SAFE public projects git trees. - safe/jmp/linux-2.6/blob - drivers/staging/rtl8187se/ieee80211/ieee80211_rx.c

   1 /*
   2  * Original code based Host AP (software wireless LAN access point) driver
   3  * for Intersil Prism2/2.5/3 - hostap.o module, common routines
   4  *
   5  * Copyright (c) 2001-2002, SSH Communications Security Corp and Jouni Malinen
   6  * <jkmaline@cc.hut.fi>
   7  * Copyright (c) 2002-2003, Jouni Malinen <jkmaline@cc.hut.fi>
   8  * Copyright (c) 2004, Intel Corporation
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation. See README and COPYING for
  13  * more details.
  14  ******************************************************************************
  15
  16   Few modifications for Realtek's Wi-Fi drivers by
  17   Andrea Merello <andreamrl@tiscali.it>
  18
  19   A special thanks goes to Realtek for their support !
  20
  21 ******************************************************************************/
  22
  23
  24 #include <linux/compiler.h>
  25 //#include <linux/config.h>
  26 #include <linux/errno.h>
  27 #include <linux/if_arp.h>
  28 #include <linux/in6.h>
  29 #include <linux/in.h>
  30 #include <linux/ip.h>
  31 #include <linux/kernel.h>
  32 #include <linux/module.h>
  33 #include <linux/netdevice.h>
  34 #include <linux/pci.h>
  35 #include <linux/proc_fs.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/slab.h>
  38 #include <linux/tcp.h>
  39 #include <linux/types.h>
  40 #include <linux/version.h>
  41 #include <linux/wireless.h>
  42 #include <linux/etherdevice.h>
  43 #include <asm/uaccess.h>
  44 #include <linux/ctype.h>
  45
  46 #include "ieee80211.h"
  47 #include "dot11d.h"
  48 static inline void ieee80211_monitor_rx(struct ieee80211_device *ieee,
  49                                         struct sk_buff *skb,
  50                                         struct ieee80211_rx_stats *rx_stats)
  51 {
  52         struct ieee80211_hdr_4addr *hdr =
  53                 (struct ieee80211_hdr_4addr *)skb->data;
  54         u16 fc = le16_to_cpu(hdr->frame_ctl);
  55
  56         skb->dev = ieee->dev;
  57         skb_reset_mac_header(skb);
  58         skb_pull(skb, ieee80211_get_hdrlen(fc));
  59         skb->pkt_type = PACKET_OTHERHOST;
  60         skb->protocol = __constant_htons(ETH_P_80211_RAW);
  61         memset(skb->cb, 0, sizeof(skb->cb));
  62         netif_rx(skb);
  63 }
  64
  65
  66 /* Called only as a tasklet (software IRQ) */
  67 static struct ieee80211_frag_entry *
  68 ieee80211_frag_cache_find(struct ieee80211_device *ieee, unsigned int seq,
  69                           unsigned int frag, u8 tid,u8 *src, u8 *dst)
  70 {
  71         struct ieee80211_frag_entry *entry;
  72         int i;
  73
  74         for (i = 0; i < IEEE80211_FRAG_CACHE_LEN; i++) {
  75                 entry = &ieee->frag_cache[tid][i];
  76                 if (entry->skb != NULL &&
  77                     time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
  78                         IEEE80211_DEBUG_FRAG(
  79                                 "expiring fragment cache entry "
  80                                 "seq=%u last_frag=%u\n",
  81                                 entry->seq, entry->last_frag);
  82                         dev_kfree_skb_any(entry->skb);
  83                         entry->skb = NULL;
  84                 }
  85
  86                 if (entry->skb != NULL && entry->seq == seq &&
  87                     (entry->last_frag + 1 == frag || frag == -1) &&
  88                     memcmp(entry->src_addr, src, ETH_ALEN) == 0 &&
  89                     memcmp(entry->dst_addr, dst, ETH_ALEN) == 0)
  90                         return entry;
  91         }
  92
  93         return NULL;
  94 }
  95
  96 /* Called only as a tasklet (software IRQ) */
  97 static struct sk_buff *
  98 ieee80211_frag_cache_get(struct ieee80211_device *ieee,
  99                          struct ieee80211_hdr_4addr *hdr)
 100 {
 101         struct sk_buff *skb = NULL;
 102         u16 fc = le16_to_cpu(hdr->frame_ctl);
 103         u16 sc = le16_to_cpu(hdr->seq_ctl);
 104         unsigned int frag = WLAN_GET_SEQ_FRAG(sc);
 105         unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
 106         struct ieee80211_frag_entry *entry;
 107         struct ieee80211_hdr_3addrqos *hdr_3addrqos;
 108         struct ieee80211_hdr_QOS *hdr_4addr_QoS;
 109         u8 tid;
 110
 111         if (((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
 112           hdr_4addr_QoS = (struct ieee80211_hdr_QOS *)hdr;
 113           tid = le16_to_cpu(hdr_4addr_QoS->QOS_ctl) & IEEE80211_QOS_TID;
 114           tid = UP2AC(tid);
 115           tid ++;
 116         } else if (IEEE80211_QOS_HAS_SEQ(fc)) {
 117           hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
 118           tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
 119           tid = UP2AC(tid);
 120           tid ++;
 121         } else {
 122           tid = 0;
 123         }
 124
 125         if (frag == 0) {
 126                 /* Reserve enough space to fit maximum frame length */
 127                 skb = dev_alloc_skb(ieee->dev->mtu +
 128                                     sizeof(struct ieee80211_hdr_4addr) +
 129                                     8 /* LLC */ +
 130                                     2 /* alignment */ +
 131                                     8 /* WEP */ +
 132                                     ETH_ALEN /* WDS */ +
 133                                     (IEEE80211_QOS_HAS_SEQ(fc)?2:0) /* QOS Control */);
 134                 if (skb == NULL)
 135                         return NULL;
 136
 137                 entry = &ieee->frag_cache[tid][ieee->frag_next_idx[tid]];
 138                 ieee->frag_next_idx[tid]++;
 139                 if (ieee->frag_next_idx[tid] >= IEEE80211_FRAG_CACHE_LEN)
 140                         ieee->frag_next_idx[tid] = 0;
 141
 142                 if (entry->skb != NULL)
 143                         dev_kfree_skb_any(entry->skb);
 144
 145                 entry->first_frag_time = jiffies;
 146                 entry->seq = seq;
 147                 entry->last_frag = frag;
 148                 entry->skb = skb;
 149                 memcpy(entry->src_addr, hdr->addr2, ETH_ALEN);
 150                 memcpy(entry->dst_addr, hdr->addr1, ETH_ALEN);
 151         } else {
 152                 /* received a fragment of a frame for which the head fragment
 153                  * should have already been received */
 154                 entry = ieee80211_frag_cache_find(ieee, seq, frag, tid,hdr->addr2,
 155                                                   hdr->addr1);
 156                 if (entry != NULL) {
 157                         entry->last_frag = frag;
 158                         skb = entry->skb;
 159                 }
 160         }
 161
 162         return skb;
 163 }
 164
 165
 166 /* Called only as a tasklet (software IRQ) */
 167 static int ieee80211_frag_cache_invalidate(struct ieee80211_device *ieee,
 168                                            struct ieee80211_hdr_4addr *hdr)
 169 {
 170         u16 fc = le16_to_cpu(hdr->frame_ctl);
 171         u16 sc = le16_to_cpu(hdr->seq_ctl);
 172         unsigned int seq = WLAN_GET_SEQ_SEQ(sc);
 173         struct ieee80211_frag_entry *entry;
 174         struct ieee80211_hdr_3addrqos *hdr_3addrqos;
 175         struct ieee80211_hdr_QOS *hdr_4addr_QoS;
 176         u8 tid;
 177
 178         if(((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
 179           hdr_4addr_QoS = (struct ieee80211_hdr_QOS *)hdr;
 180           tid = le16_to_cpu(hdr_4addr_QoS->QOS_ctl) & IEEE80211_QOS_TID;
 181           tid = UP2AC(tid);
 182           tid ++;
 183         } else if (IEEE80211_QOS_HAS_SEQ(fc)) {
 184           hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)hdr;
 185           tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
 186           tid = UP2AC(tid);
 187           tid ++;
 188         } else {
 189           tid = 0;
 190         }
 191
 192         entry = ieee80211_frag_cache_find(ieee, seq, -1, tid,hdr->addr2,
 193                                           hdr->addr1);
 194
 195         if (entry == NULL) {
 196                 IEEE80211_DEBUG_FRAG(
 197                         "could not invalidate fragment cache "
 198                         "entry (seq=%u)\n", seq);
 199                 return -1;
 200         }
 201
 202         entry->skb = NULL;
 203         return 0;
 204 }
 205
 206
 207
 208 /* ieee80211_rx_frame_mgtmt
 209  *
 210  * Responsible for handling management control frames
 211  *
 212  * Called by ieee80211_rx */
 213 static inline int
 214 ieee80211_rx_frame_mgmt(struct ieee80211_device *ieee, struct sk_buff *skb,
 215                         struct ieee80211_rx_stats *rx_stats, u16 type,
 216                         u16 stype)
 217 {
 218         struct ieee80211_hdr_4addr *hdr;
 219
 220         // cheat the the hdr type
 221         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 222
 223         /* On the struct stats definition there is written that
 224          * this is not mandatory.... but seems that the probe
 225          * response parser uses it
 226          */
 227         rx_stats->len = skb->len;
 228         ieee80211_rx_mgt(ieee, (struct ieee80211_hdr_4addr *)skb->data,
 229                          rx_stats);
 230
 231         if((ieee->state == IEEE80211_LINKED)&&(memcmp(hdr->addr3,ieee->current_network.bssid,ETH_ALEN))) {
 232                 dev_kfree_skb_any(skb);
 233                 return 0;
 234         }
 235
