linux/drivers/staging/rtl8188eu/core/rtw_recv.c
<<
>>
Prefs
   1/******************************************************************************
   2 *
   3 * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   4 *
   5 * This program is free software; you can redistribute it and/or modify it
   6 * under the terms of version 2 of the GNU General Public License as
   7 * published by the Free Software Foundation.
   8 *
   9 * This program is distributed in the hope that it will be useful, but WITHOUT
  10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12 * more details.
  13 *
  14 ******************************************************************************/
  15#define _RTW_RECV_C_
  16
  17#include <linux/ieee80211.h>
  18
  19#include <osdep_service.h>
  20#include <drv_types.h>
  21#include <recv_osdep.h>
  22#include <mlme_osdep.h>
  23#include <mon.h>
  24#include <wifi.h>
  25#include <linux/vmalloc.h>
  26#include <net/lib80211.h>
  27
  28#define ETHERNET_HEADER_SIZE    14      /*  Ethernet Header Length */
  29#define LLC_HEADER_SIZE                 6       /*  LLC Header Length */
  30
  31static u8 SNAP_ETH_TYPE_IPX[2] = {0x81, 0x37};
  32static u8 SNAP_ETH_TYPE_APPLETALK_AARP[2] = {0x80, 0xf3};
  33
  34/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
  35static u8 rtw_bridge_tunnel_header[] = {
  36       0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8
  37};
  38
  39static u8 rtw_rfc1042_header[] = {
  40       0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00
  41};
  42
  43static void rtw_signal_stat_timer_hdl(struct timer_list *t);
  44
  45void _rtw_init_sta_recv_priv(struct sta_recv_priv *psta_recvpriv)
  46{
  47
  48        memset((u8 *)psta_recvpriv, 0, sizeof(struct sta_recv_priv));
  49
  50        spin_lock_init(&psta_recvpriv->lock);
  51
  52        _rtw_init_queue(&psta_recvpriv->defrag_q);
  53
  54}
  55
  56int _rtw_init_recv_priv(struct recv_priv *precvpriv, struct adapter *padapter)
  57{
  58        int i;
  59
  60        struct recv_frame *precvframe;
  61
  62        int     res = _SUCCESS;
  63
  64        _rtw_init_queue(&precvpriv->free_recv_queue);
  65        _rtw_init_queue(&precvpriv->recv_pending_queue);
  66        _rtw_init_queue(&precvpriv->uc_swdec_pending_queue);
  67
  68        precvpriv->adapter = padapter;
  69
  70        precvpriv->pallocated_frame_buf = vzalloc(NR_RECVFRAME * sizeof(struct recv_frame) + RXFRAME_ALIGN_SZ);
  71
  72        if (!precvpriv->pallocated_frame_buf)
  73                return _FAIL;
  74
  75        precvframe = PTR_ALIGN(precvpriv->pallocated_frame_buf, RXFRAME_ALIGN_SZ);
  76
  77        for (i = 0; i < NR_RECVFRAME; i++) {
  78                INIT_LIST_HEAD(&(precvframe->list));
  79
  80                list_add_tail(&(precvframe->list),
  81                                     &(precvpriv->free_recv_queue.queue));
  82
  83                precvframe->pkt = NULL;
  84
  85                precvframe->adapter = padapter;
  86                precvframe++;
  87        }
  88        res = rtw_hal_init_recv_priv(padapter);
  89
  90        timer_setup(&precvpriv->signal_stat_timer, rtw_signal_stat_timer_hdl,
  91                    0);
  92
  93        precvpriv->signal_stat_sampling_interval = 1000; /* ms */
  94
  95        rtw_set_signal_stat_timer(precvpriv);
  96
  97        return res;
  98}
  99
 100void _rtw_free_recv_priv(struct recv_priv *precvpriv)
 101{
 102        struct adapter  *padapter = precvpriv->adapter;
 103
 104        rtw_free_uc_swdec_pending_queue(padapter);
 105
 106        vfree(precvpriv->pallocated_frame_buf);
 107
 108        rtw_hal_free_recv_priv(padapter);
 109
 110}
 111
 112struct recv_frame *_rtw_alloc_recvframe(struct __queue *pfree_recv_queue)
 113{
 114        struct recv_frame *hdr;
 115
 116        hdr = list_first_entry_or_null(&pfree_recv_queue->queue,
 117                                       struct recv_frame, list);
 118        if (hdr)
 119                list_del_init(&hdr->list);
 120
 121        return hdr;
 122}
 123
 124struct recv_frame *rtw_alloc_recvframe(struct __queue *pfree_recv_queue)
 125{
 126        struct recv_frame  *precvframe;
 127
 128        spin_lock_bh(&pfree_recv_queue->lock);
 129
 130        precvframe = _rtw_alloc_recvframe(pfree_recv_queue);
 131
 132        spin_unlock_bh(&pfree_recv_queue->lock);
 133
 134        return precvframe;
 135}
 136
 137int rtw_free_recvframe(struct recv_frame *precvframe,
 138                       struct __queue *pfree_recv_queue)
 139{
 140        if (!precvframe)
 141                return _FAIL;
 142        if (precvframe->pkt) {
 143                dev_kfree_skb_any(precvframe->pkt);/* free skb by driver */
 144                precvframe->pkt = NULL;
 145        }
 146
 147        spin_lock_bh(&pfree_recv_queue->lock);
 148
 149        list_del_init(&(precvframe->list));
 150
 151        list_add_tail(&(precvframe->list), get_list_head(pfree_recv_queue));
 152
 153        spin_unlock_bh(&pfree_recv_queue->lock);
 154
 155        return _SUCCESS;
 156}
 157
 158int _rtw_enqueue_recvframe(struct recv_frame *precvframe, struct __queue *queue)
 159{
 160        list_del_init(&(precvframe->list));
 161        list_add_tail(&(precvframe->list), get_list_head(queue));
 162
 163        return _SUCCESS;
 164}
 165
 166int rtw_enqueue_recvframe(struct recv_frame *precvframe, struct __queue *queue)
 167{
 168        int ret;
 169
 170        spin_lock_bh(&queue->lock);
 171        ret = _rtw_enqueue_recvframe(precvframe, queue);
 172        spin_unlock_bh(&queue->lock);
 173
 174        return ret;
 175}
 176
 177/*
 178caller : defrag ; recvframe_chk_defrag in recv_thread  (passive)
 179pframequeue: defrag_queue : will be accessed in recv_thread  (passive)
 180
 181using spinlock to protect
 182
 183*/
 184
 185void rtw_free_recvframe_queue(struct __queue *pframequeue,  struct __queue *pfree_recv_queue)
 186{
 187        struct recv_frame *hdr;
 188        struct list_head *plist, *phead;
 189
 190        spin_lock(&pframequeue->lock);
 191
 192        phead = get_list_head(pframequeue);
 193        plist = phead->next;
 194
 195        while (phead != plist) {
 196                hdr = list_entry(plist, struct recv_frame, list);
 197
 198                plist = plist->next;
 199
 200                rtw_free_recvframe(hdr, pfree_recv_queue);
 201        }
 202
 203        spin_unlock(&pframequeue->lock);
 204
 205}
 206
 207u32 rtw_free_uc_swdec_pending_queue(struct adapter *adapter)
 208{
 209        u32 cnt = 0;
 210        struct recv_frame *pending_frame;
 211
 212        while ((pending_frame = rtw_alloc_recvframe(&adapter->recvpriv.uc_swdec_pending_queue))) {
 213                rtw_free_recvframe(pending_frame, &adapter->recvpriv.free_recv_queue);
 214                DBG_88E("%s: dequeue uc_swdec_pending_queue\n", __func__);
 215                cnt++;
 216        }
 217
 218        return cnt;
 219}
 220
 221static int recvframe_chkmic(struct adapter *adapter,
 222                            struct recv_frame *precvframe)
 223{
 224        int res = _SUCCESS;
 225        struct rx_pkt_attrib *prxattrib = &precvframe->attrib;
 226        struct sta_info *stainfo = rtw_get_stainfo(&adapter->stapriv, prxattrib->ta);
 227
 228        if (prxattrib->encrypt == _TKIP_) {
 229                if (stainfo) {
 230                        int key_idx;
 231                        const int iv_len = 8, icv_len = 4, key_length = 32;
 232                        struct sk_buff *skb = precvframe->pkt;
 233                        u8 key[32], iv[8], icv[4], *pframe = skb->data;
 234                        void *crypto_private = NULL;
 235                        struct lib80211_crypto_ops *crypto_ops = try_then_request_module(lib80211_get_crypto_ops("TKIP"), "lib80211_crypt_tkip");
 236                        struct security_priv *psecuritypriv = &adapter->securitypriv;
 237
 238                        if (IS_MCAST(prxattrib->ra)) {
 239                                if (!psecuritypriv) {
 240                                        res = _FAIL;
 241                                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 242                                                 ("\n %s: didn't install group key!!!!!!!!!!\n", __func__));
 243                                        DBG_88E("\n %s: didn't install group key!!!!!!!!!!\n", __func__);
 244                                        goto exit;
 245                                }
 246                                key_idx = prxattrib->key_index;
 247                                memcpy(key, psecuritypriv->dot118021XGrpKey[key_idx].skey, 16);
 248                                memcpy(key + 16, psecuritypriv->dot118021XGrprxmickey[key_idx].skey, 16);
 249                        } else {
 250                                key_idx = 0;
 251                                memcpy(key, stainfo->dot118021x_UncstKey.skey, 16);
 252                                memcpy(key + 16, stainfo->dot11tkiprxmickey.skey, 16);
 253                        }
 254
 255                        if (!crypto_ops) {
 256                                res = _FAIL;
 257                                goto exit_lib80211_tkip;
 258                        }
 259
 260                        memcpy(iv, pframe + prxattrib->hdrlen, iv_len);
 261                        memcpy(icv, pframe + skb->len - icv_len, icv_len);
 262                        memmove(pframe + iv_len, pframe, prxattrib->hdrlen);
 263
 264                        skb_pull(skb, iv_len);
 265                        skb_trim(skb, skb->len - icv_len);
 266
 267                        crypto_private = crypto_ops->init(key_idx);
 268                        if (!crypto_private) {
 269                                res = _FAIL;
 270                                goto exit_lib80211_tkip;
 271                        }
 272                        if (crypto_ops->set_key(key, key_length, NULL, crypto_private) < 0) {
 273                                res = _FAIL;
 274                                goto exit_lib80211_tkip;
 275                        }
 276                        if (crypto_ops->decrypt_msdu(skb, key_idx, prxattrib->hdrlen, crypto_private)) {
