drivers/staging/rtl8188eu/core/rtw_mlme_ext.c

   1 /******************************************************************************
   2  *
   3  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  ******************************************************************************/
  15 #define _RTW_MLME_EXT_C_
  16
  17 #include <linux/ieee80211.h>
  18 #include <asm/unaligned.h>
  19
  20 #include <osdep_service.h>
  21 #include <drv_types.h>
  22 #include <wifi.h>
  23 #include <rtw_mlme_ext.h>
  24 #include <wlan_bssdef.h>
  25 #include <mlme_osdep.h>
  26 #include <recv_osdep.h>
  27
  28 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  29
  30 /**************************************************
  31 OUI definitions for the vendor specific IE
  32 ***************************************************/
  33 unsigned char   RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  34 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  35 unsigned char   WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  36 unsigned char   P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  37 unsigned char   WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  38
  39 unsigned char   WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  40 unsigned char   WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  41
  42 unsigned char WPA_TKIP_CIPHER[4] = {0x00, 0x50, 0xf2, 0x02};
  43 unsigned char RSN_TKIP_CIPHER[4] = {0x00, 0x0f, 0xac, 0x02};
  44
  45 extern unsigned char REALTEK_96B_IE[];
  46
  47 /********************************************************
  48 MCS rate definitions
  49 *********************************************************/
  50 unsigned char   MCS_rate_2R[16] = {0xff, 0xff, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  51 unsigned char   MCS_rate_1R[16] = {0xff, 0x00, 0x0, 0x0, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
  52
  53 /********************************************************
  54 ChannelPlan definitions
  55 *********************************************************/
  56 static struct rt_channel_plan_2g RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  57         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  58         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  59         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  60         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  61         {{10, 11, 12, 13}, 4},                                  /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  62         {{}, 0},                                                                        /*  0x05, RT_CHANNEL_DOMAIN_2G_NULL */
  63 };
  64
  65 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  66         /*  0x00 ~ 0x1F , Old Define ===== */
  67         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  68         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  69         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  70         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  71         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  72         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  73         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  74         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  75         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  76         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  77         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  78         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  79         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  80         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  81         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  82         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  83         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
  84         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
  85         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  86         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
  87         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
  88         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
  89         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
  90         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
  91         {0x05}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
  92         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
  93         {0x00}, /* 0x1A, */
  94         {0x00}, /* 0x1B, */
  95         {0x00}, /* 0x1C, */
  96         {0x00}, /* 0x1D, */
  97         {0x00}, /* 0x1E, */
  98         {0x05}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
  99         /*  0x20 ~ 0x7F , New Define ===== */
 100         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 101         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 102         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 103         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 104         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 105         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 106         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 107         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 108         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 109         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 110         {0x00}, /* 0x2A, */
 111         {0x00}, /* 0x2B, */
 112         {0x00}, /* 0x2C, */
 113         {0x00}, /* 0x2D, */
 114         {0x00}, /* 0x2E, */
 115         {0x00}, /* 0x2F, */
 116         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 117         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 118         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 119         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 120         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 121         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 122         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 123         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 124         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 125         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 126         {0x00}, /* 0x3A, */
 127         {0x00}, /* 0x3B, */
 128         {0x00}, /* 0x3C, */
 129         {0x00}, /* 0x3D, */
 130         {0x00}, /* 0x3E, */
 131         {0x00}, /* 0x3F, */
 132         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 133         {0x03}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G */
 134 };
 135
 136 static struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03}; /* use the combination for max channel numbers */
 137
 138 /*
 139  * Search the @param channel_num in given @param channel_set
 140  * @ch_set: the given channel set
 141  * @ch: the given channel number
 142  *
 143  * return the index of channel_num in channel_set, -1 if not found
 144  */
 145 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 146 {
 147         int i;
 148         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 149                 if (ch == ch_set[i].ChannelNum)
 150                         break;
 151         }
 152
 153         if (i >= ch_set[i].ChannelNum)
 154                 return -1;
 155         return i;
 156 }
 157
 158 struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
 159 {
 160         struct xmit_frame                       *pmgntframe;
 161         struct xmit_buf                         *pxmitbuf;
 162
 163         pmgntframe = rtw_alloc_xmitframe(pxmitpriv);
 164         if (pmgntframe == NULL) {
 165                 DBG_88E("%s, alloc xmitframe fail\n", __func__);
 166                 return NULL;
 167         }
 168
 169         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
 170         if (pxmitbuf == NULL) {
 171                 DBG_88E("%s, alloc xmitbuf fail\n", __func__);
 172                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
 173                 return NULL;
 174         }
 175         pmgntframe->frame_tag = MGNT_FRAMETAG;
 176         pmgntframe->pxmitbuf = pxmitbuf;
 177         pmgntframe->buf_addr = pxmitbuf->pbuf;
 178         pxmitbuf->priv_data = pmgntframe;
 179         return pmgntframe;
 180 }
 181
 182 /****************************************************************************
 183
 184 Following are some TX functions for WiFi MLME
 185
 186 *****************************************************************************/
 187
 188 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
 189 {
 190         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 191
 192         pmlmeext->tx_rate = rate;
 193         DBG_88E("%s(): rate = %x\n", __func__, rate);
 194 }
 195
 196 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
 197 {
 198         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 199
 200         memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib));
 201
 202         pattrib->hdrlen = 24;
 203         pattrib->nr_frags = 1;
 204         pattrib->priority = 7;
 205         pattrib->mac_id = 0;
 206         pattrib->qsel = 0x12;
 207
 208         pattrib->pktlen = 0;
 209
 210         if (pmlmeext->cur_wireless_mode & WIRELESS_11B)
 211                 pattrib->raid = 6;/* b mode */
 212         else
 213                 pattrib->raid = 5;/* a/g mode */
 214
 215         pattrib->encrypt = _NO_PRIVACY_;
 216         pattrib->bswenc = false;
 217
 218         pattrib->qos_en = false;
 219         pattrib->ht_en = false;
 220         pattrib->bwmode = HT_CHANNEL_WIDTH_20;
 221         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 222         pattrib->sgi = false;
 223
 224         pattrib->seqnum = pmlmeext->mgnt_seq;
 225
 226         pattrib->retry_ctrl = true;
 227 }
 228
 229 static void dump_mgntframe(struct adapter *padapter,
 230                            struct xmit_frame *pmgntframe)
 231 {
 232         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 233                 return;
 234
 235         rtw_hal_mgnt_xmit(padapter, pmgntframe);
 236 }
 237
 238 static s32 dump_mgntframe_and_wait(struct adapter *padapter,
 239                                    struct xmit_frame *pmgntframe,
 240                                    int timeout_ms)
 241 {
 242         s32 ret = _FAIL;
 243         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
 244         struct submit_ctx sctx;
 245
 246         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 247                 return ret;
 248
 249         rtw_sctx_init(&sctx, timeout_ms);
 250         pxmitbuf->sctx = &sctx;
 251
 252         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
 253
 254         if (ret == _SUCCESS)
 255                 ret = rtw_sctx_wait(&sctx);
 256
 257         return ret;
 258 }
 259
 260 static s32 dump_mgntframe_and_wait_ack(struct adapter *padapter,
 261                                        struct xmit_frame *pmgntframe)
 262 {
 263         s32 ret = _FAIL;
 264         u32 timeout_ms = 500;/*   500ms */
 265         struct xmit_priv        *pxmitpriv = &padapter->xmitpriv;
 266
 267         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
 268                 return -1;
 269
 270         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex))
 271                 return _FAIL;
 272         pxmitpriv->ack_tx = true;
 273
 274         pmgntframe->ack_report = 1;
 275         if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS) {
 276                 ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
 277         }
 278
 279         pxmitpriv->ack_tx = false;
 280         mutex_unlock(&pxmitpriv->ack_tx_mutex);
 281
 282         return ret;
 283 }
 284
 285 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
 286 {
 287         u8 *ssid_ie;
 288         int ssid_len_ori;
 289         int len_diff = 0;
 290
 291         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
 292
 293         if (ssid_ie && ssid_len_ori > 0) {
 294                 switch (hidden_ssid_mode) {
 295                 case 1: {
 296                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
 297                         u32 remain_len = 0;
 298
 299                         remain_len = ies_len - (next_ie - ies);
 300
 301                         ssid_ie[1] = 0;
 302                         memcpy(ssid_ie+2, next_ie, remain_len);
 303                         len_diff -= ssid_len_ori;
 304
 305                         break;
 306                 }
 307                 case 2:
 308                         memset(&ssid_ie[2], 0, ssid_len_ori);
 309                         break;
 310                 default:
 311                         break;
 312                 }
 313         }
 314
 315         return len_diff;
 316 }
 317
 318 static void issue_beacon(struct adapter *padapter, int timeout_ms)
 319 {
 320         struct xmit_frame       *pmgntframe;
 321         struct pkt_attrib       *pattrib;
 322         unsigned char   *pframe;
 323         struct ieee80211_hdr *pwlanhdr;
 324         __le16 *fctrl;
 325         unsigned int    rate_len;
 326         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 327         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 328         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 329         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 330         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 331         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 332
 333         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 334         if (pmgntframe == NULL) {
 335                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 336                 return;
 337         }
 338 #if defined(CONFIG_88EU_AP_MODE)
 339         spin_lock_bh(&pmlmepriv->bcn_update_lock);
 340 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 341
 342         /* update attribute */
 343         pattrib = &pmgntframe->attrib;
 344         update_mgntframe_attrib(padapter, pattrib);
 345         pattrib->qsel = 0x10;
 346
 347         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 348
 349         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 350         pwlanhdr = (struct ieee80211_hdr *)pframe;
 351
 352
 353         fctrl = &pwlanhdr->frame_control;
 354         *(fctrl) = 0;
 355
 356         ether_addr_copy(pwlanhdr->addr1, bc_addr);
 357         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
 358         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
 359
 360         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
 361         /* pmlmeext->mgnt_seq++; */
 362         SetFrameSubType(pframe, WIFI_BEACON);
 363
 364         pframe += sizeof(struct ieee80211_hdr_3addr);
 365         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 366
 367         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 368                 int len_diff;
 369                 u8 *wps_ie;
 370                 uint wps_ielen;
 371                 u8 sr = 0;
 372                 memcpy(pframe, cur_network->IEs, cur_network->IELength);
 373                 len_diff = update_hidden_ssid(
 374                         pframe+_BEACON_IE_OFFSET_
 375                         , cur_network->IELength-_BEACON_IE_OFFSET_
 376                         , pmlmeinfo->hidden_ssid_mode
 377                         );
 378                 pframe += (cur_network->IELength+len_diff);
 379                 pattrib->pktlen += (cur_network->IELength+len_diff);
 380                 wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
 381                         pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
 382                 if (wps_ie && wps_ielen > 0)
 383                         rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
 384                 if (sr != 0)
 385                         set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
 386                 else
 387                         _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
 388
 389                 goto _issue_bcn;
 390         }
 391
 392         /* below for ad-hoc mode */
 393
 394         /* timestamp will be inserted by hardware */
 395         pframe += 8;
 396         pattrib->pktlen += 8;
 397
 398         /*  beacon interval: 2 bytes */
 399
 400         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 401
 402         pframe += 2;
 403         pattrib->pktlen += 2;
 404
 405         /*  capability info: 2 bytes */
 406
 407         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 408
 409         pframe += 2;
 410         pattrib->pktlen += 2;
 411
 412         /*  SSID */
 413         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 414
 415         /*  supported rates... */
 416         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 417         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 418
 419         /*  DS parameter set */
 420         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 421
 422         {
 423                 u8 erpinfo = 0;
 424                 u32 ATIMWindow;
 425                 /*  IBSS Parameter Set... */
 426                 ATIMWindow = 0;
 427                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 428
 429                 /* ERP IE */
 430                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 431         }
 432
 433         /*  EXTERNDED SUPPORTED RATE */
 434         if (rate_len > 8)
 435                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 436         /* todo:HT for adhoc */
 437 _issue_bcn:
 438
 439 #if defined(CONFIG_88EU_AP_MODE)
 440         pmlmepriv->update_bcn = false;
 441
 442         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
 443 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 444
 445         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
 446                 DBG_88E("beacon frame too large\n");
 447                 return;
 448         }
 449
 450         pattrib->last_txcmdsz = pattrib->pktlen;
 451
 452         /* DBG_88E("issue bcn_sz=%d\n", pattrib->last_txcmdsz); */
 453         if (timeout_ms > 0)
 454                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
 455         else
 456                 dump_mgntframe(padapter, pmgntframe);
 457 }
 458
 459 static void issue_probersp(struct adapter *padapter, unsigned char *da)
 460 {
 461         struct xmit_frame                       *pmgntframe;
 462         struct pkt_attrib                       *pattrib;
 463         unsigned char                                   *pframe;
 464         struct ieee80211_hdr *pwlanhdr;
 465         __le16 *fctrl;
 466         unsigned char                                   *mac, *bssid;
 467         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
 468 #if defined(CONFIG_88EU_AP_MODE)
 469         u8 *pwps_ie;
 470         uint wps_ielen;
 471         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 472 #endif /* if defined (CONFIG_88EU_AP_MODE) */
 473         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 474         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 475         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
 476         unsigned int    rate_len;
 477
 478         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 479         if (pmgntframe == NULL) {
 480                 DBG_88E("%s, alloc mgnt frame fail\n", __func__);
 481                 return;
 482         }
 483
 484         /* update attribute */
 485         pattrib = &pmgntframe->attrib;
 486         update_mgntframe_attrib(padapter, pattrib);
 487
 488         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 489
 490         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 491         pwlanhdr = (struct ieee80211_hdr *)pframe;
 492
 493         mac = myid(&(padapter->eeprompriv));
 494         bssid = cur_network->MacAddress;
 495
 496         fctrl = &pwlanhdr->frame_control;
 497         *(fctrl) = 0;
 498         ether_addr_copy(pwlanhdr->addr1, da);
 499         ether_addr_copy(pwlanhdr->addr2, mac);
 500         ether_addr_copy(pwlanhdr->addr3, bssid);
 501
 502         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 503         pmlmeext->mgnt_seq++;
 504         SetFrameSubType(fctrl, WIFI_PROBERSP);
 505
 506         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 507         pattrib->pktlen = pattrib->hdrlen;
 508         pframe += pattrib->hdrlen;
 509
 510         if (cur_network->IELength > MAX_IE_SZ)
 511                 return;
 512
 513 #if defined(CONFIG_88EU_AP_MODE)
 514         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
 515                 pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
 516
 517                 /* inerset & update wps_probe_resp_ie */
 518                 if ((pmlmepriv->wps_probe_resp_ie != NULL) && pwps_ie && (wps_ielen > 0)) {
 519                         uint wps_offset, remainder_ielen;
 520                         u8 *premainder_ie;
 521
 522                         wps_offset = (uint)(pwps_ie - cur_network->IEs);
 523
 524                         premainder_ie = pwps_ie + wps_ielen;
 525
 526                         remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
 527
 528                         memcpy(pframe, cur_network->IEs, wps_offset);
 529                         pframe += wps_offset;
 530                         pattrib->pktlen += wps_offset;
 531
 532                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
 533                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
 534                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
 535                                 pframe += wps_ielen+2;
 536                                 pattrib->pktlen += wps_ielen+2;
 537                         }
 538
 539                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
 540                                 memcpy(pframe, premainder_ie, remainder_ielen);
 541                                 pframe += remainder_ielen;
 542                                 pattrib->pktlen += remainder_ielen;
 543                         }
 544                 } else {
 545                         memcpy(pframe, cur_network->IEs, cur_network->IELength);
 546                         pframe += cur_network->IELength;
 547                         pattrib->pktlen += cur_network->IELength;
 548                 }
 549         } else
 550 #endif
 551         {
 552                 /* timestamp will be inserted by hardware */
 553                 pframe += 8;
 554                 pattrib->pktlen += 8;
 555
 556                 /*  beacon interval: 2 bytes */
 557
 558                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
 559
 560                 pframe += 2;
 561                 pattrib->pktlen += 2;
 562
 563                 /*  capability info: 2 bytes */
 564
 565                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
 566
 567                 pframe += 2;
 568                 pattrib->pktlen += 2;
 569
 570                 /* below for ad-hoc mode */
 571
 572                 /*  SSID */
 573                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
 574
 575                 /*  supported rates... */
 576                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
 577                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, min_t(unsigned int, rate_len, 8), cur_network->SupportedRates, &pattrib->pktlen);
 578
 579                 /*  DS parameter set */
 580                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
 581
 582                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 583                         u8 erpinfo = 0;
 584                         u32 ATIMWindow;
 585                         /*  IBSS Parameter Set... */
 586                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
 587                         ATIMWindow = 0;
 588                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
 589
 590                         /* ERP IE */
 591                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
 592                 }
 593
 594
 595                 /*  EXTERNDED SUPPORTED RATE */
 596                 if (rate_len > 8)
 597                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
 598                 /* todo:HT for adhoc */
 599         }
 600
 601         pattrib->last_txcmdsz = pattrib->pktlen;
 602
 603         dump_mgntframe(padapter, pmgntframe);
 604 }
 605
 606 static int issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, bool wait_ack)
 607 {
 608         int ret = _FAIL;
 609         struct xmit_frame               *pmgntframe;
 610         struct pkt_attrib               *pattrib;
 611         unsigned char                   *pframe;
 612         struct ieee80211_hdr *pwlanhdr;
 613         __le16 *fctrl;
 614         unsigned char                   *mac;
 615         unsigned char                   bssrate[NumRates];
 616         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
 617         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 618         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 619         int     bssrate_len = 0;
 620         u8      bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 621
 622         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+issue_probereq\n"));
 623
 624         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 625         if (pmgntframe == NULL)
 626                 goto exit;
 627
 628         /* update attribute */
 629         pattrib = &pmgntframe->attrib;
 630         update_mgntframe_attrib(padapter, pattrib);
 631
 632
 633         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 634
 635         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 636         pwlanhdr = (struct ieee80211_hdr *)pframe;
 637
 638         mac = myid(&(padapter->eeprompriv));
 639
 640         fctrl = &pwlanhdr->frame_control;
 641         *(fctrl) = 0;
 642
 643         if (da) {
 644                 /*      unicast probe request frame */
 645                 ether_addr_copy(pwlanhdr->addr1, da);
 646                 ether_addr_copy(pwlanhdr->addr3, da);
 647         } else {
 648                 /*      broadcast probe request frame */
 649                 ether_addr_copy(pwlanhdr->addr1, bc_addr);
 650                 ether_addr_copy(pwlanhdr->addr3, bc_addr);
 651         }
 652
 653         ether_addr_copy(pwlanhdr->addr2, mac);
 654
 655         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 656         pmlmeext->mgnt_seq++;
 657         SetFrameSubType(pframe, WIFI_PROBEREQ);
 658
 659         pframe += sizeof(struct ieee80211_hdr_3addr);
 660         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 661
 662         if (pssid)
 663                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
 664         else
 665                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
 666
 667         get_rate_set(padapter, bssrate, &bssrate_len);
 668
 669         if (bssrate_len > 8) {
 670                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
 671                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
 672         } else {
 673                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
 674         }
 675
 676         /* add wps_ie for wps2.0 */
 677         if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
 678                 memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
 679                 pframe += pmlmepriv->wps_probe_req_ie_len;
 680                 pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
 681         }
 682
 683         pattrib->last_txcmdsz = pattrib->pktlen;
 684
 685         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
 686                  ("issuing probe_req, tx_len=%d\n", pattrib->last_txcmdsz));
 687
 688         if (wait_ack) {
 689                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
 690         } else {
 691                 dump_mgntframe(padapter, pmgntframe);
 692                 ret = _SUCCESS;
 693         }
 694
 695 exit:
 696         return ret;
 697 }
 698
 699 static int issue_probereq_ex(struct adapter *padapter,
 700                              struct ndis_802_11_ssid *pssid, u8 *da,
 701                              int try_cnt, int wait_ms)
 702 {
 703         int ret;
 704         int i = 0;
 705         unsigned long start = jiffies;
 706
 707         do {
 708                 ret = issue_probereq(padapter, pssid, da, wait_ms > 0 ? true : false);
 709
 710                 i++;
 711
 712                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
 713                         break;
 714
 715                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
 716                         msleep(wait_ms);
 717
 718         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
 719
 720         if (ret != _FAIL) {
 721                 ret = _SUCCESS;
 722                 goto exit;
 723         }
 724
 725         if (try_cnt && wait_ms) {
 726                 if (da)
 727                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
 728                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
 729                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 730                                 jiffies_to_msecs(jiffies - start));
 731                 else
