drivers/staging/rtl8723bs/core/rtw_mlme_ext.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /******************************************************************************
   3  *
   4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   5  *
   6  ******************************************************************************/
   7 #include <drv_types.h>
   8 #include <rtw_debug.h>
   9 #include <rtw_wifi_regd.h>
  10 #include <hal_btcoex.h>
  11 #include <linux/kernel.h>
  12 #include <asm/unaligned.h>
  13
  14 static struct mlme_handler mlme_sta_tbl[] = {
  15         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
  16         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
  17         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
  18         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
  19         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
  20         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
  21
  22         /*----------------------------------------------------------
  23                                         below 2 are reserved
  24         -----------------------------------------------------------*/
  25         {0,                                     "DoReserved",           &DoReserved},
  26         {0,                                     "DoReserved",           &DoReserved},
  27         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
  28         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
  29         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
  30         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
  31         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
  32         {WIFI_ACTION,           "OnAction",             &OnAction},
  33         {WIFI_ACTION_NOACK, "OnActionNoAck",    &OnAction},
  34 };
  35
  36 static struct action_handler OnAction_tbl[] = {
  37         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
  38         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &DoReserved},
  39         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &DoReserved},
  40         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
  41         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
  42         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
  43         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
  44         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
  45         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &OnAction_sa_query},
  46         {RTW_WLAN_CATEGORY_UNPROTECTED_WNM, "ACTION_UNPROTECTED_WNM", &DoReserved},
  47         {RTW_WLAN_CATEGORY_SELF_PROTECTED, "ACTION_SELF_PROTECTED", &DoReserved},
  48         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &DoReserved},
  49         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &DoReserved},
  50 };
  51
  52 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  53
  54 /**************************************************
  55 OUI definitions for the vendor specific IE
  56 ***************************************************/
  57 unsigned char RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  58 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  59 unsigned char WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  60 unsigned char P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  61 unsigned char WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  62
  63 unsigned char WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  64 unsigned char WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  65
  66 static unsigned char REALTEK_96B_IE[] = {0x00, 0xe0, 0x4c, 0x02, 0x01, 0x20};
  67
  68 /********************************************************
  69 ChannelPlan definitions
  70 *********************************************************/
  71 static struct rt_channel_plan_2g        RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  72         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  73         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  74         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  75         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  76         {{10, 11, 12, 13}, 4},                                          /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  77         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x05, RT_CHANNEL_DOMAIN_2G_GLOBAL , Passive scan CH 12, 13, 14 */
  78         {{}, 0},                                                                /*  0x06, RT_CHANNEL_DOMAIN_2G_NULL */
  79 };
  80
  81 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  82         /*  0x00 ~ 0x1F , Old Define ===== */
  83         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  84         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  85         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  86         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  87         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  88         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  89         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  90         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  91         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  92         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  93         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  94         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  95         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  96         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  97         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  98         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  99         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
 100         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
 101         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
 102         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
 103         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
 104         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
 105         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
 106         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
 107         {0x06}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
 108         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
 109         {0x00}, /* 0x1A, */
 110         {0x00}, /* 0x1B, */
 111         {0x00}, /* 0x1C, */
 112         {0x00}, /* 0x1D, */
 113         {0x00}, /* 0x1E, */
 114         {0x06}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
 115         /*  0x20 ~ 0x7F , New Define ===== */
 116         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 117         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 118         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 119         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 120         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 121         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 122         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 123         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 124         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 125         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 126         {0x00}, /* 0x2A, */
 127         {0x00}, /* 0x2B, */
 128         {0x00}, /* 0x2C, */
 129         {0x00}, /* 0x2D, */
 130         {0x00}, /* 0x2E, */
 131         {0x00}, /* 0x2F, */
 132         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 133         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 134         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 135         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 136         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 137         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 138         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 139         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 140         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 141         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 142         {0x00}, /* 0x3A, */
 143         {0x00}, /* 0x3B, */
 144         {0x00}, /* 0x3C, */
 145         {0x00}, /* 0x3D, */
 146         {0x00}, /* 0x3E, */
 147         {0x00}, /* 0x3F, */
 148         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 149         {0x05}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */
 150         {0x01}, /* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */
 151         {0x02}, /* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */
 152         {0x02}, /* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */
 153         {0x00}, /* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */
 154         {0x02}, /* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */
 155         {0x00}, /* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */
 156         {0x00}, /* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */
 157         {0x00}, /* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */
 158         {0x00}, /* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */
 159         {0x00}, /* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */
 160         {0x00}, /* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */
 161         {0x02}, /* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */
 162         {0x00}, /* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */
 163         {0x02}, /* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */
 164         {0x00}, /* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */
 165         {0x02}, /* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */
 166 };
 167
 168  /* use the combination for max channel numbers */
 169 static struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03};
 170
 171 /* Search the @param ch in given @param ch_set
 172  * @ch_set: the given channel set
 173  * @ch: the given channel number
 174  *
 175  * return the index of channel_num in channel_set, -1 if not found
 176  */
 177 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 178 {
 179         int i;
 180
 181         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 182                 if (ch == ch_set[i].ChannelNum)
 183                         break;
 184         }
 185
 186         if (i >= ch_set[i].ChannelNum)
 187                 return -1;
 188         return i;
 189 }
 190
 191 /****************************************************************************
 192
 193 Following are the initialization functions for WiFi MLME
 194
 195 *****************************************************************************/
 196
 197 int init_hw_mlme_ext(struct adapter *padapter)
 198 {
 199         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 200
 201         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
 202         return _SUCCESS;
 203 }
 204
 205 void init_mlme_default_rate_set(struct adapter *padapter)
 206 {
 207         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 208
 209         unsigned char mixed_datarate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_, _48M_RATE_, _54M_RATE_, 0xff};
 210         unsigned char mixed_basicrate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _12M_RATE_, _24M_RATE_, 0xff,};
 211         unsigned char supported_mcs_set[16] = {0xff, 0xff, 0x00, 0x00, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
 212
 213         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
 214         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
 215
 216         memcpy(pmlmeext->default_supported_mcs_set, supported_mcs_set, sizeof(pmlmeext->default_supported_mcs_set));
 217 }
 218
 219 static void init_mlme_ext_priv_value(struct adapter *padapter)
 220 {
 221         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 222         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 223
 224         atomic_set(&pmlmeext->event_seq, 0);
 225         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
 226         pmlmeext->sa_query_seq = 0;
 227         pmlmeext->mgnt_80211w_IPN = 0;
 228         pmlmeext->mgnt_80211w_IPN_rx = 0;
 229         pmlmeext->cur_channel = padapter->registrypriv.channel;
 230         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
 231         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 232
 233         pmlmeext->retry = 0;
 234
 235         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
 236
 237         init_mlme_default_rate_set(padapter);
 238
 239         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
 240         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
 241         pmlmeext->sitesurvey_res.channel_idx = 0;
 242         pmlmeext->sitesurvey_res.bss_cnt = 0;
 243         pmlmeext->scan_abort = false;
 244
 245         pmlmeinfo->state = WIFI_FW_NULL_STATE;
 246         pmlmeinfo->reauth_count = 0;
 247         pmlmeinfo->reassoc_count = 0;
 248         pmlmeinfo->link_count = 0;
 249         pmlmeinfo->auth_seq = 0;
 250         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
 251         pmlmeinfo->key_index = 0;
 252         pmlmeinfo->iv = 0;
 253
 254         pmlmeinfo->enc_algo = _NO_PRIVACY_;
 255         pmlmeinfo->authModeToggle = 0;
 256
 257         memset(pmlmeinfo->chg_txt, 0, 128);
 258
 259         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
 260         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
 261
 262         pmlmeinfo->dialogToken = 0;
 263
 264         pmlmeext->action_public_rxseq = 0xffff;
 265         pmlmeext->action_public_dialog_token = 0xff;
 266 }
 267
 268 static int has_channel(struct rt_channel_info *channel_set,
 269                                            u8 chanset_size,
 270                                            u8 chan)
 271 {
 272         int i;
 273
 274         for (i = 0; i < chanset_size; i++)
 275                 if (channel_set[i].ChannelNum == chan)
 276                         return 1;
 277
 278         return 0;
 279 }
 280
 281 static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
 282                                                           u8 chanset_size,
 283                                                           struct p2p_channels *channel_list)
 284 {
 285
 286         static const struct p2p_oper_class_map op_class[] = {
 287                 { IEEE80211G,  81,   1,  13,  1, BW20 },
 288                 { IEEE80211G,  82,  14,  14,  1, BW20 },
 289                 { IEEE80211A, 115,  36,  48,  4, BW20 },
 290                 { IEEE80211A, 116,  36,  44,  8, BW40PLUS },
 291                 { IEEE80211A, 117,  40,  48,  8, BW40MINUS },
 292                 { IEEE80211A, 124, 149, 161,  4, BW20 },
 293                 { IEEE80211A, 125, 149, 169,  4, BW20 },
 294                 { IEEE80211A, 126, 149, 157,  8, BW40PLUS },
 295                 { IEEE80211A, 127, 153, 161,  8, BW40MINUS },
 296                 { -1, 0, 0, 0, 0, BW20 }
 297         };
 298
 299         int cla, op;
 300
 301         cla = 0;
 302
 303         for (op = 0; op_class[op].op_class; op++) {
 304                 u8 ch;
 305                 const struct p2p_oper_class_map *o = &op_class[op];
 306                 struct p2p_reg_class *reg = NULL;
 307
 308                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
 309                         if (!has_channel(channel_set, chanset_size, ch))
 310                                 continue;
 311
 312                         if ((padapter->registrypriv.ht_enable == 0) && (o->inc == 8))
 313                                 continue;
 314
 315                         if ((0 < (padapter->registrypriv.bw_mode & 0xf0)) &&
 316                                 ((o->bw == BW40MINUS) || (o->bw == BW40PLUS)))
 317                                 continue;
 318
 319                         if (!reg) {
 320                                 reg = &channel_list->reg_class[cla];
 321                                 cla++;
 322                                 reg->reg_class = o->op_class;
 323                                 reg->channels = 0;
 324                         }
 325                         reg->channel[reg->channels] = ch;
 326                         reg->channels++;
 327                 }
 328         }
 329         channel_list->reg_classes = cla;
 330
 331 }
 332
 333 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
 334 {
 335         u8 index, chanset_size = 0;
 336         u8 b2_4GBand = false;
 337         u8 Index2G = 0;
 338
 339         memset(channel_set, 0, sizeof(struct rt_channel_info)*MAX_CHANNEL_NUM);
 340
 341         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
 342                 return chanset_size;
 343
 344         if (is_supported_24g(padapter->registrypriv.wireless_mode)) {
 345                 b2_4GBand = true;
 346                 if (ChannelPlan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
 347                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
 348                 else
 349                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
 350         }
 351
 352         if (b2_4GBand) {
 353                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
 354                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
 355
 356                         if ((ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN) ||/* Channel 1~11 is active, and 12~14 is passive */
 357                                 (ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_NULL)) {
 358                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
 359                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 360                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
 361                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
 362                         } else if (ChannelPlan == RT_CHANNEL_DOMAIN_WORLD_WIDE_13 ||
 363                                  Index2G == RT_CHANNEL_DOMAIN_2G_WORLD) { /*  channel 12~13, passive scan */
 364                                 if (channel_set[chanset_size].ChannelNum <= 11)
 365                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 366                                 else
 367                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
 368                         } else
 369                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 370
 371                         chanset_size++;
 372                 }
 373         }
 374
 375         return chanset_size;
 376 }
 377
 378 void init_mlme_ext_priv(struct adapter *padapter)
 379 {
 380         struct registry_priv *pregistrypriv = &padapter->registrypriv;
 381         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 382         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 383         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 384
 385         pmlmeext->padapter = padapter;
 386
 387         /* fill_fwpriv(padapter, &(pmlmeext->fwpriv)); */
 388
 389         init_mlme_ext_priv_value(padapter);
 390         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
 391
 392         init_mlme_ext_timer(padapter);
 393
 394         init_mlme_ap_info(padapter);
 395
 396         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
 397         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
 398         pmlmeext->last_scan_time = 0;
 399         pmlmeext->chan_scan_time = SURVEY_TO;
 400         pmlmeext->mlmeext_init = true;
 401         pmlmeext->active_keep_alive_check = true;
 402
 403 #ifdef DBG_FIXED_CHAN
 404         pmlmeext->fixed_chan = 0xFF;
 405 #endif
 406 }
 407
 408 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
 409 {
 410         struct adapter *padapter = pmlmeext->padapter;
 411
 412         if (!padapter)
 413                 return;
 414
 415         if (padapter->bDriverStopped) {
 416                 del_timer_sync(&pmlmeext->survey_timer);
 417                 del_timer_sync(&pmlmeext->link_timer);
 418                 /* del_timer_sync(&pmlmeext->ADDBA_timer); */
 419         }
 420 }
 421
 422 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, union recv_frame *precv_frame)
 423 {
 424         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 425         u8 *pframe = precv_frame->u.hdr.rx_data;
 426
 427         if (ptable->func) {
 428                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
 429                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
 430                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
 431                         return;
 432
 433                 ptable->func(padapter, precv_frame);
 434         }
 435 }
 436
 437 void mgt_dispatcher(struct adapter *padapter, union recv_frame *precv_frame)
 438 {
 439         int index;
 440         struct mlme_handler *ptable;
 441         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 442         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 443         u8 *pframe = precv_frame->u.hdr.rx_data;
 444         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
 445         struct dvobj_priv *psdpriv = padapter->dvobj;
 446         struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;
 447
 448         if (GetFrameType(pframe) != WIFI_MGT_TYPE)
 449                 return;
 450
 451         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
 452         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
 453                 memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN)) {
 454                 return;
 455         }
 456
 457         ptable = mlme_sta_tbl;
 458
 459         index = GetFrameSubType(pframe) >> 4;
 460
 461         if (index >= ARRAY_SIZE(mlme_sta_tbl))
 462                 return;
 463
 464         ptable += index;
 465
 466         if (psta) {
 467                 if (GetRetry(pframe)) {
 468                         if (precv_frame->u.hdr.attrib.seq_num == psta->RxMgmtFrameSeqNum) {
 469                                 /* drop the duplicate management frame */
 470                                 pdbgpriv->dbg_rx_dup_mgt_frame_drop_count++;
 471                                 return;
 472                         }
 473                 }
 474                 psta->RxMgmtFrameSeqNum = precv_frame->u.hdr.attrib.seq_num;
 475         }
 476
 477         switch (GetFrameSubType(pframe)) {
 478         case WIFI_AUTH:
 479                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
 480                         ptable->func = &OnAuth;
 481                 else
 482                         ptable->func = &OnAuthClient;
 483                 fallthrough;
 484         case WIFI_ASSOCREQ:
 485         case WIFI_REASSOCREQ:
 486                 _mgt_dispatcher(padapter, ptable, precv_frame);
 487                 break;
 488         case WIFI_PROBEREQ:
 489                 _mgt_dispatcher(padapter, ptable, precv_frame);
 490                 break;
 491         case WIFI_BEACON:
 492                 _mgt_dispatcher(padapter, ptable, precv_frame);
 493                 break;
 494         case WIFI_ACTION:
 495                 /* if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) */
 496                 _mgt_dispatcher(padapter, ptable, precv_frame);
 497                 break;
 498         default:
 499                 _mgt_dispatcher(padapter, ptable, precv_frame);
 500                 break;
 501         }
 502 }
 503
 504 /****************************************************************************
 505
 506 Following are the callback functions for each subtype of the management frames
 507
 508 *****************************************************************************/
 509
 510 unsigned int OnProbeReq(struct adapter *padapter, union recv_frame *precv_frame)
 511 {
 512         unsigned int    ielen;
 513         unsigned char *p;
 514         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 515         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 516         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 517         struct wlan_bssid_ex    *cur = &pmlmeinfo->network;
 518         u8 *pframe = precv_frame->u.hdr.rx_data;
 519         uint len = precv_frame->u.hdr.len;
 520         u8 is_valid_p2p_probereq = false;
 521
 522         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
 523                 return _SUCCESS;
 524
 525         if (check_fwstate(pmlmepriv, _FW_LINKED) == false &&
 526                 check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE) == false) {
 527                 return _SUCCESS;
 528         }
 529
 530         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, WLAN_EID_SSID, (int *)&ielen,
 531                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
 532
 533
 534         /* check (wildcard) SSID */
 535         if (p) {
 536                 if (is_valid_p2p_probereq)
 537                         goto _issue_probersp;
 538
 539                 if ((ielen != 0 && false == !memcmp((void *)(p+2), (void *)cur->ssid.ssid, cur->ssid.ssid_length))
 540                         || (ielen == 0 && pmlmeinfo->hidden_ssid_mode)
 541                 )
 542                         return _SUCCESS;
 543
 544 _issue_probersp:
 545                 if ((check_fwstate(pmlmepriv, _FW_LINKED) &&
 546                      pmlmepriv->cur_network.join_res) ||
 547                     check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))
 548                         issue_probersp(padapter, get_sa(pframe), is_valid_p2p_probereq);
 549         }
 550
 551         return _SUCCESS;
 552
 553 }
 554
 555 unsigned int OnProbeRsp(struct adapter *padapter, union recv_frame *precv_frame)
 556 {
 557         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 558
 559         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
 560                 report_survey_event(padapter, precv_frame);
 561                 return _SUCCESS;
 562         }
 563
 564         return _SUCCESS;
 565
 566 }
 567
 568 unsigned int OnBeacon(struct adapter *padapter, union recv_frame *precv_frame)
 569 {
 570         int cam_idx;
 571         struct sta_info *psta;
 572         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 573         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 574         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 575         struct sta_priv *pstapriv = &padapter->stapriv;
 576         u8 *pframe = precv_frame->u.hdr.rx_data;
 577         uint len = precv_frame->u.hdr.len;
 578         struct wlan_bssid_ex *pbss;
 579         int ret = _SUCCESS;
 580         u8 *p = NULL;
 581         u32 ielen = 0;
 582
 583         p = rtw_get_ie(pframe + sizeof(struct ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, WLAN_EID_EXT_SUPP_RATES, &ielen, precv_frame->u.hdr.len - sizeof(struct ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_);
 584         if (p && ielen > 0) {
 585                 if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D))
 586                         /* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */
 587                         *(p + 1) = ielen - 1;
 588         }
 589
 590         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
 591                 report_survey_event(padapter, precv_frame);
 592                 return _SUCCESS;
 593         }
 594
 595         if (!memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)) {
 596                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
 597                         /* we should update current network before auth, or some IE is wrong */
 598                         pbss = rtw_malloc(sizeof(struct wlan_bssid_ex));
 599                         if (pbss) {
 600                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
 601                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
 602                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
 603                                 }
 604                                 kfree(pbss);
 605                         }
 606
 607                         /* check the vendor of the assoc AP */
 608                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
 609
 610                         /* update TSF Value */
 611                         update_TSF(pmlmeext, pframe, len);
 612
 613                         /* reset for adaptive_early_32k */
 614                         pmlmeext->adaptive_tsf_done = false;
 615                         pmlmeext->DrvBcnEarly = 0xff;
 616                         pmlmeext->DrvBcnTimeOut = 0xff;
 617                         pmlmeext->bcn_cnt = 0;
 618                         memset(pmlmeext->bcn_delay_cnt, 0, sizeof(pmlmeext->bcn_delay_cnt));
 619                         memset(pmlmeext->bcn_delay_ratio, 0, sizeof(pmlmeext->bcn_delay_ratio));
 620
 621                         /* start auth */
 622                         start_clnt_auth(padapter);
 623
 624                         return _SUCCESS;
 625                 }
 626
 627                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
 628                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 629                         if (psta) {
 630                                 ret = rtw_check_bcn_info(padapter, pframe, len);
 631                                 if (!ret) {
 632                                         netdev_dbg(padapter->pnetdev,
 633                                                    "ap has changed, disconnect now\n ");
 634                                         receive_disconnect(padapter,
 635                                                            pmlmeinfo->network.mac_address, 0);
 636                                         return _SUCCESS;
 637                                 }
 638                                 /* update WMM, ERP in the beacon */
 639                                 /* todo: the timer is used instead of the number of the beacon received */
 640                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
 641                                         update_beacon_info(padapter, pframe, len, psta);
 642
 643                                 adaptive_early_32k(pmlmeext, pframe, len);
 644                         }
 645                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 646                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 647                         if (psta) {
 648                                 /* update WMM, ERP in the beacon */
 649                                 /* todo: the timer is used instead of the number of the beacon received */
 650                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
 651                                         update_beacon_info(padapter, pframe, len, psta);
 652                         } else {
 653                                 /* allocate a new CAM entry for IBSS station */
 654                                 cam_idx = allocate_fw_sta_entry(padapter);
 655                                 if (cam_idx == NUM_STA)
 656                                         goto _END_ONBEACON_;
 657
 658                                 /* get supported rate */
 659                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
 660                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
 661                                         goto _END_ONBEACON_;
 662                                 }
 663
 664                                 /* update TSF Value */
 665                                 update_TSF(pmlmeext, pframe, len);
 666
 667                                 /* report sta add event */
 668                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
 669                         }
 670                 }
 671         }
 672
 673 _END_ONBEACON_:
 674
 675         return _SUCCESS;
 676
 677 }
 678
 679 unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 680 {
 681         unsigned int    auth_mode, seq, ie_len;
 682         unsigned char *sa, *p;
 683         u16 algorithm;
 684         int     status;
 685         static struct sta_info stat;
 686         struct  sta_info *pstat = NULL;
 687         struct  sta_priv *pstapriv = &padapter->stapriv;
 688         struct security_priv *psecuritypriv = &padapter->securitypriv;
 689         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 690         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 691         u8 *pframe = precv_frame->u.hdr.rx_data;
 692         uint len = precv_frame->u.hdr.len;
 693         u8 offset = 0;
 694
 695         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 696                 return _FAIL;
 697
 698         sa = GetAddr2Ptr(pframe);
 699
 700         auth_mode = psecuritypriv->dot11AuthAlgrthm;
 701
