[PATCH bluetooth-next 00/16] ieee802154: rework receive handling

[PATCH bluetooth-next 00/16] ieee802154: rework receive handling

[Alexander Aring]

This patch serie improves and cleanups the receive handling.
Instead workqueue we use a tasklet now for parsing frames.
The first patch is a fix for using put_unaligned_le16 to copy
checksum in skb data which was reported by Marcel Holtmann.

Other patches are cleanups for preparing further patches to
introduce a frame parsing like mac80211. We don't change
the printout function to netdev_foo now because the most
code will be replaced by the new frame parsing implementation.

Alexander Aring (16):
  mac802154: tx: use put_unaligned_le16 for copy crc
  ieee802154: drivers: use dev_alloc_skb
  mac802154: rx: use tasklet instead workqueue
  mac802154: rx: warn if ieee80211_rx call from irq
  mac802154: rx: move receive handling into rx.c
  mac802154: tx: remove monitor receive while xmit
  mac802154: rx: rename remove mac802154_subif_rx
  mac802154: rx: move skb->protocol setting
  mac802154: rx: add CHECKSUM_UNNECESSARY
  mac802154: rx: add monitor pkt_type information
  mac802154: rx: move skb_reset_mac_header
  mac802154: rx: move rcu locking
  ieee802154: add valid psdu length helper
  at86rf230: use ieee802154_is_valid_psdu_len helper
  at86rf230: improve receive handling
  mac802154: rx: change naming convention

 drivers/net/ieee802154/at86rf230.c |  32 ++---
 drivers/net/ieee802154/cc2520.c    |   2 +-
 drivers/net/ieee802154/mrf24j40.c  |   2 +-
 include/linux/ieee802154.h         |  11 ++
 include/net/mac802154.h            |   1 +
 net/mac802154/ieee802154_i.h       |   9 +-
 net/mac802154/iface.c              | 186 -------------------------
 net/mac802154/main.c               |  30 ++++
 net/mac802154/monitor.c            |  27 ----
 net/mac802154/rx.c                 | 279 +++++++++++++++++++++++++++++++------
 net/mac802154/tx.c                 |   7 +-
 11 files changed, 296 insertions(+), 290 deletions(-)

-- 
2.1.2

[PATCH bluetooth-next 01/16] mac802154: tx: use put_unaligned_le16 for copy crc

[Alexander Aring]

This patch replaces the memcpy with a put_unaligned_le16. The placement
of crc inside of PSDU can also be unaligned. With memcpy this can fail
on some architectures.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Reported-by: Marcel Holtmann <marcel@holtmann.org>
---
 net/mac802154/tx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index fe2e17e..31e51e4 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -20,6 +20,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/crc-ccitt.h>
+#include <asm/unaligned.h>
 
 #include <net/rtnetlink.h>
 #include <net/ieee802154_netdev.h>
@@ -84,9 +85,9 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
 	mac802154_monitors_rx(local, skb);
 
 	if (!(local->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
-		__le16 crc = cpu_to_le16(crc_ccitt(0, skb->data, skb->len));
+		u16 crc = crc_ccitt(0, skb->data, skb->len);
 
-		memcpy(skb_put(skb, 2), &crc, 2);
+		put_unaligned_le16(crc, skb_put(skb, 2));
 	}
 
 	if (skb_cow_head(skb, local->hw.extra_tx_headroom))
-- 
2.1.2

[PATCH bluetooth-next 02/16] ieee802154: drivers: use dev_alloc_skb

[Alexander Aring]

This patch change the allocation of skb inside the ieee802154 driver
layer to dev_alloc_skb. This changes also the gfp mask to GFP_ATOMIC
which is needed for upcomming change that the receiving is done by a
tasklet and not a workqueue anymore.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
Cc: Alan Ott <alan@signal11.us>
---
 drivers/net/ieee802154/at86rf230.c | 2 +-
 drivers/net/ieee802154/cc2520.c    | 2 +-
 drivers/net/ieee802154/mrf24j40.c  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 0669783..e4fbcaa 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -811,7 +811,7 @@ at86rf230_rx(struct at86rf230_local *lp,
 	memcpy(rx_local_buf, data, len);
 	enable_irq(lp->spi->irq);
 
-	skb = alloc_skb(IEEE802154_MTU, GFP_ATOMIC);
+	skb = dev_alloc_skb(IEEE802154_MTU);
 	if (!skb) {
 		dev_vdbg(&lp->spi->dev, "failed to allocate sk_buff\n");
 		return;
diff --git a/drivers/net/ieee802154/cc2520.c b/drivers/net/ieee802154/cc2520.c
index f6f07f4..a31b5b6 100644
--- a/drivers/net/ieee802154/cc2520.c
+++ b/drivers/net/ieee802154/cc2520.c
@@ -524,7 +524,7 @@ static int cc2520_rx(struct cc2520_private *priv)
 	if (len < 2 || len > IEEE802154_MTU)
 		return -EINVAL;
 
-	skb = alloc_skb(len, GFP_KERNEL);
+	skb = dev_alloc_skb(len);
 	if (!skb)
 		return -ENOMEM;
 
diff --git a/drivers/net/ieee802154/mrf24j40.c b/drivers/net/ieee802154/mrf24j40.c
index 3d775af..7abb237 100644
--- a/drivers/net/ieee802154/mrf24j40.c
+++ b/drivers/net/ieee802154/mrf24j40.c
@@ -544,7 +544,7 @@ static int mrf24j40_handle_rx(struct mrf24j40 *devrec)
 	val |= 4; /* SET RXDECINV */
 	write_short_reg(devrec, REG_BBREG1, val);
 
-	skb = alloc_skb(len, GFP_KERNEL);
+	skb = dev_alloc_skb(len);
 	if (!skb) {
 		ret = -ENOMEM;
 		goto out;
-- 
2.1.2

[PATCH bluetooth-next 03/16] mac802154: rx: use tasklet instead workqueue

[Alexander Aring]

