drivers/staging/rtl8188eu/core/rtw_mlme_ext.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /******************************************************************************
   3  *
   4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   5  *
   6  ******************************************************************************/
   7 #define _RTW_MLME_EXT_C_
   8
   9 #include <linux/ieee80211.h>
  10 #include <asm/unaligned.h>
  11
  12 #include <osdep_service.h>
  13 #include <drv_types.h>
  14 #include <wifi.h>
  15 #include <rtw_mlme_ext.h>
  16 #include <wlan_bssdef.h>
  17 #include <mlme_osdep.h>
  18 #include <recv_osdep.h>
  19
  20 static u8 null_addr[ETH_ALEN] = {};
  21
  22 /* OUI definitions for the vendor specific IE */
  23 const u8 RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  24 const u8 WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  25 static const u8 WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  26 static const u8 P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  27
  28 static const u8 WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  29
  30 const u8 WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
  31 const u8 RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
  32
  33 /* MCS rate definitions */
  34 const u8 MCS_rate_1R[16] = {
  35         0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
  36         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
  37 };
  38
  39 /* ChannelPlan definitions */
  40 static struct rt_channel_plan_2g RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  41         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  42         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  43         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  44         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  45         {{10, 11, 12, 13}, 4},                                  /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  46         {{}, 0},                                                                        /*  0x05, RT_CHANNEL_DOMAIN_2G_NULL */
  47 };
  48
  49 static struct rt_channel_plan_map RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  50         /*  0x00 ~ 0x1F , Old Define ===== */
  51         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  52         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  53         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  54         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  55         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  56         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  57         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  58         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  59         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  60         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  61         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  62         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  63         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  64         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  65         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  66         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  67         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
  68         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
  69         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  70         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
  71         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
  72         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
  73         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
  74         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  75         {0x05}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
  76         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
  77         {0x00}, /* 0x1A, */
  78         {0x00}, /* 0x1B, */
  79         {0x00}, /* 0x1C, */
  80         {0x00}, /* 0x1D, */
  81         {0x00}, /* 0x1E, */
  82         {0x05}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
  83         /*  0x20 ~ 0x7F , New Define ===== */
  84         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
  85         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
  86         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
  87         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
  88         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
  89         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
  90         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
  91         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
  92         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
  93         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
  94         {0x00}, /* 0x2A, */
  95         {0x00}, /* 0x2B, */
  96         {0x00}, /* 0x2C, */
  97         {0x00}, /* 0x2D, */
  98         {0x00}, /* 0x2E, */
  99         {0x00}, /* 0x2F, */
 100         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 101         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 102         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 103         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 104         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 105         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 106         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 107         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 108         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 109         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 110         {0x00}, /* 0x3A, */
 111         {0x00}, /* 0x3B, */
 112         {0x00}, /* 0x3C, */
 113         {0x00}, /* 0x3D, */
 114         {0x00}, /* 0x3E, */
 115         {0x00}, /* 0x3F, */
 116         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 117         {0x03}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G */
 118 };
 119
 120 static const struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {
 121         0x03
 122 }; /* use the combination for max channel numbers */
 123
 124 /*
 125  * Search the @param channel_num in given @param channel_set
 126  * @ch_set: the given channel set
 127  * @ch: the given channel number
 128  *
 129  * return the index of channel_num in channel_set, -1 if not found
 130  */
 131 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 132 {
 133         int i;
 134
 135         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 136                 if (ch == ch_set[i].ChannelNum)
 137                         break;
 138         }
 139
 140         if (i >= ch_set[i].ChannelNum)
 141                 return -1;
 142         return i;
 143 }
 144
 145 struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
 146 {
 147         struct xmit_frame *pmgntframe;
 148         struct xmit_buf *pxmitbuf;
 149
 150         pmgntframe = rtw_alloc_xmitframe(pxmitpriv);
 151         if (!pmgntframe) {
 152                 DBG_88E("%s, alloc xmitframe fail\n", __func__);
 153                 return NULL;
 154         }
 155
 156         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
 157         if (!pxmitbuf) {
 158                 DBG_88E("%s, alloc xmitbuf fail\n", __func__);
 159                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
 160                 return NULL;
 161         }
 162         pmgntframe->frame_tag = MGNT_FRAMETAG;
 163         pmgntframe->pxmitbuf = pxmitbuf;
 164         pmgntframe->buf_addr = pxmitbuf->pbuf;
 165         pxmitbuf->priv_data = pmgntframe;
 166         return pmgntframe;
 167 }
 168
 169 /****************************************************************************
 170
 171 Following are some TX functions for WiFi MLME
 172
 173 *****************************************************************************/
 174
 175 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
 176 {
 177         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 178
 179         pmlmeext->tx_rate = rate;
 180         DBG_88E("%s(): rate = %x\n", __func__, rate);
 181 }
 182
 183 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
 184 {
 185         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 186
 187         memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
 188
 189         pattrib->hdrlen = 24;
 190         pattrib->nr_frags = 1;
 191         pattrib->priority = 7;
 192         pattrib->mac_id = 0;
 193         pattrib->qsel = 0x12;
 194
 195         pattrib->pktlen = 0;
 196
 197         if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
 198                 pattrib->raid = 6;/* b mode */
 199         else
 200                 pattrib->raid = 5;/* a/g mode */
 201
 202         pattrib->encrypt = _NO_PRIVACY_;
 203         pattrib->bswenc = false;
 204
 205         pattrib->qos_en = false;
 206         pattrib->ht_en = false;
 207         pattrib->bwmode = HT_CHANNEL_WIDTH_20;
 208         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 209         pattrib->sgi = false;
 210
 211         pattrib->seqnum = pmlmeext->mgnt_seq;
 212
 213         pattrib->retry_ctrl = true;
 214 }
 215
 216 static void dump_mgntframe(struct adapter *padapter,
 217                            struct xmit_frame *pmgntframe)
 218 {
 219         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 220                 return;
 221
 222         rtw_hal_mgnt_xmit(padapter, pmgntframe);
 223 }
 224
 225 static s32 dump_mgntframe_and_wait(struct adapter *padapter,
 226                                    struct xmit_frame *pmgntframe,
 227                                    int timeout_ms)
 228 {
 229         s32 ret = _FAIL;
 230         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
 231         struct submit_ctx sctx;
 232
 233         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 234                 return ret;
 235
 236         rtw_sctx_init(&sctx, timeout_ms);
 237         pxmitbuf->sctx = &sctx;
 238
 239         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
 240
 241         if (ret == _SUCCESS)
 242                 ret = rtw_sctx_wait(&sctx);
 243
 244         return ret;
 245 }
 246
 247 static s32 dump_mgntframe_and_wait_ack(struct adapter *padapter,
 248                                        struct xmit_frame *pmgntframe)
 249 {
 250         s32 ret = _FAIL;
 251         u32 timeout_ms = 500;/*   500ms */
 252         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 253
 254         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 255                 return -1;
 256
 257         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex))
 258                 return _FAIL;
 259         pxmitpriv->ack_tx = true;
 260
 261         pmgntframe->ack_report = 1;
 262         if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
 263                 ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
 264
 265         pxmitpriv->ack_tx = false;
 266         mutex_unlock(&pxmitpriv->ack_tx_mutex);
 267
 268         return ret;
 269 }
 270
 271 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
 272 {
 273         u8 *ssid_ie;
 274         uint ssid_len_ori;
 275         int len_diff = 0;
 276
 277         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
 278
 279         if (ssid_ie && ssid_len_ori > 0) {
 280                 switch (hidden_ssid_mode) {
 281                 case 1: {
 282                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
 283                         u32 remain_len = 0;
 284
 285                         remain_len = ies_len - (next_ie - ies);
 286
 287                         ssid_ie[1] = 0;
 288                         memcpy(ssid_ie + 2, next_ie, remain_len);
 289                         len_diff -= ssid_len_ori;
 290
 291                         break;
 292                 }
 293                 case 2:
 294                         memset(&ssid_ie[2], 0, ssid_len_ori);
 295                         break;
 296                 default:
 297                         break;
 298                 }
 299         }
 300
 301         return len_diff;
 302 }
 303
 304 static void issue_beacon(struct adapter *padapter, int timeout_ms)
 305 {
 306         struct xmit_frame *pmgntframe;
 307         struct pkt_attrib *pattrib;
 308         unsigned char *pframe;
 309         struct ieee80211_hdr *pwlanhdr;
 310         __le16 *fctrl;
 311         unsigned int rate_len;
 312         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 313         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 314         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 315         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 316         struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
 317         u8 bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 318
 319         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 320         if (!pmgntframe) {
 321                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 322                 return;
 323         }
 324 #if defined(CONFIG_88EU_AP_MODE)
 325         spin_lock_bh(&pmlmepriv->bcn_update_lock);
 326 #endif
 327
 328         /* update attribute */
 329         pattrib = &pmgntframe->attrib;
 330         update_mgntframe_attrib(padapter, pattrib);
 331         pattrib->qsel = 0x10;
 332
 333         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 334
 335         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 336         pwlanhdr = (struct ieee80211_hdr *)pframe;
 337
 338         fctrl = &pwlanhdr->frame_control;
 339         *(fctrl) = 0;
 340
 341         ether_addr_copy(pwlanhdr->addr1, bc_addr);
 342         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
 343         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
 344
 345         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
 346         /* pmlmeext->mgnt_seq++; */
 347         SetFrameSubType(pframe, WIFI_BEACON);
 348
 349         pframe += sizeof(struct ieee80211_hdr_3addr);
 350         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 351
 352         if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) {
 353                 int len_diff;
 354                 u8 *wps_ie;
 355                 uint wps_ielen;
 356                 u8 sr = 0;
 357
 358                 memcpy(pframe, cur_network->ies, cur_network->ie_length);
 359                 len_diff = update_hidden_ssid(
 360                         pframe + _BEACON_IE_OFFSET_
 361                         , cur_network->ie_length - _BEACON_IE_OFFSET_
 362                         , pmlmeinfo->hidden_ssid_mode
 363                         );
 364                 pframe += (cur_network->ie_length + len_diff);
 365                 pattrib->pktlen += (cur_network->ie_length + len_diff);
 366                 wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr + TXDESC_OFFSET + sizeof(struct ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_,
 367                                         pattrib->pktlen - sizeof(struct ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_, NULL, &wps_ielen);
 368                 if (wps_ie && wps_ielen > 0)
 369                         rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
 370                 if (sr != 0)
 371                         set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
 372                 else
 373                         _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
 374
 375                 goto _issue_bcn;
 376         }
 377
 378         /* below for ad-hoc mode */
 379
 380         /* timestamp will be inserted by hardware */
 381         pframe += 8;
 382         pattrib->pktlen += 8;
 383
 384         /*  beacon interval: 2 bytes */
 385
 386         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
 387
 388         pframe += 2;
 389         pattrib->pktlen += 2;
 390
 391         /*  capability info: 2 bytes */
 392
 393         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
 394
 395         pframe += 2;
 396         pattrib->pktlen += 2;
 397
 398         /*  SSID */
 399         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);
 400
 401         /*  supported rates... */
 402         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 403         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 404
 405         /*  DS parameter set */
 406         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&cur_network->Configuration.DSConfig, &pattrib->pktlen);
 407
 408         {
 409                 u8 erpinfo = 0;
 410                 u32 ATIMWindow;
 411                 /*  IBSS Parameter Set... */
 412                 ATIMWindow = 0;
 413                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 414
 415                 /* ERP IE */
 416                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 417         }
 418
 419         /*  EXTERNDED SUPPORTED RATE */
 420         if (rate_len > 8)
 421                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 422         /* todo:HT for adhoc */
 423 _issue_bcn:
 424
 425 #if defined(CONFIG_88EU_AP_MODE)
 426         pmlmepriv->update_bcn = false;
 427
 428         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
 429 #endif
 430
 431         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
 432                 DBG_88E("beacon frame too large\n");
 433                 return;
 434         }
 435
 436         pattrib->last_txcmdsz = pattrib->pktlen;
 437
 438         /* DBG_88E("issue bcn_sz=%d\n", pattrib->last_txcmdsz); */
 439         if (timeout_ms > 0)
 440                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
 441         else
 442                 dump_mgntframe(padapter, pmgntframe);
 443 }
 444
 445 static void issue_probersp(struct adapter *padapter, unsigned char *da)
 446 {
 447         struct xmit_frame *pmgntframe;
 448         struct pkt_attrib *pattrib;
 449         unsigned char *pframe;
 450         struct ieee80211_hdr *pwlanhdr;
 451         __le16 *fctrl;
 452         unsigned char *mac, *bssid;
 453         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 454 #if defined(CONFIG_88EU_AP_MODE)
 455         u8 *pwps_ie;
 456         uint wps_ielen;
 457         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 458 #endif
 459         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 460         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 461         struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
 462         unsigned int rate_len;
 463
 464         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 465         if (!pmgntframe) {
 466                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 467                 return;
 468         }
 469
 470         /* update attribute */
 471         pattrib = &pmgntframe->attrib;
 472         update_mgntframe_attrib(padapter, pattrib);
 473
 474         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 475
 476         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 477         pwlanhdr = (struct ieee80211_hdr *)pframe;
 478
 479         mac = myid(&padapter->eeprompriv);
 480         bssid = cur_network->MacAddress;
 481
 482         fctrl = &pwlanhdr->frame_control;
 483         *(fctrl) = 0;
 484         ether_addr_copy(pwlanhdr->addr1, da);
 485         ether_addr_copy(pwlanhdr->addr2, mac);
 486         ether_addr_copy(pwlanhdr->addr3, bssid);
 487
 488         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 489         pmlmeext->mgnt_seq++;
 490         SetFrameSubType(fctrl, WIFI_PROBERSP);
 491
 492         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 493         pattrib->pktlen = pattrib->hdrlen;
 494         pframe += pattrib->hdrlen;
 495
 496         if (cur_network->ie_length > MAX_IE_SZ)
 497                 return;
 498
 499 #if defined(CONFIG_88EU_AP_MODE)
 500         if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) {
 501                 pwps_ie = rtw_get_wps_ie(cur_network->ies + _FIXED_IE_LENGTH_, cur_network->ie_length - _FIXED_IE_LENGTH_, NULL, &wps_ielen);
 502
 503                 /* inerset & update wps_probe_resp_ie */
 504                 if (pmlmepriv->wps_probe_resp_ie && pwps_ie && wps_ielen > 0) {
 505                         uint wps_offset, remainder_ielen;
 506                         u8 *premainder_ie;
 507
 508                         wps_offset = (uint)(pwps_ie - cur_network->ies);
 509
 510                         premainder_ie = pwps_ie + wps_ielen;
 511
 512                         remainder_ielen = cur_network->ie_length - wps_offset - wps_ielen;
 513
 514                         memcpy(pframe, cur_network->ies, wps_offset);
 515                         pframe += wps_offset;
 516                         pattrib->pktlen += wps_offset;
 517
 518                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
 519                         if ((wps_offset + wps_ielen + 2) <= MAX_IE_SZ) {
 520                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen + 2);
 521                                 pframe += wps_ielen + 2;
 522                                 pattrib->pktlen += wps_ielen + 2;
 523                         }
 524
 525                         if ((wps_offset + wps_ielen + 2 + remainder_ielen) <= MAX_IE_SZ) {
 526                                 memcpy(pframe, premainder_ie, remainder_ielen);
 527                                 pframe += remainder_ielen;
 528                                 pattrib->pktlen += remainder_ielen;
 529                         }
 530                 } else {
 531                         memcpy(pframe, cur_network->ies, cur_network->ie_length);
 532                         pframe += cur_network->ie_length;
 533                         pattrib->pktlen += cur_network->ie_length;
 534                 }
 535         } else
 536 #endif
 537         {
 538                 /* timestamp will be inserted by hardware */
 539                 pframe += 8;
 540                 pattrib->pktlen += 8;
 541
 542                 /*  beacon interval: 2 bytes */
 543
 544                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
 545
 546                 pframe += 2;
 547                 pattrib->pktlen += 2;
 548
 549                 /*  capability info: 2 bytes */
 550
 551                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
 552
 553                 pframe += 2;
 554                 pattrib->pktlen += 2;
 555
 556                 /* below for ad-hoc mode */
 557
 558                 /*  SSID */
 559                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);
 560
 561                 /*  supported rates... */
 562                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 563                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 564
 565                 /*  DS parameter set */
 566                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&cur_network->Configuration.DSConfig, &pattrib->pktlen);
 567
 568                 if ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) {
 569                         u8 erpinfo = 0;
 570                         u32 ATIMWindow;
 571                         /*  IBSS Parameter Set... */
 572                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
 573                         ATIMWindow = 0;
 574                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 575
 576                         /* ERP IE */
 577                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 578                 }
 579
 580                 /*  EXTERNDED SUPPORTED RATE */
 581                 if (rate_len > 8)
 582                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 583                 /* todo:HT for adhoc */
 584         }
 585
 586         pattrib->last_txcmdsz = pattrib->pktlen;
 587
 588         dump_mgntframe(padapter, pmgntframe);
 589 }
 590
 591 static int issue_probereq(struct adapter *padapter,
 592                           struct ndis_802_11_ssid *pssid, u8 *da,
 593                           bool wait_ack)
 594 {
 595         int ret = _FAIL;
 596         struct xmit_frame *pmgntframe;
 597         struct pkt_attrib *pattrib;
 598         unsigned char *pframe;
 599         struct ieee80211_hdr *pwlanhdr;
 600         __le16 *fctrl;
 601         unsigned char *mac;
 602         unsigned char bssrate[NumRates];
 603         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 604         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 605         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 606         int bssrate_len = 0;
 607         u8 bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 608
 609         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+%s\n", __func__));
 610
 611         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 612         if (!pmgntframe)
 613                 goto exit;
 614
 615         /* update attribute */
 616         pattrib = &pmgntframe->attrib;
 617         update_mgntframe_attrib(padapter, pattrib);
 618
 619         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 620
 621         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 622         pwlanhdr = (struct ieee80211_hdr *)pframe;
 623
 624         mac = myid(&padapter->eeprompriv);
 625
 626         fctrl = &pwlanhdr->frame_control;
 627         *(fctrl) = 0;
 628
 629         if (da) {
 630                 /*      unicast probe request frame */
 631                 ether_addr_copy(pwlanhdr->addr1, da);
 632                 ether_addr_copy(pwlanhdr->addr3, da);
 633         } else {
 634                 /*      broadcast probe request frame */
 635                 ether_addr_copy(pwlanhdr->addr1, bc_addr);
 636                 ether_addr_copy(pwlanhdr->addr3, bc_addr);
 637         }
 638
 639         ether_addr_copy(pwlanhdr->addr2, mac);
 640
 641         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 642         pmlmeext->mgnt_seq++;
 643         SetFrameSubType(pframe, WIFI_PROBEREQ);
 644
 645         pframe += sizeof(struct ieee80211_hdr_3addr);
 646         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 647
 648         if (pssid)
 649                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->ssid_length, pssid->ssid, &pattrib->pktlen);
 650         else
 651                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &pattrib->pktlen);
 652
 653         get_rate_set(padapter, bssrate, &bssrate_len);
 654
 655         if (bssrate_len > 8) {
 656                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &pattrib->pktlen);
 657                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, bssrate_len - 8, bssrate + 8, &pattrib->pktlen);
 658         } else {
 659                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &pattrib->pktlen);
 660         }
 661
 662         /* add wps_ie for wps2.0 */
 663         if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
 664                 memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
 665                 pframe += pmlmepriv->wps_probe_req_ie_len;
 666                 pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
 667         }
 668
 669         pattrib->last_txcmdsz = pattrib->pktlen;
 670
 671         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
 672                  ("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
 673
 674         if (wait_ack) {
 675                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
 676         } else {
 677                 dump_mgntframe(padapter, pmgntframe);
 678                 ret = _SUCCESS;
 679         }
 680
 681 exit:
 682         return ret;
 683 }
 684
 685 static int issue_probereq_ex(struct adapter *padapter,
 686                              struct ndis_802_11_ssid *pssid, u8 *da,
 687                              int try_cnt, int wait_ms)
 688 {
 689         int ret;
 690         int i = 0;
 691         unsigned long start = jiffies;
 692
 693         do {
 694                 ret = issue_probereq(padapter, pssid, da, wait_ms > 0);
 695
 696                 i++;
 697
 698                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
 699                         break;
 700
 701                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
 702                         msleep(wait_ms);
 703
 704         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
 705
 706         if (ret != _FAIL) {
 707                 ret = _SUCCESS;
 708                 goto exit;
 709         }
 710
 711         if (try_cnt && wait_ms) {
 712                 if (da)
 713                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
 714                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
 715                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 716                                 jiffies_to_msecs(jiffies - start));
