1/******************************************************************************
2 * rtl8712_recv.c
3 *
4 * Copyright(c) 2007 - 2010 Realtek Corporation. All rights reserved.
5 * Linux device driver for RTL8192SU
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of version 2 of the GNU General Public License as
9 * published by the Free Software Foundation.
10 *
11 * This program is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14 * more details.
15 *
16 * You should have received a copy of the GNU General Public License along with
17 * this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA
19 *
20 * Modifications for inclusion into the Linux staging tree are
21 * Copyright(c) 2010 Larry Finger. All rights reserved.
22 *
23 * Contact information:
24 * WLAN FAE <wlanfae@realtek.com>
25 * Larry Finger <Larry.Finger@lwfinger.net>
26 *
27 ******************************************************************************/
28
29#define _RTL8712_RECV_C_
30
31#include <linux/if_ether.h>
32#include <linux/ip.h>
33
34#include "osdep_service.h"
35#include "drv_types.h"
36#include "recv_osdep.h"
37#include "mlme_osdep.h"
38#include "ethernet.h"
39#include "usb_ops.h"
40#include "wifi.h"
41
42/* Bridge-Tunnel header (for EtherTypes ETH_P_AARP and ETH_P_IPX) */
43static u8 bridge_tunnel_header[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0xf8};
44
45/* Ethernet-II snap header (RFC1042 for most EtherTypes) */
46static u8 rfc1042_header[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
47
48static void recv_tasklet(void *priv);
49
50int r8712_init_recv_priv(struct recv_priv *precvpriv, struct _adapter *padapter)
51{
52	int i;
53	struct recv_buf *precvbuf;
54	int res = _SUCCESS;
55	addr_t tmpaddr = 0;
56	int alignment = 0;
57	struct sk_buff *pskb = NULL;
58
59	/*init recv_buf*/
60	_init_queue(&precvpriv->free_recv_buf_queue);
61	precvpriv->pallocated_recv_buf =
62		kzalloc(NR_RECVBUFF * sizeof(struct recv_buf) + 4, GFP_ATOMIC);
63	if (precvpriv->pallocated_recv_buf == NULL)
64		return _FAIL;
65	precvpriv->precv_buf = precvpriv->pallocated_recv_buf + 4 -
66			      ((addr_t) (precvpriv->pallocated_recv_buf) & 3);
67	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
68	for (i = 0; i < NR_RECVBUFF; i++) {
69		INIT_LIST_HEAD(&precvbuf->list);
70		spin_lock_init(&precvbuf->recvbuf_lock);
71		res = r8712_os_recvbuf_resource_alloc(padapter, precvbuf);
72		if (res == _FAIL)
73			break;
74		precvbuf->ref_cnt = 0;
75		precvbuf->adapter = padapter;
76		list_add_tail(&precvbuf->list,
77				 &(precvpriv->free_recv_buf_queue.queue));
78		precvbuf++;
79	}
80	precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF;
81	tasklet_init(&precvpriv->recv_tasklet,
82	     (void(*)(unsigned long))recv_tasklet,
83	     (unsigned long)padapter);
84	skb_queue_head_init(&precvpriv->rx_skb_queue);
85
86	skb_queue_head_init(&precvpriv->free_recv_skb_queue);
87	for (i = 0; i < NR_PREALLOC_RECV_SKB; i++) {
88		pskb = netdev_alloc_skb(padapter->pnetdev, MAX_RECVBUF_SZ +
89		       RECVBUFF_ALIGN_SZ);
90		if (pskb) {
91			tmpaddr = (addr_t)pskb->data;
92			alignment = tmpaddr & (RECVBUFF_ALIGN_SZ - 1);
93			skb_reserve(pskb, (RECVBUFF_ALIGN_SZ - alignment));
94			skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
95		}
96		pskb = NULL;
97	}
98	return res;
99}
100
101void r8712_free_recv_priv(struct recv_priv *precvpriv)
102{
103	int i;
104	struct recv_buf *precvbuf;
105	struct _adapter *padapter = precvpriv->adapter;
106
107	precvbuf = (struct recv_buf *)precvpriv->precv_buf;
108	for (i = 0; i < NR_RECVBUFF; i++) {
109		r8712_os_recvbuf_resource_free(padapter, precvbuf);
110		precvbuf++;
111	}
112	kfree(precvpriv->pallocated_recv_buf);
113	skb_queue_purge(&precvpriv->rx_skb_queue);
114	if (skb_queue_len(&precvpriv->rx_skb_queue))
115		netdev_warn(padapter->pnetdev, "r8712u: rx_skb_queue not empty\n");
116	skb_queue_purge(&precvpriv->free_recv_skb_queue);
117	if (skb_queue_len(&precvpriv->free_recv_skb_queue))
118		netdev_warn(padapter->pnetdev, "r8712u: free_recv_skb_queue not empty %d\n",
119			    skb_queue_len(&precvpriv->free_recv_skb_queue));
120}
121
122int r8712_init_recvbuf(struct _adapter *padapter, struct recv_buf *precvbuf)
123{
124	precvbuf->transfer_len = 0;
125	precvbuf->len = 0;
126	precvbuf->ref_cnt = 0;
127	if (precvbuf->pbuf) {
128		precvbuf->pdata = precvbuf->pbuf;
129		precvbuf->phead = precvbuf->pbuf;
130		precvbuf->ptail = precvbuf->pbuf;
131		precvbuf->pend = precvbuf->pdata + MAX_RECVBUF_SZ;
132	}
133	return _SUCCESS;
134}
135
136int r8712_free_recvframe(union recv_frame *precvframe,
137		   struct  __queue *pfree_recv_queue)
