drivers/staging/vt6656/dpc.c

   1 /*
   2  * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
   3  * All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * File: dpc.c
  20  *
  21  * Purpose: handle dpc rx functions
  22  *
  23  * Author: Lyndon Chen
  24  *
  25  * Date: May 20, 2003
  26  *
  27  * Functions:
  28  *      device_receive_frame - Rcv 802.11 frame function
  29  *      s_bAPModeRxCtl- AP Rcv frame filer Ctl.
  30  *      s_bAPModeRxData- AP Rcv data frame handle
  31  *      s_bHandleRxEncryption- Rcv decrypted data via on-fly
  32  *      s_bHostWepRxEncryption- Rcv encrypted data via host
  33  *      s_byGetRateIdx- get rate index
  34  *      s_vGetDASA- get data offset
  35  *      s_vProcessRxMACHeader- Rcv 802.11 and translate to 802.3
  36  *
  37  * Revision History:
  38  *
  39  */
  40
  41 #include "device.h"
  42 #include "rxtx.h"
  43 #include "tether.h"
  44 #include "card.h"
  45 #include "bssdb.h"
  46 #include "mac.h"
  47 #include "baseband.h"
  48 #include "michael.h"
  49 #include "tkip.h"
  50 #include "tcrc.h"
  51 #include "wctl.h"
  52 #include "hostap.h"
  53 #include "rf.h"
  54 #include "iowpa.h"
  55 #include "aes_ccmp.h"
  56 #include "datarate.h"
  57 #include "usbpipe.h"
  58
  59 //static int          msglevel                =MSG_LEVEL_DEBUG;
  60 static int          msglevel                =MSG_LEVEL_INFO;
  61
  62 const u8 acbyRxRate[MAX_RATE] =
  63 {2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108};
  64
  65 static u8 s_byGetRateIdx(u8 byRate);
  66
  67 static
  68 void
  69 s_vGetDASA(
  70       u8 * pbyRxBufferAddr,
  71      unsigned int *pcbHeaderSize,
  72      struct ethhdr *psEthHeader
  73     );
  74
  75 static void s_vProcessRxMACHeader(struct vnt_private *pDevice,
  76         u8 *pbyRxBufferAddr, u32 cbPacketSize, int bIsWEP, int bExtIV,
  77         u32 *pcbHeadSize);
  78
  79 static int s_bAPModeRxCtl(struct vnt_private *pDevice, u8 *pbyFrame,
  80         s32 iSANodeIndex);
  81
  82 static int s_bAPModeRxData(struct vnt_private *pDevice, struct sk_buff *skb,
  83         u32 FrameSize, u32 cbHeaderOffset, s32 iSANodeIndex, s32 iDANodeIndex);
  84
  85 static int s_bHandleRxEncryption(struct vnt_private *pDevice, u8 *pbyFrame,
  86         u32 FrameSize, u8 *pbyRsr, u8 *pbyNewRsr, PSKeyItem *pKeyOut,
  87         s32 *pbExtIV, u16 *pwRxTSC15_0, u32 *pdwRxTSC47_16);
  88
  89 static int s_bHostWepRxEncryption(struct vnt_private *pDevice, u8 *pbyFrame,
  90         u32 FrameSize, u8 *pbyRsr, int bOnFly, PSKeyItem pKey, u8 *pbyNewRsr,
  91         s32 *pbExtIV, u16 *pwRxTSC15_0, u32 *pdwRxTSC47_16);
  92
  93 /*+
  94  *
  95  * Description:
  96  *    Translate Rcv 802.11 header to 802.3 header with Rx buffer
  97  *
  98  * Parameters:
  99  *  In:
 100  *      pDevice
 101  *      dwRxBufferAddr  - Address of Rcv Buffer
 102  *      cbPacketSize    - Rcv Packet size
 103  *      bIsWEP          - If Rcv with WEP
 104  *  Out:
 105  *      pcbHeaderSize   - 802.11 header size
 106  *
 107  * Return Value: None
 108  *
 109 -*/
 110
 111 static void s_vProcessRxMACHeader(struct vnt_private *pDevice,
 112         u8 *pbyRxBufferAddr, u32 cbPacketSize, int bIsWEP, int bExtIV,
 113         u32 *pcbHeadSize)
 114 {
 115         u8 *pbyRxBuffer;
 116         u32 cbHeaderSize = 0;
 117         u16 *pwType;
 118         struct ieee80211_hdr *pMACHeader;
 119         int ii;
 120
 121     pMACHeader = (struct ieee80211_hdr *) (pbyRxBufferAddr + cbHeaderSize);
 122
 123     s_vGetDASA((u8 *)pMACHeader, &cbHeaderSize, &pDevice->sRxEthHeader);
 124
 125     if (bIsWEP) {
 126         if (bExtIV) {
 127             // strip IV&ExtIV , add 8 byte
 128             cbHeaderSize += (WLAN_HDR_ADDR3_LEN + 8);
 129         } else {
 130             // strip IV , add 4 byte
 131             cbHeaderSize += (WLAN_HDR_ADDR3_LEN + 4);
 132         }
 133     }
 134     else {
 135         cbHeaderSize += WLAN_HDR_ADDR3_LEN;
 136     };
 137
 138     pbyRxBuffer = (u8 *) (pbyRxBufferAddr + cbHeaderSize);
 139     if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_Bridgetunnel[0])) {
 140         cbHeaderSize += 6;
 141     } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
 142         cbHeaderSize += 6;
 143         pwType = (u16 *) (pbyRxBufferAddr + cbHeaderSize);
 144         if ((*pwType == cpu_to_be16(ETH_P_IPX)) ||
 145             (*pwType == cpu_to_le16(0xF380))) {
 146                 cbHeaderSize -= 8;
 147             pwType = (u16 *) (pbyRxBufferAddr + cbHeaderSize);
 148             if (bIsWEP) {
 149                 if (bExtIV) {
 150                     *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 8);    // 8 is IV&ExtIV
 151                 } else {
 152                     *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 4);    // 4 is IV
 153                 }
 154             }
 155             else {
 156                 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN);
 157             }
 158         }
 159     }
 160     else {
 161         cbHeaderSize -= 2;
 162         pwType = (u16 *) (pbyRxBufferAddr + cbHeaderSize);
 163         if (bIsWEP) {
 164             if (bExtIV) {
 165                 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 8);    // 8 is IV&ExtIV
 166             } else {
 167                 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 4);    // 4 is IV
 168             }
 169         }
 170         else {
 171             *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN);
 172         }
 173     }
 174
 175     cbHeaderSize -= (ETH_ALEN * 2);
 176     pbyRxBuffer = (u8 *) (pbyRxBufferAddr + cbHeaderSize);
 177     for (ii = 0; ii < ETH_ALEN; ii++)
 178         *pbyRxBuffer++ = pDevice->sRxEthHeader.h_dest[ii];
 179     for (ii = 0; ii < ETH_ALEN; ii++)
 180         *pbyRxBuffer++ = pDevice->sRxEthHeader.h_source[ii];
 181
 182     *pcbHeadSize = cbHeaderSize;
 183 }
 184
 185 static u8 s_byGetRateIdx(u8 byRate)
 186 {
 187     u8    byRateIdx;
 188
 189     for (byRateIdx = 0; byRateIdx <MAX_RATE ; byRateIdx++) {
 190         if (acbyRxRate[byRateIdx%MAX_RATE] == byRate)
 191             return byRateIdx;
 192     }
 193     return 0;
 194 }
 195
 196 static
 197 void
 198 s_vGetDASA (
 199       u8 * pbyRxBufferAddr,
 200      unsigned int *pcbHeaderSize,
 201      struct ethhdr *psEthHeader
 202     )
 203 {
 204         unsigned int            cbHeaderSize = 0;
 205         struct ieee80211_hdr *pMACHeader;
 206         int             ii;
 207