 702         if (GetPrivacy(pframe)) {
 703                 u8 *iv;
 704                 struct rx_pkt_attrib     *prxattrib = &(precv_frame->u.hdr.attrib);
 705
 706                 prxattrib->hdrlen = WLAN_HDR_A3_LEN;
 707                 prxattrib->encrypt = _WEP40_;
 708
 709                 iv = pframe+prxattrib->hdrlen;
 710                 prxattrib->key_index = ((iv[3]>>6)&0x3);
 711
 712                 prxattrib->iv_len = 4;
 713                 prxattrib->icv_len = 4;
 714
 715                 rtw_wep_decrypt(padapter, (u8 *)precv_frame);
 716
 717                 offset = 4;
 718         }
 719
 720         algorithm = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset));
 721         seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
 722
 723         if (auth_mode == 2 &&
 724                         psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
 725                         psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
 726                 auth_mode = 0;
 727
 728         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
 729                 (algorithm == 0 && auth_mode == 1)) {   /*  rx a open-system auth but shared-key is enabled */
 730
 731                 status = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 732
 733                 goto auth_fail;
 734         }
 735
 736         if (rtw_access_ctrl(padapter, sa) == false) {
 737                 status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 738                 goto auth_fail;
 739         }
 740
 741         pstat = rtw_get_stainfo(pstapriv, sa);
 742         if (!pstat) {
 743
 744                 /*  allocate a new one */
 745                 pstat = rtw_alloc_stainfo(pstapriv, sa);
 746                 if (!pstat) {
 747                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 748                         goto auth_fail;
 749                 }
 750
 751                 pstat->state = WIFI_FW_AUTH_NULL;
 752                 pstat->auth_seq = 0;
 753
 754                 /* pstat->flags = 0; */
 755                 /* pstat->capability = 0; */
 756         } else {
 757
 758                 spin_lock_bh(&pstapriv->asoc_list_lock);
 759                 if (list_empty(&pstat->asoc_list) == false) {
 760                         list_del_init(&pstat->asoc_list);
 761                         pstapriv->asoc_list_cnt--;
 762                         if (pstat->expire_to > 0) {
 763                                 /* TODO: STA re_auth within expire_to */
 764                         }
 765                 }
 766                 spin_unlock_bh(&pstapriv->asoc_list_lock);
 767
 768                 if (seq == 1) {
 769                         /* TODO: STA re_auth and auth timeout */
 770                 }
 771         }
 772
 773         spin_lock_bh(&pstapriv->auth_list_lock);
 774         if (list_empty(&pstat->auth_list)) {
 775
 776                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
 777                 pstapriv->auth_list_cnt++;
 778         }
 779         spin_unlock_bh(&pstapriv->auth_list_lock);
 780
 781         if (pstat->auth_seq == 0)
 782                 pstat->expire_to = pstapriv->auth_to;
 783
 784
 785         if ((pstat->auth_seq + 1) != seq) {
 786                 status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 787                 goto auth_fail;
 788         }
 789
 790         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2 || auth_mode == 3)) {
 791                 if (seq == 1) {
 792                         pstat->state &= ~WIFI_FW_AUTH_NULL;
 793                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
 794                         pstat->expire_to = pstapriv->assoc_to;
 795                         pstat->authalg = algorithm;
 796                 } else {
 797                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 798                         goto auth_fail;
 799                 }
 800         } else { /*  shared system or auto authentication */
 801                 if (seq == 1) {
 802                         /* prepare for the challenging txt... */
 803                         memset((void *)pstat->chg_txt, 78, 128);
 804
 805                         pstat->state &= ~WIFI_FW_AUTH_NULL;
 806                         pstat->state |= WIFI_FW_AUTH_STATE;
 807                         pstat->authalg = algorithm;
 808                 } else if (seq == 3) {
 809
 810                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&ie_len,
 811                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
 812
 813                         if (!p || ie_len <= 0) {
 814                                 status = WLAN_STATUS_CHALLENGE_FAIL;
 815                                 goto auth_fail;
 816                         }
 817
 818                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
 819                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
 820                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
 821                                 /*  challenging txt is correct... */
 822                                 pstat->expire_to =  pstapriv->assoc_to;
 823                         } else {
 824                                 status = WLAN_STATUS_CHALLENGE_FAIL;
 825                                 goto auth_fail;
 826                         }
 827                 } else {
 828                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 829                         goto auth_fail;
 830                 }
 831         }
 832
 833
 834         /*  Now, we are going to issue_auth... */
 835         pstat->auth_seq = seq + 1;
 836
 837         issue_auth(padapter, pstat, (unsigned short)(WLAN_STATUS_SUCCESS));
 838
 839         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
 840                 pstat->auth_seq = 0;
 841
 842
 843         return _SUCCESS;
 844
 845 auth_fail:
 846
 847         if (pstat)
 848                 rtw_free_stainfo(padapter, pstat);
 849
 850         pstat = &stat;
 851         memset((char *)pstat, '\0', sizeof(stat));
 852         pstat->auth_seq = 2;
 853         memcpy(pstat->hwaddr, sa, 6);
 854
 855         issue_auth(padapter, pstat, (unsigned short)status);
 856
 857         return _FAIL;
 858
 859 }
 860
 861 unsigned int OnAuthClient(struct adapter *padapter, union recv_frame *precv_frame)
 862 {
 863         unsigned int    seq, len, status, offset;
 864         unsigned char *p;
 865         unsigned int    go2asoc = 0;
 866         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 867         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 868         u8 *pframe = precv_frame->u.hdr.rx_data;
 869         uint pkt_len = precv_frame->u.hdr.len;
 870
 871         /* check A1 matches or not */
 872         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
 873                 return _SUCCESS;
 874
 875         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
 876                 return _SUCCESS;
 877
 878         offset = (GetPrivacy(pframe)) ? 4 : 0;
 879
 880         seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
 881         status  = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 4));
 882
 883         if (status != 0) {
 884                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
 885                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
 886                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
 887                         else
 888                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
 889                         /* pmlmeinfo->reauth_count = 0; */
 890                 }
 891
 892                 set_link_timer(pmlmeext, 1);
 893                 goto authclnt_fail;
 894         }
 895
 896         if (seq == 2) {
 897                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
 898                          /*  legendary shared system */
 899                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&len,
 900                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
 901
 902                         if (!p)
 903                                 goto authclnt_fail;
 904
 905                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
 906                         pmlmeinfo->auth_seq = 3;
 907                         issue_auth(padapter, NULL, 0);
 908                         set_link_timer(pmlmeext, REAUTH_TO);
 909
 910                         return _SUCCESS;
 911                 }
 912                 /* open system */
 913                 go2asoc = 1;
 914         } else if (seq == 4) {
 915                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
 916                         go2asoc = 1;
 917                 else
 918                         goto authclnt_fail;
 919         } else {
 920                 /*  this is also illegal */
 921                 goto authclnt_fail;
 922         }
 923
 924         if (go2asoc) {
 925                 netdev_dbg(padapter->pnetdev, "auth success, start assoc\n");
 926                 start_clnt_assoc(padapter);
 927                 return _SUCCESS;
 928         }
 929
 930 authclnt_fail:
 931
 932         /* pmlmeinfo->state &= ~(WIFI_FW_AUTH_STATE); */
 933
 934         return _FAIL;
 935
 936 }
 937
 938 unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
 939 {
 940         u16 capab_info;
 941         struct rtw_ieee802_11_elems elems;
 942         struct sta_info *pstat;
 943         unsigned char   *p, *pos, *wpa_ie;
 944         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
 945         int             i, ie_len, wpa_ie_len, left;
 946         unsigned char   supportRate[16];
 947         int                                     supportRateNum;
 948         unsigned short          status = WLAN_STATUS_SUCCESS;
 949         unsigned short          frame_type, ie_offset = 0;
 950         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 951         struct security_priv *psecuritypriv = &padapter->securitypriv;
 952         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 953         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 954         struct wlan_bssid_ex    *cur = &(pmlmeinfo->network);
 955         struct sta_priv *pstapriv = &padapter->stapriv;
 956         u8 *pframe = precv_frame->u.hdr.rx_data;
 957         uint pkt_len = precv_frame->u.hdr.len;
 958
 959         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 960                 return _FAIL;
 961
 962         frame_type = GetFrameSubType(pframe);
 963         if (frame_type == WIFI_ASSOCREQ)
 964                 ie_offset = _ASOCREQ_IE_OFFSET_;
 965         else /*  WIFI_REASSOCREQ */
 966                 ie_offset = _REASOCREQ_IE_OFFSET_;
 967
 968
 969         if (pkt_len < sizeof(struct ieee80211_hdr_3addr) + ie_offset)
 970                 return _FAIL;
 971
 972         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 973         if (!pstat) {
 974                 status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
 975                 goto asoc_class2_error;
 976         }
 977
 978         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
 979         /* capab_info = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN)); */
 980
 981         left = pkt_len - (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
 982         pos = pframe + (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
 983
 984         /*  check if this stat has been successfully authenticated/assocated */
 985         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
 986                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
 987                         status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
 988                         goto asoc_class2_error;
 989                 } else {
 990                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
 991                         pstat->state |= WIFI_FW_ASSOC_STATE;
 992                 }
 993         } else {
 994                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
 995                 pstat->state |= WIFI_FW_ASSOC_STATE;
 996         }
 997
 998
 999         pstat->capability = capab_info;
1000
1001         /* now parse all ieee802_11 ie to point to elems */
1002         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
1003             !elems.ssid) {
1004                 status = WLAN_STATUS_CHALLENGE_FAIL;
1005                 goto OnAssocReqFail;
1006         }
1007
1008         /*  now we should check all the fields... */
1009         /*  checking SSID */
1010         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_SSID, &ie_len,
1011                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1012
1013         if (!p || ie_len == 0) {
1014                 /*  broadcast ssid, however it is not allowed in assocreq */
1015                 status = WLAN_STATUS_CHALLENGE_FAIL;
1016                 goto OnAssocReqFail;
1017         } else {
1018                 /*  check if ssid match */
1019                 if (memcmp((void *)(p+2), cur->ssid.ssid, cur->ssid.ssid_length))
1020                         status = WLAN_STATUS_CHALLENGE_FAIL;
1021
1022                 if (ie_len != cur->ssid.ssid_length)
1023                         status = WLAN_STATUS_CHALLENGE_FAIL;
1024         }
1025
1026         if (status != WLAN_STATUS_SUCCESS)
1027                 goto OnAssocReqFail;
1028
1029         /*  check if the supported rate is ok */
1030         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_SUPP_RATES, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1031         if (!p) {
1032                 /*  use our own rate set as statoin used */
1033                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
1034                 /* supportRateNum = AP_BSSRATE_LEN; */
1035
1036                 status = WLAN_STATUS_CHALLENGE_FAIL;
1037                 goto OnAssocReqFail;
1038         } else {
1039                 memcpy(supportRate, p+2, ie_len);
1040                 supportRateNum = ie_len;
1041
1042                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_EXT_SUPP_RATES, &ie_len,
1043                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1044                 if (p) {
1045
1046                         if (supportRateNum <= sizeof(supportRate)) {
1047                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
1048                                 supportRateNum += ie_len;
1049                         }
1050                 }
1051         }
1052
1053         /* todo: mask supportRate between AP & STA -> move to update raid */
1054         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
1055
1056         /* update station supportRate */
1057         pstat->bssratelen = supportRateNum;
1058         memcpy(pstat->bssrateset, supportRate, supportRateNum);
1059         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
1060
1061         /* check RSN/WPA/WPS */
1062         pstat->dot8021xalg = 0;
1063         pstat->wpa_psk = 0;
1064         pstat->wpa_group_cipher = 0;
1065         pstat->wpa2_group_cipher = 0;
1066         pstat->wpa_pairwise_cipher = 0;
1067         pstat->wpa2_pairwise_cipher = 0;
1068         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
1069         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
1070
1071                 int group_cipher = 0, pairwise_cipher = 0;
1072
1073                 wpa_ie = elems.rsn_ie;
1074                 wpa_ie_len = elems.rsn_ie_len;
1075
1076                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
1077                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
1078                         pstat->wpa_psk |= BIT(1);
1079
1080                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
1081                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
1082
1083                         if (!pstat->wpa2_group_cipher)
1084                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
1085
1086                         if (!pstat->wpa2_pairwise_cipher)
1087                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
1088                 } else {
1089                         status = WLAN_STATUS_INVALID_IE;
1090                 }
1091
1092         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
1093
1094                 int group_cipher = 0, pairwise_cipher = 0;
1095
1096                 wpa_ie = elems.wpa_ie;
1097                 wpa_ie_len = elems.wpa_ie_len;
1098
1099                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
1100                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
1101                         pstat->wpa_psk |= BIT(0);
1102
1103                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
1104                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
1105
1106                         if (!pstat->wpa_group_cipher)
1107                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
1108
1109                         if (!pstat->wpa_pairwise_cipher)
1110                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
1111
1112                 } else {
1113                         status = WLAN_STATUS_INVALID_IE;
1114                 }
1115
1116         } else {
1117                 wpa_ie = NULL;
1118                 wpa_ie_len = 0;
1119         }
1120
1121         if (status != WLAN_STATUS_SUCCESS)
1122                 goto OnAssocReqFail;
1123
1124         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
1125         if (!wpa_ie) {
1126                 if (elems.wps_ie) {
1127                         pstat->flags |= WLAN_STA_WPS;
1128                         /* wpabuf_free(sta->wps_ie); */
1129                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
1130                         /*                              elems.wps_ie_len - 4); */
1131                 } else {
1132                         pstat->flags |= WLAN_STA_MAYBE_WPS;
1133                 }
1134
1135
1136                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
1137                 /*  that the selected registrar of AP is _FLASE */
1138                 if ((psecuritypriv->wpa_psk > 0)
1139                         && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
1140                         if (pmlmepriv->wps_beacon_ie) {
1141                                 u8 selected_registrar = 0;
1142
1143                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
1144
1145                                 if (!selected_registrar) {
1146                                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1147
1148                                         goto OnAssocReqFail;
1149                                 }
1150                         }
1151                 }
1152
1153         } else {
1154                 int copy_len;
1155
1156                 if (psecuritypriv->wpa_psk == 0) {
1157                         status = WLAN_STATUS_INVALID_IE;
1158
1159                         goto OnAssocReqFail;
1160
1161                 }
1162
1163                 if (elems.wps_ie) {
1164                         pstat->flags |= WLAN_STA_WPS;
1165                         copy_len = 0;
1166                 } else {
1167                         copy_len = ((wpa_ie_len+2) > sizeof(pstat->wpa_ie)) ? (sizeof(pstat->wpa_ie)):(wpa_ie_len+2);
1168                 }
1169
1170
1171                 if (copy_len > 0)
1172                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
1173
1174         }
1175
1176
1177         /*  check if there is WMM IE & support WWM-PS */
1178         pstat->flags &= ~WLAN_STA_WME;
1179         pstat->qos_option = 0;
1180         pstat->qos_info = 0;
1181         pstat->has_legacy_ac = true;
1182         pstat->uapsd_vo = 0;
1183         pstat->uapsd_vi = 0;
1184         pstat->uapsd_be = 0;
1185         pstat->uapsd_bk = 0;
1186         if (pmlmepriv->qospriv.qos_option) {
1187                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
1188                 for (;;) {
1189                         p = rtw_get_ie(p, WLAN_EID_VENDOR_SPECIFIC, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1190                         if (p) {
1191                                 if (!memcmp(p+2, WMM_IE, 6)) {
1192
1193                                         pstat->flags |= WLAN_STA_WME;
1194
1195                                         pstat->qos_option = 1;
1196                                         pstat->qos_info = *(p+8);
1197
1198                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
1199
1200                                         if ((pstat->qos_info&0xf) != 0xf)
1201                                                 pstat->has_legacy_ac = true;
1202                                         else
1203                                                 pstat->has_legacy_ac = false;
1204
1205                                         if (pstat->qos_info&0xf) {
1206                                                 if (pstat->qos_info&BIT(0))
1207                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
1208                                                 else
1209                                                         pstat->uapsd_vo = 0;
1210
1211                                                 if (pstat->qos_info&BIT(1))
1212                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
1213                                                 else
1214                                                         pstat->uapsd_vi = 0;
1215
1216                                                 if (pstat->qos_info&BIT(2))
1217                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
1218                                                 else
1219                                                         pstat->uapsd_bk = 0;
1220
1221                                                 if (pstat->qos_info&BIT(3))
1222                                                         pstat->uapsd_be = BIT(0)|BIT(1);
1223                                                 else
1224                                                         pstat->uapsd_be = 0;
1225
1226                                         }
1227
1228                                         break;
1229                                 }
1230                         } else {
1231                                 break;
1232                         }
1233                         p = p + ie_len + 2;
1234                 }
1235         }
1236
1237         /* save HT capabilities in the sta object */
1238         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
1239         if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
1240                 pstat->flags |= WLAN_STA_HT;
1241
1242                 pstat->flags |= WLAN_STA_WME;
1243
1244                 memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
1245
1246         } else
1247                 pstat->flags &= ~WLAN_STA_HT;
1248
1249
1250         if ((pmlmepriv->htpriv.ht_option == false) && (pstat->flags&WLAN_STA_HT)) {
1251                 status = WLAN_STATUS_CHALLENGE_FAIL;
1252                 goto OnAssocReqFail;
1253         }
1254
1255
1256         if ((pstat->flags & WLAN_STA_HT) &&
1257                     ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
1258                       (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
1259                 /* status = WLAN_STATUS_CIPHER_SUITE_REJECTED; */
1260                 /* goto OnAssocReqFail; */
1261         }
1262         pstat->flags |= WLAN_STA_NONERP;
1263         for (i = 0; i < pstat->bssratelen; i++) {
1264                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
1265                         pstat->flags &= ~WLAN_STA_NONERP;
1266                         break;
1267                 }
1268         }
1269
1270         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1271                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
1272         else
1273                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1274
1275
1276
1277         if (status != WLAN_STATUS_SUCCESS)
1278                 goto OnAssocReqFail;
1279
1280         /* TODO: identify_proprietary_vendor_ie(); */
1281         /*  Realtek proprietary IE */
1282         /*  identify if this is Broadcom sta */
1283         /*  identify if this is ralink sta */
1284         /*  Customer proprietary IE */
1285
1286
1287
1288         /* get a unique AID */
1289         if (pstat->aid == 0) {
1290                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
1291                         if (!pstapriv->sta_aid[pstat->aid - 1])
1292                                 break;
1293
1294                 /* if (pstat->aid > NUM_STA) { */
1295                 if (pstat->aid > pstapriv->max_num_sta) {
1296
1297                         pstat->aid = 0;
1298
1299                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1300
1301                         goto OnAssocReqFail;
1302
1303
1304                 } else {
1305                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
1306                 }
1307         }
1308
1309
1310         pstat->state &= (~WIFI_FW_ASSOC_STATE);
1311         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
1312
1313         spin_lock_bh(&pstapriv->auth_list_lock);
1314         if (!list_empty(&pstat->auth_list)) {
1315                 list_del_init(&pstat->auth_list);
1316                 pstapriv->auth_list_cnt--;
1317         }
1318         spin_unlock_bh(&pstapriv->auth_list_lock);
1319
1320         spin_lock_bh(&pstapriv->asoc_list_lock);
1321         if (list_empty(&pstat->asoc_list)) {
1322                 pstat->expire_to = pstapriv->expire_to;
1323                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
1324                 pstapriv->asoc_list_cnt++;
1325         }
1326         spin_unlock_bh(&pstapriv->asoc_list_lock);
1327
1328         /*  now the station is qualified to join our BSS... */
1329         if (pstat && (pstat->state & WIFI_FW_ASSOC_SUCCESS) && (status == WLAN_STATUS_SUCCESS)) {
1330                 /* 1 bss_cap_update & sta_info_update */
1331                 bss_cap_update_on_sta_join(padapter, pstat);
1332                 sta_info_update(padapter, pstat);
1333
1334                 /* 2 issue assoc rsp before notify station join event. */
1335                 if (frame_type == WIFI_ASSOCREQ)
1336                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
1337                 else
1338                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
1339
1340                 spin_lock_bh(&pstat->lock);
1341                 kfree(pstat->passoc_req);
1342                 pstat->assoc_req_len = 0;
1343                 pstat->passoc_req =  rtw_zmalloc(pkt_len);
1344                 if (pstat->passoc_req) {
1345                         memcpy(pstat->passoc_req, pframe, pkt_len);
1346                         pstat->assoc_req_len = pkt_len;
1347                 }
1348                 spin_unlock_bh(&pstat->lock);
1349
1350                 /* 3-(1) report sta add event */
1351                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
1352         }
1353
1354         return _SUCCESS;
1355
1356 asoc_class2_error:
1357
1358         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
1359
1360         return _FAIL;
1361
1362 OnAssocReqFail:
1363
1364         pstat->aid = 0;
1365         if (frame_type == WIFI_ASSOCREQ)
1366                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
1367         else
1368                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
1369
1370         return _FAIL;
1371 }
1372
1373 unsigned int OnAssocRsp(struct adapter *padapter, union recv_frame *precv_frame)
1374 {
1375         uint i;
1376         int res;
1377         unsigned short  status;
1378         struct ndis_80211_var_ie *pIE;
1379         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1380         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1381         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1382         /* struct wlan_bssid_ex                 *cur_network = &(pmlmeinfo->network); */
1383         u8 *pframe = precv_frame->u.hdr.rx_data;
1384         uint pkt_len = precv_frame->u.hdr.len;
1385
1386         /* check A1 matches or not */
1387         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
1388                 return _SUCCESS;
1389
1390         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
1391                 return _SUCCESS;
1392
1393         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
1394                 return _SUCCESS;
1395
1396         del_timer_sync(&pmlmeext->link_timer);
1397
1398         /* status */
1399         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
1400         if (status > 0) {
1401                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
1402                 res = -4;
1403                 goto report_assoc_result;
1404         }
1405
1406         /* get capabilities */
1407         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1408
1409         /* set slot time */
1410         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
1411
1412         /* AID */
1413         res = pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
1414
1415         /* following are moved to join event callback function */
1416         /* to handle HT, WMM, rate adaptive, update MAC reg */
1417         /* for not to handle the synchronous IO in the tasklet */
1418         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
1419                 pIE = (struct ndis_80211_var_ie *)(pframe + i);
1420
1421                 switch (pIE->element_id) {
1422                 case WLAN_EID_VENDOR_SPECIFIC:
1423                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6))        /* WMM */
1424                                 WMM_param_handler(padapter, pIE);
1425                         break;
1426
1427                 case WLAN_EID_HT_CAPABILITY:    /* HT caps */
1428                         HT_caps_handler(padapter, pIE);
1429                         break;
1430
1431                 case WLAN_EID_HT_OPERATION:     /* HT info */
1432                         HT_info_handler(padapter, pIE);
1433                         break;
1434
1435                 case WLAN_EID_ERP_INFO:
1436                         ERP_IE_handler(padapter, pIE);
1437                         break;
1438
1439                 default:
1440                         break;
1441                 }
1442
1443                 i += (pIE->length + 2);
1444         }
1445
1446         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
1447         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
1448
1449         /* Update Basic Rate Table for spec, 2010-12-28 , by thomas */
1450         UpdateBrateTbl(padapter, pmlmeinfo->network.supported_rates);
1451
1452 report_assoc_result:
1453         if (res > 0)
1454                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
1455         else
1456                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
1457
1458         report_join_res(padapter, res);
1459
1460         return _SUCCESS;
1461 }
1462
1463 unsigned int OnDeAuth(struct adapter *padapter, union recv_frame *precv_frame)
1464 {
1465         unsigned short  reason;
1466         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1467         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1468         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1469         u8 *pframe = precv_frame->u.hdr.rx_data;
1470         int ignore_received_deauth = 0;
1471
1472         /* check A3 */
1473         if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
1474                 return _SUCCESS;
1475
1476         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1477
1478         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1479                 struct sta_info *psta;
1480                 struct sta_priv *pstapriv = &padapter->stapriv;
1481
1482                 /* rtw_free_stainfo(padapter, psta); */
1483
1484                 netdev_dbg(padapter->pnetdev,
1485                            "ap recv deauth reason code(%d) sta:%pM\n", reason,
1486                            GetAddr2Ptr(pframe));
1487
1488                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1489                 if (psta) {
1490                         u8 updated = false;
1491
1492                         spin_lock_bh(&pstapriv->asoc_list_lock);
1493                         if (list_empty(&psta->asoc_list) == false) {
1494                                 list_del_init(&psta->asoc_list);
1495                                 pstapriv->asoc_list_cnt--;
1496                                 updated = ap_free_sta(padapter, psta, false, reason);
1497
