1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Original code based Host AP (software wireless LAN access point) driver
4  * for Intersil Prism2/2.5/3 - hostap.o module, common routines
5  *
6  * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
7  * <jkmaline@cc.hut.fi>
8  * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
9  * Copyright (c) 2004, Intel Corporation
10  *
11  * Few modifications for Realtek's Wi-Fi drivers by
12  * Andrea Merello <andrea.merello@gmail.com>
13  *
14  * A special thanks goes to Realtek for their support !
15  */
16 #include <linux/compiler.h>
17 #include <linux/errno.h>
18 #include <linux/if_arp.h>
19 #include <linux/in6.h>
20 #include <linux/in.h>
21 #include <linux/ip.h>
22 #include <linux/kernel.h>
23 #include <linux/module.h>
24 #include <linux/netdevice.h>
25 #include <linux/pci.h>
26 #include <linux/proc_fs.h>
27 #include <linux/skbuff.h>
28 #include <linux/slab.h>
29 #include <linux/tcp.h>
30 #include <linux/types.h>
31 #include <linux/wireless.h>
32 #include <linux/etherdevice.h>
33 #include <linux/uaccess.h>
34 #include <linux/ctype.h>
35 
36 #include "rtllib.h"
37 #include "dot11d.h"
38 
39 static void rtllib_rx_mgt(struct rtllib_device *ieee, struct sk_buff *skb,
40 			  struct rtllib_rx_stats *stats);
41 
rtllib_monitor_rx(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_status,size_t hdr_length)42 static inline void rtllib_monitor_rx(struct rtllib_device *ieee,
43 				     struct sk_buff *skb,
44 				     struct rtllib_rx_stats *rx_status,
45 				     size_t hdr_length)
46 {
47 	skb->dev = ieee->dev;
48 	skb_reset_mac_header(skb);
49 	skb_pull(skb, hdr_length);
50 	skb->pkt_type = PACKET_OTHERHOST;
51 	skb->protocol = htons(ETH_P_80211_RAW);
52 	memset(skb->cb, 0, sizeof(skb->cb));
53 	netif_rx(skb);
54 }
55 
56 /* Called only as a tasklet (software IRQ) */
57 static struct rtllib_frag_entry *
rtllib_frag_cache_find(struct rtllib_device * ieee,unsigned int seq,unsigned int frag,u8 tid,u8 * src,u8 * dst)58 rtllib_frag_cache_find(struct rtllib_device *ieee, unsigned int seq,
59 			  unsigned int frag, u8 tid, u8 *src, u8 *dst)
60 {
61 	struct rtllib_frag_entry *entry;
62 	int i;
63 
64 	for (i = 0; i < RTLLIB_FRAG_CACHE_LEN; i++) {
65 		entry = &ieee->frag_cache[tid][i];
66 		if (entry->skb != NULL &&
67 		    time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
68 			netdev_dbg(ieee->dev,
69 				   "expiring fragment cache entry seq=%u last_frag=%u\n",
70 				   entry->seq, entry->last_frag);
71 			dev_kfree_skb_any(entry->skb);
72 			entry->skb = NULL;
73 		}
74 
75 		if (entry->skb != NULL && entry->seq == seq &&
76 		    (entry->last_frag + 1 == frag || frag == -1) &&
77 		    memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
78 		    memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
79 			return entry;
80 	}
81 
82 	return NULL;
83 }
84 
85 /* Called only as a tasklet (software IRQ) */
86 static struct sk_buff *
rtllib_frag_cache_get(struct rtllib_device * ieee,struct rtllib_hdr_4addr * hdr)87 rtllib_frag_cache_get(struct rtllib_device *ieee,
88 			 struct rtllib_hdr_4addr *hdr)
89 {
90 	struct sk_buff *skb = NULL;
91 	u16 fc = le16_to_cpu(hdr->frame_ctl);
92 	u16 sc = le16_to_cpu(hdr->seq_ctl);
93 	unsigned int frag = WLAN_GET_SEQ_FRAG(sc);
94 	unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
95 	struct rtllib_frag_entry *entry;
96 	struct rtllib_hdr_3addrqos *hdr_3addrqos;
97 	struct rtllib_hdr_4addrqos *hdr_4addrqos;
98 	u8 tid;
99 
100 	if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) &&
101 	    RTLLIB_QOS_HAS_SEQ(fc)) {
102 		hdr_4addrqos = (struct rtllib_hdr_4addrqos *)hdr;
103 		tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID;
104 		tid = UP2AC(tid);
105 		tid++;
106 	} else if (RTLLIB_QOS_HAS_SEQ(fc)) {
107 		hdr_3addrqos = (struct rtllib_hdr_3addrqos *)hdr;
108 		tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID;
109 		tid = UP2AC(tid);
110 		tid++;
111 	} else {
112 		tid = 0;
113 	}
114 
115 	if (frag == 0) {
116 		/* Reserve enough space to fit maximum frame length */
117 		skb = dev_alloc_skb(ieee->dev->mtu +
118 				    sizeof(struct rtllib_hdr_4addr) +
119 				    8 /* LLC */ +
120 				    2 /* alignment */ +
121 				    8 /* WEP */ +
122 				    ETH_ALEN /* WDS */ +
123 				    /* QOS Control */
124 				    (RTLLIB_QOS_HAS_SEQ(fc) ? 2 : 0));
125 		if (!skb)
126 			return NULL;
127 
128 		entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]];
129 		ieee->frag_next_idx[tid]++;
130 		if (ieee->frag_next_idx[tid] >= RTLLIB_FRAG_CACHE_LEN)
131 			ieee->frag_next_idx[tid] = 0;
132 
133 		if (entry->skb != NULL)
134 			dev_kfree_skb_any(entry->skb);
135 
136 		entry->first_frag_time = jiffies;
137 		entry->seq = seq;
138 		entry->last_frag = frag;
139 		entry->skb = skb;
140 		ether_addr_copy(entry->src_addr, hdr->addr2);
141 		ether_addr_copy(entry->dst_addr, hdr->addr1);
142 	} else {
143 		/* received a fragment of a frame for which the head fragment
144 		 * should have already been received
145 		 */
146 		entry = rtllib_frag_cache_find(ieee, seq, frag, tid, hdr->addr2,
147 						  hdr->addr1);
148 		if (entry != NULL) {
149 			entry->last_frag = frag;
150 			skb = entry->skb;
151 		}
152 	}
153 
154 	return skb;
155 }
156 
157 /* Called only as a tasklet (software IRQ) */
rtllib_frag_cache_invalidate(struct rtllib_device * ieee,struct rtllib_hdr_4addr * hdr)158 static int rtllib_frag_cache_invalidate(struct rtllib_device *ieee,
159 					   struct rtllib_hdr_4addr *hdr)
160 {
161 	u16 fc = le16_to_cpu(hdr->frame_ctl);
162 	u16 sc = le16_to_cpu(hdr->seq_ctl);
163 	unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
164 	struct rtllib_frag_entry *entry;
165 	struct rtllib_hdr_3addrqos *hdr_3addrqos;
166 	struct rtllib_hdr_4addrqos *hdr_4addrqos;
167 	u8 tid;
168 
169 	if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) &&
170 	    RTLLIB_QOS_HAS_SEQ(fc)) {
171 		hdr_4addrqos = (struct rtllib_hdr_4addrqos *)hdr;
172 		tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID;
173 		tid = UP2AC(tid);
174 		tid++;
175 	} else if (RTLLIB_QOS_HAS_SEQ(fc)) {
176 		hdr_3addrqos = (struct rtllib_hdr_3addrqos *)hdr;
177 		tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID;
178 		tid = UP2AC(tid);
179 		tid++;
180 	} else {
181 		tid = 0;
182 	}
183 
184 	entry = rtllib_frag_cache_find(ieee, seq, -1, tid, hdr->addr2,
185 					  hdr->addr1);
186 
187 	if (entry == NULL) {
188 		netdev_dbg(ieee->dev,
189 			   "Couldn't invalidate fragment cache entry (seq=%u)\n",
190 			   seq);
191 		return -1;
192 	}
193 
194 	entry->skb = NULL;
195 	return 0;
196 }
197 
198 /* rtllib_rx_frame_mgtmt
199  *
200  * Responsible for handling management control frames
201  *
202  * Called by rtllib_rx
203  */
204 static inline int
rtllib_rx_frame_mgmt(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats,u16 type,u16 stype)205 rtllib_rx_frame_mgmt(struct rtllib_device *ieee, struct sk_buff *skb,
206 			struct rtllib_rx_stats *rx_stats, u16 type,
207 			u16 stype)
208 {
209 	/* On the struct stats definition there is written that
210 	 * this is not mandatory.... but seems that the probe
211 	 * response parser uses it
212 	 */
213 	struct rtllib_hdr_3addr *hdr = (struct rtllib_hdr_3addr *)skb->data;
214 
215 	rx_stats->len = skb->len;
216 	rtllib_rx_mgt(ieee, skb, rx_stats);
217 	if ((memcmp(hdr->addr1, ieee->dev->dev_addr, ETH_ALEN))) {
218 		dev_kfree_skb_any(skb);
219 		return 0;
220 	}
221 	rtllib_rx_frame_softmac(ieee, skb, rx_stats, type, stype);
222 
223 	dev_kfree_skb_any(skb);
224 
225 	return 0;
226 }
227 
228 /* No encapsulation header if EtherType < 0x600 (=length) */
229 
230 /* Called by rtllib_rx_frame_decrypt */
rtllib_is_eapol_frame(struct rtllib_device * ieee,struct sk_buff * skb,size_t hdrlen)231 static int rtllib_is_eapol_frame(struct rtllib_device *ieee,
232 				    struct sk_buff *skb, size_t hdrlen)
233 {
234 	struct net_device *dev = ieee->dev;
235 	u16 fc, ethertype;
236 	struct rtllib_hdr_4addr *hdr;
237 	u8 *pos;
238 
239 	if (skb->len < 24)
240 		return 0;
241 
242 	hdr = (struct rtllib_hdr_4addr *)skb->data;
243 	fc = le16_to_cpu(hdr->frame_ctl);
244 
245 	/* check that the frame is unicast frame to us */
246 	if ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) ==
247 	    RTLLIB_FCTL_TODS &&
248 	    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
249 	    memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
250 		/* ToDS frame with own addr BSSID and DA */
251 	} else if ((fc & (RTLLIB_FCTL_TODS | RTLLIB_FCTL_FROMDS)) ==
252 		   RTLLIB_FCTL_FROMDS &&
253 		   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
254 		/* FromDS frame with own addr as DA */
255 	} else {
256 		return 0;
257 	}
258 
259 	if (skb->len < 24 + 8)
260 		return 0;
261 
262 	/* check for port access entity Ethernet type */
263 	pos = skb->data + hdrlen;
264 	ethertype = (pos[6] << 8) | pos[7];
265 	if (ethertype == ETH_P_PAE)
266 		return 1;
267 
268 	return 0;
269 }
270 
271 /* Called only as a tasklet (software IRQ), by rtllib_rx */
272 static inline int
rtllib_rx_frame_decrypt(struct rtllib_device * ieee,struct sk_buff * skb,struct lib80211_crypt_data * crypt)273 rtllib_rx_frame_decrypt(struct rtllib_device *ieee, struct sk_buff *skb,
274 			struct lib80211_crypt_data *crypt)
275 {
276 	struct rtllib_hdr_4addr *hdr;
277 	int res, hdrlen;
278 
279 	if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
280 		return 0;
281 
282 	if (ieee->hwsec_active) {
283 		struct cb_desc *tcb_desc = (struct cb_desc *)
284 						(skb->cb + MAX_DEV_ADDR_SIZE);
285 
286 		tcb_desc->bHwSec = 1;
287 
288 		if (ieee->need_sw_enc)
289 			tcb_desc->bHwSec = 0;
290 	}
291 
292 	hdr = (struct rtllib_hdr_4addr *)skb->data;
293 	hdrlen = rtllib_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
294 
295 	atomic_inc(&crypt->refcnt);
296 	res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
297 	atomic_dec(&crypt->refcnt);
298 	if (res < 0) {
299 		netdev_dbg(ieee->dev, "decryption failed (SA= %pM) res=%d\n",
300 			   hdr->addr2, res);
301 		if (res == -2)
302 			netdev_dbg(ieee->dev,
303 				   "Decryption failed ICV mismatch (key %d)\n",
304 				   skb->data[hdrlen + 3] >> 6);
305 		return -1;
306 	}
307 
308 	return res;
309 }
310 
311 /* Called only as a tasklet (software IRQ), by rtllib_rx */
312 static inline int
rtllib_rx_frame_decrypt_msdu(struct rtllib_device * ieee,struct sk_buff * skb,int keyidx,struct lib80211_crypt_data * crypt)313 rtllib_rx_frame_decrypt_msdu(struct rtllib_device *ieee, struct sk_buff *skb,
314 			     int keyidx, struct lib80211_crypt_data *crypt)
315 {
316 	struct rtllib_hdr_4addr *hdr;
317 	int res, hdrlen;
318 
319 	if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
320 		return 0;
321 	if (ieee->hwsec_active) {
322 		struct cb_desc *tcb_desc = (struct cb_desc *)
323 						(skb->cb + MAX_DEV_ADDR_SIZE);
324 
325 		tcb_desc->bHwSec = 1;
326 
327 		if (ieee->need_sw_enc)
328 			tcb_desc->bHwSec = 0;
329 	}
330 
331 	hdr = (struct rtllib_hdr_4addr *)skb->data;
332 	hdrlen = rtllib_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
333 
334 	atomic_inc(&crypt->refcnt);
335 	res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
336 	atomic_dec(&crypt->refcnt);
337 	if (res < 0) {
338 		netdev_dbg(ieee->dev,
339 			   "MSDU decryption/MIC verification failed (SA= %pM keyidx=%d)\n",
340 			   hdr->addr2, keyidx);
341 		return -1;
342 	}
343 
344 	return 0;
345 }
346 
347 /* this function is stolen from ipw2200 driver*/
348 #define IEEE_PACKET_RETRY_TIME (5 * HZ)
is_duplicate_packet(struct rtllib_device * ieee,struct rtllib_hdr_4addr * header)349 static int is_duplicate_packet(struct rtllib_device *ieee,
350 				      struct rtllib_hdr_4addr *header)
351 {
352 	u16 fc = le16_to_cpu(header->frame_ctl);
353 	u16 sc = le16_to_cpu(header->seq_ctl);
354 	u16 seq = WLAN_GET_SEQ_SEQ(sc);
355 	u16 frag = WLAN_GET_SEQ_FRAG(sc);
356 	u16 *last_seq, *last_frag;
357 	unsigned long *last_time;
358 	struct rtllib_hdr_3addrqos *hdr_3addrqos;
359 	struct rtllib_hdr_4addrqos *hdr_4addrqos;
360 	u8 tid;
361 
362 	if (((fc & RTLLIB_FCTL_DSTODS) == RTLLIB_FCTL_DSTODS) &&
363 	    RTLLIB_QOS_HAS_SEQ(fc)) {
364 		hdr_4addrqos = (struct rtllib_hdr_4addrqos *)header;
