drivers/staging/rtl8188eu/core/rtw_recv.c

   1 /******************************************************************************
   2  *
   3  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  ******************************************************************************/
  15 #define _RTW_RECV_C_
  16
  17 #include <linux/ieee80211.h>
  18
  19 #include <osdep_service.h>
  20 #include <drv_types.h>
  21 #include <recv_osdep.h>
  22 #include <mlme_osdep.h>
  23 #include <mon.h>
  24 #include <wifi.h>
  25 #include <linux/vmalloc.h>
  26
  27 #define ETHERNET_HEADER_SIZE    14      /*  Ethernet Header Length */
  28 #define LLC_HEADER_SIZE                 6       /*  LLC Header Length */
  29
  30 static u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37};
  31 static u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3};
  32
  33 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
  34 static u8 rtw_bridge_tunnel_header[] = {
  35        0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8
  36 };
  37
  38 static u8 rtw_rfc1042_header[] = {
  39        0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00
  40 };
  41
  42 static void rtw_signal_stat_timer_hdl(unsigned long data);
  43
  44 void _rtw_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv)
  45 {
  46
  47         memset((u8 *)psta_recvpriv, 0, sizeof(struct sta_recv_priv));
  48
  49         spin_lock_init(&psta_recvpriv->lock);
  50
  51         _rtw_init_queue(&psta_recvpriv->defrag_q);
  52
  53 }
  54
  55 int _rtw_init_recv_priv(struct recv_priv *precvpriv, struct adapter *padapter)
  56 {
  57         int i;
  58
  59         struct recv_frame *precvframe;
  60
  61         int     res = _SUCCESS;
  62
  63         _rtw_init_queue(&precvpriv->free_recv_queue);
  64         _rtw_init_queue(&precvpriv->recv_pending_queue);
  65         _rtw_init_queue(&precvpriv->uc_swdec_pending_queue);
  66
  67         precvpriv->adapter = padapter;
  68
  69         precvpriv->pallocated_frame_buf = vzalloc(NR_RECVFRAME * sizeof(struct recv_frame) + RXFRAME_ALIGN_SZ);
  70
  71         if (!precvpriv->pallocated_frame_buf)
  72                 return _FAIL;
  73
  74         precvframe = PTR_ALIGN(precvpriv->pallocated_frame_buf, RXFRAME_ALIGN_SZ);
  75
  76         for (i = 0; i < NR_RECVFRAME; i++) {
  77                 INIT_LIST_HEAD(&(precvframe->list));
  78
  79                 list_add_tail(&(precvframe->list),
  80                                      &(precvpriv->free_recv_queue.queue));
  81
  82                 precvframe->pkt = NULL;
  83
  84                 precvframe->adapter = padapter;
  85                 precvframe++;
  86         }
  87         res = rtw_hal_init_recv_priv(padapter);
  88
  89         setup_timer(&precvpriv->signal_stat_timer,
  90                     rtw_signal_stat_timer_hdl,
  91                     (unsigned long)padapter);
  92
  93         precvpriv->signal_stat_sampling_interval = 1000; /* ms */
  94
  95         rtw_set_signal_stat_timer(precvpriv);
  96
  97         return res;
  98 }
  99
 100 void _rtw_free_recv_priv(struct recv_priv *precvpriv)
 101 {
 102         struct adapter  *padapter = precvpriv->adapter;
 103
 104         rtw_free_uc_swdec_pending_queue(padapter);
 105
 106         vfree(precvpriv->pallocated_frame_buf);
 107
 108         rtw_hal_free_recv_priv(padapter);
 109
 110 }
 111
 112 struct recv_frame *_rtw_alloc_recvframe(struct __queue *pfree_recv_queue)
 113 {
 114         struct recv_frame *hdr;
 115
 116         hdr = list_first_entry_or_null(&pfree_recv_queue->queue,
 117                                        struct recv_frame, list);
 118         if (hdr)
 119                 list_del_init(&hdr->list);
 120
 121         return hdr;
 122 }
 123
 124 struct recv_frame *rtw_alloc_recvframe(struct __queue *pfree_recv_queue)
 125 {
 126         struct recv_frame  *precvframe;
 127
 128         spin_lock_bh(&pfree_recv_queue->lock);
 129
 130         precvframe = _rtw_alloc_recvframe(pfree_recv_queue);
 131
 132         spin_unlock_bh(&pfree_recv_queue->lock);
 133
 134         return precvframe;
 135 }
 136
 137 int rtw_free_recvframe(struct recv_frame *precvframe,
 138                        struct __queue *pfree_recv_queue)
 139 {
 140         if (!precvframe)
 141                 return _FAIL;
 142         if (precvframe->pkt) {
 143                 dev_kfree_skb_any(precvframe->pkt);/* free skb by driver */
 144                 precvframe->pkt = NULL;
 145         }
 146
 147         spin_lock_bh(&pfree_recv_queue->lock);
 148
 149         list_del_init(&(precvframe->list));
 150
 151         list_add_tail(&(precvframe->list), get_list_head(pfree_recv_queue));
 152
 153         spin_unlock_bh(&pfree_recv_queue->lock);
 154
 155         return _SUCCESS;
 156 }
 157
 158 int _rtw_enqueue_recvframe(struct recv_frame *precvframe, struct __queue *queue)
 159 {
 160         list_del_init(&(precvframe->list));
 161         list_add_tail(&(precvframe->list), get_list_head(queue));
 162
 163         return _SUCCESS;
 164 }
 165
 166 int rtw_enqueue_recvframe(struct recv_frame *precvframe, struct __queue *queue)
 167 {
 168         int ret;
 169
 170         spin_lock_bh(&queue->lock);
 171         ret = _rtw_enqueue_recvframe(precvframe, queue);
 172         spin_unlock_bh(&queue->lock);
 173
 174         return ret;
 175 }
 176
 177 /*
 178 caller : defrag ; recvframe_chk_defrag in recv_thread  (passive)
 179 pframequeue: defrag_queue : will be accessed in recv_thread  (passive)
 180
 181 using spinlock to protect
 182
 183 */
 184
 185 void rtw_free_recvframe_queue(struct __queue *pframequeue,  struct __queue *pfree_recv_queue)
 186 {
 187         struct recv_frame *hdr;
 188         struct list_head *plist, *phead;
 189
 190         spin_lock(&pframequeue->lock);
 191
 192         phead = get_list_head(pframequeue);
 193         plist = phead->next;
 194
 195         while (phead != plist) {
 196                 hdr = container_of(plist, struct recv_frame, list);
 197
 198                 plist = plist->next;
 199
 200                 rtw_free_recvframe(hdr, pfree_recv_queue);
 201         }
 202
 203         spin_unlock(&pframequeue->lock);
 204
 205 }
 206
 207 u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter)
 208 {
 209         u32 cnt = 0;
 210         struct recv_frame *pending_frame;
 211
 212         while ((pending_frame = rtw_alloc_recvframe(&adapter->recvpriv.uc_swdec_pending_queue))) {
 213                 rtw_free_recvframe(pending_frame, &adapter->recvpriv.free_recv_queue);
 214                 DBG_88E("%s: dequeue uc_swdec_pending_queue\n", __func__);
 215                 cnt++;
 216         }
 217
 218         return cnt;
 219 }
 220
 221 static int recvframe_chkmic(struct adapter *adapter,
 222                             struct recv_frame *precvframe)
 223 {
 224         int     i, res = _SUCCESS;
 225         u32     datalen;
 226         u8      miccode[8];
 227         u8      bmic_err = false, brpt_micerror = true;
 228         u8      *pframe, *payload, *pframemic;
 229         u8      *mickey;
 230         struct  sta_info                *stainfo;
 231         struct  rx_pkt_attrib   *prxattrib = &precvframe->attrib;
 232         struct  security_priv   *psecuritypriv = &adapter->securitypriv;
 233
 234         struct mlme_ext_priv    *pmlmeext = &adapter->mlmeextpriv;
 235         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 236
 237         stainfo = rtw_get_stainfo(&adapter->stapriv, &prxattrib->ta[0]);
 238
 239         if (prxattrib->encrypt == _TKIP_) {
 240                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n recvframe_chkmic:prxattrib->encrypt==_TKIP_\n"));
 241                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n recvframe_chkmic:da=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
 242                          prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2], prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5]));
 243
 244                 /* calculate mic code */
 245                 if (stainfo != NULL) {
 246                         if (IS_MCAST(prxattrib->ra)) {
 247                                 if (!psecuritypriv) {
 248                                         res = _FAIL;
 249                                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("\n recvframe_chkmic:didn't install group key!!!!!!!!!!\n"));
 250                                         DBG_88E("\n recvframe_chkmic:didn't install group key!!!!!!!!!!\n");
 251                                         goto exit;
 252                                 }
 253                                 mickey = &psecuritypriv->dot118021XGrprxmickey[prxattrib->key_index].skey[0];
 254
 255                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n recvframe_chkmic: bcmc key\n"));
 256                         } else {
 257                                 mickey = &stainfo->dot11tkiprxmickey.skey[0];
 258                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("\n recvframe_chkmic: unicast key\n"));
 259                         }
 260
 261                         /* icv_len included the mic code */
 262                         datalen = precvframe->pkt->len-prxattrib->hdrlen -
 263                                   prxattrib->iv_len-prxattrib->icv_len-8;
 264                         pframe = precvframe->pkt->data;
 265                         payload = pframe+prxattrib->hdrlen+prxattrib->iv_len;
 266
 267                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n prxattrib->iv_len=%d prxattrib->icv_len=%d\n", prxattrib->iv_len, prxattrib->icv_len));
 268                         rtw_seccalctkipmic(mickey, pframe, payload, datalen, &miccode[0],
 269                                            (unsigned char)prxattrib->priority); /* care the length of the data */
 270
 271                         pframemic = payload+datalen;
 272
 273                         bmic_err = false;
 274
 275                         for (i = 0; i < 8; i++) {
 276                                 if (miccode[i] != *(pframemic+i)) {
 277                                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 278                                                  ("recvframe_chkmic:miccode[%d](%02x)!=*(pframemic+%d)(%02x) ",
 279                                                  i, miccode[i], i, *(pframemic+i)));
 280                                         bmic_err = true;
 281                                 }
 282                         }
 283
 284                         if (bmic_err) {
 285                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 286                                          ("\n *(pframemic-8)-*(pframemic-1)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
 287                                          *(pframemic-8), *(pframemic-7), *(pframemic-6),
 288                                          *(pframemic-5), *(pframemic-4), *(pframemic-3),
 289                                          *(pframemic-2), *(pframemic-1)));
 290                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 291                                          ("\n *(pframemic-16)-*(pframemic-9)=0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x\n",
