drivers/staging/rtl8192e/rtllib_rx.c

   1 /*
   2  * Original code based Host AP (software wireless LAN access point) driver
   3  * for Intersil Prism2/2.5/3 - hostap.o module, common routines
   4  *
   5  * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
   6  * <[email protected]>
   7  * Copyright (c) 2002-2003, Jouni Malinen <[email protected]>
   8  * Copyright (c) 2004, Intel Corporation
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation. See README and COPYING for
  13  * more details.
  14  ******************************************************************************
  15
  16   Few modifications for Realtek's Wi-Fi drivers by
  17   Andrea Merello <[email protected]>
  18
  19   A special thanks goes to Realtek for their support !
  20
  21 ******************************************************************************/
  22
  23
  24 #include <linux/compiler.h>
  25 #include <linux/errno.h>
  26 #include <linux/if_arp.h>
  27 #include <linux/in6.h>
  28 #include <linux/in.h>
  29 #include <linux/ip.h>
  30 #include <linux/kernel.h>
  31 #include <linux/module.h>
  32 #include <linux/netdevice.h>
  33 #include <linux/pci.h>
  34 #include <linux/proc_fs.h>
  35 #include <linux/skbuff.h>
  36 #include <linux/slab.h>
  37 #include <linux/tcp.h>
  38 #include <linux/types.h>
  39 #include <linux/wireless.h>
  40 #include <linux/etherdevice.h>
  41 #include <linux/uaccess.h>
  42 #include <linux/ctype.h>
  43
  44 #include "rtllib.h"
  45 #include "dot11d.h"
  46
  47 static inline void rtllib_monitor_rx(struct rtllib_device *ieee,
  48                                 struct sk_buff *skb, struct rtllib_rx_stats *rx_status,
  49                                 size_t hdr_length)
  50 {
  51         skb->dev = ieee->dev;
  52         skb_reset_mac_header(skb);
  53         skb_pull(skb, hdr_length);
  54         skb->pkt_type = PACKET_OTHERHOST;
  55         skb->protocol = htons(ETH_P_80211_RAW);
  56         memset(skb->cb, 0, sizeof(skb->cb));
  57         netif_rx(skb);
  58 }
  59
  60 /* Called only as a tasklet (software IRQ) */
  61 static struct rtllib_frag_entry *
  62 rtllib_frag_cache_find(struct rtllib_device *ieee, unsigned int seq,
  63                           unsigned int frag, u8 tid, u8 *src, u8 *dst)
  64 {
  65         struct rtllib_frag_entry *entry;
  66         int i;
  67
  68         for (i = 0; i < RTLLIB_FRAG_CACHE_LEN; i++) {
  69                 entry = &ieee->frag_cache[tid][i];
  70                 if (entry->skb != NULL &&
  71                     time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
  72                         RTLLIB_DEBUG_FRAG(
  73                                 "expiring fragment cache entry seq=%u last_frag=%u\n",
  74                                 entry->seq, entry->last_frag);
  75                         dev_kfree_skb_any(entry->skb);
  76                         entry->skb = NULL;
  77                 }
  78
  79                 if (entry->skb != NULL && entry->seq == seq &&
  80                     (entry->last_frag + 1 == frag || frag == -1) &&
  81                     memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
  82                     memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
  83                         return entry;
  84         }
  85
  86         return NULL;
  87 }
  88
  89 /* Called only as a tasklet (software IRQ) */
  90 static struct sk_buff *
  91 rtllib_frag_cache_get(struct rtllib_device *ieee,
  92                          struct rtllib_hdr_4addr *hdr)
  93 {
  94         struct sk_buff *skb = NULL;
  95         u16 fc = le16_to_cpu(hdr->frame_ctl);
  96         u16 sc = le16_to_cpu(hdr->seq_ctl);
  97         unsigned int frag = WLAN_GET_SEQ_FRAG(sc);
  98         unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
  99         struct rtllib_frag_entry *entry;
 100         struct rtllib_hdr_3addrqos *hdr_3addrqos;
 101         struct rtllib_hdr_4addrqos *hdr_4addrqos;
 102         u8 tid;
 103
 104         if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) && RTLLIB_QOS_HAS_SEQ(fc)) {
 105                 hdr_4addrqos = (struct rtllib_hdr_4addrqos *)hdr;
 106                 tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID;
 107                 tid = UP2AC(tid);
 108                 tid++;
 109         } else if (RTLLIB_QOS_HAS_SEQ(fc)) {
 110                 hdr_3addrqos = (struct rtllib_hdr_3addrqos *)hdr;
 111                 tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID;
 112                 tid = UP2AC(tid);
 113                 tid++;
 114         } else {
 115                 tid = 0;
 116         }
 117
 118         if (frag == 0) {
 119                 /* Reserve enough space to fit maximum frame length */
 120                 skb = dev_alloc_skb(ieee->dev->mtu +
 121                                     sizeof(struct rtllib_hdr_4addr) +
 122                                     8 /* LLC */ +
 123                                     2 /* alignment */ +
 124                                     8 /* WEP */ +
 125                                     ETH_ALEN /* WDS */ +
 126                                     (RTLLIB_QOS_HAS_SEQ(fc) ? 2 : 0) /* QOS Control */);
 127                 if (skb == NULL)
 128                         return NULL;
 129
 130                 entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]];
 131                 ieee->frag_next_idx[tid]++;
 132                 if (ieee->frag_next_idx[tid] >= RTLLIB_FRAG_CACHE_LEN)
 133                         ieee->frag_next_idx[tid] = 0;
 134
 135                 if (entry->skb != NULL)
 136                         dev_kfree_skb_any(entry->skb);
 137
 138                 entry->first_frag_time = jiffies;
 139                 entry->seq = seq;
 140                 entry->last_frag = frag;
 141                 entry->skb = skb;
 142                 memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
 143                 memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
 144         } else {
 145                 /* received a fragment of a frame for which the head fragment
 146                  * should have already been received */
 147                 entry = rtllib_frag_cache_find(ieee, seq, frag, tid, hdr->addr2,
 148                                                   hdr->addr1);
 149                 if (entry != NULL) {
 150                         entry->last_frag = frag;
 151                         skb = entry->skb;
 152                 }
 153         }
 154
 155         return skb;
 156 }
 157
 158
 159 /* Called only as a tasklet (software IRQ) */
 160 static int rtllib_frag_cache_invalidate(struct rtllib_device *ieee,
 161                                            struct rtllib_hdr_4addr *hdr)
 162 {
 163         u16 fc = le16_to_cpu(hdr->frame_ctl);
 164         u16 sc = le16_to_cpu(hdr->seq_ctl);
 165         unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
 166         struct rtllib_frag_entry *entry;
 167         struct rtllib_hdr_3addrqos *hdr_3addrqos;
 168         struct rtllib_hdr_4addrqos *hdr_4addrqos;
 169         u8 tid;
 170
 171         if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) && RTLLIB_QOS_HAS_SEQ(fc)) {
 172                 hdr_4addrqos = (struct rtllib_hdr_4addrqos *)hdr;
 173                 tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID;
 174                 tid = UP2AC(tid);
 175                 tid++;
 176         } else if (RTLLIB_QOS_HAS_SEQ(fc)) {
 177                 hdr_3addrqos = (struct rtllib_hdr_3addrqos *)hdr;
 178                 tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID;
 179                 tid = UP2AC(tid);
 180                 tid++;
 181         } else {
 182                 tid = 0;
 183         }
 184
 185         entry = rtllib_frag_cache_find(ieee, seq, -1, tid, hdr->addr2,
 186                                           hdr->addr1);
 187
 188         if (entry == NULL) {
 189                 RTLLIB_DEBUG_FRAG(
 190                         "could not invalidate fragment cache entry (seq=%u)\n", seq);
 191                 return -1;
 192         }
 193
 194         entry->skb = NULL;
 195         return 0;
 196 }
 197
 198 /* rtllib_rx_frame_mgtmt
 199  *
 200  * Responsible for handling management control frames
 201  *
 202  * Called by rtllib_rx */
 203 static inline int
 204 rtllib_rx_frame_mgmt(struct rtllib_device *ieee, struct sk_buff *skb,
 205                         struct rtllib_rx_stats *rx_stats, u16 type,
 206                         u16 stype)
 207 {
 208         /* On the struct stats definition there is written that
 209          * this is not mandatory.... but seems that the probe
 210          * response parser uses it
 211          */
 212         struct rtllib_hdr_3addr *hdr = (struct rtllib_hdr_3addr *)skb->data;
 213
 214         rx_stats->len = skb->len;
 215         rtllib_rx_mgt(ieee, skb, rx_stats);
 216         if ((memcmp(hdr->addr1, ieee->dev->dev_addr, ETH_ALEN))) {
 217                 dev_kfree_skb_any(skb);
 218                 return 0;
 219         }
 220         rtllib_rx_frame_softmac(ieee, skb, rx_stats, type, stype);
 221
 222         dev_kfree_skb_any(skb);
 223
 224         return 0;
 225 }
 226
 227 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 228 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
 229 static unsigned char rfc1042_header[] = {
 230         0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00
 231 };
 232 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
 233 static unsigned char bridge_tunnel_header[] = {
 234         0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8
 235 };
 236 /* No encapsulation header if EtherType < 0x600 (=length) */
 237
 238 /* Called by rtllib_rx_frame_decrypt */
 239 static int rtllib_is_eapol_frame(struct rtllib_device *ieee,
 240                                     struct sk_buff *skb, size_t hdrlen)
 241 {
 242         struct net_device *dev = ieee->dev;
 243         u16 fc, ethertype;
 244         struct rtllib_hdr_4addr *hdr;
 245         u8 *pos;
 246
 247         if (skb->len < 24)
 248                 return 0;
 249
 250         hdr = (struct rtllib_hdr_4addr *) skb->data;
 251         fc = le16_to_cpu(hdr->frame_ctl);
 252
 253         /* check that the frame is unicast frame to us */
 254         if ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) ==
 255             RTLLIB_FCTL_TODS &&
 256             memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
 257             memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
 258                 /* ToDS frame with own addr BSSID and DA */
 259         } else if ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) ==
 260                    RTLLIB_FCTL_FROMDS &&
 261                    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
 262                 /* FromDS frame with own addr as DA */
 263         } else
 264                 return 0;
 265
 266         if (skb->len < 24 + 8)
 267                 return 0;
 268
 269         /* check for port access entity Ethernet type */
 270         pos = skb->data + hdrlen;
 271         ethertype = (pos[6] << 8) | pos[7];
 272         if (ethertype == ETH_P_PAE)
 273                 return 1;
 274
 275         return 0;
 276 }
 277
 278 /* Called only as a tasklet (software IRQ), by rtllib_rx */
 279 static inline int
 280 rtllib_rx_frame_decrypt(struct rtllib_device *ieee, struct sk_buff *skb,
 281                         struct lib80211_crypt_data *crypt)
 282 {
 283         struct rtllib_hdr_4addr *hdr;
 284         int res, hdrlen;
 285
 286         if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
 287                 return 0;
 288
 289         if (ieee->hwsec_active) {
 290                 struct cb_desc *tcb_desc = (struct cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
 291
 292                 tcb_desc->bHwSec = 1;
 293
 294                 if (ieee->need_sw_enc)
 295                         tcb_desc->bHwSec = 0;
 296         }
 297
 298         hdr = (struct rtllib_hdr_4addr *) skb->data;
 299         hdrlen = rtllib_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
 300
 301         atomic_inc(&crypt->refcnt);
 302         res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
 303         atomic_dec(&crypt->refcnt);
 304         if (res < 0) {
 305                 RTLLIB_DEBUG_DROP(
 306                         "decryption failed (SA= %pM) res=%d\n", hdr->addr2, res);
 307                 if (res == -2)
 308                         RTLLIB_DEBUG_DROP("Decryption failed ICV mismatch (key %d)\n",
 309                                              skb->data[hdrlen + 3] >> 6);
 310                 ieee->ieee_stats.rx_discards_undecryptable++;
 311                 return -1;
 312         }
 313
 314         return res;
 315 }
 316
 317
 318 /* Called only as a tasklet (software IRQ), by rtllib_rx */
 319 static inline int
 320 rtllib_rx_frame_decrypt_msdu(struct rtllib_device *ieee, struct sk_buff *skb,
 321                              int keyidx, struct lib80211_crypt_data *crypt)
 322 {
 323         struct rtllib_hdr_4addr *hdr;
 324         int res, hdrlen;
 325
 326         if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
 327                 return 0;
 328         if (ieee->hwsec_active) {
 329                 struct cb_desc *tcb_desc = (struct cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
 330
 331                 tcb_desc->bHwSec = 1;
 332
 333                 if (ieee->need_sw_enc)
 334                         tcb_desc->bHwSec = 0;
 335         }
 336
 337         hdr = (struct rtllib_hdr_4addr *) skb->data;
 338         hdrlen = rtllib_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
 339
 340         atomic_inc(&crypt->refcnt);
 341         res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
 342         atomic_dec(&crypt->refcnt);
 343         if (res < 0) {
 344                 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed (SA= %pM keyidx=%d)\n",
 345                        ieee->dev->name, hdr->addr2, keyidx);
 346                 return -1;
 347         }
 348
 349         return 0;
 350 }
 351
 352
 353 /* this function is stolen from ipw2200 driver*/
 354 #define IEEE_PACKET_RETRY_TIME (5*HZ)
 355 static int is_duplicate_packet(struct rtllib_device *ieee,
 356                                       struct rtllib_hdr_4addr *header)
 357 {
 358         u16 fc = le16_to_cpu(header->frame_ctl);
 359         u16 sc = le16_to_cpu(header->seq_ctl);
 360         u16 seq = WLAN_GET_SEQ_SEQ(sc);