 208         pMACHeader = (struct ieee80211_hdr *) (pbyRxBufferAddr + cbHeaderSize);
 209
 210         if ((pMACHeader->frame_control & FC_TODS) == 0) {
 211                 if (pMACHeader->frame_control & FC_FROMDS) {
 212                         for (ii = 0; ii < ETH_ALEN; ii++) {
 213                                 psEthHeader->h_dest[ii] =
 214                                         pMACHeader->addr1[ii];
 215                                 psEthHeader->h_source[ii] =
 216                                         pMACHeader->addr3[ii];
 217                         }
 218                 } else {
 219                         /* IBSS mode */
 220                         for (ii = 0; ii < ETH_ALEN; ii++) {
 221                                 psEthHeader->h_dest[ii] =
 222                                         pMACHeader->addr1[ii];
 223                                 psEthHeader->h_source[ii] =
 224                                         pMACHeader->addr2[ii];
 225                         }
 226                 }
 227         } else {
 228                 /* Is AP mode.. */
 229                 if (pMACHeader->frame_control & FC_FROMDS) {
 230                         for (ii = 0; ii < ETH_ALEN; ii++) {
 231                                 psEthHeader->h_dest[ii] =
 232                                         pMACHeader->addr3[ii];
 233                                 psEthHeader->h_source[ii] =
 234                                         pMACHeader->addr4[ii];
 235                                 cbHeaderSize += 6;
 236                         }
 237                 } else {
 238                         for (ii = 0; ii < ETH_ALEN; ii++) {
 239                                 psEthHeader->h_dest[ii] =
 240                                         pMACHeader->addr3[ii];
 241                                 psEthHeader->h_source[ii] =
 242                                         pMACHeader->addr2[ii];
 243                         }
 244                 }
 245         };
 246     *pcbHeaderSize = cbHeaderSize;
 247 }
 248
 249 int RXbBulkInProcessData(struct vnt_private *pDevice, PRCB pRCB,
 250         unsigned long BytesToIndicate)
 251 {
 252         struct net_device_stats *pStats = &pDevice->stats;
 253         struct sk_buff *skb;
 254         struct vnt_manager *pMgmt = &pDevice->vnt_mgmt;
 255         struct vnt_rx_mgmt *pRxPacket = &pMgmt->sRxPacket;
 256         struct ieee80211_hdr *p802_11Header;
 257         u8 *pbyRsr, *pbyNewRsr, *pbyRSSI, *pbyFrame;
 258         u64 *pqwTSFTime;
 259         u32 bDeFragRx = false;
 260         u32 cbHeaderOffset, cbIVOffset;
 261         u32 FrameSize;
 262         u16 wEtherType = 0;
 263         s32 iSANodeIndex = -1, iDANodeIndex = -1;
 264         int ii;
 265         u8 *pbyRxSts, *pbyRxRate, *pbySQ, *pby3SQ;
 266         u32 cbHeaderSize;
 267         PSKeyItem pKey = NULL;
 268         u16 wRxTSC15_0 = 0;
 269         u32 dwRxTSC47_16 = 0;
 270         SKeyItem STempKey;
 271         /* signed long ldBm = 0; */
 272         int bIsWEP = false; int bExtIV = false;
 273         u32 dwWbkStatus;
 274         PRCB pRCBIndicate = pRCB;
 275         u8 *pbyDAddress;
 276         u16 *pwPLCP_Length;
 277         u8 abyVaildRate[MAX_RATE]
 278                 = {2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108};
 279         u16 wPLCPwithPadding;
 280         struct ieee80211_hdr *pMACHeader;
 281         int bRxeapol_key = false;
 282
 283     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---------- RXbBulkInProcessData---\n");
 284
 285     skb = pRCB->skb;
 286
 287         /* [31:16]RcvByteCount ( not include 4-byte Status ) */
 288         dwWbkStatus = *((u32 *)(skb->data));
 289         FrameSize = dwWbkStatus >> 16;
 290         FrameSize += 4;
 291
 292         if (BytesToIndicate != FrameSize) {
 293                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"------- WRONG Length 1\n");
 294                 return false;
 295         }
 296
 297     if ((BytesToIndicate > 2372) || (BytesToIndicate <= 40)) {
 298         // Frame Size error drop this packet.
 299         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "---------- WRONG Length 2\n");
 300         return false;
 301     }
 302
 303     pbyDAddress = (u8 *)(skb->data);
 304     pbyRxSts = pbyDAddress+4;
 305     pbyRxRate = pbyDAddress+5;
 306
 307     //real Frame Size = USBFrameSize -4WbkStatus - 4RxStatus - 8TSF - 4RSR - 4SQ3 - ?Padding
 308     //if SQ3 the range is 24~27, if no SQ3 the range is 20~23
 309     //real Frame size in PLCPLength field.
 310     pwPLCP_Length = (u16 *) (pbyDAddress + 6);
 311     //Fix hardware bug => PLCP_Length error
 312     if ( ((BytesToIndicate - (*pwPLCP_Length)) > 27) ||
 313          ((BytesToIndicate - (*pwPLCP_Length)) < 24) ||
 314          (BytesToIndicate < (*pwPLCP_Length)) ) {
 315
 316         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Wrong PLCP Length %x\n", (int) *pwPLCP_Length);
 317         ASSERT(0);
 318         return false;
 319     }
 320     for ( ii=RATE_1M;ii<MAX_RATE;ii++) {
 321         if ( *pbyRxRate == abyVaildRate[ii] ) {
 322             break;
 323         }
 324     }
 325     if ( ii==MAX_RATE ) {
 326         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Wrong RxRate %x\n",(int) *pbyRxRate);
 327         return false;
 328     }
 329
 330     wPLCPwithPadding = ( (*pwPLCP_Length / 4) + ( (*pwPLCP_Length % 4) ? 1:0 ) ) *4;
 331
 332         pqwTSFTime = (u64 *)(pbyDAddress + 8 + wPLCPwithPadding);
 333   if(pDevice->byBBType == BB_TYPE_11G)  {
 334       pby3SQ = pbyDAddress + 8 + wPLCPwithPadding + 12;
 335       pbySQ = pby3SQ;
 336     }
 337   else {
 338    pbySQ = pbyDAddress + 8 + wPLCPwithPadding + 8;
 339    pby3SQ = pbySQ;
 340   }
 341     pbyNewRsr = pbyDAddress + 8 + wPLCPwithPadding + 9;
 342     pbyRSSI = pbyDAddress + 8 + wPLCPwithPadding + 10;
 343     pbyRsr = pbyDAddress + 8 + wPLCPwithPadding + 11;
 344
 345     FrameSize = *pwPLCP_Length;
 346
 347     pbyFrame = pbyDAddress + 8;
 348     // update receive statistic counter
 349
 350     STAvUpdateRDStatCounter(&pDevice->scStatistic,
 351                             *pbyRsr,
 352                             *pbyNewRsr,
 353                             *pbyRxSts,
 354                             *pbyRxRate,
 355                             pbyFrame,
 356                             FrameSize
 357                             );
 358
 359     pMACHeader = (struct ieee80211_hdr *) pbyFrame;
 360
 361 //mike add: to judge if current AP is activated?