138{
139	unsigned long irqL;
140	struct _adapter *padapter = precvframe->u.hdr.adapter;
141	struct recv_priv *precvpriv = &padapter->recvpriv;
142
143	if (precvframe->u.hdr.pkt) {
144		dev_kfree_skb_any(precvframe->u.hdr.pkt);/*free skb by driver*/
145		precvframe->u.hdr.pkt = NULL;
146	}
147	spin_lock_irqsave(&pfree_recv_queue->lock, irqL);
148	list_del_init(&(precvframe->u.hdr.list));
149	list_add_tail(&(precvframe->u.hdr.list), &pfree_recv_queue->queue);
150	if (padapter != NULL) {
151		if (pfree_recv_queue == &precvpriv->free_recv_queue)
152				precvpriv->free_recvframe_cnt++;
153	}
154	spin_unlock_irqrestore(&pfree_recv_queue->lock, irqL);
155	return _SUCCESS;
156}
157
158static void update_recvframe_attrib_from_recvstat(struct rx_pkt_attrib *pattrib,
159					   struct recv_stat *prxstat)
160{
161	u16 drvinfo_sz;
162
163	drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
164	drvinfo_sz <<= 3;
165	/*TODO:
166	 * Offset 0 */
167	pattrib->bdecrypted = ((le32_to_cpu(prxstat->rxdw0) & BIT(27)) >> 27)
168				 ? 0 : 1;
169	pattrib->crc_err = (le32_to_cpu(prxstat->rxdw0) & BIT(14)) >> 14;
170	/*Offset 4*/
171	/*Offset 8*/
172	/*Offset 12*/
173	if (le32_to_cpu(prxstat->rxdw3) & BIT(13)) {
174		pattrib->tcpchk_valid = 1; /* valid */
175		if (le32_to_cpu(prxstat->rxdw3) & BIT(11))
176			pattrib->tcp_chkrpt = 1; /* correct */
177		else
178			pattrib->tcp_chkrpt = 0; /* incorrect */
179		if (le32_to_cpu(prxstat->rxdw3) & BIT(12))
180			pattrib->ip_chkrpt = 1; /* correct */
181		else
182			pattrib->ip_chkrpt = 0; /* incorrect */
183	} else {
184		pattrib->tcpchk_valid = 0; /* invalid */
185	}
186	pattrib->mcs_rate = (u8)((le32_to_cpu(prxstat->rxdw3)) & 0x3f);
187	pattrib->htc = (u8)((le32_to_cpu(prxstat->rxdw3) >> 14) & 0x1);
188	/*Offset 16*/
189	/*Offset 20*/
190	/*phy_info*/
191}
192
193/*perform defrag*/
194static union recv_frame *recvframe_defrag(struct _adapter *adapter,
195				   struct  __queue *defrag_q)
196{
197	struct list_head *plist, *phead;
198	u8 wlanhdr_offset;
199	u8	curfragnum;
200	struct recv_frame_hdr *pfhdr, *pnfhdr;
201	union recv_frame *prframe, *pnextrframe;
202	struct  __queue	*pfree_recv_queue;
203
204	pfree_recv_queue = &adapter->recvpriv.free_recv_queue;
205	phead = &defrag_q->queue;
206	plist = phead->next;
207	prframe = LIST_CONTAINOR(plist, union recv_frame, u);
208	list_del_init(&prframe->u.list);
209	pfhdr = &prframe->u.hdr;
210	curfragnum = 0;
211	if (curfragnum != pfhdr->attrib.frag_num) {
212		/*the first fragment number must be 0
213		 *free the whole queue*/
214		r8712_free_recvframe(prframe, pfree_recv_queue);
215		r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
216		return NULL;
217	}
218	curfragnum++;
219	plist = &defrag_q->queue;
220	plist = plist->next;
221	while (!end_of_queue_search(phead, plist)) {
222		pnextrframe = LIST_CONTAINOR(plist, union recv_frame, u);
223		pnfhdr = &pnextrframe->u.hdr;
224		/*check the fragment sequence  (2nd ~n fragment frame) */
225		if (curfragnum != pnfhdr->attrib.frag_num) {
226			/* the fragment number must increase  (after decache)
227			 * release the defrag_q & prframe */
228			r8712_free_recvframe(prframe, pfree_recv_queue);
229			r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
230			return NULL;
231		}
232		curfragnum++;
233		/* copy the 2nd~n fragment frame's payload to the first fragment
234		 * get the 2nd~last fragment frame's payload */
235		wlanhdr_offset = pnfhdr->attrib.hdrlen + pnfhdr->attrib.iv_len;
236		recvframe_pull(pnextrframe, wlanhdr_offset);
237		/* append  to first fragment frame's tail (if privacy frame,
238		 * pull the ICV) */
239		recvframe_pull_tail(prframe, pfhdr->attrib.icv_len);
240		memcpy(pfhdr->rx_tail, pnfhdr->rx_data, pnfhdr->len);
241		recvframe_put(prframe, pnfhdr->len);
242		pfhdr->attrib.icv_len = pnfhdr->attrib.icv_len;
243		plist = plist->next;
244	}
245	/* free the defrag_q queue and return the prframe */
246	r8712_free_recvframe_queue(defrag_q, pfree_recv_queue);
247	return prframe;
248}
249
250/* check if need to defrag, if needed queue the frame to defrag_q */
251union recv_frame *r8712_recvframe_chk_defrag(struct _adapter *padapter,
252					     union recv_frame *precv_frame)
253{
254	u8	ismfrag;
255	u8	fragnum;
256	u8   *psta_addr;
257	struct recv_frame_hdr *pfhdr;
258	struct sta_info *psta;
259	struct	sta_priv *pstapriv;
260	struct list_head *phead;
261	union recv_frame *prtnframe = NULL;
262	struct  __queue *pfree_recv_queue, *pdefrag_q;
263
264	pstapriv = &padapter->stapriv;
265	pfhdr = &precv_frame->u.hdr;
266	pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
