net/mac80211/rx.c

   1 /*
   2  * Copyright 2002-2005, Instant802 Networks, Inc.
   3  * Copyright 2005-2006, Devicescape Software, Inc.
   4  * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
   5  * Copyright 2007-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/jiffies.h>
  14 #include <linux/slab.h>
  15 #include <linux/kernel.h>
  16 #include <linux/skbuff.h>
  17 #include <linux/netdevice.h>
  18 #include <linux/etherdevice.h>
  19 #include <linux/rcupdate.h>
  20 #include <linux/export.h>
  21 #include <net/mac80211.h>
  22 #include <net/ieee80211_radiotap.h>
  23 #include <asm/unaligned.h>
  24
  25 #include "ieee80211_i.h"
  26 #include "driver-ops.h"
  27 #include "led.h"
  28 #include "mesh.h"
  29 #include "wep.h"
  30 #include "wpa.h"
  31 #include "tkip.h"
  32 #include "wme.h"
  33 #include "rate.h"
  34
  35 static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
  36 {
  37         struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
  38
  39         u64_stats_update_begin(&tstats->syncp);
  40         tstats->rx_packets++;
  41         tstats->rx_bytes += len;
  42         u64_stats_update_end(&tstats->syncp);
  43 }
  44
  45 static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
  46                                enum nl80211_iftype type)
  47 {
  48         __le16 fc = hdr->frame_control;
  49
  50         if (ieee80211_is_data(fc)) {
  51                 if (len < 24) /* drop incorrect hdr len (data) */
  52                         return NULL;
  53
  54                 if (ieee80211_has_a4(fc))
  55                         return NULL;
  56                 if (ieee80211_has_tods(fc))
  57                         return hdr->addr1;
  58                 if (ieee80211_has_fromds(fc))
  59                         return hdr->addr2;
  60
  61                 return hdr->addr3;
  62         }
  63
  64         if (ieee80211_is_mgmt(fc)) {
  65                 if (len < 24) /* drop incorrect hdr len (mgmt) */
  66                         return NULL;
  67                 return hdr->addr3;
  68         }
  69
  70         if (ieee80211_is_ctl(fc)) {
  71                 if (ieee80211_is_pspoll(fc))
  72                         return hdr->addr1;
  73
  74                 if (ieee80211_is_back_req(fc)) {
  75                         switch (type) {
  76                         case NL80211_IFTYPE_STATION:
  77                                 return hdr->addr2;
  78                         case NL80211_IFTYPE_AP:
  79                         case NL80211_IFTYPE_AP_VLAN:
  80                                 return hdr->addr1;
  81                         default:
  82                                 break; /* fall through to the return */
  83                         }
  84                 }
  85         }
  86
  87         return NULL;
  88 }
  89
  90 /*
  91  * monitor mode reception
  92  *
  93  * This function cleans up the SKB, i.e. it removes all the stuff
  94  * only useful for monitoring.
  95  */
  96 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
  97                                            struct sk_buff *skb,
  98                                            unsigned int rtap_vendor_space)
  99 {
 100         if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
 101                 if (likely(skb->len > FCS_LEN))
 102                         __pskb_trim(skb, skb->len - FCS_LEN);
 103                 else {
 104                         /* driver bug */
 105                         WARN_ON(1);
 106                         dev_kfree_skb(skb);
 107                         return NULL;
 108                 }
 109         }
 110
 111         __pskb_pull(skb, rtap_vendor_space);
 112
 113         return skb;
 114 }
 115
 116 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
 117                                      unsigned int rtap_vendor_space)
 118 {
 119         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 120         struct ieee80211_hdr *hdr;
 121
 122         hdr = (void *)(skb->data + rtap_vendor_space);
 123
 124         if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
 125                             RX_FLAG_FAILED_PLCP_CRC))
 126                 return true;
 127
 128         if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
 129                 return true;
 130
 131         if (ieee80211_is_ctl(hdr->frame_control) &&
 132             !ieee80211_is_pspoll(hdr->frame_control) &&
 133             !ieee80211_is_back_req(hdr->frame_control))
 134                 return true;
 135
 136         return false;
 137 }
 138
 139 static int
 140 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
 141                              struct ieee80211_rx_status *status,
 142                              struct sk_buff *skb)
 143 {
 144         int len;
 145
 146         /* always present fields */
 147         len = sizeof(struct ieee80211_radiotap_header) + 8;
 148
 149         /* allocate extra bitmaps */
 150         if (status->chains)
 151                 len += 4 * hweight8(status->chains);
 152         /* vendor presence bitmap */
 153         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)
 154                 len += 4;
 155
 156         if (ieee80211_have_rx_timestamp(status)) {
 157                 len = ALIGN(len, 8);
 158                 len += 8;
 159         }
 160         if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
 161                 len += 1;
 162
 163         /* antenna field, if we don't have per-chain info */
 164         if (!status->chains)
 165                 len += 1;
 166
 167         /* padding for RX_FLAGS if necessary */
 168         len = ALIGN(len, 2);
 169
 170         if (status->flag & RX_FLAG_HT) /* HT info */
 171                 len += 3;
 172
 173         if (status->flag & RX_FLAG_AMPDU_DETAILS) {
 174                 len = ALIGN(len, 4);
 175                 len += 8;
 176         }
 177
 178         if (status->flag & RX_FLAG_VHT) {
 179                 len = ALIGN(len, 2);
 180                 len += 12;
 181         }
 182
 183         if (status->chains) {
 184                 /* antenna and antenna signal fields */
 185                 len += 2 * hweight8(status->chains);
 186         }
 187
 188         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 189                 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
 190
 191                 /* alignment for fixed 6-byte vendor data header */
 192                 len = ALIGN(len, 2);
 193                 /* vendor data header */
 194                 len += 6;
 195                 if (WARN_ON(rtap->align == 0))
 196                         rtap->align = 1;
 197                 len = ALIGN(len, rtap->align);
 198                 len += rtap->len + rtap->pad;
 199         }
 200
 201         return len;
 202 }
 203
 204 /*
 205  * ieee80211_add_rx_radiotap_header - add radiotap header
 206  *
 207  * add a radiotap header containing all the fields which the hardware provided.
 208  */
 209 static void
 210 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
 211                                  struct sk_buff *skb,
 212                                  struct ieee80211_rate *rate,
 213                                  int rtap_len, bool has_fcs)
 214 {
 215         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 216         struct ieee80211_radiotap_header *rthdr;
 217         unsigned char *pos;
 218         __le32 *it_present;
 219         u32 it_present_val;
 220         u16 rx_flags = 0;
 221         u16 channel_flags = 0;
 222         int mpdulen, chain;
 223         unsigned long chains = status->chains;
 224         struct ieee80211_vendor_radiotap rtap = {};
 225
 226         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 227                 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
 228                 /* rtap.len and rtap.pad are undone immediately */
 229                 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
 230         }
 231
 232         mpdulen = skb->len;
 233         if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
 234                 mpdulen += FCS_LEN;
 235
 236         rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
 237         memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
 238         it_present = &rthdr->it_present;
 239
 240         /* radiotap header, set always present flags */
 241         rthdr->it_len = cpu_to_le16(rtap_len);
 242         it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
 243                          BIT(IEEE80211_RADIOTAP_CHANNEL) |
 244                          BIT(IEEE80211_RADIOTAP_RX_FLAGS);
 245
 246         if (!status->chains)
 247                 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
 248
 249         for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
 250                 it_present_val |=
 251                         BIT(IEEE80211_RADIOTAP_EXT) |
 252                         BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
 253                 put_unaligned_le32(it_present_val, it_present);
 254                 it_present++;
 255                 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
 256                                  BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
 257         }
 258
 259         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 260                 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
 261                                   BIT(IEEE80211_RADIOTAP_EXT);
 262                 put_unaligned_le32(it_present_val, it_present);
 263                 it_present++;
 264                 it_present_val = rtap.present;
 265         }
 266
 267         put_unaligned_le32(it_present_val, it_present);
 268
 269         pos = (void *)(it_present + 1);
 270
 271         /* the order of the following fields is important */
 272
 273         /* IEEE80211_RADIOTAP_TSFT */
 274         if (ieee80211_have_rx_timestamp(status)) {
 275                 /* padding */
 276                 while ((pos - (u8 *)rthdr) & 7)
 277                         *pos++ = 0;
 278                 put_unaligned_le64(
 279                         ieee80211_calculate_rx_timestamp(local, status,
 280                                                          mpdulen, 0),
 281                         pos);
 282                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
 283                 pos += 8;
 284         }
 285
 286         /* IEEE80211_RADIOTAP_FLAGS */
 287         if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
 288                 *pos |= IEEE80211_RADIOTAP_F_FCS;
 289         if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
 290                 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
 291         if (status->flag & RX_FLAG_SHORTPRE)
 292                 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
 293         pos++;
 294
 295         /* IEEE80211_RADIOTAP_RATE */
 296         if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
 297                 /*
 298                  * Without rate information don't add it. If we have,
 299                  * MCS information is a separate field in radiotap,
 300                  * added below. The byte here is needed as padding
 301                  * for the channel though, so initialise it to 0.
 302                  */
 303                 *pos = 0;
 304         } else {
 305                 int shift = 0;
 306                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
 307                 if (status->flag & RX_FLAG_10MHZ)
 308                         shift = 1;
 309                 else if (status->flag & RX_FLAG_5MHZ)
 310                         shift = 2;
 311                 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
 312         }
 313         pos++;
 314
 315         /* IEEE80211_RADIOTAP_CHANNEL */
 316         put_unaligned_le16(status->freq, pos);
 317         pos += 2;
 318         if (status->flag & RX_FLAG_10MHZ)
 319                 channel_flags |= IEEE80211_CHAN_HALF;
 320         else if (status->flag & RX_FLAG_5MHZ)
 321                 channel_flags |= IEEE80211_CHAN_QUARTER;
 322
 323         if (status->band == IEEE80211_BAND_5GHZ)
 324                 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
 325         else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
 326                 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
 327         else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
 328                 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
 329         else if (rate)
 330                 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
 331         else
 332                 channel_flags |= IEEE80211_CHAN_2GHZ;
 333         put_unaligned_le16(channel_flags, pos);
 334         pos += 2;
 335
 336         /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
 337         if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
 338             !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
 339                 *pos = status->signal;
 340                 rthdr->it_present |=
 341                         cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
 342                 pos++;
 343         }
 344
 345         /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
 346
 347         if (!status->chains) {
 348                 /* IEEE80211_RADIOTAP_ANTENNA */
 349                 *pos = status->antenna;
 350                 pos++;
 351         }
 352
 353         /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
 354
 355         /* IEEE80211_RADIOTAP_RX_FLAGS */
 356         /* ensure 2 byte alignment for the 2 byte field as required */
 357         if ((pos - (u8 *)rthdr) & 1)
 358                 *pos++ = 0;
 359         if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
 360                 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
 361         put_unaligned_le16(rx_flags, pos);
 362         pos += 2;
 363
 364         if (status->flag & RX_FLAG_HT) {
 365                 unsigned int stbc;
 366
 367                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
 368                 *pos++ = local->hw.radiotap_mcs_details;
 369                 *pos = 0;
 370                 if (status->flag & RX_FLAG_SHORT_GI)
 371                         *pos |= IEEE80211_RADIOTAP_MCS_SGI;
 372                 if (status->flag & RX_FLAG_40MHZ)
 373                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
 374                 if (status->flag & RX_FLAG_HT_GF)
 375                         *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
 376                 if (status->flag & RX_FLAG_LDPC)
 377                         *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
 378                 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
 379                 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
 380                 pos++;
 381                 *pos++ = status->rate_idx;
 382         }
 383
 384         if (status->flag & RX_FLAG_AMPDU_DETAILS) {
 385                 u16 flags = 0;
 386
 387                 /* ensure 4 byte alignment */
 388                 while ((pos - (u8 *)rthdr) & 3)
 389                         pos++;
 390                 rthdr->it_present |=
 391                         cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
 392                 put_unaligned_le32(status->ampdu_reference, pos);
 393                 pos += 4;
 394                 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
 395                         flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
 396                 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
 397                         flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
 398                 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
 399                         flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
 400                 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
 401                         flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
 402                 put_unaligned_le16(flags, pos);
 403                 pos += 2;
 404                 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
 405                         *pos++ = status->ampdu_delimiter_crc;
 406                 else
 407                         *pos++ = 0;
 408                 *pos++ = 0;
 409         }
 410
 411         if (status->flag & RX_FLAG_VHT) {
 412                 u16 known = local->hw.radiotap_vht_details;
 413
 414                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
 415                 put_unaligned_le16(known, pos);
 416                 pos += 2;
 417                 /* flags */
 418                 if (status->flag & RX_FLAG_SHORT_GI)
 419                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
 420                 /* in VHT, STBC is binary */
 421                 if (status->flag & RX_FLAG_STBC_MASK)
 422                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
 423                 if (status->vht_flag & RX_VHT_FLAG_BF)
 424                         *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
 425                 pos++;
 426                 /* bandwidth */
 427                 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
 428                         *pos++ = 4;
 429                 else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
 430                         *pos++ = 11;
 431                 else if (status->flag & RX_FLAG_40MHZ)
 432                         *pos++ = 1;
 433                 else /* 20 MHz */
 434                         *pos++ = 0;
 435                 /* MCS/NSS */
 436                 *pos = (status->rate_idx << 4) | status->vht_nss;
 437                 pos += 4;
 438                 /* coding field */
 439                 if (status->flag & RX_FLAG_LDPC)
 440                         *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
 441                 pos++;
 442                 /* group ID */
 443                 pos++;
 444                 /* partial_aid */
 445                 pos += 2;
 446         }
 447
 448         for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
 449                 *pos++ = status->chain_signal[chain];
 450                 *pos++ = chain;
 451         }
 452
 453         if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
 454                 /* ensure 2 byte alignment for the vendor field as required */
 455                 if ((pos - (u8 *)rthdr) & 1)
 456                         *pos++ = 0;
 457                 *pos++ = rtap.oui[0];
 458                 *pos++ = rtap.oui[1];
 459                 *pos++ = rtap.oui[2];
 460                 *pos++ = rtap.subns;
 461                 put_unaligned_le16(rtap.len, pos);
 462                 pos += 2;
 463                 /* align the actual payload as requested */
 464                 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
 465                         *pos++ = 0;
 466                 /* data (and possible padding) already follows */
 467         }
 468 }
 469
 470 /*
 471  * This function copies a received frame to all monitor interfaces and
 472  * returns a cleaned-up SKB that no longer includes the FCS nor the
 473  * radiotap header the driver might have added.
 474  */
 475 static struct sk_buff *
 476 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 477                      struct ieee80211_rate *rate)
 478 {
 479         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
 480         struct ieee80211_sub_if_data *sdata;
 481         int rt_hdrlen, needed_headroom;
 482         struct sk_buff *skb, *skb2;
 483         struct net_device *prev_dev = NULL;
 484         int present_fcs_len = 0;
 485         unsigned int rtap_vendor_space = 0;
 486
 487         if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
 488                 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
 489
 490                 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
 491         }
 492
 493         /*
 494          * First, we may need to make a copy of the skb because
 495          *  (1) we need to modify it for radiotap (if not present), and
 496          *  (2) the other RX handlers will modify the skb we got.
 497          *
 498          * We don't need to, of course, if we aren't going to return
 499          * the SKB because it has a bad FCS/PLCP checksum.