 292                                          *(pframemic-16), *(pframemic-15), *(pframemic-14),
 293                                          *(pframemic-13), *(pframemic-12), *(pframemic-11),
 294                                          *(pframemic-10), *(pframemic-9)));
 295                                 {
 296                                         uint i;
 297
 298                                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 299                                                  ("\n ======demp packet (len=%d)======\n",
 300                                                  precvframe->pkt->len));
 301                                         for (i = 0; i < precvframe->pkt->len; i += 8) {
 302                                                 RT_TRACE(_module_rtl871x_recv_c_,
 303                                                          _drv_err_,
 304                                                          ("0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x:0x%02x",
 305                                                          *(precvframe->pkt->data+i),
 306                                                          *(precvframe->pkt->data+i+1),
 307                                                          *(precvframe->pkt->data+i+2),
 308                                                          *(precvframe->pkt->data+i+3),
 309                                                          *(precvframe->pkt->data+i+4),
 310                                                          *(precvframe->pkt->data+i+5),
 311                                                          *(precvframe->pkt->data+i+6),
 312                                                          *(precvframe->pkt->data+i+7)));
 313                                         }
 314                                         RT_TRACE(_module_rtl871x_recv_c_,
 315                                                  _drv_err_,
 316                                                  ("\n ====== demp packet end [len=%d]======\n",
 317                                                  precvframe->pkt->len));
 318                                         RT_TRACE(_module_rtl871x_recv_c_,
 319                                                  _drv_err_,
 320                                                  ("\n hrdlen=%d,\n",
 321                                                  prxattrib->hdrlen));
 322                                 }
 323
 324                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 325                                          ("ra=0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x 0x%.2x psecuritypriv->binstallGrpkey=%d ",
 326                                          prxattrib->ra[0], prxattrib->ra[1], prxattrib->ra[2],
 327                                          prxattrib->ra[3], prxattrib->ra[4], prxattrib->ra[5], psecuritypriv->binstallGrpkey));
 328
 329                                 /*  double check key_index for some timing issue , */
 330                                 /*  cannot compare with psecuritypriv->dot118021XGrpKeyid also cause timing issue */
 331                                 if ((IS_MCAST(prxattrib->ra) == true)  && (prxattrib->key_index != pmlmeinfo->key_index))
 332                                         brpt_micerror = false;
 333
 334                                 if ((prxattrib->bdecrypted) && (brpt_micerror)) {
 335                                         rtw_handle_tkip_mic_err(adapter, (u8)IS_MCAST(prxattrib->ra));
 336                                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
 337                                         DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
 338                                 } else {
 339                                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" mic error :prxattrib->bdecrypted=%d ", prxattrib->bdecrypted));
 340                                         DBG_88E(" mic error :prxattrib->bdecrypted=%d\n", prxattrib->bdecrypted);
 341                                 }
 342                                 res = _FAIL;
 343                         } else {
 344                                 /* mic checked ok */
 345                                 if ((!psecuritypriv->bcheck_grpkey) && (IS_MCAST(prxattrib->ra))) {
 346                                         psecuritypriv->bcheck_grpkey = true;
 347                                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("psecuritypriv->bcheck_grpkey = true"));
 348                                 }
 349                         }
 350                 } else {
 351                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recvframe_chkmic: rtw_get_stainfo==NULL!!!\n"));
 352                 }
 353
 354                 skb_trim(precvframe->pkt, precvframe->pkt->len - 8);
 355         }
 356
 357 exit:
 358
 359         return res;
 360 }
 361
 362 /* decrypt and set the ivlen, icvlen of the recv_frame */
 363 static struct recv_frame *decryptor(struct adapter *padapter,
 364                                     struct recv_frame *precv_frame)
 365 {
 366         struct rx_pkt_attrib *prxattrib = &precv_frame->attrib;
 367         struct security_priv *psecuritypriv = &padapter->securitypriv;
 368         struct recv_frame *return_packet = precv_frame;
 369         u32      res = _SUCCESS;
 370
 371         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("prxstat->decrypted=%x prxattrib->encrypt=0x%03x\n", prxattrib->bdecrypted, prxattrib->encrypt));
 372
 373         if (prxattrib->encrypt > 0) {
 374                 u8 *iv = precv_frame->pkt->data+prxattrib->hdrlen;
 375
 376                 prxattrib->key_index = (((iv[3])>>6)&0x3);
 377
 378                 if (prxattrib->key_index > WEP_KEYS) {
 379                         DBG_88E("prxattrib->key_index(%d)>WEP_KEYS\n", prxattrib->key_index);
 380
 381                         switch (prxattrib->encrypt) {
 382                         case _WEP40_:
 383                         case _WEP104_:
 384                                 prxattrib->key_index = psecuritypriv->dot11PrivacyKeyIndex;
 385                                 break;
 386                         case _TKIP_:
 387                         case _AES_:
 388                         default:
 389                                 prxattrib->key_index = psecuritypriv->dot118021XGrpKeyid;
 390                                 break;
 391                         }
 392                 }
 393         }
 394
 395         if ((prxattrib->encrypt > 0) && (prxattrib->bdecrypted == 0)) {
 396                 psecuritypriv->hw_decrypted = false;
 397
 398                 switch (prxattrib->encrypt) {
 399                 case _WEP40_:
 400                 case _WEP104_:
 401                         rtw_wep_decrypt(padapter, (u8 *)precv_frame);
 402                         break;
 403                 case _TKIP_:
 404                         res = rtw_tkip_decrypt(padapter, (u8 *)precv_frame);
 405                         break;
 406                 case _AES_:
 407                         res = rtw_aes_decrypt(padapter, (u8 *)precv_frame);
 408                         break;
 409                 default:
 410                         break;
 411                 }
 412         } else if (prxattrib->bdecrypted == 1 && prxattrib->encrypt > 0 &&
 413                    (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_))
 414                         psecuritypriv->hw_decrypted = true;
 415
 416         if (res == _FAIL) {
 417                 rtw_free_recvframe(return_packet, &padapter->recvpriv.free_recv_queue);
 418                 return_packet = NULL;
 419         }
 420
 421         return return_packet;
 422 }
 423
 424 /* set the security information in the recv_frame */
 425 static struct recv_frame *portctrl(struct adapter *adapter,
 426                                    struct recv_frame *precv_frame)
 427 {
 428         u8   *psta_addr, *ptr;
 429         uint  auth_alg;
 430         struct recv_frame *pfhdr;
 431         struct sta_info *psta;
 432         struct sta_priv *pstapriv;
 433         struct recv_frame *prtnframe;
 434         u16     ether_type;
 435         u16  eapol_type = 0x888e;/* for Funia BD's WPA issue */
 436         struct rx_pkt_attrib *pattrib;
 437         __be16 be_tmp;
 438
 439         pstapriv = &adapter->stapriv;
 440
 441         auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
 442
 443         ptr = precv_frame->pkt->data;
 444         pfhdr = precv_frame;
 445         pattrib = &pfhdr->attrib;
 446         psta_addr = pattrib->ta;
 447         psta = rtw_get_stainfo(pstapriv, psta_addr);
 448
 449         prtnframe = NULL;
 450
 451         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########portctrl:adapter->securitypriv.dot11AuthAlgrthm=%d\n", adapter->securitypriv.dot11AuthAlgrthm));
 452
 453         if (auth_alg == 2) {
 454                 /* get ether_type */
 455                 ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE + pfhdr->attrib.iv_len;
 456                 memcpy(&be_tmp, ptr, 2);
 457                 ether_type = ntohs(be_tmp);
 458
 459                 if ((psta != NULL) && (psta->ieee8021x_blocked)) {
 460                         /* blocked */
 461                         /* only accept EAPOL frame */
 462                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########portctrl:psta->ieee8021x_blocked==1\n"));
 463
 464                         if (ether_type == eapol_type) {
 465                                 prtnframe = precv_frame;
 466                         } else {
 467                                 /* free this frame */
 468                                 rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue);
 469                                 prtnframe = NULL;
 470                         }
 471                 } else {
 472                         /* allowed */
 473                         /* check decryption status, and decrypt the frame if needed */
 474                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########portctrl:psta->ieee8021x_blocked==0\n"));
 475                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
 476                                  ("portctrl:precv_frame->hdr.attrib.privacy=%x\n",
 477                                  precv_frame->attrib.privacy));
 478
 479                         if (pattrib->bdecrypted == 0)
 480                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("portctrl:prxstat->decrypted=%x\n", pattrib->bdecrypted));
 481
 482                         prtnframe = precv_frame;
 483                         /* check is the EAPOL frame or not (Rekey) */
 484                         if (ether_type == eapol_type) {
 485                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("########portctrl:ether_type==0x888e\n"));
 486                                 /* check Rekey */
 487
 488                                 prtnframe = precv_frame;
 489                         } else {
 490                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########portctrl:ether_type=0x%04x\n", ether_type));
 491                         }
 492                 }