267	/* need to define struct of wlan header frame ctrl */
268	ismfrag = pfhdr->attrib.mfrag;
269	fragnum = pfhdr->attrib.frag_num;
270	psta_addr = pfhdr->attrib.ta;
271	psta = r8712_get_stainfo(pstapriv, psta_addr);
272	if (psta == NULL)
273		pdefrag_q = NULL;
274	else
275		pdefrag_q = &psta->sta_recvpriv.defrag_q;
276
277	if ((ismfrag == 0) && (fragnum == 0))
278		prtnframe = precv_frame;/*isn't a fragment frame*/
279	if (ismfrag == 1) {
280		/* 0~(n-1) fragment frame
281		 * enqueue to defraf_g */
282		if (pdefrag_q != NULL) {
283			if (fragnum == 0) {
284				/*the first fragment*/
285				if (!list_empty(&pdefrag_q->queue)) {
286					/*free current defrag_q */
287					r8712_free_recvframe_queue(pdefrag_q,
288							     pfree_recv_queue);
289				}
290			}
291			/* Then enqueue the 0~(n-1) fragment to the defrag_q */
292			phead = &pdefrag_q->queue;
293			list_add_tail(&pfhdr->list, phead);
294			prtnframe = NULL;
295		} else {
296			/* can't find this ta's defrag_queue, so free this
297			 * recv_frame */
298			r8712_free_recvframe(precv_frame, pfree_recv_queue);
299			prtnframe = NULL;
300		}
301
302	}
303	if ((ismfrag == 0) && (fragnum != 0)) {
304		/* the last fragment frame
305		 * enqueue the last fragment */
306		if (pdefrag_q != NULL) {
307			phead = &pdefrag_q->queue;
308			list_add_tail(&pfhdr->list, phead);
309			/*call recvframe_defrag to defrag*/
310			precv_frame = recvframe_defrag(padapter, pdefrag_q);
311			prtnframe = precv_frame;
312		} else {
313			/* can't find this ta's defrag_queue, so free this
314			 *  recv_frame */
315			r8712_free_recvframe(precv_frame, pfree_recv_queue);
316			prtnframe = NULL;
317		}
318	}
319	if ((prtnframe != NULL) && (prtnframe->u.hdr.attrib.privacy)) {
320		/* after defrag we must check tkip mic code */
321		if (r8712_recvframe_chkmic(padapter, prtnframe) == _FAIL) {
322			r8712_free_recvframe(prtnframe, pfree_recv_queue);
323			prtnframe = NULL;
324		}
325	}
326	return prtnframe;
327}
328
329static int amsdu_to_msdu(struct _adapter *padapter, union recv_frame *prframe)
330{
331	int	a_len, padding_len;
332	u16	eth_type, nSubframe_Length;
333	u8	nr_subframes, i;
334	unsigned char *data_ptr, *pdata;
335	struct rx_pkt_attrib *pattrib;
336	_pkt *sub_skb, *subframes[MAX_SUBFRAME_COUNT];
337	struct recv_priv *precvpriv = &padapter->recvpriv;
338	struct  __queue *pfree_recv_queue = &(precvpriv->free_recv_queue);
339
340	nr_subframes = 0;
341	pattrib = &prframe->u.hdr.attrib;
342	recvframe_pull(prframe, prframe->u.hdr.attrib.hdrlen);
343	if (prframe->u.hdr.attrib.iv_len > 0)
344		recvframe_pull(prframe, prframe->u.hdr.attrib.iv_len);
345	a_len = prframe->u.hdr.len;
346	pdata = prframe->u.hdr.rx_data;
347	while (a_len > ETH_HLEN) {
348		/* Offset 12 denote 2 mac address */
349		nSubframe_Length = *((u16 *)(pdata + 12));
350		/*==m==>change the length order*/
351		nSubframe_Length = (nSubframe_Length >> 8) +
352				   (nSubframe_Length << 8);
353		if (a_len < (ETHERNET_HEADER_SIZE + nSubframe_Length)) {
354			netdev_warn(padapter->pnetdev, "r8712u: nRemain_Length is %d and nSubframe_Length is: %d\n",
355				    a_len, nSubframe_Length);
356			goto exit;
357		}
358		/* move the data point to data content */
359		pdata += ETH_HLEN;
360		a_len -= ETH_HLEN;
361		/* Allocate new skb for releasing to upper layer */
362		sub_skb = dev_alloc_skb(nSubframe_Length + 12);
363		if (!sub_skb)
364			break;
365		skb_reserve(sub_skb, 12);
366		data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length);
367		memcpy(data_ptr, pdata, nSubframe_Length);
368		subframes[nr_subframes++] = sub_skb;
369		if (nr_subframes >= MAX_SUBFRAME_COUNT) {
370			netdev_warn(padapter->pnetdev, "r8712u: ParseSubframe(): Too many Subframes! Packets dropped!\n");
371			break;
372		}
373		pdata += nSubframe_Length;
374		a_len -= nSubframe_Length;
375		if (a_len != 0) {
376			padding_len = 4 - ((nSubframe_Length + ETH_HLEN) & 3);
377			if (padding_len == 4)
378				padding_len = 0;
379			if (a_len < padding_len)
380				goto exit;
381			pdata += padding_len;
382			a_len -= padding_len;
383		}
384	}
385	for (i = 0; i < nr_subframes; i++) {
386		sub_skb = subframes[i];
387		/* convert hdr + possible LLC headers into Ethernet header */
388		eth_type = (sub_skb->data[6] << 8) | sub_skb->data[7];
389		if (sub_skb->len >= 8 &&
390		   ((!memcmp(sub_skb->data, rfc1042_header, SNAP_SIZE) &&
391		   eth_type != ETH_P_AARP && eth_type != ETH_P_IPX) ||
392		   !memcmp(sub_skb->data, bridge_tunnel_header, SNAP_SIZE))) {
393			/* remove RFC1042 or Bridge-Tunnel encapsulation and
394			 * replace EtherType */
395			skb_pull(sub_skb, SNAP_SIZE);