 500          */
 501
 502         if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
 503                 present_fcs_len = FCS_LEN;
 504
 505         /* ensure hdr->frame_control and vendor radiotap data are in skb head */
 506         if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
 507                 dev_kfree_skb(origskb);
 508                 return NULL;
 509         }
 510
 511         if (!local->monitors) {
 512                 if (should_drop_frame(origskb, present_fcs_len,
 513                                       rtap_vendor_space)) {
 514                         dev_kfree_skb(origskb);
 515                         return NULL;
 516                 }
 517
 518                 return remove_monitor_info(local, origskb, rtap_vendor_space);
 519         }
 520
 521         /* room for the radiotap header based on driver features */
 522         rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
 523         needed_headroom = rt_hdrlen - rtap_vendor_space;
 524
 525         if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
 526                 /* only need to expand headroom if necessary */
 527                 skb = origskb;
 528                 origskb = NULL;
 529
 530                 /*
 531                  * This shouldn't trigger often because most devices have an
 532                  * RX header they pull before we get here, and that should
 533                  * be big enough for our radiotap information. We should
 534                  * probably export the length to drivers so that we can have
 535                  * them allocate enough headroom to start with.
 536                  */
 537                 if (skb_headroom(skb) < needed_headroom &&
 538                     pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
 539                         dev_kfree_skb(skb);
 540                         return NULL;
 541                 }
 542         } else {
 543                 /*
 544                  * Need to make a copy and possibly remove radiotap header
 545                  * and FCS from the original.
 546                  */
 547                 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
 548
 549                 origskb = remove_monitor_info(local, origskb,
 550                                               rtap_vendor_space);
 551
 552                 if (!skb)
 553                         return origskb;
 554         }
 555
 556         /* prepend radiotap information */
 557         ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
 558
 559         skb_reset_mac_header(skb);
 560         skb->ip_summed = CHECKSUM_UNNECESSARY;
 561         skb->pkt_type = PACKET_OTHERHOST;
 562         skb->protocol = htons(ETH_P_802_2);
 563
 564         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 565                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
 566                         continue;
 567
 568                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
 569                         continue;
 570
 571                 if (!ieee80211_sdata_running(sdata))
 572                         continue;
 573
 574                 if (prev_dev) {
 575                         skb2 = skb_clone(skb, GFP_ATOMIC);
 576                         if (skb2) {
 577                                 skb2->dev = prev_dev;
 578                                 netif_receive_skb(skb2);
 579                         }
 580                 }
 581
 582                 prev_dev = sdata->dev;
 583                 ieee80211_rx_stats(sdata->dev, skb->len);
 584         }
 585
 586         if (prev_dev) {
 587                 skb->dev = prev_dev;
 588                 netif_receive_skb(skb);
 589         } else
 590                 dev_kfree_skb(skb);
 591
 592         return origskb;
 593 }
 594
 595 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
 596 {
 597         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 598         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
 599         int tid, seqno_idx, security_idx;
 600
 601         /* does the frame have a qos control field? */
 602         if (ieee80211_is_data_qos(hdr->frame_control)) {
 603                 u8 *qc = ieee80211_get_qos_ctl(hdr);
 604                 /* frame has qos control */
 605                 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
 606                 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
 607                         status->rx_flags |= IEEE80211_RX_AMSDU;
 608
 609                 seqno_idx = tid;
 610                 security_idx = tid;
 611         } else {
 612                 /*
 613                  * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
 614                  *
 615                  *      Sequence numbers for management frames, QoS data
 616                  *      frames with a broadcast/multicast address in the
 617                  *      Address 1 field, and all non-QoS data frames sent
 618                  *      by QoS STAs are assigned using an additional single
 619                  *      modulo-4096 counter, [...]
 620                  *
 621                  * We also use that counter for non-QoS STAs.
 622                  */
 623                 seqno_idx = IEEE80211_NUM_TIDS;
 624                 security_idx = 0;
 625                 if (ieee80211_is_mgmt(hdr->frame_control))
 626                         security_idx = IEEE80211_NUM_TIDS;
 627                 tid = 0;
 628         }
 629
 630         rx->seqno_idx = seqno_idx;
 631         rx->security_idx = security_idx;
 632         /* Set skb->priority to 1d tag if highest order bit of TID is not set.
 633          * For now, set skb->priority to 0 for other cases. */
 634         rx->skb->priority = (tid > 7) ? 0 : tid;
 635 }
 636
 637 /**
 638  * DOC: Packet alignment
 639  *
 640  * Drivers always need to pass packets that are aligned to two-byte boundaries
 641  * to the stack.
 642  *
 643  * Additionally, should, if possible, align the payload data in a way that
 644  * guarantees that the contained IP header is aligned to a four-byte
 645  * boundary. In the case of regular frames, this simply means aligning the
 646  * payload to a four-byte boundary (because either the IP header is directly
 647  * contained, or IV/RFC1042 headers that have a length divisible by four are
 648  * in front of it).  If the payload data is not properly aligned and the
 649  * architecture doesn't support efficient unaligned operations, mac80211
 650  * will align the data.
 651  *
 652  * With A-MSDU frames, however, the payload data address must yield two modulo
 653  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 654  * push the IP header further back to a multiple of four again. Thankfully, the
 655  * specs were sane enough this time around to require padding each A-MSDU
 656  * subframe to a length that is a multiple of four.
 657  *
 658  * Padding like Atheros hardware adds which is between the 802.11 header and
 659  * the payload is not supported, the driver is required to move the 802.11
 660  * header to be directly in front of the payload in that case.
 661  */
 662 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 663 {
 664 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
 665         WARN_ONCE((unsigned long)rx->skb->data & 1,
 666                   "unaligned packet at 0x%p\n", rx->skb->data);
 667 #endif
 668 }
 669
 670
 671 /* rx handlers */
 672
 673 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
 674 {
 675         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 676
 677         if (is_multicast_ether_addr(hdr->addr1))
 678                 return 0;
 679
 680         return ieee80211_is_robust_mgmt_frame(skb);
 681 }
 682
 683
 684 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
 685 {
 686         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 687
 688         if (!is_multicast_ether_addr(hdr->addr1))
 689                 return 0;
 690
 691         return ieee80211_is_robust_mgmt_frame(skb);
 692 }
 693
 694
 695 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
 696 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
 697 {
 698         struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
 699         struct ieee80211_mmie *mmie;
 700         struct ieee80211_mmie_16 *mmie16;
 701
 702         if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
 703                 return -1;
 704
 705         if (!ieee80211_is_robust_mgmt_frame(skb))
 706                 return -1; /* not a robust management frame */
 707
 708         mmie = (struct ieee80211_mmie *)
 709                 (skb->data + skb->len - sizeof(*mmie));
 710         if (mmie->element_id == WLAN_EID_MMIE &&
 711             mmie->length == sizeof(*mmie) - 2)
 712                 return le16_to_cpu(mmie->key_id);
 713
 714         mmie16 = (struct ieee80211_mmie_16 *)
 715                 (skb->data + skb->len - sizeof(*mmie16));
 716         if (skb->len >= 24 + sizeof(*mmie16) &&
 717             mmie16->element_id == WLAN_EID_MMIE &&
 718             mmie16->length == sizeof(*mmie16) - 2)
 719                 return le16_to_cpu(mmie16->key_id);
 720
 721         return -1;
 722 }
 723
 724 static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
 725                                  struct sk_buff *skb)
 726 {
 727         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
 728         __le16 fc;
 729         int hdrlen;
 730         u8 keyid;
 731
 732         fc = hdr->frame_control;
 733         hdrlen = ieee80211_hdrlen(fc);
 734
 735         if (skb->len < hdrlen + cs->hdr_len)
 736                 return -EINVAL;
 737
 738         skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
 739         keyid &= cs->key_idx_mask;
 740         keyid >>= cs->key_idx_shift;
 741
 742         return keyid;
 743 }
 744
 745 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 746 {
 747         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 748         char *dev_addr = rx->sdata->vif.addr;
 749
 750         if (ieee80211_is_data(hdr->frame_control)) {
 751                 if (is_multicast_ether_addr(hdr->addr1)) {
 752                         if (ieee80211_has_tods(hdr->frame_control) ||
 753                             !ieee80211_has_fromds(hdr->frame_control))
 754                                 return RX_DROP_MONITOR;
 755                         if (ether_addr_equal(hdr->addr3, dev_addr))
 756                                 return RX_DROP_MONITOR;
 757                 } else {
 758                         if (!ieee80211_has_a4(hdr->frame_control))
 759                                 return RX_DROP_MONITOR;
 760                         if (ether_addr_equal(hdr->addr4, dev_addr))
 761                                 return RX_DROP_MONITOR;
 762                 }
 763         }
 764
 765         /* If there is not an established peer link and this is not a peer link
 766          * establisment frame, beacon or probe, drop the frame.
 767          */
 768
 769         if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
 770                 struct ieee80211_mgmt *mgmt;
 771
 772                 if (!ieee80211_is_mgmt(hdr->frame_control))
 773                         return RX_DROP_MONITOR;
 774
 775                 if (ieee80211_is_action(hdr->frame_control)) {
 776                         u8 category;
 777
 778                         /* make sure category field is present */
 779                         if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
 780                                 return RX_DROP_MONITOR;
 781
 782                         mgmt = (struct ieee80211_mgmt *)hdr;
 783                         category = mgmt->u.action.category;
 784                         if (category != WLAN_CATEGORY_MESH_ACTION &&
 785                             category != WLAN_CATEGORY_SELF_PROTECTED)
 786                                 return RX_DROP_MONITOR;
 787                         return RX_CONTINUE;
 788                 }
 789
 790                 if (ieee80211_is_probe_req(hdr->frame_control) ||
 791                     ieee80211_is_probe_resp(hdr->frame_control) ||
 792                     ieee80211_is_beacon(hdr->frame_control) ||
 793                     ieee80211_is_auth(hdr->frame_control))
 794                         return RX_CONTINUE;
 795
 796                 return RX_DROP_MONITOR;
 797         }
 798
 799         return RX_CONTINUE;
 800 }
 801
 802 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
 803                                             struct tid_ampdu_rx *tid_agg_rx,
 804                                             int index,
 805                                             struct sk_buff_head *frames)
 806 {
 807         struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
 808         struct sk_buff *skb;
 809         struct ieee80211_rx_status *status;
 810
 811         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 812
 813         if (skb_queue_empty(skb_list))
 814                 goto no_frame;
 815
 816         if (!ieee80211_rx_reorder_ready(skb_list)) {
 817                 __skb_queue_purge(skb_list);
 818                 goto no_frame;
 819         }
 820
 821         /* release frames from the reorder ring buffer */
 822         tid_agg_rx->stored_mpdu_num--;
 823         while ((skb = __skb_dequeue(skb_list))) {
 824                 status = IEEE80211_SKB_RXCB(skb);
 825                 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
 826                 __skb_queue_tail(frames, skb);
 827         }
 828
 829 no_frame:
 830         tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
 831 }
 832
 833 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
 834                                              struct tid_ampdu_rx *tid_agg_rx,
 835                                              u16 head_seq_num,
 836                                              struct sk_buff_head *frames)
 837 {
 838         int index;
 839
 840         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 841
 842         while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
 843                 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 844                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
 845                                                 frames);
 846         }
 847 }
 848
 849 /*
 850  * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 851  * the skb was added to the buffer longer than this time ago, the earlier
 852  * frames that have not yet been received are assumed to be lost and the skb
 853  * can be released for processing. This may also release other skb's from the
 854  * reorder buffer if there are no additional gaps between the frames.
 855  *
 856  * Callers must hold tid_agg_rx->reorder_lock.
 857  */
 858 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
 859
 860 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 861                                           struct tid_ampdu_rx *tid_agg_rx,
 862                                           struct sk_buff_head *frames)
 863 {
 864         int index, i, j;
 865
 866         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 867
 868         /* release the buffer until next missing frame */
 869         index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 870         if (!ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index]) &&
 871             tid_agg_rx->stored_mpdu_num) {
 872                 /*
 873                  * No buffers ready to be released, but check whether any
 874                  * frames in the reorder buffer have timed out.
 875                  */
 876                 int skipped = 1;
 877                 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
 878                      j = (j + 1) % tid_agg_rx->buf_size) {
 879                         if (!ieee80211_rx_reorder_ready(
 880                                         &tid_agg_rx->reorder_buf[j])) {
 881                                 skipped++;
 882                                 continue;
 883                         }
 884                         if (skipped &&
 885                             !time_after(jiffies, tid_agg_rx->reorder_time[j] +
 886                                         HT_RX_REORDER_BUF_TIMEOUT))
 887                                 goto set_release_timer;
 888
 889                         /* don't leave incomplete A-MSDUs around */
 890                         for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
 891                              i = (i + 1) % tid_agg_rx->buf_size)
 892                                 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
 893
 894                         ht_dbg_ratelimited(sdata,
 895                                            "release an RX reorder frame due to timeout on earlier frames\n");
 896                         ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
 897                                                         frames);
 898
 899                         /*
 900                          * Increment the head seq# also for the skipped slots.
 901                          */
 902                         tid_agg_rx->head_seq_num =
 903                                 (tid_agg_rx->head_seq_num +
 904                                  skipped) & IEEE80211_SN_MASK;
 905                         skipped = 0;
 906                 }
 907         } else while (ieee80211_rx_reorder_ready(
 908                                 &tid_agg_rx->reorder_buf[index])) {
 909                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
 910                                                 frames);
 911                 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 912         }
 913
 914         if (tid_agg_rx->stored_mpdu_num) {
 915                 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
 916
 917                 for (; j != (index - 1) % tid_agg_rx->buf_size;
 918                      j = (j + 1) % tid_agg_rx->buf_size) {
 919                         if (ieee80211_rx_reorder_ready(
 920                                         &tid_agg_rx->reorder_buf[j]))
 921                                 break;
 922                 }
 923
 924  set_release_timer:
 925
 926                 if (!tid_agg_rx->removed)
 927                         mod_timer(&tid_agg_rx->reorder_timer,
 928                                   tid_agg_rx->reorder_time[j] + 1 +
 929                                   HT_RX_REORDER_BUF_TIMEOUT);
 930         } else {
 931                 del_timer(&tid_agg_rx->reorder_timer);
 932         }
 933 }
 934
 935 /*
 936  * As this function belongs to the RX path it must be under
 937  * rcu_read_lock protection. It returns false if the frame
 938  * can be processed immediately, true if it was consumed.
 939  */
 940 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
 941                                              struct tid_ampdu_rx *tid_agg_rx,
 942                                              struct sk_buff *skb,
 943                                              struct sk_buff_head *frames)
 944 {
 945         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
 946         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 947         u16 sc = le16_to_cpu(hdr->seq_ctrl);
 948         u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
 949         u16 head_seq_num, buf_size;
 950         int index;
 951         bool ret = true;
 952
 953         spin_lock(&tid_agg_rx->reorder_lock);
 954
 955         /*
 956          * Offloaded BA sessions have no known starting sequence number so pick
 957          * one from first Rxed frame for this tid after BA was started.
 958          */
 959         if (unlikely(tid_agg_rx->auto_seq)) {
 960                 tid_agg_rx->auto_seq = false;
 961                 tid_agg_rx->ssn = mpdu_seq_num;
 962                 tid_agg_rx->head_seq_num = mpdu_seq_num;
 963         }
 964
 965         buf_size = tid_agg_rx->buf_size;
 966         head_seq_num = tid_agg_rx->head_seq_num;
 967
 968         /* frame with out of date sequence number */
 969         if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
 970                 dev_kfree_skb(skb);
 971                 goto out;
 972         }
 973
 974         /*
 975          * If frame the sequence number exceeds our buffering window
 976          * size release some previous frames to make room for this one.