 493         } else {
 494                 prtnframe = precv_frame;
 495         }
 496
 497                 return prtnframe;
 498 }
 499
 500 static int recv_decache(struct recv_frame *precv_frame, u8 bretry,
 501                         struct stainfo_rxcache *prxcache)
 502 {
 503         int tid = precv_frame->attrib.priority;
 504
 505         u16 seq_ctrl = ((precv_frame->attrib.seq_num&0xffff) << 4) |
 506                 (precv_frame->attrib.frag_num & 0xf);
 507
 508         if (tid > 15) {
 509                 RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_decache, (tid>15)! seq_ctrl=0x%x, tid=0x%x\n", seq_ctrl, tid));
 510
 511                 return _FAIL;
 512         }
 513
 514         if (1) {/* if (bretry) */
 515                 if (seq_ctrl == prxcache->tid_rxseq[tid]) {
 516                         RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_decache, seq_ctrl=0x%x, tid=0x%x, tid_rxseq=0x%x\n", seq_ctrl, tid, prxcache->tid_rxseq[tid]));
 517
 518                         return _FAIL;
 519                 }
 520         }
 521
 522         prxcache->tid_rxseq[tid] = seq_ctrl;
 523
 524         return _SUCCESS;
 525 }
 526
 527 static void process_pwrbit_data(struct adapter *padapter,
 528                                 struct recv_frame *precv_frame)
 529 {
 530 #ifdef CONFIG_88EU_AP_MODE
 531         unsigned char pwrbit;
 532         u8 *ptr = precv_frame->pkt->data;
 533         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 534         struct sta_priv *pstapriv = &padapter->stapriv;
 535         struct sta_info *psta = NULL;
 536
 537         psta = rtw_get_stainfo(pstapriv, pattrib->src);
 538
 539         pwrbit = GetPwrMgt(ptr);
 540
 541         if (psta) {
 542                 if (pwrbit) {
 543                         if (!(psta->state & WIFI_SLEEP_STATE))
 544                                 stop_sta_xmit(padapter, psta);
 545                 } else {
 546                         if (psta->state & WIFI_SLEEP_STATE)
 547                                 wakeup_sta_to_xmit(padapter, psta);
 548                 }
 549         }
 550
 551 #endif
 552 }
 553
 554 static void process_wmmps_data(struct adapter *padapter,
 555                                struct recv_frame *precv_frame)
 556 {
 557 #ifdef CONFIG_88EU_AP_MODE
 558         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 559         struct sta_priv *pstapriv = &padapter->stapriv;
 560         struct sta_info *psta = NULL;
 561
 562         psta = rtw_get_stainfo(pstapriv, pattrib->src);
 563
 564         if (!psta)
 565                 return;
 566
 567         if (!psta->qos_option)
 568                 return;
 569
 570         if (!(psta->qos_info&0xf))
 571                 return;
 572
 573         if (psta->state&WIFI_SLEEP_STATE) {
 574                 u8 wmmps_ac = 0;
 575
 576                 switch (pattrib->priority) {
 577                 case 1:
 578                 case 2:
 579                         wmmps_ac = psta->uapsd_bk&BIT(1);
 580                         break;
 581                 case 4:
 582                 case 5:
 583                         wmmps_ac = psta->uapsd_vi&BIT(1);
 584                         break;
 585                 case 6:
 586                 case 7:
 587                         wmmps_ac = psta->uapsd_vo&BIT(1);
 588                         break;
 589                 case 0:
 590                 case 3:
 591                 default:
 592                         wmmps_ac = psta->uapsd_be&BIT(1);
 593                         break;
 594                 }
 595
 596                 if (wmmps_ac) {
 597                         if (psta->sleepq_ac_len > 0) {
 598                                 /* process received triggered frame */
 599                                 xmit_delivery_enabled_frames(padapter, psta);
 600                         } else {
 601                                 /* issue one qos null frame with More data bit = 0 and the EOSP bit set (= 1) */
 602                                 issue_qos_nulldata(padapter, psta->hwaddr, (u16)pattrib->priority, 0, 0);
 603                         }
 604                 }
 605         }
 606
 607 #endif
 608 }
 609
 610 static void count_rx_stats(struct adapter *padapter,
 611                            struct recv_frame *prframe,
 612                            struct sta_info *sta)
 613 {
 614         int     sz;
 615         struct sta_info         *psta = NULL;
 616         struct stainfo_stats    *pstats = NULL;
 617         struct rx_pkt_attrib    *pattrib = &prframe->attrib;
 618         struct recv_priv        *precvpriv = &padapter->recvpriv;
 619
 620         sz = prframe->pkt->len;
 621         precvpriv->rx_bytes += sz;
 622
 623         padapter->mlmepriv.LinkDetectInfo.NumRxOkInPeriod++;
 624
 625         if ((!MacAddr_isBcst(pattrib->dst)) && (!IS_MCAST(pattrib->dst)))
 626                 padapter->mlmepriv.LinkDetectInfo.NumRxUnicastOkInPeriod++;
 627
 628         if (sta)
 629                 psta = sta;
 630         else
 631                 psta = prframe->psta;
 632
 633         if (psta) {
 634                 pstats = &psta->sta_stats;
 635
 636                 pstats->rx_data_pkts++;
 637                 pstats->rx_bytes += sz;
 638         }
 639 }
 640
 641 int sta2sta_data_frame(
 642         struct adapter *adapter,
 643         struct recv_frame *precv_frame,
 644         struct sta_info **psta
 645 );
 646
 647 int sta2sta_data_frame(struct adapter *adapter, struct recv_frame *precv_frame,
 648                        struct sta_info **psta)
 649 {
 650         int ret = _SUCCESS;
 651         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 652         struct  sta_priv *pstapriv = &adapter->stapriv;
 653         struct  mlme_priv *pmlmepriv = &adapter->mlmepriv;
 654         u8 *mybssid  = get_bssid(pmlmepriv);
 655         u8 *myhwaddr = myid(&adapter->eeprompriv);
 656         u8 *sta_addr = NULL;
 657         int bmcast = IS_MCAST(pattrib->dst);
 658
 659         if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) ||
 660             (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true)) {
 661                 /*  filter packets that SA is myself or multicast or broadcast */
 662                 if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN)) {
 663                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" SA==myself\n"));
 664                         ret = _FAIL;
 665                         goto exit;
 666                 }
 667
 668                 if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast)) {
 669                         ret = _FAIL;
 670                         goto exit;
 671                 }
 672
 673                 if (!memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 674                     !memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 675                     memcmp(pattrib->bssid, mybssid, ETH_ALEN)) {
 676                         ret = _FAIL;
 677                         goto exit;
 678                 }
 679
 680                 sta_addr = pattrib->src;
 681         } else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
 682                 /*  For Station mode, sa and bssid should always be BSSID, and DA is my mac-address */
 683                 if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN)) {
 684                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("bssid!=TA under STATION_MODE; drop pkt\n"));
 685                         ret = _FAIL;
 686                         goto exit;
 687                 }
 688                 sta_addr = pattrib->bssid;
 689         } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
 690                 if (bmcast) {
 691                         /*  For AP mode, if DA == MCAST, then BSSID should be also MCAST */
 692                         if (!IS_MCAST(pattrib->bssid)) {
 693                                         ret = _FAIL;
 694                                         goto exit;
 695                         }
 696                 } else { /*  not mc-frame */
 697                         /*  For AP mode, if DA is non-MCAST, then it must be BSSID, and bssid == BSSID */
 698                         if (memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN)) {
 699                                 ret = _FAIL;
 700                                 goto exit;
 701                         }
 702
 703                         sta_addr = pattrib->src;
 704                 }
 705         } else {
 706                 ret  = _FAIL;
 707         }
 708
 709         if (bmcast)
 710                 *psta = rtw_get_bcmc_stainfo(adapter);
 711         else
 712                 *psta = rtw_get_stainfo(pstapriv, sta_addr); /*  get ap_info */
 713
 714         if (*psta == NULL) {
 715                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("can't get psta under sta2sta_data_frame ; drop pkt\n"));
 716                 ret = _FAIL;
 717                 goto exit;
 718         }
 719
 720 exit:
 721         return ret;
 722 }
 723
 724 static int ap2sta_data_frame(
 725         struct adapter *adapter,
 726         struct recv_frame *precv_frame,
 727         struct sta_info **psta)
 728 {
 729         u8 *ptr = precv_frame->pkt->data;
 730         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 731         int ret = _SUCCESS;
 732         struct  sta_priv *pstapriv = &adapter->stapriv;
 733         struct  mlme_priv *pmlmepriv = &adapter->mlmepriv;
 734         u8 *mybssid  = get_bssid(pmlmepriv);
 735         u8 *myhwaddr = myid(&adapter->eeprompriv);
 736         int bmcast = IS_MCAST(pattrib->dst);
 737
 738         if ((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) &&
 739             (check_fwstate(pmlmepriv, _FW_LINKED) == true ||
 740             check_fwstate(pmlmepriv, _FW_UNDER_LINKING))) {
 741                 /*  filter packets that SA is myself or multicast or broadcast */
 742                 if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN)) {
 743                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" SA==myself\n"));
 744                         ret = _FAIL;
 745                         goto exit;
 746                 }
 747
 748                 /*  da should be for me */
 749                 if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast)) {
 750                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
 751                                  (" ap2sta_data_frame:  compare DA fail; DA=%pM\n", (pattrib->dst)));
 752                         ret = _FAIL;
 753                         goto exit;
 754                 }
 755
 756                 /*  check BSSID */
 757                 if (!memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 758                     !memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 759                      (memcmp(pattrib->bssid, mybssid, ETH_ALEN))) {
 760                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
 761                                  (" ap2sta_data_frame:  compare BSSID fail ; BSSID=%pM\n", (pattrib->bssid)));
 762                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("mybssid=%pM\n", (mybssid)));
 763