396			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src,
397				ETH_ALEN);
398			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst,
399				ETH_ALEN);
400		} else {
401			u16 len;
402			/* Leave Ethernet header part of hdr and full payload */
403			len = htons(sub_skb->len);
404			memcpy(skb_push(sub_skb, 2), &len, 2);
405			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->src,
406				ETH_ALEN);
407			memcpy(skb_push(sub_skb, ETH_ALEN), pattrib->dst,
408				ETH_ALEN);
409		}
410		/* Indicate the packets to upper layer */
411		if (sub_skb) {
412			sub_skb->protocol =
413				 eth_type_trans(sub_skb, padapter->pnetdev);
414			sub_skb->dev = padapter->pnetdev;
415			if ((pattrib->tcpchk_valid == 1) &&
416			    (pattrib->tcp_chkrpt == 1)) {
417				sub_skb->ip_summed = CHECKSUM_UNNECESSARY;
418			} else {
419				sub_skb->ip_summed = CHECKSUM_NONE;
420			}
421			netif_rx(sub_skb);
422		}
423	}
424exit:
425	prframe->u.hdr.len = 0;
426	r8712_free_recvframe(prframe, pfree_recv_queue);
427	return _SUCCESS;
428}
429
430void r8712_rxcmd_event_hdl(struct _adapter *padapter, void *prxcmdbuf)
431{
432	uint voffset;
433	u8 *poffset;
434	u16 cmd_len, drvinfo_sz;
435	struct recv_stat *prxstat;
436
437	poffset = (u8 *)prxcmdbuf;
438	voffset = *(uint *)poffset;
439	prxstat = (struct recv_stat *)prxcmdbuf;
440	drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
441	drvinfo_sz <<= 3;
442	poffset += RXDESC_SIZE + drvinfo_sz;
443	do {
444		voffset  = *(uint *)poffset;
445		cmd_len = (u16)(le32_to_cpu(voffset) & 0xffff);
446		r8712_event_handle(padapter, (uint *)poffset);
447		poffset += (cmd_len + 8);/*8 bytes alignment*/
448	} while (le32_to_cpu(voffset) & BIT(31));
449
450}
451
452static int check_indicate_seq(struct recv_reorder_ctrl *preorder_ctrl,
453			      u16 seq_num)
454{
455	u8 wsize = preorder_ctrl->wsize_b;
456	u16 wend = (preorder_ctrl->indicate_seq + wsize - 1) % 4096;
457
458	/* Rx Reorder initialize condition.*/
459	if (preorder_ctrl->indicate_seq == 0xffff)
460		preorder_ctrl->indicate_seq = seq_num;
461	/* Drop out the packet which SeqNum is smaller than WinStart */
462	if (SN_LESS(seq_num, preorder_ctrl->indicate_seq))
463		return false;
464	/*
465	 * Sliding window manipulation. Conditions includes:
466	 * 1. Incoming SeqNum is equal to WinStart =>Window shift 1
467	 * 2. Incoming SeqNum is larger than the WinEnd => Window shift N
468	 */
469	if (SN_EQUAL(seq_num, preorder_ctrl->indicate_seq))
470		preorder_ctrl->indicate_seq = (preorder_ctrl->indicate_seq +
471					      1) % 4096;
472	else if (SN_LESS(wend, seq_num)) {
473		if (seq_num >= (wsize - 1))
474			preorder_ctrl->indicate_seq = seq_num + 1 - wsize;
475		else
476			preorder_ctrl->indicate_seq = 4095 - (wsize -
477						      (seq_num + 1)) + 1;
478	}
479	return true;
480}
481
482static int enqueue_reorder_recvframe(struct recv_reorder_ctrl *preorder_ctrl,
483			      union recv_frame *prframe)
484{
485	struct list_head *phead, *plist;
486	union recv_frame *pnextrframe;
487	struct rx_pkt_attrib *pnextattrib;
488	struct  __queue *ppending_recvframe_queue =
489					&preorder_ctrl->pending_recvframe_queue;
490	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
491
492	phead = &ppending_recvframe_queue->queue;
493	plist = phead->next;
494	while (!end_of_queue_search(phead, plist)) {
495		pnextrframe = LIST_CONTAINOR(plist, union recv_frame, u);
496		pnextattrib = &pnextrframe->u.hdr.attrib;
497		if (SN_LESS(pnextattrib->seq_num, pattrib->seq_num))
498			plist = plist->next;
499		else if (SN_EQUAL(pnextattrib->seq_num, pattrib->seq_num))
500			return false;
501		else
502			break;
503	}
504	list_del_init(&(prframe->u.hdr.list));
505	list_add_tail(&(prframe->u.hdr.list), plist);
506	return true;
507}
508
509int r8712_recv_indicatepkts_in_order(struct _adapter *padapter,
510			       struct recv_reorder_ctrl *preorder_ctrl,
511			       int bforced)
512{
513	struct list_head *phead, *plist;
514	union recv_frame *prframe;
515	struct rx_pkt_attrib *pattrib;
516	int bPktInBuf = false;
517	struct recv_priv *precvpriv = &padapter->recvpriv;
518	struct  __queue *ppending_recvframe_queue =
519			 &preorder_ctrl->pending_recvframe_queue;
520
521	phead = &ppending_recvframe_queue->queue;
522	plist = phead->next;
523	/* Handling some condition for forced indicate case.*/
524	if (bforced) {
525		if (list_empty(phead))
526			return true;
527
528		prframe = LIST_CONTAINOR(plist, union recv_frame, u);
529		pattrib = &prframe->u.hdr.attrib;
530		preorder_ctrl->indicate_seq = pattrib->seq_num;
531	}
532	/* Prepare indication list and indication.