 277                                res = _FAIL;
 278                                goto exit_lib80211_tkip;
 279                        }
 280
 281                        memmove(pframe, pframe + iv_len, prxattrib->hdrlen);
 282                        skb_push(skb, iv_len);
 283                        skb_put(skb, icv_len);
 284
 285                        memcpy(pframe + prxattrib->hdrlen, iv, iv_len);
 286                        memcpy(pframe + skb->len - icv_len, icv, icv_len);
 287
 288exit_lib80211_tkip:
 289                        if (crypto_ops && crypto_private)
 290                                crypto_ops->deinit(crypto_private);
 291                } else {
 292                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_,
 293                                 ("%s: rtw_get_stainfo==NULL!!!\n", __func__));
 294                }
 295        }
 296
 297exit:
 298        return res;
 299}
 300
 301/* decrypt and set the ivlen, icvlen of the recv_frame */
 302static struct recv_frame *decryptor(struct adapter *padapter,
 303                                    struct recv_frame *precv_frame)
 304{
 305        struct rx_pkt_attrib *prxattrib = &precv_frame->attrib;
 306        struct security_priv *psecuritypriv = &padapter->securitypriv;
 307        struct recv_frame *return_packet = precv_frame;
 308        u32      res = _SUCCESS;
 309
 310        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("prxstat->decrypted=%x prxattrib->encrypt=0x%03x\n", prxattrib->bdecrypted, prxattrib->encrypt));
 311
 312        if (prxattrib->encrypt > 0) {
 313                u8 *iv = precv_frame->pkt->data+prxattrib->hdrlen;
 314
 315                prxattrib->key_index = (((iv[3])>>6)&0x3);
 316
 317                if (prxattrib->key_index > WEP_KEYS) {
 318                        DBG_88E("prxattrib->key_index(%d)>WEP_KEYS\n", prxattrib->key_index);
 319
 320                        switch (prxattrib->encrypt) {
 321                        case _WEP40_:
 322                        case _WEP104_:
 323                                prxattrib->key_index = psecuritypriv->dot11PrivacyKeyIndex;
 324                                break;
 325                        case _TKIP_:
 326                        case _AES_:
 327                        default:
 328                                prxattrib->key_index = psecuritypriv->dot118021XGrpKeyid;
 329                                break;
 330                        }
 331                }
 332        }
 333
 334        if ((prxattrib->encrypt > 0) && (prxattrib->bdecrypted == 0)) {
 335                psecuritypriv->hw_decrypted = false;
 336
 337                switch (prxattrib->encrypt) {
 338                case _WEP40_:
 339                case _WEP104_:
 340                        res = rtw_wep_decrypt(padapter, (u8 *)precv_frame);
 341                        break;
 342                case _TKIP_:
 343                        res = rtw_tkip_decrypt(padapter, (u8 *)precv_frame);
 344                        break;
 345                case _AES_:
 346                        res = rtw_aes_decrypt(padapter, (u8 *)precv_frame);
 347                        break;
 348                default:
 349                        break;
 350                }
 351        } else if (prxattrib->bdecrypted == 1 && prxattrib->encrypt > 0 &&
 352                   (psecuritypriv->busetkipkey == 1 || prxattrib->encrypt != _TKIP_))
 353                        psecuritypriv->hw_decrypted = true;
 354
 355        if (res == _FAIL) {
 356                rtw_free_recvframe(return_packet, &padapter->recvpriv.free_recv_queue);
 357                return_packet = NULL;
 358        }
 359
 360        return return_packet;
 361}
 362
 363/* set the security information in the recv_frame */
 364static struct recv_frame *portctrl(struct adapter *adapter,
 365                                   struct recv_frame *precv_frame)
 366{
 367        u8   *psta_addr, *ptr;
 368        uint  auth_alg;
 369        struct recv_frame *pfhdr;
 370        struct sta_info *psta;
 371        struct sta_priv *pstapriv;
 372        struct recv_frame *prtnframe;
 373        u16     ether_type;
 374        u16  eapol_type = 0x888e;/* for Funia BD's WPA issue */
 375        struct rx_pkt_attrib *pattrib;
 376        __be16 be_tmp;
 377
 378        pstapriv = &adapter->stapriv;
 379
 380        auth_alg = adapter->securitypriv.dot11AuthAlgrthm;
 381
 382        ptr = precv_frame->pkt->data;
 383        pfhdr = precv_frame;
 384        pattrib = &pfhdr->attrib;
 385        psta_addr = pattrib->ta;
 386        psta = rtw_get_stainfo(pstapriv, psta_addr);
 387
 388        prtnframe = NULL;
 389
 390        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########%s:adapter->securitypriv.dot11AuthAlgrthm=%d\n", __func__, adapter->securitypriv.dot11AuthAlgrthm));
 391
 392        if (auth_alg == 2) {
 393                /* get ether_type */
 394                ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE + pfhdr->attrib.iv_len;
 395                memcpy(&be_tmp, ptr, 2);
 396                ether_type = ntohs(be_tmp);
 397
 398                if ((psta != NULL) && (psta->ieee8021x_blocked)) {
 399                        /* blocked */
 400                        /* only accept EAPOL frame */
 401                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########%s:psta->ieee8021x_blocked==1\n", __func__));
 402
 403                        if (ether_type == eapol_type) {
 404                                prtnframe = precv_frame;
 405                        } else {
 406                                /* free this frame */
 407                                rtw_free_recvframe(precv_frame, &adapter->recvpriv.free_recv_queue);
 408                                prtnframe = NULL;
 409                        }
 410                } else {
 411                        /* allowed */
 412                        /* check decryption status, and decrypt the frame if needed */
 413                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########%s:psta->ieee8021x_blocked==0\n", __func__));
 414                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
 415                                 ("%s:precv_frame->hdr.attrib.privacy=%x\n",
 416                                  __func__, precv_frame->attrib.privacy));
 417
 418                        if (pattrib->bdecrypted == 0)
 419                                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("%s:prxstat->decrypted=%x\n", __func__, pattrib->bdecrypted));
 420
 421                        prtnframe = precv_frame;
 422                        /* check is the EAPOL frame or not (Rekey) */
 423                        if (ether_type == eapol_type) {
 424                                RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("########%s:ether_type==0x888e\n", __func__));
 425                                /* check Rekey */
 426
 427                                prtnframe = precv_frame;
 428                        } else {
 429                                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("########%s:ether_type=0x%04x\n", __func__, ether_type));
 430                        }
 431                }
 432        } else {
 433                prtnframe = precv_frame;
 434        }
 435
 436                return prtnframe;
 437}
 438
 439static int recv_decache(struct recv_frame *precv_frame, u8 bretry,
 440                        struct stainfo_rxcache *prxcache)
 441{
 442        int tid = precv_frame->attrib.priority;
 443
 444        u16 seq_ctrl = ((precv_frame->attrib.seq_num&0xffff) << 4) |
 445                (precv_frame->attrib.frag_num & 0xf);
 446
 447        if (tid > 15) {
 448                RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("%s, (tid>15)! seq_ctrl=0x%x, tid=0x%x\n", __func__, seq_ctrl, tid));
 449
 450                return _FAIL;
 451        }
 452
 453        if (1) {/* if (bretry) */
 454                if (seq_ctrl == prxcache->tid_rxseq[tid]) {
 455                        RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("%s, seq_ctrl=0x%x, tid=0x%x, tid_rxseq=0x%x\n", __func__, seq_ctrl, tid, prxcache->tid_rxseq[tid]));
 456
 457                        return _FAIL;
 458                }
 459        }
 460
 461        prxcache->tid_rxseq[tid] = seq_ctrl;
 462
 463        return _SUCCESS;
 464}
 465
 466static void process_pwrbit_data(struct adapter *padapter,
 467                                struct recv_frame *precv_frame)
 468{
 469#ifdef CONFIG_88EU_AP_MODE
 470        unsigned char pwrbit;
 471        u8 *ptr = precv_frame->pkt->data;
 472        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 473        struct sta_priv *pstapriv = &padapter->stapriv;
 474        struct sta_info *psta = NULL;
 475
 476        psta = rtw_get_stainfo(pstapriv, pattrib->src);
 477
 478        pwrbit = GetPwrMgt(ptr);
 479
 480        if (psta) {
 481                if (pwrbit) {
 482                        if (!(psta->state & WIFI_SLEEP_STATE))
 483                                stop_sta_xmit(padapter, psta);
 484                } else {
 485                        if (psta->state & WIFI_SLEEP_STATE)
 486                                wakeup_sta_to_xmit(padapter, psta);
 487                }
 488        }
 489
 490#endif
 491}
 492
 493static void process_wmmps_data(struct adapter *padapter,
 494                               struct recv_frame *precv_frame)
 495{
 496#ifdef CONFIG_88EU_AP_MODE
 497        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 498        struct sta_priv *pstapriv = &padapter->stapriv;
 499        struct sta_info *psta = NULL;
 500
 501        psta = rtw_get_stainfo(pstapriv, pattrib->src);
 502
 503        if (!psta)
 504                return;
 505
 506        if (!psta->qos_option)
 507                return;
 508
 509        if (!(psta->qos_info&0xf))
 510                return;
 511
 512        if (psta->state&WIFI_SLEEP_STATE) {
 513                u8 wmmps_ac = 0;
 514
 515                switch (pattrib->priority) {
 516                case 1:
 517                case 2:
 518                        wmmps_ac = psta->uapsd_bk&BIT(1);
 519                        break;
 520                case 4:
 521                case 5:
 522                        wmmps_ac = psta->uapsd_vi&BIT(1);
 523                        break;
 524                case 6:
 525                case 7:
 526                        wmmps_ac = psta->uapsd_vo&BIT(1);
 527                        break;
 528                case 0:
 529                case 3:
 530                default:
 531                        wmmps_ac = psta->uapsd_be&BIT(1);
 532                        break;
 533                }
 534
 535                if (wmmps_ac) {
 536                        if (psta->sleepq_ac_len > 0) {
 537                                /* process received triggered frame */
 538                                xmit_delivery_enabled_frames(padapter, psta);
 539                        } else {
 540                                /* issue one qos null frame with More data bit = 0 and the EOSP bit set (= 1) */
 541                                issue_qos_nulldata(padapter, psta->hwaddr, (u16)pattrib->priority, 0, 0);
 542                        }
 543                }
 544        }
 545
 546#endif
 547}
 548
 549static void count_rx_stats(struct adapter *padapter,
 550                           struct recv_frame *prframe,
 551                           struct sta_info *sta)
 552{
 553        int     sz;
 554        struct sta_info         *psta = NULL;
 555        struct stainfo_stats    *pstats = NULL;
 556        struct rx_pkt_attrib    *pattrib = &prframe->attrib;
 557        struct recv_priv        *precvpriv = &padapter->recvpriv;
 558
 559        sz = prframe->pkt->len;
 560        precvpriv->rx_bytes += sz;
 561
 562        padapter->mlmepriv.LinkDetectInfo.NumRxOkInPeriod++;
 563
 564        if ((!MacAddr_isBcst(pattrib->dst)) && (!IS_MCAST(pattrib->dst)))
 565                padapter->mlmepriv.LinkDetectInfo.NumRxUnicastOkInPeriod++;
 566
 567        if (sta)
 568                psta = sta;
 569        else
 570                psta = prframe->psta;
 571
 572        if (psta) {
 573                pstats = &psta->sta_stats;
 574
 575                pstats->rx_data_pkts++;
 576                pstats->rx_bytes += sz;
 577        }
 578}
 579
 580int sta2sta_data_frame(
 581        struct adapter *adapter,
 582        struct recv_frame *precv_frame,
 583        struct sta_info **psta
 584);
 585
 586int sta2sta_data_frame(struct adapter *adapter, struct recv_frame *precv_frame,
 587                       struct sta_info **psta)
 588{
 589        int ret = _SUCCESS;
 590        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 591        struct  sta_priv *pstapriv = &adapter->stapriv;
 592        struct  mlme_priv *pmlmepriv = &adapter->mlmepriv;
 593        u8 *mybssid  = get_bssid(pmlmepriv);
 594        u8 *myhwaddr = myid(&adapter->eeprompriv);
 595        u8 *sta_addr = NULL;
 596        int bmcast = IS_MCAST(pattrib->dst);
 597
 598        if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) == true) ||
 599            (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) == true)) {
 600                /*  filter packets that SA is myself or multicast or broadcast */
 601                if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN)) {
 602                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" SA==myself\n"));
 603                        ret = _FAIL;
 604                        goto exit;
 605                }
 606
 607                if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast)) {
 608                        ret = _FAIL;
 609                        goto exit;
 610                }
 611
 612                if (!memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 613                    !memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 614                    memcmp(pattrib->bssid, mybssid, ETH_ALEN)) {
 615                        ret = _FAIL;
 616                        goto exit;
 617                }
 618
 619                sta_addr = pattrib->src;
 620        } else if (check_fwstate(pmlmepriv, WIFI_STATION_STATE)) {
 621                /*  For Station mode, sa and bssid should always be BSSID, and DA is my mac-address */
 622                if (memcmp(pattrib->bssid, pattrib->src, ETH_ALEN)) {
 623                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("bssid!=TA under STATION_MODE; drop pkt\n"));
 624                        ret = _FAIL;
 625                        goto exit;
 626                }
 627                sta_addr = pattrib->bssid;
 628        } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
 629                if (bmcast) {
 630                        /*  For AP mode, if DA == MCAST, then BSSID should be also MCAST */
 631                        if (!IS_MCAST(pattrib->bssid)) {
 632                                        ret = _FAIL;
 633                                        goto exit;
 634                        }
 635                } else { /*  not mc-frame */
 636                        /*  For AP mode, if DA is non-MCAST, then it must be BSSID, and bssid == BSSID */
 637                        if (memcmp(pattrib->bssid, pattrib->dst, ETH_ALEN)) {
 638                                ret = _FAIL;
 639                                goto exit;
 640                        }
 641
 642                        sta_addr = pattrib->src;
 643                }
 644        } else {
 645                ret  = _FAIL;
 646        }
 647
 648        if (bmcast)
 649                *psta = rtw_get_bcmc_stainfo(adapter);
 650        else
 651                *psta = rtw_get_stainfo(pstapriv, sta_addr); /*  get ap_info */
 652
 653        if (*psta == NULL) {
 654                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("can't get psta under %s ; drop pkt\n", __func__));
 655                ret = _FAIL;
 656                goto exit;
 657        }
 658
 659exit:
 660        return ret;
 661}
 662
 663static int ap2sta_data_frame(
 664        struct adapter *adapter,
 665        struct recv_frame *precv_frame,
 666        struct sta_info **psta)
 667{
 668        u8 *ptr = precv_frame->pkt->data;
 669        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 670        int ret = _SUCCESS;
 671        struct  sta_priv *pstapriv = &adapter->stapriv;
 672        struct  mlme_priv *pmlmepriv = &adapter->mlmepriv;
 673        u8 *mybssid  = get_bssid(pmlmepriv);
 674        u8 *myhwaddr = myid(&adapter->eeprompriv);
 675        int bmcast = IS_MCAST(pattrib->dst);
 676
 677        if ((check_fwstate(pmlmepriv, WIFI_STATION_STATE) == true) &&
 678            (check_fwstate(pmlmepriv, _FW_LINKED) == true ||
 679            check_fwstate(pmlmepriv, _FW_UNDER_LINKING))) {
 680                /*  filter packets that SA is myself or multicast or broadcast */
 681                if (!memcmp(myhwaddr, pattrib->src, ETH_ALEN)) {
 682                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" SA==myself\n"));
 683                        ret = _FAIL;
 684                        goto exit;
 685                }
 686
 687                /*  da should be for me */
 688                if ((memcmp(myhwaddr, pattrib->dst, ETH_ALEN)) && (!bmcast)) {
 689                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
 690                                 (" %s:  compare DA fail; DA=%pM\n", __func__, (pattrib->dst)));
 691                        ret = _FAIL;
 692                        goto exit;
 693                }
 694
 695                /*  check BSSID */
 696                if (!memcmp(pattrib->bssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 697                    !memcmp(mybssid, "\x0\x0\x0\x0\x0\x0", ETH_ALEN) ||
 698                     (memcmp(pattrib->bssid, mybssid, ETH_ALEN))) {
 699                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
 700                                 (" %s:  compare BSSID fail ; BSSID=%pM\n", __func__, (pattrib->bssid)));
 701                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("mybssid=%pM\n", (mybssid)));
 702
 703                        if (!bmcast) {
 704                                DBG_88E("issue_deauth to the nonassociated ap=%pM for the reason(7)\n", (pattrib->bssid));
 705                                issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 706                        }
 707
 708                        ret = _FAIL;
 709                        goto exit;
 710                }
 711
 712                if (bmcast)
 713                        *psta = rtw_get_bcmc_stainfo(adapter);
 714                else
 715                        *psta = rtw_get_stainfo(pstapriv, pattrib->bssid); /*  get ap_info */
 716
 717                if (*psta == NULL) {
 718                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("ap2sta: can't get psta under STATION_MODE ; drop pkt\n"));
 719                        ret = _FAIL;
 720                        goto exit;
 721                }
 722
 723                /* if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE) { */
 724                /*  */
 725
 726                if (GetFrameSubType(ptr) & BIT(6)) {
 727                        /* No data, will not indicate to upper layer, temporily count it here */
 728                        count_rx_stats(adapter, precv_frame, *psta);
 729                        ret = RTW_RX_HANDLED;
 730                        goto exit;
 731                }
 732        } else if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
 733                /* Special case */
 734                ret = RTW_RX_HANDLED;
 735                goto exit;
 736        } else {
 737                if (!memcmp(myhwaddr, pattrib->dst, ETH_ALEN) && (!bmcast)) {
 738                        *psta = rtw_get_stainfo(pstapriv, pattrib->bssid); /*  get sta_info */
 739                        if (*psta == NULL) {
 740                                DBG_88E("issue_deauth to the ap =%pM for the reason(7)\n", (pattrib->bssid));
 741
 742                                issue_deauth(adapter, pattrib->bssid, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 743                        }