 717                 else
 718                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
 719                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
 720                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 721                                 jiffies_to_msecs(jiffies - start));
 722         }
 723 exit:
 724         return ret;
 725 }
 726
 727 /*  if psta == NULL, indicate we are station(client) now... */
 728 static void issue_auth(struct adapter *padapter, struct sta_info *psta,
 729                        unsigned short status)
 730 {
 731         struct xmit_frame *pmgntframe;
 732         struct pkt_attrib *pattrib;
 733         unsigned char *pframe;
 734         struct ieee80211_hdr *pwlanhdr;
 735         __le16 *fctrl;
 736         unsigned int val32;
 737         u16 val16;
 738 #ifdef CONFIG_88EU_AP_MODE
 739         __le16 le_val16;
 740 #endif
 741         int use_shared_key = 0;
 742         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 743         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 744         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 745         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
 746
 747         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 748         if (!pmgntframe)
 749                 return;
 750
 751         /* update attribute */
 752         pattrib = &pmgntframe->attrib;
 753         update_mgntframe_attrib(padapter, pattrib);
 754
 755         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 756
 757         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 758         pwlanhdr = (struct ieee80211_hdr *)pframe;
 759
 760         fctrl = &pwlanhdr->frame_control;
 761         *(fctrl) = 0;
 762
 763         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 764         pmlmeext->mgnt_seq++;
 765         SetFrameSubType(pframe, WIFI_AUTH);
 766
 767         pframe += sizeof(struct ieee80211_hdr_3addr);
 768         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 769
 770         if (psta) {/*  for AP mode */
 771 #ifdef CONFIG_88EU_AP_MODE
 772
 773                 ether_addr_copy(pwlanhdr->addr1, psta->hwaddr);
 774                 ether_addr_copy(pwlanhdr->addr2,
 775                                 myid(&padapter->eeprompriv));
 776                 ether_addr_copy(pwlanhdr->addr3,
 777                                 myid(&padapter->eeprompriv));
 778
 779                 /*  setting auth algo number */
 780                 val16 = (u16)psta->authalg;
 781
 782                 if (status != _STATS_SUCCESSFUL_)
 783                         val16 = 0;
 784
 785                 if (val16) {
 786                         le_val16 = cpu_to_le16(val16);
 787                         use_shared_key = 1;
 788                 } else {
 789                         le_val16 = 0;
 790                 }
 791
 792                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_val16,
 793                                           &pattrib->pktlen);
 794
 795                 /*  setting auth seq number */
 796                 val16 = (u16)psta->auth_seq;
 797                 le_val16 = cpu_to_le16(val16);
 798                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_val16,
 799                                           &pattrib->pktlen);
 800
 801                 /*  setting status code... */
 802                 val16 = status;
 803                 le_val16 = cpu_to_le16(val16);
 804                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_,
 805                                           &le_val16, &pattrib->pktlen);
 806
 807                 /*  added challenging text... */
 808                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
 809                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &pattrib->pktlen);
 810 #endif
 811         } else {
 812                 __le32 le_tmp32;
 813                 __le16 le_tmp16;
 814
 815                 ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
 816                 ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
 817                 ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
 818
 819                 /*  setting auth algo number */
 820                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
 821                 if (val16)
 822                         use_shared_key = 1;
 823
 824                 /* setting IV for auth seq #3 */
 825                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 826                         val32 = (pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30);
 827                         le_tmp32 = cpu_to_le32(val32);
 828                         pframe = rtw_set_fixed_ie(pframe, 4, &le_tmp32,
 829                                                   &pattrib->pktlen);
 830
 831                         pattrib->iv_len = 4;
 832                 }
 833
 834                 le_tmp16 = cpu_to_le16(val16);
 835                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_tmp16,
 836                                           &pattrib->pktlen);
 837
 838                 /*  setting auth seq number */
 839                 val16 = pmlmeinfo->auth_seq;
 840                 le_tmp16 = cpu_to_le16(val16);
 841                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_tmp16,
 842                                           &pattrib->pktlen);
 843
 844                 /*  setting status code... */
 845                 le_tmp16 = cpu_to_le16(status);
 846                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &le_tmp16,
 847                                           &pattrib->pktlen);
 848
 849                 /*  then checking to see if sending challenging text... */
 850                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 851                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &pattrib->pktlen);
 852
 853                         SetPrivacy(fctrl);
 854
 855                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 856
 857                         pattrib->encrypt = _WEP40_;
 858
 859                         pattrib->icv_len = 4;
 860
 861                         pattrib->pktlen += pattrib->icv_len;
 862                 }
 863         }
 864
 865         pattrib->last_txcmdsz = pattrib->pktlen;
 866
 867         rtw_wep_encrypt(padapter, pmgntframe);
 868         DBG_88E("%s\n", __func__);
 869         dump_mgntframe(padapter, pmgntframe);
 870 }
 871
 872 #ifdef CONFIG_88EU_AP_MODE
 873 static void issue_asocrsp(struct adapter *padapter, unsigned short status,
 874                           struct sta_info *pstat, int pkt_type)
 875 {
 876         struct xmit_frame *pmgntframe;
 877         struct ieee80211_hdr *pwlanhdr;
 878         struct pkt_attrib *pattrib;
 879         unsigned char *pbuf, *pframe;
 880         unsigned short val;
 881         __le16 *fctrl;
 882         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
 883         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 884         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 885         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 886         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
 887         u8 *ie = pnetwork->ies;
 888         __le16 lestatus, leval;
 889
 890         DBG_88E("%s\n", __func__);
 891
 892         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 893         if (!pmgntframe)
 894                 return;
 895
 896         /* update attribute */
 897         pattrib = &pmgntframe->attrib;
 898         update_mgntframe_attrib(padapter, pattrib);
 899
 900         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 901
 902         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 903         pwlanhdr = (struct ieee80211_hdr *)pframe;
 904
 905         fctrl = &pwlanhdr->frame_control;
 906         *(fctrl) = 0;
 907
 908         ether_addr_copy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr);
 909         ether_addr_copy((void *)GetAddr2Ptr(pwlanhdr),
 910                         myid(&padapter->eeprompriv));
 911         ether_addr_copy((void *)GetAddr3Ptr(pwlanhdr), pnetwork->MacAddress);
 912
 913         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 914         pmlmeext->mgnt_seq++;
 915         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
 916                 SetFrameSubType(pwlanhdr, pkt_type);
 917         else
 918                 return;
 919
 920         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 921         pattrib->pktlen += pattrib->hdrlen;
 922         pframe += pattrib->hdrlen;
 923
 924         /* capability */
 925         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
 926
 927         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, &val, &pattrib->pktlen);
 928
 929         lestatus = cpu_to_le16(status);
 930         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &lestatus,
 931                                   &pattrib->pktlen);
 932
 933         leval = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
 934         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, &leval, &pattrib->pktlen);
 935
 936         if (pstat->bssratelen <= 8) {
 937                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &pattrib->pktlen);
 938         } else {
 939                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &pattrib->pktlen);
 940                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, pstat->bssratelen - 8, pstat->bssrateset + 8, &pattrib->pktlen);
 941         }
 942
 943         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
 944                 uint ie_len = 0;
 945
 946                 /* FILL HT CAP INFO IE */
 947                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
 948                 if (pbuf && ie_len > 0) {
 949                         memcpy(pframe, pbuf, ie_len + 2);
 950                         pframe += (ie_len + 2);
 951                         pattrib->pktlen += (ie_len + 2);
 952                 }
 953
 954                 /* FILL HT ADD INFO IE */
 955                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
 956                 if (pbuf && ie_len > 0) {
 957                         memcpy(pframe, pbuf, ie_len + 2);
 958                         pframe += (ie_len + 2);
 959                         pattrib->pktlen += (ie_len + 2);
 960                 }
 961         }
 962
 963         /* FILL WMM IE */
 964         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
 965                 uint ie_len = 0;
 966                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
 967
 968                 for (pbuf = ie + _BEACON_IE_OFFSET_;; pbuf += (ie_len + 2)) {
 969                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_ - (ie_len + 2)));
 970                         if (pbuf && !memcmp(pbuf + 2, WMM_PARA_IE, 6)) {
 971                                 memcpy(pframe, pbuf, ie_len + 2);
 972                                 pframe += (ie_len + 2);
 973                                 pattrib->pktlen += (ie_len + 2);
 974                                 break;
 975                         }
 976
 977                         if (!pbuf || ie_len == 0)
 978                                 break;
 979                 }
 980         }
 981
 982         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
 983                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &pattrib->pktlen);
 984
 985         /* add WPS IE ie for wps 2.0 */
 986         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
 987                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
 988
 989                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
 990                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
 991         }
 992
 993         pattrib->last_txcmdsz = pattrib->pktlen;
 994         dump_mgntframe(padapter, pmgntframe);
 995 }
 996 #endif /* CONFIG_88EU_AP_MODE */
 997
 998 static void issue_assocreq(struct adapter *padapter)
 999 {
1000         int ret = _FAIL;
1001         struct xmit_frame *pmgntframe;
1002         struct pkt_attrib *pattrib;
1003         unsigned char *pframe, *p;
1004         struct ieee80211_hdr *pwlanhdr;
1005         __le16 *fctrl;
1006         unsigned int i, j, ie_len, index = 0;
1007         unsigned char bssrate[NumRates], sta_bssrate[NumRates];
1008         struct ndis_802_11_var_ie *pIE;
1009         struct registry_priv *pregpriv = &padapter->registrypriv;
1010         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1011         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1012         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1013         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1014         int bssrate_len = 0, sta_bssrate_len = 0;
1015         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
1016
1017         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1018         if (!pmgntframe)
1019                 goto exit;
1020
1021         /* update attribute */
1022         pattrib = &pmgntframe->attrib;
1023         update_mgntframe_attrib(padapter, pattrib);
1024
1025         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1026         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1027         pwlanhdr = (struct ieee80211_hdr *)pframe;
1028
1029         fctrl = &pwlanhdr->frame_control;
1030         *(fctrl) = 0;
1031         ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
1032         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
1033         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1034
1035         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1036         pmlmeext->mgnt_seq++;
1037         SetFrameSubType(pframe, WIFI_ASSOCREQ);
1038
1039         pframe += sizeof(struct ieee80211_hdr_3addr);
1040         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1041
1042         /* caps */
1043
1044         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.ies), 2);
1045
1046         pframe += 2;
1047         pattrib->pktlen += 2;
1048
1049         /* listen interval */
1050         /* todo: listen interval for power saving */
1051         put_unaligned_le16(3, pframe);
1052         pframe += 2;
1053         pattrib->pktlen += 2;
1054
1055         /* SSID */
1056         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.ssid.ssid_length, pmlmeinfo->network.ssid.ssid, &pattrib->pktlen);
1057
1058         /* supported rate & extended supported rate */
1059
1060         /*  Check if the AP's supported rates are also supported by STA. */
1061         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
1062
1063         if (pmlmeext->cur_channel == 14)/*  for JAPAN, channel 14 can only uses B Mode(CCK) */
1064                 sta_bssrate_len = 4;
1065
1066         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1067                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1068                         break;
1069                 DBG_88E("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
1070         }
1071
1072         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1073                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1074                         break;
1075
1076                 /*  Check if the AP's supported rates are also supported by STA. */
1077                 for (j = 0; j < sta_bssrate_len; j++) {
1078                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
1079                         if ((pmlmeinfo->network.SupportedRates[i] | IEEE80211_BASIC_RATE_MASK)
1080                                         == (sta_bssrate[j] | IEEE80211_BASIC_RATE_MASK))
1081                                 break;
1082                 }
1083
1084                 if (j == sta_bssrate_len) {
1085                         /*  the rate is not supported by STA */
1086                         DBG_88E("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
1087                 } else {
1088                         /*  the rate is supported by STA */
1089                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
1090                 }
1091         }
1092
1093         bssrate_len = index;
1094         DBG_88E("bssrate_len=%d\n", bssrate_len);
1095
1096         if (bssrate_len == 0) {
1097                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
1098                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1099                 goto exit; /* don't connect to AP if no joint supported rate */
1100         }
1101
1102         if (bssrate_len > 8) {
1103                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &pattrib->pktlen);
1104                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, bssrate_len - 8, bssrate + 8, &pattrib->pktlen);
1105         } else {
1106                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &pattrib->pktlen);
1107         }
1108
1109         /* RSN */
1110         p = rtw_get_ie((pmlmeinfo->network.ies + sizeof(struct ndis_802_11_fixed_ie)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.ie_length - sizeof(struct ndis_802_11_fixed_ie)));
1111         if (p)
1112                 pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, p + 2, &pattrib->pktlen);
1113
1114         /* HT caps */
1115         if (padapter->mlmepriv.htpriv.ht_option) {
1116                 p = rtw_get_ie((pmlmeinfo->network.ies + sizeof(struct ndis_802_11_fixed_ie)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.ie_length - sizeof(struct ndis_802_11_fixed_ie)));
1117                 if (p && !is_ap_in_tkip(padapter)) {
1118                         memcpy(&pmlmeinfo->HT_caps, p + 2, sizeof(struct ieee80211_ht_cap));
1119
1120                         /* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
1121                         if (pregpriv->cbw40_enable == 0)
1122                                 pmlmeinfo->HT_caps.cap_info &= cpu_to_le16(~(BIT(6) | BIT(1)));
1123                         else
1124                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(BIT(1));
1125
1126                         /* todo: disable SM power save mode */
1127                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x000c);
1128
1129                         if (pregpriv->rx_stbc)
1130                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0100);/* RX STBC One spatial stream */
1131                         memcpy((u8 *)&pmlmeinfo->HT_caps.mcs, MCS_rate_1R, 16);
1132                         pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len, (u8 *)(&pmlmeinfo->HT_caps), &pattrib->pktlen);
1133                 }
1134         }
1135
1136         /* vendor specific IE, such as WPA, WMM, WPS */
1137         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pmlmeinfo->network.ie_length; i += (pIE->Length + 2)) {
1138                 pIE = (struct ndis_802_11_var_ie *)(pmlmeinfo->network.ies + i);
1139
1140                 switch (pIE->ElementID) {
1141                 case _VENDOR_SPECIFIC_IE_:
1142                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
1143                             (!memcmp(pIE->data, WMM_OUI, 4)) ||
1144                             (!memcmp(pIE->data, WPS_OUI, 4))) {
1145                                 if (!padapter->registrypriv.wifi_spec) {
1146                                         /* Commented by Kurt 20110629 */
1147                                         /* In some older APs, WPS handshake */
1148                                         /* would be fail if we append vender extensions information to AP */
1149                                         if (!memcmp(pIE->data, WPS_OUI, 4))
1150                                                 pIE->Length = 14;
1151                                 }
1152                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &pattrib->pktlen);
1153                         }
1154                         break;
1155                 default:
1156                         break;
1157                 }
1158         }
1159
1160         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1161                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &pattrib->pktlen);
1162
1163         pattrib->last_txcmdsz = pattrib->pktlen;
1164         dump_mgntframe(padapter, pmgntframe);
1165
1166         ret = _SUCCESS;
1167
1168 exit:
1169         if (ret == _SUCCESS)
1170                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
1171         else
1172                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
1173 }
1174
1175 /* when wait_ack is true, this function should be called at process context */
1176 static int _issue_nulldata(struct adapter *padapter, unsigned char *da,
1177                            unsigned int power_mode, bool wait_ack)
1178 {
1179         int ret = _FAIL;
1180         struct xmit_frame *pmgntframe;
1181         struct pkt_attrib *pattrib;
1182         unsigned char *pframe;
1183         struct ieee80211_hdr *pwlanhdr;
1184         __le16 *fctrl;
1185         struct xmit_priv *pxmitpriv;
1186         struct mlme_ext_priv *pmlmeext;
1187         struct mlme_ext_info *pmlmeinfo;
1188         struct wlan_bssid_ex *pnetwork;
1189
1190         if (!padapter)
1191                 goto exit;
1192
1193         pxmitpriv = &padapter->xmitpriv;
1194         pmlmeext = &padapter->mlmeextpriv;
1195         pmlmeinfo = &pmlmeext->mlmext_info;
1196         pnetwork = &pmlmeinfo->network;
1197
1198         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1199         if (!pmgntframe)
1200                 goto exit;
1201
1202         /* update attribute */
1203         pattrib = &pmgntframe->attrib;
1204         update_mgntframe_attrib(padapter, pattrib);
1205         pattrib->retry_ctrl = false;
1206
1207         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1208
1209         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1210         pwlanhdr = (struct ieee80211_hdr *)pframe;
1211
1212         fctrl = &pwlanhdr->frame_control;
1213         *(fctrl) = 0;
1214
1215         if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)
1216                 SetFrDs(fctrl);
1217         else if ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE)
1218                 SetToDs(fctrl);
1219
1220         if (power_mode)
1221                 SetPwrMgt(fctrl);
1222
1223         ether_addr_copy(pwlanhdr->addr1, da);
1224         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
1225         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1226
1227         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1228         pmlmeext->mgnt_seq++;
1229         SetFrameSubType(pframe, WIFI_DATA_NULL);
1230
1231         pframe += sizeof(struct ieee80211_hdr_3addr);
1232         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1233
1234         pattrib->last_txcmdsz = pattrib->pktlen;
1235
1236         if (wait_ack) {
1237                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1238         } else {
1239                 dump_mgntframe(padapter, pmgntframe);
1240                 ret = _SUCCESS;
1241         }
1242
1243 exit:
1244         return ret;
1245 }
1246
1247 /* when wait_ms > 0 , this function should be called at process context */
1248 /* da == NULL for station mode */
1249 int issue_nulldata(struct adapter *padapter, unsigned char *da,
1250                    unsigned int power_mode, int try_cnt, int wait_ms)
1251 {
1252         int ret;
1253         int i = 0;
1254         unsigned long start = jiffies;
1255         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1256         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1257         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
1258
1259         /* da == NULL, assume it's null data for sta to ap*/
1260         if (!da)
1261                 da = pnetwork->MacAddress;
1262
1263         do {
1264                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0);
1265
1266                 i++;
1267
1268                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1269                         break;
1270
1271                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1272                         msleep(wait_ms);
1273         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1274
1275         if (ret != _FAIL) {
1276                 ret = _SUCCESS;
1277                 goto exit;
1278         }
1279
1280         if (try_cnt && wait_ms) {
1281                 if (da)
1282                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1283                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1284                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1285                                 jiffies_to_msecs(jiffies - start));
1286                 else
1287                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1288                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1289                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1290                                 jiffies_to_msecs(jiffies - start));
1291         }
1292 exit:
1293         return ret;
1294 }
1295
1296 /* when wait_ack is true, this function should be called at process context */
1297 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
1298                                u16 tid, bool wait_ack)
1299 {
1300         int ret = _FAIL;
1301         struct xmit_frame *pmgntframe;
1302         struct pkt_attrib *pattrib;
1303         unsigned char *pframe;
1304         struct ieee80211_hdr *pwlanhdr;
1305         __le16 *fctrl;
1306         unsigned short *qc;
1307         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1308         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1309         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1310         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
1311
1312         DBG_88E("%s\n", __func__);
1313
1314         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1315         if (!pmgntframe)
1316                 goto exit;
1317
1318         /* update attribute */
1319         pattrib = &pmgntframe->attrib;
1320         update_mgntframe_attrib(padapter, pattrib);
1321
1322         pattrib->hdrlen += 2;
1323         pattrib->qos_en = true;
1324         pattrib->eosp = 1;
1325         pattrib->ack_policy = 0;
1326         pattrib->mdata = 0;
1327
1328         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1329
1330         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1331         pwlanhdr = (struct ieee80211_hdr *)pframe;
1332
1333         fctrl = &pwlanhdr->frame_control;
1334         *(fctrl) = 0;
1335
1336         if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)
1337                 SetFrDs(fctrl);
1338         else if ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE)
1339                 SetToDs(fctrl);
1340
1341         if (pattrib->mdata)
1342                 SetMData(fctrl);
1343
1344         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
1345
1346         SetPriority(qc, tid);
1347
1348         SetEOSP(qc, pattrib->eosp);
1349
1350         SetAckpolicy(qc, pattrib->ack_policy);
1351
1352         ether_addr_copy(pwlanhdr->addr1, da);
1353         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
1354         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1355
1356         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1357         pmlmeext->mgnt_seq++;
1358         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
1359
1360         pframe += sizeof(struct ieee80211_qos_hdr);
1361         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
1362
1363         pattrib->last_txcmdsz = pattrib->pktlen;
1364
1365         if (wait_ack) {
1366                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1367         } else {
1368                 dump_mgntframe(padapter, pmgntframe);
1369                 ret = _SUCCESS;
1370         }
1371
1372 exit:
1373         return ret;
1374 }
1375
1376 /* when wait_ms > 0 , this function should be called at process context */
1377 /* da == NULL for station mode */
1378 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
1379                        u16 tid, int try_cnt, int wait_ms)
1380 {
1381         int ret;
1382         int i = 0;
1383         unsigned long start = jiffies;
1384         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1385         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1386         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
1387
1388         /* da == NULL, assume it's null data for sta to ap*/
1389         if (!da)
1390                 da = pnetwork->MacAddress;
1391
1392         do {
1393                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0);
1394
1395                 i++;
1396
1397                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1398                         break;
1399