365 		tid = le16_to_cpu(hdr_4addrqos->qos_ctl) & RTLLIB_QCTL_TID;
366 		tid = UP2AC(tid);
367 		tid++;
368 	} else if (RTLLIB_QOS_HAS_SEQ(fc)) {
369 		hdr_3addrqos = (struct rtllib_hdr_3addrqos *)header;
370 		tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & RTLLIB_QCTL_TID;
371 		tid = UP2AC(tid);
372 		tid++;
373 	} else {
374 		tid = 0;
375 	}
376 
377 	switch (ieee->iw_mode) {
378 	case IW_MODE_ADHOC:
379 	{
380 		struct list_head *p;
381 		struct ieee_ibss_seq *entry = NULL;
382 		u8 *mac = header->addr2;
383 		int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE;
384 
385 		list_for_each(p, &ieee->ibss_mac_hash[index]) {
386 			entry = list_entry(p, struct ieee_ibss_seq, list);
387 			if (!memcmp(entry->mac, mac, ETH_ALEN))
388 				break;
389 		}
390 		if (p == &ieee->ibss_mac_hash[index]) {
391 			entry = kmalloc(sizeof(struct ieee_ibss_seq),
392 					GFP_ATOMIC);
393 			if (!entry)
394 				return 0;
395 
396 			ether_addr_copy(entry->mac, mac);
397 			entry->seq_num[tid] = seq;
398 			entry->frag_num[tid] = frag;
399 			entry->packet_time[tid] = jiffies;
400 			list_add(&entry->list, &ieee->ibss_mac_hash[index]);
401 			return 0;
402 		}
403 		last_seq = &entry->seq_num[tid];
404 		last_frag = &entry->frag_num[tid];
405 		last_time = &entry->packet_time[tid];
406 		break;
407 	}
408 
409 	case IW_MODE_INFRA:
410 		last_seq = &ieee->last_rxseq_num[tid];
411 		last_frag = &ieee->last_rxfrag_num[tid];
412 		last_time = &ieee->last_packet_time[tid];
413 		break;
414 	default:
415 		return 0;
416 	}
417 
418 	if ((*last_seq == seq) &&
419 	    time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) {
420 		if (*last_frag == frag)
421 			goto drop;
422 		if (*last_frag + 1 != frag)
423 			/* out-of-order fragment */
424 			goto drop;
425 	} else {
426 		*last_seq = seq;
427 	}
428 
429 	*last_frag = frag;
430 	*last_time = jiffies;
431 	return 0;
432 
433 drop:
434 
435 	return 1;
436 }
437 
AddReorderEntry(struct rx_ts_record * pTS,struct rx_reorder_entry * pReorderEntry)438 static bool AddReorderEntry(struct rx_ts_record *pTS,
439 			    struct rx_reorder_entry *pReorderEntry)
440 {
441 	struct list_head *pList = &pTS->rx_pending_pkt_list;
442 
443 	while (pList->next != &pTS->rx_pending_pkt_list) {
444 		if (SN_LESS(pReorderEntry->SeqNum, ((struct rx_reorder_entry *)
445 		    list_entry(pList->next, struct rx_reorder_entry,
446 		    List))->SeqNum))
447 			pList = pList->next;
448 		else if (SN_EQUAL(pReorderEntry->SeqNum,
449 			((struct rx_reorder_entry *)list_entry(pList->next,
450 			struct rx_reorder_entry, List))->SeqNum))
451 			return false;
452 		else
453 			break;
454 	}
455 	pReorderEntry->List.next = pList->next;
456 	pReorderEntry->List.next->prev = &pReorderEntry->List;
457 	pReorderEntry->List.prev = pList;
458 	pList->next = &pReorderEntry->List;
459 
460 	return true;
461 }
462 
rtllib_indicate_packets(struct rtllib_device * ieee,struct rtllib_rxb ** prxbIndicateArray,u8 index)463 void rtllib_indicate_packets(struct rtllib_device *ieee,
464 			     struct rtllib_rxb **prxbIndicateArray, u8 index)
465 {
466 	struct net_device_stats *stats = &ieee->stats;
467 	u8 i = 0, j = 0;
468 	u16 ethertype;
469 
470 	for (j = 0; j < index; j++) {
471 		struct rtllib_rxb *prxb = prxbIndicateArray[j];
472 
473 		for (i = 0; i < prxb->nr_subframes; i++) {
474 			struct sk_buff *sub_skb = prxb->subframes[i];
475 
476 		/* convert hdr + possible LLC headers into Ethernet header */
477 			ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7];
478 			if (sub_skb->len >= 8 &&
479 			    ((memcmp(sub_skb->data, rfc1042_header,
480 				     SNAP_SIZE) == 0 &&
481 			      ethertype != ETH_P_AARP &&
482 			      ethertype != ETH_P_IPX) ||
483 			    memcmp(sub_skb->data, bridge_tunnel_header,
484 				   SNAP_SIZE) == 0)) {
485 				/* remove RFC1042 or Bridge-Tunnel encapsulation
486 				 * and replace EtherType
487 				 */
488 				skb_pull(sub_skb, SNAP_SIZE);
489 				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN);
490 				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN);
491 			} else {
492 				u16 len;
493 			/* Leave Ethernet header part of hdr and full payload */
494 				len = sub_skb->len;
495 				memcpy(skb_push(sub_skb, 2), &len, 2);
496 				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->src, ETH_ALEN);
497 				memcpy(skb_push(sub_skb, ETH_ALEN), prxb->dst, ETH_ALEN);
498 			}
499 
500 			/* Indicate the packets to upper layer */
501 			if (sub_skb) {
502 				stats->rx_packets++;
503 				stats->rx_bytes += sub_skb->len;
504 
505 				memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
506 				sub_skb->protocol = eth_type_trans(sub_skb,
507 								   ieee->dev);
508 				sub_skb->dev = ieee->dev;
509 				sub_skb->dev->stats.rx_packets++;
510 				sub_skb->dev->stats.rx_bytes += sub_skb->len;
511 				/* 802.11 crc not sufficient */
512 				sub_skb->ip_summed = CHECKSUM_NONE;
513 				ieee->last_rx_ps_time = jiffies;
514 				netif_rx(sub_skb);
515 			}
516 		}
517 		kfree(prxb);
518 		prxb = NULL;
519 	}
520 }
521 
rtllib_FlushRxTsPendingPkts(struct rtllib_device * ieee,struct rx_ts_record * pTS)522 void rtllib_FlushRxTsPendingPkts(struct rtllib_device *ieee,
523 				 struct rx_ts_record *pTS)
524 {
525 	struct rx_reorder_entry *pRxReorderEntry;
526 	u8 RfdCnt = 0;
527 
528 	del_timer_sync(&pTS->rx_pkt_pending_timer);
529 	while (!list_empty(&pTS->rx_pending_pkt_list)) {
530 		if (RfdCnt >= REORDER_WIN_SIZE) {
531 			netdev_info(ieee->dev,
532 				    "-------------->%s() error! RfdCnt >= REORDER_WIN_SIZE\n",
533 				    __func__);
534 			break;
535 		}
536 
537 		pRxReorderEntry = (struct rx_reorder_entry *)
538 				  list_entry(pTS->rx_pending_pkt_list.prev,
539 					     struct rx_reorder_entry, List);
540 		netdev_dbg(ieee->dev, "%s(): Indicate SeqNum %d!\n", __func__,
541 			   pRxReorderEntry->SeqNum);
542 		list_del_init(&pRxReorderEntry->List);
543 
544 		ieee->RfdArray[RfdCnt] = pRxReorderEntry->prxb;
545 
546 		RfdCnt = RfdCnt + 1;
547 		list_add_tail(&pRxReorderEntry->List,
548 			      &ieee->RxReorder_Unused_List);
549 	}
550 	rtllib_indicate_packets(ieee, ieee->RfdArray, RfdCnt);
551 
552 	pTS->rx_indicate_seq = 0xffff;
553 }
554 
RxReorderIndicatePacket(struct rtllib_device * ieee,struct rtllib_rxb * prxb,struct rx_ts_record * pTS,u16 SeqNum)555 static void RxReorderIndicatePacket(struct rtllib_device *ieee,
556 				    struct rtllib_rxb *prxb,
557 				    struct rx_ts_record *pTS, u16 SeqNum)
558 {
559 	struct rt_hi_throughput *ht_info = ieee->ht_info;
560 	struct rx_reorder_entry *pReorderEntry = NULL;
561 	u8 WinSize = ht_info->rx_reorder_win_size;
562 	u16 WinEnd = 0;
563 	u8 index = 0;
564 	bool bMatchWinStart = false, bPktInBuf = false;
565 	unsigned long flags;
566 
567 	netdev_dbg(ieee->dev,
568 		   "%s(): Seq is %d, pTS->rx_indicate_seq is %d, WinSize is %d\n",
569 		   __func__, SeqNum, pTS->rx_indicate_seq, WinSize);
570 
571 	spin_lock_irqsave(&(ieee->reorder_spinlock), flags);
572 
573 	WinEnd = (pTS->rx_indicate_seq + WinSize - 1) % 4096;
574 	/* Rx Reorder initialize condition.*/
575 	if (pTS->rx_indicate_seq == 0xffff)
576 		pTS->rx_indicate_seq = SeqNum;
577 
578 	/* Drop out the packet which SeqNum is smaller than WinStart */
579 	if (SN_LESS(SeqNum, pTS->rx_indicate_seq)) {
580 		netdev_dbg(ieee->dev,
581 			   "Packet Drop! IndicateSeq: %d, NewSeq: %d\n",
582 			   pTS->rx_indicate_seq, SeqNum);
583 		ht_info->rx_reorder_drop_counter++;
584 		{
585 			int i;
586 
587 			for (i = 0; i < prxb->nr_subframes; i++)
588 				dev_kfree_skb(prxb->subframes[i]);
589 			kfree(prxb);
590 			prxb = NULL;
591 		}
592 		spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
593 		return;
594 	}
595 
596 	/* Sliding window manipulation. Conditions includes:
597 	 * 1. Incoming SeqNum is equal to WinStart =>Window shift 1
598 	 * 2. Incoming SeqNum is larger than the WinEnd => Window shift N
599 	 */
600 	if (SN_EQUAL(SeqNum, pTS->rx_indicate_seq)) {
601 		pTS->rx_indicate_seq = (pTS->rx_indicate_seq + 1) % 4096;
602 		bMatchWinStart = true;
603 	} else if (SN_LESS(WinEnd, SeqNum)) {
604 		if (SeqNum >= (WinSize - 1))
605 			pTS->rx_indicate_seq = SeqNum + 1 - WinSize;
606 		else
607 			pTS->rx_indicate_seq = 4095 -
608 					     (WinSize - (SeqNum + 1)) + 1;
609 		netdev_dbg(ieee->dev,
610 			   "Window Shift! IndicateSeq: %d, NewSeq: %d\n",
611 			   pTS->rx_indicate_seq, SeqNum);
612 	}
613 
614 	/* Indication process.
615 	 * After Packet dropping and Sliding Window shifting as above, we can
616 	 * now just indicate the packets with the SeqNum smaller than latest
617 	 * WinStart and struct buffer other packets.
618 	 *
619 	 * For Rx Reorder condition:
620 	 * 1. All packets with SeqNum smaller than WinStart => Indicate
621 	 * 2. All packets with SeqNum larger than or equal to
622 	 *	 WinStart => Buffer it.
623 	 */
624 	if (bMatchWinStart) {
625 		/* Current packet is going to be indicated.*/
626 		netdev_dbg(ieee->dev,
627 			   "Packets indication! IndicateSeq: %d, NewSeq: %d\n",
628 			   pTS->rx_indicate_seq, SeqNum);
629 		ieee->prxbIndicateArray[0] = prxb;
630 		index = 1;
631 	} else {
632 		/* Current packet is going to be inserted into pending list.*/
633 		if (!list_empty(&ieee->RxReorder_Unused_List)) {
634 			pReorderEntry = (struct rx_reorder_entry *)
635 					list_entry(ieee->RxReorder_Unused_List.next,
636 					struct rx_reorder_entry, List);
637 			list_del_init(&pReorderEntry->List);
638 
639 			/* Make a reorder entry and insert
640 			 * into a the packet list.
641 			 */
642 			pReorderEntry->SeqNum = SeqNum;
643 			pReorderEntry->prxb = prxb;
644 
645 			if (!AddReorderEntry(pTS, pReorderEntry)) {
646 				int i;
647 
648 				netdev_dbg(ieee->dev,
649 					   "%s(): Duplicate packet is dropped. IndicateSeq: %d, NewSeq: %d\n",
650 					   __func__, pTS->rx_indicate_seq,
651 					   SeqNum);
652 				list_add_tail(&pReorderEntry->List,
653 					      &ieee->RxReorder_Unused_List);
654 
655 				for (i = 0; i < prxb->nr_subframes; i++)
656 					dev_kfree_skb(prxb->subframes[i]);
657 				kfree(prxb);
658 				prxb = NULL;
659 			} else {
660 				netdev_dbg(ieee->dev,
661 					   "Pkt insert into struct buffer. IndicateSeq: %d, NewSeq: %d\n",
662 					   pTS->rx_indicate_seq, SeqNum);
663 			}
664 		} else {
665 			/* Packets are dropped if there are not enough reorder
666 			 * entries. This part should be modified!! We can just
667 			 * indicate all the packets in struct buffer and get
668 			 * reorder entries.
669 			 */
670 			netdev_err(ieee->dev,
671 				   "%s(): There is no reorder entry! Packet is dropped!\n",
672 				   __func__);
673 			{
674 				int i;
675 
676 				for (i = 0; i < prxb->nr_subframes; i++)
677 					dev_kfree_skb(prxb->subframes[i]);
678 				kfree(prxb);
679 				prxb = NULL;
680 			}
681 		}
682 	}
683 
684 	/* Check if there is any packet need indicate.*/
685 	while (!list_empty(&pTS->rx_pending_pkt_list)) {
686 		netdev_dbg(ieee->dev, "%s(): start RREORDER indicate\n",
687 			   __func__);
688 
689 		pReorderEntry = (struct rx_reorder_entry *)
690 					list_entry(pTS->rx_pending_pkt_list.prev,
691 						   struct rx_reorder_entry,
692 						   List);
693 		if (SN_LESS(pReorderEntry->SeqNum, pTS->rx_indicate_seq) ||
694 		    SN_EQUAL(pReorderEntry->SeqNum, pTS->rx_indicate_seq)) {
695 			/* This protect struct buffer from overflow. */
696 			if (index >= REORDER_WIN_SIZE) {
697 				netdev_err(ieee->dev,
698 					   "%s(): Buffer overflow!\n",
699 					   __func__);
700 				bPktInBuf = true;
701 				break;
702 			}
703 
704 			list_del_init(&pReorderEntry->List);
705 
706 			if (SN_EQUAL(pReorderEntry->SeqNum, pTS->rx_indicate_seq))
707 				pTS->rx_indicate_seq = (pTS->rx_indicate_seq + 1) %
708 						     4096;
709 
710 			ieee->prxbIndicateArray[index] = pReorderEntry->prxb;
711 			netdev_dbg(ieee->dev, "%s(): Indicate SeqNum %d!\n",
712 				   __func__, pReorderEntry->SeqNum);
713 			index++;
714 
715 			list_add_tail(&pReorderEntry->List,
716 				      &ieee->RxReorder_Unused_List);
717 		} else {
718 			bPktInBuf = true;
719 			break;
720 		}
721 	}
722 
723 	/* Handling pending timer. Set this timer to prevent from long time
724 	 * Rx buffering.