 744                }
 745
 746                ret = _FAIL;
 747        }
 748
 749exit:
 750
 751        return ret;
 752}
 753
 754static int sta2ap_data_frame(struct adapter *adapter,
 755                             struct recv_frame *precv_frame,
 756                             struct sta_info **psta)
 757{
 758        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 759        struct  sta_priv *pstapriv = &adapter->stapriv;
 760        struct  mlme_priv *pmlmepriv = &adapter->mlmepriv;
 761        u8 *ptr = precv_frame->pkt->data;
 762        unsigned char *mybssid  = get_bssid(pmlmepriv);
 763        int ret = _SUCCESS;
 764
 765        if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) {
 766                /* For AP mode, RA = BSSID, TX = STA(SRC_ADDR), A3 = DST_ADDR */
 767                if (memcmp(pattrib->bssid, mybssid, ETH_ALEN)) {
 768                        ret = _FAIL;
 769                        goto exit;
 770                }
 771
 772                *psta = rtw_get_stainfo(pstapriv, pattrib->src);
 773                if (*psta == NULL) {
 774                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("can't get psta under AP_MODE; drop pkt\n"));
 775                        DBG_88E("issue_deauth to sta=%pM for the reason(7)\n", (pattrib->src));
 776
 777                        issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 778
 779                        ret = RTW_RX_HANDLED;
 780                        goto exit;
 781                }
 782
 783                process_pwrbit_data(adapter, precv_frame);
 784
 785                if ((GetFrameSubType(ptr) & WIFI_QOS_DATA_TYPE) == WIFI_QOS_DATA_TYPE)
 786                        process_wmmps_data(adapter, precv_frame);
 787
 788                if (GetFrameSubType(ptr) & BIT(6)) {
 789                        /* No data, will not indicate to upper layer, temporily count it here */
 790                        count_rx_stats(adapter, precv_frame, *psta);
 791                        ret = RTW_RX_HANDLED;
 792                        goto exit;
 793                }
 794        } else {
 795                u8 *myhwaddr = myid(&adapter->eeprompriv);
 796
 797                if (memcmp(pattrib->ra, myhwaddr, ETH_ALEN)) {
 798                        ret = RTW_RX_HANDLED;
 799                        goto exit;
 800                }
 801                DBG_88E("issue_deauth to sta=%pM for the reason(7)\n", (pattrib->src));
 802                issue_deauth(adapter, pattrib->src, WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
 803                ret = RTW_RX_HANDLED;
 804                goto exit;
 805        }
 806
 807exit:
 808
 809        return ret;
 810}
 811
 812static int validate_recv_ctrl_frame(struct adapter *padapter,
 813                                    struct recv_frame *precv_frame)
 814{
 815#ifdef CONFIG_88EU_AP_MODE
 816        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
 817        struct sta_priv *pstapriv = &padapter->stapriv;
 818        u8 *pframe = precv_frame->pkt->data;
 819
 820        if (GetFrameType(pframe) != WIFI_CTRL_TYPE)
 821                return _FAIL;
 822
 823        /* receive the frames that ra(a1) is my address */
 824        if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN))
 825                return _FAIL;
 826
 827        /* only handle ps-poll */
 828        if (GetFrameSubType(pframe) == WIFI_PSPOLL) {
 829                u16 aid;
 830                u8 wmmps_ac = 0;
 831                struct sta_info *psta = NULL;
 832
 833                aid = GetAid(pframe);
 834                psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 835
 836                if ((psta == NULL) || (psta->aid != aid))
 837                        return _FAIL;
 838
 839                /* for rx pkt statistics */
 840                psta->sta_stats.rx_ctrl_pkts++;
 841
 842                switch (pattrib->priority) {
 843                case 1:
 844                case 2:
 845                        wmmps_ac = psta->uapsd_bk&BIT(0);
 846                        break;
 847                case 4:
 848                case 5:
 849                        wmmps_ac = psta->uapsd_vi&BIT(0);
 850                        break;
 851                case 6:
 852                case 7:
 853                        wmmps_ac = psta->uapsd_vo&BIT(0);
 854                        break;
 855                case 0:
 856                case 3:
 857                default:
 858                        wmmps_ac = psta->uapsd_be&BIT(0);
 859                        break;
 860                }
 861
 862                if (wmmps_ac)
 863                        return _FAIL;
 864
 865                if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
 866                        DBG_88E("%s alive check-rx ps-poll\n", __func__);
 867                        psta->expire_to = pstapriv->expire_to;
 868                        psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
 869                }
 870
 871                if ((psta->state&WIFI_SLEEP_STATE) && (pstapriv->sta_dz_bitmap&BIT(psta->aid))) {
 872                        struct list_head *xmitframe_plist, *xmitframe_phead;
 873                        struct xmit_frame *pxmitframe = NULL;
 874
 875                        spin_lock_bh(&psta->sleep_q.lock);
 876
 877                        xmitframe_phead = get_list_head(&psta->sleep_q);
 878                        xmitframe_plist = xmitframe_phead->next;
 879
 880                        if (xmitframe_phead != xmitframe_plist) {
 881                                pxmitframe = list_entry(xmitframe_plist, struct xmit_frame, list);
 882
 883                                xmitframe_plist = xmitframe_plist->next;
 884
 885                                list_del_init(&pxmitframe->list);
 886
 887                                psta->sleepq_len--;
 888
 889                                if (psta->sleepq_len > 0)
 890                                        pxmitframe->attrib.mdata = 1;
 891                                else
 892                                        pxmitframe->attrib.mdata = 0;
 893
 894                                pxmitframe->attrib.triggered = 1;
 895
 896                                spin_unlock_bh(&psta->sleep_q.lock);
 897                                if (rtw_hal_xmit(padapter, pxmitframe) == true)
 898                                        rtw_os_xmit_complete(padapter, pxmitframe);
 899                                spin_lock_bh(&psta->sleep_q.lock);
 900
 901                                if (psta->sleepq_len == 0) {
 902                                        pstapriv->tim_bitmap &= ~BIT(psta->aid);
 903
 904                                        /* update BCN for TIM IE */
 905                                        /* update_BCNTIM(padapter); */
 906                                        update_beacon(padapter, _TIM_IE_, NULL, false);
 907                                }
 908                        } else {
 909                                if (pstapriv->tim_bitmap&BIT(psta->aid)) {
 910                                        if (psta->sleepq_len == 0) {
 911                                                DBG_88E("no buffered packets to xmit\n");
 912
 913                                                /* issue nulldata with More data bit = 0 to indicate we have no buffered packets */
 914                                                issue_nulldata(padapter, psta->hwaddr, 0, 0, 0);
 915                                        } else {
 916                                                DBG_88E("error!psta->sleepq_len=%d\n", psta->sleepq_len);
 917                                                psta->sleepq_len = 0;
 918                                        }
 919
 920                                        pstapriv->tim_bitmap &= ~BIT(psta->aid);
 921
 922                                        /* update BCN for TIM IE */
 923                                        /* update_BCNTIM(padapter); */
 924                                        update_beacon(padapter, _TIM_IE_, NULL, false);
 925                                }
 926                        }
 927
 928                        spin_unlock_bh(&psta->sleep_q.lock);
 929                }
 930        }
 931
 932#endif
 933
 934        return _FAIL;
 935}
 936
 937struct recv_frame *recvframe_chk_defrag(struct adapter *padapter,
 938                                        struct recv_frame *precv_frame);
 939
 940static int validate_recv_mgnt_frame(struct adapter *padapter,
 941                                    struct recv_frame *precv_frame)
 942{
 943        struct sta_info *psta;
 944
 945        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("+%s\n", __func__));
 946
 947        precv_frame = recvframe_chk_defrag(padapter, precv_frame);
 948        if (!precv_frame) {
 949                RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
 950                         ("%s: fragment packet\n", __func__));
 951                return _SUCCESS;
 952        }
 953
 954        /* for rx pkt statistics */
 955        psta = rtw_get_stainfo(&padapter->stapriv,
 956                               GetAddr2Ptr(precv_frame->pkt->data));
 957        if (psta) {
 958                psta->sta_stats.rx_mgnt_pkts++;
 959                if (GetFrameSubType(precv_frame->pkt->data) == WIFI_BEACON) {
 960                        psta->sta_stats.rx_beacon_pkts++;
 961                } else if (GetFrameSubType(precv_frame->pkt->data) == WIFI_PROBEREQ) {
 962                        psta->sta_stats.rx_probereq_pkts++;
 963                } else if (GetFrameSubType(precv_frame->pkt->data) == WIFI_PROBERSP) {
 964                        if (!memcmp(padapter->eeprompriv.mac_addr,
 965                                    GetAddr1Ptr(precv_frame->pkt->data), ETH_ALEN))
 966                                psta->sta_stats.rx_probersp_pkts++;
 967                        else if (is_broadcast_mac_addr(GetAddr1Ptr(precv_frame->pkt->data)) ||
 968                                 is_multicast_mac_addr(GetAddr1Ptr(precv_frame->pkt->data)))