 236         ieee80211_rx_frame_softmac(ieee, skb, rx_stats, type, stype);
 237
 238         dev_kfree_skb_any(skb);
 239
 240         return 0;
 241
 242 }
 243
 244
 245
 246 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 247 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
 248 static unsigned char rfc1042_header[] =
 249 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 250 /* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
 251 static unsigned char bridge_tunnel_header[] =
 252 { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8 };
 253 /* No encapsulation header if EtherType < 0x600 (=length) */
 254
 255 /* Called by ieee80211_rx_frame_decrypt */
 256 static int ieee80211_is_eapol_frame(struct ieee80211_device *ieee,
 257                                     struct sk_buff *skb, size_t hdrlen)
 258 {
 259         struct net_device *dev = ieee->dev;
 260         u16 fc, ethertype;
 261         struct ieee80211_hdr_4addr *hdr;
 262         u8 *pos;
 263
 264         if (skb->len < 24)
 265                 return 0;
 266
 267         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 268         fc = le16_to_cpu(hdr->frame_ctl);
 269
 270         /* check that the frame is unicast frame to us */
 271         if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
 272             IEEE80211_FCTL_TODS &&
 273             memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
 274             memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
 275                 /* ToDS frame with own addr BSSID and DA */
 276         } else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
 277                    IEEE80211_FCTL_FROMDS &&
 278                    memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
 279                 /* FromDS frame with own addr as DA */
 280         } else
 281                 return 0;
 282
 283         if (skb->len < 24 + 8)
 284                 return 0;
 285
 286         /* check for port access entity Ethernet type */
 287 //      pos = skb->data + 24;
 288         pos = skb->data + hdrlen;
 289         ethertype = (pos[6] << 8) | pos[7];
 290         if (ethertype == ETH_P_PAE)
 291                 return 1;
 292
 293         return 0;
 294 }
 295
 296 /* Called only as a tasklet (software IRQ), by ieee80211_rx */
 297 static inline int
 298 ieee80211_rx_frame_decrypt(struct ieee80211_device* ieee, struct sk_buff *skb,
 299                            struct ieee80211_crypt_data *crypt)
 300 {
 301         struct ieee80211_hdr_4addr *hdr;
 302         int res, hdrlen;
 303
 304         if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
 305                 return 0;
 306
 307         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 308         hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
 309
 310 #ifdef CONFIG_IEEE80211_CRYPT_TKIP
 311         if (ieee->tkip_countermeasures &&
 312             strcmp(crypt->ops->name, "TKIP") == 0) {
 313                 if (net_ratelimit()) {
 314                         printk(KERN_DEBUG "%s: TKIP countermeasures: dropped "
 315                                "received packet from " MAC_FMT "\n",
 316                                ieee->dev->name, MAC_ARG(hdr->addr2));
 317                 }
 318                 return -1;
 319         }
 320 #endif
 321
 322         atomic_inc(&crypt->refcnt);
 323         res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
 324         atomic_dec(&crypt->refcnt);
 325         if (res < 0) {
 326                 IEEE80211_DEBUG_DROP(
 327                         "decryption failed (SA=" MAC_FMT
 328                         ") res=%d\n", MAC_ARG(hdr->addr2), res);
 329                 if (res == -2)
 330                         IEEE80211_DEBUG_DROP("Decryption failed ICV "
 331                                              "mismatch (key %d)\n",
 332                                              skb->data[hdrlen + 3] >> 6);
 333                 ieee->ieee_stats.rx_discards_undecryptable++;
 334                 return -1;
 335         }
 336
 337         return res;
 338 }
 339
 340
 341 /* Called only as a tasklet (software IRQ), by ieee80211_rx */
 342 static inline int
 343 ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device* ieee, struct sk_buff *skb,
 344                              int keyidx, struct ieee80211_crypt_data *crypt)
 345 {
 346         struct ieee80211_hdr_4addr *hdr;
 347         int res, hdrlen;
 348
 349         if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
 350                 return 0;
 351
 352         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 353         hdrlen = ieee80211_get_hdrlen(le16_to_cpu(hdr->frame_ctl));
 354
 355         atomic_inc(&crypt->refcnt);
 356         res = crypt->ops->decrypt_msdu(skb, keyidx, hdrlen, crypt->priv);
 357         atomic_dec(&crypt->refcnt);
 358         if (res < 0) {
 359                 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
 360                        " (SA=" MAC_FMT " keyidx=%d)\n",
 361                        ieee->dev->name, MAC_ARG(hdr->addr2), keyidx);
 362                 return -1;
 363         }
 364
 365         return 0;
 366 }
 367
 368
 369 /* this function is stolen from ipw2200 driver*/
 370 #define IEEE_PACKET_RETRY_TIME (5*HZ)
 371 static int is_duplicate_packet(struct ieee80211_device *ieee,
 372                                       struct ieee80211_hdr_4addr *header)
 373 {
 374         u16 fc = le16_to_cpu(header->frame_ctl);
 375         u16 sc = le16_to_cpu(header->seq_ctl);
 376         u16 seq = WLAN_GET_SEQ_SEQ(sc);
 377         u16 frag = WLAN_GET_SEQ_FRAG(sc);
 378         u16 *last_seq, *last_frag;
 379         unsigned long *last_time;
 380         struct ieee80211_hdr_3addrqos *hdr_3addrqos;
 381         struct ieee80211_hdr_QOS *hdr_4addr_QoS;
 382         u8 tid;
 383
 384         //TO2DS and QoS
 385         if(((fc & IEEE80211_FCTL_DSTODS) == IEEE80211_FCTL_DSTODS)&&IEEE80211_QOS_HAS_SEQ(fc)) {
 386           hdr_4addr_QoS = (struct ieee80211_hdr_QOS *)header;
 387           tid = le16_to_cpu(hdr_4addr_QoS->QOS_ctl) & IEEE80211_QOS_TID;
 388           tid = UP2AC(tid);
 389           tid ++;
 390         } else if(IEEE80211_QOS_HAS_SEQ(fc)) { //QoS
 391           hdr_3addrqos = (struct ieee80211_hdr_3addrqos *)header;
 392           tid = le16_to_cpu(hdr_3addrqos->qos_ctl) & IEEE80211_QOS_TID;
 393           tid = UP2AC(tid);
 394           tid ++;
 395         } else { // no QoS
 396           tid = 0;
 397         }
 398         switch (ieee->iw_mode) {
 399         case IW_MODE_ADHOC:
 400         {
 401                 struct list_head *p;
 402                 struct ieee_ibss_seq *entry = NULL;
 403                 u8 *mac = header->addr2;
 404                 int index = mac[5] % IEEE_IBSS_MAC_HASH_SIZE;
 405                 //for (pos = (head)->next; pos != (head); pos = pos->next)
 406                 __list_for_each(p, &ieee->ibss_mac_hash[index]) {
 407                         entry = list_entry(p, struct ieee_ibss_seq, list);
 408                         if (!memcmp(entry->mac, mac, ETH_ALEN))
 409                                 break;
 410                 }
 411         //      if (memcmp(entry->mac, mac, ETH_ALEN)){
 412                 if (p == &ieee->ibss_mac_hash[index]) {
 413                         entry = kmalloc(sizeof(struct ieee_ibss_seq), GFP_ATOMIC);
 414                         if (!entry) {
 415                                 printk(KERN_WARNING "Cannot malloc new mac entry\n");
 416                                 return 0;
 417                         }
 418                         memcpy(entry->mac, mac, ETH_ALEN);
 419                         entry->seq_num[tid] = seq;
 420                         entry->frag_num[tid] = frag;
 421                         entry->packet_time[tid] = jiffies;
 422                         list_add(&entry->list, &ieee->ibss_mac_hash[index]);
 423                         return 0;
 424                 }
 425                 last_seq = &entry->seq_num[tid];
 426                 last_frag = &entry->frag_num[tid];
 427                 last_time = &entry->packet_time[tid];
 428                 break;
 429         }
 430
 431         case IW_MODE_INFRA:
 432                 last_seq = &ieee->last_rxseq_num[tid];
 433                 last_frag = &ieee->last_rxfrag_num[tid];
 434                 last_time = &ieee->last_packet_time[tid];
 435
 436                 break;
 437         default:
 438                 return 0;
 439         }
 440
 441 //      if(tid != 0) {
 442 //              printk(KERN_WARNING ":)))))))))))%x %x %x, fc(%x)\n", tid, *last_seq, seq, header->frame_ctl);
 443 //      }
 444         if ((*last_seq == seq) &&
 445             time_after(*last_time + IEEE_PACKET_RETRY_TIME, jiffies)) {
 446                 if (*last_frag == frag){
 447                         //printk(KERN_WARNING "[1] go drop!\n");
 448                         goto drop;
 449
 450                 }
 451                 if (*last_frag + 1 != frag)
 452                         /* out-of-order fragment */
 453                         //printk(KERN_WARNING "[2] go drop!\n");
 454                         goto drop;
 455         } else
 456                 *last_seq = seq;
 457
 458         *last_frag = frag;
 459         *last_time = jiffies;
 460         return 0;
 461
 462 drop:
 463 //      BUG_ON(!(fc & IEEE80211_FCTL_RETRY));
 464 //      printk("DUP\n");
 465
 466         return 1;
 467 }
 468
 469
 470 /* All received frames are sent to this function. @skb contains the frame in
 471  * IEEE 802.11 format, i.e., in the format it was sent over air.
