security_idx;
1864
1865                         /* Store CCMP/GCMP PN so that we can verify that the
1866                          * next fragment has a sequential PN value.
1867                          */
1868                         entry->check_sequential_pn = true;
1869                         memcpy(entry->last_pn,
1870                                rx->key->u.ccmp.rx_pn[queue],
1871                                IEEE80211_CCMP_PN_LEN);
1872                         BUILD_BUG_ON(offsetof(struct ieee80211_key,
1873                                               u.ccmp.rx_pn) !=
1874                                      offsetof(struct ieee80211_key,
1875                                               u.gcmp.rx_pn));
1876                         BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
1877                                      sizeof(rx->key->u.gcmp.rx_pn[queue]));
1878                         BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
1879                                      IEEE80211_GCMP_PN_LEN);
1880                 }
1881                 return RX_QUEUED;
1882         }
1883
1884         /* This is a fragment for a frame that should already be pending in
1885          * fragment cache. Add this fragment to the end of the pending entry.
1886          */
1887         entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
1888                                           rx->seqno_idx, hdr);
1889         if (!entry) {
1890                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1891                 return RX_DROP_MONITOR;
1892         }
1893
1894         /* "The receiver shall discard MSDUs and MMPDUs whose constituent
1895          *  MPDU PN values are not incrementing in steps of 1."
1896          * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
1897          * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
1898          */
1899         if (entry->check_sequential_pn) {
1900                 int i;
1901                 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1902                 int queue;
1903
1904                 if (!rx->key ||
1905                     (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
1906                      rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
1907                      rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
1908                      rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
1909                         return RX_DROP_UNUSABLE;
1910                 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
1911                 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1912                         pn[i]++;
1913                         if (pn[i])
1914                                 break;
1915                 }
1916                 queue = rx->security_idx;
1917                 rpn = rx->key->u.ccmp.rx_pn[queue];
1918                 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
1919                         return RX_DROP_UNUSABLE;
1920                 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1921         }
1922
1923         skb_pull(rx->skb, ieee80211_hdrlen(fc));
1924         __skb_queue_tail(&entry->skb_list, rx->skb);
1925         entry->last_frag = frag;
1926         entry->extra_len += rx->skb->len;
1927         if (ieee80211_has_morefrags(fc)) {
1928                 rx->skb = NULL;
1929                 return RX_QUEUED;
1930         }
1931
1932         rx->skb = __skb_dequeue(&entry->skb_list);
1933         if (skb_tailroom(rx->skb) < entry->extra_len) {
1934                 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
1935                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1936                                               GFP_ATOMIC))) {
1937                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1938                         __skb_queue_purge(&entry->skb_list);
1939                         return RX_DROP_UNUSABLE;
1940                 }
1941         }
1942         while ((skb = __skb_dequeue(&entry->skb_list))) {
1943                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1944                 dev_kfree_skb(skb);
1945         }
1946
1947         /* Complete frame has been reassembled - process it now */
1948         status = IEEE80211_SKB_RXCB(rx->skb);
1949
1950  out:
1951         ieee80211_led_rx(rx->local);
1952  out_no_led:
1953         if (rx->sta)
1954                 rx->sta->rx_stats.packets++;
1955         return RX_CONTINUE;
1956 }
1957
1958 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1959 {
1960         if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
1961                 return -EACCES;
1962
1963         return 0;
1964 }
1965
1966 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1967 {
1968         struct sk_buff *skb = rx->skb;
1969         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1970
1971         /*
1972          * Pass through unencrypted frames if the hardware has
1973          * decrypted them already.
1974          */
1975         if (status->flag & RX_FLAG_DECRYPTED)
1976                 return 0;
1977
1978         /* Drop unencrypted frames if key is set. */
1979         if (unlikely(!ieee80211_has_protected(fc) &&
1980                      !ieee80211_is_nullfunc(fc) &&
1981                      ieee80211_is_data(fc) && rx->key))
1982                 return -EACCES;
1983
1984         return 0;
1985 }
1986
1987 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1988 {
1989         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1990         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1991         __le16 fc = hdr->frame_control;
1992
1993         /*
1994          * Pass through unencrypted frames if the hardware has
1995          * decrypted them already.
1996          */
1997         if (status->flag & RX_FLAG_DECRYPTED)
1998                 return 0;
1999
2000         if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2001                 if (unlikely(!ieee80211_has_protected(fc) &&
2002                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
2003                              rx->key)) {
2004                         if (ieee80211_is_deauth(fc) ||
2005                             ieee80211_is_disassoc(fc))
2006                                 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2007                                                              rx->skb->data,
2008                                                              rx->skb->len);
2009                         return -EACCES;
2010                 }
2011                 /* BIP does not use Protected field, so need to check MMIE */
2012                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2013                              ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2014                         if (ieee80211_is_deauth(fc) ||
2015                             ieee80211_is_disassoc(fc))
2016                                 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2017                                                              rx->skb->data,
2018                                                              rx->skb->len);
2019                         return -EACCES;
2020                 }
2021                 /*
2022                  * When using MFP, Action frames are not allowed prior to
2023                  * having configured keys.
2024                  */
2025                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2026                              ieee80211_is_robust_mgmt_frame(rx->skb)))
2027                         return -EACCES;
2028         }
2029
2030         return 0;
2031 }
2032
2033 static int
2034 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2035 {
2036         struct ieee80211_sub_if_data *sdata = rx->sdata;
2037         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2038         bool check_port_control = false;
2039         struct ethhdr *ehdr;
2040         int ret;
2041
2042         *port_control = false;
2043         if (ieee80211_has_a4(hdr->frame_control) &&
2044             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2045                 return -1;
2046
2047         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2048             !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2049
2050                 if (!sdata->u.mgd.use_4addr)
2051                         return -1;
2052                 else
2053                         check_port_control = true;
2054         }
2055
2056         if (is_multicast_ether_addr(hdr->addr1) &&
2057             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2058                 return -1;
2059
2060         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2061         if (ret < 0)
2062                 return ret;
2063
2064         ehdr = (struct ethhdr *) rx->skb->data;
2065         if (ehdr->h_proto == rx->sdata->control_port_protocol)
2066                 *port_control = true;
2067         else if (check_port_control)
2068                 return -1;
2069
2070         return 0;
2071 }
2072
2073 /*
2074  * requires that rx->skb is a frame with ethernet header
2075  */
2076 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2077 {
2078         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2079                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2080         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2081
2082         /*
2083          * Allow EAPOL frames to us/the PAE group address regardless
2084          * of whether the frame was encrypted or not.
2085          */
2086         if (ehdr->h_proto == rx->sdata->control_port_protocol &&
2087             (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2088              ether_addr_equal(ehdr->h_dest, pae_group_addr)))
2089                 return true;
2090
2091         if (ieee80211_802_1x_port_control(rx) ||
2092             ieee80211_drop_unencrypted(rx, fc))
2093                 return false;
2094
2095         return true;
2096 }
2097
2098 /*
2099  * requires that rx->skb is a frame with ethernet header
2100  */
2101 static void
2102 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2103 {
2104         struct ieee80211_sub_if_data *sdata = rx->sdata;
2105         struct net_device *dev = sdata->dev;
2106         struct sk_buff *skb, *xmit_skb;
2107         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2108         struct sta_info *dsta;
2109
2110         skb = rx->skb;
2111         xmit_skb = NULL;
2112
2113         ieee80211_rx_stats(dev, skb->len);
2114
2115         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2116              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2117             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2118             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2119                 if (is_multicast_ether_addr(ehdr->h_dest)) {
2120                         /*
2121                          * send multicast frames both to higher layers in
2122                          * local net stack and back to the wireless medium
2123                          */
2124                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
2125                         if (!xmit_skb)
2126                                 net_info_ratelimited("%s: failed to clone multicast frame\n",
2127                                                     dev->name);
2128                 } else {
2129                         dsta = sta_info_get(sdata, skb->data);
2130                         if (dsta) {
2131                                 /*
2132                                  * The destination station is associated to
2133                                  * this AP (in this VLAN), so send the frame
2134                                  * directly to it and do not pass it to local
2135                                  * net stack.