 732                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
 733                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
 734                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
 735                                 jiffies_to_msecs(jiffies - start));
 736         }
 737 exit:
 738         return ret;
 739 }
 740
 741 /*  if psta == NULL, indicate we are station(client) now... */
 742 static void issue_auth(struct adapter *padapter, struct sta_info *psta,
 743                        unsigned short status)
 744 {
 745         struct xmit_frame *pmgntframe;
 746         struct pkt_attrib *pattrib;
 747         unsigned char *pframe;
 748         struct ieee80211_hdr *pwlanhdr;
 749         __le16 *fctrl;
 750         unsigned int val32;
 751         u16 val16;
 752 #ifdef CONFIG_88EU_AP_MODE
 753         __le16 le_val16;
 754 #endif
 755         int use_shared_key = 0;
 756         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 757         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
 758         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 759         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
 760
 761         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 762         if (pmgntframe == NULL)
 763                 return;
 764
 765         /* update attribute */
 766         pattrib = &pmgntframe->attrib;
 767         update_mgntframe_attrib(padapter, pattrib);
 768
 769         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 770
 771         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 772         pwlanhdr = (struct ieee80211_hdr *)pframe;
 773
 774         fctrl = &pwlanhdr->frame_control;
 775         *(fctrl) = 0;
 776
 777         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 778         pmlmeext->mgnt_seq++;
 779         SetFrameSubType(pframe, WIFI_AUTH);
 780
 781         pframe += sizeof(struct ieee80211_hdr_3addr);
 782         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
 783
 784
 785         if (psta) {/*  for AP mode */
 786 #ifdef CONFIG_88EU_AP_MODE
 787
 788                 ether_addr_copy(pwlanhdr->addr1, psta->hwaddr);
 789                 ether_addr_copy(pwlanhdr->addr2,
 790                                 myid(&(padapter->eeprompriv)));
 791                 ether_addr_copy(pwlanhdr->addr3,
 792                                 myid(&(padapter->eeprompriv)));
 793
 794
 795                 /*  setting auth algo number */
 796                 val16 = (u16)psta->authalg;
 797
 798                 if (status != _STATS_SUCCESSFUL_)
 799                         val16 = 0;
 800
 801                 if (val16) {
 802                         le_val16 = cpu_to_le16(val16);
 803                         use_shared_key = 1;
 804                 } else {
 805                         le_val16 = 0;
 806                 }
 807
 808                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_val16,
 809                                           &pattrib->pktlen);
 810
 811                 /*  setting auth seq number */
 812                 val16 = (u16)psta->auth_seq;
 813                 le_val16 = cpu_to_le16(val16);
 814                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_val16,
 815                                           &pattrib->pktlen);
 816
 817                 /*  setting status code... */
 818                 val16 = status;
 819                 le_val16 = cpu_to_le16(val16);
 820                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_,
 821                                           &le_val16, &pattrib->pktlen);
 822
 823                 /*  added challenging text... */
 824                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
 825                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
 826 #endif
 827         } else {
 828                 __le32 le_tmp32;
 829                 __le16 le_tmp16;
 830                 ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
 831                 ether_addr_copy(pwlanhdr->addr2, myid(&padapter->eeprompriv));
 832                 ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
 833
 834                 /*  setting auth algo number */
 835                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
 836                 if (val16)
 837                         use_shared_key = 1;
 838
 839                 /* setting IV for auth seq #3 */
 840                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 841                         val32 = (pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30);
 842                         le_tmp32 = cpu_to_le32(val32);
 843                         pframe = rtw_set_fixed_ie(pframe, 4, &le_tmp32,
 844                                                   &pattrib->pktlen);
 845
 846                         pattrib->iv_len = 4;
 847                 }
 848
 849                 le_tmp16 = cpu_to_le16(val16);
 850                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, &le_tmp16,
 851                                           &pattrib->pktlen);
 852
 853                 /*  setting auth seq number */
 854                 val16 = pmlmeinfo->auth_seq;
 855                 le_tmp16 = cpu_to_le16(val16);
 856                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, &le_tmp16,
 857                                           &pattrib->pktlen);
 858
 859
 860                 /*  setting status code... */
 861                 le_tmp16 = cpu_to_le16(status);
 862                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &le_tmp16,
 863                                           &pattrib->pktlen);
 864
 865                 /*  then checking to see if sending challenging text... */
 866                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
 867                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
 868
 869                         SetPrivacy(fctrl);
 870
 871                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 872
 873                         pattrib->encrypt = _WEP40_;
 874
 875                         pattrib->icv_len = 4;
 876
 877                         pattrib->pktlen += pattrib->icv_len;
 878                 }
 879         }
 880
 881         pattrib->last_txcmdsz = pattrib->pktlen;
 882
 883         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
 884         DBG_88E("%s\n", __func__);
 885         dump_mgntframe(padapter, pmgntframe);
 886 }
 887
 888
 889 #ifdef CONFIG_88EU_AP_MODE
 890 static void issue_asocrsp(struct adapter *padapter, unsigned short status,
 891                           struct sta_info *pstat, int pkt_type)
 892 {
 893         struct xmit_frame       *pmgntframe;
 894         struct ieee80211_hdr *pwlanhdr;
 895         struct pkt_attrib *pattrib;
 896         unsigned char   *pbuf, *pframe;
 897         unsigned short val;
 898         __le16 *fctrl;
 899         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
 900         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
 901         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 902         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
 903         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
 904         u8 *ie = pnetwork->IEs;
 905         __le16 lestatus, leval;
 906
 907         DBG_88E("%s\n", __func__);
 908
 909         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
 910         if (pmgntframe == NULL)
 911                 return;
 912
 913         /* update attribute */
 914         pattrib = &pmgntframe->attrib;
 915         update_mgntframe_attrib(padapter, pattrib);
 916
 917
 918         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
 919
 920         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
 921         pwlanhdr = (struct ieee80211_hdr *)pframe;
 922
 923         fctrl = &pwlanhdr->frame_control;
 924         *(fctrl) = 0;
 925
 926         ether_addr_copy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr);
 927         ether_addr_copy((void *)GetAddr2Ptr(pwlanhdr),
 928                         myid(&(padapter->eeprompriv)));
 929         ether_addr_copy((void *)GetAddr3Ptr(pwlanhdr), pnetwork->MacAddress);
 930
 931
 932         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
 933         pmlmeext->mgnt_seq++;
 934         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
 935                 SetFrameSubType(pwlanhdr, pkt_type);
 936         else
 937                 return;
 938
 939         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
 940         pattrib->pktlen += pattrib->hdrlen;
 941         pframe += pattrib->hdrlen;
 942
 943         /* capability */
 944         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
 945
 946         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, &val, &pattrib->pktlen);
 947
 948         lestatus = cpu_to_le16(status);
 949         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, &lestatus,
 950                                   &pattrib->pktlen);
 951
 952         leval = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
 953         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, &leval, &pattrib->pktlen);
 954
 955         if (pstat->bssratelen <= 8) {
 956                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
 957         } else {
 958                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
 959                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
 960         }
 961
 962         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
 963                 uint ie_len = 0;
 964
 965                 /* FILL HT CAP INFO IE */
 966                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 967                 if (pbuf && ie_len > 0) {
 968                         memcpy(pframe, pbuf, ie_len+2);
 969                         pframe += (ie_len+2);
 970                         pattrib->pktlen += (ie_len+2);
 971                 }
 972
 973                 /* FILL HT ADD INFO IE */
 974                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
 975                 if (pbuf && ie_len > 0) {
 976                         memcpy(pframe, pbuf, ie_len+2);
 977                         pframe += (ie_len+2);
 978                         pattrib->pktlen += (ie_len+2);
 979                 }
 980         }
 981
 982         /* FILL WMM IE */
 983         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
 984                 uint ie_len = 0;
 985                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
 986
 987                 for (pbuf = ie + _BEACON_IE_OFFSET_;; pbuf += (ie_len + 2)) {
 988                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
 989                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
 990                                 memcpy(pframe, pbuf, ie_len+2);
 991                                 pframe += (ie_len+2);
 992                                 pattrib->pktlen += (ie_len+2);
 993                                 break;
 994                         }
 995
 996                         if ((pbuf == NULL) || (ie_len == 0))
 997                                 break;
 998                 }
 999         }
1000
1001         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1002                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
1003
1004         /* add WPS IE ie for wps 2.0 */
1005         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
1006                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
1007
1008                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
1009                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
1010         }
1011
1012         pattrib->last_txcmdsz = pattrib->pktlen;
1013         dump_mgntframe(padapter, pmgntframe);
1014 }
1015 #endif /* CONFIG_88EU_AP_MODE */
1016
1017 static void issue_assocreq(struct adapter *padapter)
1018 {
1019         int ret = _FAIL;
1020         struct xmit_frame       *pmgntframe;
1021         struct pkt_attrib       *pattrib;
1022         unsigned char           *pframe, *p;
1023         struct ieee80211_hdr *pwlanhdr;
1024         __le16 *fctrl;
1025         unsigned int    i, j, ie_len, index = 0;
1026         unsigned char   rf_type, bssrate[NumRates], sta_bssrate[NumRates];
1027         struct ndis_802_11_var_ie *pIE;
1028         struct registry_priv    *pregpriv = &padapter->registrypriv;
1029         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
1030         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
1031         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1032         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1033         int     bssrate_len = 0, sta_bssrate_len = 0;
1034         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1035
1036         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1037         if (pmgntframe == NULL)
1038                 goto exit;
1039
1040         /* update attribute */
1041         pattrib = &pmgntframe->attrib;
1042         update_mgntframe_attrib(padapter, pattrib);
1043
1044         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1045         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1046         pwlanhdr = (struct ieee80211_hdr *)pframe;
1047
1048         fctrl = &pwlanhdr->frame_control;
1049         *(fctrl) = 0;
1050         ether_addr_copy(pwlanhdr->addr1, pnetwork->MacAddress);
1051         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1052         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1053
1054         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1055         pmlmeext->mgnt_seq++;
1056         SetFrameSubType(pframe, WIFI_ASSOCREQ);
1057
1058         pframe += sizeof(struct ieee80211_hdr_3addr);
1059         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1060
1061         /* caps */
1062
1063         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
1064
1065         pframe += 2;
1066         pattrib->pktlen += 2;
1067
1068         /* listen interval */
1069         /* todo: listen interval for power saving */
1070         put_unaligned_le16(3, pframe);
1071         pframe += 2;
1072         pattrib->pktlen += 2;
1073
1074         /* SSID */
1075         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
1076
1077         /* supported rate & extended supported rate */
1078
1079         /*  Check if the AP's supported rates are also supported by STA. */
1080         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
1081
1082         if (pmlmeext->cur_channel == 14)/*  for JAPAN, channel 14 can only uses B Mode(CCK) */
1083                 sta_bssrate_len = 4;
1084
1085         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1086                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1087                         break;
1088                 DBG_88E("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
1089         }
1090
1091         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
1092                 if (pmlmeinfo->network.SupportedRates[i] == 0)
1093                         break;
1094
1095                 /*  Check if the AP's supported rates are also supported by STA. */
1096                 for (j = 0; j < sta_bssrate_len; j++) {
1097                         /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
1098                         if ((pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
1099                                         == (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK))
1100                                 break;
1101                 }
1102
1103                 if (j == sta_bssrate_len) {
1104                         /*  the rate is not supported by STA */
1105                         DBG_88E("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
1106                 } else {
1107                         /*  the rate is supported by STA */
1108                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
1109                 }
1110         }
1111
1112         bssrate_len = index;
1113         DBG_88E("bssrate_len=%d\n", bssrate_len);
1114
1115         if (bssrate_len == 0) {
1116                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
1117                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1118                 goto exit; /* don't connect to AP if no joint supported rate */
1119         }
1120
1121
1122         if (bssrate_len > 8) {
1123                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , 8, bssrate, &(pattrib->pktlen));
1124                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_ , (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
1125         } else {
1126                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_ , bssrate_len , bssrate, &(pattrib->pktlen));
1127         }
1128
1129         /* RSN */
1130         p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _RSN_IE_2_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1131         if (p != NULL)
1132                 pframe = rtw_set_ie(pframe, _RSN_IE_2_, ie_len, (p + 2), &(pattrib->pktlen));
1133
1134         /* HT caps */
1135         if (padapter->mlmepriv.htpriv.ht_option) {
1136                 p = rtw_get_ie((pmlmeinfo->network.IEs + sizeof(struct ndis_802_11_fixed_ie)), _HT_CAPABILITY_IE_, &ie_len, (pmlmeinfo->network.IELength - sizeof(struct ndis_802_11_fixed_ie)));
1137                 if ((p != NULL) && (!(is_ap_in_tkip(padapter)))) {
1138                         memcpy(&pmlmeinfo->HT_caps, p + 2, sizeof(struct ieee80211_ht_cap));
1139
1140                         /* to disable 40M Hz support while gd_bw_40MHz_en = 0 */
1141                         if (pregpriv->cbw40_enable == 0)
1142                                 pmlmeinfo->HT_caps.cap_info &= cpu_to_le16(~(BIT(6) | BIT(1)));
1143                         else
1144                                 pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(BIT(1));
1145
1146                         /* todo: disable SM power save mode */
1147                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x000c);
1148
1149                         rtw_hal_get_hwreg(padapter, HW_VAR_RF_TYPE, (u8 *)(&rf_type));
1150                         switch (rf_type) {
1151                         case RF_1T1R:
1152                                 if (pregpriv->rx_stbc)
1153                                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0100);/* RX STBC One spatial stream */
1154                                 memcpy((u8 *)&pmlmeinfo->HT_caps.mcs, MCS_rate_1R, 16);
1155                                 break;
1156                         case RF_2T2R:
1157                         case RF_1T2R:
1158                         default:
1159                                 if ((pregpriv->rx_stbc == 0x3) ||/* enable for 2.4/5 GHz */
1160                                     ((pmlmeext->cur_wireless_mode & WIRELESS_11_24N) && (pregpriv->rx_stbc == 0x1)) || /* enable for 2.4GHz */
1161                                     (pregpriv->wifi_spec == 1)) {
1162                                         DBG_88E("declare supporting RX STBC\n");
1163                                         pmlmeinfo->HT_caps.cap_info |= cpu_to_le16(0x0200);/* RX STBC two spatial stream */
1164                                 }
1165                                 memcpy(&pmlmeinfo->HT_caps.mcs, MCS_rate_2R, 16);
1166                                 break;
1167                         }
1168                         pframe = rtw_set_ie(pframe, _HT_CAPABILITY_IE_, ie_len , (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
1169                 }
1170         }
1171
1172         /* vendor specific IE, such as WPA, WMM, WPS */
1173         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pmlmeinfo->network.IELength; i += (pIE->Length + 2)) {
1174                 pIE = (struct ndis_802_11_var_ie *)(pmlmeinfo->network.IEs + i);
1175
1176                 switch (pIE->ElementID) {
1177                 case _VENDOR_SPECIFIC_IE_:
1178                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
1179                             (!memcmp(pIE->data, WMM_OUI, 4)) ||
1180                             (!memcmp(pIE->data, WPS_OUI, 4))) {
1181                                 if (!padapter->registrypriv.wifi_spec) {
1182                                         /* Commented by Kurt 20110629 */
1183                                         /* In some older APs, WPS handshake */
1184                                         /* would be fail if we append vender extensions informations to AP */
1185                                         if (!memcmp(pIE->data, WPS_OUI, 4))
1186                                                 pIE->Length = 14;
1187                                 }
1188                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, pIE->Length, pIE->data, &(pattrib->pktlen));
1189                         }
1190                         break;
1191                 default:
1192                         break;
1193                 }
1194         }
1195
1196         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
1197                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6 , REALTEK_96B_IE, &(pattrib->pktlen));
1198
1199         pattrib->last_txcmdsz = pattrib->pktlen;
1200         dump_mgntframe(padapter, pmgntframe);
1201
1202         ret = _SUCCESS;
1203
1204 exit:
1205         if (ret == _SUCCESS)
1206                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
1207         else
1208                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
1209 }
1210
1211 /* when wait_ack is true, this function should be called at process context */
1212 static int _issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int wait_ack)
1213 {
1214         int ret = _FAIL;
1215         struct xmit_frame                       *pmgntframe;
1216         struct pkt_attrib                       *pattrib;
1217         unsigned char                                   *pframe;
1218         struct ieee80211_hdr *pwlanhdr;
1219         __le16 *fctrl;
1220         struct xmit_priv        *pxmitpriv;
1221         struct mlme_ext_priv    *pmlmeext;
1222         struct mlme_ext_info    *pmlmeinfo;
1223         struct wlan_bssid_ex    *pnetwork;
1224
1225         if (!padapter)
1226                 goto exit;
1227
1228         pxmitpriv = &(padapter->xmitpriv);
1229         pmlmeext = &(padapter->mlmeextpriv);
1230         pmlmeinfo = &(pmlmeext->mlmext_info);
1231         pnetwork = &(pmlmeinfo->network);
1232
1233         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1234         if (pmgntframe == NULL)
1235                 goto exit;
1236
1237         /* update attribute */
1238         pattrib = &pmgntframe->attrib;
1239         update_mgntframe_attrib(padapter, pattrib);
1240         pattrib->retry_ctrl = false;
1241
1242         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1243
1244         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1245         pwlanhdr = (struct ieee80211_hdr *)pframe;
1246
1247         fctrl = &pwlanhdr->frame_control;
1248         *(fctrl) = 0;
1249
1250         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1251                 SetFrDs(fctrl);
1252         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1253                 SetToDs(fctrl);
1254
1255         if (power_mode)
1256                 SetPwrMgt(fctrl);
1257
1258         ether_addr_copy(pwlanhdr->addr1, da);
1259         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1260         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1261
1262         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1263         pmlmeext->mgnt_seq++;
1264         SetFrameSubType(pframe, WIFI_DATA_NULL);
1265
1266         pframe += sizeof(struct ieee80211_hdr_3addr);
1267         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1268
1269         pattrib->last_txcmdsz = pattrib->pktlen;
1270
1271         if (wait_ack) {
1272                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1273         } else {
1274                 dump_mgntframe(padapter, pmgntframe);
1275                 ret = _SUCCESS;
1276         }
1277
1278 exit:
1279         return ret;
1280 }
1281
1282
1283 /* when wait_ms > 0 , this function should be called at process context */
1284 /* da == NULL for station mode */
1285 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
1286 {
1287         int ret;
1288         int i = 0;
1289         unsigned long start = jiffies;
1290         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1291         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1292         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1293
1294         /* da == NULL, assume it's null data for sta to ap*/
1295         if (da == NULL)
1296                 da = pnetwork->MacAddress;
1297
1298         do {
1299                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0 ? true : false);
1300
1301                 i++;
1302
1303                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1304                         break;
1305
1306                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1307                         msleep(wait_ms);
1308         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1309
1310         if (ret != _FAIL) {
1311                 ret = _SUCCESS;
1312                 goto exit;
1313         }
1314
1315         if (try_cnt && wait_ms) {
1316                 if (da)
1317                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1318                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1319                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1320                                 jiffies_to_msecs(jiffies - start));
1321                 else
1322                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1323                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1324                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1325                                 jiffies_to_msecs(jiffies - start));
1326         }
1327 exit:
1328         return ret;
1329 }
1330
1331 /* when wait_ack is true, this function should be called at process context */
1332 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int wait_ack)
1333 {
1334         int ret = _FAIL;
1335         struct xmit_frame                       *pmgntframe;
1336         struct pkt_attrib                       *pattrib;
1337         unsigned char                                   *pframe;
1338         struct ieee80211_hdr *pwlanhdr;
1339         __le16 *fctrl;
1340         unsigned short *qc;
1341         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1342         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1343         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1344         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1345
1346         DBG_88E("%s\n", __func__);
1347
1348         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1349         if (pmgntframe == NULL)
1350                 goto exit;
1351
1352         /* update attribute */
1353         pattrib = &pmgntframe->attrib;
1354         update_mgntframe_attrib(padapter, pattrib);
1355
1356         pattrib->hdrlen += 2;
1357         pattrib->qos_en = true;
1358         pattrib->eosp = 1;
1359         pattrib->ack_policy = 0;
1360         pattrib->mdata = 0;
1361
1362         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1363
1364         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1365         pwlanhdr = (struct ieee80211_hdr *)pframe;
1366
1367         fctrl = &pwlanhdr->frame_control;
1368         *(fctrl) = 0;
1369
1370         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
1371                 SetFrDs(fctrl);
1372         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
1373                 SetToDs(fctrl);
1374
1375         if (pattrib->mdata)
1376                 SetMData(fctrl);
1377
1378         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
1379
1380         SetPriority(qc, tid);
1381
1382         SetEOSP(qc, pattrib->eosp);
1383
1384         SetAckpolicy(qc, pattrib->ack_policy);
1385
1386         ether_addr_copy(pwlanhdr->addr1, da);
1387         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1388         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1389
1390         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1391         pmlmeext->mgnt_seq++;
1392         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
1393
1394         pframe += sizeof(struct ieee80211_qos_hdr);
1395         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
1396
1397         pattrib->last_txcmdsz = pattrib->pktlen;
1398
1399         if (wait_ack) {
1400                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1401         } else {
1402                 dump_mgntframe(padapter, pmgntframe);
1403                 ret = _SUCCESS;
1404         }
1405
1406 exit:
1407         return ret;
1408 }
1409
1410 /* when wait_ms > 0 , this function should be called at process context */
1411 /* da == NULL for station mode */
1412 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
1413 {
1414         int ret;
1415         int i = 0;
1416         unsigned long start = jiffies;
1417         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1418         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1419         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1420