 472  * This function is called only as a tasklet (software IRQ). */
 473 int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
 474                  struct ieee80211_rx_stats *rx_stats)
 475 {
 476         struct net_device *dev = ieee->dev;
 477         //struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
 478         struct ieee80211_hdr_4addr *hdr;
 479
 480         size_t hdrlen;
 481         u16 fc, type, stype, sc;
 482         struct net_device_stats *stats;
 483         unsigned int frag;
 484         u8 *payload;
 485         u16 ethertype;
 486         u8 dst[ETH_ALEN];
 487         u8 src[ETH_ALEN];
 488         u8 bssid[ETH_ALEN];
 489         struct ieee80211_crypt_data *crypt = NULL;
 490         int keyidx = 0;
 491
 492         // cheat the the hdr type
 493         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 494         stats = &ieee->stats;
 495
 496         if (skb->len < 10) {
 497                 printk(KERN_INFO "%s: SKB length < 10\n",
 498                        dev->name);
 499                 goto rx_dropped;
 500         }
 501
 502         fc = le16_to_cpu(hdr->frame_ctl);
 503         type = WLAN_FC_GET_TYPE(fc);
 504         stype = WLAN_FC_GET_STYPE(fc);
 505         sc = le16_to_cpu(hdr->seq_ctl);
 506
 507         frag = WLAN_GET_SEQ_FRAG(sc);
 508
 509 //YJ,add,080828,for keep alive
 510         if((fc & IEEE80211_FCTL_TODS) != IEEE80211_FCTL_TODS)
 511         {
 512                 if(!memcmp(hdr->addr1,dev->dev_addr, ETH_ALEN))
 513                 {
 514                         ieee->NumRxUnicast++;
 515                 }
 516         }
 517         else
 518         {
 519                 if(!memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN))
 520                 {
 521                         ieee->NumRxUnicast++;
 522                 }
 523         }
 524 //YJ,add,080828,for keep alive,end
 525
 526         hdrlen = ieee80211_get_hdrlen(fc);
 527
 528
 529         if (ieee->iw_mode == IW_MODE_MONITOR) {
 530                 ieee80211_monitor_rx(ieee, skb, rx_stats);
 531                 stats->rx_packets++;
 532                 stats->rx_bytes += skb->len;
 533                 return 1;
 534         }
 535
 536         if (ieee->host_decrypt) {
 537                 int idx = 0;
 538                 if (skb->len >= hdrlen + 3)
 539                         idx = skb->data[hdrlen + 3] >> 6;
 540                 crypt = ieee->crypt[idx];
 541
 542                 /* allow NULL decrypt to indicate an station specific override
 543                  * for default encryption */
 544                 if (crypt && (crypt->ops == NULL ||
 545                               crypt->ops->decrypt_mpdu == NULL))
 546                         crypt = NULL;
 547
 548                 if (!crypt && (fc & IEEE80211_FCTL_WEP)) {
 549                         /* This seems to be triggered by some (multicast?)
 550                          * frames from other than current BSS, so just drop the
 551                          * frames silently instead of filling system log with
 552                          * these reports. */
 553                         IEEE80211_DEBUG_DROP("Decryption failed (not set)"
 554                                              " (SA=" MAC_FMT ")\n",
 555                                              MAC_ARG(hdr->addr2));
 556                         ieee->ieee_stats.rx_discards_undecryptable++;
 557                         goto rx_dropped;
 558                 }
 559         }
 560
 561         if (skb->len < IEEE80211_DATA_HDR3_LEN)
 562                 goto rx_dropped;
 563
 564         // if QoS enabled, should check the sequence for each of the AC
 565         if (is_duplicate_packet(ieee, hdr))
 566                 goto rx_dropped;
 567
 568
 569         if (type == IEEE80211_FTYPE_MGMT) {
 570                 if (ieee80211_rx_frame_mgmt(ieee, skb, rx_stats, type, stype))
 571                         goto rx_dropped;
 572                 else
 573                         goto rx_exit;
 574         }
 575
 576         /* Data frame - extract src/dst addresses */
 577         switch (fc & (IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS)) {
 578         case IEEE80211_FCTL_FROMDS:
 579                 memcpy(dst, hdr->addr1, ETH_ALEN);
 580                 memcpy(src, hdr->addr3, ETH_ALEN);
 581                 memcpy(bssid,hdr->addr2,ETH_ALEN);
 582                 break;
 583         case IEEE80211_FCTL_TODS:
 584                 memcpy(dst, hdr->addr3, ETH_ALEN);
 585                 memcpy(src, hdr->addr2, ETH_ALEN);
 586                 memcpy(bssid,hdr->addr1,ETH_ALEN);
 587                 break;
 588         case IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS:
 589                 if (skb->len < IEEE80211_DATA_HDR4_LEN)
 590                         goto rx_dropped;
 591                 memcpy(dst, hdr->addr3, ETH_ALEN);
 592                 memcpy(src, hdr->addr4, ETH_ALEN);
 593                 memcpy(bssid, ieee->current_network.bssid, ETH_ALEN);
 594                 break;
 595         case 0:
 596                 memcpy(dst, hdr->addr1, ETH_ALEN);
 597                 memcpy(src, hdr->addr2, ETH_ALEN);
 598                 memcpy(bssid,hdr->addr3,ETH_ALEN);
 599                 break;
 600         }
 601
 602
 603         dev->last_rx = jiffies;
 604
 605
 606         /* Nullfunc frames may have PS-bit set, so they must be passed to
 607          * hostap_handle_sta_rx() before being dropped here. */
 608         if (stype != IEEE80211_STYPE_DATA &&
 609             stype != IEEE80211_STYPE_DATA_CFACK &&
 610             stype != IEEE80211_STYPE_DATA_CFPOLL &&
 611             stype != IEEE80211_STYPE_DATA_CFACKPOLL&&
 612             stype != IEEE80211_STYPE_QOS_DATA//add by David,2006.8.4
 613             ) {
 614                 if (stype != IEEE80211_STYPE_NULLFUNC)
 615                         IEEE80211_DEBUG_DROP(
 616                                 "RX: dropped data frame "
 617                                 "with no data (type=0x%02x, "
 618                                 "subtype=0x%02x, len=%d)\n",
 619                                 type, stype, skb->len);
 620                 goto rx_dropped;
 621         }
 622         if(memcmp(bssid,ieee->current_network.bssid,ETH_ALEN)) {
 623                 goto rx_dropped;
 624         }
 625
 626         ieee->NumRxDataInPeriod++;
 627         ieee->NumRxOkTotal++;
 628         /* skb: hdr + (possibly fragmented, possibly encrypted) payload */
 629
 630         if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
 631             (keyidx = ieee80211_rx_frame_decrypt(ieee, skb, crypt)) < 0)
 632                 goto rx_dropped;
 633
 634         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 635
 636         /* skb: hdr + (possibly fragmented) plaintext payload */
 637         // PR: FIXME: hostap has additional conditions in the "if" below:
 638         // ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
 639         if ((frag != 0 || (fc & IEEE80211_FCTL_MOREFRAGS))) {
 640                 int flen;
 641                 struct sk_buff *frag_skb = ieee80211_frag_cache_get(ieee, hdr);
 642                 IEEE80211_DEBUG_FRAG("Rx Fragment received (%u)\n", frag);
 643
 644                 if (!frag_skb) {
 645                         IEEE80211_DEBUG(IEEE80211_DL_RX | IEEE80211_DL_FRAG,
 646                                         "Rx cannot get skb from fragment "
 647                                         "cache (morefrag=%d seq=%u frag=%u)\n",
