2 * Copyright (c) 1996, 2003 VIA Networking Technologies, Inc.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 * Purpose: handle dpc rx functions
28 * device_receive_frame - Rcv 802.11 frame function
29 * s_bAPModeRxCtl- AP Rcv frame filer Ctl.
30 * s_bAPModeRxData- AP Rcv data frame handle
31 * s_bHandleRxEncryption- Rcv decrypted data via on-fly
32 * s_bHostWepRxEncryption- Rcv encrypted data via host
33 * s_byGetRateIdx- get rate index
34 * s_vGetDASA- get data offset
35 * s_vProcessRxMACHeader- Rcv 802.11 and translate to 802.3
59 /*--------------------- Static Definitions -------------------------*/
61 /*--------------------- Static Classes ----------------------------*/
63 /*--------------------- Static Variables --------------------------*/
64 //static int msglevel =MSG_LEVEL_DEBUG;
65 static int msglevel =MSG_LEVEL_INFO;
67 const BYTE acbyRxRate[MAX_RATE] =
68 {2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108};
71 /*--------------------- Static Functions --------------------------*/
73 /*--------------------- Static Definitions -------------------------*/
75 /*--------------------- Static Functions --------------------------*/
77 static BYTE s_byGetRateIdx(BYTE byRate);
82 PBYTE pbyRxBufferAddr,
83 unsigned int *pcbHeaderSize,
84 PSEthernetHeader psEthHeader
89 s_vProcessRxMACHeader (
91 PBYTE pbyRxBufferAddr,
92 unsigned int cbPacketSize,
95 unsigned int *pcbHeadSize
98 static BOOL s_bAPModeRxCtl(
101 signed int iSANodeIndex
106 static BOOL s_bAPModeRxData (
109 unsigned int FrameSize,
110 unsigned int cbHeaderOffset,
111 signed int iSANodeIndex,
112 signed int iDANodeIndex
116 static BOOL s_bHandleRxEncryption(
119 unsigned int FrameSize,
128 static BOOL s_bHostWepRxEncryption(
132 unsigned int FrameSize,
143 /*--------------------- Export Variables --------------------------*/
148 * Translate Rcv 802.11 header to 802.3 header with Rx buffer
153 * dwRxBufferAddr - Address of Rcv Buffer
154 * cbPacketSize - Rcv Packet size
155 * bIsWEP - If Rcv with WEP
157 * pcbHeaderSize - 802.11 header size
164 s_vProcessRxMACHeader (
166 PBYTE pbyRxBufferAddr,
167 unsigned int cbPacketSize,
170 unsigned int *pcbHeadSize
174 unsigned int cbHeaderSize = 0;
176 PS802_11Header pMACHeader;
180 pMACHeader = (PS802_11Header) (pbyRxBufferAddr + cbHeaderSize);
182 s_vGetDASA((PBYTE)pMACHeader, &cbHeaderSize, &pDevice->sRxEthHeader);
186 // strip IV&ExtIV , add 8 byte
187 cbHeaderSize += (WLAN_HDR_ADDR3_LEN + 8);
189 // strip IV , add 4 byte
190 cbHeaderSize += (WLAN_HDR_ADDR3_LEN + 4);
194 cbHeaderSize += WLAN_HDR_ADDR3_LEN;
197 pbyRxBuffer = (PBYTE) (pbyRxBufferAddr + cbHeaderSize);
198 if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_Bridgetunnel[0])) {
200 } else if (!compare_ether_addr(pbyRxBuffer, &pDevice->abySNAP_RFC1042[0])) {
202 pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
203 if ((*pwType == cpu_to_le16(ETH_P_IPX)) ||
204 (*pwType == cpu_to_le16(0xF380))) {
206 pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
209 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 8); // 8 is IV&ExtIV
211 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 4); // 4 is IV
215 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN);
221 pwType = (PWORD) (pbyRxBufferAddr + cbHeaderSize);
224 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 8); // 8 is IV&ExtIV
226 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN - 4); // 4 is IV
230 *pwType = htons(cbPacketSize - WLAN_HDR_ADDR3_LEN);
234 cbHeaderSize -= (ETH_ALEN * 2);
235 pbyRxBuffer = (PBYTE) (pbyRxBufferAddr + cbHeaderSize);
236 for (ii = 0; ii < ETH_ALEN; ii++)
237 *pbyRxBuffer++ = pDevice->sRxEthHeader.abyDstAddr[ii];
238 for (ii = 0; ii < ETH_ALEN; ii++)
239 *pbyRxBuffer++ = pDevice->sRxEthHeader.abySrcAddr[ii];
241 *pcbHeadSize = cbHeaderSize;
247 static BYTE s_byGetRateIdx(BYTE byRate)
251 for (byRateIdx = 0; byRateIdx <MAX_RATE ; byRateIdx++) {
252 if (acbyRxRate[byRateIdx%MAX_RATE] == byRate)
262 PBYTE pbyRxBufferAddr,
263 unsigned int *pcbHeaderSize,
264 PSEthernetHeader psEthHeader
267 unsigned int cbHeaderSize = 0;
268 PS802_11Header pMACHeader;
271 pMACHeader = (PS802_11Header) (pbyRxBufferAddr + cbHeaderSize);
273 if ((pMACHeader->wFrameCtl & FC_TODS) == 0) {
274 if (pMACHeader->wFrameCtl & FC_FROMDS) {
275 for (ii = 0; ii < ETH_ALEN; ii++) {
276 psEthHeader->abyDstAddr[ii] =
277 pMACHeader->abyAddr1[ii];
278 psEthHeader->abySrcAddr[ii] =
279 pMACHeader->abyAddr3[ii];
283 for (ii = 0; ii < ETH_ALEN; ii++) {
284 psEthHeader->abyDstAddr[ii] =
285 pMACHeader->abyAddr1[ii];
286 psEthHeader->abySrcAddr[ii] =
287 pMACHeader->abyAddr2[ii];
292 if (pMACHeader->wFrameCtl & FC_FROMDS) {
293 for (ii = 0; ii < ETH_ALEN; ii++) {
294 psEthHeader->abyDstAddr[ii] =
295 pMACHeader->abyAddr3[ii];
296 psEthHeader->abySrcAddr[ii] =
297 pMACHeader->abyAddr4[ii];
301 for (ii = 0; ii < ETH_ALEN; ii++) {
302 psEthHeader->abyDstAddr[ii] =
303 pMACHeader->abyAddr3[ii];
304 psEthHeader->abySrcAddr[ii] =
305 pMACHeader->abyAddr2[ii];
309 *pcbHeaderSize = cbHeaderSize;
316 RXbBulkInProcessData (
319 unsigned long BytesToIndicate
323 struct net_device_stats* pStats=&pDevice->stats;
325 PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
326 PSRxMgmtPacket pRxPacket = &(pMgmt->sRxPacket);
327 PS802_11Header p802_11Header;
333 BOOL bDeFragRx = FALSE;
334 unsigned int cbHeaderOffset;
335 unsigned int FrameSize;
337 signed int iSANodeIndex = -1;
338 signed int iDANodeIndex = -1;
340 unsigned int cbIVOffset;
345 unsigned int cbHeaderSize;
346 PSKeyItem pKey = NULL;
348 DWORD dwRxTSC47_16 = 0;
351 /* signed long ldBm = 0; */
355 PRCB pRCBIndicate = pRCB;
358 BYTE abyVaildRate[MAX_RATE] = {2,4,11,22,12,18,24,36,48,72,96,108};
359 WORD wPLCPwithPadding;
360 PS802_11Header pMACHeader;
361 BOOL bRxeapol_key = FALSE;
365 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---------- RXbBulkInProcessData---\n");
369 //[31:16]RcvByteCount ( not include 4-byte Status )
370 dwWbkStatus = *( (PDWORD)(skb->data) );
371 FrameSize = (unsigned int)(dwWbkStatus >> 16);
374 if (BytesToIndicate != FrameSize) {
375 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---------- WRONG Length 1 \n");
379 if ((BytesToIndicate > 2372) || (BytesToIndicate <= 40)) {
380 // Frame Size error drop this packet.
