2 * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 * Purpose: handle dpc rx functions
28 * device_receive_frame - Rcv 802.11 frame function
29 * s_bAPModeRxCtl- AP Rcv frame filer Ctl.
30 * s_bAPModeRxData- AP Rcv data frame handle
31 * s_bHandleRxEncryption- Rcv decrypted data via on-fly
32 * s_bHostWepRxEncryption- Rcv encrypted data via host
33 * s_byGetRateIdx- get rate index
34 * s_vGetDASA- get data offset
35 * s_vProcessRxMACHeader- Rcv 802.11 and translate to 802.3
59 //static int msglevel =MSG_LEVEL_DEBUG;
60 static int msglevel
=MSG_LEVEL_INFO
;
62 static const u8 acbyRxRate
[MAX_RATE
] =
63 {2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108};
65 static u8
s_byGetRateIdx(u8 byRate
);
71 unsigned int *pcbHeaderSize
,
72 struct ethhdr
*psEthHeader
75 static void s_vProcessRxMACHeader(struct vnt_private
*pDevice
,
76 u8
*pbyRxBufferAddr
, u32 cbPacketSize
, int bIsWEP
, int bExtIV
,
79 static int s_bAPModeRxCtl(struct vnt_private
*pDevice
, u8
*pbyFrame
,
82 static int s_bAPModeRxData(struct vnt_private
*pDevice
, struct sk_buff
*skb
,
83 u32 FrameSize
, u32 cbHeaderOffset
, s32 iSANodeIndex
, s32 iDANodeIndex
);
85 static int s_bHandleRxEncryption(struct vnt_private
*pDevice
, u8
*pbyFrame
,
86 u32 FrameSize
, u8
*pbyRsr
, u8
*pbyNewRsr
, PSKeyItem
*pKeyOut
,
87 s32
*pbExtIV
, u16
*pwRxTSC15_0
, u32
*pdwRxTSC47_16
);
89 static int s_bHostWepRxEncryption(struct vnt_private
*pDevice
, u8
*pbyFrame
,
90 u32 FrameSize
, u8
*pbyRsr
, int bOnFly
, PSKeyItem pKey
, u8
*pbyNewRsr
,
91 s32
*pbExtIV
, u16
*pwRxTSC15_0
, u32
*pdwRxTSC47_16
);
96 * Translate Rcv 802.11 header to 802.3 header with Rx buffer
101 * dwRxBufferAddr - Address of Rcv Buffer
102 * cbPacketSize - Rcv Packet size
103 * bIsWEP - If Rcv with WEP
105 * pcbHeaderSize - 802.11 header size
111 static void s_vProcessRxMACHeader(struct vnt_private
*pDevice
,
112 u8
*pbyRxBufferAddr
, u32 cbPacketSize
, int bIsWEP
, int bExtIV
,
116 u32 cbHeaderSize
= 0;
118 struct ieee80211_hdr
*pMACHeader
;
121 pMACHeader
= (struct ieee80211_hdr
*) (pbyRxBufferAddr
+ cbHeaderSize
);
123 s_vGetDASA((u8
*)pMACHeader
, &cbHeaderSize
, &pDevice
->sRxEthHeader
);
127 // strip IV&ExtIV , add 8 byte
128 cbHeaderSize
+= (WLAN_HDR_ADDR3_LEN
+ 8);
130 // strip IV , add 4 byte
131 cbHeaderSize
+= (WLAN_HDR_ADDR3_LEN
+ 4);
135 cbHeaderSize
+= WLAN_HDR_ADDR3_LEN
;
138 pbyRxBuffer
= (u8
*) (pbyRxBufferAddr
+ cbHeaderSize
);
139 if (ether_addr_equal(pbyRxBuffer
, pDevice
->abySNAP_Bridgetunnel
)) {
141 } else if (ether_addr_equal(pbyRxBuffer
, pDevice
->abySNAP_RFC1042
)) {
143 pwType
= (u16
*) (pbyRxBufferAddr
+ cbHeaderSize
);
144 if ((*pwType
== cpu_to_be16(ETH_P_IPX
)) ||
145 (*pwType
== cpu_to_le16(0xF380))) {
147 pwType
= (u16
*) (pbyRxBufferAddr
+ cbHeaderSize
);
150 *pwType
= htons(cbPacketSize
- WLAN_HDR_ADDR3_LEN
- 8); // 8 is IV&ExtIV
152 *pwType
= htons(cbPacketSize
- WLAN_HDR_ADDR3_LEN
- 4); // 4 is IV
156 *pwType
= htons(cbPacketSize
- WLAN_HDR_ADDR3_LEN
);
162 pwType
= (u16
*) (pbyRxBufferAddr
+ cbHeaderSize
);
165 *pwType
= htons(cbPacketSize
- WLAN_HDR_ADDR3_LEN
- 8); // 8 is IV&ExtIV
167 *pwType
= htons(cbPacketSize
- WLAN_HDR_ADDR3_LEN
- 4); // 4 is IV
171 *pwType
= htons(cbPacketSize
- WLAN_HDR_ADDR3_LEN
);
175 cbHeaderSize
-= (ETH_ALEN
* 2);
176 pbyRxBuffer
= (u8
*) (pbyRxBufferAddr
+ cbHeaderSize
);
177 for (ii
= 0; ii
< ETH_ALEN
; ii
++)
178 *pbyRxBuffer
++ = pDevice
->sRxEthHeader
.h_dest
[ii
];
179 for (ii
= 0; ii
< ETH_ALEN
; ii
++)
180 *pbyRxBuffer
++ = pDevice
->sRxEthHeader
.h_source
[ii
];
182 *pcbHeadSize
= cbHeaderSize
;
185 static u8
s_byGetRateIdx(u8 byRate
)
189 for (byRateIdx
= 0; byRateIdx
<MAX_RATE
; byRateIdx
++) {
190 if (acbyRxRate
[byRateIdx
%MAX_RATE
] == byRate
)
199 u8
* pbyRxBufferAddr
,
200 unsigned int *pcbHeaderSize
,
201 struct ethhdr
*psEthHeader
204 unsigned int cbHeaderSize
= 0;
205 struct ieee80211_hdr
*pMACHeader
;
208 pMACHeader
= (struct ieee80211_hdr
*) (pbyRxBufferAddr
+ cbHeaderSize