1400                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1401                         msleep(wait_ms);
1402         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1403
1404         if (ret != _FAIL) {
1405                 ret = _SUCCESS;
1406                 goto exit;
1407         }
1408
1409         if (try_cnt && wait_ms) {
1410                 if (da)
1411                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1412                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1413                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1414                                 jiffies_to_msecs(jiffies - start));
1415                 else
1416                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1417                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1418                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1419                                 jiffies_to_msecs(jiffies - start));
1420         }
1421 exit:
1422         return ret;
1423 }
1424
1425 static int _issue_deauth(struct adapter *padapter, unsigned char *da,
1426                          unsigned short reason, bool wait_ack)
1427 {
1428         struct xmit_frame *pmgntframe;
1429         struct pkt_attrib *pattrib;
1430         unsigned char *pframe;
1431         struct ieee80211_hdr *pwlanhdr;
1432         __le16 *fctrl;
1433         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1434         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1435         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1436         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
1437         int ret = _FAIL;
1438         __le16 le_tmp;
1439
1440         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1441         if (!pmgntframe)
1442                 goto exit;
1443
1444         /* update attribute */
1445         pattrib = &pmgntframe->attrib;
1446         update_mgntframe_attrib(padapter, pattrib);
1447         pattrib->retry_ctrl = false;
1448
1449         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1450
1451         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1452         pwlanhdr = (struct ieee80211_hdr *)pframe;
1453
1454         fctrl = &pwlanhdr->frame_control;
1455         *(fctrl) = 0;
1456
1457         ether_addr_copy(pwlanhdr->addr1, da);
1458         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
1459         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1460
1461         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1462         pmlmeext->mgnt_seq++;
1463         SetFrameSubType(pframe, WIFI_DEAUTH);
1464
1465         pframe += sizeof(struct ieee80211_hdr_3addr);
1466         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1467
1468         le_tmp = cpu_to_le16(reason);
1469         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, &le_tmp,
1470                                   &pattrib->pktlen);
1471
1472         pattrib->last_txcmdsz = pattrib->pktlen;
1473
1474         if (wait_ack) {
1475                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1476         } else {
1477                 dump_mgntframe(padapter, pmgntframe);
1478                 ret = _SUCCESS;
1479         }
1480
1481 exit:
1482         return ret;
1483 }
1484
1485 int issue_deauth(struct adapter *padapter, unsigned char *da,
1486                  unsigned short reason)
1487 {
1488         DBG_88E("%s to %pM\n", __func__, da);
1489         return _issue_deauth(padapter, da, reason, false);
1490 }
1491
1492 static int issue_deauth_ex(struct adapter *padapter, u8 *da,
1493                            unsigned short reason, int try_cnt,
1494                            int wait_ms)
1495 {
1496         int ret;
1497         int i = 0;
1498         unsigned long start = jiffies;
1499
1500         do {
1501                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0);
1502
1503                 i++;
1504
1505                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1506                         break;
1507
1508                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1509                         mdelay(wait_ms);
1510         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1511
1512         if (ret != _FAIL) {
1513                 ret = _SUCCESS;
1514                 goto exit;
1515         }
1516
1517         if (try_cnt && wait_ms) {
1518                 if (da)
1519                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1520                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1521                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1522                                 jiffies_to_msecs(jiffies - start));
1523                 else
1524                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1525                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1526                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1527                                 jiffies_to_msecs(jiffies - start));
1528         }
1529 exit:
1530         return ret;
1531 }
1532
1533 static void issue_action_BA(struct adapter *padapter, unsigned char *raddr,
1534                             unsigned char action, unsigned short status)
1535 {
1536         u8 category = RTW_WLAN_CATEGORY_BACK;
1537         u16 start_seq;
1538         u16 BA_para_set;
1539         u16 reason_code;
1540         u16 BA_timeout_value;
1541         __le16 le_tmp;
1542         u16 BA_starting_seqctrl = 0;
1543         enum ht_cap_ampdu_factor max_rx_ampdu_factor;
1544         struct xmit_frame *pmgntframe;
1545         struct pkt_attrib *pattrib;
1546         u8 *pframe;
1547         struct ieee80211_hdr *pwlanhdr;
1548         __le16 *fctrl;
1549         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1550         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1551         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1552         struct sta_info *psta;
1553         struct sta_priv *pstapriv = &padapter->stapriv;
1554         struct registry_priv *pregpriv = &padapter->registrypriv;
1555         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
1556
1557         DBG_88E("%s, category=%d, action=%d, status=%d\n", __func__, category, action, status);
1558
1559         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1560         if (!pmgntframe)
1561                 return;
1562
1563         /* update attribute */
1564         pattrib = &pmgntframe->attrib;
1565         update_mgntframe_attrib(padapter, pattrib);
1566
1567         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1568
1569         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1570         pwlanhdr = (struct ieee80211_hdr *)pframe;
1571
1572         fctrl = &pwlanhdr->frame_control;
1573         *(fctrl) = 0;
1574
1575         ether_addr_copy(pwlanhdr->addr1, raddr);
1576         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
1577         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1578
1579         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1580         pmlmeext->mgnt_seq++;
1581         SetFrameSubType(pframe, WIFI_ACTION);
1582
1583         pframe += sizeof(struct ieee80211_hdr_3addr);
1584         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1585
1586         pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
1587         pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
1588
1589         if (category == 3) {
1590                 switch (action) {
1591                 case 0: /* ADDBA req */
1592                         do {
1593                                 pmlmeinfo->dialogToken++;
1594                         } while (pmlmeinfo->dialogToken == 0);
1595                         pframe = rtw_set_fixed_ie(pframe, 1, &pmlmeinfo->dialogToken, &pattrib->pktlen);
1596
1597                         BA_para_set = 0x1002 | ((status & 0xf) << 2); /* immediate ack & 64 buffer size */
1598                         le_tmp = cpu_to_le16(BA_para_set);
1599                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1600                                                   &pattrib->pktlen);
1601
1602                         BA_timeout_value = 5000;/*  5ms */
1603                         le_tmp = cpu_to_le16(BA_timeout_value);
1604                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1605                                                   &pattrib->pktlen);
1606
1607                         psta = rtw_get_stainfo(pstapriv, raddr);
1608                         if (psta) {
1609                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07] & 0xfff) + 1;
1610
1611                                 DBG_88E("BA_starting_seqctrl=%d for TID=%d\n", start_seq, status & 0x07);
1612
1613                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
1614
1615                                 BA_starting_seqctrl = start_seq << 4;
1616                         }
1617                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
1618                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1619                                                   &pattrib->pktlen);
1620                         break;
1621                 case 1: /* ADDBA rsp */
1622                 {
1623                         struct ADDBA_request *ADDBA_req = &pmlmeinfo->ADDBA_req;
1624
1625                         pframe = rtw_set_fixed_ie(pframe, 1,
1626                                                   &ADDBA_req->dialog_token,
1627                                                   &pattrib->pktlen);
1628                         pframe = rtw_set_fixed_ie(pframe, 2, &status,
1629                                                   &pattrib->pktlen);
1630
1631                         BA_para_set = le16_to_cpu(ADDBA_req->BA_para_set) &
1632                                       0x3f;
1633                         rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
1634                         switch (max_rx_ampdu_factor) {
1635                         case MAX_AMPDU_FACTOR_64K:
1636                                 BA_para_set |= 0x1000; /* 64 buffer size */
1637                                 break;
1638                         case MAX_AMPDU_FACTOR_32K:
1639                                 BA_para_set |= 0x0800; /* 32 buffer size */
1640                                 break;
1641                         case MAX_AMPDU_FACTOR_16K:
1642                                 BA_para_set |= 0x0400; /* 16 buffer size */
1643                                 break;
1644                         case MAX_AMPDU_FACTOR_8K:
1645                                 BA_para_set |= 0x0200; /* 8 buffer size */
1646                                 break;
1647                         default:
1648                                 BA_para_set |= 0x1000; /* 64 buffer size */
1649                                 break;
1650                         }
1651
1652                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
1653                                 BA_para_set = BA_para_set & ~BIT(0);
1654                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
1655                                 BA_para_set = BA_para_set | BIT(0);
1656                         le_tmp = cpu_to_le16(BA_para_set);
1657
1658                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1659                                                   &pattrib->pktlen);
1660                         pframe = rtw_set_fixed_ie(pframe, 2,
1661                                                   &ADDBA_req->BA_timeout_value,
1662                                                   &pattrib->pktlen);
1663                         break;
1664                 }
1665                 case 2:/* DELBA */
1666                         BA_para_set = (status & 0x1F) << 3;
1667                         le_tmp = cpu_to_le16(BA_para_set);
1668                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1669                                                   &pattrib->pktlen);
1670
1671                         reason_code = 37;/* Requested from peer STA as it does not want to use the mechanism */
1672                         le_tmp = cpu_to_le16(reason_code);
1673                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1674                                                   &pattrib->pktlen);
1675                         break;
1676                 default:
1677                         break;
1678                 }
1679         }
1680
1681         pattrib->last_txcmdsz = pattrib->pktlen;
1682
1683         dump_mgntframe(padapter, pmgntframe);
1684 }
1685
1686 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
1687 {
1688         struct list_head *plist, *phead;
1689         unsigned char category, action;
1690         struct xmit_frame *pmgntframe;
1691         struct pkt_attrib *pattrib;
1692         unsigned char *pframe;
1693         struct ieee80211_hdr *pwlanhdr;
1694         __le16 *fctrl;
1695         struct wlan_network *pnetwork = NULL;
1696         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
1697         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1698         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1699         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1700         struct __queue *queue = &pmlmepriv->scanned_queue;
1701         u8 InfoContent[16] = {0};
1702         u8 ICS[8][15];
1703         struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
1704
1705         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
1706                 return;
1707
1708         if (pmlmeinfo->bwmode_updated)
1709                 return;
1710
1711         DBG_88E("%s\n", __func__);
1712
1713         category = RTW_WLAN_CATEGORY_PUBLIC;
1714         action = ACT_PUBLIC_BSSCOEXIST;
1715
1716         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1717         if (!pmgntframe)
1718                 return;
1719
1720         /* update attribute */
1721         pattrib = &pmgntframe->attrib;
1722         update_mgntframe_attrib(padapter, pattrib);
1723
1724         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1725
1726         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1727         pwlanhdr = (struct ieee80211_hdr *)pframe;
1728
1729         fctrl = &pwlanhdr->frame_control;
1730         *(fctrl) = 0;
1731
1732         ether_addr_copy(pwlanhdr->addr1, cur_network->MacAddress);
1733         ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
1734         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
1735
1736         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1737         pmlmeext->mgnt_seq++;
1738         SetFrameSubType(pframe, WIFI_ACTION);
1739
1740         pframe += sizeof(struct ieee80211_hdr_3addr);
1741         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1742
1743         pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
1744         pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
1745
1746         /*  */
1747         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
1748                 u8 iedata = 0;
1749
1750                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
1751
1752                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &pattrib->pktlen);
1753         }
1754
1755         /*  */
1756         memset(ICS, 0, sizeof(ICS));
1757         if (pmlmepriv->num_sta_no_ht > 0) {
1758                 int i;
1759
1760                 spin_lock_bh(&pmlmepriv->scanned_queue.lock);
1761
1762                 phead = get_list_head(queue);
1763                 plist = phead->next;
1764
1765                 while (phead != plist) {
1766                         uint len;
1767                         u8 *p;
1768                         struct wlan_bssid_ex *pbss_network;
1769
1770                         pnetwork = container_of(plist, struct wlan_network, list);
1771
1772                         plist = plist->next;
1773
1774                         pbss_network = &pnetwork->network;
1775
1776                         p = rtw_get_ie(pbss_network->ies + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->ie_length - _FIXED_IE_LENGTH_);
1777                         if (!p || len == 0) { /* non-HT */
1778                                 if (pbss_network->Configuration.DSConfig <= 0)
1779                                         continue;
1780
1781                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
1782
1783                                 if (ICS[0][0] == 0)
1784                                         ICS[0][0] = 1;
1785                         }
1786                 }
1787                 spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
1788
1789                 for (i = 0; i < 8; i++) {
1790                         if (ICS[i][0] == 1) {
1791                                 int j, k = 0;
1792
1793                                 InfoContent[k] = i;
1794                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
1795                                 k++;
1796
1797                                 for (j = 1; j <= 14; j++) {
1798                                         if (ICS[i][j] == 1) {
1799                                                 if (k < 16) {
1800                                                         InfoContent[k] = j; /* channel number */
1801                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
1802                                                         k++;
1803                                                 }
1804                                         }
1805                                 }
1806
1807                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &pattrib->pktlen);
1808                         }
1809                 }
1810         }
1811
1812         pattrib->last_txcmdsz = pattrib->pktlen;
1813
1814         dump_mgntframe(padapter, pmgntframe);
1815 }
1816
1817 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
1818 {
1819         struct sta_priv *pstapriv = &padapter->stapriv;
1820         struct sta_info *psta = NULL;
1821         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1822         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1823         u16 tid;
1824
1825         if ((pmlmeinfo->state & 0x03) != WIFI_FW_AP_STATE)
1826                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1827                         return _SUCCESS;
1828
1829         psta = rtw_get_stainfo(pstapriv, addr);
1830         if (!psta)
1831                 return _SUCCESS;
1832
1833         if (initiator == 0) { /*  recipient */
1834                 for (tid = 0; tid < MAXTID; tid++) {
1835                         if (psta->recvreorder_ctrl[tid].enable) {
1836                                 DBG_88E("rx agg disable tid(%d)\n", tid);
1837                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator) & 0x1F));
1838                                 psta->recvreorder_ctrl[tid].enable = false;
1839                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
1840                         }
1841                 }
1842         } else if (initiator == 1) { /*  originator */
1843                 for (tid = 0; tid < MAXTID; tid++) {
1844                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
1845                                 DBG_88E("tx agg disable tid(%d)\n", tid);
1846                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator) & 0x1F));
1847                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1848                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1849                         }
1850                 }
1851         }
1852
1853         return _SUCCESS;
1854 }
1855
1856 unsigned int send_beacon(struct adapter *padapter)
1857 {
1858         u8 bxmitok = false;
1859         int issue = 0;
1860         int poll = 0;
1861         unsigned long start = jiffies;
1862         u32 passing_time;
1863
1864         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
1865         do {
1866                 issue_beacon(padapter, 100);
1867                 issue++;
1868                 do {
1869                         yield();
1870                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
1871                         poll++;
1872                 } while ((poll % 10) != 0 && !bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1873         } while (!bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1874
1875         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
1876                 return _FAIL;
1877         if (!bxmitok) {
1878                 DBG_88E("%s fail! %u ms\n", __func__,
1879                         jiffies_to_msecs(jiffies - start));
1880                 return _FAIL;
1881         }
1882         passing_time = jiffies_to_msecs(jiffies - start);
1883
1884         if (passing_time > 100 || issue > 3)
1885                 DBG_88E("%s success, issue:%d, poll:%d, %u ms\n",
1886                         __func__, issue, poll,
1887                         jiffies_to_msecs(jiffies - start));
1888         return _SUCCESS;
1889 }
1890
1891 /****************************************************************************
1892
1893 Following are some utility functions for WiFi MLME
1894
1895 *****************************************************************************/
1896
1897 static void site_survey(struct adapter *padapter)
1898 {
1899         unsigned char survey_channel = 0, val8;
1900         enum rt_scan_type ScanType = SCAN_PASSIVE;
1901         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1902         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
1903         u32 initialgain = 0;
1904         struct rtw_ieee80211_channel *ch;
1905
1906         if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
1907                 ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
1908                 survey_channel = ch->hw_value;
1909                 ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
1910         }
1911
1912         if (survey_channel != 0) {
1913                 /* PAUSE 4-AC Queue when site_survey */
1914                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1915                 /* val8 |= 0x0f; */
1916                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1917                 if (pmlmeext->sitesurvey_res.channel_idx == 0)
1918                         set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
1919                 else
1920                         SelectChannel(padapter, survey_channel);
1921
1922                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
1923                         int i;
1924
1925                         for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
1926                                 if (pmlmeext->sitesurvey_res.ssid[i].ssid_length) {
1927                                         /* todo: to issue two probe req??? */
1928                                         issue_probereq(padapter,
1929                                                        &pmlmeext->sitesurvey_res.ssid[i],
1930                                                        NULL, false);
1931                                         /* msleep(SURVEY_TO>>1); */
1932                                         issue_probereq(padapter,
1933                                                        &pmlmeext->sitesurvey_res.ssid[i],
1934                                                        NULL, false);
1935                                 }
1936                         }
1937
1938                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1939                                 /* todo: to issue two probe req??? */
1940                                 issue_probereq(padapter, NULL, NULL, false);
1941                                 /* msleep(SURVEY_TO>>1); */
1942                                 issue_probereq(padapter, NULL, NULL, false);
1943                         }
1944
1945                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1946                                 /* todo: to issue two probe req??? */
1947                                 issue_probereq(padapter, NULL, NULL, false);
1948                                 /* msleep(SURVEY_TO>>1); */
1949                                 issue_probereq(padapter, NULL, NULL, false);
1950                         }
1951                 }
1952
1953                 set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1954         } else {
1955                 /*  20100721:Interrupt scan operation here. */
1956                 /*  For SW antenna diversity before link, it needs to switch to another antenna and scan again. */
1957                 /*  It compares the scan result and select better one to do connection. */
1958                 if (rtw_hal_antdiv_before_linked(padapter)) {
1959                         pmlmeext->sitesurvey_res.bss_cnt = 0;
1960                         pmlmeext->sitesurvey_res.channel_idx = -1;
1961                         pmlmeext->chan_scan_time = SURVEY_TO / 2;
1962                         set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1963                         return;
1964                 }
1965
1966                 pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
1967
1968                 /* switch back to the original channel */
1969
1970                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
1971
1972                 /* flush 4-AC Queue after site_survey */
1973                 /* val8 = 0; */
1974                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1975
1976                 /* config MSR */
1977                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
1978
1979                 initialgain = 0xff; /* restore RX GAIN */
1980                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
1981                 /* turn on dynamic functions */
1982                 Restore_DM_Func_Flag(padapter);
1983                 /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
1984
1985                 if (is_client_associated_to_ap(padapter))
1986                         issue_nulldata(padapter, NULL, 0, 3, 500);
1987
1988                 val8 = 0; /* survey done */
1989                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
1990
1991                 report_surveydone_event(padapter);
1992
1993                 pmlmeext->chan_scan_time = SURVEY_TO;
1994                 pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
1995
1996                 issue_action_BSSCoexistPacket(padapter);
1997                 issue_action_BSSCoexistPacket(padapter);
1998                 issue_action_BSSCoexistPacket(padapter);
1999         }
2000 }
2001
2002 /* collect bss info from Beacon and Probe request/response frames. */
2003 static u8 collect_bss_info(struct adapter *padapter,
2004                            struct recv_frame *precv_frame,
2005                            struct wlan_bssid_ex *bssid)
2006 {
2007         int i;
2008         u32 len;
2009         u8 *p;
2010         u16 val16, subtype;
2011         u8 *pframe = precv_frame->pkt->data;
2012         u32 packet_len = precv_frame->pkt->len;
2013         u8 ie_offset;
2014         struct registry_priv *pregistrypriv = &padapter->registrypriv;
2015         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2016         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2017
2018         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
2019
2020         if (len > MAX_IE_SZ)
2021                 return _FAIL;
2022
2023         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
2024
2025         subtype = GetFrameSubType(pframe);
2026
2027         if (subtype == WIFI_BEACON) {
2028                 bssid->Reserved[0] = 1;
2029                 ie_offset = _BEACON_IE_OFFSET_;
2030         } else {
2031                 /*  FIXME : more type */
2032                 if (subtype == WIFI_PROBEREQ) {
2033                         ie_offset = _PROBEREQ_IE_OFFSET_;
2034                         bssid->Reserved[0] = 2;
2035                 } else if (subtype == WIFI_PROBERSP) {
2036                         ie_offset = _PROBERSP_IE_OFFSET_;
2037                         bssid->Reserved[0] = 3;
2038                 } else {
2039                         bssid->Reserved[0] = 0;
2040                         ie_offset = _FIXED_IE_LENGTH_;
2041                 }
2042         }
2043
2044         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
2045
2046         /* below is to copy the information element */
2047         bssid->ie_length = len;
2048         memcpy(bssid->ies, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->ie_length);
2049
2050         /* get the signal strength in dBM.raw data */
2051         bssid->Rssi = precv_frame->attrib.phy_info.recvpower;
2052         bssid->PhyInfo.SignalQuality = precv_frame->attrib.phy_info.SignalQuality;/* in percentage */
2053         bssid->PhyInfo.SignalStrength = precv_frame->attrib.phy_info.SignalStrength;/* in percentage */