2136                                  */
2137                                 xmit_skb = skb;
2138                                 skb = NULL;
2139                         }
2140                 }
2141         }
2142
2143 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2144         if (skb) {
2145                 /* 'align' will only take the values 0 or 2 here since all
2146                  * frames are required to be aligned to 2-byte boundaries
2147                  * when being passed to mac80211; the code here works just
2148                  * as well if that isn't true, but mac80211 assumes it can
2149                  * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2150                  */
2151                 int align;
2152
2153                 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2154                 if (align) {
2155                         if (WARN_ON(skb_headroom(skb) < 3)) {
2156                                 dev_kfree_skb(skb);
2157                                 skb = NULL;
2158                         } else {
2159                                 u8 *data = skb->data;
2160                                 size_t len = skb_headlen(skb);
2161                                 skb->data -= align;
2162                                 memmove(skb->data, data, len);
2163                                 skb_set_tail_pointer(skb, len);
2164                         }
2165                 }
2166         }
2167 #endif
2168
2169         if (skb) {
2170                 /* deliver to local stack */
2171                 skb->protocol = eth_type_trans(skb, dev);
2172                 memset(skb->cb, 0, sizeof(skb->cb));
2173                 if (rx->napi)
2174                         napi_gro_receive(rx->napi, skb);
2175                 else
2176                         netif_receive_skb(skb);
2177         }
2178
2179         if (xmit_skb) {
2180                 /*
2181                  * Send to wireless media and increase priority by 256 to
2182                  * keep the received priority instead of reclassifying
2183                  * the frame (see cfg80211_classify8021d).
2184                  */
2185                 xmit_skb->priority += 256;
2186                 xmit_skb->protocol = htons(ETH_P_802_3);
2187                 skb_reset_network_header(xmit_skb);
2188                 skb_reset_mac_header(xmit_skb);
2189                 dev_queue_xmit(xmit_skb);
2190         }
2191 }
2192
2193 static ieee80211_rx_result debug_noinline
2194 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2195 {
2196         struct net_device *dev = rx->sdata->dev;
2197         struct sk_buff *skb = rx->skb;
2198         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2199         __le16 fc = hdr->frame_control;
2200         struct sk_buff_head frame_list;
2201         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2202
2203         if (unlikely(!ieee80211_is_data(fc)))
2204                 return RX_CONTINUE;
2205
2206         if (unlikely(!ieee80211_is_data_present(fc)))
2207                 return RX_DROP_MONITOR;
2208
2209         if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2210                 return RX_CONTINUE;
2211
2212         if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2213                 switch (rx->sdata->vif.type) {
2214                 case NL80211_IFTYPE_AP_VLAN:
2215                         if (!rx->sdata->u.vlan.sta)
2216                                 return RX_DROP_UNUSABLE;
2217                         break;
2218                 case NL80211_IFTYPE_STATION:
2219                         if (!rx->sdata->u.mgd.use_4addr)
2220                                 return RX_DROP_UNUSABLE;
2221                         break;
2222                 default:
2223                         return RX_DROP_UNUSABLE;
2224                 }
2225         }
2226
2227         if (is_multicast_ether_addr(hdr->addr1))
2228                 return RX_DROP_UNUSABLE;
2229
2230         skb->dev = dev;
2231         __skb_queue_head_init(&frame_list);
2232
2233         if (skb_linearize(skb))
2234                 return RX_DROP_UNUSABLE;
2235
2236         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2237                                  rx->sdata->vif.type,
2238                                  rx->local->hw.extra_tx_headroom, true);
2239
2240         while (!skb_queue_empty(&frame_list)) {
2241                 rx->skb = __skb_dequeue(&frame_list);
2242
2243                 if (!ieee80211_frame_allowed(rx, fc)) {
2244                         dev_kfree_skb(rx->skb);
2245                         continue;
2246                 }
2247
2248                 ieee80211_deliver_skb(rx);
2249         }
2250
2251         return RX_QUEUED;
2252 }
2253
2254 #ifdef CONFIG_MAC80211_MESH
2255 static ieee80211_rx_result
2256 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2257 {
2258         struct ieee80211_hdr *fwd_hdr, *hdr;
2259         struct ieee80211_tx_info *info;
2260         struct ieee80211s_hdr *mesh_hdr;
2261         struct sk_buff *skb = rx->skb, *fwd_skb;
2262         struct ieee80211_local *local = rx->local;
2263         struct ieee80211_sub_if_data *sdata = rx->sdata;
2264         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2265         u16 ac, q, hdrlen;
2266
2267         hdr = (struct ieee80211_hdr *) skb->data;
2268         hdrlen = ieee80211_hdrlen(hdr->frame_control);
2269
2270         /* make sure fixed part of mesh header is there, also checks skb len */
2271         if (!pskb_may_pull(rx->skb, hdrlen + 6))
2272                 return RX_DROP_MONITOR;
2273
2274         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2275
2276         /* make sure full mesh header is there, also checks skb len */
2277         if (!pskb_may_pull(rx->skb,
2278                            hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2279                 return RX_DROP_MONITOR;
2280
2281         /* reload pointers */
2282         hdr = (struct ieee80211_hdr *) skb->data;
2283         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2284
2285         if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2286                 return RX_DROP_MONITOR;
2287
2288         /* frame is in RMC, don't forward */
2289         if (ieee80211_is_data(hdr->frame_control) &&
2290             is_multicast_ether_addr(hdr->addr1) &&
2291             mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2292                 return RX_DROP_MONITOR;
2293
2294         if (!ieee80211_is_data(hdr->frame_control))
2295                 return RX_CONTINUE;
2296
2297         if (!mesh_hdr->ttl)
2298                 return RX_DROP_MONITOR;
2299
2300         if (mesh_hdr->flags & MESH_FLAGS_AE) {
2301                 struct mesh_path *mppath;
2302                 char *proxied_addr;
2303                 char *mpp_addr;
2304
2305                 if (is_multicast_ether_addr(hdr->addr1)) {
2306                         mpp_addr = hdr->addr3;
2307                         proxied_addr = mesh_hdr->eaddr1;
2308                 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
2309                         /* has_a4 already checked in ieee80211_rx_mesh_check */
2310                         mpp_addr = hdr->addr4;
2311                         proxied_addr = mesh_hdr->eaddr2;
2312                 } else {
2313                         return RX_DROP_MONITOR;
2314                 }
2315
2316                 rcu_read_lock();
2317                 mppath = mpp_path_lookup(sdata, proxied_addr);
2318                 if (!mppath) {
2319                         mpp_path_add(sdata, proxied_addr, mpp_addr);
2320                 } else {
2321                         spin_lock_bh(&mppath->state_lock);
2322                         if (!ether_addr_equal(mppath->mpp, mpp_addr))
2323                                 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2324                         spin_unlock_bh(&mppath->state_lock);
2325                 }
2326                 rcu_read_unlock();
2327         }
2328
2329         /* Frame has reached destination.  Don't forward */
2330         if (!is_multicast_ether_addr(hdr->addr1) &&
2331             ether_addr_equal(sdata->vif.addr, hdr->addr3))
2332                 return RX_CONTINUE;
2333
2334         ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2335         q = sdata->vif.hw_queue[ac];
2336         if (ieee80211_queue_stopped(&local->hw, q)) {
2337                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2338                 return RX_DROP_MONITOR;
2339         }
2340         skb_set_queue_mapping(skb, q);
2341
2342         if (!--mesh_hdr->ttl) {
2343                 if (!is_multicast_ether_addr(hdr->addr1))