 648                                         (fc & IEEE80211_FCTL_MOREFRAGS) != 0,
 649                                         WLAN_GET_SEQ_SEQ(sc), frag);
 650                         goto rx_dropped;
 651                 }
 652                 flen = skb->len;
 653                 if (frag != 0)
 654                         flen -= hdrlen;
 655
 656                 if (frag_skb->tail + flen > frag_skb->end) {
 657                         printk(KERN_WARNING "%s: host decrypted and "
 658                                "reassembled frame did not fit skb\n",
 659                                dev->name);
 660                         ieee80211_frag_cache_invalidate(ieee, hdr);
 661                         goto rx_dropped;
 662                 }
 663
 664                 if (frag == 0) {
 665                         /* copy first fragment (including full headers) into
 666                          * beginning of the fragment cache skb */
 667                         memcpy(skb_put(frag_skb, flen), skb->data, flen);
 668                 } else {
 669                         /* append frame payload to the end of the fragment
 670                          * cache skb */
 671                         memcpy(skb_put(frag_skb, flen), skb->data + hdrlen,
 672                                flen);
 673                 }
 674                 dev_kfree_skb_any(skb);
 675                 skb = NULL;
 676
 677                 if (fc & IEEE80211_FCTL_MOREFRAGS) {
 678                         /* more fragments expected - leave the skb in fragment
 679                          * cache for now; it will be delivered to upper layers
 680                          * after all fragments have been received */
 681                         goto rx_exit;
 682                 }
 683
 684                 /* this was the last fragment and the frame will be
 685                  * delivered, so remove skb from fragment cache */
 686                 skb = frag_skb;
 687                 hdr = (struct ieee80211_hdr_4addr *)skb->data;
 688                 ieee80211_frag_cache_invalidate(ieee, hdr);
 689         }
 690
 691         /* skb: hdr + (possible reassembled) full MSDU payload; possibly still
 692          * encrypted/authenticated */
 693         if (ieee->host_decrypt && (fc & IEEE80211_FCTL_WEP) &&
 694             ieee80211_rx_frame_decrypt_msdu(ieee, skb, keyidx, crypt))
 695                 goto rx_dropped;
 696
 697         hdr = (struct ieee80211_hdr_4addr *)skb->data;
 698         if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep) {
 699                 if (/*ieee->ieee802_1x &&*/
 700                     ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
 701
 702 #ifdef CONFIG_IEEE80211_DEBUG
 703                         /* pass unencrypted EAPOL frames even if encryption is
 704                          * configured */
 705                         struct eapol *eap = (struct eapol *)(skb->data +
 706                                 24);
 707                         IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
 708                                                 eap_get_type(eap->type));
 709 #endif
 710                 } else {
 711                         IEEE80211_DEBUG_DROP(
 712                                 "encryption configured, but RX "
 713                                 "frame not encrypted (SA=" MAC_FMT ")\n",
 714                                 MAC_ARG(hdr->addr2));
 715                         goto rx_dropped;
 716                 }
 717         }
 718
 719 #ifdef CONFIG_IEEE80211_DEBUG
 720         if (crypt && !(fc & IEEE80211_FCTL_WEP) &&
 721             ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
 722                         struct eapol *eap = (struct eapol *)(skb->data +
 723                                 24);
 724                         IEEE80211_DEBUG_EAP("RX: IEEE 802.1X EAPOL frame: %s\n",
 725                                                 eap_get_type(eap->type));
 726         }
 727 #endif
 728
 729         if (crypt && !(fc & IEEE80211_FCTL_WEP) && !ieee->open_wep &&
 730             !ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
 731                 IEEE80211_DEBUG_DROP(
 732                         "dropped unencrypted RX data "
 733                         "frame from " MAC_FMT
 734                         " (drop_unencrypted=1)\n",
 735                         MAC_ARG(hdr->addr2));
 736                 goto rx_dropped;
 737         }
 738 /*
 739         if(ieee80211_is_eapol_frame(ieee, skb, hdrlen)) {
 740                 printk(KERN_WARNING "RX: IEEE802.1X EPAOL frame!\n");
 741         }
 742 */
 743         /* skb: hdr + (possible reassembled) full plaintext payload */
 744         payload = skb->data + hdrlen;
 745         ethertype = (payload[6] << 8) | payload[7];
 746
 747
 748         /* convert hdr + possible LLC headers into Ethernet header */
 749         if (skb->len - hdrlen >= 8 &&
 750             ((memcmp(payload, rfc1042_header, SNAP_SIZE) == 0 &&
 751               ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
 752              memcmp(payload, bridge_tunnel_header, SNAP_SIZE) == 0)) {
 753                 /* remove RFC1042 or Bridge-Tunnel encapsulation and
 754                  * replace EtherType */
 755                 skb_pull(skb, hdrlen + SNAP_SIZE);
 756                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
 757                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
 758         } else {
 759                 u16 len;
 760                 /* Leave Ethernet header part of hdr and full payload */
 761                 skb_pull(skb, hdrlen);
 762                 len = htons(skb->len);
 763                 memcpy(skb_push(skb, 2), &len, 2);
 764                 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
 765                 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
 766         }
 767
 768
 769         stats->rx_packets++;
 770         stats->rx_bytes += skb->len;
 771
 772         if (skb) {
 773                 skb->protocol = eth_type_trans(skb, dev);
 774                 memset(skb->cb, 0, sizeof(skb->cb));
 775                 skb->dev = dev;
 776                 skb->ip_summed = CHECKSUM_NONE; /* 802.11 crc not sufficient */
 777                 ieee->last_rx_ps_time = jiffies;
 778                 netif_rx(skb);
 779         }
 780
 781  rx_exit:
 782         return 1;
 783
 784  rx_dropped:
 785         stats->rx_dropped++;
 786
 787         /* Returning 0 indicates to caller that we have not handled the SKB--
 788          * so it is still allocated and can be used again by underlying
 789          * hardware as a DMA target */
 790         return 0;
 791 }
 792
 793 #define MGMT_FRAME_FIXED_PART_LENGTH            0x24
 794
 795 static inline int ieee80211_is_ofdm_rate(u8 rate)
 796 {
 797         switch (rate & ~IEEE80211_BASIC_RATE_MASK) {
 798         case IEEE80211_OFDM_RATE_6MB:
 799         case IEEE80211_OFDM_RATE_9MB:
 800         case IEEE80211_OFDM_RATE_12MB:
 801         case IEEE80211_OFDM_RATE_18MB:
 802         case IEEE80211_OFDM_RATE_24MB:
 803         case IEEE80211_OFDM_RATE_36MB:
 804         case IEEE80211_OFDM_RATE_48MB:
 805         case IEEE80211_OFDM_RATE_54MB:
 806                 return 1;
 807         }
 808         return 0;
 809 }
 810
 811 static inline int ieee80211_SignalStrengthTranslate(
 812         int  CurrSS
 813         )
 814 {
 815         int RetSS;
 816
 817         // Step 1. Scale mapping.