533	 * Check if there is any packet need indicate. */
534	while (!list_empty(phead)) {
535		prframe = LIST_CONTAINOR(plist, union recv_frame, u);
536		pattrib = &prframe->u.hdr.attrib;
537		if (!SN_LESS(preorder_ctrl->indicate_seq, pattrib->seq_num)) {
538			plist = plist->next;
539			list_del_init(&(prframe->u.hdr.list));
540			if (SN_EQUAL(preorder_ctrl->indicate_seq,
541			    pattrib->seq_num))
542				preorder_ctrl->indicate_seq =
543				  (preorder_ctrl->indicate_seq + 1) % 4096;
544			/*indicate this recv_frame*/
545			if (!pattrib->amsdu) {
546				if (!padapter->bDriverStopped &&
547				    !padapter->bSurpriseRemoved) {
548					/* indicate this recv_frame */
549					r8712_recv_indicatepkt(padapter,
550							       prframe);
551				}
552			} else if (pattrib->amsdu == 1) {
553				if (amsdu_to_msdu(padapter, prframe) !=
554				    _SUCCESS)
555					r8712_free_recvframe(prframe,
556						   &precvpriv->free_recv_queue);
557			}
558			/* Update local variables. */
559			bPktInBuf = false;
560		} else {
561			bPktInBuf = true;
562			break;
563		}
564	}
565	return bPktInBuf;
566}
567
568static int recv_indicatepkt_reorder(struct _adapter *padapter,
569			     union recv_frame *prframe)
570{
571	unsigned long irql;
572	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
573	struct recv_reorder_ctrl *preorder_ctrl = prframe->u.hdr.preorder_ctrl;
574	struct  __queue *ppending_recvframe_queue =
575			 &preorder_ctrl->pending_recvframe_queue;
576
577	if (!pattrib->amsdu) {
578		/* s1. */
579		r8712_wlanhdr_to_ethhdr(prframe);
580		if (pattrib->qos != 1) {
581			if (!padapter->bDriverStopped &&
582			    !padapter->bSurpriseRemoved) {
583				r8712_recv_indicatepkt(padapter, prframe);
584				return _SUCCESS;
585			} else {
586				return _FAIL;
587			}
588		}
589	}
590	spin_lock_irqsave(&ppending_recvframe_queue->lock, irql);
591	/*s2. check if winstart_b(indicate_seq) needs to be updated*/
592	if (!check_indicate_seq(preorder_ctrl, pattrib->seq_num))
593		goto _err_exit;
594	/*s3. Insert all packet into Reorder Queue to maintain its ordering.*/
595	if (!enqueue_reorder_recvframe(preorder_ctrl, prframe))
596		goto _err_exit;
597	/*s4.
598	 * Indication process.
599	 * After Packet dropping and Sliding Window shifting as above, we can
600	 * now just indicate the packets with the SeqNum smaller than latest
601	 * WinStart and buffer other packets.
602	 *
603	 * For Rx Reorder condition:
604	 * 1. All packets with SeqNum smaller than WinStart => Indicate
605	 * 2. All packets with SeqNum larger than or equal to
606	 * WinStart => Buffer it.
607	 */
608	if (r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, false) ==
609	    true) {
610		mod_timer(&preorder_ctrl->reordering_ctrl_timer,
611			  jiffies + msecs_to_jiffies(REORDER_WAIT_TIME));
612		spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
613	} else {
614		spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
615		del_timer(&preorder_ctrl->reordering_ctrl_timer);
616	}
617	return _SUCCESS;
618_err_exit:
619	spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
620	return _FAIL;
621}
622
623void r8712_reordering_ctrl_timeout_handler(void *pcontext)
624{
625	unsigned long irql;
626	struct recv_reorder_ctrl *preorder_ctrl =
627				 (struct recv_reorder_ctrl *)pcontext;
628	struct _adapter *padapter = preorder_ctrl->padapter;
629	struct  __queue *ppending_recvframe_queue =
630				 &preorder_ctrl->pending_recvframe_queue;
631
632	if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
633		return;
634	spin_lock_irqsave(&ppending_recvframe_queue->lock, irql);
635	r8712_recv_indicatepkts_in_order(padapter, preorder_ctrl, true);
636	spin_unlock_irqrestore(&ppending_recvframe_queue->lock, irql);
637}
638
639static int r8712_process_recv_indicatepkts(struct _adapter *padapter,
640			      union recv_frame *prframe)
641{
642	int retval = _SUCCESS;
643	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
644	struct ht_priv	*phtpriv = &pmlmepriv->htpriv;
645
646	if (phtpriv->ht_option == 1) { /*B/G/N Mode*/
647		if (recv_indicatepkt_reorder(padapter, prframe) != _SUCCESS) {
648			/* including perform A-MPDU Rx Ordering Buffer Control*/
649			if (!padapter->bDriverStopped &&
650			    !padapter->bSurpriseRemoved)
651				return _FAIL;
652		}
653	} else { /*B/G mode*/
654		retval = r8712_wlanhdr_to_ethhdr(prframe);
655		if (retval != _SUCCESS)
656			return retval;
657		if (!padapter->bDriverStopped && !padapter->bSurpriseRemoved) {
658			/* indicate this recv_frame */
659			r8712_recv_indicatepkt(padapter, prframe);
660		} else {
661			return _FAIL;
662		}
663	}
664	return retval;
665}
666
667static u8 query_rx_pwr_percentage(s8 antpower)
668{
669	if ((antpower <= -100) || (antpower >= 20))
670		return	0;
671	else if (antpower >= 0)
672		return	100;
673	else
674		return 100 + antpower;
675}
676
677static u8 evm_db2percentage(s8 value)
678{
679	/*
680	 * -33dB~0dB to 0%~99%
681	 */
682	s8 ret_val;
683
684	ret_val = value;
685	if (ret_val >= 0)
686		ret_val = 0;
687	if (ret_val <= -33)
688		ret_val = -33;
689	ret_val = -ret_val;
690	ret_val *= 3;
691	if (ret_val == 99)
692		ret_val = 100;
693	return ret_val;
694}
695
696s32 r8712_signal_scale_mapping(s32 cur_sig)
697{
698	s32 ret_sig;
699
700	if (cur_sig >= 51 && cur_sig <= 100)
701		ret_sig = 100;
702	else if (cur_sig >= 41 && cur_sig <= 50)
703		ret_sig = 80 + ((cur_sig - 40) * 2);
704	else if (cur_sig >= 31 && cur_sig <= 40)
705		ret_sig = 66 + (cur_sig - 30);
706	else if (cur_sig >= 21 && cur_sig <= 30)
707		ret_sig = 54 + (cur_sig - 20);
708	else if (cur_sig >= 10 && cur_sig <= 20)
709		ret_sig = 42 + (((cur_sig - 10) * 2) / 3);
710	else if (cur_sig >= 5 && cur_sig <= 9)
711		ret_sig = 22 + (((cur_sig - 5) * 3) / 2);