Tasklets have much less overhead than workqueues. This patch also
removes the heap allocation for the worker on receiving path.
Like mac80211 we should prefer use a tasklet here instead a workqueue to
getting fast out of interrupt context when ieee802154_rx_irqsafe is
called by driver. Like wireless inside the tasklet context we should
call netif_receive_skb instead netif_rx_ni anymore.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 include/net/mac802154.h      |  1 +
 net/mac802154/ieee802154_i.h |  7 +++++++
 net/mac802154/iface.c        |  2 +-
 net/mac802154/main.c         | 30 +++++++++++++++++++++++++++
 net/mac802154/rx.c           | 48 ++++++++------------------------------------
 5 files changed, 47 insertions(+), 41 deletions(-)

diff --git a/include/net/mac802154.h b/include/net/mac802154.h
index 942dd53..4c4642e 100644
--- a/include/net/mac802154.h
+++ b/include/net/mac802154.h
@@ -202,6 +202,7 @@ void ieee802154_free_hw(struct ieee802154_hw *hw);
 int ieee802154_register_hw(struct ieee802154_hw *hw);
 void ieee802154_unregister_hw(struct ieee802154_hw *hw);
 
+void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb);
 void ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb,
 			   u8 lqi);
 
diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h
index ef29c10..603509a 100644
--- a/net/mac802154/ieee802154_i.h
+++ b/net/mac802154/ieee802154_i.h
@@ -55,11 +55,18 @@ struct ieee802154_local {
 	 * read them using any of protection methods.
 	 */
 	bool running;
+
+	struct tasklet_struct tasklet;
+	struct sk_buff_head skb_queue;
 };
 
 #define	MAC802154_DEVICE_STOPPED	0x00
 #define MAC802154_DEVICE_RUN		0x01
 
+enum {
+	IEEE802154_RX_MSG        = 1,
+};
+
 /* Slave interface definition.
  *
  * Slaves represent typical network interfaces available from userspace.
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index be45dc9..311f60c 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -376,7 +376,7 @@ void mac802154_wpan_setup(struct net_device *dev)
 
 static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
 {
-	return netif_rx_ni(skb);
+	return netif_receive_skb(skb);
 }
 
 static int
diff --git a/net/mac802154/main.c b/net/mac802154/main.c
index 3c0a824..4c484bb 100644
--- a/net/mac802154/main.c
+++ b/net/mac802154/main.c
@@ -222,6 +222,29 @@ static int mac802154_set_frame_retries(struct wpan_phy *phy, s8 retries)
 	return local->ops->set_frame_retries(&local->hw, retries);
 }
 
+static void ieee802154_tasklet_handler(unsigned long data)
+{
+	struct ieee802154_local *local = (struct ieee802154_local *)data;
+	struct sk_buff *skb;
+
+	while ((skb = skb_dequeue(&local->skb_queue))) {
+		switch (skb->pkt_type) {
+		case IEEE802154_RX_MSG:
+			/* Clear skb->pkt_type in order to not confuse kernel
+			 * netstack.
+			 */
+			skb->pkt_type = 0;
+			ieee802154_rx(&local->hw, skb);
+			break;
+		default:
+			WARN(1, "mac80211: Packet is of unknown type %d\n",
+			     skb->pkt_type);
+			kfree_skb(skb);
+			break;
+		}
+	}
+}
+
 struct ieee802154_hw *
 ieee802154_alloc_hw(size_t priv_data_len, struct ieee802154_ops *ops)
 {
@@ -270,6 +293,12 @@ ieee802154_alloc_hw(size_t priv_data_len, struct ieee802154_ops *ops)
 	INIT_LIST_HEAD(&local->interfaces);
 	mutex_init(&local->iflist_mtx);
 
+	tasklet_init(&local->tasklet,
+		     ieee802154_tasklet_handler,
+		     (unsigned long)local);
+
+	skb_queue_head_init(&local->skb_queue);
+
 	return &local->hw;
 }
 EXPORT_SYMBOL(ieee802154_alloc_hw);
@@ -371,6 +400,7 @@ void ieee802154_unregister_hw(struct ieee802154_hw *hw)
 	struct ieee802154_local *local = hw_to_local(hw);
 	struct ieee802154_sub_if_data *sdata, *next;
 
+	tasklet_kill(&local->tasklet);
 	flush_workqueue(local->workqueue);
 	destroy_workqueue(local->workqueue);
 
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 53c9e0c..2851a3f 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -19,7 +19,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/workqueue.h>
 #include <linux/netdevice.h>
 #include <linux/crc-ccitt.h>
 
@@ -28,30 +27,11 @@
 
 #include "ieee802154_i.h"
 
-/* The IEEE 802.15.4 standard defines 4 MAC packet types:
- * - beacon frame
- * - MAC command frame
- * - acknowledgement frame
- * - data frame
- *
- * and only the data frame should be pushed to the upper layers, other types
- * are just internal MAC layer management information. So only data packets
- * are going to be sent to the networking queue, all other will be processed
- * right here by using the device workqueue.
- */
-struct rx_work {
-	struct sk_buff *skb;
-	struct work_struct work;
-	struct ieee802154_hw *hw;
-	u8 lqi;
-};
-
 static void
-mac802154_subif_rx(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
+mac802154_subif_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 {
 	struct ieee802154_local *local = hw_to_local(hw);
 
-	mac_cb(skb)->lqi = lqi;
 	skb->protocol = htons(ETH_P_IEEE802154);
 	skb_reset_mac_header(skb);
 
@@ -79,32 +59,20 @@ fail:
 	kfree_skb(skb);
 }
 
-static void mac802154_rx_worker(struct work_struct *work)
+void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 {
-	struct rx_work *rw = container_of(work, struct rx_work, work);
-
-	mac802154_subif_rx(rw->hw, rw->skb, rw->lqi);
-	kfree(rw);
+	mac802154_subif_rx(hw, skb);
 }
+EXPORT_SYMBOL(ieee802154_rx);
 
 void
 ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi)
 {
 	struct ieee802154_local *local = hw_to_local(hw);
-	struct rx_work *work;
 
-	if (!skb)
-		return;
-
-	work = kzalloc(sizeof(*work), GFP_ATOMIC);
-	if (!work)
-		return;
-
-	INIT_WORK(&work->work, mac802154_rx_worker);
-	work->skb = skb;
-	work->hw = hw;
-	work->lqi = lqi;
-
-	queue_work(local->workqueue, &work->work);
+	mac_cb(skb)->lqi = lqi;
+	skb->pkt_type = IEEE802154_RX_MSG;
+	skb_queue_tail(&local->skb_queue, skb);
+	tasklet_schedule(&local->tasklet);
 }
 EXPORT_SYMBOL(ieee802154_rx_irqsafe);
-- 
2.1.2