 361         u16 frag = WLAN_GET_SEQ_FRAG(sc);
 362         u16 *last_seq, *last_frag;
 363         unsigned long *last_time;
 364         struct rtllib_hdr_3addrqos *hdr_3addrqos;
 365         struct rtllib_hdr_4addrqos *hdr_4addrqos;
 366         u8 tid;
 367
 368         if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) && RTLLIB_QOS_HAS_SEQ(fc)) {
 369                 hdr_4addrqos = (struct rtllib_hdr_4addrqos *)header;
 370                 tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID;
 371                 tid = UP2AC(tid);
 372                 tid++;
 373         } else if (RTLLIB_QOS_HAS_SEQ(fc)) {
 374                 hdr_3addrqos = (struct rtllib_hdr_3addrqos *)header;
 375                 tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID;
 376                 tid = UP2AC(tid);
 377                 tid++;
 378         } else {
 379                 tid = 0;
 380         }
 381
 382         switch (ieee->iw_mode) {
 383         case IW_MODE_ADHOC:
 384         {
 385                 struct list_head *p;
 386                 struct ieee_ibss_seq *entry = NULL;
 387                 u8 *mac = header->addr2;
 388                 int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE;
 389
 390                 list_for_each(p, &ieee->ibss_mac_hash[index]) {
 391                         entry = list_entry(p, struct ieee_ibss_seq, list);
 392                         if (!memcmp(entry->mac, mac, ETH_ALEN))
 393                                 break;
 394                 }
 395                 if (p == &ieee->ibss_mac_hash[index]) {
 396                         entry = kmalloc(sizeof(struct ieee_ibss_seq), GFP_ATOMIC);
 397                         if (!entry) {
 398                                 printk(KERN_WARNING "Cannot malloc new mac entry\n");
 399                                 return 0;
 400                         }
 401                         memcpy(entry->mac, mac, ETH_ALEN);
 402                         entry->seq_num[tid] = seq;
 403                         entry->frag_num[tid] = frag;
 404                         entry->packet_time[tid] = jiffies;
 405                         list_add(&entry->list, &ieee->ibss_mac_hash[index]);
 406                         return 0;
 407                 }
 408                 last_seq = &entry->seq_num[tid];
 409                 last_frag = &entry->frag_num[tid];
 410                 last_time = &entry->packet_time[tid];
 411                 break;
 412         }
 413
 414         case IW_MODE_INFRA:
 415                 last_seq = &ieee->last_rxseq_num[tid];
 416                 last_frag = &ieee->last_rxfrag_num[tid];
 417                 last_time = &ieee->last_packet_time[tid];
 418                 break;
 419         default:
 420                 return 0;
 421         }
 422
 423         if ((*last_seq == seq) &&
 424             time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) {
 425                 if (*last_frag == frag)
 426                         goto drop;
 427                 if (*last_frag + 1 != frag)
 428                         /* out-of-order fragment */
 429                         goto drop;
 430         } else
 431                 *last_seq = seq;
 432
 433         *last_frag = frag;
 434         *last_time = jiffies;
 435         return 0;
 436
 437 drop:
 438
 439         return 1;
 440 }
 441
 442 static bool AddReorderEntry(struct rx_ts_record *pTS,
 443                             struct rx_reorder_entry *pReorderEntry)
 444 {
 445         struct list_head *pList = &pTS->RxPendingPktList;
 446
 447         while (pList->next != &pTS->RxPendingPktList) {
 448                 if (SN_LESS(pReorderEntry->SeqNum, ((struct rx_reorder_entry *)
 449                     list_entry(pList->next, struct rx_reorder_entry,
 450                     List))->SeqNum))
 451                         pList = pList->next;
 452                 else if (SN_EQUAL(pReorderEntry->SeqNum,
 453                         ((struct rx_reorder_entry *)list_entry(pList->next,
 454                         struct rx_reorder_entry, List))->SeqNum))
 455                                 return false;
 456                 else
 457                         break;
 458         }
 459         pReorderEntry->List.next = pList->next;
 460         pReorderEntry->List.next->prev = &pReorderEntry->List;
 461         pReorderEntry->List.prev = pList;
 462         pList->next = &pReorderEntry->List;
 463
 464         return true;
 465 }
 466
 467 void rtllib_indicate_packets(struct rtllib_device *ieee, struct rtllib_rxb **prxbIndicateArray, u8 index)
 468 {
 469         struct net_device_stats *stats = &ieee->stats;
 470         u8 i = 0 , j = 0;
 471         u16 ethertype;
 472
 473         for (j = 0; j < index; j++) {
 474                 struct rtllib_rxb *prxb = prxbIndicateArray[j];
 475
 476                 for (i = 0; i < prxb->nr_subframes; i++) {
 477                         struct sk_buff *sub_skb = prxb->subframes[i];
 478
 479                 /* convert hdr + possible LLC headers into Ethernet header */
 480                         ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7];
 481                         if (sub_skb->len >= 8 &&
 482                             ((memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) == 0 &&
 483                             ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
 484                             memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE) == 0)) {
 485                                 /* remove RFC1042 or Bridge-Tunnel encapsulation
 486                                  * and replace EtherType */
 487                                 skb_pull(sub_skb, SNAP_SIZE);
 488                                 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN);
 489                                 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN);
 490                         } else {
 491                                 u16 len;
 492                         /* Leave Ethernet header part of hdr and full payload */
 493                                 len = sub_skb->len;
 494                                 memcpy(skb_push(sub_skb, 2), &len, 2);
 495                                 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN);
 496                                 memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN);
 497                         }
 498
 499                         /* Indicate the packets to upper layer */
 500                         if (sub_skb) {
 501                                 stats->rx_packets++;
 502                                 stats->rx_bytes += sub_skb->len;
 503
 504                                 memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
 505                                 sub_skb->protocol = eth_type_trans(sub_skb, ieee->dev);
 506                                 sub_skb->dev = ieee->dev;
 507                                 sub_skb->dev->stats.rx_packets++;
 508                                 sub_skb->dev->stats.rx_bytes += sub_skb->len;
 509                                 sub_skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
 510                                 ieee->last_rx_ps_time = jiffies;
 511                                 netif_rx(sub_skb);
 512                         }
 513                 }
 514                 kfree(prxb);
 515                 prxb = NULL;
 516         }
 517 }
 518
 519 void rtllib_FlushRxTsPendingPkts(struct rtllib_device *ieee,    struct rx_ts_record *pTS)
 520 {
 521         struct rx_reorder_entry *pRxReorderEntry;
 522         u8 RfdCnt = 0;
 523
 524         del_timer_sync(&pTS->RxPktPendingTimer);
 525         while (!list_empty(&pTS->RxPendingPktList)) {
 526                 if (RfdCnt >= REORDER_WIN_SIZE) {
 527                         printk(KERN_INFO "-------------->%s() error! RfdCnt >= REORDER_WIN_SIZE\n", __func__);
 528                         break;
 529                 }
 530
 531                 pRxReorderEntry = (struct rx_reorder_entry *)list_entry(pTS->RxPendingPktList.prev, struct rx_reorder_entry, List);
 532                 RTLLIB_DEBUG(RTLLIB_DL_REORDER, "%s(): Indicate SeqNum %d!\n", __func__, pRxReorderEntry->SeqNum);
 533                 list_del_init(&pRxReorderEntry->List);
 534
 535                 ieee->RfdArray[RfdCnt] = pRxReorderEntry->prxb;
 536
 537                 RfdCnt = RfdCnt + 1;
 538                 list_add_tail(&pRxReorderEntry->List, &ieee->RxReorder_Unused_List);
 539         }
 540         rtllib_indicate_packets(ieee, ieee->RfdArray, RfdCnt);
 541
 542         pTS->RxIndicateSeq = 0xffff;
 543 }
 544
 545 static void RxReorderIndicatePacket(struct rtllib_device *ieee,
 546                                     struct rtllib_rxb *prxb,
 547                                     struct rx_ts_record *pTS, u16 SeqNum)
 548 {
 549         struct rt_hi_throughput *pHTInfo = ieee->pHTInfo;
 550         struct rx_reorder_entry *pReorderEntry = NULL;
 551         u8 WinSize = pHTInfo->RxReorderWinSize;
 552         u16 WinEnd = 0;
 553         u8 index = 0;
 554         bool bMatchWinStart = false, bPktInBuf = false;
 555         unsigned long flags;
 556
 557         RTLLIB_DEBUG(RTLLIB_DL_REORDER, "%s(): Seq is %d, pTS->RxIndicateSeq is %d, WinSize is %d\n", __func__, SeqNum,
 558                      pTS->RxIndicateSeq, WinSize);
 559
 560         spin_lock_irqsave(&(ieee->reorder_spinlock), flags);
 561
 562         WinEnd = (pTS->RxIndicateSeq + WinSize - 1) % 4096;
 563         /* Rx Reorder initialize condition.*/
 564         if (pTS->RxIndicateSeq == 0xffff)
 565                 pTS->RxIndicateSeq = SeqNum;
 566
 567         /* Drop out the packet which SeqNum is smaller than WinStart */
 568         if (SN_LESS(SeqNum, pTS->RxIndicateSeq)) {
 569                 RTLLIB_DEBUG(RTLLIB_DL_REORDER, "Packet Drop! IndicateSeq: %d, NewSeq: %d\n",
 570                                  pTS->RxIndicateSeq, SeqNum);
 571                 pHTInfo->RxReorderDropCounter++;
 572                 {
 573                         int i;
 574
 575                         for (i = 0; i < prxb->nr_subframes; i++)
 576                                 dev_kfree_skb(prxb->subframes[i]);
 577                         kfree(prxb);
 578                         prxb = NULL;
 579                 }
 580                 spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
 581                 return;
 582         }
 583
 584         /*
 585          * Sliding window manipulation. Conditions includes:
 586          * 1. Incoming SeqNum is equal to WinStart =>Window shift 1
 587          * 2. Incoming SeqNum is larger than the WinEnd => Window shift N
 588          */
 589         if (SN_EQUAL(SeqNum, pTS->RxIndicateSeq)) {
 590                 pTS->RxIndicateSeq = (pTS->RxIndicateSeq + 1) % 4096;
 591                 bMatchWinStart = true;
 592         } else if (SN_LESS(WinEnd, SeqNum)) {
 593                 if (SeqNum >= (WinSize - 1))
 594                         pTS->RxIndicateSeq = SeqNum + 1 - WinSize;
 595                 else
 596                         pTS->RxIndicateSeq = 4095 - (WinSize - (SeqNum + 1)) + 1;
 597                 RTLLIB_DEBUG(RTLLIB_DL_REORDER, "Window Shift! IndicateSeq: %d, NewSeq: %d\n", pTS->RxIndicateSeq, SeqNum);
 598         }
 599
 600         /*
 601          * Indication process.
 602          * After Packet dropping and Sliding Window shifting as above, we can
 603          * now just indicate the packets with the SeqNum smaller than latest
 604          * WinStart and struct buffer other packets.
 605          */
 606         /* For Rx Reorder condition:
 607          * 1. All packets with SeqNum smaller than WinStart => Indicate
 608          * 2. All packets with SeqNum larger than or equal to
 609          *       WinStart => Buffer it.
 610          */
 611         if (bMatchWinStart) {
 612                 /* Current packet is going to be indicated.*/
 613                 RTLLIB_DEBUG(RTLLIB_DL_REORDER, "Packets indication!! IndicateSeq: %d, NewSeq: %d\n",
 614                                 pTS->RxIndicateSeq, SeqNum);
 615                 ieee->prxbIndicateArray[0] = prxb;
 616                 index = 1;
 617         } else {
 618                 /* Current packet is going to be inserted into pending list.*/
 619                 if (!list_empty(&ieee->RxReorder_Unused_List)) {
 620                         pReorderEntry = (struct rx_reorder_entry *)
 621                                         list_entry(ieee->RxReorder_Unused_List.next,
 622                                         struct rx_reorder_entry, List);
 623                         list_del_init(&pReorderEntry->List);
 624
 625                         /* Make a reorder entry and insert into a the packet list.*/
 626                         pReorderEntry->SeqNum = SeqNum;
 627                         pReorderEntry->prxb = prxb;
 628
 629                         if (!AddReorderEntry(pTS, pReorderEntry)) {
 630                                 RTLLIB_DEBUG(RTLLIB_DL_REORDER,
 631                                              "%s(): Duplicate packet is dropped!! IndicateSeq: %d, NewSeq: %d\n",
 632                                             __func__, pTS->RxIndicateSeq,
 633                                             SeqNum);
 634                                 list_add_tail(&pReorderEntry->List,
 635                                               &ieee->RxReorder_Unused_List); {
 636                                         int i;
 637
 638                                         for (i = 0; i < prxb->nr_subframes; i++)
 639                                                 dev_kfree_skb(prxb->subframes[i]);
 640                                         kfree(prxb);
 641                                         prxb = NULL;
 642                                 }
 643                         } else {
 644                                 RTLLIB_DEBUG(RTLLIB_DL_REORDER,
 645                                          "Pkt insert into struct buffer!! IndicateSeq: %d, NewSeq: %d\n",
 646                                          pTS->RxIndicateSeq, SeqNum);
 647                         }
 648                 } else {
 649                         /*
 650                          * Packets are dropped if there are not enough reorder
 651                          * entries. This part should be modified!! We can just
 652                          * indicate all the packets in struct buffer and get
 653                          * reorder entries.
