drivers/staging/rtl8723bs/core/rtw_mlme_ext.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /******************************************************************************
   3  *
   4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   5  *
   6  ******************************************************************************/
   7 #include <drv_types.h>
   8 #include <rtw_debug.h>
   9 #include <rtw_wifi_regd.h>
  10 #include <hal_btcoex.h>
  11 #include <linux/kernel.h>
  12 #include <asm/unaligned.h>
  13
  14 static struct mlme_handler mlme_sta_tbl[] = {
  15         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
  16         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
  17         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
  18         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
  19         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
  20         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
  21
  22         /*----------------------------------------------------------
  23                                         below 2 are reserved
  24         -----------------------------------------------------------*/
  25         {0,                                     "DoReserved",           &DoReserved},
  26         {0,                                     "DoReserved",           &DoReserved},
  27         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
  28         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
  29         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
  30         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
  31         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
  32         {WIFI_ACTION,           "OnAction",             &OnAction},
  33         {WIFI_ACTION_NOACK, "OnActionNoAck",    &OnAction},
  34 };
  35
  36 static struct action_handler OnAction_tbl[] = {
  37         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
  38         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &DoReserved},
  39         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &DoReserved},
  40         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
  41         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
  42         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
  43         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
  44         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
  45         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &OnAction_sa_query},
  46         {RTW_WLAN_CATEGORY_UNPROTECTED_WNM, "ACTION_UNPROTECTED_WNM", &DoReserved},
  47         {RTW_WLAN_CATEGORY_SELF_PROTECTED, "ACTION_SELF_PROTECTED", &DoReserved},
  48         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &DoReserved},
  49         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &DoReserved},
  50 };
  51
  52 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  53
  54 /**************************************************
  55 OUI definitions for the vendor specific IE
  56 ***************************************************/
  57 unsigned char RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  58 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  59 unsigned char WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  60 unsigned char P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  61 unsigned char WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  62
  63 unsigned char WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  64 unsigned char WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  65
  66 static unsigned char REALTEK_96B_IE[] = {0x00, 0xe0, 0x4c, 0x02, 0x01, 0x20};
  67
  68 /********************************************************
  69 ChannelPlan definitions
  70 *********************************************************/
  71 static struct rt_channel_plan_2g        RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  72         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  73         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  74         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  75         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  76         {{10, 11, 12, 13}, 4},                                          /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  77         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x05, RT_CHANNEL_DOMAIN_2G_GLOBAL , Passive scan CH 12, 13, 14 */
  78         {{}, 0},                                                                /*  0x06, RT_CHANNEL_DOMAIN_2G_NULL */
  79 };
  80
  81 static struct rt_channel_plan_map       RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
  82         /*  0x00 ~ 0x1F , Old Define ===== */
  83         {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
  84         {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
  85         {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
  86         {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
  87         {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
  88         {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
  89         {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
  90         {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
  91         {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
  92         {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
  93         {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
  94         {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
  95         {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
  96         {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
  97         {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
  98         {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
  99         {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
 100         {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
 101         {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
 102         {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
 103         {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
 104         {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
 105         {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
 106         {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
 107         {0x06}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
 108         {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
 109         {0x00}, /* 0x1A, */
 110         {0x00}, /* 0x1B, */
 111         {0x00}, /* 0x1C, */
 112         {0x00}, /* 0x1D, */
 113         {0x00}, /* 0x1E, */
 114         {0x06}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
 115         /*  0x20 ~ 0x7F , New Define ===== */
 116         {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 117         {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 118         {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 119         {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 120         {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 121         {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 122         {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 123         {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 124         {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 125         {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 126         {0x00}, /* 0x2A, */
 127         {0x00}, /* 0x2B, */
 128         {0x00}, /* 0x2C, */
 129         {0x00}, /* 0x2D, */
 130         {0x00}, /* 0x2E, */
 131         {0x00}, /* 0x2F, */
 132         {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 133         {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 134         {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 135         {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 136         {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 137         {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 138         {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 139         {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 140         {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 141         {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 142         {0x00}, /* 0x3A, */
 143         {0x00}, /* 0x3B, */
 144         {0x00}, /* 0x3C, */
 145         {0x00}, /* 0x3D, */
 146         {0x00}, /* 0x3E, */
 147         {0x00}, /* 0x3F, */
 148         {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 149         {0x05}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */
 150         {0x01}, /* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */
 151         {0x02}, /* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */
 152         {0x02}, /* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */
 153         {0x00}, /* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */
 154         {0x02}, /* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */
 155         {0x00}, /* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */
 156         {0x00}, /* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */
 157         {0x00}, /* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */
 158         {0x00}, /* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */
 159         {0x00}, /* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */
 160         {0x00}, /* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */
 161         {0x02}, /* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */
 162         {0x00}, /* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */
 163         {0x02}, /* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */
 164         {0x00}, /* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */
 165         {0x02}, /* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */
 166 };
 167
 168  /* use the combination for max channel numbers */
 169 static struct rt_channel_plan_map RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03};
 170
 171 /* Search the @param ch in given @param ch_set
 172  * @ch_set: the given channel set
 173  * @ch: the given channel number
 174  *
 175  * return the index of channel_num in channel_set, -1 if not found
 176  */
 177 int rtw_ch_set_search_ch(struct rt_channel_info *ch_set, const u32 ch)
 178 {
 179         int i;
 180
 181         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 182                 if (ch == ch_set[i].ChannelNum)
 183                         break;
 184         }
 185
 186         if (i >= ch_set[i].ChannelNum)
 187                 return -1;
 188         return i;
 189 }
 190
 191 /****************************************************************************
 192
 193 Following are the initialization functions for WiFi MLME
 194
 195 *****************************************************************************/
 196
 197 int init_hw_mlme_ext(struct adapter *padapter)
 198 {
 199         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 200
 201         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
 202         return _SUCCESS;
 203 }
 204
 205 void init_mlme_default_rate_set(struct adapter *padapter)
 206 {
 207         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 208
 209         unsigned char mixed_datarate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_, _48M_RATE_, _54M_RATE_, 0xff};
 210         unsigned char mixed_basicrate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _12M_RATE_, _24M_RATE_, 0xff,};
 211         unsigned char supported_mcs_set[16] = {0xff, 0xff, 0x00, 0x00, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
 212
 213         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
 214         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
 215
 216         memcpy(pmlmeext->default_supported_mcs_set, supported_mcs_set, sizeof(pmlmeext->default_supported_mcs_set));
 217 }
 218
 219 static void init_mlme_ext_priv_value(struct adapter *padapter)
 220 {
 221         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 222         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 223
 224         atomic_set(&pmlmeext->event_seq, 0);
 225         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
 226         pmlmeext->sa_query_seq = 0;
 227         pmlmeext->mgnt_80211w_IPN = 0;
 228         pmlmeext->mgnt_80211w_IPN_rx = 0;
 229         pmlmeext->cur_channel = padapter->registrypriv.channel;
 230         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
 231         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 232
 233         pmlmeext->retry = 0;
 234
 235         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
 236
 237         init_mlme_default_rate_set(padapter);
 238
 239         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
 240         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
 241         pmlmeext->sitesurvey_res.channel_idx = 0;
 242         pmlmeext->sitesurvey_res.bss_cnt = 0;
 243         pmlmeext->scan_abort = false;
 244
 245         pmlmeinfo->state = WIFI_FW_NULL_STATE;
 246         pmlmeinfo->reauth_count = 0;
 247         pmlmeinfo->reassoc_count = 0;
 248         pmlmeinfo->link_count = 0;
 249         pmlmeinfo->auth_seq = 0;
 250         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
 251         pmlmeinfo->key_index = 0;
 252         pmlmeinfo->iv = 0;
 253
 254         pmlmeinfo->enc_algo = _NO_PRIVACY_;
 255         pmlmeinfo->authModeToggle = 0;
 256
 257         memset(pmlmeinfo->chg_txt, 0, 128);
 258
 259         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
 260         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
 261
 262         pmlmeinfo->dialogToken = 0;
 263
 264         pmlmeext->action_public_rxseq = 0xffff;
 265         pmlmeext->action_public_dialog_token = 0xff;
 266 }
 267
 268 static int has_channel(struct rt_channel_info *channel_set,
 269                                            u8 chanset_size,
 270                                            u8 chan)
 271 {
 272         int i;
 273
 274         for (i = 0; i < chanset_size; i++)
 275                 if (channel_set[i].ChannelNum == chan)
 276                         return 1;
 277
 278         return 0;
 279 }
 280
 281 static void init_channel_list(struct adapter *padapter, struct rt_channel_info *channel_set,
 282                                                           u8 chanset_size,
 283                                                           struct p2p_channels *channel_list)
 284 {
 285
 286         static const struct p2p_oper_class_map op_class[] = {
 287                 { IEEE80211G,  81,   1,  13,  1, BW20 },
 288                 { IEEE80211G,  82,  14,  14,  1, BW20 },
 289                 { IEEE80211A, 115,  36,  48,  4, BW20 },
 290                 { IEEE80211A, 116,  36,  44,  8, BW40PLUS },
 291                 { IEEE80211A, 117,  40,  48,  8, BW40MINUS },
 292                 { IEEE80211A, 124, 149, 161,  4, BW20 },
 293                 { IEEE80211A, 125, 149, 169,  4, BW20 },
 294                 { IEEE80211A, 126, 149, 157,  8, BW40PLUS },
 295                 { IEEE80211A, 127, 153, 161,  8, BW40MINUS },
 296                 { -1, 0, 0, 0, 0, BW20 }
 297         };
 298
 299         int cla, op;
 300
 301         cla = 0;
 302
 303         for (op = 0; op_class[op].op_class; op++) {
 304                 u8 ch;
 305                 const struct p2p_oper_class_map *o = &op_class[op];
 306                 struct p2p_reg_class *reg = NULL;
 307
 308                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
 309                         if (!has_channel(channel_set, chanset_size, ch))
 310                                 continue;
 311
 312                         if ((padapter->registrypriv.ht_enable == 0) && (o->inc == 8))
 313                                 continue;
 314
 315                         if ((0 < (padapter->registrypriv.bw_mode & 0xf0)) &&
 316                                 ((o->bw == BW40MINUS) || (o->bw == BW40PLUS)))
 317                                 continue;
 318
 319                         if (!reg) {
 320                                 reg = &channel_list->reg_class[cla];
 321                                 cla++;
 322                                 reg->reg_class = o->op_class;
 323                                 reg->channels = 0;
 324                         }
 325                         reg->channel[reg->channels] = ch;
 326                         reg->channels++;
 327                 }
 328         }
 329         channel_list->reg_classes = cla;
 330
 331 }
 332
 333 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, struct rt_channel_info *channel_set)
 334 {
 335         u8 index, chanset_size = 0;
 336         u8 b2_4GBand = false;
 337         u8 Index2G = 0;
 338
 339         memset(channel_set, 0, sizeof(struct rt_channel_info)*MAX_CHANNEL_NUM);
 340
 341         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
 342                 return chanset_size;
 343
 344         if (is_supported_24g(padapter->registrypriv.wireless_mode)) {
 345                 b2_4GBand = true;
 346                 if (ChannelPlan == RT_CHANNEL_DOMAIN_REALTEK_DEFINE)
 347                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
 348                 else
 349                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
 350         }
 351
 352         if (b2_4GBand) {
 353                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
 354                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
 355
 356                         if ((ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN) ||/* Channel 1~11 is active, and 12~14 is passive */
 357                                 (ChannelPlan == RT_CHANNEL_DOMAIN_GLOBAL_NULL)) {
 358                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
 359                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 360                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
 361                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
 362                         } else if (ChannelPlan == RT_CHANNEL_DOMAIN_WORLD_WIDE_13 ||
 363                                  Index2G == RT_CHANNEL_DOMAIN_2G_WORLD) { /*  channel 12~13, passive scan */
 364                                 if (channel_set[chanset_size].ChannelNum <= 11)
 365                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 366                                 else
 367                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
 368                         } else
 369                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 370
 371                         chanset_size++;
 372                 }
 373         }
 374
 375         return chanset_size;
 376 }
 377
 378 void init_mlme_ext_priv(struct adapter *padapter)
 379 {
 380         struct registry_priv *pregistrypriv = &padapter->registrypriv;
 381         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 382         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 383         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 384
 385         pmlmeext->padapter = padapter;
 386
 387         /* fill_fwpriv(padapter, &(pmlmeext->fwpriv)); */
 388
 389         init_mlme_ext_priv_value(padapter);
 390         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
 391
 392         init_mlme_ext_timer(padapter);
 393
 394         init_mlme_ap_info(padapter);
 395
 396         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
 397         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
 398         pmlmeext->last_scan_time = 0;
 399         pmlmeext->chan_scan_time = SURVEY_TO;
 400         pmlmeext->mlmeext_init = true;
 401         pmlmeext->active_keep_alive_check = true;
 402
 403 #ifdef DBG_FIXED_CHAN
 404         pmlmeext->fixed_chan = 0xFF;
 405 #endif
 406 }
 407
 408 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
 409 {
 410         struct adapter *padapter = pmlmeext->padapter;
 411
 412         if (!padapter)
 413                 return;
 414
 415         if (padapter->bDriverStopped) {
 416                 del_timer_sync(&pmlmeext->survey_timer);
 417                 del_timer_sync(&pmlmeext->link_timer);
 418                 /* del_timer_sync(&pmlmeext->ADDBA_timer); */
 419         }
 420 }
 421
 422 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, union recv_frame *precv_frame)
 423 {
 424         u8 *pframe = precv_frame->u.hdr.rx_data;
 425
 426         if (ptable->func) {
 427                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
 428                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
 429                     !is_broadcast_ether_addr(GetAddr1Ptr(pframe)))
 430                         return;
 431
 432                 ptable->func(padapter, precv_frame);
 433         }
 434 }
 435
 436 void mgt_dispatcher(struct adapter *padapter, union recv_frame *precv_frame)
 437 {
 438         int index;
 439         struct mlme_handler *ptable;
 440         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 441         u8 *pframe = precv_frame->u.hdr.rx_data;
 442         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
 443         struct dvobj_priv *psdpriv = padapter->dvobj;
 444         struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;
 445
 446         if (GetFrameType(pframe) != WIFI_MGT_TYPE)
 447                 return;
 448
 449         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
 450         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
 451             !is_broadcast_ether_addr(GetAddr1Ptr(pframe))) {
 452                 return;
 453         }
 454
 455         ptable = mlme_sta_tbl;
 456
 457         index = GetFrameSubType(pframe) >> 4;
 458
 459         if (index >= ARRAY_SIZE(mlme_sta_tbl))
 460                 return;
 461
 462         ptable += index;
 463
 464         if (psta) {
 465                 if (GetRetry(pframe)) {
 466                         if (precv_frame->u.hdr.attrib.seq_num == psta->RxMgmtFrameSeqNum) {
 467                                 /* drop the duplicate management frame */
 468                                 pdbgpriv->dbg_rx_dup_mgt_frame_drop_count++;
 469                                 return;
 470                         }
 471                 }
 472                 psta->RxMgmtFrameSeqNum = precv_frame->u.hdr.attrib.seq_num;
 473         }
 474
 475         switch (GetFrameSubType(pframe)) {
 476         case WIFI_AUTH:
 477                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
 478                         ptable->func = &OnAuth;
 479                 else
 480                         ptable->func = &OnAuthClient;
 481                 fallthrough;
 482         case WIFI_ASSOCREQ:
 483         case WIFI_REASSOCREQ:
 484                 _mgt_dispatcher(padapter, ptable, precv_frame);
 485                 break;
 486         case WIFI_PROBEREQ:
 487                 _mgt_dispatcher(padapter, ptable, precv_frame);
 488                 break;
 489         case WIFI_BEACON:
 490                 _mgt_dispatcher(padapter, ptable, precv_frame);
 491                 break;
 492         case WIFI_ACTION:
 493                 /* if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) */
 494                 _mgt_dispatcher(padapter, ptable, precv_frame);
 495                 break;
 496         default:
 497                 _mgt_dispatcher(padapter, ptable, precv_frame);
 498                 break;
 499         }
 500 }
 501
 502 /****************************************************************************
 503
 504 Following are the callback functions for each subtype of the management frames
 505
 506 *****************************************************************************/
 507
 508 unsigned int OnProbeReq(struct adapter *padapter, union recv_frame *precv_frame)
 509 {
 510         unsigned int    ielen;
 511         unsigned char *p;
 512         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 513         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 514         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 515         struct wlan_bssid_ex    *cur = &pmlmeinfo->network;
 516         u8 *pframe = precv_frame->u.hdr.rx_data;
 517         uint len = precv_frame->u.hdr.len;
 518         u8 is_valid_p2p_probereq = false;
 519
 520         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
 521                 return _SUCCESS;
 522
 523         if (check_fwstate(pmlmepriv, _FW_LINKED) == false &&
 524                 check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE) == false) {
 525                 return _SUCCESS;
 526         }
 527
 528         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, WLAN_EID_SSID, (int *)&ielen,
 529                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
 530
 531
 532         /* check (wildcard) SSID */
 533         if (p) {
 534                 if (is_valid_p2p_probereq)
 535                         goto _issue_probersp;
 536
 537                 if ((ielen != 0 && false == !memcmp((void *)(p+2), (void *)cur->ssid.ssid, cur->ssid.ssid_length))
 538                         || (ielen == 0 && pmlmeinfo->hidden_ssid_mode)
 539                 )
 540                         return _SUCCESS;
 541
 542 _issue_probersp:
 543                 if ((check_fwstate(pmlmepriv, _FW_LINKED) &&
 544                      pmlmepriv->cur_network.join_res) ||
 545                     check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))
 546                         issue_probersp(padapter, get_sa(pframe), is_valid_p2p_probereq);
 547         }
 548
 549         return _SUCCESS;
 550
 551 }
 552
 553 unsigned int OnProbeRsp(struct adapter *padapter, union recv_frame *precv_frame)
 554 {
 555         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 556
 557         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
 558                 report_survey_event(padapter, precv_frame);
 559                 return _SUCCESS;
 560         }
 561
 562         return _SUCCESS;
 563
 564 }
 565
 566 unsigned int OnBeacon(struct adapter *padapter, union recv_frame *precv_frame)
 567 {
 568         int cam_idx;
 569         struct sta_info *psta;
 570         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 571         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 572         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 573         struct sta_priv *pstapriv = &padapter->stapriv;
 574         u8 *pframe = precv_frame->u.hdr.rx_data;
 575         uint len = precv_frame->u.hdr.len;
 576         struct wlan_bssid_ex *pbss;
 577         int ret = _SUCCESS;
 578         u8 *p = NULL;
 579         u32 ielen = 0;
 580
 581         p = rtw_get_ie(pframe + sizeof(struct ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, WLAN_EID_EXT_SUPP_RATES, &ielen, precv_frame->u.hdr.len - sizeof(struct ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_);
 582         if (p && ielen > 0) {
 583                 if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D))
 584                         /* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */
 585                         *(p + 1) = ielen - 1;
 586         }
 587
 588         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
 589                 report_survey_event(padapter, precv_frame);
 590                 return _SUCCESS;
 591         }
 592
 593         if (!memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)) {
 594                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
 595                         /* we should update current network before auth, or some IE is wrong */
 596                         pbss = rtw_malloc(sizeof(struct wlan_bssid_ex));
 597                         if (pbss) {
 598                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
 599                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
 600                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
 601                                 }
 602                                 kfree(pbss);
 603                         }
 604
 605                         /* check the vendor of the assoc AP */
 606                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
 607
 608                         /* update TSF Value */
 609                         update_TSF(pmlmeext, pframe, len);
 610
 611                         /* reset for adaptive_early_32k */
 612                         pmlmeext->adaptive_tsf_done = false;
 613                         pmlmeext->DrvBcnEarly = 0xff;
 614                         pmlmeext->DrvBcnTimeOut = 0xff;
 615                         pmlmeext->bcn_cnt = 0;
 616                         memset(pmlmeext->bcn_delay_cnt, 0, sizeof(pmlmeext->bcn_delay_cnt));
 617                         memset(pmlmeext->bcn_delay_ratio, 0, sizeof(pmlmeext->bcn_delay_ratio));
 618
 619                         /* start auth */
 620                         start_clnt_auth(padapter);
 621
 622                         return _SUCCESS;
 623                 }
 624
 625                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
 626                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 627                         if (psta) {
 628                                 ret = rtw_check_bcn_info(padapter, pframe, len);
 629                                 if (!ret) {
 630                                         netdev_dbg(padapter->pnetdev,
 631                                                    "ap has changed, disconnect now\n ");
 632                                         receive_disconnect(padapter,
 633                                                            pmlmeinfo->network.mac_address, 0);
 634                                         return _SUCCESS;
 635                                 }
 636                                 /* update WMM, ERP in the beacon */
 637                                 /* todo: the timer is used instead of the number of the beacon received */
 638                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
 639                                         update_beacon_info(padapter, pframe, len, psta);
 640
 641                                 adaptive_early_32k(pmlmeext, pframe, len);
 642                         }
 643                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 644                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 645                         if (psta) {
 646                                 /* update WMM, ERP in the beacon */
 647                                 /* todo: the timer is used instead of the number of the beacon received */
 648                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
 649                                         update_beacon_info(padapter, pframe, len, psta);
 650                         } else {
 651                                 /* allocate a new CAM entry for IBSS station */
 652                                 cam_idx = allocate_fw_sta_entry(padapter);
 653                                 if (cam_idx == NUM_STA)
 654                                         goto _END_ONBEACON_;
 655
 656                                 /* get supported rate */
 657                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
 658                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
 659                                         goto _END_ONBEACON_;
 660                                 }
 661
 662                                 /* update TSF Value */
 663                                 update_TSF(pmlmeext, pframe, len);
 664
 665                                 /* report sta add event */
 666                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
 667                         }
 668                 }
 669         }
 670
 671 _END_ONBEACON_:
 672
 673         return _SUCCESS;
 674
 675 }
 676
 677 unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 678 {
 679         unsigned int    auth_mode, seq, ie_len;
 680         unsigned char *sa, *p;
 681         u16 algorithm;
 682         int     status;
 683         static struct sta_info stat;
 684         struct  sta_info *pstat = NULL;
 685         struct  sta_priv *pstapriv = &padapter->stapriv;
 686         struct security_priv *psecuritypriv = &padapter->securitypriv;
 687         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 688         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 689         u8 *pframe = precv_frame->u.hdr.rx_data;
 690         uint len = precv_frame->u.hdr.len;
 691         u8 offset = 0;
 692
 693         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 694                 return _FAIL;
 695
 696         sa = GetAddr2Ptr(pframe);
 697
 698         auth_mode = psecuritypriv->dot11AuthAlgrthm;
 699
 700         if (GetPrivacy(pframe)) {