 362     if ((pMgmt->eCurrMode == WMAC_MODE_STANDBY) ||
 363         (pMgmt->eCurrMode == WMAC_MODE_ESS_STA)) {
 364        if (pMgmt->sNodeDBTable[0].bActive) {
 365          if (!compare_ether_addr(pMgmt->abyCurrBSSID, pMACHeader->addr2)) {
 366             if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
 367                   pMgmt->sNodeDBTable[0].uInActiveCount = 0;
 368            }
 369        }
 370     }
 371
 372     if (!is_multicast_ether_addr(pMACHeader->addr1)) {
 373         if (WCTLbIsDuplicate(&(pDevice->sDupRxCache), (struct ieee80211_hdr *) pbyFrame)) {
 374             pDevice->s802_11Counter.FrameDuplicateCount++;
 375             return false;
 376         }
 377
 378         if (compare_ether_addr(pDevice->abyCurrentNetAddr,
 379                                pMACHeader->addr1)) {
 380                 return false;
 381         }
 382     }
 383
 384     // Use for TKIP MIC
 385     s_vGetDASA(pbyFrame, &cbHeaderSize, &pDevice->sRxEthHeader);
 386
 387     if (!compare_ether_addr((u8 *)&(pDevice->sRxEthHeader.h_source[0]),
 388                             pDevice->abyCurrentNetAddr))
 389         return false;
 390
 391     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) || (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)) {
 392         if (IS_CTL_PSPOLL(pbyFrame) || !IS_TYPE_CONTROL(pbyFrame)) {
 393             p802_11Header = (struct ieee80211_hdr *) (pbyFrame);
 394             // get SA NodeIndex
 395             if (BSSbIsSTAInNodeDB(pDevice, (u8 *)(p802_11Header->addr2), &iSANodeIndex)) {
 396                 pMgmt->sNodeDBTable[iSANodeIndex].ulLastRxJiffer = jiffies;
 397                 pMgmt->sNodeDBTable[iSANodeIndex].uInActiveCount = 0;
 398             }
 399         }
 400     }
 401
 402     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
 403         if (s_bAPModeRxCtl(pDevice, pbyFrame, iSANodeIndex) == true) {
 404             return false;
 405         }
 406     }
 407
 408     if (IS_FC_WEP(pbyFrame)) {
 409         bool     bRxDecryOK = false;
 410
 411         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"rx WEP pkt\n");
 412         bIsWEP = true;
 413         if ((pDevice->bEnableHostWEP) && (iSANodeIndex >= 0)) {
 414             pKey = &STempKey;
 415             pKey->byCipherSuite = pMgmt->sNodeDBTable[iSANodeIndex].byCipherSuite;
 416             pKey->dwKeyIndex = pMgmt->sNodeDBTable[iSANodeIndex].dwKeyIndex;
 417             pKey->uKeyLength = pMgmt->sNodeDBTable[iSANodeIndex].uWepKeyLength;
 418             pKey->dwTSC47_16 = pMgmt->sNodeDBTable[iSANodeIndex].dwTSC47_16;
 419             pKey->wTSC15_0 = pMgmt->sNodeDBTable[iSANodeIndex].wTSC15_0;
 420             memcpy(pKey->abyKey,
 421                 &pMgmt->sNodeDBTable[iSANodeIndex].abyWepKey[0],
 422                 pKey->uKeyLength
 423                 );
 424
 425             bRxDecryOK = s_bHostWepRxEncryption(pDevice,
 426                                                 pbyFrame,
 427                                                 FrameSize,
 428                                                 pbyRsr,
 429                                                 pMgmt->sNodeDBTable[iSANodeIndex].bOnFly,
 430                                                 pKey,
 431                                                 pbyNewRsr,
 432                                                 &bExtIV,
 433                                                 &wRxTSC15_0,
 434                                                 &dwRxTSC47_16);
 435         } else {
 436             bRxDecryOK = s_bHandleRxEncryption(pDevice,
 437                                                 pbyFrame,
 438                                                 FrameSize,
 439                                                 pbyRsr,
 440                                                 pbyNewRsr,
 441                                                 &pKey,
 442                                                 &bExtIV,
 443                                                 &wRxTSC15_0,
 444                                                 &dwRxTSC47_16);
 445         }
 446
 447         if (bRxDecryOK) {
 448             if ((*pbyNewRsr & NEWRSR_DECRYPTOK) == 0) {
 449                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV Fail\n");
 450                 if ( (pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
 451                     (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
 452                     (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) ||
 453                     (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
 454                     (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {
 455
 456                     if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_TKIP)) {
 457                         pDevice->s802_11Counter.TKIPICVErrors++;
 458                     } else if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_CCMP)) {
 459                         pDevice->s802_11Counter.CCMPDecryptErrors++;
 460                     } else if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_WEP)) {
 461 //                      pDevice->s802_11Counter.WEPICVErrorCount.QuadPart++;
 462                     }
 463                 }
 464                 return false;
 465             }
 466         } else {
 467             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"WEP Func Fail\n");
 468             return false;
 469         }
 470         if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_CCMP))
 471             FrameSize -= 8;         // Message Integrity Code
 472         else
 473             FrameSize -= 4;         // 4 is ICV
 474     }
 475
 476     //
 477     // RX OK
 478     //
 479     /* remove the FCS/CRC length */
 480     FrameSize -= ETH_FCS_LEN;
 481
 482     if ( !(*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) && // unicast address
 483         (IS_FRAGMENT_PKT((pbyFrame)))
 484         ) {
 485         // defragment
 486         bDeFragRx = WCTLbHandleFragment(pDevice, (struct ieee80211_hdr *) (pbyFrame), FrameSize, bIsWEP, bExtIV);
 487         pDevice->s802_11Counter.ReceivedFragmentCount++;
 488         if (bDeFragRx) {
 489             // defrag complete
 490             // TODO skb, pbyFrame
 491             skb = pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx].skb;
 492             FrameSize = pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx].cbFrameLength;
 493             pbyFrame = skb->data + 8;
 494         }
 495         else {
 496             return false;
 497         }
 498     }
 499
 500     //
 501     // Management & Control frame Handle
 502     //
 503     if ((IS_TYPE_DATA((pbyFrame))) == false) {
 504         // Handle Control & Manage Frame
 505
 506         if (IS_TYPE_MGMT((pbyFrame))) {
 507             u8 * pbyData1;
 508             u8 * pbyData2;
 509
 510             pRxPacket = &(pRCB->sMngPacket);
 511             pRxPacket->p80211Header = (PUWLAN_80211HDR)(pbyFrame);
 512             pRxPacket->cbMPDULen = FrameSize;
 513             pRxPacket->uRSSI = *pbyRSSI;
 514             pRxPacket->bySQ = *pbySQ;
 515                 pRxPacket->qwLocalTSF = cpu_to_le64(*pqwTSFTime);
 516             if (bIsWEP) {
 517                 // strip IV
 518                 pbyData1 = WLAN_HDR_A3_DATA_PTR(pbyFrame);
 519                 pbyData2 = WLAN_HDR_A3_DATA_PTR(pbyFrame) + 4;
 520                 for (ii = 0; ii < (FrameSize - 4); ii++) {
 521                     *pbyData1 = *pbyData2;
 522                      pbyData1++;
 523                      pbyData2++;
 524                 }
 525             }
 526
 527             pRxPacket->byRxRate = s_byGetRateIdx(*pbyRxRate);
 528
 529             if ( *pbyRxSts == 0 ) {
 530                 //Discard beacon packet which channel is 0
 531                 if ( (WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) == WLAN_FSTYPE_BEACON) ||
 532                      (WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) == WLAN_FSTYPE_PROBERESP) ) {
 533                         return false;
 534                 }
 535             }
 536             pRxPacket->byRxChannel = (*pbyRxSts) >> 2;
 537
 538             // hostap Deamon handle 802.11 management
 539             if (pDevice->bEnableHostapd) {
 540                     skb->dev = pDevice->apdev;
 541                     //skb->data += 4;
 542                     //skb->tail += 4;
 543                     skb->data += 8;
 544                     skb->tail += 8;
 545                 skb_put(skb, FrameSize);
 546                 skb_reset_mac_header(skb);
 547                     skb->pkt_type = PACKET_OTHERHOST;
 548                 skb->protocol = htons(ETH_P_802_2);
 549                     memset(skb->cb, 0, sizeof(skb->cb));
 550                     netif_rx(skb);
 551                 return true;
 552                 }
 553
 554             //
 555             // Insert the RCB in the Recv Mng list
 556             //
 557             EnqueueRCB(pDevice->FirstRecvMngList, pDevice->LastRecvMngList, pRCBIndicate);
 558             pDevice->NumRecvMngList++;
 559             if ( bDeFragRx == false) {
 560                 pRCB->Ref++;
 561             }
 562             if (pDevice->bIsRxMngWorkItemQueued == false) {
 563                 pDevice->bIsRxMngWorkItemQueued = true;
 564                 tasklet_schedule(&pDevice->RxMngWorkItem);
 565             }
 566
 567         }
 568         else {
 569             // Control Frame
 570         };
 571         return false;
 572     }
 573     else {
 574         if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
 575             //In AP mode, hw only check addr1(BSSID or RA) if equal to local MAC.