 977          */
 978         if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
 979                 head_seq_num = ieee80211_sn_inc(
 980                                 ieee80211_sn_sub(mpdu_seq_num, buf_size));
 981                 /* release stored frames up to new head to stack */
 982                 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
 983                                                  head_seq_num, frames);
 984         }
 985
 986         /* Now the new frame is always in the range of the reordering buffer */
 987
 988         index = mpdu_seq_num % tid_agg_rx->buf_size;
 989
 990         /* check if we already stored this frame */
 991         if (ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index])) {
 992                 dev_kfree_skb(skb);
 993                 goto out;
 994         }
 995
 996         /*
 997          * If the current MPDU is in the right order and nothing else
 998          * is stored we can process it directly, no need to buffer it.
 999          * If it is first but there's something stored, we may be able
1000          * to release frames after this one.
1001          */
1002         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1003             tid_agg_rx->stored_mpdu_num == 0) {
1004                 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1005                         tid_agg_rx->head_seq_num =
1006                                 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1007                 ret = false;
1008                 goto out;
1009         }
1010
1011         /* put the frame in the reordering buffer */
1012         __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1013         if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1014                 tid_agg_rx->reorder_time[index] = jiffies;
1015                 tid_agg_rx->stored_mpdu_num++;
1016                 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1017         }
1018
1019  out:
1020         spin_unlock(&tid_agg_rx->reorder_lock);
1021         return ret;
1022 }
1023
1024 /*
1025  * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1026  * true if the MPDU was buffered, false if it should be processed.
1027  */
1028 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1029                                        struct sk_buff_head *frames)
1030 {
1031         struct sk_buff *skb = rx->skb;
1032         struct ieee80211_local *local = rx->local;
1033         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1034         struct sta_info *sta = rx->sta;
1035         struct tid_ampdu_rx *tid_agg_rx;
1036         u16 sc;
1037         u8 tid, ack_policy;
1038
1039         if (!ieee80211_is_data_qos(hdr->frame_control) ||
1040             is_multicast_ether_addr(hdr->addr1))
1041                 goto dont_reorder;
1042
1043         /*
1044          * filter the QoS data rx stream according to
1045          * STA/TID and check if this STA/TID is on aggregation
1046          */
1047
1048         if (!sta)
1049                 goto dont_reorder;
1050
1051         ack_policy = *ieee80211_get_qos_ctl(hdr) &
1052                      IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1053         tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1054
1055         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1056         if (!tid_agg_rx)
1057                 goto dont_reorder;
1058
1059         /* qos null data frames are excluded */
1060         if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1061                 goto dont_reorder;
1062
1063         /* not part of a BA session */
1064         if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1065             ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1066                 goto dont_reorder;
1067
1068         /* new, potentially un-ordered, ampdu frame - process it */
1069
1070         /* reset session timer */
1071         if (tid_agg_rx->timeout)
1072                 tid_agg_rx->last_rx = jiffies;
1073
1074         /* if this mpdu is fragmented - terminate rx aggregation session */
1075         sc = le16_to_cpu(hdr->seq_ctrl);
1076         if (sc & IEEE80211_SCTL_FRAG) {
1077                 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
1078                 skb_queue_tail(&rx->sdata->skb_queue, skb);
1079                 ieee80211_queue_work(&local->hw, &rx->sdata->work);
1080                 return;
1081         }
1082
1083         /*
1084          * No locking needed -- we will only ever process one
1085          * RX packet at a time, and thus own tid_agg_rx. All
1086          * other code manipulating it needs to (and does) make
1087          * sure that we cannot get to it any more before doing
1088          * anything with it.
1089          */
1090         if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1091                                              frames))
1092                 return;
1093
1094  dont_reorder:
1095         __skb_queue_tail(frames, skb);
1096 }
1097
1098 static ieee80211_rx_result debug_noinline
1099 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1100 {
1101         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1102         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1103
1104         /*
1105          * Drop duplicate 802.11 retransmissions
1106          * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1107          */
1108
1109         if (rx->skb->len < 24)
1110                 return RX_CONTINUE;
1111
1112         if (ieee80211_is_ctl(hdr->frame_control) ||
1113             ieee80211_is_any_nullfunc(hdr->frame_control) ||
1114             is_multicast_ether_addr(hdr->addr1))
1115                 return RX_CONTINUE;
1116
1117         if (!rx->sta)
1118                 return RX_CONTINUE;
1119
1120         if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1121                      rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1122                 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1123                 rx->sta->rx_stats.num_duplicates++;
1124                 return RX_DROP_UNUSABLE;
1125         } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1126                 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1127         }
1128
1129         return RX_CONTINUE;
1130 }
1131
1132 static ieee80211_rx_result debug_noinline
1133 ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1134 {
1135         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1136
1137         /* Drop disallowed frame classes based on STA auth/assoc state;
1138          * IEEE 802.11, Chap 5.5.
1139          *
1140          * mac80211 filters only based on association state, i.e. it drops
1141          * Class 3 frames from not associated stations. hostapd sends
1142          * deauth/disassoc frames when needed. In addition, hostapd is
1143          * responsible for filtering on both auth and assoc states.
1144          */
1145
1146         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1147                 return ieee80211_rx_mesh_check(rx);
1148
1149         if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1150                       ieee80211_is_pspoll(hdr->frame_control)) &&
1151                      rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1152                      rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1153                      rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
1154                      (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1155                 /*
1156                  * accept port control frames from the AP even when it's not
1157                  * yet marked ASSOC to prevent a race where we don't set the
1158                  * assoc bit quickly enough before it sends the first frame
1159                  */
1160                 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1161                     ieee80211_is_data_present(hdr->frame_control)) {
1162                         unsigned int hdrlen;
1163                         __be16 ethertype;
1164
1165                         hdrlen = ieee80211_hdrlen(hdr->frame_control);
1166
1167                         if (rx->skb->len < hdrlen + 8)
1168                                 return RX_DROP_MONITOR;
1169
1170                         skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1171                         if (ethertype == rx->sdata->control_port_protocol)
1172                                 return RX_CONTINUE;
1173                 }
1174
1175                 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1176                     cfg80211_rx_spurious_frame(rx->sdata->dev,
1177                                                hdr->addr2,
1178                                                GFP_ATOMIC))
1179                         return RX_DROP_UNUSABLE;
1180
1181                 return RX_DROP_MONITOR;
1182         }
1183
1184         return RX_CONTINUE;
1185 }
1186
1187
1188 static ieee80211_rx_result debug_noinline
1189 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1190 {
1191         struct ieee80211_local *local;
1192         struct ieee80211_hdr *hdr;
1193         struct sk_buff *skb;
1194
1195         local = rx->local;
1196         skb = rx->skb;
1197         hdr = (struct ieee80211_hdr *) skb->data;
1198
1199         if (!local->pspolling)
1200                 return RX_CONTINUE;
1201
1202         if (!ieee80211_has_fromds(hdr->frame_control))
1203                 /* this is not from AP */
1204                 return RX_CONTINUE;
1205
1206         if (!ieee80211_is_data(hdr->frame_control))
1207                 return RX_CONTINUE;
1208
1209         if (!ieee80211_has_moredata(hdr->frame_control)) {
1210                 /* AP has no more frames buffered for us */
1211                 local->pspolling = false;
1212                 return RX_CONTINUE;
1213         }
1214
1215         /* more data bit is set, let's request a new frame from the AP */
1216         ieee80211_send_pspoll(local, rx->sdata);
1217
1218         return RX_CONTINUE;
1219 }
1220
1221 static void sta_ps_start(struct sta_info *sta)
1222 {
1223         struct ieee80211_sub_if_data *sdata = sta->sdata;
1224         struct ieee80211_local *local = sdata->local;
1225         struct ps_data *ps;
1226         int tid;
1227
1228         if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1229             sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1230                 ps = &sdata->bss->ps;
1231         else
1232                 return;
1233
1234         atomic_inc(&ps->num_sta_ps);
1235         set_sta_flag(sta, WLAN_STA_PS_STA);
1236         if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1237                 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
1238         ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1239                sta->sta.addr, sta->sta.aid);
1240
1241         ieee80211_clear_fast_xmit(sta);
1242
1243         if (!sta->sta.txq[0])
1244                 return;
1245
1246         for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
1247                 struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
1248
1249                 if (!skb_queue_len(&txqi->queue))
1250                         set_bit(tid, &sta->txq_buffered_tids);
1251                 else
1252                         clear_bit(tid, &sta->txq_buffered_tids);
1253         }
1254 }
1255
1256 static void sta_ps_end(struct sta_info *sta)
1257 {
1258         ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1259                sta->sta.addr, sta->sta.aid);
1260
1261         if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1262                 /*
1263                  * Clear the flag only if the other one is still set
1264                  * so that the TX path won't start TX'ing new frames
1265                  * directly ... In the case that the driver flag isn't
1266                  * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1267                  */
1268                 clear_sta_flag(sta, WLAN_STA_PS_STA);
1269                 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1270                        sta->sta.addr, sta->sta.aid);
1271                 return;
1272         }
1273
1274         set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1275         clear_sta_flag(sta, WLAN_STA_PS_STA);
1276         ieee80211_sta_ps_deliver_wakeup(sta);
1277 }
1278
1279 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1280 {
1281         struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1282         bool in_ps;
1283
1284         WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1285
1286         /* Don't let the same PS state be set twice */
1287         in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1288         if ((start && in_ps) || (!start && !in_ps))
1289                 return -EINVAL;
1290
1291         if (start)
1292                 sta_ps_start(sta);
1293         else
1294                 sta_ps_end(sta);
1295
1296         return 0;
1297 }
1298 EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1299
1300 static ieee80211_rx_result debug_noinline
1301 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1302 {
1303         struct ieee80211_sub_if_data *sdata = rx->sdata;
1304         struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1305         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1306         int tid, ac;
1307
1308         if (!rx->sta)
1309                 return RX_CONTINUE;
1310
1311         if (sdata->vif.type != NL80211_IFTYPE_AP &&
1312             sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1313                 return RX_CONTINUE;
1314
1315         /*
1316          * The device handles station powersave, so don't do anything about
1317          * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1318          * it to mac80211 since they're handled.)
1319          */
1320         if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
1321                 return RX_CONTINUE;
1322
1323         /*
1324          * Don't do anything if the station isn't already asleep. In
1325          * the uAPSD case, the station will probably be marked asleep,
1326          * in the PS-Poll case the station must be confused ...
1327          */
1328         if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
1329                 return RX_CONTINUE;
1330
1331         if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1332                 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
1333                         if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1334                                 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1335                         else
1336                                 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1337                 }
1338
1339                 /* Free PS Poll skb here instead of returning RX_DROP that would
1340                  * count as an dropped frame. */
1341                 dev_kfree_skb(rx->skb);
1342
1343                 return RX_QUEUED;
1344         } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1345                    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1346                    ieee80211_has_pm(hdr->frame_control) &&
1347                    (ieee80211_is_data_qos(hdr->frame_control) ||
1348                     ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1349                 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1350                 ac = ieee802_1d_to_ac[tid & 7];
1351
1352                 /*
1353                  * If this AC is not trigger-enabled do nothing.
1354                  *
1355                  * NB: This could/should check a separate bitmap of trigger-
1356                  * enabled queues, but for now we only implement uAPSD w/o
1357                  * TSPEC changes to the ACs, so they're always the same.
1358                  */
1359                 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
1360                         return RX_CONTINUE;
1361
1362                 /* if we are in a service period, do nothing */
1363                 if (test_sta_flag(rx->sta, WLAN_STA_SP))
1364                         return RX_CONTINUE;
1365
1366                 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1367                         ieee80211_sta_ps_deliver_uapsd(rx->sta);
1368                 else
1369                         set_sta_flag(rx->sta, WLAN_STA_UAPSD);
1370         }
1371
1372         return RX_CONTINUE;
1373 }
1374
1375 static ieee80211_rx_result debug_noinline
1376 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1377 {
1378         struct sta_info *sta = rx->sta;
1379         struct sk_buff *skb = rx->skb;
1380         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1381         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1382         int i;
1383
1384         if (!sta)
1385                 return RX_CONTINUE;
1386
1387         /*
1388          * Update last_rx only for IBSS packets which are for the current
1389          * BSSID and for station already AUTHORIZED to avoid keeping the
1390          * current IBSS network alive in cases where other STAs start
1391          * using different BSSID. This will also give the station another
1392          * chance to restart the authentication/authorization in case
1393          * something went wrong the first time.
1394          */
1395         if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1396                 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1397                                                 NL80211_IFTYPE_ADHOC);
1398                 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1399                     test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1400                         sta->rx_stats.last_rx = jiffies;
1401                         if (ieee80211_is_data(hdr->frame_control) &&
1402                             !is_multicast_ether_addr(hdr->addr1)) {
1403                                 sta->rx_stats.last_rate_idx =
1404                                         status->rate_idx;
1405                                 sta->rx_stats.last_rate_flag =
1406                                         status->flag;
1407                                 sta->rx_stats.last_rate_vht_flag =
1408                                         status->vht_flag;
1409                                 sta->rx_stats.last_rate_vht_nss =
1410                                         status->vht_nss;
1411                         }
1412                 }
1413         } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1414                 sta->rx_stats.last_rx = jiffies;
1415         } else if (!is_multicast_ether_addr(hdr->addr1)) {
1416                 /*
1417                  * Mesh beacons will update last_rx when if they are found to
1418                  * match the current local configuration when processed.
1419                  */
1420                 sta->rx_stats.last_rx = jiffies;
1421                 if (ieee80211_is_data(hdr->frame_control)) {
1422                         sta->rx_stats.last_rate_idx = status->rate_idx;
1423                         sta->rx_stats.last_rate_flag = status->flag;
1424                         sta->rx_stats.last_rate_vht_flag = status->vht_flag;
1425                         sta->rx_stats.last_rate_vht_nss = status->vht_nss;
1426                 }
1427         }
1428
1429         if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1430                 ieee80211_sta_rx_notify(rx->sdata, hdr);
1431
1432         sta->rx_stats.fragments++;
1433         sta->rx_stats.bytes += rx->skb->len;
1434         if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1435                 sta->rx_stats.last_signal = status->signal;
1436                 ewma_signal_add(&sta->rx_stats.avg_signal, -status->signal);
1437         }
1438
1439         if (status->chains) {
1440                 sta->rx_stats.chains = status->chains;
1441                 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1442                         int signal = status->chain_signal[i];
1443
1444                         if (!(status->chains & BIT(i)))
1445                                 continue;
1446
1447                         sta->rx_stats.chain_signal_last[i] = signal;
1448                         ewma_signal_add(&sta->rx_stats.chain_signal_avg[i],
1449                                         -signal);
1450                 }
1451         }
1452
1453         /*
1454          * Change STA power saving mode only at the end of a frame
1455          * exchange sequence.
1456          */
1457         if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1458             !ieee80211_has_morefrags(hdr->frame_control) &&
1459             !ieee80211_is_back_req(hdr->frame_control) &&
1460             !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1461             (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1462              rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1463             /*
1464              * PM bit is only checked in frames where it isn't reserved,
1465              * in AP mode it's reserved in non-bufferable management frames
1466              * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
1467              * BAR frames should be ignored as specified in
1468              * IEEE 802.11-2012 10.2.1.2.