[PATCH bluetooth-next 04/16] mac802154: rx: warn if ieee80211_rx call from irq

[Alexander Aring]

This patch adds a warning if the ieee80211_rx function is called from an
irq context which should never happen.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 2851a3f..c4df321 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -61,6 +61,8 @@ fail:
 
 void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 {
+	WARN_ON_ONCE(softirq_count() == 0);
+
 	mac802154_subif_rx(hw, skb);
 }
 EXPORT_SYMBOL(ieee802154_rx);
-- 
2.1.2

Re: [PATCH bluetooth-next 04/16] mac802154: rx: warn if ieee80211_rx call from irq

[Marc Kleine-Budde]

[-- Attachment #1: Type: text/plain, Size: 1049 bytes --]

On 10/27/2014 12:42 PM, Alexander Aring wrote:
> This patch adds a warning if the ieee80211_rx function is called from an
> irq context which should never happen.

do you mean hard and/or softirq here?

> 
> Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> ---
>  net/mac802154/rx.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
> index 2851a3f..c4df321 100644
> --- a/net/mac802154/rx.c
> +++ b/net/mac802154/rx.c
> @@ -61,6 +61,8 @@ fail:
>  
>  void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
>  {
> +	WARN_ON_ONCE(softirq_count() == 0);
> +

better use in_irq() or in_softirq(), see:

http://lxr.free-electrons.com/source/include/linux/preempt_mask.h#L64

Marc

-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [PATCH bluetooth-next 04/16] mac802154: rx: warn if ieee80211_rx call from irq

[Alexander Aring]

Hi Marc,

On Mon, Oct 27, 2014 at 01:10:54PM +0100, Marc Kleine-Budde wrote:
> On 10/27/2014 12:42 PM, Alexander Aring wrote:
> > This patch adds a warning if the ieee80211_rx function is called from an
> > irq context which should never happen.
> 
> do you mean hard and/or softirq here?
> 

Comment for in_softirq() is "in_softirq - Are we currently processing
softirq or have bh disabled?"

Then we checking is (softirq_count() == 0) if true then print warning.

in_softirq is declared as:

#define in_softirq()            (softirq_count())

So (softirq_count() == 0) is identically with (!in_softirq()).

Translating the "deMorgan law" to the above sentence:

We print a warning when we are not in a softirq context and have bh
enabled.

So we need to be in a softirq context or bh enabled.

> > 
> > Signed-off-by: Alexander Aring <alex.aring@gmail.com>
> > ---
> >  net/mac802154/rx.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
> > index 2851a3f..c4df321 100644
> > --- a/net/mac802154/rx.c
> > +++ b/net/mac802154/rx.c
> > @@ -61,6 +61,8 @@ fail:
> >  
> >  void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
> >  {
> > +	WARN_ON_ONCE(softirq_count() == 0);
> > +
> 
> better use in_irq() or in_softirq(), see:
> 
> http://lxr.free-electrons.com/source/include/linux/preempt_mask.h#L64
> 

Okay, maybe want to fix that also in:

http://lxr.free-electrons.com/source/net/mac80211/rx.c#L3347



btw. I will also fix in this patch s/80211/802154/ at several places. I
should do a grep before.

Are you sure we can use in_irq here? I would change it to:

WARN_ON_ONCE(!in_softirq());

- Alex

[PATCH bluetooth-next 05/16] mac802154: rx: move receive handling into rx.c

[Alexander Aring]

This patch removes all relevant receiving functions inclusive frame
parsing into rx file. Like mac80211 we should implement the complete
receive handling and parsing in this file.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/ieee802154_i.h |   1 -
 net/mac802154/iface.c        | 186 -------------------------------------
 net/mac802154/monitor.c      |  27 ------
 net/mac802154/rx.c           | 214 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 214 insertions(+), 214 deletions(-)

diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h
index 603509a..be2f2f6 100644
--- a/net/mac802154/ieee802154_i.h
+++ b/net/mac802154/ieee802154_i.h
@@ -131,7 +131,6 @@ void mac802154_monitor_setup(struct net_device *dev);
 netdev_tx_t
 ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
 
-void mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb);
 void mac802154_wpan_setup(struct net_device *dev);
 netdev_tx_t
 ieee802154_subif_start_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/net/mac802154/iface.c b/net/mac802154/iface.c
index 311f60c..7e4bffc 100644
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -373,189 +373,3 @@ void mac802154_wpan_setup(struct net_device *dev)
 
