drivers/staging/rtl8723bs/core/rtw_mlme_ext.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /******************************************************************************
   3  *
   4  * Copyright(c) 2007 - 2012 Realtek Corporation. All rights reserved.
   5  *
   6  ******************************************************************************/
   7 #define _RTW_MLME_EXT_C_
   8
   9 #include <drv_types.h>
  10 #include <rtw_debug.h>
  11 #include <rtw_wifi_regd.h>
  12 #include <hal_btcoex.h>
  13 #include <linux/kernel.h>
  14 #include <asm/unaligned.h>
  15
  16 static struct mlme_handler mlme_sta_tbl[] = {
  17         {WIFI_ASSOCREQ,         "OnAssocReq",   &OnAssocReq},
  18         {WIFI_ASSOCRSP,         "OnAssocRsp",   &OnAssocRsp},
  19         {WIFI_REASSOCREQ,       "OnReAssocReq", &OnAssocReq},
  20         {WIFI_REASSOCRSP,       "OnReAssocRsp", &OnAssocRsp},
  21         {WIFI_PROBEREQ,         "OnProbeReq",   &OnProbeReq},
  22         {WIFI_PROBERSP,         "OnProbeRsp",           &OnProbeRsp},
  23
  24         /*----------------------------------------------------------
  25                                         below 2 are reserved
  26         -----------------------------------------------------------*/
  27         {0,                                     "DoReserved",           &DoReserved},
  28         {0,                                     "DoReserved",           &DoReserved},
  29         {WIFI_BEACON,           "OnBeacon",             &OnBeacon},
  30         {WIFI_ATIM,                     "OnATIM",               &OnAtim},
  31         {WIFI_DISASSOC,         "OnDisassoc",           &OnDisassoc},
  32         {WIFI_AUTH,                     "OnAuth",               &OnAuthClient},
  33         {WIFI_DEAUTH,           "OnDeAuth",             &OnDeAuth},
  34         {WIFI_ACTION,           "OnAction",             &OnAction},
  35         {WIFI_ACTION_NOACK, "OnActionNoAck",    &OnAction},
  36 };
  37
  38 static struct action_handler OnAction_tbl[] = {
  39         {RTW_WLAN_CATEGORY_SPECTRUM_MGMT,        "ACTION_SPECTRUM_MGMT", on_action_spct},
  40         {RTW_WLAN_CATEGORY_QOS, "ACTION_QOS", &DoReserved},
  41         {RTW_WLAN_CATEGORY_DLS, "ACTION_DLS", &DoReserved},
  42         {RTW_WLAN_CATEGORY_BACK, "ACTION_BACK", &OnAction_back},
  43         {RTW_WLAN_CATEGORY_PUBLIC, "ACTION_PUBLIC", on_action_public},
  44         {RTW_WLAN_CATEGORY_RADIO_MEASUREMENT, "ACTION_RADIO_MEASUREMENT", &DoReserved},
  45         {RTW_WLAN_CATEGORY_FT, "ACTION_FT",     &DoReserved},
  46         {RTW_WLAN_CATEGORY_HT,  "ACTION_HT",    &OnAction_ht},
  47         {RTW_WLAN_CATEGORY_SA_QUERY, "ACTION_SA_QUERY", &OnAction_sa_query},
  48         {RTW_WLAN_CATEGORY_UNPROTECTED_WNM, "ACTION_UNPROTECTED_WNM", &DoReserved},
  49         {RTW_WLAN_CATEGORY_SELF_PROTECTED, "ACTION_SELF_PROTECTED", &DoReserved},
  50         {RTW_WLAN_CATEGORY_WMM, "ACTION_WMM", &DoReserved},
  51         {RTW_WLAN_CATEGORY_VHT, "ACTION_VHT", &DoReserved},
  52         {RTW_WLAN_CATEGORY_P2P, "ACTION_P2P", &DoReserved},
  53 };
  54
  55 static u8 null_addr[ETH_ALEN] = {0, 0, 0, 0, 0, 0};
  56
  57 /**************************************************
  58 OUI definitions for the vendor specific IE
  59 ***************************************************/
  60 unsigned char RTW_WPA_OUI[] = {0x00, 0x50, 0xf2, 0x01};
  61 unsigned char WMM_OUI[] = {0x00, 0x50, 0xf2, 0x02};
  62 unsigned char WPS_OUI[] = {0x00, 0x50, 0xf2, 0x04};
  63 unsigned char P2P_OUI[] = {0x50, 0x6F, 0x9A, 0x09};
  64 unsigned char WFD_OUI[] = {0x50, 0x6F, 0x9A, 0x0A};
  65
  66 unsigned char WMM_INFO_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
  67 unsigned char WMM_PARA_OUI[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
  68
  69 static unsigned char REALTEK_96B_IE[] = {0x00, 0xe0, 0x4c, 0x02, 0x01, 0x20};
  70
  71 /********************************************************
  72 ChannelPlan definitions
  73 *********************************************************/
  74 static RT_CHANNEL_PLAN_2G       RTW_ChannelPlan2G[RT_CHANNEL_DOMAIN_2G_MAX] = {
  75         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x00, RT_CHANNEL_DOMAIN_2G_WORLD , Passive scan CH 12, 13 */
  76         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}, 13},              /*  0x01, RT_CHANNEL_DOMAIN_2G_ETSI1 */
  77         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11}, 11},                      /*  0x02, RT_CHANNEL_DOMAIN_2G_FCC1 */
  78         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x03, RT_CHANNEL_DOMAIN_2G_MIKK1 */
  79         {{10, 11, 12, 13}, 4},                                          /*  0x04, RT_CHANNEL_DOMAIN_2G_ETSI2 */
  80         {{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14}, 14},  /*  0x05, RT_CHANNEL_DOMAIN_2G_GLOBAL , Passive scan CH 12, 13, 14 */
  81         {{}, 0},                                                                /*  0x06, RT_CHANNEL_DOMAIN_2G_NULL */
  82 };
  83
  84 static RT_CHANNEL_PLAN_5G       RTW_ChannelPlan5G[RT_CHANNEL_DOMAIN_5G_MAX] = {
  85         {{}, 0},                                                                                                                                                                        /*  0x00, RT_CHANNEL_DOMAIN_5G_NULL */
  86         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}, 19},                                          /*  0x01, RT_CHANNEL_DOMAIN_5G_ETSI1 */
  87         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165}, 24}, /*  0x02, RT_CHANNEL_DOMAIN_5G_ETSI2 */
  88         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 149, 153, 157, 161, 165}, 22},                   /*  0x03, RT_CHANNEL_DOMAIN_5G_ETSI3 */
  89         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 149, 153, 157, 161, 165}, 24}, /*  0x04, RT_CHANNEL_DOMAIN_5G_FCC1 */
  90         {{36, 40, 44, 48, 149, 153, 157, 161, 165}, 9},                                                                                                         /*  0x05, RT_CHANNEL_DOMAIN_5G_FCC2 */
  91         {{36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165}, 13},                                                                                        /*  0x06, RT_CHANNEL_DOMAIN_5G_FCC3 */
  92         {{36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161}, 12},                                                                                             /*  0x07, RT_CHANNEL_DOMAIN_5G_FCC4 */
  93         {{149, 153, 157, 161, 165}, 5},                                                                                                                                 /*  0x08, RT_CHANNEL_DOMAIN_5G_FCC5 */
  94         {{36, 40, 44, 48, 52, 56, 60, 64}, 8},                                                                                                                          /*  0x09, RT_CHANNEL_DOMAIN_5G_FCC6 */
  95         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149, 153, 157, 161, 165}, 20},                                     /*  0x0A, RT_CHANNEL_DOMAIN_5G_FCC7_IC1 */
  96         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 149, 153, 157, 161, 165}, 20},                                     /*  0x0B, RT_CHANNEL_DOMAIN_5G_KCC1 */
  97         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}, 19},                                          /*  0x0C, RT_CHANNEL_DOMAIN_5G_MKK1 */
  98         {{36, 40, 44, 48, 52, 56, 60, 64}, 8},                                                                                                                          /*  0x0D, RT_CHANNEL_DOMAIN_5G_MKK2 */
  99         {{100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}, 11},                                                                                  /*  0x0E, RT_CHANNEL_DOMAIN_5G_MKK3 */
 100         {{56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149, 153, 157, 161, 165}, 15},                                                         /*  0x0F, RT_CHANNEL_DOMAIN_5G_NCC1 */
 101         {{56, 60, 64, 149, 153, 157, 161, 165}, 8},                                                                                                                     /*  0x10, RT_CHANNEL_DOMAIN_5G_NCC2 */
 102         {{149, 153, 157, 161, 165}, 5},                                                                                                                                 /*  0x11, RT_CHANNEL_DOMAIN_5G_NCC3 */
 103         {{36, 40, 44, 48}, 4},                                                                                                                                                  /*  0x12, RT_CHANNEL_DOMAIN_5G_ETSI4 */
 104         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 136, 140, 149, 153, 157, 161, 165}, 20},                                     /*  0x13, RT_CHANNEL_DOMAIN_5G_ETSI5 */
 105         {{149, 153, 157, 161}, 4},                                                                                                                                              /*  0x14, RT_CHANNEL_DOMAIN_5G_FCC8 */
 106         {{36, 40, 44, 48, 52, 56, 60, 64}, 8},                                                                                                                          /*  0x15, RT_CHANNEL_DOMAIN_5G_ETSI6 */
 107         {{36, 40, 44, 48, 52, 56, 60, 64, 149, 153, 157, 161, 165}, 13},                                                                                        /*  0x16, RT_CHANNEL_DOMAIN_5G_ETSI7 */
 108         {{36, 40, 44, 48, 149, 153, 157, 161, 165}, 9},                                                                                                         /*  0x17, RT_CHANNEL_DOMAIN_5G_ETSI8 */
 109         {{100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140}, 11},                                                                                  /*  0x18, RT_CHANNEL_DOMAIN_5G_ETSI9 */
 110         {{149, 153, 157, 161, 165}, 5},                                                                                                                                 /*  0x19, RT_CHANNEL_DOMAIN_5G_ETSI10 */
 111         {{36, 40, 44, 48, 52, 56, 60, 64, 132, 136, 140, 149, 153, 157, 161, 165}, 16},                                                                 /*  0x1A, RT_CHANNEL_DOMAIN_5G_ETSI11 */
 112         {{52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165}, 17},                                                        /*  0x1B, RT_CHANNEL_DOMAIN_5G_NCC4 */
 113         {{149, 153, 157, 161}, 4},                                                                                                                                              /*  0x1C, RT_CHANNEL_DOMAIN_5G_ETSI12 */
 114         {{36, 40, 44, 48, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165}, 17},                                                        /*  0x1D, RT_CHANNEL_DOMAIN_5G_FCC9 */
 115         {{36, 40, 44, 48, 100, 104, 108, 112, 116, 132, 136, 140}, 12},                                                                                 /*  0x1E, RT_CHANNEL_DOMAIN_5G_ETSI13 */
 116         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161}, 20},                                     /*  0x1F, RT_CHANNEL_DOMAIN_5G_FCC10 */
 117
 118         /*  Driver self defined for old channel plan Compatible , Remember to modify if have new channel plan definition ===== */
 119         {{36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 132, 136, 140, 149, 153, 157, 161, 165}, 21},                                /*  0x20, RT_CHANNEL_DOMAIN_5G_FCC */
 120         {{36, 40, 44, 48}, 4},                                                                                                                                                  /*  0x21, RT_CHANNEL_DOMAIN_5G_JAPAN_NO_DFS */
 121         {{36, 40, 44, 48, 149, 153, 157, 161}, 8},                                                                                                                      /*  0x22, RT_CHANNEL_DOMAIN_5G_FCC4_NO_DFS */
 122 };
 123
 124 static RT_CHANNEL_PLAN_MAP      RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
 125         /*  0x00 ~ 0x1F , Old Define ===== */
 126         {0x02, 0x20},   /* 0x00, RT_CHANNEL_DOMAIN_FCC */
 127         {0x02, 0x0A},   /* 0x01, RT_CHANNEL_DOMAIN_IC */
 128         {0x01, 0x01},   /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
 129         {0x01, 0x00},   /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
 130         {0x01, 0x00},   /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
 131         {0x03, 0x00},   /* 0x05, RT_CHANNEL_DOMAIN_MKK */
 132         {0x03, 0x00},   /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
 133         {0x01, 0x09},   /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
 134         {0x03, 0x09},   /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
 135         {0x03, 0x00},   /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
 136         {0x00, 0x00},   /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
 137         {0x02, 0x0F},   /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
 138         {0x01, 0x08},   /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
 139         {0x02, 0x06},   /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
 140         {0x02, 0x0B},   /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
 141         {0x02, 0x09},   /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
 142         {0x01, 0x01},   /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
 143         {0x02, 0x05},   /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
 144         {0x01, 0x21},   /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
 145         {0x00, 0x04},   /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
 146         {0x02, 0x10},   /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
 147         {0x00, 0x21},   /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
 148         {0x00, 0x22},   /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
 149         {0x03, 0x21},   /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
 150         {0x06, 0x08},   /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
 151         {0x02, 0x08},   /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
 152         {0x00, 0x00},   /* 0x1A, */
 153         {0x00, 0x00},   /* 0x1B, */
 154         {0x00, 0x00},   /* 0x1C, */
 155         {0x00, 0x00},   /* 0x1D, */
 156         {0x00, 0x00},   /* 0x1E, */
 157         {0x06, 0x04},   /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
 158         /*  0x20 ~ 0x7F , New Define ===== */
 159         {0x00, 0x00},   /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
 160         {0x01, 0x00},   /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
 161         {0x02, 0x00},   /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
 162         {0x03, 0x00},   /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
 163         {0x04, 0x00},   /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
 164         {0x02, 0x04},   /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
 165         {0x00, 0x01},   /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
 166         {0x03, 0x0C},   /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
 167         {0x00, 0x0B},   /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
 168         {0x00, 0x05},   /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
 169         {0x00, 0x00},   /* 0x2A, */
 170         {0x00, 0x00},   /* 0x2B, */
 171         {0x00, 0x00},   /* 0x2C, */
 172         {0x00, 0x00},   /* 0x2D, */
 173         {0x00, 0x00},   /* 0x2E, */
 174         {0x00, 0x00},   /* 0x2F, */
 175         {0x00, 0x06},   /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
 176         {0x00, 0x07},   /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
 177         {0x00, 0x08},   /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
 178         {0x00, 0x09},   /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
 179         {0x02, 0x0A},   /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
 180         {0x00, 0x02},   /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
 181         {0x00, 0x03},   /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
 182         {0x03, 0x0D},   /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
 183         {0x03, 0x0E},   /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
 184         {0x02, 0x0F},   /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
 185         {0x00, 0x00},   /* 0x3A, */
 186         {0x00, 0x00},   /* 0x3B, */
 187         {0x00, 0x00},   /* 0x3C, */
 188         {0x00, 0x00},   /* 0x3D, */
 189         {0x00, 0x00},   /* 0x3E, */
 190         {0x00, 0x00},   /* 0x3F, */
 191         {0x02, 0x10},   /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
 192         {0x05, 0x00},   /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */
 193         {0x01, 0x12},   /* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */
 194         {0x02, 0x05},   /* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */
 195         {0x02, 0x11},   /* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */
 196         {0x00, 0x13},   /* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */
 197         {0x02, 0x14},   /* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */
 198         {0x00, 0x15},   /* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */
 199         {0x00, 0x16},   /* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */
 200         {0x00, 0x17},   /* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */
 201         {0x00, 0x18},   /* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */
 202         {0x00, 0x19},   /* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */
 203         {0x00, 0x1A},   /* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */
 204         {0x02, 0x1B},   /* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */
 205         {0x00, 0x1C},   /* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */
 206         {0x02, 0x1D},   /* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */
 207         {0x00, 0x1E},   /* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */
 208         {0x02, 0x1F},   /* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */
 209 };
 210
 211  /* use the combination for max channel numbers */
 212 static RT_CHANNEL_PLAN_MAP RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03, 0x02};
 213
 214 /* Search the @param ch in given @param ch_set
 215  * @ch_set: the given channel set
 216  * @ch: the given channel number
 217  *
 218  * return the index of channel_num in channel_set, -1 if not found
 219  */
 220 int rtw_ch_set_search_ch(RT_CHANNEL_INFO *ch_set, const u32 ch)
 221 {
 222         int i;
 223
 224         for (i = 0; ch_set[i].ChannelNum != 0; i++) {
 225                 if (ch == ch_set[i].ChannelNum)
 226                         break;
 227         }
 228
 229         if (i >= ch_set[i].ChannelNum)
 230                 return -1;
 231         return i;
 232 }
 233
 234 /* Check the @param ch is fit with setband setting of @param adapter
 235  * @adapter: the given adapter
 236  * @ch: the given channel number
 237  *
 238  * return true when check valid, false not valid
 239  */
 240 bool rtw_mlme_band_check(struct adapter *adapter, const u32 ch)
 241 {
 242         if (adapter->setband == GHZ24_50 /* 2.4G and 5G */
 243                 || (adapter->setband == GHZ_24 && ch < 35) /* 2.4G only */
 244                 || (adapter->setband == GHZ_50 && ch > 35) /* 5G only */
 245         ) {
 246                 return true;
 247         }
 248         return false;
 249 }
 250
 251 /****************************************************************************
 252
 253 Following are the initialization functions for WiFi MLME
 254
 255 *****************************************************************************/
 256
 257 int init_hw_mlme_ext(struct adapter *padapter)
 258 {
 259         struct  mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 260
 261         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
 262         return _SUCCESS;
 263 }
 264
 265 void init_mlme_default_rate_set(struct adapter *padapter)
 266 {
 267         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 268
 269         unsigned char mixed_datarate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _9M_RATE_, _12M_RATE_, _18M_RATE_, _24M_RATE_, _36M_RATE_, _48M_RATE_, _54M_RATE_, 0xff};
 270         unsigned char mixed_basicrate[NumRates] = {_1M_RATE_, _2M_RATE_, _5M_RATE_, _11M_RATE_, _6M_RATE_, _12M_RATE_, _24M_RATE_, 0xff,};
 271         unsigned char supported_mcs_set[16] = {0xff, 0xff, 0x00, 0x00, 0x01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0};
 272
 273         memcpy(pmlmeext->datarate, mixed_datarate, NumRates);
 274         memcpy(pmlmeext->basicrate, mixed_basicrate, NumRates);
 275
 276         memcpy(pmlmeext->default_supported_mcs_set, supported_mcs_set, sizeof(pmlmeext->default_supported_mcs_set));
 277 }
 278
 279 static void init_mlme_ext_priv_value(struct adapter *padapter)
 280 {
 281         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 282         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 283
 284         atomic_set(&pmlmeext->event_seq, 0);
 285         pmlmeext->mgnt_seq = 0;/* reset to zero when disconnect at client mode */
 286         pmlmeext->sa_query_seq = 0;
 287         pmlmeext->mgnt_80211w_IPN = 0;
 288         pmlmeext->mgnt_80211w_IPN_rx = 0;
 289         pmlmeext->cur_channel = padapter->registrypriv.channel;
 290         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
 291         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 292
 293         pmlmeext->retry = 0;
 294
 295         pmlmeext->cur_wireless_mode = padapter->registrypriv.wireless_mode;
 296
 297         init_mlme_default_rate_set(padapter);
 298
 299         pmlmeext->tx_rate = IEEE80211_CCK_RATE_1MB;
 300         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
 301         pmlmeext->sitesurvey_res.channel_idx = 0;
 302         pmlmeext->sitesurvey_res.bss_cnt = 0;
 303         pmlmeext->scan_abort = false;
 304
 305         pmlmeinfo->state = WIFI_FW_NULL_STATE;
 306         pmlmeinfo->reauth_count = 0;
 307         pmlmeinfo->reassoc_count = 0;
 308         pmlmeinfo->link_count = 0;
 309         pmlmeinfo->auth_seq = 0;
 310         pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
 311         pmlmeinfo->key_index = 0;
 312         pmlmeinfo->iv = 0;
 313
 314         pmlmeinfo->enc_algo = _NO_PRIVACY_;
 315         pmlmeinfo->authModeToggle = 0;
 316
 317         memset(pmlmeinfo->chg_txt, 0, 128);
 318
 319         pmlmeinfo->slotTime = SHORT_SLOT_TIME;
 320         pmlmeinfo->preamble_mode = PREAMBLE_AUTO;
 321
 322         pmlmeinfo->dialogToken = 0;
 323
 324         pmlmeext->action_public_rxseq = 0xffff;
 325         pmlmeext->action_public_dialog_token = 0xff;
 326 }
 327
 328 static int has_channel(RT_CHANNEL_INFO *channel_set,
 329                                            u8 chanset_size,
 330                                            u8 chan)
 331 {
 332         int i;
 333
 334         for (i = 0; i < chanset_size; i++) {
 335                 if (channel_set[i].ChannelNum == chan) {
 336                         return 1;
 337                 }
 338         }
 339
 340         return 0;
 341 }
 342
 343 static void init_channel_list(struct adapter *padapter, RT_CHANNEL_INFO *channel_set,
 344                                                           u8 chanset_size,
 345                                                           struct p2p_channels *channel_list)
 346 {
 347
 348         static const struct p2p_oper_class_map op_class[] = {
 349                 { IEEE80211G,  81,   1,  13,  1, BW20 },
 350                 { IEEE80211G,  82,  14,  14,  1, BW20 },
 351                 { IEEE80211A, 115,  36,  48,  4, BW20 },
 352                 { IEEE80211A, 116,  36,  44,  8, BW40PLUS },
 353                 { IEEE80211A, 117,  40,  48,  8, BW40MINUS },
 354                 { IEEE80211A, 124, 149, 161,  4, BW20 },
 355                 { IEEE80211A, 125, 149, 169,  4, BW20 },
 356                 { IEEE80211A, 126, 149, 157,  8, BW40PLUS },
 357                 { IEEE80211A, 127, 153, 161,  8, BW40MINUS },
 358                 { -1, 0, 0, 0, 0, BW20 }
 359         };
 360
 361         int cla, op;
 362
 363         cla = 0;
 364
 365         for (op = 0; op_class[op].op_class; op++) {
 366                 u8 ch;
 367                 const struct p2p_oper_class_map *o = &op_class[op];
 368                 struct p2p_reg_class *reg = NULL;
 369
 370                 for (ch = o->min_chan; ch <= o->max_chan; ch += o->inc) {
 371                         if (!has_channel(channel_set, chanset_size, ch))
 372                                 continue;
 373
 374                         if ((0 == padapter->registrypriv.ht_enable) && (8 == o->inc))
 375                                 continue;
 376
 377                         if ((0 < (padapter->registrypriv.bw_mode & 0xf0)) &&
 378                                 ((BW40MINUS == o->bw) || (BW40PLUS == o->bw)))
 379                                 continue;
 380
 381                         if (!reg) {
 382                                 reg = &channel_list->reg_class[cla];
 383                                 cla++;
 384                                 reg->reg_class = o->op_class;
 385                                 reg->channels = 0;
 386                         }
 387                         reg->channel[reg->channels] = ch;
 388                         reg->channels++;
 389                 }
 390         }
 391         channel_list->reg_classes = cla;
 392
 393 }
 394
 395 static u8 init_channel_set(struct adapter *padapter, u8 ChannelPlan, RT_CHANNEL_INFO *channel_set)
 396 {
 397         u8 index, chanset_size = 0;
 398         u8 b5GBand = false, b2_4GBand = false;
 399         u8 Index2G = 0, Index5G = 0;
 400
 401         memset(channel_set, 0, sizeof(RT_CHANNEL_INFO)*MAX_CHANNEL_NUM);
 402
 403         if (ChannelPlan >= RT_CHANNEL_DOMAIN_MAX && ChannelPlan != RT_CHANNEL_DOMAIN_REALTEK_DEFINE) {
 404                 DBG_871X("ChannelPlan ID %x error !!!!!\n", ChannelPlan);
 405                 return chanset_size;
 406         }
 407
 408         if (IsSupported24G(padapter->registrypriv.wireless_mode)) {
 409                 b2_4GBand = true;
 410                 if (RT_CHANNEL_DOMAIN_REALTEK_DEFINE == ChannelPlan)
 411                         Index2G = RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE.Index2G;
 412                 else
 413                         Index2G = RTW_ChannelPlanMap[ChannelPlan].Index2G;
 414         }
 415
 416         if (b2_4GBand) {
 417                 for (index = 0; index < RTW_ChannelPlan2G[Index2G].Len; index++) {
 418                         channel_set[chanset_size].ChannelNum = RTW_ChannelPlan2G[Index2G].Channel[index];
 419
 420                         if ((RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN == ChannelPlan) ||/* Channel 1~11 is active, and 12~14 is passive */
 421                                 (RT_CHANNEL_DOMAIN_GLOBAL_NULL == ChannelPlan)) {
 422                                 if (channel_set[chanset_size].ChannelNum >= 1 && channel_set[chanset_size].ChannelNum <= 11)
 423                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 424                                 else if ((channel_set[chanset_size].ChannelNum  >= 12 && channel_set[chanset_size].ChannelNum  <= 14))
 425                                         channel_set[chanset_size].ScanType  = SCAN_PASSIVE;
 426                         } else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
 427                                 RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan ||
 428                                 RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) { /*  channel 12~13, passive scan */
 429                                 if (channel_set[chanset_size].ChannelNum <= 11)
 430                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 431                                 else
 432                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
 433                         } else
 434                                 channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 435
 436                         chanset_size++;
 437                 }
 438         }
 439
 440         if (b5GBand) {
 441                 for (index = 0; index < RTW_ChannelPlan5G[Index5G].Len; index++) {
 442                         if (RTW_ChannelPlan5G[Index5G].Channel[index] <= 48
 443                                 || RTW_ChannelPlan5G[Index5G].Channel[index] >= 149) {
 444                                 channel_set[chanset_size].ChannelNum = RTW_ChannelPlan5G[Index5G].Channel[index];
 445                                 if (RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan)/* passive scan for all 5G channels */
 446                                         channel_set[chanset_size].ScanType = SCAN_PASSIVE;
 447                                 else
 448                                         channel_set[chanset_size].ScanType = SCAN_ACTIVE;
 449                                 DBG_871X("%s(): channel_set[%d].ChannelNum = %d\n", __func__, chanset_size, channel_set[chanset_size].ChannelNum);
 450                                 chanset_size++;
 451                         }
 452                 }
 453         }
 454
 455         DBG_871X("%s ChannelPlan ID %x Chan num:%d \n", __func__, ChannelPlan, chanset_size);
 456         return chanset_size;
 457 }
 458
 459 void init_mlme_ext_priv(struct adapter *padapter)
 460 {