381 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "---------- WRONG Length 2\n");
385 pbyDAddress = (PBYTE)(skb->data);
386 pbyRxSts = pbyDAddress+4;
387 pbyRxRate = pbyDAddress+5;
389 //real Frame Size = USBFrameSize -4WbkStatus - 4RxStatus - 8TSF - 4RSR - 4SQ3 - ?Padding
390 //if SQ3 the range is 24~27, if no SQ3 the range is 20~23
391 //real Frame size in PLCPLength field.
392 pwPLCP_Length = (PWORD) (pbyDAddress + 6);
393 //Fix hardware bug => PLCP_Length error
394 if ( ((BytesToIndicate - (*pwPLCP_Length)) > 27) ||
395 ((BytesToIndicate - (*pwPLCP_Length)) < 24) ||
396 (BytesToIndicate < (*pwPLCP_Length)) ) {
398 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Wrong PLCP Length %x\n", (int) *pwPLCP_Length);
402 for ( ii=RATE_1M;ii<MAX_RATE;ii++) {
403 if ( *pbyRxRate == abyVaildRate[ii] ) {
407 if ( ii==MAX_RATE ) {
408 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Wrong RxRate %x\n",(int) *pbyRxRate);
412 wPLCPwithPadding = ( (*pwPLCP_Length / 4) + ( (*pwPLCP_Length % 4) ? 1:0 ) ) *4;
414 pqwTSFTime = (PQWORD) (pbyDAddress + 8 + wPLCPwithPadding);
415 if(pDevice->byBBType == BB_TYPE_11G) {
416 pby3SQ = pbyDAddress + 8 + wPLCPwithPadding + 12;
420 pbySQ = pbyDAddress + 8 + wPLCPwithPadding + 8;
423 pbyNewRsr = pbyDAddress + 8 + wPLCPwithPadding + 9;
424 pbyRSSI = pbyDAddress + 8 + wPLCPwithPadding + 10;
425 pbyRsr = pbyDAddress + 8 + wPLCPwithPadding + 11;
427 FrameSize = *pwPLCP_Length;
429 pbyFrame = pbyDAddress + 8;
430 // update receive statistic counter
432 STAvUpdateRDStatCounter(&pDevice->scStatistic,
442 pMACHeader = (PS802_11Header) pbyFrame;
444 //mike add: to judge if current AP is activated?
445 if ((pMgmt->eCurrMode == WMAC_MODE_STANDBY) ||
446 (pMgmt->eCurrMode == WMAC_MODE_ESS_STA)) {
447 if (pMgmt->sNodeDBTable[0].bActive) {
448 if (!compare_ether_addr(pMgmt->abyCurrBSSID, pMACHeader->abyAddr2)) {
449 if (pMgmt->sNodeDBTable[0].uInActiveCount != 0)
450 pMgmt->sNodeDBTable[0].uInActiveCount = 0;
455 if (!is_multicast_ether_addr(pMACHeader->abyAddr1) && !is_broadcast_ether_addr(pMACHeader->abyAddr1)) {
456 if ( WCTLbIsDuplicate(&(pDevice->sDupRxCache), (PS802_11Header) pbyFrame) ) {
457 pDevice->s802_11Counter.FrameDuplicateCount++;
461 if (compare_ether_addr(pDevice->abyCurrentNetAddr,
462 pMACHeader->abyAddr1)) {
469 s_vGetDASA(pbyFrame, &cbHeaderSize, &pDevice->sRxEthHeader);
471 if (!compare_ether_addr((PBYTE)&(pDevice->sRxEthHeader.abySrcAddr[0]),
472 pDevice->abyCurrentNetAddr))
475 if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) || (pMgmt->eCurrMode == WMAC_MODE_IBSS_STA)) {
476 if (IS_CTL_PSPOLL(pbyFrame) || !IS_TYPE_CONTROL(pbyFrame)) {
477 p802_11Header = (PS802_11Header) (pbyFrame);
479 if (BSSbIsSTAInNodeDB(pDevice, (PBYTE)(p802_11Header->abyAddr2), &iSANodeIndex)) {
480 pMgmt->sNodeDBTable[iSANodeIndex].ulLastRxJiffer = jiffies;
481 pMgmt->sNodeDBTable[iSANodeIndex].uInActiveCount = 0;
486 if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
487 if (s_bAPModeRxCtl(pDevice, pbyFrame, iSANodeIndex) == TRUE) {
493 if (IS_FC_WEP(pbyFrame)) {
494 BOOL bRxDecryOK = FALSE;
496 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"rx WEP pkt\n");
498 if ((pDevice->bEnableHostWEP) && (iSANodeIndex >= 0)) {
500 pKey->byCipherSuite = pMgmt->sNodeDBTable[iSANodeIndex].byCipherSuite;
501 pKey->dwKeyIndex = pMgmt->sNodeDBTable[iSANodeIndex].dwKeyIndex;
502 pKey->uKeyLength = pMgmt->sNodeDBTable[iSANodeIndex].uWepKeyLength;
503 pKey->dwTSC47_16 = pMgmt->sNodeDBTable[iSANodeIndex].dwTSC47_16;
504 pKey->wTSC15_0 = pMgmt->sNodeDBTable[iSANodeIndex].wTSC15_0;
506 &pMgmt->sNodeDBTable[iSANodeIndex].abyWepKey[0],
510 bRxDecryOK = s_bHostWepRxEncryption(pDevice,
514 pMgmt->sNodeDBTable[iSANodeIndex].bOnFly,
521 bRxDecryOK = s_bHandleRxEncryption(pDevice,
533 if ((*pbyNewRsr & NEWRSR_DECRYPTOK) == 0) {
534 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV Fail\n");
535 if ( (pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
536 (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
537 (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) ||
538 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
539 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {
541 if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_TKIP)) {
542 pDevice->s802_11Counter.TKIPICVErrors++;
543 } else if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_CCMP)) {
544 pDevice->s802_11Counter.CCMPDecryptErrors++;
545 } else if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_WEP)) {
546 // pDevice->s802_11Counter.WEPICVErrorCount.QuadPart++;
552 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"WEP Func Fail\n");
555 if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_CCMP))