1421         /* da == NULL, assume it's null data for sta to ap*/
1422         if (da == NULL)
1423                 da = pnetwork->MacAddress;
1424
1425         do {
1426                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0 ? true : false);
1427
1428                 i++;
1429
1430                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1431                         break;
1432
1433                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1434                         msleep(wait_ms);
1435         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1436
1437         if (ret != _FAIL) {
1438                 ret = _SUCCESS;
1439                 goto exit;
1440         }
1441
1442         if (try_cnt && wait_ms) {
1443                 if (da)
1444                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1445                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1446                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1447                                 jiffies_to_msecs(jiffies - start));
1448                 else
1449                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1450                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1451                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1452                                 jiffies_to_msecs(jiffies - start));
1453         }
1454 exit:
1455         return ret;
1456 }
1457
1458 static int _issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason, u8 wait_ack)
1459 {
1460         struct xmit_frame                       *pmgntframe;
1461         struct pkt_attrib                       *pattrib;
1462         unsigned char                                   *pframe;
1463         struct ieee80211_hdr *pwlanhdr;
1464         __le16 *fctrl;
1465         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1466         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1467         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1468         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1469         int ret = _FAIL;
1470         __le16 le_tmp;
1471
1472         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1473         if (pmgntframe == NULL)
1474                 goto exit;
1475
1476         /* update attribute */
1477         pattrib = &pmgntframe->attrib;
1478         update_mgntframe_attrib(padapter, pattrib);
1479         pattrib->retry_ctrl = false;
1480
1481         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1482
1483         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1484         pwlanhdr = (struct ieee80211_hdr *)pframe;
1485
1486         fctrl = &pwlanhdr->frame_control;
1487         *(fctrl) = 0;
1488
1489         ether_addr_copy(pwlanhdr->addr1, da);
1490         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1491         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1492
1493         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1494         pmlmeext->mgnt_seq++;
1495         SetFrameSubType(pframe, WIFI_DEAUTH);
1496
1497         pframe += sizeof(struct ieee80211_hdr_3addr);
1498         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1499
1500         le_tmp = cpu_to_le16(reason);
1501         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, &le_tmp,
1502                                   &pattrib->pktlen);
1503
1504         pattrib->last_txcmdsz = pattrib->pktlen;
1505
1506
1507         if (wait_ack) {
1508                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
1509         } else {
1510                 dump_mgntframe(padapter, pmgntframe);
1511                 ret = _SUCCESS;
1512         }
1513
1514 exit:
1515         return ret;
1516 }
1517
1518 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
1519 {
1520         DBG_88E("%s to %pM\n", __func__, da);
1521         return _issue_deauth(padapter, da, reason, false);
1522 }
1523
1524 static int issue_deauth_ex(struct adapter *padapter, u8 *da,
1525                            unsigned short reason, int try_cnt,
1526                            int wait_ms)
1527 {
1528         int ret;
1529         int i = 0;
1530         unsigned long start = jiffies;
1531
1532         do {
1533                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0 ? true : false);
1534
1535                 i++;
1536
1537                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
1538                         break;
1539
1540                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
1541                         msleep(wait_ms);
1542         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
1543
1544         if (ret != _FAIL) {
1545                 ret = _SUCCESS;
1546                 goto exit;
1547         }
1548
1549         if (try_cnt && wait_ms) {
1550                 if (da)
1551                         DBG_88E(FUNC_ADPT_FMT" to %pM, ch:%u%s, %d/%d in %u ms\n",
1552                                 FUNC_ADPT_ARG(padapter), da, rtw_get_oper_ch(padapter),
1553                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1554                                 jiffies_to_msecs(jiffies - start));
1555                 else
1556                         DBG_88E(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
1557                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
1558                                 ret == _SUCCESS ? ", acked" : "", i, try_cnt,
1559                                 jiffies_to_msecs(jiffies - start));
1560         }
1561 exit:
1562         return ret;
1563 }
1564
1565 static void issue_action_BA(struct adapter *padapter, unsigned char *raddr,
1566                             unsigned char action, unsigned short status)
1567 {
1568         u8 category = RTW_WLAN_CATEGORY_BACK;
1569         u16 start_seq;
1570         u16 BA_para_set;
1571         u16 reason_code;
1572         u16 BA_timeout_value;
1573         __le16  le_tmp;
1574         u16 BA_starting_seqctrl = 0;
1575         enum ht_cap_ampdu_factor max_rx_ampdu_factor;
1576         struct xmit_frame *pmgntframe;
1577         struct pkt_attrib *pattrib;
1578         u8 *pframe;
1579         struct ieee80211_hdr *pwlanhdr;
1580         __le16 *fctrl;
1581         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
1582         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1583         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1584         struct sta_info *psta;
1585         struct sta_priv *pstapriv = &padapter->stapriv;
1586         struct registry_priv *pregpriv = &padapter->registrypriv;
1587         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
1588
1589         DBG_88E("%s, category=%d, action=%d, status=%d\n", __func__, category, action, status);
1590
1591         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1592         if (pmgntframe == NULL)
1593                 return;
1594
1595         /* update attribute */
1596         pattrib = &pmgntframe->attrib;
1597         update_mgntframe_attrib(padapter, pattrib);
1598
1599         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1600
1601         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1602         pwlanhdr = (struct ieee80211_hdr *)pframe;
1603
1604         fctrl = &pwlanhdr->frame_control;
1605         *(fctrl) = 0;
1606
1607         ether_addr_copy(pwlanhdr->addr1, raddr);
1608         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1609         ether_addr_copy(pwlanhdr->addr3, pnetwork->MacAddress);
1610
1611         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1612         pmlmeext->mgnt_seq++;
1613         SetFrameSubType(pframe, WIFI_ACTION);
1614
1615         pframe += sizeof(struct ieee80211_hdr_3addr);
1616         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1617
1618         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1619         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1620
1621         if (category == 3) {
1622                 switch (action) {
1623                 case 0: /* ADDBA req */
1624                         do {
1625                                 pmlmeinfo->dialogToken++;
1626                         } while (pmlmeinfo->dialogToken == 0);
1627                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
1628
1629                         BA_para_set = 0x1002 | ((status & 0xf) << 2); /* immediate ack & 64 buffer size */
1630                         le_tmp = cpu_to_le16(BA_para_set);
1631                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1632                                                   &pattrib->pktlen);
1633
1634                         BA_timeout_value = 5000;/*  5ms */
1635                         le_tmp = cpu_to_le16(BA_timeout_value);
1636                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1637                                                   &pattrib->pktlen);
1638
1639                         psta = rtw_get_stainfo(pstapriv, raddr);
1640                         if (psta != NULL) {
1641                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
1642
1643                                 DBG_88E("BA_starting_seqctrl=%d for TID=%d\n", start_seq, status & 0x07);
1644
1645                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
1646
1647                                 BA_starting_seqctrl = start_seq << 4;
1648                         }
1649                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
1650                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1651                                                   &pattrib->pktlen);
1652                         break;
1653                 case 1: /* ADDBA rsp */
1654                 {
1655                         struct ADDBA_request *ADDBA_req = &pmlmeinfo->ADDBA_req;
1656
1657                         pframe = rtw_set_fixed_ie(pframe, 1,
1658                                                   &ADDBA_req->dialog_token,
1659                                                   &pattrib->pktlen);
1660                         pframe = rtw_set_fixed_ie(pframe, 2, &status,
1661                                                   &pattrib->pktlen);
1662
1663                         BA_para_set = le16_to_cpu(ADDBA_req->BA_para_set) &
1664                                       0x3f;
1665                         rtw_hal_get_def_var(padapter, HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
1666                         switch (max_rx_ampdu_factor) {
1667                         case MAX_AMPDU_FACTOR_64K:
1668                                 BA_para_set |= 0x1000; /* 64 buffer size */
1669                                 break;
1670                         case MAX_AMPDU_FACTOR_32K:
1671                                 BA_para_set |= 0x0800; /* 32 buffer size */
1672                                 break;
1673                         case MAX_AMPDU_FACTOR_16K:
1674                                 BA_para_set |= 0x0400; /* 16 buffer size */
1675                                 break;
1676                         case MAX_AMPDU_FACTOR_8K:
1677                                 BA_para_set |= 0x0200; /* 8 buffer size */
1678                                 break;
1679                         default:
1680                                 BA_para_set |= 0x1000; /* 64 buffer size */
1681                                 break;
1682                         }
1683
1684                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
1685                                 BA_para_set = BA_para_set & ~BIT(0);
1686                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
1687                                 BA_para_set = BA_para_set | BIT(0);
1688                         le_tmp = cpu_to_le16(BA_para_set);
1689
1690                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1691                                                   &pattrib->pktlen);
1692                         pframe = rtw_set_fixed_ie(pframe, 2,
1693                                                   &ADDBA_req->BA_timeout_value,
1694                                                   &pattrib->pktlen);
1695                         break;
1696                 }
1697                 case 2:/* DELBA */
1698                         BA_para_set = (status & 0x1F) << 3;
1699                         le_tmp = cpu_to_le16(BA_para_set);
1700                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1701                                                   &pattrib->pktlen);
1702
1703                         reason_code = 37;/* Requested from peer STA as it does not want to use the mechanism */
1704                         le_tmp = cpu_to_le16(reason_code);
1705                         pframe = rtw_set_fixed_ie(pframe, 2, &(le_tmp),
1706                                                   &pattrib->pktlen);
1707                         break;
1708                 default:
1709                         break;
1710                 }
1711         }
1712
1713         pattrib->last_txcmdsz = pattrib->pktlen;
1714
1715         dump_mgntframe(padapter, pmgntframe);
1716 }
1717
1718 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
1719 {
1720         struct list_head *plist, *phead;
1721         unsigned char category, action;
1722         struct xmit_frame                       *pmgntframe;
1723         struct pkt_attrib                       *pattrib;
1724         unsigned char                           *pframe;
1725         struct ieee80211_hdr *pwlanhdr;
1726         __le16 *fctrl;
1727         struct  wlan_network    *pnetwork = NULL;
1728         struct xmit_priv                        *pxmitpriv = &(padapter->xmitpriv);
1729         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1730         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
1731         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1732         struct __queue *queue   = &(pmlmepriv->scanned_queue);
1733         u8 InfoContent[16] = {0};
1734         u8 ICS[8][15];
1735         struct wlan_bssid_ex  *cur_network   = &(pmlmeinfo->network);
1736
1737         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
1738                 return;
1739
1740         if (pmlmeinfo->bwmode_updated)
1741                 return;
1742
1743
1744         DBG_88E("%s\n", __func__);
1745
1746
1747         category = RTW_WLAN_CATEGORY_PUBLIC;
1748         action = ACT_PUBLIC_BSSCOEXIST;
1749
1750         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
1751         if (pmgntframe == NULL)
1752                 return;
1753
1754         /* update attribute */
1755         pattrib = &pmgntframe->attrib;
1756         update_mgntframe_attrib(padapter, pattrib);
1757
1758         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
1759
1760         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
1761         pwlanhdr = (struct ieee80211_hdr *)pframe;
1762
1763         fctrl = &pwlanhdr->frame_control;
1764         *(fctrl) = 0;
1765
1766         ether_addr_copy(pwlanhdr->addr1, cur_network->MacAddress);
1767         ether_addr_copy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)));
1768         ether_addr_copy(pwlanhdr->addr3, cur_network->MacAddress);
1769
1770         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
1771         pmlmeext->mgnt_seq++;
1772         SetFrameSubType(pframe, WIFI_ACTION);
1773
1774         pframe += sizeof(struct ieee80211_hdr_3addr);
1775         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
1776
1777         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
1778         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
1779
1780
1781         /*  */
1782         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
1783                 u8 iedata = 0;
1784
1785                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
1786
1787                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
1788         }
1789
1790
1791         /*  */
1792         memset(ICS, 0, sizeof(ICS));
1793         if (pmlmepriv->num_sta_no_ht > 0) {
1794                 int i;
1795
1796                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
1797
1798                 phead = get_list_head(queue);
1799                 plist = phead->next;
1800
1801                 while (phead != plist) {
1802                         int len;
1803                         u8 *p;
1804                         struct wlan_bssid_ex *pbss_network;
1805
1806                         pnetwork = container_of(plist, struct wlan_network, list);
1807
1808                         plist = plist->next;
1809
1810                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
1811
1812                         p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
1813                         if ((p == NULL) || (len == 0)) { /* non-HT */
1814                                 if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
1815                                         continue;
1816
1817                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
1818
1819                                 if (ICS[0][0] == 0)
1820                                         ICS[0][0] = 1;
1821                         }
1822                 }
1823                 spin_unlock_bh(&pmlmepriv->scanned_queue.lock);
1824
1825                 for (i = 0; i < 8; i++) {
1826                         if (ICS[i][0] == 1) {
1827                                 int j, k = 0;
1828
1829                                 InfoContent[k] = i;
1830                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
1831                                 k++;
1832
1833                                 for (j = 1; j <= 14; j++) {
1834                                         if (ICS[i][j] == 1) {
1835                                                 if (k < 16) {
1836                                                         InfoContent[k] = j; /* channel number */
1837                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
1838                                                         k++;
1839                                                 }
1840                                         }
1841                                 }
1842
1843                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
1844                         }
1845                 }
1846         }
1847
1848
1849         pattrib->last_txcmdsz = pattrib->pktlen;
1850
1851         dump_mgntframe(padapter, pmgntframe);
1852 }
1853
1854 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
1855 {
1856         struct sta_priv *pstapriv = &padapter->stapriv;
1857         struct sta_info *psta = NULL;
1858         /* struct recv_reorder_ctrl *preorder_ctrl; */
1859         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1860         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1861         u16 tid;
1862
1863         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1864                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1865                         return _SUCCESS;
1866
1867         psta = rtw_get_stainfo(pstapriv, addr);
1868         if (psta == NULL)
1869                 return _SUCCESS;
1870
1871         if (initiator == 0) { /*  recipient */
1872                 for (tid = 0; tid < MAXTID; tid++) {
1873                         if (psta->recvreorder_ctrl[tid].enable) {
1874                                 DBG_88E("rx agg disable tid(%d)\n", tid);
1875                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1876                                 psta->recvreorder_ctrl[tid].enable = false;
1877                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
1878                         }
1879                 }
1880         } else if (initiator == 1) { /*  originator */
1881                 for (tid = 0; tid < MAXTID; tid++) {
1882                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
1883                                 DBG_88E("tx agg disable tid(%d)\n", tid);
1884                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
1885                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1886                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1887                         }
1888                 }
1889         }
1890
1891         return _SUCCESS;
1892 }
1893
1894 unsigned int send_beacon(struct adapter *padapter)
1895 {
1896         u8 bxmitok = false;
1897         int     issue = 0;
1898         int poll = 0;
1899
1900         unsigned long start = jiffies;
1901
1902         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
1903         do {
1904                 issue_beacon(padapter, 100);
1905                 issue++;
1906                 do {
1907                         yield();
1908                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
1909                         poll++;
1910                 } while ((poll%10) != 0 && !bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1911         } while (!bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
1912
1913         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
1914                 return _FAIL;
1915         if (!bxmitok) {
1916                 DBG_88E("%s fail! %u ms\n", __func__,
1917                         jiffies_to_msecs(jiffies - start));
1918                 return _FAIL;
1919         } else {
1920                 u32 passing_time = jiffies_to_msecs(jiffies - start);
1921
1922                 if (passing_time > 100 || issue > 3)
1923                         DBG_88E("%s success, issue:%d, poll:%d, %u ms\n",
1924                                 __func__, issue, poll,
1925                                 jiffies_to_msecs(jiffies - start));
1926                 return _SUCCESS;
1927         }
1928 }
1929
1930 /****************************************************************************
1931
1932 Following are some utility functions for WiFi MLME
1933
1934 *****************************************************************************/
1935
1936 static void site_survey(struct adapter *padapter)
1937 {
1938         unsigned char           survey_channel = 0, val8;
1939         enum rt_scan_type ScanType = SCAN_PASSIVE;
1940         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
1941         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
1942         u32 initialgain = 0;
1943         struct rtw_ieee80211_channel *ch;
1944
1945         if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
1946                 ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
1947                 survey_channel = ch->hw_value;
1948                 ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
1949         }
1950
1951
1952         if (survey_channel != 0) {
1953                 /* PAUSE 4-AC Queue when site_survey */
1954                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1955                 /* val8 |= 0x0f; */
1956                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
1957                 if (pmlmeext->sitesurvey_res.channel_idx == 0)
1958                         set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
1959                 else
1960                         SelectChannel(padapter, survey_channel);
1961
1962                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
1963                         int i;
1964                         for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
1965                                 if (pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
1966                                         /* todo: to issue two probe req??? */
1967                                         issue_probereq(padapter,
1968                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1969                                                                 NULL, false);
1970                                         /* msleep(SURVEY_TO>>1); */
1971                                         issue_probereq(padapter,
1972                                         &(pmlmeext->sitesurvey_res.ssid[i]),
1973                                                                 NULL, false);
1974                                 }
1975                         }
1976
1977                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1978                                 /* todo: to issue two probe req??? */
1979                                 issue_probereq(padapter, NULL, NULL, false);
1980                                 /* msleep(SURVEY_TO>>1); */
1981                                 issue_probereq(padapter, NULL, NULL, false);
1982                         }
1983
1984                         if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
1985                                 /* todo: to issue two probe req??? */
1986                                 issue_probereq(padapter, NULL, NULL, false);
1987                                 /* msleep(SURVEY_TO>>1); */
1988                                 issue_probereq(padapter, NULL, NULL, false);
1989                         }
1990                 }
1991
1992                 set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
1993         } else {
1994
1995                 /*  20100721:Interrupt scan operation here. */
1996                 /*  For SW antenna diversity before link, it needs to switch to another antenna and scan again. */
1997                 /*  It compares the scan result and select better one to do connection. */
1998                 if (rtw_hal_antdiv_before_linked(padapter)) {
1999                         pmlmeext->sitesurvey_res.bss_cnt = 0;
2000                         pmlmeext->sitesurvey_res.channel_idx = -1;
2001                         pmlmeext->chan_scan_time = SURVEY_TO / 2;
2002                         set_survey_timer(pmlmeext, pmlmeext->chan_scan_time);
2003                         return;
2004                 }
2005
2006                 pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
2007
2008                 /* switch back to the original channel */
2009
2010                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2011
2012                 /* flush 4-AC Queue after site_survey */
2013                 /* val8 = 0; */
2014                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
2015
2016                 /* config MSR */
2017                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2018
2019                 initialgain = 0xff; /* restore RX GAIN */
2020                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
2021                 /* turn on dynamic functions */
2022                 Restore_DM_Func_Flag(padapter);
2023                 /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
2024
2025                 if (is_client_associated_to_ap(padapter))
2026                         issue_nulldata(padapter, NULL, 0, 3, 500);
2027
2028                 val8 = 0; /* survey done */
2029                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
2030
2031                 report_surveydone_event(padapter);
2032
2033                 pmlmeext->chan_scan_time = SURVEY_TO;
2034                 pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
2035
2036                 issue_action_BSSCoexistPacket(padapter);
2037                 issue_action_BSSCoexistPacket(padapter);
2038                 issue_action_BSSCoexistPacket(padapter);
2039         }
2040 }
2041
2042 /* collect bss info from Beacon and Probe request/response frames. */
2043 static u8 collect_bss_info(struct adapter *padapter,
2044                            struct recv_frame *precv_frame,
2045                            struct wlan_bssid_ex *bssid)
2046 {
2047         int     i;
2048         u32     len;
2049         u8 *p;
2050         u16 val16, subtype;
2051         u8 *pframe = precv_frame->rx_data;
2052         u32     packet_len = precv_frame->len;
2053         u8 ie_offset;
2054         struct registry_priv    *pregistrypriv = &padapter->registrypriv;
2055         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2056         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2057
2058         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
2059
2060         if (len > MAX_IE_SZ)
2061                 return _FAIL;
2062
2063         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
2064
2065         subtype = GetFrameSubType(pframe);
2066
2067         if (subtype == WIFI_BEACON) {
2068                 bssid->Reserved[0] = 1;
2069                 ie_offset = _BEACON_IE_OFFSET_;
2070         } else {
2071                 /*  FIXME : more type */
2072                 if (subtype == WIFI_PROBEREQ) {
2073                         ie_offset = _PROBEREQ_IE_OFFSET_;
2074                         bssid->Reserved[0] = 2;
2075                 } else if (subtype == WIFI_PROBERSP) {
2076                         ie_offset = _PROBERSP_IE_OFFSET_;
2077                         bssid->Reserved[0] = 3;
2078                 } else {
2079                         bssid->Reserved[0] = 0;
2080                         ie_offset = _FIXED_IE_LENGTH_;
2081                 }
2082         }
2083
2084         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
2085
2086         /* below is to copy the information element */
2087         bssid->IELength = len;
2088         memcpy(bssid->IEs, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->IELength);
2089
2090         /* get the signal strength in dBM.raw data */