 818         if(CurrSS >= 71 && CurrSS <= 100)
 819         {
 820                 RetSS = 90 + ((CurrSS - 70) / 3);
 821         }
 822         else if(CurrSS >= 41 && CurrSS <= 70)
 823         {
 824                 RetSS = 78 + ((CurrSS - 40) / 3);
 825         }
 826         else if(CurrSS >= 31 && CurrSS <= 40)
 827         {
 828                 RetSS = 66 + (CurrSS - 30);
 829         }
 830         else if(CurrSS >= 21 && CurrSS <= 30)
 831         {
 832                 RetSS = 54 + (CurrSS - 20);
 833         }
 834         else if(CurrSS >= 5 && CurrSS <= 20)
 835         {
 836                 RetSS = 42 + (((CurrSS - 5) * 2) / 3);
 837         }
 838         else if(CurrSS == 4)
 839         {
 840                 RetSS = 36;
 841         }
 842         else if(CurrSS == 3)
 843         {
 844                 RetSS = 27;
 845         }
 846         else if(CurrSS == 2)
 847         {
 848                 RetSS = 18;
 849         }
 850         else if(CurrSS == 1)
 851         {
 852                 RetSS = 9;
 853         }
 854         else
 855         {
 856                 RetSS = CurrSS;
 857         }
 858         //RT_TRACE(COMP_DBG, DBG_LOUD, ("##### After Mapping:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
 859
 860         // Step 2. Smoothing.
 861
 862         //RT_TRACE(COMP_DBG, DBG_LOUD, ("$$$$$ After Smoothing:  LastSS: %d, CurrSS: %d, RetSS: %d\n", LastSS, CurrSS, RetSS));
 863
 864         return RetSS;
 865 }
 866
 867 static inline void ieee80211_extract_country_ie(
 868         struct ieee80211_device *ieee,
 869         struct ieee80211_info_element *info_element,
 870         struct ieee80211_network *network,
 871         u8 * addr2
 872 )
 873 {
 874         if(IS_DOT11D_ENABLE(ieee))
 875         {
 876                 if(info_element->len!= 0)
 877                 {
 878                         memcpy(network->CountryIeBuf, info_element->data, info_element->len);
 879                         network->CountryIeLen = info_element->len;
 880
 881                         if(!IS_COUNTRY_IE_VALID(ieee))
 882                         {
 883                                 Dot11d_UpdateCountryIe(ieee, addr2, info_element->len, info_element->data);
 884                         }
 885                 }
 886
 887                 //
 888                 // 070305, rcnjko: I update country IE watch dog here because
 889                 // some AP (e.g. Cisco 1242) don't include country IE in their
 890                 // probe response frame.
 891                 //
 892                 if(IS_EQUAL_CIE_SRC(ieee, addr2) )
 893                 {
 894                         UPDATE_CIE_WATCHDOG(ieee);
 895                 }
 896         }
 897
 898 }
 899
 900 int
 901 ieee80211_TranslateToDbm(
 902         unsigned char SignalStrengthIndex       // 0-100 index.
 903         )
 904 {
 905         unsigned char SignalPower; // in dBm.
 906
 907         // Translate to dBm (x=0.5y-95).
 908         SignalPower = (int)SignalStrengthIndex * 7 / 10;
 909         SignalPower -= 95;
 910
 911         return SignalPower;
 912 }
 913 inline int ieee80211_network_init(
 914         struct ieee80211_device *ieee,
 915         struct ieee80211_probe_response *beacon,
 916         struct ieee80211_network *network,
 917         struct ieee80211_rx_stats *stats)
 918 {
 919 #ifdef CONFIG_IEEE80211_DEBUG
 920         char rates_str[64];
 921         char *p;
 922 #endif
 923         struct ieee80211_info_element *info_element;
 924         u16 left;
 925         u8 i;
 926         short offset;
 927         u8 curRate = 0,hOpRate = 0,curRate_ex = 0;
 928
 929         /* Pull out fixed field data */
 930         memcpy(network->bssid, beacon->header.addr3, ETH_ALEN);
 931         network->capability = beacon->capability;
 932         network->last_scanned = jiffies;
 933         network->time_stamp[0] = beacon->time_stamp[0];
 934         network->time_stamp[1] = beacon->time_stamp[1];
 935         network->beacon_interval = beacon->beacon_interval;
 936         /* Where to pull this? beacon->listen_interval;*/
 937         network->listen_interval = 0x0A;
 938         network->rates_len = network->rates_ex_len = 0;
 939         network->last_associate = 0;
 940         network->ssid_len = 0;
 941         network->flags = 0;
 942         network->atim_window = 0;
 943         network->QoS_Enable = 0;
 944 //by amy 080312
 945         network->HighestOperaRate = 0;
 946 //by amy 080312
 947         network->Turbo_Enable = 0;
 948         network->CountryIeLen = 0;
 949         memset(network->CountryIeBuf, 0, MAX_IE_LEN);
 950
 951         if (stats->freq == IEEE80211_52GHZ_BAND) {
 952                 /* for A band (No DS info) */
 953                 network->channel = stats->received_channel;
 954         } else
 955                 network->flags |= NETWORK_HAS_CCK;
 956
 957         network->wpa_ie_len = 0;
 958         network->rsn_ie_len = 0;
 959
 960         info_element = &beacon->info_element;
 961         left = stats->len - ((void *)info_element - (void *)beacon);
 962         while (left >= sizeof(struct ieee80211_info_element_hdr)) {
 963                 if (sizeof(struct ieee80211_info_element_hdr) + info_element->len > left) {
 964                         IEEE80211_DEBUG_SCAN("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%d left=%d.\n",
 965                                              info_element->len + sizeof(struct ieee80211_info_element),
 966                                              left);
 967                         return 1;
 968                 }
 969
 970                 switch (info_element->id) {
 971                 case MFIE_TYPE_SSID:
 972                         if (ieee80211_is_empty_essid(info_element->data,
 973                                                      info_element->len)) {
 974                                 network->flags |= NETWORK_EMPTY_ESSID;
 975                                 break;
 976                         }
 977
 978                         network->ssid_len = min(info_element->len,
 979                                                 (u8)IW_ESSID_MAX_SIZE);
 980                         memcpy(network->ssid, info_element->data, network->ssid_len);
 981                         if (network->ssid_len < IW_ESSID_MAX_SIZE)
 982                                 memset(network->ssid + network->ssid_len, 0,
 983                                        IW_ESSID_MAX_SIZE - network->ssid_len);
 984
 985                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_SSID: '%s' len=%d.\n",
 986                                              network->ssid, network->ssid_len);
 987                         break;
 988
 989                 case MFIE_TYPE_RATES:
 990 #ifdef CONFIG_IEEE80211_DEBUG
 991                         p = rates_str;
 992 #endif
 993                         network->rates_len = min(info_element->len, MAX_RATES_LENGTH);
 994                         for (i = 0; i < network->rates_len; i++) {
 995                                 network->rates[i] = info_element->data[i];
 996                                 curRate = network->rates[i] & 0x7f;
 997                                 if( hOpRate < curRate )
 998                                         hOpRate = curRate;
 999 #ifdef CONFIG_IEEE80211_DEBUG
1000                                 p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
1001 #endif
1002                                 if (ieee80211_is_ofdm_rate(info_element->data[i])) {
1003                                         network->flags |= NETWORK_HAS_OFDM;
1004                                         if (info_element->data[i] &
1005                                             IEEE80211_BASIC_RATE_MASK)
1006                                                 network->flags &=
1007                                                         ~NETWORK_HAS_CCK;
1008                                 }
1009                         }
1010
1011                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES: '%s' (%d)\n",
1012                                              rates_str, network->rates_len);
1013                         break;
1014
1015                 case MFIE_TYPE_RATES_EX:
1016 #ifdef CONFIG_IEEE80211_DEBUG
1017                         p = rates_str;
1018 #endif
1019                         network->rates_ex_len = min(info_element->len, MAX_RATES_EX_LENGTH);
1020                         for (i = 0; i < network->rates_ex_len; i++) {
1021                                 network->rates_ex[i] = info_element->data[i];
1022                                 curRate_ex = network->rates_ex[i] & 0x7f;
1023                                 if( hOpRate < curRate_ex )
1024                                         hOpRate = curRate_ex;
1025 #ifdef CONFIG_IEEE80211_DEBUG
1026                                 p += snprintf(p, sizeof(rates_str) - (p - rates_str), "%02X ", network->rates[i]);
1027 #endif
1028                                 if (ieee80211_is_ofdm_rate(info_element->data[i])) {
1029                                         network->flags |= NETWORK_HAS_OFDM;
1030                                         if (info_element->data[i] &
1031                                             IEEE80211_BASIC_RATE_MASK)
1032                                                 network->flags &=
1033                                                         ~NETWORK_HAS_CCK;
1034                                 }
1035                         }
1036
1037                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_RATES_EX: '%s' (%d)\n",