 461         struct registry_priv *pregistrypriv = &padapter->registrypriv;
 462         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 463         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 464         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 465
 466         pmlmeext->padapter = padapter;
 467
 468         /* fill_fwpriv(padapter, &(pmlmeext->fwpriv)); */
 469
 470         init_mlme_ext_priv_value(padapter);
 471         pmlmeinfo->accept_addba_req = pregistrypriv->accept_addba_req;
 472
 473         init_mlme_ext_timer(padapter);
 474
 475         init_mlme_ap_info(padapter);
 476
 477         pmlmeext->max_chan_nums = init_channel_set(padapter, pmlmepriv->ChannelPlan, pmlmeext->channel_set);
 478         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
 479         pmlmeext->last_scan_time = 0;
 480         pmlmeext->chan_scan_time = SURVEY_TO;
 481         pmlmeext->mlmeext_init = true;
 482         pmlmeext->active_keep_alive_check = true;
 483
 484 #ifdef DBG_FIXED_CHAN
 485         pmlmeext->fixed_chan = 0xFF;
 486 #endif
 487 }
 488
 489 void free_mlme_ext_priv(struct mlme_ext_priv *pmlmeext)
 490 {
 491         struct adapter *padapter = pmlmeext->padapter;
 492
 493         if (!padapter)
 494                 return;
 495
 496         if (padapter->bDriverStopped) {
 497                 del_timer_sync(&pmlmeext->survey_timer);
 498                 del_timer_sync(&pmlmeext->link_timer);
 499                 /* del_timer_sync(&pmlmeext->ADDBA_timer); */
 500         }
 501 }
 502
 503 static void _mgt_dispatcher(struct adapter *padapter, struct mlme_handler *ptable, union recv_frame *precv_frame)
 504 {
 505         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 506         u8 *pframe = precv_frame->u.hdr.rx_data;
 507
 508         if (ptable->func) {
 509                 /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
 510                 if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
 511                     memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN))
 512                         return;
 513
 514                 ptable->func(padapter, precv_frame);
 515         }
 516 }
 517
 518 void mgt_dispatcher(struct adapter *padapter, union recv_frame *precv_frame)
 519 {
 520         int index;
 521         struct mlme_handler *ptable;
 522         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 523         u8 bc_addr[ETH_ALEN] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 524         u8 *pframe = precv_frame->u.hdr.rx_data;
 525         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, GetAddr2Ptr(pframe));
 526         struct dvobj_priv *psdpriv = padapter->dvobj;
 527         struct debug_priv *pdbgpriv = &psdpriv->drv_dbg;
 528
 529         RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_,
 530                  ("+mgt_dispatcher: type(0x%x) subtype(0x%x)\n",
 531                   GetFrameType(pframe), GetFrameSubType(pframe)));
 532
 533         if (GetFrameType(pframe) != WIFI_MGT_TYPE) {
 534                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("mgt_dispatcher: type(0x%x) error!\n", GetFrameType(pframe)));
 535                 return;
 536         }
 537
 538         /* receive the frames that ra(a1) is my address or ra(a1) is bc address. */
 539         if (memcmp(GetAddr1Ptr(pframe), myid(&padapter->eeprompriv), ETH_ALEN) &&
 540                 memcmp(GetAddr1Ptr(pframe), bc_addr, ETH_ALEN)) {
 541                 return;
 542         }
 543
 544         ptable = mlme_sta_tbl;
 545
 546         index = GetFrameSubType(pframe) >> 4;
 547
 548         if (index >= ARRAY_SIZE(mlme_sta_tbl)) {
 549                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("Currently we do not support reserved sub-fr-type =%d\n", index));
 550                 return;
 551         }
 552         ptable += index;
 553
 554         if (psta != NULL) {
 555                 if (GetRetry(pframe)) {
 556                         if (precv_frame->u.hdr.attrib.seq_num == psta->RxMgmtFrameSeqNum) {
 557                                 /* drop the duplicate management frame */
 558                                 pdbgpriv->dbg_rx_dup_mgt_frame_drop_count++;
 559                                 DBG_871X("Drop duplicate management frame with seq_num = %d.\n", precv_frame->u.hdr.attrib.seq_num);
 560                                 return;
 561                         }
 562                 }
 563                 psta->RxMgmtFrameSeqNum = precv_frame->u.hdr.attrib.seq_num;
 564         }
 565
 566         switch (GetFrameSubType(pframe)) {
 567         case WIFI_AUTH:
 568                 if (check_fwstate(pmlmepriv, WIFI_AP_STATE))
 569                         ptable->func = &OnAuth;
 570                 else
 571                         ptable->func = &OnAuthClient;
 572                 fallthrough;
 573         case WIFI_ASSOCREQ:
 574         case WIFI_REASSOCREQ:
 575                 _mgt_dispatcher(padapter, ptable, precv_frame);
 576                 break;
 577         case WIFI_PROBEREQ:
 578                 _mgt_dispatcher(padapter, ptable, precv_frame);
 579                 break;
 580         case WIFI_BEACON:
 581                 _mgt_dispatcher(padapter, ptable, precv_frame);
 582                 break;
 583         case WIFI_ACTION:
 584                 /* if (check_fwstate(pmlmepriv, WIFI_AP_STATE) == true) */
 585                 _mgt_dispatcher(padapter, ptable, precv_frame);
 586                 break;
 587         default:
 588                 _mgt_dispatcher(padapter, ptable, precv_frame);
 589                 break;
 590         }
 591 }
 592
 593 /****************************************************************************
 594
 595 Following are the callback functions for each subtype of the management frames
 596
 597 *****************************************************************************/
 598
 599 unsigned int OnProbeReq(struct adapter *padapter, union recv_frame *precv_frame)
 600 {
 601         unsigned int    ielen;
 602         unsigned char *p;
 603         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 604         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 605         struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
 606         struct wlan_bssid_ex    *cur = &pmlmeinfo->network;
 607         u8 *pframe = precv_frame->u.hdr.rx_data;
 608         uint len = precv_frame->u.hdr.len;
 609         u8 is_valid_p2p_probereq = false;
 610
 611         if (check_fwstate(pmlmepriv, WIFI_STATION_STATE))
 612                 return _SUCCESS;
 613
 614         if (check_fwstate(pmlmepriv, _FW_LINKED) == false &&
 615                 check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE|WIFI_AP_STATE) == false) {
 616                 return _SUCCESS;
 617         }
 618
 619
 620         /* DBG_871X("+OnProbeReq\n"); */
 621
 622 #ifdef CONFIG_AUTO_AP_MODE
 623         if (check_fwstate(pmlmepriv, _FW_LINKED) &&
 624                         pmlmepriv->cur_network.join_res) {
 625                 struct sta_info *psta;
 626                 u8 *mac_addr, *peer_addr;
 627                 struct sta_priv *pstapriv = &padapter->stapriv;
 628                 u8 RC_OUI[4] = {0x00, 0xE0, 0x4C, 0x0A};
 629                 /* EID[1] + EID_LEN[1] + RC_OUI[4] + MAC[6] + PairingID[2] + ChannelNum[2] */
 630
 631                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _VENDOR_SPECIFIC_IE_, (int *)&ielen,
 632                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
 633
 634                 if (!p || ielen != 14)
 635                         goto _non_rc_device;
 636
 637                 if (memcmp(p+2, RC_OUI, sizeof(RC_OUI)))
 638                         goto _non_rc_device;
 639
 640                 if (memcmp(p+6, get_sa(pframe), ETH_ALEN)) {
 641                         DBG_871X("%s, do rc pairing ("MAC_FMT"), but mac addr mismatch!("MAC_FMT")\n", __func__,
 642                                 MAC_ARG(get_sa(pframe)), MAC_ARG(p+6));
 643
 644                         goto _non_rc_device;
 645                 }
 646
 647                 DBG_871X("%s, got the pairing device("MAC_FMT")\n", __func__,  MAC_ARG(get_sa(pframe)));
 648
 649                 /* new a station */
 650                 psta = rtw_get_stainfo(pstapriv, get_sa(pframe));
 651                 if (psta == NULL) {
 652                         /*  allocate a new one */
 653                         DBG_871X("going to alloc stainfo for rc ="MAC_FMT"\n",  MAC_ARG(get_sa(pframe)));
 654                         psta = rtw_alloc_stainfo(pstapriv, get_sa(pframe));
 655                         if (!psta) {
 656                                 /* TODO: */
 657                                 DBG_871X(" Exceed the upper limit of supported clients...\n");
 658                                 return _SUCCESS;
 659                         }
 660
 661                         spin_lock_bh(&pstapriv->asoc_list_lock);
 662                         if (list_empty(&psta->asoc_list)) {
 663                                 psta->expire_to = pstapriv->expire_to;
 664                                 list_add_tail(&psta->asoc_list, &pstapriv->asoc_list);
 665                                 pstapriv->asoc_list_cnt++;
 666                         }
 667                         spin_unlock_bh(&pstapriv->asoc_list_lock);
 668
 669                         /* generate pairing ID */
 670                         mac_addr = myid(&(padapter->eeprompriv));
 671                         peer_addr = psta->hwaddr;
 672                         psta->pid = (u16)(((mac_addr[4]<<8) + mac_addr[5]) + ((peer_addr[4]<<8) + peer_addr[5]));
 673
 674                         /* update peer stainfo */
 675                         psta->isrc = true;
 676                         /* psta->aid = 0; */
 677                         /* psta->mac_id = 2; */
 678
 679                         /* get a unique AID */
 680                         if (psta->aid > 0) {
 681                                 DBG_871X("old AID %d\n", psta->aid);
 682                         } else {
 683                                 for (psta->aid = 1; psta->aid <= NUM_STA; psta->aid++)
 684                                         if (pstapriv->sta_aid[psta->aid - 1] == NULL)
 685                                                 break;
 686
 687                                 if (psta->aid > pstapriv->max_num_sta) {
 688                                         psta->aid = 0;
 689                                         DBG_871X("no room for more AIDs\n");
 690                                         return _SUCCESS;
 691                                 }
 692                                 pstapriv->sta_aid[psta->aid - 1] = psta;
 693                                 DBG_871X("allocate new AID = (%d)\n", psta->aid);
 694                         }
 695
 696                         psta->qos_option = 1;
 697                         psta->bw_mode = CHANNEL_WIDTH_20;
 698                         psta->ieee8021x_blocked = false;
 699                         psta->htpriv.ht_option = true;
 700                         psta->htpriv.ampdu_enable = false;
 701                         psta->htpriv.sgi_20m = false;
 702                         psta->htpriv.sgi_40m = false;
 703                         psta->htpriv.ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
 704                         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
 705                         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
 706
 707                         rtw_hal_set_odm_var(padapter, HAL_ODM_STA_INFO, psta, true);
 708
 709                         memset((void *)&psta->sta_stats, 0, sizeof(struct stainfo_stats));
 710
 711                         spin_lock_bh(&psta->lock);
 712                         psta->state |= _FW_LINKED;
 713                         spin_unlock_bh(&psta->lock);
 714
 715                         report_add_sta_event(padapter, psta->hwaddr, psta->aid);
 716
 717                 }
 718
 719                 issue_probersp(padapter, get_sa(pframe), false);
 720
 721                 return _SUCCESS;
 722
 723         }
 724
 725 _non_rc_device:
 726
 727         return _SUCCESS;
 728
 729 #endif /* CONFIG_AUTO_AP_MODE */
 730
 731         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _PROBEREQ_IE_OFFSET_, _SSID_IE_, (int *)&ielen,
 732                         len - WLAN_HDR_A3_LEN - _PROBEREQ_IE_OFFSET_);
 733
 734
 735         /* check (wildcard) SSID */
 736         if (p != NULL) {
 737                 if (is_valid_p2p_probereq)
 738                         goto _issue_probersp;
 739
 740                 if ((ielen != 0 && false == !memcmp((void *)(p+2), (void *)cur->Ssid.Ssid, cur->Ssid.SsidLength))
 741                         || (ielen == 0 && pmlmeinfo->hidden_ssid_mode)
 742                 )
 743                         return _SUCCESS;
 744
 745 _issue_probersp:
 746                 if ((check_fwstate(pmlmepriv, _FW_LINKED)  &&
 747                         pmlmepriv->cur_network.join_res) || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)) {
 748                         /* DBG_871X("+issue_probersp during ap mode\n"); */
 749                         issue_probersp(padapter, get_sa(pframe), is_valid_p2p_probereq);
 750                 }
 751
 752         }
 753
 754         return _SUCCESS;
 755
 756 }
 757
 758 unsigned int OnProbeRsp(struct adapter *padapter, union recv_frame *precv_frame)
 759 {
 760         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 761
 762         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
 763                 report_survey_event(padapter, precv_frame);
 764                 return _SUCCESS;
 765         }
 766
 767         return _SUCCESS;
 768
 769 }
 770
 771 unsigned int OnBeacon(struct adapter *padapter, union recv_frame *precv_frame)
 772 {
 773         int cam_idx;
 774         struct sta_info *psta;
 775         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 776         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 777         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
 778         struct sta_priv *pstapriv = &padapter->stapriv;
 779         u8 *pframe = precv_frame->u.hdr.rx_data;
 780         uint len = precv_frame->u.hdr.len;
 781         struct wlan_bssid_ex *pbss;
 782         int ret = _SUCCESS;
 783         u8 *p = NULL;
 784         u32 ielen = 0;
 785
 786         p = rtw_get_ie(pframe + sizeof(struct ieee80211_hdr_3addr) + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, &ielen, precv_frame->u.hdr.len - sizeof(struct ieee80211_hdr_3addr) - _BEACON_IE_OFFSET_);
 787         if ((p != NULL) && (ielen > 0)) {
 788                 if ((*(p + 1 + ielen) == 0x2D) && (*(p + 2 + ielen) != 0x2D)) {
 789                         /* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */
 790                         DBG_871X("[WIFIDBG] Error in ESR IE is detected in Beacon of BSSID:"MAC_FMT". Fix the length of ESR IE to avoid failed Beacon parsing.\n", MAC_ARG(GetAddr3Ptr(pframe)));
 791                         *(p + 1) = ielen - 1;
 792                 }
 793         }
 794
 795         if (pmlmeext->sitesurvey_res.state == SCAN_PROCESS) {
 796                 report_survey_event(padapter, precv_frame);
 797                 return _SUCCESS;
 798         }
 799
 800         if (!memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN)) {
 801                 if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
 802                         /* we should update current network before auth, or some IE is wrong */
 803                         pbss = rtw_malloc(sizeof(struct wlan_bssid_ex));
 804                         if (pbss) {
 805                                 if (collect_bss_info(padapter, precv_frame, pbss) == _SUCCESS) {
 806                                         update_network(&(pmlmepriv->cur_network.network), pbss, padapter, true);
 807                                         rtw_get_bcn_info(&(pmlmepriv->cur_network));
 808                                 }
 809                                 kfree(pbss);
 810                         }
 811
 812                         /* check the vendor of the assoc AP */
 813                         pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pframe+sizeof(struct ieee80211_hdr_3addr), len-sizeof(struct ieee80211_hdr_3addr));
 814
 815                         /* update TSF Value */
 816                         update_TSF(pmlmeext, pframe, len);
 817
 818                         /* reset for adaptive_early_32k */
 819                         pmlmeext->adaptive_tsf_done = false;
 820                         pmlmeext->DrvBcnEarly = 0xff;
 821                         pmlmeext->DrvBcnTimeOut = 0xff;
 822                         pmlmeext->bcn_cnt = 0;
 823                         memset(pmlmeext->bcn_delay_cnt, 0, sizeof(pmlmeext->bcn_delay_cnt));
 824                         memset(pmlmeext->bcn_delay_ratio, 0, sizeof(pmlmeext->bcn_delay_ratio));
 825
 826                         /* start auth */
 827                         start_clnt_auth(padapter);
 828
 829                         return _SUCCESS;
 830                 }
 831
 832                 if (((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) && (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)) {
 833                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 834                         if (psta != NULL) {
 835                                 ret = rtw_check_bcn_info(padapter, pframe, len);
 836                                 if (!ret) {
 837                                                 DBG_871X_LEVEL(_drv_always_, "ap has changed, disconnect now\n ");
 838                                                 receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 0);
 839                                                 return _SUCCESS;
 840                                 }
 841                                 /* update WMM, ERP in the beacon */
 842                                 /* todo: the timer is used instead of the number of the beacon received */
 843                                 if ((sta_rx_pkts(psta) & 0xf) == 0)
 844                                         /* DBG_871X("update_bcn_info\n"); */
 845                                         update_beacon_info(padapter, pframe, len, psta);
 846
 847                                 adaptive_early_32k(pmlmeext, pframe, len);
 848                         }
 849                 } else if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
 850                         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
 851                         if (psta != NULL) {
 852                                 /* update WMM, ERP in the beacon */
 853                                 /* todo: the timer is used instead of the number of the beacon received */
 854                                 if ((sta_rx_pkts(psta) & 0xf) == 0) {
 855                                         /* DBG_871X("update_bcn_info\n"); */
 856                                         update_beacon_info(padapter, pframe, len, psta);
 857                                 }
 858                         } else {
 859                                 /* allocate a new CAM entry for IBSS station */
 860                                 cam_idx = allocate_fw_sta_entry(padapter);
 861                                 if (cam_idx == NUM_STA)
 862                                         goto _END_ONBEACON_;
 863
 864                                 /* get supported rate */
 865                                 if (update_sta_support_rate(padapter, (pframe + WLAN_HDR_A3_LEN + _BEACON_IE_OFFSET_), (len - WLAN_HDR_A3_LEN - _BEACON_IE_OFFSET_), cam_idx) == _FAIL) {
 866                                         pmlmeinfo->FW_sta_info[cam_idx].status = 0;
 867                                         goto _END_ONBEACON_;
 868                                 }
 869
 870                                 /* update TSF Value */
 871                                 update_TSF(pmlmeext, pframe, len);
 872
 873                                 /* report sta add event */
 874                                 report_add_sta_event(padapter, GetAddr2Ptr(pframe), cam_idx);
 875                         }
 876                 }
 877         }
 878
 879 _END_ONBEACON_:
 880
 881         return _SUCCESS;
 882
 883 }
 884
 885 unsigned int OnAuth(struct adapter *padapter, union recv_frame *precv_frame)
 886 {
 887         unsigned int    auth_mode, seq, ie_len;
 888         unsigned char *sa, *p;
 889         u16 algorithm;
 890         int     status;
 891         static struct sta_info stat;
 892         struct  sta_info *pstat = NULL;
 893         struct  sta_priv *pstapriv = &padapter->stapriv;
 894         struct security_priv *psecuritypriv = &padapter->securitypriv;
 895         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
 896         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
 897         u8 *pframe = precv_frame->u.hdr.rx_data;
 898         uint len = precv_frame->u.hdr.len;
 899         u8 offset = 0;
 900
 901         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
 902                 return _FAIL;
 903
 904         DBG_871X("+OnAuth\n");
 905
 906         sa = GetAddr2Ptr(pframe);
 907
 908         auth_mode = psecuritypriv->dot11AuthAlgrthm;
 909
 910         if (GetPrivacy(pframe)) {
 911                 u8 *iv;
 912                 struct rx_pkt_attrib     *prxattrib = &(precv_frame->u.hdr.attrib);
 913
 914                 prxattrib->hdrlen = WLAN_HDR_A3_LEN;
 915                 prxattrib->encrypt = _WEP40_;
 916
 917                 iv = pframe+prxattrib->hdrlen;
 918                 prxattrib->key_index = ((iv[3]>>6)&0x3);
 919
 920                 prxattrib->iv_len = 4;
 921                 prxattrib->icv_len = 4;
 922
 923                 rtw_wep_decrypt(padapter, (u8 *)precv_frame);
 924
 925                 offset = 4;
 926         }
 927
 928         algorithm = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset));
 929         seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
 930
 931         DBG_871X("auth alg =%x, seq =%X\n", algorithm, seq);
 932
 933         if (auth_mode == 2 &&
 934                         psecuritypriv->dot11PrivacyAlgrthm != _WEP40_ &&
 935                         psecuritypriv->dot11PrivacyAlgrthm != _WEP104_)
 936                 auth_mode = 0;
 937
 938         if ((algorithm > 0 && auth_mode == 0) ||        /*  rx a shared-key auth but shared not enabled */
 939                 (algorithm == 0 && auth_mode == 1)) {   /*  rx a open-system auth but shared-key is enabled */
 940                 DBG_871X("auth rejected due to bad alg [alg =%d, auth_mib =%d] %02X%02X%02X%02X%02X%02X\n",
 941                         algorithm, auth_mode, sa[0], sa[1], sa[2], sa[3], sa[4], sa[5]);
 942
 943                 status = _STATS_NO_SUPP_ALG_;
 944
 945                 goto auth_fail;
 946         }
 947
 948         if (rtw_access_ctrl(padapter, sa) == false) {
 949                 status = _STATS_UNABLE_HANDLE_STA_;
 950                 goto auth_fail;
 951         }
 952
 953         pstat = rtw_get_stainfo(pstapriv, sa);
 954         if (pstat == NULL) {
 955
 956                 /*  allocate a new one */
 957                 DBG_871X("going to alloc stainfo for sa ="MAC_FMT"\n",  MAC_ARG(sa));
 958                 pstat = rtw_alloc_stainfo(pstapriv, sa);
 959                 if (pstat == NULL) {
 960                         DBG_871X(" Exceed the upper limit of supported clients...\n");
 961                         status = _STATS_UNABLE_HANDLE_STA_;
 962                         goto auth_fail;
 963                 }
 964
 965                 pstat->state = WIFI_FW_AUTH_NULL;
 966                 pstat->auth_seq = 0;
 967
 968                 /* pstat->flags = 0; */
 969                 /* pstat->capability = 0; */
 970         } else {
 971
 972                 spin_lock_bh(&pstapriv->asoc_list_lock);
 973                 if (list_empty(&pstat->asoc_list) == false) {
 974                         list_del_init(&pstat->asoc_list);
 975                         pstapriv->asoc_list_cnt--;
 976                         if (pstat->expire_to > 0) {
 977                                 /* TODO: STA re_auth within expire_to */
 978                         }
 979                 }
 980                 spin_unlock_bh(&pstapriv->asoc_list_lock);
 981
 982                 if (seq == 1) {
 983                         /* TODO: STA re_auth and auth timeout */
 984                 }
 985         }
 986
 987         spin_lock_bh(&pstapriv->auth_list_lock);
 988         if (list_empty(&pstat->auth_list)) {
 989
 990                 list_add_tail(&pstat->auth_list, &pstapriv->auth_list);
 991                 pstapriv->auth_list_cnt++;
 992         }
 993         spin_unlock_bh(&pstapriv->auth_list_lock);
 994
 995         if (pstat->auth_seq == 0)
 996                 pstat->expire_to = pstapriv->auth_to;
 997
 998
 999         if ((pstat->auth_seq + 1) != seq) {
1000                 DBG_871X("(1)auth rejected because out of seq [rx_seq =%d, exp_seq =%d]!\n",
1001                         seq, pstat->auth_seq+1);
1002                 status = _STATS_OUT_OF_AUTH_SEQ_;
1003                 goto auth_fail;
1004         }
1005
1006         if (algorithm == 0 && (auth_mode == 0 || auth_mode == 2 || auth_mode == 3)) {
1007                 if (seq == 1) {
1008                         pstat->state &= ~WIFI_FW_AUTH_NULL;
1009                         pstat->state |= WIFI_FW_AUTH_SUCCESS;
1010                         pstat->expire_to = pstapriv->assoc_to;
1011                         pstat->authalg = algorithm;
1012                 } else {
1013                         DBG_871X("(2)auth rejected because out of seq [rx_seq =%d, exp_seq =%d]!\n",
1014                                 seq, pstat->auth_seq+1);
1015                         status = _STATS_OUT_OF_AUTH_SEQ_;
1016                         goto auth_fail;
1017                 }
1018         } else { /*  shared system or auto authentication */
1019                 if (seq == 1) {
1020                         /* prepare for the challenging txt... */
1021                         memset((void *)pstat->chg_txt, 78, 128);
1022
1023                         pstat->state &= ~WIFI_FW_AUTH_NULL;
1024                         pstat->state |= WIFI_FW_AUTH_STATE;
1025                         pstat->authalg = algorithm;
1026                         pstat->auth_seq = 2;
1027                 } else if (seq == 3) {
1028                         /* checking for challenging txt... */
1029                         DBG_871X("checking for challenging txt...\n");
1030
1031                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&ie_len,
1032                                         len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
1033
1034                         if ((p == NULL) || (ie_len <= 0)) {
1035                                 DBG_871X("auth rejected because challenge failure!(1)\n");
1036                                 status = _STATS_CHALLENGE_FAIL_;
1037                                 goto auth_fail;
1038                         }
1039
1040                         if (!memcmp((void *)(p + 2), pstat->chg_txt, 128)) {
1041                                 pstat->state &= (~WIFI_FW_AUTH_STATE);
1042                                 pstat->state |= WIFI_FW_AUTH_SUCCESS;
1043                                 /*  challenging txt is correct... */
1044                                 pstat->expire_to =  pstapriv->assoc_to;
1045                         } else {
1046                                 DBG_871X("auth rejected because challenge failure!\n");
1047                                 status = _STATS_CHALLENGE_FAIL_;
1048                                 goto auth_fail;
1049                         }
1050                 } else {
1051                         DBG_871X("(3)auth rejected because out of seq [rx_seq =%d, exp_seq =%d]!\n",
1052                                 seq, pstat->auth_seq+1);
1053                         status = _STATS_OUT_OF_AUTH_SEQ_;
1054                         goto auth_fail;
1055                 }
1056         }
1057
1058
1059         /*  Now, we are going to issue_auth... */
1060         pstat->auth_seq = seq + 1;
1061
1062         issue_auth(padapter, pstat, (unsigned short)(_STATS_SUCCESSFUL_));
1063
1064         if (pstat->state & WIFI_FW_AUTH_SUCCESS)
1065                 pstat->auth_seq = 0;
1066
1067
1068         return _SUCCESS;
1069
1070 auth_fail:
1071
1072         if (pstat)
1073                 rtw_free_stainfo(padapter, pstat);
1074
1075         pstat = &stat;
1076         memset((char *)pstat, '\0', sizeof(stat));
1077         pstat->auth_seq = 2;
1078         memcpy(pstat->hwaddr, sa, 6);
1079
1080         issue_auth(padapter, pstat, (unsigned short)status);
1081
1082         return _FAIL;
1083
1084 }
1085
1086 unsigned int OnAuthClient(struct adapter *padapter, union recv_frame *precv_frame)
1087 {
1088         unsigned int    seq, len, status, offset;
1089         unsigned char *p;
1090         unsigned int    go2asoc = 0;
1091         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1092         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1093         u8 *pframe = precv_frame->u.hdr.rx_data;
1094         uint pkt_len = precv_frame->u.hdr.len;
1095
1096         DBG_871X("%s\n", __func__);
1097
1098         /* check A1 matches or not */
1099         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
1100                 return _SUCCESS;
1101
1102         if (!(pmlmeinfo->state & WIFI_FW_AUTH_STATE))
1103                 return _SUCCESS;
1104
1105         offset = (GetPrivacy(pframe)) ? 4 : 0;