2091         bssid->Rssi = precv_frame->attrib.phy_info.recvpower;
2092         bssid->PhyInfo.SignalQuality = precv_frame->attrib.phy_info.SignalQuality;/* in percentage */
2093         bssid->PhyInfo.SignalStrength = precv_frame->attrib.phy_info.SignalStrength;/* in percentage */
2094         rtw_hal_get_def_var(padapter, HAL_DEF_CURRENT_ANTENNA,  &bssid->PhyInfo.Optimum_antenna);
2095
2096         /*  checking SSID */
2097         p = rtw_get_ie(bssid->IEs + ie_offset, _SSID_IE_, &len, bssid->IELength - ie_offset);
2098         if (p == NULL) {
2099                 DBG_88E("marc: cannot find SSID for survey event\n");
2100                 return _FAIL;
2101         }
2102
2103         if (len) {
2104                 if (len > NDIS_802_11_LENGTH_SSID) {
2105                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2106                         return _FAIL;
2107                 }
2108                 memcpy(bssid->Ssid.Ssid, (p + 2), len);
2109                 bssid->Ssid.SsidLength = len;
2110         } else {
2111                 bssid->Ssid.SsidLength = 0;
2112         }
2113
2114         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
2115
2116         /* checking rate info... */
2117         i = 0;
2118         p = rtw_get_ie(bssid->IEs + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2119         if (p != NULL) {
2120                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
2121                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2122                         return _FAIL;
2123                 }
2124                 memcpy(bssid->SupportedRates, (p + 2), len);
2125                 i = len;
2126         }
2127
2128         p = rtw_get_ie(bssid->IEs + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
2129         if (p != NULL) {
2130                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i)) {
2131                         DBG_88E("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
2132                         return _FAIL;
2133                 }
2134                 memcpy(bssid->SupportedRates + i, (p + 2), len);
2135         }
2136
2137         /* todo: */
2138         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
2139
2140         if (bssid->IELength < 12)
2141                 return _FAIL;
2142
2143         /*  Checking for DSConfig */
2144         p = rtw_get_ie(bssid->IEs + ie_offset, _DSSET_IE_, &len, bssid->IELength - ie_offset);
2145
2146         bssid->Configuration.DSConfig = 0;
2147         bssid->Configuration.Length = 0;
2148
2149         if (p) {
2150                 bssid->Configuration.DSConfig = *(p + 2);
2151         } else {/*  In 5G, some ap do not have DSSET IE */
2152                 /*  checking HT info for channel */
2153                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->IELength - ie_offset);
2154                 if (p) {
2155                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
2156                         bssid->Configuration.DSConfig = HT_info->primary_channel;
2157                 } else { /*  use current channel */
2158                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
2159                 }
2160         }
2161
2162         if (subtype == WIFI_PROBEREQ) {
2163                 /*  FIXME */
2164                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2165                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2166                 bssid->Privacy = 1;
2167                 return _SUCCESS;
2168         }
2169
2170         bssid->Configuration.BeaconPeriod =
2171                 get_unaligned_le16(rtw_get_beacon_interval_from_ie(bssid->IEs));
2172
2173         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
2174
2175         if (val16 & BIT(0)) {
2176                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
2177                 ether_addr_copy(bssid->MacAddress, GetAddr2Ptr(pframe));
2178         } else {
2179                 bssid->InfrastructureMode = Ndis802_11IBSS;
2180                 ether_addr_copy(bssid->MacAddress, GetAddr3Ptr(pframe));
2181         }
2182
2183         if (val16 & BIT(4))
2184                 bssid->Privacy = 1;
2185         else
2186                 bssid->Privacy = 0;
2187
2188         bssid->Configuration.ATIMWindow = 0;
2189
2190         /* 20/40 BSS Coexistence check */
2191         if ((pregistrypriv->wifi_spec == 1) && (!pmlmeinfo->bwmode_updated)) {
2192                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2193                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->IELength - ie_offset);
2194                 if (p && len > 0) {
2195                         struct ieee80211_ht_cap *pHT_caps =
2196                                 (struct ieee80211_ht_cap *)(p + 2);
2197
2198                         if (le16_to_cpu(pHT_caps->cap_info) & BIT(14))
2199                                 pmlmepriv->num_FortyMHzIntolerant++;
2200                 } else {
2201                         pmlmepriv->num_sta_no_ht++;
2202                 }
2203         }
2204
2205         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
2206         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
2207                 bssid->PhyInfo.SignalQuality = 101;
2208         return _SUCCESS;
2209 }
2210
2211 static void start_create_ibss(struct adapter *padapter)
2212 {
2213         unsigned short  caps;
2214         u8 val8;
2215         u8 join_type;
2216         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2217         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2218         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2219         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2220         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2221
2222         /* update wireless mode */
2223         update_wireless_mode(padapter);
2224
2225         /* update capability */
2226         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2227         update_capinfo(padapter, caps);
2228         if (caps&cap_IBSS) {/* adhoc master */
2229                 val8 = 0xcf;
2230                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2231
2232                 /* switch channel */
2233                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
2234                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, HT_CHANNEL_WIDTH_20);
2235
2236                 beacon_timing_control(padapter);
2237
2238                 /* set msr to WIFI_FW_ADHOC_STATE */
2239                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2240                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
2241
2242                 /* issue beacon */
2243                 if (send_beacon(padapter) == _FAIL) {
2244                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
2245
2246                         report_join_res(padapter, -1);
2247                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2248                 } else {
2249                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
2250                         join_type = 0;
2251                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
2252
2253                         report_join_res(padapter, 1);
2254                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
2255                 }
2256         } else {
2257                 DBG_88E("start_create_ibss, invalid cap:%x\n", caps);
2258                 return;
2259         }
2260 }
2261
2262 static void start_clnt_join(struct adapter *padapter)
2263 {
2264         unsigned short  caps;
2265         u8 val8;
2266         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2267         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2268         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
2269         int beacon_timeout;
2270
2271         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
2272         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
2273
2274         /* update wireless mode */
2275         update_wireless_mode(padapter);
2276
2277         /* update capability */
2278         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
2279         update_capinfo(padapter, caps);
2280         if (caps&cap_ESS) {
2281                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
2282
2283                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
2284
2285                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2286
2287                 /* switch channel */
2288                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2289
2290                 /* here wait for receiving the beacon to start auth */
2291                 /* and enable a timer */
2292                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
2293                 set_link_timer(pmlmeext, beacon_timeout);
2294                 mod_timer(&padapter->mlmepriv.assoc_timer, jiffies +
2295                           msecs_to_jiffies((REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO * REASSOC_LIMIT) + beacon_timeout));
2296
2297                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
2298         } else if (caps&cap_IBSS) { /* adhoc client */
2299                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
2300
2301                 val8 = 0xcf;
2302                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
2303
2304                 /* switch channel */
2305                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
2306
2307                 beacon_timing_control(padapter);
2308
2309                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
2310
2311                 report_join_res(padapter, 1);
2312         } else {
2313                 return;
2314         }
2315 }
2316
2317 static void start_clnt_auth(struct adapter *padapter)
2318 {
2319         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2320         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2321
2322         del_timer_sync(&pmlmeext->link_timer);
2323
2324         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
2325         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
2326
2327         pmlmeinfo->auth_seq = 1;
2328         pmlmeinfo->reauth_count = 0;
2329         pmlmeinfo->reassoc_count = 0;
2330         pmlmeinfo->link_count = 0;
2331         pmlmeext->retry = 0;
2332
2333
2334         /*  Because of AP's not receiving deauth before */
2335         /*  AP may: 1)not response auth or 2)deauth us after link is complete */
2336         /*  issue deauth before issuing auth to deal with the situation */
2337         /*      Commented by Albert 2012/07/21 */
2338         /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
2339         issue_deauth(padapter, (&(pmlmeinfo->network))->MacAddress, WLAN_REASON_DEAUTH_LEAVING);
2340
2341         DBG_88E_LEVEL(_drv_info_, "start auth\n");
2342         issue_auth(padapter, NULL, 0);
2343
2344         set_link_timer(pmlmeext, REAUTH_TO);
2345 }
2346
2347
2348 static void start_clnt_assoc(struct adapter *padapter)
2349 {
2350         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2351         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2352
2353         del_timer_sync(&pmlmeext->link_timer);
2354
2355         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
2356         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
2357
2358         issue_assocreq(padapter);
2359
2360         set_link_timer(pmlmeext, REASSOC_TO);
2361 }
2362
2363 static unsigned int receive_disconnect(struct adapter *padapter,
2364                                        unsigned char *MacAddr,
2365                                        unsigned short reason)
2366 {
2367         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2368         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2369         struct wlan_bssid_ex    *pnetwork = &(pmlmeinfo->network);
2370
2371         /* check A3 */
2372         if (memcmp(MacAddr, pnetwork->MacAddress, ETH_ALEN))
2373                 return _SUCCESS;
2374
2375         DBG_88E("%s\n", __func__);
2376
2377         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
2378                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
2379                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2380                         report_del_sta_event(padapter, MacAddr, reason);
2381                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
2382                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
2383                         report_join_res(padapter, -2);
2384                 }
2385         }
2386         return _SUCCESS;
2387 }
2388
2389 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
2390 {
2391         struct registry_priv *pregistrypriv;
2392         struct mlme_ext_priv *pmlmeext;
2393         struct rt_channel_info *chplan_new;
2394         u8 channel;
2395         u8 i;
2396
2397         pregistrypriv = &padapter->registrypriv;
2398         pmlmeext = &padapter->mlmeextpriv;
2399
2400         /*  Adjust channel plan by AP Country IE */
2401         if (pregistrypriv->enable80211d &&
2402             (!pmlmeext->update_channel_plan_by_ap_done)) {
2403                 u8 *ie, *p;
2404                 u32 len;
2405                 struct rt_channel_plan chplan_ap;
2406                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
2407                 u8 country[4];
2408                 u8 fcn; /*  first channel number */
2409                 u8 noc; /*  number of channel */
2410                 u8 j, k;
2411
2412                 ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
2413                 if (!ie)
2414                         return;
2415                 if (len < 6)
2416                         return;
2417                 ie += 2;
2418                 p = ie;
2419                 ie += len;
2420
2421                 memset(country, 0, 4);
2422                 memcpy(country, p, 3);
2423                 p += 3;
2424                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2425                          ("%s: 802.11d country =%s\n", __func__, country));
2426
2427                 i = 0;
2428                 while ((ie - p) >= 3) {
2429                         fcn = *(p++);
2430                         noc = *(p++);
2431                         p++;
2432
2433                         for (j = 0; j < noc; j++) {
2434                                 if (fcn <= 14)
2435                                         channel = fcn + j; /*  2.4 GHz */
2436                                 else
2437                                         channel = fcn + j*4; /*  5 GHz */
2438
2439                                 chplan_ap.Channel[i++] = channel;
2440                         }
2441                 }
2442                 chplan_ap.Len = i;
2443
2444                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
2445
2446                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
2447                 chplan_new = pmlmeext->channel_set;
2448
2449                 i = 0;
2450                 j = 0;
2451                 k = 0;
2452                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
2453                         do {
2454                                 if ((i == MAX_CHANNEL_NUM) ||
2455                                     (chplan_sta[i].ChannelNum == 0) ||
2456                                     (chplan_sta[i].ChannelNum > 14))
2457                                         break;
2458
2459                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
2460                                         break;
2461
2462                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
2463                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2464                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2465                                         i++;
2466                                         j++;
2467                                         k++;
2468                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
2469                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2470                                         chplan_new[k].ScanType = SCAN_PASSIVE;
2471                                         i++;
2472                                         k++;
2473                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
2474                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2475                                         chplan_new[k].ScanType = SCAN_ACTIVE;
2476                                         j++;
2477                                         k++;
2478                                 }
2479                         } while (1);
2480
2481                         /*  change AP not support channel to Passive scan */
2482                         while ((i < MAX_CHANNEL_NUM) &&
2483                                (chplan_sta[i].ChannelNum != 0) &&
2484                                (chplan_sta[i].ChannelNum <= 14)) {
2485                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2486                                 chplan_new[k].ScanType = SCAN_PASSIVE;
2487                                 i++;
2488                                 k++;
2489                         }
2490
2491                         /*  add channel AP supported */
2492                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
2493                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
2494                                 chplan_new[k].ScanType = SCAN_ACTIVE;
2495                                 j++;
2496                                 k++;
2497                         }
2498                 } else {
2499                         /*  keep original STA 2.4G channel plan */
2500                         while ((i < MAX_CHANNEL_NUM) &&
2501                                (chplan_sta[i].ChannelNum != 0) &&
2502                                (chplan_sta[i].ChannelNum <= 14)) {
2503                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2504                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
2505                                 i++;
2506                                 k++;
2507                         }
2508
2509                         /*  skip AP 2.4G channel plan */
2510                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
2511                                 j++;
2512                 }
2513
2514                 /*  keep original STA 5G channel plan */
2515                 while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
2516                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
2517                         chplan_new[k].ScanType = chplan_sta[i].ScanType;
2518                         i++;
2519                         k++;
2520                 }
2521
2522                 pmlmeext->update_channel_plan_by_ap_done = 1;
2523         }
2524
2525         /*  If channel is used by AP, set channel scan type to active */
2526         channel = bssid->Configuration.DSConfig;
2527         chplan_new = pmlmeext->channel_set;
2528         i = 0;
2529         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
2530                 if (chplan_new[i].ChannelNum == channel) {
2531                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
2532                                 chplan_new[i].ScanType = SCAN_ACTIVE;
2533                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
2534                                          ("%s: change channel %d scan type from passive to active\n",
2535                                          __func__, channel));
2536                         }
2537                         break;
2538                 }
2539                 i++;
2540         }
2541 }
2542
2543 /****************************************************************************
2544
2545 Following are the callback functions for each subtype of the management frames
2546
2547 *****************************************************************************/
2548
2549 static unsigned int OnProbeReq(struct adapter *padapter,
2550                                struct recv_frame *precv_frame)
2551 {
2552         unsigned int    ielen;
2553         unsigned char   *p;
2554         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2555         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2556         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2557         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2558         u8 *pframe = precv_frame->rx_data;
2559         uint len = precv_frame->len;
2560
2561         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
2562                 return _SUCCESS;
2563
2564         if (!check_fwstate(pmlmepriv, _FW_LINKED) &&
2565             !check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE))
2566                 return _SUCCESS;
2567
2568         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ielen,
2569                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
2570
2571         /* check (wildcard) SSID */
2572         if (p != NULL) {
2573                 if ((ielen != 0 && memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength)) ||
2574                     (ielen == 0 && pmlmeinfo->hidden_ssid_mode))
2575                         return _SUCCESS;
2576
2577                 if (check_fwstate(pmlmepriv, _FW_LINKED) &&
2578                     pmlmepriv->cur_network.join_res)
2579                         issue_probersp(padapter, get_sa(pframe));
2580         }
2581         return _SUCCESS;
2582 }
2583
2584 static unsigned int OnProbeRsp(struct adapter *padapter,
2585                                struct recv_frame *precv_frame)
2586 {
2587         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2588
2589         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2590                 report_survey_event(padapter, precv_frame);
2591                 return _SUCCESS;
2592         }
2593
2594         return _SUCCESS;
2595 }
2596
2597 static unsigned int OnBeacon(struct adapter *padapter,
2598                              struct recv_frame *precv_frame)
2599 {
2600         int cam_idx;
2601         struct sta_info *psta;
2602         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2603         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2604         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2605         struct sta_priv *pstapriv = &padapter->stapriv;
2606         u8 *pframe = precv_frame->rx_data;
2607         uint len = precv_frame->len;
2608         struct wlan_bssid_ex *pbss;
2609         int ret = _SUCCESS;
2610         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2611
2612         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
2613                 report_survey_event(padapter, precv_frame);
2614                 return _SUCCESS;
2615         }
2616
2617         if (!memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN)) {
2618                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
2619                         /* we should update current network before auth, or some IE is wrong */
2620                         pbss = (struct wlan_bssid_ex *)rtw_malloc(sizeof(struct wlan_bssid_ex));
2621                         if (pbss) {
2622                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
2623                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
2624                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
2625                                 }
2626                                 kfree(pbss);
2627                         }
2628
2629                         /* check the vendor of the assoc AP */
2630                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
2631
2632                         /* update TSF Value */
2633                         update_TSF(pmlmeext, pframe, len);
2634
2635                         /* start auth */
2636                         start_clnt_auth(padapter);
2637
2638                         return _SUCCESS;
2639                 }
2640
2641                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
2642                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2643                         if (psta != NULL) {
2644                                 ret = rtw_check_bcn_info(padapter, pframe, len);
2645                                 if (!ret) {
2646                                                 DBG_88E_LEVEL(_drv_info_, "ap has changed, disconnect now\n ");
2647                                                 receive_disconnect(padapter, pmlmeinfo->network.MacAddress , 65535);
2648                                                 return _SUCCESS;
2649                                 }
2650                                 /* update WMM, ERP in the beacon */
2651                                 /* todo: the timer is used instead of the number of the beacon received */
2652                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2653                                         update_beacon_info(padapter, pframe, len, psta);
2654                         }
2655                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2656                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2657                         if (psta != NULL) {
2658                                 /* update WMM, ERP in the beacon */
2659                                 /* todo: the timer is used instead of the number of the beacon received */
2660                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
2661                                         update_beacon_info(padapter, pframe, len, psta);
2662                         } else {
2663                                 /* allocate a new CAM entry for IBSS station */
2664                                 cam_idx = allocate_fw_sta_entry(padapter);
2665                                 if (cam_idx == NUM_STA)
2666                                         goto _END_ONBEACON_;
2667
2668                                 /* get supported rate */
2669                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
2670                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
2671                                         goto _END_ONBEACON_;
2672                                 }
2673
2674                                 /* update TSF Value */
2675                                 update_TSF(pmlmeext, pframe, len);
2676
2677                                 /* report sta add event */
2678                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
2679                         }
2680                 }
2681         }
2682
2683 _END_ONBEACON_:
2684
2685         return _SUCCESS;
2686 }
2687
2688 #ifdef CONFIG_88EU_AP_MODE
2689 static unsigned int OnAuth(struct adapter *padapter,
2690                            struct recv_frame *precv_frame)
2691 {
2692         unsigned int    auth_mode, ie_len;
2693         u16 seq;
2694         unsigned char   *sa, *p;
2695         u16 algorithm;
2696         int     status;
2697         static struct sta_info stat;
2698         struct  sta_info        *pstat = NULL;
2699         struct  sta_priv *pstapriv = &padapter->stapriv;
2700         struct security_priv *psecuritypriv = &padapter->securitypriv;
2701         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2702         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2703         u8 *pframe = precv_frame->rx_data;
2704         uint len = precv_frame->len;
2705
2706         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2707                 return _FAIL;
2708
2709         DBG_88E("+OnAuth\n");
2710
2711         sa = GetAddr2Ptr(pframe);
2712
2713         auth_mode = psecuritypriv->dot11AuthAlgrthm;
2714         seq = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + 2));
2715         algorithm = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN));
2716
2717         DBG_88E("auth alg=%x, seq=%X\n", algorithm, seq);
2718
2719         if (auth_mode == 2 && psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
2720             psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
2721                 auth_mode = 0;
2722
2723         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
2724             (algorithm == 0 && auth_mode == 1)) {       /*  rx a open-system auth but shared-key is enabled */
2725                 DBG_88E("auth rejected due to bad alg [alg=%d, auth_mib=%d] %02X%02X%02X%02X%02X%02X\n",
2726                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
2727
2728                 status = _STATS_NO_SUPP_ALG_;
2729
2730                 goto auth_fail;
2731         }
2732
2733         if (!rtw_access_ctrl(padapter, sa)) {
2734                 status = _STATS_UNABLE_HANDLE_STA_;
2735                 goto auth_fail;
2736         }
2737
2738         pstat = rtw_get_stainfo(pstapriv, sa);
2739         if (pstat == NULL) {
2740                 /*  allocate a new one */
2741                 DBG_88E("going to alloc stainfo for sa=%pM\n", sa);
2742                 pstat = rtw_alloc_stainfo(pstapriv, sa);
2743                 if (pstat == NULL) {
2744                         DBG_88E(" Exceed the upper limit of supported clients...\n");
2745                         status = _STATS_UNABLE_HANDLE_STA_;
2746                         goto auth_fail;
2747                 }
2748
2749                 pstat->state = WIFI_FW_AUTH_NULL;