 764                         if (!bmcast) {
 765                                 DBG_88E("issue_deauth to the nonassociated ap=%pM for the reason(7)\n", (pattrib->bssid));
 766                                 issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 767                         }
 768
 769                         ret = _FAIL;
 770                         goto exit;
 771                 }
 772
 773                 if (bmcast)
 774                         *psta = rtw_get_bcmc_stainfo(adapter);
 775                 else
 776                         *psta = rtw_get_stainfo(pstapriv, pattrib->bssid); /*  get ap_info */
 777
 778                 if (*psta == NULL) {
 779                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("ap2sta: can't get psta under STATION_MODE ; drop pkt\n"));
 780                         ret = _FAIL;
 781                         goto exit;
 782                 }
 783
 784                 /* if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE) { */
 785                 /*  */
 786
 787                 if (GetFrameSubType(ptr) & BIT(6)) {
 788                         /* No data, will not indicate to upper layer, temporily count it here */
 789                         count_rx_stats(adapter, precv_frame, *psta);
 790                         ret = RTW_RX_HANDLED;
 791                         goto exit;
 792                 }
 793         } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
 794                 /* Special case */
 795                 ret = RTW_RX_HANDLED;
 796                 goto exit;
 797         } else {
 798                 if (!memcmp(myhwaddr, pattrib->dst, ETH_ALEN) && (!bmcast)) {
 799                         *psta = rtw_get_stainfo(pstapriv, pattrib->bssid); /*  get sta_info */
 800                         if (*psta == NULL) {
 801                                 DBG_88E("issue_deauth to the ap =%pM for the reason(7)\n", (pattrib->bssid));
 802
 803                                 issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 804                         }
 805                 }
 806
 807                 ret = _FAIL;
 808         }
 809
 810 exit:
 811
 812         return ret;
 813 }
 814
 815 static int sta2ap_data_frame(struct adapter *adapter,
 816                              struct recv_frame *precv_frame,
 817                              struct sta_info **psta)
 818 {
 819         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 820         struct  sta_priv *pstapriv = &adapter->stapriv;
 821         struct  mlme_priv *pmlmepriv = &adapter->mlmepriv;
 822         u8 *ptr = precv_frame->pkt->data;
 823         unsigned char *mybssid  = get_bssid(pmlmepriv);
 824         int ret = _SUCCESS;
 825
 826         if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) {
 827                 /* For AP mode, RA = BSSID, TX = STA(SRC_ADDR), A3 = DST_ADDR */
 828                 if (memcmp(pattrib->bssid, mybssid, ETH_ALEN)) {
 829                         ret = _FAIL;
 830                         goto exit;
 831                 }
 832
 833                 *psta = rtw_get_stainfo(pstapriv, pattrib->src);
 834                 if (*psta == NULL) {
 835                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("can't get psta under AP_MODE; drop pkt\n"));
 836                         DBG_88E("issue_deauth to sta=%pM for the reason(7)\n", (pattrib->src));
 837
 838                         issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 839
 840                         ret = RTW_RX_HANDLED;
 841                         goto exit;
 842                 }
 843
 844                 process_pwrbit_data(adapter, precv_frame);
 845
 846                 if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE)
 847                         process_wmmps_data(adapter, precv_frame);
 848
 849                 if (GetFrameSubType(ptr) & BIT(6)) {
 850                         /* No data, will not indicate to upper layer, temporily count it here */
 851                         count_rx_stats(adapter, precv_frame, *psta);
 852                         ret = RTW_RX_HANDLED;
 853                         goto exit;
 854                 }
 855         } else {
 856                 u8 *myhwaddr = myid(&adapter->eeprompriv);
 857
 858                 if (memcmp(pattrib->ra, myhwaddr, ETH_ALEN)) {
 859                         ret = RTW_RX_HANDLED;
 860                         goto exit;
 861                 }
 862                 DBG_88E("issue_deauth to sta=%pM for the reason(7)\n", (pattrib->src));
 863                 issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 864                 ret = RTW_RX_HANDLED;
 865                 goto exit;
 866         }
 867
 868 exit:
 869
 870         return ret;
 871 }
 872
 873 static int validate_recv_ctrl_frame(struct adapter *padapter,
 874                                     struct recv_frame *precv_frame)
 875 {
 876 #ifdef CONFIG_88EU_AP_MODE
 877         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 878         struct sta_priv *pstapriv = &padapter->stapriv;
 879         u8 *pframe = precv_frame->pkt->data;
 880
 881         if (GetFrameType(pframe) != WIFI_CTRL_TYPE)
 882                 return _FAIL;
 883
 884         /* receive the frames that ra(a1) is my address */
 885         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN))
 886                 return _FAIL;
 887
 888         /* only handle ps-poll */
 889         if (GetFrameSubType(pframe) == WIFI_PSPOLL) {
 890                 u16 aid;
 891                 u8 wmmps_ac = 0;
 892                 struct sta_info *psta = NULL;
 893
 894                 aid = GetAid(pframe);
 895                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 896
 897                 if ((psta == NULL) || (psta->aid != aid))
 898                         return _FAIL;
 899
 900                 /* for rx pkt statistics */
 901                 psta->sta_stats.rx_ctrl_pkts++;
 902
 903                 switch (pattrib->priority) {
 904                 case 1:
 905                 case 2:
 906                         wmmps_ac = psta->uapsd_bk&BIT(0);
 907                         break;
 908                 case 4:
 909                 case 5:
 910                         wmmps_ac = psta->uapsd_vi&BIT(0);
 911                         break;
 912                 case 6:
 913                 case 7:
 914                         wmmps_ac = psta->uapsd_vo&BIT(0);
 915                         break;
 916                 case 0:
 917                 case 3:
 918                 default:
 919                         wmmps_ac = psta->uapsd_be&BIT(0);
 920                         break;
 921                 }
 922
 923                 if (wmmps_ac)
 924                         return _FAIL;
 925
 926                 if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
 927                         DBG_88E("%s alive check-rx ps-poll\n", __func__);
 928                         psta->expire_to = pstapriv->expire_to;
 929                         psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
 930                 }
 931
 932                 if ((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid))) {
 933                         struct list_head *xmitframe_plist, *xmitframe_phead;
 934                         struct xmit_frame *pxmitframe = NULL;
 935
 936                         spin_lock_bh(&psta->sleep_q.lock);
 937
 938                         xmitframe_phead = get_list_head(&psta->sleep_q);
 939                         xmitframe_plist = xmitframe_phead->next;
 940
 941                         if (xmitframe_phead != xmitframe_plist) {
 942                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
 943
 944                                 xmitframe_plist = xmitframe_plist->next;
 945
 946                                 list_del_init(&pxmitframe->list);
 947
 948                                 psta->sleepq_len--;
 949
 950                                 if (psta->sleepq_len > 0)
 951                                         pxmitframe->attrib.mdata = 1;
 952                                 else
 953                                         pxmitframe->attrib.mdata = 0;
 954
 955                                 pxmitframe->attrib.triggered = 1;
 956
 957                                 spin_unlock_bh(&psta->sleep_q.lock);
 958                                 if (rtw_hal_xmit(padapter, pxmitframe) == true)
 959                                         rtw_os_xmit_complete(padapter, pxmitframe);
 960                                 spin_lock_bh(&psta->sleep_q.lock);
 961
 962                                 if (psta->sleepq_len == 0) {
 963                                         pstapriv->tim_bitmap &= ~BIT(psta->aid);
 964
 965                                         /* update BCN for TIM IE */
 966                                         /* update_BCNTIM(padapter); */
 967                                         update_beacon(padapter, _TIM_IE_, NULL, false);
 968                                 }
 969                         } else {
 970                                 if (pstapriv->tim_bitmap&BIT(psta->aid)) {
 971                                         if (psta->sleepq_len == 0) {
 972                                                 DBG_88E("no buffered packets to xmit\n");
 973
 974                                                 /* issue nulldata with More data bit = 0 to indicate we have no buffered packets */
 975                                                 issue_nulldata(padapter, psta->hwaddr, 0, 0, 0);
 976                                         } else {
 977                                                 DBG_88E("error!psta->sleepq_len=%d\n", psta->sleepq_len);
 978                                                 psta->sleepq_len = 0;
 979                                         }
 980
 981                                         pstapriv->tim_bitmap &= ~BIT(psta->aid);
 982
 983                                         /* update BCN for TIM IE */
 984                                         /* update_BCNTIM(padapter); */
 985                                         update_beacon(padapter, _TIM_IE_, NULL, false);
 986                                 }
 987                         }
 988
 989                         spin_unlock_bh(&psta->sleep_q.lock);
 990                 }
 991         }
 992
 993 #endif
 994
 995         return _FAIL;
 996 }
 997
 998 struct recv_frame *recvframe_chk_defrag(struct adapter *padapter,
 999                                         struct recv_frame *precv_frame);
1000
1001 static int validate_recv_mgnt_frame(struct adapter *padapter,
1002                                     struct recv_frame *precv_frame)
1003 {
1004         struct sta_info *psta;
1005
1006         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("+validate_recv_mgnt_frame\n"));
1007
1008         precv_frame = recvframe_chk_defrag(padapter, precv_frame);
1009         if (precv_frame == NULL) {
1010                 RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("%s: fragment packet\n", __func__));
1011                 return _SUCCESS;
1012         }
1013
1014         /* for rx pkt statistics */
1015         psta = rtw_get_stainfo(&padapter->stapriv,