 654                          */
 655                         RTLLIB_DEBUG(RTLLIB_DL_ERR, "RxReorderIndicatePacket(): There is no reorder entry!! Packet is dropped!!\n");
 656                         {
 657                                 int i;
 658
 659                                 for (i = 0; i < prxb->nr_subframes; i++)
 660                                         dev_kfree_skb(prxb->subframes[i]);
 661                                 kfree(prxb);
 662                                 prxb = NULL;
 663                         }
 664                 }
 665         }
 666
 667         /* Check if there is any packet need indicate.*/
 668         while (!list_empty(&pTS->RxPendingPktList)) {
 669                 RTLLIB_DEBUG(RTLLIB_DL_REORDER, "%s(): start RREORDER indicate\n", __func__);
 670
 671                 pReorderEntry = (struct rx_reorder_entry *)list_entry(pTS->RxPendingPktList.prev,
 672                                  struct rx_reorder_entry, List);
 673                 if (SN_LESS(pReorderEntry->SeqNum, pTS->RxIndicateSeq) ||
 674                                 SN_EQUAL(pReorderEntry->SeqNum, pTS->RxIndicateSeq)) {
 675                         /* This protect struct buffer from overflow. */
 676                         if (index >= REORDER_WIN_SIZE) {
 677                                 RTLLIB_DEBUG(RTLLIB_DL_ERR, "RxReorderIndicatePacket(): Buffer overflow!!\n");
 678                                 bPktInBuf = true;
 679                                 break;
 680                         }
 681
 682                         list_del_init(&pReorderEntry->List);
 683
 684                         if (SN_EQUAL(pReorderEntry->SeqNum, pTS->RxIndicateSeq))
 685                                 pTS->RxIndicateSeq = (pTS->RxIndicateSeq + 1) % 4096;
 686
 687                         ieee->prxbIndicateArray[index] = pReorderEntry->prxb;
 688                         RTLLIB_DEBUG(RTLLIB_DL_REORDER, "%s(): Indicate SeqNum %d!\n", __func__, pReorderEntry->SeqNum);
 689                         index++;
 690
 691                         list_add_tail(&pReorderEntry->List,
 692                                       &ieee->RxReorder_Unused_List);
 693                 } else {
 694                         bPktInBuf = true;
 695                         break;
 696                 }
 697         }
 698
 699         /* Handling pending timer. Set this timer to prevent from long time
 700          * Rx buffering.*/
 701         if (index > 0) {
 702                 if (timer_pending(&pTS->RxPktPendingTimer))
 703                         del_timer_sync(&pTS->RxPktPendingTimer);
 704                 pTS->RxTimeoutIndicateSeq = 0xffff;
 705
 706                 if (index > REORDER_WIN_SIZE) {
 707                         RTLLIB_DEBUG(RTLLIB_DL_ERR, "RxReorderIndicatePacket(): Rx Reorder struct buffer full!!\n");
 708                         spin_unlock_irqrestore(&(ieee->reorder_spinlock),
 709                                                flags);
 710                         return;
 711                 }
 712                 rtllib_indicate_packets(ieee, ieee->prxbIndicateArray, index);
 713                 bPktInBuf = false;
 714         }
 715
 716         if (bPktInBuf && pTS->RxTimeoutIndicateSeq == 0xffff) {
 717                 RTLLIB_DEBUG(RTLLIB_DL_REORDER, "%s(): SET rx timeout timer\n",
 718                              __func__);
 719                 pTS->RxTimeoutIndicateSeq = pTS->RxIndicateSeq;
 720                 mod_timer(&pTS->RxPktPendingTimer, jiffies +
 721                           MSECS(pHTInfo->RxReorderPendingTime));
 722         }
 723         spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
 724 }
 725
 726 static u8 parse_subframe(struct rtllib_device *ieee, struct sk_buff *skb,
 727                          struct rtllib_rx_stats *rx_stats,
 728                          struct rtllib_rxb *rxb, u8 *src, u8 *dst)
 729 {
 730         struct rtllib_hdr_3addr  *hdr = (struct rtllib_hdr_3addr *)skb->data;
 731         u16             fc = le16_to_cpu(hdr->frame_ctl);
 732
 733         u16             LLCOffset = sizeof(struct rtllib_hdr_3addr);
 734         u16             ChkLength;
 735         bool            bIsAggregateFrame = false;
 736         u16             nSubframe_Length;
 737         u8              nPadding_Length = 0;
 738         u16             SeqNum = 0;
 739         struct sk_buff *sub_skb;
 740         u8           *data_ptr;
 741         /* just for debug purpose */
 742         SeqNum = WLAN_GET_SEQ_SEQ(le16_to_cpu(hdr->seq_ctl));
 743         if ((RTLLIB_QOS_HAS_SEQ(fc)) &&
 744            (((union frameqos *)(skb->data + RTLLIB_3ADDR_LEN))->field.reserved))
 745                 bIsAggregateFrame = true;
 746
 747         if (RTLLIB_QOS_HAS_SEQ(fc))
 748                 LLCOffset += 2;
 749         if (rx_stats->bContainHTC)
 750                 LLCOffset += sHTCLng;
 751
 752         ChkLength = LLCOffset;
 753
 754         if (skb->len <= ChkLength)
 755                 return 0;
 756
 757         skb_pull(skb, LLCOffset);
 758         ieee->bIsAggregateFrame = bIsAggregateFrame;
 759         if (!bIsAggregateFrame) {
 760                 rxb->nr_subframes = 1;
 761
 762                 /* altered by clark 3/30/2010
 763                  * The struct buffer size of the skb indicated to upper layer
 764                  * must be less than 5000, or the defraged IP datagram
 765                  * in the IP layer will exceed "ipfrag_high_tresh" and be
 766                  * discarded. so there must not use the function
 767                  * "skb_copy" and "skb_clone" for "skb".
 768                  */
 769
 770                 /* Allocate new skb for releasing to upper layer */
 771                 sub_skb = dev_alloc_skb(RTLLIB_SKBBUFFER_SIZE);
 772                 if (!sub_skb)
 773                         return 0;
 774                 skb_reserve(sub_skb, 12);
 775                 data_ptr = (u8 *)skb_put(sub_skb, skb->len);
 776                 memcpy(data_ptr, skb->data, skb->len);
 777                 sub_skb->dev = ieee->dev;
 778
 779                 rxb->subframes[0] = sub_skb;
 780
 781                 memcpy(rxb->src, src, ETH_ALEN);
 782                 memcpy(rxb->dst, dst, ETH_ALEN);
 783                 rxb->subframes[0]->dev = ieee->dev;
 784                 return 1;
 785         } else {
 786                 rxb->nr_subframes = 0;
 787                 memcpy(rxb->src, src, ETH_ALEN);
 788                 memcpy(rxb->dst, dst, ETH_ALEN);
 789                 while (skb->len > ETHERNET_HEADER_SIZE) {
 790                         /* Offset 12 denote 2 mac address */
 791                         nSubframe_Length = *((u16 *)(skb->data + 12));
 792                         nSubframe_Length = (nSubframe_Length >> 8) +
 793                                            (nSubframe_Length << 8);
 794
 795                         if (skb->len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
 796                                 printk(KERN_INFO "%s: A-MSDU parse error!! pRfd->nTotalSubframe : %d\n",\
 797                                        __func__, rxb->nr_subframes);
 798                                 printk(KERN_INFO "%s: A-MSDU parse error!! Subframe Length: %d\n", __func__,
 799                                        nSubframe_Length);
 800                                 printk(KERN_INFO "nRemain_Length is %d and nSubframe_Length is : %d\n", skb->len,
 801                                        nSubframe_Length);
 802                                 printk(KERN_INFO "The Packet SeqNum is %d\n", SeqNum);
 803                                 return 0;
 804                         }
 805
 806                         /* move the data point to data content */
 807                         skb_pull(skb, ETHERNET_HEADER_SIZE);
 808
 809                         /* altered by clark 3/30/2010
 810                          * The struct buffer size of the skb indicated to upper layer
 811                          * must be less than 5000, or the defraged IP datagram
 812                          * in the IP layer will exceed "ipfrag_high_tresh" and be
 813                          * discarded. so there must not use the function
 814                          * "skb_copy" and "skb_clone" for "skb".
 815                          */
 816
 817                         /* Allocate new skb for releasing to upper layer */
 818                         sub_skb = dev_alloc_skb(nSubframe_Length + 12);
 819                         if (!sub_skb)
 820                                 return 0;
 821                         skb_reserve(sub_skb, 12);
 822                         data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length);
 823                         memcpy(data_ptr, skb->data, nSubframe_Length);
 824
 825                         sub_skb->dev = ieee->dev;
 826                         rxb->subframes[rxb->nr_subframes++] = sub_skb;
 827                         if (rxb->nr_subframes >= MAX_SUBFRAME_COUNT) {
 828                                 RTLLIB_DEBUG_RX("ParseSubframe(): Too many Subframes! Packets dropped!\n");
 829                                 break;
 830                         }
 831                         skb_pull(skb, nSubframe_Length);
 832
 833                         if (skb->len != 0) {
 834                                 nPadding_Length = 4 - ((nSubframe_Length +
 835                                                   ETHERNET_HEADER_SIZE) % 4);
 836                                 if (nPadding_Length == 4)
 837                                         nPadding_Length = 0;
 838
 839                                 if (skb->len < nPadding_Length)
 840                                         return 0;
 841
 842                                 skb_pull(skb, nPadding_Length);
 843                         }
 844                 }
 845
 846                 return rxb->nr_subframes;
 847         }
 848 }
 849
 850
 851 static size_t rtllib_rx_get_hdrlen(struct rtllib_device *ieee,
 852                                    struct sk_buff *skb,
 853                                    struct rtllib_rx_stats *rx_stats)
 854 {
 855         struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
 856         u16 fc = le16_to_cpu(hdr->frame_ctl);
 857         size_t hdrlen = 0;
 858
 859         hdrlen = rtllib_get_hdrlen(fc);
 860         if (HTCCheck(ieee, skb->data)) {
 861                 if (net_ratelimit())
 862                         printk(KERN_INFO "%s: find HTCControl!\n", __func__);
 863                 hdrlen += 4;
 864                 rx_stats->bContainHTC = true;
 865         }
 866
 867          if (RTLLIB_QOS_HAS_SEQ(fc))
 868                 rx_stats->bIsQosData = true;
 869
 870         return hdrlen;
 871 }
 872
 873 static int rtllib_rx_check_duplicate(struct rtllib_device *ieee,
 874                                      struct sk_buff *skb, u8 multicast)
 875 {
 876         struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
 877         u16 fc, sc;
 878         u8 frag, type, stype;
 879
 880         fc = le16_to_cpu(hdr->frame_ctl);
 881         type = WLAN_FC_GET_TYPE(fc);
 882         stype = WLAN_FC_GET_STYPE(fc);
 883         sc = le16_to_cpu(hdr->seq_ctl);
 884         frag = WLAN_GET_SEQ_FRAG(sc);
 885
 886         if ((ieee->pHTInfo->bCurRxReorderEnable == false) ||
 887                 !ieee->current_network.qos_data.active ||
 888                 !IsDataFrame(skb->data) ||
 889                 IsLegacyDataFrame(skb->data)) {
 890                 if (!((type == RTLLIB_FTYPE_MGMT) && (stype == RTLLIB_STYPE_BEACON))) {
 891                         if (is_duplicate_packet(ieee, hdr))
 892                                 return -1;
 893                 }
 894         } else {
 895                 struct rx_ts_record *pRxTS = NULL;
 896
 897                 if (GetTs(ieee, (struct ts_common_info **) &pRxTS, hdr->addr2,
 898                         (u8)Frame_QoSTID((u8 *)(skb->data)), RX_DIR, true)) {
 899                         if ((fc & (1<<11)) && (frag == pRxTS->RxLastFragNum) &&
 900                             (WLAN_GET_SEQ_SEQ(sc) == pRxTS->RxLastSeqNum))
 901                                 return -1;
 902                         pRxTS->RxLastFragNum = frag;
 903                         pRxTS->RxLastSeqNum = WLAN_GET_SEQ_SEQ(sc);
 904                 } else {
 905                         RTLLIB_DEBUG(RTLLIB_DL_ERR, "ERR!!%s(): No TS!! Skip the check!!\n", __func__);
 906                         return -1;
 907                 }
 908         }
 909
 910         return 0;
 911 }
 912
 913 static void rtllib_rx_extract_addr(struct rtllib_device *ieee,
 914                                    struct rtllib_hdr_4addr *hdr, u8 *dst,
 915                                    u8 *src, u8 *bssid)
 916 {
 917         u16 fc = le16_to_cpu(hdr->frame_ctl);
 918
 919         switch (fc & (RTLLIB_FCTL_FROMDS | RTLLIB_FCTL_TODS)) {
 920         case RTLLIB_FCTL_FROMDS:
 921                 memcpy(dst, hdr->addr1, ETH_ALEN);
 922                 memcpy(src, hdr->addr3, ETH_ALEN);
 923                 memcpy(bssid, hdr->addr2, ETH_ALEN);
 924                 break;
 925         case RTLLIB_FCTL_TODS:
 926                 memcpy(dst, hdr->addr3, ETH_ALEN);
 927                 memcpy(src, hdr->addr2, ETH_ALEN);
 928                 memcpy(bssid, hdr->addr1, ETH_ALEN);
 929                 break;
 930         case RTLLIB_FCTL_FROMDS | RTLLIB_FCTL_TODS:
 931                 memcpy(dst, hdr->addr3, ETH_ALEN);
 932                 memcpy(src, hdr->addr4, ETH_ALEN);
 933                 memcpy(bssid, ieee->current_network.bssid, ETH_ALEN);
 934                 break;
 935         case 0:
 936                 memcpy(dst, hdr->addr1, ETH_ALEN);
 937                 memcpy(src, hdr->addr2, ETH_ALEN);
 938                 memcpy(bssid, hdr->addr3, ETH_ALEN);
 939                 break;
 940         }
 941 }
 942
 943 static int rtllib_rx_data_filter(struct rtllib_device *ieee, u16 fc,
 944                                  u8 *dst, u8 *src, u8 *bssid, u8 *addr2)
 945 {
 946         u8 type, stype;
 947
 948         type = WLAN_FC_GET_TYPE(fc);
 949         stype = WLAN_FC_GET_STYPE(fc);
 950
 951         /* Filter frames from different BSS */
 952         if (((fc & RTLLIB_FCTL_DSTODS) != RTLLIB_FCTL_DSTODS) &&
 953             !ether_addr_equal(ieee->current_network.bssid, bssid) &&
 954             !is_zero_ether_addr(ieee->current_network.bssid)) {
 955                 return -1;
 956         }
 957
 958         /* Filter packets sent by an STA that will be forwarded by AP */
 959         if (ieee->IntelPromiscuousModeInfo.bPromiscuousOn  &&
 960                 ieee->IntelPromiscuousModeInfo.bFilterSourceStationFrame) {
 961                 if ((fc & RTLLIB_FCTL_TODS) && !(fc & RTLLIB_FCTL_FROMDS) &&
 962                     !ether_addr_equal(dst, ieee->current_network.bssid) &&
 963                     ether_addr_equal(bssid, ieee->current_network.bssid)) {
 964                         return -1;
 965                 }
 966         }
 967
 968         /* Nullfunc frames may have PS-bit set, so they must be passed to
 969          * hostap_handle_sta_rx() before being dropped here. */
 970         if (!ieee->IntelPromiscuousModeInfo.bPromiscuousOn) {
 971                 if (stype != RTLLIB_STYPE_DATA &&
 972                     stype != RTLLIB_STYPE_DATA_CFACK &&
 973                     stype != RTLLIB_STYPE_DATA_CFPOLL &&
 974                     stype != RTLLIB_STYPE_DATA_CFACKPOLL &&
 975                     stype != RTLLIB_STYPE_QOS_DATA) {
 976                         if (stype != RTLLIB_STYPE_NULLFUNC)
 977                                 RTLLIB_DEBUG_DROP(
 978                                         "RX: dropped data frame with no data (type=0x%02x, subtype=0x%02x)\n",
 979                                         type, stype);
 980                         return -1;
 981                 }
 982         }
 983
 984         if (ieee->iw_mode != IW_MODE_MESH) {
 985                 /* packets from our adapter are dropped (echo) */
 986                 if (!memcmp(src, ieee->dev->dev_addr, ETH_ALEN))
 987                         return -1;
 988
 989                 /* {broad,multi}cast packets to our BSS go through */
 990                 if (is_multicast_ether_addr(dst)) {
 991                         if (memcmp(bssid, ieee->current_network.bssid, ETH_ALEN))
 992                                 return -1;
 993                 }
 994         }
 995         return 0;
 996 }
 997
 998 static int rtllib_rx_get_crypt(struct rtllib_device *ieee, struct sk_buff *skb,
 999                         struct lib80211_crypt_data **crypt, size_t hdrlen)
1000 {
1001         struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
1002         u16 fc = le16_to_cpu(hdr->frame_ctl);
1003         int idx = 0;
1004
1005         if (ieee->host_decrypt) {
1006                 if (skb->len >= hdrlen + 3)
1007                         idx = skb->data[hdrlen + 3] >> 6;
1008
1009                 *crypt = ieee->crypt_info.crypt[idx];
1010                 /* allow NULL decrypt to indicate an station specific override
1011                  * for default encryption */
1012                 if (*crypt && ((*crypt)->ops == NULL ||
1013                               (*crypt)->ops->decrypt_mpdu == NULL))
1014                         *crypt = NULL;
1015
1016                 if (!*crypt && (fc & RTLLIB_FCTL_WEP)) {
1017                         /* This seems to be triggered by some (multicast?)