2344                         IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
2345                                                      dropped_frames_ttl);
2346                 goto out;
2347         }
2348
2349         if (!ifmsh->mshcfg.dot11MeshForwarding)
2350                 goto out;
2351
2352         fwd_skb = skb_copy(skb, GFP_ATOMIC);
2353         if (!fwd_skb) {
2354                 net_info_ratelimited("%s: failed to clone mesh frame\n",
2355                                     sdata->name);
2356                 goto out;
2357         }
2358
2359         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2360         fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2361         info = IEEE80211_SKB_CB(fwd_skb);
2362         memset(info, 0, sizeof(*info));
2363         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2364         info->control.vif = &rx->sdata->vif;
2365         info->control.jiffies = jiffies;
2366         if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2367                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2368                 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2369                 /* update power mode indication when forwarding */
2370                 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2371         } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2372                 /* mesh power mode flags updated in mesh_nexthop_lookup */
2373                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2374         } else {
2375                 /* unable to resolve next hop */
2376                 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2377                                    fwd_hdr->addr3, 0,
2378                                    WLAN_REASON_MESH_PATH_NOFORWARD,
2379                                    fwd_hdr->addr2);
2380                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2381                 kfree_skb(fwd_skb);
2382                 return RX_DROP_MONITOR;
2383         }
2384
2385         IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2386         ieee80211_add_pending_skb(local, fwd_skb);
2387  out:
2388         if (is_multicast_ether_addr(hdr->addr1))
2389                 return RX_CONTINUE;
2390         return RX_DROP_MONITOR;
2391 }
2392 #endif
2393
2394 static ieee80211_rx_result debug_noinline
2395 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2396 {
2397         struct ieee80211_sub_if_data *sdata = rx->sdata;
2398         struct ieee80211_local *local = rx->local;
2399         struct net_device *dev = sdata->dev;
2400         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2401         __le16 fc = hdr->frame_control;
2402         bool port_control;
2403         int err;
2404
2405         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2406                 return RX_CONTINUE;
2407
2408         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
2409                 return RX_DROP_MONITOR;
2410
2411         if (rx->sta) {
2412                 /* The seqno index has the same property as needed
2413                  * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2414                  * for non-QoS-data frames. Here we know it's a data
2415                  * frame, so count MSDUs.
2416                  */
2417                 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
2418         }
2419
2420         /*
2421          * Send unexpected-4addr-frame event to hostapd. For older versions,
2422          * also drop the frame to cooked monitor interfaces.
2423          */
2424         if (ieee80211_has_a4(hdr->frame_control) &&
2425             sdata->vif.type == NL80211_IFTYPE_AP) {
2426                 if (rx->sta &&
2427                     !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2428                         cfg80211_rx_unexpected_4addr_frame(
2429                                 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2430                 return RX_DROP_MONITOR;
2431         }
2432
2433         err = __ieee80211_data_to_8023(rx, &port_control);
2434         if (unlikely(err))
2435                 return RX_DROP_UNUSABLE;
2436
2437         if (!ieee80211_frame_allowed(rx, fc))
2438                 return RX_DROP_MONITOR;
2439
2440         /* directly handle TDLS channel switch requests/responses */
2441         if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2442                                                 cpu_to_be16(ETH_P_TDLS))) {
2443                 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2444
2445                 if (pskb_may_pull(rx->skb,
2446                                   offsetof(struct ieee80211_tdls_data, u)) &&
2447                     tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2448                     tf->category == WLAN_CATEGORY_TDLS &&
2449                     (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2450                      tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
2451                         skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2452                         schedule_work(&local->tdls_chsw_work);
2453                         if (rx->sta)
2454                                 rx->sta->rx_stats.packets++;
2455
2456                         return RX_QUEUED;
2457                 }
2458         }
2459
2460         if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2461             unlikely(port_control) && sdata->bss) {
2462                 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2463                                      u.ap);
2464                 dev = sdata->dev;
2465                 rx->sdata = sdata;
2466         }
2467
2468         rx->skb->dev = dev;
2469
2470         if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2471             !is_multicast_ether_addr(
2472                     ((struct ethhdr *)rx->skb->data)->h_dest) &&
2473             (!local->scanning &&
2474              !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2475                         mod_timer(&local->dynamic_ps_timer, jiffies +
2476                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2477         }
2478
2479         ieee80211_deliver_skb(rx);
2480
2481         return RX_QUEUED;
2482 }
2483
2484 static ieee80211_rx_result debug_noinline
2485 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2486 {
2487         struct sk_buff *skb = rx->skb;
2488         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2489         struct tid_ampdu_rx *tid_agg_rx;
2490         u16 start_seq_num;
2491         u16 tid;
2492
2493         if (likely(!ieee80211_is_ctl(bar->frame_control)))
2494                 return RX_CONTINUE;
2495
2496         if (ieee80211_is_back_req(bar->frame_control)) {
2497                 struct {
2498                         __le16 control, start_seq_num;
2499                 } __packed bar_data;
2500                 struct ieee80211_event event = {
2501                         .type = BAR_RX_EVENT,
2502                 };
2503
2504                 if (!rx->sta)
2505                         return RX_DROP_MONITOR;
2506
2507                 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2508                                   &bar_data, sizeof(bar_data)))
2509                         return RX_DROP_MONITOR;
2510
2511                 tid = le16_to_cpu(bar_data.control) >> 12;
2512
2513                 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2514                 if (!tid_agg_rx)
2515                         return RX_DROP_MONITOR;
2516
2517                 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2518                 event.u.ba.tid = tid;
2519                 event.u.ba.ssn = start_seq_num;
2520                 event.u.ba.sta = &rx->sta->sta;
2521
2522                 /* reset session timer */
2523                 if (tid_agg_rx->timeout)
2524                         mod_timer(&tid_agg_rx->session_timer,
2525                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
2526
2527                 spin_lock(&tid_agg_rx->reorder_lock);
2528                 /* release stored frames up to start of BAR */
2529                 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2530                                                  start_seq_num, frames);
2531                 spin_unlock(&tid_agg_rx->reorder_lock);
2532
2533                 drv_event_callback(rx->local, rx->sdata, &event);
2534
2535                 kfree_skb(skb);
2536                 return RX_QUEUED;
2537         }
2538
2539         /*
2540          * After this point, we only want management frames,
2541          * so we can drop all remaining control frames to
2542          * cooked monitor interfaces.