);
210 if ((pMACHeader
->frame_control
& FC_TODS
) == 0) {
211 if (pMACHeader
->frame_control
& FC_FROMDS
) {
212 for (ii
= 0; ii
< ETH_ALEN
; ii
++) {
213 psEthHeader
->h_dest
[ii
] =
214 pMACHeader
->addr1
[ii
];
215 psEthHeader
->h_source
[ii
] =
216 pMACHeader
->addr3
[ii
];
220 for (ii
= 0; ii
< ETH_ALEN
; ii
++) {
221 psEthHeader
->h_dest
[ii
] =
222 pMACHeader
->addr1
[ii
];
223 psEthHeader
->h_source
[ii
] =
224 pMACHeader
->addr2
[ii
];
229 if (pMACHeader
->frame_control
& FC_FROMDS
) {
230 for (ii
= 0; ii
< ETH_ALEN
; ii
++) {
231 psEthHeader
->h_dest
[ii
] =
232 pMACHeader
->addr3
[ii
];
233 psEthHeader
->h_source
[ii
] =
234 pMACHeader
->addr4
[ii
];
238 for (ii
= 0; ii
< ETH_ALEN
; ii
++) {
239 psEthHeader
->h_dest
[ii
] =
240 pMACHeader
->addr3
[ii
];
241 psEthHeader
->h_source
[ii
] =
242 pMACHeader
->addr2
[ii
];
246 *pcbHeaderSize
= cbHeaderSize
;
249 int RXbBulkInProcessData(struct vnt_private
*pDevice
, struct vnt_rcb
*pRCB
,
250 unsigned long BytesToIndicate
)
252 struct net_device_stats
*pStats
= &pDevice
->stats
;
254 struct vnt_manager
*pMgmt
= &pDevice
->vnt_mgmt
;
255 struct vnt_rx_mgmt
*pRxPacket
= &pMgmt
->sRxPacket
;
256 struct ieee80211_hdr
*p802_11Header
;
257 u8
*pbyRsr
, *pbyNewRsr
, *pbyRSSI
, *pbyFrame
;
259 u32 bDeFragRx
= false;
260 u32 cbHeaderOffset
, cbIVOffset
;
263 s32 iSANodeIndex
= -1, iDANodeIndex
= -1;
265 u8
*pbyRxSts
, *pbyRxRate
, *pbySQ
, *pby3SQ
;
267 PSKeyItem pKey
= NULL
;
269 u32 dwRxTSC47_16
= 0;
271 /* signed long ldBm = 0; */
272 int bIsWEP
= false; int bExtIV
= false;
274 struct vnt_rcb
*pRCBIndicate
= pRCB
;
277 u8 abyVaildRate
[MAX_RATE
]
278 = {2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108};
279 u16 wPLCPwithPadding
;
280 struct ieee80211_hdr
*pMACHeader
;
281 int bRxeapol_key
= false;
283 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"---------- RXbBulkInProcessData---\n");
287 /* [31:16]RcvByteCount ( not include 4-byte Status ) */
288 dwWbkStatus
= *((u32
*)(skb
->data
));
289 FrameSize
= dwWbkStatus
>> 16;
292 if (BytesToIndicate
!= FrameSize
) {
293 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"------- WRONG Length 1\n");
294 pStats
->rx_frame_errors
++;
298 if ((BytesToIndicate
> 2372) || (BytesToIndicate
<= 40)) {
299 // Frame Size error drop this packet.
300 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"---------- WRONG Length 2\n");
301 pStats
->rx_frame_errors
++;
305 pbyDAddress
= (u8
*)(skb
->data
);
306 pbyRxSts
= pbyDAddress
+4;
307 pbyRxRate
= pbyDAddress
+5;
309 //real Frame Size = USBFrameSize -4WbkStatus - 4RxStatus - 8TSF - 4RSR - 4SQ3 - ?Padding
310 //if SQ3 the range is 24~27, if no SQ3 the range is 20~23
311 //real Frame size in PLCPLength field.
312 pwPLCP_Length
= (u16
*) (pbyDAddress
+ 6);
313 //Fix hardware bug => PLCP_Length error
314 if ( ((BytesToIndicate
- (*pwPLCP_Length
)) > 27) ||
315 ((BytesToIndicate
- (*pwPLCP_Length
)) < 24) ||
316 (BytesToIndicate
< (*pwPLCP_Length
)) ) {
318 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"Wrong PLCP Length %x\n", (int) *pwPLCP_Length
);
319 pStats
->rx_frame_errors
++;
322 for ( ii
=RATE_1M
;ii
<MAX_RATE
;ii
++) {
323 if ( *pbyRxRate
== abyVaildRate
[ii
] ) {
327 if ( ii
==MAX_RATE
) {
328 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"Wrong RxRate %x\n",(int) *pbyRxRate
);
332 wPLCPwithPadding
= ( (*pwPLCP_Length
/ 4) + ( (*pwPLCP_Length
% 4) ? 1:0 ) ) *4;
334 pqwTSFTime
= (u64
*)(pbyDAddress
+ 8 + wPLCPwithPadding
);
335 if(pDevice
->byBBType
== BB_TYPE_11G
) {
336 pby3SQ
= pbyDAddress
+ 8 + wPLCPwithPadding
+ 12;
340 pbySQ
= pbyDAddress
+ 8 + wPLCPwithPadding
+ 8;
343 pbyNewRsr
= pbyDAddress
+ 8 + wPLCPwithPadding
+ 9;
344 pbyRSSI
= pbyDAddress
+ 8 + wPLCPwithPadding
+ 10;
345 pbyRsr
= pbyDAddress
+ 8 + wPLCPwithPadding
+ 11;
347 FrameSize
= *pwPLCP_Length
;
349 pbyFrame
= pbyDAddress
+ 8;
351 pMACHeader
= (struct ieee80211_hdr
*) pbyFrame
;
353 //mike add: to judge if current AP is activated?