1469              */
1470             (!ieee80211_is_mgmt(hdr->frame_control) ||
1471              ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
1472                 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1473                         if (!ieee80211_has_pm(hdr->frame_control))
1474                                 sta_ps_end(sta);
1475                 } else {
1476                         if (ieee80211_has_pm(hdr->frame_control))
1477                                 sta_ps_start(sta);
1478                 }
1479         }
1480
1481         /* mesh power save support */
1482         if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1483                 ieee80211_mps_rx_h_sta_process(sta, hdr);
1484
1485         /*
1486          * Drop (qos-)data::nullfunc frames silently, since they
1487          * are used only to control station power saving mode.
1488          */
1489         if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
1490                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1491
1492                 /*
1493                  * If we receive a 4-addr nullfunc frame from a STA
1494                  * that was not moved to a 4-addr STA vlan yet send
1495                  * the event to userspace and for older hostapd drop
1496                  * the frame to the monitor interface.
1497                  */
1498                 if (ieee80211_has_a4(hdr->frame_control) &&
1499                     (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1500                      (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1501                       !rx->sdata->u.vlan.sta))) {
1502                         if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1503                                 cfg80211_rx_unexpected_4addr_frame(
1504                                         rx->sdata->dev, sta->sta.addr,
1505                                         GFP_ATOMIC);
1506                         return RX_DROP_MONITOR;
1507                 }
1508                 /*
1509                  * Update counter and free packet here to avoid
1510                  * counting this as a dropped packed.
1511                  */
1512                 sta->rx_stats.packets++;
1513                 dev_kfree_skb(rx->skb);
1514                 return RX_QUEUED;
1515         }
1516
1517         return RX_CONTINUE;
1518 } /* ieee80211_rx_h_sta_process */
1519
1520 static ieee80211_rx_result debug_noinline
1521 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1522 {
1523         struct sk_buff *skb = rx->skb;
1524         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1525         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1526         int keyidx;
1527         int hdrlen;
1528         ieee80211_rx_result result = RX_DROP_UNUSABLE;
1529         struct ieee80211_key *sta_ptk = NULL;
1530         int mmie_keyidx = -1;
1531         __le16 fc;
1532         const struct ieee80211_cipher_scheme *cs = NULL;
1533
1534         /*
1535          * Key selection 101
1536          *
1537          * There are four types of keys:
1538          *  - GTK (group keys)
1539          *  - IGTK (group keys for management frames)
1540          *  - PTK (pairwise keys)
1541          *  - STK (station-to-station pairwise keys)
1542          *
1543          * When selecting a key, we have to distinguish between multicast
1544          * (including broadcast) and unicast frames, the latter can only
1545          * use PTKs and STKs while the former always use GTKs and IGTKs.
1546          * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1547          * unicast frames can also use key indices like GTKs. Hence, if we
1548          * don't have a PTK/STK we check the key index for a WEP key.
1549          *
1550          * Note that in a regular BSS, multicast frames are sent by the
1551          * AP only, associated stations unicast the frame to the AP first
1552          * which then multicasts it on their behalf.
1553          *
1554          * There is also a slight problem in IBSS mode: GTKs are negotiated
1555          * with each station, that is something we don't currently handle.
1556          * The spec seems to expect that one negotiates the same key with
1557          * every station but there's no such requirement; VLANs could be
1558          * possible.
1559          */
1560
1561         /* start without a key */
1562         rx->key = NULL;
1563         fc = hdr->frame_control;
1564
1565         if (rx->sta) {
1566                 int keyid = rx->sta->ptk_idx;
1567
1568                 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1569                         cs = rx->sta->cipher_scheme;
1570                         keyid = iwl80211_get_cs_keyid(cs, rx->skb);
1571                         if (unlikely(keyid < 0))
1572                                 return RX_DROP_UNUSABLE;
1573                 }
1574                 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1575         }
1576
1577         if (!ieee80211_has_protected(fc))
1578                 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1579
1580         if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1581                 rx->key = sta_ptk;
1582                 if ((status->flag & RX_FLAG_DECRYPTED) &&
1583                     (status->flag & RX_FLAG_IV_STRIPPED))
1584                         return RX_CONTINUE;
1585                 /* Skip decryption if the frame is not protected. */
1586                 if (!ieee80211_has_protected(fc))
1587                         return RX_CONTINUE;
1588         } else if (mmie_keyidx >= 0) {
1589                 /* Broadcast/multicast robust management frame / BIP */
1590                 if ((status->flag & RX_FLAG_DECRYPTED) &&
1591                     (status->flag & RX_FLAG_IV_STRIPPED))
1592                         return RX_CONTINUE;
1593
1594                 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1595                     mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1596                         return RX_DROP_MONITOR; /* unexpected BIP keyidx */
1597                 if (rx->sta)
1598                         rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1599                 if (!rx->key)
1600                         rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1601         } else if (!ieee80211_has_protected(fc)) {
1602                 /*
1603                  * The frame was not protected, so skip decryption. However, we
1604                  * need to set rx->key if there is a key that could have been
1605                  * used so that the frame may be dropped if encryption would
1606                  * have been expected.
1607                  */
1608                 struct ieee80211_key *key = NULL;
1609                 struct ieee80211_sub_if_data *sdata = rx->sdata;
1610                 int i;
1611
1612                 if (ieee80211_is_mgmt(fc) &&
1613                     is_multicast_ether_addr(hdr->addr1) &&
1614                     (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1615                         rx->key = key;
1616                 else {
1617                         if (rx->sta) {
1618                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1619                                         key = rcu_dereference(rx->sta->gtk[i]);
1620                                         if (key)
1621                                                 break;
1622                                 }
1623                         }
1624                         if (!key) {
1625                                 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1626                                         key = rcu_dereference(sdata->keys[i]);
1627                                         if (key)
1628                                                 break;
1629                                 }
1630                         }
1631                         if (key)
1632                                 rx->key = key;
1633                 }
1634                 return RX_CONTINUE;
1635         } else {
1636                 u8 keyid;
1637
1638                 /*
1639                  * The device doesn't give us the IV so we won't be
1640                  * able to look up the key. That's ok though, we
1641                  * don't need to decrypt the frame, we just won't
1642                  * be able to keep statistics accurate.
1643                  * Except for key threshold notifications, should
1644                  * we somehow allow the driver to tell us which key
1645                  * the hardware used if this flag is set?
1646                  */
1647                 if ((status->flag & RX_FLAG_DECRYPTED) &&
1648                     (status->flag & RX_FLAG_IV_STRIPPED))
1649                         return RX_CONTINUE;
1650
1651                 hdrlen = ieee80211_hdrlen(fc);
1652
1653                 if (cs) {
1654                         keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
1655
1656                         if (unlikely(keyidx < 0))
1657                                 return RX_DROP_UNUSABLE;
1658                 } else {
1659                         if (rx->skb->len < 8 + hdrlen)
1660                                 return RX_DROP_UNUSABLE; /* TODO: count this? */
1661                         /*
1662                          * no need to call ieee80211_wep_get_keyidx,
1663                          * it verifies a bunch of things we've done already
1664                          */
1665                         skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1666                         keyidx = keyid >> 6;
1667                 }
1668
1669                 /* check per-station GTK first, if multicast packet */
1670                 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1671                         rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1672
1673                 /* if not found, try default key */
1674                 if (!rx->key) {
1675                         rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1676
1677                         /*
1678                          * RSNA-protected unicast frames should always be
1679                          * sent with pairwise or station-to-station keys,
1680                          * but for WEP we allow using a key index as well.
1681                          */
1682                         if (rx->key &&
1683                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1684                             rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1685                             !is_multicast_ether_addr(hdr->addr1))
1686                                 rx->key = NULL;
1687                 }
1688         }
1689
1690         if (rx->key) {
1691                 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1692                         return RX_DROP_MONITOR;
1693
1694                 /* TODO: add threshold stuff again */
1695         } else {
1696                 return RX_DROP_MONITOR;
1697         }
1698
1699         switch (rx->key->conf.cipher) {
1700         case WLAN_CIPHER_SUITE_WEP40:
1701         case WLAN_CIPHER_SUITE_WEP104:
1702                 result = ieee80211_crypto_wep_decrypt(rx);
1703                 break;
1704         case WLAN_CIPHER_SUITE_TKIP:
1705                 result = ieee80211_crypto_tkip_decrypt(rx);
1706                 break;
1707         case WLAN_CIPHER_SUITE_CCMP:
1708                 result = ieee80211_crypto_ccmp_decrypt(
1709                         rx, IEEE80211_CCMP_MIC_LEN);
1710                 break;
1711         case WLAN_CIPHER_SUITE_CCMP_256:
1712                 result = ieee80211_crypto_ccmp_decrypt(
1713                         rx, IEEE80211_CCMP_256_MIC_LEN);
1714                 break;
1715         case WLAN_CIPHER_SUITE_AES_CMAC:
1716                 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1717                 break;
1718         case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1719                 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
1720                 break;
1721         case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1722         case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1723                 result = ieee80211_crypto_aes_gmac_decrypt(rx);
1724                 break;
1725         case WLAN_CIPHER_SUITE_GCMP:
1726         case WLAN_CIPHER_SUITE_GCMP_256:
1727                 result = ieee80211_crypto_gcmp_decrypt(rx);
1728                 break;
1729         default:
1730                 result = ieee80211_crypto_hw_decrypt(rx);
1731         }
1732
1733         /* the hdr variable is invalid after the decrypt handlers */
1734
1735         /* either the frame has been decrypted or will be dropped */
1736         status->flag |= RX_FLAG_DECRYPTED;
1737
1738         return result;
1739 }
1740
1741 void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache)
1742 {
1743         int i;
1744
1745         for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
1746                 skb_queue_head_init(&cache->entries[i].skb_list);
1747 }
1748
1749 void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache)
1750 {
1751         int i;
1752
1753         for (i = 0; i < ARRAY_SIZE(cache->entries); i++)
1754                 __skb_queue_purge(&cache->entries[i].skb_list);
1755 }
1756
1757 static inline struct ieee80211_fragment_entry *
1758 ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache,
1759                          unsigned int frag, unsigned int seq, int rx_queue,
1760                          struct sk_buff **skb)
1761 {
1762         struct ieee80211_fragment_entry *entry;
1763
1764         entry = &cache->entries[cache->next++];
1765         if (cache->next >= IEEE80211_FRAGMENT_MAX)
1766                 cache->next = 0;
1767
1768         __skb_queue_purge(&entry->skb_list);
1769
1770         __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1771         *skb = NULL;
1772         entry->first_frag_time = jiffies;
1773         entry->seq = seq;
1774         entry->rx_queue = rx_queue;
1775         entry->last_frag = frag;
1776         entry->check_sequential_pn = false;
1777         entry->extra_len = 0;
1778
1779         return entry;
1780 }
1781
1782 static inline struct ieee80211_fragment_entry *
1783 ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache,
1784                           unsigned int frag, unsigned int seq,
1785                           int rx_queue, struct ieee80211_hdr *hdr)
1786 {
1787         struct ieee80211_fragment_entry *entry;
1788         int i, idx;
1789
1790         idx = cache->next;
1791         for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1792                 struct ieee80211_hdr *f_hdr;
1793
1794                 idx--;
1795                 if (idx < 0)
1796                         idx = IEEE80211_FRAGMENT_MAX - 1;
1797
1798                 entry = &cache->entries[idx];
1799                 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1800                     entry->rx_queue != rx_queue ||
1801                     entry->last_frag + 1 != frag)
1802                         continue;
1803
1804                 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1805
1806                 /*
1807                  * Check ftype and addresses are equal, else check next fragment
1808                  */
1809                 if (((hdr->frame_control ^ f_hdr->frame_control) &
1810                      cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1811                     !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1812                     !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1813                         continue;
1814
1815                 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1816                         __skb_queue_purge(&entry->skb_list);
1817                         continue;
1818                 }
1819                 return entry;
1820         }
1821
1822         return NULL;
1823 }
1824
1825 static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc)
1826 {
1827         return rx->key &&
1828                 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
1829                  rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
1830                  rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
1831                  rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
1832                 ieee80211_has_protected(fc);
1833 }
1834
1835 static ieee80211_rx_result debug_noinline
1836 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1837 {
1838         struct ieee80211_fragment_cache *cache = &rx->sdata->frags;
1839         struct ieee80211_hdr *hdr;
1840         u16 sc;
1841         __le16 fc;
1842         unsigned int frag, seq;
1843         struct ieee80211_fragment_entry *entry;
1844         struct sk_buff *skb;
1845         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1846
1847         hdr = (struct ieee80211_hdr *)rx->skb->data;
1848         fc = hdr->frame_control;
1849
1850         if (ieee80211_is_ctl(fc))
1851                 return RX_CONTINUE;
1852
1853         sc = le16_to_cpu(hdr->seq_ctrl);
1854         frag = sc & IEEE80211_SCTL_FRAG;
1855
1856         if (rx->sta)
1857                 cache = &rx->sta->frags;
1858
1859         if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1860                 goto out;
1861
1862         if (is_multicast_ether_addr(hdr->addr1))
1863                 return RX_DROP_MONITOR;
1864
1865         I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1866
1867         if (skb_linearize(rx->skb))
1868                 return RX_DROP_UNUSABLE;
1869
1870         /*
1871          *  skb_linearize() might change the skb->data and
1872          *  previously cached variables (in this case, hdr) need to
1873          *  be refreshed with the new data.
1874          */
1875         hdr = (struct ieee80211_hdr *)rx->skb->data;
1876         seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1877
1878         if (frag == 0) {
1879                 /* This is the first fragment of a new frame. */
1880                 entry = ieee80211_reassemble_add(cache, frag, seq,
1881                                                  rx->seqno_idx, &(rx->skb));
1882                 if (requires_sequential_pn(rx, fc)) {
1883                         int queue = rx->security_idx;
1884
1885                         /* Store CCMP/GCMP PN so that we can verify that the
1886                          * next fragment has a sequential PN value.
1887                          */
1888                         entry->check_sequential_pn = true;
1889                         entry->is_protected = true;
1890                         entry->key_color = rx->key->color;
1891                         memcpy(entry->last_pn,
1892                                rx->key->u.ccmp.rx_pn[queue],
1893                                IEEE80211_CCMP_PN_LEN);
1894                         BUILD_BUG_ON(offsetof(struct ieee80211_key,
1895                                               u.ccmp.rx_pn) !=
1896                                      offsetof(struct ieee80211_key,
1897                                               u.gcmp.rx_pn));
1898                         BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
1899                                      sizeof(rx->key->u.gcmp.rx_pn[queue]));
1900                         BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
1901                                      IEEE80211_GCMP_PN_LEN);
1902                 } else if (rx->key &&
1903                            (ieee80211_has_protected(fc) ||
1904                             (status->flag & RX_FLAG_DECRYPTED))) {
1905                         entry->is_protected = true;
1906                         entry->key_color = rx->key->color;
1907                 }
1908                 return RX_QUEUED;
1909         }
1910
1911         /* This is a fragment for a frame that should already be pending in
1912          * fragment cache. Add this fragment to the end of the pending entry.
1913          */
1914         entry = ieee80211_reassemble_find(cache, frag, seq,
1915                                           rx->seqno_idx, hdr);
1916         if (!entry) {
1917                 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1918                 return RX_DROP_MONITOR;
1919         }
1920
1921         /* "The receiver shall discard MSDUs and MMPDUs whose constituent
1922          *  MPDU PN values are not incrementing in steps of 1."