1498                         }
1499                         spin_unlock_bh(&pstapriv->asoc_list_lock);
1500
1501                         associated_clients_update(padapter, updated);
1502                 }
1503
1504
1505                 return _SUCCESS;
1506         }
1507
1508         /*      Commented by Albert 20130604 */
1509         /*      Before sending the auth frame to start the STA/GC mode connection with AP/GO, */
1510         /*      we will send the deauth first. */
1511         /*      However, the Win8.1 with BRCM Wi-Fi will send the deauth with reason code 6 to us after receieving our deauth. */
1512         /*      Added the following code to avoid this case. */
1513         if ((pmlmeinfo->state & WIFI_FW_AUTH_STATE) ||
1514             (pmlmeinfo->state & WIFI_FW_ASSOC_STATE)) {
1515                 if (reason == WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA) {
1516                         ignore_received_deauth = 1;
1517                 } else if (reason == WLAN_REASON_PREV_AUTH_NOT_VALID) {
1518                         /*  TODO: 802.11r */
1519                         ignore_received_deauth = 1;
1520                 }
1521         }
1522
1523         netdev_dbg(padapter->pnetdev,
1524                    "sta recv deauth reason code(%d) sta:%pM, ignore = %d\n",
1525                    reason, GetAddr3Ptr(pframe),
1526                    ignore_received_deauth);
1527
1528         if (ignore_received_deauth == 0)
1529                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
1530
1531         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
1532         return _SUCCESS;
1533 }
1534
1535 unsigned int OnDisassoc(struct adapter *padapter, union recv_frame *precv_frame)
1536 {
1537         unsigned short  reason;
1538         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1539         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1540         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1541         u8 *pframe = precv_frame->u.hdr.rx_data;
1542
1543         /* check A3 */
1544         if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
1545                 return _SUCCESS;
1546
1547         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1548
1549         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1550                 struct sta_info *psta;
1551                 struct sta_priv *pstapriv = &padapter->stapriv;
1552
1553                 /* rtw_free_stainfo(padapter, psta); */
1554
1555                 netdev_dbg(padapter->pnetdev,
1556                            "ap recv disassoc reason code(%d) sta:%pM\n",
1557                            reason, GetAddr2Ptr(pframe));
1558
1559                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1560                 if (psta) {
1561                         u8 updated = false;
1562
1563                         spin_lock_bh(&pstapriv->asoc_list_lock);
1564                         if (list_empty(&psta->asoc_list) == false) {
1565                                 list_del_init(&psta->asoc_list);
1566                                 pstapriv->asoc_list_cnt--;
1567                                 updated = ap_free_sta(padapter, psta, false, reason);
1568
1569                         }
1570                         spin_unlock_bh(&pstapriv->asoc_list_lock);
1571
1572                         associated_clients_update(padapter, updated);
1573                 }
1574
1575                 return _SUCCESS;
1576         }
1577         netdev_dbg(padapter->pnetdev,
1578                    "sta recv disassoc reason code(%d) sta:%pM\n",
1579                    reason, GetAddr3Ptr(pframe));
1580
1581         receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
1582
1583         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
1584         return _SUCCESS;
1585
1586 }
1587
1588 unsigned int OnAtim(struct adapter *padapter, union recv_frame *precv_frame)
1589 {
1590         return _SUCCESS;
1591 }
1592
1593 unsigned int on_action_spct(struct adapter *padapter, union recv_frame *precv_frame)
1594 {
1595         struct sta_info *psta = NULL;
1596         struct sta_priv *pstapriv = &padapter->stapriv;
1597         u8 *pframe = precv_frame->u.hdr.rx_data;
1598         u8 *frame_body = (u8 *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1599         u8 category;
1600         u8 action;
1601
1602         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1603
1604         if (!psta)
1605                 goto exit;
1606
1607         category = frame_body[0];
1608         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
1609                 goto exit;
1610
1611         action = frame_body[1];
1612         switch (action) {
1613         case WLAN_ACTION_SPCT_MSR_REQ:
1614         case WLAN_ACTION_SPCT_MSR_RPRT:
1615         case WLAN_ACTION_SPCT_TPC_REQ:
1616         case WLAN_ACTION_SPCT_TPC_RPRT:
1617         case WLAN_ACTION_SPCT_CHL_SWITCH:
1618                 break;
1619         default:
1620                 break;
1621         }
1622
1623 exit:
1624         return _FAIL;
1625 }
1626
1627 unsigned int OnAction_back(struct adapter *padapter, union recv_frame *precv_frame)
1628 {
1629         u8 *addr;
1630         struct sta_info *psta = NULL;
1631         struct recv_reorder_ctrl *preorder_ctrl;
1632         unsigned char   *frame_body;
1633         unsigned char   category, action;
1634         unsigned short  tid, status;
1635         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1636         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1637         u8 *pframe = precv_frame->u.hdr.rx_data;
1638         struct sta_priv *pstapriv = &padapter->stapriv;
1639
1640         /* check RA matches or not */
1641         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))/* for if1, sta/ap mode */
1642                 return _SUCCESS;
1643
1644         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1645                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1646                         return _SUCCESS;
1647
1648         addr = GetAddr2Ptr(pframe);
1649         psta = rtw_get_stainfo(pstapriv, addr);
1650
1651         if (!psta)
1652                 return _SUCCESS;
1653
1654         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1655
1656         category = frame_body[0];
1657         if (category == RTW_WLAN_CATEGORY_BACK) {/*  representing Block Ack */
1658                 if (!pmlmeinfo->HT_enable)
1659                         return _SUCCESS;
1660
1661                 action = frame_body[1];
1662                 switch (action) {
1663                 case WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
1664
1665                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
1666                         /* process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), GetAddr3Ptr(pframe)); */
1667                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
1668
1669                         if (pmlmeinfo->accept_addba_req)
1670                                 issue_action_BA(padapter, addr, WLAN_ACTION_ADDBA_RESP, 0);
1671                         else
1672                                 issue_action_BA(padapter, addr, WLAN_ACTION_ADDBA_RESP, 37);/* reject ADDBA Req */
1673
1674                         break;
1675
1676                 case WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
1677                         status = get_unaligned_le16(&frame_body[3]);
1678                         tid = ((frame_body[5] >> 2) & 0x7);
1679
1680                         if (status == 0) {
1681                                 /* successful */
1682                                 psta->htpriv.agg_enable_bitmap |= BIT(tid);
1683                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1684                         } else {
1685                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1686                         }
1687
1688                         if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
1689                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1690                                 psta->expire_to = pstapriv->expire_to;
1691                                 psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
1692                         }
1693
1694                         break;
1695
1696                 case WLAN_ACTION_DELBA: /* DELBA */
1697                         if ((frame_body[3] & BIT(3)) == 0) {
1698                                 psta->htpriv.agg_enable_bitmap &=
1699                                         ~BIT((frame_body[3] >> 4) & 0xf);
1700                                 psta->htpriv.candidate_tid_bitmap &=
1701                                         ~BIT((frame_body[3] >> 4) & 0xf);
1702                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
1703                                 tid = (frame_body[3] >> 4) & 0x0F;
1704
1705                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
1706                                 preorder_ctrl->enable = false;
1707                                 preorder_ctrl->indicate_seq = 0xffff;
1708                         }
1709                         /* todo: how to notify the host while receiving DELETE BA */
1710                         break;
1711
1712                 default:
1713                         break;
1714                 }
1715         }
1716         return _SUCCESS;
1717 }
1718
1719 static s32 rtw_action_public_decache(union recv_frame *recv_frame, s32 token)
1720 {
1721         struct adapter *adapter = recv_frame->u.hdr.adapter;
1722         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
1723         u8 *frame = recv_frame->u.hdr.rx_data;
1724         u16 seq_ctrl = ((recv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
1725                 (recv_frame->u.hdr.attrib.frag_num & 0xf);
1726
1727         if (GetRetry(frame)) {
1728                 if (token >= 0) {
1729                         if ((seq_ctrl == mlmeext->action_public_rxseq)
1730                                 && (token == mlmeext->action_public_dialog_token))
1731                                 return _FAIL;
1732                 } else {
1733                         if (seq_ctrl == mlmeext->action_public_rxseq)
1734                                 return _FAIL;
1735                 }
1736         }
1737
1738         mlmeext->action_public_rxseq = seq_ctrl;
1739
1740         if (token >= 0)
1741                 mlmeext->action_public_dialog_token = token;
1742
1743         return _SUCCESS;
1744 }
1745
1746 static unsigned int on_action_public_p2p(union recv_frame *precv_frame)
1747 {
1748         u8 *pframe = precv_frame->u.hdr.rx_data;
1749         u8 *frame_body;
1750         u8 dialogToken = 0;
1751
1752         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1753
1754         dialogToken = frame_body[7];
1755
1756         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
1757                 return _FAIL;
1758
1759         return _SUCCESS;
1760 }
1761
1762 static unsigned int on_action_public_vendor(union recv_frame *precv_frame)
1763 {
1764         unsigned int ret = _FAIL;
1765         u8 *pframe = precv_frame->u.hdr.rx_data;
1766         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1767
1768         if (!memcmp(frame_body + 2, P2P_OUI, 4))
1769                 ret = on_action_public_p2p(precv_frame);
1770
1771         return ret;
1772 }
1773
1774 static unsigned int on_action_public_default(union recv_frame *precv_frame, u8 action)
1775 {
1776         unsigned int ret = _FAIL;
1777         u8 *pframe = precv_frame->u.hdr.rx_data;
1778         uint frame_len = precv_frame->u.hdr.len;
1779         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1780         u8 token;
1781         struct adapter *adapter = precv_frame->u.hdr.adapter;
1782         char msg[64];
1783
1784         token = frame_body[2];
1785
1786         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
1787                 goto exit;
1788
1789         scnprintf(msg, sizeof(msg), "%s(token:%u)", action_public_str(action), token);
1790         rtw_cfg80211_rx_action(adapter, pframe, frame_len, msg);
1791
1792         ret = _SUCCESS;
1793
1794 exit:
1795         return ret;
1796 }
1797
1798 unsigned int on_action_public(struct adapter *padapter, union recv_frame *precv_frame)
1799 {
1800         unsigned int ret = _FAIL;
1801         u8 *pframe = precv_frame->u.hdr.rx_data;
1802         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1803         u8 category, action;
1804
1805         /* check RA matches or not */
1806         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
1807                 goto exit;
1808
1809         category = frame_body[0];
1810         if (category != RTW_WLAN_CATEGORY_PUBLIC)
1811                 goto exit;
1812
1813         action = frame_body[1];
1814         switch (action) {
1815         case ACT_PUBLIC_VENDOR:
1816                 ret = on_action_public_vendor(precv_frame);
1817                 break;
1818         default:
1819                 ret = on_action_public_default(precv_frame, action);
1820                 break;
1821         }
1822
1823 exit:
1824         return ret;
1825 }
1826
1827 unsigned int OnAction_ht(struct adapter *padapter, union recv_frame *precv_frame)
1828 {
1829         u8 *pframe = precv_frame->u.hdr.rx_data;
1830         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1831         u8 category, action;
1832
1833         /* check RA matches or not */
1834         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
1835                 goto exit;
1836
1837         category = frame_body[0];
1838         if (category != RTW_WLAN_CATEGORY_HT)
1839                 goto exit;
1840
1841         action = frame_body[1];
1842         switch (action) {
1843         case WLAN_HT_ACTION_COMPRESSED_BF:
1844                 break;
1845         default:
1846                 break;
1847         }
1848
1849 exit:
1850
1851         return _SUCCESS;
1852 }
1853
1854 unsigned int OnAction_sa_query(struct adapter *padapter, union recv_frame *precv_frame)
1855 {
1856         u8 *pframe = precv_frame->u.hdr.rx_data;
1857         struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
1858         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1859         unsigned short tid;
1860
1861         switch (pframe[WLAN_HDR_A3_LEN+1]) {
1862         case 0: /* SA Query req */
1863                 memcpy(&tid, &pframe[WLAN_HDR_A3_LEN+2], sizeof(unsigned short));
1864                 issue_action_SA_Query(padapter, GetAddr2Ptr(pframe), 1, tid);
1865                 break;
1866
1867         case 1: /* SA Query rsp */
1868                 del_timer_sync(&pmlmeext->sa_query_timer);
1869                 break;
1870         default:
1871                 break;
1872         }
1873         if (0) {
1874                 int pp;
1875
1876                 printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
1877                 for (pp = 0; pp < pattrib->pkt_len; pp++)
1878                         printk(" %02x ", pframe[pp]);
1879                 printk("\n");
1880         }
1881
1882         return _SUCCESS;
1883 }
1884
1885 unsigned int OnAction(struct adapter *padapter, union recv_frame *precv_frame)
1886 {
1887         int i;
1888         unsigned char category;
1889         struct action_handler *ptable;
1890         unsigned char *frame_body;
1891         u8 *pframe = precv_frame->u.hdr.rx_data;
1892
1893         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1894
1895         category = frame_body[0];
1896
1897         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
1898                 ptable = &OnAction_tbl[i];
1899
1900                 if (category == ptable->num)
1901                         ptable->func(padapter, precv_frame);
1902
1903         }
1904
1905         return _SUCCESS;
1906
1907 }
1908
1909 unsigned int DoReserved(struct adapter *padapter, union recv_frame *precv_frame)
1910 {
1911         return _SUCCESS;
1912 }
1913
1914 static struct xmit_frame *_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv, bool once)
1915 {
1916         struct xmit_frame *pmgntframe;
1917         struct xmit_buf *pxmitbuf;
1918
1919         if (once)
1920                 pmgntframe = rtw_alloc_xmitframe_once(pxmitpriv);
1921         else
1922                 pmgntframe = rtw_alloc_xmitframe_ext(pxmitpriv);
1923
1924         if (!pmgntframe)
1925                 goto exit;
1926
1927         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
1928         if (!pxmitbuf) {
1929                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1930                 pmgntframe = NULL;
1931                 goto exit;
1932         }
1933
1934         pmgntframe->frame_tag = MGNT_FRAMETAG;
1935         pmgntframe->pxmitbuf = pxmitbuf;
1936         pmgntframe->buf_addr = pxmitbuf->pbuf;
1937         pxmitbuf->priv_data = pmgntframe;
1938
1939 exit:
1940         return pmgntframe;
1941
1942 }
1943
1944 inline struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
1945 {
1946         return _alloc_mgtxmitframe(pxmitpriv, false);
1947 }
1948
1949 /****************************************************************************
1950
1951 Following are some TX functions for WiFi MLME
1952
1953 *****************************************************************************/
1954
1955 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
1956 {
1957         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1958
1959         pmlmeext->tx_rate = rate;
1960 }
1961
1962 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
1963 {
1964         u8 wireless_mode;
1965         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1966
1967         /* memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib)); */
1968
1969         pattrib->hdrlen = 24;
1970         pattrib->nr_frags = 1;
1971         pattrib->priority = 7;
1972         pattrib->mac_id = 0;
1973         pattrib->qsel = 0x12;
1974
1975         pattrib->pktlen = 0;
1976
1977         if (pmlmeext->tx_rate == IEEE80211_CCK_RATE_1MB)
1978                 wireless_mode = WIRELESS_11B;
1979         else
1980                 wireless_mode = WIRELESS_11G;
1981         pattrib->raid =  rtw_get_mgntframe_raid(padapter, wireless_mode);
1982         pattrib->rate = pmlmeext->tx_rate;
1983
1984         pattrib->encrypt = _NO_PRIVACY_;
1985         pattrib->bswenc = false;
1986
1987         pattrib->qos_en = false;
1988         pattrib->ht_en = false;
1989         pattrib->bwmode = CHANNEL_WIDTH_20;
1990         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
1991         pattrib->sgi = false;
1992
1993         pattrib->seqnum = pmlmeext->mgnt_seq;
1994
1995         pattrib->retry_ctrl = true;
1996
1997         pattrib->mbssid = 0;
1998
1999 }
2000
2001 void update_mgntframe_attrib_addr(struct adapter *padapter, struct xmit_frame *pmgntframe)
2002 {
2003         u8 *pframe;
2004         struct pkt_attrib       *pattrib = &pmgntframe->attrib;
2005
2006         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2007
2008         memcpy(pattrib->ra, GetAddr1Ptr(pframe), ETH_ALEN);
2009         memcpy(pattrib->ta, GetAddr2Ptr(pframe), ETH_ALEN);
2010 }
2011
2012 void dump_mgntframe(struct adapter *padapter, struct xmit_frame *pmgntframe)
2013 {
2014         if (padapter->bSurpriseRemoved ||
2015                 padapter->bDriverStopped) {
2016                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2017                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2018                 return;
2019         }
2020
2021         rtw_hal_mgnt_xmit(padapter, pmgntframe);
2022 }
2023
2024 s32 dump_mgntframe_and_wait(struct adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms)
2025 {
2026         s32 ret = _FAIL;
2027         unsigned long irqL;
2028         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2029         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
2030         struct submit_ctx sctx;
2031
2032         if (padapter->bSurpriseRemoved ||
2033                 padapter->bDriverStopped) {
2034                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2035                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2036                 return ret;
2037         }
2038
2039         rtw_sctx_init(&sctx, timeout_ms);
2040         pxmitbuf->sctx = &sctx;
2041
2042         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
2043
2044         if (ret == _SUCCESS)
2045                 ret = rtw_sctx_wait(&sctx);
2046
2047         spin_lock_irqsave(&pxmitpriv->lock_sctx, irqL);
2048         pxmitbuf->sctx = NULL;
2049         spin_unlock_irqrestore(&pxmitpriv->lock_sctx, irqL);
2050
2051         return ret;
2052 }
2053
2054 s32 dump_mgntframe_and_wait_ack(struct adapter *padapter, struct xmit_frame *pmgntframe)
2055 {
2056         static u8 seq_no;
2057         s32 ret = _FAIL;
2058         u32 timeout_ms = 500;/*   500ms */
2059         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2060
2061         if (padapter->bSurpriseRemoved ||
2062                 padapter->bDriverStopped) {
2063                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2064                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2065                 return -1;
2066         }
2067
2068         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex) == 0) {
2069                 pxmitpriv->ack_tx = true;
2070                 pxmitpriv->seq_no = seq_no++;
2071                 pmgntframe->ack_report = 1;
2072                 if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
2073                         ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
2074
2075                 pxmitpriv->ack_tx = false;
2076                 mutex_unlock(&pxmitpriv->ack_tx_mutex);
2077         }
2078
2079         return ret;
2080 }
2081
2082 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
2083 {
2084         u8 *ssid_ie;
2085         signed int ssid_len_ori;
2086         int len_diff = 0;
2087
2088         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
2089
2090         if (ssid_ie && ssid_len_ori > 0) {
2091                 switch (hidden_ssid_mode) {
2092                 case 1:
2093                 {
2094                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
2095                         u32 remain_len = 0;
2096
2097                         remain_len = ies_len - (next_ie-ies);
2098
2099                         ssid_ie[1] = 0;
2100                         memcpy(ssid_ie+2, next_ie, remain_len);
2101                         len_diff -= ssid_len_ori;
2102
2103                         break;
2104                 }
2105                 case 2:
2106                         memset(&ssid_ie[2], 0, ssid_len_ori);
2107                         break;
2108                 default:
2109                         break;
2110         }
2111         }
2112
2113         return len_diff;
2114 }
2115
2116 void issue_beacon(struct adapter *padapter, int timeout_ms)
2117 {
2118         struct xmit_frame       *pmgntframe;
2119         struct pkt_attrib       *pattrib;
2120         unsigned char *pframe;
2121         struct ieee80211_hdr *pwlanhdr;
2122         __le16 *fctrl;
2123         unsigned int    rate_len;
2124         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2125         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2126         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2127         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2128         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
2129
2130         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2131         if (!pmgntframe)
2132                 return;
2133
2134         spin_lock_bh(&pmlmepriv->bcn_update_lock);
2135
2136         /* update attribute */
2137         pattrib = &pmgntframe->attrib;
2138         update_mgntframe_attrib(padapter, pattrib);
2139         pattrib->qsel = 0x10;
2140
2141         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2142
2143         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2144         pwlanhdr = (struct ieee80211_hdr *)pframe;
2145
2146
2147         fctrl = &(pwlanhdr->frame_control);
2148         *(fctrl) = 0;
2149
2150         eth_broadcast_addr(pwlanhdr->addr1);
2151         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2152         memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
2153
2154         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
2155         /* pmlmeext->mgnt_seq++; */
2156         SetFrameSubType(pframe, WIFI_BEACON);
2157
2158         pframe += sizeof(struct ieee80211_hdr_3addr);
2159         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2160
2161         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
2162                 {
2163                         int len_diff;
2164
2165                         memcpy(pframe, cur_network->ies, cur_network->ie_length);
2166                         len_diff = update_hidden_ssid(pframe+_BEACON_IE_OFFSET_,
2167                                                       cur_network->ie_length-_BEACON_IE_OFFSET_,
2168                                                       pmlmeinfo->hidden_ssid_mode);
2169                         pframe += (cur_network->ie_length+len_diff);
2170                         pattrib->pktlen += (cur_network->ie_length+len_diff);
2171                 }
2172
2173                 {
2174                         u8 *wps_ie;
2175                         uint wps_ielen;
2176                         u8 sr = 0;
2177
2178                         wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
2179                                 pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
2180                         if (wps_ie && wps_ielen > 0)
2181                                 rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
2182                         if (sr != 0)
2183                                 set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
2184                         else
2185                                 _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
2186                 }
2187
2188                 goto _issue_bcn;
2189
2190         }
2191
2192         /* below for ad-hoc mode */
2193
2194         /* timestamp will be inserted by hardware */
2195         pframe += 8;
2196         pattrib->pktlen += 8;
2197
2198         /*  beacon interval: 2 bytes */
2199
2200         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
2201
2202         pframe += 2;
2203         pattrib->pktlen += 2;
2204
2205         /*  capability info: 2 bytes */
2206
2207         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
2208
2209         pframe += 2;
2210         pattrib->pktlen += 2;
2211
2212         /*  SSID */
2213         pframe = rtw_set_ie(pframe, WLAN_EID_SSID, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);
2214
2215         /*  supported rates... */
2216         rate_len = rtw_get_rateset_len(cur_network->supported_rates);
2217         pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, ((rate_len > 8) ? 8 : rate_len), cur_network->supported_rates, &pattrib->pktlen);
2218
2219         /*  DS parameter set */
2220         pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, (unsigned char *)&(cur_network->configuration.ds_config), &pattrib->pktlen);
2221
2222         /* if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) */
2223         {
2224                 u8 erpinfo = 0;
2225                 u32 ATIMWindow;
2226                 /*  IBSS Parameter Set... */
2227                 /* ATIMWindow = cur->configuration.ATIMWindow; */
2228                 ATIMWindow = 0;
2229                 pframe = rtw_set_ie(pframe, WLAN_EID_IBSS_PARAMS, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
2230
2231                 /* ERP IE */
2232                 pframe = rtw_set_ie(pframe, WLAN_EID_ERP_INFO, 1, &erpinfo, &pattrib->pktlen);
2233         }
2234
2235
2236         /*  EXTERNDED SUPPORTED RATE */
2237         if (rate_len > 8)
2238                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (cur_network->supported_rates + 8), &pattrib->pktlen);
2239
2240
2241         /* todo:HT for adhoc */
2242
2243 _issue_bcn:
2244
2245         pmlmepriv->update_bcn = false;
2246
2247         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
2248
2249         if ((pattrib->pktlen + TXDESC_SIZE) > 512)
2250                 return;
2251
2252         pattrib->last_txcmdsz = pattrib->pktlen;
2253
2254         if (timeout_ms > 0)
2255                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
2256         else
2257                 dump_mgntframe(padapter, pmgntframe);
2258
2259 }
2260
2261 void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq)
2262 {
2263         struct xmit_frame                       *pmgntframe;
2264         struct pkt_attrib                       *pattrib;
2265         unsigned char                           *pframe;
2266         struct ieee80211_hdr    *pwlanhdr;
2267         __le16 *fctrl;
2268         unsigned char                           *mac, *bssid;
2269         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2270
2271         u8 *pwps_ie;
2272         uint wps_ielen;
2273         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2274         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2275         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2276         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
2277         unsigned int    rate_len;
2278
2279         if (!da)
2280                 return;
2281
2282         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2283         if (!pmgntframe)
2284                 return;
2285
2286         /* update attribute */
2287         pattrib = &pmgntframe->attrib;
2288         update_mgntframe_attrib(padapter, pattrib);
2289
2290         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2291
2292         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2293         pwlanhdr = (struct ieee80211_hdr *)pframe;
2294
2295         mac = myid(&(padapter->eeprompriv));
2296         bssid = cur_network->mac_address;
2297
2298         fctrl = &(pwlanhdr->frame_control);
2299         *(fctrl) = 0;
2300         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
2301         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
2302         memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
2303
2304         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2305         pmlmeext->mgnt_seq++;
2306         SetFrameSubType(fctrl, WIFI_PROBERSP);
2307
2308         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2309         pattrib->pktlen = pattrib->hdrlen;
2310         pframe += pattrib->hdrlen;
2311
2312
2313         if (cur_network->ie_length > MAX_IE_SZ)
2314                 return;
2315
2316         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
2317                 pwps_ie = rtw_get_wps_ie(cur_network->ies+_FIXED_IE_LENGTH_, cur_network->ie_length-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
2318
2319                 /* inerset & update wps_probe_resp_ie */
2320                 if (pmlmepriv->wps_probe_resp_ie && pwps_ie && wps_ielen > 0) {
2321                         uint wps_offset, remainder_ielen;
2322                         u8 *premainder_ie;
2323
2324                         wps_offset = (uint)(pwps_ie - cur_network->ies);
2325
2326                         premainder_ie = pwps_ie + wps_ielen;
2327
2328                         remainder_ielen = cur_network->ie_length - wps_offset - wps_ielen;
2329
2330                         memcpy(pframe, cur_network->ies, wps_offset);
2331                         pframe += wps_offset;
2332                         pattrib->pktlen += wps_offset;
2333
2334                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
2335                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
2336                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
2337                                 pframe += wps_ielen+2;
2338                                 pattrib->pktlen += wps_ielen+2;
2339                         }
2340
2341                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
2342                                 memcpy(pframe, premainder_ie, remainder_ielen);
2343                                 pframe += remainder_ielen;
2344                                 pattrib->pktlen += remainder_ielen;
2345                         }
2346                 } else {
2347                         memcpy(pframe, cur_network->ies, cur_network->ie_length);
2348                         pframe += cur_network->ie_length;
2349                         pattrib->pktlen += cur_network->ie_length;
2350                 }
2351
2352                 /* retrieve SSID IE from cur_network->ssid */
2353                 {
2354                         u8 *ssid_ie;