1016                                GetAddr2Ptr(precv_frame->pkt->data));
1017         if (psta) {
1018                 psta->sta_stats.rx_mgnt_pkts++;
1019                 if (GetFrameSubType(precv_frame->pkt->data) == WIFI_BEACON) {
1020                         psta->sta_stats.rx_beacon_pkts++;
1021                 } else if (GetFrameSubType(precv_frame->pkt->data) == WIFI_PROBEREQ) {
1022                         psta->sta_stats.rx_probereq_pkts++;
1023                 } else if (GetFrameSubType(precv_frame->pkt->data) == WIFI_PROBERSP) {
1024                         if (!memcmp(padapter->eeprompriv.mac_addr,
1025                                     GetAddr1Ptr(precv_frame->pkt->data), ETH_ALEN))
1026                                 psta->sta_stats.rx_probersp_pkts++;
1027                         else if (is_broadcast_mac_addr(GetAddr1Ptr(precv_frame->pkt->data)) ||
1028                                  is_multicast_mac_addr(GetAddr1Ptr(precv_frame->pkt->data)))
1029                                 psta->sta_stats.rx_probersp_bm_pkts++;
1030                         else
1031                                 psta->sta_stats.rx_probersp_uo_pkts++;
1032                 }
1033         }
1034
1035         mgt_dispatcher(padapter, precv_frame);
1036
1037         return _SUCCESS;
1038 }
1039
1040 static int validate_recv_data_frame(struct adapter *adapter,
1041                                     struct recv_frame *precv_frame)
1042 {
1043         u8 bretry;
1044         u8 *psa, *pda, *pbssid;
1045         struct sta_info *psta = NULL;
1046         u8 *ptr = precv_frame->pkt->data;
1047         struct rx_pkt_attrib    *pattrib = &precv_frame->attrib;
1048         struct security_priv    *psecuritypriv = &adapter->securitypriv;
1049         int ret = _SUCCESS;
1050
1051         bretry = GetRetry(ptr);
1052         pda = get_da(ptr);
1053         psa = get_sa(ptr);
1054         pbssid = get_hdr_bssid(ptr);
1055
1056         if (pbssid == NULL) {
1057                 ret = _FAIL;
1058                 goto exit;
1059         }
1060
1061         memcpy(pattrib->dst, pda, ETH_ALEN);
1062         memcpy(pattrib->src, psa, ETH_ALEN);
1063
1064         memcpy(pattrib->bssid, pbssid, ETH_ALEN);
1065
1066         switch (pattrib->to_fr_ds) {
1067         case 0:
1068                 memcpy(pattrib->ra, pda, ETH_ALEN);
1069                 memcpy(pattrib->ta, psa, ETH_ALEN);
1070                 ret = sta2sta_data_frame(adapter, precv_frame, &psta);
1071                 break;
1072         case 1:
1073                 memcpy(pattrib->ra, pda, ETH_ALEN);
1074                 memcpy(pattrib->ta, pbssid, ETH_ALEN);
1075                 ret = ap2sta_data_frame(adapter, precv_frame, &psta);
1076                 break;
1077         case 2:
1078                 memcpy(pattrib->ra, pbssid, ETH_ALEN);
1079                 memcpy(pattrib->ta, psa, ETH_ALEN);
1080                 ret = sta2ap_data_frame(adapter, precv_frame, &psta);
1081                 break;
1082         case 3:
1083                 memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
1084                 memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
1085                 ret = _FAIL;
1086                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" case 3\n"));
1087                 break;
1088         default:
1089                 ret = _FAIL;
1090                 break;
1091         }
1092
1093         if (ret == _FAIL)
1094                 goto exit;
1095         else if (ret == RTW_RX_HANDLED)
1096                 goto exit;
1097
1098         if (psta == NULL) {
1099                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" after to_fr_ds_chk; psta==NULL\n"));
1100                 ret = _FAIL;
1101                 goto exit;
1102         }
1103
1104         /* psta->rssi = prxcmd->rssi; */
1105         /* psta->signal_quality = prxcmd->sq; */
1106         precv_frame->psta = psta;
1107
1108         pattrib->amsdu = 0;
1109         pattrib->ack_policy = 0;
1110         /* parsing QC field */
1111         if (pattrib->qos == 1) {
1112                 pattrib->priority = GetPriority((ptr + 24));
1113                 pattrib->ack_policy = GetAckpolicy((ptr + 24));
1114                 pattrib->amsdu = GetAMsdu((ptr + 24));
1115                 pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 32 : 26;
1116
1117                 if (pattrib->priority != 0 && pattrib->priority != 3)
1118                         adapter->recvpriv.bIsAnyNonBEPkts = true;
1119         } else {
1120                 pattrib->priority = 0;
1121                 pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 30 : 24;
1122         }
1123
1124         if (pattrib->order)/* HT-CTRL 11n */
1125                 pattrib->hdrlen += 4;
1126
1127         precv_frame->preorder_ctrl = &psta->recvreorder_ctrl[pattrib->priority];
1128
1129         /*  decache, drop duplicate recv packets */
1130         if (recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) == _FAIL) {
1131                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("decache : drop pkt\n"));
1132                 ret = _FAIL;
1133                 goto exit;
1134         }
1135
1136         if (pattrib->privacy) {
1137                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("validate_recv_data_frame:pattrib->privacy=%x\n", pattrib->privacy));
1138                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0], IS_MCAST(pattrib->ra)));
1139
1140                 GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, IS_MCAST(pattrib->ra));
1141
1142                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n pattrib->encrypt=%d\n", pattrib->encrypt));
1143
1144                 SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
1145         } else {
1146                 pattrib->encrypt = 0;
1147                 pattrib->iv_len = 0;
1148                 pattrib->icv_len = 0;
1149         }
1150
1151 exit:
1152
1153         return ret;
1154 }
1155
1156 static int validate_recv_frame(struct adapter *adapter,
1157                                struct recv_frame *precv_frame)
1158 {
1159         /* shall check frame subtype, to / from ds, da, bssid */
1160
1161         /* then call check if rx seq/frag. duplicated. */
1162
1163         u8 type;
1164         u8 subtype;
1165         int retval = _SUCCESS;
1166         u8 bDumpRxPkt;
1167         struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
1168         u8 *ptr = precv_frame->pkt->data;
1169         u8  ver = (unsigned char)(*ptr)&0x3;
1170         struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
1171
1172         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
1173                 int ch_set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, rtw_get_oper_ch(adapter));
1174
1175                 if (ch_set_idx >= 0)
1176                         pmlmeext->channel_set[ch_set_idx].rx_count++;
1177         }
1178
1179         /* add version chk */
1180         if (ver != 0) {
1181                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_data_frame fail! (ver!=0)\n"));
1182                 retval = _FAIL;
1183                 goto exit;
1184         }
1185
1186         type =  GetFrameType(ptr);
1187         subtype = GetFrameSubType(ptr); /* bit(7)~bit(2) */
1188
1189         pattrib->to_fr_ds = get_tofr_ds(ptr);
1190
1191         pattrib->frag_num = GetFragNum(ptr);
1192         pattrib->seq_num = GetSequence(ptr);
1193
1194         pattrib->pw_save = GetPwrMgt(ptr);
1195         pattrib->mfrag = GetMFrag(ptr);
1196         pattrib->mdata = GetMData(ptr);
1197         pattrib->privacy = GetPrivacy(ptr);
1198         pattrib->order = GetOrder(ptr);
1199
1200         /* Dump rx packets */
1201         rtw_hal_get_def_var(adapter, HAL_DEF_DBG_DUMP_RXPKT, &(bDumpRxPkt));
1202         if (bDumpRxPkt == 1) {/* dump all rx packets */
1203                 if (_drv_err_ <= GlobalDebugLevel) {
1204                         pr_info(DRIVER_PREFIX "#############################\n");
1205                         print_hex_dump(KERN_INFO, DRIVER_PREFIX, DUMP_PREFIX_NONE,
1206                                         16, 1, ptr, 64, false);
1207                         pr_info(DRIVER_PREFIX "#############################\n");
1208                 }
1209         } else if (bDumpRxPkt == 2) {
1210                 if ((_drv_err_ <= GlobalDebugLevel) && (type == WIFI_MGT_TYPE)) {
1211                         pr_info(DRIVER_PREFIX "#############################\n");
1212                         print_hex_dump(KERN_INFO, DRIVER_PREFIX, DUMP_PREFIX_NONE,
1213                                         16, 1, ptr, 64, false);
1214                         pr_info(DRIVER_PREFIX "#############################\n");
1215                 }
1216         } else if (bDumpRxPkt == 3) {
1217                 if ((_drv_err_ <= GlobalDebugLevel) && (type == WIFI_DATA_TYPE)) {
1218                         pr_info(DRIVER_PREFIX "#############################\n");
1219                         print_hex_dump(KERN_INFO, DRIVER_PREFIX, DUMP_PREFIX_NONE,
1220                                         16, 1, ptr, 64, false);
1221                         pr_info(DRIVER_PREFIX "#############################\n");
1222                 }
1223         }
1224         switch (type) {
1225         case WIFI_MGT_TYPE: /* mgnt */
1226                 retval = validate_recv_mgnt_frame(adapter, precv_frame);
1227                 if (retval == _FAIL)
1228                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_mgnt_frame fail\n"));
1229                 retval = _FAIL; /*  only data frame return _SUCCESS */
1230                 break;
1231         case WIFI_CTRL_TYPE: /* ctrl */
1232                 retval = validate_recv_ctrl_frame(adapter, precv_frame);
1233                 if (retval == _FAIL)
1234                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_ctrl_frame fail\n"));
1235                 retval = _FAIL; /*  only data frame return _SUCCESS */
1236                 break;
1237         case WIFI_DATA_TYPE: /* data */
1238                 LedControl8188eu(adapter, LED_CTL_RX);
1239                 pattrib->qos = (subtype & BIT(7)) ? 1 : 0;
1240                 retval = validate_recv_data_frame(adapter, precv_frame);
1241                 if (retval == _FAIL) {
1242                         struct recv_priv *precvpriv = &adapter->recvpriv;
1243
1244                         precvpriv->rx_drop++;
1245                 }
1246                 break;
1247         default:
1248                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_data_frame fail! type= 0x%x\n", type));
1249                 retval = _FAIL;
1250                 break;
1251         }
1252
1253         /*
1254          * This is the last moment before management and control frames get
1255          * discarded. So we need to forward them to the monitor now or never.
1256          *
1257          * At the same time data frames can still be encrypted if software
1258          * decryption is in use. However, decryption can occur not until later
1259          * (see recv_func()).
1260          *
1261          * Hence forward the frame to the monitor anyway to preserve the order
1262          * in which frames were received.