2054         rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
2055
2056         /*  checking SSID */
2057         p = rtw_get_ie(bssid->ies + ie_offset, _SSID_IE_, &len, bssid->ie_length - ie_offset);
2058         if (!p) {
2059                 DBG_88E("marc: cannot find SSID for survey event\n");
2060                 return _FAIL;
2061         }
2062
2063         if (len) {
2064                 if (len > NDIS_802_11_LENGTH_SSID) {
2065                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2066                         return _FAIL;
2067                 }
2068                 memcpy(bssid->ssid.ssid, (p + 2), len);
2069                 bssid->ssid.ssid_length = len;
2070         } else {
2071                 bssid->ssid.ssid_length = 0;
2072         }
2073
2074         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
2075
2076         /* checking rate info... */
2077         i = 0;
2078         p = rtw_get_ie(bssid->ies + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->ie_length - ie_offset);
2079         if (p) {
2080                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
2081                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2082                         return _FAIL;
2083                 }
2084                 memcpy(bssid->SupportedRates, (p + 2), len);
2085                 i = len;
2086         }
2087
2088         p = rtw_get_ie(bssid->ies + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->ie_length - ie_offset);
2089         if (p) {
2090                 if (len > (NDIS_802_11_LENGTH_RATES_EX - i)) {
2091                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2092                         return _FAIL;
2093                 }
2094                 memcpy(bssid->SupportedRates + i, (p + 2), len);
2095         }
2096
2097         /* todo: */
2098         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
2099
2100         if (bssid->ie_length < 12)
2101                 return _FAIL;
2102
2103         /*  Checking for DSConfig */
2104         p = rtw_get_ie(bssid->ies + ie_offset, _DSSET_IE_, &len, bssid->ie_length - ie_offset);
2105
2106         bssid->Configuration.DSConfig = 0;
2107         bssid->Configuration.Length = 0;
2108
2109         if (p) {
2110                 bssid->Configuration.DSConfig = *(p + 2);
2111         } else {/*  In 5G, some ap do not have DSSET IE */
2112                 /*  checking HT info for channel */
2113                 p = rtw_get_ie(bssid->ies + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->ie_length - ie_offset);
2114                 if (p) {
2115                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
2116
2117                         bssid->Configuration.DSConfig = HT_info->primary_channel;
2118                 } else { /*  use current channel */
2119                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
2120                 }
2121         }
2122
2123         if (subtype == WIFI_PROBEREQ) {
2124                 /*  FIXME */
2125                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2126                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2127                 bssid->Privacy = 1;
2128                 return _SUCCESS;
2129         }
2130
2131         bssid->Configuration.BeaconPeriod =
2132                 get_unaligned_le16(rtw_get_beacon_interval_from_ie(bssid->ies));
2133
2134         val16 = rtw_get_capability(bssid);
2135
2136         if (val16 & BIT(0)) {
2137                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2138                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2139         } else {
2140                 bssid->InfrastructureMode = Ndis802_11IBSS;
2141                 ether_addr_copy(bssid->MacAddress, GetAddr3Ptr(pframe));
2142         }
2143
2144         if (val16 & BIT(4))
2145                 bssid->Privacy = 1;
2146         else
2147                 bssid->Privacy = 0;
2148
2149         bssid->Configuration.ATIMWindow = 0;
2150
2151         /* 20/40 BSS Coexistence check */
2152         if ((pregistrypriv->wifi_spec == 1) && (!pmlmeinfo->bwmode_updated)) {
2153                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2154
2155                 p = rtw_get_ie(bssid->ies + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->ie_length - ie_offset);
2156                 if (p && len > 0) {
2157                         struct ieee80211_ht_cap *pHT_caps =
2158                                 (struct ieee80211_ht_cap *)(p + 2);
2159
2160                         if (le16_to_cpu(pHT_caps->cap_info) & BIT(14))
2161                                 pmlmepriv->num_FortyMHzIntolerant++;
2162                 } else {
2163                         pmlmepriv->num_sta_no_ht++;
2164                 }
2165         }
2166
2167         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
2168         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
2169                 bssid->PhyInfo.SignalQuality = 101;
2170         return _SUCCESS;
2171 }
2172
2173 static void start_create_ibss(struct adapter *padapter)
2174 {
2175         unsigned short caps;
2176         u8 val8;
2177         u8 join_type;
2178         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2179         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2180         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
2181
2182         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2183         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2184
2185         /* update wireless mode */
2186         update_wireless_mode(padapter);
2187
2188         /* update capability */
2189         caps = rtw_get_capability(pnetwork);
2190         update_capinfo(padapter, caps);
2191         if (caps & cap_IBSS) {/* adhoc master */
2192                 val8 = 0xcf;
2193                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2194
2195                 /* switch channel */
2196                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
2197                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2198
2199                 beacon_timing_control(padapter);
2200
2201                 /* set msr to WIFI_FW_ADHOC_STATE */
2202                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2203                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2204
2205                 /* issue beacon */
2206                 if (send_beacon(padapter) == _FAIL) {
2207                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
2208
2209                         report_join_res(padapter, -1);
2210                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2211                 } else {
2212                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
2213                         join_type = 0;
2214                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
2215
2216                         report_join_res(padapter, 1);
2217                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
2218                 }
2219         } else {
2220                 DBG_88E("%s, invalid cap:%x\n", __func__, caps);
2221                 return;
2222         }
2223 }
2224
2225 static void start_clnt_join(struct adapter *padapter)
2226 {
2227         unsigned short caps;
2228         u8 val8;
2229         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2230         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2231         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
2232         int beacon_timeout;
2233
2234         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2235         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2236
2237         /* update wireless mode */
2238         update_wireless_mode(padapter);
2239
2240         /* update capability */
2241         caps = rtw_get_capability(pnetwork);
2242         update_capinfo(padapter, caps);
2243         if (caps & cap_ESS) {
2244                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
2245
2246                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
2247
2248                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2249
2250                 /* switch channel */
2251                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2252
2253                 /* here wait for receiving the beacon to start auth */
2254                 /* and enable a timer */
2255                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
2256                 set_link_timer(pmlmeext, beacon_timeout);
2257                 mod_timer(&padapter->mlmepriv.assoc_timer, jiffies +
2258                           msecs_to_jiffies((REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO * REASSOC_LIMIT) + beacon_timeout));
2259
2260                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
2261         } else if (caps & cap_IBSS) { /* adhoc client */
2262                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
2263
2264                 val8 = 0xcf;
2265                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2266
2267                 /* switch channel */
2268                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2269
2270                 beacon_timing_control(padapter);
2271
2272                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2273
2274                 report_join_res(padapter, 1);
2275         } else {
2276                 return;
2277         }
2278 }
2279
2280 static void start_clnt_auth(struct adapter *padapter)
2281 {
2282         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2283         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2284
2285         del_timer_sync(&pmlmeext->link_timer);
2286
2287         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
2288         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
2289
2290         pmlmeinfo->auth_seq = 1;
2291         pmlmeinfo->reauth_count = 0;
2292         pmlmeinfo->reassoc_count = 0;
2293         pmlmeinfo->link_count = 0;
2294         pmlmeext->retry = 0;
2295
2296         /*  Because of AP's not receiving deauth before */
2297         /*  AP may: 1)not response auth or 2)deauth us after link is complete */
2298         /*  issue deauth before issuing auth to deal with the situation */
2299         /*      Commented by Albert 2012/07/21 */
2300         /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
2301         issue_deauth(padapter, (&pmlmeinfo->network)->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
2302
2303         DBG_88E_LEVEL(_drv_info_, "start auth\n");
2304         issue_auth(padapter, NULL, 0);
2305
2306         set_link_timer(pmlmeext, REAUTH_TO);
2307 }
2308
2309 static void start_clnt_assoc(struct adapter *padapter)
2310 {
2311         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2312         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2313
2314         del_timer_sync(&pmlmeext->link_timer);
2315
2316         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
2317         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
2318
2319         issue_assocreq(padapter);
2320
2321         set_link_timer(pmlmeext, REASSOC_TO);
2322 }
2323
2324 static unsigned int receive_disconnect(struct adapter *padapter,
2325                                        unsigned char *MacAddr,
2326                                        unsigned short reason)
2327 {
2328         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2329         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2330         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
2331
2332         /* check A3 */
2333         if (memcmp(MacAddr, pnetwork->MacAddress, ETH_ALEN))
2334                 return _SUCCESS;
2335
2336         DBG_88E("%s\n", __func__);
2337
2338         if ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE) {
2339                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
2340                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2341                         report_del_sta_event(padapter, MacAddr, reason);
2342                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
2343                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2344                         report_join_res(padapter, -2);
2345                 }
2346         }
2347         return _SUCCESS;
2348 }
2349
2350 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
2351 {
2352         struct registry_priv *pregistrypriv;
2353         struct mlme_ext_priv *pmlmeext;
2354         struct rt_channel_info *chplan_new;
2355         u8 channel;
2356         u8 i;
2357
2358         pregistrypriv = &padapter->registrypriv;
2359         pmlmeext = &padapter->mlmeextpriv;
2360
2361         /*  Adjust channel plan by AP Country IE */
2362         if (pregistrypriv->enable80211d &&
2363             (!pmlmeext->update_channel_plan_by_ap_done)) {
2364                 u8 *ie, *p;
2365                 u32 len;
2366                 struct rt_channel_plan chplan_ap;
2367                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
2368                 u8 country[4];
2369                 u8 fcn; /*  first channel number */
2370                 u8 noc; /*  number of channel */
2371                 u8 j, k;
2372
2373                 ie = rtw_get_ie(bssid->ies + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->ie_length - _FIXED_IE_LENGTH_);
2374                 if (!ie)
2375                         return;
2376                 if (len < 6)
2377                         return;
2378                 ie += 2;
2379                 p = ie;
2380                 ie += len;
2381
2382                 memset(country, 0, 4);
2383                 memcpy(country, p, 3);
2384                 p += 3;
2385                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2386                          ("%s: 802.11d country =%s\n", __func__, country));
2387
2388                 i = 0;
2389                 while ((ie - p) >= 3) {
2390                         fcn = *(p++);
2391                         noc = *(p++);
2392                         p++;
2393
2394                         for (j = 0; j < noc; j++) {
2395                                 channel = fcn + j;
2396
2397                                 chplan_ap.Channel[i++] = channel;
2398                         }
2399                 }
2400                 chplan_ap.Len = i;
2401
2402                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
2403
2404                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
2405                 chplan_new = pmlmeext->channel_set;
2406
2407                 i = 0;
2408                 j = 0;
2409                 k = 0;
2410                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
2411                         do {
2412                                 if ((i == MAX_CHANNEL_NUM) ||
2413                                     (chplan_sta[i].ChannelNum == 0) ||
2414                                     (chplan_sta[i].ChannelNum > 14))
2415                                         break;
2416
2417                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
2418                                         break;
2419
2420                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
2421                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2422                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2423                                         i++;
2424                                         j++;
2425                                         k++;
2426                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
2427                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2428                                         chplan_new[k].ScanType = SCAN_PASSIVE;
2429                                         i++;
2430                                         k++;
2431                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
2432                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2433                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2434                                         j++;
2435                                         k++;
2436                                 }
2437                         } while (1);
2438
2439                         /*  change AP not support channel to Passive scan */
2440                         while ((i < MAX_CHANNEL_NUM) &&
2441                                (chplan_sta[i].ChannelNum != 0) &&
2442                                (chplan_sta[i].ChannelNum <= 14)) {
2443                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2444                                 chplan_new[k].ScanType = SCAN_PASSIVE;
2445                                 i++;
2446                                 k++;
2447                         }
2448
2449                         /*  add channel AP supported */
2450                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
2451                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2452                                 chplan_new[k].ScanType = SCAN_ACTIVE;
2453                                 j++;
2454                                 k++;
2455                         }
2456                 } else {
2457                         /*  keep original STA 2.4G channel plan */
2458                         while ((i < MAX_CHANNEL_NUM) &&
2459                                (chplan_sta[i].ChannelNum != 0) &&
2460                                (chplan_sta[i].ChannelNum <= 14)) {
2461                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2462                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
2463                                 i++;
2464                                 k++;
2465                         }
2466
2467                         /*  skip AP 2.4G channel plan */
2468                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
2469                                 j++;
2470                 }
2471
2472                 pmlmeext->update_channel_plan_by_ap_done = 1;
2473         }
2474
2475         /*  If channel is used by AP, set channel scan type to active */
2476         channel = bssid->Configuration.DSConfig;
2477         chplan_new = pmlmeext->channel_set;
2478         i = 0;
2479         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
2480                 if (chplan_new[i].ChannelNum == channel) {
2481                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
2482                                 chplan_new[i].ScanType = SCAN_ACTIVE;
2483                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2484                                          ("%s: change channel %d scan type from passive to active\n",
2485                                          __func__, channel));
2486                         }
2487                         break;
2488                 }
2489                 i++;
2490         }
2491 }
2492
2493 /****************************************************************************
2494
2495 Following are the callback functions for each subtype of the management frames
2496
2497 *****************************************************************************/
2498
2499 static unsigned int OnProbeReq(struct adapter *padapter,
2500                                struct recv_frame *precv_frame)
2501 {
2502         unsigned int ielen;
2503         unsigned char *p;
2504         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2505         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2506         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2507         struct wlan_bssid_ex *cur = &pmlmeinfo->network;
2508         u8 *pframe = precv_frame->pkt->data;
2509         uint len = precv_frame->pkt->len;
2510
2511         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
2512                 return _SUCCESS;
2513
2514         if (!check_fwstate(pmlmepriv, _FW_LINKED) &&
2515             !check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE | WIFI_AP_STATE))
2516                 return _SUCCESS;
2517
2518         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, &ielen,
2519                        len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
2520
2521         /* check (wildcard) SSID */
2522         if (p) {
2523                 if ((ielen != 0 && memcmp((void *)(p + 2), (void *)cur->ssid.ssid, cur->ssid.ssid_length)) ||
2524                     (ielen == 0 && pmlmeinfo->hidden_ssid_mode))
2525                         return _SUCCESS;
2526
2527                 if (check_fwstate(pmlmepriv, _FW_LINKED) &&
2528                     pmlmepriv->cur_network.join_res)
2529                         issue_probersp(padapter, get_sa(pframe));
2530         }
2531         return _SUCCESS;
2532 }
2533
2534 static unsigned int OnProbeRsp(struct adapter *padapter,
2535                                struct recv_frame *precv_frame)
2536 {
2537         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2538
2539         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2540                 report_survey_event(padapter, precv_frame);
2541                 return _SUCCESS;
2542         }
2543
2544         return _SUCCESS;
2545 }
2546
2547 static unsigned int OnBeacon(struct adapter *padapter,
2548                              struct recv_frame *precv_frame)
2549 {
2550         int cam_idx;
2551         struct sta_info *psta;
2552         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2553         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2554         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2555         struct sta_priv *pstapriv = &padapter->stapriv;
2556         u8 *pframe = precv_frame->pkt->data;
2557         uint len = precv_frame->pkt->len;
2558         struct wlan_bssid_ex *pbss;
2559         int ret = _SUCCESS;
2560         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
2561
2562         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2563                 report_survey_event(padapter, precv_frame);
2564                 return _SUCCESS;
2565         }
2566
2567         if (!memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN)) {
2568                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
2569                         /* we should update current network before auth, or some IE is wrong */
2570                         pbss = (struct wlan_bssid_ex *)rtw_malloc(sizeof(struct wlan_bssid_ex));
2571                         if (pbss) {
2572                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
2573                                         update_network(&pmlmepriv->cur_network.network, pbss, padapter, true);
2574                                         rtw_get_bcn_info(&pmlmepriv->cur_network);
2575                                 }
2576                                 kfree(pbss);
2577                         }
2578
2579                         /* check the vendor of the assoc AP */
2580                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe + sizeof(struct ieee80211_hdr_3addr), len - sizeof(struct ieee80211_hdr_3addr));
2581
2582                         /* update TSF Value */
2583                         update_TSF(pmlmeext, pframe, len);
2584
2585                         /* start auth */
2586                         start_clnt_auth(padapter);
2587
2588                         return _SUCCESS;
2589                 }
2590
2591                 if (((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
2592                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2593                         if (psta) {
2594                                 ret = rtw_check_bcn_info(padapter, pframe, len);
2595                                 if (!ret) {
2596                                         DBG_88E_LEVEL(_drv_info_, "ap has changed, disconnect now\n ");
2597                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 65535);
2598                                         return _SUCCESS;
2599                                 }
2600                                 /* update WMM, ERP in the beacon */
2601                                 /* todo: the timer is used instead of the number of the beacon received */
2602                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2603                                         update_beacon_info(padapter, pframe, len, psta);
2604                         }
2605                 } else if ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) {
2606                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2607                         if (psta) {
2608                                 /* update WMM, ERP in the beacon */
2609                                 /* todo: the timer is used instead of the number of the beacon received */
2610                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2611                                         update_beacon_info(padapter, pframe, len, psta);
2612                         } else {
2613                                 /* allocate a new CAM entry for IBSS station */
2614                                 cam_idx = allocate_fw_sta_entry(padapter);
2615                                 if (cam_idx == NUM_STA)
2616                                         goto _END_ONBEACON_;
2617
2618                                 /* get supported rate */
2619                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
2620                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
2621                                         goto _END_ONBEACON_;
2622                                 }
2623
2624                                 /* update TSF Value */
2625                                 update_TSF(pmlmeext, pframe, len);
2626
2627                                 /* report sta add event */
2628                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
2629                         }
2630                 }
2631         }
2632
2633 _END_ONBEACON_:
2634
2635         return _SUCCESS;
2636 }
2637
2638 #ifdef CONFIG_88EU_AP_MODE
2639 static unsigned int OnAuth(struct adapter *padapter,
2640                            struct recv_frame *precv_frame)
2641 {
2642         unsigned int auth_mode, ie_len;
2643         u16 seq;
2644         unsigned char *sa, *p;
2645         u16 algorithm;
2646         int status;
2647         static struct sta_info stat;
2648         struct sta_info *pstat = NULL;
2649         struct sta_priv *pstapriv = &padapter->stapriv;
2650         struct security_priv *psecuritypriv = &padapter->securitypriv;
2651         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2652         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2653         u8 *pframe = precv_frame->pkt->data;
2654         uint len = precv_frame->pkt->len;
2655
2656         if ((pmlmeinfo->state & 0x03) != WIFI_FW_AP_STATE)
2657                 return _FAIL;
2658
2659         DBG_88E("+%s\n", __func__);
2660
2661         sa = GetAddr2Ptr(pframe);
2662
2663         auth_mode = psecuritypriv->dot11AuthAlgrthm;
2664         seq = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + 2));
2665         algorithm = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN));
2666
2667         DBG_88E("auth alg=%x, seq=%X\n", algorithm, seq);
2668
2669         if (auth_mode == 2 && psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
2670             psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
2671                 auth_mode = 0;
2672
2673         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
2674             (algorithm == 0 && auth_mode == 1)) {       /*  rx a open-system auth but shared-key is enabled */
2675                 DBG_88E("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
2676                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
2677
2678                 status = _STATS_NO_SUPP_ALG_;
2679
2680                 goto auth_fail;
2681         }
2682
2683         if (!rtw_access_ctrl(padapter, sa)) {
2684                 status = _STATS_UNABLE_HANDLE_STA_;
2685                 goto auth_fail;
2686         }
2687
2688         pstat = rtw_get_stainfo(pstapriv, sa);
2689         if (!pstat) {
2690                 /*  allocate a new one */
2691                 DBG_88E("going to alloc stainfo for sa=%pM\n", sa);
2692                 pstat = rtw_alloc_stainfo(pstapriv, sa);
2693                 if (!pstat) {
2694                         DBG_88E(" Exceed the upper limit of supported clients...\n");
2695                         status = _STATS_UNABLE_HANDLE_STA_;
2696                         goto auth_fail;
2697                 }
2698
2699                 pstat->state = WIFI_FW_AUTH_NULL;
2700                 pstat->auth_seq = 0;
2701         } else {
2702                 spin_lock_bh(&pstapriv->asoc_list_lock);
2703                 if (!list_empty(&pstat->asoc_list)) {
2704                         list_del_init(&pstat->asoc_list);
2705                         pstapriv->asoc_list_cnt--;
2706                 }