 701                 u8 *iv;
 702                 struct rx_pkt_attrib     *prxattrib = &(precv_frame->u.hdr.attrib);
 703
 704                 prxattrib->hdrlen = WLAN_HDR_A3_LEN;
 705                 prxattrib->encrypt = _WEP40_;
 706
 707                 iv = pframe+prxattrib->hdrlen;
 708                 prxattrib->key_index = ((iv[3]>>6)&0x3);
 709
 710                 prxattrib->iv_len = 4;
 711                 prxattrib->icv_len = 4;
 712
 713                 rtw_wep_decrypt(padapter, (u8 *)precv_frame);
 714
 715                 offset = 4;
 716         }
 717
 718         algorithm = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset));
 719         seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
 720
 721         if (auth_mode == 2 &&
 722                         psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
 723                         psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
 724                 auth_mode = 0;
 725
 726         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
 727                 (algorithm == 0 && auth_mode == 1)) {   /*  rx a open-system auth but shared-key is enabled */
 728
 729                 status = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 730
 731                 goto auth_fail;
 732         }
 733
 734         if (rtw_access_ctrl(padapter, sa) == false) {
 735                 status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 736                 goto auth_fail;
 737         }
 738
 739         pstat = rtw_get_stainfo(pstapriv, sa);
 740         if (!pstat) {
 741
 742                 /*  allocate a new one */
 743                 pstat = rtw_alloc_stainfo(pstapriv, sa);
 744                 if (!pstat) {
 745                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 746                         goto auth_fail;
 747                 }
 748
 749                 pstat->state = WIFI_FW_AUTH_NULL;
 750                 pstat->auth_seq = 0;
 751
 752                 /* pstat->flags = 0; */
 753                 /* pstat->capability = 0; */
 754         } else {
 755
 756                 spin_lock_bh(&pstapriv->asoc_list_lock);
 757                 if (list_empty(&pstat->asoc_list) == false) {
 758                         list_del_init(&pstat->asoc_list);
 759                         pstapriv->asoc_list_cnt--;
 760                         if (pstat->expire_to > 0) {
 761                                 /* TODO: STA re_auth within expire_to */
 762                         }
 763                 }
 764                 spin_unlock_bh(&pstapriv->asoc_list_lock);
 765
 766                 if (seq == 1) {
 767                         /* TODO: STA re_auth and auth timeout */
 768                 }
 769         }
 770
 771         spin_lock_bh(&pstapriv->auth_list_lock);
 772         if (list_empty(&pstat->auth_list)) {
 773
 774                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
 775                 pstapriv->auth_list_cnt++;
 776         }
 777         spin_unlock_bh(&pstapriv->auth_list_lock);
 778
 779         if (pstat->auth_seq == 0)
 780                 pstat->expire_to = pstapriv->auth_to;
 781
 782
 783         if ((pstat->auth_seq + 1) != seq) {
 784                 status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 785                 goto auth_fail;
 786         }
 787
 788         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2 || auth_mode == 3)) {
 789                 if (seq == 1) {
 790                         pstat->state &= ~WIFI_FW_AUTH_NULL;
 791                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
 792                         pstat->expire_to = pstapriv->assoc_to;
 793                         pstat->authalg = algorithm;
 794                 } else {
 795                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 796                         goto auth_fail;
 797                 }
 798         } else { /*  shared system or auto authentication */
 799                 if (seq == 1) {
 800                         /* prepare for the challenging txt... */
 801                         memset((void *)pstat->chg_txt, 78, 128);
 802
 803                         pstat->state &= ~WIFI_FW_AUTH_NULL;
 804                         pstat->state |= WIFI_FW_AUTH_STATE;
 805                         pstat->authalg = algorithm;
 806                 } else if (seq == 3) {
 807
 808                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&ie_len,
 809                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
 810
 811                         if (!p || ie_len <= 0) {
 812                                 status = WLAN_STATUS_CHALLENGE_FAIL;
 813                                 goto auth_fail;
 814                         }
 815
 816                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
 817                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
 818                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
 819                                 /*  challenging txt is correct... */
 820                                 pstat->expire_to =  pstapriv->assoc_to;
 821                         } else {
 822                                 status = WLAN_STATUS_CHALLENGE_FAIL;
 823                                 goto auth_fail;
 824                         }
 825                 } else {
 826                         status = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 827                         goto auth_fail;
 828                 }
 829         }
 830
 831
 832         /*  Now, we are going to issue_auth... */
 833         pstat->auth_seq = seq + 1;
 834
 835         issue_auth(padapter, pstat, (unsigned short)(WLAN_STATUS_SUCCESS));
 836
 837         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
 838                 pstat->auth_seq = 0;
 839
 840
 841         return _SUCCESS;
 842
 843 auth_fail:
 844
 845         if (pstat)
 846                 rtw_free_stainfo(padapter, pstat);
 847
 848         pstat = &stat;
 849         memset((char *)pstat, '\0', sizeof(stat));
 850         pstat->auth_seq = 2;
 851         memcpy(pstat->hwaddr, sa, 6);
 852
 853         issue_auth(padapter, pstat, (unsigned short)status);
 854
 855         return _FAIL;
 856
 857 }
 858
 859 unsigned int OnAuthClient(struct adapter *padapter, union recv_frame *precv_frame)
 860 {
 861         unsigned int    seq, len, status, offset;
 862         unsigned char *p;
 863         unsigned int    go2asoc = 0;
 864         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 865         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 866         u8 *pframe = precv_frame->u.hdr.rx_data;
 867         uint pkt_len = precv_frame->u.hdr.len;
 868
 869         /* check A1 matches or not */
 870         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
 871                 return _SUCCESS;
 872
 873         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
 874                 return _SUCCESS;
 875
 876         offset = (GetPrivacy(pframe)) ? 4 : 0;
 877
 878         seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
 879         status  = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 4));
 880
 881         if (status != 0) {
 882                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
 883                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
 884                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
 885                         else
 886                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
 887                         /* pmlmeinfo->reauth_count = 0; */
 888                 }
 889
 890                 set_link_timer(pmlmeext, 1);
 891                 goto authclnt_fail;
 892         }
 893
 894         if (seq == 2) {
 895                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
 896                          /*  legendary shared system */
 897                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, WLAN_EID_CHALLENGE, (int *)&len,
 898                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
 899
 900                         if (!p)
 901                                 goto authclnt_fail;
 902
 903                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
 904                         pmlmeinfo->auth_seq = 3;
 905                         issue_auth(padapter, NULL, 0);
 906                         set_link_timer(pmlmeext, REAUTH_TO);
 907
 908                         return _SUCCESS;
 909                 }
 910                 /* open system */
 911                 go2asoc = 1;
 912         } else if (seq == 4) {
 913                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
 914                         go2asoc = 1;
 915                 else
 916                         goto authclnt_fail;
 917         } else {
 918                 /*  this is also illegal */
 919                 goto authclnt_fail;
 920         }
 921
 922         if (go2asoc) {
 923                 netdev_dbg(padapter->pnetdev, "auth success, start assoc\n");
 924                 start_clnt_assoc(padapter);
 925                 return _SUCCESS;
 926         }
 927
 928 authclnt_fail:
 929
 930         /* pmlmeinfo->state &= ~(WIFI_FW_AUTH_STATE); */
 931
 932         return _FAIL;
 933
 934 }
 935
 936 unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
 937 {
 938         u16 capab_info;
 939         struct rtw_ieee802_11_elems elems;
 940         struct sta_info *pstat;
 941         unsigned char   *p, *pos, *wpa_ie;
 942         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
 943         int             i, ie_len, wpa_ie_len, left;
 944         unsigned char   supportRate[16];
 945         int                                     supportRateNum;
 946         unsigned short          status = WLAN_STATUS_SUCCESS;
 947         unsigned short          frame_type, ie_offset = 0;
 948         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 949         struct security_priv *psecuritypriv = &padapter->securitypriv;
 950         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 951         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 952         struct wlan_bssid_ex    *cur = &(pmlmeinfo->network);
 953         struct sta_priv *pstapriv = &padapter->stapriv;
 954         u8 *pframe = precv_frame->u.hdr.rx_data;
 955         uint pkt_len = precv_frame->u.hdr.len;
 956
 957         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 958                 return _FAIL;
 959
 960         frame_type = GetFrameSubType(pframe);
 961         if (frame_type == WIFI_ASSOCREQ)
 962                 ie_offset = _ASOCREQ_IE_OFFSET_;
 963         else /*  WIFI_REASSOCREQ */
 964                 ie_offset = _REASOCREQ_IE_OFFSET_;
 965
 966
 967         if (pkt_len < sizeof(struct ieee80211_hdr_3addr) + ie_offset)
 968                 return _FAIL;
 969
 970         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 971         if (!pstat) {
 972                 status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
 973                 goto asoc_class2_error;
 974         }
 975
 976         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
 977         /* capab_info = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN)); */
 978
 979         left = pkt_len - (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
 980         pos = pframe + (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
 981
 982         /*  check if this stat has been successfully authenticated/assocated */
 983         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
 984                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
 985                         status = WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA;
 986                         goto asoc_class2_error;
 987                 } else {
 988                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
 989                         pstat->state |= WIFI_FW_ASSOC_STATE;
 990                 }
 991         } else {
 992                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
 993                 pstat->state |= WIFI_FW_ASSOC_STATE;
 994         }
 995
 996
 997         pstat->capability = capab_info;
 998
 999         /* now parse all ieee802_11 ie to point to elems */
1000         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
1001             !elems.ssid) {
1002                 status = WLAN_STATUS_CHALLENGE_FAIL;
1003                 goto OnAssocReqFail;
1004         }
1005
1006         /*  now we should check all the fields... */
1007         /*  checking SSID */
1008         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_SSID, &ie_len,
1009                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1010
1011         if (!p || ie_len == 0) {
1012                 /*  broadcast ssid, however it is not allowed in assocreq */
1013                 status = WLAN_STATUS_CHALLENGE_FAIL;
1014                 goto OnAssocReqFail;
1015         } else {
1016                 /*  check if ssid match */
1017                 if (memcmp((void *)(p+2), cur->ssid.ssid, cur->ssid.ssid_length))
1018                         status = WLAN_STATUS_CHALLENGE_FAIL;
1019
1020                 if (ie_len != cur->ssid.ssid_length)
1021                         status = WLAN_STATUS_CHALLENGE_FAIL;
1022         }
1023
1024         if (status != WLAN_STATUS_SUCCESS)
1025                 goto OnAssocReqFail;
1026
1027         /*  check if the supported rate is ok */
1028         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_SUPP_RATES, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1029         if (!p) {
1030                 /*  use our own rate set as statoin used */
1031                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
1032                 /* supportRateNum = AP_BSSRATE_LEN; */
1033
1034                 status = WLAN_STATUS_CHALLENGE_FAIL;
1035                 goto OnAssocReqFail;
1036         } else {
1037                 memcpy(supportRate, p+2, ie_len);
1038                 supportRateNum = ie_len;
1039
1040                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, WLAN_EID_EXT_SUPP_RATES, &ie_len,
1041                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1042                 if (p) {
1043
1044                         if (supportRateNum <= sizeof(supportRate)) {
1045                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
1046                                 supportRateNum += ie_len;
1047                         }
1048                 }
1049         }
1050
1051         /* todo: mask supportRate between AP & STA -> move to update raid */
1052         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
1053
1054         /* update station supportRate */
1055         pstat->bssratelen = supportRateNum;
1056         memcpy(pstat->bssrateset, supportRate, supportRateNum);
1057         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
1058
1059         /* check RSN/WPA/WPS */
1060         pstat->dot8021xalg = 0;
1061         pstat->wpa_psk = 0;
1062         pstat->wpa_group_cipher = 0;
1063         pstat->wpa2_group_cipher = 0;
1064         pstat->wpa_pairwise_cipher = 0;
1065         pstat->wpa2_pairwise_cipher = 0;
1066         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
1067         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
1068
1069                 int group_cipher = 0, pairwise_cipher = 0;
1070
1071                 wpa_ie = elems.rsn_ie;
1072                 wpa_ie_len = elems.rsn_ie_len;
1073
1074                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
1075                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
1076                         pstat->wpa_psk |= BIT(1);
1077
1078                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
1079                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
1080
1081                         if (!pstat->wpa2_group_cipher)
1082                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
1083
1084                         if (!pstat->wpa2_pairwise_cipher)
1085                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
1086                 } else {
1087                         status = WLAN_STATUS_INVALID_IE;
1088                 }
1089
1090         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
1091
1092                 int group_cipher = 0, pairwise_cipher = 0;
1093
1094                 wpa_ie = elems.wpa_ie;
1095                 wpa_ie_len = elems.wpa_ie_len;
1096
1097                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
1098                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
1099                         pstat->wpa_psk |= BIT(0);
1100
1101                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
1102                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
1103
1104                         if (!pstat->wpa_group_cipher)
1105                                 status = WLAN_STATUS_INVALID_GROUP_CIPHER;
1106
1107                         if (!pstat->wpa_pairwise_cipher)
1108                                 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
1109
1110                 } else {
1111                         status = WLAN_STATUS_INVALID_IE;
1112                 }
1113
1114         } else {
1115                 wpa_ie = NULL;
1116                 wpa_ie_len = 0;
1117         }
1118
1119         if (status != WLAN_STATUS_SUCCESS)
1120                 goto OnAssocReqFail;
1121
1122         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
1123         if (!wpa_ie) {
1124                 if (elems.wps_ie) {
1125                         pstat->flags |= WLAN_STA_WPS;
1126                         /* wpabuf_free(sta->wps_ie); */
1127                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
1128                         /*                              elems.wps_ie_len - 4); */
1129                 } else {
1130                         pstat->flags |= WLAN_STA_MAYBE_WPS;
1131                 }
1132
1133
1134                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
1135                 /*  that the selected registrar of AP is _FLASE */
1136                 if ((psecuritypriv->wpa_psk > 0)
1137                         && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
1138                         if (pmlmepriv->wps_beacon_ie) {
1139                                 u8 selected_registrar = 0;
1140
1141                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
1142
1143                                 if (!selected_registrar) {
1144                                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1145
1146                                         goto OnAssocReqFail;
1147                                 }
1148                         }
1149                 }
1150
1151         } else {
1152                 int copy_len;
1153
1154                 if (psecuritypriv->wpa_psk == 0) {
1155                         status = WLAN_STATUS_INVALID_IE;
1156
1157                         goto OnAssocReqFail;
1158
1159                 }
1160
1161                 if (elems.wps_ie) {
1162                         pstat->flags |= WLAN_STA_WPS;
1163                         copy_len = 0;
1164                 } else {
1165                         copy_len = ((wpa_ie_len+2) > sizeof(pstat->wpa_ie)) ? (sizeof(pstat->wpa_ie)):(wpa_ie_len+2);
1166                 }
1167
1168
1169                 if (copy_len > 0)
1170                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
1171
1172         }
1173
1174
1175         /*  check if there is WMM IE & support WWM-PS */
1176         pstat->flags &= ~WLAN_STA_WME;
1177         pstat->qos_option = 0;
1178         pstat->qos_info = 0;
1179         pstat->has_legacy_ac = true;
1180         pstat->uapsd_vo = 0;
1181         pstat->uapsd_vi = 0;
1182         pstat->uapsd_be = 0;
1183         pstat->uapsd_bk = 0;
1184         if (pmlmepriv->qospriv.qos_option) {
1185                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
1186                 for (;;) {
1187                         p = rtw_get_ie(p, WLAN_EID_VENDOR_SPECIFIC, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1188                         if (p) {
1189                                 if (!memcmp(p+2, WMM_IE, 6)) {
1190
1191                                         pstat->flags |= WLAN_STA_WME;
1192
1193                                         pstat->qos_option = 1;
1194                                         pstat->qos_info = *(p+8);
1195
1196                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
1197
1198                                         if ((pstat->qos_info&0xf) != 0xf)
1199                                                 pstat->has_legacy_ac = true;
1200                                         else
1201                                                 pstat->has_legacy_ac = false;
1202
1203                                         if (pstat->qos_info&0xf) {
1204                                                 if (pstat->qos_info&BIT(0))
1205                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
1206                                                 else
1207                                                         pstat->uapsd_vo = 0;
1208
1209                                                 if (pstat->qos_info&BIT(1))
1210                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
1211                                                 else
1212                                                         pstat->uapsd_vi = 0;
1213
1214                                                 if (pstat->qos_info&BIT(2))
1215                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
1216                                                 else
1217                                                         pstat->uapsd_bk = 0;
1218
1219                                                 if (pstat->qos_info&BIT(3))
1220                                                         pstat->uapsd_be = BIT(0)|BIT(1);
1221                                                 else
1222                                                         pstat->uapsd_be = 0;
1223
1224                                         }
1225
1226                                         break;
1227                                 }
1228                         } else {
1229                                 break;
1230                         }
1231                         p = p + ie_len + 2;
1232                 }
1233         }
1234
1235         /* save HT capabilities in the sta object */
1236         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct ieee80211_ht_cap));
1237         if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct ieee80211_ht_cap)) {
1238                 pstat->flags |= WLAN_STA_HT;
1239
1240                 pstat->flags |= WLAN_STA_WME;
1241
1242                 memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct ieee80211_ht_cap));
1243
1244         } else
1245                 pstat->flags &= ~WLAN_STA_HT;
1246
1247
1248         if ((pmlmepriv->htpriv.ht_option == false) && (pstat->flags&WLAN_STA_HT)) {
1249                 status = WLAN_STATUS_CHALLENGE_FAIL;
1250                 goto OnAssocReqFail;
1251         }
1252
1253
1254         if ((pstat->flags & WLAN_STA_HT) &&
1255                     ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
1256                       (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
1257                 /* status = WLAN_STATUS_CIPHER_SUITE_REJECTED; */
1258                 /* goto OnAssocReqFail; */
1259         }
1260         pstat->flags |= WLAN_STA_NONERP;
1261         for (i = 0; i < pstat->bssratelen; i++) {
1262                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
1263                         pstat->flags &= ~WLAN_STA_NONERP;
1264                         break;
1265                 }
1266         }
1267
1268         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1269                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
1270         else
1271                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1272
1273
1274
1275         if (status != WLAN_STATUS_SUCCESS)
1276                 goto OnAssocReqFail;
1277
1278         /* TODO: identify_proprietary_vendor_ie(); */
1279         /*  Realtek proprietary IE */
1280         /*  identify if this is Broadcom sta */
1281         /*  identify if this is ralink sta */
1282         /*  Customer proprietary IE */
1283
1284
1285
1286         /* get a unique AID */
1287         if (pstat->aid == 0) {
1288                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
1289                         if (!pstapriv->sta_aid[pstat->aid - 1])
1290                                 break;
1291
1292                 /* if (pstat->aid > NUM_STA) { */
1293                 if (pstat->aid > pstapriv->max_num_sta) {
1294
1295                         pstat->aid = 0;
1296
1297                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1298
1299                         goto OnAssocReqFail;
1300
1301
1302                 } else {
1303                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
1304                 }
1305         }
1306
1307
1308         pstat->state &= (~WIFI_FW_ASSOC_STATE);
1309         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
1310
1311         spin_lock_bh(&pstapriv->auth_list_lock);
1312         if (!list_empty(&pstat->auth_list)) {
1313                 list_del_init(&pstat->auth_list);
1314                 pstapriv->auth_list_cnt--;
1315         }
1316         spin_unlock_bh(&pstapriv->auth_list_lock);
1317
1318         spin_lock_bh(&pstapriv->asoc_list_lock);
1319         if (list_empty(&pstat->asoc_list)) {
1320                 pstat->expire_to = pstapriv->expire_to;
1321                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
1322                 pstapriv->asoc_list_cnt++;
1323         }
1324         spin_unlock_bh(&pstapriv->asoc_list_lock);
1325
1326         /*  now the station is qualified to join our BSS... */
1327         if (pstat && (pstat->state & WIFI_FW_ASSOC_SUCCESS) && (status == WLAN_STATUS_SUCCESS)) {
1328                 /* 1 bss_cap_update & sta_info_update */
1329                 bss_cap_update_on_sta_join(padapter, pstat);
1330                 sta_info_update(padapter, pstat);
1331
1332                 /* 2 issue assoc rsp before notify station join event. */
1333                 if (frame_type == WIFI_ASSOCREQ)
1334                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
1335                 else
1336                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
1337
1338                 spin_lock_bh(&pstat->lock);
1339                 kfree(pstat->passoc_req);
1340                 pstat->assoc_req_len = 0;
1341                 pstat->passoc_req =  rtw_zmalloc(pkt_len);
1342                 if (pstat->passoc_req) {
1343                         memcpy(pstat->passoc_req, pframe, pkt_len);
1344                         pstat->assoc_req_len = pkt_len;
1345                 }
1346                 spin_unlock_bh(&pstat->lock);
1347
1348                 /* 3-(1) report sta add event */
1349                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
1350         }
1351
1352         return _SUCCESS;
1353
1354 asoc_class2_error:
1355
1356         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
1357
1358         return _FAIL;
1359
1360 OnAssocReqFail:
1361
1362         pstat->aid = 0;
1363         if (frame_type == WIFI_ASSOCREQ)
1364                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
1365         else
1366                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
1367
1368         return _FAIL;
1369 }
1370
1371 unsigned int OnAssocRsp(struct adapter *padapter, union recv_frame *precv_frame)
1372 {
1373         uint i;
1374         int res;
1375         unsigned short  status;
1376         struct ndis_80211_var_ie *pIE;
1377         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1378         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1379         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1380         /* struct wlan_bssid_ex                 *cur_network = &(pmlmeinfo->network); */
1381         u8 *pframe = precv_frame->u.hdr.rx_data;
1382         uint pkt_len = precv_frame->u.hdr.len;
1383
1384         /* check A1 matches or not */
1385         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
1386                 return _SUCCESS;
1387
1388         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
1389                 return _SUCCESS;
1390
1391         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
1392                 return _SUCCESS;
1393
1394         del_timer_sync(&pmlmeext->link_timer);
1395
1396         /* status */
1397         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
1398         if (status > 0) {
1399                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
1400                 res = -4;
1401                 goto report_assoc_result;
1402         }
1403
1404         /* get capabilities */
1405         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1406
1407         /* set slot time */
1408         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
1409
1410         /* AID */
1411         res = pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
1412
1413         /* following are moved to join event callback function */
1414         /* to handle HT, WMM, rate adaptive, update MAC reg */
1415         /* for not to handle the synchronous IO in the tasklet */
1416         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
1417                 pIE = (struct ndis_80211_var_ie *)(pframe + i);
1418
1419                 switch (pIE->element_id) {
1420                 case WLAN_EID_VENDOR_SPECIFIC:
1421                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6))        /* WMM */
1422                                 WMM_param_handler(padapter, pIE);
1423                         break;
1424
1425                 case WLAN_EID_HT_CAPABILITY:    /* HT caps */
1426                         HT_caps_handler(padapter, pIE);
1427                         break;
1428
1429                 case WLAN_EID_HT_OPERATION:     /* HT info */
1430                         HT_info_handler(padapter, pIE);
1431                         break;
1432
1433                 case WLAN_EID_ERP_INFO:
1434                         ERP_IE_handler(padapter, pIE);
1435                         break;
1436
1437                 default:
1438                         break;
1439                 }
1440
1441                 i += (pIE->length + 2);
1442         }
1443
1444         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
1445         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
1446
1447         /* Update Basic Rate Table for spec, 2010-12-28 , by thomas */
1448         UpdateBrateTbl(padapter, pmlmeinfo->network.supported_rates);
1449
1450 report_assoc_result:
1451         if (res > 0)
1452                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
1453         else
1454                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
1455
1456         report_join_res(padapter, res);
1457
1458         return _SUCCESS;
1459 }
1460
1461 unsigned int OnDeAuth(struct adapter *padapter, union recv_frame *precv_frame)
1462 {
1463         unsigned short  reason;
1464         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1465         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1466         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1467         u8 *pframe = precv_frame->u.hdr.rx_data;
1468         int ignore_received_deauth = 0;
1469
1470         /* check A3 */
1471         if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
1472                 return _SUCCESS;
1473
1474         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1475
1476         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1477                 struct sta_info *psta;
1478                 struct sta_priv *pstapriv = &padapter->stapriv;
1479
1480                 /* rtw_free_stainfo(padapter, psta); */
1481
1482                 netdev_dbg(padapter->pnetdev,
1483                            "ap recv deauth reason code(%d) sta:%pM\n", reason,
1484                            GetAddr2Ptr(pframe));
1485
1486                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1487                 if (psta) {
1488                         u8 updated = false;
1489
1490                         spin_lock_bh(&pstapriv->asoc_list_lock);
1491                         if (list_empty(&psta->asoc_list) == false) {
1492                                 list_del_init(&psta->asoc_list);
1493                                 pstapriv->asoc_list_cnt--;
1494                                 updated = ap_free_sta(padapter, psta, false, reason);