1263          */
1264         rtl88eu_mon_recv_hook(adapter->pmondev, precv_frame);
1265
1266 exit:
1267
1268         return retval;
1269 }
1270
1271 /* remove the wlanhdr and add the eth_hdr */
1272
1273 static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
1274 {
1275         int     rmv_len;
1276         u16     eth_type, len;
1277         __be16 be_tmp;
1278         u8      bsnaphdr;
1279         u8      *psnap_type;
1280         struct ieee80211_snap_hdr       *psnap;
1281
1282         u8 *ptr = precvframe->pkt->data;
1283         struct rx_pkt_attrib *pattrib = &precvframe->attrib;
1284
1285         if (pattrib->encrypt)
1286                 skb_trim(precvframe->pkt, precvframe->pkt->len - pattrib->icv_len);
1287
1288         psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen + pattrib->iv_len);
1289         psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
1290         /* convert hdr + possible LLC headers into Ethernet header */
1291         if ((!memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
1292              (!memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == false) &&
1293              (!memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_AARP, 2) == false)) ||
1294              !memcmp(psnap, rtw_bridge_tunnel_header, SNAP_SIZE)) {
1295                 /* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
1296                 bsnaphdr = true;
1297         } else {
1298                 /* Leave Ethernet header part of hdr and full payload */
1299                 bsnaphdr = false;
1300         }
1301
1302         rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
1303         len = precvframe->pkt->len - rmv_len;
1304
1305         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
1306                  ("\n===pattrib->hdrlen: %x,  pattrib->iv_len:%x===\n\n", pattrib->hdrlen,  pattrib->iv_len));
1307
1308         memcpy(&be_tmp, ptr+rmv_len, 2);
1309         eth_type = ntohs(be_tmp); /* pattrib->ether_type */
1310         pattrib->eth_type = eth_type;
1311
1312         ptr = skb_pull(precvframe->pkt, rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0));
1313         if (!ptr)
1314                 return _FAIL;
1315
1316         memcpy(ptr, pattrib->dst, ETH_ALEN);
1317         memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
1318
1319         if (!bsnaphdr) {
1320                 be_tmp = htons(len);
1321                 memcpy(ptr+12, &be_tmp, 2);
1322         }
1323
1324         return _SUCCESS;
1325 }
1326
1327 /* perform defrag */
1328 static struct recv_frame *recvframe_defrag(struct adapter *adapter,
1329                                            struct __queue *defrag_q)
1330 {
1331         struct list_head *plist, *phead;
1332         u8 wlanhdr_offset;
1333         u8      curfragnum;
1334         struct recv_frame *pfhdr, *pnfhdr;
1335         struct recv_frame *prframe, *pnextrframe;
1336         struct __queue *pfree_recv_queue;
1337
1338         curfragnum = 0;
1339         pfree_recv_queue = &adapter->recvpriv.free_recv_queue;
1340
1341         phead = get_list_head(defrag_q);
1342         plist = phead->next;
1343         pfhdr = container_of(plist, struct recv_frame, list);
1344         prframe = pfhdr;
1345         list_del_init(&(prframe->list));
1346
1347         if (curfragnum != pfhdr->attrib.frag_num) {
1348                 /* the first fragment number must be 0 */
1349                 /* free the whole queue */
1350                 rtw_free_recvframe(prframe, pfree_recv_queue);
1351                 rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
1352
1353                 return NULL;
1354         }
1355
1356         curfragnum++;
1357
1358         plist = get_list_head(defrag_q);
1359
1360         plist = plist->next;
1361
1362         while (phead != plist) {
1363                 pnfhdr = container_of(plist, struct recv_frame, list);
1364                 pnextrframe = pnfhdr;
1365
1366                 /* check the fragment sequence  (2nd ~n fragment frame) */
1367
1368                 if (curfragnum != pnfhdr->attrib.frag_num) {
1369                         /* the fragment number must be increasing  (after decache) */
1370                         /* release the defrag_q & prframe */
1371                         rtw_free_recvframe(prframe, pfree_recv_queue);
1372                         rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
1373                         return NULL;
1374                 }
1375
1376                 curfragnum++;
1377
1378                 /* copy the 2nd~n fragment frame's payload to the first fragment */
1379                 /* get the 2nd~last fragment frame's payload */
1380
1381                 wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
1382
1383                 skb_pull(pnextrframe->pkt, wlanhdr_offset);
1384
1385                 /* append  to first fragment frame's tail (if privacy frame, pull the ICV) */
1386                 skb_trim(prframe->pkt, prframe->pkt->len - pfhdr->attrib.icv_len);
1387
1388                 /* memcpy */
1389                 memcpy(skb_tail_pointer(pfhdr->pkt), pnfhdr->pkt->data,
1390                        pnfhdr->pkt->len);
1391
1392                 skb_put(prframe->pkt, pnfhdr->pkt->len);
1393
1394                 pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
1395                 plist = plist->next;
1396         }
1397
1398         /* free the defrag_q queue and return the prframe */
1399         rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
1400
1401         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("Performance defrag!!!!!\n"));
1402
1403         return prframe;
1404 }
1405
1406 /* check if need to defrag, if needed queue the frame to defrag_q */
1407 struct recv_frame *recvframe_chk_defrag(struct adapter *padapter,
1408                                         struct recv_frame *precv_frame)
1409 {
1410         u8      ismfrag;
1411         u8      fragnum;
1412         u8      *psta_addr;
1413         struct recv_frame *pfhdr;
1414         struct sta_info *psta;
1415         struct sta_priv *pstapriv;
1416         struct list_head *phead;
1417         struct recv_frame *prtnframe = NULL;
1418         struct __queue *pfree_recv_queue, *pdefrag_q;
1419
1420         pstapriv = &padapter->stapriv;
1421
1422         pfhdr = precv_frame;
1423
1424         pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
1425
1426         /* need to define struct of wlan header frame ctrl */
1427         ismfrag = pfhdr->attrib.mfrag;
1428         fragnum = pfhdr->attrib.frag_num;
1429
1430         psta_addr = pfhdr->attrib.ta;
1431         psta = rtw_get_stainfo(pstapriv, psta_addr);
1432         if (psta == NULL) {
1433                 u8 type = GetFrameType(pfhdr->pkt->data);
1434
1435                 if (type != WIFI_DATA_TYPE) {
1436                         psta = rtw_get_bcmc_stainfo(padapter);
1437                         pdefrag_q = &psta->sta_recvpriv.defrag_q;
1438                 } else {
1439                         pdefrag_q = NULL;
1440                 }
1441         } else {
1442                 pdefrag_q = &psta->sta_recvpriv.defrag_q;
1443         }
1444
1445         if ((ismfrag == 0) && (fragnum == 0))
1446                 prtnframe = precv_frame;/* isn't a fragment frame */
1447
1448         if (ismfrag == 1) {
1449                 /* 0~(n-1) fragment frame */
1450                 /* enqueue to defraf_g */
1451                 if (pdefrag_q != NULL) {
1452                         if (fragnum == 0) {
1453                                 /* the first fragment */
1454                                 if (!list_empty(&pdefrag_q->queue))
1455                                         /* free current defrag_q */
1456                                         rtw_free_recvframe_queue(pdefrag_q, pfree_recv_queue);
1457                         }
1458
1459                         /* Then enqueue the 0~(n-1) fragment into the defrag_q */
1460
1461                         phead = get_list_head(pdefrag_q);
1462                         list_add_tail(&pfhdr->list, phead);
1463
1464                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("Enqueuq: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1465
1466                         prtnframe = NULL;
1467                 } else {
1468                         /* can't find this ta's defrag_queue, so free this recv_frame */
1469                         rtw_free_recvframe(precv_frame, pfree_recv_queue);
1470                         prtnframe = NULL;
1471                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("Free because pdefrag_q==NULL: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1472                 }
1473         }
1474
1475         if ((ismfrag == 0) && (fragnum != 0)) {
1476                 /* the last fragment frame */
1477                 /* enqueue the last fragment */
1478                 if (pdefrag_q != NULL) {
1479                         phead = get_list_head(pdefrag_q);
1480                         list_add_tail(&pfhdr->list, phead);
1481
1482                         /* call recvframe_defrag to defrag */
1483                         RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("defrag: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1484                         precv_frame = recvframe_defrag(padapter, pdefrag_q);
1485                         prtnframe = precv_frame;
1486                 } else {
1487                         /* can't find this ta's defrag_queue, so free this recv_frame */
1488                         rtw_free_recvframe(precv_frame, pfree_recv_queue);
1489                         prtnframe = NULL;
1490                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("Free because pdefrag_q==NULL: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1491                 }
1492         }
1493
1494         if ((prtnframe != NULL) && (prtnframe->attrib.privacy)) {
1495                 /* after defrag we must check tkip mic code */
1496                 if (recvframe_chkmic(padapter,  prtnframe) == _FAIL) {
1497                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recvframe_chkmic(padapter,  prtnframe)==_FAIL\n"));
1498                         rtw_free_recvframe(prtnframe, pfree_recv_queue);
1499                         prtnframe = NULL;
1500                 }
1501         }
1502
1503         return prtnframe;
1504 }
1505
1506 static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
1507 {
1508         int     a_len, padding_len;
1509         u16     eth_type, nSubframe_Length;
1510         u8      nr_subframes, i;
1511         unsigned char *pdata;
1512         struct rx_pkt_attrib *pattrib;
1513         struct sk_buff *sub_skb, *subframes[MAX_SUBFRAME_COUNT];
1514         struct recv_priv *precvpriv = &padapter->recvpriv;
1515         struct __queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
1516
1517         nr_subframes = 0;
1518         pattrib = &prframe->attrib;
1519
1520         skb_pull(prframe->pkt, prframe->attrib.hdrlen);
1521
1522         if (prframe->attrib.iv_len > 0)
1523                 skb_pull(prframe->pkt, prframe->attrib.iv_len);
1524
1525         a_len = prframe->pkt->len;
1526
1527         pdata = prframe->pkt->data;
1528
1529         while (a_len > ETH_HLEN) {
1530                 /* Offset 12 denote 2 mac address */
1531                 nSubframe_Length = get_unaligned_be16(pdata + 12);
1532
1533                 if (a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
1534                         DBG_88E("nRemain_Length is %d and nSubframe_Length is : %d\n", a_len, nSubframe_Length);