354 if ((pMgmt
->eCurrMode
== WMAC_MODE_STANDBY
) ||
355 (pMgmt
->eCurrMode
== WMAC_MODE_ESS_STA
)) {
356 if (pMgmt
->sNodeDBTable
[0].bActive
) {
357 if (ether_addr_equal(pMgmt
->abyCurrBSSID
, pMACHeader
->addr2
)) {
358 if (pMgmt
->sNodeDBTable
[0].uInActiveCount
!= 0)
359 pMgmt
->sNodeDBTable
[0].uInActiveCount
= 0;
364 if (!is_multicast_ether_addr(pMACHeader
->addr1
)) {
365 if (WCTLbIsDuplicate(&(pDevice
->sDupRxCache
), (struct ieee80211_hdr
*) pbyFrame
)) {
369 if (!ether_addr_equal(pDevice
->abyCurrentNetAddr
, pMACHeader
->addr1
)) {
375 s_vGetDASA(pbyFrame
, &cbHeaderSize
, &pDevice
->sRxEthHeader
);
377 if (ether_addr_equal((u8
*)pDevice
->sRxEthHeader
.h_source
,
378 pDevice
->abyCurrentNetAddr
))
381 if ((pMgmt
->eCurrMode
== WMAC_MODE_ESS_AP
) || (pMgmt
->eCurrMode
== WMAC_MODE_IBSS_STA
)) {
382 if (IS_CTL_PSPOLL(pbyFrame
) || !IS_TYPE_CONTROL(pbyFrame
)) {
383 p802_11Header
= (struct ieee80211_hdr
*) (pbyFrame
);
385 if (BSSbIsSTAInNodeDB(pDevice
, (u8
*)(p802_11Header
->addr2
), &iSANodeIndex
)) {
386 pMgmt
->sNodeDBTable
[iSANodeIndex
].ulLastRxJiffer
= jiffies
;
387 pMgmt
->sNodeDBTable
[iSANodeIndex
].uInActiveCount
= 0;
392 if (pMgmt
->eCurrMode
== WMAC_MODE_ESS_AP
) {
393 if (s_bAPModeRxCtl(pDevice
, pbyFrame
, iSANodeIndex
) == true) {
398 if (IS_FC_WEP(pbyFrame
)) {
399 bool bRxDecryOK
= false;
401 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"rx WEP pkt\n");
403 if ((pDevice
->bEnableHostWEP
) && (iSANodeIndex
>= 0)) {
405 pKey
->byCipherSuite
= pMgmt
->sNodeDBTable
[iSANodeIndex
].byCipherSuite
;
406 pKey
->dwKeyIndex
= pMgmt
->sNodeDBTable
[iSANodeIndex
].dwKeyIndex
;
407 pKey
->uKeyLength
= pMgmt
->sNodeDBTable
[iSANodeIndex
].uWepKeyLength
;
408 pKey
->dwTSC47_16
= pMgmt
->sNodeDBTable
[iSANodeIndex
].dwTSC47_16
;
409 pKey
->wTSC15_0
= pMgmt
->sNodeDBTable
[iSANodeIndex
].wTSC15_0
;
411 &pMgmt
->sNodeDBTable
[iSANodeIndex
].abyWepKey
[0],
415 bRxDecryOK
= s_bHostWepRxEncryption(pDevice
,
419 pMgmt
->sNodeDBTable
[iSANodeIndex
].bOnFly
,
426 bRxDecryOK
= s_bHandleRxEncryption(pDevice
,
438 if ((*pbyNewRsr
& NEWRSR_DECRYPTOK
) == 0) {
439 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ICV Fail\n");
440 if ( (pMgmt
->eAuthenMode
== WMAC_AUTH_WPA
) ||
441 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPAPSK
) ||
442 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPANONE
) ||
443 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPA2
) ||
444 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPA2PSK
)) {
449 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"WEP Func Fail\n");
452 if ((pKey
!= NULL
) && (pKey
->byCipherSuite
== KEY_CTL_CCMP
))
453 FrameSize
-= 8; // Message Integrity Code
455 FrameSize
-= 4; // 4 is ICV
461 /* remove the FCS/CRC length */
462 FrameSize
-= ETH_FCS_LEN
;
464 if ( !(*pbyRsr
& (RSR_ADDRBROAD
| RSR_ADDRMULTI
)) && // unicast address
465 (IS_FRAGMENT_PKT((pbyFrame
)))
468 bDeFragRx
= WCTLbHandleFragment(pDevice
, (struct ieee80211_hdr
*) (pbyFrame
), FrameSize
, bIsWEP
, bExtIV
);
471 // TODO skb, pbyFrame
472 skb
= pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
].skb
;
473 FrameSize
= pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
].cbFrameLength
;
474 pbyFrame
= skb
->data
+ 8;
482 // Management & Control frame Handle
484 if ((IS_TYPE_DATA((pbyFrame
))) == false) {
485 // Handle Control & Manage Frame
487 if (IS_TYPE_MGMT((pbyFrame
))) {
491 pRxPacket
= &(pRCB
->sMngPacket
);
492 pRxPacket
->p80211Header
= (PUWLAN_80211HDR
)(pbyFrame
);
493 pRxPacket
->cbMPDULen
= FrameSize
;
494 pRxPacket
->uRSSI
= *pbyRSSI
;
495 pRxPacket
->bySQ
= *pbySQ
;
496 pRxPacket
->qwLocalTSF
= cpu_to_le64(*pqwTSFTime
);
499 pbyData1
= WLAN_HDR_A3_DATA_PTR(pbyFrame
);
500 pbyData2
= WLAN_HDR_A3_DATA_PTR(pbyFrame
) + 4;
501 for (ii
= 0; ii
< (FrameSize
- 4); ii
++) {
502 *pbyData1
= *pbyData2
;
508 pRxPacket
->byRxRate
= s_byGetRateIdx(*pbyRxRate
);
510 if ( *pbyRxSts
== 0 ) {
511 //Discard beacon packet which channel is 0
512 if ( (WLAN_GET_FC_FSTYPE((pRxPacket
->p80211Header
->sA3
.wFrameCtl
)) == WLAN_FSTYPE_BEACON
) ||
513 (WLAN_GET_FC_FSTYPE((pRxPacket
->p80211Header
->sA3
.wFrameCtl
)) == WLAN_FSTYPE_PROBERESP
) ) {
517 pRxPacket
->byRxChannel
= (*pbyRxSts
) >> 2;
519 // hostap Deamon handle 802.11 management
520 if (pDevice
->bEnableHostapd
) {
521 skb
->dev
= pDevice
->apdev
;
526 skb_put(skb
, FrameSize
);
527 skb_reset_mac_header(skb
);
528 skb
->pkt_type
= PACKET_OTHERHOST
;
529 skb
->protocol
= htons(ETH_P_802_2
);
530 memset(skb
->cb
, 0, sizeof(skb
->cb
));
536 // Insert the RCB in the Recv Mng list
538 EnqueueRCB(pDevice
->FirstRecvMngList
, pDevice
->LastRecvMngList
, pRCBIndicate
);
539 pDevice
->NumRecvMngList
++;
540 if ( bDeFragRx
== false) {
543 if (pDevice
->bIsRxMngWorkItemQueued
== false) {
544 pDevice
->bIsRxMngWorkItemQueued
= true;
545 schedule_work(&pDevice
->rx_mng_work_item
);
555 if (pMgmt
->eCurrMode
== WMAC_MODE_ESS_AP
) {
556 //In AP mode, hw only check addr1(BSSID or RA) if equal to local MAC.