556 FrameSize -= 8; // Message Integrity Code
558 FrameSize -= 4; // 4 is ICV
565 /* remove the FCS/CRC length */
566 FrameSize -= ETH_FCS_LEN;
568 if ( !(*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) && // unicast address
569 (IS_FRAGMENT_PKT((pbyFrame)))
572 bDeFragRx = WCTLbHandleFragment(pDevice, (PS802_11Header) (pbyFrame), FrameSize, bIsWEP, bExtIV);
573 pDevice->s802_11Counter.ReceivedFragmentCount++;
576 // TODO skb, pbyFrame
577 skb = pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx].skb;
578 FrameSize = pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx].cbFrameLength;
579 pbyFrame = skb->data + 8;
587 // Management & Control frame Handle
589 if ((IS_TYPE_DATA((pbyFrame))) == FALSE) {
590 // Handle Control & Manage Frame
592 if (IS_TYPE_MGMT((pbyFrame))) {
596 pRxPacket = &(pRCB->sMngPacket);
597 pRxPacket->p80211Header = (PUWLAN_80211HDR)(pbyFrame);
598 pRxPacket->cbMPDULen = FrameSize;
599 pRxPacket->uRSSI = *pbyRSSI;
600 pRxPacket->bySQ = *pbySQ;
601 HIDWORD(pRxPacket->qwLocalTSF) = cpu_to_le32(HIDWORD(*pqwTSFTime));
602 LODWORD(pRxPacket->qwLocalTSF) = cpu_to_le32(LODWORD(*pqwTSFTime));
605 pbyData1 = WLAN_HDR_A3_DATA_PTR(pbyFrame);
606 pbyData2 = WLAN_HDR_A3_DATA_PTR(pbyFrame) + 4;
607 for (ii = 0; ii < (FrameSize - 4); ii++) {
608 *pbyData1 = *pbyData2;
614 pRxPacket->byRxRate = s_byGetRateIdx(*pbyRxRate);
616 if ( *pbyRxSts == 0 ) {
617 //Discard beacon packet which channel is 0
618 if ( (WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) == WLAN_FSTYPE_BEACON) ||
619 (WLAN_GET_FC_FSTYPE((pRxPacket->p80211Header->sA3.wFrameCtl)) == WLAN_FSTYPE_PROBERESP) ) {
623 pRxPacket->byRxChannel = (*pbyRxSts) >> 2;
625 // hostap Deamon handle 802.11 management
626 if (pDevice->bEnableHostapd) {
627 skb->dev = pDevice->apdev;
632 skb_put(skb, FrameSize);
633 skb_reset_mac_header(skb);
634 skb->pkt_type = PACKET_OTHERHOST;
635 skb->protocol = htons(ETH_P_802_2);
636 memset(skb->cb, 0, sizeof(skb->cb));
642 // Insert the RCB in the Recv Mng list
644 EnqueueRCB(pDevice->FirstRecvMngList, pDevice->LastRecvMngList, pRCBIndicate);
645 pDevice->NumRecvMngList++;
646 if ( bDeFragRx == FALSE) {
649 if (pDevice->bIsRxMngWorkItemQueued == FALSE) {
650 pDevice->bIsRxMngWorkItemQueued = TRUE;
651 tasklet_schedule(&pDevice->RxMngWorkItem);
661 if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
662 //In AP mode, hw only check addr1(BSSID or RA) if equal to local MAC.
663 if ( !(*pbyRsr & RSR_BSSIDOK)) {
665 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
666 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
674 // discard DATA packet while not associate || BSSID error
675 if ((pDevice->bLinkPass == FALSE) ||
676 !(*pbyRsr & RSR_BSSIDOK)) {
678 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
679 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
685 //mike add:station mode check eapol-key challenge--->
687 BYTE Protocol_Version; //802.1x Authentication
688 BYTE Packet_Type; //802.1x Authentication
689 BYTE Descriptor_type;
695 wEtherType = (skb->data[cbIVOffset + 8 + 24 + 6] << 8) |
696 skb->data[cbIVOffset + 8 + 24 + 6 + 1];
697 Protocol_Version = skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1];
698 Packet_Type = skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1];
699 if (wEtherType == ETH_P_PAE) { //Protocol Type in LLC-Header
700 if(((Protocol_Version==1) ||(Protocol_Version==2)) &&
701 (Packet_Type==3)) { //802.1x OR eapol-key challenge frame receive
703 Descriptor_type = skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1+1+2];
704 Key_info = (skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1+1+2+1]<<8) |skb->data[cbIVOffset + 8 + 24 + 6 + 1 +1+1+1+2+2] ;
705 if(Descriptor_type==2) { //RSN
706 // printk("WPA2_Rx_eapol-key_info<-----:%x\n",Key_info);
708 else if(Descriptor_type==254) {
709 // printk("WPA_Rx_eapol-key_info<-----:%x\n",Key_info);
714 //mike add:station mode check eapol-key challenge<---
722 if (pDevice->bEnablePSMode) {
723 if (IS_FC_MOREDATA((pbyFrame))) {
724 if (*pbyRsr & RSR_ADDROK) {
725 //PSbSendPSPOLL((PSDevice)pDevice);
729 if (pMgmt->bInTIMWake == TRUE) {
730 pMgmt->bInTIMWake = FALSE;
735 // Now it only supports 802.11g Infrastructure Mode, and support rate must up to 54 Mbps
736 if (pDevice->bDiversityEnable && (FrameSize>50) &&
737 (pDevice->eOPMode == OP_MODE_INFRASTRUCTURE) &&
738 (pDevice->bLinkPass == TRUE)) {
739 BBvAntennaDiversity(pDevice, s_byGetRateIdx(*pbyRxRate), 0);
742 // ++++++++ For BaseBand Algorithm +++++++++++++++
743 pDevice->uCurrRSSI = *pbyRSSI;
744 pDevice->byCurrSQ = *pbySQ;
748 if ((*pbyRSSI != 0) &&
749 (pMgmt->pCurrBSS!=NULL)) {
750 RFvRSSITodBm(pDevice, *pbyRSSI, &ldBm);
751 // Moniter if RSSI is too strong.