1495
1496                         }
1497                         spin_unlock_bh(&pstapriv->asoc_list_lock);
1498
1499                         associated_clients_update(padapter, updated);
1500                 }
1501
1502
1503                 return _SUCCESS;
1504         }
1505
1506         /*      Commented by Albert 20130604 */
1507         /*      Before sending the auth frame to start the STA/GC mode connection with AP/GO, */
1508         /*      we will send the deauth first. */
1509         /*      However, the Win8.1 with BRCM Wi-Fi will send the deauth with reason code 6 to us after receieving our deauth. */
1510         /*      Added the following code to avoid this case. */
1511         if ((pmlmeinfo->state & WIFI_FW_AUTH_STATE) ||
1512             (pmlmeinfo->state & WIFI_FW_ASSOC_STATE)) {
1513                 if (reason == WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA) {
1514                         ignore_received_deauth = 1;
1515                 } else if (reason == WLAN_REASON_PREV_AUTH_NOT_VALID) {
1516                         /*  TODO: 802.11r */
1517                         ignore_received_deauth = 1;
1518                 }
1519         }
1520
1521         netdev_dbg(padapter->pnetdev,
1522                    "sta recv deauth reason code(%d) sta:%pM, ignore = %d\n",
1523                    reason, GetAddr3Ptr(pframe),
1524                    ignore_received_deauth);
1525
1526         if (ignore_received_deauth == 0)
1527                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
1528
1529         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
1530         return _SUCCESS;
1531 }
1532
1533 unsigned int OnDisassoc(struct adapter *padapter, union recv_frame *precv_frame)
1534 {
1535         unsigned short  reason;
1536         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1537         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1538         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1539         u8 *pframe = precv_frame->u.hdr.rx_data;
1540
1541         /* check A3 */
1542         if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
1543                 return _SUCCESS;
1544
1545         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1546
1547         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1548                 struct sta_info *psta;
1549                 struct sta_priv *pstapriv = &padapter->stapriv;
1550
1551                 /* rtw_free_stainfo(padapter, psta); */
1552
1553                 netdev_dbg(padapter->pnetdev,
1554                            "ap recv disassoc reason code(%d) sta:%pM\n",
1555                            reason, GetAddr2Ptr(pframe));
1556
1557                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1558                 if (psta) {
1559                         u8 updated = false;
1560
1561                         spin_lock_bh(&pstapriv->asoc_list_lock);
1562                         if (list_empty(&psta->asoc_list) == false) {
1563                                 list_del_init(&psta->asoc_list);
1564                                 pstapriv->asoc_list_cnt--;
1565                                 updated = ap_free_sta(padapter, psta, false, reason);
1566
1567                         }
1568                         spin_unlock_bh(&pstapriv->asoc_list_lock);
1569
1570                         associated_clients_update(padapter, updated);
1571                 }
1572
1573                 return _SUCCESS;
1574         }
1575         netdev_dbg(padapter->pnetdev,
1576                    "sta recv disassoc reason code(%d) sta:%pM\n",
1577                    reason, GetAddr3Ptr(pframe));
1578
1579         receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
1580
1581         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
1582         return _SUCCESS;
1583
1584 }
1585
1586 unsigned int OnAtim(struct adapter *padapter, union recv_frame *precv_frame)
1587 {
1588         return _SUCCESS;
1589 }
1590
1591 unsigned int on_action_spct(struct adapter *padapter, union recv_frame *precv_frame)
1592 {
1593         struct sta_info *psta = NULL;
1594         struct sta_priv *pstapriv = &padapter->stapriv;
1595         u8 *pframe = precv_frame->u.hdr.rx_data;
1596         u8 *frame_body = (u8 *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1597         u8 category;
1598         u8 action;
1599
1600         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1601
1602         if (!psta)
1603                 goto exit;
1604
1605         category = frame_body[0];
1606         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
1607                 goto exit;
1608
1609         action = frame_body[1];
1610         switch (action) {
1611         case WLAN_ACTION_SPCT_MSR_REQ:
1612         case WLAN_ACTION_SPCT_MSR_RPRT:
1613         case WLAN_ACTION_SPCT_TPC_REQ:
1614         case WLAN_ACTION_SPCT_TPC_RPRT:
1615         case WLAN_ACTION_SPCT_CHL_SWITCH:
1616                 break;
1617         default:
1618                 break;
1619         }
1620
1621 exit:
1622         return _FAIL;
1623 }
1624
1625 unsigned int OnAction_back(struct adapter *padapter, union recv_frame *precv_frame)
1626 {
1627         u8 *addr;
1628         struct sta_info *psta = NULL;
1629         struct recv_reorder_ctrl *preorder_ctrl;
1630         unsigned char   *frame_body;
1631         unsigned char   category, action;
1632         unsigned short  tid, status;
1633         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1634         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1635         u8 *pframe = precv_frame->u.hdr.rx_data;
1636         struct sta_priv *pstapriv = &padapter->stapriv;
1637
1638         /* check RA matches or not */
1639         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))/* for if1, sta/ap mode */
1640                 return _SUCCESS;
1641
1642         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1643                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1644                         return _SUCCESS;
1645
1646         addr = GetAddr2Ptr(pframe);
1647         psta = rtw_get_stainfo(pstapriv, addr);
1648
1649         if (!psta)
1650                 return _SUCCESS;
1651
1652         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1653
1654         category = frame_body[0];
1655         if (category == RTW_WLAN_CATEGORY_BACK) {/*  representing Block Ack */
1656                 if (!pmlmeinfo->HT_enable)
1657                         return _SUCCESS;
1658
1659                 action = frame_body[1];
1660                 switch (action) {
1661                 case WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
1662
1663                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
1664                         /* process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), GetAddr3Ptr(pframe)); */
1665                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
1666
1667                         if (pmlmeinfo->accept_addba_req)
1668                                 issue_action_BA(padapter, addr, WLAN_ACTION_ADDBA_RESP, 0);
1669                         else
1670                                 issue_action_BA(padapter, addr, WLAN_ACTION_ADDBA_RESP, 37);/* reject ADDBA Req */
1671
1672                         break;
1673
1674                 case WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
1675                         status = get_unaligned_le16(&frame_body[3]);
1676                         tid = ((frame_body[5] >> 2) & 0x7);
1677
1678                         if (status == 0) {
1679                                 /* successful */
1680                                 psta->htpriv.agg_enable_bitmap |= BIT(tid);
1681                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1682                         } else {
1683                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1684                         }
1685
1686                         if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
1687                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1688                                 psta->expire_to = pstapriv->expire_to;
1689                                 psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
1690                         }
1691
1692                         break;
1693
1694                 case WLAN_ACTION_DELBA: /* DELBA */
1695                         if ((frame_body[3] & BIT(3)) == 0) {
1696                                 psta->htpriv.agg_enable_bitmap &=
1697                                         ~BIT((frame_body[3] >> 4) & 0xf);
1698                                 psta->htpriv.candidate_tid_bitmap &=
1699                                         ~BIT((frame_body[3] >> 4) & 0xf);
1700                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
1701                                 tid = (frame_body[3] >> 4) & 0x0F;
1702
1703                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
1704                                 preorder_ctrl->enable = false;
1705                                 preorder_ctrl->indicate_seq = 0xffff;
1706                         }
1707                         /* todo: how to notify the host while receiving DELETE BA */
1708                         break;
1709
1710                 default:
1711                         break;
1712                 }
1713         }
1714         return _SUCCESS;
1715 }
1716
1717 static s32 rtw_action_public_decache(union recv_frame *recv_frame, s32 token)
1718 {
1719         struct adapter *adapter = recv_frame->u.hdr.adapter;
1720         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
1721         u8 *frame = recv_frame->u.hdr.rx_data;
1722         u16 seq_ctrl = ((recv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
1723                 (recv_frame->u.hdr.attrib.frag_num & 0xf);
1724
1725         if (GetRetry(frame)) {
1726                 if (token >= 0) {
1727                         if ((seq_ctrl == mlmeext->action_public_rxseq)
1728                                 && (token == mlmeext->action_public_dialog_token))
1729                                 return _FAIL;
1730                 } else {
1731                         if (seq_ctrl == mlmeext->action_public_rxseq)
1732                                 return _FAIL;
1733                 }
1734         }
1735
1736         mlmeext->action_public_rxseq = seq_ctrl;
1737
1738         if (token >= 0)
1739                 mlmeext->action_public_dialog_token = token;
1740
1741         return _SUCCESS;
1742 }
1743
1744 static unsigned int on_action_public_p2p(union recv_frame *precv_frame)
1745 {
1746         u8 *pframe = precv_frame->u.hdr.rx_data;
1747         u8 *frame_body;
1748         u8 dialogToken = 0;
1749
1750         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1751
1752         dialogToken = frame_body[7];
1753
1754         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
1755                 return _FAIL;
1756
1757         return _SUCCESS;
1758 }
1759
1760 static unsigned int on_action_public_vendor(union recv_frame *precv_frame)
1761 {
1762         unsigned int ret = _FAIL;
1763         u8 *pframe = precv_frame->u.hdr.rx_data;
1764         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1765
1766         if (!memcmp(frame_body + 2, P2P_OUI, 4))
1767                 ret = on_action_public_p2p(precv_frame);
1768
1769         return ret;
1770 }
1771
1772 static unsigned int on_action_public_default(union recv_frame *precv_frame, u8 action)
1773 {
1774         unsigned int ret = _FAIL;
1775         u8 *pframe = precv_frame->u.hdr.rx_data;
1776         uint frame_len = precv_frame->u.hdr.len;
1777         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1778         u8 token;
1779         struct adapter *adapter = precv_frame->u.hdr.adapter;
1780         char msg[64];
1781
1782         token = frame_body[2];
1783
1784         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
1785                 goto exit;
1786
1787         scnprintf(msg, sizeof(msg), "%s(token:%u)", action_public_str(action), token);
1788         rtw_cfg80211_rx_action(adapter, pframe, frame_len, msg);
1789
1790         ret = _SUCCESS;
1791
1792 exit:
1793         return ret;
1794 }
1795
1796 unsigned int on_action_public(struct adapter *padapter, union recv_frame *precv_frame)
1797 {
1798         unsigned int ret = _FAIL;
1799         u8 *pframe = precv_frame->u.hdr.rx_data;
1800         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1801         u8 category, action;
1802
1803         /* check RA matches or not */
1804         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
1805                 goto exit;
1806
1807         category = frame_body[0];
1808         if (category != RTW_WLAN_CATEGORY_PUBLIC)
1809                 goto exit;
1810
1811         action = frame_body[1];
1812         switch (action) {
1813         case ACT_PUBLIC_VENDOR:
1814                 ret = on_action_public_vendor(precv_frame);
1815                 break;
1816         default:
1817                 ret = on_action_public_default(precv_frame, action);
1818                 break;
1819         }
1820
1821 exit:
1822         return ret;
1823 }
1824
1825 unsigned int OnAction_ht(struct adapter *padapter, union recv_frame *precv_frame)
1826 {
1827         u8 *pframe = precv_frame->u.hdr.rx_data;
1828         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
1829         u8 category, action;
1830
1831         /* check RA matches or not */
1832         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
1833                 goto exit;
1834
1835         category = frame_body[0];
1836         if (category != RTW_WLAN_CATEGORY_HT)
1837                 goto exit;
1838
1839         action = frame_body[1];
1840         switch (action) {
1841         case WLAN_HT_ACTION_COMPRESSED_BF:
1842                 break;
1843         default:
1844                 break;
1845         }
1846
1847 exit:
1848
1849         return _SUCCESS;
1850 }
1851
1852 unsigned int OnAction_sa_query(struct adapter *padapter, union recv_frame *precv_frame)
1853 {
1854         u8 *pframe = precv_frame->u.hdr.rx_data;
1855         struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
1856         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1857         unsigned short tid;
1858
1859         switch (pframe[WLAN_HDR_A3_LEN+1]) {
1860         case 0: /* SA Query req */
1861                 memcpy(&tid, &pframe[WLAN_HDR_A3_LEN+2], sizeof(unsigned short));
1862                 issue_action_SA_Query(padapter, GetAddr2Ptr(pframe), 1, tid);
1863                 break;
1864
1865         case 1: /* SA Query rsp */
1866                 del_timer_sync(&pmlmeext->sa_query_timer);
1867                 break;
1868         default:
1869                 break;
1870         }
1871         if (0) {
1872                 int pp;
1873
1874                 printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
1875                 for (pp = 0; pp < pattrib->pkt_len; pp++)
1876                         printk(" %02x ", pframe[pp]);
1877                 printk("\n");
1878         }
1879
1880         return _SUCCESS;
1881 }
1882
1883 unsigned int OnAction(struct adapter *padapter, union recv_frame *precv_frame)
1884 {
1885         int i;
1886         unsigned char category;
1887         struct action_handler *ptable;
1888         unsigned char *frame_body;
1889         u8 *pframe = precv_frame->u.hdr.rx_data;
1890
1891         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1892
1893         category = frame_body[0];
1894
1895         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
1896                 ptable = &OnAction_tbl[i];
1897
1898                 if (category == ptable->num)
1899                         ptable->func(padapter, precv_frame);
1900
1901         }
1902
1903         return _SUCCESS;
1904
1905 }
1906
1907 unsigned int DoReserved(struct adapter *padapter, union recv_frame *precv_frame)
1908 {
1909         return _SUCCESS;
1910 }
1911
1912 static struct xmit_frame *_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv, bool once)
1913 {
1914         struct xmit_frame *pmgntframe;
1915         struct xmit_buf *pxmitbuf;
1916
1917         if (once)
1918                 pmgntframe = rtw_alloc_xmitframe_once(pxmitpriv);
1919         else
1920                 pmgntframe = rtw_alloc_xmitframe_ext(pxmitpriv);
1921
1922         if (!pmgntframe)
1923                 goto exit;
1924
1925         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
1926         if (!pxmitbuf) {
1927                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
1928                 pmgntframe = NULL;
1929                 goto exit;
1930         }
1931
1932         pmgntframe->frame_tag = MGNT_FRAMETAG;
1933         pmgntframe->pxmitbuf = pxmitbuf;
1934         pmgntframe->buf_addr = pxmitbuf->pbuf;
1935         pxmitbuf->priv_data = pmgntframe;
1936
1937 exit:
1938         return pmgntframe;
1939
1940 }
1941
1942 inline struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
1943 {
1944         return _alloc_mgtxmitframe(pxmitpriv, false);
1945 }
1946
1947 /****************************************************************************
1948
1949 Following are some TX functions for WiFi MLME
1950
1951 *****************************************************************************/
1952
1953 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
1954 {
1955         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1956
1957         pmlmeext->tx_rate = rate;
1958 }
1959
1960 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
1961 {
1962         u8 wireless_mode;
1963         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
1964
1965         /* memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib)); */
1966
1967         pattrib->hdrlen = 24;
1968         pattrib->nr_frags = 1;
1969         pattrib->priority = 7;
1970         pattrib->mac_id = 0;
1971         pattrib->qsel = 0x12;
1972
1973         pattrib->pktlen = 0;
1974
1975         if (pmlmeext->tx_rate == IEEE80211_CCK_RATE_1MB)
1976                 wireless_mode = WIRELESS_11B;
1977         else
1978                 wireless_mode = WIRELESS_11G;
1979         pattrib->raid =  rtw_get_mgntframe_raid(padapter, wireless_mode);
1980         pattrib->rate = pmlmeext->tx_rate;
1981
1982         pattrib->encrypt = _NO_PRIVACY_;
1983         pattrib->bswenc = false;
1984
1985         pattrib->qos_en = false;
1986         pattrib->ht_en = false;
1987         pattrib->bwmode = CHANNEL_WIDTH_20;
1988         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
1989         pattrib->sgi = false;
1990
1991         pattrib->seqnum = pmlmeext->mgnt_seq;
1992
1993         pattrib->retry_ctrl = true;
1994
1995         pattrib->mbssid = 0;
1996
1997 }
1998
1999 void update_mgntframe_attrib_addr(struct adapter *padapter, struct xmit_frame *pmgntframe)
2000 {
2001         u8 *pframe;
2002         struct pkt_attrib       *pattrib = &pmgntframe->attrib;
2003
2004         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2005
2006         memcpy(pattrib->ra, GetAddr1Ptr(pframe), ETH_ALEN);
2007         memcpy(pattrib->ta, GetAddr2Ptr(pframe), ETH_ALEN);
2008 }
2009
2010 void dump_mgntframe(struct adapter *padapter, struct xmit_frame *pmgntframe)
2011 {
2012         if (padapter->bSurpriseRemoved ||
2013                 padapter->bDriverStopped) {
2014                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2015                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2016                 return;
2017         }
2018
2019         rtw_hal_mgnt_xmit(padapter, pmgntframe);
2020 }
2021
2022 s32 dump_mgntframe_and_wait(struct adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms)
2023 {
2024         s32 ret = _FAIL;
2025         unsigned long irqL;
2026         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2027         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
2028         struct submit_ctx sctx;
2029
2030         if (padapter->bSurpriseRemoved ||
2031                 padapter->bDriverStopped) {
2032                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2033                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2034                 return ret;
2035         }
2036
2037         rtw_sctx_init(&sctx, timeout_ms);
2038         pxmitbuf->sctx = &sctx;
2039
2040         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
2041
2042         if (ret == _SUCCESS)
2043                 ret = rtw_sctx_wait(&sctx);
2044
2045         spin_lock_irqsave(&pxmitpriv->lock_sctx, irqL);
2046         pxmitbuf->sctx = NULL;
2047         spin_unlock_irqrestore(&pxmitpriv->lock_sctx, irqL);
2048
2049         return ret;
2050 }
2051
2052 s32 dump_mgntframe_and_wait_ack(struct adapter *padapter, struct xmit_frame *pmgntframe)
2053 {
2054         static u8 seq_no;
2055         s32 ret = _FAIL;
2056         u32 timeout_ms = 500;/*   500ms */
2057         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2058
2059         if (padapter->bSurpriseRemoved ||
2060                 padapter->bDriverStopped) {
2061                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2062                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2063                 return -1;
2064         }
2065
2066         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex) == 0) {
2067                 pxmitpriv->ack_tx = true;
2068                 pxmitpriv->seq_no = seq_no++;
2069                 pmgntframe->ack_report = 1;
2070                 if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
2071                         ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
2072
2073                 pxmitpriv->ack_tx = false;
2074                 mutex_unlock(&pxmitpriv->ack_tx_mutex);
2075         }
2076
2077         return ret;
2078 }
2079
2080 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
2081 {
2082         u8 *ssid_ie;
2083         signed int ssid_len_ori;
2084         int len_diff = 0;
2085
2086         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
2087
2088         if (ssid_ie && ssid_len_ori > 0) {
2089                 switch (hidden_ssid_mode) {
2090                 case 1:
2091                 {
2092                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
2093                         u32 remain_len = 0;
2094
2095                         remain_len = ies_len - (next_ie-ies);
2096
2097                         ssid_ie[1] = 0;
2098                         memcpy(ssid_ie+2, next_ie, remain_len);
2099                         len_diff -= ssid_len_ori;
2100
2101                         break;
2102                 }
2103                 case 2:
2104                         memset(&ssid_ie[2], 0, ssid_len_ori);
2105                         break;
2106                 default:
2107                         break;
2108         }
2109         }
2110
2111         return len_diff;
2112 }
2113
2114 void issue_beacon(struct adapter *padapter, int timeout_ms)
2115 {
2116         struct xmit_frame       *pmgntframe;
2117         struct pkt_attrib       *pattrib;
2118         unsigned char *pframe;
2119         struct ieee80211_hdr *pwlanhdr;
2120         __le16 *fctrl;
2121         unsigned int    rate_len;
2122         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2123         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2124         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2125         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2126         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
2127
2128         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2129         if (!pmgntframe)
2130                 return;
2131
2132         spin_lock_bh(&pmlmepriv->bcn_update_lock);
2133
2134         /* update attribute */
2135         pattrib = &pmgntframe->attrib;
2136         update_mgntframe_attrib(padapter, pattrib);
2137         pattrib->qsel = 0x10;
2138
2139         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2140
2141         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2142         pwlanhdr = (struct ieee80211_hdr *)pframe;
2143
2144
2145         fctrl = &(pwlanhdr->frame_control);
2146         *(fctrl) = 0;
2147
2148         eth_broadcast_addr(pwlanhdr->addr1);
2149         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2150         memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
2151
2152         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
2153         /* pmlmeext->mgnt_seq++; */
2154         SetFrameSubType(pframe, WIFI_BEACON);
2155
2156         pframe += sizeof(struct ieee80211_hdr_3addr);
2157         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2158
2159         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
2160                 {
2161                         int len_diff;
2162
2163                         memcpy(pframe, cur_network->ies, cur_network->ie_length);
2164                         len_diff = update_hidden_ssid(pframe+_BEACON_IE_OFFSET_,
2165                                                       cur_network->ie_length-_BEACON_IE_OFFSET_,
2166                                                       pmlmeinfo->hidden_ssid_mode);
2167                         pframe += (cur_network->ie_length+len_diff);
2168                         pattrib->pktlen += (cur_network->ie_length+len_diff);
2169                 }
2170
2171                 {
2172                         u8 *wps_ie;
2173                         uint wps_ielen;
2174                         u8 sr = 0;
2175
2176                         wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
2177                                 pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
2178                         if (wps_ie && wps_ielen > 0)
2179                                 rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
2180                         if (sr != 0)
2181                                 set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
2182                         else
2183                                 _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
2184                 }
2185
2186                 goto _issue_bcn;
2187
2188         }
2189
2190         /* below for ad-hoc mode */
2191
2192         /* timestamp will be inserted by hardware */
2193         pframe += 8;
2194         pattrib->pktlen += 8;
2195
2196         /*  beacon interval: 2 bytes */
2197
2198         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
2199
2200         pframe += 2;
2201         pattrib->pktlen += 2;
2202
2203         /*  capability info: 2 bytes */
2204
2205         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
2206
2207         pframe += 2;
2208         pattrib->pktlen += 2;
2209
2210         /*  SSID */
2211         pframe = rtw_set_ie(pframe, WLAN_EID_SSID, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);
2212
2213         /*  supported rates... */
2214         rate_len = rtw_get_rateset_len(cur_network->supported_rates);
2215         pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, ((rate_len > 8) ? 8 : rate_len), cur_network->supported_rates, &pattrib->pktlen);
2216
2217         /*  DS parameter set */
2218         pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, (unsigned char *)&(cur_network->configuration.ds_config), &pattrib->pktlen);
2219
2220         /* if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) */
2221         {
2222                 u8 erpinfo = 0;
2223                 u32 ATIMWindow;
2224                 /*  IBSS Parameter Set... */
2225                 /* ATIMWindow = cur->configuration.ATIMWindow; */
2226                 ATIMWindow = 0;
2227                 pframe = rtw_set_ie(pframe, WLAN_EID_IBSS_PARAMS, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
2228
2229                 /* ERP IE */
2230                 pframe = rtw_set_ie(pframe, WLAN_EID_ERP_INFO, 1, &erpinfo, &pattrib->pktlen);
2231         }
2232
2233
2234         /*  EXTERNDED SUPPORTED RATE */
2235         if (rate_len > 8)
2236                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (cur_network->supported_rates + 8), &pattrib->pktlen);
2237
2238
2239         /* todo:HT for adhoc */
2240
2241 _issue_bcn:
2242
2243         pmlmepriv->update_bcn = false;
2244
2245         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
2246
2247         if ((pattrib->pktlen + TXDESC_SIZE) > 512)
2248                 return;
2249
2250         pattrib->last_txcmdsz = pattrib->pktlen;
2251
2252         if (timeout_ms > 0)
2253                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
2254         else
2255                 dump_mgntframe(padapter, pmgntframe);
2256
2257 }
2258
2259 void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq)
2260 {
2261         struct xmit_frame                       *pmgntframe;
2262         struct pkt_attrib                       *pattrib;
2263         unsigned char                           *pframe;
2264         struct ieee80211_hdr    *pwlanhdr;
2265         __le16 *fctrl;
2266         unsigned char                           *mac, *bssid;
2267         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2268
2269         u8 *pwps_ie;
2270         uint wps_ielen;
2271         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2272         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2273         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2274         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
2275         unsigned int    rate_len;
2276
2277         if (!da)
2278                 return;
2279
2280         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2281         if (!pmgntframe)
2282                 return;
2283
2284         /* update attribute */
2285         pattrib = &pmgntframe->attrib;
2286         update_mgntframe_attrib(padapter, pattrib);
2287
2288         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2289
2290         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2291         pwlanhdr = (struct ieee80211_hdr *)pframe;
2292
2293         mac = myid(&(padapter->eeprompriv));
2294         bssid = cur_network->mac_address;
2295
2296         fctrl = &(pwlanhdr->frame_control);
2297         *(fctrl) = 0;
2298         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
2299         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
2300         memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
2301
2302         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2303         pmlmeext->mgnt_seq++;
2304         SetFrameSubType(fctrl, WIFI_PROBERSP);
2305
2306         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2307         pattrib->pktlen = pattrib->hdrlen;
2308         pframe += pattrib->hdrlen;
2309
2310
2311         if (cur_network->ie_length > MAX_IE_SZ)
2312                 return;
2313
2314         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
2315                 pwps_ie = rtw_get_wps_ie(cur_network->ies+_FIXED_IE_LENGTH_, cur_network->ie_length-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
2316
2317                 /* inerset & update wps_probe_resp_ie */
2318                 if (pmlmepriv->wps_probe_resp_ie && pwps_ie && wps_ielen > 0) {
2319                         uint wps_offset, remainder_ielen;
2320                         u8 *premainder_ie;
2321
2322                         wps_offset = (uint)(pwps_ie - cur_network->ies);
2323
2324                         premainder_ie = pwps_ie + wps_ielen;
2325
2326                         remainder_ielen = cur_network->ie_length - wps_offset - wps_ielen;
2327
2328                         memcpy(pframe, cur_network->ies, wps_offset);
2329                         pframe += wps_offset;
2330                         pattrib->pktlen += wps_offset;
2331
2332                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
2333                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
2334                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
2335                                 pframe += wps_ielen+2;
2336                                 pattrib->pktlen += wps_ielen+2;
2337                         }
2338
2339                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
2340                                 memcpy(pframe, premainder_ie, remainder_ielen);
2341                                 pframe += remainder_ielen;
2342                                 pattrib->pktlen += remainder_ielen;
2343                         }
2344                 } else {
2345                         memcpy(pframe, cur_network->ies, cur_network->ie_length);
2346                         pframe += cur_network->ie_length;
2347                         pattrib->pktlen += cur_network->ie_length;
2348                 }
2349
2350                 /* retrieve SSID IE from cur_network->ssid */
2351                 {
2352                         u8 *ssid_ie;
2353                         signed int ssid_ielen;