557 if ( !(*pbyRsr
& RSR_BSSIDOK
)) {
559 if (!device_alloc_frag_buf(pDevice
, &pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
])) {
560 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
"%s: can not alloc more frag bufs\n",
568 // discard DATA packet while not associate || BSSID error
569 if ((pDevice
->bLinkPass
== false) ||
570 !(*pbyRsr
& RSR_BSSIDOK
)) {
572 if (!device_alloc_frag_buf(pDevice
, &pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
])) {
573 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
"%s: can not alloc more frag bufs\n",
579 //mike add:station mode check eapol-key challenge--->
581 u8 Protocol_Version
; //802.1x Authentication
582 u8 Packet_Type
; //802.1x Authentication
589 wEtherType
= (skb
->data
[cbIVOffset
+ 8 + 24 + 6] << 8) |
590 skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1];
591 Protocol_Version
= skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1 +1];
592 Packet_Type
= skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1 +1+1];
593 if (wEtherType
== ETH_P_PAE
) { //Protocol Type in LLC-Header
594 if(((Protocol_Version
==1) ||(Protocol_Version
==2)) &&
595 (Packet_Type
==3)) { //802.1x OR eapol-key challenge frame receive
597 Descriptor_type
= skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1 +1+1+1+2];
598 Key_info
= (skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1 +1+1+1+2+1]<<8) |skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1 +1+1+1+2+2] ;
599 if(Descriptor_type
==2) { //RSN
600 // printk("WPA2_Rx_eapol-key_info<-----:%x\n",Key_info);
602 else if(Descriptor_type
==254) {
603 // printk("WPA_Rx_eapol-key_info<-----:%x\n",Key_info);
608 //mike add:station mode check eapol-key challenge<---
614 if (pDevice
->bEnablePSMode
) {
615 if (IS_FC_MOREDATA((pbyFrame
))) {
616 if (*pbyRsr
& RSR_ADDROK
) {
617 //PSbSendPSPOLL((PSDevice)pDevice);
621 if (pMgmt
->bInTIMWake
== true) {
622 pMgmt
->bInTIMWake
= false;
627 // Now it only supports 802.11g Infrastructure Mode, and support rate must up to 54 Mbps
628 if (pDevice
->bDiversityEnable
&& (FrameSize
>50) &&
629 (pDevice
->eOPMode
== OP_MODE_INFRASTRUCTURE
) &&
630 (pDevice
->bLinkPass
== true)) {
631 BBvAntennaDiversity(pDevice
, s_byGetRateIdx(*pbyRxRate
), 0);
634 // ++++++++ For BaseBand Algorithm +++++++++++++++
635 pDevice
->uCurrRSSI
= *pbyRSSI
;
636 pDevice
->byCurrSQ
= *pbySQ
;
640 if ((*pbyRSSI != 0) &&
641 (pMgmt->pCurrBSS!=NULL)) {
642 RFvRSSITodBm(pDevice, *pbyRSSI, &ldBm);
643 // Monitor if RSSI is too strong.
644 pMgmt->pCurrBSS->byRSSIStatCnt++;
645 pMgmt->pCurrBSS->byRSSIStatCnt %= RSSI_STAT_COUNT;
646 pMgmt->pCurrBSS->ldBmAverage[pMgmt->pCurrBSS->byRSSIStatCnt] = ldBm;
647 for (ii = 0; ii < RSSI_STAT_COUNT; ii++) {
648 if (pMgmt->pCurrBSS->ldBmAverage[ii] != 0) {
649 pMgmt->pCurrBSS->ldBmMAX =
650 max(pMgmt->pCurrBSS->ldBmAverage[ii], ldBm);
656 // -----------------------------------------------
658 if ((pMgmt
->eCurrMode
== WMAC_MODE_ESS_AP
) && (pDevice
->bEnable8021x
== true)){
661 // Only 802.1x packet incoming allowed
666 wEtherType
= (skb
->data
[cbIVOffset
+ 8 + 24 + 6] << 8) |
667 skb
->data
[cbIVOffset
+ 8 + 24 + 6 + 1];
669 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"wEtherType = %04x \n", wEtherType
);
670 if (wEtherType
== ETH_P_PAE
) {
671 skb
->dev
= pDevice
->apdev
;
673 if (bIsWEP
== true) {
674 // strip IV header(8)
675 memcpy(&abyMacHdr
[0], (skb
->data
+ 8), 24);
676 memcpy((skb
->data
+ 8 + cbIVOffset
), &abyMacHdr
[0], 24);
679 skb
->data
+= (cbIVOffset
+ 8);
680 skb
->tail
+= (cbIVOffset
+ 8);
681 skb_put(skb
, FrameSize
);
682 skb_reset_mac_header(skb
);
683 skb
->pkt_type
= PACKET_OTHERHOST
;
684 skb
->protocol
= htons(ETH_P_802_2
);
685 memset(skb
->cb
, 0, sizeof(skb
->cb
));
690 // check if 802.1x authorized
691 if (!(pMgmt
->sNodeDBTable
[iSANodeIndex
].dwFlags
& WLAN_STA_AUTHORIZED
))
695 if ((pKey
!= NULL
) && (pKey
->byCipherSuite
== KEY_CTL_TKIP
)) {
697 FrameSize
-= 8; //MIC
701 //--------------------------------------------------------------------------------
703 if ((pKey
!= NULL
) && (pKey
->byCipherSuite
== KEY_CTL_TKIP
)) {
708 u32 dwMICKey0
= 0, dwMICKey1
= 0;
709 u32 dwLocalMIC_L
= 0;
710 u32 dwLocalMIC_R
= 0;
712 if (pMgmt
->eCurrMode
== WMAC_MODE_ESS_AP
) {
713 dwMICKey0
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[24]));
714 dwMICKey1
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[28]));
717 if (pMgmt
->eAuthenMode
== WMAC_AUTH_WPANONE
) {
718 dwMICKey0
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[16]));
719 dwMICKey1
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[20]));
720 } else if ((pKey
->dwKeyIndex
& BIT28
) == 0) {
721 dwMICKey0
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[16]));
722 dwMICKey1
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[20]));
724 dwMICKey0
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[24]));
725 dwMICKey1
= cpu_to_le32(*(u32
*)(&pKey
->abyKey
[28]));
729 MIC_vInit(dwMICKey0
, dwMICKey1
);
730 MIC_vAppend((u8
*)&(pDevice
->sRxEthHeader
.h_dest
[0]), 12);
732 MIC_vAppend((u8
*)&dwMIC_Priority
, 4);
733 // 4 is Rcv buffer header, 24 is MAC Header, and 8 is IV and Ext IV.