2543          */
2544         return RX_DROP_MONITOR;
2545 }
2546
2547 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2548                                            struct ieee80211_mgmt *mgmt,
2549                                            size_t len)
2550 {
2551         struct ieee80211_local *local = sdata->local;
2552         struct sk_buff *skb;
2553         struct ieee80211_mgmt *resp;
2554
2555         if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2556                 /* Not to own unicast address */
2557                 return;
2558         }
2559
2560         if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2561             !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2562                 /* Not from the current AP or not associated yet. */
2563                 return;
2564         }
2565
2566         if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2567                 /* Too short SA Query request frame */
2568                 return;
2569         }
2570
2571         skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2572         if (skb == NULL)
2573                 return;
2574
2575         skb_reserve(skb, local->hw.extra_tx_headroom);
2576         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2577         memset(resp, 0, 24);
2578         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2579         memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2580         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2581         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2582                                           IEEE80211_STYPE_ACTION);
2583         skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2584         resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2585         resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2586         memcpy(resp->u.action.u.sa_query.trans_id,
2587                mgmt->u.action.u.sa_query.trans_id,
2588                WLAN_SA_QUERY_TR_ID_LEN);
2589
2590         ieee80211_tx_skb(sdata, skb);
2591 }
2592
2593 static ieee80211_rx_result debug_noinline
2594 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2595 {
2596         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2597         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2598
2599         /*
2600          * From here on, look only at management frames.
2601          * Data and control frames are already handled,
2602          * and unknown (reserved) frames are useless.
2603          */
2604         if (rx->skb->len < 24)
2605                 return RX_DROP_MONITOR;
2606
2607         if (!ieee80211_is_mgmt(mgmt->frame_control))
2608                 return RX_DROP_MONITOR;
2609
2610         if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2611             ieee80211_is_beacon(mgmt->frame_control) &&
2612             !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2613                 int sig = 0;
2614
2615                 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
2616                         sig = status->signal;
2617
2618                 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2619                                             rx->skb->data, rx->skb->len,
2620                                             status->freq, sig);
2621                 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2622         }
2623
2624         if (ieee80211_drop_unencrypted_mgmt(rx))
2625                 return RX_DROP_UNUSABLE;
2626
2627         return RX_CONTINUE;
2628 }
2629
2630 static ieee80211_rx_result debug_noinline
2631 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2632 {
2633         struct ieee80211_local *local = rx->local;
2634         struct ieee80211_sub_if_data *sdata = rx->sdata;
2635         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2636         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2637         int len = rx->skb->len;
2638
2639         if (!ieee80211_is_action(mgmt->frame_control))
2640                 return RX_CONTINUE;
2641
2642         /* drop too small frames */
2643         if (len < IEEE80211_MIN_ACTION_SIZE)
2644                 return RX_DROP_UNUSABLE;
2645
2646         if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2647             mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2648             mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2649                 return RX_DROP_UNUSABLE;
2650
2651         switch (mgmt->u.action.category) {
2652         case WLAN_CATEGORY_HT:
2653                 /* reject HT action frames from stations not supporting HT */
2654                 if (!rx->sta->sta.ht_cap.ht_supported)
2655                         goto invalid;
2656
2657                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2658                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2659                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2660                     sdata->vif.type != NL80211_IFTYPE_AP &&
2661                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
2662                         break;
2663
2664                 /* verify action & smps_control/chanwidth are present */
2665                 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2666                         goto invalid;
2667
2668                 switch (mgmt->u.action.u.ht_smps.action) {
2669                 case WLAN_HT_ACTION_SMPS: {
2670                         struct ieee80211_supported_band *sband;
2671                         enum ieee80211_smps_mode smps_mode;
2672
2673                         /* convert to HT capability */
2674                         switch (mgmt->u.action.u.ht_smps.smps_control) {
2675                         case WLAN_HT_SMPS_CONTROL_DISABLED:
2676                                 smps_mode = IEEE80211_SMPS_OFF;
2677                                 break;
2678                         case WLAN_HT_SMPS_CONTROL_STATIC:
2679                                 smps_mode = IEEE80211_SMPS_STATIC;
2680                                 break;
2681                         case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2682                                 smps_mode = IEEE80211_SMPS_DYNAMIC;
2683                                 break;
2684                         default:
2685                                 goto invalid;
2686                         }
2687
2688                         /* if no change do nothing */
2689                         if (rx->sta->sta.smps_mode == smps_mode)
2690                                 goto handled;
2691                         rx->sta->sta.smps_mode = smps_mode;
2692
2693                         sband = rx->local->hw.wiphy->bands[status->band];
2694
2695                         rate_control_rate_update(local, sband, rx->sta,
2696                                                  IEEE80211_RC_SMPS_CHANGED);
2697                         goto handled;
2698                 }
2699                 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2700                         struct ieee80211_supported_band *sband;
2701                         u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2702                         enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
2703
2704                         /* If it doesn't support 40 MHz it can't change ... */
2705                         if (!(rx->sta->sta.ht_cap.cap &
2706                                         IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2707                                 goto handled;
2708
2709                         if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2710                                 max_bw = IEEE80211_STA_RX_BW_20;
2711                         else
2712                                 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2713
2714                         /* set cur_max_bandwidth and recalc sta bw */
2715                         rx->sta->cur_max_bandwidth = max_bw;
2716                         new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2717
2718                         if (rx->sta->sta.bandwidth == new_bw)
2719                                 goto handled;
2720
2721                         rx->sta->sta.bandwidth = new_bw;
2722                         sband = rx->local->hw.wiphy->bands[status->band];
2723
2724                         rate_control_rate_update(local, sband, rx->sta,
2725                                                  IEEE80211_RC_BW_CHANGED);
2726                         goto handled;
2727                 }
2728                 default:
2729                         goto invalid;
2730                 }
2731
2732                 break;
2733         case WLAN_CATEGORY_PUBLIC:
2734                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2735                         goto invalid;
2736                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2737                         break;
2738                 if (!rx->sta)
2739                         break;
2740                 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2741                         break;
2742                 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2743                                 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2744                         break;
2745                 if (len < offsetof(struct ieee80211_mgmt,
2746                                    u.action.u.ext_chan_switch.variable))
2747                         goto invalid;
2748                 goto queue;
2749         case WLAN_CATEGORY_VHT:
2750                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2751                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2752                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2753                     sdata->vif.type != NL80211_IFTYPE_AP &&
2754                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
2755                         break;
2756
2757                 /* verify action code is present */
2758                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2759                         goto invalid;
2760
2761                 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2762                 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
2763                         u8 opmode;
2764
2765                         /* verify opmode is present */
2766                         if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2767                                 goto invalid;
2768
2769                         opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
2770
2771                         ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2772                                                     opmode, status->band);
2773                         goto handled;
2774                 }
2775                 default:
2776                         break;
2777                 }
2778                 break;
2779         case WLAN_CATEGORY_BACK:
2780                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2781                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2782                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2783                     sdata->vif.type != NL80211_IFTYPE_AP &&
2784                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
2785                         break;
2786
2787                 /* verify action_code is present */
2788                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2789                         break;
2790
2791                 switch (mgmt->u.action.u.addba_req.action_code) {
2792                 case WLAN_ACTION_ADDBA_REQ:
2793                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2794                                    sizeof(mgmt->u.action.u.addba_req)))
2795                                 goto invalid;
2796                         break;
2797                 case WLAN_ACTION_ADDBA_RESP:
2798                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2799                                    sizeof(mgmt->u.action.u.addba_resp)))
2800                                 goto invalid;
2801                         break;
2802                 case WLAN_ACTION_DELBA:
2803                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2804                                    sizeof(mgmt->u.action.u.delba)))
2805                                 goto invalid;
2806                         break;
2807                 default:
2808                         goto invalid;
2809                 }
2810
2811                 goto queue;
2812         case WLAN_CATEGORY_SPECTRUM_MGMT:
2813                 /* verify action_code is present */