2355                         signed int ssid_ielen;
2356                         signed int ssid_ielen_diff;
2357                         u8 *buf;
2358                         u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr);
2359
2360                         buf = rtw_zmalloc(MAX_IE_SZ);
2361                         if (!buf)
2362                                 return;
2363
2364                         ssid_ie = rtw_get_ie(ies+_FIXED_IE_LENGTH_, WLAN_EID_SSID, &ssid_ielen,
2365                                 (pframe-ies)-_FIXED_IE_LENGTH_);
2366
2367                         ssid_ielen_diff = cur_network->ssid.ssid_length - ssid_ielen;
2368
2369                         if (ssid_ie &&  cur_network->ssid.ssid_length) {
2370                                 uint remainder_ielen;
2371                                 u8 *remainder_ie;
2372
2373                                 remainder_ie = ssid_ie+2;
2374                                 remainder_ielen = (pframe-remainder_ie);
2375
2376                                 if (remainder_ielen > MAX_IE_SZ) {
2377                                         netdev_warn(padapter->pnetdev,
2378                                                     FUNC_ADPT_FMT " remainder_ielen > MAX_IE_SZ\n",
2379                                                     FUNC_ADPT_ARG(padapter));
2380                                         remainder_ielen = MAX_IE_SZ;
2381                                 }
2382
2383                                 memcpy(buf, remainder_ie, remainder_ielen);
2384                                 memcpy(remainder_ie+ssid_ielen_diff, buf, remainder_ielen);
2385                                 *(ssid_ie+1) = cur_network->ssid.ssid_length;
2386                                 memcpy(ssid_ie+2, cur_network->ssid.ssid, cur_network->ssid.ssid_length);
2387
2388                                 pframe += ssid_ielen_diff;
2389                                 pattrib->pktlen += ssid_ielen_diff;
2390                         }
2391                         kfree(buf);
2392                 }
2393         } else {
2394                 /* timestamp will be inserted by hardware */
2395                 pframe += 8;
2396                 pattrib->pktlen += 8;
2397
2398                 /*  beacon interval: 2 bytes */
2399
2400                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
2401
2402                 pframe += 2;
2403                 pattrib->pktlen += 2;
2404
2405                 /*  capability info: 2 bytes */
2406
2407                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
2408
2409                 pframe += 2;
2410                 pattrib->pktlen += 2;
2411
2412                 /* below for ad-hoc mode */
2413
2414                 /*  SSID */
2415                 pframe = rtw_set_ie(pframe, WLAN_EID_SSID, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);
2416
2417                 /*  supported rates... */
2418                 rate_len = rtw_get_rateset_len(cur_network->supported_rates);
2419                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, ((rate_len > 8) ? 8 : rate_len), cur_network->supported_rates, &pattrib->pktlen);
2420
2421                 /*  DS parameter set */
2422                 pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, (unsigned char *)&(cur_network->configuration.ds_config), &pattrib->pktlen);
2423
2424                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2425                         u8 erpinfo = 0;
2426                         u32 ATIMWindow;
2427                         /*  IBSS Parameter Set... */
2428                         /* ATIMWindow = cur->configuration.ATIMWindow; */
2429                         ATIMWindow = 0;
2430                         pframe = rtw_set_ie(pframe, WLAN_EID_IBSS_PARAMS, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
2431
2432                         /* ERP IE */
2433                         pframe = rtw_set_ie(pframe, WLAN_EID_ERP_INFO, 1, &erpinfo, &pattrib->pktlen);
2434                 }
2435
2436
2437                 /*  EXTERNDED SUPPORTED RATE */
2438                 if (rate_len > 8)
2439                         pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (cur_network->supported_rates + 8), &pattrib->pktlen);
2440
2441
2442                 /* todo:HT for adhoc */
2443
2444         }
2445
2446         pattrib->last_txcmdsz = pattrib->pktlen;
2447
2448
2449         dump_mgntframe(padapter, pmgntframe);
2450
2451         return;
2452
2453 }
2454
2455 static int _issue_probereq(struct adapter *padapter,
2456                            struct ndis_802_11_ssid *pssid,
2457                            u8 *da, u8 ch, bool append_wps, bool wait_ack)
2458 {
2459         int ret = _FAIL;
2460         struct xmit_frame               *pmgntframe;
2461         struct pkt_attrib               *pattrib;
2462         unsigned char           *pframe;
2463         struct ieee80211_hdr    *pwlanhdr;
2464         __le16 *fctrl;
2465         unsigned char           *mac;
2466         unsigned char           bssrate[NumRates];
2467         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
2468         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2469         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2470         int     bssrate_len = 0;
2471
2472         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2473         if (!pmgntframe)
2474                 goto exit;
2475
2476         /* update attribute */
2477         pattrib = &pmgntframe->attrib;
2478         update_mgntframe_attrib(padapter, pattrib);
2479
2480
2481         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2482
2483         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2484         pwlanhdr = (struct ieee80211_hdr *)pframe;
2485
2486         mac = myid(&(padapter->eeprompriv));
2487
2488         fctrl = &(pwlanhdr->frame_control);
2489         *(fctrl) = 0;
2490
2491         if (da) {
2492                 /*      unicast probe request frame */
2493                 memcpy(pwlanhdr->addr1, da, ETH_ALEN);
2494                 memcpy(pwlanhdr->addr3, da, ETH_ALEN);
2495         } else {
2496                 /*      broadcast probe request frame */
2497                 eth_broadcast_addr(pwlanhdr->addr1);
2498                 eth_broadcast_addr(pwlanhdr->addr3);
2499         }
2500
2501         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
2502
2503         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2504         pmlmeext->mgnt_seq++;
2505         SetFrameSubType(pframe, WIFI_PROBEREQ);
2506
2507         pframe += sizeof(struct ieee80211_hdr_3addr);
2508         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2509
2510         if (pssid)
2511                 pframe = rtw_set_ie(pframe, WLAN_EID_SSID, pssid->ssid_length, pssid->ssid, &(pattrib->pktlen));
2512         else
2513                 pframe = rtw_set_ie(pframe, WLAN_EID_SSID, 0, NULL, &(pattrib->pktlen));
2514
2515         get_rate_set(padapter, bssrate, &bssrate_len);
2516
2517         if (bssrate_len > 8) {
2518                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, bssrate, &(pattrib->pktlen));
2519                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
2520         } else {
2521                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, bssrate_len, bssrate, &(pattrib->pktlen));
2522         }
2523
2524         if (ch)
2525                 pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, &ch, &pattrib->pktlen);
2526
2527         if (append_wps) {
2528                 /* add wps_ie for wps2.0 */
2529                 if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
2530                         memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
2531                         pframe += pmlmepriv->wps_probe_req_ie_len;
2532                         pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
2533                 }
2534         }
2535
2536         pattrib->last_txcmdsz = pattrib->pktlen;
2537
2538         if (wait_ack) {
2539                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
2540         } else {
2541                 dump_mgntframe(padapter, pmgntframe);
2542                 ret = _SUCCESS;
2543         }
2544
2545 exit:
2546         return ret;
2547 }
2548
2549 inline void issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da)
2550 {
2551         _issue_probereq(padapter, pssid, da, 0, 1, false);
2552 }
2553
2554 int issue_probereq_ex(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, u8 ch, bool append_wps,
2555         int try_cnt, int wait_ms)
2556 {
2557         int ret;
2558         int i = 0;
2559
2560         do {
2561                 ret = _issue_probereq(padapter, pssid, da, ch, append_wps,
2562                                       wait_ms > 0);
2563
2564                 i++;
2565
2566                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
2567                         break;
2568
2569                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
2570                         msleep(wait_ms);
2571
2572         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
2573
2574         if (ret != _FAIL) {
2575                 ret = _SUCCESS;
2576                 #ifndef DBG_XMIT_ACK
2577                 goto exit;
2578                 #endif
2579         }
2580
2581 exit:
2582         return ret;
2583 }
2584
2585 /*  if psta == NULL, indicate we are station(client) now... */
2586 void issue_auth(struct adapter *padapter, struct sta_info *psta, unsigned short status)
2587 {
2588         struct xmit_frame                       *pmgntframe;
2589         struct pkt_attrib                       *pattrib;
2590         unsigned char                           *pframe;
2591         struct ieee80211_hdr    *pwlanhdr;
2592         __le16 *fctrl;
2593         unsigned int                                    val32;
2594         unsigned short                          val16;
2595         int use_shared_key = 0;
2596         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
2597         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2598         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2599         __le16 le_tmp;
2600
2601         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2602         if (!pmgntframe)
2603                 return;
2604
2605         /* update attribute */
2606         pattrib = &pmgntframe->attrib;
2607         update_mgntframe_attrib(padapter, pattrib);
2608
2609         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2610
2611         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2612         pwlanhdr = (struct ieee80211_hdr *)pframe;
2613
2614         fctrl = &(pwlanhdr->frame_control);
2615         *(fctrl) = 0;
2616
2617         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2618         pmlmeext->mgnt_seq++;
2619         SetFrameSubType(pframe, WIFI_AUTH);
2620
2621         pframe += sizeof(struct ieee80211_hdr_3addr);
2622         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2623
2624
2625         if (psta) { /*  for AP mode */
2626                 memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);
2627                 memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2628                 memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
2629
2630                 /*  setting auth algo number */
2631                 val16 = (u16)psta->authalg;
2632
2633                 if (status != WLAN_STATUS_SUCCESS)
2634                         val16 = 0;
2635
2636                 if (val16)
2637                         use_shared_key = 1;
2638
2639                 le_tmp = cpu_to_le16(val16);
2640
2641                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2642
2643                 /*  setting auth seq number */
2644                 val16 = (u16)psta->auth_seq;
2645                 le_tmp = cpu_to_le16(val16);
2646                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2647
2648                 /*  setting status code... */
2649                 val16 = status;
2650                 le_tmp = cpu_to_le16(val16);
2651                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2652
2653                 /*  added challenging text... */
2654                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
2655                         pframe = rtw_set_ie(pframe, WLAN_EID_CHALLENGE, 128, psta->chg_txt, &(pattrib->pktlen));
2656
2657         } else {
2658                 memcpy(pwlanhdr->addr1, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
2659                 memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
2660                 memcpy(pwlanhdr->addr3, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
2661
2662                 /*  setting auth algo number */
2663                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
2664                 if (val16)
2665                         use_shared_key = 1;
2666                 le_tmp = cpu_to_le16(val16);
2667
2668                 /* setting IV for auth seq #3 */
2669                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
2670                         __le32 le_tmp32;
2671
2672                         val32 = ((pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30));
2673                         le_tmp32 = cpu_to_le32(val32);
2674                         pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *)&le_tmp32, &(pattrib->pktlen));
2675
2676                         pattrib->iv_len = 4;
2677                 }
2678
2679                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2680
2681                 /*  setting auth seq number */
2682                 le_tmp = cpu_to_le16(pmlmeinfo->auth_seq);
2683                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2684
2685
2686                 /*  setting status code... */
2687                 le_tmp = cpu_to_le16(status);
2688                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2689
2690                 /*  then checking to see if sending challenging text... */
2691                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
2692                         pframe = rtw_set_ie(pframe, WLAN_EID_CHALLENGE, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
2693
2694                         SetPrivacy(fctrl);
2695
2696                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2697
2698                         pattrib->encrypt = _WEP40_;
2699
2700                         pattrib->icv_len = 4;
2701
2702                         pattrib->pktlen += pattrib->icv_len;
2703
2704                 }
2705
2706         }
2707
2708         pattrib->last_txcmdsz = pattrib->pktlen;
2709
2710         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
2711         dump_mgntframe(padapter, pmgntframe);
2712 }
2713
2714
2715 void issue_asocrsp(struct adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type)
2716 {
2717         struct xmit_frame       *pmgntframe;
2718         struct ieee80211_hdr    *pwlanhdr;
2719         struct pkt_attrib *pattrib;
2720         unsigned char *pbuf, *pframe;
2721         unsigned short val;
2722         __le16 *fctrl;
2723         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2724         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2725         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2726         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2727         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2728         u8 *ie = pnetwork->ies;
2729         __le16 lestatus, le_tmp;
2730
2731         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2732         if (!pmgntframe)
2733                 return;
2734
2735         /* update attribute */
2736         pattrib = &pmgntframe->attrib;
2737         update_mgntframe_attrib(padapter, pattrib);
2738
2739
2740         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2741
2742         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2743         pwlanhdr = (struct ieee80211_hdr *)pframe;
2744
2745         fctrl = &(pwlanhdr->frame_control);
2746         *(fctrl) = 0;
2747
2748         memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
2749         memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
2750         memcpy((void *)GetAddr3Ptr(pwlanhdr), get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
2751
2752
2753         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2754         pmlmeext->mgnt_seq++;
2755         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
2756                 SetFrameSubType(pwlanhdr, pkt_type);
2757         else
2758                 return;
2759
2760         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2761         pattrib->pktlen += pattrib->hdrlen;
2762         pframe += pattrib->hdrlen;
2763
2764         /* capability */
2765         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
2766
2767         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, (unsigned char *)&val, &(pattrib->pktlen));
2768
2769         lestatus = cpu_to_le16(status);
2770         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&lestatus, &(pattrib->pktlen));
2771
2772         le_tmp = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
2773         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2774
2775         if (pstat->bssratelen <= 8) {
2776                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
2777         } else {
2778                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, pstat->bssrateset, &(pattrib->pktlen));
2779                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
2780         }
2781
2782         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
2783                 uint ie_len = 0;
2784
2785                 /* FILL HT CAP INFO IE */
2786                 /* p = hostapd_eid_ht_capabilities_info(hapd, p); */
2787                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_HT_CAPABILITY, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
2788                 if (pbuf && ie_len > 0) {
2789                         memcpy(pframe, pbuf, ie_len+2);
2790                         pframe += (ie_len+2);
2791                         pattrib->pktlen += (ie_len+2);
2792                 }
2793
2794                 /* FILL HT ADD INFO IE */
2795                 /* p = hostapd_eid_ht_operation(hapd, p); */
2796                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_HT_OPERATION, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
2797                 if (pbuf && ie_len > 0) {
2798                         memcpy(pframe, pbuf, ie_len+2);
2799                         pframe += (ie_len+2);
2800                         pattrib->pktlen += (ie_len+2);
2801                 }
2802
2803         }
2804
2805         /* FILL WMM IE */
2806         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
2807                 uint ie_len = 0;
2808                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
2809
2810                 for (pbuf = ie + _BEACON_IE_OFFSET_; ; pbuf += (ie_len + 2)) {
2811                         pbuf = rtw_get_ie(pbuf, WLAN_EID_VENDOR_SPECIFIC, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_ - (ie_len + 2)));
2812                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
2813                                 memcpy(pframe, pbuf, ie_len+2);
2814                                 pframe += (ie_len+2);
2815                                 pattrib->pktlen += (ie_len+2);
2816
2817                                 break;
2818                         }
2819
2820                         if (!pbuf || ie_len == 0)
2821                                 break;
2822                 }
2823
2824         }
2825
2826         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
2827                 pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, 6, REALTEK_96B_IE, &(pattrib->pktlen));
2828
2829         /* add WPS IE ie for wps 2.0 */
2830         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
2831                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
2832
2833                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
2834                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
2835         }
2836
2837         pattrib->last_txcmdsz = pattrib->pktlen;
2838
2839         dump_mgntframe(padapter, pmgntframe);
2840 }
2841
2842 void issue_assocreq(struct adapter *padapter)
2843 {
2844         int ret = _FAIL;
2845         struct xmit_frame                               *pmgntframe;
2846         struct pkt_attrib                               *pattrib;
2847         unsigned char                           *pframe;
2848         struct ieee80211_hdr                    *pwlanhdr;
2849         __le16 *fctrl;
2850         __le16 val16;
2851         unsigned int                                    i, j, index = 0;
2852         unsigned char bssrate[NumRates], sta_bssrate[NumRates];
2853         struct ndis_80211_var_ie *pIE;
2854         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
2855         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2856         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2857         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2858         int     bssrate_len = 0, sta_bssrate_len = 0;
2859         u8 vs_ie_length = 0;
2860
2861         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2862         if (!pmgntframe)
2863                 goto exit;
2864
2865         /* update attribute */
2866         pattrib = &pmgntframe->attrib;
2867         update_mgntframe_attrib(padapter, pattrib);
2868
2869         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2870
2871         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2872         pwlanhdr = (struct ieee80211_hdr *)pframe;
2873
2874         fctrl = &(pwlanhdr->frame_control);
2875         *(fctrl) = 0;
2876         memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
2877         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2878         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
2879
2880         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2881         pmlmeext->mgnt_seq++;
2882         SetFrameSubType(pframe, WIFI_ASSOCREQ);
2883
2884         pframe += sizeof(struct ieee80211_hdr_3addr);
2885         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2886
2887         /* caps */
2888         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.ies), 2);
2889
2890         pframe += 2;
2891         pattrib->pktlen += 2;
2892
2893         /* listen interval */
2894         /* todo: listen interval for power saving */
2895         val16 = cpu_to_le16(3);
2896         memcpy(pframe, (unsigned char *)&val16, 2);
2897         pframe += 2;
2898         pattrib->pktlen += 2;
2899
2900         /* SSID */
2901         pframe = rtw_set_ie(pframe, WLAN_EID_SSID,  pmlmeinfo->network.ssid.ssid_length, pmlmeinfo->network.ssid.ssid, &(pattrib->pktlen));
2902
2903         /* supported rate & extended supported rate */
2904
2905         /*  Check if the AP's supported rates are also supported by STA. */
2906         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
2907
2908         if (pmlmeext->cur_channel == 14) /*  for JAPAN, channel 14 can only uses B Mode(CCK) */
2909                 sta_bssrate_len = 4;
2910
2911
2912         /* for (i = 0; i < sta_bssrate_len; i++) { */
2913         /*  */
2914
2915         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
2916                 if (pmlmeinfo->network.supported_rates[i] == 0)
2917                         break;
2918         }
2919
2920
2921         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
2922                 if (pmlmeinfo->network.supported_rates[i] == 0)
2923                         break;
2924
2925
2926                 /*  Check if the AP's supported rates are also supported by STA. */
2927                 for (j = 0; j < sta_bssrate_len; j++) {
2928                          /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
2929                         if ((pmlmeinfo->network.supported_rates[i] | IEEE80211_BASIC_RATE_MASK)
2930                                         == (sta_bssrate[j] | IEEE80211_BASIC_RATE_MASK))
2931                                 break;
2932                 }
2933
2934                 if (j != sta_bssrate_len)
2935                         /*  the rate is supported by STA */
2936                         bssrate[index++] = pmlmeinfo->network.supported_rates[i];
2937         }
2938
2939         bssrate_len = index;
2940
2941         if (bssrate_len == 0) {
2942                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
2943                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
2944                 goto exit; /* don't connect to AP if no joint supported rate */
2945         }
2946
2947
2948         if (bssrate_len > 8) {
2949                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, bssrate, &(pattrib->pktlen));
2950                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
2951         } else
2952                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, bssrate_len, bssrate, &(pattrib->pktlen));
2953
2954         /* vendor specific IE, such as WPA, WMM, WPS */
2955         for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
2956                 pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
2957
2958                 switch (pIE->element_id) {
2959                 case WLAN_EID_VENDOR_SPECIFIC:
2960                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
2961                                         (!memcmp(pIE->data, WMM_OUI, 4)) ||
2962                                         (!memcmp(pIE->data, WPS_OUI, 4))) {
2963                                 vs_ie_length = pIE->length;
2964                                 if ((!padapter->registrypriv.wifi_spec) && (!memcmp(pIE->data, WPS_OUI, 4))) {
2965                                         /* Commented by Kurt 20110629
2966                                          * In some older APs, WPS handshake
2967                                          * would be fail if we append vendor
2968                                          * extensions information to AP
2969                                          */
2970
2971                                         vs_ie_length = 14;
2972                                 }
2973
2974                                 pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, vs_ie_length, pIE->data, &(pattrib->pktlen));
2975                         }
2976                         break;
2977
2978                 case WLAN_EID_RSN:
2979                         pframe = rtw_set_ie(pframe, WLAN_EID_RSN, pIE->length, pIE->data, &(pattrib->pktlen));
2980                         break;
2981                 case WLAN_EID_HT_CAPABILITY:
2982                         if (padapter->mlmepriv.htpriv.ht_option) {
2983                                 if (!(is_ap_in_tkip(padapter))) {
2984                                         memcpy(&(pmlmeinfo->HT_caps), pIE->data, sizeof(struct HT_caps_element));
2985                                         pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY, pIE->length, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
2986                                 }
2987                         }
2988                         break;
2989
2990                 case WLAN_EID_EXT_CAPABILITY:
2991                         if (padapter->mlmepriv.htpriv.ht_option)
2992                                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_CAPABILITY, pIE->length, pIE->data, &(pattrib->pktlen));
2993                         break;
2994                 default:
2995                         break;
2996                 }
2997
2998                 i += (pIE->length + 2);
2999         }
3000
3001         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
3002                 pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, 6, REALTEK_96B_IE, &(pattrib->pktlen));
3003
3004
3005         pattrib->last_txcmdsz = pattrib->pktlen;
3006         dump_mgntframe(padapter, pmgntframe);
3007
3008         ret = _SUCCESS;
3009
3010 exit:
3011         if (ret == _SUCCESS)
3012                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
3013         else
3014                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
3015 }
3016
3017 /* when wait_ack is true, this function should be called at process context */
3018 static int _issue_nulldata(struct adapter *padapter, unsigned char *da,
3019                            unsigned int power_mode, bool wait_ack)
3020 {
3021         int ret = _FAIL;
3022         struct xmit_frame                       *pmgntframe;
3023         struct pkt_attrib                       *pattrib;
3024         unsigned char                           *pframe;
3025         struct ieee80211_hdr    *pwlanhdr;
3026         __le16 *fctrl;
3027         struct xmit_priv *pxmitpriv;
3028         struct mlme_ext_priv *pmlmeext;
3029         struct mlme_ext_info *pmlmeinfo;
3030
3031         if (!padapter)
3032                 goto exit;
3033
3034         pxmitpriv = &(padapter->xmitpriv);
3035         pmlmeext = &(padapter->mlmeextpriv);
3036         pmlmeinfo = &(pmlmeext->mlmext_info);
3037
3038         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3039         if (!pmgntframe)
3040                 goto exit;
3041
3042         /* update attribute */
3043         pattrib = &pmgntframe->attrib;
3044         update_mgntframe_attrib(padapter, pattrib);
3045         pattrib->retry_ctrl = false;
3046
3047         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3048
3049         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3050         pwlanhdr = (struct ieee80211_hdr *)pframe;
3051
3052         fctrl = &(pwlanhdr->frame_control);
3053         *(fctrl) = 0;
3054
3055         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
3056                 SetFrDs(fctrl);
3057         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
3058                 SetToDs(fctrl);
3059
3060         if (power_mode)
3061                 SetPwrMgt(fctrl);
3062
3063         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3064         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3065         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3066
3067         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3068         pmlmeext->mgnt_seq++;
3069         SetFrameSubType(pframe, WIFI_DATA_NULL);
3070
3071         pframe += sizeof(struct ieee80211_hdr_3addr);
3072         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3073
3074         pattrib->last_txcmdsz = pattrib->pktlen;
3075
3076         if (wait_ack) {
3077                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3078         } else {
3079                 dump_mgntframe(padapter, pmgntframe);
3080                 ret = _SUCCESS;
3081         }
3082
3083 exit:
3084         return ret;
3085 }
3086
3087 /*
3088  * [IMPORTANT] Don't call this function in interrupt context
3089  *
3090  * When wait_ms > 0, this function should be called at process context
3091  * da == NULL for station mode
3092  */
3093 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
3094 {
3095         int ret;
3096         int i = 0;
3097         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3098         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3099         struct sta_info *psta;
3100
3101
3102         /* da == NULL, assume it's null data for sta to ap*/
3103         if (!da)
3104                 da = get_my_bssid(&(pmlmeinfo->network));
3105
3106         psta = rtw_get_stainfo(&padapter->stapriv, da);
3107         if (psta) {
3108                 if (power_mode)
3109                         rtw_hal_macid_sleep(padapter, psta->mac_id);
3110                 else
3111                         rtw_hal_macid_wakeup(padapter, psta->mac_id);
3112         } else {
3113                 rtw_warn_on(1);
3114         }
3115
3116         do {
3117                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0);
3118
3119                 i++;
3120
3121                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3122                         break;
3123
3124                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3125                         msleep(wait_ms);
3126
3127         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3128
3129         if (ret != _FAIL) {
3130                 ret = _SUCCESS;
3131                 #ifndef DBG_XMIT_ACK
3132                 goto exit;
3133                 #endif
3134         }
3135
3136 exit:
3137         return ret;
3138 }
3139
3140 /*
3141  * [IMPORTANT] This function run in interrupt context
3142  *
3143  * The null data packet would be sent without power bit,
3144  * and not guarantee success.