752 pMgmt->pCurrBSS->byRSSIStatCnt++;
753 pMgmt->pCurrBSS->byRSSIStatCnt %= RSSI_STAT_COUNT;
754 pMgmt->pCurrBSS->ldBmAverage[pMgmt->pCurrBSS->byRSSIStatCnt] = ldBm;
755 for (ii = 0; ii < RSSI_STAT_COUNT; ii++) {
756 if (pMgmt->pCurrBSS->ldBmAverage[ii] != 0) {
757 pMgmt->pCurrBSS->ldBmMAX =
758 max(pMgmt->pCurrBSS->ldBmAverage[ii], ldBm);
765 // -----------------------------------------------
767 if ((pMgmt->eCurrMode == WMAC_MODE_ESS_AP) && (pDevice->bEnable8021x == TRUE)){
770 // Only 802.1x packet incoming allowed
775 wEtherType = (skb->data[cbIVOffset + 8 + 24 + 6] << 8) |
776 skb->data[cbIVOffset + 8 + 24 + 6 + 1];
778 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"wEtherType = %04x \n", wEtherType);
779 if (wEtherType == ETH_P_PAE) {
780 skb->dev = pDevice->apdev;
782 if (bIsWEP == TRUE) {
783 // strip IV header(8)
784 memcpy(&abyMacHdr[0], (skb->data + 8), 24);
785 memcpy((skb->data + 8 + cbIVOffset), &abyMacHdr[0], 24);
788 skb->data += (cbIVOffset + 8);
789 skb->tail += (cbIVOffset + 8);
790 skb_put(skb, FrameSize);
791 skb_reset_mac_header(skb);
792 skb->pkt_type = PACKET_OTHERHOST;
793 skb->protocol = htons(ETH_P_802_2);
794 memset(skb->cb, 0, sizeof(skb->cb));
799 // check if 802.1x authorized
800 if (!(pMgmt->sNodeDBTable[iSANodeIndex].dwFlags & WLAN_STA_AUTHORIZED))
805 if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_TKIP)) {
807 FrameSize -= 8; //MIC
811 //--------------------------------------------------------------------------------
813 if ((pKey != NULL) && (pKey->byCipherSuite == KEY_CTL_TKIP)) {
817 DWORD dwMIC_Priority;
818 DWORD dwMICKey0 = 0, dwMICKey1 = 0;
819 DWORD dwLocalMIC_L = 0;
820 DWORD dwLocalMIC_R = 0;
821 viawget_wpa_header *wpahdr;
824 if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
825 dwMICKey0 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[24]));
826 dwMICKey1 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[28]));
829 if (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) {
830 dwMICKey0 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[16]));
831 dwMICKey1 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[20]));
832 } else if ((pKey->dwKeyIndex & BIT28) == 0) {
833 dwMICKey0 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[16]));
834 dwMICKey1 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[20]));
836 dwMICKey0 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[24]));
837 dwMICKey1 = cpu_to_le32(*(PDWORD)(&pKey->abyKey[28]));
841 MIC_vInit(dwMICKey0, dwMICKey1);
842 MIC_vAppend((PBYTE)&(pDevice->sRxEthHeader.abyDstAddr[0]), 12);
844 MIC_vAppend((PBYTE)&dwMIC_Priority, 4);
845 // 4 is Rcv buffer header, 24 is MAC Header, and 8 is IV and Ext IV.
846 MIC_vAppend((PBYTE)(skb->data + 8 + WLAN_HDR_ADDR3_LEN + 8),
847 FrameSize - WLAN_HDR_ADDR3_LEN - 8);
848 MIC_vGetMIC(&dwLocalMIC_L, &dwLocalMIC_R);
851 pdwMIC_L = (PDWORD)(skb->data + 8 + FrameSize);
852 pdwMIC_R = (PDWORD)(skb->data + 8 + FrameSize + 4);
855 if ((cpu_to_le32(*pdwMIC_L) != dwLocalMIC_L) || (cpu_to_le32(*pdwMIC_R) != dwLocalMIC_R) ||
856 (pDevice->bRxMICFail == TRUE)) {
857 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"MIC comparison is fail!\n");
858 pDevice->bRxMICFail = FALSE;
859 //pDevice->s802_11Counter.TKIPLocalMICFailures.QuadPart++;
860 pDevice->s802_11Counter.TKIPLocalMICFailures++;
862 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
863 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
867 #ifdef WPA_SUPPLICANT_DRIVER_WEXT_SUPPORT
868 //send event to wpa_supplicant
869 //if(pDevice->bWPASuppWextEnabled == TRUE)
871 union iwreq_data wrqu;
872 struct iw_michaelmicfailure ev;
873 int keyidx = pbyFrame[cbHeaderSize+3] >> 6; //top two-bits
874 memset(&ev, 0, sizeof(ev));
875 ev.flags = keyidx & IW_MICFAILURE_KEY_ID;
876 if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
877 (pMgmt->eCurrState == WMAC_STATE_ASSOC) &&
878 (*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) == 0) {
879 ev.flags |= IW_MICFAILURE_PAIRWISE;
881 ev.flags |= IW_MICFAILURE_GROUP;
884 ev.src_addr.sa_family = ARPHRD_ETHER;
885 memcpy(ev.src_addr.sa_data, pMACHeader->abyAddr2, ETH_ALEN);
886 memset(&wrqu, 0, sizeof(wrqu));
887 wrqu.data.length = sizeof(ev);
888 PRINT_K("wireless_send_event--->IWEVMICHAELMICFAILURE\n");
889 wireless_send_event(pDevice->dev, IWEVMICHAELMICFAILURE, &wrqu, (char *)&ev);
895 if ((pDevice->bWPADEVUp) && (pDevice->skb != NULL)) {
896 wpahdr = (viawget_wpa_header *)pDevice->skb->data;
897 if ((pMgmt->eCurrMode == WMAC_MODE_ESS_STA) &&
898 (pMgmt->eCurrState == WMAC_STATE_ASSOC) &&
899 (*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) == 0) {
900 //s802_11_Status.Flags = NDIS_802_11_AUTH_REQUEST_PAIRWISE_ERROR;
901 wpahdr->type = VIAWGET_PTK_MIC_MSG;
903 //s802_11_Status.Flags = NDIS_802_11_AUTH_REQUEST_GROUP_ERROR;