 576             if ( !(*pbyRsr & RSR_BSSIDOK)) {
 577                 if (bDeFragRx) {
 578                     if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
 579                         DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
 580                         pDevice->dev->name);
 581                     }
 582                 }
 583                 return false;
 584             }
 585         }
 586         else {
 587             // discard DATA packet while not associate || BSSID error
 588             if ((pDevice->bLinkPass == false) ||
 589                 !(*pbyRsr & RSR_BSSIDOK)) {
 590                 if (bDeFragRx) {
 591                     if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
 592                         DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
 593                         pDevice->dev->name);
 594                     }
 595                 }
 596                 return false;
 597             }
 598    //mike add:station mode check eapol-key challenge--->
 599           {
 600             u8  Protocol_Version;    //802.1x Authentication
 601             u8  Packet_Type;           //802.1x Authentication
 602             u8  Descriptor_type;
 603              u16 Key_info;
 604               if (bIsWEP)
 605                   cbIVOffset = 8;
 606               else
 607                   cbIVOffset = 0;
 608               wEtherType = (skb->data[cbIVOffset + 8 + 24 + 6] << 8) |
 609                           skb->data[cbIVOffset + 8 + 24 + 6 + 1];
 610               Protocol_Version = skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1];
 611               Packet_Type = skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1];
 612              if (wEtherType == ETH_P_PAE) {         //Protocol Type in LLC-Header
 613                   if(((Protocol_Version==1) ||(Protocol_Version==2)) &&
 614                      (Packet_Type==3)) {  //802.1x OR eapol-key challenge frame receive
 615                         bRxeapol_key = true;
 616                       Descriptor_type = skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1+1+2];
 617                       Key_info = (skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1+1+2+1]<<8) |skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1+1+2+2] ;
 618                       if(Descriptor_type==2) {    //RSN
 619                          //  printk("WPA2_Rx_eapol-key_info<-----:%x\n",Key_info);
 620                       }
 621                      else  if(Descriptor_type==254) {
 622                         //  printk("WPA_Rx_eapol-key_info<-----:%x\n",Key_info);
 623                      }
 624                   }
 625               }
 626           }
 627     //mike add:station mode check eapol-key challenge<---
 628         }
 629     }
 630
 631 // Data frame Handle
 632
 633     if (pDevice->bEnablePSMode) {
 634         if (IS_FC_MOREDATA((pbyFrame))) {
 635             if (*pbyRsr & RSR_ADDROK) {
 636                 //PSbSendPSPOLL((PSDevice)pDevice);
 637             }
 638         }
 639         else {
 640             if (pMgmt->bInTIMWake == true) {
 641                 pMgmt->bInTIMWake = false;
 642             }
 643         }
 644     }
 645
 646     // Now it only supports 802.11g Infrastructure Mode, and support rate must up to 54 Mbps
 647     if (pDevice->bDiversityEnable && (FrameSize>50) &&
 648        (pDevice->eOPMode == OP_MODE_INFRASTRUCTURE) &&
 649        (pDevice->bLinkPass == true)) {
 650         BBvAntennaDiversity(pDevice, s_byGetRateIdx(*pbyRxRate), 0);
 651     }
 652
 653     // ++++++++ For BaseBand Algorithm +++++++++++++++
 654     pDevice->uCurrRSSI = *pbyRSSI;
 655     pDevice->byCurrSQ = *pbySQ;
 656
 657     // todo
 658 /*
 659     if ((*pbyRSSI != 0) &&
 660         (pMgmt->pCurrBSS!=NULL)) {
 661         RFvRSSITodBm(pDevice, *pbyRSSI, &ldBm);
 662         // Monitor if RSSI is too strong.
 663         pMgmt->pCurrBSS->byRSSIStatCnt++;
 664         pMgmt->pCurrBSS->byRSSIStatCnt %= RSSI_STAT_COUNT;
 665         pMgmt->pCurrBSS->ldBmAverage[pMgmt->pCurrBSS->byRSSIStatCnt] = ldBm;
 666         for (ii = 0; ii < RSSI_STAT_COUNT; ii++) {
 667                 if (pMgmt->pCurrBSS->ldBmAverage[ii] != 0) {
 668                         pMgmt->pCurrBSS->ldBmMAX =
 669                                 max(pMgmt->pCurrBSS->ldBmAverage[ii], ldBm);
 670                 }
 671         }
 672     }
 673 */
 674
 675     // -----------------------------------------------
 676
 677     if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnable8021x == true)){
 678         u8    abyMacHdr[24];
 679
 680         // Only 802.1x packet incoming allowed
 681         if (bIsWEP)
 682             cbIVOffset = 8;
 683         else
 684             cbIVOffset = 0;
 685         wEtherType = (skb->data[cbIVOffset + 8 + 24 + 6] << 8) |
 686                     skb->data[cbIVOffset + 8 + 24 + 6 + 1];
 687
 688             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wEtherType = %04x \n", wEtherType);
 689         if (wEtherType == ETH_P_PAE) {
 690             skb->dev = pDevice->apdev;
 691
 692             if (bIsWEP == true) {
 693                 // strip IV header(8)
 694                 memcpy(&abyMacHdr[0], (skb->data + 8), 24);
 695                 memcpy((skb->data + 8 + cbIVOffset), &abyMacHdr[0], 24);
 696             }
 697
 698             skb->data +=  (cbIVOffset + 8);
 699             skb->tail +=  (cbIVOffset + 8);
 700             skb_put(skb, FrameSize);
 701             skb_reset_mac_header(skb);
 702             skb->pkt_type = PACKET_OTHERHOST;
 703             skb->protocol = htons(ETH_P_802_2);
 704             memset(skb->cb, 0, sizeof(skb->cb));
 705             netif_rx(skb);
 706             return true;
 707
 708         }
 709         // check if 802.1x authorized
 710         if (!(pMgmt->sNodeDBTable[iSANodeIndex].dwFlags & WLAN_STA_AUTHORIZED))
 711             return false;
 712     }
 713
 714     if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_TKIP)) {
 715         if (bIsWEP) {
 716             FrameSize -= 8;  //MIC
 717         }
 718     }
 719
 720     //--------------------------------------------------------------------------------
 721     // Soft MIC
 722     if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_TKIP)) {
 723         if (bIsWEP) {
 724             u32 *          pdwMIC_L;
 725             u32 *          pdwMIC_R;
 726             u32           dwMIC_Priority;
 727             u32           dwMICKey0 = 0, dwMICKey1 = 0;
 728             u32           dwLocalMIC_L = 0;
 729             u32           dwLocalMIC_R = 0;
 730
 731             if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
 732                 dwMICKey0 = cpu_to_le32(*(u32 *)(&pKey->abyKey[24]));
 733                 dwMICKey1 = cpu_to_le32(*(u32 *)(&pKey->abyKey[28]));
 734             }
 735             else {
 736                 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
 737                     dwMICKey0 = cpu_to_le32(*(u32 *)(&pKey->abyKey[16]));
 738                     dwMICKey1 = cpu_to_le32(*(u32 *)(&pKey->abyKey[20]));
 739                 } else if ((pKey->dwKeyIndex & BIT28) == 0) {
 740                     dwMICKey0 = cpu_to_le32(*(u32 *)(&pKey->abyKey[16]));
 741                     dwMICKey1 = cpu_to_le32(*(u32 *)(&pKey->abyKey[20]));
 742                 } else {
 743                     dwMICKey0 = cpu_to_le32(*(u32 *)(&pKey->abyKey[24]));
 744                     dwMICKey1 = cpu_to_le32(*(u32 *)(&pKey->abyKey[28]));
 745                 }
 746             }
 747
 748             MIC_vInit(dwMICKey0, dwMICKey1);
 749             MIC_vAppend((u8 *)&(pDevice->sRxEthHeader.h_dest[0]), 12);
 750             dwMIC_Priority = 0;
 751             MIC_vAppend((u8 *)&dwMIC_Priority, 4);
 752             // 4 is Rcv buffer header, 24 is MAC Header, and 8 is IV and Ext IV.