725 	 */
726 	if (index > 0) {
727 		if (timer_pending(&pTS->rx_pkt_pending_timer))
728 			del_timer_sync(&pTS->rx_pkt_pending_timer);
729 		pTS->rx_timeout_indicate_seq = 0xffff;
730 
731 		if (index > REORDER_WIN_SIZE) {
732 			netdev_err(ieee->dev,
733 				   "%s(): Rx Reorder struct buffer full!\n",
734 				   __func__);
735 			spin_unlock_irqrestore(&(ieee->reorder_spinlock),
736 					       flags);
737 			return;
738 		}
739 		rtllib_indicate_packets(ieee, ieee->prxbIndicateArray, index);
740 		bPktInBuf = false;
741 	}
742 
743 	if (bPktInBuf && pTS->rx_timeout_indicate_seq == 0xffff) {
744 		netdev_dbg(ieee->dev, "%s(): SET rx timeout timer\n", __func__);
745 		pTS->rx_timeout_indicate_seq = pTS->rx_indicate_seq;
746 		mod_timer(&pTS->rx_pkt_pending_timer, jiffies +
747 			  msecs_to_jiffies(ht_info->rx_reorder_pending_time));
748 	}
749 	spin_unlock_irqrestore(&(ieee->reorder_spinlock), flags);
750 }
751 
parse_subframe(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats,struct rtllib_rxb * rxb,u8 * src,u8 * dst)752 static u8 parse_subframe(struct rtllib_device *ieee, struct sk_buff *skb,
753 			 struct rtllib_rx_stats *rx_stats,
754 			 struct rtllib_rxb *rxb, u8 *src, u8 *dst)
755 {
756 	struct rtllib_hdr_3addr  *hdr = (struct rtllib_hdr_3addr *)skb->data;
757 	u16		fc = le16_to_cpu(hdr->frame_ctl);
758 
759 	u16		LLCOffset = sizeof(struct rtllib_hdr_3addr);
760 	u16		ChkLength;
761 	bool		bIsAggregateFrame = false;
762 	u16		nSubframe_Length;
763 	u8		nPadding_Length = 0;
764 	u16		SeqNum = 0;
765 	struct sk_buff *sub_skb;
766 	/* just for debug purpose */
767 	SeqNum = WLAN_GET_SEQ_SEQ(le16_to_cpu(hdr->seq_ctl));
768 	if ((RTLLIB_QOS_HAS_SEQ(fc)) &&
769 	   (((union frameqos *)(skb->data + RTLLIB_3ADDR_LEN))->field.reserved))
770 		bIsAggregateFrame = true;
771 
772 	if (RTLLIB_QOS_HAS_SEQ(fc))
773 		LLCOffset += 2;
774 	if (rx_stats->bContainHTC)
775 		LLCOffset += sHTCLng;
776 
777 	ChkLength = LLCOffset;
778 
779 	if (skb->len <= ChkLength)
780 		return 0;
781 
782 	skb_pull(skb, LLCOffset);
783 	ieee->bIsAggregateFrame = bIsAggregateFrame;
784 	if (!bIsAggregateFrame) {
785 		rxb->nr_subframes = 1;
786 
787 		/* altered by clark 3/30/2010
788 		 * The struct buffer size of the skb indicated to upper layer
789 		 * must be less than 5000, or the defraged IP datagram
790 		 * in the IP layer will exceed "ipfrag_high_tresh" and be
791 		 * discarded. so there must not use the function
792 		 * "skb_copy" and "skb_clone" for "skb".
793 		 */
794 
795 		/* Allocate new skb for releasing to upper layer */
796 		sub_skb = dev_alloc_skb(RTLLIB_SKBBUFFER_SIZE);
797 		if (!sub_skb)
798 			return 0;
799 		skb_reserve(sub_skb, 12);
800 		skb_put_data(sub_skb, skb->data, skb->len);
801 		sub_skb->dev = ieee->dev;
802 
803 		rxb->subframes[0] = sub_skb;
804 
805 		memcpy(rxb->src, src, ETH_ALEN);
806 		memcpy(rxb->dst, dst, ETH_ALEN);
807 		rxb->subframes[0]->dev = ieee->dev;
808 		return 1;
809 	}
810 
811 	rxb->nr_subframes = 0;
812 	memcpy(rxb->src, src, ETH_ALEN);
813 	memcpy(rxb->dst, dst, ETH_ALEN);
814 	while (skb->len > ETHERNET_HEADER_SIZE) {
815 		/* Offset 12 denote 2 mac address */
816 		nSubframe_Length = *((u16 *)(skb->data + 12));
817 		nSubframe_Length = (nSubframe_Length >> 8) +
818 				   (nSubframe_Length << 8);
819 
820 		if (skb->len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
821 			netdev_info(ieee->dev,
822 				    "%s: A-MSDU parse error!! pRfd->nTotalSubframe : %d\n",
823 				    __func__, rxb->nr_subframes);
824 			netdev_info(ieee->dev,
825 				    "%s: A-MSDU parse error!! Subframe Length: %d\n",
826 				    __func__, nSubframe_Length);
827 			netdev_info(ieee->dev,
828 				    "nRemain_Length is %d and nSubframe_Length is : %d\n",
829 				    skb->len, nSubframe_Length);
830 			netdev_info(ieee->dev,
831 				    "The Packet SeqNum is %d\n",
832 				    SeqNum);
833 			return 0;
834 		}
835 
836 		/* move the data point to data content */
837 		skb_pull(skb, ETHERNET_HEADER_SIZE);
838 
839 		/* altered by clark 3/30/2010
840 		 * The struct buffer size of the skb indicated to upper layer
841 		 * must be less than 5000, or the defraged IP datagram
842 		 * in the IP layer will exceed "ipfrag_high_tresh" and be
843 		 * discarded. so there must not use the function
844 		 * "skb_copy" and "skb_clone" for "skb".
845 		 */
846 
847 		/* Allocate new skb for releasing to upper layer */
848 		sub_skb = dev_alloc_skb(nSubframe_Length + 12);
849 		if (!sub_skb)
850 			return 0;
851 		skb_reserve(sub_skb, 12);
852 		skb_put_data(sub_skb, skb->data, nSubframe_Length);
853 
854 		sub_skb->dev = ieee->dev;
855 		rxb->subframes[rxb->nr_subframes++] = sub_skb;
856 		if (rxb->nr_subframes >= MAX_SUBFRAME_COUNT) {
857 			netdev_dbg(ieee->dev,
858 				   "ParseSubframe(): Too many Subframes! Packets dropped!\n");
859 			break;
860 		}
861 		skb_pull(skb, nSubframe_Length);
862 
863 		if (skb->len != 0) {
864 			nPadding_Length = 4 - ((nSubframe_Length +
865 					  ETHERNET_HEADER_SIZE) % 4);
866 			if (nPadding_Length == 4)
867 				nPadding_Length = 0;
868 
869 			if (skb->len < nPadding_Length)
870 				return 0;
871 
872 			skb_pull(skb, nPadding_Length);
873 		}
874 	}
875 
876 	return rxb->nr_subframes;
877 }
878 
rtllib_rx_get_hdrlen(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats)879 static size_t rtllib_rx_get_hdrlen(struct rtllib_device *ieee,
880 				   struct sk_buff *skb,
881 				   struct rtllib_rx_stats *rx_stats)
882 {
883 	struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
884 	u16 fc = le16_to_cpu(hdr->frame_ctl);
885 	size_t hdrlen;
886 
887 	hdrlen = rtllib_get_hdrlen(fc);
888 	if (HTCCheck(ieee, skb->data)) {
889 		if (net_ratelimit())
890 			netdev_info(ieee->dev, "%s: find HTCControl!\n",
891 				    __func__);
892 		hdrlen += 4;
893 		rx_stats->bContainHTC = true;
894 	}
895 
896 	if (RTLLIB_QOS_HAS_SEQ(fc))
897 		rx_stats->bIsQosData = true;
898 
899 	return hdrlen;
900 }
901 
rtllib_rx_check_duplicate(struct rtllib_device * ieee,struct sk_buff * skb,u8 multicast)902 static int rtllib_rx_check_duplicate(struct rtllib_device *ieee,
903 				     struct sk_buff *skb, u8 multicast)
904 {
905 	struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
906 	u16 fc, sc;
907 	u8 frag, type, stype;
908 
909 	fc = le16_to_cpu(hdr->frame_ctl);
910 	type = WLAN_FC_GET_TYPE(fc);
911 	stype = WLAN_FC_GET_STYPE(fc);
912 	sc = le16_to_cpu(hdr->seq_ctl);
913 	frag = WLAN_GET_SEQ_FRAG(sc);
914 
915 	if (!ieee->ht_info->cur_rx_reorder_enable ||
916 		!ieee->current_network.qos_data.active ||
917 		!IsDataFrame(skb->data) ||
918 		IsLegacyDataFrame(skb->data)) {
919 		if (!((type == RTLLIB_FTYPE_MGMT) &&
920 		      (stype == RTLLIB_STYPE_BEACON))) {
921 			if (is_duplicate_packet(ieee, hdr))
922 				return -1;
923 		}
924 	} else {
925 		struct rx_ts_record *pRxTS = NULL;
926 
927 		if (GetTs(ieee, (struct ts_common_info **)&pRxTS, hdr->addr2,
928 			(u8)Frame_QoSTID((u8 *)(skb->data)), RX_DIR, true)) {
929 			if ((fc & (1 << 11)) && (frag == pRxTS->rx_last_frag_num) &&
930 			    (WLAN_GET_SEQ_SEQ(sc) == pRxTS->rx_last_seq_num))
931 				return -1;
932 			pRxTS->rx_last_frag_num = frag;
933 			pRxTS->rx_last_seq_num = WLAN_GET_SEQ_SEQ(sc);
934 		} else {
935 			netdev_warn(ieee->dev, "%s(): No TS! Skip the check!\n",
936 				    __func__);
937 			return -1;
938 		}
939 	}
940 
941 	return 0;
942 }
943 
rtllib_rx_extract_addr(struct rtllib_device * ieee,struct rtllib_hdr_4addr * hdr,u8 * dst,u8 * src,u8 * bssid)944 static void rtllib_rx_extract_addr(struct rtllib_device *ieee,
945 				   struct rtllib_hdr_4addr *hdr, u8 *dst,
946 				   u8 *src, u8 *bssid)
947 {
948 	u16 fc = le16_to_cpu(hdr->frame_ctl);
949 
950 	switch (fc & (RTLLIB_FCTL_FROMDS | RTLLIB_FCTL_TODS)) {
951 	case RTLLIB_FCTL_FROMDS:
952 		ether_addr_copy(dst, hdr->addr1);
953 		ether_addr_copy(src, hdr->addr3);
954 		ether_addr_copy(bssid, hdr->addr2);
955 		break;
956 	case RTLLIB_FCTL_TODS:
957 		ether_addr_copy(dst, hdr->addr3);
958 		ether_addr_copy(src, hdr->addr2);
959 		ether_addr_copy(bssid, hdr->addr1);
960 		break;
961 	case RTLLIB_FCTL_FROMDS | RTLLIB_FCTL_TODS:
962 		ether_addr_copy(dst, hdr->addr3);
963 		ether_addr_copy(src, hdr->addr4);
964 		ether_addr_copy(bssid, ieee->current_network.bssid);
965 		break;
966 	default:
967 		ether_addr_copy(dst, hdr->addr1);
968 		ether_addr_copy(src, hdr->addr2);
969 		ether_addr_copy(bssid, hdr->addr3);
970 		break;
971 	}
972 }
973 
rtllib_rx_data_filter(struct rtllib_device * ieee,u16 fc,u8 * dst,u8 * src,u8 * bssid,u8 * addr2)974 static int rtllib_rx_data_filter(struct rtllib_device *ieee, u16 fc,
975 				 u8 *dst, u8 *src, u8 *bssid, u8 *addr2)
976 {
977 	u8 type, stype;
978 
979 	type = WLAN_FC_GET_TYPE(fc);
980 	stype = WLAN_FC_GET_STYPE(fc);
981 
982 	/* Filter frames from different BSS */
983 	if (((fc & RTLLIB_FCTL_DSTODS) != RTLLIB_FCTL_DSTODS) &&
984 	    !ether_addr_equal(ieee->current_network.bssid, bssid) &&
985 	    !is_zero_ether_addr(ieee->current_network.bssid)) {
986 		return -1;
987 	}
988 
989 	/* Filter packets sent by an STA that will be forwarded by AP */
990 	if (ieee->intel_promiscuous_md_info.promiscuous_on  &&
991 		ieee->intel_promiscuous_md_info.fltr_src_sta_frame) {
992 		if ((fc & RTLLIB_FCTL_TODS) && !(fc & RTLLIB_FCTL_FROMDS) &&
993 		    !ether_addr_equal(dst, ieee->current_network.bssid) &&
994 		    ether_addr_equal(bssid, ieee->current_network.bssid)) {
995 			return -1;
996 		}
997 	}
998 
999 	/* Nullfunc frames may have PS-bit set, so they must be passed to
1000 	 * hostap_handle_sta_rx() before being dropped here.
1001 	 */
1002 	if (!ieee->intel_promiscuous_md_info.promiscuous_on) {
1003 		if (stype != RTLLIB_STYPE_DATA &&
1004 		    stype != RTLLIB_STYPE_DATA_CFACK &&
1005 		    stype != RTLLIB_STYPE_DATA_CFPOLL &&
1006 		    stype != RTLLIB_STYPE_DATA_CFACKPOLL &&
1007 		    stype != RTLLIB_STYPE_QOS_DATA) {
1008 			if (stype != RTLLIB_STYPE_NULLFUNC)
1009 				netdev_dbg(ieee->dev,
1010 					   "RX: dropped data frame with no data (type=0x%02x, subtype=0x%02x)\n",
1011 					   type, stype);
1012 			return -1;
1013 		}
1014 	}
1015 
1016 	/* packets from our adapter are dropped (echo) */
1017 	if (!memcmp(src, ieee->dev->dev_addr, ETH_ALEN))
1018 		return -1;
1019 
1020 	/* {broad,multi}cast packets to our BSS go through */
1021 	if (is_multicast_ether_addr(dst)) {
1022 		if (memcmp(bssid, ieee->current_network.bssid,
1023 			   ETH_ALEN))
1024 			return -1;
1025 	}
1026 	return 0;
1027 }
1028 
rtllib_rx_get_crypt(struct rtllib_device * ieee,struct sk_buff * skb,struct lib80211_crypt_data ** crypt,size_t hdrlen)1029 static int rtllib_rx_get_crypt(struct rtllib_device *ieee, struct sk_buff *skb,
1030 			struct lib80211_crypt_data **crypt, size_t hdrlen)
1031 {
1032 	struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
1033 	u16 fc = le16_to_cpu(hdr->frame_ctl);
1034 	int idx = 0;
1035 
1036 	if (skb->len >= hdrlen + 3)
1037 		idx = skb->data[hdrlen + 3] >> 6;
1038 
1039 	*crypt = ieee->crypt_info.crypt[idx];
1040 	/* allow NULL decrypt to indicate an station specific override
1041 	 * for default encryption
1042 	 */
1043 	if (*crypt && ((*crypt)->ops == NULL ||
1044 		      (*crypt)->ops->decrypt_mpdu == NULL))
1045 		*crypt = NULL;
1046 
1047 	if (!*crypt && (fc & RTLLIB_FCTL_WEP)) {
1048 		/* This seems to be triggered by some (multicast?)
1049 		 * frames from other than current BSS, so just drop the
1050 		 * frames silently instead of filling system log with
1051 		 * these reports.