1106
1107         seq     = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 2));
1108         status  = le16_to_cpu(*(__le16 *)((SIZE_PTR)pframe + WLAN_HDR_A3_LEN + offset + 4));
1109
1110         if (status != 0) {
1111                 DBG_871X("clnt auth fail, status: %d\n", status);
1112                 if (status == 13) { /*  pmlmeinfo->auth_algo == dot11AuthAlgrthm_Auto) */
1113                         if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared)
1114                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Open;
1115                         else
1116                                 pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared;
1117                         /* pmlmeinfo->reauth_count = 0; */
1118                 }
1119
1120                 set_link_timer(pmlmeext, 1);
1121                 goto authclnt_fail;
1122         }
1123
1124         if (seq == 2) {
1125                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
1126                          /*  legendary shared system */
1127                         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&len,
1128                                 pkt_len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_);
1129
1130                         if (p == NULL) {
1131                                 /* DBG_871X("marc: no challenge text?\n"); */
1132                                 goto authclnt_fail;
1133                         }
1134
1135                         memcpy((void *)(pmlmeinfo->chg_txt), (void *)(p + 2), len);
1136                         pmlmeinfo->auth_seq = 3;
1137                         issue_auth(padapter, NULL, 0);
1138                         set_link_timer(pmlmeext, REAUTH_TO);
1139
1140                         return _SUCCESS;
1141                 } else {
1142                         /*  open system */
1143                         go2asoc = 1;
1144                 }
1145         } else if (seq == 4) {
1146                 if (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) {
1147                         go2asoc = 1;
1148                 } else {
1149                         goto authclnt_fail;
1150                 }
1151         } else {
1152                 /*  this is also illegal */
1153                 /* DBG_871X("marc: clnt auth failed due to illegal seq =%x\n", seq); */
1154                 goto authclnt_fail;
1155         }
1156
1157         if (go2asoc) {
1158                 DBG_871X_LEVEL(_drv_always_, "auth success, start assoc\n");
1159                 start_clnt_assoc(padapter);
1160                 return _SUCCESS;
1161         }
1162
1163 authclnt_fail:
1164
1165         /* pmlmeinfo->state &= ~(WIFI_FW_AUTH_STATE); */
1166
1167         return _FAIL;
1168
1169 }
1170
1171 unsigned int OnAssocReq(struct adapter *padapter, union recv_frame *precv_frame)
1172 {
1173         u16 capab_info;
1174         struct rtw_ieee802_11_elems elems;
1175         struct sta_info *pstat;
1176         unsigned char   reassoc, *p, *pos, *wpa_ie;
1177         unsigned char WMM_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x00, 0x01};
1178         int             i, ie_len, wpa_ie_len, left;
1179         unsigned char   supportRate[16];
1180         int                                     supportRateNum;
1181         unsigned short          status = _STATS_SUCCESSFUL_;
1182         unsigned short          frame_type, ie_offset = 0;
1183         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1184         struct security_priv *psecuritypriv = &padapter->securitypriv;
1185         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1186         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1187         struct wlan_bssid_ex    *cur = &(pmlmeinfo->network);
1188         struct sta_priv *pstapriv = &padapter->stapriv;
1189         u8 *pframe = precv_frame->u.hdr.rx_data;
1190         uint pkt_len = precv_frame->u.hdr.len;
1191
1192         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1193                 return _FAIL;
1194
1195         frame_type = GetFrameSubType(pframe);
1196         if (frame_type == WIFI_ASSOCREQ) {
1197                 reassoc = 0;
1198                 ie_offset = _ASOCREQ_IE_OFFSET_;
1199         } else { /*  WIFI_REASSOCREQ */
1200                 reassoc = 1;
1201                 ie_offset = _REASOCREQ_IE_OFFSET_;
1202         }
1203
1204
1205         if (pkt_len < sizeof(struct ieee80211_hdr_3addr) + ie_offset) {
1206                 DBG_871X("handle_assoc(reassoc =%d) - too short payload (len =%lu)"
1207                        "\n", reassoc, (unsigned long)pkt_len);
1208                 return _FAIL;
1209         }
1210
1211         pstat = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1212         if (!pstat) {
1213                 status = _RSON_CLS2_;
1214                 goto asoc_class2_error;
1215         }
1216
1217         capab_info = get_unaligned_le16(pframe + WLAN_HDR_A3_LEN);
1218         /* capab_info = le16_to_cpu(*(unsigned short *)(pframe + WLAN_HDR_A3_LEN)); */
1219
1220         left = pkt_len - (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
1221         pos = pframe + (sizeof(struct ieee80211_hdr_3addr) + ie_offset);
1222
1223
1224         DBG_871X("%s\n", __func__);
1225
1226         /*  check if this stat has been successfully authenticated/assocated */
1227         if (!((pstat->state) & WIFI_FW_AUTH_SUCCESS)) {
1228                 if (!((pstat->state) & WIFI_FW_ASSOC_SUCCESS)) {
1229                         status = _RSON_CLS2_;
1230                         goto asoc_class2_error;
1231                 } else {
1232                         pstat->state &= (~WIFI_FW_ASSOC_SUCCESS);
1233                         pstat->state |= WIFI_FW_ASSOC_STATE;
1234                 }
1235         } else {
1236                 pstat->state &= (~WIFI_FW_AUTH_SUCCESS);
1237                 pstat->state |= WIFI_FW_ASSOC_STATE;
1238         }
1239
1240
1241         pstat->capability = capab_info;
1242
1243         /* now parse all ieee802_11 ie to point to elems */
1244         if (rtw_ieee802_11_parse_elems(pos, left, &elems, 1) == ParseFailed ||
1245             !elems.ssid) {
1246                 DBG_871X("STA " MAC_FMT " sent invalid association request\n",
1247                        MAC_ARG(pstat->hwaddr));
1248                 status = _STATS_FAILURE_;
1249                 goto OnAssocReqFail;
1250         }
1251
1252         /*  now we should check all the fields... */
1253         /*  checking SSID */
1254         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SSID_IE_, &ie_len,
1255                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1256
1257         if (!p || ie_len == 0) {
1258                 /*  broadcast ssid, however it is not allowed in assocreq */
1259                 status = _STATS_FAILURE_;
1260                 goto OnAssocReqFail;
1261         } else {
1262                 /*  check if ssid match */
1263                 if (memcmp((void *)(p+2), cur->Ssid.Ssid, cur->Ssid.SsidLength))
1264                         status = _STATS_FAILURE_;
1265
1266                 if (ie_len != cur->Ssid.SsidLength)
1267                         status = _STATS_FAILURE_;
1268         }
1269
1270         if (status != _STATS_SUCCESSFUL_)
1271                 goto OnAssocReqFail;
1272
1273         /*  check if the supported rate is ok */
1274         p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1275         if (p == NULL) {
1276                 DBG_871X("Rx a sta assoc-req which supported rate is empty!\n");
1277                 /*  use our own rate set as statoin used */
1278                 /* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
1279                 /* supportRateNum = AP_BSSRATE_LEN; */
1280
1281                 status = _STATS_FAILURE_;
1282                 goto OnAssocReqFail;
1283         } else {
1284                 memcpy(supportRate, p+2, ie_len);
1285                 supportRateNum = ie_len;
1286
1287                 p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_, &ie_len,
1288                                 pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1289                 if (p !=  NULL) {
1290
1291                         if (supportRateNum <= sizeof(supportRate)) {
1292                                 memcpy(supportRate+supportRateNum, p+2, ie_len);
1293                                 supportRateNum += ie_len;
1294                         }
1295                 }
1296         }
1297
1298         /* todo: mask supportRate between AP & STA -> move to update raid */
1299         /* get_matched_rate(pmlmeext, supportRate, &supportRateNum, 0); */
1300
1301         /* update station supportRate */
1302         pstat->bssratelen = supportRateNum;
1303         memcpy(pstat->bssrateset, supportRate, supportRateNum);
1304         UpdateBrateTblForSoftAP(pstat->bssrateset, pstat->bssratelen);
1305
1306         /* check RSN/WPA/WPS */
1307         pstat->dot8021xalg = 0;
1308         pstat->wpa_psk = 0;
1309         pstat->wpa_group_cipher = 0;
1310         pstat->wpa2_group_cipher = 0;
1311         pstat->wpa_pairwise_cipher = 0;
1312         pstat->wpa2_pairwise_cipher = 0;
1313         memset(pstat->wpa_ie, 0, sizeof(pstat->wpa_ie));
1314         if ((psecuritypriv->wpa_psk & BIT(1)) && elems.rsn_ie) {
1315
1316                 int group_cipher = 0, pairwise_cipher = 0;
1317
1318                 wpa_ie = elems.rsn_ie;
1319                 wpa_ie_len = elems.rsn_ie_len;
1320
1321                 if (rtw_parse_wpa2_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
1322                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
1323                         pstat->wpa_psk |= BIT(1);
1324
1325                         pstat->wpa2_group_cipher = group_cipher&psecuritypriv->wpa2_group_cipher;
1326                         pstat->wpa2_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa2_pairwise_cipher;
1327
1328                         if (!pstat->wpa2_group_cipher)
1329                                 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1330
1331                         if (!pstat->wpa2_pairwise_cipher)
1332                                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1333                 } else {
1334                         status = WLAN_STATUS_INVALID_IE;
1335                 }
1336
1337         } else if ((psecuritypriv->wpa_psk & BIT(0)) && elems.wpa_ie) {
1338
1339                 int group_cipher = 0, pairwise_cipher = 0;
1340
1341                 wpa_ie = elems.wpa_ie;
1342                 wpa_ie_len = elems.wpa_ie_len;
1343
1344                 if (rtw_parse_wpa_ie(wpa_ie-2, wpa_ie_len+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
1345                         pstat->dot8021xalg = 1;/* psk,  todo:802.1x */
1346                         pstat->wpa_psk |= BIT(0);
1347
1348                         pstat->wpa_group_cipher = group_cipher&psecuritypriv->wpa_group_cipher;
1349                         pstat->wpa_pairwise_cipher = pairwise_cipher&psecuritypriv->wpa_pairwise_cipher;
1350
1351                         if (!pstat->wpa_group_cipher)
1352                                 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1353
1354                         if (!pstat->wpa_pairwise_cipher)
1355                                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1356
1357                 } else {
1358                         status = WLAN_STATUS_INVALID_IE;
1359                 }
1360
1361         } else {
1362                 wpa_ie = NULL;
1363                 wpa_ie_len = 0;
1364         }
1365
1366         if (status != _STATS_SUCCESSFUL_)
1367                 goto OnAssocReqFail;
1368
1369         pstat->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
1370         if (!wpa_ie) {
1371                 if (elems.wps_ie) {
1372                         DBG_871X("STA included WPS IE in "
1373                                    "(Re)Association Request - assume WPS is "
1374                                    "used\n");
1375                         pstat->flags |= WLAN_STA_WPS;
1376                         /* wpabuf_free(sta->wps_ie); */
1377                         /* sta->wps_ie = wpabuf_alloc_copy(elems.wps_ie + 4, */
1378                         /*                              elems.wps_ie_len - 4); */
1379                 } else {
1380                         DBG_871X("STA did not include WPA/RSN IE "
1381                                    "in (Re)Association Request - possible WPS "
1382                                    "use\n");
1383                         pstat->flags |= WLAN_STA_MAYBE_WPS;
1384                 }
1385
1386
1387                 /*  AP support WPA/RSN, and sta is going to do WPS, but AP is not ready */
1388                 /*  that the selected registrar of AP is _FLASE */
1389                 if ((psecuritypriv->wpa_psk > 0)
1390                         && (pstat->flags & (WLAN_STA_WPS|WLAN_STA_MAYBE_WPS))) {
1391                         if (pmlmepriv->wps_beacon_ie) {
1392                                 u8 selected_registrar = 0;
1393
1394                                 rtw_get_wps_attr_content(pmlmepriv->wps_beacon_ie, pmlmepriv->wps_beacon_ie_len, WPS_ATTR_SELECTED_REGISTRAR, &selected_registrar, NULL);
1395
1396                                 if (!selected_registrar) {
1397                                         DBG_871X("selected_registrar is false , or AP is not ready to do WPS\n");
1398
1399                                         status = _STATS_UNABLE_HANDLE_STA_;
1400
1401                                         goto OnAssocReqFail;
1402                                 }
1403                         }
1404                 }
1405
1406         } else {
1407                 int copy_len;
1408
1409                 if (psecuritypriv->wpa_psk == 0) {
1410                         DBG_871X("STA " MAC_FMT ": WPA/RSN IE in association "
1411                         "request, but AP don't support WPA/RSN\n", MAC_ARG(pstat->hwaddr));
1412
1413                         status = WLAN_STATUS_INVALID_IE;
1414
1415                         goto OnAssocReqFail;
1416
1417                 }
1418
1419                 if (elems.wps_ie) {
1420                         DBG_871X("STA included WPS IE in "
1421                                    "(Re)Association Request - WPS is "
1422                                    "used\n");
1423                         pstat->flags |= WLAN_STA_WPS;
1424                         copy_len = 0;
1425                 } else {
1426                         copy_len = ((wpa_ie_len+2) > sizeof(pstat->wpa_ie)) ? (sizeof(pstat->wpa_ie)):(wpa_ie_len+2);
1427                 }
1428
1429
1430                 if (copy_len > 0)
1431                         memcpy(pstat->wpa_ie, wpa_ie-2, copy_len);
1432
1433         }
1434
1435
1436         /*  check if there is WMM IE & support WWM-PS */
1437         pstat->flags &= ~WLAN_STA_WME;
1438         pstat->qos_option = 0;
1439         pstat->qos_info = 0;
1440         pstat->has_legacy_ac = true;
1441         pstat->uapsd_vo = 0;
1442         pstat->uapsd_vi = 0;
1443         pstat->uapsd_be = 0;
1444         pstat->uapsd_bk = 0;
1445         if (pmlmepriv->qospriv.qos_option) {
1446                 p = pframe + WLAN_HDR_A3_LEN + ie_offset; ie_len = 0;
1447                 for (;;) {
1448                         p = rtw_get_ie(p, _VENDOR_SPECIFIC_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
1449                         if (p != NULL) {
1450                                 if (!memcmp(p+2, WMM_IE, 6)) {
1451
1452                                         pstat->flags |= WLAN_STA_WME;
1453
1454                                         pstat->qos_option = 1;
1455                                         pstat->qos_info = *(p+8);
1456
1457                                         pstat->max_sp_len = (pstat->qos_info>>5)&0x3;
1458
1459                                         if ((pstat->qos_info&0xf) != 0xf)
1460                                                 pstat->has_legacy_ac = true;
1461                                         else
1462                                                 pstat->has_legacy_ac = false;
1463
1464                                         if (pstat->qos_info&0xf) {
1465                                                 if (pstat->qos_info&BIT(0))
1466                                                         pstat->uapsd_vo = BIT(0)|BIT(1);
1467                                                 else
1468                                                         pstat->uapsd_vo = 0;
1469
1470                                                 if (pstat->qos_info&BIT(1))
1471                                                         pstat->uapsd_vi = BIT(0)|BIT(1);
1472                                                 else
1473                                                         pstat->uapsd_vi = 0;
1474
1475                                                 if (pstat->qos_info&BIT(2))
1476                                                         pstat->uapsd_bk = BIT(0)|BIT(1);
1477                                                 else
1478                                                         pstat->uapsd_bk = 0;
1479
1480                                                 if (pstat->qos_info&BIT(3))
1481                                                         pstat->uapsd_be = BIT(0)|BIT(1);
1482                                                 else
1483                                                         pstat->uapsd_be = 0;
1484
1485                                         }
1486
1487                                         break;
1488                                 }
1489                         } else {
1490                                 break;
1491                         }
1492                         p = p + ie_len + 2;
1493                 }
1494         }
1495
1496         /* save HT capabilities in the sta object */
1497         memset(&pstat->htpriv.ht_cap, 0, sizeof(struct rtw_ieee80211_ht_cap));
1498         if (elems.ht_capabilities && elems.ht_capabilities_len >= sizeof(struct rtw_ieee80211_ht_cap)) {
1499                 pstat->flags |= WLAN_STA_HT;
1500
1501                 pstat->flags |= WLAN_STA_WME;
1502
1503                 memcpy(&pstat->htpriv.ht_cap, elems.ht_capabilities, sizeof(struct rtw_ieee80211_ht_cap));
1504
1505         } else
1506                 pstat->flags &= ~WLAN_STA_HT;
1507
1508
1509         if ((pmlmepriv->htpriv.ht_option == false) && (pstat->flags&WLAN_STA_HT)) {
1510                 status = _STATS_FAILURE_;
1511                 goto OnAssocReqFail;
1512         }
1513
1514
1515         if ((pstat->flags & WLAN_STA_HT) &&
1516                     ((pstat->wpa2_pairwise_cipher&WPA_CIPHER_TKIP) ||
1517                       (pstat->wpa_pairwise_cipher&WPA_CIPHER_TKIP))) {
1518                 DBG_871X("HT: " MAC_FMT " tried to "
1519                                    "use TKIP with HT association\n", MAC_ARG(pstat->hwaddr));
1520
1521                 /* status = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY; */
1522                 /* goto OnAssocReqFail; */
1523         }
1524         pstat->flags |= WLAN_STA_NONERP;
1525         for (i = 0; i < pstat->bssratelen; i++) {
1526                 if ((pstat->bssrateset[i] & 0x7f) > 22) {
1527                         pstat->flags &= ~WLAN_STA_NONERP;
1528                         break;
1529                 }
1530         }
1531
1532         if (pstat->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1533                 pstat->flags |= WLAN_STA_SHORT_PREAMBLE;
1534         else
1535                 pstat->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1536
1537
1538
1539         if (status != _STATS_SUCCESSFUL_)
1540                 goto OnAssocReqFail;
1541
1542         /* TODO: identify_proprietary_vendor_ie(); */
1543         /*  Realtek proprietary IE */
1544         /*  identify if this is Broadcom sta */
1545         /*  identify if this is ralink sta */
1546         /*  Customer proprietary IE */
1547
1548
1549
1550         /* get a unique AID */
1551         if (pstat->aid > 0) {
1552                 DBG_871X("  old AID %d\n", pstat->aid);
1553         } else {
1554                 for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
1555                         if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
1556                                 break;
1557
1558                 /* if (pstat->aid > NUM_STA) { */
1559                 if (pstat->aid > pstapriv->max_num_sta) {
1560
1561                         pstat->aid = 0;
1562
1563                         DBG_871X("  no room for more AIDs\n");
1564
1565                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1566
1567                         goto OnAssocReqFail;
1568
1569
1570                 } else {
1571                         pstapriv->sta_aid[pstat->aid - 1] = pstat;
1572                         DBG_871X("allocate new AID = (%d)\n", pstat->aid);
1573                 }
1574         }
1575
1576
1577         pstat->state &= (~WIFI_FW_ASSOC_STATE);
1578         pstat->state |= WIFI_FW_ASSOC_SUCCESS;
1579
1580         spin_lock_bh(&pstapriv->auth_list_lock);
1581         if (!list_empty(&pstat->auth_list)) {
1582                 list_del_init(&pstat->auth_list);
1583                 pstapriv->auth_list_cnt--;
1584         }
1585         spin_unlock_bh(&pstapriv->auth_list_lock);
1586
1587         spin_lock_bh(&pstapriv->asoc_list_lock);
1588         if (list_empty(&pstat->asoc_list)) {
1589                 pstat->expire_to = pstapriv->expire_to;
1590                 list_add_tail(&pstat->asoc_list, &pstapriv->asoc_list);
1591                 pstapriv->asoc_list_cnt++;
1592         }
1593         spin_unlock_bh(&pstapriv->asoc_list_lock);
1594
1595         /*  now the station is qualified to join our BSS... */
1596         if (pstat && (pstat->state & WIFI_FW_ASSOC_SUCCESS) && (_STATS_SUCCESSFUL_ == status)) {
1597                 /* 1 bss_cap_update & sta_info_update */
1598                 bss_cap_update_on_sta_join(padapter, pstat);
1599                 sta_info_update(padapter, pstat);
1600
1601                 /* 2 issue assoc rsp before notify station join event. */
1602                 if (frame_type == WIFI_ASSOCREQ)
1603                         issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
1604                 else
1605                         issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
1606
1607                 spin_lock_bh(&pstat->lock);
1608                 if (pstat->passoc_req) {
1609                         kfree(pstat->passoc_req);
1610                         pstat->passoc_req = NULL;
1611                         pstat->assoc_req_len = 0;
1612                 }
1613
1614                 pstat->passoc_req =  rtw_zmalloc(pkt_len);
1615                 if (pstat->passoc_req) {
1616                         memcpy(pstat->passoc_req, pframe, pkt_len);
1617                         pstat->assoc_req_len = pkt_len;
1618                 }
1619                 spin_unlock_bh(&pstat->lock);
1620
1621                 /* 3-(1) report sta add event */
1622                 report_add_sta_event(padapter, pstat->hwaddr, pstat->aid);
1623         }
1624
1625         return _SUCCESS;
1626
1627 asoc_class2_error:
1628
1629         issue_deauth(padapter, (void *)GetAddr2Ptr(pframe), status);
1630
1631         return _FAIL;
1632
1633 OnAssocReqFail:
1634
1635         pstat->aid = 0;
1636         if (frame_type == WIFI_ASSOCREQ)
1637                 issue_asocrsp(padapter, status, pstat, WIFI_ASSOCRSP);
1638         else
1639                 issue_asocrsp(padapter, status, pstat, WIFI_REASSOCRSP);
1640
1641         return _FAIL;
1642 }
1643
1644 unsigned int OnAssocRsp(struct adapter *padapter, union recv_frame *precv_frame)
1645 {
1646         uint i;
1647         int res;
1648         unsigned short  status;
1649         struct ndis_80211_var_ie *pIE;
1650         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1651         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1652         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1653         /* struct wlan_bssid_ex                 *cur_network = &(pmlmeinfo->network); */
1654         u8 *pframe = precv_frame->u.hdr.rx_data;
1655         uint pkt_len = precv_frame->u.hdr.len;
1656
1657         DBG_871X("%s\n", __func__);
1658
1659         /* check A1 matches or not */
1660         if (memcmp(myid(&(padapter->eeprompriv)), get_da(pframe), ETH_ALEN))
1661                 return _SUCCESS;
1662
1663         if (!(pmlmeinfo->state & (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE)))
1664                 return _SUCCESS;
1665
1666         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS)
1667                 return _SUCCESS;
1668
1669         del_timer_sync(&pmlmeext->link_timer);
1670
1671         /* status */
1672         status = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 2));
1673         if (status > 0) {
1674                 DBG_871X("assoc reject, status code: %d\n", status);
1675                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
1676                 res = -4;
1677                 goto report_assoc_result;
1678         }
1679
1680         /* get capabilities */
1681         pmlmeinfo->capability = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1682
1683         /* set slot time */
1684         pmlmeinfo->slotTime = (pmlmeinfo->capability & BIT(10)) ? 9 : 20;
1685
1686         /* AID */
1687         res = pmlmeinfo->aid = (int)(le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN + 4))&0x3fff);
1688
1689         /* following are moved to join event callback function */
1690         /* to handle HT, WMM, rate adaptive, update MAC reg */
1691         /* for not to handle the synchronous IO in the tasklet */
1692         for (i = (6 + WLAN_HDR_A3_LEN); i < pkt_len;) {
1693                 pIE = (struct ndis_80211_var_ie *)(pframe + i);
1694
1695                 switch (pIE->ElementID) {
1696                 case _VENDOR_SPECIFIC_IE_:
1697                         if (!memcmp(pIE->data, WMM_PARA_OUI, 6))        /* WMM */
1698                                 WMM_param_handler(padapter, pIE);
1699                         break;
1700
1701                 case _HT_CAPABILITY_IE_:        /* HT caps */
1702                         HT_caps_handler(padapter, pIE);
1703                         break;
1704
1705                 case _HT_EXTRA_INFO_IE_:        /* HT info */
1706                         HT_info_handler(padapter, pIE);
1707                         break;
1708
1709                 case _ERPINFO_IE_:
1710                         ERP_IE_handler(padapter, pIE);
1711
1712                 default:
1713                         break;
1714                 }
1715
1716                 i += (pIE->Length + 2);
1717         }
1718
1719         pmlmeinfo->state &= (~WIFI_FW_ASSOC_STATE);
1720         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
1721
1722         /* Update Basic Rate Table for spec, 2010-12-28 , by thomas */
1723         UpdateBrateTbl(padapter, pmlmeinfo->network.SupportedRates);
1724
1725 report_assoc_result:
1726         if (res > 0) {
1727                 rtw_buf_update(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len, pframe, pkt_len);
1728         } else {
1729                 rtw_buf_free(&pmlmepriv->assoc_rsp, &pmlmepriv->assoc_rsp_len);
1730         }
1731
1732         report_join_res(padapter, res);
1733
1734         return _SUCCESS;
1735 }
1736
1737 unsigned int OnDeAuth(struct adapter *padapter, union recv_frame *precv_frame)
1738 {
1739         unsigned short  reason;
1740         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1741         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1742         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1743         u8 *pframe = precv_frame->u.hdr.rx_data;
1744
1745         /* check A3 */
1746         if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
1747                 return _SUCCESS;
1748
1749         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1750
1751         DBG_871X("%s Reason code(%d)\n", __func__, reason);
1752
1753         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1754                 struct sta_info *psta;
1755                 struct sta_priv *pstapriv = &padapter->stapriv;
1756
1757                 /* spin_lock_bh(&(pstapriv->sta_hash_lock)); */
1758                 /* rtw_free_stainfo(padapter, psta); */
1759                 /* spin_unlock_bh(&(pstapriv->sta_hash_lock)); */
1760
1761                 DBG_871X_LEVEL(_drv_always_, "ap recv deauth reason code(%d) sta:%pM\n",
1762                                 reason, GetAddr2Ptr(pframe));
1763
1764                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1765                 if (psta) {
1766                         u8 updated = false;
1767
1768                         spin_lock_bh(&pstapriv->asoc_list_lock);
1769                         if (list_empty(&psta->asoc_list) == false) {
1770                                 list_del_init(&psta->asoc_list);
1771                                 pstapriv->asoc_list_cnt--;
1772                                 updated = ap_free_sta(padapter, psta, false, reason);
1773
1774                         }
1775                         spin_unlock_bh(&pstapriv->asoc_list_lock);
1776
1777                         associated_clients_update(padapter, updated);
1778                 }
1779
1780
1781                 return _SUCCESS;
1782         } else {
1783                 int     ignore_received_deauth = 0;
1784
1785                 /*      Commented by Albert 20130604 */