 753             MIC_vAppend((u8 *)(skb->data + 8 + WLAN_HDR_ADDR3_LEN + 8),
 754                         FrameSize - WLAN_HDR_ADDR3_LEN - 8);
 755             MIC_vGetMIC(&dwLocalMIC_L, &dwLocalMIC_R);
 756             MIC_vUnInit();
 757
 758             pdwMIC_L = (u32 *)(skb->data + 8 + FrameSize);
 759             pdwMIC_R = (u32 *)(skb->data + 8 + FrameSize + 4);
 760
 761             if ((cpu_to_le32(*pdwMIC_L) != dwLocalMIC_L) || (cpu_to_le32(*pdwMIC_R) != dwLocalMIC_R) ||
 762                 (pDevice->bRxMICFail == true)) {
 763                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC comparison is fail!\n");
 764                 pDevice->bRxMICFail = false;
 765                 //pDevice->s802_11Counter.TKIPLocalMICFailures.QuadPart++;
 766                 pDevice->s802_11Counter.TKIPLocalMICFailures++;
 767                 if (bDeFragRx) {
 768                     if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
 769                         DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
 770                             pDevice->dev->name);
 771                     }
 772                 }
 773                                 //send event to wpa_supplicant
 774                                 //if(pDevice->bWPASuppWextEnabled == true)
 775                                 {
 776                                         union iwreq_data wrqu;
 777                                         struct iw_michaelmicfailure ev;
 778                                         int keyidx = pbyFrame[cbHeaderSize+3] >> 6; //top two-bits
 779                                         memset(&ev, 0, sizeof(ev));
 780                                         ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
 781                                         if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
 782                                                         (pMgmt->eCurrState == WMAC_STATE_ASSOC) &&
 783                                                                 (*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) == 0) {
 784                                                 ev.flags |= IW_MICFAILURE_PAIRWISE;
 785                                         } else {
 786                                                 ev.flags |= IW_MICFAILURE_GROUP;
 787                                         }
 788
 789                                         ev.src_addr.sa_family = ARPHRD_ETHER;
 790                                         memcpy(ev.src_addr.sa_data, pMACHeader->addr2, ETH_ALEN);
 791                                         memset(&wrqu, 0, sizeof(wrqu));
 792                                         wrqu.data.length = sizeof(ev);
 793                         PRINT_K("wireless_send_event--->IWEVMICHAELMICFAILURE\n");
 794                                         wireless_send_event(pDevice->dev, IWEVMICHAELMICFAILURE, &wrqu, (char *)&ev);
 795
 796                                 }
 797
 798                 return false;
 799
 800             }
 801         }
 802     } //---end of SOFT MIC-----------------------------------------------------------------------
 803
 804     // ++++++++++ Reply Counter Check +++++++++++++
 805
 806     if ((pKey != NULL) && ((pKey->byCipherSuite == KEY_CTL_TKIP) ||
 807                            (pKey->byCipherSuite == KEY_CTL_CCMP))) {
 808         if (bIsWEP) {
 809             u16        wLocalTSC15_0 = 0;
 810             u32       dwLocalTSC47_16 = 0;
 811             unsigned long long       RSC = 0;
 812             // endian issues
 813             RSC = *((unsigned long long *) &(pKey->KeyRSC));
 814             wLocalTSC15_0 = (u16) RSC;
 815             dwLocalTSC47_16 = (u32) (RSC>>16);
 816
 817             RSC = dwRxTSC47_16;
 818             RSC <<= 16;
 819             RSC += wRxTSC15_0;
 820                 memcpy(&(pKey->KeyRSC), &RSC,  sizeof(u64));
 821
 822                 if (pDevice->vnt_mgmt.eCurrMode == WMAC_MODE_ESS_STA &&
 823                         pDevice->vnt_mgmt.eCurrState == WMAC_STATE_ASSOC) {
 824                         /* check RSC */
 825                 if ( (wRxTSC15_0 < wLocalTSC15_0) &&
 826                      (dwRxTSC47_16 <= dwLocalTSC47_16) &&
 827                      !((dwRxTSC47_16 == 0) && (dwLocalTSC47_16 == 0xFFFFFFFF))) {
 828                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"TSC is illegal~~!\n ");
 829                     if (pKey->byCipherSuite == KEY_CTL_TKIP)
 830                         //pDevice->s802_11Counter.TKIPReplays.QuadPart++;
 831                         pDevice->s802_11Counter.TKIPReplays++;
 832                     else
 833                         //pDevice->s802_11Counter.CCMPReplays.QuadPart++;
 834                         pDevice->s802_11Counter.CCMPReplays++;
 835
 836                     if (bDeFragRx) {
 837                         if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
 838                             DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
 839                                 pDevice->dev->name);
 840                         }
 841                     }
 842                     return false;
 843                 }
 844             }
 845         }
 846     } // ----- End of Reply Counter Check --------------------------
 847
 848     s_vProcessRxMACHeader(pDevice, (u8 *)(skb->data+8), FrameSize, bIsWEP, bExtIV, &cbHeaderOffset);
 849     FrameSize -= cbHeaderOffset;
 850     cbHeaderOffset += 8;        // 8 is Rcv buffer header
 851
 852     // Null data, framesize = 12
 853     if (FrameSize < 12)
 854         return false;
 855
 856     if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
 857         if (s_bAPModeRxData(pDevice,
 858                             skb,
 859                             FrameSize,
 860                             cbHeaderOffset,
 861                             iSANodeIndex,
 862                             iDANodeIndex
 863                             ) == false) {
 864
 865             if (bDeFragRx) {
 866                 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
 867                     DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
 868                     pDevice->dev->name);
 869                 }
 870             }
 871             return false;
 872         }
 873
 874     }
 875
 876         skb->data += cbHeaderOffset;
 877         skb->tail += cbHeaderOffset;
 878     skb_put(skb, FrameSize);
 879     skb->protocol=eth_type_trans(skb, skb->dev);
 880     skb->ip_summed=CHECKSUM_NONE;
 881     pStats->rx_bytes +=skb->len;
 882     pStats->rx_packets++;
 883     netif_rx(skb);
 884     if (bDeFragRx) {
 885         if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
 886             DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
 887                 pDevice->dev->name);
 888         }
 889         return false;
 890     }
 891
 892     return true;
 893 }
 894
 895 static int s_bAPModeRxCtl(struct vnt_private *pDevice, u8 *pbyFrame,
 896         s32 iSANodeIndex)
 897 {
 898         struct vnt_manager *pMgmt = &pDevice->vnt_mgmt;
 899         struct ieee80211_hdr *p802_11Header;
 900         CMD_STATUS Status;
 901
 902     if (IS_CTL_PSPOLL(pbyFrame) || !IS_TYPE_CONTROL(pbyFrame)) {
 903
 904         p802_11Header = (struct ieee80211_hdr *) (pbyFrame);
 905         if (!IS_TYPE_MGMT(pbyFrame)) {
 906
 907             // Data & PS-Poll packet
 908             // check frame class
 909             if (iSANodeIndex > 0) {
 910                 // frame class 3 fliter & checking
 911                 if (pMgmt->sNodeDBTable[iSANodeIndex].eNodeState < NODE_AUTH) {
 912                     // send deauth notification
 913                     // reason = (6) class 2 received from nonauth sta
 914                     vMgrDeAuthenBeginSta(pDevice,
 915                                          pMgmt,
 916                                          (u8 *)(p802_11Header->addr2),
 917                                          (WLAN_MGMT_REASON_CLASS2_NONAUTH),
 918                                          &Status
 919                                          );
 920                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDeAuthenBeginSta 1\n");
 921                     return true;
 922                 }
 923                 if (pMgmt->sNodeDBTable[iSANodeIndex].eNodeState < NODE_ASSOC) {
 924                     // send deassoc notification
 925                     // reason = (7) class 3 received from nonassoc sta
 926                     vMgrDisassocBeginSta(pDevice,
 927                                          pMgmt,
 928                                          (u8 *)(p802_11Header->addr2),
 929                                          (WLAN_MGMT_REASON_CLASS3_NONASSOC),
 930                                          &Status
 931                                          );
 932                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDisassocBeginSta 2\n");
 933                     return true;
 934                 }
 935
 936                 if (pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable) {
 937                     // delcare received ps-poll event
 938                     if (IS_CTL_PSPOLL(pbyFrame)) {
 939                         pMgmt->sNodeDBTable[iSANodeIndex].bRxPSPoll = true;
 940                         bScheduleCommand((void *) pDevice,
 941                                          WLAN_CMD_RX_PSPOLL,
 942                                          NULL);
 943                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: WLAN_CMD_RX_PSPOLL 1\n");
 944                     }
 945                     else {
 946                         // check Data PS state
 947                         // if PW bit off, send out all PS bufferring packets.