 969                                psta->sta_stats.rx_probersp_bm_pkts++;
 970                        else
 971                                psta->sta_stats.rx_probersp_uo_pkts++;
 972                }
 973        }
 974
 975        mgt_dispatcher(padapter, precv_frame);
 976
 977        return _SUCCESS;
 978}
 979
 980static int validate_recv_data_frame(struct adapter *adapter,
 981                                    struct recv_frame *precv_frame)
 982{
 983        u8 bretry;
 984        u8 *psa, *pda, *pbssid;
 985        struct sta_info *psta = NULL;
 986        u8 *ptr = precv_frame->pkt->data;
 987        struct rx_pkt_attrib    *pattrib = &precv_frame->attrib;
 988        struct security_priv    *psecuritypriv = &adapter->securitypriv;
 989        int ret = _SUCCESS;
 990
 991        bretry = GetRetry(ptr);
 992        pda = get_da(ptr);
 993        psa = get_sa(ptr);
 994        pbssid = get_hdr_bssid(ptr);
 995
 996        if (!pbssid) {
 997                ret = _FAIL;
 998                goto exit;
 999        }
1000
1001        memcpy(pattrib->dst, pda, ETH_ALEN);
1002        memcpy(pattrib->src, psa, ETH_ALEN);
1003
1004        memcpy(pattrib->bssid, pbssid, ETH_ALEN);
1005
1006        switch (pattrib->to_fr_ds) {
1007        case 0:
1008                memcpy(pattrib->ra, pda, ETH_ALEN);
1009                memcpy(pattrib->ta, psa, ETH_ALEN);
1010                ret = sta2sta_data_frame(adapter, precv_frame, &psta);
1011                break;
1012        case 1:
1013                memcpy(pattrib->ra, pda, ETH_ALEN);
1014                memcpy(pattrib->ta, pbssid, ETH_ALEN);
1015                ret = ap2sta_data_frame(adapter, precv_frame, &psta);
1016                break;
1017        case 2:
1018                memcpy(pattrib->ra, pbssid, ETH_ALEN);
1019                memcpy(pattrib->ta, psa, ETH_ALEN);
1020                ret = sta2ap_data_frame(adapter, precv_frame, &psta);
1021                break;
1022        case 3:
1023                memcpy(pattrib->ra, GetAddr1Ptr(ptr), ETH_ALEN);
1024                memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);
1025                ret = _FAIL;
1026                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" case 3\n"));
1027                break;
1028        default:
1029                ret = _FAIL;
1030                break;
1031        }
1032
1033        if (ret == _FAIL)
1034                goto exit;
1035        else if (ret == RTW_RX_HANDLED)
1036                goto exit;
1037
1038        if (!psta) {
1039                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, (" after to_fr_ds_chk; psta==NULL\n"));
1040                ret = _FAIL;
1041                goto exit;
1042        }
1043
1044        /* psta->rssi = prxcmd->rssi; */
1045        /* psta->signal_quality = prxcmd->sq; */
1046        precv_frame->psta = psta;
1047
1048        pattrib->amsdu = 0;
1049        pattrib->ack_policy = 0;
1050        /* parsing QC field */
1051        if (pattrib->qos == 1) {
1052                pattrib->priority = GetPriority((ptr + 24));
1053                pattrib->ack_policy = GetAckpolicy((ptr + 24));
1054                pattrib->amsdu = GetAMsdu((ptr + 24));
1055                pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 32 : 26;
1056
1057                if (pattrib->priority != 0 && pattrib->priority != 3)
1058                        adapter->recvpriv.bIsAnyNonBEPkts = true;
1059        } else {
1060                pattrib->priority = 0;
1061                pattrib->hdrlen = pattrib->to_fr_ds == 3 ? 30 : 24;
1062        }
1063
1064        if (pattrib->order)/* HT-CTRL 11n */
1065                pattrib->hdrlen += 4;
1066
1067        precv_frame->preorder_ctrl = &psta->recvreorder_ctrl[pattrib->priority];
1068
1069        /*  decache, drop duplicate recv packets */
1070        if (recv_decache(precv_frame, bretry, &psta->sta_recvpriv.rxcache) == _FAIL) {
1071                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("decache : drop pkt\n"));
1072                ret = _FAIL;
1073                goto exit;
1074        }
1075
1076        if (pattrib->privacy) {
1077                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("%s:pattrib->privacy=%x\n", __func__, pattrib->privacy));
1078                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n ^^^^^^^^^^^IS_MCAST(pattrib->ra(0x%02x))=%d^^^^^^^^^^^^^^^6\n", pattrib->ra[0], IS_MCAST(pattrib->ra)));
1079
1080                GET_ENCRY_ALGO(psecuritypriv, psta, pattrib->encrypt, IS_MCAST(pattrib->ra));
1081
1082                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("\n pattrib->encrypt=%d\n", pattrib->encrypt));
1083
1084                SET_ICE_IV_LEN(pattrib->iv_len, pattrib->icv_len, pattrib->encrypt);
1085        } else {
1086                pattrib->encrypt = 0;
1087                pattrib->iv_len = 0;
1088                pattrib->icv_len = 0;
1089        }
1090
1091exit:
1092
1093        return ret;
1094}
1095
1096static int validate_recv_frame(struct adapter *adapter,
1097                               struct recv_frame *precv_frame)
1098{
1099        /* shall check frame subtype, to / from ds, da, bssid */
1100
1101        /* then call check if rx seq/frag. duplicated. */
1102
1103        u8 type;
1104        u8 subtype;
1105        int retval = _SUCCESS;
1106        u8 bDumpRxPkt;
1107        struct rx_pkt_attrib *pattrib = &precv_frame->attrib;
1108        u8 *ptr = precv_frame->pkt->data;
1109        u8  ver = (unsigned char)(*ptr)&0x3;
1110        struct mlme_ext_priv *pmlmeext = &adapter->mlmeextpriv;
1111
1112        if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
1113                int ch_set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, rtw_get_oper_ch(adapter));
1114
1115                if (ch_set_idx >= 0)
1116                        pmlmeext->channel_set[ch_set_idx].rx_count++;
1117        }
1118
1119        /* add version chk */
1120        if (ver != 0) {
1121                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_data_frame fail! (ver!=0)\n"));
1122                retval = _FAIL;
1123                goto exit;
1124        }
1125
1126        type =  GetFrameType(ptr);
1127        subtype = GetFrameSubType(ptr); /* bit(7)~bit(2) */
1128
1129        pattrib->to_fr_ds = get_tofr_ds(ptr);
1130
1131        pattrib->frag_num = GetFragNum(ptr);
1132        pattrib->seq_num = GetSequence(ptr);
1133
1134        pattrib->pw_save = GetPwrMgt(ptr);
1135        pattrib->mfrag = GetMFrag(ptr);
1136        pattrib->mdata = GetMData(ptr);
1137        pattrib->privacy = GetPrivacy(ptr);
1138        pattrib->order = GetOrder(ptr);
1139
1140        /* Dump rx packets */
1141        rtw_hal_get_def_var(adapter, HAL_DEF_DBG_DUMP_RXPKT, &(bDumpRxPkt));
1142        if (bDumpRxPkt == 1) {/* dump all rx packets */
1143                if (_drv_err_ <= GlobalDebugLevel) {
1144                        pr_info(DRIVER_PREFIX "#############################\n");
1145                        print_hex_dump(KERN_INFO, DRIVER_PREFIX, DUMP_PREFIX_NONE,
1146                                        16, 1, ptr, 64, false);
1147                        pr_info(DRIVER_PREFIX "#############################\n");
1148                }
1149        } else if (bDumpRxPkt == 2) {
1150                if ((_drv_err_ <= GlobalDebugLevel) && (type == WIFI_MGT_TYPE)) {
1151                        pr_info(DRIVER_PREFIX "#############################\n");
1152                        print_hex_dump(KERN_INFO, DRIVER_PREFIX, DUMP_PREFIX_NONE,
1153                                        16, 1, ptr, 64, false);
1154                        pr_info(DRIVER_PREFIX "#############################\n");
1155                }
1156        } else if (bDumpRxPkt == 3) {
1157                if ((_drv_err_ <= GlobalDebugLevel) && (type == WIFI_DATA_TYPE)) {
1158                        pr_info(DRIVER_PREFIX "#############################\n");
1159                        print_hex_dump(KERN_INFO, DRIVER_PREFIX, DUMP_PREFIX_NONE,
1160                                        16, 1, ptr, 64, false);
1161                        pr_info(DRIVER_PREFIX "#############################\n");
1162                }
1163        }
1164        switch (type) {
1165        case WIFI_MGT_TYPE: /* mgnt */
1166                retval = validate_recv_mgnt_frame(adapter, precv_frame);
1167                if (retval == _FAIL)
1168                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_mgnt_frame fail\n"));
1169                retval = _FAIL; /*  only data frame return _SUCCESS */
1170                break;
1171        case WIFI_CTRL_TYPE: /* ctrl */
1172                retval = validate_recv_ctrl_frame(adapter, precv_frame);
1173                if (retval == _FAIL)
1174                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_ctrl_frame fail\n"));
1175                retval = _FAIL; /*  only data frame return _SUCCESS */
1176                break;
1177        case WIFI_DATA_TYPE: /* data */
1178                LedControl8188eu(adapter, LED_CTL_RX);
1179                pattrib->qos = (subtype & BIT(7)) ? 1 : 0;
1180                retval = validate_recv_data_frame(adapter, precv_frame);
1181                if (retval == _FAIL) {
1182                        struct recv_priv *precvpriv = &adapter->recvpriv;
1183
1184                        precvpriv->rx_drop++;
1185                }
1186                break;
1187        default:
1188                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("validate_recv_data_frame fail! type= 0x%x\n", type));
1189                retval = _FAIL;
1190                break;
1191        }
1192
1193        /*
1194         * This is the last moment before management and control frames get
1195         * discarded. So we need to forward them to the monitor now or never.
1196         *
1197         * At the same time data frames can still be encrypted if software
1198         * decryption is in use. However, decryption can occur not until later
1199         * (see recv_func()).
1200         *
1201         * Hence forward the frame to the monitor anyway to preserve the order
1202         * in which frames were received.