2814                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2815                         break;
2816
2817                 switch (mgmt->u.action.u.measurement.action_code) {
2818                 case WLAN_ACTION_SPCT_MSR_REQ:
2819                         if (status->band != IEEE80211_BAND_5GHZ)
2820                                 break;
2821
2822                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2823                                    sizeof(mgmt->u.action.u.measurement)))
2824                                 break;
2825
2826                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2827                                 break;
2828
2829                         ieee80211_process_measurement_req(sdata, mgmt, len);
2830                         goto handled;
2831                 case WLAN_ACTION_SPCT_CHL_SWITCH: {
2832                         u8 *bssid;
2833                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2834                                    sizeof(mgmt->u.action.u.chan_switch)))
2835                                 break;
2836
2837                         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2838                             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2839                             sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2840                                 break;
2841
2842                         if (sdata->vif.type == NL80211_IFTYPE_STATION)
2843                                 bssid = sdata->u.mgd.bssid;
2844                         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2845                                 bssid = sdata->u.ibss.bssid;
2846                         else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
2847                                 bssid = mgmt->sa;
2848                         else
2849                                 break;
2850
2851                         if (!ether_addr_equal(mgmt->bssid, bssid))
2852                                 break;
2853
2854                         goto queue;
2855                         }
2856                 }
2857                 break;
2858         case WLAN_CATEGORY_SA_QUERY:
2859                 if (len < (IEEE80211_MIN_ACTION_SIZE +
2860                            sizeof(mgmt->u.action.u.sa_query)))
2861                         break;
2862
2863                 switch (mgmt->u.action.u.sa_query.action) {
2864                 case WLAN_ACTION_SA_QUERY_REQUEST:
2865                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2866                                 break;
2867                         ieee80211_process_sa_query_req(sdata, mgmt, len);
2868                         goto handled;
2869                 }
2870                 break;
2871         case WLAN_CATEGORY_SELF_PROTECTED:
2872                 if (len < (IEEE80211_MIN_ACTION_SIZE +
2873                            sizeof(mgmt->u.action.u.self_prot.action_code)))
2874                         break;
2875
2876                 switch (mgmt->u.action.u.self_prot.action_code) {
2877                 case WLAN_SP_MESH_PEERING_OPEN:
2878                 case WLAN_SP_MESH_PEERING_CLOSE:
2879                 case WLAN_SP_MESH_PEERING_CONFIRM:
2880                         if (!ieee80211_vif_is_mesh(&sdata->vif))
2881                                 goto invalid;
2882                         if (sdata->u.mesh.user_mpm)
2883                                 /* userspace handles this frame */
2884                                 break;
2885                         goto queue;
2886                 case WLAN_SP_MGK_INFORM:
2887                 case WLAN_SP_MGK_ACK:
2888                         if (!ieee80211_vif_is_mesh(&sdata->vif))
2889                                 goto invalid;
2890                         break;
2891                 }
2892                 break;
2893         case WLAN_CATEGORY_MESH_ACTION:
2894                 if (len < (IEEE80211_MIN_ACTION_SIZE +
2895                            sizeof(mgmt->u.action.u.mesh_action.action_code)))
2896                         break;
2897
2898                 if (!ieee80211_vif_is_mesh(&sdata->vif))
2899                         break;
2900                 if (mesh_action_is_path_sel(mgmt) &&
2901                     !mesh_path_sel_is_hwmp(sdata))
2902                         break;
2903                 goto queue;
2904         }
2905
2906         return RX_CONTINUE;
2907
2908  invalid:
2909         status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2910         /* will return in the next handlers */
2911         return RX_CONTINUE;
2912
2913  handled:
2914         if (rx->sta)
2915                 rx->sta->rx_stats.packets++;
2916         dev_kfree_skb(rx->skb);
2917         return RX_QUEUED;
2918
2919  queue:
2920         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2921         skb_queue_tail(&sdata->skb_queue, rx->skb);
2922         ieee80211_queue_work(&local->hw, &sdata->work);
2923         if (rx->sta)
2924                 rx->sta->rx_stats.packets++;
2925         return RX_QUEUED;
2926 }
2927
2928 static ieee80211_rx_result debug_noinline
2929 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2930 {
2931         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2932         int sig = 0;
2933
2934         /* skip known-bad action frames and return them in the next handler */
2935         if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2936                 return RX_CONTINUE;
2937
2938         /*
2939          * Getting here means the kernel doesn't know how to handle
2940          * it, but maybe userspace does ... include returned frames
2941          * so userspace can register for those to know whether ones
2942          * it transmitted were processed or returned.
2943          */
2944
2945         if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
2946                 sig = status->signal;
2947
2948         if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2949                              rx->skb->data, rx->skb->len, 0)) {
2950                 if (rx->sta)
2951                         rx->sta->rx_stats.packets++;
2952                 dev_kfree_skb(rx->skb);
2953                 return RX_QUEUED;
2954         }
2955
2956         return RX_CONTINUE;
2957 }
2958
2959 static ieee80211_rx_result debug_noinline
2960 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2961 {
2962         struct ieee80211_local *local = rx->local;
2963         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2964         struct sk_buff *nskb;
2965         struct ieee80211_sub_if_data *sdata = rx->sdata;
2966         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2967
2968         if (!ieee80211_is_action(mgmt->frame_control))
2969                 return RX_CONTINUE;
2970
2971         /*
2972          * For AP mode, hostapd is responsible for handling any action
2973          * frames that we didn't handle, including returning unknown
2974          * ones. For all other modes we will return them to the sender,
2975          * setting the 0x80 bit in the action category, as required by
2976          * 802.11-2012 9.24.4.
2977          * Newer versions of hostapd shall also use the management frame
2978          * registration mechanisms, but older ones still use cooked
2979          * monitor interfaces so push all frames there.
2980          */
2981         if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2982             (sdata->vif.type == NL80211_IFTYPE_AP ||
2983              sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2984                 return RX_DROP_MONITOR;
2985
2986         if (is_multicast_ether_addr(mgmt->da))
2987                 return RX_DROP_MONITOR;
2988
2989         /* do not return rejected action frames */
2990         if (mgmt->u.action.category & 0x80)
2991                 return RX_DROP_UNUSABLE;
2992
2993         nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2994                                GFP_ATOMIC);
2995         if (nskb) {
2996                 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2997
2998                 nmgmt->u.action.category |= 0x80;
2999                 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3000                 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3001
3002                 memset(nskb->cb, 0, sizeof(nskb->cb));
3003
3004                 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3005                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3006
3007                         info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3008                                       IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3009                                       IEEE80211_TX_CTL_NO_CCK_RATE;
3010                         if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3011                                 info->hw_queue =
3012                                         local->hw.offchannel_tx_hw_queue;
3013                 }
3014
3015                 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
3016                                             status->band);
3017         }
3018         dev_kfree_skb(rx->skb);
3019         return RX_QUEUED;
3020 }
3021
3022 static ieee80211_rx_result debug_noinline
3023 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3024 {
3025         struct ieee80211_sub_if_data *sdata = rx->sdata;
3026         struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3027         __le16 stype;
3028
3029         stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3030
3031         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3032             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3033             sdata->vif.type != NL80211_IFTYPE_OCB &&
3034             sdata->vif.type != NL80211_IFTYPE_STATION)
3035                 return RX_DROP_MONITOR;
3036
3037         switch (stype) {
3038         case cpu_to_le16(IEEE80211_STYPE_AUTH):
3039         case cpu_to_le16(IEEE80211_STYPE_BEACON):
3040         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3041                 /* process for all: mesh, mlme, ibss */
3042                 break;
3043         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3044                 if (is_multicast_ether_addr(mgmt->da) &&
3045                     !is_broadcast_ether_addr(mgmt->da))
3046                         return RX_DROP_MONITOR;
3047
3048                 /* process only for station/IBSS */
3049                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3050                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
3051                         return RX_DROP_MONITOR;
3052                 break;
3053         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3054         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3055         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3056                 if (is_multicast_ether_addr(mgmt->da) &&
3057                     !is_broadcast_ether_addr(mgmt->da))
3058                         return RX_DROP_MONITOR;
3059
3060                 /* process only for station */
3061                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3062                         return RX_DROP_MONITOR;
3063                 break;
3064         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3065                 /* process only for ibss and mesh */
3066                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3067                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3068                         return RX_DROP_MONITOR;
3069                 break;
3070         default:
3071                 return RX_DROP_MONITOR;
3072         }
3073
3074         /* queue up frame and kick off work to process it */
3075         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
3076         skb_queue_tail(&sdata->skb_queue, rx->skb);
3077         ieee80211_queue_work(&rx->local->hw, &sdata->work);
3078         if (rx->sta)
3079                 rx->sta->rx_stats.packets++;
3080
3081         return RX_QUEUED;
3082 }
3083
3084 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3085                                         struct ieee80211_rate *rate)
3086 {
3087         struct ieee80211_sub_if_data *sdata;
3088         struct ieee80211_local *local = rx->local;
3089         struct sk_buff *skb = rx->skb, *skb2;
3090         struct net_device *prev_dev = NULL;
3091         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3092         int needed_headroom;
3093
3094         /*
3095          * If cooked monitor has been processed already, then
3096          * don't do it again. If not, set the flag.