 948                         if (!IS_FC_POWERMGT(pbyFrame)) {
 949                             pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable = false;
 950                             pMgmt->sNodeDBTable[iSANodeIndex].bRxPSPoll = true;
 951                                 bScheduleCommand((void *) pDevice,
 952                                                  WLAN_CMD_RX_PSPOLL,
 953                                                  NULL);
 954                             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: WLAN_CMD_RX_PSPOLL 2\n");
 955                         }
 956                     }
 957                 }
 958                 else {
 959                    if (IS_FC_POWERMGT(pbyFrame)) {
 960                        pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable = true;
 961                        // Once if STA in PS state, enable multicast bufferring
 962                        pMgmt->sNodeDBTable[0].bPSEnable = true;
 963                    }
 964                    else {
 965                       // clear all pending PS frame.
 966                       if (pMgmt->sNodeDBTable[iSANodeIndex].wEnQueueCnt > 0) {
 967                           pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable = false;
 968                           pMgmt->sNodeDBTable[iSANodeIndex].bRxPSPoll = true;
 969                         bScheduleCommand((void *) pDevice,
 970                                          WLAN_CMD_RX_PSPOLL,
 971                                          NULL);
 972                          DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: WLAN_CMD_RX_PSPOLL 3\n");
 973
 974                       }
 975                    }
 976                 }
 977             }
 978             else {
 979                   vMgrDeAuthenBeginSta(pDevice,
 980                                        pMgmt,
 981                                        (u8 *)(p802_11Header->addr2),
 982                                        (WLAN_MGMT_REASON_CLASS2_NONAUTH),
 983                                        &Status
 984                                        );
 985                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDeAuthenBeginSta 3\n");
 986                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BSSID:%pM\n",
 987                                 p802_11Header->addr3);
 988                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR2:%pM\n",
 989                                 p802_11Header->addr2);
 990                         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR1:%pM\n",
 991                                 p802_11Header->addr1);
 992                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: frame_control= %x\n", p802_11Header->frame_control);
 993                     return true;
 994             }
 995         }
 996     }
 997     return false;
 998
 999 }
1000
1001 static int s_bHandleRxEncryption(struct vnt_private *pDevice, u8 *pbyFrame,
1002         u32 FrameSize, u8 *pbyRsr, u8 *pbyNewRsr, PSKeyItem *pKeyOut,
1003         s32 *pbExtIV, u16 *pwRxTSC15_0, u32 *pdwRxTSC47_16)
1004 {
1005         struct vnt_manager *pMgmt = &pDevice->vnt_mgmt;
1006         u32 PayloadLen = FrameSize;
1007         u8 *pbyIV;
1008         u8 byKeyIdx;
1009         PSKeyItem pKey = NULL;
1010         u8 byDecMode = KEY_CTL_WEP;
1011
1012     *pwRxTSC15_0 = 0;
1013     *pdwRxTSC47_16 = 0;
1014
1015     pbyIV = pbyFrame + WLAN_HDR_ADDR3_LEN;
1016     if ( WLAN_GET_FC_TODS(*(u16 *)pbyFrame) &&
1017          WLAN_GET_FC_FROMDS(*(u16 *)pbyFrame) ) {
1018          pbyIV += 6;             // 6 is 802.11 address4
1019          PayloadLen -= 6;
1020     }
1021     byKeyIdx = (*(pbyIV+3) & 0xc0);
1022     byKeyIdx >>= 6;
1023     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\nKeyIdx: %d\n", byKeyIdx);
1024
1025     if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
1026         (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
1027         (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) ||
1028         (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
1029         (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {
1030         if (((*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) == 0) &&
1031             (pMgmt->byCSSPK != KEY_CTL_NONE)) {
1032             // unicast pkt use pairwise key
1033             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"unicast pkt\n");
1034             if (KeybGetKey(&(pDevice->sKey), pDevice->abyBSSID, 0xFFFFFFFF, &pKey) == true) {
1035                 if (pMgmt->byCSSPK == KEY_CTL_TKIP)
1036                     byDecMode = KEY_CTL_TKIP;
1037                 else if (pMgmt->byCSSPK == KEY_CTL_CCMP)
1038                     byDecMode = KEY_CTL_CCMP;
1039             }
1040             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"unicast pkt: %d, %p\n", byDecMode, pKey);
1041         } else {
1042             // use group key
1043             KeybGetKey(&(pDevice->sKey), pDevice->abyBSSID, byKeyIdx, &pKey);
1044             if (pMgmt->byCSSGK == KEY_CTL_TKIP)
1045                 byDecMode = KEY_CTL_TKIP;
1046             else if (pMgmt->byCSSGK == KEY_CTL_CCMP)
1047                 byDecMode = KEY_CTL_CCMP;
1048             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"group pkt: %d, %d, %p\n", byKeyIdx, byDecMode, pKey);
1049         }
1050     }
1051     // our WEP only support Default Key
1052     if (pKey == NULL) {
1053         // use default group key
1054         KeybGetKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, byKeyIdx, &pKey);
1055         if (pMgmt->byCSSGK == KEY_CTL_TKIP)
1056             byDecMode = KEY_CTL_TKIP;
1057         else if (pMgmt->byCSSGK == KEY_CTL_CCMP)
1058             byDecMode = KEY_CTL_CCMP;
1059     }
1060     *pKeyOut = pKey;
1061
1062     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"AES:%d %d %d\n", pMgmt->byCSSPK, pMgmt->byCSSGK, byDecMode);
1063
1064     if (pKey == NULL) {
1065         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey == NULL\n");
1066         if (byDecMode == KEY_CTL_WEP) {
1067 //            pDevice->s802_11Counter.WEPUndecryptableCount.QuadPart++;
1068         } else if (pDevice->bLinkPass == true) {
1069 //            pDevice->s802_11Counter.DecryptFailureCount.QuadPart++;
1070         }
1071         return false;
1072     }
1073     if (byDecMode != pKey->byCipherSuite) {
1074         if (byDecMode == KEY_CTL_WEP) {
1075 //            pDevice->s802_11Counter.WEPUndecryptableCount.QuadPart++;
1076         } else if (pDevice->bLinkPass == true) {
1077 //            pDevice->s802_11Counter.DecryptFailureCount.QuadPart++;
1078         }
1079         *pKeyOut = NULL;
1080         return false;
1081     }
1082     if (byDecMode == KEY_CTL_WEP) {
1083         // handle WEP
1084         if ((pDevice->byLocalID <= REV_ID_VT3253_A1) ||
1085                 (((PSKeyTable)(pKey->pvKeyTable))->bSoftWEP == true)) {
1086             // Software WEP
1087             // 1. 3253A
1088             // 2. WEP 256
1089
1090             PayloadLen -= (WLAN_HDR_ADDR3_LEN + 4 + 4); // 24 is 802.11 header,4 is IV, 4 is crc
1091             memcpy(pDevice->abyPRNG, pbyIV, 3);
1092             memcpy(pDevice->abyPRNG + 3, pKey->abyKey, pKey->uKeyLength);
1093             rc4_init(&pDevice->SBox, pDevice->abyPRNG, pKey->uKeyLength + 3);
1094             rc4_encrypt(&pDevice->SBox, pbyIV+4, pbyIV+4, PayloadLen);
1095
1096             if (ETHbIsBufferCrc32Ok(pbyIV+4, PayloadLen)) {
1097                 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1098             }
1099         }
1100     } else if ((byDecMode == KEY_CTL_TKIP) ||
1101                (byDecMode == KEY_CTL_CCMP)) {
1102         // TKIP/AES
1103