1052 		 */
1053 		netdev_dbg(ieee->dev,
1054 			   "Decryption failed (not set) (SA= %pM)\n",
1055 			   hdr->addr2);
1056 		return -1;
1057 	}
1058 
1059 	return 0;
1060 }
1061 
rtllib_rx_decrypt(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats,struct lib80211_crypt_data * crypt,size_t hdrlen)1062 static int rtllib_rx_decrypt(struct rtllib_device *ieee, struct sk_buff *skb,
1063 		      struct rtllib_rx_stats *rx_stats,
1064 		      struct lib80211_crypt_data *crypt, size_t hdrlen)
1065 {
1066 	struct rtllib_hdr_4addr *hdr;
1067 	int keyidx = 0;
1068 	u16 fc, sc;
1069 	u8 frag;
1070 
1071 	hdr = (struct rtllib_hdr_4addr *)skb->data;
1072 	fc = le16_to_cpu(hdr->frame_ctl);
1073 	sc = le16_to_cpu(hdr->seq_ctl);
1074 	frag = WLAN_GET_SEQ_FRAG(sc);
1075 
1076 	if ((!rx_stats->Decrypted))
1077 		ieee->need_sw_enc = 1;
1078 	else
1079 		ieee->need_sw_enc = 0;
1080 
1081 	keyidx = rtllib_rx_frame_decrypt(ieee, skb, crypt);
1082 	if ((fc & RTLLIB_FCTL_WEP) && (keyidx < 0)) {
1083 		netdev_info(ieee->dev, "%s: decrypt frame error\n", __func__);
1084 		return -1;
1085 	}
1086 
1087 	hdr = (struct rtllib_hdr_4addr *)skb->data;
1088 	if ((frag != 0 || (fc & RTLLIB_FCTL_MOREFRAGS))) {
1089 		int flen;
1090 		struct sk_buff *frag_skb = rtllib_frag_cache_get(ieee, hdr);
1091 
1092 		netdev_dbg(ieee->dev, "Rx Fragment received (%u)\n", frag);
1093 
1094 		if (!frag_skb) {
1095 			netdev_dbg(ieee->dev,
1096 				   "Rx cannot get skb from fragment cache (morefrag=%d seq=%u frag=%u)\n",
1097 				   (fc & RTLLIB_FCTL_MOREFRAGS) != 0,
1098 				   WLAN_GET_SEQ_SEQ(sc), frag);
1099 			return -1;
1100 		}
1101 		flen = skb->len;
1102 		if (frag != 0)
1103 			flen -= hdrlen;
1104 
1105 		if (frag_skb->tail + flen > frag_skb->end) {
1106 			netdev_warn(ieee->dev,
1107 				    "%s: host decrypted and reassembled frame did not fit skb\n",
1108 				    __func__);
1109 			rtllib_frag_cache_invalidate(ieee, hdr);
1110 			return -1;
1111 		}
1112 
1113 		if (frag == 0) {
1114 			/* copy first fragment (including full headers) into
1115 			 * beginning of the fragment cache skb
1116 			 */
1117 			skb_put_data(frag_skb, skb->data, flen);
1118 		} else {
1119 			/* append frame payload to the end of the fragment
1120 			 * cache skb
1121 			 */
1122 			skb_put_data(frag_skb, skb->data + hdrlen, flen);
1123 		}
1124 		dev_kfree_skb_any(skb);
1125 		skb = NULL;
1126 
1127 		if (fc & RTLLIB_FCTL_MOREFRAGS) {
1128 			/* more fragments expected - leave the skb in fragment
1129 			 * cache for now; it will be delivered to upper layers
1130 			 * after all fragments have been received
1131 			 */
1132 			return -2;
1133 		}
1134 
1135 		/* this was the last fragment and the frame will be
1136 		 * delivered, so remove skb from fragment cache
1137 		 */
1138 		skb = frag_skb;
1139 		hdr = (struct rtllib_hdr_4addr *)skb->data;
1140 		rtllib_frag_cache_invalidate(ieee, hdr);
1141 	}
1142 
1143 	/* skb: hdr + (possible reassembled) full MSDU payload; possibly still
1144 	 * encrypted/authenticated
1145 	 */
1146 	if ((fc & RTLLIB_FCTL_WEP) &&
1147 		rtllib_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt)) {
1148 		netdev_info(ieee->dev, "%s: ==>decrypt msdu error\n", __func__);
1149 		return -1;
1150 	}
1151 
1152 	hdr = (struct rtllib_hdr_4addr *)skb->data;
1153 	if (crypt && !(fc & RTLLIB_FCTL_WEP) && !ieee->open_wep) {
1154 		if (/*ieee->ieee802_1x &&*/
1155 		    rtllib_is_eapol_frame(ieee, skb, hdrlen)) {
1156 			/* pass unencrypted EAPOL frames even if encryption is
1157 			 * configured
1158 			 */
1159 			struct eapol *eap = (struct eapol *)(skb->data +
1160 				24);
1161 			netdev_dbg(ieee->dev,
1162 				   "RX: IEEE 802.1X EAPOL frame: %s\n",
1163 				   eap_get_type(eap->type));
1164 		} else {
1165 			netdev_dbg(ieee->dev,
1166 				   "encryption configured, but RX frame not encrypted (SA= %pM)\n",
1167 				   hdr->addr2);
1168 			return -1;
1169 		}
1170 	}
1171 
1172 	if (crypt && !(fc & RTLLIB_FCTL_WEP) &&
1173 	    rtllib_is_eapol_frame(ieee, skb, hdrlen)) {
1174 		struct eapol *eap = (struct eapol *)(skb->data + 24);
1175 
1176 		netdev_dbg(ieee->dev, "RX: IEEE 802.1X EAPOL frame: %s\n",
1177 			   eap_get_type(eap->type));
1178 	}
1179 
1180 	if (crypt && !(fc & RTLLIB_FCTL_WEP) && !ieee->open_wep &&
1181 	    !rtllib_is_eapol_frame(ieee, skb, hdrlen)) {
1182 		netdev_dbg(ieee->dev,
1183 			   "dropped unencrypted RX data frame from %pM (drop_unencrypted=1)\n",
1184 			   hdr->addr2);
1185 		return -1;
1186 	}
1187 
1188 	return 0;
1189 }
1190 
rtllib_rx_check_leave_lps(struct rtllib_device * ieee,u8 unicast,u8 nr_subframes)1191 static void rtllib_rx_check_leave_lps(struct rtllib_device *ieee, u8 unicast,
1192 				      u8 nr_subframes)
1193 {
1194 	if (unicast) {
1195 		if (ieee->link_state == MAC80211_LINKED) {
1196 			if (((ieee->link_detect_info.NumRxUnicastOkInPeriod +
1197 			    ieee->link_detect_info.NumTxOkInPeriod) > 8) ||
1198 			    (ieee->link_detect_info.NumRxUnicastOkInPeriod > 2)) {
1199 				ieee->leisure_ps_leave(ieee->dev);
1200 			}
1201 		}
1202 	}
1203 	ieee->last_rx_ps_time = jiffies;
1204 }
1205 
rtllib_rx_indicate_pkt_legacy(struct rtllib_device * ieee,struct rtllib_rx_stats * rx_stats,struct rtllib_rxb * rxb,u8 * dst,u8 * src)1206 static void rtllib_rx_indicate_pkt_legacy(struct rtllib_device *ieee,
1207 		struct rtllib_rx_stats *rx_stats,
1208 		struct rtllib_rxb *rxb,
1209 		u8 *dst,
1210 		u8 *src)
1211 {
1212 	struct net_device *dev = ieee->dev;
1213 	u16 ethertype;
1214 	int i = 0;
1215 
1216 	if (rxb == NULL) {
1217 		netdev_info(dev, "%s: rxb is NULL!!\n", __func__);
1218 		return;
1219 	}
1220 
1221 	for (i = 0; i < rxb->nr_subframes; i++) {
1222 		struct sk_buff *sub_skb = rxb->subframes[i];
1223 
1224 		if (sub_skb) {
1225 			/* convert hdr + possible LLC headers
1226 			 * into Ethernet header
1227 			 */
1228 			ethertype = (sub_skb->data[6] << 8) | sub_skb->data[7];
1229 			if (sub_skb->len >= 8 &&
1230 				((memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) == 0 &&
1231 				ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1232 				memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE) == 0)) {
1233 				/* remove RFC1042 or Bridge-Tunnel encapsulation
1234 				 * and replace EtherType
1235 				 */
1236 				skb_pull(sub_skb, SNAP_SIZE);
1237 				ether_addr_copy(skb_push(sub_skb, ETH_ALEN),
1238 						src);
1239 				ether_addr_copy(skb_push(sub_skb, ETH_ALEN),
1240 						dst);
1241 			} else {
1242 				u16 len;
1243 				/* Leave Ethernet header part of hdr
1244 				 * and full payload
1245 				 */
1246 				len = sub_skb->len;
1247 				memcpy(skb_push(sub_skb, 2), &len, 2);
1248 				ether_addr_copy(skb_push(sub_skb, ETH_ALEN),
1249 						src);
1250 				ether_addr_copy(skb_push(sub_skb, ETH_ALEN),
1251 						dst);
1252 			}
1253 
1254 			ieee->stats.rx_packets++;
1255 			ieee->stats.rx_bytes += sub_skb->len;
1256 
1257 			if (is_multicast_ether_addr(dst))
1258 				ieee->stats.multicast++;
1259 
1260 			/* Indicate the packets to upper layer */
1261 			memset(sub_skb->cb, 0, sizeof(sub_skb->cb));
1262 			sub_skb->protocol = eth_type_trans(sub_skb, dev);
1263 			sub_skb->dev = dev;
1264 			sub_skb->dev->stats.rx_packets++;
1265 			sub_skb->dev->stats.rx_bytes += sub_skb->len;
1266 			/* 802.11 crc not sufficient */
1267 			sub_skb->ip_summed = CHECKSUM_NONE;
1268 			netif_rx(sub_skb);
1269 		}
1270 	}
1271 	kfree(rxb);
1272 }
1273 
rtllib_rx_InfraAdhoc(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats)1274 static int rtllib_rx_InfraAdhoc(struct rtllib_device *ieee, struct sk_buff *skb,
1275 		 struct rtllib_rx_stats *rx_stats)
1276 {
1277 	struct net_device *dev = ieee->dev;
1278 	struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
1279 	struct lib80211_crypt_data *crypt = NULL;
1280 	struct rtllib_rxb *rxb = NULL;
1281 	struct rx_ts_record *pTS = NULL;
1282 	u16 fc, sc, SeqNum = 0;
1283 	u8 type, stype, multicast = 0, unicast = 0, nr_subframes = 0, TID = 0;
1284 	u8 dst[ETH_ALEN];
1285 	u8 src[ETH_ALEN];
1286 	u8 bssid[ETH_ALEN] = {0};
1287 
1288 	size_t hdrlen = 0;
1289 	bool bToOtherSTA = false;
1290 	int ret = 0, i = 0;
1291 
1292 	fc = le16_to_cpu(hdr->frame_ctl);
1293 	type = WLAN_FC_GET_TYPE(fc);
1294 	stype = WLAN_FC_GET_STYPE(fc);
1295 	sc = le16_to_cpu(hdr->seq_ctl);
1296 
1297 	/*Filter pkt not to me*/
1298 	multicast = is_multicast_ether_addr(hdr->addr1);
1299 	unicast = !multicast;
1300 	if (unicast && !ether_addr_equal(dev->dev_addr, hdr->addr1)) {
1301 		if (ieee->net_promiscuous_md)
1302 			bToOtherSTA = true;
1303 		else
1304 			goto rx_dropped;
1305 	}
1306 
1307 	/*Filter pkt has too small length */
1308 	hdrlen = rtllib_rx_get_hdrlen(ieee, skb, rx_stats);
1309 	if (skb->len < hdrlen) {
1310 		netdev_info(dev,
1311 			    "%s():ERR!!! skb->len is smaller than hdrlen\n",
1312 			    __func__);
1313 		goto rx_dropped;
1314 	}
1315 
1316 	/* Filter Duplicate pkt */
1317 	ret = rtllib_rx_check_duplicate(ieee, skb, multicast);
1318 	if (ret < 0)
1319 		goto rx_dropped;
1320 
1321 	/* Filter CTRL Frame */
1322 	if (type == RTLLIB_FTYPE_CTL)
1323 		goto rx_dropped;
1324 
1325 	/* Filter MGNT Frame */
1326 	if (type == RTLLIB_FTYPE_MGMT) {
1327 		if (bToOtherSTA)
1328 			goto rx_dropped;
1329 		if (rtllib_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
1330 			goto rx_dropped;
1331 		else
1332 			goto rx_exit;
1333 	}
1334 
1335 	/* Filter WAPI DATA Frame */
1336 
1337 	/* Update statstics for AP roaming */
1338 	if (!bToOtherSTA) {
1339 		ieee->link_detect_info.NumRecvDataInPeriod++;
1340 		ieee->link_detect_info.NumRxOkInPeriod++;
1341 	}
1342 
1343 	/* Data frame - extract src/dst addresses */
1344 	rtllib_rx_extract_addr(ieee, hdr, dst, src, bssid);
1345 
1346 	/* Filter Data frames */
1347 	ret = rtllib_rx_data_filter(ieee, fc, dst, src, bssid, hdr->addr2);
1348 	if (ret < 0)
1349 		goto rx_dropped;
1350 
1351 	if (skb->len == hdrlen)
1352 		goto rx_dropped;
1353 
1354 	/* Send pspoll based on moredata */
1355 	if ((ieee->iw_mode == IW_MODE_INFRA)  &&
1356 	    (ieee->sta_sleep == LPS_IS_SLEEP) &&
1357 	    (ieee->polling) && (!bToOtherSTA)) {
1358 		if (WLAN_FC_MORE_DATA(fc)) {
1359 			/* more data bit is set, let's request a new frame
1360 			 * from the AP
1361 			 */
1362 			rtllib_sta_ps_send_pspoll_frame(ieee);
1363 		} else {
1364 			ieee->polling =  false;
1365 		}
1366 	}
1367 
1368 	/* Get crypt if encrypted */
1369 	ret = rtllib_rx_get_crypt(ieee, skb, &crypt, hdrlen);
1370 	if (ret == -1)
1371 		goto rx_dropped;
1372 
1373 	/* Decrypt data frame (including reassemble) */
1374 	ret = rtllib_rx_decrypt(ieee, skb, rx_stats, crypt, hdrlen);
1375 	if (ret == -1)
1376 		goto rx_dropped;
1377 	else if (ret == -2)
1378 		goto rx_exit;
1379 
1380 	/* Get TS for Rx Reorder  */
1381 	hdr = (struct rtllib_hdr_4addr *)skb->data;
1382 	if (ieee->current_network.qos_data.active && IsQoSDataFrame(skb->data)
1383 		&& !is_multicast_ether_addr(hdr->addr1)
1384 		&& (!bToOtherSTA)) {
1385 		TID = Frame_QoSTID(skb->data);
1386 		SeqNum = WLAN_GET_SEQ_SEQ(sc);
1387 		GetTs(ieee, (struct ts_common_info **)&pTS, hdr->addr2, TID,
1388 		      RX_DIR, true);
1389 		if (TID != 0 && TID != 3)
1390 			ieee->bis_any_nonbepkts = true;
1391 	}
1392 
1393 	/* Parse rx data frame (For AMSDU) */
1394 	/* skb: hdr + (possible reassembled) full plaintext payload */
1395 	rxb = kmalloc(sizeof(struct rtllib_rxb), GFP_ATOMIC);
1396 	if (!rxb)
1397 		goto rx_dropped;
1398 
1399 	/* to parse amsdu packets */
1400 	/* qos data packets & reserved bit is 1 */
1401 	if (parse_subframe(ieee, skb, rx_stats, rxb, src, dst) == 0) {
1402 		/* only to free rxb, and not submit the packets
1403 		 * to upper layer
1404 		 */
1405 		for (i = 0; i < rxb->nr_subframes; i++)
1406 			dev_kfree_skb(rxb->subframes[i]);
1407 		kfree(rxb);
1408 		rxb = NULL;
1409 		goto rx_dropped;
1410 	}
1411 
1412 	/* Update WAPI PN */
1413 
1414 	/* Check if leave LPS */
1415 	if (!bToOtherSTA) {
1416 		if (ieee->bIsAggregateFrame)
1417 			nr_subframes = rxb->nr_subframes;
1418 		else
1419 			nr_subframes = 1;
1420 		if (unicast)
1421 			ieee->link_detect_info.NumRxUnicastOkInPeriod += nr_subframes;
1422 		rtllib_rx_check_leave_lps(ieee, unicast, nr_subframes);
1423 	}
1424 
1425 	/* Indicate packets to upper layer or Rx Reorder */
1426 	if (!ieee->ht_info->cur_rx_reorder_enable || pTS == NULL || bToOtherSTA)
1427 		rtllib_rx_indicate_pkt_legacy(ieee, rx_stats, rxb, dst, src);
1428 	else
1429 		RxReorderIndicatePacket(ieee, rxb, pTS, SeqNum);
1430 
1431 	dev_kfree_skb(skb);
1432 
1433  rx_exit:
1434 	return 1;
1435 
1436  rx_dropped:
1437 	ieee->stats.rx_dropped++;
1438 
1439 	/* Returning 0 indicates to caller that we have not handled the SKB--
1440 	 * so it is still allocated and can be used again by underlying
1441 	 * hardware as a DMA target
1442 	 */
1443 	return 0;
1444 }
1445 
rtllib_rx_Monitor(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats)1446 static int rtllib_rx_Monitor(struct rtllib_device *ieee, struct sk_buff *skb,
1447 		 struct rtllib_rx_stats *rx_stats)
1448 {
1449 	struct rtllib_hdr_4addr *hdr = (struct rtllib_hdr_4addr *)skb->data;
1450 	u16 fc = le16_to_cpu(hdr->frame_ctl);
1451 	size_t hdrlen = rtllib_get_hdrlen(fc);
1452 
1453 	if (skb->len < hdrlen) {
1454 		netdev_info(ieee->dev,
1455 			    "%s():ERR!!! skb->len is smaller than hdrlen\n",
1456 			    __func__);
1457 		return 0;
1458 	}
1459 
1460 	if (HTCCheck(ieee, skb->data)) {
1461 		if (net_ratelimit())
1462 			netdev_info(ieee->dev, "%s: Find HTCControl!\n",
1463 				    __func__);
1464 		hdrlen += 4;
1465 	}
1466 
1467 	ieee->stats.rx_packets++;
1468 	ieee->stats.rx_bytes += skb->len;
1469 	rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen);
1470 
1471 	return 1;
1472 }
1473 
1474 /* All received frames are sent to this function. @skb contains the frame in
1475  * IEEE 802.11 format, i.e., in the format it was sent over air.