 	mac802154_llsec_init(&sdata->sec);
 }
-
-static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
-{
-	return netif_receive_skb(skb);
-}
-
-static int
-mac802154_subif_frame(struct ieee802154_sub_if_data *sdata, struct sk_buff *skb,
-		      const struct ieee802154_hdr *hdr)
-{
-	__le16 span, sshort;
-	int rc;
-
-	pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
-
-	spin_lock_bh(&sdata->mib_lock);
-
-	span = sdata->pan_id;
-	sshort = sdata->short_addr;
-
-	switch (mac_cb(skb)->dest.mode) {
-	case IEEE802154_ADDR_NONE:
-		if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
-			/* FIXME: check if we are PAN coordinator */
-			skb->pkt_type = PACKET_OTHERHOST;
-		else
-			/* ACK comes with both addresses empty */
-			skb->pkt_type = PACKET_HOST;
-		break;
-	case IEEE802154_ADDR_LONG:
-		if (mac_cb(skb)->dest.pan_id != span &&
-		    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
-			skb->pkt_type = PACKET_OTHERHOST;
-		else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
-			skb->pkt_type = PACKET_HOST;
-		else
-			skb->pkt_type = PACKET_OTHERHOST;
-		break;
-	case IEEE802154_ADDR_SHORT:
-		if (mac_cb(skb)->dest.pan_id != span &&
-		    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
-			skb->pkt_type = PACKET_OTHERHOST;
-		else if (mac_cb(skb)->dest.short_addr == sshort)
-			skb->pkt_type = PACKET_HOST;
-		else if (mac_cb(skb)->dest.short_addr ==
-			  cpu_to_le16(IEEE802154_ADDR_BROADCAST))
-			skb->pkt_type = PACKET_BROADCAST;
-		else
-			skb->pkt_type = PACKET_OTHERHOST;
-		break;
-	default:
-		spin_unlock_bh(&sdata->mib_lock);
-		pr_debug("invalid dest mode\n");
-		kfree_skb(skb);
-		return NET_RX_DROP;
-	}
-
-	spin_unlock_bh(&sdata->mib_lock);
-
-	skb->dev = sdata->dev;
-
-	rc = mac802154_llsec_decrypt(&sdata->sec, skb);
-	if (rc) {
-		pr_debug("decryption failed: %i\n", rc);
-		goto fail;
-	}
-
-	sdata->dev->stats.rx_packets++;
-	sdata->dev->stats.rx_bytes += skb->len;
-
-	switch (mac_cb(skb)->type) {
-	case IEEE802154_FC_TYPE_DATA:
-		return mac802154_process_data(sdata->dev, skb);
-	default:
-		pr_warn("ieee802154: bad frame received (type = %d)\n",
-			mac_cb(skb)->type);
-		goto fail;
-	}
-
-fail:
-	kfree_skb(skb);
-	return NET_RX_DROP;
-}
-
-static void mac802154_print_addr(const char *name,
-				 const struct ieee802154_addr *addr)
-{
-	if (addr->mode == IEEE802154_ADDR_NONE)
-		pr_debug("%s not present\n", name);
-
-	pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
-	if (addr->mode == IEEE802154_ADDR_SHORT) {
-		pr_debug("%s is short: %04x\n", name,
-			 le16_to_cpu(addr->short_addr));
-	} else {
-		u64 hw = swab64((__force u64) addr->extended_addr);
-
-		pr_debug("%s is hardware: %8phC\n", name, &hw);
-	}
-}
-
-static int mac802154_parse_frame_start(struct sk_buff *skb,
-				       struct ieee802154_hdr *hdr)
-{
-	int hlen;
-	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
-
-	hlen = ieee802154_hdr_pull(skb, hdr);
-	if (hlen < 0)
-		return -EINVAL;
-
-	skb->mac_len = hlen;
-
-	pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
-		 hdr->seq);
-
-	cb->type = hdr->fc.type;
-	cb->ackreq = hdr->fc.ack_request;
-	cb->secen = hdr->fc.security_enabled;
-
-	mac802154_print_addr("destination", &hdr->dest);
-	mac802154_print_addr("source", &hdr->source);
-
-	cb->source = hdr->source;
-	cb->dest = hdr->dest;
-
-	if (hdr->fc.security_enabled) {
-		u64 key;
-
-		pr_debug("seclevel %i\n", hdr->sec.level);
-
-		switch (hdr->sec.key_id_mode) {
-		case IEEE802154_SCF_KEY_IMPLICIT:
-			pr_debug("implicit key\n");
-			break;
-
-		case IEEE802154_SCF_KEY_INDEX:
-			pr_debug("key %02x\n", hdr->sec.key_id);
-			break;
-
-		case IEEE802154_SCF_KEY_SHORT_INDEX:
-			pr_debug("key %04x:%04x %02x\n",
-				 le32_to_cpu(hdr->sec.short_src) >> 16,
-				 le32_to_cpu(hdr->sec.short_src) & 0xffff,
-				 hdr->sec.key_id);
-			break;
-
-		case IEEE802154_SCF_KEY_HW_INDEX:
-			key = swab64((__force u64) hdr->sec.extended_src);
-			pr_debug("key source %8phC %02x\n", &key,
-				 hdr->sec.key_id);
-			break;
-		}
-	}
-
-	return 0;
-}
-
-void mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
-{
-	int ret;
-	struct ieee802154_sub_if_data *sdata;
-	struct ieee802154_hdr hdr;
-
-	ret = mac802154_parse_frame_start(skb, &hdr);
-	if (ret) {
-		pr_debug("got invalid frame\n");
-		kfree_skb(skb);
-		return;
-	}
-
-	rcu_read_lock();
-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-		if (sdata->type != IEEE802154_DEV_WPAN ||
-		    !netif_running(sdata->dev))
-			continue;
-
-		mac802154_subif_frame(sdata, skb, &hdr);
-		skb = NULL;
-		break;
-	}
-	rcu_read_unlock();
-
-	if (skb)
-		kfree_skb(skb);
-}
diff --git a/net/mac802154/monitor.c b/net/mac802154/monitor.c
index 5758322..dfdedc2 100644
--- a/net/mac802154/monitor.c
+++ b/net/mac802154/monitor.c
@@ -18,9 +18,7 @@
  */
 
 #include <linux/netdevice.h>
-#include <linux/skbuff.h>
 #include <linux/if_arp.h>
-#include <linux/crc-ccitt.h>
 #include <linux/ieee802154.h>
 
 #include <net/mac802154.h>
@@ -30,31 +28,6 @@
 
 #include "ieee802154_i.h"
 
-void mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
-{
-	struct sk_buff *skb2;
-	struct ieee802154_sub_if_data *sdata;
-	u16 crc = crc_ccitt(0, skb->data, skb->len);
-	u8 *data;
-
-	rcu_read_lock();
-	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-		if (sdata->type != IEEE802154_DEV_MONITOR ||
-		    !netif_running(sdata->dev))
-			continue;
-
-		skb2 = skb_clone(skb, GFP_ATOMIC);
-		skb2->dev = sdata->dev;
-		skb2->pkt_type = PACKET_HOST;
-		data = skb_put(skb2, 2);
-		data[0] = crc & 0xff;
-		data[1] = crc >> 8;
-
-		netif_rx_ni(skb2);
-	}
-	rcu_read_unlock();
-}
-
 static const struct net_device_ops mac802154_monitor_ops = {
 	.ndo_open		= mac802154_slave_open,
 	.ndo_stop		= mac802154_slave_close,
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index c4df321..d8498c5 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -24,9 +24,223 @@
 
 #include <net/mac802154.h>
 #include <net/ieee802154_netdev.h>
+#include <net/rtnetlink.h>
+#include <linux/nl802154.h>
 
 #include "ieee802154_i.h"
 