2354                         signed int ssid_ielen_diff;
2355                         u8 *buf;
2356                         u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr);
2357
2358                         buf = rtw_zmalloc(MAX_IE_SZ);
2359                         if (!buf)
2360                                 return;
2361
2362                         ssid_ie = rtw_get_ie(ies+_FIXED_IE_LENGTH_, WLAN_EID_SSID, &ssid_ielen,
2363                                 (pframe-ies)-_FIXED_IE_LENGTH_);
2364
2365                         ssid_ielen_diff = cur_network->ssid.ssid_length - ssid_ielen;
2366
2367                         if (ssid_ie &&  cur_network->ssid.ssid_length) {
2368                                 uint remainder_ielen;
2369                                 u8 *remainder_ie;
2370
2371                                 remainder_ie = ssid_ie+2;
2372                                 remainder_ielen = (pframe-remainder_ie);
2373
2374                                 if (remainder_ielen > MAX_IE_SZ) {
2375                                         netdev_warn(padapter->pnetdev,
2376                                                     FUNC_ADPT_FMT " remainder_ielen > MAX_IE_SZ\n",
2377                                                     FUNC_ADPT_ARG(padapter));
2378                                         remainder_ielen = MAX_IE_SZ;
2379                                 }
2380
2381                                 memcpy(buf, remainder_ie, remainder_ielen);
2382                                 memcpy(remainder_ie+ssid_ielen_diff, buf, remainder_ielen);
2383                                 *(ssid_ie+1) = cur_network->ssid.ssid_length;
2384                                 memcpy(ssid_ie+2, cur_network->ssid.ssid, cur_network->ssid.ssid_length);
2385
2386                                 pframe += ssid_ielen_diff;
2387                                 pattrib->pktlen += ssid_ielen_diff;
2388                         }
2389                         kfree(buf);
2390                 }
2391         } else {
2392                 /* timestamp will be inserted by hardware */
2393                 pframe += 8;
2394                 pattrib->pktlen += 8;
2395
2396                 /*  beacon interval: 2 bytes */
2397
2398                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->ies)), 2);
2399
2400                 pframe += 2;
2401                 pattrib->pktlen += 2;
2402
2403                 /*  capability info: 2 bytes */
2404
2405                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->ies)), 2);
2406
2407                 pframe += 2;
2408                 pattrib->pktlen += 2;
2409
2410                 /* below for ad-hoc mode */
2411
2412                 /*  SSID */
2413                 pframe = rtw_set_ie(pframe, WLAN_EID_SSID, cur_network->ssid.ssid_length, cur_network->ssid.ssid, &pattrib->pktlen);
2414
2415                 /*  supported rates... */
2416                 rate_len = rtw_get_rateset_len(cur_network->supported_rates);
2417                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, ((rate_len > 8) ? 8 : rate_len), cur_network->supported_rates, &pattrib->pktlen);
2418
2419                 /*  DS parameter set */
2420                 pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, (unsigned char *)&(cur_network->configuration.ds_config), &pattrib->pktlen);
2421
2422                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2423                         u8 erpinfo = 0;
2424                         u32 ATIMWindow;
2425                         /*  IBSS Parameter Set... */
2426                         /* ATIMWindow = cur->configuration.ATIMWindow; */
2427                         ATIMWindow = 0;
2428                         pframe = rtw_set_ie(pframe, WLAN_EID_IBSS_PARAMS, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
2429
2430                         /* ERP IE */
2431                         pframe = rtw_set_ie(pframe, WLAN_EID_ERP_INFO, 1, &erpinfo, &pattrib->pktlen);
2432                 }
2433
2434
2435                 /*  EXTERNDED SUPPORTED RATE */
2436                 if (rate_len > 8)
2437                         pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (rate_len - 8), (cur_network->supported_rates + 8), &pattrib->pktlen);
2438
2439
2440                 /* todo:HT for adhoc */
2441
2442         }
2443
2444         pattrib->last_txcmdsz = pattrib->pktlen;
2445
2446
2447         dump_mgntframe(padapter, pmgntframe);
2448
2449         return;
2450
2451 }
2452
2453 static int _issue_probereq(struct adapter *padapter,
2454                            struct ndis_802_11_ssid *pssid,
2455                            u8 *da, u8 ch, bool append_wps, bool wait_ack)
2456 {
2457         int ret = _FAIL;
2458         struct xmit_frame               *pmgntframe;
2459         struct pkt_attrib               *pattrib;
2460         unsigned char           *pframe;
2461         struct ieee80211_hdr    *pwlanhdr;
2462         __le16 *fctrl;
2463         unsigned char           *mac;
2464         unsigned char           bssrate[NumRates];
2465         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
2466         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2467         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2468         int     bssrate_len = 0;
2469
2470         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2471         if (!pmgntframe)
2472                 goto exit;
2473
2474         /* update attribute */
2475         pattrib = &pmgntframe->attrib;
2476         update_mgntframe_attrib(padapter, pattrib);
2477
2478
2479         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2480
2481         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2482         pwlanhdr = (struct ieee80211_hdr *)pframe;
2483
2484         mac = myid(&(padapter->eeprompriv));
2485
2486         fctrl = &(pwlanhdr->frame_control);
2487         *(fctrl) = 0;
2488
2489         if (da) {
2490                 /*      unicast probe request frame */
2491                 memcpy(pwlanhdr->addr1, da, ETH_ALEN);
2492                 memcpy(pwlanhdr->addr3, da, ETH_ALEN);
2493         } else {
2494                 /*      broadcast probe request frame */
2495                 eth_broadcast_addr(pwlanhdr->addr1);
2496                 eth_broadcast_addr(pwlanhdr->addr3);
2497         }
2498
2499         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
2500
2501         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2502         pmlmeext->mgnt_seq++;
2503         SetFrameSubType(pframe, WIFI_PROBEREQ);
2504
2505         pframe += sizeof(struct ieee80211_hdr_3addr);
2506         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2507
2508         if (pssid)
2509                 pframe = rtw_set_ie(pframe, WLAN_EID_SSID, pssid->ssid_length, pssid->ssid, &(pattrib->pktlen));
2510         else
2511                 pframe = rtw_set_ie(pframe, WLAN_EID_SSID, 0, NULL, &(pattrib->pktlen));
2512
2513         get_rate_set(padapter, bssrate, &bssrate_len);
2514
2515         if (bssrate_len > 8) {
2516                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, bssrate, &(pattrib->pktlen));
2517                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
2518         } else {
2519                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, bssrate_len, bssrate, &(pattrib->pktlen));
2520         }
2521
2522         if (ch)
2523                 pframe = rtw_set_ie(pframe, WLAN_EID_DS_PARAMS, 1, &ch, &pattrib->pktlen);
2524
2525         if (append_wps) {
2526                 /* add wps_ie for wps2.0 */
2527                 if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
2528                         memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
2529                         pframe += pmlmepriv->wps_probe_req_ie_len;
2530                         pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
2531                 }
2532         }
2533
2534         pattrib->last_txcmdsz = pattrib->pktlen;
2535
2536         if (wait_ack) {
2537                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
2538         } else {
2539                 dump_mgntframe(padapter, pmgntframe);
2540                 ret = _SUCCESS;
2541         }
2542
2543 exit:
2544         return ret;
2545 }
2546
2547 inline void issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da)
2548 {
2549         _issue_probereq(padapter, pssid, da, 0, 1, false);
2550 }
2551
2552 int issue_probereq_ex(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, u8 ch, bool append_wps,
2553         int try_cnt, int wait_ms)
2554 {
2555         int ret;
2556         int i = 0;
2557
2558         do {
2559                 ret = _issue_probereq(padapter, pssid, da, ch, append_wps,
2560                                       wait_ms > 0);
2561
2562                 i++;
2563
2564                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
2565                         break;
2566
2567                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
2568                         msleep(wait_ms);
2569
2570         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
2571
2572         if (ret != _FAIL) {
2573                 ret = _SUCCESS;
2574                 #ifndef DBG_XMIT_ACK
2575                 goto exit;
2576                 #endif
2577         }
2578
2579 exit:
2580         return ret;
2581 }
2582
2583 /*  if psta == NULL, indicate we are station(client) now... */
2584 void issue_auth(struct adapter *padapter, struct sta_info *psta, unsigned short status)
2585 {
2586         struct xmit_frame                       *pmgntframe;
2587         struct pkt_attrib                       *pattrib;
2588         unsigned char                           *pframe;
2589         struct ieee80211_hdr    *pwlanhdr;
2590         __le16 *fctrl;
2591         unsigned int                                    val32;
2592         unsigned short                          val16;
2593         int use_shared_key = 0;
2594         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
2595         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2596         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2597         __le16 le_tmp;
2598
2599         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2600         if (!pmgntframe)
2601                 return;
2602
2603         /* update attribute */
2604         pattrib = &pmgntframe->attrib;
2605         update_mgntframe_attrib(padapter, pattrib);
2606
2607         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2608
2609         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2610         pwlanhdr = (struct ieee80211_hdr *)pframe;
2611
2612         fctrl = &(pwlanhdr->frame_control);
2613         *(fctrl) = 0;
2614
2615         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2616         pmlmeext->mgnt_seq++;
2617         SetFrameSubType(pframe, WIFI_AUTH);
2618
2619         pframe += sizeof(struct ieee80211_hdr_3addr);
2620         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2621
2622
2623         if (psta) { /*  for AP mode */
2624                 memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);
2625                 memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2626                 memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
2627
2628                 /*  setting auth algo number */
2629                 val16 = (u16)psta->authalg;
2630
2631                 if (status != WLAN_STATUS_SUCCESS)
2632                         val16 = 0;
2633
2634                 if (val16)
2635                         use_shared_key = 1;
2636
2637                 le_tmp = cpu_to_le16(val16);
2638
2639                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2640
2641                 /*  setting auth seq number */
2642                 val16 = (u16)psta->auth_seq;
2643                 le_tmp = cpu_to_le16(val16);
2644                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2645
2646                 /*  setting status code... */
2647                 val16 = status;
2648                 le_tmp = cpu_to_le16(val16);
2649                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2650
2651                 /*  added challenging text... */
2652                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
2653                         pframe = rtw_set_ie(pframe, WLAN_EID_CHALLENGE, 128, psta->chg_txt, &(pattrib->pktlen));
2654
2655         } else {
2656                 memcpy(pwlanhdr->addr1, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
2657                 memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
2658                 memcpy(pwlanhdr->addr3, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
2659
2660                 /*  setting auth algo number */
2661                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
2662                 if (val16)
2663                         use_shared_key = 1;
2664                 le_tmp = cpu_to_le16(val16);
2665
2666                 /* setting IV for auth seq #3 */
2667                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
2668                         __le32 le_tmp32;
2669
2670                         val32 = ((pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30));
2671                         le_tmp32 = cpu_to_le32(val32);
2672                         pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *)&le_tmp32, &(pattrib->pktlen));
2673
2674                         pattrib->iv_len = 4;
2675                 }
2676
2677                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2678
2679                 /*  setting auth seq number */
2680                 le_tmp = cpu_to_le16(pmlmeinfo->auth_seq);
2681                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2682
2683
2684                 /*  setting status code... */
2685                 le_tmp = cpu_to_le16(status);
2686                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2687
2688                 /*  then checking to see if sending challenging text... */
2689                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
2690                         pframe = rtw_set_ie(pframe, WLAN_EID_CHALLENGE, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
2691
2692                         SetPrivacy(fctrl);
2693
2694                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2695
2696                         pattrib->encrypt = _WEP40_;
2697
2698                         pattrib->icv_len = 4;
2699
2700                         pattrib->pktlen += pattrib->icv_len;
2701
2702                 }
2703
2704         }
2705
2706         pattrib->last_txcmdsz = pattrib->pktlen;
2707
2708         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
2709         dump_mgntframe(padapter, pmgntframe);
2710 }
2711
2712
2713 void issue_asocrsp(struct adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type)
2714 {
2715         struct xmit_frame       *pmgntframe;
2716         struct ieee80211_hdr    *pwlanhdr;
2717         struct pkt_attrib *pattrib;
2718         unsigned char *pbuf, *pframe;
2719         unsigned short val;
2720         __le16 *fctrl;
2721         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2722         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2723         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
2724         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2725         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
2726         u8 *ie = pnetwork->ies;
2727         __le16 lestatus, le_tmp;
2728
2729         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2730         if (!pmgntframe)
2731                 return;
2732
2733         /* update attribute */
2734         pattrib = &pmgntframe->attrib;
2735         update_mgntframe_attrib(padapter, pattrib);
2736
2737
2738         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2739
2740         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2741         pwlanhdr = (struct ieee80211_hdr *)pframe;
2742
2743         fctrl = &(pwlanhdr->frame_control);
2744         *(fctrl) = 0;
2745
2746         memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
2747         memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
2748         memcpy((void *)GetAddr3Ptr(pwlanhdr), get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
2749
2750
2751         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2752         pmlmeext->mgnt_seq++;
2753         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
2754                 SetFrameSubType(pwlanhdr, pkt_type);
2755         else
2756                 return;
2757
2758         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2759         pattrib->pktlen += pattrib->hdrlen;
2760         pframe += pattrib->hdrlen;
2761
2762         /* capability */
2763         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
2764
2765         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, (unsigned char *)&val, &(pattrib->pktlen));
2766
2767         lestatus = cpu_to_le16(status);
2768         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&lestatus, &(pattrib->pktlen));
2769
2770         le_tmp = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
2771         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
2772
2773         if (pstat->bssratelen <= 8) {
2774                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
2775         } else {
2776                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, pstat->bssrateset, &(pattrib->pktlen));
2777                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
2778         }
2779
2780         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
2781                 uint ie_len = 0;
2782
2783                 /* FILL HT CAP INFO IE */
2784                 /* p = hostapd_eid_ht_capabilities_info(hapd, p); */
2785                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_HT_CAPABILITY, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
2786                 if (pbuf && ie_len > 0) {
2787                         memcpy(pframe, pbuf, ie_len+2);
2788                         pframe += (ie_len+2);
2789                         pattrib->pktlen += (ie_len+2);
2790                 }
2791
2792                 /* FILL HT ADD INFO IE */
2793                 /* p = hostapd_eid_ht_operation(hapd, p); */
2794                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, WLAN_EID_HT_OPERATION, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_));
2795                 if (pbuf && ie_len > 0) {
2796                         memcpy(pframe, pbuf, ie_len+2);
2797                         pframe += (ie_len+2);
2798                         pattrib->pktlen += (ie_len+2);
2799                 }
2800
2801         }
2802
2803         /* FILL WMM IE */
2804         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
2805                 uint ie_len = 0;
2806                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
2807
2808                 for (pbuf = ie + _BEACON_IE_OFFSET_; ; pbuf += (ie_len + 2)) {
2809                         pbuf = rtw_get_ie(pbuf, WLAN_EID_VENDOR_SPECIFIC, &ie_len, (pnetwork->ie_length - _BEACON_IE_OFFSET_ - (ie_len + 2)));
2810                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
2811                                 memcpy(pframe, pbuf, ie_len+2);
2812                                 pframe += (ie_len+2);
2813                                 pattrib->pktlen += (ie_len+2);
2814
2815                                 break;
2816                         }
2817
2818                         if (!pbuf || ie_len == 0)
2819                                 break;
2820                 }
2821
2822         }
2823
2824         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
2825                 pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, 6, REALTEK_96B_IE, &(pattrib->pktlen));
2826
2827         /* add WPS IE ie for wps 2.0 */
2828         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
2829                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
2830
2831                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
2832                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
2833         }
2834
2835         pattrib->last_txcmdsz = pattrib->pktlen;
2836
2837         dump_mgntframe(padapter, pmgntframe);
2838 }
2839
2840 void issue_assocreq(struct adapter *padapter)
2841 {
2842         int ret = _FAIL;
2843         struct xmit_frame                               *pmgntframe;
2844         struct pkt_attrib                               *pattrib;
2845         unsigned char                           *pframe;
2846         struct ieee80211_hdr                    *pwlanhdr;
2847         __le16 *fctrl;
2848         __le16 val16;
2849         unsigned int                                    i, j, index = 0;
2850         unsigned char bssrate[NumRates], sta_bssrate[NumRates];
2851         struct ndis_80211_var_ie *pIE;
2852         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
2853         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2854         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2855         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2856         int     bssrate_len = 0, sta_bssrate_len = 0;
2857         u8 vs_ie_length = 0;
2858
2859         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2860         if (!pmgntframe)
2861                 goto exit;
2862
2863         /* update attribute */
2864         pattrib = &pmgntframe->attrib;
2865         update_mgntframe_attrib(padapter, pattrib);
2866
2867         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2868
2869         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2870         pwlanhdr = (struct ieee80211_hdr *)pframe;
2871
2872         fctrl = &(pwlanhdr->frame_control);
2873         *(fctrl) = 0;
2874         memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
2875         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2876         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
2877
2878         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2879         pmlmeext->mgnt_seq++;
2880         SetFrameSubType(pframe, WIFI_ASSOCREQ);
2881
2882         pframe += sizeof(struct ieee80211_hdr_3addr);
2883         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2884
2885         /* caps */
2886         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.ies), 2);
2887
2888         pframe += 2;
2889         pattrib->pktlen += 2;
2890
2891         /* listen interval */
2892         /* todo: listen interval for power saving */
2893         val16 = cpu_to_le16(3);
2894         memcpy(pframe, (unsigned char *)&val16, 2);
2895         pframe += 2;
2896         pattrib->pktlen += 2;
2897
2898         /* SSID */
2899         pframe = rtw_set_ie(pframe, WLAN_EID_SSID,  pmlmeinfo->network.ssid.ssid_length, pmlmeinfo->network.ssid.ssid, &(pattrib->pktlen));
2900
2901         /* supported rate & extended supported rate */
2902
2903         /*  Check if the AP's supported rates are also supported by STA. */
2904         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
2905
2906         if (pmlmeext->cur_channel == 14) /*  for JAPAN, channel 14 can only uses B Mode(CCK) */
2907                 sta_bssrate_len = 4;
2908
2909
2910         /* for (i = 0; i < sta_bssrate_len; i++) { */
2911         /*  */
2912
2913         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
2914                 if (pmlmeinfo->network.supported_rates[i] == 0)
2915                         break;
2916         }
2917
2918
2919         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
2920                 if (pmlmeinfo->network.supported_rates[i] == 0)
2921                         break;
2922
2923
2924                 /*  Check if the AP's supported rates are also supported by STA. */
2925                 for (j = 0; j < sta_bssrate_len; j++) {
2926                          /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
2927                         if ((pmlmeinfo->network.supported_rates[i] | IEEE80211_BASIC_RATE_MASK)
2928                                         == (sta_bssrate[j] | IEEE80211_BASIC_RATE_MASK))
2929                                 break;
2930                 }
2931
2932                 if (j != sta_bssrate_len)
2933                         /*  the rate is supported by STA */
2934                         bssrate[index++] = pmlmeinfo->network.supported_rates[i];
2935         }
2936
2937         bssrate_len = index;
2938
2939         if (bssrate_len == 0) {
2940                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
2941                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
2942                 goto exit; /* don't connect to AP if no joint supported rate */
2943         }
2944
2945
2946         if (bssrate_len > 8) {
2947                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, 8, bssrate, &(pattrib->pktlen));
2948                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_SUPP_RATES, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
2949         } else
2950                 pframe = rtw_set_ie(pframe, WLAN_EID_SUPP_RATES, bssrate_len, bssrate, &(pattrib->pktlen));
2951
2952         /* vendor specific IE, such as WPA, WMM, WPS */
2953         for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.ie_length;) {
2954                 pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.ies + i);
2955
2956                 switch (pIE->element_id) {
2957                 case WLAN_EID_VENDOR_SPECIFIC:
2958                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
2959                                         (!memcmp(pIE->data, WMM_OUI, 4)) ||
2960                                         (!memcmp(pIE->data, WPS_OUI, 4))) {
2961                                 vs_ie_length = pIE->length;
2962                                 if ((!padapter->registrypriv.wifi_spec) && (!memcmp(pIE->data, WPS_OUI, 4))) {
2963                                         /* Commented by Kurt 20110629
2964                                          * In some older APs, WPS handshake
2965                                          * would be fail if we append vendor
2966                                          * extensions information to AP
2967                                          */
2968
2969                                         vs_ie_length = 14;
2970                                 }
2971
2972                                 pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, vs_ie_length, pIE->data, &(pattrib->pktlen));
2973                         }
2974                         break;
2975
2976                 case WLAN_EID_RSN:
2977                         pframe = rtw_set_ie(pframe, WLAN_EID_RSN, pIE->length, pIE->data, &(pattrib->pktlen));
2978                         break;
2979                 case WLAN_EID_HT_CAPABILITY:
2980                         if (padapter->mlmepriv.htpriv.ht_option) {
2981                                 if (!(is_ap_in_tkip(padapter))) {
2982                                         memcpy(&(pmlmeinfo->HT_caps), pIE->data, sizeof(struct HT_caps_element));
2983                                         pframe = rtw_set_ie(pframe, WLAN_EID_HT_CAPABILITY, pIE->length, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
2984                                 }
2985                         }
2986                         break;
2987
2988                 case WLAN_EID_EXT_CAPABILITY:
2989                         if (padapter->mlmepriv.htpriv.ht_option)
2990                                 pframe = rtw_set_ie(pframe, WLAN_EID_EXT_CAPABILITY, pIE->length, pIE->data, &(pattrib->pktlen));
2991                         break;
2992                 default:
2993                         break;
2994                 }
2995
2996                 i += (pIE->length + 2);
2997         }
2998
2999         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
3000                 pframe = rtw_set_ie(pframe, WLAN_EID_VENDOR_SPECIFIC, 6, REALTEK_96B_IE, &(pattrib->pktlen));
3001
3002
3003         pattrib->last_txcmdsz = pattrib->pktlen;
3004         dump_mgntframe(padapter, pmgntframe);
3005
3006         ret = _SUCCESS;
3007
3008 exit:
3009         if (ret == _SUCCESS)
3010                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
3011         else
3012                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
3013 }
3014
3015 /* when wait_ack is true, this function should be called at process context */
3016 static int _issue_nulldata(struct adapter *padapter, unsigned char *da,
3017                            unsigned int power_mode, bool wait_ack)
3018 {
3019         int ret = _FAIL;
3020         struct xmit_frame                       *pmgntframe;
3021         struct pkt_attrib                       *pattrib;
3022         unsigned char                           *pframe;
3023         struct ieee80211_hdr    *pwlanhdr;
3024         __le16 *fctrl;
3025         struct xmit_priv *pxmitpriv;
3026         struct mlme_ext_priv *pmlmeext;
3027         struct mlme_ext_info *pmlmeinfo;
3028
3029         if (!padapter)
3030                 goto exit;
3031
3032         pxmitpriv = &(padapter->xmitpriv);
3033         pmlmeext = &(padapter->mlmeextpriv);
3034         pmlmeinfo = &(pmlmeext->mlmext_info);
3035
3036         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3037         if (!pmgntframe)
3038                 goto exit;
3039
3040         /* update attribute */
3041         pattrib = &pmgntframe->attrib;
3042         update_mgntframe_attrib(padapter, pattrib);
3043         pattrib->retry_ctrl = false;
3044
3045         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3046
3047         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3048         pwlanhdr = (struct ieee80211_hdr *)pframe;
3049
3050         fctrl = &(pwlanhdr->frame_control);
3051         *(fctrl) = 0;
3052
3053         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
3054                 SetFrDs(fctrl);
3055         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
3056                 SetToDs(fctrl);
3057
3058         if (power_mode)
3059                 SetPwrMgt(fctrl);
3060
3061         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3062         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3063         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3064
3065         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3066         pmlmeext->mgnt_seq++;
3067         SetFrameSubType(pframe, WIFI_DATA_NULL);
3068
3069         pframe += sizeof(struct ieee80211_hdr_3addr);
3070         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3071
3072         pattrib->last_txcmdsz = pattrib->pktlen;
3073
3074         if (wait_ack) {
3075                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3076         } else {
3077                 dump_mgntframe(padapter, pmgntframe);
3078                 ret = _SUCCESS;
3079         }
3080
3081 exit:
3082         return ret;
3083 }
3084
3085 /*
3086  * [IMPORTANT] Don't call this function in interrupt context
3087  *
3088  * When wait_ms > 0, this function should be called at process context
3089  * da == NULL for station mode
3090  */
3091 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
3092 {
3093         int ret;
3094         int i = 0;
3095         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3096         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3097         struct sta_info *psta;
3098
3099
3100         /* da == NULL, assume it's null data for sta to ap*/
3101         if (!da)
3102                 da = get_my_bssid(&(pmlmeinfo->network));
3103
3104         psta = rtw_get_stainfo(&padapter->stapriv, da);
3105         if (psta) {
3106                 if (power_mode)
3107                         rtw_hal_macid_sleep(padapter, psta->mac_id);
3108                 else
3109                         rtw_hal_macid_wakeup(padapter, psta->mac_id);
3110         } else {
3111                 rtw_warn_on(1);
3112         }
3113
3114         do {
3115                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0);
3116
3117                 i++;
3118
3119                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3120                         break;
3121
3122                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3123                         msleep(wait_ms);
3124
3125         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3126
3127         if (ret != _FAIL) {
3128                 ret = _SUCCESS;
3129                 #ifndef DBG_XMIT_ACK
3130                 goto exit;
3131                 #endif
3132         }
3133
3134 exit:
3135         return ret;
3136 }
3137
3138 /*
3139  * [IMPORTANT] This function run in interrupt context
3140  *
3141  * The null data packet would be sent without power bit,
3142  * and not guarantee success.