3097          */
3098         if (rx->flags & IEEE80211_RX_CMNTR)
3099                 goto out_free_skb;
3100         rx->flags |= IEEE80211_RX_CMNTR;
3101
3102         /* If there are no cooked monitor interfaces, just free the SKB */
3103         if (!local->cooked_mntrs)
3104                 goto out_free_skb;
3105
3106         /* vendor data is long removed here */
3107         status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3108         /* room for the radiotap header based on driver features */
3109         needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3110
3111         if (skb_headroom(skb) < needed_headroom &&
3112             pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3113                 goto out_free_skb;
3114
3115         /* prepend radiotap information */
3116         ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3117                                          false);
3118
3119         skb_set_mac_header(skb, 0);
3120         skb->ip_summed = CHECKSUM_UNNECESSARY;
3121         skb->pkt_type = PACKET_OTHERHOST;
3122         skb->protocol = htons(ETH_P_802_2);
3123
3124         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3125                 if (!ieee80211_sdata_running(sdata))
3126                         continue;
3127
3128                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3129                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
3130                         continue;
3131
3132                 if (prev_dev) {
3133                         skb2 = skb_clone(skb, GFP_ATOMIC);
3134                         if (skb2) {
3135                                 skb2->dev = prev_dev;
3136                                 netif_receive_skb(skb2);
3137                         }
3138                 }
3139
3140                 prev_dev = sdata->dev;
3141                 ieee80211_rx_stats(sdata->dev, skb->len);
3142         }
3143
3144         if (prev_dev) {
3145                 skb->dev = prev_dev;
3146                 netif_receive_skb(skb);
3147                 return;
3148         }
3149
3150  out_free_skb:
3151         dev_kfree_skb(skb);
3152 }
3153
3154 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3155                                          ieee80211_rx_result res)
3156 {
3157         switch (res) {
3158         case RX_DROP_MONITOR:
3159                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3160                 if (rx->sta)
3161                         rx->sta->rx_stats.dropped++;
3162                 /* fall through */
3163         case RX_CONTINUE: {
3164                 struct ieee80211_rate *rate = NULL;
3165                 struct ieee80211_supported_band *sband;
3166                 struct ieee80211_rx_status *status;
3167
3168                 status = IEEE80211_SKB_RXCB((rx->skb));
3169
3170                 sband = rx->local->hw.wiphy->bands[status->band];
3171                 if (!(status->flag & RX_FLAG_HT) &&
3172                     !(status->flag & RX_FLAG_VHT))
3173                         rate = &sband->bitrates[status->rate_idx];
3174
3175                 ieee80211_rx_cooked_monitor(rx, rate);
3176                 break;
3177                 }
3178         case RX_DROP_UNUSABLE:
3179                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3180                 if (rx->sta)
3181                         rx->sta->rx_stats.dropped++;
3182                 dev_kfree_skb(rx->skb);
3183                 break;
3184         case RX_QUEUED:
3185                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3186                 break;
3187         }
3188 }
3189
3190 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3191                                   struct sk_buff_head *frames)
3192 {
3193         ieee80211_rx_result res = RX_DROP_MONITOR;
3194         struct sk_buff *skb;
3195
3196 #define CALL_RXH(rxh)                   \
3197         do {                            \
3198                 res = rxh(rx);          \
3199                 if (res != RX_CONTINUE) \
3200                         goto rxh_next;  \
3201         } while (0);
3202
3203         /* Lock here to avoid hitting all of the data used in the RX
3204          * path (e.g. key data, station data, ...) concurrently when
3205          * a frame is released from the reorder buffer due to timeout
3206          * from the timer, potentially concurrently with RX from the
3207          * driver.
3208          */
3209         spin_lock_bh(&rx->local->rx_path_lock);
3210
3211         while ((skb = __skb_dequeue(frames))) {
3212                 /*
3213                  * all the other fields are valid across frames
3214                  * that belong to an aMPDU since they are on the
3215                  * same TID from the same station
3216                  */
3217                 rx->skb = skb;
3218
3219                 CALL_RXH(ieee80211_rx_h_check_more_data)
3220                 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
3221                 CALL_RXH(ieee80211_rx_h_sta_process)
3222                 CALL_RXH(ieee80211_rx_h_decrypt)
3223                 CALL_RXH(ieee80211_rx_h_defragment)
3224                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
3225                 /* must be after MMIC verify so header is counted in MPDU mic */
3226 #ifdef CONFIG_MAC80211_MESH
3227                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3228                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
3229 #endif
3230                 CALL_RXH(ieee80211_rx_h_amsdu)
3231                 CALL_RXH(ieee80211_rx_h_data)
3232
3233                 /* special treatment -- needs the queue */
3234                 res = ieee80211_rx_h_ctrl(rx, frames);
3235                 if (res != RX_CONTINUE)
3236                         goto rxh_next;
3237
3238                 CALL_RXH(ieee80211_rx_h_mgmt_check)
3239                 CALL_RXH(ieee80211_rx_h_action)
3240                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
3241                 CALL_RXH(ieee80211_rx_h_action_return)
3242                 CALL_RXH(ieee80211_rx_h_mgmt)
3243
3244  rxh_next:
3245                 ieee80211_rx_handlers_result(rx, res);
3246
3247 #undef CALL_RXH
3248         }
3249
3250         spin_unlock_bh(&rx->local->rx_path_lock);
3251 }
3252
3253 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3254 {
3255         struct sk_buff_head reorder_release;
3256         ieee80211_rx_result res = RX_DROP_MONITOR;
3257
3258         __skb_queue_head_init(&reorder_release);
3259
3260 #define CALL_RXH(rxh)                   \
3261         do {                            \
3262                 res = rxh(rx);          \
3263                 if (res != RX_CONTINUE) \
3264                         goto rxh_next;  \
3265         } while (0);
3266
3267         CALL_RXH(ieee80211_rx_h_check_dup)
3268         CALL_RXH(ieee80211_rx_h_check)
3269
3270         ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3271
3272         ieee80211_rx_handlers(rx, &reorder_release);
3273         return;
3274
3275  rxh_next:
3276         ieee80211_rx_handlers_result(rx, res);
3277
3278 #undef CALL_RXH
3279 }
3280
3281 /*
3282  * This function makes calls into the RX path, therefore
3283  * it has to be invoked under RCU read lock.