734 MIC_vAppend((u8
*)(skb
->data
+ 8 + WLAN_HDR_ADDR3_LEN
+ 8),
735 FrameSize
- WLAN_HDR_ADDR3_LEN
- 8);
736 MIC_vGetMIC(&dwLocalMIC_L
, &dwLocalMIC_R
);
739 pdwMIC_L
= (u32
*)(skb
->data
+ 8 + FrameSize
);
740 pdwMIC_R
= (u32
*)(skb
->data
+ 8 + FrameSize
+ 4);
742 if ((cpu_to_le32(*pdwMIC_L
) != dwLocalMIC_L
) || (cpu_to_le32(*pdwMIC_R
) != dwLocalMIC_R
) ||
743 (pDevice
->bRxMICFail
== true)) {
744 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"MIC comparison is fail!\n");
745 pDevice
->bRxMICFail
= false;
747 if (!device_alloc_frag_buf(pDevice
, &pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
])) {
748 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
"%s: can not alloc more frag bufs\n",
752 //send event to wpa_supplicant
753 //if(pDevice->bWPASuppWextEnabled == true)
755 union iwreq_data wrqu
;
756 struct iw_michaelmicfailure ev
;
757 int keyidx
= pbyFrame
[cbHeaderSize
+3] >> 6; //top two-bits
758 memset(&ev
, 0, sizeof(ev
));
759 ev
.flags
= keyidx
& IW_MICFAILURE_KEY_ID
;
760 if ((pMgmt
->eCurrMode
== WMAC_MODE_ESS_STA
) &&
761 (pMgmt
->eCurrState
== WMAC_STATE_ASSOC
) &&
762 (*pbyRsr
& (RSR_ADDRBROAD
| RSR_ADDRMULTI
)) == 0) {
763 ev
.flags
|= IW_MICFAILURE_PAIRWISE
;
765 ev
.flags
|= IW_MICFAILURE_GROUP
;
768 ev
.src_addr
.sa_family
= ARPHRD_ETHER
;
769 memcpy(ev
.src_addr
.sa_data
, pMACHeader
->addr2
, ETH_ALEN
);
770 memset(&wrqu
, 0, sizeof(wrqu
));
771 wrqu
.data
.length
= sizeof(ev
);
772 PRINT_K("wireless_send_event--->IWEVMICHAELMICFAILURE\n");
773 wireless_send_event(pDevice
->dev
, IWEVMICHAELMICFAILURE
, &wrqu
, (char *)&ev
);
781 } //---end of SOFT MIC-----------------------------------------------------------------------
783 // ++++++++++ Reply Counter Check +++++++++++++
785 if ((pKey
!= NULL
) && ((pKey
->byCipherSuite
== KEY_CTL_TKIP
) ||
786 (pKey
->byCipherSuite
== KEY_CTL_CCMP
))) {
788 u16 wLocalTSC15_0
= 0;
789 u32 dwLocalTSC47_16
= 0;
790 unsigned long long RSC
= 0;
792 RSC
= *((unsigned long long *) &(pKey
->KeyRSC
));
793 wLocalTSC15_0
= (u16
) RSC
;
794 dwLocalTSC47_16
= (u32
) (RSC
>>16);
799 memcpy(&(pKey
->KeyRSC
), &RSC
, sizeof(u64
));
801 if (pDevice
->vnt_mgmt
.eCurrMode
== WMAC_MODE_ESS_STA
&&
802 pDevice
->vnt_mgmt
.eCurrState
== WMAC_STATE_ASSOC
) {
804 if ( (wRxTSC15_0
< wLocalTSC15_0
) &&
805 (dwRxTSC47_16
<= dwLocalTSC47_16
) &&
806 !((dwRxTSC47_16
== 0) && (dwLocalTSC47_16
== 0xFFFFFFFF))) {
807 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"TSC is illegal~~!\n ");
810 if (!device_alloc_frag_buf(pDevice
, &pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
])) {
811 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
"%s: can not alloc more frag bufs\n",
819 } // ----- End of Reply Counter Check --------------------------
821 s_vProcessRxMACHeader(pDevice
, (u8
*)(skb
->data
+8), FrameSize
, bIsWEP
, bExtIV
, &cbHeaderOffset
);
822 FrameSize
-= cbHeaderOffset
;
823 cbHeaderOffset
+= 8; // 8 is Rcv buffer header
825 // Null data, framesize = 12
829 if (pMgmt
->eCurrMode
== WMAC_MODE_ESS_AP
) {
830 if (s_bAPModeRxData(pDevice
,
839 if (!device_alloc_frag_buf(pDevice
, &pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
])) {
840 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
"%s: can not alloc more frag bufs\n",
849 skb
->data
+= cbHeaderOffset
;
850 skb
->tail
+= cbHeaderOffset
;
851 skb_put(skb
, FrameSize
);
852 skb
->protocol
=eth_type_trans(skb
, skb
->dev
);
853 skb
->ip_summed
=CHECKSUM_NONE
;
854 pStats
->rx_bytes
+=skb
->len
;
855 pStats
->rx_packets
++;
858 if (!device_alloc_frag_buf(pDevice
, &pDevice
->sRxDFCB
[pDevice
->uCurrentDFCBIdx
])) {
859 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
"%s: can not alloc more frag bufs\n",
868 static int s_bAPModeRxCtl(struct vnt_private
*pDevice
, u8
*pbyFrame
,
871 struct vnt_manager
*pMgmt
= &pDevice
->vnt_mgmt
;
872 struct ieee80211_hdr
*p802_11Header
;
875 if (IS_CTL_PSPOLL(pbyFrame
) || !IS_TYPE_CONTROL(pbyFrame
)) {
877 p802_11Header
= (struct ieee80211_hdr
*) (pbyFrame
);
878 if (!IS_TYPE_MGMT(pbyFrame
)) {
880 // Data & PS-Poll packet
882 if (iSANodeIndex
> 0) {
883 // frame class 3 fliter & checking
884 if (pMgmt
->sNodeDBTable
[iSANodeIndex
].eNodeState
< NODE_AUTH
) {
885 // send deauth notification
886 // reason = (6) class 2 received from nonauth sta
887 vMgrDeAuthenBeginSta(pDevice
,
889 (u8
*)(p802_11Header
->addr2
),
890 (WLAN_MGMT_REASON_CLASS2_NONAUTH
),
893 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: send vMgrDeAuthenBeginSta 1\n");
896 if (pMgmt
->sNodeDBTable
[iSANodeIndex
].eNodeState
< NODE_ASSOC
) {
897 // send deassoc notification
898 // reason = (7) class 3 received from nonassoc sta
899 vMgrDisassocBeginSta(pDevice
,
901 (u8
*)(p802_11Header
->addr2
),
902 (WLAN_MGMT_REASON_CLASS3_NONASSOC
),
905 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: send vMgrDisassocBeginSta 2\n");
909 if (pMgmt
->sNodeDBTable
[iSANodeIndex
].bPSEnable
) {
910 // delcare received ps-poll event
911 if (IS_CTL_PSPOLL(pbyFrame
)) {
912 pMgmt
->sNodeDBTable
[iSANodeIndex
].bRxPSPoll
= true;
913 bScheduleCommand((void *) pDevice
,
916 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: WLAN_CMD_RX_PSPOLL 1\n");
919 // check Data PS state
920 // if PW bit off, send out all PS bufferring packets.
921 if (!IS_FC_POWERMGT(pbyFrame
)) {
922 pMgmt
->sNodeDBTable
[iSANodeIndex
].bPSEnable
= false;
923 pMgmt
->sNodeDBTable
[iSANodeIndex
].bRxPSPoll
= true;
924 bScheduleCommand((void *) pDevice
,
927 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: WLAN_CMD_RX_PSPOLL 2\n");
932 if (IS_FC_POWERMGT(pbyFrame
)) {
933 pMgmt
->sNodeDBTable
[iSANodeIndex
].bPSEnable
= true;
934 // Once if STA in PS state, enable multicast bufferring
935 pMgmt
->sNodeDBTable
[0].bPSEnable
= true;
938 // clear all pending PS frame.