1038                                              rates_str, network->rates_ex_len);
1039                         break;
1040
1041                 case MFIE_TYPE_DS_SET:
1042                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_DS_SET: %d\n",
1043                                              info_element->data[0]);
1044                         if (stats->freq == IEEE80211_24GHZ_BAND)
1045                                 network->channel = info_element->data[0];
1046                         break;
1047
1048                 case MFIE_TYPE_FH_SET:
1049                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_FH_SET: ignored\n");
1050                         break;
1051
1052                 case MFIE_TYPE_CF_SET:
1053                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_CF_SET: ignored\n");
1054                         break;
1055
1056                 case MFIE_TYPE_TIM:
1057
1058                         if(info_element->len < 4)
1059                                 break;
1060
1061                         network->dtim_period = info_element->data[1];
1062
1063                         if(ieee->state != IEEE80211_LINKED)
1064                                 break;
1065
1066                         network->last_dtim_sta_time[0] = jiffies;
1067                         network->last_dtim_sta_time[1] = stats->mac_time[1];
1068
1069                         network->dtim_data = IEEE80211_DTIM_VALID;
1070
1071                         if(info_element->data[0] != 0)
1072                                 break;
1073
1074                         if(info_element->data[2] & 1)
1075                                 network->dtim_data |= IEEE80211_DTIM_MBCAST;
1076
1077                         offset = (info_element->data[2] >> 1)*2;
1078
1079                         //printk("offset1:%x aid:%x\n",offset, ieee->assoc_id);
1080
1081                         /* add and modified for ps 2008.1.22 */
1082                         if(ieee->assoc_id < 8*offset ||
1083                                 ieee->assoc_id > 8*(offset + info_element->len -3)) {
1084                                 break;
1085                         }
1086
1087                         offset = (ieee->assoc_id/8) - offset;// + ((aid % 8)? 0 : 1) ;
1088
1089                 //      printk("offset:%x data:%x, ucast:%d\n", offset,
1090                         //      info_element->data[3+offset] ,
1091                         //      info_element->data[3+offset] & (1<<(ieee->assoc_id%8)));
1092
1093                         if(info_element->data[3+offset] & (1<<(ieee->assoc_id%8))) {
1094                                 network->dtim_data |= IEEE80211_DTIM_UCAST;
1095                         }
1096                         break;
1097
1098                 case MFIE_TYPE_IBSS_SET:
1099                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_IBSS_SET: ignored\n");
1100                         break;
1101
1102                 case MFIE_TYPE_CHALLENGE:
1103                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_CHALLENGE: ignored\n");
1104                         break;
1105
1106                 case MFIE_TYPE_GENERIC:
1107                         //nic is 87B
1108                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_GENERIC: %d bytes\n",
1109                                              info_element->len);
1110                         if (info_element->len >= 4  &&
1111                             info_element->data[0] == 0x00 &&
1112                             info_element->data[1] == 0x50 &&
1113                             info_element->data[2] == 0xf2 &&
1114                             info_element->data[3] == 0x01) {
1115                                 network->wpa_ie_len = min(info_element->len + 2,
1116                                                          MAX_WPA_IE_LEN);
1117                                 memcpy(network->wpa_ie, info_element,
1118                                        network->wpa_ie_len);
1119                         }
1120
1121                         if (info_element->len == 7 &&
1122                             info_element->data[0] == 0x00 &&
1123                             info_element->data[1] == 0xe0 &&
1124                             info_element->data[2] == 0x4c &&
1125                             info_element->data[3] == 0x01 &&
1126                             info_element->data[4] == 0x02) {
1127                                 network->Turbo_Enable = 1;
1128                         }
1129                         if (1 == stats->nic_type) {//nic 87
1130                                 break;
1131                         }
1132
1133                         if (info_element->len >= 5  &&
1134                             info_element->data[0] == 0x00 &&
1135                             info_element->data[1] == 0x50 &&
1136                             info_element->data[2] == 0xf2 &&
1137                             info_element->data[3] == 0x02 &&
1138                             info_element->data[4] == 0x00) {
1139                                 //printk(KERN_WARNING "wmm info updated: %x\n", info_element->data[6]);
1140                                 //WMM Information Element
1141                                 network->wmm_info = info_element->data[6];
1142                                 network->QoS_Enable = 1;
1143                         }
1144
1145                         if (info_element->len >= 8  &&
1146                             info_element->data[0] == 0x00 &&
1147                             info_element->data[1] == 0x50 &&
1148                             info_element->data[2] == 0xf2 &&
1149                             info_element->data[3] == 0x02 &&
1150                             info_element->data[4] == 0x01) {
1151                                 // Not care about version at present.
1152                                 //WMM Information Element
1153                                 //printk(KERN_WARNING "wmm info&param updated: %x\n", info_element->data[6]);
1154                                 network->wmm_info = info_element->data[6];
1155                                 //WMM Parameter Element
1156                                 memcpy(network->wmm_param, (u8 *)(info_element->data + 8),(info_element->len - 8));
1157                                 network->QoS_Enable = 1;
1158                         }
1159                         break;
1160
1161                 case MFIE_TYPE_RSN:
1162                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_RSN: %d bytes\n",
1163                                              info_element->len);
1164                         network->rsn_ie_len = min(info_element->len + 2,
1165                                                  MAX_WPA_IE_LEN);
1166                         memcpy(network->rsn_ie, info_element,
1167                                network->rsn_ie_len);
1168                         break;
1169                 case MFIE_TYPE_COUNTRY:
1170                         IEEE80211_DEBUG_SCAN("MFIE_TYPE_COUNTRY: %d bytes\n",
1171                                              info_element->len);
1172 //                      printk("=====>Receive <%s> Country IE\n",network->ssid);
1173                         ieee80211_extract_country_ie(ieee, info_element, network, beacon->header.addr2);
1174                         break;
1175                 default:
1176                         IEEE80211_DEBUG_SCAN("unsupported IE %d\n",
1177                                              info_element->id);
1178                         break;
1179                 }
1180
1181                 left -= sizeof(struct ieee80211_info_element_hdr) +
1182                         info_element->len;
1183                 info_element = (struct ieee80211_info_element *)
1184                         &info_element->data[info_element->len];
1185         }
1186 //by amy 080312
1187         network->HighestOperaRate = hOpRate;
1188 //by amy 080312
1189         network->mode = 0;
1190         if (stats->freq == IEEE80211_52GHZ_BAND)
1191                 network->mode = IEEE_A;
1192         else {
1193                 if (network->flags & NETWORK_HAS_OFDM)
1194                         network->mode |= IEEE_G;
1195                 if (network->flags & NETWORK_HAS_CCK)
1196                         network->mode |= IEEE_B;
1197         }
1198
1199         if (network->mode == 0) {
1200                 IEEE80211_DEBUG_SCAN("Filtered out '%s (" MAC_FMT ")' "
1201                                      "network.\n",
1202                                      escape_essid(network->ssid,
1203                                                   network->ssid_len),
1204                                      MAC_ARG(network->bssid));
1205                 return 1;
1206         }
1207
1208         if (ieee80211_is_empty_essid(network->ssid, network->ssid_len))
1209                 network->flags |= NETWORK_EMPTY_ESSID;
1210
1211         stats->signal = ieee80211_TranslateToDbm(stats->signalstrength);
1212         //stats->noise = stats->signal - stats->noise;
1213         stats->noise = ieee80211_TranslateToDbm(100 - stats->signalstrength) - 25;
1214         memcpy(&network->stats, stats, sizeof(network->stats));
1215
1216         return 0;
1217 }
1218
1219 static inline int is_same_network(struct ieee80211_network *src,
1220                                   struct ieee80211_network *dst,
1221                                   struct ieee80211_device * ieee)
1222 {
1223         /* A network is only a duplicate if the channel, BSSID, ESSID
1224          * and the capability field (in particular IBSS and BSS) all match.