2707                 spin_unlock_bh(&pstapriv->asoc_list_lock);
2708
2709                 if (seq == 1) {
2710                         /* TODO: STA re_auth and auth timeout */
2711                 }
2712         }
2713
2714         spin_lock_bh(&pstapriv->auth_list_lock);
2715         if (list_empty(&pstat->auth_list)) {
2716                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
2717                 pstapriv->auth_list_cnt++;
2718         }
2719         spin_unlock_bh(&pstapriv->auth_list_lock);
2720
2721         if (pstat->auth_seq == 0)
2722                 pstat->expire_to = pstapriv->auth_to;
2723
2724         if ((pstat->auth_seq + 1) != seq) {
2725                 DBG_88E("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2726                         seq, pstat->auth_seq + 1);
2727                 status = _STATS_OUT_OF_AUTH_SEQ_;
2728                 goto auth_fail;
2729         }
2730
2731         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2)) {
2732                 if (seq == 1) {
2733                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2734                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
2735                         pstat->expire_to = pstapriv->assoc_to;
2736                         pstat->authalg = algorithm;
2737                 } else {
2738                         DBG_88E("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2739                                 seq, pstat->auth_seq + 1);
2740                         status = _STATS_OUT_OF_AUTH_SEQ_;
2741                         goto auth_fail;
2742                 }
2743         } else { /*  shared system or auto authentication */
2744                 if (seq == 1) {
2745                         /* prepare for the challenging txt... */
2746
2747                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2748                         pstat->state |= WIFI_FW_AUTH_STATE;
2749                         pstat->authalg = algorithm;
2750                         pstat->auth_seq = 2;
2751                 } else if (seq == 3) {
2752                         /* checking for challenging txt... */
2753                         DBG_88E("checking for challenging txt...\n");
2754
2755                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, &ie_len,
2756                                        len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
2757
2758                         if (!p || ie_len <= 0) {
2759                                 DBG_88E("auth rejected because challenge failure!(1)\n");
2760                                 status = _STATS_CHALLENGE_FAIL_;
2761                                 goto auth_fail;
2762                         }
2763
2764                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
2765                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
2766                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
2767                                 /*  challenging txt is correct... */
2768                                 pstat->expire_to =  pstapriv->assoc_to;
2769                         } else {
2770                                 DBG_88E("auth rejected because challenge failure!\n");
2771                                 status = _STATS_CHALLENGE_FAIL_;
2772                                 goto auth_fail;
2773                         }
2774                 } else {
2775                         DBG_88E("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2776                                 seq, pstat->auth_seq + 1);
2777                         status = _STATS_OUT_OF_AUTH_SEQ_;
2778                         goto auth_fail;
2779                 }
2780         }
2781
2782         /*  Now, we are going to issue_auth... */
2783         pstat->auth_seq = seq + 1;
2784
2785         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
2786
2787         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
2788                 pstat->auth_seq = 0;
2789
2790         return _SUCCESS;
2791
2792 auth_fail:
2793
2794         if (pstat)
2795                 rtw_free_stainfo(padapter, pstat);
2796
2797         pstat = &stat;
2798         memset((char *)pstat, '\0', sizeof(stat));
2799         pstat->auth_seq = 2;
2800         memcpy(pstat->hwaddr, sa, 6);
2801
2802         issue_auth(padapter, pstat, (unsigned short)status);
2803
2804         return _FAIL;
2805 }
2806 #endif /* CONFIG_88EU_AP_MODE */
2807
2808 static unsigned int OnAuthClient(struct adapter *padapter,
2809                                  struct recv_frame *precv_frame)
2810 {
2811         unsigned int seq, len, status, offset;
2812         unsigned char *p;
2813         unsigned int go2asoc = 0;
2814         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2815         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2816         u8 *pframe = precv_frame->pkt->data;
2817         uint pkt_len = precv_frame->pkt->len;
2818
2819         DBG_88E("%s\n", __func__);
2820
2821         /* check A1 matches or not */
2822         if (memcmp(myid(&padapter->eeprompriv), get_da(pframe), ETH_ALEN))
2823                 return _SUCCESS;
2824
2825         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
2826                 return _SUCCESS;
2827
2828         offset = (GetPrivacy(pframe)) ? 4 : 0;
2829
2830         seq     = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 2));
2831         status  = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 4));
2832
2833         if (status != 0) {
2834                 DBG_88E("clnt auth fail, status: %d\n", status);
2835                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
2836                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2837                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
2838                         else
2839                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
2840                 }
2841
2842                 set_link_timer(pmlmeext, 1);
2843                 goto authclnt_fail;
2844         }
2845
2846         if (seq == 2) {
2847                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
2848                         /*  legendary shared system */
2849                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, &len,
2850                                        pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
2851
2852                         if (!p)
2853                                 goto authclnt_fail;
2854
2855                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
2856                         pmlmeinfo->auth_seq = 3;
2857                         issue_auth(padapter, NULL, 0);
2858                         set_link_timer(pmlmeext, REAUTH_TO);
2859
2860                         return _SUCCESS;
2861                 }
2862                 /*  open system */
2863                 go2asoc = 1;
2864         } else if (seq == 4) {
2865                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2866                         go2asoc = 1;
2867                 else
2868                         goto authclnt_fail;
2869         } else {
2870                 /*  this is also illegal */
2871                 goto authclnt_fail;
2872         }
2873
2874         if (go2asoc) {
2875                 DBG_88E_LEVEL(_drv_info_, "auth success, start assoc\n");
2876                 start_clnt_assoc(padapter);
2877                 return _SUCCESS;
2878         }
2879 authclnt_fail:
2880         return _FAIL;
2881 }
2882
2883 static unsigned int OnAssocReq(struct adapter *padapter,
2884                                struct recv_frame *precv_frame)
2885 {
2886 #ifdef CONFIG_88EU_AP_MODE
2887         u16 capab_info;
2888         struct rtw_ieee802_11_elems elems;
2889         struct sta_info *pstat;
2890         unsigned char reassoc, *p, *pos, *wpa_ie;
2891         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
2892         int i, wpa_ie_len, left;
2893         unsigned char supportRate[16];
2894         int supportRateNum;
2895         unsigned short status = _STATS_SUCCESSFUL_;
2896         unsigned short frame_type, ie_offset = 0;
2897         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2898         struct security_priv *psecuritypriv = &padapter->securitypriv;
2899         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2900         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
2901         struct wlan_bssid_ex *cur = &pmlmeinfo->network;
2902         struct sta_priv *pstapriv = &padapter->stapriv;
2903         u8 *pframe = precv_frame->pkt->data;
2904         uint ie_len, pkt_len = precv_frame->pkt->len;
2905
2906         if ((pmlmeinfo->state & 0x03) != WIFI_FW_AP_STATE)
2907                 return _FAIL;
2908
2909         frame_type = GetFrameSubType(pframe);
2910         if (frame_type == WIFI_ASSOCREQ) {
2911                 reassoc = 0;
2912                 ie_offset = _ASOCREQ_IE_OFFSET_;
2913         } else { /*  WIFI_REASSOCREQ */
2914                 reassoc = 1;
2915                 ie_offset = _REASOCREQ_IE_OFFSET_;
2916         }
2917
2918         if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
2919                 DBG_88E("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
2920                        "\n", reassoc, (unsigned long)pkt_len);
2921                 return _FAIL;
2922         }
2923
2924         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2925         if (!pstat) {
2926                 status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
2927                 goto asoc_class2_error;
2928         }
2929
2930         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
2931
2932         left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
2933         pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
2934
2935         DBG_88E("%s\n", __func__);
2936
2937         /*  check if this stat has been successfully authenticated/assocated */
2938         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
2939                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
2940                         status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
2941                         goto asoc_class2_error;
2942                 } else {
2943                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
2944                         pstat->state |= WIFI_FW_ASSOC_STATE;
2945                 }
2946         } else {
2947                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
2948                 pstat->state |= WIFI_FW_ASSOC_STATE;
2949         }
2950         pstat->capability = capab_info;
2951         /* now parse all ieee802_11 ie to point to elems */
2952         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
2953             !elems.ssid) {
2954                 DBG_88E("STA %pM sent invalid association request\n",
2955                         pstat->hwaddr);
2956                 status = _STATS_FAILURE_;
2957                 goto OnAssocReqFail;
2958         }
2959
2960         /*  now we should check all the fields... */
2961         /*  checking SSID */
2962         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
2963                        pkt_len - WLAN_HDR_A3_LEN - ie_offset);
2964
2965         if (!p || ie_len == 0) {
2966                 /*  broadcast ssid, however it is not allowed in assocreq */
2967                 status = _STATS_FAILURE_;
2968                 goto OnAssocReqFail;
2969         } else {
2970                 /*  check if ssid match */
2971                 if (memcmp((void *)(p + 2), cur->ssid.ssid, cur->ssid.ssid_length))
2972                         status = _STATS_FAILURE_;
2973
2974                 if (ie_len != cur->ssid.ssid_length)
2975                         status = _STATS_FAILURE_;
2976         }
2977
2978         if (status != _STATS_SUCCESSFUL_)
2979                 goto OnAssocReqFail;
2980
2981         /*  check if the supported rate is ok */
2982         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
2983         if (!p) {
2984                 DBG_88E("Rx a sta assoc-req which supported rate is empty!\n");
2985                 /*  use our own rate set as statoin used */
2986                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
2987                 /* supportRateNum = AP_BSSRATE_LEN; */
2988
2989                 status = _STATS_FAILURE_;
2990                 goto OnAssocReqFail;
2991         } else {
2992                 memcpy(supportRate, p + 2, ie_len);
2993                 supportRateNum = ie_len;
2994
2995                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_, &ie_len,
2996                                pkt_len - WLAN_HDR_A3_LEN - ie_offset);
2997                 if (p) {
2998                         if (supportRateNum <= sizeof(supportRate)) {
2999                                 memcpy(supportRate + supportRateNum,
3000                                        p + 2, ie_len);
3001                                 supportRateNum += ie_len;
3002                         }
3003                 }
3004         }
3005
3006         /* todo: mask supportRate between AP & STA -> move to update raid */
3007         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
3008
3009         /* update station supportRate */
3010         pstat->bssratelen = supportRateNum;
3011         memcpy(pstat->bssrateset, supportRate, supportRateNum);
3012         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
3013
3014         /* check RSN/WPA/WPS */
3015         pstat->dot8021xalg = 0;
3016         pstat->wpa_psk = 0;
3017         pstat->wpa_group_cipher = 0;
3018         pstat->wpa2_group_cipher = 0;
3019         pstat->wpa_pairwise_cipher = 0;
3020         pstat->wpa2_pairwise_cipher = 0;
3021         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
3022         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
3023                 int group_cipher = 0, pairwise_cipher = 0;
3024
3025                 wpa_ie = elems.rsn_ie;
3026                 wpa_ie_len = elems.rsn_ie_len;
3027
3028                 if (rtw_parse_wpa2_ie(wpa_ie - 2, wpa_ie_len + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3029                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3030                         pstat->wpa_psk |= BIT(1);
3031
3032                         pstat->wpa2_group_cipher = group_cipher & psecuritypriv->wpa2_group_cipher;
3033                         pstat->wpa2_pairwise_cipher = pairwise_cipher & psecuritypriv->wpa2_pairwise_cipher;
3034
3035                         if (!pstat->wpa2_group_cipher)
3036                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3037
3038                         if (!pstat->wpa2_pairwise_cipher)
3039                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3040                 } else {
3041                         status = WLAN_STATUS_INVALID_IE;
3042                 }
3043         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
3044                 int group_cipher = 0, pairwise_cipher = 0;
3045
3046                 wpa_ie = elems.wpa_ie;
3047                 wpa_ie_len = elems.wpa_ie_len;
3048
3049                 if (rtw_parse_wpa_ie(wpa_ie - 2, wpa_ie_len + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3050                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3051                         pstat->wpa_psk |= BIT(0);
3052
3053                         pstat->wpa_group_cipher = group_cipher & psecuritypriv->wpa_group_cipher;
3054                         pstat->wpa_pairwise_cipher = pairwise_cipher & psecuritypriv->wpa_pairwise_cipher;
3055
3056                         if (!pstat->wpa_group_cipher)
3057                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3058
3059                         if (!pstat->wpa_pairwise_cipher)
3060                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3061                 } else {
3062                         status = WLAN_STATUS_INVALID_IE;
3063                 }
3064         } else {
3065                 wpa_ie = NULL;
3066                 wpa_ie_len = 0;
3067         }
3068
3069         if (status != _STATS_SUCCESSFUL_)
3070                 goto OnAssocReqFail;
3071
3072         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
3073         if (!wpa_ie) {
3074                 if (elems.wps_ie) {
3075                         DBG_88E("STA included WPS IE in "
3076                                    "(Re)Association Request - assume WPS is "
3077                                    "used\n");
3078                         pstat->flags |= WLAN_STA_WPS;
3079                         /* wpabuf_free(sta->wps_ie); */
3080                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
3081                         /*                              elems.wps_ie_len - 4); */
3082                 } else {
3083                         DBG_88E("STA did not include WPA/RSN IE "
3084                                    "in (Re)Association Request - possible WPS "
3085                                    "use\n");
3086                         pstat->flags |= WLAN_STA_MAYBE_WPS;
3087                 }
3088
3089                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
3090                 /*  that the selected registrar of AP is _FLASE */
3091                 if ((psecuritypriv->wpa_psk > 0) && (pstat->flags & (WLAN_STA_WPS | WLAN_STA_MAYBE_WPS))) {
3092                         if (pmlmepriv->wps_beacon_ie) {
3093                                 u8 selected_registrar = 0;
3094
3095                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
3096
3097                                 if (!selected_registrar) {
3098                                         DBG_88E("selected_registrar is false , or AP is not ready to do WPS\n");
3099
3100                                         status = _STATS_UNABLE_HANDLE_STA_;
3101
3102                                         goto OnAssocReqFail;
3103                                 }
3104                         }
3105                 }
3106         } else {
3107                 int copy_len;
3108
3109                 if (psecuritypriv->wpa_psk == 0) {
3110                         DBG_88E("STA %pM: WPA/RSN IE in association "
3111                         "request, but AP don't support WPA/RSN\n", pstat->hwaddr);
3112
3113                         status = WLAN_STATUS_INVALID_IE;
3114
3115                         goto OnAssocReqFail;
3116                 }
3117
3118                 if (elems.wps_ie) {
3119                         DBG_88E("STA included WPS IE in "
3120                                    "(Re)Association Request - WPS is "
3121                                    "used\n");
3122                         pstat->flags |= WLAN_STA_WPS;
3123                         copy_len = 0;
3124                 } else {
3125                         copy_len = min_t(int, wpa_ie_len + 2, sizeof(pstat->wpa_ie));
3126                 }
3127                 if (copy_len > 0)
3128                         memcpy(pstat->wpa_ie, wpa_ie - 2, copy_len);
3129         }
3130         /*  check if there is WMM IE & support WWM-PS */
3131         pstat->flags &= ~WLAN_STA_WME;
3132         pstat->qos_option = 0;
3133         pstat->qos_info = 0;
3134         pstat->has_legacy_ac = true;
3135         pstat->uapsd_vo = 0;
3136         pstat->uapsd_vi = 0;
3137         pstat->uapsd_be = 0;
3138         pstat->uapsd_bk = 0;
3139         if (pmlmepriv->qospriv.qos_option) {
3140                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
3141                 for (;;) {
3142                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3143                         if (p) {
3144                                 if (!memcmp(p + 2, WMM_IE, 6)) {
3145                                         pstat->flags |= WLAN_STA_WME;
3146
3147                                         pstat->qos_option = 1;
3148                                         pstat->qos_info = *(p + 8);
3149
3150                                         pstat->max_sp_len = (pstat->qos_info >> 5) & 0x3;
3151
3152                                         if ((pstat->qos_info & 0xf) != 0xf)
3153                                                 pstat->has_legacy_ac = true;
3154                                         else
3155                                                 pstat->has_legacy_ac = false;
3156
3157                                         if (pstat->qos_info & 0xf) {
3158                                                 if (pstat->qos_info & BIT(0))
3159                                                         pstat->uapsd_vo = BIT(0) | BIT(1);
3160                                                 else
3161                                                         pstat->uapsd_vo = 0;
3162
3163                                                 if (pstat->qos_info & BIT(1))
3164                                                         pstat->uapsd_vi = BIT(0) | BIT(1);
3165                                                 else
3166                                                         pstat->uapsd_vi = 0;
3167
3168                                                 if (pstat->qos_info & BIT(2))
3169                                                         pstat->uapsd_bk = BIT(0) | BIT(1);
3170                                                 else
3171                                                         pstat->uapsd_bk = 0;
3172
3173                                                 if (pstat->qos_info & BIT(3))
3174                                                         pstat->uapsd_be = BIT(0) | BIT(1);
3175                                                 else
3176                                                         pstat->uapsd_be = 0;
3177                                         }
3178                                         break;
3179                                 }
3180                         } else {
3181                                 break;
3182                         }
3183                         p = p + ie_len + 2;
3184                 }
3185         }
3186
3187         /* save HT capabilities in the sta object */
3188         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
3189         if (elems.ht_capabilities &&
3190             elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
3191                 pstat->flags |= WLAN_STA_HT;
3192
3193                 pstat->flags |= WLAN_STA_WME;
3194
3195                 memcpy(&pstat->htpriv.ht_cap,
3196                        elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
3197         } else {
3198                 pstat->flags &= ~WLAN_STA_HT;
3199         }
3200         if ((!pmlmepriv->htpriv.ht_option) && (pstat->flags & WLAN_STA_HT)) {
3201                 status = _STATS_FAILURE_;
3202                 goto OnAssocReqFail;
3203         }
3204
3205         if ((pstat->flags & WLAN_STA_HT) &&
3206             ((pstat->wpa2_pairwise_cipher & WPA_CIPHER_TKIP) ||
3207             (pstat->wpa_pairwise_cipher & WPA_CIPHER_TKIP))) {
3208                 DBG_88E("HT: %pM tried to "
3209                         "use TKIP with HT association\n", pstat->hwaddr);
3210
3211                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
3212                 /* goto OnAssocReqFail; */
3213         }
3214
3215         pstat->flags |= WLAN_STA_NONERP;
3216         for (i = 0; i < pstat->bssratelen; i++) {
3217                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
3218                         pstat->flags &= ~WLAN_STA_NONERP;
3219                         break;
3220                 }
3221         }
3222
3223         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3224                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
3225         else
3226                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3227
3228         if (status != _STATS_SUCCESSFUL_)
3229                 goto OnAssocReqFail;
3230
3231         /* TODO: identify_proprietary_vendor_ie(); */
3232         /*  Realtek proprietary IE */
3233         /*  identify if this is Broadcom sta */
3234         /*  identify if this is ralink sta */
3235         /*  Customer proprietary IE */
3236
3237         /* get a unique AID */
3238         if (pstat->aid > 0) {
3239                 DBG_88E("  old AID %d\n", pstat->aid);
3240         } else {
3241                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
3242                         if (!pstapriv->sta_aid[pstat->aid - 1])
3243                                 break;
3244
3245                 /* if (pstat->aid > NUM_STA) { */
3246                 if (pstat->aid > pstapriv->max_num_sta) {
3247                         pstat->aid = 0;
3248
3249                         DBG_88E("  no room for more AIDs\n");
3250
3251                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3252
3253                         goto OnAssocReqFail;
3254                 } else {
3255                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
3256                         DBG_88E("allocate new AID=(%d)\n", pstat->aid);
3257                 }
3258         }
3259
3260         pstat->state &= (~WIFI_FW_ASSOC_STATE);
3261         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
3262
3263         spin_lock_bh(&pstapriv->auth_list_lock);
3264         if (!list_empty(&pstat->auth_list)) {
3265                 list_del_init(&pstat->auth_list);
3266                 pstapriv->auth_list_cnt--;
3267         }
3268         spin_unlock_bh(&pstapriv->auth_list_lock);
3269
3270         spin_lock_bh(&pstapriv->asoc_list_lock);
3271         if (list_empty(&pstat->asoc_list)) {
3272                 pstat->expire_to = pstapriv->expire_to;
3273                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
3274                 pstapriv->asoc_list_cnt++;
3275         }
3276         spin_unlock_bh(&pstapriv->asoc_list_lock);
3277
3278         /*  now the station is qualified to join our BSS... */
3279         if ((pstat->state & WIFI_FW_ASSOC_SUCCESS) && (status == _STATS_SUCCESSFUL_)) {
3280                 /* 1 bss_cap_update & sta_info_update */
3281                 bss_cap_update_on_sta_join(padapter, pstat);
3282                 sta_info_update(padapter, pstat);
3283
3284                 /* issue assoc rsp before notify station join event. */
3285                 if (frame_type == WIFI_ASSOCREQ)
3286                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3287                 else
3288                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3289
3290                 /* 2 - report to upper layer */
3291                 DBG_88E("indicate_sta_join_event to upper layer - hostapd\n");
3292                 rtw_indicate_sta_assoc_event(padapter, pstat);
3293
3294                 /* 3-(1) report sta add event */
3295                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
3296         }
3297
3298         return _SUCCESS;
3299
3300 asoc_class2_error:
3301
3302         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
3303
3304         return _FAIL;
3305
3306 OnAssocReqFail:
3307
3308         pstat->aid = 0;
3309         if (frame_type == WIFI_ASSOCREQ)
3310                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3311         else
3312                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3313
3314 #endif /* CONFIG_88EU_AP_MODE */
3315
3316         return _FAIL;
3317 }
3318
3319 static unsigned int OnAssocRsp(struct adapter *padapter,
3320                                struct recv_frame *precv_frame)
3321 {
3322         uint i;
3323         int res;
3324         unsigned short status;
3325         struct ndis_802_11_var_ie *pIE;
3326         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3327         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3328         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
3329         u8 *pframe = precv_frame->pkt->data;
3330         uint pkt_len = precv_frame->pkt->len;
3331
3332         DBG_88E("%s\n", __func__);
3333
3334         /* check A1 matches or not */
3335         if (memcmp(myid(&padapter->eeprompriv), get_da(pframe), ETH_ALEN))
3336                 return _SUCCESS;
3337
3338         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
3339                 return _SUCCESS;
3340
3341         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
3342                 return _SUCCESS;
3343
3344         del_timer_sync(&pmlmeext->link_timer);
3345
3346         /* status */
3347         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
3348         if (status > 0) {
3349                 DBG_88E("assoc reject, status code: %d\n", status);
3350                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
3351                 res = -4;
3352                 goto report_assoc_result;
3353         }
3354
3355         /* get capabilities */
3356         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3357
3358         /* set slot time */
3359         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
3360
3361         /* AID */