712	else if (cur_sig >= 1 && cur_sig <= 4)
713		ret_sig = 6 + (((cur_sig - 1) * 3) / 2);
714	else
715		ret_sig = cur_sig;
716	return ret_sig;
717}
718
719static s32  translate2dbm(struct _adapter *padapter, u8 signal_strength_idx)
720{
721	s32 signal_power; /* in dBm.*/
722	/* Translate to dBm (x=0.5y-95).*/
723	signal_power = (s32)((signal_strength_idx + 1) >> 1);
724	signal_power -= 95;
725	return signal_power;
726}
727
728static void query_rx_phy_status(struct _adapter *padapter,
729				union recv_frame *prframe)
730{
731	u8 i, max_spatial_stream, evm;
732	struct recv_stat *prxstat = (struct recv_stat *)prframe->u.hdr.rx_head;
733	struct phy_stat *pphy_stat = (struct phy_stat *)(prxstat + 1);
734	u8 *pphy_head = (u8 *)(prxstat + 1);
735	s8 rx_pwr[4], rx_pwr_all;
736	u8 pwdb_all;
737	u32 rssi, total_rssi = 0;
738	u8 bcck_rate = 0, rf_rx_num = 0, cck_highpwr = 0;
739	struct phy_cck_rx_status *pcck_buf;
740	u8 sq;
741
742	/* Record it for next packet processing*/
743	bcck_rate = (prframe->u.hdr.attrib.mcs_rate <= 3 ? 1 : 0);
744	if (bcck_rate) {
745		u8 report;
746
747		/* CCK Driver info Structure is not the same as OFDM packet.*/
748		pcck_buf = (struct phy_cck_rx_status *)pphy_stat;
749		/* (1)Hardware does not provide RSSI for CCK
750		 * (2)PWDB, Average PWDB cacluated by hardware
751		 * (for rate adaptive)
752		 */
753		if (!cck_highpwr) {
754			report = pcck_buf->cck_agc_rpt & 0xc0;
755			report >>= 6;
756			switch (report) {
757			/* Modify the RF RNA gain value to -40, -20,
758			 * -2, 14 by Jenyu's suggestion
759			 * Note: different RF with the different
760			 * RNA gain. */
761			case 0x3:
762				rx_pwr_all = -40 - (pcck_buf->cck_agc_rpt &
763					     0x3e);
764				break;
765			case 0x2:
766				rx_pwr_all = -20 - (pcck_buf->cck_agc_rpt &
767					     0x3e);
768				break;
769			case 0x1:
770				rx_pwr_all = -2 - (pcck_buf->cck_agc_rpt &
771					     0x3e);
772				break;
773			case 0x0:
774				rx_pwr_all = 14 - (pcck_buf->cck_agc_rpt &
775					     0x3e);
776				break;
777			}
778		} else {
779			report = ((u8)(le32_to_cpu(pphy_stat->phydw1) >> 8)) &
780				 0x60;
781			report >>= 5;
782			switch (report) {
783			case 0x3:
784				rx_pwr_all = -40 - ((pcck_buf->cck_agc_rpt &
785					     0x1f) << 1);
786				break;
787			case 0x2:
788				rx_pwr_all = -20 - ((pcck_buf->cck_agc_rpt &
789					     0x1f) << 1);
790				break;
791			case 0x1:
792				rx_pwr_all = -2 - ((pcck_buf->cck_agc_rpt &
793					     0x1f) << 1);
794				break;
795			case 0x0:
796				rx_pwr_all = 14 - ((pcck_buf->cck_agc_rpt &
797					     0x1f) << 1);
798				break;
799			}
800		}
801		pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
802		/* CCK gain is smaller than OFDM/MCS gain,*/
803		/* so we add gain diff by experiences, the val is 6 */
804		pwdb_all += 6;
805		if (pwdb_all > 100)
806			pwdb_all = 100;
807		/* modify the offset to make the same gain index with OFDM.*/
808		if (pwdb_all > 34 && pwdb_all <= 42)
809			pwdb_all -= 2;
810		else if (pwdb_all > 26 && pwdb_all <= 34)
811			pwdb_all -= 6;
812		else if (pwdb_all > 14 && pwdb_all <= 26)
813			pwdb_all -= 8;
814		else if (pwdb_all > 4 && pwdb_all <= 14)
815			pwdb_all -= 4;
816		/*
817		 * (3) Get Signal Quality (EVM)
818		 */
819		if (pwdb_all > 40) {
820			sq = 100;
821		} else {
822			sq = pcck_buf->sq_rpt;
823			if (pcck_buf->sq_rpt > 64)
824				sq = 0;
825			else if (pcck_buf->sq_rpt < 20)
826				sq = 100;
827			else
828				sq = ((64 - sq) * 100) / 44;
829		}
830		prframe->u.hdr.attrib.signal_qual = sq;
831		prframe->u.hdr.attrib.rx_mimo_signal_qual[0] = sq;
832		prframe->u.hdr.attrib.rx_mimo_signal_qual[1] = -1;
833	} else {
834		/* (1)Get RSSI for HT rate */
835		for (i = 0; i < ((padapter->registrypriv.rf_config) &
836			    0x0f); i++) {
837			rf_rx_num++;
838			rx_pwr[i] = ((pphy_head[PHY_STAT_GAIN_TRSW_SHT + i]
839				    & 0x3F) * 2) - 110;
840			/* Translate DBM to percentage. */
841			rssi = query_rx_pwr_percentage(rx_pwr[i]);
842			total_rssi += rssi;
843		}
844		/* (2)PWDB, Average PWDB cacluated by hardware (for
845		 * rate adaptive) */
846		rx_pwr_all = (((pphy_head[PHY_STAT_PWDB_ALL_SHT]) >> 1) & 0x7f)
847			     - 106;
848		pwdb_all = query_rx_pwr_percentage(rx_pwr_all);
849
850		{
851			/* (3)EVM of HT rate */
852			if (prframe->u.hdr.attrib.htc &&
853			    prframe->u.hdr.attrib.mcs_rate >= 20 &&
854			    prframe->u.hdr.attrib.mcs_rate <= 27) {
855				/* both spatial stream make sense */
856				max_spatial_stream = 2;
857			} else {
858				/* only spatial stream 1 makes sense */
859				max_spatial_stream = 1;
860			}
861			for (i = 0; i < max_spatial_stream; i++) {
862				evm = evm_db2percentage((pphy_head
863				      [PHY_STAT_RXEVM_SHT + i]));/*dbm*/
864				prframe->u.hdr.attrib.signal_qual =
865					 (u8)(evm & 0xff);
866				prframe->u.hdr.attrib.rx_mimo_signal_qual[i] =
867					 (u8)(evm & 0xff);
868			}
869		}
870	}
871	/* UI BSS List signal strength(in percentage), make it good looking,
872	 * from 0~100. It is assigned to the BSS List in
873	 * GetValueFromBeaconOrProbeRsp(). */
874	if (bcck_rate)
875		prframe->u.hdr.attrib.signal_strength =
876			 (u8)r8712_signal_scale_mapping(pwdb_all);
877	else {
878		if (rf_rx_num != 0)
879			prframe->u.hdr.attrib.signal_strength =
880				 (u8)(r8712_signal_scale_mapping(total_rssi /=
881				 rf_rx_num));
882	}
883}
884
885static void process_link_qual(struct _adapter *padapter,
886			      union recv_frame *prframe)
887{
888	u32	last_evm = 0, tmpVal;
889	struct rx_pkt_attrib *pattrib;
890
891	if (prframe == NULL || padapter == NULL)
892		return;
893	pattrib = &prframe->u.hdr.attrib;
894	if (pattrib->signal_qual != 0) {
895		/*
896		 * 1. Record the general EVM to the sliding window.