3143  */
3144 s32 issue_nulldata_in_interrupt(struct adapter *padapter, u8 *da)
3145 {
3146         struct mlme_ext_priv *pmlmeext;
3147         struct mlme_ext_info *pmlmeinfo;
3148
3149
3150         pmlmeext = &padapter->mlmeextpriv;
3151         pmlmeinfo = &pmlmeext->mlmext_info;
3152
3153         /* da == NULL, assume it's null data for sta to ap*/
3154         if (!da)
3155                 da = get_my_bssid(&(pmlmeinfo->network));
3156
3157         return _issue_nulldata(padapter, da, 0, false);
3158 }
3159
3160 /* when wait_ack is true, this function should be called at process context */
3161 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
3162                                u16 tid, bool wait_ack)
3163 {
3164         int ret = _FAIL;
3165         struct xmit_frame                       *pmgntframe;
3166         struct pkt_attrib                       *pattrib;
3167         unsigned char                           *pframe;
3168         struct ieee80211_hdr    *pwlanhdr;
3169         __le16 *fctrl;
3170         u16 *qc;
3171         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3172         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3173         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3174
3175         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3176         if (!pmgntframe)
3177                 goto exit;
3178
3179         /* update attribute */
3180         pattrib = &pmgntframe->attrib;
3181         update_mgntframe_attrib(padapter, pattrib);
3182
3183         pattrib->hdrlen += 2;
3184         pattrib->qos_en = true;
3185         pattrib->eosp = 1;
3186         pattrib->ack_policy = 0;
3187         pattrib->mdata = 0;
3188
3189         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3190
3191         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3192         pwlanhdr = (struct ieee80211_hdr *)pframe;
3193
3194         fctrl = &(pwlanhdr->frame_control);
3195         *(fctrl) = 0;
3196
3197         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
3198                 SetFrDs(fctrl);
3199         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
3200                 SetToDs(fctrl);
3201
3202         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
3203
3204         SetPriority(qc, tid);
3205
3206         SetEOSP(qc, pattrib->eosp);
3207
3208         SetAckpolicy(qc, pattrib->ack_policy);
3209
3210         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3211         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3212         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3213
3214         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3215         pmlmeext->mgnt_seq++;
3216         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
3217
3218         pframe += sizeof(struct ieee80211_qos_hdr);
3219         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
3220
3221         pattrib->last_txcmdsz = pattrib->pktlen;
3222
3223         if (wait_ack) {
3224                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3225         } else {
3226                 dump_mgntframe(padapter, pmgntframe);
3227                 ret = _SUCCESS;
3228         }
3229
3230 exit:
3231         return ret;
3232 }
3233
3234 /* when wait_ms >0 , this function should be called at process context */
3235 /* da == NULL for station mode */
3236 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
3237 {
3238         int ret;
3239         int i = 0;
3240         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3241         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3242
3243         /* da == NULL, assume it's null data for sta to ap*/
3244         if (!da)
3245                 da = get_my_bssid(&(pmlmeinfo->network));
3246
3247         do {
3248                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0);
3249
3250                 i++;
3251
3252                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3253                         break;
3254
3255                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3256                         msleep(wait_ms);
3257
3258         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3259
3260         if (ret != _FAIL) {
3261                 ret = _SUCCESS;
3262                 #ifndef DBG_XMIT_ACK
3263                 goto exit;
3264                 #endif
3265         }
3266
3267 exit:
3268         return ret;
3269 }
3270
3271 static int _issue_deauth(struct adapter *padapter, unsigned char *da,
3272                          unsigned short reason, bool wait_ack)
3273 {
3274         struct xmit_frame                       *pmgntframe;
3275         struct pkt_attrib                       *pattrib;
3276         unsigned char                           *pframe;
3277         struct ieee80211_hdr    *pwlanhdr;
3278         __le16 *fctrl;
3279         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3280         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3281         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3282         int ret = _FAIL;
3283         __le16 le_tmp;
3284
3285         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3286         if (!pmgntframe)
3287                 goto exit;
3288
3289         /* update attribute */
3290         pattrib = &pmgntframe->attrib;
3291         update_mgntframe_attrib(padapter, pattrib);
3292         pattrib->retry_ctrl = false;
3293
3294         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3295
3296         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3297         pwlanhdr = (struct ieee80211_hdr *)pframe;
3298
3299         fctrl = &(pwlanhdr->frame_control);
3300         *(fctrl) = 0;
3301
3302         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3303         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3304         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3305
3306         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3307         pmlmeext->mgnt_seq++;
3308         SetFrameSubType(pframe, WIFI_DEAUTH);
3309
3310         pframe += sizeof(struct ieee80211_hdr_3addr);
3311         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3312
3313         le_tmp = cpu_to_le16(reason);
3314         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3315
3316         pattrib->last_txcmdsz = pattrib->pktlen;
3317
3318
3319         if (wait_ack) {
3320                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3321         } else {
3322                 dump_mgntframe(padapter, pmgntframe);
3323                 ret = _SUCCESS;
3324         }
3325
3326 exit:
3327         return ret;
3328 }
3329
3330 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
3331 {
3332         return _issue_deauth(padapter, da, reason, false);
3333 }
3334
3335 int issue_deauth_ex(struct adapter *padapter, u8 *da, unsigned short reason, int try_cnt,
3336         int wait_ms)
3337 {
3338         int ret;
3339         int i = 0;
3340
3341         do {
3342                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0);
3343
3344                 i++;
3345
3346                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3347                         break;
3348
3349                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3350                         mdelay(wait_ms);
3351
3352         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3353
3354         if (ret != _FAIL) {
3355                 ret = _SUCCESS;
3356                 #ifndef DBG_XMIT_ACK
3357                 goto exit;
3358                 #endif
3359         }
3360
3361 exit:
3362         return ret;
3363 }
3364
3365 void issue_action_SA_Query(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid)
3366 {
3367         u8 category = RTW_WLAN_CATEGORY_SA_QUERY;
3368         struct xmit_frame               *pmgntframe;
3369         struct pkt_attrib               *pattrib;
3370         u8                      *pframe;
3371         struct ieee80211_hdr    *pwlanhdr;
3372         __le16 *fctrl;
3373         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3374         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3375         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3376         __le16 le_tmp;
3377
3378         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3379         if (!pmgntframe)
3380                 return;
3381
3382         /* update attribute */
3383         pattrib = &pmgntframe->attrib;
3384         update_mgntframe_attrib(padapter, pattrib);
3385
3386         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3387
3388         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3389         pwlanhdr = (struct ieee80211_hdr *)pframe;
3390
3391         fctrl = &(pwlanhdr->frame_control);
3392         *(fctrl) = 0;
3393
3394         if (raddr)
3395                 memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
3396         else
3397                 memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3398         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3399         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3400
3401         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3402         pmlmeext->mgnt_seq++;
3403         SetFrameSubType(pframe, WIFI_ACTION);
3404
3405         pframe += sizeof(struct ieee80211_hdr_3addr);
3406         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3407
3408         pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
3409         pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
3410
3411         switch (action) {
3412         case 0: /* SA Query req */
3413                 pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&pmlmeext->sa_query_seq, &pattrib->pktlen);
3414                 pmlmeext->sa_query_seq++;
3415                 /* send sa query request to AP, AP should reply sa query response in 1 second */
3416                 set_sa_query_timer(pmlmeext, 1000);
3417                 break;
3418
3419         case 1: /* SA Query rsp */
3420                 le_tmp = cpu_to_le16(tid);
3421                 pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&le_tmp, &pattrib->pktlen);
3422                 break;
3423         default:
3424                 break;
3425         }
3426
3427         pattrib->last_txcmdsz = pattrib->pktlen;
3428
3429         dump_mgntframe(padapter, pmgntframe);
3430 }
3431
3432 void issue_action_BA(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status)
3433 {
3434         u8 category = RTW_WLAN_CATEGORY_BACK;
3435         u16 start_seq;
3436         u16 BA_para_set;
3437         u16 reason_code;
3438         u16 BA_timeout_value;
3439         u16 BA_starting_seqctrl = 0;
3440         enum ieee80211_max_ampdu_length_exp max_rx_ampdu_factor;
3441         struct xmit_frame               *pmgntframe;
3442         struct pkt_attrib               *pattrib;
3443         u8                      *pframe;
3444         struct ieee80211_hdr    *pwlanhdr;
3445         __le16 *fctrl;
3446         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3447         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3448         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3449         struct sta_info         *psta;
3450         struct sta_priv         *pstapriv = &padapter->stapriv;
3451         struct registry_priv    *pregpriv = &padapter->registrypriv;
3452         __le16 le_tmp;
3453
3454         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3455         if (!pmgntframe)
3456                 return;
3457
3458         /* update attribute */
3459         pattrib = &pmgntframe->attrib;
3460         update_mgntframe_attrib(padapter, pattrib);
3461
3462         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3463
3464         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3465         pwlanhdr = (struct ieee80211_hdr *)pframe;
3466
3467         fctrl = &(pwlanhdr->frame_control);
3468         *(fctrl) = 0;
3469
3470         /* memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN); */
3471         memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
3472         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3473         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3474
3475         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3476         pmlmeext->mgnt_seq++;
3477         SetFrameSubType(pframe, WIFI_ACTION);
3478
3479         pframe += sizeof(struct ieee80211_hdr_3addr);
3480         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3481
3482         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
3483         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
3484
3485         if (category == 3) {
3486                 switch (action) {
3487                 case 0: /* ADDBA req */
3488                         do {
3489                                 pmlmeinfo->dialogToken++;
3490                         } while (pmlmeinfo->dialogToken == 0);
3491                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
3492
3493                         if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter)) {
3494                                 /*  A-MSDU NOT Supported */
3495                                 BA_para_set = 0;
3496                                 /*  immediate Block Ack */
3497                                 BA_para_set |= BIT(1) & IEEE80211_ADDBA_PARAM_POLICY_MASK;
3498                                 /*  TID */
3499                                 BA_para_set |= (status << 2) & IEEE80211_ADDBA_PARAM_TID_MASK;
3500                                 /*  max buffer size is 8 MSDU */
3501                                 BA_para_set |= (8 << 6) & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3502                         } else {
3503                                 BA_para_set = (0x1002 | ((status & 0xf) << 2)); /* immediate ack & 64 buffer size */
3504                         }
3505                         le_tmp = cpu_to_le16(BA_para_set);
3506                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3507
3508                         BA_timeout_value = 5000;/*  5ms */
3509                         le_tmp = cpu_to_le16(BA_timeout_value);
3510                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3511
3512                         /* if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.mac_address)) != NULL) */
3513                         psta = rtw_get_stainfo(pstapriv, raddr);
3514                         if (psta) {
3515                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
3516
3517                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
3518
3519                                 BA_starting_seqctrl = start_seq << 4;
3520                         }
3521
3522                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
3523                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3524                         break;
3525
3526                 case 1: /* ADDBA rsp */
3527                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->ADDBA_req.dialog_token), &(pattrib->pktlen));
3528                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&status), &(pattrib->pktlen));
3529                         if (padapter->driver_rx_ampdu_factor != 0xFF)
3530                                 max_rx_ampdu_factor =
3531                                   (enum ieee80211_max_ampdu_length_exp)padapter->driver_rx_ampdu_factor;
3532                         else
3533                                 rtw_hal_get_def_var(padapter,
3534                                                     HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
3535
3536                         if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_64K)
3537                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
3538                         else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_32K)
3539                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0800); /* 32 buffer size */
3540                         else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_16K)
3541                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0400); /* 16 buffer size */
3542                         else if (max_rx_ampdu_factor == IEEE80211_HT_MAX_AMPDU_8K)
3543                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0200); /* 8 buffer size */
3544                         else
3545                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
3546
3547                         if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter) &&
3548                             padapter->driver_rx_ampdu_factor == 0xFF) {
3549                                 /*  max buffer size is 8 MSDU */
3550                                 BA_para_set &= ~IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3551                                 BA_para_set |= (8 << 6) & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3552                         }
3553
3554                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
3555                                 le_tmp = cpu_to_le16(BA_para_set & ~BIT(0));
3556                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
3557                                 le_tmp = cpu_to_le16(BA_para_set | BIT(0));
3558                         else /* auto */
3559                                 le_tmp = cpu_to_le16(BA_para_set);
3560
3561                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3562                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(pmlmeinfo->ADDBA_req.BA_timeout_value)), &(pattrib->pktlen));
3563                         break;
3564                 case 2:/* DELBA */
3565                         BA_para_set = (status & 0x1F) << 3;
3566                         le_tmp = cpu_to_le16(BA_para_set);
3567                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3568
3569                         reason_code = 37;
3570                         le_tmp = cpu_to_le16(reason_code);
3571                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3572                         break;
3573                 default:
3574                         break;
3575                 }
3576         }
3577
3578         pattrib->last_txcmdsz = pattrib->pktlen;
3579
3580         dump_mgntframe(padapter, pmgntframe);
3581 }
3582
3583 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
3584 {
3585         struct list_head                *plist, *phead;
3586         unsigned char category, action;
3587         struct xmit_frame                       *pmgntframe;
3588         struct pkt_attrib                       *pattrib;
3589         unsigned char                   *pframe;
3590         struct ieee80211_hdr    *pwlanhdr;
3591         __le16 *fctrl;
3592         struct  wlan_network    *pnetwork = NULL;
3593         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3594         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
3595         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3596         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3597         struct __queue          *queue  = &(pmlmepriv->scanned_queue);
3598         u8 InfoContent[16] = {0};
3599         u8 ICS[8][15];
3600
3601         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
3602                 return;
3603
3604         if (true == pmlmeinfo->bwmode_updated)
3605                 return;
3606
3607         category = RTW_WLAN_CATEGORY_PUBLIC;
3608         action = ACT_PUBLIC_BSSCOEXIST;
3609
3610         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3611         if (!pmgntframe)
3612                 return;
3613
3614         /* update attribute */
3615         pattrib = &pmgntframe->attrib;
3616         update_mgntframe_attrib(padapter, pattrib);
3617
3618         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3619
3620         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3621         pwlanhdr = (struct ieee80211_hdr *)pframe;
3622
3623         fctrl = &(pwlanhdr->frame_control);
3624         *(fctrl) = 0;
3625
3626         memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3627         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3628         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3629
3630         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3631         pmlmeext->mgnt_seq++;
3632         SetFrameSubType(pframe, WIFI_ACTION);
3633
3634         pframe += sizeof(struct ieee80211_hdr_3addr);
3635         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3636
3637         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
3638         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
3639
3640
3641         /*  */
3642         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
3643                 u8 iedata = 0;
3644
3645                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
3646
3647                 pframe = rtw_set_ie(pframe, WLAN_EID_BSS_COEX_2040,  1, &iedata, &(pattrib->pktlen));
3648
3649         }
3650
3651
3652         /*  */
3653         memset(ICS, 0, sizeof(ICS));
3654         if (pmlmepriv->num_sta_no_ht > 0) {
3655                 int i;
3656
3657                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
3658
3659                 phead = get_list_head(queue);
3660                 plist = get_next(phead);
3661
3662                 while (1) {
3663                         int len;
3664                         u8 *p;
3665                         struct wlan_bssid_ex *pbss_network;
3666
3667                         if (phead == plist)
3668                                 break;
3669
3670                         pnetwork = container_of(plist, struct wlan_network, list);
3671
3672                         plist = get_next(plist);
3673
3674                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
3675
3676                         p = rtw_get_ie(pbss_network->ies + _FIXED_IE_LENGTH_, WLAN_EID_HT_CAPABILITY, &len, pbss_network->ie_length - _FIXED_IE_LENGTH_);
3677                         if (!p || len == 0) {/* non-HT */
3678
3679                                 if (pbss_network->configuration.ds_config <= 0)
3680                                         continue;
3681
3682                                 ICS[0][pbss_network->configuration.ds_config] = 1;
3683
3684                                 if (ICS[0][0] == 0)
3685                                         ICS[0][0] = 1;
3686                         }
3687
3688                 }
3689
3690                 spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
3691
3692
3693                 for (i = 0; i < 8; i++) {
3694                         if (ICS[i][0] == 1) {
3695                                 int j, k = 0;
3696
3697                                 InfoContent[k] = i;
3698                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
3699                                 k++;
3700
3701                                 for (j = 1; j <= 14; j++) {
3702                                         if (ICS[i][j] == 1) {
3703                                                 if (k < 16) {
3704                                                         InfoContent[k] = j; /* channel number */
3705                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
3706                                                         k++;
3707                                                 }
3708                                         }
3709                                 }
3710
3711                                 pframe = rtw_set_ie(pframe, WLAN_EID_BSS_INTOLERANT_CHL_REPORT, k, InfoContent, &(pattrib->pktlen));
3712
3713                         }
3714
3715                 }
3716
3717
3718         }
3719
3720
3721         pattrib->last_txcmdsz = pattrib->pktlen;
3722
3723         dump_mgntframe(padapter, pmgntframe);
3724 }
3725
3726 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
3727 {
3728         struct sta_priv *pstapriv = &padapter->stapriv;
3729         struct sta_info *psta = NULL;
3730         /* struct recv_reorder_ctrl *preorder_ctrl; */
3731         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3732         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3733         u16 tid;
3734
3735         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
3736                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
3737                         return _SUCCESS;
3738
3739         psta = rtw_get_stainfo(pstapriv, addr);
3740         if (!psta)
3741                 return _SUCCESS;
3742
3743         if (initiator == 0) {/*  recipient */
3744                 for (tid = 0; tid < MAXTID; tid++) {
3745                         if (psta->recvreorder_ctrl[tid].enable) {
3746                                 issue_action_BA(padapter, addr, WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
3747                                 psta->recvreorder_ctrl[tid].enable = false;
3748                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
3749                         }
3750                 }
3751         } else if (initiator == 1) {/*  originator */
3752                 for (tid = 0; tid < MAXTID; tid++) {
3753                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
3754                                 issue_action_BA(padapter, addr, WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
3755                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
3756                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
3757
3758                         }
3759                 }
3760         }
3761
3762         return _SUCCESS;
3763
3764 }
3765
3766 unsigned int send_beacon(struct adapter *padapter)
3767 {
3768         u8 bxmitok = false;
3769         int     issue = 0;
3770         int poll = 0;
3771
3772         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
3773         rtw_hal_set_hwreg(padapter, HW_VAR_DL_BCN_SEL, NULL);
3774         do {
3775                 issue_beacon(padapter, 100);
3776                 issue++;
3777                 do {
3778                         cond_resched();
3779                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
3780                         poll++;
3781                 } while ((poll%10) != 0 && false == bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
3782
3783         } while (false == bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
3784
3785         if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
3786                 return _FAIL;
3787
3788         if (!bxmitok)
3789                 return _FAIL;
3790         else
3791                 return _SUCCESS;
3792 }
3793
3794 /****************************************************************************
3795
3796 Following are some utility functions for WiFi MLME
3797
3798 *****************************************************************************/
3799
3800 void site_survey(struct adapter *padapter)
3801 {
3802         unsigned char   survey_channel = 0, val8;
3803         enum rt_scan_type       ScanType = SCAN_PASSIVE;
3804         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3805         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3806         u32 initialgain = 0;
3807         u32 channel_scan_time_ms = 0;
3808
3809         {
3810                 struct rtw_ieee80211_channel *ch;
3811
3812                 if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
3813                         ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
3814                         survey_channel = ch->hw_value;
3815                         ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
3816                 }
3817         }
3818
3819         if (survey_channel != 0) {
3820                 /* PAUSE 4-AC Queue when site_survey */
3821                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
3822                 /* val8 |= 0x0f; */
3823                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
3824                 if (pmlmeext->sitesurvey_res.channel_idx == 0) {
3825 #ifdef DBG_FIXED_CHAN
3826                         if (pmlmeext->fixed_chan != 0xff)
3827                                 set_channel_bwmode(padapter, pmlmeext->fixed_chan, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
3828                         else
3829 #endif
3830                                 set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
3831                 } else {
3832 #ifdef DBG_FIXED_CHAN
3833                         if (pmlmeext->fixed_chan != 0xff)
3834                                 SelectChannel(padapter, pmlmeext->fixed_chan);
3835                         else
3836 #endif
3837                                 SelectChannel(padapter, survey_channel);
3838                 }
3839
3840                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
3841                         {
3842                                 int i;
3843
3844                                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
3845                                         if (pmlmeext->sitesurvey_res.ssid[i].ssid_length) {
3846                                                 /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
3847                                                 if (padapter->registrypriv.wifi_spec)