1476  * This function is called only as a tasklet (software IRQ).
1477  */
rtllib_rx(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * rx_stats)1478 int rtllib_rx(struct rtllib_device *ieee, struct sk_buff *skb,
1479 		 struct rtllib_rx_stats *rx_stats)
1480 {
1481 	int ret = 0;
1482 
1483 	if (!ieee || !skb || !rx_stats) {
1484 		pr_info("%s: Input parameters NULL!\n", __func__);
1485 		goto rx_dropped;
1486 	}
1487 	if (skb->len < 10) {
1488 		netdev_info(ieee->dev, "%s: SKB length < 10\n", __func__);
1489 		goto rx_dropped;
1490 	}
1491 
1492 	switch (ieee->iw_mode) {
1493 	case IW_MODE_ADHOC:
1494 	case IW_MODE_INFRA:
1495 		ret = rtllib_rx_InfraAdhoc(ieee, skb, rx_stats);
1496 		break;
1497 	case IW_MODE_MONITOR:
1498 		ret = rtllib_rx_Monitor(ieee, skb, rx_stats);
1499 		break;
1500 	default:
1501 		netdev_info(ieee->dev, "%s: ERR iw mode!!!\n", __func__);
1502 		break;
1503 	}
1504 
1505 	return ret;
1506 
1507  rx_dropped:
1508 	if (ieee)
1509 		ieee->stats.rx_dropped++;
1510 	return 0;
1511 }
1512 EXPORT_SYMBOL(rtllib_rx);
1513 
1514 static u8 qos_oui[QOS_OUI_LEN] = { 0x00, 0x50, 0xF2 };
1515 
1516 /* Make ther structure we read from the beacon packet has the right values */
rtllib_verify_qos_info(struct rtllib_qos_information_element * info_element,int sub_type)1517 static int rtllib_verify_qos_info(struct rtllib_qos_information_element
1518 				     *info_element, int sub_type)
1519 {
1520 	if (info_element->elementID != QOS_ELEMENT_ID)
1521 		return -1;
1522 	if (info_element->qui_subtype != sub_type)
1523 		return -1;
1524 	if (memcmp(info_element->qui, qos_oui, QOS_OUI_LEN))
1525 		return -1;
1526 	if (info_element->qui_type != QOS_OUI_TYPE)
1527 		return -1;
1528 	if (info_element->version != QOS_VERSION_1)
1529 		return -1;
1530 
1531 	return 0;
1532 }
1533 
1534 /* Parse a QoS parameter element */
rtllib_read_qos_param_element(struct rtllib_qos_parameter_info * element_param,struct rtllib_info_element * info_element)1535 static int rtllib_read_qos_param_element(
1536 			struct rtllib_qos_parameter_info *element_param,
1537 			struct rtllib_info_element *info_element)
1538 {
1539 	size_t size = sizeof(*element_param);
1540 
1541 	if (!element_param || !info_element || info_element->len != size - 2)
1542 		return -1;
1543 
1544 	memcpy(element_param, info_element, size);
1545 	return rtllib_verify_qos_info(&element_param->info_element,
1546 				      QOS_OUI_PARAM_SUB_TYPE);
1547 }
1548 
1549 /* Parse a QoS information element */
rtllib_read_qos_info_element(struct rtllib_qos_information_element * element_info,struct rtllib_info_element * info_element)1550 static int rtllib_read_qos_info_element(
1551 			struct rtllib_qos_information_element *element_info,
1552 			struct rtllib_info_element *info_element)
1553 {
1554 	size_t size = sizeof(*element_info);
1555 
1556 	if (!element_info || !info_element || info_element->len != size - 2)
1557 		return -1;
1558 
1559 	memcpy(element_info, info_element, size);
1560 	return rtllib_verify_qos_info(element_info, QOS_OUI_INFO_SUB_TYPE);
1561 }
1562 
1563 /* Write QoS parameters from the ac parameters. */
rtllib_qos_convert_ac_to_parameters(struct rtllib_qos_parameter_info * param_elm,struct rtllib_qos_data * qos_data)1564 static int rtllib_qos_convert_ac_to_parameters(struct rtllib_qos_parameter_info *param_elm,
1565 					       struct rtllib_qos_data *qos_data)
1566 {
1567 	struct rtllib_qos_ac_parameter *ac_params;
1568 	struct rtllib_qos_parameters *qos_param = &(qos_data->parameters);
1569 	int i;
1570 	u8 aci;
1571 	u8 acm;
1572 
1573 	qos_data->wmm_acm = 0;
1574 	for (i = 0; i < QOS_QUEUE_NUM; i++) {
1575 		ac_params = &(param_elm->ac_params_record[i]);
1576 
1577 		aci = (ac_params->aci_aifsn & 0x60) >> 5;
1578 		acm = (ac_params->aci_aifsn & 0x10) >> 4;
1579 
1580 		if (aci >= QOS_QUEUE_NUM)
1581 			continue;
1582 		switch (aci) {
1583 		case 1:
1584 			/* BIT(0) | BIT(3) */
1585 			if (acm)
1586 				qos_data->wmm_acm |= (0x01 << 0) | (0x01 << 3);
1587 			break;
1588 		case 2:
1589 			/* BIT(4) | BIT(5) */
1590 			if (acm)
1591 				qos_data->wmm_acm |= (0x01 << 4) | (0x01 << 5);
1592 			break;
1593 		case 3:
1594 			/* BIT(6) | BIT(7) */
1595 			if (acm)
1596 				qos_data->wmm_acm |= (0x01 << 6) | (0x01 << 7);
1597 			break;
1598 		case 0:
1599 		default:
1600 			/* BIT(1) | BIT(2) */
1601 			if (acm)
1602 				qos_data->wmm_acm |= (0x01 << 1) | (0x01 << 2);
1603 			break;
1604 		}
1605 
1606 		qos_param->aifs[aci] = (ac_params->aci_aifsn) & 0x0f;
1607 
1608 		/* WMM spec P.11: The minimum value for AIFSN shall be 2 */
1609 		qos_param->aifs[aci] = max_t(u8, qos_param->aifs[aci], 2);
1610 
1611 		qos_param->cw_min[aci] = cpu_to_le16(ac_params->ecw_min_max &
1612 						     0x0F);
1613 
1614 		qos_param->cw_max[aci] = cpu_to_le16((ac_params->ecw_min_max &
1615 						      0xF0) >> 4);
1616 
1617 		qos_param->flag[aci] =
1618 		    (ac_params->aci_aifsn & 0x10) ? 0x01 : 0x00;
1619 		qos_param->tx_op_limit[aci] = ac_params->tx_op_limit;
1620 	}
1621 	return 0;
1622 }
1623 
1624 /* we have a generic data element which it may contain QoS information or
1625  * parameters element. check the information element length to decide
1626  * which type to read
1627  */
rtllib_parse_qos_info_param_IE(struct rtllib_device * ieee,struct rtllib_info_element * info_element,struct rtllib_network * network)1628 static int rtllib_parse_qos_info_param_IE(struct rtllib_device *ieee,
1629 					  struct rtllib_info_element
1630 					     *info_element,
1631 					  struct rtllib_network *network)
1632 {
1633 	int rc = 0;
1634 	struct rtllib_qos_information_element qos_info_element;
1635 
1636 	rc = rtllib_read_qos_info_element(&qos_info_element, info_element);
1637 
1638 	if (rc == 0) {
1639 		network->qos_data.param_count = qos_info_element.ac_info & 0x0F;
1640 		network->flags |= NETWORK_HAS_QOS_INFORMATION;
1641 	} else {
1642 		struct rtllib_qos_parameter_info param_element;
1643 
1644 		rc = rtllib_read_qos_param_element(&param_element,
1645 						      info_element);
1646 		if (rc == 0) {
1647 			rtllib_qos_convert_ac_to_parameters(&param_element,
1648 							       &(network->qos_data));
1649 			network->flags |= NETWORK_HAS_QOS_PARAMETERS;
1650 			network->qos_data.param_count =
1651 			    param_element.info_element.ac_info & 0x0F;
1652 		}
1653 	}
1654 
1655 	if (rc == 0) {
1656 		netdev_dbg(ieee->dev, "QoS is supported\n");
1657 		network->qos_data.supported = 1;
1658 	}
1659 	return rc;
1660 }
1661 
get_info_element_string(u16 id)1662 static const char *get_info_element_string(u16 id)
1663 {
1664 	switch (id) {
1665 	case MFIE_TYPE_SSID:
1666 		return "SSID";
1667 	case MFIE_TYPE_RATES:
1668 		return "RATES";
1669 	case MFIE_TYPE_FH_SET:
1670 		return "FH_SET";
1671 	case MFIE_TYPE_DS_SET:
1672 		return "DS_SET";
1673 	case MFIE_TYPE_CF_SET:
1674 		return "CF_SET";
1675 	case MFIE_TYPE_TIM:
1676 		return "TIM";
1677 	case MFIE_TYPE_IBSS_SET:
1678 		return "IBSS_SET";
1679 	case MFIE_TYPE_COUNTRY:
1680 		return "COUNTRY";
1681 	case MFIE_TYPE_HOP_PARAMS:
1682 		return "HOP_PARAMS";
1683 	case MFIE_TYPE_HOP_TABLE:
1684 		return "HOP_TABLE";
1685 	case MFIE_TYPE_REQUEST:
1686 		return "REQUEST";
1687 	case MFIE_TYPE_CHALLENGE:
1688 		return "CHALLENGE";
1689 	case MFIE_TYPE_POWER_CONSTRAINT:
1690 		return "POWER_CONSTRAINT";
1691 	case MFIE_TYPE_POWER_CAPABILITY:
1692 		return "POWER_CAPABILITY";
1693 	case MFIE_TYPE_TPC_REQUEST:
1694 		return "TPC_REQUEST";
1695 	case MFIE_TYPE_TPC_REPORT:
1696 		return "TPC_REPORT";
1697 	case MFIE_TYPE_SUPP_CHANNELS:
1698 		return "SUPP_CHANNELS";
1699 	case MFIE_TYPE_CSA:
1700 		return "CSA";
1701 	case MFIE_TYPE_MEASURE_REQUEST:
1702 		return "MEASURE_REQUEST";
1703 	case MFIE_TYPE_MEASURE_REPORT:
1704 		return "MEASURE_REPORT";
1705 	case MFIE_TYPE_QUIET:
1706 		return "QUIET";
1707 	case MFIE_TYPE_IBSS_DFS:
1708 		return "IBSS_DFS";
1709 	case MFIE_TYPE_RSN:
1710 		return "RSN";
1711 	case MFIE_TYPE_RATES_EX:
1712 		return "RATES_EX";
1713 	case MFIE_TYPE_GENERIC:
1714 		return "GENERIC";
1715 	case MFIE_TYPE_QOS_PARAMETER:
1716 		return "QOS_PARAMETER";
1717 	default:
1718 		return "UNKNOWN";
1719 	}
1720 }
1721 
rtllib_extract_country_ie(struct rtllib_device * ieee,struct rtllib_info_element * info_element,struct rtllib_network * network,u8 * addr2)1722 static inline void rtllib_extract_country_ie(
1723 	struct rtllib_device *ieee,
1724 	struct rtllib_info_element *info_element,
1725 	struct rtllib_network *network,
1726 	u8 *addr2)
1727 {
1728 	if (IS_DOT11D_ENABLE(ieee)) {
1729 		if (info_element->len != 0) {
1730 			memcpy(network->CountryIeBuf, info_element->data,
1731 			       info_element->len);
1732 			network->CountryIeLen = info_element->len;
1733 
1734 			if (!IS_COUNTRY_IE_VALID(ieee)) {
1735 				if (rtllib_act_scanning(ieee, false) &&
1736 				    ieee->FirstIe_InScan)
1737 					netdev_info(ieee->dev,
1738 						    "Received beacon CountryIE, SSID: <%s>\n",
1739 						    network->ssid);
1740 				dot11d_update_country(ieee, addr2,
1741 						       info_element->len,
1742 						       info_element->data);
1743 			}
1744 		}
1745 
1746 		if (IS_EQUAL_CIE_SRC(ieee, addr2))
1747 			UPDATE_CIE_WATCHDOG(ieee);
1748 	}
1749 }
1750 
rtllib_parse_mife_generic(struct rtllib_device * ieee,struct rtllib_info_element * info_element,struct rtllib_network * network,u16 * tmp_htcap_len,u16 * tmp_htinfo_len)1751 static void rtllib_parse_mife_generic(struct rtllib_device *ieee,
1752 				      struct rtllib_info_element *info_element,