3145  */
3146 s32 issue_nulldata_in_interrupt(struct adapter *padapter, u8 *da)
3147 {
3148         struct mlme_ext_priv *pmlmeext;
3149         struct mlme_ext_info *pmlmeinfo;
3150
3151
3152         pmlmeext = &padapter->mlmeextpriv;
3153         pmlmeinfo = &pmlmeext->mlmext_info;
3154
3155         /* da == NULL, assume it's null data for sta to ap*/
3156         if (!da)
3157                 da = get_my_bssid(&(pmlmeinfo->network));
3158
3159         return _issue_nulldata(padapter, da, 0, false);
3160 }
3161
3162 /* when wait_ack is true, this function should be called at process context */
3163 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
3164                                u16 tid, bool wait_ack)
3165 {
3166         int ret = _FAIL;
3167         struct xmit_frame                       *pmgntframe;
3168         struct pkt_attrib                       *pattrib;
3169         unsigned char                           *pframe;
3170         struct ieee80211_hdr    *pwlanhdr;
3171         __le16 *fctrl;
3172         u16 *qc;
3173         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3174         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3175         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3176
3177         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3178         if (!pmgntframe)
3179                 goto exit;
3180
3181         /* update attribute */
3182         pattrib = &pmgntframe->attrib;
3183         update_mgntframe_attrib(padapter, pattrib);
3184
3185         pattrib->hdrlen += 2;
3186         pattrib->qos_en = true;
3187         pattrib->eosp = 1;
3188         pattrib->ack_policy = 0;
3189         pattrib->mdata = 0;
3190
3191         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3192
3193         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3194         pwlanhdr = (struct ieee80211_hdr *)pframe;
3195
3196         fctrl = &(pwlanhdr->frame_control);
3197         *(fctrl) = 0;
3198
3199         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
3200                 SetFrDs(fctrl);
3201         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
3202                 SetToDs(fctrl);
3203
3204         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
3205
3206         SetPriority(qc, tid);
3207
3208         SetEOSP(qc, pattrib->eosp);
3209
3210         SetAckpolicy(qc, pattrib->ack_policy);
3211
3212         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3213         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3214         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3215
3216         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3217         pmlmeext->mgnt_seq++;
3218         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
3219
3220         pframe += sizeof(struct ieee80211_qos_hdr);
3221         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
3222
3223         pattrib->last_txcmdsz = pattrib->pktlen;
3224
3225         if (wait_ack) {
3226                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3227         } else {
3228                 dump_mgntframe(padapter, pmgntframe);
3229                 ret = _SUCCESS;
3230         }
3231
3232 exit:
3233         return ret;
3234 }
3235
3236 /* when wait_ms >0 , this function should be called at process context */
3237 /* da == NULL for station mode */
3238 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
3239 {
3240         int ret;
3241         int i = 0;
3242         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3243         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3244
3245         /* da == NULL, assume it's null data for sta to ap*/
3246         if (!da)
3247                 da = get_my_bssid(&(pmlmeinfo->network));
3248
3249         do {
3250                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0);
3251
3252                 i++;
3253
3254                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3255                         break;
3256
3257                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3258                         msleep(wait_ms);
3259
3260         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3261
3262         if (ret != _FAIL) {
3263                 ret = _SUCCESS;
3264                 #ifndef DBG_XMIT_ACK
3265                 goto exit;
3266                 #endif
3267         }
3268
3269 exit:
3270         return ret;
3271 }
3272
3273 static int _issue_deauth(struct adapter *padapter, unsigned char *da,
3274                          unsigned short reason, bool wait_ack)
3275 {
3276         struct xmit_frame                       *pmgntframe;
3277         struct pkt_attrib                       *pattrib;
3278         unsigned char                           *pframe;
3279         struct ieee80211_hdr    *pwlanhdr;
3280         __le16 *fctrl;
3281         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3282         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3283         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3284         int ret = _FAIL;
3285         __le16 le_tmp;
3286
3287         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3288         if (!pmgntframe)
3289                 goto exit;
3290
3291         /* update attribute */
3292         pattrib = &pmgntframe->attrib;
3293         update_mgntframe_attrib(padapter, pattrib);
3294         pattrib->retry_ctrl = false;
3295
3296         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3297
3298         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3299         pwlanhdr = (struct ieee80211_hdr *)pframe;
3300
3301         fctrl = &(pwlanhdr->frame_control);
3302         *(fctrl) = 0;
3303
3304         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3305         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3306         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3307
3308         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3309         pmlmeext->mgnt_seq++;
3310         SetFrameSubType(pframe, WIFI_DEAUTH);
3311
3312         pframe += sizeof(struct ieee80211_hdr_3addr);
3313         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3314
3315         le_tmp = cpu_to_le16(reason);
3316         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3317
3318         pattrib->last_txcmdsz = pattrib->pktlen;
3319
3320
3321         if (wait_ack) {
3322                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3323         } else {
3324                 dump_mgntframe(padapter, pmgntframe);
3325                 ret = _SUCCESS;
3326         }
3327
3328 exit:
3329         return ret;
3330 }
3331
3332 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
3333 {
3334         return _issue_deauth(padapter, da, reason, false);
3335 }
3336
3337 int issue_deauth_ex(struct adapter *padapter, u8 *da, unsigned short reason, int try_cnt,
3338         int wait_ms)
3339 {
3340         int ret;
3341         int i = 0;
3342
3343         do {
3344                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0);
3345
3346                 i++;
3347
3348                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3349                         break;
3350
3351                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3352                         mdelay(wait_ms);
3353
3354         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3355
3356         if (ret != _FAIL) {
3357                 ret = _SUCCESS;
3358                 #ifndef DBG_XMIT_ACK
3359                 goto exit;
3360                 #endif
3361         }
3362
3363 exit:
3364         return ret;
3365 }
3366
3367 void issue_action_SA_Query(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid)
3368 {
3369         u8 category = RTW_WLAN_CATEGORY_SA_QUERY;
3370         struct xmit_frame               *pmgntframe;
3371         struct pkt_attrib               *pattrib;
3372         u8                      *pframe;
3373         struct ieee80211_hdr    *pwlanhdr;
3374         __le16 *fctrl;
3375         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3376         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3377         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3378         __le16 le_tmp;
3379
3380         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3381         if (!pmgntframe)
3382                 return;
3383
3384         /* update attribute */
3385         pattrib = &pmgntframe->attrib;
3386         update_mgntframe_attrib(padapter, pattrib);
3387
3388         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3389
3390         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3391         pwlanhdr = (struct ieee80211_hdr *)pframe;
3392
3393         fctrl = &(pwlanhdr->frame_control);
3394         *(fctrl) = 0;
3395
3396         if (raddr)
3397                 memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
3398         else
3399                 memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3400         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3401         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3402
3403         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3404         pmlmeext->mgnt_seq++;
3405         SetFrameSubType(pframe, WIFI_ACTION);
3406
3407         pframe += sizeof(struct ieee80211_hdr_3addr);
3408         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3409
3410         pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
3411         pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
3412
3413         switch (action) {
3414         case 0: /* SA Query req */
3415                 pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&pmlmeext->sa_query_seq, &pattrib->pktlen);
3416                 pmlmeext->sa_query_seq++;
3417                 /* send sa query request to AP, AP should reply sa query response in 1 second */
3418                 set_sa_query_timer(pmlmeext, 1000);
3419                 break;
3420
3421         case 1: /* SA Query rsp */
3422                 le_tmp = cpu_to_le16(tid);
3423                 pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&le_tmp, &pattrib->pktlen);
3424                 break;
3425         default:
3426                 break;
3427         }
3428
3429         pattrib->last_txcmdsz = pattrib->pktlen;
3430
3431         dump_mgntframe(padapter, pmgntframe);
3432 }
3433
3434 void issue_action_BA(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status)
3435 {
3436         u8 category = RTW_WLAN_CATEGORY_BACK;
3437         u16 start_seq;
3438         u16 BA_para_set;
3439         u16 reason_code;
3440         u16 BA_timeout_value;
3441         u16 BA_starting_seqctrl = 0;
3442         enum ieee80211_max_ampdu_length_exp max_rx_ampdu_factor;
3443         struct xmit_frame               *pmgntframe;
3444         struct pkt_attrib               *pattrib;
3445         u8                      *pframe;
3446         struct ieee80211_hdr    *pwlanhdr;
3447         __le16 *fctrl;
3448         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3449         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3450         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3451         struct sta_info         *psta;
3452         struct sta_priv         *pstapriv = &padapter->stapriv;
3453         struct registry_priv    *pregpriv = &padapter->registrypriv;
3454         __le16 le_tmp;
3455
3456         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3457         if (!pmgntframe)
3458                 return;
3459
3460         /* update attribute */
3461         pattrib = &pmgntframe->attrib;
3462         update_mgntframe_attrib(padapter, pattrib);
3463
3464         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3465
3466         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3467         pwlanhdr = (struct ieee80211_hdr *)pframe;
3468
3469         fctrl = &(pwlanhdr->frame_control);
3470         *(fctrl) = 0;
3471
3472         /* memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN); */
3473         memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
3474         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3475         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3476
3477         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3478         pmlmeext->mgnt_seq++;
3479         SetFrameSubType(pframe, WIFI_ACTION);
3480
3481         pframe += sizeof(struct ieee80211_hdr_3addr);
3482         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3483
3484         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
3485         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
3486
3487         if (category == 3) {
3488                 switch (action) {
3489                 case 0: /* ADDBA req */
3490                         do {
3491                                 pmlmeinfo->dialogToken++;
3492                         } while (pmlmeinfo->dialogToken == 0);
3493                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
3494
3495                         if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter)) {
3496                                 /*  A-MSDU NOT Supported */
3497                                 BA_para_set = 0;
3498                                 /*  immediate Block Ack */
3499                                 BA_para_set |= BIT(1) & IEEE80211_ADDBA_PARAM_POLICY_MASK;
3500                                 /*  TID */
3501                                 BA_para_set |= (status << 2) & IEEE80211_ADDBA_PARAM_TID_MASK;
3502                                 /*  max buffer size is 8 MSDU */
3503                                 BA_para_set |= (8 << 6) & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3504                         } else {
3505                                 BA_para_set = (0x1002 | ((status & 0xf) << 2)); /* immediate ack & 64 buffer size */
3506                         }
3507                         le_tmp = cpu_to_le16(BA_para_set);
3508                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3509
3510                         BA_timeout_value = 5000;/*  5ms */
3511                         le_tmp = cpu_to_le16(BA_timeout_value);
3512                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3513
3514                         /* if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.mac_address)) != NULL) */
3515                         psta = rtw_get_stainfo(pstapriv, raddr);
3516                         if (psta) {
3517                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
3518
3519                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
3520
3521                                 BA_starting_seqctrl = start_seq << 4;
3522                         }
3523
3524                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
3525                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3526                         break;
3527
3528                 case 1: /* ADDBA rsp */
3529                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->ADDBA_req.dialog_token), &(pattrib->pktlen));
3530                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&status), &(pattrib->pktlen));
3531                         if (padapter->driver_rx_ampdu_factor != 0xFF)
3532                                 max_rx_ampdu_factor =
3533                                   (enum ieee80211_max_ampdu_length_exp)padapter->driver_rx_ampdu_factor;
3534                         else
3535                                 rtw_hal_get_def_var(padapter,
3536                                                     HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
3537
3538                         if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_64K)
3539                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
3540                         else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_32K)
3541                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0800); /* 32 buffer size */
3542                         else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_16K)
3543                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0400); /* 16 buffer size */
3544                         else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_8K)
3545                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0200); /* 8 buffer size */
3546                         else
3547                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
3548
3549                         if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter) &&
3550                             padapter->driver_rx_ampdu_factor == 0xFF) {
3551                                 /*  max buffer size is 8 MSDU */
3552                                 BA_para_set &= ~IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3553                                 BA_para_set |= (8 << 6) & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3554                         }
3555
3556                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
3557                                 le_tmp = cpu_to_le16(BA_para_set & ~BIT(0));
3558                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
3559                                 le_tmp = cpu_to_le16(BA_para_set | BIT(0));
3560                         else /* auto */
3561                                 le_tmp = cpu_to_le16(BA_para_set);
3562
3563                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3564                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(pmlmeinfo->ADDBA_req.BA_timeout_value)), &(pattrib->pktlen));
3565                         break;
3566                 case 2:/* DELBA */
3567                         BA_para_set = (status & 0x1F) << 3;
3568                         le_tmp = cpu_to_le16(BA_para_set);
3569                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3570
3571                         reason_code = 37;
3572                         le_tmp = cpu_to_le16(reason_code);
3573                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3574                         break;
3575                 default:
3576                         break;
3577                 }
3578         }
3579
3580         pattrib->last_txcmdsz = pattrib->pktlen;
3581
3582         dump_mgntframe(padapter, pmgntframe);
3583 }
3584
3585 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
3586 {
3587         struct list_head                *plist, *phead;
3588         unsigned char category, action;
3589         struct xmit_frame                       *pmgntframe;
3590         struct pkt_attrib                       *pattrib;
3591         unsigned char                   *pframe;
3592         struct ieee80211_hdr    *pwlanhdr;
3593         __le16 *fctrl;
3594         struct  wlan_network    *pnetwork = NULL;
3595         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3596         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3597         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3598         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3599         struct __queue          *queue  = &(pmlmepriv->scanned_queue);
3600         u8 InfoContent[16] = {0};
3601         u8 ICS[8][15];
3602
3603         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
3604                 return;
3605
3606         if (true == pmlmeinfo->bwmode_updated)
3607                 return;
3608
3609         category = RTW_WLAN_CATEGORY_PUBLIC;
3610         action = ACT_PUBLIC_BSSCOEXIST;
3611
3612         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3613         if (!pmgntframe)
3614                 return;
3615
3616         /* update attribute */
3617         pattrib = &pmgntframe->attrib;
3618         update_mgntframe_attrib(padapter, pattrib);
3619
3620         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3621
3622         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3623         pwlanhdr = (struct ieee80211_hdr *)pframe;
3624
3625         fctrl = &(pwlanhdr->frame_control);
3626         *(fctrl) = 0;
3627
3628         memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3629         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3630         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3631
3632         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3633         pmlmeext->mgnt_seq++;
3634         SetFrameSubType(pframe, WIFI_ACTION);
3635
3636         pframe += sizeof(struct ieee80211_hdr_3addr);
3637         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3638
3639         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
3640         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
3641
3642
3643         /*  */
3644         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
3645                 u8 iedata = 0;
3646
3647                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
3648
3649                 pframe = rtw_set_ie(pframe, WLAN_EID_BSS_COEX_2040,  1, &iedata, &(pattrib->pktlen));
3650
3651         }
3652
3653
3654         /*  */
3655         memset(ICS, 0, sizeof(ICS));
3656         if (pmlmepriv->num_sta_no_ht > 0) {
3657                 int i;
3658
3659                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
3660
3661                 phead = get_list_head(queue);
3662                 plist = get_next(phead);
3663
3664                 while (1) {
3665                         int len;
3666                         u8 *p;
3667                         struct wlan_bssid_ex *pbss_network;
3668
3669                         if (phead == plist)
3670                                 break;
3671
3672                         pnetwork = container_of(plist, struct wlan_network, list);
3673
3674                         plist = get_next(plist);
3675
3676                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
3677
3678                         p = rtw_get_ie(pbss_network->ies + _FIXED_IE_LENGTH_, WLAN_EID_HT_CAPABILITY, &len, pbss_network->ie_length - _FIXED_IE_LENGTH_);
3679                         if (!p || len == 0) {/* non-HT */
3680
3681                                 if (pbss_network->configuration.ds_config <= 0)
3682                                         continue;
3683
3684                                 ICS[0][pbss_network->configuration.ds_config] = 1;
3685
3686                                 if (ICS[0][0] == 0)
3687                                         ICS[0][0] = 1;
3688                         }
3689
3690                 }
3691
3692                 spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
3693
3694
3695                 for (i = 0; i < 8; i++) {
3696                         if (ICS[i][0] == 1) {
3697                                 int j, k = 0;
3698
3699                                 InfoContent[k] = i;
3700                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
3701                                 k++;
3702
3703                                 for (j = 1; j <= 14; j++) {
3704                                         if (ICS[i][j] == 1) {
3705                                                 if (k < 16) {
3706                                                         InfoContent[k] = j; /* channel number */
3707                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
3708                                                         k++;
3709                                                 }
3710                                         }
3711                                 }
3712
3713                                 pframe = rtw_set_ie(pframe, WLAN_EID_BSS_INTOLERANT_CHL_REPORT, k, InfoContent, &(pattrib->pktlen));
3714
3715                         }
3716
3717                 }
3718
3719
3720         }
3721
3722
3723         pattrib->last_txcmdsz = pattrib->pktlen;
3724
3725         dump_mgntframe(padapter, pmgntframe);
3726 }
3727
3728 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
3729 {
3730         struct sta_priv *pstapriv = &padapter->stapriv;
3731         struct sta_info *psta = NULL;
3732         /* struct recv_reorder_ctrl *preorder_ctrl; */
3733         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3734         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3735         u16 tid;
3736
3737         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3738                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3739                         return _SUCCESS;
3740
3741         psta = rtw_get_stainfo(pstapriv, addr);
3742         if (!psta)
3743                 return _SUCCESS;
3744
3745         if (initiator == 0) {/*  recipient */
3746                 for (tid = 0; tid < MAXTID; tid++) {
3747                         if (psta->recvreorder_ctrl[tid].enable) {
3748                                 issue_action_BA(padapter, addr, WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
3749                                 psta->recvreorder_ctrl[tid].enable = false;
3750                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
3751                         }
3752                 }
3753         } else if (initiator == 1) {/*  originator */
3754                 for (tid = 0; tid < MAXTID; tid++) {
3755                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
3756                                 issue_action_BA(padapter, addr, WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
3757                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3758                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3759
3760                         }
3761                 }
3762         }
3763
3764         return _SUCCESS;
3765
3766 }
3767
3768 unsigned int send_beacon(struct adapter *padapter)
3769 {
3770         u8 bxmitok = false;
3771         int     issue = 0;
3772         int poll = 0;
3773
3774         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
3775         rtw_hal_set_hwreg(padapter, HW_VAR_DL_BCN_SEL, NULL);
3776         do {
3777                 issue_beacon(padapter, 100);
3778                 issue++;
3779                 do {
3780                         cond_resched();
3781                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
3782                         poll++;
3783                 } while ((poll%10) != 0 && false == bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
3784
3785         } while (false == bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
3786
3787         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
3788                 return _FAIL;
3789
3790         if (!bxmitok)
3791                 return _FAIL;
3792         else
3793                 return _SUCCESS;
3794 }
3795
3796 /****************************************************************************
3797
3798 Following are some utility functions for WiFi MLME
3799
3800 *****************************************************************************/
3801
3802 void site_survey(struct adapter *padapter)
3803 {
3804         unsigned char   survey_channel = 0, val8;
3805         enum rt_scan_type       ScanType = SCAN_PASSIVE;
3806         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3807         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3808         u32 initialgain = 0;
3809         u32 channel_scan_time_ms = 0;
3810
3811         {
3812                 struct rtw_ieee80211_channel *ch;
3813
3814                 if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
3815                         ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
3816                         survey_channel = ch->hw_value;
3817                         ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
3818                 }
3819         }
3820
3821         if (survey_channel != 0) {
3822                 /* PAUSE 4-AC Queue when site_survey */
3823                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
3824                 /* val8 |= 0x0f; */
3825                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
3826                 if (pmlmeext->sitesurvey_res.channel_idx == 0) {
3827 #ifdef DBG_FIXED_CHAN
3828                         if (pmlmeext->fixed_chan != 0xff)
3829                                 set_channel_bwmode(padapter, pmlmeext->fixed_chan, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
3830                         else
3831 #endif
3832                                 set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
3833                 } else {
3834 #ifdef DBG_FIXED_CHAN
3835                         if (pmlmeext->fixed_chan != 0xff)
3836                                 SelectChannel(padapter, pmlmeext->fixed_chan);
3837                         else
3838 #endif
3839                                 SelectChannel(padapter, survey_channel);
3840                 }
3841
3842                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
3843                         {
3844                                 int i;
3845
3846                                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
3847                                         if (pmlmeext->sitesurvey_res.ssid[i].ssid_length) {
3848                                                 /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
3849                                                 if (padapter->registrypriv.wifi_spec)
3850                                                         issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
3851                                                 else