2750                 pstat->auth_seq = 0;
2751         } else {
2752                 spin_lock_bh(&pstapriv->asoc_list_lock);
2753                 if (!list_empty(&pstat->asoc_list)) {
2754                         list_del_init(&pstat->asoc_list);
2755                         pstapriv->asoc_list_cnt--;
2756                 }
2757                 spin_unlock_bh(&pstapriv->asoc_list_lock);
2758
2759                 if (seq == 1) {
2760                         /* TODO: STA re_auth and auth timeout */
2761                 }
2762         }
2763
2764         spin_lock_bh(&pstapriv->auth_list_lock);
2765         if (list_empty(&pstat->auth_list)) {
2766                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
2767                 pstapriv->auth_list_cnt++;
2768         }
2769         spin_unlock_bh(&pstapriv->auth_list_lock);
2770
2771         if (pstat->auth_seq == 0)
2772                 pstat->expire_to = pstapriv->auth_to;
2773
2774         if ((pstat->auth_seq + 1) != seq) {
2775                 DBG_88E("(1)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2776                         seq, pstat->auth_seq+1);
2777                 status = _STATS_OUT_OF_AUTH_SEQ_;
2778                 goto auth_fail;
2779         }
2780
2781         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2)) {
2782                 if (seq == 1) {
2783                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2784                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
2785                         pstat->expire_to = pstapriv->assoc_to;
2786                         pstat->authalg = algorithm;
2787                 } else {
2788                         DBG_88E("(2)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2789                                 seq, pstat->auth_seq+1);
2790                         status = _STATS_OUT_OF_AUTH_SEQ_;
2791                         goto auth_fail;
2792                 }
2793         } else { /*  shared system or auto authentication */
2794                 if (seq == 1) {
2795                         /* prepare for the challenging txt... */
2796
2797                         pstat->state &= ~WIFI_FW_AUTH_NULL;
2798                         pstat->state |= WIFI_FW_AUTH_STATE;
2799                         pstat->authalg = algorithm;
2800                         pstat->auth_seq = 2;
2801                 } else if (seq == 3) {
2802                         /* checking for challenging txt... */
2803                         DBG_88E("checking for challenging txt...\n");
2804
2805                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_ , _CHLGETXT_IE_, (int *)&ie_len,
2806                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
2807
2808                         if ((p == NULL) || (ie_len <= 0)) {
2809                                 DBG_88E("auth rejected because challenge failure!(1)\n");
2810                                 status = _STATS_CHALLENGE_FAIL_;
2811                                 goto auth_fail;
2812                         }
2813
2814                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
2815                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
2816                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
2817                                 /*  challenging txt is correct... */
2818                                 pstat->expire_to =  pstapriv->assoc_to;
2819                         } else {
2820                                 DBG_88E("auth rejected because challenge failure!\n");
2821                                 status = _STATS_CHALLENGE_FAIL_;
2822                                 goto auth_fail;
2823                         }
2824                 } else {
2825                         DBG_88E("(3)auth rejected because out of seq [rx_seq=%d, exp_seq=%d]!\n",
2826                                 seq, pstat->auth_seq+1);
2827                         status = _STATS_OUT_OF_AUTH_SEQ_;
2828                         goto auth_fail;
2829                 }
2830         }
2831
2832         /*  Now, we are going to issue_auth... */
2833         pstat->auth_seq = seq + 1;
2834
2835         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
2836
2837         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
2838                 pstat->auth_seq = 0;
2839
2840         return _SUCCESS;
2841
2842 auth_fail:
2843
2844         if (pstat)
2845                 rtw_free_stainfo(padapter, pstat);
2846
2847         pstat = &stat;
2848         memset((char *)pstat, '\0', sizeof(stat));
2849         pstat->auth_seq = 2;
2850         memcpy(pstat->hwaddr, sa, 6);
2851
2852         issue_auth(padapter, pstat, (unsigned short)status);
2853
2854         return _FAIL;
2855 }
2856 #endif /* CONFIG_88EU_AP_MODE */
2857
2858 static unsigned int OnAuthClient(struct adapter *padapter,
2859                                  struct recv_frame *precv_frame)
2860 {
2861         unsigned int    seq, len, status, offset;
2862         unsigned char   *p;
2863         unsigned int    go2asoc = 0;
2864         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
2865         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2866         u8 *pframe = precv_frame->rx_data;
2867         uint pkt_len = precv_frame->len;
2868
2869         DBG_88E("%s\n", __func__);
2870
2871         /* check A1 matches or not */
2872         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
2873                 return _SUCCESS;
2874
2875         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
2876                 return _SUCCESS;
2877
2878         offset = (GetPrivacy(pframe)) ? 4 : 0;
2879
2880         seq     = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 2));
2881         status  = le16_to_cpu(*(__le16 *)((size_t)pframe + WLAN_HDR_A3_LEN + offset + 4));
2882
2883         if (status != 0) {
2884                 DBG_88E("clnt auth fail, status: %d\n", status);
2885                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
2886                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2887                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
2888                         else
2889                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
2890                 }
2891
2892                 set_link_timer(pmlmeext, 1);
2893                 goto authclnt_fail;
2894         }
2895
2896         if (seq == 2) {
2897                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
2898                         /*  legendary shared system */
2899                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&len,
2900                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
2901
2902                         if (p == NULL)
2903                                 goto authclnt_fail;
2904
2905                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
2906                         pmlmeinfo->auth_seq = 3;
2907                         issue_auth(padapter, NULL, 0);
2908                         set_link_timer(pmlmeext, REAUTH_TO);
2909
2910                         return _SUCCESS;
2911                 } else {
2912                         /*  open system */
2913                         go2asoc = 1;
2914                 }
2915         } else if (seq == 4) {
2916                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
2917                         go2asoc = 1;
2918                 else
2919                         goto authclnt_fail;
2920         } else {
2921                 /*  this is also illegal */
2922                 goto authclnt_fail;
2923         }
2924
2925         if (go2asoc) {
2926                 DBG_88E_LEVEL(_drv_info_, "auth success, start assoc\n");
2927                 start_clnt_assoc(padapter);
2928                 return _SUCCESS;
2929         }
2930 authclnt_fail:
2931         return _FAIL;
2932 }
2933
2934 static unsigned int OnAssocReq(struct adapter *padapter,
2935                                struct recv_frame *precv_frame)
2936 {
2937 #ifdef CONFIG_88EU_AP_MODE
2938         u16 capab_info;
2939         struct rtw_ieee802_11_elems elems;
2940         struct sta_info *pstat;
2941         unsigned char           reassoc, *p, *pos, *wpa_ie;
2942         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
2943         int             i, ie_len, wpa_ie_len, left;
2944         unsigned char           supportRate[16];
2945         int                                     supportRateNum;
2946         unsigned short          status = _STATS_SUCCESSFUL_;
2947         unsigned short          frame_type, ie_offset = 0;
2948         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2949         struct security_priv *psecuritypriv = &padapter->securitypriv;
2950         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2951         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
2952         struct wlan_bssid_ex *cur = &(pmlmeinfo->network);
2953         struct sta_priv *pstapriv = &padapter->stapriv;
2954         u8 *pframe = precv_frame->rx_data;
2955         uint pkt_len = precv_frame->len;
2956
2957         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
2958                 return _FAIL;
2959
2960         frame_type = GetFrameSubType(pframe);
2961         if (frame_type == WIFI_ASSOCREQ) {
2962                 reassoc = 0;
2963                 ie_offset = _ASOCREQ_IE_OFFSET_;
2964         } else { /*  WIFI_REASSOCREQ */
2965                 reassoc = 1;
2966                 ie_offset = _REASOCREQ_IE_OFFSET_;
2967         }
2968
2969
2970         if (pkt_len < IEEE80211_3ADDR_LEN + ie_offset) {
2971                 DBG_88E("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
2972                        "\n", reassoc, (unsigned long)pkt_len);
2973                 return _FAIL;
2974         }
2975
2976         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
2977         if (pstat == NULL) {
2978                 status = _RSON_CLS2_;
2979                 goto asoc_class2_error;
2980         }
2981
2982         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
2983
2984         left = pkt_len - (IEEE80211_3ADDR_LEN + ie_offset);
2985         pos = pframe + (IEEE80211_3ADDR_LEN + ie_offset);
2986
2987
2988         DBG_88E("%s\n", __func__);
2989
2990         /*  check if this stat has been successfully authenticated/assocated */
2991         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
2992                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
2993                         status = _RSON_CLS2_;
2994                         goto asoc_class2_error;
2995                 } else {
2996                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
2997                         pstat->state |= WIFI_FW_ASSOC_STATE;
2998                 }
2999         } else {
3000                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
3001                 pstat->state |= WIFI_FW_ASSOC_STATE;
3002         }
3003         pstat->capability = capab_info;
3004         /* now parse all ieee802_11 ie to point to elems */
3005         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
3006             !elems.ssid) {
3007                 DBG_88E("STA %pM sent invalid association request\n",
3008                         pstat->hwaddr);
3009                 status = _STATS_FAILURE_;
3010                 goto OnAssocReqFail;
3011         }
3012
3013
3014         /*  now we should check all the fields... */
3015         /*  checking SSID */
3016         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
3017                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3018         if (p == NULL)
3019                 status = _STATS_FAILURE_;
3020
3021         if (ie_len == 0) { /*  broadcast ssid, however it is not allowed in assocreq */
3022                 status = _STATS_FAILURE_;
3023         } else {
3024                 /*  check if ssid match */
3025                 if (memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
3026                         status = _STATS_FAILURE_;
3027
3028                 if (ie_len != cur->Ssid.SsidLength)
3029                         status = _STATS_FAILURE_;
3030         }
3031
3032         if (_STATS_SUCCESSFUL_ != status)
3033                 goto OnAssocReqFail;
3034
3035         /*  check if the supported rate is ok */
3036         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3037         if (p == NULL) {
3038                 DBG_88E("Rx a sta assoc-req which supported rate is empty!\n");
3039                 /*  use our own rate set as statoin used */
3040                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
3041                 /* supportRateNum = AP_BSSRATE_LEN; */
3042
3043                 status = _STATS_FAILURE_;
3044                 goto OnAssocReqFail;
3045         } else {
3046                 memcpy(supportRate, p+2, ie_len);
3047                 supportRateNum = ie_len;
3048
3049                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_ , &ie_len,
3050                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3051                 if (p !=  NULL) {
3052                         if (supportRateNum <= sizeof(supportRate)) {
3053                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
3054                                 supportRateNum += ie_len;
3055                         }
3056                 }
3057         }
3058
3059         /* todo: mask supportRate between AP & STA -> move to update raid */
3060         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
3061
3062         /* update station supportRate */
3063         pstat->bssratelen = supportRateNum;
3064         memcpy(pstat->bssrateset, supportRate, supportRateNum);
3065         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
3066
3067         /* check RSN/WPA/WPS */
3068         pstat->dot8021xalg = 0;
3069         pstat->wpa_psk = 0;
3070         pstat->wpa_group_cipher = 0;
3071         pstat->wpa2_group_cipher = 0;
3072         pstat->wpa_pairwise_cipher = 0;
3073         pstat->wpa2_pairwise_cipher = 0;
3074         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
3075         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
3076                 int group_cipher = 0, pairwise_cipher = 0;
3077
3078                 wpa_ie = elems.rsn_ie;
3079                 wpa_ie_len = elems.rsn_ie_len;
3080
3081                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3082                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3083                         pstat->wpa_psk |= BIT(1);
3084
3085                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
3086                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
3087
3088                         if (!pstat->wpa2_group_cipher)
3089                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3090
3091                         if (!pstat->wpa2_pairwise_cipher)
3092                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3093                 } else {
3094                         status = WLAN_STATUS_INVALID_IE;
3095                 }
3096         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
3097                 int group_cipher = 0, pairwise_cipher = 0;
3098
3099                 wpa_ie = elems.wpa_ie;
3100                 wpa_ie_len = elems.wpa_ie_len;
3101
3102                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
3103                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
3104                         pstat->wpa_psk |= BIT(0);
3105
3106                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
3107                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
3108
3109                         if (!pstat->wpa_group_cipher)
3110                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
3111
3112                         if (!pstat->wpa_pairwise_cipher)
3113                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
3114                 } else {
3115                         status = WLAN_STATUS_INVALID_IE;
3116                 }
3117         } else {
3118                 wpa_ie = NULL;
3119                 wpa_ie_len = 0;
3120         }
3121
3122         if (_STATS_SUCCESSFUL_ != status)
3123                 goto OnAssocReqFail;
3124
3125         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
3126         if (wpa_ie == NULL) {
3127                 if (elems.wps_ie) {
3128                         DBG_88E("STA included WPS IE in "
3129                                    "(Re)Association Request - assume WPS is "
3130                                    "used\n");
3131                         pstat->flags |= WLAN_STA_WPS;
3132                         /* wpabuf_free(sta->wps_ie); */
3133                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
3134                         /*                              elems.wps_ie_len - 4); */
3135                 } else {
3136                         DBG_88E("STA did not include WPA/RSN IE "
3137                                    "in (Re)Association Request - possible WPS "
3138                                    "use\n");
3139                         pstat->flags |= WLAN_STA_MAYBE_WPS;
3140                 }
3141
3142
3143                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
3144                 /*  that the selected registrar of AP is _FLASE */
3145                 if ((psecuritypriv->wpa_psk > 0) && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
3146                         if (pmlmepriv->wps_beacon_ie) {
3147                                 u8 selected_registrar = 0;
3148
3149                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR , &selected_registrar, NULL);
3150
3151                                 if (!selected_registrar) {
3152                                         DBG_88E("selected_registrar is false , or AP is not ready to do WPS\n");
3153
3154                                         status = _STATS_UNABLE_HANDLE_STA_;
3155
3156                                         goto OnAssocReqFail;
3157                                 }
3158                         }
3159                 }
3160         } else {
3161                 int copy_len;
3162
3163                 if (psecuritypriv->wpa_psk == 0) {
3164                         DBG_88E("STA %pM: WPA/RSN IE in association "
3165                         "request, but AP don't support WPA/RSN\n", pstat->hwaddr);
3166
3167                         status = WLAN_STATUS_INVALID_IE;
3168
3169                         goto OnAssocReqFail;
3170                 }
3171
3172                 if (elems.wps_ie) {
3173                         DBG_88E("STA included WPS IE in "
3174                                    "(Re)Association Request - WPS is "
3175                                    "used\n");
3176                         pstat->flags |= WLAN_STA_WPS;
3177                         copy_len = 0;
3178                 } else {
3179                         copy_len = min_t(int, wpa_ie_len + 2, sizeof(pstat->wpa_ie));
3180                 }
3181                 if (copy_len > 0)
3182                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
3183         }
3184         /*  check if there is WMM IE & support WWM-PS */
3185         pstat->flags &= ~WLAN_STA_WME;
3186         pstat->qos_option = 0;
3187         pstat->qos_info = 0;
3188         pstat->has_legacy_ac = true;
3189         pstat->uapsd_vo = 0;
3190         pstat->uapsd_vi = 0;
3191         pstat->uapsd_be = 0;
3192         pstat->uapsd_bk = 0;
3193         if (pmlmepriv->qospriv.qos_option) {
3194                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
3195                 for (;;) {
3196                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
3197                         if (p != NULL) {
3198                                 if (!memcmp(p+2, WMM_IE, 6)) {
3199                                         pstat->flags |= WLAN_STA_WME;
3200
3201                                         pstat->qos_option = 1;
3202                                         pstat->qos_info = *(p+8);
3203
3204                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
3205
3206                                         if ((pstat->qos_info&0xf) != 0xf)
3207                                                 pstat->has_legacy_ac = true;
3208                                         else
3209                                                 pstat->has_legacy_ac = false;
3210
3211                                         if (pstat->qos_info&0xf) {
3212                                                 if (pstat->qos_info&BIT(0))
3213                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
3214                                                 else
3215                                                         pstat->uapsd_vo = 0;
3216
3217                                                 if (pstat->qos_info&BIT(1))
3218                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
3219                                                 else
3220                                                         pstat->uapsd_vi = 0;
3221
3222                                                 if (pstat->qos_info&BIT(2))
3223                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
3224                                                 else
3225                                                         pstat->uapsd_bk = 0;
3226
3227                                                 if (pstat->qos_info&BIT(3))
3228                                                         pstat->uapsd_be = BIT(0)|BIT(1);
3229                                                 else
3230                                                         pstat->uapsd_be = 0;
3231                                         }
3232                                         break;
3233                                 }
3234                         } else {
3235                                 break;
3236                         }
3237                         p = p + ie_len + 2;
3238                 }
3239         }
3240
3241         /* save HT capabilities in the sta object */
3242         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
3243         if (elems.ht_capabilities &&
3244             elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
3245                 pstat->flags |= WLAN_STA_HT;
3246
3247                 pstat->flags |= WLAN_STA_WME;
3248
3249                 memcpy(&pstat->htpriv.ht_cap,
3250                        elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
3251         } else {
3252                 pstat->flags &= ~WLAN_STA_HT;
3253         }
3254         if ((!pmlmepriv->htpriv.ht_option) && (pstat->flags&WLAN_STA_HT)) {
3255                 status = _STATS_FAILURE_;
3256                 goto OnAssocReqFail;
3257         }
3258
3259         if ((pstat->flags & WLAN_STA_HT) &&
3260             ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
3261             (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
3262                 DBG_88E("HT: %pM tried to "
3263                         "use TKIP with HT association\n", pstat->hwaddr);
3264
3265                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
3266                 /* goto OnAssocReqFail; */
3267         }
3268
3269         pstat->flags |= WLAN_STA_NONERP;
3270         for (i = 0; i < pstat->bssratelen; i++) {
3271                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
3272                         pstat->flags &= ~WLAN_STA_NONERP;
3273                         break;
3274                 }
3275         }
3276
3277         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3278                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
3279         else
3280                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3281
3282
3283
3284         if (status != _STATS_SUCCESSFUL_)
3285                 goto OnAssocReqFail;
3286
3287         /* TODO: identify_proprietary_vendor_ie(); */
3288         /*  Realtek proprietary IE */
3289         /*  identify if this is Broadcom sta */
3290         /*  identify if this is ralink sta */
3291         /*  Customer proprietary IE */
3292
3293         /* get a unique AID */
3294         if (pstat->aid > 0) {
3295                 DBG_88E("  old AID %d\n", pstat->aid);
3296         } else {
3297                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
3298                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
3299                                 break;
3300
3301                 /* if (pstat->aid > NUM_STA) { */
3302                 if (pstat->aid > pstapriv->max_num_sta) {
3303                         pstat->aid = 0;
3304
3305                         DBG_88E("  no room for more AIDs\n");
3306
3307                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3308
3309                         goto OnAssocReqFail;
3310                 } else {
3311                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
3312                         DBG_88E("allocate new AID=(%d)\n", pstat->aid);
3313                 }
3314         }
3315
3316         pstat->state &= (~WIFI_FW_ASSOC_STATE);
3317         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
3318
3319         spin_lock_bh(&pstapriv->auth_list_lock);
3320         if (!list_empty(&pstat->auth_list)) {
3321                 list_del_init(&pstat->auth_list);
3322                 pstapriv->auth_list_cnt--;
3323         }
3324         spin_unlock_bh(&pstapriv->auth_list_lock);
3325
3326         spin_lock_bh(&pstapriv->asoc_list_lock);
3327         if (list_empty(&pstat->asoc_list)) {
3328                 pstat->expire_to = pstapriv->expire_to;
3329                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
3330                 pstapriv->asoc_list_cnt++;
3331         }
3332         spin_unlock_bh(&pstapriv->asoc_list_lock);
3333
3334         /*  now the station is qualified to join our BSS... */
3335         if ((pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_ == status)) {
3336                 /* 1 bss_cap_update & sta_info_update */
3337                 bss_cap_update_on_sta_join(padapter, pstat);
3338                 sta_info_update(padapter, pstat);
3339
3340                 /* issue assoc rsp before notify station join event. */
3341                 if (frame_type == WIFI_ASSOCREQ)
3342                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3343                 else
3344                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3345
3346                 /* 2 - report to upper layer */
3347                 DBG_88E("indicate_sta_join_event to upper layer - hostapd\n");
3348                 rtw_indicate_sta_assoc_event(padapter, pstat);
3349
3350                 /* 3-(1) report sta add event */
3351                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
3352         }
3353
3354         return _SUCCESS;
3355
3356 asoc_class2_error:
3357
3358         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
3359
3360         return _FAIL;
3361
3362 OnAssocReqFail:
3363
3364         pstat->aid = 0;
3365         if (frame_type == WIFI_ASSOCREQ)
3366                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
3367         else
3368                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
3369
3370 #endif /* CONFIG_88EU_AP_MODE */
3371
3372         return _FAIL;
3373 }
3374
3375 static unsigned int OnAssocRsp(struct adapter *padapter,
3376                                struct recv_frame *precv_frame)
3377 {
3378         uint i;
3379         int res;
3380         unsigned short  status;
3381         struct ndis_802_11_var_ie *pIE;
3382         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3383         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3384         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3385         /* struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network); */
3386         u8 *pframe = precv_frame->rx_data;
3387         uint pkt_len = precv_frame->len;
3388
3389         DBG_88E("%s\n", __func__);
3390
3391         /* check A1 matches or not */
3392         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
3393                 return _SUCCESS;
3394
3395         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
3396                 return _SUCCESS;
3397
3398         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
3399                 return _SUCCESS;
3400
3401         del_timer_sync(&pmlmeext->link_timer);
3402
3403         /* status */
3404         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
3405         if (status > 0) {
3406                 DBG_88E("assoc reject, status code: %d\n", status);
3407                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
3408                 res = -4;
3409                 goto report_assoc_result;
3410         }
3411
3412         /* get capabilities */
3413         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3414
3415         /* set slot time */
3416         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
3417
3418         /* AID */
3419         pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
3420         res = pmlmeinfo->aid;
3421
3422         /* following are moved to join event callback function */
3423         /* to handle HT, WMM, rate adaptive, update MAC reg */
3424         /* for not to handle the synchronous IO in the tasklet */