3362         pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4)) & 0x3fff);
3363         res = pmlmeinfo->aid;
3364
3365         /* following are moved to join event callback function */
3366         /* to handle HT, WMM, rate adaptive, update MAC reg */
3367         /* for not to handle the synchronous IO in the tasklet */
3368         for (i = 6 + WLAN_HDR_A3_LEN; i < pkt_len;) {
3369                 pIE = (struct ndis_802_11_var_ie *)(pframe + i);
3370
3371                 switch (pIE->ElementID) {
3372                 case _VENDOR_SPECIFIC_IE_:
3373                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6)) /* WMM */
3374                                 WMM_param_handler(padapter, pIE);
3375                         break;
3376                 case _HT_CAPABILITY_IE_:        /* HT caps */
3377                         HT_caps_handler(padapter, pIE);
3378                         break;
3379                 case _HT_EXTRA_INFO_IE_:        /* HT info */
3380                         HT_info_handler(padapter, pIE);
3381                         break;
3382                 case _ERPINFO_IE_:
3383                         ERP_IE_handler(padapter, pIE);
3384                 default:
3385                         break;
3386                 }
3387
3388                 i += (pIE->Length + 2);
3389         }
3390
3391         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
3392         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
3393
3394         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
3395
3396 report_assoc_result:
3397         if (res > 0)
3398                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
3399         else
3400                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
3401
3402         report_join_res(padapter, res);
3403
3404         return _SUCCESS;
3405 }
3406
3407 static unsigned int OnDeAuth(struct adapter *padapter,
3408                              struct recv_frame *precv_frame)
3409 {
3410         unsigned short reason;
3411         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3412         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3413         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
3414         u8 *pframe = precv_frame->pkt->data;
3415         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
3416
3417         /* check A3 */
3418         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3419                 return _SUCCESS;
3420
3421         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3422
3423         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3424
3425 #ifdef CONFIG_88EU_AP_MODE
3426         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3427                 struct sta_info *psta;
3428                 struct sta_priv *pstapriv = &padapter->stapriv;
3429
3430                 DBG_88E_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
3431                               reason, GetAddr2Ptr(pframe));
3432
3433                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3434                 if (psta) {
3435                         u8 updated = 0;
3436
3437                         spin_lock_bh(&pstapriv->asoc_list_lock);
3438                         if (!list_empty(&psta->asoc_list)) {
3439                                 list_del_init(&psta->asoc_list);
3440                                 pstapriv->asoc_list_cnt--;
3441                                 updated = ap_free_sta(padapter, psta, false, reason);
3442                         }
3443                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3444
3445                         associated_clients_update(padapter, updated);
3446                 }
3447
3448                 return _SUCCESS;
3449         }
3450 #endif
3451         DBG_88E_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM\n",
3452                       reason, GetAddr3Ptr(pframe));
3453
3454         receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3455
3456         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3457         return _SUCCESS;
3458 }
3459
3460 static unsigned int OnDisassoc(struct adapter *padapter,
3461                                struct recv_frame *precv_frame)
3462 {
3463         u16 reason;
3464         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3465         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3466         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
3467         u8 *pframe = precv_frame->pkt->data;
3468         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
3469
3470         /* check A3 */
3471         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3472                 return _SUCCESS;
3473
3474         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3475
3476         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3477
3478 #ifdef CONFIG_88EU_AP_MODE
3479         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3480                 struct sta_info *psta;
3481                 struct sta_priv *pstapriv = &padapter->stapriv;
3482
3483                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3484                               reason, GetAddr2Ptr(pframe));
3485
3486                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3487                 if (psta) {
3488                         u8 updated = 0;
3489
3490                         spin_lock_bh(&pstapriv->asoc_list_lock);
3491                         if (!list_empty(&psta->asoc_list)) {
3492                                 list_del_init(&psta->asoc_list);
3493                                 pstapriv->asoc_list_cnt--;
3494                                 updated = ap_free_sta(padapter, psta, false, reason);
3495                         }
3496                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3497
3498                         associated_clients_update(padapter, updated);
3499                 }
3500
3501                 return _SUCCESS;
3502         }
3503 #endif
3504         DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3505                       reason, GetAddr3Ptr(pframe));
3506
3507         receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3508
3509         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3510         return _SUCCESS;
3511 }
3512
3513 static unsigned int OnAtim(struct adapter *padapter,
3514                            struct recv_frame *precv_frame)
3515 {
3516         DBG_88E("%s\n", __func__);
3517         return _SUCCESS;
3518 }
3519
3520 static unsigned int on_action_spct(struct adapter *padapter,
3521                                    struct recv_frame *precv_frame)
3522 {
3523         struct sta_info *psta = NULL;
3524         struct sta_priv *pstapriv = &padapter->stapriv;
3525         u8 *pframe = precv_frame->pkt->data;
3526         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3527         u8 category;
3528         u8 action;
3529
3530         DBG_88E(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
3531
3532         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3533
3534         if (!psta)
3535                 goto exit;
3536
3537         category = frame_body[0];
3538         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
3539                 goto exit;
3540
3541         action = frame_body[1];
3542         switch (action) {
3543         case WLAN_ACTION_SPCT_MSR_REQ:
3544         case WLAN_ACTION_SPCT_MSR_RPRT:
3545         case WLAN_ACTION_SPCT_TPC_REQ:
3546         case WLAN_ACTION_SPCT_TPC_RPRT:
3547                 break;
3548         case WLAN_ACTION_SPCT_CHL_SWITCH:
3549                 break;
3550         default:
3551                 break;
3552         }
3553
3554 exit:
3555         return _FAIL;
3556 }
3557
3558 static unsigned int OnAction_qos(struct adapter *padapter,
3559                                  struct recv_frame *precv_frame)
3560 {
3561         return _SUCCESS;
3562 }
3563
3564 static unsigned int OnAction_dls(struct adapter *padapter,
3565                                  struct recv_frame *precv_frame)
3566 {
3567         return _SUCCESS;
3568 }
3569
3570 static unsigned int OnAction_back(struct adapter *padapter,
3571                                   struct recv_frame *precv_frame)
3572 {
3573         u8 *addr;
3574         struct sta_info *psta = NULL;
3575         struct recv_reorder_ctrl *preorder_ctrl;
3576         unsigned char *frame_body;
3577         unsigned char category, action;
3578         unsigned short tid, status, reason_code = 0;
3579         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3580         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
3581         u8 *pframe = precv_frame->pkt->data;
3582         struct sta_priv *pstapriv = &padapter->stapriv;
3583
3584         /* check RA matches or not */
3585         if (memcmp(myid(&padapter->eeprompriv), GetAddr1Ptr(pframe),
3586                    ETH_ALEN))/* for if1, sta/ap mode */
3587                 return _SUCCESS;
3588
3589         DBG_88E("%s\n", __func__);
3590
3591         if ((pmlmeinfo->state & 0x03) != WIFI_FW_AP_STATE)
3592                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3593                         return _SUCCESS;
3594
3595         addr = GetAddr2Ptr(pframe);
3596         psta = rtw_get_stainfo(pstapriv, addr);
3597
3598         if (!psta)
3599                 return _SUCCESS;
3600
3601         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3602
3603         category = frame_body[0];
3604         if (category == RTW_WLAN_CATEGORY_BACK) { /*  representing Block Ack */
3605                 if (!pmlmeinfo->HT_enable)
3606                         return _SUCCESS;
3607                 action = frame_body[1];
3608                 DBG_88E("%s, action=%d\n", __func__, action);
3609                 switch (action) {
3610                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
3611                         memcpy(&pmlmeinfo->ADDBA_req, &frame_body[2], sizeof(struct ADDBA_request));
3612                         process_addba_req(padapter, (u8 *)&pmlmeinfo->ADDBA_req, addr);
3613
3614                         /* 37 = reject ADDBA Req */
3615                         issue_action_BA(padapter, addr,
3616                                         RTW_WLAN_ACTION_ADDBA_RESP,
3617                                         pmlmeinfo->accept_addba_req ? 0 : 37);
3618                         break;
3619                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
3620                         status = get_unaligned_le16(&frame_body[3]);
3621                         tid = (frame_body[5] >> 2) & 0x7;
3622                         if (status == 0) {      /* successful */
3623                                 DBG_88E("agg_enable for TID=%d\n", tid);
3624                                 psta->htpriv.agg_enable_bitmap |= 1 << tid;
3625                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3626                         } else {
3627                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3628                         }
3629                         break;
3630                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
3631                         if ((frame_body[3] & BIT(3)) == 0) {
3632                                 psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3633                                 psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3634                                 reason_code = get_unaligned_le16(&frame_body[4]);
3635                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
3636                                 tid = (frame_body[3] >> 4) & 0x0F;
3637                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
3638                                 preorder_ctrl->enable = false;
3639                                 preorder_ctrl->indicate_seq = 0xffff;
3640                         }
3641                         DBG_88E("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
3642                         /* todo: how to notify the host while receiving DELETE BA */
3643                         break;
3644                 default:
3645                         break;
3646                 }
3647         }
3648         return _SUCCESS;
3649 }
3650
3651 static s32 rtw_action_public_decache(struct recv_frame *recv_frame, s32 token)
3652 {
3653         struct adapter *adapter = recv_frame->adapter;
3654         struct mlme_ext_priv *mlmeext = &adapter->mlmeextpriv;
3655         u8 *frame = recv_frame->pkt->data;
3656         u16 seq_ctrl = ((recv_frame->attrib.seq_num & 0xffff) << 4) |
3657                 (recv_frame->attrib.frag_num & 0xf);
3658
3659         if (GetRetry(frame)) {
3660                 if (token >= 0) {
3661                         if ((seq_ctrl == mlmeext->action_public_rxseq) && (token == mlmeext->action_public_dialog_token)) {
3662                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
3663                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
3664                                 return _FAIL;
3665                         }
3666                 } else {
3667                         if (seq_ctrl == mlmeext->action_public_rxseq) {
3668                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
3669                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
3670                                 return _FAIL;
3671                         }
3672                 }
3673         }
3674
3675         mlmeext->action_public_rxseq = seq_ctrl;
3676
3677         if (token >= 0)
3678                 mlmeext->action_public_dialog_token = token;
3679
3680         return _SUCCESS;
3681 }
3682
3683 static unsigned int on_action_public_p2p(struct recv_frame *precv_frame)
3684 {
3685         u8 *pframe = precv_frame->pkt->data;
3686         u8 *frame_body;
3687         u8 dialogToken = 0;
3688
3689         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3690         dialogToken = frame_body[7];
3691
3692         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
3693                 return _FAIL;
3694
3695         return _SUCCESS;
3696 }
3697
3698 static unsigned int on_action_public_vendor(struct recv_frame *precv_frame)
3699 {
3700         unsigned int ret = _FAIL;
3701         u8 *pframe = precv_frame->pkt->data;
3702         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3703
3704         if (!memcmp(frame_body + 2, P2P_OUI, 4))
3705                 ret = on_action_public_p2p(precv_frame);
3706
3707         return ret;
3708 }
3709
3710 static unsigned int on_action_public_default(struct recv_frame *precv_frame,
3711                                              u8 action)
3712 {
3713         unsigned int ret = _FAIL;
3714         u8 *pframe = precv_frame->pkt->data;
3715         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3716         u8 token;
3717
3718         token = frame_body[2];
3719
3720         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
3721                 goto exit;
3722
3723         ret = _SUCCESS;
3724
3725 exit:
3726         return ret;
3727 }
3728
3729 static unsigned int on_action_public(struct adapter *padapter,
3730                                      struct recv_frame *precv_frame)
3731 {
3732         unsigned int ret = _FAIL;
3733         u8 *pframe = precv_frame->pkt->data;
3734         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3735         u8 category, action;
3736
3737         /* check RA matches or not */
3738         if (memcmp(myid(&padapter->eeprompriv), GetAddr1Ptr(pframe), ETH_ALEN))
3739                 goto exit;
3740
3741         category = frame_body[0];
3742         if (category != RTW_WLAN_CATEGORY_PUBLIC)
3743                 goto exit;
3744
3745         action = frame_body[1];
3746         switch (action) {
3747         case ACT_PUBLIC_VENDOR:
3748                 ret = on_action_public_vendor(precv_frame);
3749                 break;
3750         default:
3751                 ret = on_action_public_default(precv_frame, action);
3752                 break;
3753         }
3754
3755 exit:
3756         return ret;
3757 }
3758
3759 static unsigned int OnAction_ht(struct adapter *padapter,
3760                                 struct recv_frame *precv_frame)
3761 {
3762         return _SUCCESS;
3763 }
3764
3765 static unsigned int OnAction_wmm(struct adapter *padapter,
3766                                  struct recv_frame *precv_frame)
3767 {
3768         return _SUCCESS;
3769 }
3770
3771 static unsigned int OnAction_p2p(struct adapter *padapter,
3772                                  struct recv_frame *precv_frame)
3773 {
3774         return _SUCCESS;
3775 }
3776
3777 static unsigned int DoReserved(struct adapter *padapter,
3778                                struct recv_frame *precv_frame)
3779 {
3780         return _SUCCESS;
3781 }
3782
3783 static struct action_handler OnAction_tbl[] = {
3784         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
3785         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
3786         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
3787         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
3788         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
3789         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
3790         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
3791         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
3792         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
3793         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
3794         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
3795 };
3796
3797 static unsigned int OnAction(struct adapter *padapter,
3798                              struct recv_frame *precv_frame)
3799 {
3800         int i;
3801         unsigned char category;
3802         struct action_handler *ptable;
3803         unsigned char *frame_body;
3804         u8 *pframe = precv_frame->pkt->data;
3805
3806         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3807
3808         category = frame_body[0];
3809
3810         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
3811                 ptable = &OnAction_tbl[i];
3812                 if (category == ptable->num)
3813                         ptable->func(padapter, precv_frame);
3814         }
3815         return _SUCCESS;
3816 }
3817
3818 /****************************************************************************
3819
3820 Following are the initialization functions for WiFi MLME
3821
3822 *****************************************************************************/
3823
3824 static struct mlme_handler mlme_sta_tbl[] = {
3825         {WIFI_ASSOCREQ,   "OnAssocReq",   &OnAssocReq},
3826         {WIFI_ASSOCRSP,   "OnAssocRsp",   &OnAssocRsp},
3827         {WIFI_REASSOCREQ, "OnReAssocReq", &OnAssocReq},
3828         {WIFI_REASSOCRSP, "OnReAssocRsp", &OnAssocRsp},
3829         {WIFI_PROBEREQ,   "OnProbeReq",   &OnProbeReq},
3830         {WIFI_PROBERSP,   "OnProbeRsp",   &OnProbeRsp},
3831         {0,               "DoReserved",   &DoReserved},
3832         {0,               "DoReserved",   &DoReserved},
3833         {WIFI_BEACON,     "OnBeacon",     &OnBeacon},
3834         {WIFI_ATIM,       "OnATIM",       &OnAtim},
3835         {WIFI_DISASSOC,   "OnDisassoc",   &OnDisassoc},
3836         {WIFI_AUTH,       "OnAuth",       &OnAuthClient},
3837         {WIFI_DEAUTH,     "OnDeAuth",     &OnDeAuth},
3838         {WIFI_ACTION,     "OnAction",     &OnAction},
3839 };
3840
3841 int init_hw_mlme_ext(struct adapter *padapter)
3842 {
3843         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3844
3845         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3846         return _SUCCESS;
3847 }
3848
3849 static void init_mlme_ext_priv_value(struct adapter *padapter)
3850 {
3851         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3852         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
3853         unsigned char mixed_datarate[NumRates] = {
3854                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3855                 _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_,
3856                 _48M_RATE_, _54M_RATE_, 0xff
3857         };
3858         unsigned char mixed_basicrate[NumRates] = {
3859                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3860                 _12M_RATE_, _24M_RATE_, 0xff,
3861         };
3862
3863         atomic_set(&pmlmeext->event_seq, 0);
3864         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
3865
3866         pmlmeext->cur_channel = padapter->registrypriv.channel;
3867         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
3868         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
3869         pmlmeext->oper_channel = pmlmeext->cur_channel;
3870         pmlmeext->oper_bwmode = pmlmeext->cur_bwmode;
3871         pmlmeext->oper_ch_offset = pmlmeext->cur_ch_offset;
3872         pmlmeext->retry = 0;
3873
3874         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
3875
3876         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
3877         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
3878
3879         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
3880
3881         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3882         pmlmeext->sitesurvey_res.channel_idx = 0;
3883         pmlmeext->sitesurvey_res.bss_cnt = 0;
3884         pmlmeext->scan_abort = false;
3885
3886         pmlmeinfo->state = WIFI_FW_NULL_STATE;
3887         pmlmeinfo->reauth_count = 0;
3888         pmlmeinfo->reassoc_count = 0;
3889         pmlmeinfo->link_count = 0;
3890         pmlmeinfo->auth_seq = 0;
3891         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
3892         pmlmeinfo->key_index = 0;
3893         pmlmeinfo->iv = 0;
3894
3895         pmlmeinfo->enc_algo = _NO_PRIVACY_;
3896         pmlmeinfo->authModeToggle = 0;
3897
3898         memset(pmlmeinfo->chg_txt, 0, 128);
3899
3900         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
3901         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
3902
3903         pmlmeinfo->dialogToken = 0;
3904
3905         pmlmeext->action_public_rxseq = 0xffff;
3906         pmlmeext->action_public_dialog_token = 0xff;
3907 }
3908
3909 static int has_channel(struct rt_channel_info *channel_set,
3910                        u8 chanset_size, u8 chan)
3911 {
3912         int i;
3913
3914         for (i = 0; i < chanset_size; i++) {
3915                 if (channel_set[i].ChannelNum == chan)
3916                         return 1;
3917         }
3918         return 0;
3919 }
3920
3921 static void init_channel_list(struct adapter *padapter,
3922                               struct rt_channel_info *channel_set,
3923                               u8 chanset_size,
3924                               struct p2p_channels *channel_list)
3925 {
3926         struct p2p_oper_class_map op_class[] = {
3927                 { IEEE80211G,  81,   1,  13,  1, BW20 },
3928                 { IEEE80211G,  82,  14,  14,  1, BW20 },
3929                 { -1, 0, 0, 0, 0, BW20 }
3930         };
3931
3932         int cla, op;
3933
3934         cla = 0;
3935
3936         for (op = 0; op_class[op].op_class; op++) {
3937                 u8 ch;
3938                 struct p2p_oper_class_map *o = &op_class[op];
3939                 struct p2p_reg_class *reg = NULL;
3940
3941                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
3942                         if (!has_channel(channel_set, chanset_size, ch))
3943                                 continue;
3944
3945                         if (!padapter->registrypriv.ht_enable && o->inc == 8)
3946                                 continue;
3947
3948                         if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
3949                             ((o->bw == BW40MINUS) || (o->bw == BW40PLUS)))
3950                                 continue;
3951
3952                         if (!reg) {
3953                                 reg = &channel_list->reg_class[cla];
3954                                 cla++;
3955                                 reg->reg_class = o->op_class;
3956                                 reg->channels = 0;
3957                         }
3958                         reg->channel[reg->channels] = ch;
3959                         reg->channels++;
3960                 }
3961         }
3962         channel_list->reg_classes = cla;
3963 }
3964
3965 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan,
3966                            struct rt_channel_info *channel_set)
3967 {
3968         u8 index, chanset_size = 0;
3969         u8 b2_4GBand = false;
3970         u8 Index2G = 0;
3971
3972         memset(channel_set, 0, sizeof(struct rt_channel_info) * MAX_CHANNEL_NUM);
3973
3974         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
3975                 DBG_88E("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
3976                 return chanset_size;
3977         }
3978
3979         if (padapter->registrypriv.wireless_mode & WIRELESS_11G) {
3980                 b2_4GBand = true;
3981                 if (ChannelPlan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
3982                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
3983                 else
3984                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
3985         }
3986
3987         if (b2_4GBand) {
3988                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
3989                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
3990
3991                         if ((ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN) ||/* Channel 1~11 is active, and 12~14 is passive */
3992                             (ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G)) {
3993                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
3994                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
3995                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
3996                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
3997                         } else if (ChannelPlan == RT_CHANNEL_DOMAIN_WORLD_WIDE_13 ||
3998                                    Index2G == RT_CHANNEL_DOMAIN_2G_WORLD) {/*  channel 12~13, passive scan */
3999                                 if (channel_set[chanset_size].ChannelNum <= 11)
4000                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4001                                 else
4002                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
4003                         } else {
4004                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4005                         }
4006
4007                         chanset_size++;
4008                 }
4009         }
4010         return chanset_size;
4011 }
4012
4013 int init_mlme_ext_priv(struct adapter *padapter)
4014 {
4015         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4016         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4017         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4018         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4019
4020         pmlmeext->padapter = padapter;
4021
4022         init_mlme_ext_priv_value(padapter);
4023         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
4024
4025         init_mlme_ext_timer(padapter);
4026
4027 #ifdef CONFIG_88EU_AP_MODE
4028         init_mlme_ap_info(padapter);
4029 #endif
4030
4031         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
4032         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
4033
4034         pmlmeext->chan_scan_time = SURVEY_TO;
4035         pmlmeext->mlmeext_init = true;
4036
4037         pmlmeext->active_keep_alive_check = true;
4038
4039         return _SUCCESS;
4040 }
4041
4042 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
4043 {
4044         struct adapter *padapter = pmlmeext->padapter;
4045
4046         if (!padapter)
4047                 return;
4048
4049         if (padapter->bDriverStopped) {
4050                 del_timer_sync(&pmlmeext->survey_timer);
4051                 del_timer_sync(&pmlmeext->link_timer);
4052         }
4053 }
4054
4055 static void _mgt_dispatcher(struct adapter *padapter,
4056                             struct mlme_handler *ptable,
4057                             struct recv_frame *precv_frame)
4058 {
4059         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4060         u8 *pframe = precv_frame->pkt->data;
4061
4062         if (ptable->func) {
4063                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4064                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4065                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4066                         return;
4067                 ptable->func(padapter, precv_frame);
4068         }
4069 }
4070
4071 void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame)
4072 {
4073         int index;
4074         struct mlme_handler *ptable;
4075 #ifdef CONFIG_88EU_AP_MODE