1786                 /*      Before sending the auth frame to start the STA/GC mode connection with AP/GO, */
1787                 /*      we will send the deauth first. */
1788                 /*      However, the Win8.1 with BRCM Wi-Fi will send the deauth with reason code 6 to us after receieving our deauth. */
1789                 /*      Added the following code to avoid this case. */
1790                 if ((pmlmeinfo->state & WIFI_FW_AUTH_STATE) ||
1791                         (pmlmeinfo->state & WIFI_FW_ASSOC_STATE)) {
1792                         if (reason == WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA) {
1793                                 ignore_received_deauth = 1;
1794                         } else if (WLAN_REASON_PREV_AUTH_NOT_VALID == reason) {
1795                                 /*  TODO: 802.11r */
1796                                 ignore_received_deauth = 1;
1797                         }
1798                 }
1799
1800                 DBG_871X_LEVEL(_drv_always_, "sta recv deauth reason code(%d) sta:%pM, ignore = %d\n",
1801                                 reason, GetAddr3Ptr(pframe), ignore_received_deauth);
1802
1803                 if (0 == ignore_received_deauth) {
1804                         receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
1805                 }
1806         }
1807         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
1808         return _SUCCESS;
1809
1810 }
1811
1812 unsigned int OnDisassoc(struct adapter *padapter, union recv_frame *precv_frame)
1813 {
1814         unsigned short  reason;
1815         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
1816         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1817         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1818         u8 *pframe = precv_frame->u.hdr.rx_data;
1819
1820         /* check A3 */
1821         if (memcmp(GetAddr3Ptr(pframe), get_my_bssid(&pmlmeinfo->network), ETH_ALEN))
1822                 return _SUCCESS;
1823
1824         reason = le16_to_cpu(*(__le16 *)(pframe + WLAN_HDR_A3_LEN));
1825
1826         DBG_871X("%s Reason code(%d)\n", __func__, reason);
1827
1828         if (check_fwstate(pmlmepriv, WIFI_AP_STATE)) {
1829                 struct sta_info *psta;
1830                 struct sta_priv *pstapriv = &padapter->stapriv;
1831
1832                 /* spin_lock_bh(&(pstapriv->sta_hash_lock)); */
1833                 /* rtw_free_stainfo(padapter, psta); */
1834                 /* spin_unlock_bh(&(pstapriv->sta_hash_lock)); */
1835
1836                 DBG_871X_LEVEL(_drv_always_, "ap recv disassoc reason code(%d) sta:%pM\n",
1837                                 reason, GetAddr2Ptr(pframe));
1838
1839                 psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1840                 if (psta) {
1841                         u8 updated = false;
1842
1843                         spin_lock_bh(&pstapriv->asoc_list_lock);
1844                         if (list_empty(&psta->asoc_list) == false) {
1845                                 list_del_init(&psta->asoc_list);
1846                                 pstapriv->asoc_list_cnt--;
1847                                 updated = ap_free_sta(padapter, psta, false, reason);
1848
1849                         }
1850                         spin_unlock_bh(&pstapriv->asoc_list_lock);
1851
1852                         associated_clients_update(padapter, updated);
1853                 }
1854
1855                 return _SUCCESS;
1856         } else {
1857                 DBG_871X_LEVEL(_drv_always_, "sta recv disassoc reason code(%d) sta:%pM\n",
1858                                 reason, GetAddr3Ptr(pframe));
1859
1860                 receive_disconnect(padapter, GetAddr3Ptr(pframe), reason);
1861         }
1862         pmlmepriv->LinkDetectInfo.bBusyTraffic = false;
1863         return _SUCCESS;
1864
1865 }
1866
1867 unsigned int OnAtim(struct adapter *padapter, union recv_frame *precv_frame)
1868 {
1869         DBG_871X("%s\n", __func__);
1870         return _SUCCESS;
1871 }
1872
1873 unsigned int on_action_spct(struct adapter *padapter, union recv_frame *precv_frame)
1874 {
1875         struct sta_info *psta = NULL;
1876         struct sta_priv *pstapriv = &padapter->stapriv;
1877         u8 *pframe = precv_frame->u.hdr.rx_data;
1878         u8 *frame_body = (u8 *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1879         u8 category;
1880         u8 action;
1881
1882         DBG_871X(FUNC_NDEV_FMT"\n", FUNC_NDEV_ARG(padapter->pnetdev));
1883
1884         psta = rtw_get_stainfo(pstapriv, GetAddr2Ptr(pframe));
1885
1886         if (!psta)
1887                 goto exit;
1888
1889         category = frame_body[0];
1890         if (category != RTW_WLAN_CATEGORY_SPECTRUM_MGMT)
1891                 goto exit;
1892
1893         action = frame_body[1];
1894         switch (action) {
1895         case RTW_WLAN_ACTION_SPCT_MSR_REQ:
1896         case RTW_WLAN_ACTION_SPCT_MSR_RPRT:
1897         case RTW_WLAN_ACTION_SPCT_TPC_REQ:
1898         case RTW_WLAN_ACTION_SPCT_TPC_RPRT:
1899         case RTW_WLAN_ACTION_SPCT_CHL_SWITCH:
1900                 break;
1901         default:
1902                 break;
1903         }
1904
1905 exit:
1906         return _FAIL;
1907 }
1908
1909 unsigned int OnAction_back(struct adapter *padapter, union recv_frame *precv_frame)
1910 {
1911         u8 *addr;
1912         struct sta_info *psta = NULL;
1913         struct recv_reorder_ctrl *preorder_ctrl;
1914         unsigned char   *frame_body;
1915         unsigned char   category, action;
1916         unsigned short  tid, status, reason_code = 0;
1917         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
1918         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
1919         u8 *pframe = precv_frame->u.hdr.rx_data;
1920         struct sta_priv *pstapriv = &padapter->stapriv;
1921
1922         DBG_871X("%s\n", __func__);
1923
1924         /* check RA matches or not */
1925         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))/* for if1, sta/ap mode */
1926                 return _SUCCESS;
1927
1928         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
1929                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
1930                         return _SUCCESS;
1931
1932         addr = GetAddr2Ptr(pframe);
1933         psta = rtw_get_stainfo(pstapriv, addr);
1934
1935         if (!psta)
1936                 return _SUCCESS;
1937
1938         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
1939
1940         category = frame_body[0];
1941         if (category == RTW_WLAN_CATEGORY_BACK) {/*  representing Block Ack */
1942                 if (!pmlmeinfo->HT_enable)
1943                         return _SUCCESS;
1944
1945                 action = frame_body[1];
1946                 DBG_871X("%s, action =%d\n", __func__, action);
1947                 switch (action) {
1948                 case RTW_WLAN_ACTION_ADDBA_REQ: /* ADDBA request */
1949
1950                         memcpy(&(pmlmeinfo->ADDBA_req), &(frame_body[2]), sizeof(struct ADDBA_request));
1951                         /* process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), GetAddr3Ptr(pframe)); */
1952                         process_addba_req(padapter, (u8 *)&(pmlmeinfo->ADDBA_req), addr);
1953
1954                         if (pmlmeinfo->accept_addba_req) {
1955                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 0);
1956                         } else {
1957                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_ADDBA_RESP, 37);/* reject ADDBA Req */
1958                         }
1959
1960                         break;
1961
1962                 case RTW_WLAN_ACTION_ADDBA_RESP: /* ADDBA response */
1963                         status = get_unaligned_le16(&frame_body[3]);
1964                         tid = ((frame_body[5] >> 2) & 0x7);
1965
1966                         if (status == 0) {
1967                                 /* successful */
1968                                 DBG_871X("agg_enable for TID =%d\n", tid);
1969                                 psta->htpriv.agg_enable_bitmap |= BIT(tid);
1970                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
1971                         } else {
1972                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1973                         }
1974
1975                         if (psta->state & WIFI_STA_ALIVE_CHK_STATE) {
1976                                 DBG_871X("%s alive check - rx ADDBA response\n", __func__);
1977                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
1978                                 psta->expire_to = pstapriv->expire_to;
1979                                 psta->state ^= WIFI_STA_ALIVE_CHK_STATE;
1980                         }
1981
1982                         /* DBG_871X("marc: ADDBA RSP: %x\n", pmlmeinfo->agg_enable_bitmap); */
1983                         break;
1984
1985                 case RTW_WLAN_ACTION_DELBA: /* DELBA */
1986                         if ((frame_body[3] & BIT(3)) == 0) {
1987                                 psta->htpriv.agg_enable_bitmap &=
1988                                         ~BIT((frame_body[3] >> 4) & 0xf);
1989                                 psta->htpriv.candidate_tid_bitmap &=
1990                                         ~BIT((frame_body[3] >> 4) & 0xf);
1991
1992                                 /* reason_code = frame_body[4] | (frame_body[5] << 8); */
1993                                 reason_code = get_unaligned_le16(&frame_body[4]);
1994                         } else if ((frame_body[3] & BIT(3)) == BIT(3)) {
1995                                 tid = (frame_body[3] >> 4) & 0x0F;
1996
1997                                 preorder_ctrl =  &psta->recvreorder_ctrl[tid];
1998                                 preorder_ctrl->enable = false;
1999                                 preorder_ctrl->indicate_seq = 0xffff;
2000                                 #ifdef DBG_RX_SEQ
2001                                 DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u\n", __func__, __LINE__,
2002                                         preorder_ctrl->indicate_seq);
2003                                 #endif
2004                         }
2005
2006                         DBG_871X("%s(): DELBA: %x(%x)\n", __func__, pmlmeinfo->agg_enable_bitmap, reason_code);
2007                         /* todo: how to notify the host while receiving DELETE BA */
2008                         break;
2009
2010                 default:
2011                         break;
2012                 }
2013         }
2014         return _SUCCESS;
2015 }
2016
2017 static s32 rtw_action_public_decache(union recv_frame *recv_frame, s32 token)
2018 {
2019         struct adapter *adapter = recv_frame->u.hdr.adapter;
2020         struct mlme_ext_priv *mlmeext = &(adapter->mlmeextpriv);
2021         u8 *frame = recv_frame->u.hdr.rx_data;
2022         u16 seq_ctrl = ((recv_frame->u.hdr.attrib.seq_num&0xffff) << 4) |
2023                 (recv_frame->u.hdr.attrib.frag_num & 0xf);
2024
2025         if (GetRetry(frame)) {
2026                 if (token >= 0) {
2027                         if ((seq_ctrl == mlmeext->action_public_rxseq)
2028                                 && (token == mlmeext->action_public_dialog_token)) {
2029                                 DBG_871X(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x, token:%d\n",
2030                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq, token);
2031                                 return _FAIL;
2032                         }
2033                 } else {
2034                         if (seq_ctrl == mlmeext->action_public_rxseq) {
2035                                 DBG_871X(FUNC_ADPT_FMT" seq_ctrl = 0x%x, rxseq = 0x%x\n",
2036                                         FUNC_ADPT_ARG(adapter), seq_ctrl, mlmeext->action_public_rxseq);
2037                                 return _FAIL;
2038                         }
2039                 }
2040         }
2041
2042         mlmeext->action_public_rxseq = seq_ctrl;
2043
2044         if (token >= 0)
2045                 mlmeext->action_public_dialog_token = token;
2046
2047         return _SUCCESS;
2048 }
2049
2050 static unsigned int on_action_public_p2p(union recv_frame *precv_frame)
2051 {
2052         u8 *pframe = precv_frame->u.hdr.rx_data;
2053         u8 *frame_body;
2054         u8 dialogToken = 0;
2055
2056         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
2057
2058         dialogToken = frame_body[7];
2059
2060         if (rtw_action_public_decache(precv_frame, dialogToken) == _FAIL)
2061                 return _FAIL;
2062
2063         return _SUCCESS;
2064 }
2065
2066 static unsigned int on_action_public_vendor(union recv_frame *precv_frame)
2067 {
2068         unsigned int ret = _FAIL;
2069         u8 *pframe = precv_frame->u.hdr.rx_data;
2070         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
2071
2072         if (!memcmp(frame_body + 2, P2P_OUI, 4)) {
2073                 ret = on_action_public_p2p(precv_frame);
2074         }
2075
2076         return ret;
2077 }
2078
2079 static unsigned int on_action_public_default(union recv_frame *precv_frame, u8 action)
2080 {
2081         unsigned int ret = _FAIL;
2082         u8 *pframe = precv_frame->u.hdr.rx_data;
2083         uint frame_len = precv_frame->u.hdr.len;
2084         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
2085         u8 token;
2086         struct adapter *adapter = precv_frame->u.hdr.adapter;
2087         int cnt = 0;
2088         char msg[64];
2089
2090         token = frame_body[2];
2091
2092         if (rtw_action_public_decache(precv_frame, token) == _FAIL)
2093                 goto exit;
2094
2095         cnt += sprintf((msg+cnt), "%s(token:%u)", action_public_str(action), token);
2096         rtw_cfg80211_rx_action(adapter, pframe, frame_len, msg);
2097
2098         ret = _SUCCESS;
2099
2100 exit:
2101         return ret;
2102 }
2103
2104 unsigned int on_action_public(struct adapter *padapter, union recv_frame *precv_frame)
2105 {
2106         unsigned int ret = _FAIL;
2107         u8 *pframe = precv_frame->u.hdr.rx_data;
2108         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
2109         u8 category, action;
2110
2111         /* check RA matches or not */
2112         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
2113                 goto exit;
2114
2115         category = frame_body[0];
2116         if (category != RTW_WLAN_CATEGORY_PUBLIC)
2117                 goto exit;
2118
2119         action = frame_body[1];
2120         switch (action) {
2121         case ACT_PUBLIC_VENDOR:
2122                 ret = on_action_public_vendor(precv_frame);
2123                 break;
2124         default:
2125                 ret = on_action_public_default(precv_frame, action);
2126                 break;
2127         }
2128
2129 exit:
2130         return ret;
2131 }
2132
2133 unsigned int OnAction_ht(struct adapter *padapter, union recv_frame *precv_frame)
2134 {
2135         u8 *pframe = precv_frame->u.hdr.rx_data;
2136         u8 *frame_body = pframe + sizeof(struct ieee80211_hdr_3addr);
2137         u8 category, action;
2138
2139         /* check RA matches or not */
2140         if (memcmp(myid(&(padapter->eeprompriv)), GetAddr1Ptr(pframe), ETH_ALEN))
2141                 goto exit;
2142
2143         category = frame_body[0];
2144         if (category != RTW_WLAN_CATEGORY_HT)
2145                 goto exit;
2146
2147         action = frame_body[1];
2148         switch (action) {
2149         case RTW_WLAN_ACTION_HT_COMPRESS_BEAMFORMING:
2150                 break;
2151         default:
2152                 break;
2153         }
2154
2155 exit:
2156
2157         return _SUCCESS;
2158 }
2159
2160 unsigned int OnAction_sa_query(struct adapter *padapter, union recv_frame *precv_frame)
2161 {
2162         u8 *pframe = precv_frame->u.hdr.rx_data;
2163         struct rx_pkt_attrib *pattrib = &precv_frame->u.hdr.attrib;
2164         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2165         unsigned short tid;
2166         /* Baron */
2167
2168         DBG_871X("OnAction_sa_query\n");
2169
2170         switch (pframe[WLAN_HDR_A3_LEN+1]) {
2171         case 0: /* SA Query req */
2172                 memcpy(&tid, &pframe[WLAN_HDR_A3_LEN+2], sizeof(unsigned short));
2173                 DBG_871X("OnAction_sa_query request, action =%d, tid =%04x\n", pframe[WLAN_HDR_A3_LEN+1], tid);
2174                 issue_action_SA_Query(padapter, GetAddr2Ptr(pframe), 1, tid);
2175                 break;
2176
2177         case 1: /* SA Query rsp */
2178                 del_timer_sync(&pmlmeext->sa_query_timer);
2179                 DBG_871X("OnAction_sa_query response, action =%d, tid =%04x, cancel timer\n", pframe[WLAN_HDR_A3_LEN+1], pframe[WLAN_HDR_A3_LEN+2]);
2180                 break;
2181         default:
2182                 break;
2183         }
2184         if (0) {
2185                 int pp;
2186
2187                 printk("pattrib->pktlen = %d =>", pattrib->pkt_len);
2188                 for (pp = 0; pp < pattrib->pkt_len; pp++)
2189                         printk(" %02x ", pframe[pp]);
2190                 printk("\n");
2191         }
2192
2193         return _SUCCESS;
2194 }
2195
2196 unsigned int OnAction(struct adapter *padapter, union recv_frame *precv_frame)
2197 {
2198         int i;
2199         unsigned char category;
2200         struct action_handler *ptable;
2201         unsigned char *frame_body;
2202         u8 *pframe = precv_frame->u.hdr.rx_data;
2203
2204         frame_body = (unsigned char *)(pframe + sizeof(struct ieee80211_hdr_3addr));
2205
2206         category = frame_body[0];
2207
2208         for (i = 0; i < ARRAY_SIZE(OnAction_tbl); i++) {
2209                 ptable = &OnAction_tbl[i];
2210
2211                 if (category == ptable->num)
2212                         ptable->func(padapter, precv_frame);
2213
2214         }
2215
2216         return _SUCCESS;
2217
2218 }
2219
2220 unsigned int DoReserved(struct adapter *padapter, union recv_frame *precv_frame)
2221 {
2222
2223         /* DBG_871X("rcvd mgt frame(%x, %x)\n", (GetFrameSubType(pframe) >> 4), *(unsigned int *)GetAddr1Ptr(pframe)); */
2224         return _SUCCESS;
2225 }
2226
2227 static struct xmit_frame *_alloc_mgtxmitframe(struct xmit_priv *pxmitpriv, bool once)
2228 {
2229         struct xmit_frame *pmgntframe;
2230         struct xmit_buf *pxmitbuf;
2231
2232         if (once)
2233                 pmgntframe = rtw_alloc_xmitframe_once(pxmitpriv);
2234         else
2235                 pmgntframe = rtw_alloc_xmitframe_ext(pxmitpriv);
2236
2237         if (pmgntframe == NULL) {
2238                 DBG_871X(FUNC_ADPT_FMT" alloc xmitframe fail, once:%d\n", FUNC_ADPT_ARG(pxmitpriv->adapter), once);
2239                 goto exit;
2240         }
2241
2242         pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
2243         if (pxmitbuf == NULL) {
2244                 DBG_871X(FUNC_ADPT_FMT" alloc xmitbuf fail\n", FUNC_ADPT_ARG(pxmitpriv->adapter));
2245                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
2246                 pmgntframe = NULL;
2247                 goto exit;
2248         }
2249
2250         pmgntframe->frame_tag = MGNT_FRAMETAG;
2251         pmgntframe->pxmitbuf = pxmitbuf;
2252         pmgntframe->buf_addr = pxmitbuf->pbuf;
2253         pxmitbuf->priv_data = pmgntframe;
2254
2255 exit:
2256         return pmgntframe;
2257
2258 }
2259
2260 inline struct xmit_frame *alloc_mgtxmitframe(struct xmit_priv *pxmitpriv)
2261 {
2262         return _alloc_mgtxmitframe(pxmitpriv, false);
2263 }
2264
2265 /****************************************************************************
2266
2267 Following are some TX functions for WiFi MLME
2268
2269 *****************************************************************************/
2270
2271 void update_mgnt_tx_rate(struct adapter *padapter, u8 rate)
2272 {
2273         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2274
2275         pmlmeext->tx_rate = rate;
2276         /* DBG_871X("%s(): rate = %x\n", __func__, rate); */
2277 }
2278
2279 void update_mgntframe_attrib(struct adapter *padapter, struct pkt_attrib *pattrib)
2280 {
2281         u8 wireless_mode;
2282         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2283
2284         /* memset((u8 *)(pattrib), 0, sizeof(struct pkt_attrib)); */
2285
2286         pattrib->hdrlen = 24;
2287         pattrib->nr_frags = 1;
2288         pattrib->priority = 7;
2289         pattrib->mac_id = 0;
2290         pattrib->qsel = 0x12;
2291
2292         pattrib->pktlen = 0;
2293
2294         if (pmlmeext->tx_rate == IEEE80211_CCK_RATE_1MB)
2295                 wireless_mode = WIRELESS_11B;
2296         else
2297                 wireless_mode = WIRELESS_11G;
2298         pattrib->raid =  rtw_get_mgntframe_raid(padapter, wireless_mode);
2299         pattrib->rate = pmlmeext->tx_rate;
2300
2301         pattrib->encrypt = _NO_PRIVACY_;
2302         pattrib->bswenc = false;
2303
2304         pattrib->qos_en = false;
2305         pattrib->ht_en = false;
2306         pattrib->bwmode = CHANNEL_WIDTH_20;
2307         pattrib->ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
2308         pattrib->sgi = false;
2309
2310         pattrib->seqnum = pmlmeext->mgnt_seq;
2311
2312         pattrib->retry_ctrl = true;
2313
2314         pattrib->mbssid = 0;
2315
2316 }
2317
2318 void update_mgntframe_attrib_addr(struct adapter *padapter, struct xmit_frame *pmgntframe)
2319 {
2320         u8 *pframe;
2321         struct pkt_attrib       *pattrib = &pmgntframe->attrib;
2322
2323         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2324
2325         memcpy(pattrib->ra, GetAddr1Ptr(pframe), ETH_ALEN);
2326         memcpy(pattrib->ta, GetAddr2Ptr(pframe), ETH_ALEN);
2327 }
2328
2329 void dump_mgntframe(struct adapter *padapter, struct xmit_frame *pmgntframe)
2330 {
2331         if (padapter->bSurpriseRemoved ||
2332                 padapter->bDriverStopped) {
2333                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2334                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2335                 return;
2336         }
2337
2338         rtw_hal_mgnt_xmit(padapter, pmgntframe);
2339 }
2340
2341 s32 dump_mgntframe_and_wait(struct adapter *padapter, struct xmit_frame *pmgntframe, int timeout_ms)
2342 {
2343         s32 ret = _FAIL;
2344         _irqL irqL;
2345         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2346         struct xmit_buf *pxmitbuf = pmgntframe->pxmitbuf;
2347         struct submit_ctx sctx;
2348
2349         if (padapter->bSurpriseRemoved ||
2350                 padapter->bDriverStopped) {
2351                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2352                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2353                 return ret;
2354         }
2355
2356         rtw_sctx_init(&sctx, timeout_ms);
2357         pxmitbuf->sctx = &sctx;
2358
2359         ret = rtw_hal_mgnt_xmit(padapter, pmgntframe);
2360
2361         if (ret == _SUCCESS)
2362                 ret = rtw_sctx_wait(&sctx, __func__);
2363
2364         spin_lock_irqsave(&pxmitpriv->lock_sctx, irqL);
2365         pxmitbuf->sctx = NULL;
2366         spin_unlock_irqrestore(&pxmitpriv->lock_sctx, irqL);
2367
2368         return ret;
2369 }
2370
2371 s32 dump_mgntframe_and_wait_ack(struct adapter *padapter, struct xmit_frame *pmgntframe)
2372 {
2373         static u8 seq_no;
2374         s32 ret = _FAIL;
2375         u32 timeout_ms = 500;/*   500ms */
2376         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
2377
2378         if (padapter->bSurpriseRemoved ||
2379                 padapter->bDriverStopped) {
2380                 rtw_free_xmitbuf(&padapter->xmitpriv, pmgntframe->pxmitbuf);
2381                 rtw_free_xmitframe(&padapter->xmitpriv, pmgntframe);
2382                 return -1;
2383         }
2384
2385         if (mutex_lock_interruptible(&pxmitpriv->ack_tx_mutex) == 0) {
2386                 pxmitpriv->ack_tx = true;
2387                 pxmitpriv->seq_no = seq_no++;
2388                 pmgntframe->ack_report = 1;
2389                 if (rtw_hal_mgnt_xmit(padapter, pmgntframe) == _SUCCESS)
2390                         ret = rtw_ack_tx_wait(pxmitpriv, timeout_ms);
2391
2392                 pxmitpriv->ack_tx = false;
2393                 mutex_unlock(&pxmitpriv->ack_tx_mutex);
2394         }
2395
2396         return ret;
2397 }
2398
2399 static int update_hidden_ssid(u8 *ies, u32 ies_len, u8 hidden_ssid_mode)
2400 {
2401         u8 *ssid_ie;
2402         sint ssid_len_ori;
2403         int len_diff = 0;
2404
2405         ssid_ie = rtw_get_ie(ies,  WLAN_EID_SSID, &ssid_len_ori, ies_len);
2406
2407         /* DBG_871X("%s hidden_ssid_mode:%u, ssid_ie:%p, ssid_len_ori:%d\n", __func__, hidden_ssid_mode, ssid_ie, ssid_len_ori); */
2408
2409         if (ssid_ie && ssid_len_ori > 0) {
2410                 switch (hidden_ssid_mode) {
2411                 case 1:
2412                 {
2413                         u8 *next_ie = ssid_ie + 2 + ssid_len_ori;
2414                         u32 remain_len = 0;
2415
2416                         remain_len = ies_len - (next_ie-ies);
2417
2418                         ssid_ie[1] = 0;
2419                         memcpy(ssid_ie+2, next_ie, remain_len);
2420                         len_diff -= ssid_len_ori;
2421
2422                         break;
2423                 }
2424                 case 2:
2425                         memset(&ssid_ie[2], 0, ssid_len_ori);
2426                         break;
2427                 default:
2428                         break;
2429         }
2430         }
2431
2432         return len_diff;
2433 }
2434
2435 void issue_beacon(struct adapter *padapter, int timeout_ms)
2436 {
2437         struct xmit_frame       *pmgntframe;
2438         struct pkt_attrib       *pattrib;
2439         unsigned char *pframe;
2440         struct ieee80211_hdr *pwlanhdr;
2441         __le16 *fctrl;
2442         unsigned int    rate_len;
2443         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2444         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2445         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2446         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2447         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
2448         u8 bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
2449
2450         /* DBG_871X("%s\n", __func__); */
2451
2452         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2453         if (!pmgntframe) {
2454                 DBG_871X("%s, alloc mgnt frame fail\n", __func__);
2455                 return;
2456         }
2457
2458         spin_lock_bh(&pmlmepriv->bcn_update_lock);
2459
2460         /* update attribute */
2461         pattrib = &pmgntframe->attrib;
2462         update_mgntframe_attrib(padapter, pattrib);
2463         pattrib->qsel = 0x10;
2464
2465         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2466
2467         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2468         pwlanhdr = (struct ieee80211_hdr *)pframe;
2469
2470
2471         fctrl = &(pwlanhdr->frame_control);
2472         *(fctrl) = 0;
2473
2474         memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
2475         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
2476         memcpy(pwlanhdr->addr3, get_my_bssid(cur_network), ETH_ALEN);
2477
2478         SetSeqNum(pwlanhdr, 0/*pmlmeext->mgnt_seq*/);
2479         /* pmlmeext->mgnt_seq++; */
2480         SetFrameSubType(pframe, WIFI_BEACON);
2481
2482         pframe += sizeof(struct ieee80211_hdr_3addr);
2483         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2484
2485         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
2486                 /* DBG_871X("ie len =%d\n", cur_network->IELength); */
2487                 {
2488                         int len_diff;
2489
2490                         memcpy(pframe, cur_network->IEs, cur_network->IELength);
2491                         len_diff = update_hidden_ssid(
2492                                 pframe+_BEACON_IE_OFFSET_
2493                                 , cur_network->IELength-_BEACON_IE_OFFSET_
2494                                 , pmlmeinfo->hidden_ssid_mode
2495                         );
2496                         pframe += (cur_network->IELength+len_diff);
2497                         pattrib->pktlen += (cur_network->IELength+len_diff);
2498                 }
2499
2500                 {
2501                         u8 *wps_ie;
2502                         uint wps_ielen;
2503                         u8 sr = 0;
2504
2505                         wps_ie = rtw_get_wps_ie(pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr)+_BEACON_IE_OFFSET_,
2506                                 pattrib->pktlen-sizeof(struct ieee80211_hdr_3addr)-_BEACON_IE_OFFSET_, NULL, &wps_ielen);
2507                         if (wps_ie && wps_ielen > 0) {
2508                                 rtw_get_wps_attr_content(wps_ie,  wps_ielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
2509                         }
2510                         if (sr != 0)
2511                                 set_fwstate(pmlmepriv, WIFI_UNDER_WPS);
2512                         else
2513                                 _clr_fwstate_(pmlmepriv, WIFI_UNDER_WPS);
2514                 }
2515
2516                 goto _issue_bcn;
2517
2518         }
2519
2520         /* below for ad-hoc mode */
2521
2522         /* timestamp will be inserted by hardware */
2523         pframe += 8;
2524         pattrib->pktlen += 8;
2525
2526         /*  beacon interval: 2 bytes */
2527
2528         memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