1923          * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
1924          * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
1925          */
1926         if (entry->check_sequential_pn) {
1927                 int i;
1928                 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1929
1930                 if (!requires_sequential_pn(rx, fc))
1931                         return RX_DROP_UNUSABLE;
1932
1933                 /* Prevent mixed key and fragment cache attacks */
1934                 if (entry->key_color != rx->key->color)
1935                         return RX_DROP_UNUSABLE;
1936
1937                 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
1938                 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1939                         pn[i]++;
1940                         if (pn[i])
1941                                 break;
1942                 }
1943
1944                 rpn = rx->ccm_gcm.pn;
1945                 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
1946                         return RX_DROP_UNUSABLE;
1947                 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1948         } else if (entry->is_protected &&
1949                    (!rx->key ||
1950                     (!ieee80211_has_protected(fc) &&
1951                      !(status->flag & RX_FLAG_DECRYPTED)) ||
1952                     rx->key->color != entry->key_color)) {
1953                 /* Drop this as a mixed key or fragment cache attack, even
1954                  * if for TKIP Michael MIC should protect us, and WEP is a
1955                  * lost cause anyway.
1956                  */
1957                 return RX_DROP_UNUSABLE;
1958         } else if (entry->is_protected && rx->key &&
1959                    entry->key_color != rx->key->color &&
1960                    (status->flag & RX_FLAG_DECRYPTED)) {
1961                 return RX_DROP_UNUSABLE;
1962         }
1963
1964         skb_pull(rx->skb, ieee80211_hdrlen(fc));
1965         __skb_queue_tail(&entry->skb_list, rx->skb);
1966         entry->last_frag = frag;
1967         entry->extra_len += rx->skb->len;
1968         if (ieee80211_has_morefrags(fc)) {
1969                 rx->skb = NULL;
1970                 return RX_QUEUED;
1971         }
1972
1973         rx->skb = __skb_dequeue(&entry->skb_list);
1974         if (skb_tailroom(rx->skb) < entry->extra_len) {
1975                 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
1976                 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1977                                               GFP_ATOMIC))) {
1978                         I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1979                         __skb_queue_purge(&entry->skb_list);
1980                         return RX_DROP_UNUSABLE;
1981                 }
1982         }
1983         while ((skb = __skb_dequeue(&entry->skb_list))) {
1984                 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1985                 dev_kfree_skb(skb);
1986         }
1987
1988         /* Complete frame has been reassembled - process it now */
1989         status = IEEE80211_SKB_RXCB(rx->skb);
1990
1991  out:
1992         ieee80211_led_rx(rx->local);
1993         if (rx->sta)
1994                 rx->sta->rx_stats.packets++;
1995         return RX_CONTINUE;
1996 }
1997
1998 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1999 {
2000         if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2001                 return -EACCES;
2002
2003         return 0;
2004 }
2005
2006 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2007 {
2008         struct ieee80211_hdr *hdr = (void *)rx->skb->data;
2009         struct sk_buff *skb = rx->skb;
2010         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2011
2012         /*
2013          * Pass through unencrypted frames if the hardware has
2014          * decrypted them already.
2015          */
2016         if (status->flag & RX_FLAG_DECRYPTED)
2017                 return 0;
2018
2019         /* check mesh EAPOL frames first */
2020         if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
2021                      ieee80211_is_data(fc))) {
2022                 struct ieee80211s_hdr *mesh_hdr;
2023                 u16 hdr_len = ieee80211_hdrlen(fc);
2024                 u16 ethertype_offset;
2025                 __be16 ethertype;
2026
2027                 if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
2028                         goto drop_check;
2029
2030                 /* make sure fixed part of mesh header is there, also checks skb len */
2031                 if (!pskb_may_pull(rx->skb, hdr_len + 6))
2032                         goto drop_check;
2033
2034                 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
2035                 ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
2036                                    sizeof(rfc1042_header);
2037
2038                 if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
2039                     ethertype == rx->sdata->control_port_protocol)
2040                         return 0;
2041         }
2042
2043 drop_check:
2044         /* Drop unencrypted frames if key is set. */
2045         if (unlikely(!ieee80211_has_protected(fc) &&
2046                      !ieee80211_is_any_nullfunc(fc) &&
2047                      ieee80211_is_data(fc) && rx->key))
2048                 return -EACCES;
2049
2050         return 0;
2051 }
2052
2053 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2054 {
2055         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2056         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2057         __le16 fc = hdr->frame_control;
2058
2059         /*
2060          * Pass through unencrypted frames if the hardware has
2061          * decrypted them already.
2062          */
2063         if (status->flag & RX_FLAG_DECRYPTED)
2064                 return 0;
2065
2066         if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2067                 if (unlikely(!ieee80211_has_protected(fc) &&
2068                              ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
2069                              rx->key)) {
2070                         if (ieee80211_is_deauth(fc) ||
2071                             ieee80211_is_disassoc(fc))
2072                                 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2073                                                              rx->skb->data,
2074                                                              rx->skb->len);
2075                         return -EACCES;
2076                 }
2077                 /* BIP does not use Protected field, so need to check MMIE */
2078                 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2079                              ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2080                         if (ieee80211_is_deauth(fc) ||
2081                             ieee80211_is_disassoc(fc))
2082                                 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2083                                                              rx->skb->data,
2084                                                              rx->skb->len);
2085                         return -EACCES;
2086                 }
2087                 /*
2088                  * When using MFP, Action frames are not allowed prior to
2089                  * having configured keys.
2090                  */
2091                 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2092                              ieee80211_is_robust_mgmt_frame(rx->skb)))
2093                         return -EACCES;
2094         }
2095
2096         return 0;
2097 }
2098
2099 static int
2100 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2101 {
2102         struct ieee80211_sub_if_data *sdata = rx->sdata;
2103         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2104         bool check_port_control = false;
2105         struct ethhdr *ehdr;
2106         int ret;
2107
2108         *port_control = false;
2109         if (ieee80211_has_a4(hdr->frame_control) &&
2110             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2111                 return -1;
2112
2113         if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2114             !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2115
2116                 if (!sdata->u.mgd.use_4addr)
2117                         return -1;
2118                 else
2119                         check_port_control = true;
2120         }
2121
2122         if (is_multicast_ether_addr(hdr->addr1) &&
2123             sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2124                 return -1;
2125
2126         ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2127         if (ret < 0)
2128                 return ret;
2129
2130         ehdr = (struct ethhdr *) rx->skb->data;
2131         if (ehdr->h_proto == rx->sdata->control_port_protocol)
2132                 *port_control = true;
2133         else if (check_port_control)
2134                 return -1;
2135
2136         return 0;
2137 }
2138
2139 /*
2140  * requires that rx->skb is a frame with ethernet header
2141  */
2142 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2143 {
2144         static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2145                 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2146         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2147
2148         /*
2149          * Allow EAPOL frames to us/the PAE group address regardless of
2150          * whether the frame was encrypted or not, and always disallow
2151          * all other destination addresses for them.
2152          */
2153         if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol))
2154                 return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2155                        ether_addr_equal(ehdr->h_dest, pae_group_addr);
2156
2157         if (ieee80211_802_1x_port_control(rx) ||
2158             ieee80211_drop_unencrypted(rx, fc))
2159                 return false;
2160
2161         return true;
2162 }
2163
2164 /*
2165  * requires that rx->skb is a frame with ethernet header
2166  */
2167 static void
2168 ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2169 {
2170         struct ieee80211_sub_if_data *sdata = rx->sdata;
2171         struct net_device *dev = sdata->dev;
2172         struct sk_buff *skb, *xmit_skb;
2173         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2174         struct sta_info *dsta;
2175
2176         skb = rx->skb;
2177         xmit_skb = NULL;
2178
2179         ieee80211_rx_stats(dev, skb->len);
2180
2181         if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2182              sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2183             !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2184             ehdr->h_proto != rx->sdata->control_port_protocol &&
2185             (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2186                 if (is_multicast_ether_addr(ehdr->h_dest)) {
2187                         /*
2188                          * send multicast frames both to higher layers in
2189                          * local net stack and back to the wireless medium
2190                          */
2191                         xmit_skb = skb_copy(skb, GFP_ATOMIC);
2192                         if (!xmit_skb)
2193                                 net_info_ratelimited("%s: failed to clone multicast frame\n",
2194                                                     dev->name);
2195                 } else {
2196                         dsta = sta_info_get(sdata, skb->data);
2197                         if (dsta) {
2198                                 /*
2199                                  * The destination station is associated to
2200                                  * this AP (in this VLAN), so send the frame
2201                                  * directly to it and do not pass it to local
2202                                  * net stack.
2203                                  */
2204                                 xmit_skb = skb;
2205                                 skb = NULL;
2206                         }
2207                 }
2208         }
2209
2210 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2211         if (skb) {
2212                 /* 'align' will only take the values 0 or 2 here since all
2213                  * frames are required to be aligned to 2-byte boundaries
2214                  * when being passed to mac80211; the code here works just
2215                  * as well if that isn't true, but mac80211 assumes it can
2216                  * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2217                  */
2218                 int align;
2219
2220                 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2221                 if (align) {
2222                         if (WARN_ON(skb_headroom(skb) < 3)) {
2223                                 dev_kfree_skb(skb);
2224                                 skb = NULL;
2225                         } else {
2226                                 u8 *data = skb->data;
2227                                 size_t len = skb_headlen(skb);
2228                                 skb->data -= align;
2229                                 memmove(skb->data, data, len);
2230                                 skb_set_tail_pointer(skb, len);
2231                         }
2232                 }
2233         }
2234 #endif
2235
2236         if (skb) {
2237                 struct ethhdr *ehdr = (struct ethhdr *)skb->data;
2238
2239                 /* deliver to local stack */
2240                 skb->protocol = eth_type_trans(skb, dev);
2241                 memset(skb->cb, 0, sizeof(skb->cb));
2242
2243                 /*
2244                  * 802.1X over 802.11 requires that the authenticator address
2245                  * be used for EAPOL frames. However, 802.1X allows the use of
2246                  * the PAE group address instead. If the interface is part of
2247                  * a bridge and we pass the frame with the PAE group address,
2248                  * then the bridge will forward it to the network (even if the
2249                  * client was not associated yet), which isn't supposed to
2250                  * happen.
2251                  * To avoid that, rewrite the destination address to our own
2252                  * address, so that the authenticator (e.g. hostapd) will see
2253                  * the frame, but bridge won't forward it anywhere else. Note
2254                  * that due to earlier filtering, the only other address can
2255                  * be the PAE group address.
2256                  */
2257                 if (unlikely(skb->protocol == sdata->control_port_protocol &&
2258                              !ether_addr_equal(ehdr->h_dest, sdata->vif.addr)))
2259                         ether_addr_copy(ehdr->h_dest, sdata->vif.addr);
2260
2261                 if (rx->napi)
2262                         napi_gro_receive(rx->napi, skb);
2263                 else
2264                         netif_receive_skb(skb);
2265         }
2266
2267         if (xmit_skb) {
2268                 /*
2269                  * Send to wireless media and increase priority by 256 to
2270                  * keep the received priority instead of reclassifying
2271                  * the frame (see cfg80211_classify8021d).
2272                  */
2273                 xmit_skb->priority += 256;
2274                 xmit_skb->protocol = htons(ETH_P_802_3);
2275                 skb_reset_network_header(xmit_skb);
2276                 skb_reset_mac_header(xmit_skb);
2277                 dev_queue_xmit(xmit_skb);
2278         }
2279 }
2280
2281 static ieee80211_rx_result debug_noinline
2282 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2283 {
2284         struct net_device *dev = rx->sdata->dev;
2285         struct sk_buff *skb = rx->skb;
2286         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2287         __le16 fc = hdr->frame_control;
2288         struct sk_buff_head frame_list;
2289         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2290
2291         if (unlikely(!ieee80211_is_data(fc)))
2292                 return RX_CONTINUE;
2293
2294         if (unlikely(!ieee80211_is_data_present(fc)))
2295                 return RX_DROP_MONITOR;
2296
2297         if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2298                 return RX_CONTINUE;
2299
2300         if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2301                 switch (rx->sdata->vif.type) {
2302                 case NL80211_IFTYPE_AP_VLAN:
2303                         if (!rx->sdata->u.vlan.sta)
2304                                 return RX_DROP_UNUSABLE;
2305                         break;
2306                 case NL80211_IFTYPE_STATION:
2307                         if (!rx->sdata->u.mgd.use_4addr)
2308                                 return RX_DROP_UNUSABLE;
2309                         break;
2310                 default:
2311                         return RX_DROP_UNUSABLE;
2312                 }
2313         }
2314
2315         if (is_multicast_ether_addr(hdr->addr1))
2316                 return RX_DROP_UNUSABLE;
2317
2318         skb->dev = dev;
2319         __skb_queue_head_init(&frame_list);
2320
2321         if (skb_linearize(skb))
2322                 return RX_DROP_UNUSABLE;
2323
2324         if (rx->key) {
2325                 /*
2326                  * We should not receive A-MSDUs on pre-HT connections,
2327                  * and HT connections cannot use old ciphers. Thus drop
2328                  * them, as in those cases we couldn't even have SPP
2329                  * A-MSDUs or such.