1753 				      struct rtllib_network *network,
1754 				      u16 *tmp_htcap_len,
1755 				      u16 *tmp_htinfo_len)
1756 {
1757 	u16 ht_realtek_agg_len = 0;
1758 	u8  ht_realtek_agg_buf[MAX_IE_LEN];
1759 
1760 	if (!rtllib_parse_qos_info_param_IE(ieee, info_element, network))
1761 		return;
1762 	if (info_element->len >= 4 &&
1763 	    info_element->data[0] == 0x00 &&
1764 	    info_element->data[1] == 0x50 &&
1765 	    info_element->data[2] == 0xf2 &&
1766 	    info_element->data[3] == 0x01) {
1767 		network->wpa_ie_len = min(info_element->len + 2,
1768 					  MAX_WPA_IE_LEN);
1769 		memcpy(network->wpa_ie, info_element, network->wpa_ie_len);
1770 		return;
1771 	}
1772 	if (info_element->len == 7 &&
1773 	    info_element->data[0] == 0x00 &&
1774 	    info_element->data[1] == 0xe0 &&
1775 	    info_element->data[2] == 0x4c &&
1776 	    info_element->data[3] == 0x01 &&
1777 	    info_element->data[4] == 0x02)
1778 		network->Turbo_Enable = 1;
1779 
1780 	if (*tmp_htcap_len == 0) {
1781 		if (info_element->len >= 4 &&
1782 		    info_element->data[0] == 0x00 &&
1783 		    info_element->data[1] == 0x90 &&
1784 		    info_element->data[2] == 0x4c &&
1785 		    info_element->data[3] == 0x033) {
1786 			*tmp_htcap_len = min_t(u8, info_element->len,
1787 					       MAX_IE_LEN);
1788 			if (*tmp_htcap_len != 0) {
1789 				network->bssht.bd_ht_spec_ver = HT_SPEC_VER_EWC;
1790 				network->bssht.bd_ht_cap_len = min_t(u16, *tmp_htcap_len,
1791 								  sizeof(network->bssht.bd_ht_cap_buf));
1792 				memcpy(network->bssht.bd_ht_cap_buf,
1793 				       info_element->data,
1794 				       network->bssht.bd_ht_cap_len);
1795 			}
1796 		}
1797 		if (*tmp_htcap_len != 0) {
1798 			network->bssht.bd_support_ht = true;
1799 			network->bssht.bd_ht_1r = ((((struct ht_capab_ele *)(network->bssht.bd_ht_cap_buf))->MCS[1]) == 0);
1800 		} else {
1801 			network->bssht.bd_support_ht = false;
1802 			network->bssht.bd_ht_1r = false;
1803 		}
1804 	}
1805 
1806 	if (*tmp_htinfo_len == 0) {
1807 		if (info_element->len >= 4 &&
1808 		    info_element->data[0] == 0x00 &&
1809 		    info_element->data[1] == 0x90 &&
1810 		    info_element->data[2] == 0x4c &&
1811 		    info_element->data[3] == 0x034) {
1812 			*tmp_htinfo_len = min_t(u8, info_element->len,
1813 						MAX_IE_LEN);
1814 			if (*tmp_htinfo_len != 0) {
1815 				network->bssht.bd_ht_spec_ver = HT_SPEC_VER_EWC;
1816 				network->bssht.bd_ht_info_len = min_t(u16, *tmp_htinfo_len,
1817 								      sizeof(network->bssht.bd_ht_info_buf));
1818 				memcpy(network->bssht.bd_ht_info_buf,
1819 				       info_element->data,
1820 				       network->bssht.bd_ht_info_len);
1821 			}
1822 		}
1823 	}
1824 
1825 	if (network->bssht.bd_support_ht) {
1826 		if (info_element->len >= 4 &&
1827 		    info_element->data[0] == 0x00 &&
1828 		    info_element->data[1] == 0xe0 &&
1829 		    info_element->data[2] == 0x4c &&
1830 		    info_element->data[3] == 0x02) {
1831 			ht_realtek_agg_len = min_t(u8, info_element->len,
1832 						   MAX_IE_LEN);
1833 			memcpy(ht_realtek_agg_buf, info_element->data,
1834 			       info_element->len);
1835 		}
1836 		if (ht_realtek_agg_len >= 5) {
1837 			network->realtek_cap_exit = true;
1838 			network->bssht.bd_rt2rt_aggregation = true;
1839 
1840 			if ((ht_realtek_agg_buf[4] == 1) &&
1841 			    (ht_realtek_agg_buf[5] & 0x02))
1842 				network->bssht.bd_rt2rt_long_slot_time = true;
1843 
1844 			if ((ht_realtek_agg_buf[4] == 1) &&
1845 			    (ht_realtek_agg_buf[5] & RT_HT_CAP_USE_92SE))
1846 				network->bssht.rt2rt_ht_mode |= RT_HT_CAP_USE_92SE;
1847 		}
1848 	}
1849 	if (ht_realtek_agg_len >= 5) {
1850 		if ((ht_realtek_agg_buf[5] & RT_HT_CAP_USE_SOFTAP))
1851 			network->bssht.rt2rt_ht_mode |= RT_HT_CAP_USE_SOFTAP;
1852 	}
1853 
1854 	if ((info_element->len >= 3 &&
1855 	     info_element->data[0] == 0x00 &&
1856 	     info_element->data[1] == 0x05 &&
1857 	     info_element->data[2] == 0xb5) ||
1858 	     (info_element->len >= 3 &&
1859 	     info_element->data[0] == 0x00 &&
1860 	     info_element->data[1] == 0x0a &&
1861 	     info_element->data[2] == 0xf7) ||
1862 	     (info_element->len >= 3 &&
1863 	     info_element->data[0] == 0x00 &&
1864 	     info_element->data[1] == 0x10 &&
1865 	     info_element->data[2] == 0x18)) {
1866 		network->broadcom_cap_exist = true;
1867 	}
1868 	if (info_element->len >= 3 &&
1869 	    info_element->data[0] == 0x00 &&
1870 	    info_element->data[1] == 0x0c &&
1871 	    info_element->data[2] == 0x43)
1872 		network->ralink_cap_exist = true;
1873 	if ((info_element->len >= 3 &&
1874 	     info_element->data[0] == 0x00 &&
1875 	     info_element->data[1] == 0x03 &&
1876 	     info_element->data[2] == 0x7f) ||
1877 	     (info_element->len >= 3 &&
1878 	     info_element->data[0] == 0x00 &&
1879 	     info_element->data[1] == 0x13 &&
1880 	     info_element->data[2] == 0x74))
1881 		network->atheros_cap_exist = true;
1882 
1883 	if ((info_element->len >= 3 &&
1884 	     info_element->data[0] == 0x00 &&
1885 	     info_element->data[1] == 0x50 &&
1886 	     info_element->data[2] == 0x43))
1887 		network->marvell_cap_exist = true;
1888 	if (info_element->len >= 3 &&
1889 	    info_element->data[0] == 0x00 &&
1890 	    info_element->data[1] == 0x40 &&
1891 	    info_element->data[2] == 0x96)
1892 		network->cisco_cap_exist = true;
1893 
1894 	if (info_element->len >= 3 &&
1895 	    info_element->data[0] == 0x00 &&
1896 	    info_element->data[1] == 0x0a &&
1897 	    info_element->data[2] == 0xf5)
1898 		network->airgo_cap_exist = true;
1899 
1900 	if (info_element->len > 4 &&
1901 	    info_element->data[0] == 0x00 &&
1902 	    info_element->data[1] == 0x40 &&
1903 	    info_element->data[2] == 0x96 &&
1904 	    info_element->data[3] == 0x01) {
1905 		if (info_element->len == 6) {
1906 			memcpy(network->CcxRmState, &info_element->data[4], 2);
1907 			if (network->CcxRmState[0] != 0)
1908 				network->bCcxRmEnable = true;
1909 			else
1910 				network->bCcxRmEnable = false;
1911 			network->MBssidMask = network->CcxRmState[1] & 0x07;
1912 			if (network->MBssidMask != 0) {
1913 				network->bMBssidValid = true;
1914 				network->MBssidMask = 0xff <<
1915 						      (network->MBssidMask);
1916 				ether_addr_copy(network->MBssid,
1917 						network->bssid);
1918 				network->MBssid[5] &= network->MBssidMask;
1919 			} else {
1920 				network->bMBssidValid = false;
1921 			}
1922 		} else {
1923 			network->bCcxRmEnable = false;
1924 		}
1925 	}
1926 	if (info_element->len > 4  &&
1927 	    info_element->data[0] == 0x00 &&
1928 	    info_element->data[1] == 0x40 &&
1929 	    info_element->data[2] == 0x96 &&
1930 	    info_element->data[3] == 0x03) {
1931 		if (info_element->len == 5) {
1932 			network->bWithCcxVerNum = true;
1933 			network->BssCcxVerNumber = info_element->data[4];
1934 		} else {
1935 			network->bWithCcxVerNum = false;
1936 			network->BssCcxVerNumber = 0;
1937 		}
1938 	}
1939 	if (info_element->len > 4  &&
1940 	    info_element->data[0] == 0x00 &&
1941 	    info_element->data[1] == 0x50 &&
1942 	    info_element->data[2] == 0xf2 &&
1943 	    info_element->data[3] == 0x04) {
1944 		netdev_dbg(ieee->dev, "MFIE_TYPE_WZC: %d bytes\n",
1945 			   info_element->len);
1946 		network->wzc_ie_len = min(info_element->len + 2, MAX_WZC_IE_LEN);
1947 		memcpy(network->wzc_ie, info_element, network->wzc_ie_len);
1948 	}
1949 }
1950 
rtllib_parse_mfie_ht_cap(struct rtllib_info_element * info_element,struct rtllib_network * network,u16 * tmp_htcap_len)1951 static void rtllib_parse_mfie_ht_cap(struct rtllib_info_element *info_element,
1952 				     struct rtllib_network *network,
1953 				     u16 *tmp_htcap_len)
1954 {
1955 	struct bss_ht *ht = &network->bssht;
1956 
1957 	*tmp_htcap_len = min_t(u8, info_element->len, MAX_IE_LEN);
1958 	if (*tmp_htcap_len != 0) {
1959 		ht->bd_ht_spec_ver = HT_SPEC_VER_EWC;
1960 		ht->bd_ht_cap_len = min_t(u16, *tmp_htcap_len,
1961 				       sizeof(ht->bd_ht_cap_buf));
1962 		memcpy(ht->bd_ht_cap_buf, info_element->data, ht->bd_ht_cap_len);
1963 
1964 		ht->bd_support_ht = true;
1965 		ht->bd_ht_1r = ((((struct ht_capab_ele *)
1966 				ht->bd_ht_cap_buf))->MCS[1]) == 0;
1967 
1968 		ht->bd_bandwidth = (enum ht_channel_width)
1969 					     (((struct ht_capab_ele *)
1970 					     (ht->bd_ht_cap_buf))->ChlWidth);
1971 	} else {
1972 		ht->bd_support_ht = false;
1973 		ht->bd_ht_1r = false;
1974 		ht->bd_bandwidth = HT_CHANNEL_WIDTH_20;
1975 	}
1976 }
1977 
rtllib_parse_info_param(struct rtllib_device * ieee,struct rtllib_info_element * info_element,u16 length,struct rtllib_network * network,struct rtllib_rx_stats * stats)1978 int rtllib_parse_info_param(struct rtllib_device *ieee,
1979 		struct rtllib_info_element *info_element,
1980 		u16 length,
1981 		struct rtllib_network *network,
1982 		struct rtllib_rx_stats *stats)
1983 {
1984 	u8 i;
1985 	short offset;
1986 	u16	tmp_htcap_len = 0;
1987 	u16	tmp_htinfo_len = 0;
1988 	char rates_str[64];
1989 	char *p;
1990 
1991 	while (length >= sizeof(*info_element)) {
1992 		if (sizeof(*info_element) + info_element->len > length) {
1993 			netdev_dbg(ieee->dev,
1994 				   "Info elem: parse failed: info_element->len + 2 > left : info_element->len+2=%zd left=%d, id=%d.\n",
1995 				   info_element->len + sizeof(*info_element),
1996 				   length, info_element->id);
1997 			/* We stop processing but don't return an error here
1998 			 * because some misbehaviour APs break this rule. ie.
1999 			 * Orinoco AP1000.