939 if (pMgmt
->sNodeDBTable
[iSANodeIndex
].wEnQueueCnt
> 0) {
940 pMgmt
->sNodeDBTable
[iSANodeIndex
].bPSEnable
= false;
941 pMgmt
->sNodeDBTable
[iSANodeIndex
].bRxPSPoll
= true;
942 bScheduleCommand((void *) pDevice
,
945 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: WLAN_CMD_RX_PSPOLL 3\n");
952 vMgrDeAuthenBeginSta(pDevice
,
954 (u8
*)(p802_11Header
->addr2
),
955 (WLAN_MGMT_REASON_CLASS2_NONAUTH
),
958 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: send vMgrDeAuthenBeginSta 3\n");
959 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"BSSID:%pM\n",
960 p802_11Header
->addr3
);
961 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ADDR2:%pM\n",
962 p802_11Header
->addr2
);
963 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ADDR1:%pM\n",
964 p802_11Header
->addr1
);
965 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"dpc: frame_control= %x\n", p802_11Header
->frame_control
);
974 static int s_bHandleRxEncryption(struct vnt_private
*pDevice
, u8
*pbyFrame
,
975 u32 FrameSize
, u8
*pbyRsr
, u8
*pbyNewRsr
, PSKeyItem
*pKeyOut
,
976 s32
*pbExtIV
, u16
*pwRxTSC15_0
, u32
*pdwRxTSC47_16
)
978 struct vnt_manager
*pMgmt
= &pDevice
->vnt_mgmt
;
979 u32 PayloadLen
= FrameSize
;
982 PSKeyItem pKey
= NULL
;
983 u8 byDecMode
= KEY_CTL_WEP
;
988 pbyIV
= pbyFrame
+ WLAN_HDR_ADDR3_LEN
;
989 if ( WLAN_GET_FC_TODS(*(u16
*)pbyFrame
) &&
990 WLAN_GET_FC_FROMDS(*(u16
*)pbyFrame
) ) {
991 pbyIV
+= 6; // 6 is 802.11 address4
994 byKeyIdx
= (*(pbyIV
+3) & 0xc0);
996 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"\nKeyIdx: %d\n", byKeyIdx
);
998 if ((pMgmt
->eAuthenMode
== WMAC_AUTH_WPA
) ||
999 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPAPSK
) ||
1000 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPANONE
) ||
1001 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPA2
) ||
1002 (pMgmt
->eAuthenMode
== WMAC_AUTH_WPA2PSK
)) {
1003 if (((*pbyRsr
& (RSR_ADDRBROAD
| RSR_ADDRMULTI
)) == 0) &&
1004 (pMgmt
->byCSSPK
!= KEY_CTL_NONE
)) {
1005 // unicast pkt use pairwise key
1006 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"unicast pkt\n");
1007 if (KeybGetKey(&(pDevice
->sKey
), pDevice
->abyBSSID
, 0xFFFFFFFF, &pKey
) == true) {
1008 if (pMgmt
->byCSSPK
== KEY_CTL_TKIP
)
1009 byDecMode
= KEY_CTL_TKIP
;
1010 else if (pMgmt
->byCSSPK
== KEY_CTL_CCMP
)
1011 byDecMode
= KEY_CTL_CCMP
;
1013 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"unicast pkt: %d, %p\n", byDecMode
, pKey
);
1016 KeybGetKey(&(pDevice
->sKey
), pDevice
->abyBSSID
, byKeyIdx
, &pKey
);
1017 if (pMgmt
->byCSSGK
== KEY_CTL_TKIP
)
1018 byDecMode
= KEY_CTL_TKIP
;
1019 else if (pMgmt
->byCSSGK
== KEY_CTL_CCMP
)
1020 byDecMode
= KEY_CTL_CCMP
;
1021 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"group pkt: %d, %d, %p\n", byKeyIdx
, byDecMode
, pKey
);
1024 // our WEP only support Default Key
1026 // use default group key
1027 KeybGetKey(&(pDevice
->sKey
), pDevice
->abyBroadcastAddr
, byKeyIdx
, &pKey
);
1028 if (pMgmt
->byCSSGK
== KEY_CTL_TKIP
)
1029 byDecMode
= KEY_CTL_TKIP
;
1030 else if (pMgmt
->byCSSGK
== KEY_CTL_CCMP
)
1031 byDecMode
= KEY_CTL_CCMP
;
1035 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"AES:%d %d %d\n", pMgmt
->byCSSPK
, pMgmt
->byCSSGK
, byDecMode
);
1038 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"pKey == NULL\n");
1041 if (byDecMode
!= pKey
->byCipherSuite
) {
1045 if (byDecMode
== KEY_CTL_WEP
) {
1047 if ((pDevice
->byLocalID
<= REV_ID_VT3253_A1
) ||
1048 (((PSKeyTable
)(pKey
->pvKeyTable
))->bSoftWEP
== true)) {
1053 PayloadLen
-= (WLAN_HDR_ADDR3_LEN
+ 4 + 4); // 24 is 802.11 header,4 is IV, 4 is crc
1054 memcpy(pDevice
->abyPRNG
, pbyIV
, 3);
1055 memcpy(pDevice
->abyPRNG
+ 3, pKey
->abyKey
, pKey
->uKeyLength
);
1056 rc4_init(&pDevice
->SBox
, pDevice
->abyPRNG
, pKey
->uKeyLength
+ 3);
1057 rc4_encrypt(&pDevice
->SBox
, pbyIV
+4, pbyIV
+4, PayloadLen
);
1059 if (ETHbIsBufferCrc32Ok(pbyIV
+4, PayloadLen
)) {
1060 *pbyNewRsr
|= NEWRSR_DECRYPTOK
;
1063 } else if ((byDecMode
== KEY_CTL_TKIP
) ||
1064 (byDecMode
== KEY_CTL_CCMP
)) {
1067 PayloadLen
-= (WLAN_HDR_ADDR3_LEN
+ 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
1068 *pdwRxTSC47_16
= cpu_to_le32(*(u32
*)(pbyIV
+ 4));
1069 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ExtIV: %x\n", *pdwRxTSC47_16
);
1070 if (byDecMode
== KEY_CTL_TKIP
) {
1071 *pwRxTSC15_0
= cpu_to_le16(MAKEWORD(*(pbyIV
+2), *pbyIV
));
1073 *pwRxTSC15_0
= cpu_to_le16(*(u16
*)pbyIV
);
1075 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"TSC0_15: %x\n", *pwRxTSC15_0
);
1077 if ((byDecMode
== KEY_CTL_TKIP
) &&
1078 (pDevice
->byLocalID
<= REV_ID_VT3253_A1
)) {
1081 struct ieee80211_hdr
*pMACHeader
= (struct ieee80211_hdr
*) (pbyFrame
);
1082 TKIPvMixKey(pKey
->abyKey
, pMACHeader
->addr2
, *pwRxTSC15_0