4076         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4077 #endif
4078         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4079         u8 *pframe = precv_frame->pkt->data;
4080         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
4081
4082         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
4083                  ("+%s: type(0x%x) subtype(0x%x)\n", __func__,
4084                   (unsigned int)GetFrameType(pframe),
4085                   (unsigned int)GetFrameSubType(pframe)));
4086
4087         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
4088                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
4089                          ("%s: type(0x%x) error!\n", __func__,
4090                           (unsigned int)GetFrameType(pframe)));
4091                 return;
4092         }
4093
4094         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4095         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4096             memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4097                 return;
4098
4099         ptable = mlme_sta_tbl;
4100
4101         index = GetFrameSubType(pframe) >> 4;
4102
4103         if (index > 13) {
4104                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type=%d\n", index));
4105                 return;
4106         }
4107         ptable += index;
4108
4109         if (psta) {
4110                 if (GetRetry(pframe)) {
4111                         if (precv_frame->attrib.seq_num ==
4112                             psta->RxMgmtFrameSeqNum) {
4113                                 /* drop the duplicate management frame */
4114                                 DBG_88E("Drop duplicate management frame with seq_num=%d.\n",
4115                                         precv_frame->attrib.seq_num);
4116                                 return;
4117                         }
4118                 }
4119                 psta->RxMgmtFrameSeqNum = precv_frame->attrib.seq_num;
4120         }
4121
4122 #ifdef CONFIG_88EU_AP_MODE
4123         switch (GetFrameSubType(pframe)) {
4124         case WIFI_AUTH:
4125                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
4126                         ptable->func = &OnAuth;
4127                 else
4128                         ptable->func = &OnAuthClient;
4129                 fallthrough;
4130         case WIFI_ASSOCREQ:
4131         case WIFI_REASSOCREQ:
4132         case WIFI_PROBEREQ:
4133         case WIFI_BEACON:
4134         case WIFI_ACTION:
4135                 _mgt_dispatcher(padapter, ptable, precv_frame);
4136                 break;
4137         default:
4138                 _mgt_dispatcher(padapter, ptable, precv_frame);
4139                 break;
4140         }
4141 #else
4142         _mgt_dispatcher(padapter, ptable, precv_frame);
4143 #endif
4144 }
4145
4146 /****************************************************************************
4147
4148 Following are the functions to report events
4149
4150 *****************************************************************************/
4151
4152 void report_survey_event(struct adapter *padapter,
4153                          struct recv_frame *precv_frame)
4154 {
4155         struct cmd_obj *pcmd_obj;
4156         u8 *pevtcmd;
4157         u32 cmdsz;
4158         struct survey_event *psurvey_evt;
4159         struct C2HEvent_Header *pc2h_evt_hdr;
4160         struct mlme_ext_priv *pmlmeext;
4161         struct cmd_priv *pcmdpriv;
4162
4163         if (!padapter)
4164                 return;
4165
4166         pmlmeext = &padapter->mlmeextpriv;
4167         pcmdpriv = &padapter->cmdpriv;
4168
4169         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4170         if (!pcmd_obj)
4171                 return;
4172
4173         cmdsz = sizeof(struct survey_event) + sizeof(struct C2HEvent_Header);
4174         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4175         if (!pevtcmd) {
4176                 kfree(pcmd_obj);
4177                 return;
4178         }
4179
4180         INIT_LIST_HEAD(&pcmd_obj->list);
4181
4182         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4183         pcmd_obj->cmdsz = cmdsz;
4184         pcmd_obj->parmbuf = pevtcmd;
4185
4186         pcmd_obj->rsp = NULL;
4187         pcmd_obj->rspsz  = 0;
4188
4189         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4190         pc2h_evt_hdr->len = sizeof(struct survey_event);
4191         pc2h_evt_hdr->ID = _Survey_EVT_;
4192         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4193
4194         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4195
4196         if (collect_bss_info(padapter, precv_frame, &psurvey_evt->bss) == _FAIL) {
4197                 kfree(pcmd_obj);
4198                 kfree(pevtcmd);
4199                 return;
4200         }
4201
4202         process_80211d(padapter, &psurvey_evt->bss);
4203
4204         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4205
4206         pmlmeext->sitesurvey_res.bss_cnt++;
4207 }
4208
4209 void report_surveydone_event(struct adapter *padapter)
4210 {
4211         struct cmd_obj *pcmd_obj;
4212         u8 *pevtcmd;
4213         u32 cmdsz;
4214         struct surveydone_event *psurveydone_evt;
4215         struct C2HEvent_Header *pc2h_evt_hdr;
4216         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4217         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4218
4219         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4220         if (!pcmd_obj)
4221                 return;
4222
4223         cmdsz = sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header);
4224         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4225         if (!pevtcmd) {
4226                 kfree(pcmd_obj);
4227                 return;
4228         }
4229
4230         INIT_LIST_HEAD(&pcmd_obj->list);
4231
4232         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4233         pcmd_obj->cmdsz = cmdsz;
4234         pcmd_obj->parmbuf = pevtcmd;
4235
4236         pcmd_obj->rsp = NULL;
4237         pcmd_obj->rspsz  = 0;
4238
4239         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4240         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4241         pc2h_evt_hdr->ID = _SurveyDone_EVT_;
4242         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4243
4244         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4245         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4246
4247         DBG_88E("survey done event(%x)\n", psurveydone_evt->bss_cnt);
4248
4249         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4250 }
4251
4252 void report_join_res(struct adapter *padapter, int res)
4253 {
4254         struct cmd_obj *pcmd_obj;
4255         u8 *pevtcmd;
4256         u32 cmdsz;
4257         struct joinbss_event *pjoinbss_evt;
4258         struct C2HEvent_Header *pc2h_evt_hdr;
4259         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4260         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4261         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4262
4263         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4264         if (!pcmd_obj)
4265                 return;
4266
4267         cmdsz = sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header);
4268         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4269         if (!pevtcmd) {
4270                 kfree(pcmd_obj);
4271                 return;
4272         }
4273
4274         INIT_LIST_HEAD(&pcmd_obj->list);
4275
4276         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4277         pcmd_obj->cmdsz = cmdsz;
4278         pcmd_obj->parmbuf = pevtcmd;
4279
4280         pcmd_obj->rsp = NULL;
4281         pcmd_obj->rspsz  = 0;
4282
4283         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4284         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4285         pc2h_evt_hdr->ID = _JoinBss_EVT_;
4286         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4287
4288         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4289         memcpy((unsigned char *)(&pjoinbss_evt->network.network), &pmlmeinfo->network, sizeof(struct wlan_bssid_ex));
4290         pjoinbss_evt->network.join_res  = res;
4291         pjoinbss_evt->network.aid = res;
4292
4293         DBG_88E("%s(%d)\n", __func__, res);
4294
4295         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4296
4297         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4298 }
4299
4300 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr,
4301                           unsigned short reason)
4302 {
4303         struct cmd_obj *pcmd_obj;
4304         u8 *pevtcmd;
4305         u32 cmdsz;
4306         struct sta_info *psta;
4307         int mac_id;
4308         struct stadel_event *pdel_sta_evt;
4309         struct C2HEvent_Header *pc2h_evt_hdr;
4310         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4311         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4312
4313         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4314         if (!pcmd_obj)
4315                 return;
4316
4317         cmdsz = sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header);
4318         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4319         if (!pevtcmd) {
4320                 kfree(pcmd_obj);
4321                 return;
4322         }
4323
4324         INIT_LIST_HEAD(&pcmd_obj->list);
4325
4326         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4327         pcmd_obj->cmdsz = cmdsz;
4328         pcmd_obj->parmbuf = pevtcmd;
4329
4330         pcmd_obj->rsp = NULL;
4331         pcmd_obj->rspsz  = 0;
4332
4333         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4334         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4335         pc2h_evt_hdr->ID = _DelSTA_EVT_;
4336         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4337
4338         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4339         ether_addr_copy((unsigned char *)(&pdel_sta_evt->macaddr), MacAddr);
4340         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4341
4342         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4343         if (psta)
4344                 mac_id = (int)psta->mac_id;
4345         else
4346                 mac_id = -1;
4347
4348         pdel_sta_evt->mac_id = mac_id;
4349
4350         DBG_88E("%s: delete STA, mac_id =%d\n", __func__, mac_id);
4351
4352         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4353 }
4354
4355 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr,
4356                           int cam_idx)
4357 {
4358         struct cmd_obj *pcmd_obj;
4359         u8 *pevtcmd;
4360         u32 cmdsz;
4361         struct stassoc_event *padd_sta_evt;
4362         struct C2HEvent_Header *pc2h_evt_hdr;
4363         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4364         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4365
4366         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4367         if (!pcmd_obj)
4368                 return;
4369
4370         cmdsz = sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header);
4371         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4372         if (!pevtcmd) {
4373                 kfree(pcmd_obj);
4374                 return;
4375         }
4376
4377         INIT_LIST_HEAD(&pcmd_obj->list);
4378
4379         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4380         pcmd_obj->cmdsz = cmdsz;
4381         pcmd_obj->parmbuf = pevtcmd;
4382
4383         pcmd_obj->rsp = NULL;
4384         pcmd_obj->rspsz  = 0;
4385
4386         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4387         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4388         pc2h_evt_hdr->ID = _AddSTA_EVT_;
4389         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4390
4391         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4392         ether_addr_copy((unsigned char *)(&padd_sta_evt->macaddr), MacAddr);
4393         padd_sta_evt->cam_id = cam_idx;
4394
4395         DBG_88E("%s: add STA\n", __func__);
4396
4397         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4398 }
4399
4400 /****************************************************************************
4401
4402 Following are the event callback functions
4403
4404 *****************************************************************************/
4405
4406 /* for sta/adhoc mode */
4407 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4408 {
4409         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4410         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4411         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4412
4413         /* ERP */
4414         VCS_update(padapter, psta);
4415
4416         /* HT */
4417         if (pmlmepriv->htpriv.ht_option) {
4418                 psta->htpriv.ht_option = true;
4419
4420                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4421
4422                 if (support_short_GI(padapter, &pmlmeinfo->HT_caps))
4423                         psta->htpriv.sgi = true;
4424
4425                 psta->qos_option = true;
4426         } else {
4427                 psta->htpriv.ht_option = false;
4428
4429                 psta->htpriv.ampdu_enable = false;
4430
4431                 psta->htpriv.sgi = false;
4432                 psta->qos_option = false;
4433         }
4434         psta->htpriv.bwmode = pmlmeext->cur_bwmode;
4435         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4436
4437         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4438         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4439
4440         /* QoS */
4441         if (pmlmepriv->qospriv.qos_option)
4442                 psta->qos_option = true;
4443
4444         psta->state = _FW_LINKED;
4445 }
4446
4447 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4448 {
4449         struct sta_info *psta, *psta_bmc;
4450         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4451         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4452         struct wlan_bssid_ex *cur_network = &pmlmeinfo->network;
4453         struct sta_priv *pstapriv = &padapter->stapriv;
4454         u8 join_type;
4455         u16 media_status;
4456
4457         if (join_res < 0) {
4458                 join_type = 1;
4459                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4460                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4461
4462                 /* restore to initial setting. */
4463                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4464
4465                 goto exit_mlmeext_joinbss_event_callback;
4466         }
4467
4468         if ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) {
4469                 /* for bc/mc */
4470                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
4471                 if (psta_bmc) {
4472                         pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
4473                         update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
4474                         Update_RA_Entry(padapter, psta_bmc->mac_id);
4475                 }
4476         }
4477
4478         /* turn on dynamic functions */
4479         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4480
4481         /*  update IOT-related issue */
4482         update_IOT_info(padapter);
4483
4484         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
4485
4486         /* BCN interval */
4487         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4488
4489         /* update capability */
4490         update_capinfo(padapter, pmlmeinfo->capability);
4491
4492         /* WMM, Update EDCA param */
4493         WMMOnAssocRsp(padapter);
4494
4495         /* HT */
4496         HTOnAssocRsp(padapter);
4497
4498         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4499
4500         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
4501         if (psta) { /* only for infra. mode */
4502                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4503
4504                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4505
4506                 /* set per sta rate after updating HT cap. */
4507                 set_sta_rate(padapter, psta);
4508                 rtw_hal_set_hwreg(padapter, HW_VAR_TX_RPT_MAX_MACID, (u8 *)&psta->mac_id);
4509                 media_status = (psta->mac_id << 8) | 1; /*   MACID|OPMODE: 1 means connect */
4510                 rtw_hal_set_hwreg(padapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
4511         }
4512
4513         join_type = 2;
4514         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4515
4516         if ((pmlmeinfo->state & 0x03) == WIFI_FW_STATION_STATE) {
4517                 /*  correcting TSF */
4518                 correct_TSF(padapter, pmlmeext);
4519         }
4520         rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4521
4522 exit_mlmeext_joinbss_event_callback:
4523
4524         DBG_88E("=>%s\n", __func__);
4525 }
4526
4527 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4528 {
4529         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4530         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4531         u8 join_type;
4532
4533         DBG_88E("%s\n", __func__);
4534
4535         if ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) {
4536                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {/* adhoc master or sta_count>1 */
4537                         /* nothing to do */
4538                 } else { /* adhoc client */
4539                         /*  correcting TSF */
4540                         correct_TSF(padapter, pmlmeext);
4541
4542                         /* start beacon */
4543                         if (send_beacon(padapter) == _FAIL) {
4544                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4545                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4546                                 return;
4547                         }
4548                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4549                 }
4550
4551                 join_type = 2;
4552                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4553         }
4554
4555         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4556
4557         /* rate radaptive */
4558         Update_RA_Entry(padapter, psta->mac_id);
4559
4560         /* update adhoc sta_info */
4561         update_sta_info(padapter, psta);
4562 }
4563
4564 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4565 {
4566         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4567         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4568
4569         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter)) {
4570                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4571                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4572
4573                 /* restore to initial setting. */
4574                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4575
4576                 /* switch to the 20M Hz mode after disconnect */
4577                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4578                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4579
4580                 /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4581                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4582
4583                 flush_all_cam_entry(padapter);
4584
4585                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4586
4587                 /* set MSR to no link state -> infra. mode */
4588                 Set_MSR(padapter, _HW_STATE_STATION_);
4589
4590                 del_timer_sync(&pmlmeext->link_timer);
4591         }
4592 }
4593
4594 /****************************************************************************
4595
4596 Following are the functions for the timer handlers
4597
4598 *****************************************************************************/
4599
4600 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4601 {
4602         u8 ret = false;
4603
4604         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta)) &&
4605             sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta) &&
4606             sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta))
4607                 ret = false;
4608         else
4609                 ret = true;
4610
4611         sta_update_last_rx_pkts(psta);
4612
4613         return ret;
4614 }
4615
4616 void linked_status_chk(struct adapter *padapter)
4617 {
4618         u32 i;
4619         struct sta_info *psta;
4620         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
4621         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4622         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4623         struct sta_priv *pstapriv = &padapter->stapriv;
4624
4625         if (is_client_associated_to_ap(padapter)) {
4626                 /* linked infrastructure client mode */
4627
4628                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
4629                 int rx_chk_limit;
4630
4631                 rx_chk_limit = 4;
4632                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
4633                 if (psta) {
4634                         bool is_p2p_enable = false;
4635
4636                         if (!chk_ap_is_alive(padapter, psta))
4637                                 rx_chk = _FAIL;
4638
4639                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
4640                                 tx_chk = _FAIL;
4641
4642                         if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
4643                                 u8 backup_oper_channel = 0;
4644
4645                                 /* switch to correct channel of current network  before issue keep-alive frames */
4646                                 if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
4647                                         backup_oper_channel = rtw_get_oper_ch(padapter);
4648                                         SelectChannel(padapter, pmlmeext->cur_channel);
4649                                 }
4650
4651                                 if (rx_chk != _SUCCESS)
4652                                         issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, psta->hwaddr, 3, 1);
4653
4654                                 if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
4655                                         tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
4656                                         /* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
4657                                         if (tx_chk == _SUCCESS && !is_p2p_enable)
4658                                                 rx_chk = _SUCCESS;
4659                                 }
4660
4661                                 /* back to the original operation channel */
4662                                 if (backup_oper_channel > 0)
4663                                         SelectChannel(padapter, backup_oper_channel);
4664                         } else {
4665                                 if (rx_chk != _SUCCESS) {
4666                                         if (pmlmeext->retry == 0) {
4667                                                 issue_probereq(padapter, &pmlmeinfo->network.ssid,
4668                                                                pmlmeinfo->network.MacAddress,
4669                                                                false);
4670                                                 issue_probereq(padapter, &pmlmeinfo->network.ssid,
4671                                                                pmlmeinfo->network.MacAddress,
4672                                                                false);
4673                                                 issue_probereq(padapter, &pmlmeinfo->network.ssid,
4674                                                                pmlmeinfo->network.MacAddress,
4675                                                                false);
4676                                         }
4677                                 }
4678
4679                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf)
4680                                         tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
4681                         }
4682
4683                         if (rx_chk == _FAIL) {
4684                                 pmlmeext->retry++;
4685                                 if (pmlmeext->retry > rx_chk_limit) {
4686                                         DBG_88E_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
4687                                                       FUNC_ADPT_ARG(padapter));
4688                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress,
4689                                                            WLAN_REASON_EXPIRATION_CHK);
4690                                         return;
4691                                 }
4692                         } else {
4693                                 pmlmeext->retry = 0;
4694                         }
4695
4696                         if (tx_chk == _FAIL) {
4697                                 pmlmeinfo->link_count &= 0xf;
4698                         } else {
4699                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
4700                                 pmlmeinfo->link_count = 0;
4701                         }
4702                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
4703         } else if (is_client_associated_to_ibss(padapter)) {
4704                 /* linked IBSS mode */
4705                 /* for each assoc list entry to check the rx pkt counter */
4706                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
4707                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
4708                                 psta = pmlmeinfo->FW_sta_info[i].psta;
4709
4710                                 if (!psta)
4711                                         continue;
4712                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
4713                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
4714                                                 pmlmeinfo->FW_sta_info[i].retry++;
4715                                         } else {
4716                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
4717                                                 pmlmeinfo->FW_sta_info[i].status = 0;
4718                                                 report_del_sta_event(padapter, psta->hwaddr
4719                                                         , 65535/*  indicate disconnect caused by no rx */
4720                                         );
4721                                         }
4722                                 } else {
4723                                         pmlmeinfo->FW_sta_info[i].retry = 0;
4724                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
4725                                 }
4726                         }
4727                 }
4728         }
4729 }
4730
4731 void survey_timer_hdl(struct timer_list *t)
4732 {
4733         struct adapter *padapter = from_timer(padapter, t,
4734                                               mlmeextpriv.survey_timer);
4735         struct cmd_obj *ph2c;
4736         struct sitesurvey_parm *psurveyPara;
4737         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4738         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4739
4740         /* issue rtw_sitesurvey_cmd */
4741         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
4742                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
4743                         pmlmeext->sitesurvey_res.channel_idx++;
4744
4745                 if (pmlmeext->scan_abort) {
4746                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
4747                         DBG_88E("%s idx:%d\n", __func__
4748                                 , pmlmeext->sitesurvey_res.channel_idx);
4749
4750                         pmlmeext->scan_abort = false;/* reset */
4751                 }
4752
4753                 ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4754                 if (!ph2c)
4755                         goto exit_survey_timer_hdl;
4756
4757                 psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
4758                 if (!psurveyPara) {
4759                         kfree(ph2c);
4760                         goto exit_survey_timer_hdl;
4761                 }
4762
4763                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, _SiteSurvey_CMD_);
4764                 rtw_enqueue_cmd(pcmdpriv, ph2c);
4765         }
4766
4767 exit_survey_timer_hdl:
4768         return;
4769 }
4770
4771 void link_timer_hdl(struct timer_list *t)
4772 {
4773         struct adapter *padapter = from_timer(padapter, t,
4774                                             mlmeextpriv.link_timer);