+static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
+{
+	return netif_receive_skb(skb);
+}
+
+static int
+mac802154_subif_frame(struct ieee802154_sub_if_data *sdata, struct sk_buff *skb,
+		      const struct ieee802154_hdr *hdr)
+{
+	__le16 span, sshort;
+	int rc;
+
+	pr_debug("getting packet via slave interface %s\n", sdata->dev->name);
+
+	spin_lock_bh(&sdata->mib_lock);
+
+	span = sdata->pan_id;
+	sshort = sdata->short_addr;
+
+	switch (mac_cb(skb)->dest.mode) {
+	case IEEE802154_ADDR_NONE:
+		if (mac_cb(skb)->dest.mode != IEEE802154_ADDR_NONE)
+			/* FIXME: check if we are PAN coordinator */
+			skb->pkt_type = PACKET_OTHERHOST;
+		else
+			/* ACK comes with both addresses empty */
+			skb->pkt_type = PACKET_HOST;
+		break;
+	case IEEE802154_ADDR_LONG:
+		if (mac_cb(skb)->dest.pan_id != span &&
+		    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
+			skb->pkt_type = PACKET_OTHERHOST;
+		else if (mac_cb(skb)->dest.extended_addr == sdata->extended_addr)
+			skb->pkt_type = PACKET_HOST;
+		else
+			skb->pkt_type = PACKET_OTHERHOST;
+		break;
+	case IEEE802154_ADDR_SHORT:
+		if (mac_cb(skb)->dest.pan_id != span &&
+		    mac_cb(skb)->dest.pan_id != cpu_to_le16(IEEE802154_PANID_BROADCAST))
+			skb->pkt_type = PACKET_OTHERHOST;
+		else if (mac_cb(skb)->dest.short_addr == sshort)
+			skb->pkt_type = PACKET_HOST;
+		else if (mac_cb(skb)->dest.short_addr ==
+			  cpu_to_le16(IEEE802154_ADDR_BROADCAST))
+			skb->pkt_type = PACKET_BROADCAST;
+		else
+			skb->pkt_type = PACKET_OTHERHOST;
+		break;
+	default:
+		spin_unlock_bh(&sdata->mib_lock);
+		pr_debug("invalid dest mode\n");
+		kfree_skb(skb);
+		return NET_RX_DROP;
+	}
+
+	spin_unlock_bh(&sdata->mib_lock);
+
+	skb->dev = sdata->dev;
+
+	rc = mac802154_llsec_decrypt(&sdata->sec, skb);
+	if (rc) {
+		pr_debug("decryption failed: %i\n", rc);
+		goto fail;
+	}
+
+	sdata->dev->stats.rx_packets++;
+	sdata->dev->stats.rx_bytes += skb->len;
+
+	switch (mac_cb(skb)->type) {
+	case IEEE802154_FC_TYPE_DATA:
+		return mac802154_process_data(sdata->dev, skb);
+	default:
+		pr_warn("ieee802154: bad frame received (type = %d)\n",
+			mac_cb(skb)->type);
+		goto fail;
+	}
+
+fail:
+	kfree_skb(skb);
+	return NET_RX_DROP;
+}
+
+static void mac802154_print_addr(const char *name,
+				 const struct ieee802154_addr *addr)
+{
+	if (addr->mode == IEEE802154_ADDR_NONE)
+		pr_debug("%s not present\n", name);
+
+	pr_debug("%s PAN ID: %04x\n", name, le16_to_cpu(addr->pan_id));
+	if (addr->mode == IEEE802154_ADDR_SHORT) {
+		pr_debug("%s is short: %04x\n", name,
+			 le16_to_cpu(addr->short_addr));
+	} else {
+		u64 hw = swab64((__force u64)addr->extended_addr);
+
+		pr_debug("%s is hardware: %8phC\n", name, &hw);
+	}
+}
+
+static int mac802154_parse_frame_start(struct sk_buff *skb,
+				       struct ieee802154_hdr *hdr)
+{
+	int hlen;
+	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
+
+	hlen = ieee802154_hdr_pull(skb, hdr);
+	if (hlen < 0)
+		return -EINVAL;
+
+	skb->mac_len = hlen;
+
+	pr_debug("fc: %04x dsn: %02x\n", le16_to_cpup((__le16 *)&hdr->fc),
+		 hdr->seq);
+
+	cb->type = hdr->fc.type;
+	cb->ackreq = hdr->fc.ack_request;
+	cb->secen = hdr->fc.security_enabled;
+
+	mac802154_print_addr("destination", &hdr->dest);
+	mac802154_print_addr("source", &hdr->source);
+
+	cb->source = hdr->source;
+	cb->dest = hdr->dest;
+
+	if (hdr->fc.security_enabled) {
+		u64 key;
+
+		pr_debug("seclevel %i\n", hdr->sec.level);
+
+		switch (hdr->sec.key_id_mode) {
+		case IEEE802154_SCF_KEY_IMPLICIT:
+			pr_debug("implicit key\n");
+			break;
+
+		case IEEE802154_SCF_KEY_INDEX:
+			pr_debug("key %02x\n", hdr->sec.key_id);
+			break;
+
+		case IEEE802154_SCF_KEY_SHORT_INDEX:
+			pr_debug("key %04x:%04x %02x\n",
+				 le32_to_cpu(hdr->sec.short_src) >> 16,
+				 le32_to_cpu(hdr->sec.short_src) & 0xffff,
+				 hdr->sec.key_id);
+			break;
+
+		case IEEE802154_SCF_KEY_HW_INDEX:
+			key = swab64((__force u64)hdr->sec.extended_src);
+			pr_debug("key source %8phC %02x\n", &key,
+				 hdr->sec.key_id);
+			break;
+		}
+	}
+
+	return 0;
+}
+
+static void
+mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
+{
+	int ret;
+	struct ieee802154_sub_if_data *sdata;
+	struct ieee802154_hdr hdr;
+
+	ret = mac802154_parse_frame_start(skb, &hdr);
+	if (ret) {
+		pr_debug("got invalid frame\n");
+		kfree_skb(skb);
+		return;
+	}
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+		if (sdata->type != IEEE802154_DEV_WPAN ||
+		    !netif_running(sdata->dev))
+			continue;
+
+		mac802154_subif_frame(sdata, skb, &hdr);
+		skb = NULL;
+		break;
+	}
+	rcu_read_unlock();
+
+	if (skb)
+		kfree_skb(skb);
+}
+
+void mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
+{
+	struct sk_buff *skb2;
+	struct ieee802154_sub_if_data *sdata;
+	u16 crc = crc_ccitt(0, skb->data, skb->len);
+	u8 *data;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+		if (sdata->type != IEEE802154_DEV_MONITOR ||
+		    !netif_running(sdata->dev))
+			continue;
+
+		skb2 = skb_clone(skb, GFP_ATOMIC);
+		skb2->dev = sdata->dev;
+		skb2->pkt_type = PACKET_HOST;
+		data = skb_put(skb2, 2);
+		data[0] = crc & 0xff;
+		data[1] = crc >> 8;
+
+		netif_rx_ni(skb2);
+	}
+	rcu_read_unlock();
+}
+
 static void
 mac802154_subif_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 {
-- 
2.1.2