2330                  */
2331                 switch (rx->key->conf.cipher) {
2332                 case WLAN_CIPHER_SUITE_WEP40:
2333                 case WLAN_CIPHER_SUITE_WEP104:
2334                 case WLAN_CIPHER_SUITE_TKIP:
2335                         return RX_DROP_UNUSABLE;
2336                 default:
2337                         break;
2338                 }
2339         }
2340
2341         ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2342                                  rx->sdata->vif.type,
2343                                  rx->local->hw.extra_tx_headroom, true);
2344
2345         while (!skb_queue_empty(&frame_list)) {
2346                 rx->skb = __skb_dequeue(&frame_list);
2347
2348                 if (!ieee80211_frame_allowed(rx, fc)) {
2349                         dev_kfree_skb(rx->skb);
2350                         continue;
2351                 }
2352
2353                 ieee80211_deliver_skb(rx);
2354         }
2355
2356         return RX_QUEUED;
2357 }
2358
2359 #ifdef CONFIG_MAC80211_MESH
2360 static ieee80211_rx_result
2361 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2362 {
2363         struct ieee80211_hdr *fwd_hdr, *hdr;
2364         struct ieee80211_tx_info *info;
2365         struct ieee80211s_hdr *mesh_hdr;
2366         struct sk_buff *skb = rx->skb, *fwd_skb;
2367         struct ieee80211_local *local = rx->local;
2368         struct ieee80211_sub_if_data *sdata = rx->sdata;
2369         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2370         u16 ac, q, hdrlen;
2371
2372         hdr = (struct ieee80211_hdr *) skb->data;
2373         hdrlen = ieee80211_hdrlen(hdr->frame_control);
2374
2375         /* make sure fixed part of mesh header is there, also checks skb len */
2376         if (!pskb_may_pull(rx->skb, hdrlen + 6))
2377                 return RX_DROP_MONITOR;
2378
2379         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2380
2381         /* make sure full mesh header is there, also checks skb len */
2382         if (!pskb_may_pull(rx->skb,
2383                            hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2384                 return RX_DROP_MONITOR;
2385
2386         /* reload pointers */
2387         hdr = (struct ieee80211_hdr *) skb->data;
2388         mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2389
2390         if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2391                 return RX_DROP_MONITOR;
2392
2393         /* frame is in RMC, don't forward */
2394         if (ieee80211_is_data(hdr->frame_control) &&
2395             is_multicast_ether_addr(hdr->addr1) &&
2396             mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2397                 return RX_DROP_MONITOR;
2398
2399         if (!ieee80211_is_data(hdr->frame_control))
2400                 return RX_CONTINUE;
2401
2402         if (!mesh_hdr->ttl)
2403                 return RX_DROP_MONITOR;
2404
2405         if (mesh_hdr->flags & MESH_FLAGS_AE) {
2406                 struct mesh_path *mppath;
2407                 char *proxied_addr;
2408                 char *mpp_addr;
2409
2410                 if (is_multicast_ether_addr(hdr->addr1)) {
2411                         mpp_addr = hdr->addr3;
2412                         proxied_addr = mesh_hdr->eaddr1;
2413                 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
2414                         /* has_a4 already checked in ieee80211_rx_mesh_check */
2415                         mpp_addr = hdr->addr4;
2416                         proxied_addr = mesh_hdr->eaddr2;
2417                 } else {
2418                         return RX_DROP_MONITOR;
2419                 }
2420
2421                 rcu_read_lock();
2422                 mppath = mpp_path_lookup(sdata, proxied_addr);
2423                 if (!mppath) {
2424                         mpp_path_add(sdata, proxied_addr, mpp_addr);
2425                 } else {
2426                         spin_lock_bh(&mppath->state_lock);
2427                         if (!ether_addr_equal(mppath->mpp, mpp_addr))
2428                                 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2429                         spin_unlock_bh(&mppath->state_lock);
2430                 }
2431                 rcu_read_unlock();
2432         }
2433
2434         /* Frame has reached destination.  Don't forward */
2435         if (!is_multicast_ether_addr(hdr->addr1) &&
2436             ether_addr_equal(sdata->vif.addr, hdr->addr3))
2437                 return RX_CONTINUE;
2438
2439         ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2440         q = sdata->vif.hw_queue[ac];
2441         if (ieee80211_queue_stopped(&local->hw, q)) {
2442                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2443                 return RX_DROP_MONITOR;
2444         }
2445         skb_set_queue_mapping(skb, q);
2446
2447         if (!--mesh_hdr->ttl) {
2448                 if (!is_multicast_ether_addr(hdr->addr1))
2449                         IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
2450                                                      dropped_frames_ttl);
2451                 goto out;
2452         }
2453
2454         if (!ifmsh->mshcfg.dot11MeshForwarding)
2455                 goto out;
2456
2457         fwd_skb = skb_copy(skb, GFP_ATOMIC);
2458         if (!fwd_skb) {
2459                 net_info_ratelimited("%s: failed to clone mesh frame\n",
2460                                     sdata->name);
2461                 goto out;
2462         }
2463
2464         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2465         fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2466         info = IEEE80211_SKB_CB(fwd_skb);
2467         memset(info, 0, sizeof(*info));
2468         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2469         info->control.vif = &rx->sdata->vif;
2470         info->control.jiffies = jiffies;
2471         if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2472                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2473                 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2474                 /* update power mode indication when forwarding */
2475                 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
2476         } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
2477                 /* mesh power mode flags updated in mesh_nexthop_lookup */
2478                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2479         } else {
2480                 /* unable to resolve next hop */
2481                 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2482                                    fwd_hdr->addr3, 0,
2483                                    WLAN_REASON_MESH_PATH_NOFORWARD,
2484                                    fwd_hdr->addr2);
2485                 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2486                 kfree_skb(fwd_skb);
2487                 return RX_DROP_MONITOR;
2488         }
2489
2490         IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2491         ieee80211_add_pending_skb(local, fwd_skb);
2492  out:
2493         if (is_multicast_ether_addr(hdr->addr1))
2494                 return RX_CONTINUE;
2495         return RX_DROP_MONITOR;
2496 }
2497 #endif
2498
2499 static ieee80211_rx_result debug_noinline
2500 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2501 {
2502         struct ieee80211_sub_if_data *sdata = rx->sdata;
2503         struct ieee80211_local *local = rx->local;
2504         struct net_device *dev = sdata->dev;
2505         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2506         __le16 fc = hdr->frame_control;
2507         bool port_control;
2508         int err;
2509
2510         if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2511                 return RX_CONTINUE;
2512
2513         if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
2514                 return RX_DROP_MONITOR;
2515
2516         if (rx->sta) {
2517                 /* The seqno index has the same property as needed
2518                  * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2519                  * for non-QoS-data frames. Here we know it's a data
2520                  * frame, so count MSDUs.
2521                  */
2522                 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
2523         }
2524
2525         /*
2526          * Send unexpected-4addr-frame event to hostapd. For older versions,
2527          * also drop the frame to cooked monitor interfaces.
2528          */
2529         if (ieee80211_has_a4(hdr->frame_control) &&
2530             sdata->vif.type == NL80211_IFTYPE_AP) {
2531                 if (rx->sta &&
2532                     !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2533                         cfg80211_rx_unexpected_4addr_frame(
2534                                 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2535                 return RX_DROP_MONITOR;
2536         }
2537
2538         err = __ieee80211_data_to_8023(rx, &port_control);
2539         if (unlikely(err))
2540                 return RX_DROP_UNUSABLE;
2541
2542         if (!ieee80211_frame_allowed(rx, fc))
2543                 return RX_DROP_MONITOR;
2544
2545         /* directly handle TDLS channel switch requests/responses */
2546         if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2547                                                 cpu_to_be16(ETH_P_TDLS))) {
2548                 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2549
2550                 if (pskb_may_pull(rx->skb,
2551                                   offsetof(struct ieee80211_tdls_data, u)) &&
2552                     tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2553                     tf->category == WLAN_CATEGORY_TDLS &&
2554                     (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2555                      tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
2556                         skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2557                         schedule_work(&local->tdls_chsw_work);
2558                         if (rx->sta)
2559                                 rx->sta->rx_stats.packets++;
2560
2561                         return RX_QUEUED;
2562                 }
2563         }
2564
2565         if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2566             unlikely(port_control) && sdata->bss) {
2567                 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2568                                      u.ap);
2569                 dev = sdata->dev;
2570                 rx->sdata = sdata;
2571         }
2572
2573         rx->skb->dev = dev;
2574
2575         if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2576             !is_multicast_ether_addr(
2577                     ((struct ethhdr *)rx->skb->data)->h_dest) &&
2578             (!local->scanning &&
2579              !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2580                         mod_timer(&local->dynamic_ps_timer, jiffies +
2581                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2582         }
2583
2584         ieee80211_deliver_skb(rx);
2585
2586         return RX_QUEUED;
2587 }
2588
2589 static ieee80211_rx_result debug_noinline
2590 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2591 {
2592         struct sk_buff *skb = rx->skb;
2593         struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2594         struct tid_ampdu_rx *tid_agg_rx;
2595         u16 start_seq_num;
2596         u16 tid;
2597
2598         if (likely(!ieee80211_is_ctl(bar->frame_control)))
2599                 return RX_CONTINUE;
2600
2601         if (ieee80211_is_back_req(bar->frame_control)) {
2602                 struct {
2603                         __le16 control, start_seq_num;
2604                 } __packed bar_data;
2605                 struct ieee80211_event event = {
2606                         .type = BAR_RX_EVENT,
2607                 };
2608
2609                 if (!rx->sta)
2610                         return RX_DROP_MONITOR;
2611
2612                 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2613                                   &bar_data, sizeof(bar_data)))
2614                         return RX_DROP_MONITOR;
2615
2616                 tid = le16_to_cpu(bar_data.control) >> 12;
2617
2618                 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2619                 if (!tid_agg_rx)
2620                         return RX_DROP_MONITOR;
2621
2622                 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2623                 event.u.ba.tid = tid;
2624                 event.u.ba.ssn = start_seq_num;
2625                 event.u.ba.sta = &rx->sta->sta;
2626
2627                 /* reset session timer */
2628                 if (tid_agg_rx->timeout)
2629                         mod_timer(&tid_agg_rx->session_timer,
2630                                   TU_TO_EXP_TIME(tid_agg_rx->timeout));
2631
2632                 spin_lock(&tid_agg_rx->reorder_lock);
2633                 /* release stored frames up to start of BAR */
2634                 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2635                                                  start_seq_num, frames);
2636                 spin_unlock(&tid_agg_rx->reorder_lock);
2637
2638                 drv_event_callback(rx->local, rx->sdata, &event);
2639
2640                 kfree_skb(skb);
2641                 return RX_QUEUED;
2642         }
2643
2644         /*
2645          * After this point, we only want management frames,
2646          * so we can drop all remaining control frames to
2647          * cooked monitor interfaces.
2648          */
2649         return RX_DROP_MONITOR;
2650 }
2651
2652 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2653                                            struct ieee80211_mgmt *mgmt,
2654                                            size_t len)
2655 {
2656         struct ieee80211_local *local = sdata->local;
2657         struct sk_buff *skb;
2658         struct ieee80211_mgmt *resp;
2659
2660         if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2661                 /* Not to own unicast address */
2662                 return;
2663         }
2664
2665         if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2666             !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2667                 /* Not from the current AP or not associated yet. */
2668                 return;
2669         }
2670
2671         if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2672                 /* Too short SA Query request frame */
2673                 return;
2674         }
2675
2676         skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2677         if (skb == NULL)
2678                 return;
2679
2680         skb_reserve(skb, local->hw.extra_tx_headroom);
2681         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2682         memset(resp, 0, 24);
2683         memcpy(resp->da, mgmt->sa, ETH_ALEN);
2684         memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2685         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2686         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2687                                           IEEE80211_STYPE_ACTION);
2688         skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2689         resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2690         resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2691         memcpy(resp->u.action.u.sa_query.trans_id,
2692                mgmt->u.action.u.sa_query.trans_id,
2693                WLAN_SA_QUERY_TR_ID_LEN);
2694
2695         ieee80211_tx_skb(sdata, skb);
2696 }
2697
2698 static ieee80211_rx_result debug_noinline
2699 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2700 {
2701         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2702         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2703
2704         /*
2705          * From here on, look only at management frames.
2706          * Data and control frames are already handled,
2707          * and unknown (reserved) frames are useless.
2708          */
2709         if (rx->skb->len < 24)
2710                 return RX_DROP_MONITOR;
2711
2712         if (!ieee80211_is_mgmt(mgmt->frame_control))
2713                 return RX_DROP_MONITOR;
2714
2715         if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2716             ieee80211_is_beacon(mgmt->frame_control) &&
2717             !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2718                 int sig = 0;
2719
2720                 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
2721                         sig = status->signal;
2722
2723                 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2724                                             rx->skb->data, rx->skb->len,
2725                                             status->freq, sig);
2726                 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2727         }
2728
2729         if (ieee80211_drop_unencrypted_mgmt(rx))
2730                 return RX_DROP_UNUSABLE;
2731
2732         return RX_CONTINUE;
2733 }
2734
2735 static ieee80211_rx_result debug_noinline
2736 ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2737 {
2738         struct ieee80211_local *local = rx->local;
2739         struct ieee80211_sub_if_data *sdata = rx->sdata;
2740         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2741         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2742         int len = rx->skb->len;
2743
2744         if (!ieee80211_is_action(mgmt->frame_control))
2745                 return RX_CONTINUE;
2746
2747         /* drop too small frames */
2748         if (len < IEEE80211_MIN_ACTION_SIZE)
2749                 return RX_DROP_UNUSABLE;
2750
2751         if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2752             mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2753             mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2754                 return RX_DROP_UNUSABLE;
2755
2756         switch (mgmt->u.action.category) {
2757         case WLAN_CATEGORY_HT:
2758                 /* reject HT action frames from stations not supporting HT */
2759                 if (!rx->sta->sta.ht_cap.ht_supported)
2760                         goto invalid;
2761
2762                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2763                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2764                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2765                     sdata->vif.type != NL80211_IFTYPE_AP &&
2766                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
2767                         break;
2768
2769                 /* verify action & smps_control/chanwidth are present */
2770                 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2771                         goto invalid;
2772
2773                 switch (mgmt->u.action.u.ht_smps.action) {
2774                 case WLAN_HT_ACTION_SMPS: {
2775                         struct ieee80211_supported_band *sband;
2776                         enum ieee80211_smps_mode smps_mode;
2777
2778                         /* convert to HT capability */
2779                         switch (mgmt->u.action.u.ht_smps.smps_control) {
2780                         case WLAN_HT_SMPS_CONTROL_DISABLED:
2781                                 smps_mode = IEEE80211_SMPS_OFF;
2782                                 break;
2783                         case WLAN_HT_SMPS_CONTROL_STATIC:
2784                                 smps_mode = IEEE80211_SMPS_STATIC;
2785                                 break;
2786                         case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2787                                 smps_mode = IEEE80211_SMPS_DYNAMIC;
2788                                 break;
2789                         default:
2790                                 goto invalid;
2791                         }
2792
2793                         /* if no change do nothing */
2794                         if (rx->sta->sta.smps_mode == smps_mode)
2795                                 goto handled;
2796                         rx->sta->sta.smps_mode = smps_mode;
2797
2798                         sband = rx->local->hw.wiphy->bands[status->band];
2799
2800                         rate_control_rate_update(local, sband, rx->sta,
2801                                                  IEEE80211_RC_SMPS_CHANGED);
2802                         goto handled;
2803                 }
2804                 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2805                         struct ieee80211_supported_band *sband;
2806                         u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2807                         enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
2808
2809                         /* If it doesn't support 40 MHz it can't change ... */
2810                         if (!(rx->sta->sta.ht_cap.cap &
2811                                         IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2812                                 goto handled;
2813
2814                         if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2815                                 max_bw = IEEE80211_STA_RX_BW_20;
2816                         else
2817                                 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2818
2819                         /* set cur_max_bandwidth and recalc sta bw */
2820                         rx->sta->cur_max_bandwidth = max_bw;
2821                         new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2822
2823                         if (rx->sta->sta.bandwidth == new_bw)
2824                                 goto handled;
2825
2826                         rx->sta->sta.bandwidth = new_bw;
2827                         sband = rx->local->hw.wiphy->bands[status->band];
2828
2829                         rate_control_rate_update(local, sband, rx->sta,
2830                                                  IEEE80211_RC_BW_CHANGED);
2831                         goto handled;
2832                 }
2833                 default:
2834                         goto invalid;
2835                 }
2836
2837                 break;
2838         case WLAN_CATEGORY_PUBLIC:
2839                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2840                         goto invalid;
2841                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2842                         break;
2843                 if (!rx->sta)
2844                         break;
2845                 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2846                         break;
2847                 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2848                                 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2849                         break;
2850                 if (len < offsetof(struct ieee80211_mgmt,
2851                                    u.action.u.ext_chan_switch.variable))
2852                         goto invalid;
2853                 goto queue;