2000 			 */
2001 			break;
2002 		}
2003 
2004 		switch (info_element->id) {
2005 		case MFIE_TYPE_SSID:
2006 			if (rtllib_is_empty_essid(info_element->data,
2007 						     info_element->len)) {
2008 				network->flags |= NETWORK_EMPTY_ESSID;
2009 				break;
2010 			}
2011 
2012 			network->ssid_len = min(info_element->len,
2013 						(u8)IW_ESSID_MAX_SIZE);
2014 			memcpy(network->ssid, info_element->data,
2015 			       network->ssid_len);
2016 			if (network->ssid_len < IW_ESSID_MAX_SIZE)
2017 				memset(network->ssid + network->ssid_len, 0,
2018 				       IW_ESSID_MAX_SIZE - network->ssid_len);
2019 
2020 			netdev_dbg(ieee->dev, "MFIE_TYPE_SSID: '%s' len=%d.\n",
2021 				   network->ssid, network->ssid_len);
2022 			break;
2023 
2024 		case MFIE_TYPE_RATES:
2025 			p = rates_str;
2026 			network->rates_len = min(info_element->len,
2027 						 MAX_RATES_LENGTH);
2028 			for (i = 0; i < network->rates_len; i++) {
2029 				network->rates[i] = info_element->data[i];
2030 				p += scnprintf(p, sizeof(rates_str) -
2031 					      (p - rates_str), "%02X ",
2032 					      network->rates[i]);
2033 				if (rtllib_is_ofdm_rate
2034 				    (info_element->data[i])) {
2035 					network->flags |= NETWORK_HAS_OFDM;
2036 					if (info_element->data[i] &
2037 					    RTLLIB_BASIC_RATE_MASK)
2038 						network->flags &=
2039 						    ~NETWORK_HAS_CCK;
2040 				}
2041 
2042 				if (rtllib_is_cck_rate
2043 				    (info_element->data[i])) {
2044 					network->flags |= NETWORK_HAS_CCK;
2045 				}
2046 			}
2047 
2048 			netdev_dbg(ieee->dev, "MFIE_TYPE_RATES: '%s' (%d)\n",
2049 				   rates_str, network->rates_len);
2050 			break;
2051 
2052 		case MFIE_TYPE_RATES_EX:
2053 			p = rates_str;
2054 			network->rates_ex_len = min(info_element->len,
2055 						    MAX_RATES_EX_LENGTH);
2056 			for (i = 0; i < network->rates_ex_len; i++) {
2057 				network->rates_ex[i] = info_element->data[i];
2058 				p += scnprintf(p, sizeof(rates_str) -
2059 					      (p - rates_str), "%02X ",
2060 					      network->rates_ex[i]);
2061 				if (rtllib_is_ofdm_rate
2062 				    (info_element->data[i])) {
2063 					network->flags |= NETWORK_HAS_OFDM;
2064 					if (info_element->data[i] &
2065 					    RTLLIB_BASIC_RATE_MASK)
2066 						network->flags &=
2067 						    ~NETWORK_HAS_CCK;
2068 				}
2069 			}
2070 
2071 			netdev_dbg(ieee->dev, "MFIE_TYPE_RATES_EX: '%s' (%d)\n",
2072 				   rates_str, network->rates_ex_len);
2073 			break;
2074 
2075 		case MFIE_TYPE_DS_SET:
2076 			netdev_dbg(ieee->dev, "MFIE_TYPE_DS_SET: %d\n",
2077 				   info_element->data[0]);
2078 			network->channel = info_element->data[0];
2079 			break;
2080 
2081 		case MFIE_TYPE_FH_SET:
2082 			netdev_dbg(ieee->dev, "MFIE_TYPE_FH_SET: ignored\n");
2083 			break;
2084 
2085 		case MFIE_TYPE_CF_SET:
2086 			netdev_dbg(ieee->dev, "MFIE_TYPE_CF_SET: ignored\n");
2087 			break;
2088 
2089 		case MFIE_TYPE_TIM:
2090 			if (info_element->len < 4)
2091 				break;
2092 
2093 			network->tim.tim_count = info_element->data[0];
2094 			network->tim.tim_period = info_element->data[1];
2095 
2096 			network->dtim_period = info_element->data[1];
2097 			if (ieee->link_state != MAC80211_LINKED)
2098 				break;
2099 			network->last_dtim_sta_time = jiffies;
2100 
2101 			network->dtim_data = RTLLIB_DTIM_VALID;
2102 
2103 			if (info_element->data[2] & 1)
2104 				network->dtim_data |= RTLLIB_DTIM_MBCAST;
2105 
2106 			offset = (info_element->data[2] >> 1) * 2;
2107 
2108 			if (ieee->assoc_id < 8 * offset ||
2109 			    ieee->assoc_id > 8 * (offset + info_element->len - 3))
2110 				break;
2111 
2112 			offset = (ieee->assoc_id / 8) - offset;
2113 			if (info_element->data[3 + offset] &
2114 			   (1 << (ieee->assoc_id % 8)))
2115 				network->dtim_data |= RTLLIB_DTIM_UCAST;
2116 
2117 			network->listen_interval = network->dtim_period;
2118 			break;
2119 
2120 		case MFIE_TYPE_ERP:
2121 			network->erp_value = info_element->data[0];
2122 			network->flags |= NETWORK_HAS_ERP_VALUE;
2123 			netdev_dbg(ieee->dev, "MFIE_TYPE_ERP_SET: %d\n",
2124 				   network->erp_value);
2125 			break;
2126 		case MFIE_TYPE_IBSS_SET:
2127 			network->atim_window = info_element->data[0];
2128 			netdev_dbg(ieee->dev, "MFIE_TYPE_IBSS_SET: %d\n",
2129 				   network->atim_window);
2130 			break;
2131 
2132 		case MFIE_TYPE_CHALLENGE:
2133 			netdev_dbg(ieee->dev, "MFIE_TYPE_CHALLENGE: ignored\n");
2134 			break;
2135 
2136 		case MFIE_TYPE_GENERIC:
2137 			netdev_dbg(ieee->dev, "MFIE_TYPE_GENERIC: %d bytes\n",
2138 				   info_element->len);
2139 
2140 			rtllib_parse_mife_generic(ieee, info_element, network,
2141 						  &tmp_htcap_len,
2142 						  &tmp_htinfo_len);
2143 			break;
2144 
2145 		case MFIE_TYPE_RSN:
2146 			netdev_dbg(ieee->dev, "MFIE_TYPE_RSN: %d bytes\n",
2147 				   info_element->len);
2148 			network->rsn_ie_len = min(info_element->len + 2,
2149 						  MAX_WPA_IE_LEN);
2150 			memcpy(network->rsn_ie, info_element,
2151 			       network->rsn_ie_len);
2152 			break;
2153 
2154 		case MFIE_TYPE_HT_CAP:
2155 			netdev_dbg(ieee->dev, "MFIE_TYPE_HT_CAP: %d bytes\n",
2156 				   info_element->len);
2157 
2158 			rtllib_parse_mfie_ht_cap(info_element, network,
2159 						 &tmp_htcap_len);
2160 			break;
2161 
2162 		case MFIE_TYPE_HT_INFO:
2163 			netdev_dbg(ieee->dev, "MFIE_TYPE_HT_INFO: %d bytes\n",
2164 				   info_element->len);
2165 			tmp_htinfo_len = min_t(u8, info_element->len,
2166 					       MAX_IE_LEN);
2167 			if (tmp_htinfo_len) {
2168 				network->bssht.bd_ht_spec_ver = HT_SPEC_VER_IEEE;
2169 				network->bssht.bd_ht_info_len = tmp_htinfo_len >
2170 					sizeof(network->bssht.bd_ht_info_buf) ?
2171 					sizeof(network->bssht.bd_ht_info_buf) :
2172 					tmp_htinfo_len;
2173 				memcpy(network->bssht.bd_ht_info_buf,
2174 				       info_element->data,
2175 				       network->bssht.bd_ht_info_len);
2176 			}
2177 			break;
2178 
2179 		case MFIE_TYPE_AIRONET:
2180 			netdev_dbg(ieee->dev, "MFIE_TYPE_AIRONET: %d bytes\n",
2181 				   info_element->len);
2182 			if (info_element->len > IE_CISCO_FLAG_POSITION) {
2183 				network->bWithAironetIE = true;
2184 
2185 				if ((info_element->data[IE_CISCO_FLAG_POSITION]
2186 				     & SUPPORT_CKIP_MIC) ||
2187 				     (info_element->data[IE_CISCO_FLAG_POSITION]
2188 				     & SUPPORT_CKIP_PK))
2189 					network->bCkipSupported = true;
2190 				else
2191 					network->bCkipSupported = false;
2192 			} else {
2193 				network->bWithAironetIE = false;
2194 				network->bCkipSupported = false;
2195 			}
2196 			break;
2197 		case MFIE_TYPE_QOS_PARAMETER:
2198 			netdev_err(ieee->dev,
2199 				   "QoS Error need to parse QOS_PARAMETER IE\n");
2200 			break;
2201 
2202 		case MFIE_TYPE_COUNTRY:
2203 			netdev_dbg(ieee->dev, "MFIE_TYPE_COUNTRY: %d bytes\n",
2204 				   info_element->len);
2205 			rtllib_extract_country_ie(ieee, info_element, network,
2206 						  network->bssid);
2207 			break;
2208 /* TODO */
2209 		default:
2210 			netdev_dbg(ieee->dev,
2211 				   "Unsupported info element: %s (%d)\n",
2212 				   get_info_element_string(info_element->id),
2213 				   info_element->id);
2214 			break;
2215 		}
2216 
2217 		length -= sizeof(*info_element) + info_element->len;
2218 		info_element =
2219 		    (struct rtllib_info_element *)&info_element->data[info_element->len];
2220 	}
2221 
2222 	if (!network->atheros_cap_exist && !network->broadcom_cap_exist &&
2223 	    !network->cisco_cap_exist && !network->ralink_cap_exist &&
2224 	    !network->bssht.bd_rt2rt_aggregation)
2225 		network->unknown_cap_exist = true;
2226 	else
2227 		network->unknown_cap_exist = false;
2228 	return 0;
2229 }
2230 
rtllib_translate_todbm(u8 signal_strength_index)2231 static long rtllib_translate_todbm(u8 signal_strength_index)
2232 {
2233 	long	signal_power;
2234 
2235 	signal_power = (long)((signal_strength_index + 1) >> 1);
2236 	signal_power -= 95;
2237 
2238 	return signal_power;
2239 }
2240 
rtllib_network_init(struct rtllib_device * ieee,struct rtllib_probe_response * beacon,struct rtllib_network * network,struct rtllib_rx_stats * stats)2241 static inline int rtllib_network_init(
2242 	struct rtllib_device *ieee,
2243 	struct rtllib_probe_response *beacon,
2244 	struct rtllib_network *network,
2245 	struct rtllib_rx_stats *stats)
2246 {
2247 	memset(&network->qos_data, 0, sizeof(struct rtllib_qos_data));
2248 
2249 	/* Pull out fixed field data */
2250 	ether_addr_copy(network->bssid, beacon->header.addr3);
2251 	network->capability = le16_to_cpu(beacon->capability);
2252 	network->last_scanned = jiffies;
2253 	network->time_stamp[0] = beacon->time_stamp[0];
2254 	network->time_stamp[1] = beacon->time_stamp[1];
2255 	network->beacon_interval = le16_to_cpu(beacon->beacon_interval);
2256 	/* Where to pull this? beacon->listen_interval;*/
2257 	network->listen_interval = 0x0A;
2258 	network->rates_len = network->rates_ex_len = 0;
2259 	network->ssid_len = 0;
2260 	network->hidden_ssid_len = 0;
2261 	memset(network->hidden_ssid, 0, sizeof(network->hidden_ssid));
2262 	network->flags = 0;
2263 	network->atim_window = 0;
2264 	network->erp_value = (network->capability & WLAN_CAPABILITY_IBSS) ?
2265 	    0x3 : 0x0;
2266 	network->berp_info_valid = false;
2267 	network->broadcom_cap_exist = false;
2268 	network->ralink_cap_exist = false;
2269 	network->atheros_cap_exist = false;
2270 	network->cisco_cap_exist = false;
2271 	network->unknown_cap_exist = false;
2272 	network->realtek_cap_exit = false;
2273 	network->marvell_cap_exist = false;
2274 	network->airgo_cap_exist = false;
2275 	network->Turbo_Enable = 0;
2276 	network->SignalStrength = stats->SignalStrength;
2277 	network->RSSI = stats->SignalStrength;
2278 	network->CountryIeLen = 0;
2279 	memset(network->CountryIeBuf, 0, MAX_IE_LEN);
2280 	HTInitializeBssDesc(&network->bssht);
2281 	network->flags |= NETWORK_HAS_CCK;
2282 
2283 	network->wpa_ie_len = 0;
2284 	network->rsn_ie_len = 0;
2285 	network->wzc_ie_len = 0;
2286 
2287 	if (rtllib_parse_info_param(ieee,
2288 			beacon->info_element,
2289 			(stats->len - sizeof(*beacon)),
2290 			network,
2291 			stats))
2292 		return 1;
2293 
2294 	network->mode = 0;
2295 
2296 	if (network->flags & NETWORK_HAS_OFDM)
2297 		network->mode |= WIRELESS_MODE_G;
2298 	if (network->flags & NETWORK_HAS_CCK)
2299 		network->mode |= WIRELESS_MODE_B;
2300 
2301 	if (network->mode == 0) {
2302 		netdev_dbg(ieee->dev, "Filtered out '%s (%pM)' network.\n",
2303 			   escape_essid(network->ssid, network->ssid_len),
2304 			   network->bssid);
2305 		return 1;
2306 	}
2307 
2308 	if (network->bssht.bd_support_ht) {
2309 		if (network->mode & (WIRELESS_MODE_G | WIRELESS_MODE_B))
2310 			network->mode = WIRELESS_MODE_N_24G;
2311 	}
2312 	if (rtllib_is_empty_essid(network->ssid, network->ssid_len))
2313 		network->flags |= NETWORK_EMPTY_ESSID;
2314 	stats->signal = 30 + (stats->SignalStrength * 70) / 100;
2315 	stats->noise = rtllib_translate_todbm((u8)(100 - stats->signal)) - 25;
2316 
2317 	memcpy(&network->stats, stats, sizeof(network->stats));
2318 
2319 	return 0;
2320 }
2321 
is_same_network(struct rtllib_network * src,struct rtllib_network * dst,u8 ssidbroad)2322 static inline int is_same_network(struct rtllib_network *src,
2323 				  struct rtllib_network *dst, u8 ssidbroad)
2324 {
2325 	/* A network is only a duplicate if the channel, BSSID, ESSID
2326 	 * and the capability field (in particular IBSS and BSS) all match.