904 wpahdr->type = VIAWGET_GTK_MIC_MSG;
906 wpahdr->resp_ie_len = 0;
907 wpahdr->req_ie_len = 0;
908 skb_put(pDevice->skb, sizeof(viawget_wpa_header));
909 pDevice->skb->dev = pDevice->wpadev;
910 skb_reset_mac_header(pDevice->skb);
911 pDevice->skb->pkt_type = PACKET_HOST;
912 pDevice->skb->protocol = htons(ETH_P_802_2);
913 memset(pDevice->skb->cb, 0, sizeof(pDevice->skb->cb));
914 netif_rx(pDevice->skb);
915 pDevice->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
922 } //---end of SOFT MIC-----------------------------------------------------------------------
924 // ++++++++++ Reply Counter Check +++++++++++++
926 if ((pKey != NULL) && ((pKey->byCipherSuite == KEY_CTL_TKIP) ||
927 (pKey->byCipherSuite == KEY_CTL_CCMP))) {
929 WORD wLocalTSC15_0 = 0;
930 DWORD dwLocalTSC47_16 = 0;
931 unsigned long long RSC = 0;
933 RSC = *((unsigned long long *) &(pKey->KeyRSC));
934 wLocalTSC15_0 = (WORD) RSC;
935 dwLocalTSC47_16 = (DWORD) (RSC>>16);
940 memcpy(&(pKey->KeyRSC), &RSC, sizeof(QWORD));
942 if ( (pDevice->sMgmtObj.eCurrMode == WMAC_MODE_ESS_STA) &&
943 (pDevice->sMgmtObj.eCurrState == WMAC_STATE_ASSOC)) {
945 if ( (wRxTSC15_0 < wLocalTSC15_0) &&
946 (dwRxTSC47_16 <= dwLocalTSC47_16) &&
947 !((dwRxTSC47_16 == 0) && (dwLocalTSC47_16 == 0xFFFFFFFF))) {
948 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"TSC is illegal~~!\n ");
949 if (pKey->byCipherSuite == KEY_CTL_TKIP)
950 //pDevice->s802_11Counter.TKIPReplays.QuadPart++;
951 pDevice->s802_11Counter.TKIPReplays++;
953 //pDevice->s802_11Counter.CCMPReplays.QuadPart++;
954 pDevice->s802_11Counter.CCMPReplays++;
957 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
958 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
966 } // ----- End of Reply Counter Check --------------------------
969 s_vProcessRxMACHeader(pDevice, (PBYTE)(skb->data+8), FrameSize, bIsWEP, bExtIV, &cbHeaderOffset);
970 FrameSize -= cbHeaderOffset;
971 cbHeaderOffset += 8; // 8 is Rcv buffer header
973 // Null data, framesize = 12
977 if (pMgmt->eCurrMode == WMAC_MODE_ESS_AP) {
978 if (s_bAPModeRxData(pDevice,
987 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
988 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
997 skb->data += cbHeaderOffset;
998 skb->tail += cbHeaderOffset;
999 skb_put(skb, FrameSize);
1000 skb->protocol=eth_type_trans(skb, skb->dev);
1001 skb->ip_summed=CHECKSUM_NONE;
1002 pStats->rx_bytes +=skb->len;
1003 pStats->rx_packets++;
1006 if (!device_alloc_frag_buf(pDevice, &pDevice->sRxDFCB[pDevice->uCurrentDFCBIdx])) {
1007 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR "%s: can not alloc more frag bufs\n",
1008 pDevice->dev->name);
1017 static BOOL s_bAPModeRxCtl (
1020 signed int iSANodeIndex
1023 PS802_11Header p802_11Header;
1025 PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
1028 if (IS_CTL_PSPOLL(pbyFrame) || !IS_TYPE_CONTROL(pbyFrame)) {
1030 p802_11Header = (PS802_11Header) (pbyFrame);
1031 if (!IS_TYPE_MGMT(pbyFrame)) {
1033 // Data & PS-Poll packet
1034 // check frame class
1035 if (iSANodeIndex > 0) {
1036 // frame class 3 fliter & checking
1037 if (pMgmt->sNodeDBTable[iSANodeIndex].eNodeState < NODE_AUTH) {
1038 // send deauth notification
1039 // reason = (6) class 2 received from nonauth sta
1040 vMgrDeAuthenBeginSta(pDevice,
1042 (PBYTE)(p802_11Header->abyAddr2),
1043 (WLAN_MGMT_REASON_CLASS2_NONAUTH),
1046 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDeAuthenBeginSta 1\n");
1049 if (pMgmt->sNodeDBTable[iSANodeIndex].eNodeState < NODE_ASSOC) {
1050 // send deassoc notification
1051 // reason = (7) class 3 received from nonassoc sta
1052 vMgrDisassocBeginSta(pDevice,
1054 (PBYTE)(p802_11Header->abyAddr2),
1055 (WLAN_MGMT_REASON_CLASS3_NONASSOC),
1058 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDisassocBeginSta 2\n");
1062 if (pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable) {
1063 // delcare received ps-poll event
1064 if (IS_CTL_PSPOLL(pbyFrame)) {
1065 pMgmt->sNodeDBTable[iSANodeIndex].bRxPSPoll = TRUE;
1066 bScheduleCommand((void *) pDevice,
1069 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: WLAN_CMD_RX_PSPOLL 1\n");
1072 // check Data PS state
1073 // if PW bit off, send out all PS bufferring packets.
1074 if (!IS_FC_POWERMGT(pbyFrame)) {
1075 pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable = FALSE;
1076 pMgmt->sNodeDBTable[iSANodeIndex].bRxPSPoll = TRUE;
1077 bScheduleCommand((void *) pDevice,
1080 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: WLAN_CMD_RX_PSPOLL 2\n");
1085 if (IS_FC_POWERMGT(pbyFrame)) {
1086 pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable = TRUE;
1087 // Once if STA in PS state, enable multicast bufferring
1088 pMgmt->sNodeDBTable[0].bPSEnable = TRUE;
1091 // clear all pending PS frame.