, *pdwRxTSC47_16
, pDevice
->abyPRNG
);
1083 rc4_init(&pDevice
->SBox
, pDevice
->abyPRNG
, TKIP_KEY_LEN
);
1084 rc4_encrypt(&pDevice
->SBox
, pbyIV
+8, pbyIV
+8, PayloadLen
);
1085 if (ETHbIsBufferCrc32Ok(pbyIV
+8, PayloadLen
)) {
1086 *pbyNewRsr
|= NEWRSR_DECRYPTOK
;
1087 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ICV OK!\n");
1089 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ICV FAIL!!!\n");
1090 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"PayloadLen = %d\n", PayloadLen
);
1095 if ((*(pbyIV
+3) & 0x20) != 0)
1100 static int s_bHostWepRxEncryption(struct vnt_private
*pDevice
, u8
*pbyFrame
,
1101 u32 FrameSize
, u8
*pbyRsr
, int bOnFly
, PSKeyItem pKey
, u8
*pbyNewRsr
,
1102 s32
*pbExtIV
, u16
*pwRxTSC15_0
, u32
*pdwRxTSC47_16
)
1104 struct vnt_manager
*pMgmt
= &pDevice
->vnt_mgmt
;
1105 struct ieee80211_hdr
*pMACHeader
;
1106 u32 PayloadLen
= FrameSize
;
1109 u8 byDecMode
= KEY_CTL_WEP
;
1114 pbyIV
= pbyFrame
+ WLAN_HDR_ADDR3_LEN
;
1115 if ( WLAN_GET_FC_TODS(*(u16
*)pbyFrame
) &&
1116 WLAN_GET_FC_FROMDS(*(u16
*)pbyFrame
) ) {
1117 pbyIV
+= 6; // 6 is 802.11 address4
1120 byKeyIdx
= (*(pbyIV
+3) & 0xc0);
1122 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"\nKeyIdx: %d\n", byKeyIdx
);
1124 if (pMgmt
->byCSSGK
== KEY_CTL_TKIP
)
1125 byDecMode
= KEY_CTL_TKIP
;
1126 else if (pMgmt
->byCSSGK
== KEY_CTL_CCMP
)
1127 byDecMode
= KEY_CTL_CCMP
;
1129 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"AES:%d %d %d\n", pMgmt
->byCSSPK
, pMgmt
->byCSSGK
, byDecMode
);
1131 if (byDecMode
!= pKey
->byCipherSuite
) {
1135 if (byDecMode
== KEY_CTL_WEP
) {
1137 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"byDecMode == KEY_CTL_WEP\n");
1138 if ((pDevice
->byLocalID
<= REV_ID_VT3253_A1
) ||
1139 (((PSKeyTable
)(pKey
->pvKeyTable
))->bSoftWEP
== true) ||
1140 (bOnFly
== false)) {
1146 PayloadLen
-= (WLAN_HDR_ADDR3_LEN
+ 4 + 4); // 24 is 802.11 header,4 is IV, 4 is crc
1147 memcpy(pDevice
->abyPRNG
, pbyIV
, 3);
1148 memcpy(pDevice
->abyPRNG
+ 3, pKey
->abyKey
, pKey
->uKeyLength
);
1149 rc4_init(&pDevice
->SBox
, pDevice
->abyPRNG
, pKey
->uKeyLength
+ 3);
1150 rc4_encrypt(&pDevice
->SBox
, pbyIV
+4, pbyIV
+4, PayloadLen
);
1152 if (ETHbIsBufferCrc32Ok(pbyIV
+4, PayloadLen
)) {
1153 *pbyNewRsr
|= NEWRSR_DECRYPTOK
;
1156 } else if ((byDecMode
== KEY_CTL_TKIP
) ||
1157 (byDecMode
== KEY_CTL_CCMP
)) {
1160 PayloadLen
-= (WLAN_HDR_ADDR3_LEN
+ 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
1161 *pdwRxTSC47_16
= cpu_to_le32(*(u32
*)(pbyIV
+ 4));
1162 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ExtIV: %x\n", *pdwRxTSC47_16
);
1164 if (byDecMode
== KEY_CTL_TKIP
) {
1165 *pwRxTSC15_0
= cpu_to_le16(MAKEWORD(*(pbyIV
+2), *pbyIV
));
1167 *pwRxTSC15_0
= cpu_to_le16(*(u16
*)pbyIV
);
1169 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"TSC0_15: %x\n", *pwRxTSC15_0
);
1171 if (byDecMode
== KEY_CTL_TKIP
) {
1173 if ((pDevice
->byLocalID
<= REV_ID_VT3253_A1
) || (bOnFly
== false)) {
1177 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"soft KEY_CTL_TKIP \n");
1178 pMACHeader
= (struct ieee80211_hdr
*) (pbyFrame
);
1179 TKIPvMixKey(pKey
->abyKey
, pMACHeader
->addr2
, *pwRxTSC15_0
, *pdwRxTSC47_16
, pDevice
->abyPRNG
);
1180 rc4_init(&pDevice
->SBox
, pDevice
->abyPRNG
, TKIP_KEY_LEN
);
1181 rc4_encrypt(&pDevice
->SBox
, pbyIV
+8, pbyIV
+8, PayloadLen
);
1182 if (ETHbIsBufferCrc32Ok(pbyIV
+8, PayloadLen
)) {
1183 *pbyNewRsr
|= NEWRSR_DECRYPTOK
;
1184 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ICV OK!\n");
1186 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"ICV FAIL!!!\n");
1187 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"PayloadLen = %d\n", PayloadLen
);
1192 if (byDecMode
== KEY_CTL_CCMP
) {
1193 if (bOnFly
== false) {
1196 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"soft KEY_CTL_CCMP\n");
1197 if (AESbGenCCMP(pKey
->abyKey
, pbyFrame
, FrameSize
)) {
1198 *pbyNewRsr
|= NEWRSR_DECRYPTOK
;
1199 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"CCMP MIC compare OK!\n");
1201 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"CCMP MIC fail!\n");
1208 if ((*(pbyIV
+3) & 0x20) != 0)
1213 static int s_bAPModeRxData(struct vnt_private
*pDevice
, struct sk_buff
*skb
,
1214 u32 FrameSize
, u32 cbHeaderOffset
, s32 iSANodeIndex
, s32 iDANodeIndex
)
1216 struct sk_buff
*skbcpy
;
1217 struct vnt_manager
*pMgmt
= &pDevice
->vnt_mgmt
;
1218 int bRelayAndForward
= false;
1219 int bRelayOnly
= false;
1220 u8 byMask
[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
1223 if (FrameSize
> CB_MAX_BUF_SIZE
)
1226 if (is_multicast_ether_addr((u8
*)(skb
->data
+cbHeaderOffset
))) {
1227 if (pMgmt
->sNodeDBTable
[0].bPSEnable
) {
1229 skbcpy
= dev_alloc_skb((int)pDevice
->rx_buf_sz
);
1231 // if any node in PS mode, buffer packet until DTIM.