2529
2530         pframe += 2;
2531         pattrib->pktlen += 2;
2532
2533         /*  capability info: 2 bytes */
2534
2535         memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
2536
2537         pframe += 2;
2538         pattrib->pktlen += 2;
2539
2540         /*  SSID */
2541         pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
2542
2543         /*  supported rates... */
2544         rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
2545         pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8) ? 8 : rate_len), cur_network->SupportedRates, &pattrib->pktlen);
2546
2547         /*  DS parameter set */
2548         pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
2549
2550         /* if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) */
2551         {
2552                 u8 erpinfo = 0;
2553                 u32 ATIMWindow;
2554                 /*  IBSS Parameter Set... */
2555                 /* ATIMWindow = cur->Configuration.ATIMWindow; */
2556                 ATIMWindow = 0;
2557                 pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
2558
2559                 /* ERP IE */
2560                 pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
2561         }
2562
2563
2564         /*  EXTERNDED SUPPORTED RATE */
2565         if (rate_len > 8) {
2566                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
2567         }
2568
2569
2570         /* todo:HT for adhoc */
2571
2572 _issue_bcn:
2573
2574         pmlmepriv->update_bcn = false;
2575
2576         spin_unlock_bh(&pmlmepriv->bcn_update_lock);
2577
2578         if ((pattrib->pktlen + TXDESC_SIZE) > 512) {
2579                 DBG_871X("beacon frame too large\n");
2580                 return;
2581         }
2582
2583         pattrib->last_txcmdsz = pattrib->pktlen;
2584
2585         /* DBG_871X("issue bcn_sz =%d\n", pattrib->last_txcmdsz); */
2586         if (timeout_ms > 0)
2587                 dump_mgntframe_and_wait(padapter, pmgntframe, timeout_ms);
2588         else
2589                 dump_mgntframe(padapter, pmgntframe);
2590
2591 }
2592
2593 void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p_probereq)
2594 {
2595         struct xmit_frame                       *pmgntframe;
2596         struct pkt_attrib                       *pattrib;
2597         unsigned char                           *pframe;
2598         struct ieee80211_hdr    *pwlanhdr;
2599         __le16 *fctrl;
2600         unsigned char                           *mac, *bssid;
2601         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
2602
2603         u8 *pwps_ie;
2604         uint wps_ielen;
2605         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
2606         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2607         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2608         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
2609         unsigned int    rate_len;
2610
2611         /* DBG_871X("%s\n", __func__); */
2612
2613         if (da == NULL)
2614                 return;
2615
2616         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2617         if (pmgntframe == NULL) {
2618                 DBG_871X("%s, alloc mgnt frame fail\n", __func__);
2619                 return;
2620         }
2621
2622
2623         /* update attribute */
2624         pattrib = &pmgntframe->attrib;
2625         update_mgntframe_attrib(padapter, pattrib);
2626
2627         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2628
2629         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2630         pwlanhdr = (struct ieee80211_hdr *)pframe;
2631
2632         mac = myid(&(padapter->eeprompriv));
2633         bssid = cur_network->MacAddress;
2634
2635         fctrl = &(pwlanhdr->frame_control);
2636         *(fctrl) = 0;
2637         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
2638         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
2639         memcpy(pwlanhdr->addr3, bssid, ETH_ALEN);
2640
2641         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2642         pmlmeext->mgnt_seq++;
2643         SetFrameSubType(fctrl, WIFI_PROBERSP);
2644
2645         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
2646         pattrib->pktlen = pattrib->hdrlen;
2647         pframe += pattrib->hdrlen;
2648
2649
2650         if (cur_network->IELength > MAX_IE_SZ)
2651                 return;
2652
2653         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE) {
2654                 pwps_ie = rtw_get_wps_ie(cur_network->IEs+_FIXED_IE_LENGTH_, cur_network->IELength-_FIXED_IE_LENGTH_, NULL, &wps_ielen);
2655
2656                 /* inerset & update wps_probe_resp_ie */
2657                 if ((pmlmepriv->wps_probe_resp_ie != NULL) && pwps_ie && (wps_ielen > 0)) {
2658                         uint wps_offset, remainder_ielen;
2659                         u8 *premainder_ie;
2660
2661                         wps_offset = (uint)(pwps_ie - cur_network->IEs);
2662
2663                         premainder_ie = pwps_ie + wps_ielen;
2664
2665                         remainder_ielen = cur_network->IELength - wps_offset - wps_ielen;
2666
2667                         memcpy(pframe, cur_network->IEs, wps_offset);
2668                         pframe += wps_offset;
2669                         pattrib->pktlen += wps_offset;
2670
2671                         wps_ielen = (uint)pmlmepriv->wps_probe_resp_ie[1];/* to get ie data len */
2672                         if ((wps_offset+wps_ielen+2) <= MAX_IE_SZ) {
2673                                 memcpy(pframe, pmlmepriv->wps_probe_resp_ie, wps_ielen+2);
2674                                 pframe += wps_ielen+2;
2675                                 pattrib->pktlen += wps_ielen+2;
2676                         }
2677
2678                         if ((wps_offset+wps_ielen+2+remainder_ielen) <= MAX_IE_SZ) {
2679                                 memcpy(pframe, premainder_ie, remainder_ielen);
2680                                 pframe += remainder_ielen;
2681                                 pattrib->pktlen += remainder_ielen;
2682                         }
2683                 } else {
2684                         memcpy(pframe, cur_network->IEs, cur_network->IELength);
2685                         pframe += cur_network->IELength;
2686                         pattrib->pktlen += cur_network->IELength;
2687                 }
2688
2689                 /* retrieve SSID IE from cur_network->Ssid */
2690                 {
2691                         u8 *ssid_ie;
2692                         sint ssid_ielen;
2693                         sint ssid_ielen_diff;
2694                         u8 buf[MAX_IE_SZ];
2695                         u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr);
2696
2697                         ssid_ie = rtw_get_ie(ies+_FIXED_IE_LENGTH_, _SSID_IE_, &ssid_ielen,
2698                                 (pframe-ies)-_FIXED_IE_LENGTH_);
2699
2700                         ssid_ielen_diff = cur_network->Ssid.SsidLength - ssid_ielen;
2701
2702                         if (ssid_ie &&  cur_network->Ssid.SsidLength) {
2703                                 uint remainder_ielen;
2704                                 u8 *remainder_ie;
2705
2706                                 remainder_ie = ssid_ie+2;
2707                                 remainder_ielen = (pframe-remainder_ie);
2708
2709                                 if (remainder_ielen > MAX_IE_SZ) {
2710                                         DBG_871X_LEVEL(_drv_warning_, FUNC_ADPT_FMT" remainder_ielen > MAX_IE_SZ\n", FUNC_ADPT_ARG(padapter));
2711                                         remainder_ielen = MAX_IE_SZ;
2712                                 }
2713
2714                                 memcpy(buf, remainder_ie, remainder_ielen);
2715                                 memcpy(remainder_ie+ssid_ielen_diff, buf, remainder_ielen);
2716                                 *(ssid_ie+1) = cur_network->Ssid.SsidLength;
2717                                 memcpy(ssid_ie+2, cur_network->Ssid.Ssid, cur_network->Ssid.SsidLength);
2718
2719                                 pframe += ssid_ielen_diff;
2720                                 pattrib->pktlen += ssid_ielen_diff;
2721                         }
2722                 }
2723         } else {
2724                 /* timestamp will be inserted by hardware */
2725                 pframe += 8;
2726                 pattrib->pktlen += 8;
2727
2728                 /*  beacon interval: 2 bytes */
2729
2730                 memcpy(pframe, (unsigned char *)(rtw_get_beacon_interval_from_ie(cur_network->IEs)), 2);
2731
2732                 pframe += 2;
2733                 pattrib->pktlen += 2;
2734
2735                 /*  capability info: 2 bytes */
2736
2737                 memcpy(pframe, (unsigned char *)(rtw_get_capability_from_ie(cur_network->IEs)), 2);
2738
2739                 pframe += 2;
2740                 pattrib->pktlen += 2;
2741
2742                 /* below for ad-hoc mode */
2743
2744                 /*  SSID */
2745                 pframe = rtw_set_ie(pframe, _SSID_IE_, cur_network->Ssid.SsidLength, cur_network->Ssid.Ssid, &pattrib->pktlen);
2746
2747                 /*  supported rates... */
2748                 rate_len = rtw_get_rateset_len(cur_network->SupportedRates);
2749                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, ((rate_len > 8) ? 8 : rate_len), cur_network->SupportedRates, &pattrib->pktlen);
2750
2751                 /*  DS parameter set */
2752                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, (unsigned char *)&(cur_network->Configuration.DSConfig), &pattrib->pktlen);
2753
2754                 if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
2755                         u8 erpinfo = 0;
2756                         u32 ATIMWindow;
2757                         /*  IBSS Parameter Set... */
2758                         /* ATIMWindow = cur->Configuration.ATIMWindow; */
2759                         ATIMWindow = 0;
2760                         pframe = rtw_set_ie(pframe, _IBSS_PARA_IE_, 2, (unsigned char *)(&ATIMWindow), &pattrib->pktlen);
2761
2762                         /* ERP IE */
2763                         pframe = rtw_set_ie(pframe, _ERPINFO_IE_, 1, &erpinfo, &pattrib->pktlen);
2764                 }
2765
2766
2767                 /*  EXTERNDED SUPPORTED RATE */
2768                 if (rate_len > 8) {
2769                         pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (rate_len - 8), (cur_network->SupportedRates + 8), &pattrib->pktlen);
2770                 }
2771
2772
2773                 /* todo:HT for adhoc */
2774
2775         }
2776
2777 #ifdef CONFIG_AUTO_AP_MODE
2778 {
2779         struct sta_info *psta;
2780         struct sta_priv *pstapriv = &padapter->stapriv;
2781
2782         DBG_871X("(%s)\n", __func__);
2783
2784         /* check rc station */
2785         psta = rtw_get_stainfo(pstapriv, da);
2786         if (psta && psta->isrc && psta->pid > 0) {
2787                 u8 RC_OUI[4] = {0x00, 0xE0, 0x4C, 0x0A};
2788                 u8 RC_INFO[14] = {0};
2789                 /* EID[1] + EID_LEN[1] + RC_OUI[4] + MAC[6] + PairingID[2] + ChannelNum[2] */
2790                 u16 cu_ch = (u16)cur_network->Configuration.DSConfig;
2791
2792                 DBG_871X("%s, reply rc(pid = 0x%x) device "MAC_FMT" in ch =%d\n", __func__,
2793                         psta->pid, MAC_ARG(psta->hwaddr), cu_ch);
2794
2795                 /* append vendor specific ie */
2796                 memcpy(RC_INFO, RC_OUI, sizeof(RC_OUI));
2797                 memcpy(&RC_INFO[4], mac, ETH_ALEN);
2798                 memcpy(&RC_INFO[10], (u8 *)&psta->pid, 2);
2799                 memcpy(&RC_INFO[12], (u8 *)&cu_ch, 2);
2800
2801                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, sizeof(RC_INFO), RC_INFO, &pattrib->pktlen);
2802         }
2803 }
2804 #endif /* CONFIG_AUTO_AP_MODE */
2805
2806
2807         pattrib->last_txcmdsz = pattrib->pktlen;
2808
2809
2810         dump_mgntframe(padapter, pmgntframe);
2811
2812         return;
2813
2814 }
2815
2816 static int _issue_probereq(struct adapter *padapter,
2817                            struct ndis_802_11_ssid *pssid,
2818                            u8 *da, u8 ch, bool append_wps, bool wait_ack)
2819 {
2820         int ret = _FAIL;
2821         struct xmit_frame               *pmgntframe;
2822         struct pkt_attrib               *pattrib;
2823         unsigned char           *pframe;
2824         struct ieee80211_hdr    *pwlanhdr;
2825         __le16 *fctrl;
2826         unsigned char           *mac;
2827         unsigned char           bssrate[NumRates];
2828         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
2829         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
2830         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2831         int     bssrate_len = 0;
2832         u8 bc_addr[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
2833
2834         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("+issue_probereq\n"));
2835
2836         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2837         if (!pmgntframe)
2838                 goto exit;
2839
2840         /* update attribute */
2841         pattrib = &pmgntframe->attrib;
2842         update_mgntframe_attrib(padapter, pattrib);
2843
2844
2845         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2846
2847         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2848         pwlanhdr = (struct ieee80211_hdr *)pframe;
2849
2850         mac = myid(&(padapter->eeprompriv));
2851
2852         fctrl = &(pwlanhdr->frame_control);
2853         *(fctrl) = 0;
2854
2855         if (da) {
2856                 /*      unicast probe request frame */
2857                 memcpy(pwlanhdr->addr1, da, ETH_ALEN);
2858                 memcpy(pwlanhdr->addr3, da, ETH_ALEN);
2859         } else {
2860                 /*      broadcast probe request frame */
2861                 memcpy(pwlanhdr->addr1, bc_addr, ETH_ALEN);
2862                 memcpy(pwlanhdr->addr3, bc_addr, ETH_ALEN);
2863         }
2864
2865         memcpy(pwlanhdr->addr2, mac, ETH_ALEN);
2866
2867         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2868         pmlmeext->mgnt_seq++;
2869         SetFrameSubType(pframe, WIFI_PROBEREQ);
2870
2871         pframe += sizeof(struct ieee80211_hdr_3addr);
2872         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2873
2874         if (pssid)
2875                 pframe = rtw_set_ie(pframe, _SSID_IE_, pssid->SsidLength, pssid->Ssid, &(pattrib->pktlen));
2876         else
2877                 pframe = rtw_set_ie(pframe, _SSID_IE_, 0, NULL, &(pattrib->pktlen));
2878
2879         get_rate_set(padapter, bssrate, &bssrate_len);
2880
2881         if (bssrate_len > 8) {
2882                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
2883                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
2884         } else {
2885                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
2886         }
2887
2888         if (ch)
2889                 pframe = rtw_set_ie(pframe, _DSSET_IE_, 1, &ch, &pattrib->pktlen);
2890
2891         if (append_wps) {
2892                 /* add wps_ie for wps2.0 */
2893                 if (pmlmepriv->wps_probe_req_ie_len > 0 && pmlmepriv->wps_probe_req_ie) {
2894                         memcpy(pframe, pmlmepriv->wps_probe_req_ie, pmlmepriv->wps_probe_req_ie_len);
2895                         pframe += pmlmepriv->wps_probe_req_ie_len;
2896                         pattrib->pktlen += pmlmepriv->wps_probe_req_ie_len;
2897                 }
2898         }
2899
2900         pattrib->last_txcmdsz = pattrib->pktlen;
2901
2902         RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_, ("issuing probe_req, tx_len =%d\n", pattrib->last_txcmdsz));
2903
2904         if (wait_ack) {
2905                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
2906         } else {
2907                 dump_mgntframe(padapter, pmgntframe);
2908                 ret = _SUCCESS;
2909         }
2910
2911 exit:
2912         return ret;
2913 }
2914
2915 inline void issue_probereq(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da)
2916 {
2917         _issue_probereq(padapter, pssid, da, 0, 1, false);
2918 }
2919
2920 int issue_probereq_ex(struct adapter *padapter, struct ndis_802_11_ssid *pssid, u8 *da, u8 ch, bool append_wps,
2921         int try_cnt, int wait_ms)
2922 {
2923         int ret;
2924         int i = 0;
2925
2926         do {
2927                 ret = _issue_probereq(padapter, pssid, da, ch, append_wps,
2928                                       wait_ms > 0);
2929
2930                 i++;
2931
2932                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
2933                         break;
2934
2935                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
2936                         msleep(wait_ms);
2937
2938         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
2939
2940         if (ret != _FAIL) {
2941                 ret = _SUCCESS;
2942                 #ifndef DBG_XMIT_ACK
2943                 goto exit;
2944                 #endif
2945         }
2946
2947         if (try_cnt && wait_ms) {
2948                 if (da)
2949                         DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
2950                                 FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
2951                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
2952                 else
2953                         DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
2954                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
2955                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
2956         }
2957 exit:
2958         return ret;
2959 }
2960
2961 /*  if psta == NULL, indicate we are station(client) now... */
2962 void issue_auth(struct adapter *padapter, struct sta_info *psta, unsigned short status)
2963 {
2964         struct xmit_frame                       *pmgntframe;
2965         struct pkt_attrib                       *pattrib;
2966         unsigned char                           *pframe;
2967         struct ieee80211_hdr    *pwlanhdr;
2968         __le16 *fctrl;
2969         unsigned int                                    val32;
2970         unsigned short                          val16;
2971         int use_shared_key = 0;
2972         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
2973         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
2974         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
2975         __le16 le_tmp;
2976
2977         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
2978         if (pmgntframe == NULL)
2979                 return;
2980
2981         /* update attribute */
2982         pattrib = &pmgntframe->attrib;
2983         update_mgntframe_attrib(padapter, pattrib);
2984
2985         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
2986
2987         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
2988         pwlanhdr = (struct ieee80211_hdr *)pframe;
2989
2990         fctrl = &(pwlanhdr->frame_control);
2991         *(fctrl) = 0;
2992
2993         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
2994         pmlmeext->mgnt_seq++;
2995         SetFrameSubType(pframe, WIFI_AUTH);
2996
2997         pframe += sizeof(struct ieee80211_hdr_3addr);
2998         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
2999
3000
3001         if (psta) { /*  for AP mode */
3002                 memcpy(pwlanhdr->addr1, psta->hwaddr, ETH_ALEN);
3003                 memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3004                 memcpy(pwlanhdr->addr3, myid(&(padapter->eeprompriv)), ETH_ALEN);
3005
3006                 /*  setting auth algo number */
3007                 val16 = (u16)psta->authalg;
3008
3009                 if (status != _STATS_SUCCESSFUL_)
3010                         val16 = 0;
3011
3012                 if (val16)
3013                         use_shared_key = 1;
3014
3015                 le_tmp = cpu_to_le16(val16);
3016
3017                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3018
3019                 /*  setting auth seq number */
3020                 val16 = (u16)psta->auth_seq;
3021                 le_tmp = cpu_to_le16(val16);
3022                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3023
3024                 /*  setting status code... */
3025                 val16 = status;
3026                 le_tmp = cpu_to_le16(val16);
3027                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3028
3029                 /*  added challenging text... */
3030                 if ((psta->auth_seq == 2) && (psta->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1))
3031                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, psta->chg_txt, &(pattrib->pktlen));
3032
3033         } else {
3034                 memcpy(pwlanhdr->addr1, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
3035                 memcpy(pwlanhdr->addr2, myid(&padapter->eeprompriv), ETH_ALEN);
3036                 memcpy(pwlanhdr->addr3, get_my_bssid(&pmlmeinfo->network), ETH_ALEN);
3037
3038                 /*  setting auth algo number */
3039                 val16 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_Shared) ? 1 : 0;/*  0:OPEN System, 1:Shared key */
3040                 if (val16) {
3041                         use_shared_key = 1;
3042                 }
3043                 le_tmp = cpu_to_le16(val16);
3044                 /* DBG_871X("%s auth_algo = %s auth_seq =%d\n", __func__, (pmlmeinfo->auth_algo == 0)?"OPEN":"SHARED", pmlmeinfo->auth_seq); */
3045
3046                 /* setting IV for auth seq #3 */
3047                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
3048                         __le32 le_tmp32;
3049
3050                         /* DBG_871X("==> iv(%d), key_index(%d)\n", pmlmeinfo->iv, pmlmeinfo->key_index); */
3051                         val32 = ((pmlmeinfo->iv++) | (pmlmeinfo->key_index << 30));
3052                         le_tmp32 = cpu_to_le32(val32);
3053                         pframe = rtw_set_fixed_ie(pframe, 4, (unsigned char *)&le_tmp32, &(pattrib->pktlen));
3054
3055                         pattrib->iv_len = 4;
3056                 }
3057
3058                 pframe = rtw_set_fixed_ie(pframe, _AUTH_ALGM_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3059
3060                 /*  setting auth seq number */
3061                 le_tmp = cpu_to_le16(pmlmeinfo->auth_seq);
3062                 pframe = rtw_set_fixed_ie(pframe, _AUTH_SEQ_NUM_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3063
3064
3065                 /*  setting status code... */
3066                 le_tmp = cpu_to_le16(status);
3067                 pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3068
3069                 /*  then checking to see if sending challenging text... */
3070                 if ((pmlmeinfo->auth_seq == 3) && (pmlmeinfo->state & WIFI_FW_AUTH_STATE) && (use_shared_key == 1)) {
3071                         pframe = rtw_set_ie(pframe, _CHLGETXT_IE_, 128, pmlmeinfo->chg_txt, &(pattrib->pktlen));
3072
3073                         SetPrivacy(fctrl);
3074
3075                         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
3076
3077                         pattrib->encrypt = _WEP40_;
3078
3079                         pattrib->icv_len = 4;
3080
3081                         pattrib->pktlen += pattrib->icv_len;
3082
3083                 }
3084
3085         }
3086
3087         pattrib->last_txcmdsz = pattrib->pktlen;
3088
3089         rtw_wep_encrypt(padapter, (u8 *)pmgntframe);
3090         DBG_871X("%s\n", __func__);
3091         dump_mgntframe(padapter, pmgntframe);
3092 }
3093
3094
3095 void issue_asocrsp(struct adapter *padapter, unsigned short status, struct sta_info *pstat, int pkt_type)
3096 {
3097         struct xmit_frame       *pmgntframe;
3098         struct ieee80211_hdr    *pwlanhdr;
3099         struct pkt_attrib *pattrib;
3100         unsigned char *pbuf, *pframe;
3101         unsigned short val;
3102         __le16 *fctrl;
3103         struct xmit_priv *pxmitpriv = &(padapter->xmitpriv);
3104         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
3105         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
3106         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3107         struct wlan_bssid_ex *pnetwork = &(pmlmeinfo->network);
3108         u8 *ie = pnetwork->IEs;
3109         __le16 lestatus, le_tmp;
3110
3111         DBG_871X("%s\n", __func__);
3112
3113         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3114         if (pmgntframe == NULL)
3115                 return;
3116
3117         /* update attribute */
3118         pattrib = &pmgntframe->attrib;
3119         update_mgntframe_attrib(padapter, pattrib);
3120
3121
3122         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3123
3124         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3125         pwlanhdr = (struct ieee80211_hdr *)pframe;
3126
3127         fctrl = &(pwlanhdr->frame_control);
3128         *(fctrl) = 0;
3129
3130         memcpy((void *)GetAddr1Ptr(pwlanhdr), pstat->hwaddr, ETH_ALEN);
3131         memcpy((void *)GetAddr2Ptr(pwlanhdr), myid(&(padapter->eeprompriv)), ETH_ALEN);
3132         memcpy((void *)GetAddr3Ptr(pwlanhdr), get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3133
3134
3135         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3136         pmlmeext->mgnt_seq++;
3137         if ((pkt_type == WIFI_ASSOCRSP) || (pkt_type == WIFI_REASSOCRSP))
3138                 SetFrameSubType(pwlanhdr, pkt_type);
3139         else
3140                 return;
3141
3142         pattrib->hdrlen = sizeof(struct ieee80211_hdr_3addr);
3143         pattrib->pktlen += pattrib->hdrlen;
3144         pframe += pattrib->hdrlen;
3145
3146         /* capability */
3147         val = *(unsigned short *)rtw_get_capability_from_ie(ie);
3148
3149         pframe = rtw_set_fixed_ie(pframe, _CAPABILITY_, (unsigned char *)&val, &(pattrib->pktlen));
3150
3151         lestatus = cpu_to_le16(status);
3152         pframe = rtw_set_fixed_ie(pframe, _STATUS_CODE_, (unsigned char *)&lestatus, &(pattrib->pktlen));
3153
3154         le_tmp = cpu_to_le16(pstat->aid | BIT(14) | BIT(15));
3155         pframe = rtw_set_fixed_ie(pframe, _ASOC_ID_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3156
3157         if (pstat->bssratelen <= 8) {
3158                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, pstat->bssratelen, pstat->bssrateset, &(pattrib->pktlen));
3159         } else {
3160                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, pstat->bssrateset, &(pattrib->pktlen));
3161                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (pstat->bssratelen-8), pstat->bssrateset+8, &(pattrib->pktlen));
3162         }
3163
3164         if ((pstat->flags & WLAN_STA_HT) && (pmlmepriv->htpriv.ht_option)) {
3165                 uint ie_len = 0;
3166
3167                 /* FILL HT CAP INFO IE */
3168                 /* p = hostapd_eid_ht_capabilities_info(hapd, p); */
3169                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_CAPABILITY_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
3170                 if (pbuf && ie_len > 0) {
3171                         memcpy(pframe, pbuf, ie_len+2);
3172                         pframe += (ie_len+2);
3173                         pattrib->pktlen += (ie_len+2);
3174                 }
3175
3176                 /* FILL HT ADD INFO IE */
3177                 /* p = hostapd_eid_ht_operation(hapd, p); */
3178                 pbuf = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _HT_ADD_INFO_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_));
3179                 if (pbuf && ie_len > 0) {
3180                         memcpy(pframe, pbuf, ie_len+2);
3181                         pframe += (ie_len+2);
3182                         pattrib->pktlen += (ie_len+2);
3183                 }
3184
3185         }
3186
3187         /* FILL WMM IE */
3188         if ((pstat->flags & WLAN_STA_WME) && (pmlmepriv->qospriv.qos_option)) {
3189                 uint ie_len = 0;
3190                 unsigned char WMM_PARA_IE[] = {0x00, 0x50, 0xf2, 0x02, 0x01, 0x01};
3191
3192                 for (pbuf = ie + _BEACON_IE_OFFSET_; ; pbuf += (ie_len + 2)) {
3193                         pbuf = rtw_get_ie(pbuf, _VENDOR_SPECIFIC_IE_, &ie_len, (pnetwork->IELength - _BEACON_IE_OFFSET_ - (ie_len + 2)));
3194                         if (pbuf && !memcmp(pbuf+2, WMM_PARA_IE, 6)) {
3195                                 memcpy(pframe, pbuf, ie_len+2);
3196                                 pframe += (ie_len+2);
3197                                 pattrib->pktlen += (ie_len+2);
3198
3199                                 break;
3200                         }
3201
3202                         if ((pbuf == NULL) || (ie_len == 0)) {
3203                                 break;
3204                         }
3205                 }
3206
3207         }
3208
3209         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK) {
3210                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
3211         }
3212
3213         /* add WPS IE ie for wps 2.0 */
3214         if (pmlmepriv->wps_assoc_resp_ie && pmlmepriv->wps_assoc_resp_ie_len > 0) {
3215                 memcpy(pframe, pmlmepriv->wps_assoc_resp_ie, pmlmepriv->wps_assoc_resp_ie_len);
3216
3217                 pframe += pmlmepriv->wps_assoc_resp_ie_len;
3218                 pattrib->pktlen += pmlmepriv->wps_assoc_resp_ie_len;