1092 if (pMgmt->sNodeDBTable[iSANodeIndex].wEnQueueCnt > 0) {
1093 pMgmt->sNodeDBTable[iSANodeIndex].bPSEnable = FALSE;
1094 pMgmt->sNodeDBTable[iSANodeIndex].bRxPSPoll = TRUE;
1095 bScheduleCommand((void *) pDevice,
1098 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: WLAN_CMD_RX_PSPOLL 3\n");
1105 vMgrDeAuthenBeginSta(pDevice,
1107 (PBYTE)(p802_11Header->abyAddr2),
1108 (WLAN_MGMT_REASON_CLASS2_NONAUTH),
1111 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: send vMgrDeAuthenBeginSta 3\n");
1112 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "BSSID:%02x-%02x-%02x=%02x-%02x-%02x \n",
1113 p802_11Header->abyAddr3[0],
1114 p802_11Header->abyAddr3[1],
1115 p802_11Header->abyAddr3[2],
1116 p802_11Header->abyAddr3[3],
1117 p802_11Header->abyAddr3[4],
1118 p802_11Header->abyAddr3[5]
1120 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR2:%02x-%02x-%02x=%02x-%02x-%02x \n",
1121 p802_11Header->abyAddr2[0],
1122 p802_11Header->abyAddr2[1],
1123 p802_11Header->abyAddr2[2],
1124 p802_11Header->abyAddr2[3],
1125 p802_11Header->abyAddr2[4],
1126 p802_11Header->abyAddr2[5]
1128 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "ADDR1:%02x-%02x-%02x=%02x-%02x-%02x \n",
1129 p802_11Header->abyAddr1[0],
1130 p802_11Header->abyAddr1[1],
1131 p802_11Header->abyAddr1[2],
1132 p802_11Header->abyAddr1[3],
1133 p802_11Header->abyAddr1[4],
1134 p802_11Header->abyAddr1[5]
1136 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "dpc: wFrameCtl= %x\n", p802_11Header->wFrameCtl );
1145 static BOOL s_bHandleRxEncryption (
1148 unsigned int FrameSize,
1151 PSKeyItem * pKeyOut,
1154 PDWORD pdwRxTSC47_16
1157 unsigned int PayloadLen = FrameSize;
1160 PSKeyItem pKey = NULL;
1161 BYTE byDecMode = KEY_CTL_WEP;
1162 PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
1168 pbyIV = pbyFrame + WLAN_HDR_ADDR3_LEN;
1169 if ( WLAN_GET_FC_TODS(*(PWORD)pbyFrame) &&
1170 WLAN_GET_FC_FROMDS(*(PWORD)pbyFrame) ) {
1171 pbyIV += 6; // 6 is 802.11 address4
1174 byKeyIdx = (*(pbyIV+3) & 0xc0);
1176 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\nKeyIdx: %d\n", byKeyIdx);
1178 if ((pMgmt->eAuthenMode == WMAC_AUTH_WPA) ||
1179 (pMgmt->eAuthenMode == WMAC_AUTH_WPAPSK) ||
1180 (pMgmt->eAuthenMode == WMAC_AUTH_WPANONE) ||
1181 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2) ||
1182 (pMgmt->eAuthenMode == WMAC_AUTH_WPA2PSK)) {
1183 if (((*pbyRsr & (RSR_ADDRBROAD | RSR_ADDRMULTI)) == 0) &&
1184 (pMgmt->byCSSPK != KEY_CTL_NONE)) {
1185 // unicast pkt use pairwise key
1186 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"unicast pkt\n");
1187 if (KeybGetKey(&(pDevice->sKey), pDevice->abyBSSID, 0xFFFFFFFF, &pKey) == TRUE) {
1188 if (pMgmt->byCSSPK == KEY_CTL_TKIP)
1189 byDecMode = KEY_CTL_TKIP;
1190 else if (pMgmt->byCSSPK == KEY_CTL_CCMP)
1191 byDecMode = KEY_CTL_CCMP;
1193 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"unicast pkt: %d, %p\n", byDecMode, pKey);
1196 KeybGetKey(&(pDevice->sKey), pDevice->abyBSSID, byKeyIdx, &pKey);
1197 if (pMgmt->byCSSGK == KEY_CTL_TKIP)
1198 byDecMode = KEY_CTL_TKIP;
1199 else if (pMgmt->byCSSGK == KEY_CTL_CCMP)
1200 byDecMode = KEY_CTL_CCMP;
1201 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"group pkt: %d, %d, %p\n", byKeyIdx, byDecMode, pKey);
1204 // our WEP only support Default Key
1206 // use default group key
1207 KeybGetKey(&(pDevice->sKey), pDevice->abyBroadcastAddr, byKeyIdx, &pKey);
1208 if (pMgmt->byCSSGK == KEY_CTL_TKIP)
1209 byDecMode = KEY_CTL_TKIP;
1210 else if (pMgmt->byCSSGK == KEY_CTL_CCMP)
1211 byDecMode = KEY_CTL_CCMP;
1215 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"AES:%d %d %d\n", pMgmt->byCSSPK, pMgmt->byCSSGK, byDecMode);
1218 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"pKey == NULL\n");
1219 if (byDecMode == KEY_CTL_WEP) {
1220 // pDevice->s802_11Counter.WEPUndecryptableCount.QuadPart++;
1221 } else if (pDevice->bLinkPass == TRUE) {
1222 // pDevice->s802_11Counter.DecryptFailureCount.QuadPart++;
1226 if (byDecMode != pKey->byCipherSuite) {
1227 if (byDecMode == KEY_CTL_WEP) {
1228 // pDevice->s802_11Counter.WEPUndecryptableCount.QuadPart++;
1229 } else if (pDevice->bLinkPass == TRUE) {
1230 // pDevice->s802_11Counter.DecryptFailureCount.QuadPart++;
1235 if (byDecMode == KEY_CTL_WEP) {
1237 if ((pDevice->byLocalID <= REV_ID_VT3253_A1) ||
1238 (((PSKeyTable)(pKey->pvKeyTable))->bSoftWEP == TRUE)) {
1243 PayloadLen -= (WLAN_HDR_ADDR3_LEN + 4 + 4); // 24 is 802.11 header,4 is IV, 4 is crc
1244 memcpy(pDevice->abyPRNG, pbyIV, 3);
1245 memcpy(pDevice->abyPRNG + 3, pKey->abyKey, pKey->uKeyLength);
1246 rc4_init(&pDevice->SBox, pDevice->abyPRNG, pKey->uKeyLength + 3);
1247 rc4_encrypt(&pDevice->SBox, pbyIV+4, pbyIV+4, PayloadLen);
1249 if (ETHbIsBufferCrc32Ok(pbyIV+4, PayloadLen)) {
1250 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1253 } else if ((byDecMode == KEY_CTL_TKIP) ||
1254 (byDecMode == KEY_CTL_CCMP)) {
1257 PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
1258 *pdwRxTSC47_16 = cpu_to_le32(*(PDWORD)(pbyIV + 4));
1259 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %lx\n",*pdwRxTSC47_16);
1260 if (byDecMode == KEY_CTL_TKIP) {
1261 *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV));