1203         */
1204        rtl88eu_mon_recv_hook(adapter->pmondev, precv_frame);
1205
1206exit:
1207
1208        return retval;
1209}
1210
1211/* remove the wlanhdr and add the eth_hdr */
1212
1213static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
1214{
1215        int     rmv_len;
1216        u16     eth_type, len;
1217        __be16 be_tmp;
1218        u8      bsnaphdr;
1219        u8      *psnap_type;
1220        struct ieee80211_snap_hdr       *psnap;
1221
1222        u8 *ptr = precvframe->pkt->data;
1223        struct rx_pkt_attrib *pattrib = &precvframe->attrib;
1224
1225        if (pattrib->encrypt)
1226                skb_trim(precvframe->pkt, precvframe->pkt->len - pattrib->icv_len);
1227
1228        psnap = (struct ieee80211_snap_hdr *)(ptr+pattrib->hdrlen + pattrib->iv_len);
1229        psnap_type = ptr+pattrib->hdrlen + pattrib->iv_len+SNAP_SIZE;
1230        /* convert hdr + possible LLC headers into Ethernet header */
1231        if ((!memcmp(psnap, rtw_rfc1042_header, SNAP_SIZE) &&
1232             (!memcmp(psnap_type, SNAP_ETH_TYPE_IPX, 2) == false) &&
1233             (!memcmp(psnap_type, SNAP_ETH_TYPE_APPLETALK_AARP, 2) == false)) ||
1234             !memcmp(psnap, rtw_bridge_tunnel_header, SNAP_SIZE)) {
1235                /* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
1236                bsnaphdr = true;
1237        } else {
1238                /* Leave Ethernet header part of hdr and full payload */
1239                bsnaphdr = false;
1240        }
1241
1242        rmv_len = pattrib->hdrlen + pattrib->iv_len + (bsnaphdr ? SNAP_SIZE : 0);
1243        len = precvframe->pkt->len - rmv_len;
1244
1245        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_,
1246                 ("\n===pattrib->hdrlen: %x,  pattrib->iv_len:%x===\n\n", pattrib->hdrlen,  pattrib->iv_len));
1247
1248        memcpy(&be_tmp, ptr+rmv_len, 2);
1249        eth_type = ntohs(be_tmp); /* pattrib->ether_type */
1250        pattrib->eth_type = eth_type;
1251
1252        ptr = skb_pull(precvframe->pkt, rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0));
1253        if (!ptr)
1254                return _FAIL;
1255
1256        memcpy(ptr, pattrib->dst, ETH_ALEN);
1257        memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN);
1258
1259        if (!bsnaphdr) {
1260                be_tmp = htons(len);
1261                memcpy(ptr+12, &be_tmp, 2);
1262        }
1263
1264        return _SUCCESS;
1265}
1266
1267/* perform defrag */
1268static struct recv_frame *recvframe_defrag(struct adapter *adapter,
1269                                           struct __queue *defrag_q)
1270{
1271        struct list_head *plist, *phead;
1272        u8 wlanhdr_offset;
1273        u8      curfragnum;
1274        struct recv_frame *pfhdr, *pnfhdr;
1275        struct recv_frame *prframe, *pnextrframe;
1276        struct __queue *pfree_recv_queue;
1277
1278        curfragnum = 0;
1279        pfree_recv_queue = &adapter->recvpriv.free_recv_queue;
1280
1281        phead = get_list_head(defrag_q);
1282        plist = phead->next;
1283        pfhdr = list_entry(plist, struct recv_frame, list);
1284        prframe = pfhdr;
1285        list_del_init(&(prframe->list));
1286
1287        if (curfragnum != pfhdr->attrib.frag_num) {
1288                /* the first fragment number must be 0 */
1289                /* free the whole queue */
1290                rtw_free_recvframe(prframe, pfree_recv_queue);
1291                rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
1292
1293                return NULL;
1294        }
1295
1296        curfragnum++;
1297
1298        plist = get_list_head(defrag_q);
1299
1300        plist = plist->next;
1301
1302        while (phead != plist) {
1303                pnfhdr = list_entry(plist, struct recv_frame, list);
1304                pnextrframe = pnfhdr;
1305
1306                /* check the fragment sequence  (2nd ~n fragment frame) */
1307
1308                if (curfragnum != pnfhdr->attrib.frag_num) {
1309                        /* the fragment number must be increasing  (after decache) */
1310                        /* release the defrag_q & prframe */
1311                        rtw_free_recvframe(prframe, pfree_recv_queue);
1312                        rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
1313                        return NULL;
1314                }
1315
1316                curfragnum++;
1317
1318                /* copy the 2nd~n fragment frame's payload to the first fragment */
1319                /* get the 2nd~last fragment frame's payload */
1320
1321                wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
1322
1323                skb_pull(pnextrframe->pkt, wlanhdr_offset);
1324
1325                /* append  to first fragment frame's tail (if privacy frame, pull the ICV) */
1326                skb_trim(prframe->pkt, prframe->pkt->len - pfhdr->attrib.icv_len);
1327
1328                /* memcpy */
1329                memcpy(skb_tail_pointer(pfhdr->pkt), pnfhdr->pkt->data,
1330                       pnfhdr->pkt->len);
1331
1332                skb_put(prframe->pkt, pnfhdr->pkt->len);
1333
1334                pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
1335                plist = plist->next;
1336        }
1337
1338        /* free the defrag_q queue and return the prframe */
1339        rtw_free_recvframe_queue(defrag_q, pfree_recv_queue);
1340
1341        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("Performance defrag!!!!!\n"));
1342
1343        return prframe;
1344}
1345
1346/* check if need to defrag, if needed queue the frame to defrag_q */
1347struct recv_frame *recvframe_chk_defrag(struct adapter *padapter,
1348                                        struct recv_frame *precv_frame)
1349{
1350        u8      ismfrag;
1351        u8      fragnum;
1352        u8      *psta_addr;
1353        struct recv_frame *pfhdr;
1354        struct sta_info *psta;
1355        struct sta_priv *pstapriv;
1356        struct list_head *phead;
1357        struct recv_frame *prtnframe = NULL;
1358        struct __queue *pfree_recv_queue, *pdefrag_q;
1359
1360        pstapriv = &padapter->stapriv;
1361
1362        pfhdr = precv_frame;
1363
1364        pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
1365
1366        /* need to define struct of wlan header frame ctrl */
1367        ismfrag = pfhdr->attrib.mfrag;
1368        fragnum = pfhdr->attrib.frag_num;
1369
1370        psta_addr = pfhdr->attrib.ta;
1371        psta = rtw_get_stainfo(pstapriv, psta_addr);
1372        if (!psta) {
1373                u8 type = GetFrameType(pfhdr->pkt->data);
1374
1375                if (type != WIFI_DATA_TYPE) {
1376                        psta = rtw_get_bcmc_stainfo(padapter);
1377                        pdefrag_q = &psta->sta_recvpriv.defrag_q;
1378                } else {
1379                        pdefrag_q = NULL;
1380                }
1381        } else {
1382                pdefrag_q = &psta->sta_recvpriv.defrag_q;
1383        }
1384
1385        if ((ismfrag == 0) && (fragnum == 0))
1386                prtnframe = precv_frame;/* isn't a fragment frame */
1387
1388        if (ismfrag == 1) {
1389                /* 0~(n-1) fragment frame */
1390                /* enqueue to defraf_g */
1391                if (pdefrag_q) {
1392                        if (fragnum == 0) {
1393                                /* the first fragment */
1394                                if (!list_empty(&pdefrag_q->queue))
1395                                        /* free current defrag_q */
1396                                        rtw_free_recvframe_queue(pdefrag_q, pfree_recv_queue);
1397                        }
1398
1399                        /* Then enqueue the 0~(n-1) fragment into the defrag_q */
1400
1401                        phead = get_list_head(pdefrag_q);
1402                        list_add_tail(&pfhdr->list, phead);
1403
1404                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("Enqueuq: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1405
1406                        prtnframe = NULL;
1407                } else {
1408                        /* can't find this ta's defrag_queue, so free this recv_frame */
1409                        rtw_free_recvframe(precv_frame, pfree_recv_queue);
1410                        prtnframe = NULL;
1411                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("Free because pdefrag_q==NULL: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1412                }
1413        }
1414
1415        if ((ismfrag == 0) && (fragnum != 0)) {
1416                /* the last fragment frame */
1417                /* enqueue the last fragment */
1418                if (pdefrag_q) {
1419                        phead = get_list_head(pdefrag_q);
1420                        list_add_tail(&pfhdr->list, phead);
1421
1422                        /* call recvframe_defrag to defrag */
1423                        RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("defrag: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1424                        precv_frame = recvframe_defrag(padapter, pdefrag_q);
1425                        prtnframe = precv_frame;
1426                } else {
1427                        /* can't find this ta's defrag_queue, so free this recv_frame */
1428                        rtw_free_recvframe(precv_frame, pfree_recv_queue);
1429                        prtnframe = NULL;
1430                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("Free because pdefrag_q==NULL: ismfrag=%d, fragnum=%d\n", ismfrag, fragnum));
1431                }
1432        }
1433
1434        if ((prtnframe != NULL) && (prtnframe->attrib.privacy)) {
1435                /* after defrag we must check tkip mic code */
1436                if (recvframe_chkmic(padapter,  prtnframe) == _FAIL) {
1437                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recvframe_chkmic(padapter,  prtnframe)==_FAIL\n"));
1438                        rtw_free_recvframe(prtnframe, pfree_recv_queue);
1439                        prtnframe = NULL;
1440                }
1441        }
1442
1443        return prtnframe;
1444}
1445
1446static int amsdu_to_msdu(struct adapter *padapter, struct recv_frame *prframe)
1447{
1448        int     a_len, padding_len;
1449        u16     eth_type, nSubframe_Length;
1450        u8      nr_subframes, i;
1451        unsigned char *pdata;
1452        struct rx_pkt_attrib *pattrib;
1453        struct sk_buff *sub_skb, *subframes[MAX_SUBFRAME_COUNT];
1454        struct recv_priv *precvpriv = &padapter->recvpriv;
1455        struct __queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
1456
1457        nr_subframes = 0;
1458        pattrib = &prframe->attrib;
1459
1460        skb_pull(prframe->pkt, prframe->attrib.hdrlen);
1461
1462        if (prframe->attrib.iv_len > 0)
1463                skb_pull(prframe->pkt, prframe->attrib.iv_len);
1464
1465        a_len = prframe->pkt->len;
1466
1467        pdata = prframe->pkt->data;
1468
1469        while (a_len > ETH_HLEN) {
1470                /* Offset 12 denote 2 mac address */
1471                nSubframe_Length = get_unaligned_be16(pdata + 12);
1472
1473                if (a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
1474                        DBG_88E("nRemain_Length is %d and nSubframe_Length is : %d\n", a_len, nSubframe_Length);
1475                        goto exit;
1476                }
1477
1478                /* move the data point to data content */
1479                pdata += ETH_HLEN;
1480                a_len -= ETH_HLEN;
1481
1482                /* Allocate new skb for releasing to upper layer */