3284  */
3285 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3286 {
3287         struct sk_buff_head frames;
3288         struct ieee80211_rx_data rx = {
3289                 .sta = sta,
3290                 .sdata = sta->sdata,
3291                 .local = sta->local,
3292                 /* This is OK -- must be QoS data frame */
3293                 .security_idx = tid,
3294                 .seqno_idx = tid,
3295                 .napi = NULL, /* must be NULL to not have races */
3296         };
3297         struct tid_ampdu_rx *tid_agg_rx;
3298
3299         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3300         if (!tid_agg_rx)
3301                 return;
3302
3303         __skb_queue_head_init(&frames);
3304
3305         spin_lock(&tid_agg_rx->reorder_lock);
3306         ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3307         spin_unlock(&tid_agg_rx->reorder_lock);
3308
3309         if (!skb_queue_empty(&frames)) {
3310                 struct ieee80211_event event = {
3311                         .type = BA_FRAME_TIMEOUT,
3312                         .u.ba.tid = tid,
3313                         .u.ba.sta = &sta->sta,
3314                 };
3315                 drv_event_callback(rx.local, rx.sdata, &event);
3316         }
3317
3318         ieee80211_rx_handlers(&rx, &frames);
3319 }
3320
3321 /* main receive path */
3322
3323 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
3324 {
3325         struct ieee80211_sub_if_data *sdata = rx->sdata;
3326         struct sk_buff *skb = rx->skb;
3327         struct ieee80211_hdr *hdr = (void *)skb->data;
3328         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3329         u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3330         int multicast = is_multicast_ether_addr(hdr->addr1);
3331
3332         switch (sdata->vif.type) {
3333         case NL80211_IFTYPE_STATION:
3334                 if (!bssid && !sdata->u.mgd.use_4addr)
3335                         return false;
3336                 if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
3337                         return false;
3338                 if (multicast)
3339                         return true;
3340                 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3341         case NL80211_IFTYPE_ADHOC:
3342                 if (!bssid)
3343                         return false;
3344                 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3345                     ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3346                         return false;
3347                 if (ieee80211_is_beacon(hdr->frame_control))
3348                         return true;
3349                 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3350                         return false;
3351                 if (!multicast &&
3352                     !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3353                         return false;
3354                 if (!rx->sta) {
3355                         int rate_idx;
3356                         if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3357                                 rate_idx = 0; /* TODO: HT/VHT rates */
3358                         else
3359                                 rate_idx = status->rate_idx;
3360                         ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3361                                                  BIT(rate_idx));
3362                 }
3363                 return true;
3364         case NL80211_IFTYPE_OCB:
3365                 if (!bssid)
3366                         return false;
3367                 if (!ieee80211_is_data_present(hdr->frame_control))
3368                         return false;
3369                 if (!is_broadcast_ether_addr(bssid))
3370                         return false;
3371                 if (!multicast &&
3372                     !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
3373                         return false;
3374                 if (!rx->sta) {
3375                         int rate_idx;
3376                         if (status->flag & RX_FLAG_HT)
3377                                 rate_idx = 0; /* TODO: HT rates */
3378                         else
3379                                 rate_idx = status->rate_idx;
3380                         ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3381                                                 BIT(rate_idx));
3382                 }
3383                 return true;
3384         case NL80211_IFTYPE_MESH_POINT:
3385                 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
3386                         return false;
3387                 if (multicast)
3388                         return true;
3389                 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3390         case NL80211_IFTYPE_AP_VLAN:
3391         case NL80211_IFTYPE_AP:
3392                 if (!bssid)
3393                         return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3394
3395                 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3396                         /*
3397                          * Accept public action frames even when the
3398                          * BSSID doesn't match, this is used for P2P
3399                          * and location updates. Note that mac80211
3400                          * itself never looks at these frames.
3401                          */
3402                         if (!multicast &&
3403                             !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3404                                 return false;
3405                         if (ieee80211_is_public_action(hdr, skb->len))
3406                                 return true;
3407                         return ieee80211_is_beacon(hdr->frame_control);
3408                 }
3409
3410                 if (!ieee80211_has_tods(hdr->frame_control)) {
3411                         /* ignore data frames to TDLS-peers */
3412                         if (ieee80211_is_data(hdr->frame_control))
3413                                 return false;
3414                         /* ignore action frames to TDLS-peers */
3415                         if (ieee80211_is_action(hdr->frame_control) &&
3416                             !is_broadcast_ether_addr(bssid) &&
3417                             !ether_addr_equal(bssid, hdr->addr1))
3418                                 return false;
3419                 }
3420
3421                 /*
3422                  * 802.11-2016 Table 9-26 says that for data frames, A1 must be
3423                  * the BSSID - we've checked that already but may have accepted
3424                  * the wildcard (ff:ff:ff:ff:ff:ff).
3425                  *
3426                  * It also says:
3427                  *      The BSSID of the Data frame is determined as follows:
3428                  *      a) If the STA is contained within an AP or is associated
3429                  *         with an AP, the BSSID is the address currently in use
3430                  *         by the STA contained in the AP.
3431                  *
3432                  * So we should not accept data frames with an address that's
3433                  * multicast.
3434                  *
3435                  * Accepting it also opens a security problem because stations
3436                  * could encrypt it with the GTK and inject traffic that way.
3437                  */
3438                 if (ieee80211_is_data(hdr->frame_control) && multicast)
3439                         return false;
3440
3441                 return true;
3442         case NL80211_IFTYPE_WDS:
3443                 if (bssid || !ieee80211_is_data(hdr->frame_control))
3444                         return false;
3445                 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
3446         case NL80211_IFTYPE_P2P_DEVICE:
3447                 return ieee80211_is_public_action(hdr, skb->len) ||
3448                        ieee80211_is_probe_req(hdr->frame_control) ||
3449                        ieee80211_is_probe_resp(hdr->frame_control) ||
3450                        ieee80211_is_beacon(hdr->frame_control);
3451         default:
3452                 break;
3453         }
3454
3455         WARN_ON_ONCE(1);
3456         return false;
3457 }
3458
3459 /*
3460  * This function returns whether or not the SKB
3461  * was destined for RX processing or not, which,
3462  * if consume is true, is equivalent to whether
3463  * or not the skb was consumed.
3464  */
3465 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
3466                                             struct sk_buff *skb, bool consume)
3467 {
3468         struct ieee80211_local *local = rx->local;
3469         struct ieee80211_sub_if_data *sdata = rx->sdata;
3470
3471         rx->skb = skb;
3472
3473         if (!ieee80211_accept_frame(rx))
3474                 return false;
3475
3476         if (!consume) {
3477                 skb = skb_copy(skb, GFP_ATOMIC);
3478                 if (!skb) {
3479                         if (net_ratelimit())
3480                                 wiphy_debug(local->hw.wiphy,
3481                                         "failed to copy skb for %s\n",
3482                                         sdata->name);
3483                         return true;
3484                 }
3485
3486                 rx->skb = skb;
3487         }
3488
3489         ieee80211_invoke_rx_handlers(rx);
3490         return true;
3491 }
3492
3493 /*
3494  * This is the actual Rx frames handler. as it belongs to Rx path it must
3495  * be called with rcu_read_lock protection.