1263 *pwRxTSC15_0 = cpu_to_le16(*(PWORD)pbyIV);
1265 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"TSC0_15: %x\n", *pwRxTSC15_0);
1267 if ((byDecMode == KEY_CTL_TKIP) &&
1268 (pDevice->byLocalID <= REV_ID_VT3253_A1)) {
1271 PS802_11Header pMACHeader = (PS802_11Header) (pbyFrame);
1272 TKIPvMixKey(pKey->abyKey, pMACHeader->abyAddr2, *pwRxTSC15_0, *pdwRxTSC47_16, pDevice->abyPRNG);
1273 rc4_init(&pDevice->SBox, pDevice->abyPRNG, TKIP_KEY_LEN);
1274 rc4_encrypt(&pDevice->SBox, pbyIV+8, pbyIV+8, PayloadLen);
1275 if (ETHbIsBufferCrc32Ok(pbyIV+8, PayloadLen)) {
1276 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1277 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV OK!\n");
1279 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV FAIL!!!\n");
1280 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"PayloadLen = %d\n", PayloadLen);
1285 if ((*(pbyIV+3) & 0x20) != 0)
1291 static BOOL s_bHostWepRxEncryption (
1294 unsigned int FrameSize,
1301 PDWORD pdwRxTSC47_16
1304 PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
1305 unsigned int PayloadLen = FrameSize;
1308 BYTE byDecMode = KEY_CTL_WEP;
1309 PS802_11Header pMACHeader;
1316 pbyIV = pbyFrame + WLAN_HDR_ADDR3_LEN;
1317 if ( WLAN_GET_FC_TODS(*(PWORD)pbyFrame) &&
1318 WLAN_GET_FC_FROMDS(*(PWORD)pbyFrame) ) {
1319 pbyIV += 6; // 6 is 802.11 address4
1322 byKeyIdx = (*(pbyIV+3) & 0xc0);
1324 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"\nKeyIdx: %d\n", byKeyIdx);
1327 if (pMgmt->byCSSGK == KEY_CTL_TKIP)
1328 byDecMode = KEY_CTL_TKIP;
1329 else if (pMgmt->byCSSGK == KEY_CTL_CCMP)
1330 byDecMode = KEY_CTL_CCMP;
1332 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"AES:%d %d %d\n", pMgmt->byCSSPK, pMgmt->byCSSGK, byDecMode);
1334 if (byDecMode != pKey->byCipherSuite) {
1335 if (byDecMode == KEY_CTL_WEP) {
1336 // pDevice->s802_11Counter.WEPUndecryptableCount.QuadPart++;
1337 } else if (pDevice->bLinkPass == TRUE) {
1338 // pDevice->s802_11Counter.DecryptFailureCount.QuadPart++;
1343 if (byDecMode == KEY_CTL_WEP) {
1345 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"byDecMode == KEY_CTL_WEP \n");
1346 if ((pDevice->byLocalID <= REV_ID_VT3253_A1) ||
1347 (((PSKeyTable)(pKey->pvKeyTable))->bSoftWEP == TRUE) ||
1348 (bOnFly == FALSE)) {
1354 PayloadLen -= (WLAN_HDR_ADDR3_LEN + 4 + 4); // 24 is 802.11 header,4 is IV, 4 is crc
1355 memcpy(pDevice->abyPRNG, pbyIV, 3);
1356 memcpy(pDevice->abyPRNG + 3, pKey->abyKey, pKey->uKeyLength);
1357 rc4_init(&pDevice->SBox, pDevice->abyPRNG, pKey->uKeyLength + 3);
1358 rc4_encrypt(&pDevice->SBox, pbyIV+4, pbyIV+4, PayloadLen);
1360 if (ETHbIsBufferCrc32Ok(pbyIV+4, PayloadLen)) {
1361 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1364 } else if ((byDecMode == KEY_CTL_TKIP) ||
1365 (byDecMode == KEY_CTL_CCMP)) {
1368 PayloadLen -= (WLAN_HDR_ADDR3_LEN + 8 + 4); // 24 is 802.11 header, 8 is IV&ExtIV, 4 is crc
1369 *pdwRxTSC47_16 = cpu_to_le32(*(PDWORD)(pbyIV + 4));
1370 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ExtIV: %lx\n",*pdwRxTSC47_16);
1372 if (byDecMode == KEY_CTL_TKIP) {
1373 *pwRxTSC15_0 = cpu_to_le16(MAKEWORD(*(pbyIV+2), *pbyIV));
1375 *pwRxTSC15_0 = cpu_to_le16(*(PWORD)pbyIV);
1377 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"TSC0_15: %x\n", *pwRxTSC15_0);
1379 if (byDecMode == KEY_CTL_TKIP) {
1381 if ((pDevice->byLocalID <= REV_ID_VT3253_A1) || (bOnFly == FALSE)) {
1385 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"soft KEY_CTL_TKIP \n");
1386 pMACHeader = (PS802_11Header) (pbyFrame);
1387 TKIPvMixKey(pKey->abyKey, pMACHeader->abyAddr2, *pwRxTSC15_0, *pdwRxTSC47_16, pDevice->abyPRNG);
1388 rc4_init(&pDevice->SBox, pDevice->abyPRNG, TKIP_KEY_LEN);
1389 rc4_encrypt(&pDevice->SBox, pbyIV+8, pbyIV+8, PayloadLen);
1390 if (ETHbIsBufferCrc32Ok(pbyIV+8, PayloadLen)) {
1391 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1392 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV OK!\n");
1394 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"ICV FAIL!!!\n");
1395 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"PayloadLen = %d\n", PayloadLen);
1400 if (byDecMode == KEY_CTL_CCMP) {
1401 if (bOnFly == FALSE) {
1404 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"soft KEY_CTL_CCMP\n");
1405 if (AESbGenCCMP(pKey->abyKey, pbyFrame, FrameSize)) {
1406 *pbyNewRsr |= NEWRSR_DECRYPTOK;
1407 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"CCMP MIC compare OK!\n");
1409 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"CCMP MIC fail!\n");
1416 if ((*(pbyIV+3) & 0x20) != 0)
1423 static BOOL s_bAPModeRxData (
1425 struct sk_buff *skb,
1426 unsigned int FrameSize,
1427 unsigned int cbHeaderOffset,
1428 signed int iSANodeIndex,
1429 signed int iDANodeIndex
1433 PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
1434 BOOL bRelayAndForward = FALSE;
1435 BOOL bRelayOnly = FALSE;
1436 BYTE byMask[8] = {1, 2, 4, 8, 0x10, 0x20, 0x40, 0x80};
1440 struct sk_buff* skbcpy = NULL;
1442 if (FrameSize > CB_MAX_BUF_SIZE)
1445 if (is_multicast_ether_addr((PBYTE)(skb->data+cbHeaderOffset))) {
1446 if (pMgmt->sNodeDBTable[0].bPSEnable) {
1448 skbcpy = dev_alloc_skb((int)pDevice->rx_buf_sz);
1450 // if any node in PS mode, buffer packet until DTIM.