1104         PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
1105         *pdwRxTSC47_16 = cpu_to_le32(*(u32 *)(pbyIV + 4));
1106         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %x\n", *pdwRxTSC47_16);
1107         if (byDecMode == KEY_CTL_TKIP) {
1108             *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV));
1109         } else {
1110             *pwRxTSC15_0 = cpu_to_le16(*(u16 *)pbyIV);
1111         }
1112         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"TSC0_15: %x\n", *pwRxTSC15_0);
1113
1114         if ((byDecMode == KEY_CTL_TKIP) &&
1115             (pDevice->byLocalID <= REV_ID_VT3253_A1)) {
1116             // Software TKIP
1117             // 1. 3253 A
1118             struct ieee80211_hdr *pMACHeader = (struct ieee80211_hdr *) (pbyFrame);
1119             TKIPvMixKey(pKey->abyKey, pMACHeader->addr2, *pwRxTSC15_0, *pdwRxTSC47_16, pDevice->abyPRNG);
1120             rc4_init(&pDevice->SBox, pDevice->abyPRNG, TKIP_KEY_LEN);
1121             rc4_encrypt(&pDevice->SBox, pbyIV+8, pbyIV+8, PayloadLen);
1122             if (ETHbIsBufferCrc32Ok(pbyIV+8, PayloadLen)) {
1123                 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1124                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV OK!\n");
1125             } else {
1126                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV FAIL!!!\n");
1127                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"PayloadLen = %d\n", PayloadLen);
1128             }
1129         }
1130     }// end of TKIP/AES
1131
1132     if ((*(pbyIV+3) & 0x20) != 0)
1133         *pbExtIV = true;
1134     return true;
1135 }
1136
1137 static int s_bHostWepRxEncryption(struct vnt_private *pDevice, u8 *pbyFrame,
1138         u32 FrameSize, u8 *pbyRsr, int bOnFly, PSKeyItem pKey, u8 *pbyNewRsr,
1139         s32 *pbExtIV, u16 *pwRxTSC15_0, u32 *pdwRxTSC47_16)
1140 {
1141         struct vnt_manager *pMgmt = &pDevice->vnt_mgmt;
1142         struct ieee80211_hdr *pMACHeader;
1143         u32 PayloadLen = FrameSize;
1144         u8 *pbyIV;
1145         u8 byKeyIdx;
1146         u8 byDecMode = KEY_CTL_WEP;
1147
1148         *pwRxTSC15_0 = 0;
1149         *pdwRxTSC47_16 = 0;
1150
1151     pbyIV = pbyFrame + WLAN_HDR_ADDR3_LEN;
1152     if ( WLAN_GET_FC_TODS(*(u16 *)pbyFrame) &&
1153          WLAN_GET_FC_FROMDS(*(u16 *)pbyFrame) ) {
1154          pbyIV += 6;             // 6 is 802.11 address4
1155          PayloadLen -= 6;
1156     }
1157     byKeyIdx = (*(pbyIV+3) & 0xc0);
1158     byKeyIdx >>= 6;
1159     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\nKeyIdx: %d\n", byKeyIdx);
1160
1161     if (pMgmt->byCSSGK == KEY_CTL_TKIP)
1162         byDecMode = KEY_CTL_TKIP;
1163     else if (pMgmt->byCSSGK == KEY_CTL_CCMP)
1164         byDecMode = KEY_CTL_CCMP;
1165
1166     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"AES:%d %d %d\n", pMgmt->byCSSPK, pMgmt->byCSSGK, byDecMode);
1167
1168     if (byDecMode != pKey->byCipherSuite) {
1169         if (byDecMode == KEY_CTL_WEP) {
1170 //            pDevice->s802_11Counter.WEPUndecryptableCount.QuadPart++;
1171         } else if (pDevice->bLinkPass == true) {
1172 //            pDevice->s802_11Counter.DecryptFailureCount.QuadPart++;
1173         }
1174         return false;
1175     }
1176
1177     if (byDecMode == KEY_CTL_WEP) {
1178         // handle WEP
1179         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"byDecMode == KEY_CTL_WEP\n");
1180         if ((pDevice->byLocalID <= REV_ID_VT3253_A1) ||
1181                 (((PSKeyTable)(pKey->pvKeyTable))->bSoftWEP == true) ||
1182             (bOnFly == false)) {
1183             // Software WEP
1184             // 1. 3253A
1185             // 2. WEP 256
1186             // 3. NotOnFly
1187
1188             PayloadLen -= (WLAN_HDR_ADDR3_LEN + 4 + 4); // 24 is 802.11 header,4 is IV, 4 is crc
1189             memcpy(pDevice->abyPRNG, pbyIV, 3);
1190             memcpy(pDevice->abyPRNG + 3, pKey->abyKey, pKey->uKeyLength);
1191             rc4_init(&pDevice->SBox, pDevice->abyPRNG, pKey->uKeyLength + 3);
1192             rc4_encrypt(&pDevice->SBox, pbyIV+4, pbyIV+4, PayloadLen);
1193
1194             if (ETHbIsBufferCrc32Ok(pbyIV+4, PayloadLen)) {
1195                 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1196             }
1197         }
1198     } else if ((byDecMode == KEY_CTL_TKIP) ||
1199                (byDecMode == KEY_CTL_CCMP)) {
1200         // TKIP/AES
1201
1202         PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
1203         *pdwRxTSC47_16 = cpu_to_le32(*(u32 *)(pbyIV + 4));
1204         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %x\n", *pdwRxTSC47_16);
1205
1206         if (byDecMode == KEY_CTL_TKIP) {
1207             *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV));
1208         } else {
1209             *pwRxTSC15_0 = cpu_to_le16(*(u16 *)pbyIV);
1210         }
1211         DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"TSC0_15: %x\n", *pwRxTSC15_0);
1212
1213         if (byDecMode == KEY_CTL_TKIP) {
1214
1215             if ((pDevice->byLocalID <= REV_ID_VT3253_A1) || (bOnFly == false)) {
1216                 // Software TKIP
1217                 // 1. 3253 A
1218                 // 2. NotOnFly
1219                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"soft KEY_CTL_TKIP \n");
1220                 pMACHeader = (struct ieee80211_hdr *) (pbyFrame);
1221                 TKIPvMixKey(pKey->abyKey, pMACHeader->addr2, *pwRxTSC15_0, *pdwRxTSC47_16, pDevice->abyPRNG);
1222                 rc4_init(&pDevice->SBox, pDevice->abyPRNG, TKIP_KEY_LEN);
1223                 rc4_encrypt(&pDevice->SBox, pbyIV+8, pbyIV+8, PayloadLen);
1224                 if (ETHbIsBufferCrc32Ok(pbyIV+8, PayloadLen)) {
1225                     *pbyNewRsr |= NEWRSR_DECRYPTOK;
1226                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV OK!\n");
1227                 } else {
1228                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV FAIL!!!\n");
1229                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"PayloadLen = %d\n", PayloadLen);
1230                 }
1231             }
1232         }
1233
1234         if (byDecMode == KEY_CTL_CCMP) {
1235             if (bOnFly == false) {
1236                 // Software CCMP
1237                 // NotOnFly
1238                 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"soft KEY_CTL_CCMP\n");
1239                 if (AESbGenCCMP(pKey->abyKey, pbyFrame, FrameSize)) {
1240                     *pbyNewRsr |= NEWRSR_DECRYPTOK;
1241                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"CCMP MIC compare OK!\n");
1242                 } else {
1243                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"CCMP MIC fail!\n");
1244                 }
1245             }
1246         }
1247
1248     }// end of TKIP/AES
1249
1250     if ((*(pbyIV+3) & 0x20) != 0)
1251         *pbExtIV = true;
1252     return true;
1253 }
1254
1255 static int s_bAPModeRxData(struct vnt_private *pDevice, struct sk_buff *skb,
1256         u32 FrameSize, u32 cbHeaderOffset, s32 iSANodeIndex, s32 iDANodeIndex)
1257 {
1258         struct sk_buff *skbcpy;
1259         struct vnt_manager *pMgmt = &pDevice->vnt_mgmt;
1260         int  bRelayAndForward = false;
1261         int bRelayOnly = false;
1262         u8 byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
1263         u16 wAID;
1264
1265     if (FrameSize > CB_MAX_BUF_SIZE)
1266         return false;
1267     // check DA
1268     if (is_multicast_ether_addr((u8 *)(skb->data+cbHeaderOffset))) {
1269        if (pMgmt->sNodeDBTable[0].bPSEnable) {
1270
1271            skbcpy = dev_alloc_skb((int)pDevice->rx_buf_sz);
1272
1273         // if any node in PS mode, buffer packet until DTIM.