3219         }
3220
3221         pattrib->last_txcmdsz = pattrib->pktlen;
3222
3223         dump_mgntframe(padapter, pmgntframe);
3224 }
3225
3226 void issue_assocreq(struct adapter *padapter)
3227 {
3228         int ret = _FAIL;
3229         struct xmit_frame                               *pmgntframe;
3230         struct pkt_attrib                               *pattrib;
3231         unsigned char                           *pframe;
3232         struct ieee80211_hdr                    *pwlanhdr;
3233         __le16 *fctrl;
3234         __le16 val16;
3235         unsigned int                                    i, j, index = 0;
3236         unsigned char bssrate[NumRates], sta_bssrate[NumRates];
3237         struct ndis_80211_var_ie *pIE;
3238         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3239         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
3240         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3241         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3242         int     bssrate_len = 0, sta_bssrate_len = 0;
3243         u8 vs_ie_length = 0;
3244
3245         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3246         if (pmgntframe == NULL)
3247                 goto exit;
3248
3249         /* update attribute */
3250         pattrib = &pmgntframe->attrib;
3251         update_mgntframe_attrib(padapter, pattrib);
3252
3253         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3254
3255         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3256         pwlanhdr = (struct ieee80211_hdr *)pframe;
3257
3258         fctrl = &(pwlanhdr->frame_control);
3259         *(fctrl) = 0;
3260         memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3261         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3262         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3263
3264         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3265         pmlmeext->mgnt_seq++;
3266         SetFrameSubType(pframe, WIFI_ASSOCREQ);
3267
3268         pframe += sizeof(struct ieee80211_hdr_3addr);
3269         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3270
3271         /* caps */
3272         memcpy(pframe, rtw_get_capability_from_ie(pmlmeinfo->network.IEs), 2);
3273
3274         pframe += 2;
3275         pattrib->pktlen += 2;
3276
3277         /* listen interval */
3278         /* todo: listen interval for power saving */
3279         val16 = cpu_to_le16(3);
3280         memcpy(pframe, (unsigned char *)&val16, 2);
3281         pframe += 2;
3282         pattrib->pktlen += 2;
3283
3284         /* SSID */
3285         pframe = rtw_set_ie(pframe, _SSID_IE_,  pmlmeinfo->network.Ssid.SsidLength, pmlmeinfo->network.Ssid.Ssid, &(pattrib->pktlen));
3286
3287         /* supported rate & extended supported rate */
3288
3289         /*  Check if the AP's supported rates are also supported by STA. */
3290         get_rate_set(padapter, sta_bssrate, &sta_bssrate_len);
3291         /* DBG_871X("sta_bssrate_len =%d\n", sta_bssrate_len); */
3292
3293         if (pmlmeext->cur_channel == 14) /*  for JAPAN, channel 14 can only uses B Mode(CCK) */
3294                 sta_bssrate_len = 4;
3295
3296
3297         /* for (i = 0; i < sta_bssrate_len; i++) { */
3298         /*      DBG_871X("sta_bssrate[%d]=%02X\n", i, sta_bssrate[i]); */
3299         /*  */
3300
3301         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
3302                 if (pmlmeinfo->network.SupportedRates[i] == 0)
3303                         break;
3304                 DBG_871X("network.SupportedRates[%d]=%02X\n", i, pmlmeinfo->network.SupportedRates[i]);
3305         }
3306
3307
3308         for (i = 0; i < NDIS_802_11_LENGTH_RATES_EX; i++) {
3309                 if (pmlmeinfo->network.SupportedRates[i] == 0)
3310                         break;
3311
3312
3313                 /*  Check if the AP's supported rates are also supported by STA. */
3314                 for (j = 0; j < sta_bssrate_len; j++) {
3315                          /*  Avoid the proprietary data rate (22Mbps) of Handlink WSG-4000 AP */
3316                         if ((pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK)
3317                                         == (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK)) {
3318                                 /* DBG_871X("match i = %d, j =%d\n", i, j); */
3319                                 break;
3320                         } else {
3321                                 /* DBG_871X("not match: %02X != %02X\n", (pmlmeinfo->network.SupportedRates[i]|IEEE80211_BASIC_RATE_MASK), (sta_bssrate[j]|IEEE80211_BASIC_RATE_MASK)); */
3322                         }
3323                 }
3324
3325                 if (j == sta_bssrate_len) {
3326                         /*  the rate is not supported by STA */
3327                         DBG_871X("%s(): the rate[%d]=%02X is not supported by STA!\n", __func__, i, pmlmeinfo->network.SupportedRates[i]);
3328                 } else {
3329                         /*  the rate is supported by STA */
3330                         bssrate[index++] = pmlmeinfo->network.SupportedRates[i];
3331                 }
3332         }
3333
3334         bssrate_len = index;
3335         DBG_871X("bssrate_len = %d\n", bssrate_len);
3336
3337         if (bssrate_len == 0) {
3338                 rtw_free_xmitbuf(pxmitpriv, pmgntframe->pxmitbuf);
3339                 rtw_free_xmitframe(pxmitpriv, pmgntframe);
3340                 goto exit; /* don't connect to AP if no joint supported rate */
3341         }
3342
3343
3344         if (bssrate_len > 8) {
3345                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, 8, bssrate, &(pattrib->pktlen));
3346                 pframe = rtw_set_ie(pframe, _EXT_SUPPORTEDRATES_IE_, (bssrate_len - 8), (bssrate + 8), &(pattrib->pktlen));
3347         } else
3348                 pframe = rtw_set_ie(pframe, _SUPPORTEDRATES_IE_, bssrate_len, bssrate, &(pattrib->pktlen));
3349
3350         /* vendor specific IE, such as WPA, WMM, WPS */
3351         for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.IELength;) {
3352                 pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.IEs + i);
3353
3354                 switch (pIE->ElementID) {
3355                 case _VENDOR_SPECIFIC_IE_:
3356                         if ((!memcmp(pIE->data, RTW_WPA_OUI, 4)) ||
3357                                         (!memcmp(pIE->data, WMM_OUI, 4)) ||
3358                                         (!memcmp(pIE->data, WPS_OUI, 4))) {
3359                                 vs_ie_length = pIE->Length;
3360                                 if ((!padapter->registrypriv.wifi_spec) && (!memcmp(pIE->data, WPS_OUI, 4))) {
3361                                         /* Commented by Kurt 20110629
3362                                          * In some older APs, WPS handshake
3363                                          * would be fail if we append vendor
3364                                          * extensions information to AP
3365                                          */
3366
3367                                         vs_ie_length = 14;
3368                                 }
3369
3370                                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, vs_ie_length, pIE->data, &(pattrib->pktlen));
3371                         }
3372                         break;
3373
3374                 case EID_WPA2:
3375                         pframe = rtw_set_ie(pframe, EID_WPA2, pIE->Length, pIE->data, &(pattrib->pktlen));
3376                         break;
3377                 case EID_HTCapability:
3378                         if (padapter->mlmepriv.htpriv.ht_option) {
3379                                 if (!(is_ap_in_tkip(padapter))) {
3380                                         memcpy(&(pmlmeinfo->HT_caps), pIE->data, sizeof(struct HT_caps_element));
3381                                         pframe = rtw_set_ie(pframe, EID_HTCapability, pIE->Length, (u8 *)(&(pmlmeinfo->HT_caps)), &(pattrib->pktlen));
3382                                 }
3383                         }
3384                         break;
3385
3386                 case EID_EXTCapability:
3387                         if (padapter->mlmepriv.htpriv.ht_option)
3388                                 pframe = rtw_set_ie(pframe, EID_EXTCapability, pIE->Length, pIE->data, &(pattrib->pktlen));
3389                         break;
3390                 default:
3391                         break;
3392                 }
3393
3394                 i += (pIE->Length + 2);
3395         }
3396
3397         if (pmlmeinfo->assoc_AP_vendor == HT_IOT_PEER_REALTEK)
3398                 pframe = rtw_set_ie(pframe, _VENDOR_SPECIFIC_IE_, 6, REALTEK_96B_IE, &(pattrib->pktlen));
3399
3400
3401         pattrib->last_txcmdsz = pattrib->pktlen;
3402         dump_mgntframe(padapter, pmgntframe);
3403
3404         ret = _SUCCESS;
3405
3406 exit:
3407         if (ret == _SUCCESS)
3408                 rtw_buf_update(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len, (u8 *)pwlanhdr, pattrib->pktlen);
3409         else
3410                 rtw_buf_free(&pmlmepriv->assoc_req, &pmlmepriv->assoc_req_len);
3411 }
3412
3413 /* when wait_ack is true, this function should be called at process context */
3414 static int _issue_nulldata(struct adapter *padapter, unsigned char *da,
3415                            unsigned int power_mode, bool wait_ack)
3416 {
3417         int ret = _FAIL;
3418         struct xmit_frame                       *pmgntframe;
3419         struct pkt_attrib                       *pattrib;
3420         unsigned char                           *pframe;
3421         struct ieee80211_hdr    *pwlanhdr;
3422         __le16 *fctrl;
3423         struct xmit_priv *pxmitpriv;
3424         struct mlme_ext_priv *pmlmeext;
3425         struct mlme_ext_info *pmlmeinfo;
3426
3427         /* DBG_871X("%s:%d\n", __func__, power_mode); */
3428
3429         if (!padapter)
3430                 goto exit;
3431
3432         pxmitpriv = &(padapter->xmitpriv);
3433         pmlmeext = &(padapter->mlmeextpriv);
3434         pmlmeinfo = &(pmlmeext->mlmext_info);
3435
3436         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3437         if (pmgntframe == NULL)
3438                 goto exit;
3439
3440         /* update attribute */
3441         pattrib = &pmgntframe->attrib;
3442         update_mgntframe_attrib(padapter, pattrib);
3443         pattrib->retry_ctrl = false;
3444
3445         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3446
3447         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3448         pwlanhdr = (struct ieee80211_hdr *)pframe;
3449
3450         fctrl = &(pwlanhdr->frame_control);
3451         *(fctrl) = 0;
3452
3453         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
3454                 SetFrDs(fctrl);
3455         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
3456                 SetToDs(fctrl);
3457
3458         if (power_mode)
3459                 SetPwrMgt(fctrl);
3460
3461         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3462         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3463         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3464
3465         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3466         pmlmeext->mgnt_seq++;
3467         SetFrameSubType(pframe, WIFI_DATA_NULL);
3468
3469         pframe += sizeof(struct ieee80211_hdr_3addr);
3470         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3471
3472         pattrib->last_txcmdsz = pattrib->pktlen;
3473
3474         if (wait_ack) {
3475                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3476         } else {
3477                 dump_mgntframe(padapter, pmgntframe);
3478                 ret = _SUCCESS;
3479         }
3480
3481 exit:
3482         return ret;
3483 }
3484
3485 /*
3486  * [IMPORTANT] Don't call this function in interrupt context
3487  *
3488  * When wait_ms > 0, this function should be called at process context
3489  * da == NULL for station mode
3490  */
3491 int issue_nulldata(struct adapter *padapter, unsigned char *da, unsigned int power_mode, int try_cnt, int wait_ms)
3492 {
3493         int ret;
3494         int i = 0;
3495         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3496         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3497         struct sta_info *psta;
3498
3499
3500         /* da == NULL, assume it's null data for sta to ap*/
3501         if (!da)
3502                 da = get_my_bssid(&(pmlmeinfo->network));
3503
3504         psta = rtw_get_stainfo(&padapter->stapriv, da);
3505         if (psta) {
3506                 if (power_mode)
3507                         rtw_hal_macid_sleep(padapter, psta->mac_id);
3508                 else
3509                         rtw_hal_macid_wakeup(padapter, psta->mac_id);
3510         } else {
3511                 DBG_871X(FUNC_ADPT_FMT ": Can't find sta info for " MAC_FMT ", skip macid %s!!\n",
3512                         FUNC_ADPT_ARG(padapter), MAC_ARG(da), power_mode?"sleep":"wakeup");
3513                 rtw_warn_on(1);
3514         }
3515
3516         do {
3517                 ret = _issue_nulldata(padapter, da, power_mode, wait_ms > 0);
3518
3519                 i++;
3520
3521                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3522                         break;
3523
3524                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3525                         msleep(wait_ms);
3526
3527         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3528
3529         if (ret != _FAIL) {
3530                 ret = _SUCCESS;
3531                 #ifndef DBG_XMIT_ACK
3532                 goto exit;
3533                 #endif
3534         }
3535
3536         if (try_cnt && wait_ms) {
3537                 if (da)
3538                         DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
3539                                 FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
3540                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
3541                 else
3542                         DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
3543                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
3544                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
3545         }
3546 exit:
3547         return ret;
3548 }
3549
3550 /*
3551  * [IMPORTANT] This function run in interrupt context
3552  *
3553  * The null data packet would be sent without power bit,
3554  * and not guarantee success.
3555  */
3556 s32 issue_nulldata_in_interrupt(struct adapter *padapter, u8 *da)
3557 {
3558         struct mlme_ext_priv *pmlmeext;
3559         struct mlme_ext_info *pmlmeinfo;
3560
3561
3562         pmlmeext = &padapter->mlmeextpriv;
3563         pmlmeinfo = &pmlmeext->mlmext_info;
3564
3565         /* da == NULL, assume it's null data for sta to ap*/
3566         if (!da)
3567                 da = get_my_bssid(&(pmlmeinfo->network));
3568
3569         return _issue_nulldata(padapter, da, 0, false);
3570 }
3571
3572 /* when wait_ack is true, this function should be called at process context */
3573 static int _issue_qos_nulldata(struct adapter *padapter, unsigned char *da,
3574                                u16 tid, bool wait_ack)
3575 {
3576         int ret = _FAIL;
3577         struct xmit_frame                       *pmgntframe;
3578         struct pkt_attrib                       *pattrib;
3579         unsigned char                           *pframe;
3580         struct ieee80211_hdr    *pwlanhdr;
3581         __le16 *fctrl;
3582         u16 *qc;
3583         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3584         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3585         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3586
3587         DBG_871X("%s\n", __func__);
3588
3589         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3590         if (pmgntframe == NULL)
3591                 goto exit;
3592
3593         /* update attribute */
3594         pattrib = &pmgntframe->attrib;
3595         update_mgntframe_attrib(padapter, pattrib);
3596
3597         pattrib->hdrlen += 2;
3598         pattrib->qos_en = true;
3599         pattrib->eosp = 1;
3600         pattrib->ack_policy = 0;
3601         pattrib->mdata = 0;
3602
3603         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3604
3605         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3606         pwlanhdr = (struct ieee80211_hdr *)pframe;
3607
3608         fctrl = &(pwlanhdr->frame_control);
3609         *(fctrl) = 0;
3610
3611         if ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)
3612                 SetFrDs(fctrl);
3613         else if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE)
3614                 SetToDs(fctrl);
3615
3616         if (pattrib->mdata)
3617                 SetMData(fctrl);
3618
3619         qc = (unsigned short *)(pframe + pattrib->hdrlen - 2);
3620
3621         SetPriority(qc, tid);
3622
3623         SetEOSP(qc, pattrib->eosp);
3624
3625         SetAckpolicy(qc, pattrib->ack_policy);
3626
3627         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3628         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3629         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3630
3631         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3632         pmlmeext->mgnt_seq++;
3633         SetFrameSubType(pframe, WIFI_QOS_DATA_NULL);
3634
3635         pframe += sizeof(struct ieee80211_qos_hdr);
3636         pattrib->pktlen = sizeof(struct ieee80211_qos_hdr);
3637
3638         pattrib->last_txcmdsz = pattrib->pktlen;
3639
3640         if (wait_ack) {
3641                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3642         } else {
3643                 dump_mgntframe(padapter, pmgntframe);
3644                 ret = _SUCCESS;
3645         }
3646
3647 exit:
3648         return ret;
3649 }
3650
3651 /* when wait_ms >0 , this function should be called at process context */
3652 /* da == NULL for station mode */
3653 int issue_qos_nulldata(struct adapter *padapter, unsigned char *da, u16 tid, int try_cnt, int wait_ms)
3654 {
3655         int ret;
3656         int i = 0;
3657         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3658         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3659
3660         /* da == NULL, assume it's null data for sta to ap*/
3661         if (!da)
3662                 da = get_my_bssid(&(pmlmeinfo->network));
3663
3664         do {
3665                 ret = _issue_qos_nulldata(padapter, da, tid, wait_ms > 0);
3666
3667                 i++;
3668
3669                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3670                         break;
3671
3672                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3673                         msleep(wait_ms);
3674
3675         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3676
3677         if (ret != _FAIL) {
3678                 ret = _SUCCESS;
3679                 #ifndef DBG_XMIT_ACK
3680                 goto exit;
3681                 #endif
3682         }
3683
3684         if (try_cnt && wait_ms) {
3685                 if (da)
3686                         DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
3687                                 FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
3688                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
3689                 else
3690                         DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
3691                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
3692                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
3693         }
3694 exit:
3695         return ret;
3696 }
3697
3698 static int _issue_deauth(struct adapter *padapter, unsigned char *da,
3699                          unsigned short reason, bool wait_ack)
3700 {
3701         struct xmit_frame                       *pmgntframe;
3702         struct pkt_attrib                       *pattrib;
3703         unsigned char                           *pframe;
3704         struct ieee80211_hdr    *pwlanhdr;
3705         __le16 *fctrl;
3706         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
3707         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3708         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3709         int ret = _FAIL;
3710         __le16 le_tmp;
3711
3712         /* DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da)); */
3713
3714         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3715         if (pmgntframe == NULL) {
3716                 goto exit;
3717         }
3718
3719         /* update attribute */
3720         pattrib = &pmgntframe->attrib;
3721         update_mgntframe_attrib(padapter, pattrib);
3722         pattrib->retry_ctrl = false;
3723
3724         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3725
3726         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3727         pwlanhdr = (struct ieee80211_hdr *)pframe;
3728
3729         fctrl = &(pwlanhdr->frame_control);
3730         *(fctrl) = 0;
3731
3732         memcpy(pwlanhdr->addr1, da, ETH_ALEN);
3733         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3734         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3735
3736         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3737         pmlmeext->mgnt_seq++;
3738         SetFrameSubType(pframe, WIFI_DEAUTH);
3739
3740         pframe += sizeof(struct ieee80211_hdr_3addr);
3741         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3742
3743         le_tmp = cpu_to_le16(reason);
3744         pframe = rtw_set_fixed_ie(pframe, _RSON_CODE_, (unsigned char *)&le_tmp, &(pattrib->pktlen));
3745
3746         pattrib->last_txcmdsz = pattrib->pktlen;
3747
3748
3749         if (wait_ack) {
3750                 ret = dump_mgntframe_and_wait_ack(padapter, pmgntframe);
3751         } else {
3752                 dump_mgntframe(padapter, pmgntframe);
3753                 ret = _SUCCESS;
3754         }
3755
3756 exit:
3757         return ret;
3758 }
3759
3760 int issue_deauth(struct adapter *padapter, unsigned char *da, unsigned short reason)
3761 {
3762         DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da));
3763         return _issue_deauth(padapter, da, reason, false);
3764 }
3765
3766 int issue_deauth_ex(struct adapter *padapter, u8 *da, unsigned short reason, int try_cnt,
3767         int wait_ms)
3768 {
3769         int ret;
3770         int i = 0;
3771
3772         do {
3773                 ret = _issue_deauth(padapter, da, reason, wait_ms > 0);
3774
3775                 i++;
3776
3777                 if (padapter->bDriverStopped || padapter->bSurpriseRemoved)
3778                         break;
3779
3780                 if (i < try_cnt && wait_ms > 0 && ret == _FAIL)
3781                         mdelay(wait_ms);
3782
3783         } while ((i < try_cnt) && ((ret == _FAIL) || (wait_ms == 0)));
3784
3785         if (ret != _FAIL) {
3786                 ret = _SUCCESS;
3787                 #ifndef DBG_XMIT_ACK
3788                 goto exit;
3789                 #endif
3790         }
3791
3792         if (try_cnt && wait_ms) {
3793                 if (da)
3794                         DBG_871X(FUNC_ADPT_FMT" to "MAC_FMT", ch:%u%s, %d/%d in %u ms\n",
3795                                 FUNC_ADPT_ARG(padapter), MAC_ARG(da), rtw_get_oper_ch(padapter),
3796                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
3797                 else
3798                         DBG_871X(FUNC_ADPT_FMT", ch:%u%s, %d/%d in %u ms\n",
3799                                 FUNC_ADPT_ARG(padapter), rtw_get_oper_ch(padapter),
3800                                 ret == _SUCCESS?", acked":"", i, try_cnt, (i + 1) * wait_ms);
3801         }
3802 exit:
3803         return ret;
3804 }
3805
3806 void issue_action_SA_Query(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short tid)
3807 {
3808         u8 category = RTW_WLAN_CATEGORY_SA_QUERY;
3809         struct xmit_frame               *pmgntframe;
3810         struct pkt_attrib               *pattrib;
3811         u8                      *pframe;
3812         struct ieee80211_hdr    *pwlanhdr;
3813         __le16 *fctrl;
3814         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3815         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3816         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3817         __le16 le_tmp;
3818
3819         DBG_871X("%s\n", __func__);
3820
3821         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3822         if (pmgntframe == NULL) {
3823                 DBG_871X("%s: alloc_mgtxmitframe fail\n", __func__);
3824                 return;
3825         }
3826
3827         /* update attribute */
3828         pattrib = &pmgntframe->attrib;
3829         update_mgntframe_attrib(padapter, pattrib);
3830
3831         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3832
3833         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3834         pwlanhdr = (struct ieee80211_hdr *)pframe;
3835
3836         fctrl = &(pwlanhdr->frame_control);
3837         *(fctrl) = 0;
3838
3839         if (raddr)
3840                 memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
3841         else
3842                 memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3843         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3844         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3845
3846         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3847         pmlmeext->mgnt_seq++;
3848         SetFrameSubType(pframe, WIFI_ACTION);
3849
3850         pframe += sizeof(struct ieee80211_hdr_3addr);
3851         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3852
3853         pframe = rtw_set_fixed_ie(pframe, 1, &category, &pattrib->pktlen);
3854         pframe = rtw_set_fixed_ie(pframe, 1, &action, &pattrib->pktlen);
3855
3856         switch (action) {
3857         case 0: /* SA Query req */
3858                 pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&pmlmeext->sa_query_seq, &pattrib->pktlen);
3859                 pmlmeext->sa_query_seq++;
3860                 /* send sa query request to AP, AP should reply sa query response in 1 second */
3861                 set_sa_query_timer(pmlmeext, 1000);
3862                 break;
3863
3864         case 1: /* SA Query rsp */
3865                 le_tmp = cpu_to_le16(tid);
3866                 pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)&le_tmp, &pattrib->pktlen);
3867                 break;
3868         default:
3869                 break;
3870         }
3871
3872         pattrib->last_txcmdsz = pattrib->pktlen;
3873
3874         dump_mgntframe(padapter, pmgntframe);
3875 }
3876
3877 void issue_action_BA(struct adapter *padapter, unsigned char *raddr, unsigned char action, unsigned short status)
3878 {
3879         u8 category = RTW_WLAN_CATEGORY_BACK;
3880         u16 start_seq;
3881         u16 BA_para_set;
3882         u16 reason_code;
3883         u16 BA_timeout_value;
3884         u16 BA_starting_seqctrl = 0;
3885         enum HT_CAP_AMPDU_FACTOR max_rx_ampdu_factor;
3886         struct xmit_frame               *pmgntframe;
3887         struct pkt_attrib               *pattrib;
3888         u8                      *pframe;
3889         struct ieee80211_hdr    *pwlanhdr;
3890         __le16 *fctrl;
3891         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
3892         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
3893         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
3894         struct sta_info         *psta;
3895         struct sta_priv         *pstapriv = &padapter->stapriv;
3896         struct registry_priv    *pregpriv = &padapter->registrypriv;
3897         __le16 le_tmp;
3898
3899         DBG_871X("%s, category =%d, action =%d, status =%d\n", __func__, category, action, status);
3900
3901         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
3902         if (!pmgntframe)
3903                 return;
3904
3905         /* update attribute */
3906         pattrib = &pmgntframe->attrib;
3907         update_mgntframe_attrib(padapter, pattrib);
3908
3909         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
3910
3911         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
3912         pwlanhdr = (struct ieee80211_hdr *)pframe;
3913
3914         fctrl = &(pwlanhdr->frame_control);
3915         *(fctrl) = 0;
3916
3917         /* memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN); */
3918         memcpy(pwlanhdr->addr1, raddr, ETH_ALEN);
3919         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
3920         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
3921
3922         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
3923         pmlmeext->mgnt_seq++;
3924         SetFrameSubType(pframe, WIFI_ACTION);
3925
3926         pframe += sizeof(struct ieee80211_hdr_3addr);
3927         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
3928
3929         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
3930         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
3931
3932         if (category == 3) {
3933                 switch (action) {
3934                 case 0: /* ADDBA req */
3935                         do {
3936                                 pmlmeinfo->dialogToken++;
3937                         } while (pmlmeinfo->dialogToken == 0);
3938                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->dialogToken), &(pattrib->pktlen));
3939
3940                         if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter)) {