1451 if (skbcpy == NULL) {
1452 DBG_PRT(MSG_LEVEL_NOTICE, KERN_INFO "relay multicast no skb available \n");
1455 skbcpy->dev = pDevice->dev;
1456 skbcpy->len = FrameSize;
1457 memcpy(skbcpy->data, skb->data+cbHeaderOffset, FrameSize);
1458 skb_queue_tail(&(pMgmt->sNodeDBTable[0].sTxPSQueue), skbcpy);
1459 pMgmt->sNodeDBTable[0].wEnQueueCnt++;
1461 pMgmt->abyPSTxMap[0] |= byMask[0];
1465 bRelayAndForward = TRUE;
1470 if (BSSbIsSTAInNodeDB(pDevice, (PBYTE)(skb->data+cbHeaderOffset), &iDANodeIndex)) {
1471 if (pMgmt->sNodeDBTable[iDANodeIndex].eNodeState >= NODE_ASSOC) {
1472 if (pMgmt->sNodeDBTable[iDANodeIndex].bPSEnable) {
1473 // queue this skb until next PS tx, and then release.
1475 skb->data += cbHeaderOffset;
1476 skb->tail += cbHeaderOffset;
1477 skb_put(skb, FrameSize);
1478 skb_queue_tail(&pMgmt->sNodeDBTable[iDANodeIndex].sTxPSQueue, skb);
1480 pMgmt->sNodeDBTable[iDANodeIndex].wEnQueueCnt++;
1481 wAID = pMgmt->sNodeDBTable[iDANodeIndex].wAID;
1482 pMgmt->abyPSTxMap[wAID >> 3] |= byMask[wAID & 7];
1483 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "relay: index= %d, pMgmt->abyPSTxMap[%d]= %d\n",
1484 iDANodeIndex, (wAID >> 3), pMgmt->abyPSTxMap[wAID >> 3]);
1494 if (bRelayOnly || bRelayAndForward) {
1495 // relay this packet right now
1496 if (bRelayAndForward)
1499 if ((pDevice->uAssocCount > 1) && (iDANodeIndex >= 0)) {
1500 bRelayPacketSend(pDevice, (PBYTE) (skb->data + cbHeaderOffset),
1501 FrameSize, (unsigned int) iDANodeIndex);
1507 // none associate, don't forward
1508 if (pDevice->uAssocCount == 0)
1517 void RXvWorkItem(void *Context)
1519 PSDevice pDevice = (PSDevice) Context;
1523 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->Rx Polling Thread\n");
1524 spin_lock_irq(&pDevice->lock);
1526 while ((pDevice->Flags & fMP_POST_READS) &&
1527 MP_IS_READY(pDevice) &&
1528 (pDevice->NumRecvFreeList != 0) ) {
1529 pRCB = pDevice->FirstRecvFreeList;
1530 pDevice->NumRecvFreeList--;
1531 ASSERT(pRCB);// cannot be NULL
1532 DequeueRCB(pDevice->FirstRecvFreeList, pDevice->LastRecvFreeList);
1533 ntStatus = PIPEnsBulkInUsbRead(pDevice, pRCB);
1535 pDevice->bIsRxWorkItemQueued = FALSE;
1536 spin_unlock_irq(&pDevice->lock);
1547 PSDevice pDevice = (PSDevice)pRCB->pDevice;
1550 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->RXvFreeRCB\n");
1552 ASSERT(!pRCB->Ref); // should be 0
1553 ASSERT(pRCB->pDevice); // shouldn't be NULL
1555 if (bReAllocSkb == TRUE) {
1556 pRCB->skb = dev_alloc_skb((int)pDevice->rx_buf_sz);
1557 // todo error handling
1558 if (pRCB->skb == NULL) {
1559 DBG_PRT(MSG_LEVEL_ERR,KERN_ERR" Failed to re-alloc rx skb\n");
1561 pRCB->skb->dev = pDevice->dev;
1565 // Insert the RCB back in the Recv free list
1567 EnqueueRCB(pDevice->FirstRecvFreeList, pDevice->LastRecvFreeList, pRCB);
1568 pDevice->NumRecvFreeList++;
1571 if ((pDevice->Flags & fMP_POST_READS) && MP_IS_READY(pDevice) &&
1572 (pDevice->bIsRxWorkItemQueued == FALSE) ) {
1574 pDevice->bIsRxWorkItemQueued = TRUE;
1575 tasklet_schedule(&pDevice->ReadWorkItem);
1577 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"<----RXFreeRCB %d %d\n",pDevice->NumRecvFreeList, pDevice->NumRecvMngList);
1581 void RXvMngWorkItem(void *Context)
1583 PSDevice pDevice = (PSDevice) Context;
1585 PSRxMgmtPacket pRxPacket;
1586 BOOL bReAllocSkb = FALSE;
1588 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"---->Rx Mng Thread\n");
1590 spin_lock_irq(&pDevice->lock);
1591 while (pDevice->NumRecvMngList!=0)
1593 pRCB = pDevice->FirstRecvMngList;
1594 pDevice->NumRecvMngList--;
1595 DequeueRCB(pDevice->FirstRecvMngList, pDevice->LastRecvMngList);
1599 ASSERT(pRCB);// cannot be NULL
1600 pRxPacket = &(pRCB->sMngPacket);
1601 vMgrRxManagePacket((void *) pDevice, &(pDevice->sMgmtObj), pRxPacket);
1603 if(pRCB->Ref == 0) {
1604 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"RxvFreeMng %d %d\n",pDevice->NumRecvFreeList, pDevice->NumRecvMngList);
1605 RXvFreeRCB(pRCB, bReAllocSkb);
1607 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO"Rx Mng Only we have the right to free RCB\n");
1611 pDevice->bIsRxMngWorkItemQueued = FALSE;
1612 spin_unlock_irq(&pDevice->lock);