3425         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
3426                 pIE = (struct ndis_802_11_var_ie *)(pframe + i);
3427
3428                 switch (pIE->ElementID) {
3429                 case _VENDOR_SPECIFIC_IE_:
3430                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6)) /* WMM */
3431                                 WMM_param_handler(padapter, pIE);
3432                         break;
3433                 case _HT_CAPABILITY_IE_:        /* HT caps */
3434                         HT_caps_handler(padapter, pIE);
3435                         break;
3436                 case _HT_EXTRA_INFO_IE_:        /* HT info */
3437                         HT_info_handler(padapter, pIE);
3438                         break;
3439                 case _ERPINFO_IE_:
3440                         ERP_IE_handler(padapter, pIE);
3441                 default:
3442                         break;
3443                 }
3444
3445                 i += (pIE->Length + 2);
3446         }
3447
3448         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
3449         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
3450
3451         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
3452
3453 report_assoc_result:
3454         if (res > 0) {
3455                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
3456         } else {
3457                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
3458         }
3459
3460         report_join_res(padapter, res);
3461
3462         return _SUCCESS;
3463 }
3464
3465 static unsigned int OnDeAuth(struct adapter *padapter,
3466                              struct recv_frame *precv_frame)
3467 {
3468         unsigned short  reason;
3469         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3470         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3471         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3472         u8 *pframe = precv_frame->rx_data;
3473         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3474
3475         /* check A3 */
3476         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3477                 return _SUCCESS;
3478
3479         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3480
3481         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3482
3483 #ifdef CONFIG_88EU_AP_MODE
3484         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3485                 struct sta_info *psta;
3486                 struct sta_priv *pstapriv = &padapter->stapriv;
3487
3488                 DBG_88E_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
3489                               reason, GetAddr2Ptr(pframe));
3490
3491                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3492                 if (psta) {
3493                         u8 updated = 0;
3494
3495                         spin_lock_bh(&pstapriv->asoc_list_lock);
3496                         if (!list_empty(&psta->asoc_list)) {
3497                                 list_del_init(&psta->asoc_list);
3498                                 pstapriv->asoc_list_cnt--;
3499                                 updated = ap_free_sta(padapter, psta, false, reason);
3500                         }
3501                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3502
3503                         associated_clients_update(padapter, updated);
3504                 }
3505
3506
3507                 return _SUCCESS;
3508         } else
3509 #endif
3510         {
3511                 DBG_88E_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM\n",
3512                               reason, GetAddr3Ptr(pframe));
3513
3514                 receive_disconnect(padapter, GetAddr3Ptr(pframe) , reason);
3515         }
3516         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3517         return _SUCCESS;
3518 }
3519
3520 static unsigned int OnDisassoc(struct adapter *padapter,
3521                                struct recv_frame *precv_frame)
3522 {
3523         u16 reason;
3524         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3525         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3526         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3527         u8 *pframe = precv_frame->rx_data;
3528         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3529
3530         /* check A3 */
3531         if (memcmp(GetAddr3Ptr(pframe), pnetwork->MacAddress, ETH_ALEN))
3532                 return _SUCCESS;
3533
3534         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
3535
3536         DBG_88E("%s Reason code(%d)\n", __func__, reason);
3537
3538 #ifdef CONFIG_88EU_AP_MODE
3539         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
3540                 struct sta_info *psta;
3541                 struct sta_priv *pstapriv = &padapter->stapriv;
3542
3543                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3544                               reason, GetAddr2Ptr(pframe));
3545
3546                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3547                 if (psta) {
3548                         u8 updated = 0;
3549
3550                         spin_lock_bh(&pstapriv->asoc_list_lock);
3551                         if (!list_empty(&psta->asoc_list)) {
3552                                 list_del_init(&psta->asoc_list);
3553                                 pstapriv->asoc_list_cnt--;
3554                                 updated = ap_free_sta(padapter, psta, false, reason);
3555                         }
3556                         spin_unlock_bh(&pstapriv->asoc_list_lock);
3557
3558                         associated_clients_update(padapter, updated);
3559                 }
3560
3561                 return _SUCCESS;
3562         } else
3563 #endif
3564         {
3565                 DBG_88E_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
3566                               reason, GetAddr3Ptr(pframe));
3567
3568                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
3569         }
3570         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
3571         return _SUCCESS;
3572 }
3573
3574 static unsigned int OnAtim(struct adapter *padapter,
3575                            struct recv_frame *precv_frame)
3576 {
3577         DBG_88E("%s\n", __func__);
3578         return _SUCCESS;
3579 }
3580
3581 static unsigned int on_action_spct(struct adapter *padapter,
3582                                    struct recv_frame *precv_frame)
3583 {
3584         struct sta_info *psta = NULL;
3585         struct sta_priv *pstapriv = &padapter->stapriv;
3586         u8 *pframe = precv_frame->rx_data;
3587         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3588         u8 category;
3589         u8 action;
3590
3591         DBG_88E(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
3592
3593         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
3594
3595         if (!psta)
3596                 goto exit;
3597
3598         category = frame_body[0];
3599         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
3600                 goto exit;
3601
3602         action = frame_body[1];
3603         switch (action) {
3604         case RTW_WLAN_ACTION_SPCT_MSR_REQ:
3605         case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
3606         case RTW_WLAN_ACTION_SPCT_TPC_REQ:
3607         case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
3608                 break;
3609         case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
3610                 break;
3611         default:
3612                 break;
3613         }
3614
3615 exit:
3616         return _FAIL;
3617 }
3618
3619 static unsigned int OnAction_qos(struct adapter *padapter,
3620                                  struct recv_frame *precv_frame)
3621 {
3622         return _SUCCESS;
3623 }
3624
3625 static unsigned int OnAction_dls(struct adapter *padapter,
3626                                  struct recv_frame *precv_frame)
3627 {
3628         return _SUCCESS;
3629 }
3630
3631 static unsigned int OnAction_back(struct adapter *padapter,
3632                                   struct recv_frame *precv_frame)
3633 {
3634         u8 *addr;
3635         struct sta_info *psta = NULL;
3636         struct recv_reorder_ctrl *preorder_ctrl;
3637         unsigned char           *frame_body;
3638         unsigned char           category, action;
3639         unsigned short  tid, status, reason_code = 0;
3640         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3641         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3642         u8 *pframe = precv_frame->rx_data;
3643         struct sta_priv *pstapriv = &padapter->stapriv;
3644         /* check RA matches or not */
3645         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe),
3646                    ETH_ALEN))/* for if1, sta/ap mode */
3647                 return _SUCCESS;
3648
3649         DBG_88E("%s\n", __func__);
3650
3651         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3652                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3653                         return _SUCCESS;
3654
3655         addr = GetAddr2Ptr(pframe);
3656         psta = rtw_get_stainfo(pstapriv, addr);
3657
3658         if (psta == NULL)
3659                 return _SUCCESS;
3660
3661         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3662
3663         category = frame_body[0];
3664         if (category == RTW_WLAN_CATEGORY_BACK) { /*  representing Block Ack */
3665                 if (!pmlmeinfo->HT_enable)
3666                         return _SUCCESS;
3667                 action = frame_body[1];
3668                 DBG_88E("%s, action=%d\n", __func__, action);
3669                 switch (action) {
3670                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
3671                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
3672                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
3673
3674                         /* 37 = reject ADDBA Req */
3675                         issue_action_BA(padapter, addr,
3676                                         RTW_WLAN_ACTION_ADDBA_RESP,
3677                                         pmlmeinfo->accept_addba_req ? 0 : 37);
3678                         break;
3679                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
3680                         status = get_unaligned_le16(&frame_body[3]);
3681                         tid = (frame_body[5] >> 2) & 0x7;
3682                         if (status == 0) {      /* successful */
3683                                 DBG_88E("agg_enable for TID=%d\n", tid);
3684                                 psta->htpriv.agg_enable_bitmap |= 1 << tid;
3685                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3686                         } else {
3687                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3688                         }
3689                         break;
3690                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
3691                         if ((frame_body[3] & BIT(3)) == 0) {
3692                                 psta->htpriv.agg_enable_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3693                                 psta->htpriv.candidate_tid_bitmap &= ~(1 << ((frame_body[3] >> 4) & 0xf));
3694                                 reason_code = get_unaligned_le16(&frame_body[4]);
3695                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
3696                                 tid = (frame_body[3] >> 4) & 0x0F;
3697                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
3698                                 preorder_ctrl->enable = false;
3699                                 preorder_ctrl->indicate_seq = 0xffff;
3700                         }
3701                         DBG_88E("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
3702                         /* todo: how to notify the host while receiving DELETE BA */
3703                         break;
3704                 default:
3705                         break;
3706                 }
3707         }
3708         return _SUCCESS;
3709 }
3710
3711 static s32 rtw_action_public_decache(struct recv_frame *recv_frame, s32 token)
3712 {
3713         struct adapter *adapter = recv_frame->adapter;
3714         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
3715         u8 *frame = recv_frame->rx_data;
3716         u16 seq_ctrl = ((recv_frame->attrib.seq_num&0xffff) << 4) |
3717                 (recv_frame->attrib.frag_num & 0xf);
3718
3719         if (GetRetry(frame)) {
3720                 if (token >= 0) {
3721                         if ((seq_ctrl == mlmeext->action_public_rxseq) && (token == mlmeext->action_public_dialog_token)) {
3722                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
3723                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
3724                                 return _FAIL;
3725                         }
3726                 } else {
3727                         if (seq_ctrl == mlmeext->action_public_rxseq) {
3728                                 DBG_88E(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
3729                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
3730                                 return _FAIL;
3731                         }
3732                 }
3733         }
3734
3735         mlmeext->action_public_rxseq = seq_ctrl;
3736
3737         if (token >= 0)
3738                 mlmeext->action_public_dialog_token = token;
3739
3740         return _SUCCESS;
3741 }
3742
3743 static unsigned int on_action_public_p2p(struct recv_frame *precv_frame)
3744 {
3745         u8 *pframe = precv_frame->rx_data;
3746         u8 *frame_body;
3747         u8 dialogToken = 0;
3748         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3749
3750         dialogToken = frame_body[7];
3751
3752         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
3753                 return _FAIL;
3754
3755         return _SUCCESS;
3756 }
3757
3758 static unsigned int on_action_public_vendor(struct recv_frame *precv_frame)
3759 {
3760         unsigned int ret = _FAIL;
3761         u8 *pframe = precv_frame->rx_data;
3762         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3763
3764         if (!memcmp(frame_body + 2, P2P_OUI, 4))
3765                 ret = on_action_public_p2p(precv_frame);
3766
3767         return ret;
3768 }
3769
3770 static unsigned int on_action_public_default(struct recv_frame *precv_frame, u8 action)
3771 {
3772         unsigned int ret = _FAIL;
3773         u8 *pframe = precv_frame->rx_data;
3774         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3775         u8 token;
3776
3777         token = frame_body[2];
3778
3779         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
3780                 goto exit;
3781
3782         ret = _SUCCESS;
3783
3784 exit:
3785         return ret;
3786 }
3787
3788 static unsigned int on_action_public(struct adapter *padapter,
3789                                      struct recv_frame *precv_frame)
3790 {
3791         unsigned int ret = _FAIL;
3792         u8 *pframe = precv_frame->rx_data;
3793         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
3794         u8 category, action;
3795
3796         /* check RA matches or not */
3797         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
3798                 goto exit;
3799
3800         category = frame_body[0];
3801         if (category != RTW_WLAN_CATEGORY_PUBLIC)
3802                 goto exit;
3803
3804         action = frame_body[1];
3805         switch (action) {
3806         case ACT_PUBLIC_VENDOR:
3807                 ret = on_action_public_vendor(precv_frame);
3808                 break;
3809         default:
3810                 ret = on_action_public_default(precv_frame, action);
3811                 break;
3812         }
3813
3814 exit:
3815         return ret;
3816 }
3817
3818 static unsigned int OnAction_ht(struct adapter *padapter,
3819                                 struct recv_frame *precv_frame)
3820 {
3821         return _SUCCESS;
3822 }
3823
3824 static unsigned int OnAction_wmm(struct adapter *padapter,
3825                                  struct recv_frame *precv_frame)
3826 {
3827         return _SUCCESS;
3828 }
3829
3830 static unsigned int OnAction_p2p(struct adapter *padapter,
3831                                  struct recv_frame *precv_frame)
3832 {
3833         return _SUCCESS;
3834 }
3835
3836 static unsigned int DoReserved(struct adapter *padapter,
3837                                struct recv_frame *precv_frame)
3838 {
3839         return _SUCCESS;
3840 }
3841
3842 static struct action_handler OnAction_tbl[] = {
3843         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
3844         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &OnAction_qos},
3845         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &OnAction_dls},
3846         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
3847         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
3848         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
3849         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
3850         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
3851         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &DoReserved},
3852         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &OnAction_wmm},
3853         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &OnAction_p2p},
3854 };
3855
3856 static unsigned int OnAction(struct adapter *padapter,
3857                              struct recv_frame *precv_frame)
3858 {
3859         int i;
3860         unsigned char   category;
3861         struct action_handler *ptable;
3862         unsigned char   *frame_body;
3863         u8 *pframe = precv_frame->rx_data;
3864
3865         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
3866
3867         category = frame_body[0];
3868
3869         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
3870                 ptable = &OnAction_tbl[i];
3871                 if (category == ptable->num)
3872                         ptable->func(padapter, precv_frame);
3873         }
3874         return _SUCCESS;
3875 }
3876
3877 /****************************************************************************
3878
3879 Following are the initialization functions for WiFi MLME
3880
3881 *****************************************************************************/
3882
3883 static struct mlme_handler mlme_sta_tbl[] = {
3884         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
3885         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
3886         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
3887         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
3888         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
3889         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
3890
3891         /*----------------------------------------------------------
3892                                         below 2 are reserved
3893         -----------------------------------------------------------*/
3894         {0,                                     "DoReserved",           &DoReserved},
3895         {0,                                     "DoReserved",           &DoReserved},
3896         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
3897         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
3898         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
3899         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
3900         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
3901         {WIFI_ACTION,           "OnAction",             &OnAction},
3902 };
3903
3904 int init_hw_mlme_ext(struct adapter *padapter)
3905 {
3906         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3907
3908         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3909         return _SUCCESS;
3910 }
3911
3912 static void init_mlme_ext_priv_value(struct adapter *padapter)
3913 {
3914         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
3915         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
3916         unsigned char   mixed_datarate[NumRates] = {
3917                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3918                 _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_,
3919                  _48M_RATE_, _54M_RATE_, 0xff
3920         };
3921         unsigned char   mixed_basicrate[NumRates] = {
3922                 _1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_,
3923                 _12M_RATE_, _24M_RATE_, 0xff,
3924         };
3925
3926         atomic_set(&pmlmeext->event_seq, 0);
3927         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
3928
3929         pmlmeext->cur_channel = padapter->registrypriv.channel;
3930         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
3931         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
3932         pmlmeext->oper_channel = pmlmeext->cur_channel;
3933         pmlmeext->oper_bwmode = pmlmeext->cur_bwmode;
3934         pmlmeext->oper_ch_offset = pmlmeext->cur_ch_offset;
3935         pmlmeext->retry = 0;
3936
3937         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
3938
3939         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
3940         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
3941
3942         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
3943
3944         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3945         pmlmeext->sitesurvey_res.channel_idx = 0;
3946         pmlmeext->sitesurvey_res.bss_cnt = 0;
3947         pmlmeext->scan_abort = false;
3948
3949         pmlmeinfo->state = WIFI_FW_NULL_STATE;
3950         pmlmeinfo->reauth_count = 0;
3951         pmlmeinfo->reassoc_count = 0;
3952         pmlmeinfo->link_count = 0;
3953         pmlmeinfo->auth_seq = 0;
3954         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
3955         pmlmeinfo->key_index = 0;
3956         pmlmeinfo->iv = 0;
3957
3958         pmlmeinfo->enc_algo = _NO_PRIVACY_;
3959         pmlmeinfo->authModeToggle = 0;
3960
3961         memset(pmlmeinfo->chg_txt, 0, 128);
3962
3963         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
3964         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
3965
3966         pmlmeinfo->dialogToken = 0;
3967
3968         pmlmeext->action_public_rxseq = 0xffff;
3969         pmlmeext->action_public_dialog_token = 0xff;
3970 }
3971
3972 static int has_channel(struct rt_channel_info *channel_set,
3973                                            u8 chanset_size,
3974                                            u8 chan) {
3975         int i;
3976
3977         for (i = 0; i < chanset_size; i++) {
3978                 if (channel_set[i].ChannelNum == chan)
3979                         return 1;
3980         }
3981         return 0;
3982 }
3983
3984 static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
3985                                                           u8 chanset_size,
3986                                                           struct p2p_channels *channel_list) {
3987         struct p2p_oper_class_map op_class[] = {
3988                 { IEEE80211G,  81,   1,  13,  1, BW20 },
3989                 { IEEE80211G,  82,  14,  14,  1, BW20 },
3990                 { -1, 0, 0, 0, 0, BW20 }
3991         };
3992
3993         int cla, op;
3994
3995         cla = 0;
3996
3997         for (op = 0; op_class[op].op_class; op++) {
3998                 u8 ch;
3999                 struct p2p_oper_class_map *o = &op_class[op];
4000                 struct p2p_reg_class *reg = NULL;
4001
4002                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
4003                         if (!has_channel(channel_set, chanset_size, ch)) {
4004                                 continue;
4005                         }
4006
4007                         if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
4008                                 continue;
4009
4010                         if ((0 == (padapter->registrypriv.cbw40_enable & BIT(1))) &&
4011                             ((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
4012                                 continue;
4013
4014                         if (reg == NULL) {
4015                                 reg = &channel_list->reg_class[cla];
4016                                 cla++;
4017                                 reg->reg_class = o->op_class;
4018                                 reg->channels = 0;
4019                         }
4020                         reg->channel[reg->channels] = ch;
4021                         reg->channels++;
4022                 }
4023         }
4024         channel_list->reg_classes = cla;
4025 }
4026
4027 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
4028 {
4029         u8 index, chanset_size = 0;
4030         u8 b2_4GBand = false;
4031         u8 Index2G = 0;
4032
4033         memset(channel_set, 0, sizeof(struct rt_channel_info) * MAX_CHANNEL_NUM);
4034
4035         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
4036                 DBG_88E("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
4037                 return chanset_size;
4038         }
4039
4040         if (padapter->registrypriv.wireless_mode & WIRELESS_11G) {
4041                 b2_4GBand = true;
4042                 if (RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
4043                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
4044                 else
4045                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
4046         }
4047
4048         if (b2_4GBand) {
4049                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
4050                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
4051
4052                         if ((RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) ||/* Channel 1~11 is active, and 12~14 is passive */
4053                             (RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN_2G == ChannelPlan)) {
4054                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
4055                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4056                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
4057                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
4058                         } else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
4059                                    RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) {/*  channel 12~13, passive scan */
4060                                 if (channel_set[chanset_size].ChannelNum <= 11)
4061                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4062                                 else
4063                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
4064                         } else {
4065                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
4066                         }
4067
4068                         chanset_size++;
4069                 }
4070         }
4071         return chanset_size;
4072 }
4073
4074 int     init_mlme_ext_priv(struct adapter *padapter)
4075 {
4076         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4077         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4078         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4079         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4080
4081         pmlmeext->padapter = padapter;
4082
4083         init_mlme_ext_priv_value(padapter);
4084         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
4085
4086         init_mlme_ext_timer(padapter);
4087
4088 #ifdef CONFIG_88EU_AP_MODE
4089         init_mlme_ap_info(padapter);
4090 #endif
4091
4092         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
4093         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
4094
4095         pmlmeext->chan_scan_time = SURVEY_TO;
4096         pmlmeext->mlmeext_init = true;
4097
4098
4099         pmlmeext->active_keep_alive_check = true;
4100
4101         return _SUCCESS;
4102 }
4103
4104 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
4105 {
4106         struct adapter *padapter = pmlmeext->padapter;
4107
4108         if (!padapter)
4109                 return;
4110
4111         if (padapter->bDriverStopped) {
4112                 del_timer_sync(&pmlmeext->survey_timer);
4113                 del_timer_sync(&pmlmeext->link_timer);
4114         }
4115 }
4116
4117 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, struct recv_frame *precv_frame)
4118 {
4119         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4120         u8 *pframe = precv_frame->rx_data;
4121
4122         if (ptable->func) {
4123                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4124                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4125                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4126                         return;
4127                 ptable->func(padapter, precv_frame);
4128         }
4129 }
4130
4131 void mgt_dispatcher(struct adapter *padapter, struct recv_frame *precv_frame)
4132 {
4133         int index;
4134         struct mlme_handler *ptable;
4135 #ifdef CONFIG_88EU_AP_MODE
4136         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4137 #endif /* CONFIG_88EU_AP_MODE */
4138         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