3941                                 /*  A-MSDU NOT Supported */
3942                                 BA_para_set = 0;
3943                                 /*  immediate Block Ack */
3944                                 BA_para_set |= BIT(1) & IEEE80211_ADDBA_PARAM_POLICY_MASK;
3945                                 /*  TID */
3946                                 BA_para_set |= (status << 2) & IEEE80211_ADDBA_PARAM_TID_MASK;
3947                                 /*  max buffer size is 8 MSDU */
3948                                 BA_para_set |= (8 << 6) & RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
3949                         } else {
3950                                 BA_para_set = (0x1002 | ((status & 0xf) << 2)); /* immediate ack & 64 buffer size */
3951                         }
3952                         le_tmp = cpu_to_le16(BA_para_set);
3953                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3954
3955                         BA_timeout_value = 5000;/*  5ms */
3956                         le_tmp = cpu_to_le16(BA_timeout_value);
3957                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3958
3959                         /* if ((psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress)) != NULL) */
3960                         psta = rtw_get_stainfo(pstapriv, raddr);
3961                         if (psta != NULL) {
3962                                 start_seq = (psta->sta_xmitpriv.txseq_tid[status & 0x07]&0xfff) + 1;
3963
3964                                 DBG_871X("BA_starting_seqctrl = %d for TID =%d\n", start_seq, status & 0x07);
3965
3966                                 psta->BA_starting_seqctrl[status & 0x07] = start_seq;
3967
3968                                 BA_starting_seqctrl = start_seq << 4;
3969                         }
3970
3971                         le_tmp = cpu_to_le16(BA_starting_seqctrl);
3972                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
3973                         break;
3974
3975                 case 1: /* ADDBA rsp */
3976                         pframe = rtw_set_fixed_ie(pframe, 1, &(pmlmeinfo->ADDBA_req.dialog_token), &(pattrib->pktlen));
3977                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&status), &(pattrib->pktlen));
3978                         if (padapter->driver_rx_ampdu_factor != 0xFF)
3979                                 max_rx_ampdu_factor =
3980                                   (enum HT_CAP_AMPDU_FACTOR)padapter->driver_rx_ampdu_factor;
3981                         else
3982                                 rtw_hal_get_def_var(padapter,
3983                                                     HW_VAR_MAX_RX_AMPDU_FACTOR, &max_rx_ampdu_factor);
3984
3985                         if (MAX_AMPDU_FACTOR_64K == max_rx_ampdu_factor)
3986                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
3987                         else if (MAX_AMPDU_FACTOR_32K == max_rx_ampdu_factor)
3988                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0800); /* 32 buffer size */
3989                         else if (MAX_AMPDU_FACTOR_16K == max_rx_ampdu_factor)
3990                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0400); /* 16 buffer size */
3991                         else if (MAX_AMPDU_FACTOR_8K == max_rx_ampdu_factor)
3992                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x0200); /* 8 buffer size */
3993                         else
3994                                 BA_para_set = ((le16_to_cpu(pmlmeinfo->ADDBA_req.BA_para_set) & 0x3f) | 0x1000); /* 64 buffer size */
3995
3996                         if (hal_btcoex_IsBTCoexCtrlAMPDUSize(padapter) &&
3997                             padapter->driver_rx_ampdu_factor == 0xFF) {
3998                                 /*  max buffer size is 8 MSDU */
3999                                 BA_para_set &= ~RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
4000                                 BA_para_set |= (8 << 6) & RTW_IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK;
4001                         }
4002
4003                         if (pregpriv->ampdu_amsdu == 0)/* disabled */
4004                                 le_tmp = cpu_to_le16(BA_para_set & ~BIT(0));
4005                         else if (pregpriv->ampdu_amsdu == 1)/* enabled */
4006                                 le_tmp = cpu_to_le16(BA_para_set | BIT(0));
4007                         else /* auto */
4008                                 le_tmp = cpu_to_le16(BA_para_set);
4009
4010                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
4011                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(pmlmeinfo->ADDBA_req.BA_timeout_value)), &(pattrib->pktlen));
4012                         break;
4013                 case 2:/* DELBA */
4014                         BA_para_set = (status & 0x1F) << 3;
4015                         le_tmp = cpu_to_le16(BA_para_set);
4016                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
4017
4018                         reason_code = 37;
4019                         le_tmp = cpu_to_le16(reason_code);
4020                         pframe = rtw_set_fixed_ie(pframe, 2, (unsigned char *)(&(le_tmp)), &(pattrib->pktlen));
4021                         break;
4022                 default:
4023                         break;
4024                 }
4025         }
4026
4027         pattrib->last_txcmdsz = pattrib->pktlen;
4028
4029         dump_mgntframe(padapter, pmgntframe);
4030 }
4031
4032 static void issue_action_BSSCoexistPacket(struct adapter *padapter)
4033 {
4034         struct list_head                *plist, *phead;
4035         unsigned char category, action;
4036         struct xmit_frame                       *pmgntframe;
4037         struct pkt_attrib                       *pattrib;
4038         unsigned char                   *pframe;
4039         struct ieee80211_hdr    *pwlanhdr;
4040         __le16 *fctrl;
4041         struct  wlan_network    *pnetwork = NULL;
4042         struct xmit_priv                *pxmitpriv = &(padapter->xmitpriv);
4043         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4044         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
4045         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4046         struct __queue          *queue  = &(pmlmepriv->scanned_queue);
4047         u8 InfoContent[16] = {0};
4048         u8 ICS[8][15];
4049
4050         if ((pmlmepriv->num_FortyMHzIntolerant == 0) || (pmlmepriv->num_sta_no_ht == 0))
4051                 return;
4052
4053         if (true == pmlmeinfo->bwmode_updated)
4054                 return;
4055
4056
4057         DBG_871X("%s\n", __func__);
4058
4059
4060         category = RTW_WLAN_CATEGORY_PUBLIC;
4061         action = ACT_PUBLIC_BSSCOEXIST;
4062
4063         pmgntframe = alloc_mgtxmitframe(pxmitpriv);
4064         if (pmgntframe == NULL) {
4065                 return;
4066         }
4067
4068         /* update attribute */
4069         pattrib = &pmgntframe->attrib;
4070         update_mgntframe_attrib(padapter, pattrib);
4071
4072         memset(pmgntframe->buf_addr, 0, WLANHDR_OFFSET + TXDESC_OFFSET);
4073
4074         pframe = (u8 *)(pmgntframe->buf_addr) + TXDESC_OFFSET;
4075         pwlanhdr = (struct ieee80211_hdr *)pframe;
4076
4077         fctrl = &(pwlanhdr->frame_control);
4078         *(fctrl) = 0;
4079
4080         memcpy(pwlanhdr->addr1, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
4081         memcpy(pwlanhdr->addr2, myid(&(padapter->eeprompriv)), ETH_ALEN);
4082         memcpy(pwlanhdr->addr3, get_my_bssid(&(pmlmeinfo->network)), ETH_ALEN);
4083
4084         SetSeqNum(pwlanhdr, pmlmeext->mgnt_seq);
4085         pmlmeext->mgnt_seq++;
4086         SetFrameSubType(pframe, WIFI_ACTION);
4087
4088         pframe += sizeof(struct ieee80211_hdr_3addr);
4089         pattrib->pktlen = sizeof(struct ieee80211_hdr_3addr);
4090
4091         pframe = rtw_set_fixed_ie(pframe, 1, &(category), &(pattrib->pktlen));
4092         pframe = rtw_set_fixed_ie(pframe, 1, &(action), &(pattrib->pktlen));
4093
4094
4095         /*  */
4096         if (pmlmepriv->num_FortyMHzIntolerant > 0) {
4097                 u8 iedata = 0;
4098
4099                 iedata |= BIT(2);/* 20 MHz BSS Width Request */
4100
4101                 pframe = rtw_set_ie(pframe, EID_BSSCoexistence,  1, &iedata, &(pattrib->pktlen));
4102
4103         }
4104
4105
4106         /*  */
4107         memset(ICS, 0, sizeof(ICS));
4108         if (pmlmepriv->num_sta_no_ht > 0) {
4109                 int i;
4110
4111                 spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
4112
4113                 phead = get_list_head(queue);
4114                 plist = get_next(phead);
4115
4116                 while (1) {
4117                         int len;
4118                         u8 *p;
4119                         struct wlan_bssid_ex *pbss_network;
4120
4121                         if (phead == plist)
4122                                 break;
4123
4124                         pnetwork = LIST_CONTAINOR(plist, struct wlan_network, list);
4125
4126                         plist = get_next(plist);
4127
4128                         pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
4129
4130                         p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
4131                         if ((p == NULL) || (len == 0)) {/* non-HT */
4132
4133                                 if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
4134                                         continue;
4135
4136                                 ICS[0][pbss_network->Configuration.DSConfig] = 1;
4137
4138                                 if (ICS[0][0] == 0)
4139                                         ICS[0][0] = 1;
4140                         }
4141
4142                 }
4143
4144                 spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
4145
4146
4147                 for (i = 0; i < 8; i++) {
4148                         if (ICS[i][0] == 1) {
4149                                 int j, k = 0;
4150
4151                                 InfoContent[k] = i;
4152                                 /* SET_BSS_INTOLERANT_ELE_REG_CLASS(InfoContent, i); */
4153                                 k++;
4154
4155                                 for (j = 1; j <= 14; j++) {
4156                                         if (ICS[i][j] == 1) {
4157                                                 if (k < 16) {
4158                                                         InfoContent[k] = j; /* channel number */
4159                                                         /* SET_BSS_INTOLERANT_ELE_CHANNEL(InfoContent+k, j); */
4160                                                         k++;
4161                                                 }
4162                                         }
4163                                 }
4164
4165                                 pframe = rtw_set_ie(pframe, EID_BSSIntolerantChlReport, k, InfoContent, &(pattrib->pktlen));
4166
4167                         }
4168
4169                 }
4170
4171
4172         }
4173
4174
4175         pattrib->last_txcmdsz = pattrib->pktlen;
4176
4177         dump_mgntframe(padapter, pmgntframe);
4178 }
4179
4180 unsigned int send_delba(struct adapter *padapter, u8 initiator, u8 *addr)
4181 {
4182         struct sta_priv *pstapriv = &padapter->stapriv;
4183         struct sta_info *psta = NULL;
4184         /* struct recv_reorder_ctrl *preorder_ctrl; */
4185         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4186         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4187         u16 tid;
4188
4189         if ((pmlmeinfo->state&0x03) != WIFI_FW_AP_STATE)
4190                 if (!(pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS))
4191                         return _SUCCESS;
4192
4193         psta = rtw_get_stainfo(pstapriv, addr);
4194         if (psta == NULL)
4195                 return _SUCCESS;
4196
4197         /* DBG_871X("%s:%s\n", __func__, (initiator == 0)?"RX_DIR":"TX_DIR"); */
4198
4199         if (initiator == 0) {/*  recipient */
4200                 for (tid = 0; tid < MAXTID; tid++) {
4201                         if (psta->recvreorder_ctrl[tid].enable) {
4202                                 DBG_871X("rx agg disable tid(%d)\n", tid);
4203                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
4204                                 psta->recvreorder_ctrl[tid].enable = false;
4205                                 psta->recvreorder_ctrl[tid].indicate_seq = 0xffff;
4206                                 #ifdef DBG_RX_SEQ
4207                                 DBG_871X("DBG_RX_SEQ %s:%d indicate_seq:%u\n", __func__, __LINE__,
4208                                         psta->recvreorder_ctrl[tid].indicate_seq);
4209                                 #endif
4210                         }
4211                 }
4212         } else if (initiator == 1) {/*  originator */
4213                 /* DBG_871X("tx agg_enable_bitmap(0x%08x)\n", psta->htpriv.agg_enable_bitmap); */
4214                 for (tid = 0; tid < MAXTID; tid++) {
4215                         if (psta->htpriv.agg_enable_bitmap & BIT(tid)) {
4216                                 DBG_871X("tx agg disable tid(%d)\n", tid);
4217                                 issue_action_BA(padapter, addr, RTW_WLAN_ACTION_DELBA, (((tid << 1) | initiator)&0x1F));
4218                                 psta->htpriv.agg_enable_bitmap &= ~BIT(tid);
4219                                 psta->htpriv.candidate_tid_bitmap &= ~BIT(tid);
4220
4221                         }
4222                 }
4223         }
4224
4225         return _SUCCESS;
4226
4227 }
4228
4229 unsigned int send_beacon(struct adapter *padapter)
4230 {
4231         u8 bxmitok = false;
4232         int     issue = 0;
4233         int poll = 0;
4234         unsigned long start = jiffies;
4235
4236         rtw_hal_set_hwreg(padapter, HW_VAR_BCN_VALID, NULL);
4237         rtw_hal_set_hwreg(padapter, HW_VAR_DL_BCN_SEL, NULL);
4238         do {
4239                 issue_beacon(padapter, 100);
4240                 issue++;
4241                 do {
4242                         cond_resched();
4243                         rtw_hal_get_hwreg(padapter, HW_VAR_BCN_VALID, (u8 *)(&bxmitok));
4244                         poll++;
4245                 } while ((poll%10) != 0 && false == bxmitok && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
4246
4247         } while (false == bxmitok && issue < 100 && !padapter->bSurpriseRemoved && !padapter->bDriverStopped);
4248
4249         if (padapter->bSurpriseRemoved || padapter->bDriverStopped) {
4250                 return _FAIL;
4251         }
4252
4253
4254         if (false == bxmitok) {
4255                 DBG_871X("%s fail! %u ms\n", __func__, jiffies_to_msecs(jiffies - start));
4256                 return _FAIL;
4257         } else {
4258                 unsigned long passing_time = jiffies_to_msecs(jiffies - start);
4259
4260                 if (passing_time > 100 || issue > 3)
4261                         DBG_871X("%s success, issue:%d, poll:%d, %lu ms\n", __func__, issue, poll, passing_time);
4262                 /* else */
4263                 /*      DBG_871X("%s success, issue:%d, poll:%d, %u ms\n", __func__, issue, poll, passing_time); */
4264
4265                 return _SUCCESS;
4266         }
4267 }
4268
4269 /****************************************************************************
4270
4271 Following are some utility functions for WiFi MLME
4272
4273 *****************************************************************************/
4274
4275 void site_survey(struct adapter *padapter)
4276 {
4277         unsigned char   survey_channel = 0, val8;
4278         RT_SCAN_TYPE    ScanType = SCAN_PASSIVE;
4279         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4280         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4281         u32 initialgain = 0;
4282         u32 channel_scan_time_ms = 0;
4283
4284         {
4285                 struct rtw_ieee80211_channel *ch;
4286
4287                 if (pmlmeext->sitesurvey_res.channel_idx < pmlmeext->sitesurvey_res.ch_num) {
4288                         ch = &pmlmeext->sitesurvey_res.ch[pmlmeext->sitesurvey_res.channel_idx];
4289                         survey_channel = ch->hw_value;
4290                         ScanType = (ch->flags & RTW_IEEE80211_CHAN_PASSIVE_SCAN) ? SCAN_PASSIVE : SCAN_ACTIVE;
4291                 }
4292         }
4293
4294         DBG_871X(FUNC_ADPT_FMT" ch:%u (cnt:%u) at %dms, %c%c%c\n"
4295                  , FUNC_ADPT_ARG(padapter)
4296                  , survey_channel
4297                  , pmlmeext->sitesurvey_res.channel_idx
4298                  , jiffies_to_msecs(jiffies - padapter->mlmepriv.scan_start_time)
4299                  , ScanType?'A':'P', pmlmeext->sitesurvey_res.scan_mode?'A':'P'
4300                  , pmlmeext->sitesurvey_res.ssid[0].SsidLength?'S':' '
4301                 );
4302 #ifdef DBG_FIXED_CHAN
4303         DBG_871X(FUNC_ADPT_FMT" fixed_chan:%u\n", pmlmeext->fixed_chan);
4304 #endif
4305
4306         if (survey_channel != 0) {
4307                 /* PAUSE 4-AC Queue when site_survey */
4308                 /* rtw_hal_get_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
4309                 /* val8 |= 0x0f; */
4310                 /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
4311                 if (pmlmeext->sitesurvey_res.channel_idx == 0) {
4312 #ifdef DBG_FIXED_CHAN
4313                         if (pmlmeext->fixed_chan != 0xff)
4314                                 set_channel_bwmode(padapter, pmlmeext->fixed_chan, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
4315                         else
4316 #endif
4317                                 set_channel_bwmode(padapter, survey_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
4318                 } else {
4319 #ifdef DBG_FIXED_CHAN
4320                         if (pmlmeext->fixed_chan != 0xff)
4321                                 SelectChannel(padapter, pmlmeext->fixed_chan);
4322                         else
4323 #endif
4324                                 SelectChannel(padapter, survey_channel);
4325                 }
4326
4327                 if (ScanType == SCAN_ACTIVE) { /* obey the channel plan setting... */
4328                         {
4329                                 int i;
4330
4331                                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
4332                                         if (pmlmeext->sitesurvey_res.ssid[i].SsidLength) {
4333                                                 /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
4334                                                 if (padapter->registrypriv.wifi_spec)
4335                                                         issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
4336                                                 else
4337                                                         issue_probereq_ex(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL, 0, 0, 0, 0);
4338                                                 issue_probereq(padapter, &(pmlmeext->sitesurvey_res.ssid[i]), NULL);
4339                                         }
4340                                 }
4341
4342                                 if (pmlmeext->sitesurvey_res.scan_mode == SCAN_ACTIVE) {
4343                                         /* IOT issue, When wifi_spec is not set, send one probe req without WPS IE. */
4344                                         if (padapter->registrypriv.wifi_spec)
4345                                                 issue_probereq(padapter, NULL, NULL);
4346                                         else
4347                                                 issue_probereq_ex(padapter, NULL, NULL, 0, 0, 0, 0);
4348                                         issue_probereq(padapter, NULL, NULL);
4349                                 }
4350                         }
4351                 }
4352
4353                 channel_scan_time_ms = pmlmeext->chan_scan_time;
4354
4355                 set_survey_timer(pmlmeext, channel_scan_time_ms);
4356 #if defined(CONFIG_SIGNAL_DISPLAY_DBM) && defined(CONFIG_BACKGROUND_NOISE_MONITOR)
4357                 {
4358                         struct noise_info info;
4359
4360                         info.bPauseDIG = false;
4361                         info.IGIValue = 0;
4362                         info.max_time = channel_scan_time_ms/2;/* ms */
4363                         info.chan = survey_channel;
4364                         rtw_hal_set_odm_var(padapter, HAL_ODM_NOISE_MONITOR, &info, false);
4365                 }
4366 #endif
4367
4368         } else {
4369
4370                 /*      channel number is 0 or this channel is not valid. */
4371
4372                 {
4373                         pmlmeext->sitesurvey_res.state = SCAN_COMPLETE;
4374
4375                         /* switch back to the original channel */
4376                         /* SelectChannel(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset); */
4377
4378                         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
4379
4380                         /* flush 4-AC Queue after site_survey */
4381                         /* val8 = 0; */
4382                         /* rtw_hal_set_hwreg(padapter, HW_VAR_TXPAUSE, (u8 *)(&val8)); */
4383
4384                         /* config MSR */
4385                         Set_MSR(padapter, (pmlmeinfo->state & 0x3));
4386
4387                         initialgain = 0xff; /* restore RX GAIN */
4388                         rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
4389                         /* turn on dynamic functions */
4390                         Restore_DM_Func_Flag(padapter);
4391                         /* Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true); */
4392
4393                         if (is_client_associated_to_ap(padapter))
4394                                 issue_nulldata(padapter, NULL, 0, 3, 500);
4395
4396                         val8 = 0; /* survey done */
4397                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
4398
4399                         report_surveydone_event(padapter);
4400
4401                         pmlmeext->chan_scan_time = SURVEY_TO;
4402                         pmlmeext->sitesurvey_res.state = SCAN_DISABLE;
4403
4404                         issue_action_BSSCoexistPacket(padapter);
4405                         issue_action_BSSCoexistPacket(padapter);
4406                         issue_action_BSSCoexistPacket(padapter);
4407                 }
4408         }
4409
4410         return;
4411
4412 }
4413
4414 /* collect bss info from Beacon and Probe request/response frames. */
4415 u8 collect_bss_info(struct adapter *padapter, union recv_frame *precv_frame, struct wlan_bssid_ex *bssid)
4416 {
4417         int     i;
4418         u32 len;
4419         u8 *p;
4420         u16 val16, subtype;
4421         u8 *pframe = precv_frame->u.hdr.rx_data;
4422         u32 packet_len = precv_frame->u.hdr.len;
4423         u8 ie_offset;
4424         struct registry_priv *pregistrypriv = &padapter->registrypriv;
4425         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4426         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4427         __le32 le32_tmp;
4428
4429         len = packet_len - sizeof(struct ieee80211_hdr_3addr);
4430
4431         if (len > MAX_IE_SZ) {
4432                 /* DBG_871X("IE too long for survey event\n"); */
4433                 return _FAIL;
4434         }
4435
4436         memset(bssid, 0, sizeof(struct wlan_bssid_ex));
4437
4438         subtype = GetFrameSubType(pframe);
4439
4440         if (subtype == WIFI_BEACON) {
4441                 bssid->Reserved[0] = 1;
4442                 ie_offset = _BEACON_IE_OFFSET_;
4443         } else {
4444                 /*  FIXME : more type */
4445                 if (subtype == WIFI_PROBERSP) {
4446                         ie_offset = _PROBERSP_IE_OFFSET_;
4447                         bssid->Reserved[0] = 3;
4448                 } else if (subtype == WIFI_PROBEREQ) {
4449                         ie_offset = _PROBEREQ_IE_OFFSET_;
4450                         bssid->Reserved[0] = 2;
4451                 } else {
4452                         bssid->Reserved[0] = 0;
4453                         ie_offset = _FIXED_IE_LENGTH_;
4454                 }
4455         }
4456
4457         bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
4458
4459         /* below is to copy the information element */
4460         bssid->IELength = len;
4461         memcpy(bssid->IEs, (pframe + sizeof(struct ieee80211_hdr_3addr)), bssid->IELength);
4462
4463         /* get the signal strength */
4464         bssid->Rssi = precv_frame->u.hdr.attrib.phy_info.RecvSignalPower; /*  in dBM.raw data */
4465         bssid->PhyInfo.SignalQuality = precv_frame->u.hdr.attrib.phy_info.SignalQuality;/* in percentage */
4466         bssid->PhyInfo.SignalStrength = precv_frame->u.hdr.attrib.phy_info.SignalStrength;/* in percentage */
4467
4468         /*  checking SSID */
4469         p = rtw_get_ie(bssid->IEs + ie_offset, _SSID_IE_, &len, bssid->IELength - ie_offset);
4470         if (p == NULL) {
4471                 DBG_871X("marc: cannot find SSID for survey event\n");
4472                 return _FAIL;
4473         }
4474
4475         if (*(p + 1)) {
4476                 if (len > NDIS_802_11_LENGTH_SSID) {
4477                         DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
4478                         return _FAIL;
4479                 }
4480                 memcpy(bssid->Ssid.Ssid, (p + 2), *(p + 1));
4481                 bssid->Ssid.SsidLength = *(p + 1);
4482         } else
4483                 bssid->Ssid.SsidLength = 0;
4484
4485         memset(bssid->SupportedRates, 0, NDIS_802_11_LENGTH_RATES_EX);
4486
4487         /* checking rate info... */
4488         i = 0;
4489         p = rtw_get_ie(bssid->IEs + ie_offset, _SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
4490         if (p != NULL) {
4491                 if (len > NDIS_802_11_LENGTH_RATES_EX) {
4492                         DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
4493                         return _FAIL;
4494                 }
4495                 memcpy(bssid->SupportedRates, (p + 2), len);
4496                 i = len;
4497         }
4498
4499         p = rtw_get_ie(bssid->IEs + ie_offset, _EXT_SUPPORTEDRATES_IE_, &len, bssid->IELength - ie_offset);
4500         if (p != NULL) {
4501                 if (len > (NDIS_802_11_LENGTH_RATES_EX-i)) {
4502                         DBG_871X("%s()-%d: IE too long (%d) for survey event\n", __func__, __LINE__, len);
4503                         return _FAIL;
4504                 }
4505                 memcpy(bssid->SupportedRates + i, (p + 2), len);
4506         }
4507
4508         bssid->NetworkTypeInUse = Ndis802_11OFDM24;
4509
4510         if (bssid->IELength < 12)
4511                 return _FAIL;
4512
4513         /*  Checking for DSConfig */
4514         p = rtw_get_ie(bssid->IEs + ie_offset, _DSSET_IE_, &len, bssid->IELength - ie_offset);
4515
4516         bssid->Configuration.DSConfig = 0;
4517         bssid->Configuration.Length = 0;
4518
4519         if (p) {
4520                 bssid->Configuration.DSConfig = *(p + 2);
4521         } else {
4522                 /*  In 5G, some ap do not have DSSET IE */
4523                 /*  checking HT info for channel */
4524                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_ADD_INFO_IE_, &len, bssid->IELength - ie_offset);
4525                 if (p) {
4526                         struct HT_info_element *HT_info = (struct HT_info_element *)(p + 2);
4527
4528                         bssid->Configuration.DSConfig = HT_info->primary_channel;
4529                 } else { /*  use current channel */
4530                         bssid->Configuration.DSConfig = rtw_get_oper_ch(padapter);
4531                 }
4532         }
4533
4534         memcpy(&le32_tmp, rtw_get_beacon_interval_from_ie(bssid->IEs), 2);
4535         bssid->Configuration.BeaconPeriod = le32_to_cpu(le32_tmp);
4536
4537         val16 = rtw_get_capability((struct wlan_bssid_ex *)bssid);
4538
4539         if (val16 & BIT(0)) {
4540                 bssid->InfrastructureMode = Ndis802_11Infrastructure;
4541                 memcpy(bssid->MacAddress, GetAddr2Ptr(pframe), ETH_ALEN);
4542         } else {
4543                 bssid->InfrastructureMode = Ndis802_11IBSS;
4544                 memcpy(bssid->MacAddress, GetAddr3Ptr(pframe), ETH_ALEN);
4545         }
4546
4547         if (val16 & BIT(4))
4548                 bssid->Privacy = 1;
4549         else
4550                 bssid->Privacy = 0;
4551
4552         bssid->Configuration.ATIMWindow = 0;
4553
4554         /* 20/40 BSS Coexistence check */
4555         if ((pregistrypriv->wifi_spec == 1) && (false == pmlmeinfo->bwmode_updated)) {
4556                 struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
4557
4558                 p = rtw_get_ie(bssid->IEs + ie_offset, _HT_CAPABILITY_IE_, &len, bssid->IELength - ie_offset);
4559                 if (p && len > 0) {
4560                         struct HT_caps_element  *pHT_caps;
4561
4562                         pHT_caps = (struct HT_caps_element      *)(p + 2);
4563
4564                         if (le16_to_cpu(pHT_caps->u.HT_cap_element.HT_caps_info) & BIT(14))
4565                                 pmlmepriv->num_FortyMHzIntolerant++;
4566                 } else
4567                         pmlmepriv->num_sta_no_ht++;
4568         }
4569