3852                                                         issue_probereq_ex(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL, 0, 0, 0, 0);
3853                                                 issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
3854                                         }
3855                                 }
3856
3857                                 if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
3858                                         /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
3859                                         if (padapter->registrypriv.wifi_spec)
3860                                                 issue_probereq(padapter, NULL, NULL);
3861                                         else
3862                                                 issue_probereq_ex(padapter, NULL, NULL, 0, 0, 0, 0);
3863                                         issue_probereq(padapter, NULL, NULL);
3864                                 }
3865                         }
3866                 }
3867
3868                 channel_scan_time_ms = pmlmeext->chan_scan_time;
3869
3870                 set_survey_timer(pmlmeext, channel_scan_time_ms);
3871         } else {
3872
3873                 /*      channel number is 0 or this channel is not valid. */
3874
3875                 {
3876                         pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
3877
3878                         /* switch back to the original channel */
3879                         /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
3880
3881                         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3882
3883                         /* flush 4-AC Queue after site_survey */
3884                         /* val8 = 0; */
3885                         /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
3886
3887                         /* config MSR */
3888                         Set_MSR(padapter, (pmlmeinfo->state & 0x3));
3889
3890                         initialgain = 0xff; /* restore RX GAIN */
3891                         rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
3892                         /* turn on dynamic functions */
3893                         Restore_DM_Func_Flag(padapter);
3894                         /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
3895
3896                         if (is_client_associated_to_ap(padapter))
3897                                 issue_nulldata(padapter, NULL, 0, 3, 500);
3898
3899                         val8 = 0; /* survey done */
3900                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
3901
3902                         report_surveydone_event(padapter);
3903
3904                         pmlmeext->chan_scan_time = SURVEY_TO;
3905                         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3906
3907                         issue_action_BSSCoexistPacket(padapter);
3908                         issue_action_BSSCoexistPacket(padapter);
3909                         issue_action_BSSCoexistPacket(padapter);
3910                 }
3911         }
3912
3913         return;
3914
3915 }
3916
3917 /* collect bss info from Beacon and Probe request/response frames. */
3918 u8 collect_bss_info(struct adapter *padapter, union recv_frame *precv_frame, struct wlan_bssid_ex *bssid)
3919 {
3920         int     i;
3921         u32 len;
3922         u8 *p;
3923         u16 val16, subtype;
3924         u8 *pframe = precv_frame->u.hdr.rx_data;
3925         u32 packet_len = precv_frame->u.hdr.len;
3926         u8 ie_offset;
3927         struct registry_priv *pregistrypriv = &padapter->registrypriv;
3928         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3929         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3930         __le32 le32_tmp;
3931
3932         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
3933
3934         if (len > MAX_IE_SZ)
3935                 return _FAIL;
3936
3937         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
3938
3939         subtype = GetFrameSubType(pframe);
3940
3941         if (subtype == WIFI_BEACON) {
3942                 bssid->reserved[0] = 1;
3943                 ie_offset = _BEACON_IE_OFFSET_;
3944         } else {
3945                 /*  FIXME : more type */
3946                 if (subtype == WIFI_PROBERSP) {
3947                         ie_offset = _PROBERSP_IE_OFFSET_;
3948                         bssid->reserved[0] = 3;
3949                 } else if (subtype == WIFI_PROBEREQ) {
3950                         ie_offset = _PROBEREQ_IE_OFFSET_;
3951                         bssid->reserved[0] = 2;
3952                 } else {
3953                         bssid->reserved[0] = 0;
3954                         ie_offset = _FIXED_IE_LENGTH_;
3955                 }
3956         }
3957
3958         bssid->length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
3959
3960         /* below is to copy the information element */
3961         bssid->ie_length = len;
3962         memcpy(bssid->ies, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->ie_length);
3963
3964         /* get the signal strength */
3965         bssid->rssi = precv_frame->u.hdr.attrib.phy_info.RecvSignalPower; /*  in dBM.raw data */
3966         bssid->phy_info.signal_quality = precv_frame->u.hdr.attrib.phy_info.SignalQuality;/* in percentage */
3967         bssid->phy_info.signal_strength = precv_frame->u.hdr.attrib.phy_info.SignalStrength;/* in percentage */
3968
3969         /*  checking SSID */
3970         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_SSID, &len, bssid->ie_length - ie_offset);
3971         if (!p)
3972                 return _FAIL;
3973
3974         if (*(p + 1)) {
3975                 if (len > NDIS_802_11_LENGTH_SSID)
3976                         return _FAIL;
3977
3978                 memcpy(bssid->ssid.ssid, (p + 2), *(p + 1));
3979                 bssid->ssid.ssid_length = *(p + 1);
3980         } else
3981                 bssid->ssid.ssid_length = 0;
3982
3983         memset(bssid->supported_rates, 0, NDIS_802_11_LENGTH_RATES_EX);
3984
3985         /* checking rate info... */
3986         i = 0;
3987         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_SUPP_RATES, &len, bssid->ie_length - ie_offset);
3988         if (p) {
3989                 if (len > NDIS_802_11_LENGTH_RATES_EX)
3990                         return _FAIL;
3991
3992                 memcpy(bssid->supported_rates, (p + 2), len);
3993                 i = len;
3994         }
3995
3996         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_EXT_SUPP_RATES, &len, bssid->ie_length - ie_offset);
3997         if (p) {
3998                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i))
3999                         return _FAIL;
4000
4001                 memcpy(bssid->supported_rates + i, (p + 2), len);
4002         }
4003
4004         bssid->network_type_in_use = Ndis802_11OFDM24;
4005
4006         if (bssid->ie_length < 12)
4007                 return _FAIL;
4008
4009         /*  Checking for ds_config */
4010         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_DS_PARAMS, &len, bssid->ie_length - ie_offset);
4011
4012         bssid->configuration.ds_config = 0;
4013         bssid->configuration.length = 0;
4014
4015         if (p) {
4016                 bssid->configuration.ds_config = *(p + 2);
4017         } else {
4018                 /*  In 5G, some ap do not have DSSET IE */
4019                 /*  checking HT info for channel */
4020                 p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_HT_OPERATION, &len, bssid->ie_length - ie_offset);
4021                 if (p) {
4022                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
4023
4024                         bssid->configuration.ds_config = HT_info->primary_channel;
4025                 } else { /*  use current channel */
4026                         bssid->configuration.ds_config = rtw_get_oper_ch(padapter);
4027                 }
4028         }
4029
4030         memcpy(&le32_tmp, rtw_get_beacon_interval_from_ie(bssid->ies), 2);
4031         bssid->configuration.beacon_period = le32_to_cpu(le32_tmp);
4032
4033         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
4034
4035         if (val16 & BIT(0)) {
4036                 bssid->infrastructure_mode = Ndis802_11Infrastructure;
4037                 memcpy(bssid->mac_address, GetAddr2Ptr(pframe), ETH_ALEN);
4038         } else {
4039                 bssid->infrastructure_mode = Ndis802_11IBSS;
4040                 memcpy(bssid->mac_address, GetAddr3Ptr(pframe), ETH_ALEN);
4041         }
4042
4043         if (val16 & BIT(4))
4044                 bssid->privacy = 1;
4045         else
4046                 bssid->privacy = 0;
4047
4048         bssid->configuration.atim_window = 0;
4049
4050         /* 20/40 BSS Coexistence check */
4051         if ((pregistrypriv->wifi_spec == 1) && (false == pmlmeinfo->bwmode_updated)) {
4052                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4053
4054                 p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_HT_CAPABILITY, &len, bssid->ie_length - ie_offset);
4055                 if (p && len > 0) {
4056                         struct HT_caps_element  *pHT_caps;
4057
4058                         pHT_caps = (struct HT_caps_element      *)(p + 2);
4059
4060                         if (le16_to_cpu(pHT_caps->u.HT_cap_element.HT_caps_info) & BIT(14))
4061                                 pmlmepriv->num_FortyMHzIntolerant++;
4062                 } else
4063                         pmlmepriv->num_sta_no_ht++;
4064         }
4065
4066         /*  mark bss info receiving from nearby channel as signal_quality 101 */
4067         if (bssid->configuration.ds_config != rtw_get_oper_ch(padapter))
4068                 bssid->phy_info.signal_quality = 101;
4069
4070         return _SUCCESS;
4071 }
4072
4073 void start_create_ibss(struct adapter *padapter)
4074 {
4075         unsigned short  caps;
4076         u8 val8;
4077         u8 join_type;
4078         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4079         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4080         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4081
4082         pmlmeext->cur_channel = (u8)pnetwork->configuration.ds_config;
4083         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
4084
4085         /* update wireless mode */
4086         update_wireless_mode(padapter);
4087
4088         /* update capability */
4089         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
4090         update_capinfo(padapter, caps);
4091         if (caps&WLAN_CAPABILITY_IBSS) {/* adhoc master */
4092                 val8 = 0xcf;
4093                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4094
4095                 rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);
4096
4097                 /* switch channel */
4098                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
4099                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
4100
4101                 beacon_timing_control(padapter);
4102
4103                 /* set msr to WIFI_FW_ADHOC_STATE */
4104                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
4105                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
4106
4107                 /* issue beacon */
4108                 if (send_beacon(padapter) == _FAIL) {
4109                         report_join_res(padapter, -1);
4110                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4111                 } else {
4112                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.mac_address);
4113                         join_type = 0;
4114                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4115
4116                         report_join_res(padapter, 1);
4117                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4118                         rtw_indicate_connect(padapter);
4119                 }
4120         } else {
4121                 return;
4122         }
4123         /* update bc/mc sta_info */
4124         update_bmc_sta(padapter);
4125
4126 }
4127
4128 void start_clnt_join(struct adapter *padapter)
4129 {
4130         unsigned short  caps;
4131         u8 val8;
4132         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4133         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4134         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4135         int beacon_timeout;
4136
4137         /* update wireless mode */
4138         update_wireless_mode(padapter);
4139
4140         /* update capability */
4141         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
4142         update_capinfo(padapter, caps);
4143         if (caps&WLAN_CAPABILITY_ESS) {
4144                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
4145
4146                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
4147
4148                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4149
4150                 /*  Because of AP's not receiving deauth before */
4151                 /*  AP may: 1)not response auth or 2)deauth us after link is complete */
4152                 /*  issue deauth before issuing auth to deal with the situation */
4153
4154                 /*      Commented by Albert 2012/07/21 */
4155                 /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
4156                 {
4157                                 /* To avoid connecting to AP fail during resume process, change retry count from 5 to 1 */
4158                                 issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
4159                 }
4160
4161                 /* here wait for receiving the beacon to start auth */
4162                 /* and enable a timer */
4163                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
4164                 set_link_timer(pmlmeext, beacon_timeout);
4165                 _set_timer(&padapter->mlmepriv.assoc_timer,
4166                         (REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO*REASSOC_LIMIT) + beacon_timeout);
4167
4168                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
4169         } else if (caps&WLAN_CAPABILITY_IBSS) { /* adhoc client */
4170                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
4171
4172                 val8 = 0xcf;
4173                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4174
4175                 beacon_timing_control(padapter);
4176
4177                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
4178
4179                 report_join_res(padapter, 1);
4180         } else {
4181                 return;
4182         }
4183
4184 }
4185
4186 void start_clnt_auth(struct adapter *padapter)
4187 {
4188         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4189         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4190
4191         del_timer_sync(&pmlmeext->link_timer);
4192
4193         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
4194         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
4195
4196         pmlmeinfo->auth_seq = 1;
4197         pmlmeinfo->reauth_count = 0;
4198         pmlmeinfo->reassoc_count = 0;
4199         pmlmeinfo->link_count = 0;
4200         pmlmeext->retry = 0;
4201
4202
4203         netdev_dbg(padapter->pnetdev, "start auth\n");
4204         issue_auth(padapter, NULL, 0);
4205
4206         set_link_timer(pmlmeext, REAUTH_TO);
4207
4208 }
4209
4210
4211 void start_clnt_assoc(struct adapter *padapter)
4212 {
4213         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4214         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4215
4216         del_timer_sync(&pmlmeext->link_timer);
4217
4218         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
4219         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
4220
4221         issue_assocreq(padapter);
4222
4223         set_link_timer(pmlmeext, REASSOC_TO);
4224 }
4225
4226 unsigned int receive_disconnect(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4227 {
4228         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4229         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4230
4231         /* check A3 */
4232         if (!(!memcmp(MacAddr, get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
4233                 return _SUCCESS;
4234
4235         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4236                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
4237                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4238                         report_del_sta_event(padapter, MacAddr, reason);
4239
4240                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
4241                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4242                         report_join_res(padapter, -2);
4243                 }
4244         }
4245
4246         return _SUCCESS;
4247 }
4248
4249 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
4250 {
4251         struct registry_priv *pregistrypriv;
4252         struct mlme_ext_priv *pmlmeext;
4253         struct rt_channel_info *chplan_new;
4254         u8 channel;
4255         u8 i;
4256
4257
4258         pregistrypriv = &padapter->registrypriv;
4259         pmlmeext = &padapter->mlmeextpriv;
4260
4261         /*  Adjust channel plan by AP Country IE */
4262         if (pregistrypriv->enable80211d &&
4263                 (!pmlmeext->update_channel_plan_by_ap_done)) {
4264                 u8 *ie, *p;
4265                 u32 len;
4266                 struct rt_channel_plan chplan_ap;
4267                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
4268                 u8 country[4];
4269                 u8 fcn; /*  first channel number */
4270                 u8 noc; /*  number of channel */
4271                 u8 j, k;
4272
4273                 ie = rtw_get_ie(bssid->ies + _FIXED_IE_LENGTH_, WLAN_EID_COUNTRY, &len, bssid->ie_length - _FIXED_IE_LENGTH_);
4274                 if (!ie)
4275                         return;
4276                 if (len < 6)
4277                         return;
4278
4279                 ie += 2;
4280                 p = ie;
4281                 ie += len;
4282
4283                 memset(country, 0, 4);
4284                 memcpy(country, p, 3);
4285                 p += 3;
4286
4287                 i = 0;
4288                 while ((ie - p) >= 3) {
4289                         fcn = *(p++);
4290                         noc = *(p++);
4291                         p++;
4292
4293                         for (j = 0; j < noc; j++) {
4294                                 if (fcn <= 14)
4295                                         channel = fcn + j; /*  2.4 GHz */
4296                                 else
4297                                         channel = fcn + j*4; /*  5 GHz */
4298
4299                                 chplan_ap.Channel[i++] = channel;
4300                         }
4301                 }
4302                 chplan_ap.Len = i;
4303
4304                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
4305
4306                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
4307                 chplan_new = pmlmeext->channel_set;
4308
4309                 i = j = k = 0;
4310                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
4311                         do {
4312                                 if ((i == MAX_CHANNEL_NUM) ||
4313                                         (chplan_sta[i].ChannelNum == 0) ||
4314                                         (chplan_sta[i].ChannelNum > 14))
4315                                         break;
4316
4317                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
4318                                         break;
4319
4320                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
4321                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4322                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4323                                         i++;
4324                                         j++;
4325                                         k++;
4326                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
4327                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4328 /*                                      chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4329                                         chplan_new[k].ScanType = SCAN_PASSIVE;
4330                                         i++;
4331                                         k++;
4332                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
4333                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4334                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4335                                         j++;
4336                                         k++;
4337                                 }
4338                         } while (1);
4339
4340                         /*  change AP not support channel to Passive scan */
4341                         while ((i < MAX_CHANNEL_NUM) &&
4342                                 (chplan_sta[i].ChannelNum != 0) &&
4343                                 (chplan_sta[i].ChannelNum <= 14)) {
4344
4345                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4346 /*                              chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4347                                 chplan_new[k].ScanType = SCAN_PASSIVE;
4348                                 i++;
4349                                 k++;
4350                         }
4351
4352                         /*  add channel AP supported */
4353                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
4354                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4355                                 chplan_new[k].ScanType = SCAN_ACTIVE;
4356                                 j++;
4357                                 k++;
4358                         }
4359                 } else {
4360                         /*  keep original STA 2.4G channel plan */
4361                         while ((i < MAX_CHANNEL_NUM) &&
4362                                 (chplan_sta[i].ChannelNum != 0) &&
4363                                 (chplan_sta[i].ChannelNum <= 14)) {
4364                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4365                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
4366                                 i++;
4367                                 k++;
4368                         }
4369
4370                         /*  skip AP 2.4G channel plan */
4371                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
4372                                 j++;
4373                 }
4374
4375                 pmlmeext->update_channel_plan_by_ap_done = 1;
4376         }
4377
4378         /*  If channel is used by AP, set channel scan type to active */
4379         channel = bssid->configuration.ds_config;
4380         chplan_new = pmlmeext->channel_set;
4381         i = 0;
4382         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
4383                 if (chplan_new[i].ChannelNum == channel) {
4384                         if (chplan_new[i].ScanType == SCAN_PASSIVE)
4385                                 chplan_new[i].ScanType = SCAN_ACTIVE;
4386                         break;
4387                 }
4388                 i++;
4389         }
4390 }
4391
4392 /****************************************************************************
4393
4394 Following are the functions to report events
4395
4396 *****************************************************************************/
4397
4398 void report_survey_event(struct adapter *padapter, union recv_frame *precv_frame)
4399 {
4400         struct cmd_obj *pcmd_obj;
4401         u8 *pevtcmd;
4402         u32 cmdsz;
4403         struct survey_event     *psurvey_evt;
4404         struct C2HEvent_Header *pc2h_evt_hdr;
4405         struct mlme_ext_priv *pmlmeext;
4406         struct cmd_priv *pcmdpriv;
4407         /* u8 *pframe = precv_frame->u.hdr.rx_data; */
4408         /* uint len = precv_frame->u.hdr.len; */
4409
4410         if (!padapter)
4411                 return;
4412
4413         pmlmeext = &padapter->mlmeextpriv;
4414         pcmdpriv = &padapter->cmdpriv;
4415
4416         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4417         if (!pcmd_obj)
4418                 return;
4419
4420         cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
4421         pevtcmd = rtw_zmalloc(cmdsz);
4422         if (!pevtcmd) {
4423                 kfree(pcmd_obj);
4424                 return;
4425         }
4426
4427         INIT_LIST_HEAD(&pcmd_obj->list);
4428
4429         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4430         pcmd_obj->cmdsz = cmdsz;
4431         pcmd_obj->parmbuf = pevtcmd;
4432
4433         pcmd_obj->rsp = NULL;
4434         pcmd_obj->rspsz  = 0;
4435
4436         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4437         pc2h_evt_hdr->len = sizeof(struct survey_event);
4438         pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
4439         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4440
4441         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4442
4443         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4444                 kfree(pcmd_obj);
4445                 kfree(pevtcmd);
4446                 return;
4447         }
4448
4449         process_80211d(padapter, &psurvey_evt->bss);
4450
4451         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4452
4453         pmlmeext->sitesurvey_res.bss_cnt++;
4454
4455         return;
4456
4457 }
4458
4459 void report_surveydone_event(struct adapter *padapter)
4460 {
4461         struct cmd_obj *pcmd_obj;
4462         u8 *pevtcmd;
4463         u32 cmdsz;
4464         struct surveydone_event *psurveydone_evt;
4465         struct C2HEvent_Header  *pc2h_evt_hdr;
4466         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4467         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4468
4469         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4470         if (!pcmd_obj)
4471                 return;
4472
4473         cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));
4474         pevtcmd = rtw_zmalloc(cmdsz);
4475         if (!pevtcmd) {
4476                 kfree(pcmd_obj);
4477                 return;
4478         }
4479
4480         INIT_LIST_HEAD(&pcmd_obj->list);
4481
4482         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4483         pcmd_obj->cmdsz = cmdsz;
4484         pcmd_obj->parmbuf = pevtcmd;
4485
4486         pcmd_obj->rsp = NULL;
4487         pcmd_obj->rspsz  = 0;
4488
4489         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4490         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4491         pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
4492         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4493
4494         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4495         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4496
4497         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4498
4499         return;
4500
4501 }
4502
4503 void report_join_res(struct adapter *padapter, int res)
4504 {
4505         struct cmd_obj *pcmd_obj;
4506         u8 *pevtcmd;
4507         u32 cmdsz;
4508         struct joinbss_event            *pjoinbss_evt;
4509         struct C2HEvent_Header  *pc2h_evt_hdr;
4510         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4511         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4512         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4513
4514         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4515         if (!pcmd_obj)
4516                 return;
4517
4518         cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
4519         pevtcmd = rtw_zmalloc(cmdsz);
4520         if (!pevtcmd) {
4521                 kfree(pcmd_obj);
4522                 return;
4523         }
4524
4525         INIT_LIST_HEAD(&pcmd_obj->list);
4526
4527         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4528         pcmd_obj->cmdsz = cmdsz;
4529         pcmd_obj->parmbuf = pevtcmd;
4530
4531         pcmd_obj->rsp = NULL;
4532         pcmd_obj->rspsz  = 0;
4533
4534         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4535         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4536         pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
4537         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4538
4539         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4540         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4541         pjoinbss_evt->network.join_res  = pjoinbss_evt->network.aid = res;
4542
4543
4544         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4545
4546
4547         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4548
4549         return;
4550
4551 }
4552
4553 void report_wmm_edca_update(struct adapter *padapter)
4554 {
4555         struct cmd_obj *pcmd_obj;
4556         u8 *pevtcmd;
4557         u32 cmdsz;
4558         struct wmm_event                *pwmm_event;
4559         struct C2HEvent_Header  *pc2h_evt_hdr;
4560         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4561         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4562