2854         case WLAN_CATEGORY_VHT:
2855                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2856                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2857                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2858                     sdata->vif.type != NL80211_IFTYPE_AP &&
2859                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
2860                         break;
2861
2862                 /* verify action code is present */
2863                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2864                         goto invalid;
2865
2866                 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2867                 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
2868                         u8 opmode;
2869
2870                         /* verify opmode is present */
2871                         if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2872                                 goto invalid;
2873
2874                         opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
2875
2876                         ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2877                                                     opmode, status->band);
2878                         goto handled;
2879                 }
2880                 default:
2881                         break;
2882                 }
2883                 break;
2884         case WLAN_CATEGORY_BACK:
2885                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2886                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2887                     sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2888                     sdata->vif.type != NL80211_IFTYPE_AP &&
2889                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
2890                         break;
2891
2892                 /* verify action_code is present */
2893                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2894                         break;
2895
2896                 switch (mgmt->u.action.u.addba_req.action_code) {
2897                 case WLAN_ACTION_ADDBA_REQ:
2898                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2899                                    sizeof(mgmt->u.action.u.addba_req)))
2900                                 goto invalid;
2901                         break;
2902                 case WLAN_ACTION_ADDBA_RESP:
2903                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2904                                    sizeof(mgmt->u.action.u.addba_resp)))
2905                                 goto invalid;
2906                         break;
2907                 case WLAN_ACTION_DELBA:
2908                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2909                                    sizeof(mgmt->u.action.u.delba)))
2910                                 goto invalid;
2911                         break;
2912                 default:
2913                         goto invalid;
2914                 }
2915
2916                 goto queue;
2917         case WLAN_CATEGORY_SPECTRUM_MGMT:
2918                 /* verify action_code is present */
2919                 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2920                         break;
2921
2922                 switch (mgmt->u.action.u.measurement.action_code) {
2923                 case WLAN_ACTION_SPCT_MSR_REQ:
2924                         if (status->band != IEEE80211_BAND_5GHZ)
2925                                 break;
2926
2927                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2928                                    sizeof(mgmt->u.action.u.measurement)))
2929                                 break;
2930
2931                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2932                                 break;
2933
2934                         ieee80211_process_measurement_req(sdata, mgmt, len);
2935                         goto handled;
2936                 case WLAN_ACTION_SPCT_CHL_SWITCH: {
2937                         u8 *bssid;
2938                         if (len < (IEEE80211_MIN_ACTION_SIZE +
2939                                    sizeof(mgmt->u.action.u.chan_switch)))
2940                                 break;
2941
2942                         if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2943                             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2944                             sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2945                                 break;
2946
2947                         if (sdata->vif.type == NL80211_IFTYPE_STATION)
2948                                 bssid = sdata->u.mgd.bssid;
2949                         else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
2950                                 bssid = sdata->u.ibss.bssid;
2951                         else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
2952                                 bssid = mgmt->sa;
2953                         else
2954                                 break;
2955
2956                         if (!ether_addr_equal(mgmt->bssid, bssid))
2957                                 break;
2958
2959                         goto queue;
2960                         }
2961                 }
2962                 break;
2963         case WLAN_CATEGORY_SA_QUERY:
2964                 if (len < (IEEE80211_MIN_ACTION_SIZE +
2965                            sizeof(mgmt->u.action.u.sa_query)))
2966                         break;
2967
2968                 switch (mgmt->u.action.u.sa_query.action) {
2969                 case WLAN_ACTION_SA_QUERY_REQUEST:
2970                         if (sdata->vif.type != NL80211_IFTYPE_STATION)
2971                                 break;
2972                         ieee80211_process_sa_query_req(sdata, mgmt, len);
2973                         goto handled;
2974                 }
2975                 break;
2976         case WLAN_CATEGORY_SELF_PROTECTED:
2977                 if (len < (IEEE80211_MIN_ACTION_SIZE +
2978                            sizeof(mgmt->u.action.u.self_prot.action_code)))
2979                         break;
2980
2981                 switch (mgmt->u.action.u.self_prot.action_code) {
2982                 case WLAN_SP_MESH_PEERING_OPEN:
2983                 case WLAN_SP_MESH_PEERING_CLOSE:
2984                 case WLAN_SP_MESH_PEERING_CONFIRM:
2985                         if (!ieee80211_vif_is_mesh(&sdata->vif))
2986                                 goto invalid;
2987                         if (sdata->u.mesh.user_mpm)
2988                                 /* userspace handles this frame */
2989                                 break;
2990                         goto queue;
2991                 case WLAN_SP_MGK_INFORM:
2992                 case WLAN_SP_MGK_ACK:
2993                         if (!ieee80211_vif_is_mesh(&sdata->vif))
2994                                 goto invalid;
2995                         break;
2996                 }
2997                 break;
2998         case WLAN_CATEGORY_MESH_ACTION:
2999                 if (len < (IEEE80211_MIN_ACTION_SIZE +
3000                            sizeof(mgmt->u.action.u.mesh_action.action_code)))
3001                         break;
3002
3003                 if (!ieee80211_vif_is_mesh(&sdata->vif))
3004                         break;
3005                 if (mesh_action_is_path_sel(mgmt) &&
3006                     !mesh_path_sel_is_hwmp(sdata))
3007                         break;
3008                 goto queue;
3009         }
3010
3011         return RX_CONTINUE;
3012
3013  invalid:
3014         status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3015         /* will return in the next handlers */
3016         return RX_CONTINUE;
3017
3018  handled:
3019         if (rx->sta)
3020                 rx->sta->rx_stats.packets++;
3021         dev_kfree_skb(rx->skb);
3022         return RX_QUEUED;
3023
3024  queue:
3025         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
3026         skb_queue_tail(&sdata->skb_queue, rx->skb);
3027         ieee80211_queue_work(&local->hw, &sdata->work);
3028         if (rx->sta)
3029                 rx->sta->rx_stats.packets++;
3030         return RX_QUEUED;
3031 }
3032
3033 static ieee80211_rx_result debug_noinline
3034 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3035 {
3036         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3037         int sig = 0;
3038
3039         /* skip known-bad action frames and return them in the next handler */
3040         if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3041                 return RX_CONTINUE;
3042
3043         /*
3044          * Getting here means the kernel doesn't know how to handle
3045          * it, but maybe userspace does ... include returned frames
3046          * so userspace can register for those to know whether ones
3047          * it transmitted were processed or returned.
3048          */
3049
3050         if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
3051                 sig = status->signal;
3052
3053         if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
3054                              rx->skb->data, rx->skb->len, 0)) {
3055                 if (rx->sta)
3056                         rx->sta->rx_stats.packets++;
3057                 dev_kfree_skb(rx->skb);
3058                 return RX_QUEUED;
3059         }
3060
3061         return RX_CONTINUE;
3062 }
3063
3064 static ieee80211_rx_result debug_noinline
3065 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3066 {
3067         struct ieee80211_local *local = rx->local;
3068         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3069         struct sk_buff *nskb;
3070         struct ieee80211_sub_if_data *sdata = rx->sdata;
3071         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3072
3073         if (!ieee80211_is_action(mgmt->frame_control))
3074                 return RX_CONTINUE;
3075
3076         /*
3077          * For AP mode, hostapd is responsible for handling any action
3078          * frames that we didn't handle, including returning unknown
3079          * ones. For all other modes we will return them to the sender,
3080          * setting the 0x80 bit in the action category, as required by
3081          * 802.11-2012 9.24.4.
3082          * Newer versions of hostapd shall also use the management frame
3083          * registration mechanisms, but older ones still use cooked
3084          * monitor interfaces so push all frames there.
3085          */
3086         if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3087             (sdata->vif.type == NL80211_IFTYPE_AP ||
3088              sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3089                 return RX_DROP_MONITOR;
3090
3091         if (is_multicast_ether_addr(mgmt->da))
3092                 return RX_DROP_MONITOR;
3093
3094         /* do not return rejected action frames */
3095         if (mgmt->u.action.category & 0x80)
3096                 return RX_DROP_UNUSABLE;
3097
3098         nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3099                                GFP_ATOMIC);
3100         if (nskb) {
3101                 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3102
3103                 nmgmt->u.action.category |= 0x80;
3104                 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3105                 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3106
3107                 memset(nskb->cb, 0, sizeof(nskb->cb));
3108
3109                 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3110                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3111
3112                         info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3113                                       IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3114                                       IEEE80211_TX_CTL_NO_CCK_RATE;
3115                         if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3116                                 info->hw_queue =
3117                                         local->hw.offchannel_tx_hw_queue;
3118                 }
3119
3120                 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
3121                                             status->band);
3122         }
3123         dev_kfree_skb(rx->skb);
3124         return RX_QUEUED;
3125 }
3126
3127 static ieee80211_rx_result debug_noinline
3128 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3129 {
3130         struct ieee80211_sub_if_data *sdata = rx->sdata;
3131         struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3132         __le16 stype;
3133
3134         stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3135
3136         if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3137             sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3138             sdata->vif.type != NL80211_IFTYPE_OCB &&
3139             sdata->vif.type != NL80211_IFTYPE_STATION)
3140                 return RX_DROP_MONITOR;
3141
3142         switch (stype) {
3143         case cpu_to_le16(IEEE80211_STYPE_AUTH):
3144         case cpu_to_le16(IEEE80211_STYPE_BEACON):
3145         case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3146                 /* process for all: mesh, mlme, ibss */
3147                 break;
3148         case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3149                 if (is_multicast_ether_addr(mgmt->da) &&
3150                     !is_broadcast_ether_addr(mgmt->da))
3151                         return RX_DROP_MONITOR;
3152
3153                 /* process only for station/IBSS */
3154                 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3155                     sdata->vif.type != NL80211_IFTYPE_ADHOC)
3156                         return RX_DROP_MONITOR;
3157                 break;
3158         case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3159         case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3160         case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3161                 if (is_multicast_ether_addr(mgmt->da) &&
3162                     !is_broadcast_ether_addr(mgmt->da))
3163                         return RX_DROP_MONITOR;
3164
3165                 /* process only for station */
3166                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3167                         return RX_DROP_MONITOR;
3168                 break;
3169         case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3170                 /* process only for ibss and mesh */
3171                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3172                     sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3173                         return RX_DROP_MONITOR;
3174                 break;
3175         default:
3176                 return RX_DROP_MONITOR;
3177         }
3178
3179         /* queue up frame and kick off work to process it */
3180         rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
3181         skb_queue_tail(&sdata->skb_queue, rx->skb);
3182         ieee80211_queue_work(&rx->local->hw, &sdata->work);
3183         if (rx->sta)
3184                 rx->sta->rx_stats.packets++;
3185
3186         return RX_QUEUED;
3187 }
3188
3189 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3190                                         struct ieee80211_rate *rate)
3191 {
3192         struct ieee80211_sub_if_data *sdata;
3193         struct ieee80211_local *local = rx->local;
3194         struct sk_buff *skb = rx->skb, *skb2;
3195         struct net_device *prev_dev = NULL;
3196         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3197         int needed_headroom;
3198
3199         /*
3200          * If cooked monitor has been processed already, then
3201          * don't do it again. If not, set the flag.
3202          */
3203         if (rx->flags & IEEE80211_RX_CMNTR)
3204                 goto out_free_skb;
3205         rx->flags |= IEEE80211_RX_CMNTR;
3206
3207         /* If there are no cooked monitor interfaces, just free the SKB */
3208         if (!local->cooked_mntrs)
3209                 goto out_free_skb;
3210
3211         /* vendor data is long removed here */
3212         status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3213         /* room for the radiotap header based on driver features */
3214         needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3215
3216         if (skb_headroom(skb) < needed_headroom &&
3217             pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
3218                 goto out_free_skb;
3219
3220         /* prepend radiotap information */
3221         ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3222                                          false);
3223
3224         skb_set_mac_header(skb, 0);
3225         skb->ip_summed = CHECKSUM_UNNECESSARY;
3226         skb->pkt_type = PACKET_OTHERHOST;
3227         skb->protocol = htons(ETH_P_802_2);
3228
3229         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3230                 if (!ieee80211_sdata_running(sdata))
3231                         continue;
3232
3233                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3234                     !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
3235                         continue;
3236
3237                 if (prev_dev) {
3238                         skb2 = skb_clone(skb, GFP_ATOMIC);
3239                         if (skb2) {
3240                                 skb2->dev = prev_dev;
3241                                 netif_receive_skb(skb2);
3242                         }
3243                 }
3244
3245                 prev_dev = sdata->dev;
3246                 ieee80211_rx_stats(sdata->dev, skb->len);
3247         }
3248
3249         if (prev_dev) {
3250                 skb->dev = prev_dev;
3251                 netif_receive_skb(skb);
3252                 return;
3253         }
3254
3255  out_free_skb:
3256         dev_kfree_skb(skb);
3257 }
3258
3259 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3260                                          ieee80211_rx_result res)
3261 {
3262         switch (res) {
3263         case RX_DROP_MONITOR:
3264                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3265                 if (rx->sta)
3266                         rx->sta->rx_stats.dropped++;
3267                 /* fall through */
3268         case RX_CONTINUE: {
3269                 struct ieee80211_rate *rate = NULL;
3270                 struct ieee80211_supported_band *sband;
3271                 struct ieee80211_rx_status *status;
3272
3273                 status = IEEE80211_SKB_RXCB((rx->skb));
3274
3275                 sband = rx->local->hw.wiphy->bands[status->band];
3276                 if (!(status->flag & RX_FLAG_HT) &&
3277                     !(status->flag & RX_FLAG_VHT))
3278                         rate = &sband->bitrates[status->rate_idx];
3279
3280                 ieee80211_rx_cooked_monitor(rx, rate);
3281                 break;
3282                 }
3283         case RX_DROP_UNUSABLE:
3284                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3285                 if (rx->sta)
3286                         rx->sta->rx_stats.dropped++;
3287                 dev_kfree_skb(rx->skb);
3288                 break;
3289         case RX_QUEUED:
3290                 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3291                 break;
3292         }
3293 }
3294
3295 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3296                                   struct sk_buff_head *frames)
3297 {
3298         ieee80211_rx_result res = RX_DROP_MONITOR;
3299         struct sk_buff *skb;
3300
3301 #define CALL_RXH(rxh)                   \
3302         do {                            \
3303                 res = rxh(rx);          \
3304                 if (res != RX_CONTINUE) \
3305                         goto rxh_next;  \
3306         } while (0);
3307
3308         /* Lock here to avoid hitting all of the data used in the RX
3309          * path (e.g. key data, station data, ...) concurrently when
3310          * a frame is released from the reorder buffer due to timeout
3311          * from the timer, potentially concurrently with RX from the
3312          * driver.
3313          */
3314         spin_lock_bh(&rx->local->rx_path_lock);
3315
3316         while ((skb = __skb_dequeue(frames))) {
3317                 /*
3318                  * all the other fields are valid across frames
3319                  * that belong to an aMPDU since they are on the
3320                  * same TID from the same station
3321                  */
3322                 rx->skb = skb;
3323
3324                 CALL_RXH(ieee80211_rx_h_check_more_data)
3325                 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
3326                 CALL_RXH(ieee80211_rx_h_sta_process)
3327                 CALL_RXH(ieee80211_rx_h_decrypt)
3328                 CALL_RXH(ieee80211_rx_h_defragment)
3329                 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
3330                 /* must be after MMIC verify so header is counted in MPDU mic */
3331 #ifdef CONFIG_MAC80211_MESH
3332                 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3333                         CALL_RXH(ieee80211_rx_h_mesh_fwding);
3334 #endif
3335                 CALL_RXH(ieee80211_rx_h_amsdu)
3336                 CALL_RXH(ieee80211_rx_h_data)
3337
3338                 /* special treatment -- needs the queue */
3339                 res = ieee80211_rx_h_ctrl(rx, frames);
3340                 if (res != RX_CONTINUE)
3341                         goto rxh_next;
3342
3343                 CALL_RXH(ieee80211_rx_h_mgmt_check)
3344                 CALL_RXH(ieee80211_rx_h_action)
3345                 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
3346                 CALL_RXH(ieee80211_rx_h_action_return)
3347                 CALL_RXH(ieee80211_rx_h_mgmt)
3348
3349  rxh_next:
3350                 ieee80211_rx_handlers_result(rx, res);
3351
3352 #undef CALL_RXH
3353         }
3354
3355         spin_unlock_bh(&rx->local->rx_path_lock);
3356 }
3357
3358 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3359 {
3360         struct sk_buff_head reorder_release;
3361         ieee80211_rx_result res = RX_DROP_MONITOR;
3362
3363         __skb_queue_head_init(&reorder_release);
3364
3365 #define CALL_RXH(rxh)                   \
3366         do {                            \
3367                 res = rxh(rx);          \
3368                 if (res != RX_CONTINUE) \
3369                         goto rxh_next;  \
3370         } while (0);
3371
3372         CALL_RXH(ieee80211_rx_h_check_dup)
3373         CALL_RXH(ieee80211_rx_h_check)
3374
3375         ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3376
3377         ieee80211_rx_handlers(rx, &reorder_release);
3378         return;
3379
3380  rxh_next:
3381         ieee80211_rx_handlers_result(rx, res);
3382
3383 #undef CALL_RXH
3384 }
3385
3386 /*
3387  * This function makes calls into the RX path, therefore
3388  * it has to be invoked under RCU read lock.