3848                                                         issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
3849                                                 else
3850                                                         issue_probereq_ex(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL, 0, 0, 0, 0);
3851                                                 issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
3852                                         }
3853                                 }
3854
3855                                 if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
3856                                         /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
3857                                         if (padapter->registrypriv.wifi_spec)
3858                                                 issue_probereq(padapter, NULL, NULL);
3859                                         else
3860                                                 issue_probereq_ex(padapter, NULL, NULL, 0, 0, 0, 0);
3861                                         issue_probereq(padapter, NULL, NULL);
3862                                 }
3863                         }
3864                 }
3865
3866                 channel_scan_time_ms = pmlmeext->chan_scan_time;
3867
3868                 set_survey_timer(pmlmeext, channel_scan_time_ms);
3869         } else {
3870
3871                 /*      channel number is 0 or this channel is not valid. */
3872
3873                 {
3874                         pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
3875
3876                         /* switch back to the original channel */
3877                         /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
3878
3879                         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
3880
3881                         /* flush 4-AC Queue after site_survey */
3882                         /* val8 = 0; */
3883                         /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
3884
3885                         /* config MSR */
3886                         Set_MSR(padapter, (pmlmeinfo->state & 0x3));
3887
3888                         initialgain = 0xff; /* restore RX GAIN */
3889                         rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
3890                         /* turn on dynamic functions */
3891                         Restore_DM_Func_Flag(padapter);
3892                         /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
3893
3894                         if (is_client_associated_to_ap(padapter))
3895                                 issue_nulldata(padapter, NULL, 0, 3, 500);
3896
3897                         val8 = 0; /* survey done */
3898                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
3899
3900                         report_surveydone_event(padapter);
3901
3902                         pmlmeext->chan_scan_time = SURVEY_TO;
3903                         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
3904
3905                         issue_action_BSSCoexistPacket(padapter);
3906                         issue_action_BSSCoexistPacket(padapter);
3907                         issue_action_BSSCoexistPacket(padapter);
3908                 }
3909         }
3910
3911         return;
3912
3913 }
3914
3915 /* collect bss info from Beacon and Probe request/response frames. */
3916 u8 collect_bss_info(struct adapter *padapter, union recv_frame *precv_frame, struct wlan_bssid_ex *bssid)
3917 {
3918         int     i;
3919         u32 len;
3920         u8 *p;
3921         u16 val16, subtype;
3922         u8 *pframe = precv_frame->u.hdr.rx_data;
3923         u32 packet_len = precv_frame->u.hdr.len;
3924         u8 ie_offset;
3925         struct registry_priv *pregistrypriv = &padapter->registrypriv;
3926         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3927         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3928         __le32 le32_tmp;
3929
3930         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
3931
3932         if (len > MAX_IE_SZ)
3933                 return _FAIL;
3934
3935         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
3936
3937         subtype = GetFrameSubType(pframe);
3938
3939         if (subtype == WIFI_BEACON) {
3940                 bssid->reserved[0] = 1;
3941                 ie_offset = _BEACON_IE_OFFSET_;
3942         } else {
3943                 /*  FIXME : more type */
3944                 if (subtype == WIFI_PROBERSP) {
3945                         ie_offset = _PROBERSP_IE_OFFSET_;
3946                         bssid->reserved[0] = 3;
3947                 } else if (subtype == WIFI_PROBEREQ) {
3948                         ie_offset = _PROBEREQ_IE_OFFSET_;
3949                         bssid->reserved[0] = 2;
3950                 } else {
3951                         bssid->reserved[0] = 0;
3952                         ie_offset = _FIXED_IE_LENGTH_;
3953                 }
3954         }
3955
3956         bssid->length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
3957
3958         /* below is to copy the information element */
3959         bssid->ie_length = len;
3960         memcpy(bssid->ies, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->ie_length);
3961
3962         /* get the signal strength */
3963         bssid->rssi = precv_frame->u.hdr.attrib.phy_info.RecvSignalPower; /*  in dBM.raw data */
3964         bssid->phy_info.signal_quality = precv_frame->u.hdr.attrib.phy_info.SignalQuality;/* in percentage */
3965         bssid->phy_info.signal_strength = precv_frame->u.hdr.attrib.phy_info.SignalStrength;/* in percentage */
3966
3967         /*  checking SSID */
3968         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_SSID, &len, bssid->ie_length - ie_offset);
3969         if (!p)
3970                 return _FAIL;
3971
3972         if (*(p + 1)) {
3973                 if (len > NDIS_802_11_LENGTH_SSID)
3974                         return _FAIL;
3975
3976                 memcpy(bssid->ssid.ssid, (p + 2), *(p + 1));
3977                 bssid->ssid.ssid_length = *(p + 1);
3978         } else
3979                 bssid->ssid.ssid_length = 0;
3980
3981         memset(bssid->supported_rates, 0, NDIS_802_11_LENGTH_RATES_EX);
3982
3983         /* checking rate info... */
3984         i = 0;
3985         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_SUPP_RATES, &len, bssid->ie_length - ie_offset);
3986         if (p) {
3987                 if (len > NDIS_802_11_LENGTH_RATES_EX)
3988                         return _FAIL;
3989
3990                 memcpy(bssid->supported_rates, (p + 2), len);
3991                 i = len;
3992         }
3993
3994         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_EXT_SUPP_RATES, &len, bssid->ie_length - ie_offset);
3995         if (p) {
3996                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i))
3997                         return _FAIL;
3998
3999                 memcpy(bssid->supported_rates + i, (p + 2), len);
4000         }
4001
4002         bssid->network_type_in_use = Ndis802_11OFDM24;
4003
4004         if (bssid->ie_length < 12)
4005                 return _FAIL;
4006
4007         /*  Checking for ds_config */
4008         p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_DS_PARAMS, &len, bssid->ie_length - ie_offset);
4009
4010         bssid->configuration.ds_config = 0;
4011         bssid->configuration.length = 0;
4012
4013         if (p) {
4014                 bssid->configuration.ds_config = *(p + 2);
4015         } else {
4016                 /*  In 5G, some ap do not have DSSET IE */
4017                 /*  checking HT info for channel */
4018                 p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_HT_OPERATION, &len, bssid->ie_length - ie_offset);
4019                 if (p) {
4020                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
4021
4022                         bssid->configuration.ds_config = HT_info->primary_channel;
4023                 } else { /*  use current channel */
4024                         bssid->configuration.ds_config = rtw_get_oper_ch(padapter);
4025                 }
4026         }
4027
4028         memcpy(&le32_tmp, rtw_get_beacon_interval_from_ie(bssid->ies), 2);
4029         bssid->configuration.beacon_period = le32_to_cpu(le32_tmp);
4030
4031         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
4032
4033         if (val16 & BIT(0)) {
4034                 bssid->infrastructure_mode = Ndis802_11Infrastructure;
4035                 memcpy(bssid->mac_address, GetAddr2Ptr(pframe), ETH_ALEN);
4036         } else {
4037                 bssid->infrastructure_mode = Ndis802_11IBSS;
4038                 memcpy(bssid->mac_address, GetAddr3Ptr(pframe), ETH_ALEN);
4039         }
4040
4041         if (val16 & BIT(4))
4042                 bssid->privacy = 1;
4043         else
4044                 bssid->privacy = 0;
4045
4046         bssid->configuration.atim_window = 0;
4047
4048         /* 20/40 BSS Coexistence check */
4049         if ((pregistrypriv->wifi_spec == 1) && (false == pmlmeinfo->bwmode_updated)) {
4050                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4051
4052                 p = rtw_get_ie(bssid->ies + ie_offset, WLAN_EID_HT_CAPABILITY, &len, bssid->ie_length - ie_offset);
4053                 if (p && len > 0) {
4054                         struct HT_caps_element  *pHT_caps;
4055
4056                         pHT_caps = (struct HT_caps_element      *)(p + 2);
4057
4058                         if (le16_to_cpu(pHT_caps->u.HT_cap_element.HT_caps_info) & BIT(14))
4059                                 pmlmepriv->num_FortyMHzIntolerant++;
4060                 } else
4061                         pmlmepriv->num_sta_no_ht++;
4062         }
4063
4064         /*  mark bss info receiving from nearby channel as signal_quality 101 */
4065         if (bssid->configuration.ds_config != rtw_get_oper_ch(padapter))
4066                 bssid->phy_info.signal_quality = 101;
4067
4068         return _SUCCESS;
4069 }
4070
4071 void start_create_ibss(struct adapter *padapter)
4072 {
4073         unsigned short  caps;
4074         u8 val8;
4075         u8 join_type;
4076         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4077         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4078         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4079
4080         pmlmeext->cur_channel = (u8)pnetwork->configuration.ds_config;
4081         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
4082
4083         /* update wireless mode */
4084         update_wireless_mode(padapter);
4085
4086         /* update capability */
4087         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
4088         update_capinfo(padapter, caps);
4089         if (caps&WLAN_CAPABILITY_IBSS) {/* adhoc master */
4090                 val8 = 0xcf;
4091                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4092
4093                 rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);
4094
4095                 /* switch channel */
4096                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
4097                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
4098
4099                 beacon_timing_control(padapter);
4100
4101                 /* set msr to WIFI_FW_ADHOC_STATE */
4102                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
4103                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
4104
4105                 /* issue beacon */
4106                 if (send_beacon(padapter) == _FAIL) {
4107                         report_join_res(padapter, -1);
4108                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4109                 } else {
4110                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.mac_address);
4111                         join_type = 0;
4112                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4113
4114                         report_join_res(padapter, 1);
4115                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4116                         rtw_indicate_connect(padapter);
4117                 }
4118         } else {
4119                 return;
4120         }
4121         /* update bc/mc sta_info */
4122         update_bmc_sta(padapter);
4123
4124 }
4125
4126 void start_clnt_join(struct adapter *padapter)
4127 {
4128         unsigned short  caps;
4129         u8 val8;
4130         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4131         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4132         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4133         int beacon_timeout;
4134
4135         /* update wireless mode */
4136         update_wireless_mode(padapter);
4137
4138         /* update capability */
4139         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
4140         update_capinfo(padapter, caps);
4141         if (caps&WLAN_CAPABILITY_ESS) {
4142                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
4143
4144                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
4145
4146                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4147
4148                 /*  Because of AP's not receiving deauth before */
4149                 /*  AP may: 1)not response auth or 2)deauth us after link is complete */
4150                 /*  issue deauth before issuing auth to deal with the situation */
4151
4152                 /*      Commented by Albert 2012/07/21 */
4153                 /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
4154                 {
4155                                 /* To avoid connecting to AP fail during resume process, change retry count from 5 to 1 */
4156                                 issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
4157                 }
4158
4159                 /* here wait for receiving the beacon to start auth */
4160                 /* and enable a timer */
4161                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
4162                 set_link_timer(pmlmeext, beacon_timeout);
4163                 _set_timer(&padapter->mlmepriv.assoc_timer,
4164                         (REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO*REASSOC_LIMIT) + beacon_timeout);
4165
4166                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
4167         } else if (caps&WLAN_CAPABILITY_IBSS) { /* adhoc client */
4168                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
4169
4170                 val8 = 0xcf;
4171                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4172
4173                 beacon_timing_control(padapter);
4174
4175                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
4176
4177                 report_join_res(padapter, 1);
4178         } else {
4179                 return;
4180         }
4181
4182 }
4183
4184 void start_clnt_auth(struct adapter *padapter)
4185 {
4186         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4187         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4188
4189         del_timer_sync(&pmlmeext->link_timer);
4190
4191         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
4192         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
4193
4194         pmlmeinfo->auth_seq = 1;
4195         pmlmeinfo->reauth_count = 0;
4196         pmlmeinfo->reassoc_count = 0;
4197         pmlmeinfo->link_count = 0;
4198         pmlmeext->retry = 0;
4199
4200
4201         netdev_dbg(padapter->pnetdev, "start auth\n");
4202         issue_auth(padapter, NULL, 0);
4203
4204         set_link_timer(pmlmeext, REAUTH_TO);
4205
4206 }
4207
4208
4209 void start_clnt_assoc(struct adapter *padapter)
4210 {
4211         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4212         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4213
4214         del_timer_sync(&pmlmeext->link_timer);
4215
4216         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
4217         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
4218
4219         issue_assocreq(padapter);
4220
4221         set_link_timer(pmlmeext, REASSOC_TO);
4222 }
4223
4224 unsigned int receive_disconnect(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4225 {
4226         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4227         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4228
4229         /* check A3 */
4230         if (!(!memcmp(MacAddr, get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
4231                 return _SUCCESS;
4232
4233         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4234                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
4235                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4236                         report_del_sta_event(padapter, MacAddr, reason);
4237
4238                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
4239                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4240                         report_join_res(padapter, -2);
4241                 }
4242         }
4243
4244         return _SUCCESS;
4245 }
4246
4247 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
4248 {
4249         struct registry_priv *pregistrypriv;
4250         struct mlme_ext_priv *pmlmeext;
4251         struct rt_channel_info *chplan_new;
4252         u8 channel;
4253         u8 i;
4254
4255
4256         pregistrypriv = &padapter->registrypriv;
4257         pmlmeext = &padapter->mlmeextpriv;
4258
4259         /*  Adjust channel plan by AP Country IE */
4260         if (pregistrypriv->enable80211d &&
4261                 (!pmlmeext->update_channel_plan_by_ap_done)) {
4262                 u8 *ie, *p;
4263                 u32 len;
4264                 struct rt_channel_plan chplan_ap;
4265                 struct rt_channel_info chplan_sta[MAX_CHANNEL_NUM];
4266                 u8 country[4];
4267                 u8 fcn; /*  first channel number */
4268                 u8 noc; /*  number of channel */
4269                 u8 j, k;
4270
4271                 ie = rtw_get_ie(bssid->ies + _FIXED_IE_LENGTH_, WLAN_EID_COUNTRY, &len, bssid->ie_length - _FIXED_IE_LENGTH_);
4272                 if (!ie)
4273                         return;
4274                 if (len < 6)
4275                         return;
4276
4277                 ie += 2;
4278                 p = ie;
4279                 ie += len;
4280
4281                 memset(country, 0, 4);
4282                 memcpy(country, p, 3);
4283                 p += 3;
4284
4285                 i = 0;
4286                 while ((ie - p) >= 3) {
4287                         fcn = *(p++);
4288                         noc = *(p++);
4289                         p++;
4290
4291                         for (j = 0; j < noc; j++) {
4292                                 if (fcn <= 14)
4293                                         channel = fcn + j; /*  2.4 GHz */
4294                                 else
4295                                         channel = fcn + j*4; /*  5 GHz */
4296
4297                                 chplan_ap.Channel[i++] = channel;
4298                         }
4299                 }
4300                 chplan_ap.Len = i;
4301
4302                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
4303
4304                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
4305                 chplan_new = pmlmeext->channel_set;
4306
4307                 i = j = k = 0;
4308                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
4309                         do {
4310                                 if ((i == MAX_CHANNEL_NUM) ||
4311                                         (chplan_sta[i].ChannelNum == 0) ||
4312                                         (chplan_sta[i].ChannelNum > 14))
4313                                         break;
4314
4315                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
4316                                         break;
4317
4318                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
4319                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4320                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4321                                         i++;
4322                                         j++;
4323                                         k++;
4324                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
4325                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4326 /*                                      chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4327                                         chplan_new[k].ScanType = SCAN_PASSIVE;
4328                                         i++;
4329                                         k++;
4330                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
4331                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4332                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4333                                         j++;
4334                                         k++;
4335                                 }
4336                         } while (1);
4337
4338                         /*  change AP not support channel to Passive scan */
4339                         while ((i < MAX_CHANNEL_NUM) &&
4340                                 (chplan_sta[i].ChannelNum != 0) &&
4341                                 (chplan_sta[i].ChannelNum <= 14)) {
4342
4343                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4344 /*                              chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4345                                 chplan_new[k].ScanType = SCAN_PASSIVE;
4346                                 i++;
4347                                 k++;
4348                         }
4349
4350                         /*  add channel AP supported */
4351                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
4352                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4353                                 chplan_new[k].ScanType = SCAN_ACTIVE;
4354                                 j++;
4355                                 k++;
4356                         }
4357                 } else {
4358                         /*  keep original STA 2.4G channel plan */
4359                         while ((i < MAX_CHANNEL_NUM) &&
4360                                 (chplan_sta[i].ChannelNum != 0) &&
4361                                 (chplan_sta[i].ChannelNum <= 14)) {
4362                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4363                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
4364                                 i++;
4365                                 k++;
4366                         }
4367
4368                         /*  skip AP 2.4G channel plan */
4369                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14))
4370                                 j++;
4371                 }
4372
4373                 pmlmeext->update_channel_plan_by_ap_done = 1;
4374         }
4375
4376         /*  If channel is used by AP, set channel scan type to active */
4377         channel = bssid->configuration.ds_config;
4378         chplan_new = pmlmeext->channel_set;
4379         i = 0;
4380         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
4381                 if (chplan_new[i].ChannelNum == channel) {
4382                         if (chplan_new[i].ScanType == SCAN_PASSIVE)
4383                                 chplan_new[i].ScanType = SCAN_ACTIVE;
4384                         break;
4385                 }
4386                 i++;
4387         }
4388 }
4389
4390 /****************************************************************************
4391
4392 Following are the functions to report events
4393
4394 *****************************************************************************/
4395
4396 void report_survey_event(struct adapter *padapter, union recv_frame *precv_frame)
4397 {
4398         struct cmd_obj *pcmd_obj;
4399         u8 *pevtcmd;
4400         u32 cmdsz;
4401         struct survey_event     *psurvey_evt;
4402         struct C2HEvent_Header *pc2h_evt_hdr;
4403         struct mlme_ext_priv *pmlmeext;
4404         struct cmd_priv *pcmdpriv;
4405         /* u8 *pframe = precv_frame->u.hdr.rx_data; */
4406         /* uint len = precv_frame->u.hdr.len; */
4407
4408         if (!padapter)
4409                 return;
4410
4411         pmlmeext = &padapter->mlmeextpriv;
4412         pcmdpriv = &padapter->cmdpriv;
4413
4414         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4415         if (!pcmd_obj)
4416                 return;
4417
4418         cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
4419         pevtcmd = rtw_zmalloc(cmdsz);
4420         if (!pevtcmd) {
4421                 kfree(pcmd_obj);
4422                 return;
4423         }
4424
4425         INIT_LIST_HEAD(&pcmd_obj->list);
4426
4427         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4428         pcmd_obj->cmdsz = cmdsz;
4429         pcmd_obj->parmbuf = pevtcmd;
4430
4431         pcmd_obj->rsp = NULL;
4432         pcmd_obj->rspsz  = 0;
4433
4434         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4435         pc2h_evt_hdr->len = sizeof(struct survey_event);
4436         pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
4437         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4438
4439         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4440
4441         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
4442                 kfree(pcmd_obj);
4443                 kfree(pevtcmd);
4444                 return;
4445         }
4446
4447         process_80211d(padapter, &psurvey_evt->bss);
4448
4449         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4450
4451         pmlmeext->sitesurvey_res.bss_cnt++;
4452
4453         return;
4454
4455 }
4456
4457 void report_surveydone_event(struct adapter *padapter)
4458 {
4459         struct cmd_obj *pcmd_obj;
4460         u8 *pevtcmd;
4461         u32 cmdsz;
4462         struct surveydone_event *psurveydone_evt;
4463         struct C2HEvent_Header  *pc2h_evt_hdr;
4464         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4465         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4466
4467         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4468         if (!pcmd_obj)
4469                 return;
4470
4471         cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));
4472         pevtcmd = rtw_zmalloc(cmdsz);
4473         if (!pevtcmd) {
4474                 kfree(pcmd_obj);
4475                 return;
4476         }
4477
4478         INIT_LIST_HEAD(&pcmd_obj->list);
4479
4480         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4481         pcmd_obj->cmdsz = cmdsz;
4482         pcmd_obj->parmbuf = pevtcmd;
4483
4484         pcmd_obj->rsp = NULL;
4485         pcmd_obj->rspsz  = 0;
4486
4487         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4488         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
4489         pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
4490         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4491
4492         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4493         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
4494
4495         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4496
4497         return;
4498
4499 }
4500
4501 void report_join_res(struct adapter *padapter, int res)
4502 {
4503         struct cmd_obj *pcmd_obj;
4504         u8 *pevtcmd;
4505         u32 cmdsz;
4506         struct joinbss_event            *pjoinbss_evt;
4507         struct C2HEvent_Header  *pc2h_evt_hdr;
4508         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4509         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4510         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4511
4512         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4513         if (!pcmd_obj)
4514                 return;
4515
4516         cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
4517         pevtcmd = rtw_zmalloc(cmdsz);
4518         if (!pevtcmd) {
4519                 kfree(pcmd_obj);
4520                 return;
4521         }
4522
4523         INIT_LIST_HEAD(&pcmd_obj->list);
4524
4525         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4526         pcmd_obj->cmdsz = cmdsz;
4527         pcmd_obj->parmbuf = pevtcmd;
4528
4529         pcmd_obj->rsp = NULL;
4530         pcmd_obj->rspsz  = 0;
4531
4532         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4533         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
4534         pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
4535         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4536
4537         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4538         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
4539         pjoinbss_evt->network.join_res  = pjoinbss_evt->network.aid = res;
4540
4541
4542         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
4543
4544
4545         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4546
4547         return;
4548
4549 }
4550
4551 void report_wmm_edca_update(struct adapter *padapter)
4552 {
4553         struct cmd_obj *pcmd_obj;
4554         u8 *pevtcmd;