1225          * We treat all <hidden> with the same BSSID and channel
1226          * as one network */
1227         return (((src->ssid_len == dst->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) &&  //YJ,mod,080819,for hidden ap
1228                 //((src->ssid_len == dst->ssid_len) &&
1229                 (src->channel == dst->channel) &&
1230                 !memcmp(src->bssid, dst->bssid, ETH_ALEN) &&
1231                 (!memcmp(src->ssid, dst->ssid, src->ssid_len) || (ieee->iw_mode == IW_MODE_INFRA)) && //YJ,mod,080819,for hidden ap
1232                 //!memcmp(src->ssid, dst->ssid, src->ssid_len) &&
1233                 ((src->capability & WLAN_CAPABILITY_IBSS) ==
1234                 (dst->capability & WLAN_CAPABILITY_IBSS)) &&
1235                 ((src->capability & WLAN_CAPABILITY_BSS) ==
1236                 (dst->capability & WLAN_CAPABILITY_BSS)));
1237 }
1238
1239 inline void update_network(struct ieee80211_network *dst,
1240                                   struct ieee80211_network *src)
1241 {
1242         unsigned char quality = src->stats.signalstrength;
1243         unsigned char signal = 0;
1244         unsigned char noise = 0;
1245         if(dst->stats.signalstrength > 0) {
1246                 quality = (dst->stats.signalstrength * 5 + src->stats.signalstrength + 5)/6;
1247         }
1248         signal = ieee80211_TranslateToDbm(quality);
1249         //noise = signal - src->stats.noise;
1250         if(dst->stats.noise > 0)
1251                 noise = (dst->stats.noise * 5 + src->stats.noise)/6;
1252         //if(strcmp(dst->ssid, "linksys_lzm000") == 0)
1253 //      printk("ssid:%s, quality:%d, signal:%d\n", dst->ssid, quality, signal);
1254         memcpy(&dst->stats, &src->stats, sizeof(struct ieee80211_rx_stats));
1255         dst->stats.signalstrength = quality;
1256         dst->stats.signal = signal;
1257 //      printk("==================>stats.signal is %d\n",dst->stats.signal);
1258         dst->stats.noise = noise;
1259
1260
1261         dst->capability = src->capability;
1262         memcpy(dst->rates, src->rates, src->rates_len);
1263         dst->rates_len = src->rates_len;
1264         memcpy(dst->rates_ex, src->rates_ex, src->rates_ex_len);
1265         dst->rates_ex_len = src->rates_ex_len;
1266         dst->HighestOperaRate= src->HighestOperaRate;
1267         //printk("==========>in %s: src->ssid is %s,chan is %d\n",__func__,src->ssid,src->channel);
1268
1269         //YJ,add,080819,for hidden ap
1270         if(src->ssid_len > 0)
1271         {
1272                 //if(src->ssid_len == 13)
1273                 //      printk("=====================>>>>>>>> Dst ssid: %s Src ssid: %s\n", dst->ssid, src->ssid);
1274                 memset(dst->ssid, 0, dst->ssid_len);
1275                 dst->ssid_len = src->ssid_len;
1276                 memcpy(dst->ssid, src->ssid, src->ssid_len);
1277         }
1278         //YJ,add,080819,for hidden ap,end
1279
1280         dst->channel = src->channel;
1281         dst->mode = src->mode;
1282         dst->flags = src->flags;
1283         dst->time_stamp[0] = src->time_stamp[0];
1284         dst->time_stamp[1] = src->time_stamp[1];
1285
1286         dst->beacon_interval = src->beacon_interval;
1287         dst->listen_interval = src->listen_interval;
1288         dst->atim_window = src->atim_window;
1289         dst->dtim_period = src->dtim_period;
1290         dst->dtim_data = src->dtim_data;
1291         dst->last_dtim_sta_time[0] = src->last_dtim_sta_time[0];
1292         dst->last_dtim_sta_time[1] = src->last_dtim_sta_time[1];
1293 //      printk("update:%s, dtim_period:%x, dtim_data:%x\n", src->ssid, src->dtim_period, src->dtim_data);
1294         memcpy(dst->wpa_ie, src->wpa_ie, src->wpa_ie_len);
1295         dst->wpa_ie_len = src->wpa_ie_len;
1296         memcpy(dst->rsn_ie, src->rsn_ie, src->rsn_ie_len);
1297         dst->rsn_ie_len = src->rsn_ie_len;
1298
1299         dst->last_scanned = jiffies;
1300         /* dst->last_associate is not overwritten */
1301 // disable QoS process now, added by David 2006/7/25
1302 #if 1
1303         dst->wmm_info = src->wmm_info; //sure to exist in beacon or probe response frame.
1304 /*
1305         if((dst->wmm_info^src->wmm_info)&0x0f) {//Param Set Count change, update Parameter
1306           memcpy(dst->wmm_param, src->wmm_param, IEEE80211_AC_PRAM_LEN);
1307         }
1308 */
1309         if(src->wmm_param[0].ac_aci_acm_aifsn|| \
1310            src->wmm_param[1].ac_aci_acm_aifsn|| \
1311            src->wmm_param[2].ac_aci_acm_aifsn|| \
1312            src->wmm_param[3].ac_aci_acm_aifsn) {
1313           memcpy(dst->wmm_param, src->wmm_param, WME_AC_PRAM_LEN);
1314         }
1315         dst->QoS_Enable = src->QoS_Enable;
1316 #else
1317         dst->QoS_Enable = 1;//for Rtl8187 simulation
1318 #endif
1319         dst->SignalStrength = src->SignalStrength;
1320         dst->Turbo_Enable = src->Turbo_Enable;
1321         dst->CountryIeLen = src->CountryIeLen;
1322         memcpy(dst->CountryIeBuf, src->CountryIeBuf, src->CountryIeLen);
1323 }
1324
1325
1326 inline void ieee80211_process_probe_response(
1327         struct ieee80211_device *ieee,
1328         struct ieee80211_probe_response *beacon,
1329         struct ieee80211_rx_stats *stats)
1330 {
1331         struct ieee80211_network network;
1332         struct ieee80211_network *target;
1333         struct ieee80211_network *oldest = NULL;
1334 #ifdef CONFIG_IEEE80211_DEBUG
1335         struct ieee80211_info_element *info_element = &beacon->info_element;
1336 #endif
1337         unsigned long flags;
1338         short renew;
1339         u8 wmm_info;
1340         u8 is_beacon = (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_BEACON)? 1:0;  //YJ,add,080819,for hidden ap
1341
1342         memset(&network, 0, sizeof(struct ieee80211_network));
1343
1344         IEEE80211_DEBUG_SCAN(
1345                 "'%s' (" MAC_FMT "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
1346                 escape_essid(info_element->data, info_element->len),
1347                 MAC_ARG(beacon->header.addr3),
1348                 (beacon->capability & (1<<0xf)) ? '1' : '0',
1349                 (beacon->capability & (1<<0xe)) ? '1' : '0',
1350                 (beacon->capability & (1<<0xd)) ? '1' : '0',
1351                 (beacon->capability & (1<<0xc)) ? '1' : '0',
1352                 (beacon->capability & (1<<0xb)) ? '1' : '0',
1353                 (beacon->capability & (1<<0xa)) ? '1' : '0',
1354                 (beacon->capability & (1<<0x9)) ? '1' : '0',
1355                 (beacon->capability & (1<<0x8)) ? '1' : '0',
1356                 (beacon->capability & (1<<0x7)) ? '1' : '0',
1357                 (beacon->capability & (1<<0x6)) ? '1' : '0',
1358                 (beacon->capability & (1<<0x5)) ? '1' : '0',
1359                 (beacon->capability & (1<<0x4)) ? '1' : '0',
1360                 (beacon->capability & (1<<0x3)) ? '1' : '0',
1361                 (beacon->capability & (1<<0x2)) ? '1' : '0',
1362                 (beacon->capability & (1<<0x1)) ? '1' : '0',
1363                 (beacon->capability & (1<<0x0)) ? '1' : '0');
1364
1365         if (ieee80211_network_init(ieee, beacon, &network, stats)) {
1366                 IEEE80211_DEBUG_SCAN("Dropped '%s' (" MAC_FMT ") via %s.\n",
1367                                      escape_essid(info_element->data,
1368                                                   info_element->len),
1369                                      MAC_ARG(beacon->header.addr3),
1370                                      WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
1371                                      IEEE80211_STYPE_PROBE_RESP ?
1372                                      "PROBE RESPONSE" : "BEACON");
1373                 return;
1374         }
1375
1376         // For Asus EeePc request,
1377         // (1) if wireless adapter receive get any 802.11d country code in AP beacon,
1378         //         wireless adapter should follow the country code.