3389  */
3390 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3391 {
3392         struct sk_buff_head frames;
3393         struct ieee80211_rx_data rx = {
3394                 .sta = sta,
3395                 .sdata = sta->sdata,
3396                 .local = sta->local,
3397                 /* This is OK -- must be QoS data frame */
3398                 .security_idx = tid,
3399                 .seqno_idx = tid,
3400                 .napi = NULL, /* must be NULL to not have races */
3401         };
3402         struct tid_ampdu_rx *tid_agg_rx;
3403
3404         tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3405         if (!tid_agg_rx)
3406                 return;
3407
3408         __skb_queue_head_init(&frames);
3409
3410         spin_lock(&tid_agg_rx->reorder_lock);
3411         ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3412         spin_unlock(&tid_agg_rx->reorder_lock);
3413
3414         if (!skb_queue_empty(&frames)) {
3415                 struct ieee80211_event event = {
3416                         .type = BA_FRAME_TIMEOUT,
3417                         .u.ba.tid = tid,
3418                         .u.ba.sta = &sta->sta,
3419                 };
3420                 drv_event_callback(rx.local, rx.sdata, &event);
3421         }
3422
3423         ieee80211_rx_handlers(&rx, &frames);
3424 }
3425
3426 /* main receive path */
3427
3428 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
3429 {
3430         struct ieee80211_sub_if_data *sdata = rx->sdata;
3431         struct sk_buff *skb = rx->skb;
3432         struct ieee80211_hdr *hdr = (void *)skb->data;
3433         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3434         u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3435         int multicast = is_multicast_ether_addr(hdr->addr1);
3436
3437         switch (sdata->vif.type) {
3438         case NL80211_IFTYPE_STATION:
3439                 if (!bssid && !sdata->u.mgd.use_4addr)
3440                         return false;
3441                 if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
3442                         return false;
3443                 if (multicast)
3444                         return true;
3445                 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3446         case NL80211_IFTYPE_ADHOC:
3447                 if (!bssid)
3448                         return false;
3449                 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3450                     ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
3451                     !is_valid_ether_addr(hdr->addr2))
3452                         return false;
3453                 if (ieee80211_is_beacon(hdr->frame_control))
3454                         return true;
3455                 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3456                         return false;
3457                 if (!multicast &&
3458                     !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3459                         return false;
3460                 if (!rx->sta) {
3461                         int rate_idx;
3462                         if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3463                                 rate_idx = 0; /* TODO: HT/VHT rates */
3464                         else
3465                                 rate_idx = status->rate_idx;
3466                         ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3467                                                  BIT(rate_idx));
3468                 }
3469                 return true;
3470         case NL80211_IFTYPE_OCB:
3471                 if (!bssid)
3472                         return false;
3473                 if (!ieee80211_is_data_present(hdr->frame_control))
3474                         return false;
3475                 if (!is_broadcast_ether_addr(bssid))
3476                         return false;
3477                 if (!multicast &&
3478                     !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
3479                         return false;
3480                 if (!rx->sta) {
3481                         int rate_idx;
3482                         if (status->flag & RX_FLAG_HT)
3483                                 rate_idx = 0; /* TODO: HT rates */
3484                         else
3485                                 rate_idx = status->rate_idx;
3486                         ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3487                                                 BIT(rate_idx));
3488                 }
3489                 return true;
3490         case NL80211_IFTYPE_MESH_POINT:
3491                 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
3492                         return false;
3493                 if (multicast)
3494                         return true;
3495                 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3496         case NL80211_IFTYPE_AP_VLAN:
3497         case NL80211_IFTYPE_AP:
3498                 if (!bssid)
3499                         return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3500
3501                 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3502                         /*
3503                          * Accept public action frames even when the
3504                          * BSSID doesn't match, this is used for P2P
3505                          * and location updates. Note that mac80211
3506                          * itself never looks at these frames.
3507                          */
3508                         if (!multicast &&
3509                             !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3510                                 return false;
3511                         if (ieee80211_is_public_action(hdr, skb->len))
3512                                 return true;
3513                         return ieee80211_is_beacon(hdr->frame_control);
3514                 }
3515
3516                 if (!ieee80211_has_tods(hdr->frame_control)) {
3517                         /* ignore data frames to TDLS-peers */
3518                         if (ieee80211_is_data(hdr->frame_control))
3519                                 return false;
3520                         /* ignore action frames to TDLS-peers */
3521                         if (ieee80211_is_action(hdr->frame_control) &&
3522                             !is_broadcast_ether_addr(bssid) &&
3523                             !ether_addr_equal(bssid, hdr->addr1))
3524                                 return false;
3525                 }
3526
3527                 /*
3528                  * 802.11-2016 Table 9-26 says that for data frames, A1 must be
3529                  * the BSSID - we've checked that already but may have accepted
3530                  * the wildcard (ff:ff:ff:ff:ff:ff).
3531                  *
3532                  * It also says:
3533                  *      The BSSID of the Data frame is determined as follows:
3534                  *      a) If the STA is contained within an AP or is associated
3535                  *         with an AP, the BSSID is the address currently in use
3536                  *         by the STA contained in the AP.
3537                  *
3538                  * So we should not accept data frames with an address that's
3539                  * multicast.
3540                  *
3541                  * Accepting it also opens a security problem because stations
3542                  * could encrypt it with the GTK and inject traffic that way.
3543                  */
3544                 if (ieee80211_is_data(hdr->frame_control) && multicast)
3545                         return false;
3546
3547                 return true;
3548         case NL80211_IFTYPE_WDS:
3549                 if (bssid || !ieee80211_is_data(hdr->frame_control))
3550                         return false;
3551                 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
3552         case NL80211_IFTYPE_P2P_DEVICE:
3553                 return ieee80211_is_public_action(hdr, skb->len) ||
3554                        ieee80211_is_probe_req(hdr->frame_control) ||
3555                        ieee80211_is_probe_resp(hdr->frame_control) ||
3556                        ieee80211_is_beacon(hdr->frame_control);
3557         default:
3558                 break;
3559         }
3560
3561         WARN_ON_ONCE(1);
3562         return false;
3563 }
3564
3565 /*
3566  * This function returns whether or not the SKB
3567  * was destined for RX processing or not, which,
3568  * if consume is true, is equivalent to whether
3569  * or not the skb was consumed.
3570  */
3571 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
3572                                             struct sk_buff *skb, bool consume)
3573 {
3574         struct ieee80211_local *local = rx->local;
3575         struct ieee80211_sub_if_data *sdata = rx->sdata;
3576
3577         rx->skb = skb;
3578
3579         if (!ieee80211_accept_frame(rx))
3580                 return false;
3581
3582         if (!consume) {
3583                 skb = skb_copy(skb, GFP_ATOMIC);
3584                 if (!skb) {
3585                         if (net_ratelimit())
3586                                 wiphy_debug(local->hw.wiphy,
3587                                         "failed to copy skb for %s\n",
3588                                         sdata->name);
3589                         return true;
3590                 }
3591
3592                 rx->skb = skb;
3593         }
3594
3595         ieee80211_invoke_rx_handlers(rx);
3596         return true;
3597 }
3598
3599 /*
3600  * This is the actual Rx frames handler. as it belongs to Rx path it must
3601  * be called with rcu_read_lock protection.
3602  */
3603 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3604                                          struct sk_buff *skb,
3605                                          struct napi_struct *napi)
3606 {
3607         struct ieee80211_local *local = hw_to_local(hw);
3608         struct ieee80211_sub_if_data *sdata;
3609         struct ieee80211_hdr *hdr;
3610         __le16 fc;
3611         struct ieee80211_rx_data rx;
3612         struct ieee80211_sub_if_data *prev;
3613         struct sta_info *sta, *prev_sta;
3614         struct rhash_head *tmp;
3615         int err = 0;
3616
3617         fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3618         memset(&rx, 0, sizeof(rx));
3619         rx.skb = skb;
3620         rx.local = local;
3621         rx.napi = napi;
3622
3623         if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3624                 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
3625
3626         if (ieee80211_is_mgmt(fc)) {
3627                 /* drop frame if too short for header */
3628                 if (skb->len < ieee80211_hdrlen(fc))
3629                         err = -ENOBUFS;
3630                 else
3631                         err = skb_linearize(skb);
3632         } else {
3633                 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3634         }
3635
3636         if (err) {
3637                 dev_kfree_skb(skb);
3638                 return;
3639         }
3640
3641         hdr = (struct ieee80211_hdr *)skb->data;
3642         ieee80211_parse_qos(&rx);
3643         ieee80211_verify_alignment(&rx);
3644
3645         if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
3646                      ieee80211_is_beacon(hdr->frame_control)))
3647                 ieee80211_scan_rx(local, skb);
3648
3649         if (ieee80211_is_data(fc)) {
3650                 const struct bucket_table *tbl;
3651
3652                 prev_sta = NULL;
3653
3654                 tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);
3655
3656                 for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) {
3657                         if (!prev_sta) {
3658                                 prev_sta = sta;
3659                                 continue;
3660                         }
3661
3662                         rx.sta = prev_sta;
3663                         rx.sdata = prev_sta->sdata;
3664                         ieee80211_prepare_and_rx_handle(&rx, skb, false);
3665
3666                         prev_sta = sta;
3667                 }
3668
3669                 if (prev_sta) {
3670                         rx.sta = prev_sta;
3671                         rx.sdata = prev_sta->sdata;
3672
3673                         if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3674                                 return;
3675                         goto out;
3676                 }
3677         }
3678
3679         prev = NULL;
3680
3681         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3682                 if (!ieee80211_sdata_running(sdata))
3683                         continue;
3684
3685                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
3686                     sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3687                         continue;
3688
3689                 /*
3690                  * frame is destined for this interface, but if it's
3691                  * not also for the previous one we handle that after
3692                  * the loop to avoid copying the SKB once too much
3693                  */
3694
3695                 if (!prev) {
3696                         prev = sdata;
3697                         continue;
3698                 }
3699
3700                 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3701                 rx.sdata = prev;
3702                 ieee80211_prepare_and_rx_handle(&rx, skb, false);
3703
3704                 prev = sdata;
3705         }
3706
3707         if (prev) {
3708                 rx.sta = sta_info_get_bss(prev, hdr->addr2);
3709                 rx.sdata = prev;
3710
3711                 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3712                         return;
3713         }
3714
3715  out:
3716         dev_kfree_skb(skb);
3717 }
3718
3719 /*
3720  * This is the receive path handler. It is called by a low level driver when an
3721  * 802.11 MPDU is received from the hardware.
3722  */
3723 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct sk_buff *skb,
3724                        struct napi_struct *napi)
3725 {
3726         struct ieee80211_local *local = hw_to_local(hw);
3727         struct ieee80211_rate *rate = NULL;
3728         struct ieee80211_supported_band *sband;
3729         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3730
3731         WARN_ON_ONCE(softirq_count() == 0);
3732
3733         if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
3734                 goto drop;
3735
3736         sband = local->hw.wiphy->bands[status->band];
3737         if (WARN_ON(!sband))
3738                 goto drop;
3739
3740         /*
3741          * If we're suspending, it is possible although not too likely
3742          * that we'd be receiving frames after having already partially
3743          * quiesced the stack. We can't process such frames then since
3744          * that might, for example, cause stations to be added or other
3745          * driver callbacks be invoked.
3746          */
3747         if (unlikely(local->quiescing || local->suspended))
3748                 goto drop;
3749
3750         /* We might be during a HW reconfig, prevent Rx for the same reason */
3751         if (unlikely(local->in_reconfig))
3752                 goto drop;
3753
3754         /*
3755          * The same happens when we're not even started,
3756          * but that's worth a warning.
3757          */
3758         if (WARN_ON(!local->started))
3759                 goto drop;
3760
3761         if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3762                 /*
3763                  * Validate the rate, unless a PLCP error means that
3764                  * we probably can't have a valid rate here anyway.
3765                  */
3766
3767                 if (status->flag & RX_FLAG_HT) {
3768                         /*
3769                          * rate_idx is MCS index, which can be [0-76]
3770                          * as documented on:
3771                          *
3772                          * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
3773                          *
3774                          * Anything else would be some sort of driver or
3775                          * hardware error. The driver should catch hardware
3776                          * errors.
3777                          */
3778                         if (WARN(status->rate_idx > 76,
3779                                  "Rate marked as an HT rate but passed "
3780                                  "status->rate_idx is not "
3781                                  "an MCS index [0-76]: %d (0x%02x)\n",
3782                                  status->rate_idx,
3783                                  status->rate_idx))
3784                                 goto drop;
3785                 } else if (status->flag & RX_FLAG_VHT) {
3786                         if (WARN_ONCE(status->rate_idx > 9 ||
3787                                       !status->vht_nss ||
3788                                       status->vht_nss > 8,
3789                                       "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
3790                                       status->rate_idx, status->vht_nss))
3791                                 goto drop;
3792                 } else {
3793                         if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3794                                 goto drop;
3795                         rate = &sband->bitrates[status->rate_idx];
3796                 }
3797         }
3798
3799         status->rx_flags = 0;
3800
3801         /*
3802          * key references and virtual interfaces are protected using RCU
3803          * and this requires that we are in a read-side RCU section during
3804          * receive processing
3805          */
3806         rcu_read_lock();
3807
3808         /*
3809          * Frames with failed FCS/PLCP checksum are not returned,
3810          * all other frames are returned without radiotap header
3811          * if it was previously present.
3812          * Also, frames with less than 16 bytes are dropped.
3813          */
3814         skb = ieee80211_rx_monitor(local, skb, rate);
3815         if (!skb) {
3816                 rcu_read_unlock();
3817                 return;
3818         }
3819
3820         ieee80211_tpt_led_trig_rx(local,
3821                         ((struct ieee80211_hdr *)skb->data)->frame_control,
3822                         skb->len);
3823         __ieee80211_rx_handle_packet(hw, skb, napi);
3824
3825         rcu_read_unlock();
3826
3827         return;
3828  drop:
3829         kfree_skb(skb);
3830 }
3831 EXPORT_SYMBOL(ieee80211_rx_napi);
3832
3833 /* This is a version of the rx handler that can be called from hard irq
3834  * context. Post the skb on the queue and schedule the tasklet */
3835 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3836 {
3837         struct ieee80211_local *local = hw_to_local(hw);
3838
3839         BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
3840
3841         skb->pkt_type = IEEE80211_RX_MSG;
3842         skb_queue_tail(&local->skb_queue, skb);
3843         tasklet_schedule(&local->tasklet);
3844 }
3845 EXPORT_SYMBOL(ieee80211_rx_irqsafe);