1018                          * frames from other than current BSS, so just drop the
1019                          * frames silently instead of filling system log with
1020                          * these reports. */
1021                         RTLLIB_DEBUG_DROP("Decryption failed (not set) (SA= %pM)\n",
1022                                              hdr->addr2);
1023                         ieee->ieee_stats.rx_discards_undecryptable++;
1024                         return -1;
1025                 }
1026         }
1027
1028         return 0;
1029 }
1030
1031 static int rtllib_rx_decrypt(struct rtllib_device *ieee, struct sk_buff *skb,
1032                       struct rtllib_rx_stats *rx_stats,
1033                       struct lib80211_crypt_data *crypt, size_t hdrlen)
1034 {
1035         struct rtllib_hdr_4addr *hdr;
1036         int keyidx = 0;
1037         u16 fc, sc;
1038         u8 frag;
1039
1040         hdr = (struct rtllib_hdr_4addr *)skb->data;
1041         fc = le16_to_cpu(hdr->frame_ctl);
1042         sc = le16_to_cpu(hdr->seq_ctl);
1043         frag = WLAN_GET_SEQ_FRAG(sc);
1044
1045         if ((!rx_stats->Decrypted))
1046                 ieee->need_sw_enc = 1;
1047         else
1048                 ieee->need_sw_enc = 0;
1049
1050         keyidx = rtllib_rx_frame_decrypt(ieee, skb, crypt);
1051         if (ieee->host_decrypt && (fc & RTLLIB_FCTL_WEP) && (keyidx < 0)) {
1052                 printk(KERN_INFO "%s: decrypt frame error\n", __func__);
1053                 return -1;
1054         }
1055
1056         hdr = (struct rtllib_hdr_4addr *) skb->data;
1057         if ((frag != 0 || (fc & RTLLIB_FCTL_MOREFRAGS))) {
1058                 int flen;
1059                 struct sk_buff *frag_skb = rtllib_frag_cache_get(ieee, hdr);
1060
1061                 RTLLIB_DEBUG_FRAG("Rx Fragment received (%u)\n", frag);
1062
1063                 if (!frag_skb) {
1064                         RTLLIB_DEBUG(RTLLIB_DL_RX | RTLLIB_DL_FRAG,
1065                                         "Rx cannot get skb from fragment cache (morefrag=%d seq=%u frag=%u)\n",
1066                                         (fc & RTLLIB_FCTL_MOREFRAGS) != 0,
1067                                         WLAN_GET_SEQ_SEQ(sc), frag);
1068                         return -1;
1069                 }
1070                 flen = skb->len;
1071                 if (frag != 0)
1072                         flen -= hdrlen;
1073
1074                 if (frag_skb->tail + flen > frag_skb->end) {
1075                         printk(KERN_WARNING "%s: host decrypted and reassembled frame did not fit skb\n",
1076                                __func__);
1077                         rtllib_frag_cache_invalidate(ieee, hdr);
1078                         return -1;
1079                 }
1080
1081                 if (frag == 0) {
1082                         /* copy first fragment (including full headers) into
1083                          * beginning of the fragment cache skb */
1084                         memcpy(skb_put(frag_skb, flen), skb->data, flen);
1085                 } else {
1086                         /* append frame payload to the end of the fragment
1087                          * cache skb */
1088                         memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
1089                                flen);
1090                 }
1091                 dev_kfree_skb_any(skb);
1092                 skb = NULL;
1093
1094                 if (fc & RTLLIB_FCTL_MOREFRAGS) {
1095                         /* more fragments expected - leave the skb in fragment
1096                          * cache for now; it will be delivered to upper layers
1097                          * after all fragments have been received */
1098                         return -2;
1099                 }
1100
1101                 /* this was the last fragment and the frame will be
1102                  * delivered, so remove skb from fragment cache */
1103                 skb = frag_skb;
1104                 hdr = (struct rtllib_hdr_4addr *) skb->data;
1105                 rtllib_frag_cache_invalidate(ieee, hdr);
1106         }
1107
1108         /* skb: hdr + (possible reassembled) full MSDU payload; possibly still
1109          * encrypted/authenticated */
1110         if (ieee->host_decrypt && (fc & RTLLIB_FCTL_WEP) &&
1111                 rtllib_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt)) {
1112                 printk(KERN_INFO "%s: ==>decrypt msdu error\n", __func__);
1113                 return -1;
1114         }
1115
1116         hdr = (struct rtllib_hdr_4addr *) skb->data;
1117         if (crypt && !(fc & RTLLIB_FCTL_WEP) && !ieee->open_wep) {
1118                 if (/*ieee->ieee802_1x &&*/
1119                     rtllib_is_eapol_frame(ieee, skb, hdrlen)) {
1120
1121                         /* pass unencrypted EAPOL frames even if encryption is
1122                          * configured */
1123                         struct eapol *eap = (struct eapol *)(skb->data +
1124                                 24);
1125                         RTLLIB_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
1126                                                 eap_get_type(eap->type));
1127                 } else {
1128                         RTLLIB_DEBUG_DROP(
1129                                 "encryption configured, but RX frame not encrypted (SA= %pM)\n",
1130                                 hdr->addr2);
1131                         return -1;
1132                 }
1133         }
1134
1135         if (crypt && !(fc & RTLLIB_FCTL_WEP) &&
1136             rtllib_is_eapol_frame(ieee, skb, hdrlen)) {
1137                         struct eapol *eap = (struct eapol *)(skb->data +
1138                                 24);
1139                         RTLLIB_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
1140                                                 eap_get_type(eap->type));
1141         }
1142
1143         if (crypt && !(fc & RTLLIB_FCTL_WEP) && !ieee->open_wep &&
1144             !rtllib_is_eapol_frame(ieee, skb, hdrlen)) {
1145                 RTLLIB_DEBUG_DROP(
1146                         "dropped unencrypted RX data frame from %pM (drop_unencrypted=1)\n",
1147                         hdr->addr2);
1148                 return -1;
1149         }
1150
1151         if (rtllib_is_eapol_frame(ieee, skb, hdrlen))
1152                 printk(KERN_WARNING "RX: IEEE802.1X EAPOL frame!\n");
1153
1154         return 0;
1155 }
1156
1157 static void rtllib_rx_check_leave_lps(struct rtllib_device *ieee, u8 unicast, u8 nr_subframes)
1158 {
1159         if (unicast) {
1160
1161                 if ((ieee->state == RTLLIB_LINKED)) {
1162                         if (((ieee->LinkDetectInfo.NumRxUnicastOkInPeriod +
1163                             ieee->LinkDetectInfo.NumTxOkInPeriod) > 8) ||
1164                             (ieee->LinkDetectInfo.NumRxUnicastOkInPeriod > 2)) {
1165                                 if (ieee->LeisurePSLeave)
1166                                         ieee->LeisurePSLeave(ieee->dev);
1167                         }
1168                 }
1169         }
1170         ieee->last_rx_ps_time = jiffies;
1171 }
1172
1173 static void rtllib_rx_indicate_pkt_legacy(struct rtllib_device *ieee,
1174                 struct rtllib_rx_stats *rx_stats,
1175                 struct rtllib_rxb *rxb,
1176                 u8 *dst,
1177                 u8 *src)
1178 {
1179         struct net_device *dev = ieee->dev;
1180         u16 ethertype;
1181         int i = 0;
1182
1183         if (rxb == NULL) {
1184                 printk(KERN_INFO "%s: rxb is NULL!!\n", __func__);
1185                 return ;
1186         }
1187
1188         for (i = 0; i < rxb->nr_subframes; i++) {
1189                 struct sk_buff *sub_skb = rxb->subframes[i];
1190
1191                 if (sub_skb) {
1192                         /* convert hdr + possible LLC headers into Ethernet header */
1193                         ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7];
1194                         if (sub_skb->len >= 8 &&
1195                                 ((memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) == 0 &&
1196                                 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1197                                 memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE) == 0)) {
1198                                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1199                                  * replace EtherType */
1200                                 skb_pull(sub_skb, SNAP_SIZE);
1201                                 memcpy(skb_push(sub_skb, ETH_ALEN), src, ETH_ALEN);
1202                                 memcpy(skb_push(sub_skb, ETH_ALEN), dst, ETH_ALEN);
1203                         } else {
1204                                 u16 len;
1205                                 /* Leave Ethernet header part of hdr and full payload */
1206                                 len = sub_skb->len;
1207                                 memcpy(skb_push(sub_skb, 2), &len, 2);
1208                                 memcpy(skb_push(sub_skb, ETH_ALEN), src, ETH_ALEN);
1209                                 memcpy(skb_push(sub_skb, ETH_ALEN), dst, ETH_ALEN);
1210                         }
1211
1212                         ieee->stats.rx_packets++;
1213                         ieee->stats.rx_bytes += sub_skb->len;
1214
1215                         if (is_multicast_ether_addr(dst))
1216                                 ieee->stats.multicast++;
1217
1218                         /* Indicate the packets to upper layer */
1219                         memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
1220                         sub_skb->protocol = eth_type_trans(sub_skb, dev);
1221                         sub_skb->dev = dev;
1222                         sub_skb->dev->stats.rx_packets++;
1223                         sub_skb->dev->stats.rx_bytes += sub_skb->len;
1224                         sub_skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
1225                         netif_rx(sub_skb);
1226                 }
1227         }
1228         kfree(rxb);
1229         rxb = NULL;
1230 }
1231
1232 static int rtllib_rx_InfraAdhoc(struct rtllib_device *ieee, struct sk_buff *skb,
1233                  struct rtllib_rx_stats *rx_stats)
1234 {
1235         struct net_device *dev = ieee->dev;
1236         struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
1237         struct lib80211_crypt_data *crypt = NULL;
1238         struct rtllib_rxb *rxb = NULL;
1239         struct rx_ts_record *pTS = NULL;
1240         u16 fc, sc, SeqNum = 0;
1241         u8 type, stype, multicast = 0, unicast = 0, nr_subframes = 0, TID = 0;
1242         u8 dst[ETH_ALEN], src[ETH_ALEN], bssid[ETH_ALEN] = {0}, *payload;
1243         size_t hdrlen = 0;
1244         bool bToOtherSTA = false;
1245         int ret = 0, i = 0;
1246
1247         hdr = (struct rtllib_hdr_4addr *)skb->data;
1248         fc = le16_to_cpu(hdr->frame_ctl);
1249         type = WLAN_FC_GET_TYPE(fc);
1250         stype = WLAN_FC_GET_STYPE(fc);
1251         sc = le16_to_cpu(hdr->seq_ctl);
1252
1253         /*Filter pkt not to me*/
1254         multicast = is_multicast_ether_addr(hdr->addr1);
1255         unicast = !multicast;
1256         if (unicast && !ether_addr_equal(dev->dev_addr, hdr->addr1)) {
1257                 if (ieee->bNetPromiscuousMode)
1258                         bToOtherSTA = true;
1259                 else
1260                         goto rx_dropped;
1261         }
1262
1263         /*Filter pkt has too small length */
1264         hdrlen = rtllib_rx_get_hdrlen(ieee, skb, rx_stats);
1265         if (skb->len < hdrlen) {
1266                 printk(KERN_INFO "%s():ERR!!! skb->len is smaller than hdrlen\n", __func__);
1267                 goto rx_dropped;
1268         }
1269
1270         /* Filter Duplicate pkt */
1271         ret = rtllib_rx_check_duplicate(ieee, skb, multicast);
1272         if (ret < 0)
1273                 goto rx_dropped;
1274
1275         /* Filter CTRL Frame */
1276         if (type == RTLLIB_FTYPE_CTL)
1277                 goto rx_dropped;
1278
1279         /* Filter MGNT Frame */
1280         if (type == RTLLIB_FTYPE_MGMT) {
1281                 if (bToOtherSTA)
1282                         goto rx_dropped;
1283                 if (rtllib_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
1284                         goto rx_dropped;
1285                 else
1286                         goto rx_exit;
1287         }
1288
1289         /* Filter WAPI DATA Frame */
1290
1291         /* Update statstics for AP roaming */
1292         if (!bToOtherSTA) {
1293                 ieee->LinkDetectInfo.NumRecvDataInPeriod++;
1294                 ieee->LinkDetectInfo.NumRxOkInPeriod++;
1295         }
1296         dev->last_rx = jiffies;
1297
1298         /* Data frame - extract src/dst addresses */
1299         rtllib_rx_extract_addr(ieee, hdr, dst, src, bssid);
1300
1301         /* Filter Data frames */
1302         ret = rtllib_rx_data_filter(ieee, fc, dst, src, bssid, hdr->addr2);
1303         if (ret < 0)
1304                 goto rx_dropped;
1305
1306         if (skb->len == hdrlen)
1307                 goto rx_dropped;
1308
1309         /* Send pspoll based on moredata */
1310         if ((ieee->iw_mode == IW_MODE_INFRA)  && (ieee->sta_sleep == LPS_IS_SLEEP)
1311                 && (ieee->polling) && (!bToOtherSTA)) {
1312                 if (WLAN_FC_MORE_DATA(fc)) {
1313                         /* more data bit is set, let's request a new frame from the AP */
1314                         rtllib_sta_ps_send_pspoll_frame(ieee);
1315                 } else {
1316                         ieee->polling =  false;
1317                 }
1318         }
1319
1320         /* Get crypt if encrypted */
1321         ret = rtllib_rx_get_crypt(ieee, skb, &crypt, hdrlen);
1322         if (ret == -1)
1323                 goto rx_dropped;
1324
1325         /* Decrypt data frame (including reassemble) */
1326         ret = rtllib_rx_decrypt(ieee, skb, rx_stats, crypt, hdrlen);
1327         if (ret == -1)
1328                 goto rx_dropped;
1329         else if (ret == -2)
1330                 goto rx_exit;
1331
1332         /* Get TS for Rx Reorder  */
1333         hdr = (struct rtllib_hdr_4addr *) skb->data;
1334         if (ieee->current_network.qos_data.active && IsQoSDataFrame(skb->data)
1335                 && !is_multicast_ether_addr(hdr->addr1)
1336                 && (!bToOtherSTA)) {
1337                 TID = Frame_QoSTID(skb->data);
1338                 SeqNum = WLAN_GET_SEQ_SEQ(sc);
1339                 GetTs(ieee, (struct ts_common_info **) &pTS, hdr->addr2, TID, RX_DIR, true);
1340                 if (TID != 0 && TID != 3)
1341                         ieee->bis_any_nonbepkts = true;
1342         }
1343
1344         /* Parse rx data frame (For AMSDU) */
1345         /* skb: hdr + (possible reassembled) full plaintext payload */
1346         payload = skb->data + hdrlen;
1347         rxb = kmalloc(sizeof(struct rtllib_rxb), GFP_ATOMIC);
1348         if (rxb == NULL) {
1349                 RTLLIB_DEBUG(RTLLIB_DL_ERR,
1350                              "%s(): kmalloc rxb error\n", __func__);
1351                 goto rx_dropped;
1352         }
1353         /* to parse amsdu packets */
1354         /* qos data packets & reserved bit is 1 */
1355         if (parse_subframe(ieee, skb, rx_stats, rxb, src, dst) == 0) {
1356                 /* only to free rxb, and not submit the packets to upper layer */
1357                 for (i = 0; i < rxb->nr_subframes; i++)
1358                         dev_kfree_skb(rxb->subframes[i]);
1359                 kfree(rxb);
1360                 rxb = NULL;
1361                 goto rx_dropped;
1362         }
1363
1364         /* Update WAPI PN */
1365
1366         /* Check if leave LPS */
1367         if (!bToOtherSTA) {
1368                 if (ieee->bIsAggregateFrame)
1369                         nr_subframes = rxb->nr_subframes;
1370                 else
1371                         nr_subframes = 1;
1372                 if (unicast)
1373                         ieee->LinkDetectInfo.NumRxUnicastOkInPeriod += nr_subframes;
1374                 rtllib_rx_check_leave_lps(ieee, unicast, nr_subframes);
1375         }
1376
1377         /* Indicate packets to upper layer or Rx Reorder */
1378         if (ieee->pHTInfo->bCurRxReorderEnable == false || pTS == NULL || bToOtherSTA)
1379                 rtllib_rx_indicate_pkt_legacy(ieee, rx_stats, rxb, dst, src);
1380         else
1381                 RxReorderIndicatePacket(ieee, rxb, pTS, SeqNum);
1382
1383         dev_kfree_skb(skb);
1384
1385  rx_exit:
1386         return 1;
1387
1388  rx_dropped:
1389         ieee->stats.rx_dropped++;
1390
1391         /* Returning 0 indicates to caller that we have not handled the SKB--
1392          * so it is still allocated and can be used again by underlying
1393          * hardware as a DMA target */
1394         return 0;
1395 }
1396
1397 static int rtllib_rx_Master(struct rtllib_device *ieee, struct sk_buff *skb,
1398                  struct rtllib_rx_stats *rx_stats)
1399 {
1400         return 0;
1401 }
1402
1403 static int rtllib_rx_Monitor(struct rtllib_device *ieee, struct sk_buff *skb,
1404                  struct rtllib_rx_stats *rx_stats)
1405 {
1406         struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
1407         u16 fc = le16_to_cpu(hdr->frame_ctl);
1408         size_t hdrlen = rtllib_get_hdrlen(fc);
1409
1410         if (skb->len < hdrlen) {
1411                 printk(KERN_INFO "%s():ERR!!! skb->len is smaller than hdrlen\n", __func__);
1412                 return 0;
1413         }
1414
1415         if (HTCCheck(ieee, skb->data)) {
1416                 if (net_ratelimit())
1417                         printk(KERN_INFO "%s: Find HTCControl!\n", __func__);
1418                 hdrlen += 4;
1419         }
1420
1421         rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen);
1422         ieee->stats.rx_packets++;
1423         ieee->stats.rx_bytes += skb->len;
1424
1425         return 1;
1426 }
1427
1428 static int rtllib_rx_Mesh(struct rtllib_device *ieee, struct sk_buff *skb,
1429                  struct rtllib_rx_stats *rx_stats)
1430 {
1431         return 0;
1432 }
1433
1434 /* All received frames are sent to this function. @skb contains the frame in
1435  * IEEE 802.11 format, i.e., in the format it was sent over air.