897		 */
898		if (padapter->recvpriv.signal_qual_data.total_num++ >=
899				  PHY_LINKQUALITY_SLID_WIN_MAX) {
900			padapter->recvpriv.signal_qual_data.total_num =
901				  PHY_LINKQUALITY_SLID_WIN_MAX;
902			last_evm = padapter->recvpriv.signal_qual_data.elements
903				  [padapter->recvpriv.signal_qual_data.index];
904			padapter->recvpriv.signal_qual_data.total_val -=
905				  last_evm;
906		}
907		padapter->recvpriv.signal_qual_data.total_val +=
908			  pattrib->signal_qual;
909		padapter->recvpriv.signal_qual_data.elements[padapter->
910			  recvpriv.signal_qual_data.index++] =
911			  pattrib->signal_qual;
912		if (padapter->recvpriv.signal_qual_data.index >=
913		    PHY_LINKQUALITY_SLID_WIN_MAX)
914			padapter->recvpriv.signal_qual_data.index = 0;
915
916		/* <1> Showed on UI for user, in percentage. */
917		tmpVal = padapter->recvpriv.signal_qual_data.total_val /
918			 padapter->recvpriv.signal_qual_data.total_num;
919		padapter->recvpriv.signal = (u8)tmpVal;
920	}
921}
922
923static void process_rssi(struct _adapter *padapter, union recv_frame *prframe)
924{
925	u32 last_rssi, tmp_val;
926	struct rx_pkt_attrib *pattrib = &prframe->u.hdr.attrib;
927
928	if (padapter->recvpriv.signal_strength_data.total_num++ >=
929	    PHY_RSSI_SLID_WIN_MAX) {
930		padapter->recvpriv.signal_strength_data.total_num =
931			 PHY_RSSI_SLID_WIN_MAX;
932		last_rssi = padapter->recvpriv.signal_strength_data.elements
933			    [padapter->recvpriv.signal_strength_data.index];
934		padapter->recvpriv.signal_strength_data.total_val -= last_rssi;
935	}
936	padapter->recvpriv.signal_strength_data.total_val +=
937			pattrib->signal_strength;
938	padapter->recvpriv.signal_strength_data.elements[padapter->recvpriv.
939			signal_strength_data.index++] =
940			pattrib->signal_strength;
941	if (padapter->recvpriv.signal_strength_data.index >=
942	    PHY_RSSI_SLID_WIN_MAX)
943		padapter->recvpriv.signal_strength_data.index = 0;
944	tmp_val = padapter->recvpriv.signal_strength_data.total_val /
945		  padapter->recvpriv.signal_strength_data.total_num;
946	padapter->recvpriv.rssi = (s8)translate2dbm(padapter, (u8)tmp_val);
947}
948
949static void process_phy_info(struct _adapter *padapter,
950			     union recv_frame *prframe)
951{
952	query_rx_phy_status(padapter, prframe);
953	process_rssi(padapter, prframe);
954	process_link_qual(padapter,  prframe);
955}
956
957int recv_func(struct _adapter *padapter, void *pcontext)
958{
959	struct rx_pkt_attrib *pattrib;
960	union recv_frame *prframe, *orig_prframe;
961	int retval = _SUCCESS;
962	struct  __queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue;
963	struct	mlme_priv	*pmlmepriv = &padapter->mlmepriv;
964
965	prframe = (union recv_frame *)pcontext;
966	orig_prframe = prframe;
967	pattrib = &prframe->u.hdr.attrib;
968	if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) {
969		if (pattrib->crc_err == 1)
970			padapter->mppriv.rx_crcerrpktcount++;
971		else
972			padapter->mppriv.rx_pktcount++;
973		if (!check_fwstate(pmlmepriv, WIFI_MP_LPBK_STATE)) {
974			/* free this recv_frame */
975			r8712_free_recvframe(orig_prframe, pfree_recv_queue);
976			goto _exit_recv_func;
977		}
978	}
979	/* check the frame crtl field and decache */
980	retval = r8712_validate_recv_frame(padapter, prframe);
981	if (retval != _SUCCESS) {
982		/* free this recv_frame */
983		r8712_free_recvframe(orig_prframe, pfree_recv_queue);
984		goto _exit_recv_func;
985	}
986	process_phy_info(padapter, prframe);
987	prframe = r8712_decryptor(padapter, prframe);
988	if (prframe == NULL) {
989		retval = _FAIL;
990		goto _exit_recv_func;
991	}
992	prframe = r8712_recvframe_chk_defrag(padapter, prframe);
993	if (prframe == NULL)
994		goto _exit_recv_func;
995	prframe = r8712_portctrl(padapter, prframe);
996	if (prframe == NULL) {
997		retval = _FAIL;
998		goto _exit_recv_func;
999	}
1000	retval = r8712_process_recv_indicatepkts(padapter, prframe);
1001	if (retval != _SUCCESS) {
1002		r8712_free_recvframe(orig_prframe, pfree_recv_queue);
1003		goto _exit_recv_func;
1004	}
1005_exit_recv_func:
1006	return retval;
1007}
1008
1009static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
1010{
1011	u8 *pbuf, shift_sz = 0;
1012	u8	frag, mf;
1013	uint	pkt_len;