1483                sub_skb = dev_alloc_skb(nSubframe_Length + 12);
1484                if (sub_skb) {
1485                        skb_reserve(sub_skb, 12);
1486                        skb_put_data(sub_skb, pdata, nSubframe_Length);
1487                } else {
1488                        sub_skb = skb_clone(prframe->pkt, GFP_ATOMIC);
1489                        if (sub_skb) {
1490                                sub_skb->data = pdata;
1491                                sub_skb->len = nSubframe_Length;
1492                                skb_set_tail_pointer(sub_skb, nSubframe_Length);
1493                        } else {
1494                                DBG_88E("skb_clone() Fail!!! , nr_subframes=%d\n", nr_subframes);
1495                                break;
1496                        }
1497                }
1498
1499                subframes[nr_subframes++] = sub_skb;
1500
1501                if (nr_subframes >= MAX_SUBFRAME_COUNT) {
1502                        DBG_88E("ParseSubframe(): Too many Subframes! Packets dropped!\n");
1503                        break;
1504                }
1505
1506                pdata += nSubframe_Length;
1507                a_len -= nSubframe_Length;
1508                if (a_len != 0) {
1509                        padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & (4-1));
1510                        if (padding_len == 4)
1511                                padding_len = 0;
1512
1513                        if (a_len < padding_len)
1514                                goto exit;
1515
1516                        pdata += padding_len;
1517                        a_len -= padding_len;
1518                }
1519        }
1520
1521        for (i = 0; i < nr_subframes; i++) {
1522                sub_skb = subframes[i];
1523                /* convert hdr + possible LLC headers into Ethernet header */
1524                eth_type = get_unaligned_be16(&sub_skb->data[6]);
1525                if (sub_skb->len >= 8 &&
1526                    ((!memcmp(sub_skb->data, rtw_rfc1042_header, SNAP_SIZE) &&
1527                          eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
1528                         !memcmp(sub_skb->data, rtw_bridge_tunnel_header, SNAP_SIZE))) {
1529                        /* remove RFC1042 or Bridge-Tunnel encapsulation and replace EtherType */
1530                        skb_pull(sub_skb, SNAP_SIZE);
1531                        memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
1532                        memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
1533                } else {
1534                        __be16 len;
1535                        /* Leave Ethernet header part of hdr and full payload */
1536                        len = htons(sub_skb->len);
1537                        memcpy(skb_push(sub_skb, 2), &len, 2);
1538                        memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src, ETH_ALEN);
1539                        memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst, ETH_ALEN);
1540                }
1541
1542                /* Indicate the packets to upper layer */
1543                /*  Insert NAT2.5 RX here! */
1544                sub_skb->protocol = eth_type_trans(sub_skb, padapter->pnetdev);
1545                sub_skb->dev = padapter->pnetdev;
1546
1547                sub_skb->ip_summed = CHECKSUM_NONE;
1548
1549                netif_rx(sub_skb);
1550        }
1551
1552exit:
1553        rtw_free_recvframe(prframe, pfree_recv_queue);/* free this recv_frame */
1554
1555        return _SUCCESS;
1556}
1557
1558static int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl, u16 seq_num)
1559{
1560        u8      wsize = preorder_ctrl->wsize_b;
1561        u16     wend = (preorder_ctrl->indicate_seq + wsize - 1) & 0xFFF;/*  4096; */
1562
1563        /*  Rx Reorder initialize condition. */
1564        if (preorder_ctrl->indicate_seq == 0xFFFF)
1565                preorder_ctrl->indicate_seq = seq_num;
1566
1567        /*  Drop out the packet which SeqNum is smaller than WinStart */
1568        if (SN_LESS(seq_num, preorder_ctrl->indicate_seq))
1569                return false;
1570
1571        /*  */
1572        /*  Sliding window manipulation. Conditions includes: */
1573        /*  1. Incoming SeqNum is equal to WinStart =>Window shift 1 */
1574        /*  2. Incoming SeqNum is larger than the WinEnd => Window shift N */
1575        /*  */
1576        if (SN_EQUAL(seq_num, preorder_ctrl->indicate_seq)) {
1577                preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
1578        } else if (SN_LESS(wend, seq_num)) {
1579                if (seq_num >= (wsize - 1))
1580                        preorder_ctrl->indicate_seq = seq_num + 1 - wsize;
1581                else
1582                        preorder_ctrl->indicate_seq = 0xFFF - (wsize - (seq_num + 1)) + 1;
1583        }
1584
1585        return true;
1586}
1587
1588static int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl,
1589                                     struct recv_frame *prframe)
1590{
1591        struct rx_pkt_attrib *pattrib = &prframe->attrib;
1592        struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1593        struct list_head *phead, *plist;
1594        struct recv_frame *hdr;
1595        struct rx_pkt_attrib *pnextattrib;
1596
1597        phead = get_list_head(ppending_recvframe_queue);
1598        plist = phead->next;
1599
1600        while (phead != plist) {
1601                hdr = list_entry(plist, struct recv_frame, list);
1602                pnextattrib = &hdr->attrib;
1603
1604                if (SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
1605                        plist = plist->next;
1606                else if (SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
1607                        return false;
1608                else
1609                        break;
1610        }
1611
1612        list_del_init(&(prframe->list));
1613
1614        list_add_tail(&(prframe->list), plist);
1615        return true;
1616}
1617
1618static int recv_indicatepkts_in_order(struct adapter *padapter, struct recv_reorder_ctrl *preorder_ctrl, int bforced)
1619{
1620        struct list_head *phead, *plist;
1621        struct recv_frame *prframe;
1622        struct recv_frame *prhdr;
1623        struct rx_pkt_attrib *pattrib;
1624        int bPktInBuf = false;
1625        struct recv_priv *precvpriv = &padapter->recvpriv;
1626        struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1627
1628        phead =         get_list_head(ppending_recvframe_queue);
1629        plist = phead->next;
1630
1631        /*  Handling some condition for forced indicate case. */
1632        if (bforced) {
1633                if (list_empty(phead))
1634                        return true;
1635
1636                prhdr = list_entry(plist, struct recv_frame, list);
1637                pattrib = &prhdr->attrib;
1638                preorder_ctrl->indicate_seq = pattrib->seq_num;
1639        }
1640
1641        /*  Prepare indication list and indication. */
1642        /*  Check if there is any packet need indicate. */
1643        while (!list_empty(phead)) {
1644                prhdr = list_entry(plist, struct recv_frame, list);
1645                prframe = prhdr;
1646                pattrib = &prframe->attrib;
1647
1648                if (!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num)) {
1649                        RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
1650                                 ("%s: indicate=%d seq=%d amsdu=%d\n",
1651                                  __func__, preorder_ctrl->indicate_seq, pattrib->seq_num, pattrib->amsdu));
1652                        plist = plist->next;
1653                        list_del_init(&(prframe->list));
1654
1655                        if (SN_EQUAL(preorder_ctrl->indicate_seq, pattrib->seq_num))
1656                                preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1) & 0xFFF;
1657
1658                        /* Set this as a lock to make sure that only one thread is indicating packet. */
1659
1660                        /* indicate this recv_frame */
1661                        if (!pattrib->amsdu) {
1662                                if ((!padapter->bDriverStopped) &&
1663                                    (!padapter->bSurpriseRemoved))
1664                                        rtw_recv_indicatepkt(padapter, prframe);/* indicate this recv_frame */
1665                        } else if (pattrib->amsdu == 1) {
1666                                if (amsdu_to_msdu(padapter, prframe) != _SUCCESS)
1667                                        rtw_free_recvframe(prframe, &precvpriv->free_recv_queue);
1668                        } else {
1669                                /* error condition; */
1670                        }
1671
1672                        /* Update local variables. */
1673                        bPktInBuf = false;
1674                } else {
1675                        bPktInBuf = true;
1676                        break;
1677                }
1678        }
1679        return bPktInBuf;
1680}
1681
1682static int recv_indicatepkt_reorder(struct adapter *padapter,
1683                                    struct recv_frame *prframe)
1684{
1685        int retval = _SUCCESS;
1686        struct rx_pkt_attrib *pattrib = &prframe->attrib;
1687        struct recv_reorder_ctrl *preorder_ctrl = prframe->preorder_ctrl;
1688        struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1689
1690        if (!pattrib->amsdu) {
1691                /* s1. */
1692                wlanhdr_to_ethhdr(prframe);
1693
1694                if ((pattrib->qos != 1) || (pattrib->eth_type == 0x0806) ||
1695                    (pattrib->ack_policy != 0)) {
1696                        if ((!padapter->bDriverStopped) &&
1697                            (!padapter->bSurpriseRemoved)) {
1698                                RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@  %s -recv_func recv_indicatepkt\n", __func__));
1699
1700                                rtw_recv_indicatepkt(padapter, prframe);
1701                                return _SUCCESS;
1702                        }
1703
1704                        return _FAIL;
1705                }
1706
1707                if (!preorder_ctrl->enable) {
1708                        /* indicate this recv_frame */
1709                        preorder_ctrl->indicate_seq = pattrib->seq_num;
1710                        rtw_recv_indicatepkt(padapter, prframe);
1711
1712                        preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
1713                        return _SUCCESS;
1714                }
1715        } else if (pattrib->amsdu == 1) { /* temp filter -> means didn't support A-MSDUs in a A-MPDU */
1716                if (!preorder_ctrl->enable) {
1717                        preorder_ctrl->indicate_seq = pattrib->seq_num;
1718                        retval = amsdu_to_msdu(padapter, prframe);
1719
1720                        preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq + 1)%4096;
1721                        return retval;
1722                }
1723        }
1724
1725        spin_lock_bh(&ppending_recvframe_queue->lock);
1726
1727        RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_,
1728                 ("%s: indicate=%d seq=%d\n", __func__,
1729                  preorder_ctrl->indicate_seq, pattrib->seq_num));
1730
1731        /* s2. check if winstart_b(indicate_seq) needs to been updated */
1732        if (!check_indicate_seq(preorder_ctrl, pattrib->seq_num)) {
1733                rtw_recv_indicatepkt(padapter, prframe);