1436  * This function is called only as a tasklet (software IRQ). */
1437 int rtllib_rx(struct rtllib_device *ieee, struct sk_buff *skb,
1438                  struct rtllib_rx_stats *rx_stats)
1439 {
1440         int ret = 0;
1441
1442         if ((NULL == ieee) || (NULL == skb) || (NULL == rx_stats)) {
1443                 printk(KERN_INFO "%s: Input parameters NULL!\n", __func__);
1444                 goto rx_dropped;
1445         }
1446         if (skb->len < 10) {
1447                 printk(KERN_INFO "%s: SKB length < 10\n", __func__);
1448                 goto rx_dropped;
1449         }
1450
1451         switch (ieee->iw_mode) {
1452         case IW_MODE_ADHOC:
1453         case IW_MODE_INFRA:
1454                 ret = rtllib_rx_InfraAdhoc(ieee, skb, rx_stats);
1455                 break;
1456         case IW_MODE_MASTER:
1457         case IW_MODE_REPEAT:
1458                 ret = rtllib_rx_Master(ieee, skb, rx_stats);
1459                 break;
1460         case IW_MODE_MONITOR:
1461                 ret = rtllib_rx_Monitor(ieee, skb, rx_stats);
1462                 break;
1463         case IW_MODE_MESH:
1464                 ret = rtllib_rx_Mesh(ieee, skb, rx_stats);
1465                 break;
1466         default:
1467                 printk(KERN_INFO"%s: ERR iw mode!!!\n", __func__);
1468                 break;
1469         }
1470
1471         return ret;
1472
1473  rx_dropped:
1474         if (ieee)
1475                 ieee->stats.rx_dropped++;
1476         return 0;
1477 }
1478 EXPORT_SYMBOL(rtllib_rx);
1479
1480 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
1481
1482 /*
1483 * Make ther structure we read from the beacon packet has
1484 * the right values
1485 */
1486 static int rtllib_verify_qos_info(struct rtllib_qos_information_element
1487                                      *info_element, int sub_type)
1488 {
1489
1490         if (info_element->qui_subtype != sub_type)
1491                 return -1;
1492         if (memcmp(info_element->qui, qos_oui, QOS_OUI_LEN))
1493                 return -1;
1494         if (info_element->qui_type != QOS_OUI_TYPE)
1495                 return -1;
1496         if (info_element->version != QOS_VERSION_1)
1497                 return -1;
1498
1499         return 0;
1500 }
1501
1502
1503 /*
1504  * Parse a QoS parameter element
1505  */
1506 static int rtllib_read_qos_param_element(struct rtllib_qos_parameter_info
1507                                             *element_param, struct rtllib_info_element
1508                                             *info_element)
1509 {
1510         int ret = 0;
1511         u16 size = sizeof(struct rtllib_qos_parameter_info) - 2;
1512
1513         if ((info_element == NULL) || (element_param == NULL))
1514                 return -1;
1515
1516         if (info_element->id == QOS_ELEMENT_ID && info_element->len == size) {
1517                 memcpy(element_param->info_element.qui, info_element->data,
1518                        info_element->len);
1519                 element_param->info_element.elementID = info_element->id;
1520                 element_param->info_element.length = info_element->len;
1521         } else
1522                 ret = -1;
1523         if (ret == 0)
1524                 ret = rtllib_verify_qos_info(&element_param->info_element,
1525                                                 QOS_OUI_PARAM_SUB_TYPE);
1526         return ret;
1527 }
1528
1529 /*
1530  * Parse a QoS information element
1531  */
1532 static int rtllib_read_qos_info_element(struct
1533                                            rtllib_qos_information_element
1534                                            *element_info, struct rtllib_info_element
1535                                            *info_element)
1536 {
1537         int ret = 0;
1538         u16 size = sizeof(struct rtllib_qos_information_element) - 2;
1539
1540         if (element_info == NULL)
1541                 return -1;
1542         if (info_element == NULL)
1543                 return -1;
1544
1545         if ((info_element->id == QOS_ELEMENT_ID) && (info_element->len == size)) {
1546                 memcpy(element_info->qui, info_element->data,
1547                        info_element->len);
1548                 element_info->elementID = info_element->id;
1549                 element_info->length = info_element->len;
1550         } else
1551                 ret = -1;
1552
1553         if (ret == 0)
1554                 ret = rtllib_verify_qos_info(element_info,
1555                                                 QOS_OUI_INFO_SUB_TYPE);
1556         return ret;
1557 }
1558
1559
1560 /*
1561  * Write QoS parameters from the ac parameters.
1562  */
1563 static int rtllib_qos_convert_ac_to_parameters(struct rtllib_qos_parameter_info *param_elm,
1564                 struct rtllib_qos_data *qos_data)
1565 {
1566         struct rtllib_qos_ac_parameter *ac_params;
1567         struct rtllib_qos_parameters *qos_param = &(qos_data->parameters);
1568         int i;
1569         u8 aci;
1570         u8 acm;
1571
1572         qos_data->wmm_acm = 0;
1573         for (i = 0; i < QOS_QUEUE_NUM; i++) {
1574                 ac_params = &(param_elm->ac_params_record[i]);
1575
1576                 aci = (ac_params->aci_aifsn & 0x60) >> 5;
1577                 acm = (ac_params->aci_aifsn & 0x10) >> 4;
1578
1579                 if (aci >= QOS_QUEUE_NUM)
1580                         continue;
1581                 switch (aci) {
1582                 case 1:
1583                         /* BIT(0) | BIT(3) */
1584                         if (acm)
1585                                 qos_data->wmm_acm |= (0x01<<0)|(0x01<<3);
1586                         break;
1587                 case 2:
1588                         /* BIT(4) | BIT(5) */
1589                         if (acm)
1590                                 qos_data->wmm_acm |= (0x01<<4)|(0x01<<5);
1591                         break;
1592                 case 3:
1593                         /* BIT(6) | BIT(7) */
1594                         if (acm)
1595                                 qos_data->wmm_acm |= (0x01<<6)|(0x01<<7);
1596                         break;
1597                 case 0:
1598                 default:
1599                         /* BIT(1) | BIT(2) */
1600                         if (acm)
1601                                 qos_data->wmm_acm |= (0x01<<1)|(0x01<<2);
1602                         break;
1603                 }
1604
1605                 qos_param->aifs[aci] = (ac_params->aci_aifsn) & 0x0f;
1606
1607                 /* WMM spec P.11: The minimum value for AIFSN shall be 2 */
1608                 qos_param->aifs[aci] = (qos_param->aifs[aci] < 2) ? 2 : qos_param->aifs[aci];
1609
1610                 qos_param->cw_min[aci] = cpu_to_le16(ac_params->ecw_min_max & 0x0F);
1611
1612                 qos_param->cw_max[aci] = cpu_to_le16((ac_params->ecw_min_max & 0xF0) >> 4);
1613
1614                 qos_param->flag[aci] =
1615                     (ac_params->aci_aifsn & 0x10) ? 0x01 : 0x00;
1616                 qos_param->tx_op_limit[aci] = ac_params->tx_op_limit;
1617         }
1618         return 0;
1619 }
1620
1621 /*
1622  * we have a generic data element which it may contain QoS information or
1623  * parameters element. check the information element length to decide
1624  * which type to read
1625  */
1626 static int rtllib_parse_qos_info_param_IE(struct rtllib_info_element
1627                                              *info_element,
1628                                              struct rtllib_network *network)
1629 {
1630         int rc = 0;
1631         struct rtllib_qos_information_element qos_info_element;
1632
1633         rc = rtllib_read_qos_info_element(&qos_info_element, info_element);
1634
1635         if (rc == 0) {
1636                 network->qos_data.param_count = qos_info_element.ac_info & 0x0F;
1637                 network->flags |= NETWORK_HAS_QOS_INFORMATION;
1638         } else {
1639                 struct rtllib_qos_parameter_info param_element;
1640
1641                 rc = rtllib_read_qos_param_element(&param_element,
1642                                                       info_element);
1643                 if (rc == 0) {
1644                         rtllib_qos_convert_ac_to_parameters(&param_element,
1645                                                                &(network->qos_data));
1646                         network->flags |= NETWORK_HAS_QOS_PARAMETERS;
1647                         network->qos_data.param_count =
1648                             param_element.info_element.ac_info & 0x0F;
1649                 }
1650         }
1651
1652         if (rc == 0) {
1653                 RTLLIB_DEBUG_QOS("QoS is supported\n");
1654                 network->qos_data.supported = 1;
1655         }
1656         return rc;
1657 }
1658
1659 #define MFIE_STRING(x) case MFIE_TYPE_ ##x: return #x
1660
1661 static const char *get_info_element_string(u16 id)
1662 {
1663         switch (id) {
1664         MFIE_STRING(SSID);
1665         MFIE_STRING(RATES);
1666         MFIE_STRING(FH_SET);
1667         MFIE_STRING(DS_SET);
1668         MFIE_STRING(CF_SET);
1669         MFIE_STRING(TIM);
1670         MFIE_STRING(IBSS_SET);
1671         MFIE_STRING(COUNTRY);
1672         MFIE_STRING(HOP_PARAMS);
1673         MFIE_STRING(HOP_TABLE);
1674         MFIE_STRING(REQUEST);
1675         MFIE_STRING(CHALLENGE);
1676         MFIE_STRING(POWER_CONSTRAINT);
1677         MFIE_STRING(POWER_CAPABILITY);
1678         MFIE_STRING(TPC_REQUEST);
1679         MFIE_STRING(TPC_REPORT);
1680         MFIE_STRING(SUPP_CHANNELS);
1681         MFIE_STRING(CSA);
1682         MFIE_STRING(MEASURE_REQUEST);
1683         MFIE_STRING(MEASURE_REPORT);
1684         MFIE_STRING(QUIET);
1685         MFIE_STRING(IBSS_DFS);
1686         MFIE_STRING(RSN);
1687         MFIE_STRING(RATES_EX);
1688         MFIE_STRING(GENERIC);
1689         MFIE_STRING(QOS_PARAMETER);
1690         default:
1691                 return "UNKNOWN";
1692         }
1693 }
1694
1695 static inline void rtllib_extract_country_ie(
1696         struct rtllib_device *ieee,
1697         struct rtllib_info_element *info_element,
1698         struct rtllib_network *network,
1699         u8 *addr2)
1700 {
1701         if (IS_DOT11D_ENABLE(ieee)) {
1702                 if (info_element->len != 0) {
1703                         memcpy(network->CountryIeBuf, info_element->data, info_element->len);
1704                         network->CountryIeLen = info_element->len;
1705
1706                         if (!IS_COUNTRY_IE_VALID(ieee)) {
1707                                 if (rtllib_act_scanning(ieee, false) && ieee->FirstIe_InScan)
1708                                         printk(KERN_INFO "Received beacon ContryIE, SSID: <%s>\n", network->ssid);
1709                                 Dot11d_UpdateCountryIe(ieee, addr2, info_element->len, info_element->data);
1710                         }
1711                 }
1712
1713                 if (IS_EQUAL_CIE_SRC(ieee, addr2))
1714                         UPDATE_CIE_WATCHDOG(ieee);
1715         }
1716
1717 }
1718
1719 int rtllib_parse_info_param(struct rtllib_device *ieee,
1720                 struct rtllib_info_element *info_element,
1721                 u16 length,
1722                 struct rtllib_network *network,
1723                 struct rtllib_rx_stats *stats)
1724 {
1725         u8 i;
1726         short offset;
1727         u16     tmp_htcap_len = 0;
1728         u16     tmp_htinfo_len = 0;
1729         u16 ht_realtek_agg_len = 0;
1730         u8  ht_realtek_agg_buf[MAX_IE_LEN];
1731         char rates_str[64];
1732         char *p;
1733
1734         while (length >= sizeof(*info_element)) {
1735                 if (sizeof(*info_element) + info_element->len > length) {
1736                         RTLLIB_DEBUG_MGMT("Info elem: parse failed: info_element->len + 2 > left : info_element->len+2=%zd left=%d, id=%d.\n",
1737                                              info_element->len +
1738                                              sizeof(*info_element),
1739                                              length, info_element->id);
1740                         /* We stop processing but don't return an error here
1741                          * because some misbehaviour APs break this rule. ie.