1014	u32 transfer_len;
1015	struct recv_stat *prxstat;
1016	u16	pkt_cnt, drvinfo_sz, pkt_offset, tmp_len, alloc_sz;
1017	struct  __queue *pfree_recv_queue;
1018	_pkt  *pkt_copy = NULL;
1019	union recv_frame *precvframe = NULL;
1020	struct recv_priv *precvpriv = &padapter->recvpriv;
1021
1022	pfree_recv_queue = &(precvpriv->free_recv_queue);
1023	pbuf = pskb->data;
1024	prxstat = (struct recv_stat *)pbuf;
1025	pkt_cnt = (le32_to_cpu(prxstat->rxdw2) >> 16) & 0xff;
1026	pkt_len =  le32_to_cpu(prxstat->rxdw0) & 0x00003fff;
1027	transfer_len = pskb->len;
1028	/* Test throughput with Netgear 3700 (No security) with Chariot 3T3R
1029	 * pairs. The packet count will be a big number so that the containing
1030	 * packet will effect the Rx reordering. */
1031	if (transfer_len < pkt_len) {
1032		/* In this case, it means the MAX_RECVBUF_SZ is too small to
1033		 * get the data from 8712u. */
1034		return _FAIL;
1035	}
1036	do {
1037		prxstat = (struct recv_stat *)pbuf;
1038		pkt_len =  le32_to_cpu(prxstat->rxdw0) & 0x00003fff;
1039		/* more fragment bit */
1040		mf = (le32_to_cpu(prxstat->rxdw1) >> 27) & 0x1;
1041		/* ragmentation number */
1042		frag = (le32_to_cpu(prxstat->rxdw2) >> 12) & 0xf;
1043		/* uint 2^3 = 8 bytes */
1044		drvinfo_sz = (le32_to_cpu(prxstat->rxdw0) & 0x000f0000) >> 16;
1045		drvinfo_sz <<= 3;
1046		if (pkt_len <= 0)
1047			goto  _exit_recvbuf2recvframe;
1048		/* Qos data, wireless lan header length is 26 */
1049		if ((le32_to_cpu(prxstat->rxdw0) >> 23) & 0x01)
1050			shift_sz = 2;
1051		precvframe = r8712_alloc_recvframe(pfree_recv_queue);
1052		if (precvframe == NULL)
1053			goto  _exit_recvbuf2recvframe;
1054		INIT_LIST_HEAD(&precvframe->u.hdr.list);
1055		precvframe->u.hdr.precvbuf = NULL; /*can't access the precvbuf*/
1056		precvframe->u.hdr.len = 0;
1057		tmp_len = pkt_len + drvinfo_sz + RXDESC_SIZE;
1058		pkt_offset = (u16)round_up(tmp_len, 128);
1059		/* for first fragment packet, driver need allocate 1536 +
1060		 * drvinfo_sz + RXDESC_SIZE to defrag packet. */
1061		if ((mf == 1) && (frag == 0))
1062			/*1658+6=1664, 1664 is 128 alignment.*/
1063			alloc_sz = max_t(u16, tmp_len, 1658);
1064		else
1065			alloc_sz = tmp_len;
1066		/* 2 is for IP header 4 bytes alignment in QoS packet case.
1067		 * 4 is for skb->data 4 bytes alignment. */
1068		alloc_sz += 6;
1069		pkt_copy = netdev_alloc_skb(padapter->pnetdev, alloc_sz);
1070		if (pkt_copy) {
1071			precvframe->u.hdr.pkt = pkt_copy;
1072			skb_reserve(pkt_copy, 4 - ((addr_t)(pkt_copy->data)
1073				    % 4));
1074			skb_reserve(pkt_copy, shift_sz);
1075			memcpy(pkt_copy->data, pbuf, tmp_len);
1076			precvframe->u.hdr.rx_head = precvframe->u.hdr.rx_data =
1077				 precvframe->u.hdr.rx_tail = pkt_copy->data;
1078			precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz;
1079		} else {
1080			precvframe->u.hdr.pkt = skb_clone(pskb, GFP_ATOMIC);
1081			if (!precvframe->u.hdr.pkt)
1082				return _FAIL;
1083			precvframe->u.hdr.rx_head = pbuf;
1084			precvframe->u.hdr.rx_data = pbuf;
1085			precvframe->u.hdr.rx_tail = pbuf;
1086			precvframe->u.hdr.rx_end = pbuf + alloc_sz;
1087		}
1088		recvframe_put(precvframe, tmp_len);
1089		recvframe_pull(precvframe, drvinfo_sz + RXDESC_SIZE);
1090		/* because the endian issue, driver avoid reference to the
1091		 * rxstat after calling update_recvframe_attrib_from_recvstat();
1092		 */
1093		update_recvframe_attrib_from_recvstat(&precvframe->u.hdr.attrib,
1094						      prxstat);
1095		r8712_recv_entry(precvframe);
1096		transfer_len -= pkt_offset;
1097		pbuf += pkt_offset;
1098		pkt_cnt--;
1099		precvframe = NULL;
1100		pkt_copy = NULL;
1101	} while ((transfer_len > 0) && pkt_cnt > 0);
1102_exit_recvbuf2recvframe:
1103	return _SUCCESS;
1104}
1105
1106static void recv_tasklet(void *priv)
1107{
1108	struct sk_buff *pskb;
1109	struct _adapter *padapter = (struct _adapter *)priv;
1110	struct recv_priv *precvpriv = &padapter->recvpriv;
1111
1112	while (NULL != (pskb = skb_dequeue(&precvpriv->rx_skb_queue))) {
1113		recvbuf2recvframe(padapter, pskb);
1114		skb_reset_tail_pointer(pskb);
1115		pskb->len = 0;
1116		if (!skb_cloned(pskb))
1117			skb_queue_tail(&precvpriv->free_recv_skb_queue, pskb);
1118		else
1119			consume_skb(pskb);
1120	}
1121}
1122