[PATCH bluetooth-next 06/16] mac802154: tx: remove monitor receive while xmit

[Alexander Aring]

This removes the call of monitor receive funktion when any interface
type call xmit. There exist no such use case that a monitor interface
should receive the actual sending frame. One use case could be that a
wpan interface and monitor interface could be running at the same time
on one phy. Then the monitor interface receives the wpan frames also.
Furthermore we adding support for promiscous mode setting. With
promiscous mode setting we can't run a wpan and monitor interface at the
same time.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/ieee802154_i.h | 1 -
 net/mac802154/rx.c           | 3 ++-
 net/mac802154/tx.c           | 2 --
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/mac802154/ieee802154_i.h b/net/mac802154/ieee802154_i.h
index be2f2f6..ac907d9 100644
--- a/net/mac802154/ieee802154_i.h
+++ b/net/mac802154/ieee802154_i.h
@@ -126,7 +126,6 @@ extern struct ieee802154_mlme_ops mac802154_mlme_wpan;
 int mac802154_slave_open(struct net_device *dev);
 int mac802154_slave_close(struct net_device *dev);
 
-void mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb);
 void mac802154_monitor_setup(struct net_device *dev);
 netdev_tx_t
 ieee802154_monitor_start_xmit(struct sk_buff *skb, struct net_device *dev);
diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index d8498c5..04f3d61 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -216,7 +216,8 @@ mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
 		kfree_skb(skb);
 }
 
-void mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
+static void
+mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 {
 	struct sk_buff *skb2;
 	struct ieee802154_sub_if_data *sdata;
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index 31e51e4..e857673 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -82,8 +82,6 @@ ieee802154_tx(struct ieee802154_local *local, struct sk_buff *skb)
 	struct net_device *dev = skb->dev;
 	int ret;
 
-	mac802154_monitors_rx(local, skb);
-
 	if (!(local->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
 		u16 crc = crc_ccitt(0, skb->data, skb->len);
 
-- 
2.1.2

[PATCH bluetooth-next 07/16] mac802154: rx: rename remove mac802154_subif_rx

[Alexander Aring]

This patch removes the mac802154_subif_rx function and do the necessary
calls inside of ieee802154_rx function. The ieee802154_rx is small
enough to move the functionality inside this function.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 04f3d61..246a60e 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -242,11 +242,12 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 	rcu_read_unlock();
 }
 
-static void
-mac802154_subif_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
+void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 {
 	struct ieee802154_local *local = hw_to_local(hw);
 
+	WARN_ON_ONCE(softirq_count() == 0);
+
 	skb->protocol = htons(ETH_P_IEEE802154);
 	skb_reset_mac_header(skb);
 
@@ -273,13 +274,6 @@ mac802154_subif_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 fail:
 	kfree_skb(skb);
 }
-
-void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
-{
-	WARN_ON_ONCE(softirq_count() == 0);
-
-	mac802154_subif_rx(hw, skb);
-}
 EXPORT_SYMBOL(ieee802154_rx);
 
 void
-- 
2.1.2

[PATCH bluetooth-next 08/16] mac802154: rx: move skb->protocol setting

[Alexander Aring]

This patch moves the skb->protocol setting to the position when it's
needed. It's only needed when frame parsing was successful.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 246a60e..c4066b5 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -31,6 +31,8 @@
 
 static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
 {
+	skb->protocol = htons(ETH_P_IEEE802154);
+
 	return netif_receive_skb(skb);
 }
 
@@ -224,6 +226,8 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 	u16 crc = crc_ccitt(0, skb->data, skb->len);
 	u8 *data;
 
+	skb->protocol = htons(ETH_P_IEEE802154);
+
 	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (sdata->type != IEEE802154_DEV_MONITOR ||
@@ -248,7 +252,6 @@ void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 
 	WARN_ON_ONCE(softirq_count() == 0);
 
-	skb->protocol = htons(ETH_P_IEEE802154);
 	skb_reset_mac_header(skb);
 
 	if (!(local->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
-- 
2.1.2

[PATCH bluetooth-next 09/16] mac802154: rx: add CHECKSUM_UNNECESSARY

[Alexander Aring]

This patch adds CHECKSUM_UNNECESSARY to skb->ip_summed before delivery.
There exist no transceiver with IP checksum functionality.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index c4066b5..14eecac 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -31,6 +31,7 @@
 
 static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
 {
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	skb->protocol = htons(ETH_P_IEEE802154);
 
 	return netif_receive_skb(skb);
@@ -226,6 +227,7 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 	u16 crc = crc_ccitt(0, skb->data, skb->len);
 	u8 *data;
 
+	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	skb->protocol = htons(ETH_P_IEEE802154);
 
 	rcu_read_lock();
-- 
2.1.2

[PATCH bluetooth-next 10/16] mac802154: rx: add monitor pkt_type information

[Alexander Aring]

This patch adds a PACKET_OTHERHOST setting when a monitor interface
receives a skb. All receiving skb's to the monitor interface should
be PACKET_OTHERHOST.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 14eecac..f7f09b4 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -228,6 +228,7 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 	u8 *data;
 
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+	skb->pkt_type = PACKET_OTHERHOST;
 	skb->protocol = htons(ETH_P_IEEE802154);
 
 	rcu_read_lock();
-- 
2.1.2

[PATCH bluetooth-next 11/16] mac802154: rx: move skb_reset_mac_header

[Alexander Aring]

This patch moves the skb_reset_mac_header call before frame parsing
while wpan rx and before monitor deliver functionality.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index f7f09b4..c299980 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -138,6 +138,8 @@ static int mac802154_parse_frame_start(struct sk_buff *skb,
 	int hlen;
 	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
 