4555         u32 cmdsz;
4556         struct wmm_event                *pwmm_event;
4557         struct C2HEvent_Header  *pc2h_evt_hdr;
4558         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4559         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4560
4561         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4562         if (!pcmd_obj)
4563                 return;
4564
4565         cmdsz = (sizeof(struct wmm_event) + sizeof(struct C2HEvent_Header));
4566         pevtcmd = rtw_zmalloc(cmdsz);
4567         if (!pevtcmd) {
4568                 kfree(pcmd_obj);
4569                 return;
4570         }
4571
4572         INIT_LIST_HEAD(&pcmd_obj->list);
4573
4574         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4575         pcmd_obj->cmdsz = cmdsz;
4576         pcmd_obj->parmbuf = pevtcmd;
4577
4578         pcmd_obj->rsp = NULL;
4579         pcmd_obj->rspsz  = 0;
4580
4581         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4582         pc2h_evt_hdr->len = sizeof(struct wmm_event);
4583         pc2h_evt_hdr->ID = GEN_EVT_CODE(_WMM);
4584         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4585
4586         pwmm_event = (struct wmm_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4587         pwmm_event->wmm = 0;
4588
4589         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4590
4591         return;
4592
4593 }
4594
4595 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4596 {
4597         struct cmd_obj *pcmd_obj;
4598         u8 *pevtcmd;
4599         u32 cmdsz;
4600         struct sta_info *psta;
4601         int     mac_id;
4602         struct stadel_event                     *pdel_sta_evt;
4603         struct C2HEvent_Header  *pc2h_evt_hdr;
4604         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4605         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4606
4607         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4608         if (!pcmd_obj)
4609                 return;
4610
4611         cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
4612         pevtcmd = rtw_zmalloc(cmdsz);
4613         if (!pevtcmd) {
4614                 kfree(pcmd_obj);
4615                 return;
4616         }
4617
4618         INIT_LIST_HEAD(&pcmd_obj->list);
4619
4620         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4621         pcmd_obj->cmdsz = cmdsz;
4622         pcmd_obj->parmbuf = pevtcmd;
4623
4624         pcmd_obj->rsp = NULL;
4625         pcmd_obj->rspsz  = 0;
4626
4627         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4628         pc2h_evt_hdr->len = sizeof(struct stadel_event);
4629         pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
4630         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4631
4632         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4633         memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
4634         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
4635
4636
4637         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
4638         if (psta)
4639                 mac_id = (int)psta->mac_id;
4640         else
4641                 mac_id = (-1);
4642
4643         pdel_sta_evt->mac_id = mac_id;
4644
4645         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4646 }
4647
4648 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
4649 {
4650         struct cmd_obj *pcmd_obj;
4651         u8 *pevtcmd;
4652         u32 cmdsz;
4653         struct stassoc_event            *padd_sta_evt;
4654         struct C2HEvent_Header  *pc2h_evt_hdr;
4655         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4656         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
4657
4658         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
4659         if (!pcmd_obj)
4660                 return;
4661
4662         cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
4663         pevtcmd = rtw_zmalloc(cmdsz);
4664         if (!pevtcmd) {
4665                 kfree(pcmd_obj);
4666                 return;
4667         }
4668
4669         INIT_LIST_HEAD(&pcmd_obj->list);
4670
4671         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
4672         pcmd_obj->cmdsz = cmdsz;
4673         pcmd_obj->parmbuf = pevtcmd;
4674
4675         pcmd_obj->rsp = NULL;
4676         pcmd_obj->rspsz  = 0;
4677
4678         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
4679         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
4680         pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
4681         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
4682
4683         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
4684         memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
4685         padd_sta_evt->cam_id = cam_idx;
4686
4687         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
4688 }
4689
4690 /****************************************************************************
4691
4692 Following are the event callback functions
4693
4694 *****************************************************************************/
4695
4696 /* for sta/adhoc mode */
4697 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
4698 {
4699         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
4700         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4701         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4702
4703         /* ERP */
4704         VCS_update(padapter, psta);
4705
4706         /* HT */
4707         if (pmlmepriv->htpriv.ht_option) {
4708                 psta->htpriv.ht_option = true;
4709
4710                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
4711
4712                 psta->htpriv.rx_ampdu_min_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para&IEEE80211_HT_CAP_AMPDU_DENSITY)>>2;
4713
4714                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_20))
4715                         psta->htpriv.sgi_20m = true;
4716
4717                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_40))
4718                         psta->htpriv.sgi_40m = true;
4719
4720                 psta->qos_option = true;
4721
4722                 psta->htpriv.ldpc_cap = pmlmepriv->htpriv.ldpc_cap;
4723                 psta->htpriv.stbc_cap = pmlmepriv->htpriv.stbc_cap;
4724                 psta->htpriv.beamform_cap = pmlmepriv->htpriv.beamform_cap;
4725
4726                 memcpy(&psta->htpriv.ht_cap, &pmlmeinfo->HT_caps, sizeof(struct ieee80211_ht_cap));
4727         } else {
4728                 psta->htpriv.ht_option = false;
4729
4730                 psta->htpriv.ampdu_enable = false;
4731
4732                 psta->htpriv.sgi_20m = false;
4733                 psta->htpriv.sgi_40m = false;
4734                 psta->qos_option = false;
4735
4736         }
4737
4738         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
4739
4740         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
4741         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
4742
4743         psta->bw_mode = pmlmeext->cur_bwmode;
4744
4745         /* QoS */
4746         if (pmlmepriv->qospriv.qos_option)
4747                 psta->qos_option = true;
4748
4749         update_ldpc_stbc_cap(psta);
4750
4751         spin_lock_bh(&psta->lock);
4752         psta->state = _FW_LINKED;
4753         spin_unlock_bh(&psta->lock);
4754
4755 }
4756
4757 static void rtw_mlmeext_disconnect(struct adapter *padapter)
4758 {
4759         struct mlme_priv        *pmlmepriv = &padapter->mlmepriv;
4760         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4761         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4762         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4763
4764         /* set_opmode_cmd(padapter, infra_client_with_mlme); */
4765
4766         /* For safety, prevent from keeping macid sleep.
4767          * If we can sure all power mode enter/leave are paired,
4768          * this check can be removed.
4769          * Lucas@20131113
4770          */
4771         /* wakeup macid after disconnect. */
4772         {
4773                 struct sta_info *psta;
4774
4775                 psta = rtw_get_stainfo(&padapter->stapriv, get_my_bssid(pnetwork));
4776                 if (psta)
4777                         rtw_hal_macid_wakeup(padapter, psta->mac_id);
4778         }
4779
4780         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
4781         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4782
4783         /* set MSR to no link state -> infra. mode */
4784         Set_MSR(padapter, _HW_STATE_STATION_);
4785
4786         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4787
4788         /* switch to the 20M Hz mode after disconnect */
4789         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
4790         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
4791
4792         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4793
4794         flush_all_cam_entry(padapter);
4795
4796         del_timer_sync(&pmlmeext->link_timer);
4797
4798         /* pmlmepriv->LinkDetectInfo.TrafficBusyState = false; */
4799         pmlmepriv->LinkDetectInfo.TrafficTransitionCount = 0;
4800         pmlmepriv->LinkDetectInfo.LowPowerTransitionCount = 0;
4801
4802 }
4803
4804 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
4805 {
4806         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4807         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4808         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
4809         struct sta_priv         *pstapriv = &padapter->stapriv;
4810         u8 join_type;
4811         struct sta_info *psta;
4812
4813         if (join_res < 0) {
4814                 join_type = 1;
4815                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4816                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
4817
4818                 return;
4819         }
4820
4821         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
4822                 /* update bc/mc sta_info */
4823                 update_bmc_sta(padapter);
4824
4825
4826         /* turn on dynamic functions */
4827         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
4828
4829         /*  update IOT-related issue */
4830         update_IOT_info(padapter);
4831
4832         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->supported_rates);
4833
4834         /* BCN interval */
4835         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
4836
4837         /* update capability */
4838         update_capinfo(padapter, pmlmeinfo->capability);
4839
4840         /* WMM, Update EDCA param */
4841         WMMOnAssocRsp(padapter);
4842
4843         /* HT */
4844         HTOnAssocRsp(padapter);
4845
4846         /* Set cur_channel&cur_bwmode&cur_ch_offset */
4847         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4848
4849         psta = rtw_get_stainfo(pstapriv, cur_network->mac_address);
4850         if (psta) { /* only for infra. mode */
4851
4852                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4853
4854                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
4855
4856                 /* set per sta rate after updating HT cap. */
4857                 set_sta_rate(padapter, psta);
4858
4859                 rtw_sta_media_status_rpt(padapter, psta, 1);
4860
4861                 /* wakeup macid after join bss successfully to ensure
4862                         the subsequent data frames can be sent out normally */
4863                 rtw_hal_macid_wakeup(padapter, psta->mac_id);
4864         }
4865
4866         join_type = 2;
4867         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4868
4869         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4870                 /*  correcting TSF */
4871                 correct_TSF(padapter, pmlmeext);
4872
4873                 /* set_link_timer(pmlmeext, DISCONNECT_TO); */
4874         }
4875
4876         if (get_iface_type(padapter) == IFACE_PORT0)
4877                 rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
4878 }
4879
4880 /* currently only adhoc mode will go here */
4881 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
4882 {
4883         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
4884         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4885         u8 join_type;
4886
4887         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
4888                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) { /* adhoc master or sta_count>1 */
4889
4890                         /* nothing to do */
4891                 } else { /* adhoc client */
4892                         /* update TSF Value */
4893                         /* update_TSF(pmlmeext, pframe, len); */
4894
4895                         /*  correcting TSF */
4896                         correct_TSF(padapter, pmlmeext);
4897
4898                         /* start beacon */
4899                         if (send_beacon(padapter) == _FAIL) {
4900                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
4901
4902                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
4903
4904                                 return;
4905                         }
4906
4907                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4908
4909                 }
4910
4911                 join_type = 2;
4912                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4913         }
4914
4915         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
4916
4917         psta->bssratelen = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates);
4918         memcpy(psta->bssrateset, pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates, psta->bssratelen);
4919
4920         /* update adhoc sta_info */
4921         update_sta_info(padapter, psta);
4922
4923         rtw_hal_update_sta_rate_mask(padapter, psta);
4924
4925         /*  ToDo: HT for Ad-hoc */
4926         psta->wireless_mode = rtw_check_network_type(psta->bssrateset, psta->bssratelen, pmlmeext->cur_channel);
4927         psta->raid = networktype_to_raid_ex(padapter, psta);
4928
4929         /* rate radaptive */
4930         Update_RA_Entry(padapter, psta);
4931 }
4932
4933 void mlmeext_sta_del_event_callback(struct adapter *padapter)
4934 {
4935         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter))
4936                 rtw_mlmeext_disconnect(padapter);
4937 }
4938
4939 /****************************************************************************
4940
4941 Following are the functions for the timer handlers
4942
4943 *****************************************************************************/
4944 void _linked_info_dump(struct adapter *padapter)
4945 {
4946         int i;
4947         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
4948         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
4949         int UndecoratedSmoothedPWDB;
4950         struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);
4951
4952         if (padapter->bLinkInfoDump) {
4953
4954                 if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
4955                         rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
4956
4957                 for (i = 0; i < NUM_STA; i++) {
4958                         if (pdvobj->macid[i]) {
4959                                 if (i != 1) /* skip bc/mc sta */
4960                                         /*   tx info ============ */
4961                                         rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &i);
4962                         }
4963                 }
4964                 rtw_hal_set_def_var(padapter, HAL_DEF_DBG_RX_INFO_DUMP, NULL);
4965         }
4966 }
4967
4968 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
4969 {
4970         u8 ret = false;
4971
4972         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta))
4973                 && sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta)
4974                 && sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta)
4975         ) {
4976                 ret = false;
4977         } else {
4978                 ret = true;
4979         }
4980
4981         sta_update_last_rx_pkts(psta);
4982
4983         return ret;
4984 }
4985
4986 void linked_status_chk(struct adapter *padapter)
4987 {
4988         u32 i;
4989         struct sta_info         *psta;
4990         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
4991         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4992         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4993         struct sta_priv         *pstapriv = &padapter->stapriv;
4994
4995
4996         if (is_client_associated_to_ap(padapter)) {
4997                 /* linked infrastructure client mode */
4998
4999                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
5000                 int rx_chk_limit;
5001                 int link_count_limit;
5002
5003                 #if defined(DBG_ROAMING_TEST)
5004                 rx_chk_limit = 1;
5005                 #else
5006                 rx_chk_limit = 8;
5007                 #endif
5008                 link_count_limit = 7; /*  16 sec */
5009
5010                 /*  Marked by Kurt 20130715 */
5011                 /*  For WiDi 3.5 and latered on, they don't ask WiDi sink to do roaming, so we could not check rx limit that strictly. */
5012                 /*  todo: To check why we under miracast session, rx_chk would be false */
5013                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.mac_address);
5014                 if (psta) {
5015                         if (chk_ap_is_alive(padapter, psta) == false)
5016                                 rx_chk = _FAIL;
5017
5018                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
5019                                 tx_chk = _FAIL;
5020
5021                         {
5022                                 if (rx_chk != _SUCCESS) {
5023                                         if (pmlmeext->retry == 0) {
5024                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, pmlmeinfo->network.mac_address, 0, 0, 0, 0);
5025                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, pmlmeinfo->network.mac_address, 0, 0, 0, 0);
5026                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.ssid, pmlmeinfo->network.mac_address, 0, 0, 0, 0);
5027                                         }
5028                                 }
5029
5030                                 if (tx_chk != _SUCCESS &&
5031                                     pmlmeinfo->link_count++ == link_count_limit)
5032                                         tx_chk = issue_nulldata_in_interrupt(padapter, NULL);
5033                         }
5034
5035                         if (rx_chk == _FAIL) {
5036                                 pmlmeext->retry++;
5037                                 if (pmlmeext->retry > rx_chk_limit) {
5038                                         netdev_dbg(padapter->pnetdev,
5039                                                    FUNC_ADPT_FMT " disconnect or roaming\n",
5040                                                    FUNC_ADPT_ARG(padapter));
5041                                         receive_disconnect(padapter, pmlmeinfo->network.mac_address
5042                                                 , WLAN_REASON_EXPIRATION_CHK);
5043                                         return;
5044                                 }
5045                         } else {
5046                                 pmlmeext->retry = 0;
5047                         }
5048
5049                         if (tx_chk == _FAIL) {
5050                                 pmlmeinfo->link_count %= (link_count_limit+1);
5051                         } else {
5052                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
5053                                 pmlmeinfo->link_count = 0;
5054                         }
5055
5056                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.mac_address)) != NULL) */
5057         } else if (is_client_associated_to_ibss(padapter)) {
5058                 /* linked IBSS mode */
5059                 /* for each assoc list entry to check the rx pkt counter */
5060                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
5061                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
5062                                 psta = pmlmeinfo->FW_sta_info[i].psta;
5063
5064                                 if (psta == NULL)
5065                                         continue;
5066
5067                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
5068
5069                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
5070                                                 pmlmeinfo->FW_sta_info[i].retry++;
5071                                         } else {
5072                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
5073                                                 pmlmeinfo->FW_sta_info[i].status = 0;
5074                                                 report_del_sta_event(padapter, psta->hwaddr
5075                                                         , 65535/*  indicate disconnect caused by no rx */
5076                                                 );
5077                                         }
5078                                 } else {
5079                                         pmlmeinfo->FW_sta_info[i].retry = 0;
5080                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
5081                                 }
5082                         }
5083                 }
5084
5085                 /* set_link_timer(pmlmeext, DISCONNECT_TO); */
5086
5087         }
5088
5089 }
5090
5091 void survey_timer_hdl(struct timer_list *t)
5092 {
5093         struct adapter *padapter =
5094                 from_timer(padapter, t, mlmeextpriv.survey_timer);
5095         struct cmd_obj  *ph2c;
5096         struct sitesurvey_parm  *psurveyPara;
5097         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
5098         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5099
5100         /* issue rtw_sitesurvey_cmd */
5101         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
5102                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS)
5103                         pmlmeext->sitesurvey_res.channel_idx++;
5104
5105                 if (pmlmeext->scan_abort) {
5106                         pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
5107
5108                         pmlmeext->scan_abort = false;/* reset */
5109                 }
5110
5111                 ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5112                 if (!ph2c)
5113                         return;
5114
5115                 psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));
5116                 if (!psurveyPara) {
5117                         kfree(ph2c);
5118                         return;
5119                 }
5120
5121                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
5122                 rtw_enqueue_cmd(pcmdpriv, ph2c);
5123         }
5124 }
5125
5126 void link_timer_hdl(struct timer_list *t)
5127 {
5128         struct adapter *padapter =
5129                 from_timer(padapter, t, mlmeextpriv.link_timer);
5130         /* static unsigned int          rx_pkt = 0; */
5131         /* static u64                           tx_cnt = 0; */
5132         /* struct xmit_priv     *pxmitpriv = &(padapter->xmitpriv); */
5133         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5134         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5135         /* struct sta_priv      *pstapriv = &padapter->stapriv; */
5136
5137
5138         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
5139                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5140                 report_join_res(padapter, -3);
5141         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
5142                 /* re-auth timer */
5143                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
5144                         pmlmeinfo->state = 0;
5145                         report_join_res(padapter, -1);
5146                         return;
5147                 }
5148
5149                 pmlmeinfo->auth_seq = 1;
5150                 issue_auth(padapter, NULL, 0);
5151                 set_link_timer(pmlmeext, REAUTH_TO);
5152         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
5153                 /* re-assoc timer */
5154                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
5155                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5156                         report_join_res(padapter, -2);
5157                         return;
5158                 }
5159
5160                 issue_assocreq(padapter);
5161                 set_link_timer(pmlmeext, REASSOC_TO);
5162         }
5163 }
5164
5165 void addba_timer_hdl(struct timer_list *t)
5166 {
5167         struct sta_info *psta = from_timer(psta, t, addba_retry_timer);
5168         struct ht_priv *phtpriv;
5169
5170         if (!psta)
5171                 return;
5172
5173         phtpriv = &psta->htpriv;
5174
5175         if (phtpriv->ht_option && phtpriv->ampdu_enable) {
5176                 if (phtpriv->candidate_tid_bitmap)
5177                         phtpriv->candidate_tid_bitmap = 0x0;
5178
5179         }
5180 }
5181
5182 void sa_query_timer_hdl(struct timer_list *t)
5183 {
5184         struct adapter *padapter =
5185                 from_timer(padapter, t, mlmeextpriv.sa_query_timer);
5186         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
5187         /* disconnect */
5188         spin_lock_bh(&pmlmepriv->lock);
5189
5190         if (check_fwstate(pmlmepriv, _FW_LINKED)) {
5191                 rtw_disassoc_cmd(padapter, 0, true);
5192                 rtw_indicate_disconnect(padapter);
5193                 rtw_free_assoc_resources(padapter, 1);
5194         }
5195
5196         spin_unlock_bh(&pmlmepriv->lock);
5197 }
5198
5199 u8 NULL_hdl(struct adapter *padapter, u8 *pbuf)
5200 {
5201         return H2C_SUCCESS;
5202 }
5203
5204 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
5205 {
5206         u8 type;
5207         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5208         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5209         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
5210
5211         if (psetop->mode == Ndis802_11APMode) {
5212                 pmlmeinfo->state = WIFI_FW_AP_STATE;
5213                 type = _HW_STATE_AP_;
5214                 /* start_ap_mode(padapter); */
5215         } else if (psetop->mode == Ndis802_11Infrastructure) {
5216                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
5217                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
5218                 type = _HW_STATE_STATION_;
5219         } else if (psetop->mode == Ndis802_11IBSS) {
5220                 type = _HW_STATE_ADHOC_;
5221         } else {
5222                 type = _HW_STATE_NOLINK_;
5223         }
5224
5225         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
5226         /* Set_MSR(padapter, type); */
5227
5228         if (psetop->mode == Ndis802_11APMode) {
5229                 /*  Do this after port switch to */
5230                 /*  prevent from downloading rsvd page to wrong port */
5231                 rtw_btcoex_MediaStatusNotify(padapter, 1); /* connect */
5232         }
5233
5234         return H2C_SUCCESS;
5235
5236 }
5237
5238 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
5239 {
5240         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5241         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5242         struct wlan_bssid_ex    *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5243         struct joinbss_parm *pparm = (struct joinbss_parm *)pbuf;
5244         /* u32 initialgain; */
5245
5246         if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
5247                 start_bss_network(padapter);
5248                 return H2C_SUCCESS;
5249         }
5250
5251         /* below is for ad-hoc master */
5252         if (pparm->network.infrastructure_mode == Ndis802_11IBSS) {
5253                 rtw_joinbss_reset(padapter);
5254
5255                 pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5256                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5257                 pmlmeinfo->ERP_enable = 0;
5258                 pmlmeinfo->WMM_enable = 0;
5259                 pmlmeinfo->HT_enable = 0;
5260                 pmlmeinfo->HT_caps_enable = 0;
5261                 pmlmeinfo->HT_info_enable = 0;
5262                 pmlmeinfo->agg_enable_bitmap = 0;
5263                 pmlmeinfo->candidate_tid_bitmap = 0;
5264
5265                 /* disable dynamic functions, such as high power, DIG */
5266                 Save_DM_Func_Flag(padapter);
5267                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5268
5269                 /* config the initial gain under linking, need to write the BB registers */
5270                 /* initialgain = 0x1E; */
5271                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
5272
5273                 /* cancel link timer */
5274                 del_timer_sync(&pmlmeext->link_timer);
5275
5276                 /* clear CAM */