1535                         goto exit;
1536                 }
1537
1538                 /* move the data point to data content */
1539                 pdata += ETH_HLEN;
1540                 a_len -= ETH_HLEN;
1541
1542                 /* Allocate new skb for releasing to upper layer */
1543                 sub_skb = dev_alloc_skb(nSubframe_Length + 12);
1544                 if (!sub_skb) {
1545                         DBG_88E("dev_alloc_skb() Fail!!! , nr_subframes=%d\n", nr_subframes);
1546                         break;
1547                 }
1548
1549                 skb_reserve(sub_skb, 12);
1550                 skb_put_data(sub_skb, pdata, nSubframe_Length);
1551
1552                 subframes[nr_subframes++] = sub_skb;
1553
1554                 if (nr_subframes >= MAX_SUBFRAME_COUNT) {
1555                         DBG_88E("ParseSubframe(): Too many Subframes! Packets dropped!\n");
1556                         break;
1557                 }
1558
1559                 pdata += nSubframe_Length;
1560                 a_len -= nSubframe_Length;
1561                 if (a_len != 0) {
1562                         padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4-1));
1563                         if (padding_len == 4)
1564                                 padding_len = 0;
1565
1566                         if (a_len < padding_len)
1567                                 goto exit;
1568
1569                         pdata += padding_len;
1570                         a_len -= padding_len;
1571                 }
1572         }
1573
1574         for (i = 0; i < nr_subframes; i++) {
1575                 sub_skb = subframes[i];
1576                 /* convert hdr + possible LLC headers into Ethernet header */
1577                 eth_type = get_unaligned_be16(&sub_skb->data[6]);
1578                 if (sub_skb->len >= 8 &&
1579                     ((!memcmp(sub_skb->data, rtw_rfc1042_header, SNAP_SIZE) &&
1580                           eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
1581                          !memcmp(sub_skb->data, rtw_bridge_tunnel_header, SNAP_SIZE))) {
1582                         /* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
1583                         skb_pull(sub_skb, SNAP_SIZE);
1584                         memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
1585                         memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
1586                 } else {
1587                         __be16 len;
1588                         /* Leave Ethernet header part of hdr and full payload */
1589                         len = htons(sub_skb->len);
1590                         memcpy(skb_push(sub_skb, 2), &len, 2);
1591                         memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
1592                         memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
1593                 }
1594
1595                 /* Indicate the packets to upper layer */
1596                 /*  Insert NAT2.5 RX here! */
1597                 sub_skb->protocol = eth_type_trans(sub_skb, padapter->pnetdev);
1598                 sub_skb->dev = padapter->pnetdev;
1599
1600                 sub_skb->ip_summed = CHECKSUM_NONE;
1601
1602                 netif_rx(sub_skb);
1603         }
1604
1605 exit:
1606         rtw_free_recvframe(prframe, pfree_recv_queue);/* free this recv_frame */
1607
1608         return _SUCCESS;
1609 }
1610
1611 static int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, u16 seq_num)
1612 {
1613         u8      wsize = preorder_ctrl->wsize_b;
1614         u16     wend = (preorder_ctrl->indicate_seq + wsize - 1) & 0xFFF;/*  4096; */
1615
1616         /*  Rx Reorder initialize condition. */
1617         if (preorder_ctrl->indicate_seq == 0xFFFF)
1618                 preorder_ctrl->indicate_seq = seq_num;
1619
1620         /*  Drop out the packet which SeqNum is smaller than WinStart */
1621         if (SN_LESS(seq_num, preorder_ctrl->indicate_seq))
1622                 return false;
1623
1624         /*  */
1625         /*  Sliding window manipulation. Conditions includes: */
1626         /*  1. Incoming SeqNum is equal to WinStart =>Window shift 1 */
1627         /*  2. Incoming SeqNum is larger than the WinEnd => Window shift N */
1628         /*  */
1629         if (SN_EQUAL(seq_num, preorder_ctrl->indicate_seq)) {
1630                 preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
1631         } else if (SN_LESS(wend, seq_num)) {
1632                 if (seq_num >= (wsize - 1))
1633                         preorder_ctrl->indicate_seq = seq_num + 1 - wsize;
1634                 else
1635                         preorder_ctrl->indicate_seq = 0xFFF - (wsize - (seq_num + 1)) + 1;
1636         }
1637
1638         return true;
1639 }
1640
1641 static int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl,
1642                                      struct recv_frame *prframe)
1643 {
1644         struct rx_pkt_attrib *pattrib = &prframe->attrib;
1645         struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1646         struct list_head *phead, *plist;
1647         struct recv_frame *hdr;
1648         struct rx_pkt_attrib *pnextattrib;
1649
1650         phead = get_list_head(ppending_recvframe_queue);
1651         plist = phead->next;
1652
1653         while (phead != plist) {
1654                 hdr = container_of(plist, struct recv_frame, list);
1655                 pnextattrib = &hdr->attrib;
1656
1657                 if (SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
1658                         plist = plist->next;
1659                 else if (SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
1660                         return false;
1661                 else
1662                         break;
1663         }
1664
1665         list_del_init(&(prframe->list));
1666
1667         list_add_tail(&(prframe->list), plist);
1668         return true;
1669 }
1670
1671 static int recv_indicatepkts_in_order(struct adapter *padapter, struct recv_reorder_ctrl *preorder_ctrl, int bforced)
1672 {
1673         struct list_head *phead, *plist;
1674         struct recv_frame *prframe;
1675         struct recv_frame *prhdr;
1676         struct rx_pkt_attrib *pattrib;
1677         int bPktInBuf = false;
1678         struct recv_priv *precvpriv = &padapter->recvpriv;
1679         struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1680
1681         phead =         get_list_head(ppending_recvframe_queue);
1682         plist = phead->next;
1683
1684         /*  Handling some condition for forced indicate case. */
1685         if (bforced) {
1686                 if (list_empty(phead))
1687                         return true;
1688
1689                 prhdr = container_of(plist, struct recv_frame, list);
1690                 pattrib = &prhdr->attrib;
1691                 preorder_ctrl->indicate_seq = pattrib->seq_num;
1692         }
1693
1694         /*  Prepare indication list and indication. */
1695         /*  Check if there is any packet need indicate. */
1696         while (!list_empty(phead)) {
1697                 prhdr = container_of(plist, struct recv_frame, list);
1698                 prframe = prhdr;
1699                 pattrib = &prframe->attrib;
1700
1701                 if (!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num)) {
1702                         RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
1703                                  ("recv_indicatepkts_in_order: indicate=%d seq=%d amsdu=%d\n",
1704                                   preorder_ctrl->indicate_seq, pattrib->seq_num, pattrib->amsdu));
1705                         plist = plist->next;
1706                         list_del_init(&(prframe->list));
1707
1708                         if (SN_EQUAL(preorder_ctrl->indicate_seq, pattrib->seq_num))
1709                                 preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
1710
1711                         /* Set this as a lock to make sure that only one thread is indicating packet. */
1712
1713                         /* indicate this recv_frame */
1714                         if (!pattrib->amsdu) {
1715                                 if ((!padapter->bDriverStopped) &&
1716                                     (!padapter->bSurpriseRemoved))
1717                                         rtw_recv_indicatepkt(padapter, prframe);/* indicate this recv_frame */
1718                         } else if (pattrib->amsdu == 1) {
1719                                 if (amsdu_to_msdu(padapter, prframe) != _SUCCESS)
1720                                         rtw_free_recvframe(prframe, &precvpriv->free_recv_queue);
1721                         } else {
1722                                 /* error condition; */
1723                         }
1724
1725                         /* Update local variables. */
1726                         bPktInBuf = false;
1727                 } else {
1728                         bPktInBuf = true;
1729                         break;
1730                 }
1731         }
1732         return bPktInBuf;
1733 }
1734
1735 static int recv_indicatepkt_reorder(struct adapter *padapter,
1736                                     struct recv_frame *prframe)
1737 {
1738         int retval = _SUCCESS;
1739         struct rx_pkt_attrib *pattrib = &prframe->attrib;
1740         struct recv_reorder_ctrl *preorder_ctrl = prframe->preorder_ctrl;
1741         struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1742
1743         if (!pattrib->amsdu) {
1744                 /* s1. */
1745                 wlanhdr_to_ethhdr(prframe);
1746
1747                 if ((pattrib->qos != 1) || (pattrib->eth_type == 0x0806) ||
1748                     (pattrib->ack_policy != 0)) {
1749                         if ((!padapter->bDriverStopped) &&
1750                             (!padapter->bSurpriseRemoved)) {
1751                                 RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@  recv_indicatepkt_reorder -recv_func recv_indicatepkt\n"));
1752
1753                                 rtw_recv_indicatepkt(padapter, prframe);
1754                                 return _SUCCESS;
1755                         }
1756
1757                         return _FAIL;
1758                 }
1759
1760                 if (!preorder_ctrl->enable) {
1761                         /* indicate this recv_frame */
1762                         preorder_ctrl->indicate_seq = pattrib->seq_num;
1763                         rtw_recv_indicatepkt(padapter, prframe);
1764
1765                         preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
1766                         return _SUCCESS;
1767                 }
1768         } else if (pattrib->amsdu == 1) { /* temp filter -> means didn't support A-MSDUs in a A-MPDU */
1769                 if (!preorder_ctrl->enable) {
1770                         preorder_ctrl->indicate_seq = pattrib->seq_num;
1771                         retval = amsdu_to_msdu(padapter, prframe);
1772
1773                         preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
1774                         return retval;
1775                 }
1776         }
1777
1778         spin_lock_bh(&ppending_recvframe_queue->lock);
1779
1780         RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
1781                  ("recv_indicatepkt_reorder: indicate=%d seq=%d\n",
1782                   preorder_ctrl->indicate_seq, pattrib->seq_num));
1783
1784         /* s2. check if winstart_b(indicate_seq) needs to been updated */
1785         if (!check_indicate_seq(preorder_ctrl, pattrib->seq_num)) {