1742                          * Orinoco AP1000. */
1743                         break;
1744                 }
1745
1746                 switch (info_element->id) {
1747                 case MFIE_TYPE_SSID:
1748                         if (rtllib_is_empty_essid(info_element->data,
1749                                                      info_element->len)) {
1750                                 network->flags |= NETWORK_EMPTY_ESSID;
1751                                 break;
1752                         }
1753
1754                         network->ssid_len = min(info_element->len,
1755                                                 (u8) IW_ESSID_MAX_SIZE);
1756                         memcpy(network->ssid, info_element->data, network->ssid_len);
1757                         if (network->ssid_len < IW_ESSID_MAX_SIZE)
1758                                 memset(network->ssid + network->ssid_len, 0,
1759                                        IW_ESSID_MAX_SIZE - network->ssid_len);
1760
1761                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_SSID: '%s' len=%d.\n",
1762                                              network->ssid, network->ssid_len);
1763                         break;
1764
1765                 case MFIE_TYPE_RATES:
1766                         p = rates_str;
1767                         network->rates_len = min(info_element->len,
1768                                                  MAX_RATES_LENGTH);
1769                         for (i = 0; i < network->rates_len; i++) {
1770                                 network->rates[i] = info_element->data[i];
1771                                 p += snprintf(p, sizeof(rates_str) -
1772                                               (p - rates_str), "%02X ",
1773                                               network->rates[i]);
1774                                 if (rtllib_is_ofdm_rate
1775                                     (info_element->data[i])) {
1776                                         network->flags |= NETWORK_HAS_OFDM;
1777                                         if (info_element->data[i] &
1778                                             RTLLIB_BASIC_RATE_MASK)
1779                                                 network->flags &=
1780                                                     ~NETWORK_HAS_CCK;
1781                                 }
1782
1783                                 if (rtllib_is_cck_rate
1784                                     (info_element->data[i])) {
1785                                         network->flags |= NETWORK_HAS_CCK;
1786                                 }
1787                         }
1788
1789                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_RATES: '%s' (%d)\n",
1790                                              rates_str, network->rates_len);
1791                         break;
1792
1793                 case MFIE_TYPE_RATES_EX:
1794                         p = rates_str;
1795                         network->rates_ex_len = min(info_element->len,
1796                                                     MAX_RATES_EX_LENGTH);
1797                         for (i = 0; i < network->rates_ex_len; i++) {
1798                                 network->rates_ex[i] = info_element->data[i];
1799                                 p += snprintf(p, sizeof(rates_str) -
1800                                               (p - rates_str), "%02X ",
1801                                               network->rates_ex[i]);
1802                                 if (rtllib_is_ofdm_rate
1803                                     (info_element->data[i])) {
1804                                         network->flags |= NETWORK_HAS_OFDM;
1805                                         if (info_element->data[i] &
1806                                             RTLLIB_BASIC_RATE_MASK)
1807                                                 network->flags &=
1808                                                     ~NETWORK_HAS_CCK;
1809                                 }
1810                         }
1811
1812                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_RATES_EX: '%s' (%d)\n",
1813                                              rates_str, network->rates_ex_len);
1814                         break;
1815
1816                 case MFIE_TYPE_DS_SET:
1817                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_DS_SET: %d\n",
1818                                              info_element->data[0]);
1819                         network->channel = info_element->data[0];
1820                         break;
1821
1822                 case MFIE_TYPE_FH_SET:
1823                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_FH_SET: ignored\n");
1824                         break;
1825
1826                 case MFIE_TYPE_CF_SET:
1827                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_CF_SET: ignored\n");
1828                         break;
1829
1830                 case MFIE_TYPE_TIM:
1831                         if (info_element->len < 4)
1832                                 break;
1833
1834                         network->tim.tim_count = info_element->data[0];
1835                         network->tim.tim_period = info_element->data[1];
1836
1837                         network->dtim_period = info_element->data[1];
1838                         if (ieee->state != RTLLIB_LINKED)
1839                                 break;
1840                         network->last_dtim_sta_time = jiffies;
1841
1842                         network->dtim_data = RTLLIB_DTIM_VALID;
1843
1844
1845                         if (info_element->data[2] & 1)
1846                                 network->dtim_data |= RTLLIB_DTIM_MBCAST;
1847
1848                         offset = (info_element->data[2] >> 1)*2;
1849
1850
1851                         if (ieee->assoc_id < 8*offset ||
1852                             ieee->assoc_id > 8*(offset + info_element->len - 3))
1853                                 break;
1854
1855                         offset = (ieee->assoc_id / 8) - offset;
1856                         if (info_element->data[3 + offset] &
1857                            (1 << (ieee->assoc_id % 8)))
1858                                 network->dtim_data |= RTLLIB_DTIM_UCAST;
1859
1860                         network->listen_interval = network->dtim_period;
1861                         break;
1862
1863                 case MFIE_TYPE_ERP:
1864                         network->erp_value = info_element->data[0];
1865                         network->flags |= NETWORK_HAS_ERP_VALUE;
1866                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_ERP_SET: %d\n",
1867                                              network->erp_value);
1868                         break;
1869                 case MFIE_TYPE_IBSS_SET:
1870                         network->atim_window = info_element->data[0];
1871                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_IBSS_SET: %d\n",
1872                                              network->atim_window);
1873                         break;
1874
1875                 case MFIE_TYPE_CHALLENGE:
1876                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_CHALLENGE: ignored\n");
1877                         break;
1878
1879                 case MFIE_TYPE_GENERIC:
1880                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_GENERIC: %d bytes\n",
1881                                              info_element->len);
1882                         if (!rtllib_parse_qos_info_param_IE(info_element,
1883                                                                network))
1884                                 break;
1885                         if (info_element->len >= 4 &&
1886                             info_element->data[0] == 0x00 &&
1887                             info_element->data[1] == 0x50 &&
1888                             info_element->data[2] == 0xf2 &&
1889                             info_element->data[3] == 0x01) {
1890                                 network->wpa_ie_len = min(info_element->len + 2,
1891                                                           MAX_WPA_IE_LEN);
1892                                 memcpy(network->wpa_ie, info_element,
1893                                        network->wpa_ie_len);
1894                                 break;
1895                         }
1896                         if (info_element->len == 7 &&
1897                             info_element->data[0] == 0x00 &&
1898                             info_element->data[1] == 0xe0 &&
1899                             info_element->data[2] == 0x4c &&
1900                             info_element->data[3] == 0x01 &&
1901                             info_element->data[4] == 0x02)
1902                                 network->Turbo_Enable = 1;
1903
1904                         if (tmp_htcap_len == 0) {
1905                                 if (info_element->len >= 4 &&
1906                                    info_element->data[0] == 0x00 &&
1907                                    info_element->data[1] == 0x90 &&
1908                                    info_element->data[2] == 0x4c &&
1909                                    info_element->data[3] == 0x033) {
1910
1911                                                 tmp_htcap_len = min(info_element->len, (u8)MAX_IE_LEN);
1912                                                 if (tmp_htcap_len != 0) {
1913                                                         network->bssht.bdHTSpecVer = HT_SPEC_VER_EWC;
1914                                                         network->bssht.bdHTCapLen = tmp_htcap_len > sizeof(network->bssht.bdHTCapBuf) ?
1915                                                                 sizeof(network->bssht.bdHTCapBuf) : tmp_htcap_len;
1916                                                         memcpy(network->bssht.bdHTCapBuf, info_element->data, network->bssht.bdHTCapLen);
1917                                                 }
1918                                 }
1919                                 if (tmp_htcap_len != 0) {
1920                                         network->bssht.bdSupportHT = true;
1921                                         network->bssht.bdHT1R = ((((struct ht_capab_ele *)(network->bssht.bdHTCapBuf))->MCS[1]) == 0);
1922                                 } else {
1923                                         network->bssht.bdSupportHT = false;
1924                                         network->bssht.bdHT1R = false;
1925                                 }
1926                         }
1927
1928
1929                         if (tmp_htinfo_len == 0) {
1930                                 if (info_element->len >= 4 &&
1931                                     info_element->data[0] == 0x00 &&
1932                                     info_element->data[1] == 0x90 &&
1933                                     info_element->data[2] == 0x4c &&
1934                                     info_element->data[3] == 0x034) {
1935                                         tmp_htinfo_len = min(info_element->len, (u8)MAX_IE_LEN);
1936                                         if (tmp_htinfo_len != 0) {
1937                                                 network->bssht.bdHTSpecVer = HT_SPEC_VER_EWC;
1938                                                 if (tmp_htinfo_len) {
1939                                                         network->bssht.bdHTInfoLen = tmp_htinfo_len > sizeof(network->bssht.bdHTInfoBuf) ?
1940                                                                 sizeof(network->bssht.bdHTInfoBuf) : tmp_htinfo_len;
1941                                                         memcpy(network->bssht.bdHTInfoBuf, info_element->data, network->bssht.bdHTInfoLen);
1942                                                 }
1943
1944                                         }
1945
1946                                 }
1947                         }
1948
1949                         if (ieee->aggregation) {
1950                                 if (network->bssht.bdSupportHT) {
1951                                         if (info_element->len >= 4 &&
1952                                             info_element->data[0] == 0x00 &&
1953                                             info_element->data[1] == 0xe0 &&
1954                                             info_element->data[2] == 0x4c &&
1955                                             info_element->data[3] == 0x02) {
1956                                                 ht_realtek_agg_len = min(info_element->len, (u8)MAX_IE_LEN);
1957                                                 memcpy(ht_realtek_agg_buf, info_element->data, info_element->len);
1958                                         }
1959                                         if (ht_realtek_agg_len >= 5) {
1960                                                 network->realtek_cap_exit = true;
1961                                                 network->bssht.bdRT2RTAggregation = true;
1962
1963                                                 if ((ht_realtek_agg_buf[4] == 1) && (ht_realtek_agg_buf[5] & 0x02))
1964                                                         network->bssht.bdRT2RTLongSlotTime = true;
1965
1966                                                 if ((ht_realtek_agg_buf[4] == 1) && (ht_realtek_agg_buf[5] & RT_HT_CAP_USE_92SE))
1967                                                         network->bssht.RT2RT_HT_Mode |= RT_HT_CAP_USE_92SE;
1968                                         }
1969                                 }
1970                                 if (ht_realtek_agg_len >= 5) {
1971                                         if ((ht_realtek_agg_buf[5] & RT_HT_CAP_USE_SOFTAP))
1972                                                 network->bssht.RT2RT_HT_Mode |= RT_HT_CAP_USE_SOFTAP;
1973                                 }
1974                         }
1975
1976                         if ((info_element->len >= 3 &&
1977                              info_element->data[0] == 0x00 &&
1978                              info_element->data[1] == 0x05 &&
1979                              info_element->data[2] == 0xb5) ||
1980                              (info_element->len >= 3 &&
1981                              info_element->data[0] == 0x00 &&
1982                              info_element->data[1] == 0x0a &&
1983                              info_element->data[2] == 0xf7) ||
1984                              (info_element->len >= 3 &&
1985                              info_element->data[0] == 0x00 &&
1986                              info_element->data[1] == 0x10 &&
1987                              info_element->data[2] == 0x18)) {
1988                                 network->broadcom_cap_exist = true;
1989                         }
1990                         if (info_element->len >= 3 &&
1991                             info_element->data[0] == 0x00 &&
1992                             info_element->data[1] == 0x0c &&
1993                             info_element->data[2] == 0x43)
1994                                 network->ralink_cap_exist = true;
1995                         if ((info_element->len >= 3 &&
1996                              info_element->data[0] == 0x00 &&
1997                              info_element->data[1] == 0x03 &&
1998                              info_element->data[2] == 0x7f) ||
1999                              (info_element->len >= 3 &&
2000                              info_element->data[0] == 0x00 &&
2001                              info_element->data[1] == 0x13 &&
2002                              info_element->data[2] == 0x74))
2003                                 network->atheros_cap_exist = true;
2004
2005                         if ((info_element->len >= 3 &&
2006                              info_element->data[0] == 0x00 &&
2007                              info_element->data[1] == 0x50 &&
2008                              info_element->data[2] == 0x43))
2009                                 network->marvell_cap_exist = true;
2010                         if (info_element->len >= 3 &&
2011                             info_element->data[0] == 0x00 &&
2012                             info_element->data[1] == 0x40 &&
2013                             info_element->data[2] == 0x96)
2014                                 network->cisco_cap_exist = true;
2015
2016
2017                         if (info_element->len >= 3 &&
2018                             info_element->data[0] == 0x00 &&
2019                             info_element->data[1] == 0x0a &&
2020                             info_element->data[2] == 0xf5)
2021                                 network->airgo_cap_exist = true;
2022
2023                         if (info_element->len > 4 &&
2024                             info_element->data[0] == 0x00 &&
2025                             info_element->data[1] == 0x40 &&
2026                             info_element->data[2] == 0x96 &&
2027                             info_element->data[3] == 0x01) {
2028                                 if (info_element->len == 6) {
2029                                         memcpy(network->CcxRmState, &info_element[4], 2);
2030                                         if (network->CcxRmState[0] != 0)
2031                                                 network->bCcxRmEnable = true;
2032                                         else
2033                                                 network->bCcxRmEnable = false;
2034                                         network->MBssidMask = network->CcxRmState[1] & 0x07;
2035                                         if (network->MBssidMask != 0) {
2036                                                 network->bMBssidValid = true;
2037                                                 network->MBssidMask = 0xff << (network->MBssidMask);
2038                                                 memcpy(network->MBssid, network->bssid, ETH_ALEN);
2039                                                 network->MBssid[5] &= network->MBssidMask;
2040                                         } else {
2041                                                 network->bMBssidValid = false;
2042                                         }
2043                                 } else {
2044                                         network->bCcxRmEnable = false;
2045                                 }
2046                         }
2047                         if (info_element->len > 4  &&
2048                             info_element->data[0] == 0x00 &&
2049                             info_element->data[1] == 0x40 &&
2050                             info_element->data[2] == 0x96 &&
2051                             info_element->data[3] == 0x03) {
2052                                 if (info_element->len == 5) {
2053                                         network->bWithCcxVerNum = true;
2054                                         network->BssCcxVerNumber = info_element->data[4];
2055                                 } else {
2056                                         network->bWithCcxVerNum = false;
2057                                         network->BssCcxVerNumber = 0;
2058                                 }
2059                         }
2060                         if (info_element->len > 4  &&
2061                             info_element->data[0] == 0x00 &&
2062                             info_element->data[1] == 0x50 &&
2063                             info_element->data[2] == 0xf2 &&
2064                             info_element->data[3] == 0x04) {
2065                                 RTLLIB_DEBUG_MGMT("MFIE_TYPE_WZC: %d bytes\n",
2066                                                      info_element->len);
2067                                 network->wzc_ie_len = min(info_element->len+2,
2068                                                           MAX_WZC_IE_LEN);
2069                                 memcpy(network->wzc_ie, info_element,
2070                                                 network->wzc_ie_len);
2071                         }
2072                         break;
2073
2074                 case MFIE_TYPE_RSN:
2075                         RTLLIB_DEBUG_MGMT("MFIE_TYPE_RSN: %d bytes\n",
2076                                              info_element->len);
2077                         network->rsn_ie_len = min(info_element->len + 2,
2078                                                   MAX_WPA_IE_LEN);
2079                         memcpy(network->rsn_ie, info_element,
2080                                network->rsn_ie_len);
2081                         break;
2082
2083                 case MFIE_TYPE_HT_CAP:
2084                         RTLLIB_DEBUG_SCAN("MFIE_TYPE_HT_CAP: %d bytes\n",
2085                                              info_element->len);
2086                         tmp_htcap_len = min(info_element->len, (u8)MAX_IE_LEN);
2087                         if (tmp_htcap_len != 0) {
2088                                 network->bssht.bdHTSpecVer = HT_SPEC_VER_EWC;
2089                                 network->bssht.bdHTCapLen = tmp_htcap_len > sizeof(network->bssht.bdHTCapBuf) ?