4139         u8 *pframe = precv_frame->rx_data;
4140         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
4141
4142         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
4143                  ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
4144                   (unsigned int)GetFrameType(pframe),
4145                   (unsigned int)GetFrameSubType(pframe)));
4146
4147         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
4148                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_,
4149                          ("mgt_dispatcher: type(0x%x) error!\n",
4150                           (unsigned int)GetFrameType(pframe)));
4151                 return;
4152         }
4153
4154         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
4155         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
4156             memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
4157                 return;
4158
4159         ptable = mlme_sta_tbl;
4160
4161         index = GetFrameSubType(pframe) >> 4;
4162
4163         if (index > 13) {
4164                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type=%d\n", index));
4165                 return;
4166         }
4167         ptable += index;
4168
4169         if (psta != NULL) {
4170                 if (GetRetry(pframe)) {
4171                         if (precv_frame->attrib.seq_num ==
4172                             psta->RxMgmtFrameSeqNum) {
4173                                 /* drop the duplicate management frame */
4174                                 DBG_88E("Drop duplicate management frame with seq_num=%d.\n",
4175                                         precv_frame->attrib.seq_num);
4176                                 return;
4177                         }
4178                 }
4179                 psta->RxMgmtFrameSeqNum = precv_frame->attrib.seq_num;
4180         }
4181
4182 #ifdef CONFIG_88EU_AP_MODE
4183         switch (GetFrameSubType(pframe)) {
4184         case WIFI_AUTH:
4185                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
4186                         ptable->func = &OnAuth;
4187                 else
4188                         ptable->func = &OnAuthClient;
4189                 /* fall through */
4190         case WIFI_ASSOCREQ:
4191         case WIFI_REASSOCREQ:
4192         case WIFI_PROBEREQ:
4193         case WIFI_BEACON:
4194         case WIFI_ACTION:
4195                 _mgt_dispatcher(padapter, ptable, precv_frame);
4196                 break;
4197         default:
4198                 _mgt_dispatcher(padapter, ptable, precv_frame);
4199                 break;
4200         }
4201 #else
4202         _mgt_dispatcher(padapter, ptable, precv_frame);
4203 #endif
4204 }
4205
4206 /****************************************************************************
4207
4208 Following are the functions to report events
4209
4210 *****************************************************************************/
4211
4212 void report_survey_event(struct adapter *padapter,
4213                          struct recv_frame *precv_frame)
4214 {
4215         struct cmd_obj *pcmd_obj;
4216         u8 *pevtcmd;
4217         u32 cmdsz;
4218         struct survey_event     *psurvey_evt;
4219         struct C2HEvent_Header *pc2h_evt_hdr;
4220         struct mlme_ext_priv *pmlmeext;
4221         struct cmd_priv *pcmdpriv;
4222
4223         if (!padapter)
4224                 return;
4225
4226         pmlmeext = &padapter->mlmeextpriv;
4227         pcmdpriv = &padapter->cmdpriv;
4228
4229
4230         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4231         if (!pcmd_obj)
4232                 return;
4233
4234         cmdsz = sizeof(struct survey_event) + sizeof(struct C2HEvent_Header);
4235         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4236         if (!pevtcmd) {
4237                 kfree(pcmd_obj);
4238                 return;
4239         }
4240
4241         INIT_LIST_HEAD(&pcmd_obj->list);
4242
4243         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4244         pcmd_obj->cmdsz = cmdsz;
4245         pcmd_obj->parmbuf = pevtcmd;
4246
4247         pcmd_obj->rsp = NULL;
4248         pcmd_obj->rspsz  = 0;
4249
4250         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4251         pc2h_evt_hdr->len = sizeof(struct survey_event);
4252         pc2h_evt_hdr->ID = _Survey_EVT_;
4253         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4254
4255         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4256
4257         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4258                 kfree(pcmd_obj);
4259                 kfree(pevtcmd);
4260                 return;
4261         }
4262
4263         process_80211d(padapter, &psurvey_evt->bss);
4264
4265         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4266
4267         pmlmeext->sitesurvey_res.bss_cnt++;
4268 }
4269
4270 void report_surveydone_event(struct adapter *padapter)
4271 {
4272         struct cmd_obj *pcmd_obj;
4273         u8 *pevtcmd;
4274         u32 cmdsz;
4275         struct surveydone_event *psurveydone_evt;
4276         struct C2HEvent_Header  *pc2h_evt_hdr;
4277         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4278         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4279
4280         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4281         if (!pcmd_obj)
4282                 return;
4283
4284         cmdsz = sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header);
4285         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4286         if (!pevtcmd) {
4287                 kfree(pcmd_obj);
4288                 return;
4289         }
4290
4291         INIT_LIST_HEAD(&pcmd_obj->list);
4292
4293         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4294         pcmd_obj->cmdsz = cmdsz;
4295         pcmd_obj->parmbuf = pevtcmd;
4296
4297         pcmd_obj->rsp = NULL;
4298         pcmd_obj->rspsz  = 0;
4299
4300         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4301         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4302         pc2h_evt_hdr->ID = _SurveyDone_EVT_;
4303         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4304
4305         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4306         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4307
4308         DBG_88E("survey done event(%x)\n", psurveydone_evt->bss_cnt);
4309
4310         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4311 }
4312
4313 void report_join_res(struct adapter *padapter, int res)
4314 {
4315         struct cmd_obj *pcmd_obj;
4316         u8 *pevtcmd;
4317         u32 cmdsz;
4318         struct joinbss_event            *pjoinbss_evt;
4319         struct C2HEvent_Header  *pc2h_evt_hdr;
4320         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4321         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4322         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4323
4324         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4325         if (!pcmd_obj)
4326                 return;
4327
4328         cmdsz = sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header);
4329         pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);
4330         if (!pevtcmd) {
4331                 kfree(pcmd_obj);
4332                 return;
4333         }
4334
4335         INIT_LIST_HEAD(&pcmd_obj->list);
4336
4337         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4338         pcmd_obj->cmdsz = cmdsz;
4339         pcmd_obj->parmbuf = pevtcmd;
4340
4341         pcmd_obj->rsp = NULL;
4342         pcmd_obj->rspsz  = 0;
4343
4344         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4345         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4346         pc2h_evt_hdr->ID = _JoinBss_EVT_;
4347         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4348
4349         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4350         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4351         pjoinbss_evt->network.join_res  = res;
4352         pjoinbss_evt->network.aid = res;
4353
4354         DBG_88E("report_join_res(%d)\n", res);
4355
4356
4357         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4358
4359
4360         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4361 }
4362
4363 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4364 {
4365         struct cmd_obj *pcmd_obj;
4366         u8 *pevtcmd;
4367         u32 cmdsz;
4368         struct sta_info *psta;
4369         int     mac_id;
4370         struct stadel_event                     *pdel_sta_evt;
4371         struct C2HEvent_Header  *pc2h_evt_hdr;
4372         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4373         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4374
4375         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4376         if (!pcmd_obj)
4377                 return;
4378
4379         cmdsz = sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header);
4380         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4381         if (!pevtcmd) {
4382                 kfree(pcmd_obj);
4383                 return;
4384         }
4385
4386         INIT_LIST_HEAD(&pcmd_obj->list);
4387
4388         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4389         pcmd_obj->cmdsz = cmdsz;
4390         pcmd_obj->parmbuf = pevtcmd;
4391
4392         pcmd_obj->rsp = NULL;
4393         pcmd_obj->rspsz  = 0;
4394
4395         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4396         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4397         pc2h_evt_hdr->ID = _DelSTA_EVT_;
4398         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4399
4400         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4401         ether_addr_copy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr);
4402         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4403
4404
4405         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4406         if (psta)
4407                 mac_id = (int)psta->mac_id;
4408         else
4409                 mac_id = -1;
4410
4411         pdel_sta_evt->mac_id = mac_id;
4412
4413         DBG_88E("report_del_sta_event: delete STA, mac_id =%d\n", mac_id);
4414
4415         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4416 }
4417
4418 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
4419 {
4420         struct cmd_obj *pcmd_obj;
4421         u8 *pevtcmd;
4422         u32 cmdsz;
4423         struct stassoc_event            *padd_sta_evt;
4424         struct C2HEvent_Header  *pc2h_evt_hdr;
4425         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4426         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4427
4428         pcmd_obj = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
4429         if (!pcmd_obj)
4430                 return;
4431
4432         cmdsz = sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header);
4433         pevtcmd = kzalloc(cmdsz, GFP_KERNEL);
4434         if (!pevtcmd) {
4435                 kfree(pcmd_obj);
4436                 return;
4437         }
4438
4439         INIT_LIST_HEAD(&pcmd_obj->list);
4440
4441         pcmd_obj->cmdcode = _Set_MLME_EVT_CMD_;
4442         pcmd_obj->cmdsz = cmdsz;
4443         pcmd_obj->parmbuf = pevtcmd;
4444
4445         pcmd_obj->rsp = NULL;
4446         pcmd_obj->rspsz  = 0;
4447
4448         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4449         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4450         pc2h_evt_hdr->ID = _AddSTA_EVT_;
4451         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4452
4453         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4454         ether_addr_copy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr);
4455         padd_sta_evt->cam_id = cam_idx;
4456
4457         DBG_88E("report_add_sta_event: add STA\n");
4458
4459         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4460 }
4461
4462
4463 /****************************************************************************
4464
4465 Following are the event callback functions
4466
4467 *****************************************************************************/
4468
4469 /* for sta/adhoc mode */
4470 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4471 {
4472         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4473         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4474         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4475
4476         /* ERP */
4477         VCS_update(padapter, psta);
4478
4479         /* HT */
4480         if (pmlmepriv->htpriv.ht_option) {
4481                 psta->htpriv.ht_option = true;
4482
4483                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4484
4485                 if (support_short_GI(padapter, &pmlmeinfo->HT_caps))
4486                         psta->htpriv.sgi = true;
4487
4488                 psta->qos_option = true;
4489         } else {
4490                 psta->htpriv.ht_option = false;
4491
4492                 psta->htpriv.ampdu_enable = false;
4493
4494                 psta->htpriv.sgi = false;
4495                 psta->qos_option = false;
4496         }
4497         psta->htpriv.bwmode = pmlmeext->cur_bwmode;
4498         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4499
4500         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4501         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4502
4503         /* QoS */
4504         if (pmlmepriv->qospriv.qos_option)
4505                 psta->qos_option = true;
4506
4507
4508         psta->state = _FW_LINKED;
4509 }
4510
4511 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4512 {
4513         struct sta_info         *psta, *psta_bmc;
4514         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4515         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4516         struct wlan_bssid_ex *cur_network = &(pmlmeinfo->network);
4517         struct sta_priv         *pstapriv = &padapter->stapriv;
4518         u8 join_type;
4519         u16 media_status;
4520
4521         if (join_res < 0) {
4522                 join_type = 1;
4523                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4524                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4525
4526                 /* restore to initial setting. */
4527                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4528
4529                 goto exit_mlmeext_joinbss_event_callback;
4530         }
4531
4532         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4533                 /* for bc/mc */
4534                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
4535                 if (psta_bmc) {
4536                         pmlmeinfo->FW_sta_info[psta_bmc->mac_id].psta = psta_bmc;
4537                         update_bmc_sta_support_rate(padapter, psta_bmc->mac_id);
4538                         Update_RA_Entry(padapter, psta_bmc->mac_id);
4539                 }
4540         }
4541
4542
4543         /* turn on dynamic functions */
4544         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4545
4546         /*  update IOT-related issue */
4547         update_IOT_info(padapter);
4548
4549         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
4550
4551         /* BCN interval */
4552         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4553
4554         /* update capability */
4555         update_capinfo(padapter, pmlmeinfo->capability);
4556
4557         /* WMM, Update EDCA param */
4558         WMMOnAssocRsp(padapter);
4559
4560         /* HT */
4561         HTOnAssocRsp(padapter);
4562
4563         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4564
4565         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
4566         if (psta) { /* only for infra. mode */
4567                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4568
4569                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4570
4571                 /* set per sta rate after updating HT cap. */
4572                 set_sta_rate(padapter, psta);
4573                 rtw_hal_set_hwreg(padapter, HW_VAR_TX_RPT_MAX_MACID, (u8 *)&psta->mac_id);
4574                 media_status = (psta->mac_id<<8)|1; /*   MACID|OPMODE: 1 means connect */
4575                 rtw_hal_set_hwreg(padapter, HW_VAR_H2C_MEDIA_STATUS_RPT, (u8 *)&media_status);
4576         }
4577
4578         join_type = 2;
4579         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4580
4581         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4582                 /*  correcting TSF */
4583                 correct_TSF(padapter, pmlmeext);
4584         }
4585         rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4586
4587 exit_mlmeext_joinbss_event_callback:
4588
4589         DBG_88E("=>%s\n", __func__);
4590 }
4591
4592 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4593 {
4594         struct mlme_ext_priv    *pmlmeext = &(padapter->mlmeextpriv);
4595         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4596         u8 join_type;
4597
4598         DBG_88E("%s\n", __func__);
4599
4600         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4601                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {/* adhoc master or sta_count>1 */
4602                         /* nothing to do */
4603                 } else { /* adhoc client */
4604                         /*  correcting TSF */
4605                         correct_TSF(padapter, pmlmeext);
4606
4607                         /* start beacon */
4608                         if (send_beacon(padapter) == _FAIL) {
4609                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4610                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4611                                 return;
4612                         }
4613                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4614                 }
4615
4616                 join_type = 2;
4617                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4618         }
4619
4620         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4621
4622         /* rate radaptive */
4623         Update_RA_Entry(padapter, psta->mac_id);
4624
4625         /* update adhoc sta_info */
4626         update_sta_info(padapter, psta);
4627 }
4628
4629 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4630 {
4631         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4632         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4633
4634         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter)) {
4635                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4636                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4637
4638                 /* restore to initial setting. */
4639                 update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
4640
4641                 /* switch to the 20M Hz mode after disconnect */
4642                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4643                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4644
4645                 /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4646                 set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4647
4648
4649                 flush_all_cam_entry(padapter);
4650
4651                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4652
4653                 /* set MSR to no link state -> infra. mode */
4654                 Set_MSR(padapter, _HW_STATE_STATION_);
4655
4656                 del_timer_sync(&pmlmeext->link_timer);
4657         }
4658 }
4659
4660 /****************************************************************************
4661
4662 Following are the functions for the timer handlers
4663
4664 *****************************************************************************/
4665 void _linked_rx_signal_strehgth_display(struct adapter *padapter);
4666 void _linked_rx_signal_strehgth_display(struct adapter *padapter)
4667 {
4668         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4669       struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4670         u8 mac_id;
4671         int UndecoratedSmoothedPWDB;
4672         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
4673                 mac_id = 0;
4674         else if ((pmlmeinfo->state&0x03) == _HW_STATE_AP_)
4675                 mac_id = 2;
4676
4677         rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &mac_id);
4678
4679         rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
4680         DBG_88E("UndecoratedSmoothedPWDB:%d\n", UndecoratedSmoothedPWDB);
4681 }
4682
4683 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4684 {
4685         u8 ret = false;
4686
4687         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta)) &&
4688             sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta) &&
4689             sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta))
4690                 ret = false;
4691         else
4692                 ret = true;
4693
4694         sta_update_last_rx_pkts(psta);
4695
4696         return ret;
4697 }
4698
4699 void linked_status_chk(struct adapter *padapter)
4700 {
4701         u32     i;
4702         struct sta_info         *psta;
4703         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
4704         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4705         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4706         struct sta_priv         *pstapriv = &padapter->stapriv;
4707
4708         if (padapter->bRxRSSIDisplay)
4709                 _linked_rx_signal_strehgth_display(padapter);
4710
4711         if (is_client_associated_to_ap(padapter)) {
4712                 /* linked infrastructure client mode */
4713
4714                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
4715                 int rx_chk_limit;
4716
4717                 rx_chk_limit = 4;
4718                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
4719                 if (psta != NULL) {
4720                         bool is_p2p_enable = false;
4721
4722                         if (!chk_ap_is_alive(padapter, psta))
4723                                 rx_chk = _FAIL;
4724
4725                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
4726                                 tx_chk = _FAIL;
4727
4728                         if (pmlmeext->active_keep_alive_check && (rx_chk == _FAIL || tx_chk == _FAIL)) {
4729                                 u8 backup_oper_channel = 0;
4730
4731                                 /* switch to correct channel of current network  before issue keep-alive frames */
4732                                 if (rtw_get_oper_ch(padapter) != pmlmeext->cur_channel) {
4733                                         backup_oper_channel = rtw_get_oper_ch(padapter);
4734                                         SelectChannel(padapter, pmlmeext->cur_channel);
4735                                 }
4736
4737                                 if (rx_chk != _SUCCESS)
4738                                         issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, psta->hwaddr, 3, 1);
4739
4740                                 if ((tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) || rx_chk != _SUCCESS) {
4741                                         tx_chk = issue_nulldata(padapter, psta->hwaddr, 0, 3, 1);
4742                                         /* if tx acked and p2p disabled, set rx_chk _SUCCESS to reset retry count */
4743                                         if (tx_chk == _SUCCESS && !is_p2p_enable)
4744                                                 rx_chk = _SUCCESS;
4745                                 }
4746
4747                                 /* back to the original operation channel */
4748                                 if (backup_oper_channel > 0)
4749                                         SelectChannel(padapter, backup_oper_channel);
4750                         } else {
4751                                 if (rx_chk != _SUCCESS) {
4752                                         if (pmlmeext->retry == 0) {
4753                                                 issue_probereq(padapter,
4754                                                 &pmlmeinfo->network.Ssid,
4755                                                 pmlmeinfo->network.MacAddress,
4756                                                                         false);
4757                                                 issue_probereq(padapter,
4758                                                 &pmlmeinfo->network.Ssid,
4759                                                 pmlmeinfo->network.MacAddress,
4760                                                                         false);
4761                                                 issue_probereq(padapter,
4762                                                 &pmlmeinfo->network.Ssid,
4763                                                 pmlmeinfo->network.MacAddress,
4764                                                                         false);
4765                                         }
4766                                 }
4767
4768                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == 0xf) {
4769                                         tx_chk = issue_nulldata(padapter, NULL, 0, 1, 0);
4770                                 }
4771                         }
4772
4773                         if (rx_chk == _FAIL) {
4774                                 pmlmeext->retry++;
4775                                 if (pmlmeext->retry > rx_chk_limit) {
4776                                         DBG_88E_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
4777                                                       FUNC_ADPT_ARG(padapter));
4778                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress,
4779                                                            WLAN_REASON_EXPIRATION_CHK);
4780                                         return;
4781                                 }
4782                         } else {
4783                                 pmlmeext->retry = 0;
4784                         }
4785
4786                         if (tx_chk == _FAIL) {
4787                                 pmlmeinfo->link_count &= 0xf;
4788                         } else {
4789                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
4790                                 pmlmeinfo->link_count = 0;
4791                         }
4792                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
4793         } else if (is_client_associated_to_ibss(padapter)) {
4794                 /* linked IBSS mode */
4795                 /* for each assoc list entry to check the rx pkt counter */
4796                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
4797                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
4798                                 psta = pmlmeinfo->FW_sta_info[i].psta;
4799
4800                                 if (NULL == psta)
4801                                         continue;
4802                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
4803                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
4804                                                 pmlmeinfo->FW_sta_info[i].retry++;
4805                                         } else {
4806                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
4807                                                 pmlmeinfo->FW_sta_info[i].status = 0;
4808                                                 report_del_sta_event(padapter, psta->hwaddr
4809                                                         , 65535/*  indicate disconnect caused by no rx */
4810                                         );
4811                                         }
4812                                 } else {
4813                                         pmlmeinfo->FW_sta_info[i].retry = 0;
4814                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
4815                                 }
4816                         }
4817                 }
4818         }
4819 }
4820
4821 void survey_timer_hdl(unsigned long data)
4822 {
4823         struct adapter *padapter = (struct adapter *)data;
4824         struct cmd_obj  *ph2c;
4825         struct sitesurvey_parm  *psurveyPara;
4826         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
4827         struct mlme_ext_priv            *pmlmeext = &padapter->mlmeextpriv;
4828
4829         /* issue rtw_sitesurvey_cmd */
4830         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
4831                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
4832                         pmlmeext->sitesurvey_res.channel_idx++;
4833
4834                 if (pmlmeext->scan_abort) {
4835                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
4836                         DBG_88E("%s idx:%d\n", __func__
4837                                 , pmlmeext->sitesurvey_res.channel_idx);
4838
4839                         pmlmeext->scan_abort = false;/* reset */
4840                 }
4841
4842                 ph2c = kzalloc(sizeof(struct cmd_obj), GFP_ATOMIC);
4843                 if (!ph2c)
4844                         goto exit_survey_timer_hdl;
4845
4846                 psurveyPara = kzalloc(sizeof(struct sitesurvey_parm), GFP_ATOMIC);
4847                 if (!psurveyPara) {