+	skb_reset_mac_header(skb);
+
 	hlen = ieee802154_hdr_pull(skb, hdr);
 	if (hlen < 0)
 		return -EINVAL;
@@ -227,6 +229,7 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 	u16 crc = crc_ccitt(0, skb->data, skb->len);
 	u8 *data;
 
+	skb_reset_mac_header(skb);
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	skb->pkt_type = PACKET_OTHERHOST;
 	skb->protocol = htons(ETH_P_IEEE802154);
@@ -255,8 +258,6 @@ void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 
 	WARN_ON_ONCE(softirq_count() == 0);
 
-	skb_reset_mac_header(skb);
-
 	if (!(local->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
 		u16 crc;
 
-- 
2.1.2

[PATCH bluetooth-next 12/16] mac802154: rx: move rcu locking

[Alexander Aring]

Instead of twice lock and unlock mechanism this patch hold these locks
only once at one position.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index c299980..689bb7f 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -205,7 +205,6 @@ mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
 		return;
 	}
 
-	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (sdata->type != IEEE802154_DEV_WPAN ||
 		    !netif_running(sdata->dev))
@@ -215,7 +214,6 @@ mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
 		skb = NULL;
 		break;
 	}
-	rcu_read_unlock();
 
 	if (skb)
 		kfree_skb(skb);
@@ -234,7 +232,6 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 	skb->pkt_type = PACKET_OTHERHOST;
 	skb->protocol = htons(ETH_P_IEEE802154);
 
-	rcu_read_lock();
 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 		if (sdata->type != IEEE802154_DEV_MONITOR ||
 		    !netif_running(sdata->dev))
@@ -249,7 +246,6 @@ mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 
 		netif_rx_ni(skb2);
 	}
-	rcu_read_unlock();
 }
 
 void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
@@ -273,9 +269,13 @@ void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 		skb_trim(skb, skb->len - 2); /* CRC */
 	}
 
+	rcu_read_lock();
+
 	mac802154_monitors_rx(local, skb);
 	mac802154_wpans_rx(local, skb);
 
+	rcu_read_unlock();
+
 	return;
 
 fail:
-- 
2.1.2

[PATCH bluetooth-next 13/16] ieee802154: add valid psdu length helper

[Alexander Aring]

This patch adds a generic valid psdu length check function helper. This
is useful to check the length field after receiving. For example the
at86rf231 doesn't filter invalid psdu length. Sometimes the CRC can also
be correct. If we get the lqi value with an invalid frame length the
kernel may crash because we dereference an invalid pointer in the
receive buffer.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 include/linux/ieee802154.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/include/linux/ieee802154.h b/include/linux/ieee802154.h
index 2dfab2d..73285a3 100644
--- a/include/linux/ieee802154.h
+++ b/include/linux/ieee802154.h
@@ -23,7 +23,10 @@
 #ifndef LINUX_IEEE802154_H
 #define LINUX_IEEE802154_H
 
+#include <linux/types.h>
+
 #define IEEE802154_MTU			127
+#define IEEE802154_MIN_PSDU_LEN		5
 
 #define IEEE802154_FC_TYPE_BEACON	0x0	/* Frame is beacon */
 #define	IEEE802154_FC_TYPE_DATA		0x1	/* Frame is data */
@@ -185,5 +188,13 @@ enum {
 	IEEE802154_SCAN_IN_PROGRESS = 0xfc,
 };
 
+/**
+ * ieee802154_is_valid_psdu_len - check if psdu len is valid
+ * @len: psdu len with (MHR + payload + MFR)
+ */
+static inline bool ieee802154_is_valid_psdu_len(const u8 len)
+{
+	return (len <= IEEE802154_MTU || len >= IEEE802154_MIN_PSDU_LEN);
+}
 
 #endif /* LINUX_IEEE802154_H */
-- 
2.1.2

[PATCH bluetooth-next 14/16] at86rf230: use ieee802154_is_valid_psdu_len helper

[Alexander Aring]

This patch adds the ieee802154_is_valid_psdu_len function to validate
the psdu length. If the psdu length is invalid we use the maximum
payload to receive also corrupted frames in monitor mode.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 drivers/net/ieee802154/at86rf230.c | 26 ++++++++------------------
 1 file changed, 8 insertions(+), 18 deletions(-)

diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index e4fbcaa..368791b 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -788,26 +788,11 @@ at86rf230_tx_trac_status(void *context)
 
 static void
 at86rf230_rx(struct at86rf230_local *lp,
-	     const u8 *data, u8 len)
+	     const u8 *data, const u8 len)
 {
-	u8 lqi;
 	struct sk_buff *skb;
 	u8 rx_local_buf[AT86RF2XX_MAX_BUF];
 
-	if (len < 2)
-		return;
-
-	/* read full frame buffer and invalid lqi value to lowest
-	 * indicator if frame was is in a corrupted state.
-	 */
-	if (len > IEEE802154_MTU) {
-		lqi = 0;
-		len = IEEE802154_MTU;
-		dev_vdbg(&lp->spi->dev, "corrupted frame received\n");
-	} else {
-		lqi = data[len];
-	}
-
 	memcpy(rx_local_buf, data, len);
 	enable_irq(lp->spi->irq);
 
@@ -822,7 +807,7 @@ at86rf230_rx(struct at86rf230_local *lp,
 	/* We do not put CRC into the frame */
 	skb_trim(skb, len - 2);
 
-	ieee802154_rx_irqsafe(lp->hw, skb, lqi);
+	ieee802154_rx_irqsafe(lp->hw, skb, rx_local_buf[len]);
 }
 
 static void
@@ -831,7 +816,12 @@ at86rf230_rx_read_frame_complete(void *context)
 	struct at86rf230_state_change *ctx = context;
 	struct at86rf230_local *lp = ctx->lp;
 	const u8 *buf = lp->irq.buf;
-	const u8 len = buf[1];
+	u8 len = buf[1];
+
+	if (!ieee802154_is_valid_psdu_len(len)) {
+		dev_vdbg(&lp->spi->dev, "corrupted frame received\n");
+		len = IEEE802154_MTU;
+	}
 
 	at86rf230_rx(lp, buf + 2, len);
 }
-- 
2.1.2

[PATCH bluetooth-next 15/16] at86rf230: improve receive handling

[Alexander Aring]