2327 	 * We treat all <hidden> with the same BSSID and channel
2328 	 * as one network
2329 	 */
2330 	return (((src->ssid_len == dst->ssid_len) || (!ssidbroad)) &&
2331 		(src->channel == dst->channel) &&
2332 		!memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
2333 		(!memcmp(src->ssid, dst->ssid, src->ssid_len) ||
2334 		(!ssidbroad)) &&
2335 		((src->capability & WLAN_CAPABILITY_IBSS) ==
2336 		(dst->capability & WLAN_CAPABILITY_IBSS)) &&
2337 		((src->capability & WLAN_CAPABILITY_ESS) ==
2338 		(dst->capability & WLAN_CAPABILITY_ESS)));
2339 }
2340 
update_network(struct rtllib_device * ieee,struct rtllib_network * dst,struct rtllib_network * src)2341 static inline void update_network(struct rtllib_device *ieee,
2342 				  struct rtllib_network *dst,
2343 				  struct rtllib_network *src)
2344 {
2345 	int qos_active;
2346 	u8 old_param;
2347 
2348 	memcpy(&dst->stats, &src->stats, sizeof(struct rtllib_rx_stats));
2349 	dst->capability = src->capability;
2350 	memcpy(dst->rates, src->rates, src->rates_len);
2351 	dst->rates_len = src->rates_len;
2352 	memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
2353 	dst->rates_ex_len = src->rates_ex_len;
2354 	if (src->ssid_len > 0) {
2355 		if (dst->ssid_len == 0) {
2356 			memset(dst->hidden_ssid, 0, sizeof(dst->hidden_ssid));
2357 			dst->hidden_ssid_len = src->ssid_len;
2358 			memcpy(dst->hidden_ssid, src->ssid, src->ssid_len);
2359 		} else {
2360 			memset(dst->ssid, 0, dst->ssid_len);
2361 			dst->ssid_len = src->ssid_len;
2362 			memcpy(dst->ssid, src->ssid, src->ssid_len);
2363 		}
2364 	}
2365 	dst->mode = src->mode;
2366 	dst->flags = src->flags;
2367 	dst->time_stamp[0] = src->time_stamp[0];
2368 	dst->time_stamp[1] = src->time_stamp[1];
2369 	if (src->flags & NETWORK_HAS_ERP_VALUE) {
2370 		dst->erp_value = src->erp_value;
2371 		dst->berp_info_valid = src->berp_info_valid = true;
2372 	}
2373 	dst->beacon_interval = src->beacon_interval;
2374 	dst->listen_interval = src->listen_interval;
2375 	dst->atim_window = src->atim_window;
2376 	dst->dtim_period = src->dtim_period;
2377 	dst->dtim_data = src->dtim_data;
2378 	dst->last_dtim_sta_time = src->last_dtim_sta_time;
2379 	memcpy(&dst->tim, &src->tim, sizeof(struct rtllib_tim_parameters));
2380 
2381 	dst->bssht.bd_support_ht = src->bssht.bd_support_ht;
2382 	dst->bssht.bd_rt2rt_aggregation = src->bssht.bd_rt2rt_aggregation;
2383 	dst->bssht.bd_ht_cap_len = src->bssht.bd_ht_cap_len;
2384 	memcpy(dst->bssht.bd_ht_cap_buf, src->bssht.bd_ht_cap_buf,
2385 	       src->bssht.bd_ht_cap_len);
2386 	dst->bssht.bd_ht_info_len = src->bssht.bd_ht_info_len;
2387 	memcpy(dst->bssht.bd_ht_info_buf, src->bssht.bd_ht_info_buf,
2388 	       src->bssht.bd_ht_info_len);
2389 	dst->bssht.bd_ht_spec_ver = src->bssht.bd_ht_spec_ver;
2390 	dst->bssht.bd_rt2rt_long_slot_time = src->bssht.bd_rt2rt_long_slot_time;
2391 	dst->broadcom_cap_exist = src->broadcom_cap_exist;
2392 	dst->ralink_cap_exist = src->ralink_cap_exist;
2393 	dst->atheros_cap_exist = src->atheros_cap_exist;
2394 	dst->realtek_cap_exit = src->realtek_cap_exit;
2395 	dst->marvell_cap_exist = src->marvell_cap_exist;
2396 	dst->cisco_cap_exist = src->cisco_cap_exist;
2397 	dst->airgo_cap_exist = src->airgo_cap_exist;
2398 	dst->unknown_cap_exist = src->unknown_cap_exist;
2399 	memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
2400 	dst->wpa_ie_len = src->wpa_ie_len;
2401 	memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
2402 	dst->rsn_ie_len = src->rsn_ie_len;
2403 	memcpy(dst->wzc_ie, src->wzc_ie, src->wzc_ie_len);
2404 	dst->wzc_ie_len = src->wzc_ie_len;
2405 
2406 	dst->last_scanned = jiffies;
2407 	/* qos related parameters */
2408 	qos_active = dst->qos_data.active;
2409 	old_param = dst->qos_data.param_count;
2410 	dst->qos_data.supported = src->qos_data.supported;
2411 	if (dst->flags & NETWORK_HAS_QOS_PARAMETERS)
2412 		memcpy(&dst->qos_data, &src->qos_data,
2413 		       sizeof(struct rtllib_qos_data));
2414 	if (dst->qos_data.supported == 1) {
2415 		if (dst->ssid_len)
2416 			netdev_dbg(ieee->dev,
2417 				   "QoS the network %s is QoS supported\n",
2418 				   dst->ssid);
2419 		else
2420 			netdev_dbg(ieee->dev,
2421 				   "QoS the network is QoS supported\n");
2422 	}
2423 	dst->qos_data.active = qos_active;
2424 	dst->qos_data.old_param_count = old_param;
2425 
2426 	dst->wmm_info = src->wmm_info;
2427 	if (src->wmm_param[0].ac_aci_acm_aifsn ||
2428 	   src->wmm_param[1].ac_aci_acm_aifsn ||
2429 	   src->wmm_param[2].ac_aci_acm_aifsn ||
2430 	   src->wmm_param[3].ac_aci_acm_aifsn)
2431 		memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN);
2432 
2433 	dst->SignalStrength = src->SignalStrength;
2434 	dst->RSSI = src->RSSI;
2435 	dst->Turbo_Enable = src->Turbo_Enable;
2436 
2437 	dst->CountryIeLen = src->CountryIeLen;
2438 	memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen);
2439 
2440 	dst->bWithAironetIE = src->bWithAironetIE;
2441 	dst->bCkipSupported = src->bCkipSupported;
2442 	memcpy(dst->CcxRmState, src->CcxRmState, 2);
2443 	dst->bCcxRmEnable = src->bCcxRmEnable;
2444 	dst->MBssidMask = src->MBssidMask;
2445 	dst->bMBssidValid = src->bMBssidValid;
2446 	memcpy(dst->MBssid, src->MBssid, 6);
2447 	dst->bWithCcxVerNum = src->bWithCcxVerNum;
2448 	dst->BssCcxVerNumber = src->BssCcxVerNumber;
2449 }
2450 
is_beacon(u16 fc)2451 static inline int is_beacon(u16 fc)
2452 {
2453 	return (WLAN_FC_GET_STYPE(fc) == RTLLIB_STYPE_BEACON);
2454 }
2455 
IsPassiveChannel(struct rtllib_device * rtllib,u8 channel)2456 static int IsPassiveChannel(struct rtllib_device *rtllib, u8 channel)
2457 {
2458 	if (channel > MAX_CHANNEL_NUMBER) {
2459 		netdev_info(rtllib->dev, "%s(): Invalid Channel\n", __func__);
2460 		return 0;
2461 	}
2462 
2463 	if (rtllib->active_channel_map[channel] == 2)
2464 		return 1;
2465 
2466 	return 0;
2467 }
2468 
rtllib_legal_channel(struct rtllib_device * rtllib,u8 channel)2469 int rtllib_legal_channel(struct rtllib_device *rtllib, u8 channel)
2470 {
2471 	if (channel > MAX_CHANNEL_NUMBER) {
2472 		netdev_info(rtllib->dev, "%s(): Invalid Channel\n", __func__);
2473 		return 0;
2474 	}
2475 	if (rtllib->active_channel_map[channel] > 0)
2476 		return 1;
2477 
2478 	return 0;
2479 }
2480 EXPORT_SYMBOL(rtllib_legal_channel);
2481 
rtllib_process_probe_response(struct rtllib_device * ieee,struct rtllib_probe_response * beacon,struct rtllib_rx_stats * stats)2482 static inline void rtllib_process_probe_response(
2483 	struct rtllib_device *ieee,
2484 	struct rtllib_probe_response *beacon,
2485 	struct rtllib_rx_stats *stats)
2486 {
2487 	struct rtllib_network *target;
2488 	struct rtllib_network *oldest = NULL;
2489 	struct rtllib_info_element *info_element = &beacon->info_element[0];
2490 	unsigned long flags;
2491 	short renew;
2492 	struct rtllib_network *network = kzalloc(sizeof(struct rtllib_network),
2493 						 GFP_ATOMIC);
2494 	u16 frame_ctl = le16_to_cpu(beacon->header.frame_ctl);
2495 
2496 	if (!network)
2497 		return;
2498 
2499 	netdev_dbg(ieee->dev,
2500 		   "'%s' ( %pM ): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
2501 		   escape_essid(info_element->data, info_element->len),
2502 		   beacon->header.addr3,
2503 		   (le16_to_cpu(beacon->capability) & (1 << 0xf)) ? '1' : '0',
2504 		   (le16_to_cpu(beacon->capability) & (1 << 0xe)) ? '1' : '0',
2505 		   (le16_to_cpu(beacon->capability) & (1 << 0xd)) ? '1' : '0',
2506 		   (le16_to_cpu(beacon->capability) & (1 << 0xc)) ? '1' : '0',
2507 		   (le16_to_cpu(beacon->capability) & (1 << 0xb)) ? '1' : '0',
2508 		   (le16_to_cpu(beacon->capability) & (1 << 0xa)) ? '1' : '0',
2509 		   (le16_to_cpu(beacon->capability) & (1 << 0x9)) ? '1' : '0',
2510 		   (le16_to_cpu(beacon->capability) & (1 << 0x8)) ? '1' : '0',
2511 		   (le16_to_cpu(beacon->capability) & (1 << 0x7)) ? '1' : '0',
2512 		   (le16_to_cpu(beacon->capability) & (1 << 0x6)) ? '1' : '0',
2513 		   (le16_to_cpu(beacon->capability) & (1 << 0x5)) ? '1' : '0',
2514 		   (le16_to_cpu(beacon->capability) & (1 << 0x4)) ? '1' : '0',
2515 		   (le16_to_cpu(beacon->capability) & (1 << 0x3)) ? '1' : '0',
2516 		   (le16_to_cpu(beacon->capability) & (1 << 0x2)) ? '1' : '0',
2517 		   (le16_to_cpu(beacon->capability) & (1 << 0x1)) ? '1' : '0',
2518 		   (le16_to_cpu(beacon->capability) & (1 << 0x0)) ? '1' : '0');
2519 
2520 	if (rtllib_network_init(ieee, beacon, network, stats)) {
2521 		netdev_dbg(ieee->dev, "Dropped '%s' ( %pM) via %s.\n",
2522 			   escape_essid(info_element->data, info_element->len),
2523 			   beacon->header.addr3,
2524 			   is_beacon(frame_ctl) ? "BEACON" : "PROBE RESPONSE");
2525 		goto free_network;
2526 	}
2527 
2528 	if (!rtllib_legal_channel(ieee, network->channel))
2529 		goto free_network;
2530 
2531 	if (WLAN_FC_GET_STYPE(frame_ctl) == RTLLIB_STYPE_PROBE_RESP) {
2532 		if (IsPassiveChannel(ieee, network->channel)) {
2533 			netdev_info(ieee->dev,
2534 				    "GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n",
2535 				    network->channel);
2536 			goto free_network;
2537 		}
2538 	}
2539 
2540 	/* The network parsed correctly -- so now we scan our known networks
2541 	 * to see if we can find it in our list.
2542 	 *
2543 	 * NOTE:  This search is definitely not optimized.  Once its doing
2544 	 *	the "right thing" we'll optimize it for efficiency if
2545 	 *	necessary
2546 	 */
2547 
2548 	/* Search for this entry in the list and update it if it is
2549 	 * already there.
2550 	 */
2551 
2552 	spin_lock_irqsave(&ieee->lock, flags);
2553 	if (is_same_network(&ieee->current_network, network,
2554 	   (network->ssid_len ? 1 : 0))) {
2555 		update_network(ieee, &ieee->current_network, network);
2556 		if ((ieee->current_network.mode == WIRELESS_MODE_N_24G ||
2557 		     ieee->current_network.mode == WIRELESS_MODE_G) &&
2558 		    ieee->current_network.berp_info_valid) {
2559 			if (ieee->current_network.erp_value & ERP_UseProtection)
2560 				ieee->current_network.buseprotection = true;
2561 			else
2562 				ieee->current_network.buseprotection = false;
2563 		}
2564 		if (is_beacon(frame_ctl)) {
2565 			if (ieee->link_state >= MAC80211_LINKED)
2566 				ieee->link_detect_info.NumRecvBcnInPeriod++;
2567 		}
2568 	}
2569 	list_for_each_entry(target, &ieee->network_list, list) {
2570 		if (is_same_network(target, network,
2571 		   (target->ssid_len ? 1 : 0)))
2572 			break;
2573 		if ((oldest == NULL) ||
2574 		    (target->last_scanned < oldest->last_scanned))
2575 			oldest = target;
2576 	}
2577 
2578 	/* If we didn't find a match, then get a new network slot to initialize
2579 	 * with this beacon's information
2580 	 */
2581 	if (&target->list == &ieee->network_list) {
2582 		if (list_empty(&ieee->network_free_list)) {
2583 			/* If there are no more slots, expire the oldest */
2584 			list_del(&oldest->list);
2585 			target = oldest;
2586 			netdev_dbg(ieee->dev,
2587 				   "Expired '%s' ( %pM) from network list.\n",
2588 				   escape_essid(target->ssid, target->ssid_len),
2589 				   target->bssid);
2590 		} else {
2591 			/* Otherwise just pull from the free list */
2592 			target = list_entry(ieee->network_free_list.next,
2593 					    struct rtllib_network, list);
2594 			list_del(ieee->network_free_list.next);
2595 		}
2596 
2597 		netdev_dbg(ieee->dev, "Adding '%s' ( %pM) via %s.\n",
2598 			   escape_essid(network->ssid, network->ssid_len),
2599 			   network->bssid,
2600 			   is_beacon(frame_ctl) ? "BEACON" : "PROBE RESPONSE");
2601 
2602 		memcpy(target, network, sizeof(*target));
2603 		list_add_tail(&target->list, &ieee->network_list);
2604 		if (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE)
2605 			rtllib_softmac_new_net(ieee, network);
2606 	} else {
2607 		netdev_dbg(ieee->dev, "Updating '%s' ( %pM) via %s.\n",
2608 			   escape_essid(target->ssid, target->ssid_len),
2609 			   target->bssid,
2610 			   is_beacon(frame_ctl) ? "BEACON" : "PROBE RESPONSE");
2611 
2612 		/* we have an entry and we are going to update it. But this
2613 		 *  entry may be already expired. In this case we do the same
2614 		 * as we found a new net and call the new_net handler
2615 		 */
2616 		renew = !time_after(target->last_scanned + ieee->scan_age,
2617 				    jiffies);
2618 		if ((!target->ssid_len) &&
2619 		    (((network->ssid_len > 0) && (target->hidden_ssid_len == 0))
2620 		    || ((ieee->current_network.ssid_len == network->ssid_len) &&
2621 		    (strncmp(ieee->current_network.ssid, network->ssid,
2622 		    network->ssid_len) == 0) &&
2623 		    (ieee->link_state == MAC80211_NOLINK))))
2624 			renew = 1;
2625 		update_network(ieee, target, network);
2626 		if (renew && (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE))
2627 			rtllib_softmac_new_net(ieee, network);
2628 	}
2629 
2630 	spin_unlock_irqrestore(&ieee->lock, flags);
2631 	if (is_beacon(frame_ctl) &&
2632 	    is_same_network(&ieee->current_network, network,
2633 	    (network->ssid_len ? 1 : 0)) &&
2634 	    (ieee->link_state == MAC80211_LINKED)) {
2635 		ieee->handle_beacon(ieee->dev, beacon, &ieee->current_network);
2636 	}
2637 free_network:
2638 	kfree(network);
2639 }
2640 
rtllib_rx_mgt(struct rtllib_device * ieee,struct sk_buff * skb,struct rtllib_rx_stats * stats)2641 static void rtllib_rx_mgt(struct rtllib_device *ieee,
2642 			  struct sk_buff *skb,
2643 			  struct rtllib_rx_stats *stats)
2644 {
2645 	struct rtllib_hdr_4addr *header = (struct rtllib_hdr_4addr *)skb->data;
2646 
2647 	if ((WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) !=
2648 	    RTLLIB_STYPE_PROBE_RESP) &&
2649 	    (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) !=
2650 	    RTLLIB_STYPE_BEACON))
2651 		ieee->last_rx_ps_time = jiffies;
2652 
2653 	switch (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl))) {
2654 	case RTLLIB_STYPE_BEACON:
2655 		netdev_dbg(ieee->dev, "received BEACON (%d)\n",
2656 			   WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)));
2657 		rtllib_process_probe_response(
2658 				ieee, (struct rtllib_probe_response *)header,
2659 				stats);
2660 
2661 		if (ieee->sta_sleep || (ieee->ps != RTLLIB_PS_DISABLED &&
2662 		    ieee->iw_mode == IW_MODE_INFRA &&
2663 		    ieee->link_state == MAC80211_LINKED))
2664 			schedule_work(&ieee->ps_task);
2665 
2666 		break;
2667 
2668 	case RTLLIB_STYPE_PROBE_RESP:
2669 		netdev_dbg(ieee->dev, "received PROBE RESPONSE (%d)\n",
2670 			   WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)));
2671 		rtllib_process_probe_response(ieee,
2672 			      (struct rtllib_probe_response *)header, stats);
2673 		break;
2674 	case RTLLIB_STYPE_PROBE_REQ:
2675 		netdev_dbg(ieee->dev, "received PROBE REQUEST (%d)\n",
2676 			   WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)));
2677 		if ((ieee->softmac_features & IEEE_SOFTMAC_PROBERS) &&
2678 		    (ieee->iw_mode == IW_MODE_ADHOC &&
2679 		    ieee->link_state == MAC80211_LINKED))
2680 			rtllib_rx_probe_rq(ieee, skb);
2681 		break;
2682 	}
2683 }
2684