1379         // (2)  If there is no any country code in beacon,
1380         //       then wireless adapter should do active scan from ch1~11 and
1381         //       passive scan from ch12~14
1382         if(ieee->bGlobalDomain)
1383         {
1384                 if (WLAN_FC_GET_STYPE(beacon->header.frame_ctl) == IEEE80211_STYPE_PROBE_RESP)
1385                 {
1386                         // Case 1: Country code
1387                         if(IS_COUNTRY_IE_VALID(ieee) )
1388                         {
1389                                 if( !IsLegalChannel(ieee, network.channel) )
1390                                 {
1391                                         printk("GetScanInfo(): For Country code, filter probe response at channel(%d).\n", network.channel);
1392                                         return;
1393                                 }
1394                         }
1395                         // Case 2: No any country code.
1396                         else
1397                         {
1398                                 // Filter over channel ch12~14
1399                                 if(network.channel > 11)
1400                                 {
1401                                         printk("GetScanInfo(): For Global Domain, filter probe response at channel(%d).\n", network.channel);
1402                                         return;
1403                                 }
1404                         }
1405                 }
1406                 else
1407                 {
1408                         // Case 1: Country code
1409                         if(IS_COUNTRY_IE_VALID(ieee) )
1410                         {
1411                                 if( !IsLegalChannel(ieee, network.channel) )
1412                                 {
1413                                         printk("GetScanInfo(): For Country code, filter beacon at channel(%d).\n",network.channel);
1414                                         return;
1415                                 }
1416                         }
1417                         // Case 2: No any country code.
1418                         else
1419                         {
1420                                 // Filter over channel ch12~14
1421                                 if(network.channel > 14)
1422                                 {
1423                                         printk("GetScanInfo(): For Global Domain, filter beacon at channel(%d).\n",network.channel);
1424                                         return;
1425                                 }
1426                         }
1427                 }
1428         }
1429         /* The network parsed correctly -- so now we scan our known networks
1430          * to see if we can find it in our list.
1431          *
1432          * NOTE:  This search is definitely not optimized.  Once its doing
1433          *        the "right thing" we'll optimize it for efficiency if
1434          *        necessary */
1435
1436         /* Search for this entry in the list and update it if it is
1437          * already there. */
1438
1439         spin_lock_irqsave(&ieee->lock, flags);
1440
1441         if(is_same_network(&ieee->current_network, &network, ieee)) {
1442                 wmm_info = ieee->current_network.wmm_info;
1443                 //YJ,add,080819,for hidden ap
1444                 if(is_beacon == 0)
1445                         network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & ieee->current_network.flags);
1446                 else if(ieee->state == IEEE80211_LINKED)
1447                         ieee->NumRxBcnInPeriod++;
1448                 //YJ,add,080819,for hidden ap,end
1449                 //printk("====>network.ssid=%s cur_ssid=%s\n", network.ssid, ieee->current_network.ssid);
1450                 update_network(&ieee->current_network, &network);
1451         }
1452
1453         list_for_each_entry(target, &ieee->network_list, list) {
1454                 if (is_same_network(target, &network, ieee))
1455                         break;
1456                 if ((oldest == NULL) ||
1457                     (target->last_scanned < oldest->last_scanned))
1458                         oldest = target;
1459         }
1460
1461         /* If we didn't find a match, then get a new network slot to initialize
1462          * with this beacon's information */
1463         if (&target->list == &ieee->network_list) {
1464                 if (list_empty(&ieee->network_free_list)) {
1465                         /* If there are no more slots, expire the oldest */
1466                         list_del(&oldest->list);
1467                         target = oldest;
1468                         IEEE80211_DEBUG_SCAN("Expired '%s' (" MAC_FMT ") from "
1469                                              "network list.\n",
1470                                              escape_essid(target->ssid,
1471                                                           target->ssid_len),
1472                                              MAC_ARG(target->bssid));
1473                 } else {
1474                         /* Otherwise just pull from the free list */
1475                         target = list_entry(ieee->network_free_list.next,
1476                                             struct ieee80211_network, list);
1477                         list_del(ieee->network_free_list.next);
1478                 }
1479
1480
1481 #ifdef CONFIG_IEEE80211_DEBUG
1482                 IEEE80211_DEBUG_SCAN("Adding '%s' (" MAC_FMT ") via %s.\n",
1483                                      escape_essid(network.ssid,
1484                                                   network.ssid_len),
1485                                      MAC_ARG(network.bssid),
1486                                      WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
1487                                      IEEE80211_STYPE_PROBE_RESP ?
1488                                      "PROBE RESPONSE" : "BEACON");
1489 #endif
1490
1491                 memcpy(target, &network, sizeof(*target));
1492                 list_add_tail(&target->list, &ieee->network_list);
1493                 if(ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE)
1494                         ieee80211_softmac_new_net(ieee,&network);
1495         } else {
1496                 IEEE80211_DEBUG_SCAN("Updating '%s' (" MAC_FMT ") via %s.\n",
1497                                      escape_essid(target->ssid,
1498                                                   target->ssid_len),
1499                                      MAC_ARG(target->bssid),
1500                                      WLAN_FC_GET_STYPE(beacon->header.frame_ctl) ==
1501                                      IEEE80211_STYPE_PROBE_RESP ?
1502                                      "PROBE RESPONSE" : "BEACON");
1503
1504                 /* we have an entry and we are going to update it. But this entry may
1505                  * be already expired. In this case we do the same as we found a new
1506                  * net and call the new_net handler
1507                  */
1508                 renew = !time_after(target->last_scanned + ieee->scan_age, jiffies);
1509                 //YJ,add,080819,for hidden ap
1510                 if(is_beacon == 0)
1511                         network.flags = (~NETWORK_EMPTY_ESSID & network.flags)|(NETWORK_EMPTY_ESSID & target->flags);
1512                 //if(strncmp(network.ssid, "linksys-c",9) == 0)
1513                 //      printk("====>2 network.ssid=%s FLAG=%d target.ssid=%s FLAG=%d\n", network.ssid, network.flags, target->ssid, target->flags);
1514                 if(((network.flags & NETWORK_EMPTY_ESSID) == NETWORK_EMPTY_ESSID) \
1515                     && (((network.ssid_len > 0) && (strncmp(target->ssid, network.ssid, network.ssid_len)))\
1516                     ||((ieee->current_network.ssid_len == network.ssid_len)&&(strncmp(ieee->current_network.ssid, network.ssid, network.ssid_len) == 0)&&(ieee->state == IEEE80211_NOLINK))))
1517                         renew = 1;
1518                 //YJ,add,080819,for hidden ap,end
1519                 update_network(target, &network);
1520                 if(renew && (ieee->softmac_features & IEEE_SOFTMAC_ASSOCIATE))
1521                         ieee80211_softmac_new_net(ieee,&network);
1522         }
1523
1524         spin_unlock_irqrestore(&ieee->lock, flags);
1525 }
1526
1527 void ieee80211_rx_mgt(struct ieee80211_device *ieee,
1528                       struct ieee80211_hdr_4addr *header,
1529                       struct ieee80211_rx_stats *stats)
1530 {
1531         switch (WLAN_FC_GET_STYPE(header->frame_ctl)) {
1532
1533         case IEEE80211_STYPE_BEACON:
1534                 IEEE80211_DEBUG_MGMT("received BEACON (%d)\n",
1535                                      WLAN_FC_GET_STYPE(header->frame_ctl));
1536                 IEEE80211_DEBUG_SCAN("Beacon\n");
1537                 ieee80211_process_probe_response(
1538                         ieee, (struct ieee80211_probe_response *)header, stats);
1539                 break;
1540
1541         case IEEE80211_STYPE_PROBE_RESP:
1542                 IEEE80211_DEBUG_MGMT("received PROBE RESPONSE (%d)\n",
1543                                      WLAN_FC_GET_STYPE(header->frame_ctl));
1544                 IEEE80211_DEBUG_SCAN("Probe response\n");
1545                 ieee80211_process_probe_response(
1546                         ieee, (struct ieee80211_probe_response *)header, stats);
1547                 break;
1548         }
1549 }