4775         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4776         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4777
4778         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
4779                 DBG_88E("%s:no beacon while connecting\n", __func__);
4780                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4781                 report_join_res(padapter, -3);
4782         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
4783                 /* re-auth timer */
4784                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
4785                         pmlmeinfo->state = 0;
4786                         report_join_res(padapter, -1);
4787                         return;
4788                 }
4789
4790                 DBG_88E("%s: auth timeout and try again\n", __func__);
4791                 pmlmeinfo->auth_seq = 1;
4792                 issue_auth(padapter, NULL, 0);
4793                 set_link_timer(pmlmeext, REAUTH_TO);
4794         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
4795                 /* re-assoc timer */
4796                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
4797                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4798                         report_join_res(padapter, -2);
4799                         return;
4800                 }
4801
4802                 DBG_88E("%s: assoc timeout and try again\n", __func__);
4803                 issue_assocreq(padapter);
4804                 set_link_timer(pmlmeext, REASSOC_TO);
4805         }
4806 }
4807
4808 void addba_timer_hdl(struct timer_list *t)
4809 {
4810         struct sta_info *psta = from_timer(psta, t, addba_retry_timer);
4811         struct ht_priv *phtpriv;
4812
4813         if (!psta)
4814                 return;
4815
4816         phtpriv = &psta->htpriv;
4817
4818         if ((phtpriv->ht_option) && (phtpriv->ampdu_enable)) {
4819                 if (phtpriv->candidate_tid_bitmap)
4820                         phtpriv->candidate_tid_bitmap = 0x0;
4821         }
4822 }
4823
4824 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
4825 {
4826         u8 type;
4827         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4828         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4829         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
4830
4831         if (psetop->mode == Ndis802_11APMode) {
4832                 pmlmeinfo->state = WIFI_FW_AP_STATE;
4833                 type = _HW_STATE_AP_;
4834         } else if (psetop->mode == Ndis802_11Infrastructure) {
4835                 pmlmeinfo->state &= ~(BIT(0) | BIT(1));/*  clear state */
4836                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
4837                 type = _HW_STATE_STATION_;
4838         } else if (psetop->mode == Ndis802_11IBSS) {
4839                 type = _HW_STATE_ADHOC_;
4840         } else {
4841                 type = _HW_STATE_NOLINK_;
4842         }
4843
4844         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
4845         /* Set_MSR(padapter, type); */
4846
4847         return H2C_SUCCESS;
4848 }
4849
4850 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
4851 {
4852         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4853         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4854         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
4855         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4856
4857         if (pparm->InfrastructureMode == Ndis802_11APMode) {
4858 #ifdef CONFIG_88EU_AP_MODE
4859
4860                 if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
4861                         /* todo: */
4862                         return H2C_SUCCESS;
4863                 }
4864 #endif
4865         }
4866
4867         /* below is for ad-hoc master */
4868         if (pparm->InfrastructureMode == Ndis802_11IBSS) {
4869                 rtw_joinbss_reset(padapter);
4870
4871                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4872                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4873                 pmlmeinfo->ERP_enable = 0;
4874                 pmlmeinfo->WMM_enable = 0;
4875                 pmlmeinfo->HT_enable = 0;
4876                 pmlmeinfo->HT_caps_enable = 0;
4877                 pmlmeinfo->HT_info_enable = 0;
4878                 pmlmeinfo->agg_enable_bitmap = 0;
4879                 pmlmeinfo->candidate_tid_bitmap = 0;
4880
4881                 /* disable dynamic functions, such as high power, DIG */
4882                 Save_DM_Func_Flag(padapter);
4883                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
4884
4885                 /* config the initial gain under linking, need to write the BB registers */
4886                 /* initialgain = 0x1E; */
4887                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
4888
4889                 /* cancel link timer */
4890                 del_timer_sync(&pmlmeext->link_timer);
4891
4892                 /* clear CAM */
4893                 flush_all_cam_entry(padapter);
4894
4895                 memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, ie_length));
4896                 pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
4897
4898                 if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
4899                         return H2C_PARAMETERS_ERROR;
4900
4901                 memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
4902
4903                 start_create_ibss(padapter);
4904         }
4905
4906         return H2C_SUCCESS;
4907 }
4908
4909 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
4910 {
4911         u8 join_type;
4912         struct ndis_802_11_var_ie *pIE;
4913         struct registry_priv *pregpriv = &padapter->registrypriv;
4914         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4915         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
4916         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
4917         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4918         u32 i;
4919
4920         /* check already connecting to AP or not */
4921         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
4922                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
4923                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
4924
4925                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4926
4927                 /* clear CAM */
4928                 flush_all_cam_entry(padapter);
4929
4930                 del_timer_sync(&pmlmeext->link_timer);
4931
4932                 /* set MSR to nolink -> infra. mode */
4933                 Set_MSR(padapter, _HW_STATE_STATION_);
4934
4935                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4936         }
4937
4938         rtw_antenna_select_cmd(padapter, pparm->PhyInfo.Optimum_antenna, false);
4939
4940         rtw_joinbss_reset(padapter);
4941
4942         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4943         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4944         pmlmeinfo->ERP_enable = 0;
4945         pmlmeinfo->WMM_enable = 0;
4946         pmlmeinfo->HT_enable = 0;
4947         pmlmeinfo->HT_caps_enable = 0;
4948         pmlmeinfo->HT_info_enable = 0;
4949         pmlmeinfo->agg_enable_bitmap = 0;
4950         pmlmeinfo->candidate_tid_bitmap = 0;
4951         pmlmeinfo->bwmode_updated = false;
4952
4953         memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, ie_length));
4954         pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
4955
4956         if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
4957                 return H2C_PARAMETERS_ERROR;
4958
4959         memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
4960
4961         /* Check AP vendor to move rtw_joinbss_cmd() */
4962
4963         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pnetwork->ie_length;) {
4964                 pIE = (struct ndis_802_11_var_ie *)(pnetwork->ies + i);
4965
4966                 switch (pIE->ElementID) {
4967                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
4968                         if (!memcmp(pIE->data, WMM_OUI, 4))
4969                                 pmlmeinfo->WMM_enable = 1;
4970                         break;
4971                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
4972                         pmlmeinfo->HT_caps_enable = 1;
4973                         break;
4974                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
4975                         pmlmeinfo->HT_info_enable = 1;
4976
4977                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
4978                         {
4979                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
4980
4981                                 if ((pregpriv->cbw40_enable) &&  (pht_info->infos[0] & BIT(2))) {
4982                                         /* switch to the 40M Hz mode according to the AP */
4983                                         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
4984                                         switch (pht_info->infos[0] & 0x3) {
4985                                         case 1:
4986                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
4987                                                 break;
4988                                         case 3:
4989                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
4990                                                 break;
4991                                         default:
4992                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4993                                                 break;
4994                                 }
4995
4996                                         DBG_88E("set ch/bw before connected\n");
4997                                 }
4998                         }
4999                         break;
5000                 default:
5001                         break;
5002                 }
5003
5004                 i += (pIE->Length + 2);
5005         }
5006         /* disable dynamic functions, such as high power, DIG */
5007
5008         /* config the initial gain under linking, need to write the BB registers */
5009
5010         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
5011         join_type = 0;
5012         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5013
5014         /* cancel link timer */
5015         del_timer_sync(&pmlmeext->link_timer);
5016
5017         start_clnt_join(padapter);
5018
5019         return H2C_SUCCESS;
5020 }
5021
5022 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5023 {
5024         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5025         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5026         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
5027         struct wlan_bssid_ex *pnetwork = &pmlmeinfo->network;
5028         u8 val8;
5029
5030         if (is_client_associated_to_ap(padapter))
5031                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms / 100, 100);
5032
5033         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5034         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5035
5036         /* restore to initial setting. */
5037         update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
5038
5039         if (((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)) {
5040                 /* Stop BCN */
5041                 val8 = 0;
5042                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5043         }
5044
5045         /* set MSR to no link state -> infra. mode */
5046         Set_MSR(padapter, _HW_STATE_STATION_);
5047
5048         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5049
5050         /* switch to the 20M Hz mode after disconnect */
5051         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5052         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5053
5054         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5055
5056         flush_all_cam_entry(padapter);
5057
5058         del_timer_sync(&pmlmeext->link_timer);
5059
5060         rtw_free_uc_swdec_pending_queue(padapter);
5061
5062         return  H2C_SUCCESS;
5063 }
5064
5065 static int rtw_scan_ch_decision(struct adapter *padapter,
5066                                 struct rtw_ieee80211_channel *out,
5067                                 u32 out_num,
5068                                 struct rtw_ieee80211_channel *in, u32 in_num)
5069 {
5070         int i, j;
5071         int set_idx;
5072         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5073
5074         /* clear out first */
5075         memset(out, 0, sizeof(struct rtw_ieee80211_channel) * out_num);
5076
5077         /* acquire channels from in */
5078         j = 0;
5079         for (i = 0; i < in_num; i++) {
5080                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5081                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED) &&
5082                     set_idx >= 0) {
5083                         out[j] = in[i];
5084
5085                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5086                                 out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5087
5088                         j++;
5089                 }
5090                 if (j >= out_num)
5091                         break;
5092         }
5093
5094         /* if out is empty, use channel_set as default */
5095         if (j == 0) {
5096                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5097                         out[i].hw_value = pmlmeext->channel_set[i].ChannelNum;
5098
5099                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5100                                 out[i].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5101
5102                         j++;
5103                 }
5104         }
5105
5106         return j;
5107 }
5108
5109 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5110 {
5111         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5112         struct sitesurvey_parm *pparm = (struct sitesurvey_parm *)pbuf;
5113         u8 bdelayscan = false;
5114         u8 val8;
5115         u32 initialgain;
5116         u32 i;
5117
5118         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5119                 /* for first time sitesurvey_cmd */
5120                 rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, NULL);
5121
5122                 pmlmeext->sitesurvey_res.state = SCAN_START;
5123                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5124                 pmlmeext->sitesurvey_res.channel_idx = 0;
5125
5126                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5127                         if (pparm->ssid[i].ssid_length) {
5128                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].ssid, pparm->ssid[i].ssid, IW_ESSID_MAX_SIZE);
5129                                 pmlmeext->sitesurvey_res.ssid[i].ssid_length = pparm->ssid[i].ssid_length;
5130                         } else {
5131                                 pmlmeext->sitesurvey_res.ssid[i].ssid_length = 0;
5132                         }
5133                 }
5134
5135                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5136                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5137                         , pparm->ch, pparm->ch_num
5138         );
5139
5140                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5141
5142                 /* issue null data if associating to the AP */
5143                 if (is_client_associated_to_ap(padapter)) {
5144                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5145
5146                         issue_nulldata(padapter, NULL, 1, 3, 500);
5147
5148                         bdelayscan = true;
5149                 }
5150                 if (bdelayscan) {
5151                         /* delay 50ms to protect nulldata(1). */
5152                         set_survey_timer(pmlmeext, 50);
5153                         return H2C_SUCCESS;
5154                 }
5155         }
5156
5157         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5158                 /* disable dynamic functions, such as high power, DIG */
5159                 Save_DM_Func_Flag(padapter);
5160                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5161
5162                 /* config the initial gain under scanning, need to write the BB registers */
5163                 initialgain = 0x1E;
5164
5165                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5166
5167                 /* set MSR to no link state */
5168                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5169
5170                 val8 = 1; /* under site survey */
5171                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5172
5173                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5174         }
5175
5176         site_survey(padapter);
5177
5178         return H2C_SUCCESS;
5179 }
5180
5181 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5182 {
5183         struct setauth_parm *pparm = (struct setauth_parm *)pbuf;
5184         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5185         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
5186
5187         if (pparm->mode < 4)
5188                 pmlmeinfo->auth_algo = pparm->mode;
5189         return H2C_SUCCESS;
5190 }
5191
5192 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5193 {
5194         unsigned short ctrl;
5195         struct setkey_parm *pparm = (struct setkey_parm *)pbuf;
5196         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5197         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
5198         u8 null_sta[ETH_ALEN] = {};
5199
5200         /* main tx key for wep. */
5201         if (pparm->set_tx)
5202                 pmlmeinfo->key_index = pparm->keyid;
5203
5204         /* write cam */
5205         ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5206
5207         DBG_88E_LEVEL(_drv_info_, "set group key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) "
5208                         "keyid:%d\n", pparm->algorithm, pparm->keyid);
5209         write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
5210
5211         return H2C_SUCCESS;
5212 }
5213
5214 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5215 {
5216         u16 ctrl = 0;
5217         u8 cam_id;/* cam_entry */
5218         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5219         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
5220         struct set_stakey_parm *pparm = (struct set_stakey_parm *)pbuf;
5221
5222         /* cam_entry: */
5223         /* 0~3 for default key */
5224
5225         /* for concurrent mode (ap+sta): */
5226         /* default key is disable, using sw encrypt/decrypt */
5227         /* cam_entry = 4 for sta mode (macid = 0) */
5228         /* cam_entry(macid+3) = 5 ~ N for ap mode (aid = 1~N, macid = 2 ~N) */
5229
5230         /* for concurrent mode (sta+sta): */
5231         /* default key is disable, using sw encrypt/decrypt */
5232         /* cam_entry = 4 mapping to macid = 0 */
5233         /* cam_entry = 5 mapping to macid = 2 */
5234
5235         cam_id = 4;
5236
5237         DBG_88E_LEVEL(_drv_info_, "set pairwise key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) camid:%d\n",
5238                       pparm->algorithm, cam_id);
5239         if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) {
5240                 struct sta_info *psta;
5241                 struct sta_priv *pstapriv = &padapter->stapriv;
5242
5243                 if (pparm->algorithm == _NO_PRIVACY_)   /*  clear cam entry */ {
5244                         clear_cam_entry(padapter, pparm->id);
5245                         return H2C_SUCCESS_RSP;
5246                 }
5247
5248                 psta = rtw_get_stainfo(pstapriv, pparm->addr);
5249                 if (psta) {
5250                         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5251
5252                         DBG_88E("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
5253
5254                         if ((psta->mac_id < 1) || (psta->mac_id > (NUM_STA - 4))) {
5255                                 DBG_88E("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
5256                                 return H2C_REJECTED;
5257                         }
5258
5259                         cam_id = psta->mac_id + 3;/* 0~3 for default key, cmd_id = macid + 3, macid = aid+1; */
5260
5261                         DBG_88E("Write CAM, mac_addr =%pM, cam_entry=%d\n",
5262                                 pparm->addr, cam_id);
5263
5264                         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5265
5266                         return H2C_SUCCESS_RSP;
5267                 }
5268
5269                 DBG_88E("r871x_set_stakey_hdl(): sta has been free\n");
5270                 return H2C_REJECTED;
5271         }
5272
5273         /* below for sta mode */
5274
5275         if (pparm->algorithm == _NO_PRIVACY_) { /*  clear cam entry */
5276                 clear_cam_entry(padapter, pparm->id);
5277                 return H2C_SUCCESS;
5278         }
5279         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5280         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5281         pmlmeinfo->enc_algo = pparm->algorithm;
5282         return H2C_SUCCESS;
5283 }
5284
5285 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5286 {
5287         struct addBaReq_parm *pparm = (struct addBaReq_parm *)pbuf;
5288         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5289         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
5290         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5291
5292         if (!psta)
5293                 return H2C_SUCCESS;
5294
5295         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5296             ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)) {
5297                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5298                 mod_timer(&psta->addba_retry_timer,
5299                           jiffies + msecs_to_jiffies(ADDBA_TO));
5300         } else {
5301                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5302         }
5303         return H2C_SUCCESS;
5304 }
5305
5306 u8 set_tx_beacon_cmd(struct adapter *padapter)
5307 {
5308         struct cmd_obj *ph2c;
5309         struct wlan_bssid_ex *ptxBeacon_parm;
5310         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
5311         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5312         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
5313         u8 res;
5314         int len_diff = 0;
5315
5316         ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
5317         if (!ph2c) {
5318                 res = _FAIL;
5319                 goto exit;
5320         }
5321
5322         ptxBeacon_parm = kmemdup(&pmlmeinfo->network,
5323                                  sizeof(struct wlan_bssid_ex), GFP_ATOMIC);
5324         if (!ptxBeacon_parm) {
5325                 kfree(ph2c);
5326                 res = _FAIL;
5327                 goto exit;
5328         }
5329
5330         len_diff = update_hidden_ssid(ptxBeacon_parm->ies + _BEACON_IE_OFFSET_,
5331                                       ptxBeacon_parm->ie_length - _BEACON_IE_OFFSET_,
5332                                       pmlmeinfo->hidden_ssid_mode);
5333         ptxBeacon_parm->ie_length += len_diff;
5334
5335         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, _TX_Beacon_CMD_);
5336
5337         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5338
5339 exit:
5340         return res;
5341 }
5342
5343 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5344 {
5345         u8 evt_code;
5346         u16 evt_sz;
5347         uint *peventbuf;
5348         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5349
5350         peventbuf = (uint *)pbuf;
5351         evt_sz = (u16)(*peventbuf & 0xffff);
5352         evt_code = (u8)((*peventbuf >> 16) & 0xff);
5353
5354         /*  checking if event code is valid */
5355         if (evt_code >= MAX_C2HEVT) {
5356                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
5357                 goto _abort_event_;
5358         }
5359
5360         /*  checking if event size match the event parm size */
5361         if ((wlanevents[evt_code].parmsize != 0) &&
5362             (wlanevents[evt_code].parmsize != evt_sz)) {
5363                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_,
5364                          ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
5365                          evt_code, wlanevents[evt_code].parmsize, evt_sz));
5366                 goto _abort_event_;
5367         }
5368
5369         peventbuf += 2;
5370
5371         if (peventbuf) {
5372                 event_callback = wlanevents[evt_code].event_callback;
5373                 event_callback(padapter, (u8 *)peventbuf);
5374         }
5375
5376 _abort_event_:
5377         return H2C_SUCCESS;
5378 }
5379
5380 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5381 {
5382         if (send_beacon(padapter) == _FAIL) {
5383                 DBG_88E("issue_beacon, fail!\n");
5384                 return H2C_PARAMETERS_ERROR;
5385         }
5386 #ifdef CONFIG_88EU_AP_MODE
5387         else { /* tx bc/mc frames after update TIM */
5388                 struct sta_info *psta_bmc;
5389                 struct list_head *xmitframe_plist, *xmitframe_phead;
5390                 struct xmit_frame *pxmitframe = NULL;
5391                 struct sta_priv *pstapriv = &padapter->stapriv;
5392
5393                 /* for BC/MC Frames */
5394                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
5395                 if (!psta_bmc)
5396                         return H2C_SUCCESS;
5397
5398                 if ((pstapriv->tim_bitmap & BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5399                         msleep(10);/*  10ms, ATIM(HIQ) Windows */
5400                         spin_lock_bh(&psta_bmc->sleep_q.lock);
5401
5402                         xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5403                         xmitframe_plist = xmitframe_phead->next;
5404
5405                         while (xmitframe_phead != xmitframe_plist) {
5406                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
5407
5408                                 xmitframe_plist = xmitframe_plist->next;
5409
5410                                 list_del_init(&pxmitframe->list);
5411
5412                                 psta_bmc->sleepq_len--;
5413                                 if (psta_bmc->sleepq_len > 0)
5414                                         pxmitframe->attrib.mdata = 1;
5415                                 else
5416                                         pxmitframe->attrib.mdata = 0;
5417
5418                                 pxmitframe->attrib.triggered = 1;
5419
5420                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5421
5422                                 spin_unlock_bh(&psta_bmc->sleep_q.lock);
5423                                 if (rtw_hal_xmit(padapter, pxmitframe))
5424                                         rtw_os_xmit_complete(padapter, pxmitframe);
5425                                 spin_lock_bh(&psta_bmc->sleep_q.lock);
5426                         }
5427                         spin_unlock_bh(&psta_bmc->sleep_q.lock);
5428                 }
5429         }
5430 #endif
5431         return H2C_SUCCESS;
5432 }
5433
5434 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5435 {
5436         struct set_ch_parm *set_ch_parm;
5437         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5438
5439         if (!pbuf)
5440                 return H2C_PARAMETERS_ERROR;
5441
5442         set_ch_parm = (struct set_ch_parm *)pbuf;
5443
5444         DBG_88E(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
5445                 FUNC_NDEV_ARG(padapter->pnetdev),
5446                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
5447
5448         pmlmeext->cur_channel = set_ch_parm->ch;
5449         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5450         pmlmeext->cur_bwmode = set_ch_parm->bw;
5451
5452         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5453
5454         return H2C_SUCCESS;
5455 }
5456
5457 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5458 {
5459         struct SetChannelPlan_param *setChannelPlan_param;
5460         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5461
5462         if (!pbuf)
5463                 return H2C_PARAMETERS_ERROR;
5464
5465         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5466
5467         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5468         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5469
5470         return H2C_SUCCESS;
5471 }