4563         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4564         if (!pcmd_obj)
4565                 return;
4566
4567         cmdsz = (sizeof(struct wmm_event) + sizeof(struct C2HEvent_Header));
4568         pevtcmd = rtw_zmalloc(cmdsz);
4569         if (!pevtcmd) {
4570                 kfree(pcmd_obj);
4571                 return;
4572         }
4573
4574         INIT_LIST_HEAD(&pcmd_obj->list);
4575
4576         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4577         pcmd_obj->cmdsz = cmdsz;
4578         pcmd_obj->parmbuf = pevtcmd;
4579
4580         pcmd_obj->rsp = NULL;
4581         pcmd_obj->rspsz  = 0;
4582
4583         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4584         pc2h_evt_hdr->len = sizeof(struct wmm_event);
4585         pc2h_evt_hdr->ID = GEN_EVT_CODE(_WMM);
4586         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4587
4588         pwmm_event = (struct wmm_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4589         pwmm_event->wmm = 0;
4590
4591         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4592
4593         return;
4594
4595 }
4596
4597 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4598 {
4599         struct cmd_obj *pcmd_obj;
4600         u8 *pevtcmd;
4601         u32 cmdsz;
4602         struct sta_info *psta;
4603         int     mac_id;
4604         struct stadel_event                     *pdel_sta_evt;
4605         struct C2HEvent_Header  *pc2h_evt_hdr;
4606         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4607         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4608
4609         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4610         if (!pcmd_obj)
4611                 return;
4612
4613         cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
4614         pevtcmd = rtw_zmalloc(cmdsz);
4615         if (!pevtcmd) {
4616                 kfree(pcmd_obj);
4617                 return;
4618         }
4619
4620         INIT_LIST_HEAD(&pcmd_obj->list);
4621
4622         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4623         pcmd_obj->cmdsz = cmdsz;
4624         pcmd_obj->parmbuf = pevtcmd;
4625
4626         pcmd_obj->rsp = NULL;
4627         pcmd_obj->rspsz  = 0;
4628
4629         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4630         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4631         pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
4632         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4633
4634         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4635         memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
4636         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4637
4638
4639         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4640         if (psta)
4641                 mac_id = (int)psta->mac_id;
4642         else
4643                 mac_id = (-1);
4644
4645         pdel_sta_evt->mac_id = mac_id;
4646
4647         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4648 }
4649
4650 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
4651 {
4652         struct cmd_obj *pcmd_obj;
4653         u8 *pevtcmd;
4654         u32 cmdsz;
4655         struct stassoc_event            *padd_sta_evt;
4656         struct C2HEvent_Header  *pc2h_evt_hdr;
4657         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4658         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4659
4660         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4661         if (!pcmd_obj)
4662                 return;
4663
4664         cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
4665         pevtcmd = rtw_zmalloc(cmdsz);
4666         if (!pevtcmd) {
4667                 kfree(pcmd_obj);
4668                 return;
4669         }
4670
4671         INIT_LIST_HEAD(&pcmd_obj->list);
4672
4673         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4674         pcmd_obj->cmdsz = cmdsz;
4675         pcmd_obj->parmbuf = pevtcmd;
4676
4677         pcmd_obj->rsp = NULL;
4678         pcmd_obj->rspsz  = 0;
4679
4680         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4681         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4682         pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
4683         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4684
4685         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4686         memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
4687         padd_sta_evt->cam_id = cam_idx;
4688
4689         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4690 }
4691
4692 /****************************************************************************
4693
4694 Following are the event callback functions
4695
4696 *****************************************************************************/
4697
4698 /* for sta/adhoc mode */
4699 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4700 {
4701         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4702         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4703         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4704
4705         /* ERP */
4706         VCS_update(padapter, psta);
4707
4708         /* HT */
4709         if (pmlmepriv->htpriv.ht_option) {
4710                 psta->htpriv.ht_option = true;
4711
4712                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4713
4714                 psta->htpriv.rx_ampdu_min_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para&IEEE80211_HT_CAP_AMPDU_DENSITY)>>2;
4715
4716                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_20))
4717                         psta->htpriv.sgi_20m = true;
4718
4719                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_40))
4720                         psta->htpriv.sgi_40m = true;
4721
4722                 psta->qos_option = true;
4723
4724                 psta->htpriv.ldpc_cap = pmlmepriv->htpriv.ldpc_cap;
4725                 psta->htpriv.stbc_cap = pmlmepriv->htpriv.stbc_cap;
4726                 psta->htpriv.beamform_cap = pmlmepriv->htpriv.beamform_cap;
4727
4728                 memcpy(&psta->htpriv.ht_cap, &pmlmeinfo->HT_caps, sizeof(struct ieee80211_ht_cap));
4729         } else {
4730                 psta->htpriv.ht_option = false;
4731
4732                 psta->htpriv.ampdu_enable = false;
4733
4734                 psta->htpriv.sgi_20m = false;
4735                 psta->htpriv.sgi_40m = false;
4736                 psta->qos_option = false;
4737
4738         }
4739
4740         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4741
4742         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4743         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4744
4745         psta->bw_mode = pmlmeext->cur_bwmode;
4746
4747         /* QoS */
4748         if (pmlmepriv->qospriv.qos_option)
4749                 psta->qos_option = true;
4750
4751         update_ldpc_stbc_cap(psta);
4752
4753         spin_lock_bh(&psta->lock);
4754         psta->state = _FW_LINKED;
4755         spin_unlock_bh(&psta->lock);
4756
4757 }
4758
4759 static void rtw_mlmeext_disconnect(struct adapter *padapter)
4760 {
4761         struct mlme_priv        *pmlmepriv = &padapter->mlmepriv;
4762         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4763         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4764         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4765
4766         /* set_opmode_cmd(padapter, infra_client_with_mlme); */
4767
4768         /* For safety, prevent from keeping macid sleep.
4769          * If we can sure all power mode enter/leave are paired,
4770          * this check can be removed.
4771          * Lucas@20131113
4772          */
4773         /* wakeup macid after disconnect. */
4774         {
4775                 struct sta_info *psta;
4776
4777                 psta = rtw_get_stainfo(&padapter->stapriv, get_my_bssid(pnetwork));
4778                 if (psta)
4779                         rtw_hal_macid_wakeup(padapter, psta->mac_id);
4780         }
4781
4782         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4783         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4784
4785         /* set MSR to no link state -> infra. mode */
4786         Set_MSR(padapter, _HW_STATE_STATION_);
4787
4788         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4789
4790         /* switch to the 20M Hz mode after disconnect */
4791         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
4792         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4793
4794         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4795
4796         flush_all_cam_entry(padapter);
4797
4798         del_timer_sync(&pmlmeext->link_timer);
4799
4800         /* pmlmepriv->LinkDetectInfo.TrafficBusyState = false; */
4801         pmlmepriv->LinkDetectInfo.TrafficTransitionCount = 0;
4802         pmlmepriv->LinkDetectInfo.LowPowerTransitionCount = 0;
4803
4804 }
4805
4806 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4807 {
4808         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4809         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4810         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
4811         struct sta_priv         *pstapriv = &padapter->stapriv;
4812         u8 join_type;
4813         struct sta_info *psta;
4814
4815         if (join_res < 0) {
4816                 join_type = 1;
4817                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4818                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4819
4820                 return;
4821         }
4822
4823         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
4824                 /* update bc/mc sta_info */
4825                 update_bmc_sta(padapter);
4826
4827
4828         /* turn on dynamic functions */
4829         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4830
4831         /*  update IOT-related issue */
4832         update_IOT_info(padapter);
4833
4834         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->supported_rates);
4835
4836         /* BCN interval */
4837         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4838
4839         /* update capability */
4840         update_capinfo(padapter, pmlmeinfo->capability);
4841
4842         /* WMM, Update EDCA param */
4843         WMMOnAssocRsp(padapter);
4844
4845         /* HT */
4846         HTOnAssocRsp(padapter);
4847
4848         /* Set cur_channel&cur_bwmode&cur_ch_offset */
4849         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4850
4851         psta = rtw_get_stainfo(pstapriv, cur_network->mac_address);
4852         if (psta) { /* only for infra. mode */
4853
4854                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4855
4856                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4857
4858                 /* set per sta rate after updating HT cap. */
4859                 set_sta_rate(padapter, psta);
4860
4861                 rtw_sta_media_status_rpt(padapter, psta, 1);
4862
4863                 /* wakeup macid after join bss successfully to ensure
4864                         the subsequent data frames can be sent out normally */
4865                 rtw_hal_macid_wakeup(padapter, psta->mac_id);
4866         }
4867
4868         join_type = 2;
4869         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4870
4871         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4872                 /*  correcting TSF */
4873                 correct_TSF(padapter, pmlmeext);
4874
4875                 /* set_link_timer(pmlmeext, DISCONNECT_TO); */
4876         }
4877
4878         if (get_iface_type(padapter) == IFACE_PORT0)
4879                 rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4880 }
4881
4882 /* currently only adhoc mode will go here */
4883 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4884 {
4885         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
4886         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4887         u8 join_type;
4888
4889         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4890                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) { /* adhoc master or sta_count>1 */
4891
4892                         /* nothing to do */
4893                 } else { /* adhoc client */
4894                         /* update TSF Value */
4895                         /* update_TSF(pmlmeext, pframe, len); */
4896
4897                         /*  correcting TSF */
4898                         correct_TSF(padapter, pmlmeext);
4899
4900                         /* start beacon */
4901                         if (send_beacon(padapter) == _FAIL) {
4902                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4903
4904                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4905
4906                                 return;
4907                         }
4908
4909                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4910
4911                 }
4912
4913                 join_type = 2;
4914                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4915         }
4916
4917         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4918
4919         psta->bssratelen = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates);
4920         memcpy(psta->bssrateset, pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates, psta->bssratelen);
4921
4922         /* update adhoc sta_info */
4923         update_sta_info(padapter, psta);
4924
4925         rtw_hal_update_sta_rate_mask(padapter, psta);
4926
4927         /*  ToDo: HT for Ad-hoc */
4928         psta->wireless_mode = rtw_check_network_type(psta->bssrateset, psta->bssratelen, pmlmeext->cur_channel);
4929         psta->raid = networktype_to_raid_ex(padapter, psta);
4930
4931         /* rate radaptive */
4932         Update_RA_Entry(padapter, psta);
4933 }
4934
4935 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4936 {
4937         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter))
4938                 rtw_mlmeext_disconnect(padapter);
4939 }
4940
4941 /****************************************************************************
4942
4943 Following are the functions for the timer handlers
4944
4945 *****************************************************************************/
4946 void _linked_info_dump(struct adapter *padapter)
4947 {
4948         int i;
4949         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4950         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4951         int UndecoratedSmoothedPWDB;
4952         struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);
4953
4954         if (padapter->bLinkInfoDump) {
4955
4956                 if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
4957                         rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
4958
4959                 for (i = 0; i < NUM_STA; i++) {
4960                         if (pdvobj->macid[i]) {
4961                                 if (i != 1) /* skip bc/mc sta */
4962                                         /*   tx info ============ */
4963                                         rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &i);
4964                         }
4965                 }
4966                 rtw_hal_set_def_var(padapter, HAL_DEF_DBG_RX_INFO_DUMP, NULL);
4967         }
4968 }
4969
4970 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4971 {
4972         u8 ret = false;
4973
4974         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta))
4975                 && sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta)
4976                 && sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta)
4977         ) {
4978                 ret = false;
4979         } else {
4980                 ret = true;
4981         }
4982
4983         sta_update_last_rx_pkts(psta);
4984
4985         return ret;
4986 }
4987
4988 void linked_status_chk(struct adapter *padapter)
4989 {
4990         u32 i;
4991         struct sta_info         *psta;
4992         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
4993         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4994         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4995         struct sta_priv         *pstapriv = &padapter->stapriv;
4996
4997
4998         if (is_client_associated_to_ap(padapter)) {
4999                 /* linked infrastructure client mode */
5000
5001                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
5002                 int rx_chk_limit;
5003                 int link_count_limit;
5004
5005                 #if defined(DBG_ROAMING_TEST)
5006                 rx_chk_limit = 1;
5007                 #else
5008                 rx_chk_limit = 8;
5009                 #endif
5010                 link_count_limit = 7; /*  16 sec */
5011
5012                 /*  Marked by Kurt 20130715 */
5013                 /*  For WiDi 3.5 and latered on, they don't ask WiDi sink to do roaming, so we could not check rx limit that strictly. */
5014                 /*  todo: To check why we under miracast session, rx_chk would be false */
5015                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.mac_address);
5016                 if (psta) {
5017                         if (chk_ap_is_alive(padapter, psta) == false)
5018                                 rx_chk = _FAIL;
5019
5020                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
5021                                 tx_chk = _FAIL;
5022
5023                         {
5024                                 if (rx_chk != _SUCCESS) {
5025                                         if (pmlmeext->retry == 0) {
5026                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, pmlmeinfo->network.mac_address, 0, 0, 0, 0);
5027                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, pmlmeinfo->network.mac_address, 0, 0, 0, 0);
5028                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, pmlmeinfo->network.mac_address, 0, 0, 0, 0);
5029                                         }
5030                                 }
5031
5032                                 if (tx_chk != _SUCCESS &&
5033                                     pmlmeinfo->link_count++ == link_count_limit)
5034                                         tx_chk = issue_nulldata_in_interrupt(padapter, NULL);
5035                         }
5036
5037                         if (rx_chk == _FAIL) {
5038                                 pmlmeext->retry++;
5039                                 if (pmlmeext->retry > rx_chk_limit) {
5040                                         netdev_dbg(padapter->pnetdev,
5041                                                    FUNC_ADPT_FMT " disconnect or roaming\n",
5042                                                    FUNC_ADPT_ARG(padapter));
5043                                         receive_disconnect(padapter, pmlmeinfo->network.mac_address
5044                                                 , WLAN_REASON_EXPIRATION_CHK);
5045                                         return;
5046                                 }
5047                         } else {
5048                                 pmlmeext->retry = 0;
5049                         }
5050
5051                         if (tx_chk == _FAIL) {
5052                                 pmlmeinfo->link_count %= (link_count_limit+1);
5053                         } else {
5054                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
5055                                 pmlmeinfo->link_count = 0;
5056                         }
5057
5058                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.mac_address)) != NULL) */
5059         } else if (is_client_associated_to_ibss(padapter)) {
5060                 /* linked IBSS mode */
5061                 /* for each assoc list entry to check the rx pkt counter */
5062                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
5063                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
5064                                 psta = pmlmeinfo->FW_sta_info[i].psta;
5065
5066                                 if (psta == NULL)
5067                                         continue;
5068
5069                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
5070
5071                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
5072                                                 pmlmeinfo->FW_sta_info[i].retry++;
5073                                         } else {
5074                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
5075                                                 pmlmeinfo->FW_sta_info[i].status = 0;
5076                                                 report_del_sta_event(padapter, psta->hwaddr
5077                                                         , 65535/*  indicate disconnect caused by no rx */
5078                                                 );
5079                                         }
5080                                 } else {
5081                                         pmlmeinfo->FW_sta_info[i].retry = 0;
5082                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
5083                                 }
5084                         }
5085                 }
5086
5087                 /* set_link_timer(pmlmeext, DISCONNECT_TO); */
5088
5089         }
5090
5091 }
5092
5093 void survey_timer_hdl(struct timer_list *t)
5094 {
5095         struct adapter *padapter =
5096                 from_timer(padapter, t, mlmeextpriv.survey_timer);
5097         struct cmd_obj  *ph2c;
5098         struct sitesurvey_parm  *psurveyPara;
5099         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
5100         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5101
5102         /* issue rtw_sitesurvey_cmd */
5103         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
5104                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
5105                         pmlmeext->sitesurvey_res.channel_idx++;
5106
5107                 if (pmlmeext->scan_abort) {
5108                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
5109
5110                         pmlmeext->scan_abort = false;/* reset */
5111                 }
5112
5113                 ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5114                 if (!ph2c)
5115                         return;
5116
5117                 psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));
5118                 if (!psurveyPara) {
5119                         kfree(ph2c);
5120                         return;
5121                 }
5122
5123                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
5124                 rtw_enqueue_cmd(pcmdpriv, ph2c);
5125         }
5126 }
5127
5128 void link_timer_hdl(struct timer_list *t)
5129 {
5130         struct adapter *padapter =
5131                 from_timer(padapter, t, mlmeextpriv.link_timer);
5132         /* static unsigned int          rx_pkt = 0; */
5133         /* static u64                           tx_cnt = 0; */
5134         /* struct xmit_priv     *pxmitpriv = &(padapter->xmitpriv); */
5135         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5136         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5137         /* struct sta_priv      *pstapriv = &padapter->stapriv; */
5138
5139
5140         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
5141                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5142                 report_join_res(padapter, -3);
5143         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
5144                 /* re-auth timer */
5145                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
5146                         pmlmeinfo->state = 0;
5147                         report_join_res(padapter, -1);
5148                         return;
5149                 }
5150
5151                 pmlmeinfo->auth_seq = 1;
5152                 issue_auth(padapter, NULL, 0);
5153                 set_link_timer(pmlmeext, REAUTH_TO);
5154         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
5155                 /* re-assoc timer */
5156                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
5157                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5158                         report_join_res(padapter, -2);
5159                         return;
5160                 }
5161
5162                 issue_assocreq(padapter);
5163                 set_link_timer(pmlmeext, REASSOC_TO);
5164         }
5165 }
5166
5167 void addba_timer_hdl(struct timer_list *t)
5168 {
5169         struct sta_info *psta = from_timer(psta, t, addba_retry_timer);
5170         struct ht_priv *phtpriv;
5171
5172         if (!psta)
5173                 return;
5174
5175         phtpriv = &psta->htpriv;
5176
5177         if (phtpriv->ht_option && phtpriv->ampdu_enable) {
5178                 if (phtpriv->candidate_tid_bitmap)
5179                         phtpriv->candidate_tid_bitmap = 0x0;
5180
5181         }
5182 }
5183
5184 void sa_query_timer_hdl(struct timer_list *t)
5185 {
5186         struct adapter *padapter =
5187                 from_timer(padapter, t, mlmeextpriv.sa_query_timer);
5188         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
5189         /* disconnect */
5190         spin_lock_bh(&pmlmepriv->lock);
5191
5192         if (check_fwstate(pmlmepriv, _FW_LINKED)) {
5193                 rtw_disassoc_cmd(padapter, 0, true);
5194                 rtw_indicate_disconnect(padapter);
5195                 rtw_free_assoc_resources(padapter, 1);
5196         }
5197
5198         spin_unlock_bh(&pmlmepriv->lock);
5199 }
5200
5201 u8 NULL_hdl(struct adapter *padapter, u8 *pbuf)
5202 {
5203         return H2C_SUCCESS;
5204 }
5205
5206 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
5207 {
5208         u8 type;
5209         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5210         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5211         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
5212
5213         if (psetop->mode == Ndis802_11APMode) {
5214                 pmlmeinfo->state = WIFI_FW_AP_STATE;
5215                 type = _HW_STATE_AP_;
5216                 /* start_ap_mode(padapter); */
5217         } else if (psetop->mode == Ndis802_11Infrastructure) {
5218                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
5219                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
5220                 type = _HW_STATE_STATION_;
5221         } else if (psetop->mode == Ndis802_11IBSS) {
5222                 type = _HW_STATE_ADHOC_;
5223         } else {
5224                 type = _HW_STATE_NOLINK_;
5225         }
5226
5227         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
5228         /* Set_MSR(padapter, type); */
5229
5230         if (psetop->mode == Ndis802_11APMode) {
5231                 /*  Do this after port switch to */
5232                 /*  prevent from downloading rsvd page to wrong port */
5233                 rtw_btcoex_MediaStatusNotify(padapter, 1); /* connect */
5234         }
5235
5236         return H2C_SUCCESS;
5237
5238 }
5239
5240 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
5241 {
5242         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5243         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5244         struct wlan_bssid_ex    *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5245         struct joinbss_parm *pparm = (struct joinbss_parm *)pbuf;
5246         /* u32 initialgain; */
5247
5248         if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
5249                 start_bss_network(padapter);
5250                 return H2C_SUCCESS;
5251         }
5252
5253         /* below is for ad-hoc master */
5254         if (pparm->network.infrastructure_mode == Ndis802_11IBSS) {
5255                 rtw_joinbss_reset(padapter);
5256
5257                 pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5258                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5259                 pmlmeinfo->ERP_enable = 0;
5260                 pmlmeinfo->WMM_enable = 0;
5261                 pmlmeinfo->HT_enable = 0;
5262                 pmlmeinfo->HT_caps_enable = 0;
5263                 pmlmeinfo->HT_info_enable = 0;
5264                 pmlmeinfo->agg_enable_bitmap = 0;
5265                 pmlmeinfo->candidate_tid_bitmap = 0;
5266
5267                 /* disable dynamic functions, such as high power, DIG */
5268                 Save_DM_Func_Flag(padapter);
5269                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5270
5271                 /* config the initial gain under linking, need to write the BB registers */
5272                 /* initialgain = 0x1E; */
5273                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
5274
5275                 /* cancel link timer */
5276                 del_timer_sync(&pmlmeext->link_timer);
5277
5278                 /* clear CAM */
5279                 flush_all_cam_entry(padapter);
5280
5281                 memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, ie_length));
5282                 pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
5283
5284                 if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
5285                         return H2C_PARAMETERS_ERROR;
5286
5287                 memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