1786                 rtw_recv_indicatepkt(padapter, prframe);
1787
1788                 spin_unlock_bh(&ppending_recvframe_queue->lock);
1789
1790                 goto _success_exit;
1791         }
1792
1793         /* s3. Insert all packet into Reorder Queue to maintain its ordering. */
1794         if (!enqueue_reorder_recvframe(preorder_ctrl, prframe))
1795                 goto _err_exit;
1796
1797         /* s4. */
1798         /*  Indication process. */
1799         /*  After Packet dropping and Sliding Window shifting as above, we can now just indicate the packets */
1800         /*  with the SeqNum smaller than latest WinStart and buffer other packets. */
1801         /*  */
1802         /*  For Rx Reorder condition: */
1803         /*  1. All packets with SeqNum smaller than WinStart => Indicate */
1804         /*  2. All packets with SeqNum larger than or equal to WinStart => Buffer it. */
1805         /*  */
1806
1807         /* recv_indicatepkts_in_order(padapter, preorder_ctrl, true); */
1808         if (recv_indicatepkts_in_order(padapter, preorder_ctrl, false)) {
1809                 mod_timer(&preorder_ctrl->reordering_ctrl_timer,
1810                           jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
1811                 spin_unlock_bh(&ppending_recvframe_queue->lock);
1812         } else {
1813                 spin_unlock_bh(&ppending_recvframe_queue->lock);
1814                 del_timer_sync(&preorder_ctrl->reordering_ctrl_timer);
1815         }
1816
1817 _success_exit:
1818
1819         return _SUCCESS;
1820
1821 _err_exit:
1822
1823         spin_unlock_bh(&ppending_recvframe_queue->lock);
1824
1825         return _FAIL;
1826 }
1827
1828 void rtw_reordering_ctrl_timeout_handler(unsigned long data)
1829 {
1830         struct recv_reorder_ctrl *preorder_ctrl = (struct recv_reorder_ctrl *)data;
1831         struct adapter *padapter = preorder_ctrl->padapter;
1832         struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1833
1834         if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1835                 return;
1836
1837         spin_lock_bh(&ppending_recvframe_queue->lock);
1838
1839         if (recv_indicatepkts_in_order(padapter, preorder_ctrl, true) == true)
1840                 mod_timer(&preorder_ctrl->reordering_ctrl_timer,
1841                           jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
1842
1843         spin_unlock_bh(&ppending_recvframe_queue->lock);
1844 }
1845
1846 static int process_recv_indicatepkts(struct adapter *padapter,
1847                                      struct recv_frame *prframe)
1848 {
1849         int retval = _SUCCESS;
1850         struct mlme_priv        *pmlmepriv = &padapter->mlmepriv;
1851         struct ht_priv  *phtpriv = &pmlmepriv->htpriv;
1852
1853         if (phtpriv->ht_option) {  /* B/G/N Mode */
1854                 if (recv_indicatepkt_reorder(padapter, prframe) != _SUCCESS) {
1855                         /*  including perform A-MPDU Rx Ordering Buffer Control */
1856                         if ((!padapter->bDriverStopped) &&
1857                             (!padapter->bSurpriseRemoved)) {
1858                                 retval = _FAIL;
1859                                 return retval;
1860                         }
1861                 }
1862         } else { /* B/G mode */
1863                 retval = wlanhdr_to_ethhdr(prframe);
1864                 if (retval != _SUCCESS) {
1865                         RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("wlanhdr_to_ethhdr: drop pkt\n"));
1866                         return retval;
1867                 }
1868
1869                 if ((!padapter->bDriverStopped) &&
1870                     (!padapter->bSurpriseRemoved)) {
1871                         /* indicate this recv_frame */
1872                         RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ process_recv_indicatepkts- recv_func recv_indicatepkt\n"));
1873                         rtw_recv_indicatepkt(padapter, prframe);
1874                 } else {
1875                         RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ process_recv_indicatepkts- recv_func free_indicatepkt\n"));
1876
1877                         RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
1878                         retval = _FAIL;
1879                         return retval;
1880                 }
1881         }
1882
1883         return retval;
1884 }
1885
1886 static int recv_func_prehandle(struct adapter *padapter,
1887                                struct recv_frame *rframe)
1888 {
1889         int ret = _SUCCESS;
1890         struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
1891
1892         /* check the frame crtl field and decache */
1893         ret = validate_recv_frame(padapter, rframe);
1894         if (ret != _SUCCESS) {
1895                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
1896                 rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
1897                 goto exit;
1898         }
1899
1900 exit:
1901         return ret;
1902 }
1903
1904 static int recv_func_posthandle(struct adapter *padapter,
1905                                 struct recv_frame *prframe)
1906 {
1907         int ret = _SUCCESS;
1908         struct recv_frame *orig_prframe = prframe;
1909         struct recv_priv *precvpriv = &padapter->recvpriv;
1910         struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
1911
1912         /*  DATA FRAME */
1913         LedControl8188eu(padapter, LED_CTL_RX);
1914
1915         prframe = decryptor(padapter, prframe);
1916         if (prframe == NULL) {
1917                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("decryptor: drop pkt\n"));
1918                 ret = _FAIL;
1919                 goto _recv_data_drop;
1920         }
1921
1922         prframe = recvframe_chk_defrag(padapter, prframe);
1923         if (prframe == NULL) {
1924                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recvframe_chk_defrag: drop pkt\n"));
1925                 goto _recv_data_drop;
1926         }
1927
1928         prframe = portctrl(padapter, prframe);
1929         if (prframe == NULL) {
1930                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("portctrl: drop pkt\n"));
1931                 ret = _FAIL;
1932                 goto _recv_data_drop;
1933         }
1934
1935         count_rx_stats(padapter, prframe, NULL);
1936
1937         ret = process_recv_indicatepkts(padapter, prframe);
1938         if (ret != _SUCCESS) {
1939                 RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recv_func: process_recv_indicatepkts fail!\n"));
1940                 rtw_free_recvframe(orig_prframe, pfree_recv_queue);/* free this recv_frame */
1941                 goto _recv_data_drop;
1942         }
1943         return ret;
1944
1945 _recv_data_drop:
1946         precvpriv->rx_drop++;
1947         return ret;
1948 }
1949
1950 static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
1951 {
1952         int ret;
1953         struct rx_pkt_attrib *prxattrib = &rframe->attrib;
1954         struct security_priv *psecuritypriv = &padapter->securitypriv;
1955         struct mlme_priv *mlmepriv = &padapter->mlmepriv;
1956
1957         /* check if need to handle uc_swdec_pending_queue*/
1958         if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey) {
1959                 struct recv_frame *pending_frame;
1960
1961                 while ((pending_frame = rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue))) {
1962                         if (recv_func_posthandle(padapter, pending_frame) == _SUCCESS)
1963                                 DBG_88E("%s: dequeue uc_swdec_pending_queue\n", __func__);
1964                 }
1965         }
1966
1967         ret = recv_func_prehandle(padapter, rframe);
1968
1969         if (ret == _SUCCESS) {
1970                 /* check if need to enqueue into uc_swdec_pending_queue*/
1971                 if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
1972                     !IS_MCAST(prxattrib->ra) && prxattrib->encrypt > 0 &&
1973                     prxattrib->bdecrypted == 0 &&
1974                     !is_wep_enc(psecuritypriv->dot11PrivacyAlgrthm) &&
1975                     !psecuritypriv->busetkipkey) {
1976                         rtw_enqueue_recvframe(rframe, &padapter->recvpriv.uc_swdec_pending_queue);
1977                         DBG_88E("%s: no key, enqueue uc_swdec_pending_queue\n", __func__);
1978                         goto exit;
1979                 }
1980
1981                 ret = recv_func_posthandle(padapter, rframe);
1982         }
1983
1984 exit:
1985         return ret;
1986 }
1987
1988 s32 rtw_recv_entry(struct recv_frame *precvframe)
1989 {
1990         struct adapter *padapter;
1991         struct recv_priv *precvpriv;
1992         s32 ret = _SUCCESS;
1993
1994         padapter = precvframe->adapter;
1995
1996         precvpriv = &padapter->recvpriv;
1997
1998         ret = recv_func(padapter, precvframe);
1999         if (ret == _FAIL) {
2000                 RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("rtw_recv_entry: recv_func return fail!!!\n"));
2001                 goto _recv_entry_drop;
2002         }
2003
2004         precvpriv->rx_pkts++;
2005
2006         return ret;
2007
2008 _recv_entry_drop:
2009         return ret;
2010 }
2011
2012 static void rtw_signal_stat_timer_hdl(unsigned long data)
2013 {
2014         struct adapter *adapter = (struct adapter *)data;
2015         struct recv_priv *recvpriv = &adapter->recvpriv;
2016
2017         u32 tmp_s, tmp_q;
2018         u8 avg_signal_strength = 0;
2019         u8 avg_signal_qual = 0;
2020         u8 _alpha = 3; /*  this value is based on converging_constant = 5000 and sampling_interval = 1000 */
2021
2022         if (recvpriv->signal_strength_data.update_req == 0) {
2023                 /* update_req is clear, means we got rx */
2024                 avg_signal_strength = recvpriv->signal_strength_data.avg_val;
2025                 /* after avg_vals are acquired, we can re-stat the signal
2026                  * values
2027                  */
2028                 recvpriv->signal_strength_data.update_req = 1;
2029         }
2030
2031         if (recvpriv->signal_qual_data.update_req == 0) {
2032                 /* update_req is clear, means we got rx */
2033                 avg_signal_qual = recvpriv->signal_qual_data.avg_val;
2034                 /* after avg_vals are acquired, we can re-stat the signal
2035                  * values
2036                  */
2037                 recvpriv->signal_qual_data.update_req = 1;
2038         }
2039
2040         /* update value of signal_strength, rssi, signal_qual */
2041         if (check_fwstate(&adapter->mlmepriv, _FW_UNDER_SURVEY) == false) {
2042                 tmp_s = avg_signal_strength +
2043                         (_alpha - 1) * recvpriv->signal_strength;
2044                 tmp_s = DIV_ROUND_UP(tmp_s, _alpha);
2045                 if (tmp_s > 100)
2046                         tmp_s = 100;
2047
2048                 tmp_q = avg_signal_qual +
2049                         (_alpha - 1) * recvpriv->signal_qual;
2050                 tmp_q = DIV_ROUND_UP(tmp_q, _alpha);
2051                 if (tmp_q > 100)
2052                         tmp_q = 100;
2053
2054                 recvpriv->signal_strength = tmp_s;
2055                 recvpriv->rssi = (s8)translate_percentage_to_dbm(tmp_s);
2056                 recvpriv->signal_qual = tmp_q;
2057         }
2058
2059         rtw_set_signal_stat_timer(recvpriv);
2060 }