4848                         kfree(ph2c);
4849                         goto exit_survey_timer_hdl;
4850                 }
4851
4852                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, _SiteSurvey_CMD_);
4853                 rtw_enqueue_cmd(pcmdpriv, ph2c);
4854         }
4855
4856
4857 exit_survey_timer_hdl:
4858         return;
4859 }
4860
4861 void link_timer_hdl(unsigned long data)
4862 {
4863         struct adapter *padapter = (struct adapter *)data;
4864         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4865         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4866
4867         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
4868                 DBG_88E("link_timer_hdl:no beacon while connecting\n");
4869                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
4870                 report_join_res(padapter, -3);
4871         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
4872                 /* re-auth timer */
4873                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
4874                         pmlmeinfo->state = 0;
4875                         report_join_res(padapter, -1);
4876                         return;
4877                 }
4878
4879                 DBG_88E("link_timer_hdl: auth timeout and try again\n");
4880                 pmlmeinfo->auth_seq = 1;
4881                 issue_auth(padapter, NULL, 0);
4882                 set_link_timer(pmlmeext, REAUTH_TO);
4883         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
4884                 /* re-assoc timer */
4885                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
4886                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4887                         report_join_res(padapter, -2);
4888                         return;
4889                 }
4890
4891                 DBG_88E("link_timer_hdl: assoc timeout and try again\n");
4892                 issue_assocreq(padapter);
4893                 set_link_timer(pmlmeext, REASSOC_TO);
4894         }
4895 }
4896
4897 void addba_timer_hdl(unsigned long data)
4898 {
4899         struct sta_info *psta = (struct sta_info *)data;
4900         struct ht_priv  *phtpriv;
4901
4902         if (!psta)
4903                 return;
4904
4905         phtpriv = &psta->htpriv;
4906
4907         if ((phtpriv->ht_option) && (phtpriv->ampdu_enable)) {
4908                 if (phtpriv->candidate_tid_bitmap)
4909                         phtpriv->candidate_tid_bitmap = 0x0;
4910         }
4911 }
4912
4913 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
4914 {
4915         u8 type;
4916         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4917         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4918         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
4919
4920         if (psetop->mode == Ndis802_11APMode) {
4921                 pmlmeinfo->state = WIFI_FW_AP_STATE;
4922                 type = _HW_STATE_AP_;
4923         } else if (psetop->mode == Ndis802_11Infrastructure) {
4924                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
4925                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
4926                 type = _HW_STATE_STATION_;
4927         } else if (psetop->mode == Ndis802_11IBSS) {
4928                 type = _HW_STATE_ADHOC_;
4929         } else {
4930                 type = _HW_STATE_NOLINK_;
4931         }
4932
4933         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
4934         /* Set_NETYPE0_MSR(padapter, type); */
4935
4936         return H2C_SUCCESS;
4937 }
4938
4939 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
4940 {
4941         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4942         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4943         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4944         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
4945         /* u32  initialgain; */
4946
4947
4948         if (pparm->InfrastructureMode == Ndis802_11APMode) {
4949 #ifdef CONFIG_88EU_AP_MODE
4950
4951                 if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
4952                         /* todo: */
4953                         return H2C_SUCCESS;
4954                 }
4955 #endif
4956         }
4957
4958         /* below is for ad-hoc master */
4959         if (pparm->InfrastructureMode == Ndis802_11IBSS) {
4960                 rtw_joinbss_reset(padapter);
4961
4962                 pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
4963                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4964                 pmlmeinfo->ERP_enable = 0;
4965                 pmlmeinfo->WMM_enable = 0;
4966                 pmlmeinfo->HT_enable = 0;
4967                 pmlmeinfo->HT_caps_enable = 0;
4968                 pmlmeinfo->HT_info_enable = 0;
4969                 pmlmeinfo->agg_enable_bitmap = 0;
4970                 pmlmeinfo->candidate_tid_bitmap = 0;
4971
4972                 /* disable dynamic functions, such as high power, DIG */
4973                 Save_DM_Func_Flag(padapter);
4974                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
4975
4976                 /* config the initial gain under linking, need to write the BB registers */
4977                 /* initialgain = 0x1E; */
4978                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
4979
4980                 /* cancel link timer */
4981                 del_timer_sync(&pmlmeext->link_timer);
4982
4983                 /* clear CAM */
4984                 flush_all_cam_entry(padapter);
4985
4986                 memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, IELength));
4987                 pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
4988
4989                 if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
4990                         return H2C_PARAMETERS_ERROR;
4991
4992                 memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
4993
4994                 start_create_ibss(padapter);
4995         }
4996
4997         return H2C_SUCCESS;
4998 }
4999
5000 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5001 {
5002         u8 join_type;
5003         struct ndis_802_11_var_ie *pIE;
5004         struct registry_priv    *pregpriv = &padapter->registrypriv;
5005         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5006         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5007         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5008         struct wlan_bssid_ex *pparm = (struct wlan_bssid_ex *)pbuf;
5009         u32 i;
5010
5011         /* check already connecting to AP or not */
5012         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
5013                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
5014                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 5, 100);
5015
5016                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5017
5018                 /* clear CAM */
5019                 flush_all_cam_entry(padapter);
5020
5021                 del_timer_sync(&pmlmeext->link_timer);
5022
5023                 /* set MSR to nolink -> infra. mode */
5024                 Set_MSR(padapter, _HW_STATE_STATION_);
5025
5026
5027                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5028         }
5029
5030         rtw_antenna_select_cmd(padapter, pparm->PhyInfo.Optimum_antenna, false);
5031
5032         rtw_joinbss_reset(padapter);
5033
5034         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5035         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5036         pmlmeinfo->ERP_enable = 0;
5037         pmlmeinfo->WMM_enable = 0;
5038         pmlmeinfo->HT_enable = 0;
5039         pmlmeinfo->HT_caps_enable = 0;
5040         pmlmeinfo->HT_info_enable = 0;
5041         pmlmeinfo->agg_enable_bitmap = 0;
5042         pmlmeinfo->candidate_tid_bitmap = 0;
5043         pmlmeinfo->bwmode_updated = false;
5044
5045         memcpy(pnetwork, pbuf, offsetof(struct wlan_bssid_ex, IELength));
5046         pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
5047
5048         if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
5049                 return H2C_PARAMETERS_ERROR;
5050
5051         memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
5052
5053         /* Check AP vendor to move rtw_joinbss_cmd() */
5054
5055         for (i = sizeof(struct ndis_802_11_fixed_ie); i < pnetwork->IELength;) {
5056                 pIE = (struct ndis_802_11_var_ie *)(pnetwork->IEs + i);
5057
5058                 switch (pIE->ElementID) {
5059                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
5060                         if (!memcmp(pIE->data, WMM_OUI, 4))
5061                                 pmlmeinfo->WMM_enable = 1;
5062                         break;
5063                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
5064                         pmlmeinfo->HT_caps_enable = 1;
5065                         break;
5066                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
5067                         pmlmeinfo->HT_info_enable = 1;
5068
5069                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5070                         {
5071                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5072
5073                                 if ((pregpriv->cbw40_enable) &&  (pht_info->infos[0] & BIT(2))) {
5074                                         /* switch to the 40M Hz mode according to the AP */
5075                                         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_40;
5076                                         switch (pht_info->infos[0] & 0x3) {
5077                                         case 1:
5078                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5079                                                 break;
5080                                         case 3:
5081                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5082                                                 break;
5083                                         default:
5084                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5085                                                 break;
5086                                 }
5087
5088                                         DBG_88E("set ch/bw before connected\n");
5089                                 }
5090                         }
5091                         break;
5092                 default:
5093                         break;
5094                 }
5095
5096                 i += (pIE->Length + 2);
5097         }
5098         /* disable dynamic functions, such as high power, DIG */
5099
5100         /* config the initial gain under linking, need to write the BB registers */
5101
5102         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
5103         join_type = 0;
5104         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5105
5106         /* cancel link timer */
5107         del_timer_sync(&pmlmeext->link_timer);
5108
5109         start_clnt_join(padapter);
5110
5111         return H2C_SUCCESS;
5112 }
5113
5114 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5115 {
5116         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5117         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5118         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5119         struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5120         u8 val8;
5121
5122         if (is_client_associated_to_ap(padapter))
5123                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5124
5125         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5126         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5127
5128         /* restore to initial setting. */
5129         update_tx_basic_rate(padapter, padapter->registrypriv.wireless_mode);
5130
5131         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5132                 /* Stop BCN */
5133                 val8 = 0;
5134                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5135         }
5136
5137
5138         /* set MSR to no link state -> infra. mode */
5139         Set_MSR(padapter, _HW_STATE_STATION_);
5140
5141         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5142
5143         /* switch to the 20M Hz mode after disconnect */
5144         pmlmeext->cur_bwmode = HT_CHANNEL_WIDTH_20;
5145         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5146
5147         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5148
5149         flush_all_cam_entry(padapter);
5150
5151         del_timer_sync(&pmlmeext->link_timer);
5152
5153         rtw_free_uc_swdec_pending_queue(padapter);
5154
5155         return  H2C_SUCCESS;
5156 }
5157
5158 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
5159         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
5160 {
5161         int i, j;
5162         int set_idx;
5163         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5164
5165         /* clear out first */
5166         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5167
5168         /* acquire channels from in */
5169         j = 0;
5170         for (i = 0; i < in_num; i++) {
5171                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5172                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED) &&
5173                     set_idx >= 0) {
5174                         out[j] = in[i];
5175
5176                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5177                                 out[j].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5178
5179                         j++;
5180                 }
5181                 if (j >= out_num)
5182                         break;
5183         }
5184
5185         /* if out is empty, use channel_set as default */
5186         if (j == 0) {
5187                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5188                         out[i].hw_value = pmlmeext->channel_set[i].ChannelNum;
5189
5190                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5191                                 out[i].flags &= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5192
5193                         j++;
5194                 }
5195         }
5196
5197         return j;
5198 }
5199
5200 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5201 {
5202         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5203         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5204         u8 bdelayscan = false;
5205         u8 val8;
5206         u32     initialgain;
5207         u32     i;
5208
5209         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5210                 /* for first time sitesurvey_cmd */
5211                 rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, NULL);
5212
5213                 pmlmeext->sitesurvey_res.state = SCAN_START;
5214                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5215                 pmlmeext->sitesurvey_res.channel_idx = 0;
5216
5217                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5218                         if (pparm->ssid[i].SsidLength) {
5219                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
5220                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = pparm->ssid[i].SsidLength;
5221                         } else {
5222                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = 0;
5223                         }
5224                 }
5225
5226                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5227                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5228                         , pparm->ch, pparm->ch_num
5229         );
5230
5231                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5232
5233                 /* issue null data if associating to the AP */
5234                 if (is_client_associated_to_ap(padapter)) {
5235                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5236
5237                         issue_nulldata(padapter, NULL, 1, 3, 500);
5238
5239                         bdelayscan = true;
5240                 }
5241                 if (bdelayscan) {
5242                         /* delay 50ms to protect nulldata(1). */
5243                         set_survey_timer(pmlmeext, 50);
5244                         return H2C_SUCCESS;
5245                 }
5246         }
5247
5248         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5249                 /* disable dynamic functions, such as high power, DIG */
5250                 Save_DM_Func_Flag(padapter);
5251                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5252
5253                 /* config the initial gain under scanning, need to write the BB registers */
5254                 initialgain = 0x1E;
5255
5256                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5257
5258                 /* set MSR to no link state */
5259                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5260
5261                 val8 = 1; /* under site survey */
5262                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5263
5264                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5265         }
5266
5267         site_survey(padapter);
5268
5269         return H2C_SUCCESS;
5270 }
5271
5272 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5273 {
5274         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5275         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5276         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5277
5278         if (pparm->mode < 4)
5279                 pmlmeinfo->auth_algo = pparm->mode;
5280         return  H2C_SUCCESS;
5281 }
5282
5283 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5284 {
5285         unsigned short                          ctrl;
5286         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5287         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5288         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5289         unsigned char                                   null_sta[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5290
5291         /* main tx key for wep. */
5292         if (pparm->set_tx)
5293                 pmlmeinfo->key_index = pparm->keyid;
5294
5295         /* write cam */
5296         ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5297
5298         DBG_88E_LEVEL(_drv_info_, "set group key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) "
5299                         "keyid:%d\n", pparm->algorithm, pparm->keyid);
5300         write_cam(padapter, pparm->keyid, ctrl, null_sta, pparm->key);
5301
5302         return H2C_SUCCESS;
5303 }
5304
5305 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5306 {
5307         u16 ctrl = 0;
5308         u8 cam_id;/* cam_entry */
5309         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5310         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5311         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5312
5313         /* cam_entry: */
5314         /* 0~3 for default key */
5315
5316         /* for concurrent mode (ap+sta): */
5317         /* default key is disable, using sw encrypt/decrypt */
5318         /* cam_entry = 4 for sta mode (macid = 0) */
5319         /* cam_entry(macid+3) = 5 ~ N for ap mode (aid = 1~N, macid = 2 ~N) */
5320
5321         /* for concurrent mode (sta+sta): */
5322         /* default key is disable, using sw encrypt/decrypt */
5323         /* cam_entry = 4 mapping to macid = 0 */
5324         /* cam_entry = 5 mapping to macid = 2 */
5325
5326         cam_id = 4;
5327
5328         DBG_88E_LEVEL(_drv_info_, "set pairwise key to hw: alg:%d(WEP40-1 WEP104-5 TKIP-2 AES-4) camid:%d\n",
5329                       pparm->algorithm, cam_id);
5330         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
5331                 struct sta_info *psta;
5332                 struct sta_priv *pstapriv = &padapter->stapriv;
5333
5334                 if (pparm->algorithm == _NO_PRIVACY_)   /*  clear cam entry */ {
5335                         clear_cam_entry(padapter, pparm->id);
5336                         return H2C_SUCCESS_RSP;
5337                 }
5338
5339                 psta = rtw_get_stainfo(pstapriv, pparm->addr);
5340                 if (psta) {
5341                         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5342
5343                         DBG_88E("r871x_set_stakey_hdl(): enc_algorithm=%d\n", pparm->algorithm);
5344
5345                         if ((psta->mac_id < 1) || (psta->mac_id > (NUM_STA-4))) {
5346                                 DBG_88E("r871x_set_stakey_hdl():set_stakey failed, mac_id(aid)=%d\n", psta->mac_id);
5347                                 return H2C_REJECTED;
5348                         }
5349
5350                         cam_id = psta->mac_id + 3;/* 0~3 for default key, cmd_id = macid + 3, macid = aid+1; */
5351
5352                         DBG_88E("Write CAM, mac_addr =%pM, cam_entry=%d\n",
5353                                 pparm->addr, cam_id);
5354
5355                         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5356
5357                         return H2C_SUCCESS_RSP;
5358                 } else {
5359                         DBG_88E("r871x_set_stakey_hdl(): sta has been free\n");
5360                         return H2C_REJECTED;
5361                 }
5362         }
5363
5364         /* below for sta mode */
5365
5366         if (pparm->algorithm == _NO_PRIVACY_) { /*  clear cam entry */
5367                 clear_cam_entry(padapter, pparm->id);
5368                 return H2C_SUCCESS;
5369         }
5370         ctrl = BIT(15) | ((pparm->algorithm) << 2);
5371         write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5372         pmlmeinfo->enc_algo = pparm->algorithm;
5373         return H2C_SUCCESS;
5374 }
5375
5376 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5377 {
5378         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5379         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5380         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5381
5382         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5383
5384         if (!psta)
5385                 return  H2C_SUCCESS;
5386
5387         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5388             ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5389                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5390                 mod_timer(&psta->addba_retry_timer,
5391                           jiffies + msecs_to_jiffies(ADDBA_TO));
5392         } else {
5393                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5394         }
5395         return  H2C_SUCCESS;
5396 }
5397
5398 u8 set_tx_beacon_cmd(struct adapter *padapter)
5399 {
5400         struct cmd_obj  *ph2c;
5401         struct wlan_bssid_ex    *ptxBeacon_parm;
5402         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5403         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5404         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5405         u8 res = _SUCCESS;
5406         int len_diff = 0;
5407
5408
5409         ph2c = kzalloc(sizeof(struct cmd_obj), GFP_KERNEL);
5410         if (!ph2c) {
5411                 res = _FAIL;
5412                 goto exit;
5413         }
5414
5415         ptxBeacon_parm = kmemdup(&(pmlmeinfo->network),
5416                                 sizeof(struct wlan_bssid_ex), GFP_KERNEL);
5417         if (ptxBeacon_parm == NULL) {
5418                 kfree(ph2c);
5419                 res = _FAIL;
5420                 goto exit;
5421         }
5422
5423         len_diff = update_hidden_ssid(ptxBeacon_parm->IEs+_BEACON_IE_OFFSET_,
5424                                       ptxBeacon_parm->IELength-_BEACON_IE_OFFSET_,
5425                                       pmlmeinfo->hidden_ssid_mode);
5426         ptxBeacon_parm->IELength += len_diff;
5427
5428         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, _TX_Beacon_CMD_);
5429
5430         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5431
5432
5433 exit:
5434
5435
5436         return res;
5437 }
5438
5439 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5440 {
5441         u8 evt_code;
5442         u16 evt_sz;
5443         uint    *peventbuf;
5444         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5445
5446         peventbuf = (uint *)pbuf;
5447         evt_sz = (u16)(*peventbuf&0xffff);
5448         evt_code = (u8)((*peventbuf>>16)&0xff);
5449
5450         /*  checking if event code is valid */
5451         if (evt_code >= MAX_C2HEVT) {
5452                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
5453                 goto _abort_event_;
5454         }
5455
5456         /*  checking if event size match the event parm size */
5457         if ((wlanevents[evt_code].parmsize != 0) &&
5458             (wlanevents[evt_code].parmsize != evt_sz)) {
5459                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_,
5460                          ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
5461                          evt_code, wlanevents[evt_code].parmsize, evt_sz));
5462                 goto _abort_event_;
5463         }
5464
5465         peventbuf += 2;
5466
5467         if (peventbuf) {
5468                 event_callback = wlanevents[evt_code].event_callback;
5469                 event_callback(padapter, (u8 *)peventbuf);
5470
5471         }
5472
5473 _abort_event_:
5474         return H2C_SUCCESS;
5475 }
5476
5477 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5478 {
5479         if (send_beacon(padapter) == _FAIL) {
5480                 DBG_88E("issue_beacon, fail!\n");
5481                 return H2C_PARAMETERS_ERROR;
5482         }
5483 #ifdef CONFIG_88EU_AP_MODE
5484         else { /* tx bc/mc frames after update TIM */
5485                 struct sta_info *psta_bmc;
5486                 struct list_head *xmitframe_plist, *xmitframe_phead;
5487                 struct xmit_frame *pxmitframe = NULL;
5488                 struct sta_priv  *pstapriv = &padapter->stapriv;
5489
5490                 /* for BC/MC Frames */
5491                 psta_bmc = rtw_get_bcmc_stainfo(padapter);
5492                 if (!psta_bmc)
5493                         return H2C_SUCCESS;
5494
5495                 if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5496                         msleep(10);/*  10ms, ATIM(HIQ) Windows */
5497                         spin_lock_bh(&psta_bmc->sleep_q.lock);
5498
5499                         xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5500                         xmitframe_plist = xmitframe_phead->next;
5501
5502                         while (xmitframe_phead != xmitframe_plist) {
5503                                 pxmitframe = container_of(xmitframe_plist, struct xmit_frame, list);
5504
5505                                 xmitframe_plist = xmitframe_plist->next;
5506
5507                                 list_del_init(&pxmitframe->list);
5508
5509                                 psta_bmc->sleepq_len--;
5510                                 if (psta_bmc->sleepq_len > 0)
5511                                         pxmitframe->attrib.mdata = 1;
5512                                 else
5513                                         pxmitframe->attrib.mdata = 0;
5514
5515                                 pxmitframe->attrib.triggered = 1;
5516
5517                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5518
5519                                 spin_unlock_bh(&psta_bmc->sleep_q.lock);
5520                                 if (rtw_hal_xmit(padapter, pxmitframe))
5521                                         rtw_os_xmit_complete(padapter, pxmitframe);
5522                                 spin_lock_bh(&psta_bmc->sleep_q.lock);
5523                         }
5524                         spin_unlock_bh(&psta_bmc->sleep_q.lock);
5525                 }
5526         }
5527 #endif
5528         return H2C_SUCCESS;
5529 }
5530
5531 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5532 {
5533         struct set_ch_parm *set_ch_parm;
5534         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5535
5536         if (!pbuf)
5537                 return H2C_PARAMETERS_ERROR;
5538
5539         set_ch_parm = (struct set_ch_parm *)pbuf;
5540
5541         DBG_88E(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
5542                 FUNC_NDEV_ARG(padapter->pnetdev),
5543                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
5544
5545         pmlmeext->cur_channel = set_ch_parm->ch;
5546         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5547         pmlmeext->cur_bwmode = set_ch_parm->bw;
5548
5549         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5550
5551         return  H2C_SUCCESS;
5552 }
5553
5554 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5555 {
5556         struct SetChannelPlan_param *setChannelPlan_param;
5557         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5558
5559         if (!pbuf)
5560                 return H2C_PARAMETERS_ERROR;
5561
5562         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5563
5564         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5565         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5566
5567         return  H2C_SUCCESS;
5568 }