1274            if (skbcpy == NULL) {
1275                DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "relay multicast no skb available \n");
1276            }
1277            else {
1278                skbcpy->dev = pDevice->dev;
1279                skbcpy->len = FrameSize;
1280                memcpy(skbcpy->data, skb->data+cbHeaderOffset, FrameSize);
1281                skb_queue_tail(&(pMgmt->sNodeDBTable[0].sTxPSQueue), skbcpy);
1282                pMgmt->sNodeDBTable[0].wEnQueueCnt++;
1283                // set tx map
1284                pMgmt->abyPSTxMap[0] |= byMask[0];
1285            }
1286        }
1287        else {
1288            bRelayAndForward = true;
1289        }
1290     }
1291     else {
1292         // check if relay
1293         if (BSSbIsSTAInNodeDB(pDevice, (u8 *)(skb->data+cbHeaderOffset), &iDANodeIndex)) {
1294             if (pMgmt->sNodeDBTable[iDANodeIndex].eNodeState >= NODE_ASSOC) {
1295                 if (pMgmt->sNodeDBTable[iDANodeIndex].bPSEnable) {
1296                     // queue this skb until next PS tx, and then release.
1297
1298                         skb->data += cbHeaderOffset;
1299                         skb->tail += cbHeaderOffset;
1300                     skb_put(skb, FrameSize);
1301                     skb_queue_tail(&pMgmt->sNodeDBTable[iDANodeIndex].sTxPSQueue, skb);
1302
1303                     pMgmt->sNodeDBTable[iDANodeIndex].wEnQueueCnt++;
1304                     wAID = pMgmt->sNodeDBTable[iDANodeIndex].wAID;
1305                     pMgmt->abyPSTxMap[wAID >> 3] |=  byMask[wAID & 7];
1306                     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "relay: index= %d, pMgmt->abyPSTxMap[%d]= %d\n",
1307                                iDANodeIndex, (wAID >> 3), pMgmt->abyPSTxMap[wAID >> 3]);
1308                     return true;
1309                 }
1310                 else {
1311                     bRelayOnly = true;
1312                 }
1313             }
1314         }
1315     }
1316
1317     if (bRelayOnly || bRelayAndForward) {
1318         // relay this packet right now
1319         if (bRelayAndForward)
1320             iDANodeIndex = 0;
1321
1322         if ((pDevice->uAssocCount > 1) && (iDANodeIndex >= 0)) {
1323                 bRelayPacketSend(pDevice, (u8 *) (skb->data + cbHeaderOffset),
1324                                  FrameSize, (unsigned int) iDANodeIndex);
1325         }
1326
1327         if (bRelayOnly)
1328             return false;
1329     }
1330     // none associate, don't forward
1331     if (pDevice->uAssocCount == 0)
1332         return false;
1333
1334     return true;
1335 }
1336
1337 void RXvWorkItem(struct vnt_private *pDevice)
1338 {
1339         int ntStatus;
1340         PRCB pRCB = NULL;
1341
1342     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->Rx Polling Thread\n");
1343     spin_lock_irq(&pDevice->lock);
1344
1345     while ((pDevice->Flags & fMP_POST_READS) &&
1346             MP_IS_READY(pDevice) &&
1347             (pDevice->NumRecvFreeList != 0) ) {
1348         pRCB = pDevice->FirstRecvFreeList;
1349         pDevice->NumRecvFreeList--;
1350         ASSERT(pRCB);// cannot be NULL
1351         DequeueRCB(pDevice->FirstRecvFreeList, pDevice->LastRecvFreeList);
1352         ntStatus = PIPEnsBulkInUsbRead(pDevice, pRCB);
1353     }
1354     pDevice->bIsRxWorkItemQueued = false;
1355     spin_unlock_irq(&pDevice->lock);
1356
1357 }
1358
1359 void RXvFreeRCB(PRCB pRCB, int bReAllocSkb)
1360 {
1361         struct vnt_private *pDevice = pRCB->pDevice;
1362
1363     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->RXvFreeRCB\n");
1364
1365     ASSERT(!pRCB->Ref);     // should be 0
1366     ASSERT(pRCB->pDevice);  // shouldn't be NULL
1367
1368         if (bReAllocSkb == false) {
1369                 kfree_skb(pRCB->skb);
1370                 bReAllocSkb = true;
1371         }
1372
1373     if (bReAllocSkb == true) {
1374         pRCB->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1375         // todo error handling
1376         if (pRCB->skb == NULL) {
1377             DBG_PRT(MSG_LEVEL_ERR,KERN_ERR" Failed to re-alloc rx skb\n");
1378         }else {
1379             pRCB->skb->dev = pDevice->dev;
1380         }
1381     }
1382     //
1383     // Insert the RCB back in the Recv free list
1384     //
1385     EnqueueRCB(pDevice->FirstRecvFreeList, pDevice->LastRecvFreeList, pRCB);
1386     pDevice->NumRecvFreeList++;
1387
1388     if ((pDevice->Flags & fMP_POST_READS) && MP_IS_READY(pDevice) &&
1389         (pDevice->bIsRxWorkItemQueued == false) ) {
1390
1391         pDevice->bIsRxWorkItemQueued = true;
1392         tasklet_schedule(&pDevice->ReadWorkItem);
1393     }
1394     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"<----RXFreeRCB %d %d\n",pDevice->NumRecvFreeList, pDevice->NumRecvMngList);
1395 }
1396
1397 void RXvMngWorkItem(struct vnt_private *pDevice)
1398 {
1399         PRCB pRCB = NULL;
1400         struct vnt_rx_mgmt *pRxPacket;
1401         int bReAllocSkb = false;
1402
1403     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->Rx Mng Thread\n");
1404
1405     spin_lock_irq(&pDevice->lock);
1406     while (pDevice->NumRecvMngList!=0)
1407     {
1408         pRCB = pDevice->FirstRecvMngList;
1409         pDevice->NumRecvMngList--;
1410         DequeueRCB(pDevice->FirstRecvMngList, pDevice->LastRecvMngList);
1411         if(!pRCB){
1412             break;
1413         }
1414         ASSERT(pRCB);// cannot be NULL
1415         pRxPacket = &(pRCB->sMngPacket);
1416         vMgrRxManagePacket(pDevice, &pDevice->vnt_mgmt, pRxPacket);
1417         pRCB->Ref--;
1418         if(pRCB->Ref == 0) {
1419             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"RxvFreeMng %d %d\n",pDevice->NumRecvFreeList, pDevice->NumRecvMngList);
1420             RXvFreeRCB(pRCB, bReAllocSkb);
1421         } else {
1422             DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Rx Mng Only we have the right to free RCB\n");
1423         }
1424     }
1425
1426         pDevice->bIsRxMngWorkItemQueued = false;
1427         spin_unlock_irq(&pDevice->lock);
1428
1429 }
1430