3496  */
3497 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3498                                          struct sk_buff *skb,
3499                                          struct napi_struct *napi)
3500 {
3501         struct ieee80211_local *local = hw_to_local(hw);
3502         struct ieee80211_sub_if_data *sdata;
3503         struct ieee80211_hdr *hdr;
3504         __le16 fc;
3505         struct ieee80211_rx_data rx;
3506         struct ieee80211_sub_if_data *prev;
3507         struct sta_info *sta, *prev_sta;
3508         struct rhash_head *tmp;
3509         int err = 0;
3510
3511         fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3512         memset(&rx, 0, sizeof(rx));
3513         rx.skb = skb;
3514         rx.local = local;
3515         rx.napi = napi;
3516
3517         if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3518                 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
3519
3520         if (ieee80211_is_mgmt(fc)) {
3521                 /* drop frame if too short for header */
3522                 if (skb->len < ieee80211_hdrlen(fc))
3523                         err = -ENOBUFS;
3524                 else
3525                         err = skb_linearize(skb);
3526         } else {
3527                 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3528         }
3529
3530         if (err) {
3531                 dev_kfree_skb(skb);
3532                 return;
3533         }
3534
3535         hdr = (struct ieee80211_hdr *)skb->data;
3536         ieee80211_parse_qos(&rx);
3537         ieee80211_verify_alignment(&rx);
3538
3539         if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
3540                      ieee80211_is_beacon(hdr->frame_control)))
3541                 ieee80211_scan_rx(local, skb);
3542
3543         if (ieee80211_is_data(fc)) {
3544                 const struct bucket_table *tbl;
3545
3546                 prev_sta = NULL;
3547
3548                 tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
3549
3550                 for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) {
3551                         if (!prev_sta) {
3552                                 prev_sta = sta;
3553                                 continue;
3554                         }
3555
3556                         rx.sta = prev_sta;
3557                         rx.sdata = prev_sta->sdata;
3558                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
3559
3560                         prev_sta = sta;
3561                 }
3562
3563                 if (prev_sta) {
3564                         rx.sta = prev_sta;
3565                         rx.sdata = prev_sta->sdata;
3566
3567                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3568                                 return;
3569                         goto out;
3570                 }
3571         }
3572
3573         prev = NULL;
3574
3575         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3576                 if (!ieee80211_sdata_running(sdata))
3577                         continue;
3578
3579                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
3580                     sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3581                         continue;
3582
3583                 /*
3584                  * frame is destined for this interface, but if it's
3585                  * not also for the previous one we handle that after
3586                  * the loop to avoid copying the SKB once too much
3587                  */
3588
3589                 if (!prev) {
3590                         prev = sdata;
3591                         continue;
3592                 }
3593
3594                 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3595                 rx.sdata = prev;
3596                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
3597
3598                 prev = sdata;
3599         }
3600
3601         if (prev) {
3602                 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3603                 rx.sdata = prev;
3604
3605                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3606                         return;
3607         }
3608
3609  out:
3610         dev_kfree_skb(skb);
3611 }
3612
3613 /*
3614  * This is the receive path handler. It is called by a low level driver when an
3615  * 802.11 MPDU is received from the hardware.
3616  */
3617 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct sk_buff *skb,
3618                        struct napi_struct *napi)
3619 {
3620         struct ieee80211_local *local = hw_to_local(hw);
3621         struct ieee80211_rate *rate = NULL;
3622         struct ieee80211_supported_band *sband;
3623         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3624
3625         WARN_ON_ONCE(softirq_count() == 0);
3626
3627         if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
3628                 goto drop;
3629
3630         sband = local->hw.wiphy->bands[status->band];
3631         if (WARN_ON(!sband))
3632                 goto drop;
3633
3634         /*
3635          * If we're suspending, it is possible although not too likely
3636          * that we'd be receiving frames after having already partially
3637          * quiesced the stack. We can't process such frames then since
3638          * that might, for example, cause stations to be added or other
3639          * driver callbacks be invoked.
3640          */
3641         if (unlikely(local->quiescing || local->suspended))
3642                 goto drop;
3643
3644         /* We might be during a HW reconfig, prevent Rx for the same reason */
3645         if (unlikely(local->in_reconfig))
3646                 goto drop;
3647
3648         /*
3649          * The same happens when we're not even started,
3650          * but that's worth a warning.
3651          */
3652         if (WARN_ON(!local->started))
3653                 goto drop;
3654
3655         if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3656                 /*
3657                  * Validate the rate, unless a PLCP error means that
3658                  * we probably can't have a valid rate here anyway.
3659                  */
3660
3661                 if (status->flag & RX_FLAG_HT) {
3662                         /*
3663                          * rate_idx is MCS index, which can be [0-76]
3664                          * as documented on:
3665                          *
3666                          * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
3667                          *
3668                          * Anything else would be some sort of driver or
3669                          * hardware error. The driver should catch hardware
3670                          * errors.
3671                          */
3672                         if (WARN(status->rate_idx > 76,
3673                                  "Rate marked as an HT rate but passed "
3674                                  "status->rate_idx is not "
3675                                  "an MCS index [0-76]: %d (0x%02x)\n",
3676                                  status->rate_idx,
3677                                  status->rate_idx))
3678                                 goto drop;
3679                 } else if (status->flag & RX_FLAG_VHT) {
3680                         if (WARN_ONCE(status->rate_idx > 9 ||
3681                                       !status->vht_nss ||
3682                                       status->vht_nss > 8,
3683                                       "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
3684                                       status->rate_idx, status->vht_nss))
3685                                 goto drop;
3686                 } else {
3687                         if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3688                                 goto drop;
3689                         rate = &sband->bitrates[status->rate_idx];
3690                 }
3691         }
3692
3693         status->rx_flags = 0;
3694
3695         /*
3696          * key references and virtual interfaces are protected using RCU
3697          * and this requires that we are in a read-side RCU section during
3698          * receive processing
3699          */
3700         rcu_read_lock();
3701
3702         /*
3703          * Frames with failed FCS/PLCP checksum are not returned,
3704          * all other frames are returned without radiotap header
3705          * if it was previously present.
3706          * Also, frames with less than 16 bytes are dropped.
3707          */
3708         skb = ieee80211_rx_monitor(local, skb, rate);
3709         if (!skb) {
3710                 rcu_read_unlock();
3711                 return;
3712         }
3713
3714         ieee80211_tpt_led_trig_rx(local,
3715                         ((struct ieee80211_hdr *)skb->data)->frame_control,
3716                         skb->len);
3717         __ieee80211_rx_handle_packet(hw, skb, napi);
3718
3719         rcu_read_unlock();
3720
3721         return;
3722  drop:
3723         kfree_skb(skb);
3724 }
3725 EXPORT_SYMBOL(ieee80211_rx_napi);
3726
3727 /* This is a version of the rx handler that can be called from hard irq
3728  * context. Post the skb on the queue and schedule the tasklet */
3729 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3730 {
3731         struct ieee80211_local *local = hw_to_local(hw);
3732
3733         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
3734
3735         skb->pkt_type = IEEE80211_RX_MSG;
3736         skb_queue_tail(&local->skb_queue, skb);
3737         tasklet_schedule(&local->tasklet);
3738 }
3739 EXPORT_SYMBOL(ieee80211_rx_irqsafe);