2090                                         sizeof(network->bssht.bdHTCapBuf) : tmp_htcap_len;
2091                                 memcpy(network->bssht.bdHTCapBuf,
2092                                        info_element->data,
2093                                        network->bssht.bdHTCapLen);
2094
2095                                 network->bssht.bdSupportHT = true;
2096                                 network->bssht.bdHT1R = ((((struct ht_capab_ele *)
2097                                                         network->bssht.bdHTCapBuf))->MCS[1]) == 0;
2098
2099                                 network->bssht.bdBandWidth = (enum ht_channel_width)
2100                                                              (((struct ht_capab_ele *)
2101                                                              (network->bssht.bdHTCapBuf))->ChlWidth);
2102                         } else {
2103                                 network->bssht.bdSupportHT = false;
2104                                 network->bssht.bdHT1R = false;
2105                                 network->bssht.bdBandWidth = HT_CHANNEL_WIDTH_20;
2106                         }
2107                         break;
2108
2109
2110                 case MFIE_TYPE_HT_INFO:
2111                         RTLLIB_DEBUG_SCAN("MFIE_TYPE_HT_INFO: %d bytes\n",
2112                                              info_element->len);
2113                         tmp_htinfo_len = min(info_element->len, (u8)MAX_IE_LEN);
2114                         if (tmp_htinfo_len) {
2115                                 network->bssht.bdHTSpecVer = HT_SPEC_VER_IEEE;
2116                                 network->bssht.bdHTInfoLen = tmp_htinfo_len >
2117                                         sizeof(network->bssht.bdHTInfoBuf) ?
2118                                         sizeof(network->bssht.bdHTInfoBuf) :
2119                                         tmp_htinfo_len;
2120                                 memcpy(network->bssht.bdHTInfoBuf,
2121                                        info_element->data,
2122                                        network->bssht.bdHTInfoLen);
2123                         }
2124                         break;
2125
2126                 case MFIE_TYPE_AIRONET:
2127                         RTLLIB_DEBUG_SCAN("MFIE_TYPE_AIRONET: %d bytes\n",
2128                                              info_element->len);
2129                         if (info_element->len > IE_CISCO_FLAG_POSITION) {
2130                                 network->bWithAironetIE = true;
2131
2132                                 if ((info_element->data[IE_CISCO_FLAG_POSITION]
2133                                      & SUPPORT_CKIP_MIC) ||
2134                                      (info_element->data[IE_CISCO_FLAG_POSITION]
2135                                      & SUPPORT_CKIP_PK))
2136                                         network->bCkipSupported = true;
2137                                 else
2138                                         network->bCkipSupported = false;
2139                         } else {
2140                                 network->bWithAironetIE = false;
2141                                 network->bCkipSupported = false;
2142                         }
2143                         break;
2144                 case MFIE_TYPE_QOS_PARAMETER:
2145                         printk(KERN_ERR
2146                                "QoS Error need to parse QOS_PARAMETER IE\n");
2147                         break;
2148
2149                 case MFIE_TYPE_COUNTRY:
2150                         RTLLIB_DEBUG_SCAN("MFIE_TYPE_COUNTRY: %d bytes\n",
2151                                              info_element->len);
2152                         rtllib_extract_country_ie(ieee, info_element, network,
2153                                                   network->bssid);
2154                         break;
2155 /* TODO */
2156                 default:
2157                         RTLLIB_DEBUG_MGMT
2158                             ("Unsupported info element: %s (%d)\n",
2159                              get_info_element_string(info_element->id),
2160                              info_element->id);
2161                         break;
2162                 }
2163
2164                 length -= sizeof(*info_element) + info_element->len;
2165                 info_element =
2166                     (struct rtllib_info_element *)&info_element->
2167                     data[info_element->len];
2168         }
2169
2170         if (!network->atheros_cap_exist && !network->broadcom_cap_exist &&
2171             !network->cisco_cap_exist && !network->ralink_cap_exist &&
2172             !network->bssht.bdRT2RTAggregation)
2173                 network->unknown_cap_exist = true;
2174         else
2175                 network->unknown_cap_exist = false;
2176         return 0;
2177 }
2178
2179 static long rtllib_translate_todbm(u8 signal_strength_index)
2180 {
2181         long    signal_power;
2182
2183         signal_power = (long)((signal_strength_index + 1) >> 1);
2184         signal_power -= 95;
2185
2186         return signal_power;
2187 }
2188
2189 static inline int rtllib_network_init(
2190         struct rtllib_device *ieee,
2191         struct rtllib_probe_response *beacon,
2192         struct rtllib_network *network,
2193         struct rtllib_rx_stats *stats)
2194 {
2195
2196         /*
2197         network->qos_data.active = 0;
2198         network->qos_data.supported = 0;
2199         network->qos_data.param_count = 0;
2200         network->qos_data.old_param_count = 0;
2201         */
2202         memset(&network->qos_data, 0, sizeof(struct rtllib_qos_data));
2203
2204         /* Pull out fixed field data */
2205         memcpy(network->bssid, beacon->header.addr3, ETH_ALEN);
2206         network->capability = le16_to_cpu(beacon->capability);
2207         network->last_scanned = jiffies;
2208         network->time_stamp[0] = beacon->time_stamp[0];
2209         network->time_stamp[1] = beacon->time_stamp[1];
2210         network->beacon_interval = le16_to_cpu(beacon->beacon_interval);
2211         /* Where to pull this? beacon->listen_interval;*/
2212         network->listen_interval = 0x0A;
2213         network->rates_len = network->rates_ex_len = 0;
2214         network->last_associate = 0;
2215         network->ssid_len = 0;
2216         network->hidden_ssid_len = 0;
2217         memset(network->hidden_ssid, 0, sizeof(network->hidden_ssid));
2218         network->flags = 0;
2219         network->atim_window = 0;
2220         network->erp_value = (network->capability & WLAN_CAPABILITY_IBSS) ?
2221             0x3 : 0x0;
2222         network->berp_info_valid = false;
2223         network->broadcom_cap_exist = false;
2224         network->ralink_cap_exist = false;
2225         network->atheros_cap_exist = false;
2226         network->cisco_cap_exist = false;
2227         network->unknown_cap_exist = false;
2228         network->realtek_cap_exit = false;
2229         network->marvell_cap_exist = false;
2230         network->airgo_cap_exist = false;
2231         network->Turbo_Enable = 0;
2232         network->SignalStrength = stats->SignalStrength;
2233         network->RSSI = stats->SignalStrength;
2234         network->CountryIeLen = 0;
2235         memset(network->CountryIeBuf, 0, MAX_IE_LEN);
2236         HTInitializeBssDesc(&network->bssht);
2237         if (stats->freq == RTLLIB_52GHZ_BAND) {
2238                 /* for A band (No DS info) */
2239                 network->channel = stats->received_channel;
2240         } else
2241                 network->flags |= NETWORK_HAS_CCK;
2242
2243         network->wpa_ie_len = 0;
2244         network->rsn_ie_len = 0;
2245         network->wzc_ie_len = 0;
2246
2247         if (rtllib_parse_info_param(ieee,
2248                         beacon->info_element,
2249                         (stats->len - sizeof(*beacon)),
2250                         network,
2251                         stats))
2252                 return 1;
2253
2254         network->mode = 0;
2255         if (stats->freq == RTLLIB_52GHZ_BAND)
2256                 network->mode = IEEE_A;
2257         else {
2258                 if (network->flags & NETWORK_HAS_OFDM)
2259                         network->mode |= IEEE_G;
2260                 if (network->flags & NETWORK_HAS_CCK)
2261                         network->mode |= IEEE_B;
2262         }
2263
2264         if (network->mode == 0) {
2265                 RTLLIB_DEBUG_SCAN("Filtered out '%s (%pM)' network.\n",
2266                                      escape_essid(network->ssid,
2267                                                   network->ssid_len),
2268                                      network->bssid);
2269                 return 1;
2270         }
2271
2272         if (network->bssht.bdSupportHT) {
2273                 if (network->mode == IEEE_A)
2274                         network->mode = IEEE_N_5G;
2275                 else if (network->mode & (IEEE_G | IEEE_B))
2276                         network->mode = IEEE_N_24G;
2277         }
2278         if (rtllib_is_empty_essid(network->ssid, network->ssid_len))
2279                 network->flags |= NETWORK_EMPTY_ESSID;
2280         stats->signal = 30 + (stats->SignalStrength * 70) / 100;
2281         stats->noise = rtllib_translate_todbm((u8)(100-stats->signal)) - 25;
2282
2283         memcpy(&network->stats, stats, sizeof(network->stats));
2284
2285         return 0;
2286 }
2287
2288 static inline int is_same_network(struct rtllib_network *src,
2289                                   struct rtllib_network *dst, u8 ssidbroad)
2290 {
2291         /* A network is only a duplicate if the channel, BSSID, ESSID
2292          * and the capability field (in particular IBSS and BSS) all match.