1232 if (skbcpy
== NULL
) {
1233 DBG_PRT(MSG_LEVEL_NOTICE
, KERN_INFO
"relay multicast no skb available \n");
1236 skbcpy
->dev
= pDevice
->dev
;
1237 skbcpy
->len
= FrameSize
;
1238 memcpy(skbcpy
->data
, skb
->data
+cbHeaderOffset
, FrameSize
);
1239 skb_queue_tail(&(pMgmt
->sNodeDBTable
[0].sTxPSQueue
), skbcpy
);
1240 pMgmt
->sNodeDBTable
[0].wEnQueueCnt
++;
1242 pMgmt
->abyPSTxMap
[0] |= byMask
[0];
1246 bRelayAndForward
= true;
1251 if (BSSbIsSTAInNodeDB(pDevice
, (u8
*)(skb
->data
+cbHeaderOffset
), &iDANodeIndex
)) {
1252 if (pMgmt
->sNodeDBTable
[iDANodeIndex
].eNodeState
>= NODE_ASSOC
) {
1253 if (pMgmt
->sNodeDBTable
[iDANodeIndex
].bPSEnable
) {
1254 // queue this skb until next PS tx, and then release.
1256 skb
->data
+= cbHeaderOffset
;
1257 skb
->tail
+= cbHeaderOffset
;
1258 skb_put(skb
, FrameSize
);
1259 skb_queue_tail(&pMgmt
->sNodeDBTable
[iDANodeIndex
].sTxPSQueue
, skb
);
1261 pMgmt
->sNodeDBTable
[iDANodeIndex
].wEnQueueCnt
++;
1262 wAID
= pMgmt
->sNodeDBTable
[iDANodeIndex
].wAID
;
1263 pMgmt
->abyPSTxMap
[wAID
>> 3] |= byMask
[wAID
& 7];
1264 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"relay: index= %d, pMgmt->abyPSTxMap[%d]= %d\n",
1265 iDANodeIndex
, (wAID
>> 3), pMgmt
->abyPSTxMap
[wAID
>> 3]);
1275 if (bRelayOnly
|| bRelayAndForward
) {
1276 // relay this packet right now
1277 if (bRelayAndForward
)
1280 if ((pDevice
->uAssocCount
> 1) && (iDANodeIndex
>= 0)) {
1281 bRelayPacketSend(pDevice
, (u8
*) (skb
->data
+ cbHeaderOffset
),
1282 FrameSize
, (unsigned int) iDANodeIndex
);
1288 // none associate, don't forward
1289 if (pDevice
->uAssocCount
== 0)
1295 void RXvWorkItem(struct work_struct
*work
)
1297 struct vnt_private
*pDevice
=
1298 container_of(work
, struct vnt_private
, read_work_item
);
1300 struct vnt_rcb
*pRCB
= NULL
;
1302 if (pDevice
->Flags
& fMP_DISCONNECTED
)
1305 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"---->Rx Polling Thread\n");
1306 spin_lock_irq(&pDevice
->lock
);
1308 while ((pDevice
->Flags
& fMP_POST_READS
) &&
1309 MP_IS_READY(pDevice
) &&
1310 (pDevice
->NumRecvFreeList
!= 0) ) {
1311 pRCB
= pDevice
->FirstRecvFreeList
;
1312 pDevice
->NumRecvFreeList
--;
1313 DequeueRCB(pDevice
->FirstRecvFreeList
, pDevice
->LastRecvFreeList
);
1314 ntStatus
= PIPEnsBulkInUsbRead(pDevice
, pRCB
);
1316 pDevice
->bIsRxWorkItemQueued
= false;
1317 spin_unlock_irq(&pDevice
->lock
);
1321 void RXvFreeRCB(struct vnt_rcb
*pRCB
, int bReAllocSkb
)
1323 struct vnt_private
*pDevice
= pRCB
->pDevice
;
1325 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"---->RXvFreeRCB\n");
1327 if (bReAllocSkb
== false) {
1328 kfree_skb(pRCB
->skb
);
1332 if (bReAllocSkb
== true) {
1333 pRCB
->skb
= dev_alloc_skb((int)pDevice
->rx_buf_sz
);
1334 // todo error handling
1335 if (pRCB
->skb
== NULL
) {
1336 DBG_PRT(MSG_LEVEL_ERR
,KERN_ERR
" Failed to re-alloc rx skb\n");
1338 pRCB
->skb
->dev
= pDevice
->dev
;
1342 // Insert the RCB back in the Recv free list
1344 EnqueueRCB(pDevice
->FirstRecvFreeList
, pDevice
->LastRecvFreeList
, pRCB
);
1345 pDevice
->NumRecvFreeList
++;
1347 if ((pDevice
->Flags
& fMP_POST_READS
) && MP_IS_READY(pDevice
) &&
1348 (pDevice
->bIsRxWorkItemQueued
== false) ) {
1350 pDevice
->bIsRxWorkItemQueued
= true;
1351 schedule_work(&pDevice
->read_work_item
);
1353 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"<----RXFreeRCB %d %d\n",pDevice
->NumRecvFreeList
, pDevice
->NumRecvMngList
);
1356 void RXvMngWorkItem(struct work_struct
*work
)
1358 struct vnt_private
*pDevice
=
1359 container_of(work
, struct vnt_private
, rx_mng_work_item
);
1360 struct vnt_rcb
*pRCB
= NULL
;
1361 struct vnt_rx_mgmt
*pRxPacket
;
1362 int bReAllocSkb
= false;
1364 if (pDevice
->Flags
& fMP_DISCONNECTED
)
1367 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"---->Rx Mng Thread\n");
1369 spin_lock_irq(&pDevice
->lock
);
1370 while (pDevice
->NumRecvMngList
!=0)
1372 pRCB
= pDevice
->FirstRecvMngList
;
1373 pDevice
->NumRecvMngList
--;
1374 DequeueRCB(pDevice
->FirstRecvMngList
, pDevice
->LastRecvMngList
);
1378 pRxPacket
= &(pRCB
->sMngPacket
);
1379 vMgrRxManagePacket(pDevice
, &pDevice
->vnt_mgmt
, pRxPacket
);
1381 if(pRCB
->Ref
== 0) {
1382 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"RxvFreeMng %d %d\n",pDevice
->NumRecvFreeList
, pDevice
->NumRecvMngList
);
1383 RXvFreeRCB(pRCB
, bReAllocSkb
);
1385 DBG_PRT(MSG_LEVEL_DEBUG
, KERN_INFO
"Rx Mng Only we have the right to free RCB\n");
1389 pDevice
->bIsRxMngWorkItemQueued
= false;
1390 spin_unlock_irq(&pDevice
->lock
);