Current behaviour it to copy the frame inclusive CRC into a skb, then
remove the CRC from the skb. This patch optimizes this by not copying
the CRC at the first place.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 drivers/net/ieee802154/at86rf230.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ieee802154/at86rf230.c b/drivers/net/ieee802154/at86rf230.c
index 368791b..a155838 100644
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -788,7 +788,7 @@ at86rf230_tx_trac_status(void *context)
 
 static void
 at86rf230_rx(struct at86rf230_local *lp,
-	     const u8 *data, const u8 len)
+	     const u8 *data, const u8 len, const u8 lqi)
 {
 	struct sk_buff *skb;
 	u8 rx_local_buf[AT86RF2XX_MAX_BUF];
@@ -803,11 +803,7 @@ at86rf230_rx(struct at86rf230_local *lp,
 	}
 
 	memcpy(skb_put(skb, len), rx_local_buf, len);
-
-	/* We do not put CRC into the frame */
-	skb_trim(skb, len - 2);
-
-	ieee802154_rx_irqsafe(lp->hw, skb, rx_local_buf[len]);
+	ieee802154_rx_irqsafe(lp->hw, skb, lqi);
 }
 
 static void
@@ -823,7 +819,7 @@ at86rf230_rx_read_frame_complete(void *context)
 		len = IEEE802154_MTU;
 	}
 
-	at86rf230_rx(lp, buf + 2, len);
+	at86rf230_rx(lp, buf + 2, len - 2, buf[2 + len]);
 }
 
 static void
-- 
2.1.2

[PATCH bluetooth-next 16/16] mac802154: rx: change naming convention

[Alexander Aring]

This patch changes the naming convention of mac802154 rx file. It should
be more named like mac80211 stack. Furthermore we introduce a new frame
parsing implementation which is much similar the mac80211
implementation.

Signed-off-by: Alexander Aring <alex.aring@gmail.com>
---
 net/mac802154/rx.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/net/mac802154/rx.c b/net/mac802154/rx.c
index 689bb7f..86394be 100644
--- a/net/mac802154/rx.c
+++ b/net/mac802154/rx.c
@@ -29,7 +29,7 @@
 
 #include "ieee802154_i.h"
 
-static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
+static int ieee802154_deliver_skb(struct net_device *dev, struct sk_buff *skb)
 {
 	skb->ip_summed = CHECKSUM_UNNECESSARY;
 	skb->protocol = htons(ETH_P_IEEE802154);
@@ -38,8 +38,8 @@ static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
 }
 
 static int
-mac802154_subif_frame(struct ieee802154_sub_if_data *sdata, struct sk_buff *skb,
-		      const struct ieee802154_hdr *hdr)
+ieee802154_subif_frame(struct ieee802154_sub_if_data *sdata,
+		       struct sk_buff *skb, const struct ieee802154_hdr *hdr)
 {
 	__le16 span, sshort;
 	int rc;
@@ -103,7 +103,7 @@ mac802154_subif_frame(struct ieee802154_sub_if_data *sdata, struct sk_buff *skb,
 
 	switch (mac_cb(skb)->type) {
 	case IEEE802154_FC_TYPE_DATA:
-		return mac802154_process_data(sdata->dev, skb);
+		return ieee802154_deliver_skb(sdata->dev, skb);
 	default:
 		pr_warn("ieee802154: bad frame received (type = %d)\n",
 			mac_cb(skb)->type);
@@ -115,8 +115,8 @@ fail:
 	return NET_RX_DROP;
 }
 
-static void mac802154_print_addr(const char *name,
-				 const struct ieee802154_addr *addr)
+static void
+ieee802154_print_addr(const char *name, const struct ieee802154_addr *addr)
 {
 	if (addr->mode == IEEE802154_ADDR_NONE)
 		pr_debug("%s not present\n", name);
@@ -132,8 +132,8 @@ static void mac802154_print_addr(const char *name,
 	}
 }
 
-static int mac802154_parse_frame_start(struct sk_buff *skb,
-				       struct ieee802154_hdr *hdr)
+static int
+ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr)
 {
 	int hlen;
 	struct ieee802154_mac_cb *cb = mac_cb_init(skb);
@@ -153,8 +153,8 @@ static int mac802154_parse_frame_start(struct sk_buff *skb,
 	cb->ackreq = hdr->fc.ack_request;
 	cb->secen = hdr->fc.security_enabled;
 
-	mac802154_print_addr("destination", &hdr->dest);
-	mac802154_print_addr("source", &hdr->source);
+	ieee802154_print_addr("destination", &hdr->dest);
+	ieee802154_print_addr("source", &hdr->source);
 
 	cb->source = hdr->source;
 	cb->dest = hdr->dest;
@@ -192,13 +192,14 @@ static int mac802154_parse_frame_start(struct sk_buff *skb,
 }
 
 static void
-mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
+__ieee802154_rx_handle_packet(struct ieee802154_local *local,
+			      struct sk_buff *skb)
 {
 	int ret;
 	struct ieee802154_sub_if_data *sdata;
 	struct ieee802154_hdr hdr;
 
-	ret = mac802154_parse_frame_start(skb, &hdr);
+	ret = ieee802154_parse_frame_start(skb, &hdr);
 	if (ret) {
 		pr_debug("got invalid frame\n");
 		kfree_skb(skb);
@@ -210,7 +211,7 @@ mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
 		    !netif_running(sdata->dev))
 			continue;
 
-		mac802154_subif_frame(sdata, skb, &hdr);
+		ieee802154_subif_frame(sdata, skb, &hdr);
 		skb = NULL;
 		break;
 	}
@@ -220,7 +221,7 @@ mac802154_wpans_rx(struct ieee802154_local *local, struct sk_buff *skb)
 }
 
 static void
-mac802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
+ieee802154_monitors_rx(struct ieee802154_local *local, struct sk_buff *skb)
 {
 	struct sk_buff *skb2;
 	struct ieee802154_sub_if_data *sdata;
@@ -271,8 +272,8 @@ void ieee802154_rx(struct ieee802154_hw *hw, struct sk_buff *skb)
 
 	rcu_read_lock();
 
-	mac802154_monitors_rx(local, skb);
-	mac802154_wpans_rx(local, skb);
+	ieee802154_monitors_rx(local, skb);
+	__ieee802154_rx_handle_packet(local, skb);
 
 	rcu_read_unlock();
 
-- 
2.1.2