1734
1735                spin_unlock_bh(&ppending_recvframe_queue->lock);
1736
1737                goto _success_exit;
1738        }
1739
1740        /* s3. Insert all packet into Reorder Queue to maintain its ordering. */
1741        if (!enqueue_reorder_recvframe(preorder_ctrl, prframe))
1742                goto _err_exit;
1743
1744        /* s4. */
1745        /*  Indication process. */
1746        /*  After Packet dropping and Sliding Window shifting as above, we can now just indicate the packets */
1747        /*  with the SeqNum smaller than latest WinStart and buffer other packets. */
1748        /*  */
1749        /*  For Rx Reorder condition: */
1750        /*  1. All packets with SeqNum smaller than WinStart => Indicate */
1751        /*  2. All packets with SeqNum larger than or equal to WinStart => Buffer it. */
1752        /*  */
1753
1754        /* recv_indicatepkts_in_order(padapter, preorder_ctrl, true); */
1755        if (recv_indicatepkts_in_order(padapter, preorder_ctrl, false)) {
1756                mod_timer(&preorder_ctrl->reordering_ctrl_timer,
1757                          jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
1758                spin_unlock_bh(&ppending_recvframe_queue->lock);
1759        } else {
1760                spin_unlock_bh(&ppending_recvframe_queue->lock);
1761                del_timer_sync(&preorder_ctrl->reordering_ctrl_timer);
1762        }
1763
1764_success_exit:
1765
1766        return _SUCCESS;
1767
1768_err_exit:
1769
1770        spin_unlock_bh(&ppending_recvframe_queue->lock);
1771
1772        return _FAIL;
1773}
1774
1775void rtw_reordering_ctrl_timeout_handler(struct timer_list *t)
1776{
1777        struct recv_reorder_ctrl *preorder_ctrl = from_timer(preorder_ctrl, t,
1778                                                           reordering_ctrl_timer);
1779        struct adapter *padapter = preorder_ctrl->padapter;
1780        struct __queue *ppending_recvframe_queue = &preorder_ctrl->pending_recvframe_queue;
1781
1782        if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1783                return;
1784
1785        spin_lock_bh(&ppending_recvframe_queue->lock);
1786
1787        if (recv_indicatepkts_in_order(padapter, preorder_ctrl, true) == true)
1788                mod_timer(&preorder_ctrl->reordering_ctrl_timer,
1789                          jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
1790
1791        spin_unlock_bh(&ppending_recvframe_queue->lock);
1792}
1793
1794static int process_recv_indicatepkts(struct adapter *padapter,
1795                                     struct recv_frame *prframe)
1796{
1797        int retval = _SUCCESS;
1798        struct mlme_priv        *pmlmepriv = &padapter->mlmepriv;
1799        struct ht_priv  *phtpriv = &pmlmepriv->htpriv;
1800
1801        if (phtpriv->ht_option) {  /* B/G/N Mode */
1802                if (recv_indicatepkt_reorder(padapter, prframe) != _SUCCESS) {
1803                        /*  including perform A-MPDU Rx Ordering Buffer Control */
1804                        if ((!padapter->bDriverStopped) &&
1805                            (!padapter->bSurpriseRemoved)) {
1806                                retval = _FAIL;
1807                                return retval;
1808                        }
1809                }
1810        } else { /* B/G mode */
1811                retval = wlanhdr_to_ethhdr(prframe);
1812                if (retval != _SUCCESS) {
1813                        RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("wlanhdr_to_ethhdr: drop pkt\n"));
1814                        return retval;
1815                }
1816
1817                if ((!padapter->bDriverStopped) &&
1818                    (!padapter->bSurpriseRemoved)) {
1819                        /* indicate this recv_frame */
1820                        RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ %s- recv_func recv_indicatepkt\n", __func__));
1821                        rtw_recv_indicatepkt(padapter, prframe);
1822                } else {
1823                        RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("@@@@ %s- recv_func free_indicatepkt\n", __func__));
1824
1825                        RT_TRACE(_module_rtl871x_recv_c_, _drv_notice_, ("recv_func:bDriverStopped(%d) OR bSurpriseRemoved(%d)", padapter->bDriverStopped, padapter->bSurpriseRemoved));
1826                        retval = _FAIL;
1827                        return retval;
1828                }
1829        }
1830
1831        return retval;
1832}
1833
1834static int recv_func_prehandle(struct adapter *padapter,
1835                               struct recv_frame *rframe)
1836{
1837        int ret = _SUCCESS;
1838        struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
1839
1840        /* check the frame crtl field and decache */
1841        ret = validate_recv_frame(padapter, rframe);
1842        if (ret != _SUCCESS) {
1843                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("recv_func: validate_recv_frame fail! drop pkt\n"));
1844                rtw_free_recvframe(rframe, pfree_recv_queue);/* free this recv_frame */
1845                goto exit;
1846        }
1847
1848exit:
1849        return ret;
1850}
1851
1852static int recv_func_posthandle(struct adapter *padapter,
1853                                struct recv_frame *prframe)
1854{
1855        int ret = _SUCCESS;
1856        struct recv_frame *orig_prframe = prframe;
1857        struct recv_priv *precvpriv = &padapter->recvpriv;
1858        struct __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
1859
1860        /*  DATA FRAME */
1861        LedControl8188eu(padapter, LED_CTL_RX);
1862
1863        prframe = decryptor(padapter, prframe);
1864        if (!prframe) {
1865                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("decryptor: drop pkt\n"));
1866                ret = _FAIL;
1867                goto _recv_data_drop;
1868        }
1869
1870        prframe = recvframe_chk_defrag(padapter, prframe);
1871        if (!prframe) {
1872                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recvframe_chk_defrag: drop pkt\n"));
1873                goto _recv_data_drop;
1874        }
1875
1876        prframe = portctrl(padapter, prframe);
1877        if (!prframe) {
1878                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("portctrl: drop pkt\n"));
1879                ret = _FAIL;
1880                goto _recv_data_drop;
1881        }
1882
1883        count_rx_stats(padapter, prframe, NULL);
1884
1885        ret = process_recv_indicatepkts(padapter, prframe);
1886        if (ret != _SUCCESS) {
1887                RT_TRACE(_module_rtl871x_recv_c_, _drv_err_, ("recv_func: process_recv_indicatepkts fail!\n"));
1888                rtw_free_recvframe(orig_prframe, pfree_recv_queue);/* free this recv_frame */
1889                goto _recv_data_drop;
1890        }
1891        return ret;
1892
1893_recv_data_drop:
1894        precvpriv->rx_drop++;
1895        return ret;
1896}
1897
1898static int recv_func(struct adapter *padapter, struct recv_frame *rframe)
1899{
1900        int ret;
1901        struct rx_pkt_attrib *prxattrib = &rframe->attrib;
1902        struct security_priv *psecuritypriv = &padapter->securitypriv;
1903        struct mlme_priv *mlmepriv = &padapter->mlmepriv;
1904
1905        /* check if need to handle uc_swdec_pending_queue*/
1906        if (check_fwstate(mlmepriv, WIFI_STATION_STATE) && psecuritypriv->busetkipkey) {
1907                struct recv_frame *pending_frame;
1908
1909                while ((pending_frame = rtw_alloc_recvframe(&padapter->recvpriv.uc_swdec_pending_queue))) {
1910                        if (recv_func_posthandle(padapter, pending_frame) == _SUCCESS)
1911                                DBG_88E("%s: dequeue uc_swdec_pending_queue\n", __func__);
1912                }
1913        }
1914
1915        ret = recv_func_prehandle(padapter, rframe);
1916
1917        if (ret == _SUCCESS) {
1918                /* check if need to enqueue into uc_swdec_pending_queue*/
1919                if (check_fwstate(mlmepriv, WIFI_STATION_STATE) &&
1920                    !IS_MCAST(prxattrib->ra) && prxattrib->encrypt > 0 &&
1921                    prxattrib->bdecrypted == 0 &&
1922                    !is_wep_enc(psecuritypriv->dot11PrivacyAlgrthm) &&
1923                    !psecuritypriv->busetkipkey) {
1924                        rtw_enqueue_recvframe(rframe, &padapter->recvpriv.uc_swdec_pending_queue);
1925                        DBG_88E("%s: no key, enqueue uc_swdec_pending_queue\n", __func__);
1926                        goto exit;
1927                }
1928
1929                ret = recv_func_posthandle(padapter, rframe);
1930        }
1931
1932exit:
1933        return ret;
1934}
1935
1936s32 rtw_recv_entry(struct recv_frame *precvframe)
1937{
1938        struct adapter *padapter;
1939        struct recv_priv *precvpriv;
1940        s32 ret = _SUCCESS;
1941
1942        padapter = precvframe->adapter;
1943
1944        precvpriv = &padapter->recvpriv;
1945
1946        ret = recv_func(padapter, precvframe);
1947        if (ret == _FAIL) {
1948                RT_TRACE(_module_rtl871x_recv_c_, _drv_info_, ("%s: recv_func return fail!!!\n", __func__));
1949                goto _recv_entry_drop;
1950        }
1951
1952        precvpriv->rx_pkts++;
1953
1954        return ret;
1955
1956_recv_entry_drop:
1957        return ret;
1958}
1959
1960static void rtw_signal_stat_timer_hdl(struct timer_list *t)
1961{
1962        struct adapter *adapter =
1963                from_timer(adapter, t, recvpriv.signal_stat_timer);
1964        struct recv_priv *recvpriv = &adapter->recvpriv;
1965
1966        u32 tmp_s, tmp_q;
1967        u8 avg_signal_strength = 0;
1968        u8 avg_signal_qual = 0;
1969        u8 _alpha = 3; /*  this value is based on converging_constant = 5000 and sampling_interval = 1000 */
1970
1971        if (recvpriv->signal_strength_data.update_req == 0) {
1972                /* update_req is clear, means we got rx */
1973                avg_signal_strength = recvpriv->signal_strength_data.avg_val;
1974                /* after avg_vals are acquired, we can re-stat the signal
1975                 * values
1976                 */
1977                recvpriv->signal_strength_data.update_req = 1;
1978        }
1979
1980        if (recvpriv->signal_qual_data.update_req == 0) {
1981                /* update_req is clear, means we got rx */
1982                avg_signal_qual = recvpriv->signal_qual_data.avg_val;
1983                /* after avg_vals are acquired, we can re-stat the signal
1984                 * values
1985                 */
1986                recvpriv->signal_qual_data.update_req = 1;
1987        }
1988
1989        /* update value of signal_strength, rssi, signal_qual */
1990        if (check_fwstate(&adapter->mlmepriv, _FW_UNDER_SURVEY) == false) {
1991                tmp_s = avg_signal_strength +
1992                        (_alpha - 1) * recvpriv->signal_strength;
1993                tmp_s = DIV_ROUND_UP(tmp_s, _alpha);
1994                if (tmp_s > 100)
1995                        tmp_s = 100;
1996
1997                tmp_q = avg_signal_qual +
1998                        (_alpha - 1) * recvpriv->signal_qual;
1999                tmp_q = DIV_ROUND_UP(tmp_q, _alpha);
2000                if (tmp_q > 100)
2001                        tmp_q = 100;
2002
2003                recvpriv->signal_strength = tmp_s;
2004                recvpriv->rssi = (s8)translate_percentage_to_dbm(tmp_s);
2005                recvpriv->signal_qual = tmp_q;
2006        }
2007
2008        rtw_set_signal_stat_timer(recvpriv);
2009}
2010