2293          * We treat all <hidden> with the same BSSID and channel
2294          * as one network */
2295         return (((src->ssid_len == dst->ssid_len) || (!ssidbroad)) &&
2296                 (src->channel == dst->channel) &&
2297                 !memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
2298                 (!memcmp(src->ssid, dst->ssid, src->ssid_len) ||
2299                 (!ssidbroad)) &&
2300                 ((src->capability & WLAN_CAPABILITY_IBSS) ==
2301                 (dst->capability & WLAN_CAPABILITY_IBSS)) &&
2302                 ((src->capability & WLAN_CAPABILITY_ESS) ==
2303                 (dst->capability & WLAN_CAPABILITY_ESS)));
2304 }
2305
2306
2307 static inline void update_network(struct rtllib_network *dst,
2308                                   struct rtllib_network *src)
2309 {
2310         int qos_active;
2311         u8 old_param;
2312
2313         memcpy(&dst->stats, &src->stats, sizeof(struct rtllib_rx_stats));
2314         dst->capability = src->capability;
2315         memcpy(dst->rates, src->rates, src->rates_len);
2316         dst->rates_len = src->rates_len;
2317         memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
2318         dst->rates_ex_len = src->rates_ex_len;
2319         if (src->ssid_len > 0) {
2320                 if (dst->ssid_len == 0) {
2321                         memset(dst->hidden_ssid, 0, sizeof(dst->hidden_ssid));
2322                         dst->hidden_ssid_len = src->ssid_len;
2323                         memcpy(dst->hidden_ssid, src->ssid, src->ssid_len);
2324                 } else {
2325                         memset(dst->ssid, 0, dst->ssid_len);
2326                         dst->ssid_len = src->ssid_len;
2327                         memcpy(dst->ssid, src->ssid, src->ssid_len);
2328                 }
2329         }
2330         dst->mode = src->mode;
2331         dst->flags = src->flags;
2332         dst->time_stamp[0] = src->time_stamp[0];
2333         dst->time_stamp[1] = src->time_stamp[1];
2334         if (src->flags & NETWORK_HAS_ERP_VALUE) {
2335                 dst->erp_value = src->erp_value;
2336                 dst->berp_info_valid = src->berp_info_valid = true;
2337         }
2338         dst->beacon_interval = src->beacon_interval;
2339         dst->listen_interval = src->listen_interval;
2340         dst->atim_window = src->atim_window;
2341         dst->dtim_period = src->dtim_period;
2342         dst->dtim_data = src->dtim_data;
2343         dst->last_dtim_sta_time = src->last_dtim_sta_time;
2344         memcpy(&dst->tim, &src->tim, sizeof(struct rtllib_tim_parameters));
2345
2346         dst->bssht.bdSupportHT = src->bssht.bdSupportHT;
2347         dst->bssht.bdRT2RTAggregation = src->bssht.bdRT2RTAggregation;
2348         dst->bssht.bdHTCapLen = src->bssht.bdHTCapLen;
2349         memcpy(dst->bssht.bdHTCapBuf, src->bssht.bdHTCapBuf,
2350                src->bssht.bdHTCapLen);
2351         dst->bssht.bdHTInfoLen = src->bssht.bdHTInfoLen;
2352         memcpy(dst->bssht.bdHTInfoBuf, src->bssht.bdHTInfoBuf,
2353                src->bssht.bdHTInfoLen);
2354         dst->bssht.bdHTSpecVer = src->bssht.bdHTSpecVer;
2355         dst->bssht.bdRT2RTLongSlotTime = src->bssht.bdRT2RTLongSlotTime;
2356         dst->broadcom_cap_exist = src->broadcom_cap_exist;
2357         dst->ralink_cap_exist = src->ralink_cap_exist;
2358         dst->atheros_cap_exist = src->atheros_cap_exist;
2359         dst->realtek_cap_exit = src->realtek_cap_exit;
2360         dst->marvell_cap_exist = src->marvell_cap_exist;
2361         dst->cisco_cap_exist = src->cisco_cap_exist;
2362         dst->airgo_cap_exist = src->airgo_cap_exist;
2363         dst->unknown_cap_exist = src->unknown_cap_exist;
2364         memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
2365         dst->wpa_ie_len = src->wpa_ie_len;
2366         memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
2367         dst->rsn_ie_len = src->rsn_ie_len;
2368         memcpy(dst->wzc_ie, src->wzc_ie, src->wzc_ie_len);
2369         dst->wzc_ie_len = src->wzc_ie_len;
2370
2371         dst->last_scanned = jiffies;
2372         /* qos related parameters */
2373         qos_active = dst->qos_data.active;
2374         old_param = dst->qos_data.param_count;
2375         dst->qos_data.supported = src->qos_data.supported;
2376         if (dst->flags & NETWORK_HAS_QOS_PARAMETERS)
2377                 memcpy(&dst->qos_data, &src->qos_data,
2378                        sizeof(struct rtllib_qos_data));
2379         if (dst->qos_data.supported == 1) {
2380                 if (dst->ssid_len)
2381                         RTLLIB_DEBUG_QOS
2382                                 ("QoS the network %s is QoS supported\n",
2383                                 dst->ssid);
2384                 else
2385                         RTLLIB_DEBUG_QOS
2386                                 ("QoS the network is QoS supported\n");
2387         }
2388         dst->qos_data.active = qos_active;
2389         dst->qos_data.old_param_count = old_param;
2390
2391         /* dst->last_associate is not overwritten */
2392         dst->wmm_info = src->wmm_info;
2393         if (src->wmm_param[0].ac_aci_acm_aifsn ||
2394            src->wmm_param[1].ac_aci_acm_aifsn ||
2395            src->wmm_param[2].ac_aci_acm_aifsn ||
2396            src->wmm_param[3].ac_aci_acm_aifsn)
2397                 memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN);
2398
2399         dst->SignalStrength = src->SignalStrength;
2400         dst->RSSI = src->RSSI;
2401         dst->Turbo_Enable = src->Turbo_Enable;
2402
2403         dst->CountryIeLen = src->CountryIeLen;
2404         memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen);
2405
2406         dst->bWithAironetIE = src->bWithAironetIE;
2407         dst->bCkipSupported = src->bCkipSupported;
2408         memcpy(dst->CcxRmState, src->CcxRmState, 2);
2409         dst->bCcxRmEnable = src->bCcxRmEnable;
2410         dst->MBssidMask = src->MBssidMask;
2411         dst->bMBssidValid = src->bMBssidValid;
2412         memcpy(dst->MBssid, src->MBssid, 6);
2413         dst->bWithCcxVerNum = src->bWithCcxVerNum;
2414         dst->BssCcxVerNumber = src->BssCcxVerNumber;
2415 }
2416
2417 static inline int is_beacon(__le16 fc)
2418 {
2419         return (WLAN_FC_GET_STYPE(le16_to_cpu(fc)) == RTLLIB_STYPE_BEACON);
2420 }
2421
2422 static int IsPassiveChannel(struct rtllib_device *rtllib, u8 channel)
2423 {
2424         if (MAX_CHANNEL_NUMBER < channel) {
2425                 printk(KERN_INFO "%s(): Invalid Channel\n", __func__);
2426                 return 0;
2427         }
2428
2429         if (rtllib->active_channel_map[channel] == 2)
2430                 return 1;
2431
2432         return 0;
2433 }
2434
2435 int rtllib_legal_channel(struct rtllib_device *rtllib, u8 channel)
2436 {
2437         if (MAX_CHANNEL_NUMBER < channel) {
2438                 printk(KERN_INFO "%s(): Invalid Channel\n", __func__);
2439                 return 0;
2440         }
2441         if (rtllib->active_channel_map[channel] > 0)
2442                 return 1;
2443
2444         return 0;
2445 }
2446 EXPORT_SYMBOL(rtllib_legal_channel);
2447
2448 static inline void rtllib_process_probe_response(
2449         struct rtllib_device *ieee,
2450         struct rtllib_probe_response *beacon,
2451         struct rtllib_rx_stats *stats)
2452 {
2453         struct rtllib_network *target;
2454         struct rtllib_network *oldest = NULL;
2455         struct rtllib_info_element *info_element = &beacon->info_element[0];
2456         unsigned long flags;
2457         short renew;
2458         struct rtllib_network *network = kzalloc(sizeof(struct rtllib_network),
2459                                                  GFP_ATOMIC);
2460
2461         if (!network)
2462                 return;
2463
2464         RTLLIB_DEBUG_SCAN(
2465                 "'%s' ( %pM ): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
2466                 escape_essid(info_element->data, info_element->len),
2467                 beacon->header.addr3,
2468                 (le16_to_cpu(beacon->capability) & (1<<0xf)) ? '1' : '0',
2469                 (le16_to_cpu(beacon->capability) & (1<<0xe)) ? '1' : '0',
2470                 (le16_to_cpu(beacon->capability) & (1<<0xd)) ? '1' : '0',
2471                 (le16_to_cpu(beacon->capability) & (1<<0xc)) ? '1' : '0',
2472                 (le16_to_cpu(beacon->capability) & (1<<0xb)) ? '1' : '0',
2473                 (le16_to_cpu(beacon->capability) & (1<<0xa)) ? '1' : '0',
2474                 (le16_to_cpu(beacon->capability) & (1<<0x9)) ? '1' : '0',
2475                 (le16_to_cpu(beacon->capability) & (1<<0x8)) ? '1' : '0',
2476                 (le16_to_cpu(beacon->capability) & (1<<0x7)) ? '1' : '0',
2477                 (le16_to_cpu(beacon->capability) & (1<<0x6)) ? '1' : '0',
2478                 (le16_to_cpu(beacon->capability) & (1<<0x5)) ? '1' : '0',
2479                 (le16_to_cpu(beacon->capability) & (1<<0x4)) ? '1' : '0',
2480                 (le16_to_cpu(beacon->capability) & (1<<0x3)) ? '1' : '0',
2481                 (le16_to_cpu(beacon->capability) & (1<<0x2)) ? '1' : '0',
2482                 (le16_to_cpu(beacon->capability) & (1<<0x1)) ? '1' : '0',
2483                 (le16_to_cpu(beacon->capability) & (1<<0x0)) ? '1' : '0');
2484
2485         if (rtllib_network_init(ieee, beacon, network, stats)) {
2486                 RTLLIB_DEBUG_SCAN("Dropped '%s' ( %pM) via %s.\n",
2487                                   escape_essid(info_element->data,
2488                                   info_element->len),
2489                                   beacon->header.addr3,
2490                                   WLAN_FC_GET_STYPE(
2491                                           le16_to_cpu(beacon->header.frame_ctl)) ==
2492                                   RTLLIB_STYPE_PROBE_RESP ?
2493                                   "PROBE RESPONSE" : "BEACON");
2494                 goto free_network;
2495         }
2496
2497
2498         if (!rtllib_legal_channel(ieee, network->channel))
2499                 goto free_network;
2500
2501         if (WLAN_FC_GET_STYPE(le16_to_cpu(beacon->header.frame_ctl)) ==
2502             RTLLIB_STYPE_PROBE_RESP) {
2503                 if (IsPassiveChannel(ieee, network->channel)) {
2504                         printk(KERN_INFO "GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n",
2505                                network->channel);
2506                         goto free_network;
2507                 }
2508         }
2509
2510         /* The network parsed correctly -- so now we scan our known networks
2511          * to see if we can find it in our list.
2512          *
2513          * NOTE:  This search is definitely not optimized.  Once its doing
2514          *      the "right thing" we'll optimize it for efficiency if
2515          *      necessary */
2516
2517         /* Search for this entry in the list and update it if it is
2518          * already there. */
2519
2520         spin_lock_irqsave(&ieee->lock, flags);
2521         if (is_same_network(&ieee->current_network, network,
2522            (network->ssid_len ? 1 : 0))) {
2523                 update_network(&ieee->current_network, network);
2524                 if ((ieee->current_network.mode == IEEE_N_24G ||
2525                      ieee->current_network.mode == IEEE_G)
2526                      && ieee->current_network.berp_info_valid) {
2527                         if (ieee->current_network.erp_value & ERP_UseProtection)
2528                                 ieee->current_network.buseprotection = true;
2529                         else
2530                                 ieee->current_network.buseprotection = false;
2531                 }
2532                 if (is_beacon(beacon->header.frame_ctl)) {
2533                         if (ieee->state >= RTLLIB_LINKED)
2534                                 ieee->LinkDetectInfo.NumRecvBcnInPeriod++;
2535                 }
2536         }
2537         list_for_each_entry(target, &ieee->network_list, list) {
2538                 if (is_same_network(target, network,
2539                    (target->ssid_len ? 1 : 0)))
2540                         break;
2541                 if ((oldest == NULL) ||
2542                     (target->last_scanned < oldest->last_scanned))
2543                         oldest = target;
2544         }
2545
2546         /* If we didn't find a match, then get a new network slot to initialize
2547          * with this beacon's information */
2548         if (&target->list == &ieee->network_list) {
2549                 if (list_empty(&ieee->network_free_list)) {
2550                         /* If there are no more slots, expire the oldest */
2551                         list_del(&oldest->list);
2552                         target = oldest;
2553                         RTLLIB_DEBUG_SCAN("Expired '%s' ( %pM) from network list.\n",
2554                                              escape_essid(target->ssid,
2555                                                           target->ssid_len),
2556                                              target->bssid);
2557                 } else {
2558                         /* Otherwise just pull from the free list */
2559                         target = list_entry(ieee->network_free_list.next,
2560                                             struct rtllib_network, list);
2561                         list_del(ieee->network_free_list.next);
2562                 }
2563
2564
2565                 RTLLIB_DEBUG_SCAN("Adding '%s' ( %pM) via %s.\n",
2566                                   escape_essid(network->ssid,
2567                                   network->ssid_len), network->bssid,
2568                                   WLAN_FC_GET_STYPE(
2569                                           le16_to_cpu(beacon->header.frame_ctl)) ==
2570                                   RTLLIB_STYPE_PROBE_RESP ?
2571                                   "PROBE RESPONSE" : "BEACON");
2572                 memcpy(target, network, sizeof(*target));
2573                 list_add_tail(&target->list, &ieee->network_list);
2574                 if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE)
2575                         rtllib_softmac_new_net(ieee, network);
2576         } else {
2577                 RTLLIB_DEBUG_SCAN("Updating '%s' ( %pM) via %s.\n",
2578                                   escape_essid(target->ssid,
2579                                   target->ssid_len), target->bssid,
2580                                   WLAN_FC_GET_STYPE(
2581                                           le16_to_cpu(beacon->header.frame_ctl)) ==
2582                                   RTLLIB_STYPE_PROBE_RESP ?
2583                                   "PROBE RESPONSE" : "BEACON");
2584
2585                 /* we have an entry and we are going to update it. But this
2586                  *  entry may be already expired. In this case we do the same
2587                  * as we found a new net and call the new_net handler
2588                  */
2589                 renew = !time_after(target->last_scanned + ieee->scan_age,
2590                                     jiffies);
2591                 if ((!target->ssid_len) &&
2592                     (((network->ssid_len > 0) && (target->hidden_ssid_len == 0))
2593                     || ((ieee->current_network.ssid_len == network->ssid_len) &&
2594                     (strncmp(ieee->current_network.ssid, network->ssid,
2595                     network->ssid_len) == 0) &&
2596                     (ieee->state == RTLLIB_NOLINK))))
2597                         renew = 1;
2598                 update_network(target, network);
2599                 if (renew && (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE))
2600                         rtllib_softmac_new_net(ieee, network);
2601         }
2602
2603         spin_unlock_irqrestore(&ieee->lock, flags);
2604         if (is_beacon(beacon->header.frame_ctl) &&
2605             is_same_network(&ieee->current_network, network,
2606             (network->ssid_len ? 1 : 0)) &&
2607             (ieee->state == RTLLIB_LINKED)) {
2608                 if (ieee->handle_beacon != NULL)
2609                         ieee->handle_beacon(ieee->dev, beacon,
2610                                             &ieee->current_network);
2611         }
2612 free_network:
2613         kfree(network);
2614         return;
2615 }
2616
2617 void rtllib_rx_mgt(struct rtllib_device *ieee,
2618                       struct sk_buff *skb,
2619                       struct rtllib_rx_stats *stats)
2620 {
2621         struct rtllib_hdr_4addr *header = (struct rtllib_hdr_4addr *)skb->data;
2622
2623         if ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) !=
2624             RTLLIB_STYPE_PROBE_RESP) &&
2625             (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) !=
2626             RTLLIB_STYPE_BEACON))
2627                 ieee->last_rx_ps_time = jiffies;
2628
2629         switch (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl))) {
2630
2631         case RTLLIB_STYPE_BEACON:
2632                 RTLLIB_DEBUG_MGMT("received BEACON (%d)\n",
2633                                   WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)));
2634                 RTLLIB_DEBUG_SCAN("Beacon\n");
2635                 rtllib_process_probe_response(
2636                                 ieee, (struct rtllib_probe_response *)header,
2637                                 stats);
2638
2639                 if (ieee->sta_sleep || (ieee->ps != RTLLIB_PS_DISABLED &&
2640                     ieee->iw_mode == IW_MODE_INFRA &&
2641                     ieee->state == RTLLIB_LINKED))
2642                         tasklet_schedule(&ieee->ps_task);
2643
2644                 break;
2645
2646         case RTLLIB_STYPE_PROBE_RESP:
2647                 RTLLIB_DEBUG_MGMT("received PROBE RESPONSE (%d)\n",
2648                         WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)));
2649                 RTLLIB_DEBUG_SCAN("Probe response\n");
2650                 rtllib_process_probe_response(ieee,
2651                               (struct rtllib_probe_response *)header, stats);
2652                 break;
2653         case RTLLIB_STYPE_PROBE_REQ:
2654                 RTLLIB_DEBUG_MGMT("received PROBE RESQUEST (%d)\n",
2655                                   WLAN_FC_GET_STYPE(
2656                                           le16_to_cpu(header->frame_ctl)));
2657                 RTLLIB_DEBUG_SCAN("Probe request\n");
2658                 if ((ieee->softmac_features & IEEE_SOFTMAC_PROBERS) &&
2659                     ((ieee->iw_mode == IW_MODE_ADHOC ||
2660                     ieee->iw_mode == IW_MODE_MASTER) &&
2661                     ieee->state == RTLLIB_LINKED))
2662                         rtllib_rx_probe_rq(ieee, skb);
2663                 break;
2664         }
2665 }