5277                 flush_all_cam_entry(padapter);
5278
5279                 memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, ie_length));
5280                 pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
5281
5282                 if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
5283                         return H2C_PARAMETERS_ERROR;
5284
5285                 memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
5286
5287                 start_create_ibss(padapter);
5288
5289         }
5290
5291         return H2C_SUCCESS;
5292
5293 }
5294
5295 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5296 {
5297         u8 join_type;
5298         struct ndis_80211_var_ie *pIE;
5299         struct registry_priv *pregpriv = &padapter->registrypriv;
5300         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5301         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5302         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5303         u32 i;
5304         u8 cbw40_enable = 0;
5305         /* u32 initialgain; */
5306         /* u32 acparm; */
5307         u8 ch, bw, offset;
5308
5309         /* check already connecting to AP or not */
5310         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
5311                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE)
5312                         issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
5313                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5314
5315                 /* clear CAM */
5316                 flush_all_cam_entry(padapter);
5317
5318                 del_timer_sync(&pmlmeext->link_timer);
5319
5320                 /* set MSR to nolink -> infra. mode */
5321                 /* Set_MSR(padapter, _HW_STATE_NOLINK_); */
5322                 Set_MSR(padapter, _HW_STATE_STATION_);
5323
5324
5325                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5326         }
5327
5328         rtw_joinbss_reset(padapter);
5329
5330         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5331         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5332         pmlmeinfo->ERP_enable = 0;
5333         pmlmeinfo->WMM_enable = 0;
5334         pmlmeinfo->HT_enable = 0;
5335         pmlmeinfo->HT_caps_enable = 0;
5336         pmlmeinfo->HT_info_enable = 0;
5337         pmlmeinfo->agg_enable_bitmap = 0;
5338         pmlmeinfo->candidate_tid_bitmap = 0;
5339         pmlmeinfo->bwmode_updated = false;
5340         /* pmlmeinfo->assoc_AP_vendor = HT_IOT_PEER_MAX; */
5341         pmlmeinfo->VHT_enable = 0;
5342
5343         memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, ie_length));
5344         pnetwork->ie_length = ((struct wlan_bssid_ex *)pbuf)->ie_length;
5345
5346         if (pnetwork->ie_length > MAX_IE_SZ)/* Check pbuf->ie_length */
5347                 return H2C_PARAMETERS_ERROR;
5348
5349         memcpy(pnetwork->ies, ((struct wlan_bssid_ex *)pbuf)->ies, pnetwork->ie_length);
5350
5351         pmlmeext->cur_channel = (u8)pnetwork->configuration.ds_config;
5352         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
5353
5354         /* Check AP vendor to move rtw_joinbss_cmd() */
5355         /* pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->ies, pnetwork->ie_length); */
5356
5357         /* sizeof(struct ndis_802_11_fix_ie) */
5358         for (i = _FIXED_IE_LENGTH_; i < pnetwork->ie_length;) {
5359                 pIE = (struct ndis_80211_var_ie *)(pnetwork->ies + i);
5360
5361                 switch (pIE->element_id) {
5362                 case WLAN_EID_VENDOR_SPECIFIC:/* Get WMM IE. */
5363                         if (!memcmp(pIE->data, WMM_OUI, 4))
5364                                 WMM_param_handler(padapter, pIE);
5365                         break;
5366
5367                 case WLAN_EID_HT_CAPABILITY:    /* Get HT Cap IE. */
5368                         pmlmeinfo->HT_caps_enable = 1;
5369                         break;
5370
5371                 case WLAN_EID_HT_OPERATION:     /* Get HT Info IE. */
5372                         pmlmeinfo->HT_info_enable = 1;
5373
5374                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
5375                         {
5376                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
5377
5378                                 if (pnetwork->configuration.ds_config <= 14) {
5379                                         if ((pregpriv->bw_mode & 0x0f) > CHANNEL_WIDTH_20)
5380                                                 cbw40_enable = 1;
5381                                 }
5382
5383                                 if ((cbw40_enable) && (pht_info->infos[0] & BIT(2))) {
5384                                         /* switch to the 40M Hz mode according to the AP */
5385                                         pmlmeext->cur_bwmode = CHANNEL_WIDTH_40;
5386                                         switch (pht_info->infos[0] & 0x3) {
5387                                         case 1:
5388                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
5389                                                 break;
5390
5391                                         case 3:
5392                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
5393                                                 break;
5394
5395                                         default:
5396                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5397                                                 pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5398                                                 break;
5399                                         }
5400                                 }
5401                         }
5402                         break;
5403                 default:
5404                         break;
5405                 }
5406
5407                 i += (pIE->length + 2);
5408         }
5409
5410         /* check channel, bandwidth, offset and switch */
5411         if (rtw_chk_start_clnt_join(padapter, &ch, &bw, &offset) == _FAIL) {
5412                 report_join_res(padapter, (-4));
5413                 return H2C_SUCCESS;
5414         }
5415
5416         /* disable dynamic functions, such as high power, DIG */
5417         /* Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false); */
5418
5419         /* config the initial gain under linking, need to write the BB registers */
5420         /* initialgain = 0x1E; */
5421         /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
5422
5423         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.mac_address);
5424         join_type = 0;
5425         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5426         rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);
5427
5428         set_channel_bwmode(padapter, ch, offset, bw);
5429
5430         /* cancel link timer */
5431         del_timer_sync(&pmlmeext->link_timer);
5432
5433         start_clnt_join(padapter);
5434
5435         return H2C_SUCCESS;
5436
5437 }
5438
5439 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
5440 {
5441         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
5442         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5443         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5444         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5445         u8 val8;
5446
5447         if (is_client_associated_to_ap(padapter))
5448                 issue_deauth_ex(padapter, pnetwork->mac_address, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
5449
5450         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5451                 /* Stop BCN */
5452                 val8 = 0;
5453                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
5454         }
5455
5456         rtw_mlmeext_disconnect(padapter);
5457
5458         rtw_free_uc_swdec_pending_queue(padapter);
5459
5460         return  H2C_SUCCESS;
5461 }
5462
5463 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
5464         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
5465 {
5466         int i, j;
5467         int set_idx;
5468         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5469
5470         /* clear first */
5471         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
5472
5473         /* acquire channels from in */
5474         j = 0;
5475         for (i = 0; i < in_num; i++) {
5476
5477                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
5478                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
5479                         && set_idx >= 0
5480                 ) {
5481                         if (j >= out_num) {
5482                                 netdev_dbg(padapter->pnetdev,
5483                                            FUNC_ADPT_FMT " out_num:%u not enough\n",
5484                                            FUNC_ADPT_ARG(padapter), out_num);
5485                                 break;
5486                         }
5487
5488                         memcpy(&out[j], &in[i], sizeof(struct rtw_ieee80211_channel));
5489
5490                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
5491                                 out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5492
5493                         j++;
5494                 }
5495                 if (j >= out_num)
5496                         break;
5497         }
5498
5499         /* if out is empty, use channel_set as default */
5500         if (j == 0) {
5501                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
5502
5503                         if (j >= out_num) {
5504                                 netdev_dbg(padapter->pnetdev,
5505                                            FUNC_ADPT_FMT " out_num:%u not enough\n",
5506                                            FUNC_ADPT_ARG(padapter),
5507                                            out_num);
5508                                 break;
5509                         }
5510
5511                         out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
5512
5513                         if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
5514                                 out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
5515
5516                         j++;
5517                 }
5518         }
5519
5520         return j;
5521 }
5522
5523 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
5524 {
5525         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5526         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
5527         u8 bdelayscan = false;
5528         u8 val8;
5529         u32 initialgain;
5530         u32 i;
5531
5532         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
5533                 pmlmeext->sitesurvey_res.state = SCAN_START;
5534                 pmlmeext->sitesurvey_res.bss_cnt = 0;
5535                 pmlmeext->sitesurvey_res.channel_idx = 0;
5536
5537                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
5538                         if (pparm->ssid[i].ssid_length) {
5539                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].ssid, pparm->ssid[i].ssid, IW_ESSID_MAX_SIZE);
5540                                 pmlmeext->sitesurvey_res.ssid[i].ssid_length = pparm->ssid[i].ssid_length;
5541                         } else {
5542                                 pmlmeext->sitesurvey_res.ssid[i].ssid_length = 0;
5543                         }
5544                 }
5545
5546                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
5547                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
5548                         , pparm->ch, pparm->ch_num
5549                 );
5550
5551                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
5552
5553                 /* issue null data if associating to the AP */
5554                 if (is_client_associated_to_ap(padapter)) {
5555                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
5556
5557                         issue_nulldata(padapter, NULL, 1, 3, 500);
5558
5559                         bdelayscan = true;
5560                 }
5561                 if (bdelayscan) {
5562                         /* delay 50ms to protect nulldata(1). */
5563                         set_survey_timer(pmlmeext, 50);
5564                         return H2C_SUCCESS;
5565                 }
5566         }
5567
5568         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
5569                 /* disable dynamic functions, such as high power, DIG */
5570                 Save_DM_Func_Flag(padapter);
5571                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
5572
5573                 /* config the initial gain under scanning, need to write the BB
5574                  * registers
5575                  */
5576                 initialgain = 0x1e;
5577
5578                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
5579
5580                 /* set MSR to no link state */
5581                 Set_MSR(padapter, _HW_STATE_NOLINK_);
5582
5583                 val8 = 1; /* under site survey */
5584                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
5585
5586                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
5587         }
5588
5589         site_survey(padapter);
5590
5591         return H2C_SUCCESS;
5592
5593 }
5594
5595 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
5596 {
5597         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
5598         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5599         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5600
5601         if (pparm->mode < 4)
5602                 pmlmeinfo->auth_algo = pparm->mode;
5603
5604         return  H2C_SUCCESS;
5605 }
5606
5607 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
5608 {
5609         u16 ctrl = 0;
5610         s16 cam_id = 0;
5611         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
5612         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5613         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5614         unsigned char null_addr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
5615         u8 *addr;
5616
5617         /* main tx key for wep. */
5618         if (pparm->set_tx)
5619                 pmlmeinfo->key_index = pparm->keyid;
5620
5621         cam_id = rtw_camid_alloc(padapter, NULL, pparm->keyid);
5622
5623         if (cam_id < 0) {
5624         } else {
5625                 if (cam_id > 3) /* not default key, searched by A2 */
5626                         addr = get_bssid(&padapter->mlmepriv);
5627                 else
5628                         addr = null_addr;
5629
5630                 ctrl = BIT(15) | BIT6 | ((pparm->algorithm) << 2) | pparm->keyid;
5631                 write_cam(padapter, cam_id, ctrl, addr, pparm->key);
5632                 netdev_dbg(padapter->pnetdev,
5633                            "set group key camid:%d, addr:%pM, kid:%d, type:%s\n",
5634                            cam_id, MAC_ARG(addr), pparm->keyid,
5635                            security_type_str(pparm->algorithm));
5636         }
5637
5638         if (cam_id >= 0 && cam_id <= 3)
5639                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_DK_CFG, (u8 *)true);
5640
5641         /* allow multicast packets to driver */
5642         padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_ON_RCR_AM, null_addr);
5643
5644         return H2C_SUCCESS;
5645 }
5646
5647 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
5648 {
5649         u16 ctrl = 0;
5650         s16 cam_id = 0;
5651         u8 ret = H2C_SUCCESS;
5652         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5653         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5654         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
5655         struct sta_priv *pstapriv = &padapter->stapriv;
5656         struct sta_info *psta;
5657
5658         if (pparm->algorithm == _NO_PRIVACY_)
5659                 goto write_to_cam;
5660
5661         psta = rtw_get_stainfo(pstapriv, pparm->addr);
5662         if (!psta) {
5663                 netdev_dbg(padapter->pnetdev, "%s sta:%pM not found\n",
5664                            __func__, MAC_ARG(pparm->addr));
5665                 ret = H2C_REJECTED;
5666                 goto exit;
5667         }
5668
5669         pmlmeinfo->enc_algo = pparm->algorithm;
5670         cam_id = rtw_camid_alloc(padapter, psta, 0);
5671         if (cam_id < 0)
5672                 goto exit;
5673
5674 write_to_cam:
5675         if (pparm->algorithm == _NO_PRIVACY_) {
5676                 while ((cam_id = rtw_camid_search(padapter, pparm->addr, -1)) >= 0) {
5677                         netdev_dbg(padapter->pnetdev,
5678                                    "clear key for addr:%pM, camid:%d\n",
5679                                    MAC_ARG(pparm->addr), cam_id);
5680                         clear_cam_entry(padapter, cam_id);
5681                         rtw_camid_free(padapter, cam_id);
5682                 }
5683         } else {
5684                 netdev_dbg(padapter->pnetdev,
5685                            "set pairwise key camid:%d, addr:%pM, kid:%d, type:%s\n",
5686                            cam_id, MAC_ARG(pparm->addr), pparm->keyid,
5687                            security_type_str(pparm->algorithm));
5688                 ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
5689                 write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
5690         }
5691         ret = H2C_SUCCESS_RSP;
5692
5693 exit:
5694         return ret;
5695 }
5696
5697 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
5698 {
5699         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
5700         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5701         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5702
5703         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
5704
5705         if (!psta)
5706                 return  H2C_SUCCESS;
5707
5708         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
5709                 ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
5710                 /* pmlmeinfo->ADDBA_retry_count = 0; */
5711                 /* pmlmeinfo->candidate_tid_bitmap |= (0x1 << pparm->tid); */
5712                 /* psta->htpriv.candidate_tid_bitmap |= BIT(pparm->tid); */
5713                 issue_action_BA(padapter, pparm->addr, WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
5714                 /* _set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO); */
5715                 _set_timer(&psta->addba_retry_timer, ADDBA_TO);
5716         } else {
5717                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
5718         }
5719         return  H2C_SUCCESS;
5720 }
5721
5722
5723 u8 chk_bmc_sleepq_cmd(struct adapter *padapter)
5724 {
5725         struct cmd_obj *ph2c;
5726         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5727         u8 res = _SUCCESS;
5728
5729         ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5730         if (!ph2c) {
5731                 res = _FAIL;
5732                 goto exit;
5733         }
5734
5735         init_h2fwcmd_w_parm_no_parm_rsp(ph2c, GEN_CMD_CODE(_ChkBMCSleepq));
5736
5737         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5738
5739 exit:
5740         return res;
5741 }
5742
5743 u8 set_tx_beacon_cmd(struct adapter *padapter)
5744 {
5745         struct cmd_obj  *ph2c;
5746         struct Tx_Beacon_param  *ptxBeacon_parm;
5747         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
5748         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5749         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5750         u8 res = _SUCCESS;
5751         int len_diff = 0;
5752
5753         ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5754         if (!ph2c) {
5755                 res = _FAIL;
5756                 goto exit;
5757         }
5758
5759         ptxBeacon_parm = rtw_zmalloc(sizeof(struct Tx_Beacon_param));
5760         if (!ptxBeacon_parm) {
5761                 kfree(ph2c);
5762                 res = _FAIL;
5763                 goto exit;
5764         }
5765
5766         memcpy(&(ptxBeacon_parm->network), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
5767
5768         len_diff = update_hidden_ssid(ptxBeacon_parm->network.ies+_BEACON_IE_OFFSET_,
5769                                       ptxBeacon_parm->network.ie_length-_BEACON_IE_OFFSET_,
5770                                       pmlmeinfo->hidden_ssid_mode);
5771         ptxBeacon_parm->network.ie_length += len_diff;
5772
5773         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));
5774
5775         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
5776
5777 exit:
5778         return res;
5779 }
5780
5781 static struct fwevent wlanevents[] = {
5782         {0, rtw_dummy_event_callback},  /*0*/
5783         {0, NULL},
5784         {0, NULL},
5785         {0, NULL},
5786         {0, NULL},
5787         {0, NULL},
5788         {0, NULL},
5789         {0, NULL},
5790         {0, &rtw_survey_event_callback},                /*8*/
5791         {sizeof(struct surveydone_event), &rtw_surveydone_event_callback},      /*9*/
5792
5793         {0, &rtw_joinbss_event_callback},               /*10*/
5794         {sizeof(struct stassoc_event), &rtw_stassoc_event_callback},
5795         {sizeof(struct stadel_event), &rtw_stadel_event_callback},
5796         {0, &rtw_atimdone_event_callback},
5797         {0, rtw_dummy_event_callback},
5798         {0, NULL},      /*15*/
5799         {0, NULL},
5800         {0, NULL},
5801         {0, NULL},
5802         {0, rtw_fwdbg_event_callback},
5803         {0, NULL},       /*20*/
5804         {0, NULL},
5805         {0, NULL},
5806         {0, &rtw_cpwm_event_callback},
5807         {0, NULL},
5808         {0, &rtw_wmm_event_callback},
5809
5810 };
5811
5812 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
5813 {
5814         u8 evt_code;
5815         u16 evt_sz;
5816         uint    *peventbuf;
5817         void (*event_callback)(struct adapter *dev, u8 *pbuf);
5818         struct evt_priv *pevt_priv = &(padapter->evtpriv);
5819
5820         if (!pbuf)
5821                 goto _abort_event_;
5822
5823         peventbuf = (uint *)pbuf;
5824         evt_sz = (u16)(*peventbuf&0xffff);
5825         evt_code = (u8)((*peventbuf>>16)&0xff);
5826
5827         /*  checking if event code is valid */
5828         if (evt_code >= MAX_C2HEVT)
5829                 goto _abort_event_;
5830
5831         /*  checking if event size match the event parm size */
5832         if ((wlanevents[evt_code].parmsize != 0) &&
5833                         (wlanevents[evt_code].parmsize != evt_sz))
5834                 goto _abort_event_;
5835
5836         atomic_inc(&pevt_priv->event_seq);
5837
5838         peventbuf += 2;
5839
5840         if (peventbuf) {
5841                 event_callback = wlanevents[evt_code].event_callback;
5842                 event_callback(padapter, (u8 *)peventbuf);
5843
5844                 pevt_priv->evt_done_cnt++;
5845         }
5846
5847
5848 _abort_event_:
5849
5850
5851         return H2C_SUCCESS;
5852
5853 }
5854
5855 u8 h2c_msg_hdl(struct adapter *padapter, unsigned char *pbuf)
5856 {
5857         if (!pbuf)
5858                 return H2C_PARAMETERS_ERROR;
5859
5860         return H2C_SUCCESS;
5861 }
5862
5863 u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf)
5864 {
5865         struct sta_info *psta_bmc;
5866         struct list_head *xmitframe_plist, *xmitframe_phead, *tmp;
5867         struct xmit_frame *pxmitframe = NULL;
5868         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
5869         struct sta_priv  *pstapriv = &padapter->stapriv;
5870
5871         /* for BC/MC Frames */
5872         psta_bmc = rtw_get_bcmc_stainfo(padapter);
5873         if (!psta_bmc)
5874                 return H2C_SUCCESS;
5875
5876         if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
5877                 msleep(10);/*  10ms, ATIM(HIQ) Windows */
5878
5879                 /* spin_lock_bh(&psta_bmc->sleep_q.lock); */
5880                 spin_lock_bh(&pxmitpriv->lock);
5881
5882                 xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
5883                 list_for_each_safe(xmitframe_plist, tmp, xmitframe_phead) {
5884                         pxmitframe = list_entry(xmitframe_plist,
5885                                                 struct xmit_frame, list);
5886
5887                         list_del_init(&pxmitframe->list);
5888
5889                         psta_bmc->sleepq_len--;
5890                         if (psta_bmc->sleepq_len > 0)
5891                                 pxmitframe->attrib.mdata = 1;
5892                         else
5893                                 pxmitframe->attrib.mdata = 0;
5894
5895                         pxmitframe->attrib.triggered = 1;
5896
5897                         if (xmitframe_hiq_filter(pxmitframe))
5898                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
5899
5900                         rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
5901                 }
5902
5903                 /* spin_unlock_bh(&psta_bmc->sleep_q.lock); */
5904                 spin_unlock_bh(&pxmitpriv->lock);
5905
5906                 /* check hi queue and bmc_sleepq */
5907                 rtw_chk_hi_queue_cmd(padapter);
5908         }
5909
5910         return H2C_SUCCESS;
5911 }
5912
5913 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
5914 {
5915         if (send_beacon(padapter) == _FAIL)
5916                 return H2C_PARAMETERS_ERROR;
5917
5918         /* tx bc/mc frames after update TIM */
5919         chk_bmc_sleepq_hdl(padapter, NULL);
5920
5921         return H2C_SUCCESS;
5922 }
5923
5924 int rtw_chk_start_clnt_join(struct adapter *padapter, u8 *ch, u8 *bw, u8 *offset)
5925 {
5926         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5927         unsigned char cur_ch = pmlmeext->cur_channel;
5928         unsigned char cur_bw = pmlmeext->cur_bwmode;
5929         unsigned char cur_ch_offset = pmlmeext->cur_ch_offset;
5930         bool connect_allow = true;
5931
5932         if (!ch || !bw || !offset) {
5933                 rtw_warn_on(1);
5934                 connect_allow = false;
5935         }
5936
5937         if (connect_allow) {
5938                 *ch = cur_ch;
5939                 *bw = cur_bw;
5940                 *offset = cur_ch_offset;
5941         }
5942
5943         return connect_allow ? _SUCCESS : _FAIL;
5944 }
5945
5946 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
5947 {
5948         struct set_ch_parm *set_ch_parm;
5949         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5950
5951         if (!pbuf)
5952                 return H2C_PARAMETERS_ERROR;
5953
5954         set_ch_parm = (struct set_ch_parm *)pbuf;
5955
5956         pmlmeext->cur_channel = set_ch_parm->ch;
5957         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
5958         pmlmeext->cur_bwmode = set_ch_parm->bw;
5959
5960         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
5961
5962         return  H2C_SUCCESS;
5963 }
5964
5965 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
5966 {
5967         struct SetChannelPlan_param *setChannelPlan_param;
5968         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5969
5970         if (!pbuf)
5971                 return H2C_PARAMETERS_ERROR;
5972
5973         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
5974
5975         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
5976         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
5977
5978         if (padapter->rtw_wdev && padapter->rtw_wdev->wiphy) {
5979                 struct regulatory_request request;
5980
5981                 request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
5982                 rtw_reg_notifier(padapter->rtw_wdev->wiphy, &request);
5983         }
5984
5985         return  H2C_SUCCESS;
5986 }
5987
5988 u8 set_csa_hdl(struct adapter *padapter, unsigned char *pbuf)
5989 {
5990         return  H2C_REJECTED;
5991 }
5992
5993 /*  TDLS_ESTABLISHED    : write RCR DATA BIT */
5994 /*  TDLS_CS_OFF         : go back to the channel linked with AP, terminating channel switch procedure */
5995 /*  TDLS_INIT_CH_SEN    : init channel sensing, receive all data and mgnt frame */
5996 /*  TDLS_DONE_CH_SEN: channel sensing and report candidate channel */
5997 /*  TDLS_OFF_CH         : first time set channel to off channel */
5998 /*  TDLS_BASE_CH                : go back tp the channel linked with AP when set base channel as target channel */
5999 /*  TDLS_P_OFF_CH       : periodically go to off channel */
6000 /*  TDLS_P_BASE_CH      : periodically go back to base channel */
6001 /*  TDLS_RS_RCR         : restore RCR */
6002 /*  TDLS_TEAR_STA       : free tdls sta */
6003 u8 tdls_hdl(struct adapter *padapter, unsigned char *pbuf)
6004 {
6005         return H2C_REJECTED;
6006 }
6007
6008 u8 run_in_thread_hdl(struct adapter *padapter, u8 *pbuf)
6009 {
6010         struct RunInThread_param *p;
6011
6012
6013         if (pbuf == NULL)
6014                 return H2C_PARAMETERS_ERROR;
6015         p = (struct RunInThread_param *)pbuf;
6016
6017         if (p->func)
6018                 p->func(p->context);
6019
6020         return H2C_SUCCESS;
6021 }