5288
5289                 start_create_ibss(padapter);
5290
5291         }
5292
5293         return H2C_SUCCESS;
5294
5295 }
5296
5297 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5298 {
5299         u8 join_type;
5300         struct ndis_80211_var_ie *pIE;
5301         struct registry_priv *pregpriv = &padapter->registrypriv;
5302         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5303         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5304         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5305         u32 i;
5306         u8 cbw40_enable = 0;
5307         /* u32 initialgain; */
5308         /* u32 acparm; */
5309         u8 ch, bw, offset;
5310
5311         /* check already connecting to AP or not */
5312         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
5313                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
5314                         issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
5315                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5316
5317                 /* clear CAM */
5318                 flush_all_cam_entry(padapter);
5319
5320                 del_timer_sync(&pmlmeext->link_timer);
5321
5322                 /* set MSR to nolink -> infra. mode */
5323                 /* Set_MSR(padapter, _HW_STATE_NOLINK_); */
5324                 Set_MSR(padapter, _HW_STATE_STATION_);
5325
5326
5327                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5328         }
5329
5330         rtw_joinbss_reset(padapter);
5331
5332         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5333         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5334         pmlmeinfo->ERP_enable = 0;
5335         pmlmeinfo->WMM_enable = 0;
5336         pmlmeinfo->HT_enable = 0;
5337         pmlmeinfo->HT_caps_enable = 0;
5338         pmlmeinfo->HT_info_enable = 0;
5339         pmlmeinfo->agg_enable_bitmap = 0;
5340         pmlmeinfo->candidate_tid_bitmap = 0;
5341         pmlmeinfo->bwmode_updated = false;
5342         /* pmlmeinfo->assoc_AP_vendor = HT_IOT_PEER_MAX; */
5343         pmlmeinfo->VHT_enable = 0;
5344
5345         memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, ie_length));
5346         pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
5347
5348         if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
5349                 return H2C_PARAMETERS_ERROR;
5350
5351         memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
5352
5353         pmlmeext->cur_channel = (u8)pnetwork->configuration.ds_config;
5354         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
5355
5356         /* Check AP vendor to move rtw_joinbss_cmd() */
5357         /* pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->ies, pnetwork->ie_length); */
5358
5359         /* sizeof(struct ndis_802_11_fix_ie) */
5360         for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) {
5361                 pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i);
5362
5363                 switch (pIE->element_id) {
5364                 case WLAN_EID_VENDOR_SPECIFIC:/* Get WMM IE. */
5365                         if (!memcmp(pIE->data, WMM_OUI, 4))
5366                                 WMM_param_handler(padapter, pIE);
5367                         break;
5368
5369                 case WLAN_EID_HT_CAPABILITY:    /* Get HT Cap IE. */
5370                         pmlmeinfo->HT_caps_enable = 1;
5371                         break;
5372
5373                 case WLAN_EID_HT_OPERATION:     /* Get HT Info IE. */
5374                         pmlmeinfo->HT_info_enable = 1;
5375
5376                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5377                         {
5378                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5379
5380                                 if (pnetwork->configuration.ds_config <= 14) {
5381                                         if ((pregpriv->bw_mode & 0x0f) > CHANNEL_WIDTH_20)
5382                                                 cbw40_enable = 1;
5383                                 }
5384
5385                                 if ((cbw40_enable) && (pht_info->infos[0] & BIT(2))) {
5386                                         /* switch to the 40M Hz mode according to the AP */
5387                                         pmlmeext->cur_bwmode = CHANNEL_WIDTH_40;
5388                                         switch (pht_info->infos[0] & 0x3) {
5389                                         case 1:
5390                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5391                                                 break;
5392
5393                                         case 3:
5394                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5395                                                 break;
5396
5397                                         default:
5398                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5399                                                 pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5400                                                 break;
5401                                         }
5402                                 }
5403                         }
5404                         break;
5405                 default:
5406                         break;
5407                 }
5408
5409                 i += (pIE->length + 2);
5410         }
5411
5412         /* check channel, bandwidth, offset and switch */
5413         if (rtw_chk_start_clnt_join(padapter, &ch, &bw, &offset) == _FAIL) {
5414                 report_join_res(padapter, (-4));
5415                 return H2C_SUCCESS;
5416         }
5417
5418         /* disable dynamic functions, such as high power, DIG */
5419         /* Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false); */
5420
5421         /* config the initial gain under linking, need to write the BB registers */
5422         /* initialgain = 0x1E; */
5423         /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
5424
5425         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.mac_address);
5426         join_type = 0;
5427         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5428         rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);
5429
5430         set_channel_bwmode(padapter, ch, offset, bw);
5431
5432         /* cancel link timer */
5433         del_timer_sync(&pmlmeext->link_timer);
5434
5435         start_clnt_join(padapter);
5436
5437         return H2C_SUCCESS;
5438
5439 }
5440
5441 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5442 {
5443         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5444         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5445         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5446         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5447         u8 val8;
5448
5449         if (is_client_associated_to_ap(padapter))
5450                         issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5451
5452         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5453                 /* Stop BCN */
5454                 val8 = 0;
5455                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5456         }
5457
5458         rtw_mlmeext_disconnect(padapter);
5459
5460         rtw_free_uc_swdec_pending_queue(padapter);
5461
5462         return  H2C_SUCCESS;
5463 }
5464
5465 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
5466         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
5467 {
5468         int i, j;
5469         int set_idx;
5470         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5471
5472         /* clear first */
5473         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5474
5475         /* acquire channels from in */
5476         j = 0;
5477         for (i = 0; i < in_num; i++) {
5478
5479                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5480                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
5481                         && set_idx >= 0
5482                 ) {
5483                         if (j >= out_num) {
5484                                 netdev_dbg(padapter->pnetdev,
5485                                            FUNC_ADPT_FMT " out_num:%u not enough\n",
5486                                            FUNC_ADPT_ARG(padapter), out_num);
5487                                 break;
5488                         }
5489
5490                         memcpy(&out[j], &in[i], sizeof(struct rtw_ieee80211_channel));
5491
5492                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5493                                 out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5494
5495                         j++;
5496                 }
5497                 if (j >= out_num)
5498                         break;
5499         }
5500
5501         /* if out is empty, use channel_set as default */
5502         if (j == 0) {
5503                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5504
5505                         if (j >= out_num) {
5506                                 netdev_dbg(padapter->pnetdev,
5507                                            FUNC_ADPT_FMT " out_num:%u not enough\n",
5508                                            FUNC_ADPT_ARG(padapter),
5509                                            out_num);
5510                                 break;
5511                         }
5512
5513                         out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
5514
5515                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5516                                 out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5517
5518                         j++;
5519                 }
5520         }
5521
5522         return j;
5523 }
5524
5525 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5526 {
5527         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5528         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5529         u8 bdelayscan = false;
5530         u8 val8;
5531         u32 initialgain;
5532         u32 i;
5533
5534         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5535                 pmlmeext->sitesurvey_res.state = SCAN_START;
5536                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5537                 pmlmeext->sitesurvey_res.channel_idx = 0;
5538
5539                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5540                         if (pparm->ssid[i].ssid_length) {
5541                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].ssid, pparm->ssid[i].ssid, IW_ESSID_MAX_SIZE);
5542                                 pmlmeext->sitesurvey_res.ssid[i].ssid_length = pparm->ssid[i].ssid_length;
5543                         } else {
5544                                 pmlmeext->sitesurvey_res.ssid[i].ssid_length = 0;
5545                         }
5546                 }
5547
5548                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5549                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5550                         , pparm->ch, pparm->ch_num
5551                 );
5552
5553                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5554
5555                 /* issue null data if associating to the AP */
5556                 if (is_client_associated_to_ap(padapter)) {
5557                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5558
5559                         issue_nulldata(padapter, NULL, 1, 3, 500);
5560
5561                         bdelayscan = true;
5562                 }
5563                 if (bdelayscan) {
5564                         /* delay 50ms to protect nulldata(1). */
5565                         set_survey_timer(pmlmeext, 50);
5566                         return H2C_SUCCESS;
5567                 }
5568         }
5569
5570         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5571                 /* disable dynamic functions, such as high power, DIG */
5572                 Save_DM_Func_Flag(padapter);
5573                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5574
5575                 /* config the initial gain under scanning, need to write the BB
5576                  * registers
5577                  */
5578                 initialgain = 0x1e;
5579
5580                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5581
5582                 /* set MSR to no link state */
5583                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5584
5585                 val8 = 1; /* under site survey */
5586                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5587
5588                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5589         }
5590
5591         site_survey(padapter);
5592
5593         return H2C_SUCCESS;
5594
5595 }
5596
5597 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5598 {
5599         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5600         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5601         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5602
5603         if (pparm->mode < 4)
5604                 pmlmeinfo->auth_algo = pparm->mode;
5605
5606         return  H2C_SUCCESS;
5607 }
5608
5609 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5610 {
5611         u16 ctrl = 0;
5612         s16 cam_id = 0;
5613         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5614         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5615         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5616         unsigned char null_addr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5617         u8 *addr;
5618
5619         /* main tx key for wep. */
5620         if (pparm->set_tx)
5621                 pmlmeinfo->key_index = pparm->keyid;
5622
5623         cam_id = rtw_camid_alloc(padapter, NULL, pparm->keyid);
5624
5625         if (cam_id < 0) {
5626         } else {
5627                 if (cam_id > 3) /* not default key, searched by A2 */
5628                         addr = get_bssid(&padapter->mlmepriv);
5629                 else
5630                         addr = null_addr;
5631
5632                 ctrl = BIT(15) | BIT6 | ((pparm->algorithm) << 2) | pparm->keyid;
5633                 write_cam(padapter, cam_id, ctrl, addr, pparm->key);
5634                 netdev_dbg(padapter->pnetdev,
5635                            "set group key camid:%d, addr:%pM, kid:%d, type:%s\n",
5636                            cam_id, MAC_ARG(addr), pparm->keyid,
5637                            security_type_str(pparm->algorithm));
5638         }
5639
5640         if (cam_id >= 0 && cam_id <= 3)
5641                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_DK_CFG, (u8 *)true);
5642
5643         /* allow multicast packets to driver */
5644         padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_ON_RCR_AM, null_addr);
5645
5646         return H2C_SUCCESS;
5647 }
5648
5649 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5650 {
5651         u16 ctrl = 0;
5652         s16 cam_id = 0;
5653         u8 ret = H2C_SUCCESS;
5654         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5655         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5656         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5657         struct sta_priv *pstapriv = &padapter->stapriv;
5658         struct sta_info *psta;
5659
5660         if (pparm->algorithm == _NO_PRIVACY_)
5661                 goto write_to_cam;
5662
5663         psta = rtw_get_stainfo(pstapriv, pparm->addr);
5664         if (!psta) {
5665                 netdev_dbg(padapter->pnetdev, "%s sta:%pM not found\n",
5666                            __func__, MAC_ARG(pparm->addr));
5667                 ret = H2C_REJECTED;
5668                 goto exit;
5669         }
5670
5671         pmlmeinfo->enc_algo = pparm->algorithm;
5672         cam_id = rtw_camid_alloc(padapter, psta, 0);
5673         if (cam_id < 0)
5674                 goto exit;
5675
5676 write_to_cam:
5677         if (pparm->algorithm == _NO_PRIVACY_) {
5678                 while ((cam_id = rtw_camid_search(padapter, pparm->addr, -1)) >= 0) {
5679                         netdev_dbg(padapter->pnetdev,
5680                                    "clear key for addr:%pM, camid:%d\n",
5681                                    MAC_ARG(pparm->addr), cam_id);
5682                         clear_cam_entry(padapter, cam_id);
5683                         rtw_camid_free(padapter, cam_id);
5684                 }
5685         } else {
5686                 netdev_dbg(padapter->pnetdev,
5687                            "set pairwise key camid:%d, addr:%pM, kid:%d, type:%s\n",
5688                            cam_id, MAC_ARG(pparm->addr), pparm->keyid,
5689                            security_type_str(pparm->algorithm));
5690                 ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5691                 write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5692         }
5693         ret = H2C_SUCCESS_RSP;
5694
5695 exit:
5696         return ret;
5697 }
5698
5699 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5700 {
5701         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5702         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5703         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5704
5705         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5706
5707         if (!psta)
5708                 return  H2C_SUCCESS;
5709
5710         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5711                 ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5712                 /* pmlmeinfo->ADDBA_retry_count = 0; */
5713                 /* pmlmeinfo->candidate_tid_bitmap |= (0x1 << pparm->tid); */
5714                 /* psta->htpriv.candidate_tid_bitmap |= BIT(pparm->tid); */
5715                 issue_action_BA(padapter, pparm->addr, WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5716                 /* _set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO); */
5717                 _set_timer(&psta->addba_retry_timer, ADDBA_TO);
5718         } else {
5719                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5720         }
5721         return  H2C_SUCCESS;
5722 }
5723
5724
5725 u8 chk_bmc_sleepq_cmd(struct adapter *padapter)
5726 {
5727         struct cmd_obj *ph2c;
5728         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5729         u8 res = _SUCCESS;
5730
5731         ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5732         if (!ph2c) {
5733                 res = _FAIL;
5734                 goto exit;
5735         }
5736
5737         init_h2fwcmd_w_parm_no_parm_rsp(ph2c, GEN_CMD_CODE(_ChkBMCSleepq));
5738
5739         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5740
5741 exit:
5742         return res;
5743 }
5744
5745 u8 set_tx_beacon_cmd(struct adapter *padapter)
5746 {
5747         struct cmd_obj  *ph2c;
5748         struct Tx_Beacon_param  *ptxBeacon_parm;
5749         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5750         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5751         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5752         u8 res = _SUCCESS;
5753         int len_diff = 0;
5754
5755         ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5756         if (!ph2c) {
5757                 res = _FAIL;
5758                 goto exit;
5759         }
5760
5761         ptxBeacon_parm = rtw_zmalloc(sizeof(struct Tx_Beacon_param));
5762         if (!ptxBeacon_parm) {
5763                 kfree(ph2c);
5764                 res = _FAIL;
5765                 goto exit;
5766         }
5767
5768         memcpy(&(ptxBeacon_parm->network), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
5769
5770         len_diff = update_hidden_ssid(ptxBeacon_parm->network.ies+_BEACON_IE_OFFSET_,
5771                                       ptxBeacon_parm->network.ie_length-_BEACON_IE_OFFSET_,
5772                                       pmlmeinfo->hidden_ssid_mode);
5773         ptxBeacon_parm->network.ie_length += len_diff;
5774
5775         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));
5776
5777         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5778
5779 exit:
5780         return res;
5781 }
5782
5783 static struct fwevent wlanevents[] = {
5784         {0, rtw_dummy_event_callback},  /*0*/
5785         {0, NULL},
5786         {0, NULL},
5787         {0, NULL},
5788         {0, NULL},
5789         {0, NULL},
5790         {0, NULL},
5791         {0, NULL},
5792         {0, &rtw_survey_event_callback},                /*8*/
5793         {sizeof(struct surveydone_event), &rtw_surveydone_event_callback},      /*9*/
5794
5795         {0, &rtw_joinbss_event_callback},               /*10*/
5796         {sizeof(struct stassoc_event), &rtw_stassoc_event_callback},
5797         {sizeof(struct stadel_event), &rtw_stadel_event_callback},
5798         {0, &rtw_atimdone_event_callback},
5799         {0, rtw_dummy_event_callback},
5800         {0, NULL},      /*15*/
5801         {0, NULL},
5802         {0, NULL},
5803         {0, NULL},
5804         {0, rtw_fwdbg_event_callback},
5805         {0, NULL},       /*20*/
5806         {0, NULL},
5807         {0, NULL},
5808         {0, &rtw_cpwm_event_callback},
5809         {0, NULL},
5810         {0, &rtw_wmm_event_callback},
5811
5812 };
5813
5814 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5815 {
5816         u8 evt_code;
5817         u16 evt_sz;
5818         uint    *peventbuf;
5819         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5820         struct evt_priv *pevt_priv = &(padapter->evtpriv);
5821
5822         if (!pbuf)
5823                 goto _abort_event_;
5824
5825         peventbuf = (uint *)pbuf;
5826         evt_sz = (u16)(*peventbuf&0xffff);
5827         evt_code = (u8)((*peventbuf>>16)&0xff);
5828
5829         /*  checking if event code is valid */
5830         if (evt_code >= MAX_C2HEVT)
5831                 goto _abort_event_;
5832
5833         /*  checking if event size match the event parm size */
5834         if ((wlanevents[evt_code].parmsize != 0) &&
5835                         (wlanevents[evt_code].parmsize != evt_sz))
5836                 goto _abort_event_;
5837
5838         atomic_inc(&pevt_priv->event_seq);
5839
5840         peventbuf += 2;
5841
5842         if (peventbuf) {
5843                 event_callback = wlanevents[evt_code].event_callback;
5844                 event_callback(padapter, (u8 *)peventbuf);
5845
5846                 pevt_priv->evt_done_cnt++;
5847         }
5848
5849
5850 _abort_event_:
5851
5852
5853         return H2C_SUCCESS;
5854
5855 }
5856
5857 u8 h2c_msg_hdl(struct adapter *padapter, unsigned char *pbuf)
5858 {
5859         if (!pbuf)
5860                 return H2C_PARAMETERS_ERROR;
5861
5862         return H2C_SUCCESS;
5863 }
5864
5865 u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf)
5866 {
5867         struct sta_info *psta_bmc;
5868         struct list_head *xmitframe_plist, *xmitframe_phead, *tmp;
5869         struct xmit_frame *pxmitframe = NULL;
5870         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
5871         struct sta_priv  *pstapriv = &padapter->stapriv;
5872
5873         /* for BC/MC Frames */
5874         psta_bmc = rtw_get_bcmc_stainfo(padapter);
5875         if (!psta_bmc)
5876                 return H2C_SUCCESS;
5877
5878         if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5879                 msleep(10);/*  10ms, ATIM(HIQ) Windows */
5880
5881                 /* spin_lock_bh(&psta_bmc->sleep_q.lock); */
5882                 spin_lock_bh(&pxmitpriv->lock);
5883
5884                 xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5885                 list_for_each_safe(xmitframe_plist, tmp, xmitframe_phead) {
5886                         pxmitframe = list_entry(xmitframe_plist,
5887                                                 struct xmit_frame, list);
5888
5889                         list_del_init(&pxmitframe->list);
5890
5891                         psta_bmc->sleepq_len--;
5892                         if (psta_bmc->sleepq_len > 0)
5893                                 pxmitframe->attrib.mdata = 1;
5894                         else
5895                                 pxmitframe->attrib.mdata = 0;
5896
5897                         pxmitframe->attrib.triggered = 1;
5898
5899                         if (xmitframe_hiq_filter(pxmitframe))
5900                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5901
5902                         rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
5903                 }
5904
5905                 /* spin_unlock_bh(&psta_bmc->sleep_q.lock); */
5906                 spin_unlock_bh(&pxmitpriv->lock);
5907
5908                 /* check hi queue and bmc_sleepq */
5909                 rtw_chk_hi_queue_cmd(padapter);
5910         }
5911
5912         return H2C_SUCCESS;
5913 }
5914
5915 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5916 {
5917         if (send_beacon(padapter) == _FAIL)
5918                 return H2C_PARAMETERS_ERROR;
5919
5920         /* tx bc/mc frames after update TIM */
5921         chk_bmc_sleepq_hdl(padapter, NULL);
5922
5923         return H2C_SUCCESS;
5924 }
5925
5926 int rtw_chk_start_clnt_join(struct adapter *padapter, u8 *ch, u8 *bw, u8 *offset)
5927 {
5928         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5929         unsigned char cur_ch = pmlmeext->cur_channel;
5930         unsigned char cur_bw = pmlmeext->cur_bwmode;
5931         unsigned char cur_ch_offset = pmlmeext->cur_ch_offset;
5932         bool connect_allow = true;
5933
5934         if (!ch || !bw || !offset) {
5935                 rtw_warn_on(1);
5936                 connect_allow = false;
5937         }
5938
5939         if (connect_allow) {
5940                 *ch = cur_ch;
5941                 *bw = cur_bw;
5942                 *offset = cur_ch_offset;
5943         }
5944
5945         return connect_allow ? _SUCCESS : _FAIL;
5946 }
5947
5948 /* Find union about ch, bw, ch_offset of all linked/linking interfaces */
5949 int rtw_get_ch_setting_union(struct adapter *adapter, u8 *ch, u8 *bw, u8 *offset)
5950 {
5951         struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
5952         struct adapter *iface;
5953
5954         if (ch)
5955                 *ch = 0;
5956         if (bw)
5957                 *bw = CHANNEL_WIDTH_20;
5958         if (offset)
5959                 *offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5960
5961         iface = dvobj->padapters;
5962
5963         if (!check_fwstate(&iface->mlmepriv, _FW_LINKED|_FW_UNDER_LINKING))
5964                 return 0;
5965
5966         return 1;
5967 }
5968
5969 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5970 {
5971         struct set_ch_parm *set_ch_parm;
5972         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5973
5974         if (!pbuf)
5975                 return H2C_PARAMETERS_ERROR;
5976
5977         set_ch_parm = (struct set_ch_parm *)pbuf;
5978
5979         pmlmeext->cur_channel = set_ch_parm->ch;
5980         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5981         pmlmeext->cur_bwmode = set_ch_parm->bw;
5982
5983         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5984
5985         return  H2C_SUCCESS;
5986 }
5987
5988 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5989 {
5990         struct SetChannelPlan_param *setChannelPlan_param;
5991         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5992
5993         if (!pbuf)
5994                 return H2C_PARAMETERS_ERROR;
5995
5996         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5997
5998         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5999         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
6000
6001         if (padapter->rtw_wdev && padapter->rtw_wdev->wiphy) {
6002                 struct regulatory_request request;
6003
6004                 request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
6005                 rtw_reg_notifier(padapter->rtw_wdev->wiphy, &request);
6006         }
6007
6008         return  H2C_SUCCESS;
6009 }
6010
6011 u8 set_csa_hdl(struct adapter *padapter, unsigned char *pbuf)
6012 {
6013         return  H2C_REJECTED;
6014 }
6015
6016 /*  TDLS_ESTABLISHED    : write RCR DATA BIT */
6017 /*  TDLS_CS_OFF         : go back to the channel linked with AP, terminating channel switch procedure */
6018 /*  TDLS_INIT_CH_SEN    : init channel sensing, receive all data and mgnt frame */
6019 /*  TDLS_DONE_CH_SEN: channel sensing and report candidate channel */
6020 /*  TDLS_OFF_CH         : first time set channel to off channel */
6021 /*  TDLS_BASE_CH                : go back tp the channel linked with AP when set base channel as target channel */
6022 /*  TDLS_P_OFF_CH       : periodically go to off channel */
6023 /*  TDLS_P_BASE_CH      : periodically go back to base channel */
6024 /*  TDLS_RS_RCR         : restore RCR */
6025 /*  TDLS_TEAR_STA       : free tdls sta */
6026 u8 tdls_hdl(struct adapter *padapter, unsigned char *pbuf)
6027 {
6028         return H2C_REJECTED;
6029 }
6030
6031 u8 run_in_thread_hdl(struct adapter *padapter, u8 *pbuf)
6032 {
6033         struct RunInThread_param *p;
6034
6035
6036         if (pbuf == NULL)
6037                 return H2C_PARAMETERS_ERROR;
6038         p = (struct RunInThread_param *)pbuf;
6039
6040         if (p->func)
6041                 p->func(p->context);
6042
6043         return H2C_SUCCESS;
6044 }