4570         #if defined(DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) & 1
4571         if (strcmp(bssid->Ssid.Ssid, DBG_RX_SIGNAL_DISPLAY_SSID_MONITORED) == 0) {
4572                 DBG_871X("Receiving %s("MAC_FMT", DSConfig:%u) from ch%u with ss:%3u, sq:%3u, RawRSSI:%3ld\n"
4573                         , bssid->Ssid.Ssid, MAC_ARG(bssid->MacAddress), bssid->Configuration.DSConfig
4574                         , rtw_get_oper_ch(padapter)
4575                         , bssid->PhyInfo.SignalStrength, bssid->PhyInfo.SignalQuality, bssid->Rssi
4576                 );
4577         }
4578         #endif
4579
4580         /*  mark bss info receiving from nearby channel as SignalQuality 101 */
4581         if (bssid->Configuration.DSConfig != rtw_get_oper_ch(padapter))
4582                 bssid->PhyInfo.SignalQuality = 101;
4583
4584         return _SUCCESS;
4585 }
4586
4587 void start_create_ibss(struct adapter *padapter)
4588 {
4589         unsigned short  caps;
4590         u8 val8;
4591         u8 join_type;
4592         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4593         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4594         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4595
4596         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
4597         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
4598
4599         /* update wireless mode */
4600         update_wireless_mode(padapter);
4601
4602         /* update capability */
4603         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
4604         update_capinfo(padapter, caps);
4605         if (caps&cap_IBSS) {/* adhoc master */
4606                 val8 = 0xcf;
4607                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4608
4609                 rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);
4610
4611                 /* switch channel */
4612                 /* SelectChannel(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE); */
4613                 set_channel_bwmode(padapter, pmlmeext->cur_channel, HAL_PRIME_CHNL_OFFSET_DONT_CARE, CHANNEL_WIDTH_20);
4614
4615                 beacon_timing_control(padapter);
4616
4617                 /* set msr to WIFI_FW_ADHOC_STATE */
4618                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
4619                 Set_MSR(padapter, (pmlmeinfo->state & 0x3));
4620
4621                 /* issue beacon */
4622                 if (send_beacon(padapter) == _FAIL) {
4623                         RT_TRACE(_module_rtl871x_mlme_c_, _drv_err_, ("issuing beacon frame fail....\n"));
4624
4625                         report_join_res(padapter, -1);
4626                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4627                 } else {
4628                         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, padapter->registrypriv.dev_network.MacAddress);
4629                         join_type = 0;
4630                         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
4631
4632                         report_join_res(padapter, 1);
4633                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
4634                         rtw_indicate_connect(padapter);
4635                 }
4636         } else {
4637                 DBG_871X("start_create_ibss, invalid cap:%x\n", caps);
4638                 return;
4639         }
4640         /* update bc/mc sta_info */
4641         update_bmc_sta(padapter);
4642
4643 }
4644
4645 void start_clnt_join(struct adapter *padapter)
4646 {
4647         unsigned short  caps;
4648         u8 val8;
4649         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4650         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4651         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
4652         int beacon_timeout;
4653
4654         /* update wireless mode */
4655         update_wireless_mode(padapter);
4656
4657         /* update capability */
4658         caps = rtw_get_capability((struct wlan_bssid_ex *)pnetwork);
4659         update_capinfo(padapter, caps);
4660         if (caps&cap_ESS) {
4661                 Set_MSR(padapter, WIFI_FW_STATION_STATE);
4662
4663                 val8 = (pmlmeinfo->auth_algo == dot11AuthAlgrthm_8021X) ? 0xcc : 0xcf;
4664
4665                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4666
4667                 /*  Because of AP's not receiving deauth before */
4668                 /*  AP may: 1)not response auth or 2)deauth us after link is complete */
4669                 /*  issue deauth before issuing auth to deal with the situation */
4670
4671                 /*      Commented by Albert 2012/07/21 */
4672                 /*      For the Win8 P2P connection, it will be hard to have a successful connection if this Wi-Fi doesn't connect to it. */
4673                 {
4674                                 /* To avoid connecting to AP fail during resume process, change retry count from 5 to 1 */
4675                                 issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
4676                 }
4677
4678                 /* here wait for receiving the beacon to start auth */
4679                 /* and enable a timer */
4680                 beacon_timeout = decide_wait_for_beacon_timeout(pmlmeinfo->bcn_interval);
4681                 set_link_timer(pmlmeext, beacon_timeout);
4682                 _set_timer(&padapter->mlmepriv.assoc_timer,
4683                         (REAUTH_TO * REAUTH_LIMIT) + (REASSOC_TO*REASSOC_LIMIT) + beacon_timeout);
4684
4685                 pmlmeinfo->state = WIFI_FW_AUTH_NULL | WIFI_FW_STATION_STATE;
4686         } else if (caps&cap_IBSS) { /* adhoc client */
4687                 Set_MSR(padapter, WIFI_FW_ADHOC_STATE);
4688
4689                 val8 = 0xcf;
4690                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_CFG, (u8 *)(&val8));
4691
4692                 beacon_timing_control(padapter);
4693
4694                 pmlmeinfo->state = WIFI_FW_ADHOC_STATE;
4695
4696                 report_join_res(padapter, 1);
4697         } else {
4698                 /* DBG_871X("marc: invalid cap:%x\n", caps); */
4699                 return;
4700         }
4701
4702 }
4703
4704 void start_clnt_auth(struct adapter *padapter)
4705 {
4706         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4707         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4708
4709         del_timer_sync(&pmlmeext->link_timer);
4710
4711         pmlmeinfo->state &= (~WIFI_FW_AUTH_NULL);
4712         pmlmeinfo->state |= WIFI_FW_AUTH_STATE;
4713
4714         pmlmeinfo->auth_seq = 1;
4715         pmlmeinfo->reauth_count = 0;
4716         pmlmeinfo->reassoc_count = 0;
4717         pmlmeinfo->link_count = 0;
4718         pmlmeext->retry = 0;
4719
4720
4721         DBG_871X_LEVEL(_drv_always_, "start auth\n");
4722         issue_auth(padapter, NULL, 0);
4723
4724         set_link_timer(pmlmeext, REAUTH_TO);
4725
4726 }
4727
4728
4729 void start_clnt_assoc(struct adapter *padapter)
4730 {
4731         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4732         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4733
4734         del_timer_sync(&pmlmeext->link_timer);
4735
4736         pmlmeinfo->state &= (~(WIFI_FW_AUTH_NULL | WIFI_FW_AUTH_STATE));
4737         pmlmeinfo->state |= (WIFI_FW_AUTH_SUCCESS | WIFI_FW_ASSOC_STATE);
4738
4739         issue_assocreq(padapter);
4740
4741         set_link_timer(pmlmeext, REASSOC_TO);
4742 }
4743
4744 unsigned int receive_disconnect(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
4745 {
4746         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
4747         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
4748
4749         /* check A3 */
4750         if (!(!memcmp(MacAddr, get_my_bssid(&pmlmeinfo->network), ETH_ALEN)))
4751                 return _SUCCESS;
4752
4753         DBG_871X("%s\n", __func__);
4754
4755         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
4756                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
4757                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4758                         report_del_sta_event(padapter, MacAddr, reason);
4759
4760                 } else if (pmlmeinfo->state & WIFI_FW_LINKING_STATE) {
4761                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
4762                         report_join_res(padapter, -2);
4763                 }
4764         }
4765
4766         return _SUCCESS;
4767 }
4768
4769 static void process_80211d(struct adapter *padapter, struct wlan_bssid_ex *bssid)
4770 {
4771         struct registry_priv *pregistrypriv;
4772         struct mlme_ext_priv *pmlmeext;
4773         RT_CHANNEL_INFO *chplan_new;
4774         u8 channel;
4775         u8 i;
4776
4777
4778         pregistrypriv = &padapter->registrypriv;
4779         pmlmeext = &padapter->mlmeextpriv;
4780
4781         /*  Adjust channel plan by AP Country IE */
4782         if (pregistrypriv->enable80211d &&
4783                 (!pmlmeext->update_channel_plan_by_ap_done)) {
4784                 u8 *ie, *p;
4785                 u32 len;
4786                 RT_CHANNEL_PLAN chplan_ap;
4787                 RT_CHANNEL_INFO chplan_sta[MAX_CHANNEL_NUM];
4788                 u8 country[4];
4789                 u8 fcn; /*  first channel number */
4790                 u8 noc; /*  number of channel */
4791                 u8 j, k;
4792
4793                 ie = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _COUNTRY_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
4794                 if (!ie)
4795                         return;
4796                 if (len < 6)
4797                         return;
4798
4799                 ie += 2;
4800                 p = ie;
4801                 ie += len;
4802
4803                 memset(country, 0, 4);
4804                 memcpy(country, p, 3);
4805                 p += 3;
4806                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
4807                                 ("%s: 802.11d country =%s\n", __func__, country));
4808
4809                 i = 0;
4810                 while ((ie - p) >= 3) {
4811                         fcn = *(p++);
4812                         noc = *(p++);
4813                         p++;
4814
4815                         for (j = 0; j < noc; j++) {
4816                                 if (fcn <= 14)
4817                                         channel = fcn + j; /*  2.4 GHz */
4818                                 else
4819                                         channel = fcn + j*4; /*  5 GHz */
4820
4821                                 chplan_ap.Channel[i++] = channel;
4822                         }
4823                 }
4824                 chplan_ap.Len = i;
4825
4826 #ifdef DEBUG_RTL871X
4827                 i = 0;
4828                 DBG_871X("%s: AP[%s] channel plan {", __func__, bssid->Ssid.Ssid);
4829                 while ((i < chplan_ap.Len) && (chplan_ap.Channel[i] != 0)) {
4830                         DBG_8192C("%02d,", chplan_ap.Channel[i]);
4831                         i++;
4832                 }
4833                 DBG_871X("}\n");
4834 #endif
4835
4836                 memcpy(chplan_sta, pmlmeext->channel_set, sizeof(chplan_sta));
4837 #ifdef DEBUG_RTL871X
4838                 i = 0;
4839                 DBG_871X("%s: STA channel plan {", __func__);
4840                 while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
4841                         DBG_871X("%02d(%c),", chplan_sta[i].ChannelNum, chplan_sta[i].ScanType == SCAN_PASSIVE?'p':'a');
4842                         i++;
4843                 }
4844                 DBG_871X("}\n");
4845 #endif
4846
4847                 memset(pmlmeext->channel_set, 0, sizeof(pmlmeext->channel_set));
4848                 chplan_new = pmlmeext->channel_set;
4849
4850                 i = j = k = 0;
4851                 if (pregistrypriv->wireless_mode & WIRELESS_11G) {
4852                         do {
4853                                 if ((i == MAX_CHANNEL_NUM) ||
4854                                         (chplan_sta[i].ChannelNum == 0) ||
4855                                         (chplan_sta[i].ChannelNum > 14))
4856                                         break;
4857
4858                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] > 14))
4859                                         break;
4860
4861                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
4862                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4863                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4864                                         i++;
4865                                         j++;
4866                                         k++;
4867                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
4868                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4869 /*                                      chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4870                                         chplan_new[k].ScanType = SCAN_PASSIVE;
4871                                         i++;
4872                                         k++;
4873                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
4874                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4875                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4876                                         j++;
4877                                         k++;
4878                                 }
4879                         } while (1);
4880
4881                         /*  change AP not support channel to Passive scan */
4882                         while ((i < MAX_CHANNEL_NUM) &&
4883                                 (chplan_sta[i].ChannelNum != 0) &&
4884                                 (chplan_sta[i].ChannelNum <= 14)) {
4885
4886                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4887 /*                              chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4888                                 chplan_new[k].ScanType = SCAN_PASSIVE;
4889                                 i++;
4890                                 k++;
4891                         }
4892
4893                         /*  add channel AP supported */
4894                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
4895                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4896                                 chplan_new[k].ScanType = SCAN_ACTIVE;
4897                                 j++;
4898                                 k++;
4899                         }
4900                 } else {
4901                         /*  keep original STA 2.4G channel plan */
4902                         while ((i < MAX_CHANNEL_NUM) &&
4903                                 (chplan_sta[i].ChannelNum != 0) &&
4904                                 (chplan_sta[i].ChannelNum <= 14)) {
4905                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4906                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
4907                                 i++;
4908                                 k++;
4909                         }
4910
4911                         /*  skip AP 2.4G channel plan */
4912                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] <= 14)) {
4913                                 j++;
4914                         }
4915                 }
4916
4917                 if (pregistrypriv->wireless_mode & WIRELESS_11A) {
4918                         do {
4919                                 if ((i == MAX_CHANNEL_NUM) ||
4920                                         (chplan_sta[i].ChannelNum == 0))
4921                                         break;
4922
4923                                 if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] == 0))
4924                                         break;
4925
4926                                 if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
4927                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4928                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4929                                         i++;
4930                                         j++;
4931                                         k++;
4932                                 } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
4933                                         chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4934 /*                                      chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4935                                         chplan_new[k].ScanType = SCAN_PASSIVE;
4936                                         i++;
4937                                         k++;
4938                                 } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
4939                                         chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4940                                         chplan_new[k].ScanType = SCAN_ACTIVE;
4941                                         j++;
4942                                         k++;
4943                                 }
4944                         } while (1);
4945
4946                         /*  change AP not support channel to Passive scan */
4947                         while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
4948                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4949 /*                              chplan_new[k].ScanType = chplan_sta[i].ScanType; */
4950                                 chplan_new[k].ScanType = SCAN_PASSIVE;
4951                                 i++;
4952                                 k++;
4953                         }
4954
4955                         /*  add channel AP supported */
4956                         while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] != 0)) {
4957                                 chplan_new[k].ChannelNum = chplan_ap.Channel[j];
4958                                 chplan_new[k].ScanType = SCAN_ACTIVE;
4959                                 j++;
4960                                 k++;
4961                         }
4962                 } else {
4963                         /*  keep original STA 5G channel plan */
4964                         while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
4965                                 chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
4966                                 chplan_new[k].ScanType = chplan_sta[i].ScanType;
4967                                 i++;
4968                                 k++;
4969                         }
4970                 }
4971
4972                 pmlmeext->update_channel_plan_by_ap_done = 1;
4973
4974 #ifdef DEBUG_RTL871X
4975                 k = 0;
4976                 DBG_871X("%s: new STA channel plan {", __func__);
4977                 while ((k < MAX_CHANNEL_NUM) && (chplan_new[k].ChannelNum != 0)) {
4978                         DBG_871X("%02d(%c),", chplan_new[k].ChannelNum, chplan_new[k].ScanType == SCAN_PASSIVE?'p':'c');
4979                         k++;
4980                 }
4981                 DBG_871X("}\n");
4982 #endif
4983         }
4984
4985         /*  If channel is used by AP, set channel scan type to active */
4986         channel = bssid->Configuration.DSConfig;
4987         chplan_new = pmlmeext->channel_set;
4988         i = 0;
4989         while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
4990                 if (chplan_new[i].ChannelNum == channel) {
4991                         if (chplan_new[i].ScanType == SCAN_PASSIVE) {
4992                                 /* 5G Bnad 2, 3 (DFS) doesn't change to active scan */
4993                                 if (channel >= 52 && channel <= 144)
4994                                         break;
4995
4996                                 chplan_new[i].ScanType = SCAN_ACTIVE;
4997                                 RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
4998                                                  ("%s: change channel %d scan type from passive to active\n",
4999                                                   __func__, channel));
5000                         }
5001                         break;
5002                 }
5003                 i++;
5004         }
5005 }
5006
5007 /****************************************************************************
5008
5009 Following are the functions to report events
5010
5011 *****************************************************************************/
5012
5013 void report_survey_event(struct adapter *padapter, union recv_frame *precv_frame)
5014 {
5015         struct cmd_obj *pcmd_obj;
5016         u8 *pevtcmd;
5017         u32 cmdsz;
5018         struct survey_event     *psurvey_evt;
5019         struct C2HEvent_Header *pc2h_evt_hdr;
5020         struct mlme_ext_priv *pmlmeext;
5021         struct cmd_priv *pcmdpriv;
5022         /* u8 *pframe = precv_frame->u.hdr.rx_data; */
5023         /* uint len = precv_frame->u.hdr.len; */
5024
5025         if (!padapter)
5026                 return;
5027
5028         pmlmeext = &padapter->mlmeextpriv;
5029         pcmdpriv = &padapter->cmdpriv;
5030
5031         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
5032         if (!pcmd_obj)
5033                 return;
5034
5035         cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));
5036         pevtcmd = rtw_zmalloc(cmdsz);
5037         if (!pevtcmd) {
5038                 kfree(pcmd_obj);
5039                 return;
5040         }
5041
5042         INIT_LIST_HEAD(&pcmd_obj->list);
5043
5044         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
5045         pcmd_obj->cmdsz = cmdsz;
5046         pcmd_obj->parmbuf = pevtcmd;
5047
5048         pcmd_obj->rsp = NULL;
5049         pcmd_obj->rspsz  = 0;
5050
5051         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
5052         pc2h_evt_hdr->len = sizeof(struct survey_event);
5053         pc2h_evt_hdr->ID = GEN_EVT_CODE(_Survey);
5054         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
5055
5056         psurvey_evt = (struct survey_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
5057
5058         if (collect_bss_info(padapter, precv_frame, (struct wlan_bssid_ex *)&psurvey_evt->bss) == _FAIL) {
5059                 kfree(pcmd_obj);
5060                 kfree(pevtcmd);
5061                 return;
5062         }
5063
5064         process_80211d(padapter, &psurvey_evt->bss);
5065
5066         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
5067
5068         pmlmeext->sitesurvey_res.bss_cnt++;
5069
5070         return;
5071
5072 }
5073
5074 void report_surveydone_event(struct adapter *padapter)
5075 {
5076         struct cmd_obj *pcmd_obj;
5077         u8 *pevtcmd;
5078         u32 cmdsz;
5079         struct surveydone_event *psurveydone_evt;
5080         struct C2HEvent_Header  *pc2h_evt_hdr;
5081         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5082         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
5083
5084         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
5085         if (!pcmd_obj)
5086                 return;
5087
5088         cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));
5089         pevtcmd = rtw_zmalloc(cmdsz);
5090         if (!pevtcmd) {
5091                 kfree(pcmd_obj);
5092                 return;
5093         }
5094
5095         INIT_LIST_HEAD(&pcmd_obj->list);
5096
5097         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
5098         pcmd_obj->cmdsz = cmdsz;
5099         pcmd_obj->parmbuf = pevtcmd;
5100
5101         pcmd_obj->rsp = NULL;
5102         pcmd_obj->rspsz  = 0;
5103
5104         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
5105         pc2h_evt_hdr->len = sizeof(struct surveydone_event);
5106         pc2h_evt_hdr->ID = GEN_EVT_CODE(_SurveyDone);
5107         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
5108
5109         psurveydone_evt = (struct surveydone_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
5110         psurveydone_evt->bss_cnt = pmlmeext->sitesurvey_res.bss_cnt;
5111
5112         DBG_871X("survey done event(%x) band:%d for "ADPT_FMT"\n", psurveydone_evt->bss_cnt, padapter->setband, ADPT_ARG(padapter));
5113
5114         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
5115
5116         return;
5117
5118 }
5119
5120 void report_join_res(struct adapter *padapter, int res)
5121 {
5122         struct cmd_obj *pcmd_obj;
5123         u8 *pevtcmd;
5124         u32 cmdsz;
5125         struct joinbss_event            *pjoinbss_evt;
5126         struct C2HEvent_Header  *pc2h_evt_hdr;
5127         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5128         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5129         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
5130
5131         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
5132         if (!pcmd_obj)
5133                 return;
5134
5135         cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));
5136         pevtcmd = rtw_zmalloc(cmdsz);
5137         if (!pevtcmd) {
5138                 kfree(pcmd_obj);
5139                 return;
5140         }
5141
5142         INIT_LIST_HEAD(&pcmd_obj->list);
5143
5144         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
5145         pcmd_obj->cmdsz = cmdsz;
5146         pcmd_obj->parmbuf = pevtcmd;
5147
5148         pcmd_obj->rsp = NULL;
5149         pcmd_obj->rspsz  = 0;
5150
5151         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
5152         pc2h_evt_hdr->len = sizeof(struct joinbss_event);
5153         pc2h_evt_hdr->ID = GEN_EVT_CODE(_JoinBss);
5154         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
5155
5156         pjoinbss_evt = (struct joinbss_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
5157         memcpy((unsigned char *)(&(pjoinbss_evt->network.network)), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
5158         pjoinbss_evt->network.join_res  = pjoinbss_evt->network.aid = res;
5159
5160         DBG_871X("report_join_res(%d)\n", res);
5161
5162
5163         rtw_joinbss_event_prehandle(padapter, (u8 *)&pjoinbss_evt->network);
5164
5165
5166         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
5167
5168         return;
5169
5170 }
5171
5172 void report_wmm_edca_update(struct adapter *padapter)
5173 {
5174         struct cmd_obj *pcmd_obj;
5175         u8 *pevtcmd;
5176         u32 cmdsz;
5177         struct wmm_event                *pwmm_event;
5178         struct C2HEvent_Header  *pc2h_evt_hdr;
5179         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5180         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
5181
5182         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
5183         if (!pcmd_obj)
5184                 return;
5185
5186         cmdsz = (sizeof(struct wmm_event) + sizeof(struct C2HEvent_Header));
5187         pevtcmd = rtw_zmalloc(cmdsz);
5188         if (!pevtcmd) {
5189                 kfree(pcmd_obj);
5190                 return;
5191         }
5192
5193         INIT_LIST_HEAD(&pcmd_obj->list);
5194
5195         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
5196         pcmd_obj->cmdsz = cmdsz;
5197         pcmd_obj->parmbuf = pevtcmd;
5198
5199         pcmd_obj->rsp = NULL;
5200         pcmd_obj->rspsz  = 0;
5201
5202         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
5203         pc2h_evt_hdr->len = sizeof(struct wmm_event);
5204         pc2h_evt_hdr->ID = GEN_EVT_CODE(_WMM);
5205         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
5206
5207         pwmm_event = (struct wmm_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
5208         pwmm_event->wmm = 0;
5209
5210         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
5211
5212         return;
5213
5214 }
5215
5216 void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsigned short reason)
5217 {
5218         struct cmd_obj *pcmd_obj;
5219         u8 *pevtcmd;
5220         u32 cmdsz;
5221         struct sta_info *psta;
5222         int     mac_id;
5223         struct stadel_event                     *pdel_sta_evt;
5224         struct C2HEvent_Header  *pc2h_evt_hdr;
5225         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5226         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
5227
5228         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
5229         if (pcmd_obj == NULL) {
5230                 return;
5231         }
5232
5233         cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
5234         pevtcmd = rtw_zmalloc(cmdsz);
5235         if (pevtcmd == NULL) {
5236                 kfree(pcmd_obj);
5237                 return;
5238         }
5239
5240         INIT_LIST_HEAD(&pcmd_obj->list);
5241
5242         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
5243         pcmd_obj->cmdsz = cmdsz;
5244         pcmd_obj->parmbuf = pevtcmd;
5245
5246         pcmd_obj->rsp = NULL;
5247         pcmd_obj->rspsz  = 0;
5248
5249         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
5250         pc2h_evt_hdr->len = sizeof(struct stadel_event);
5251         pc2h_evt_hdr->ID = GEN_EVT_CODE(_DelSTA);
5252         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
5253
5254         pdel_sta_evt = (struct stadel_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
5255         memcpy((unsigned char *)(&(pdel_sta_evt->macaddr)), MacAddr, ETH_ALEN);
5256         memcpy((unsigned char *)(pdel_sta_evt->rsvd), (unsigned char *)(&reason), 2);
5257
5258
5259         psta = rtw_get_stainfo(&padapter->stapriv, MacAddr);
5260         if (psta)
5261                 mac_id = (int)psta->mac_id;
5262         else
5263                 mac_id = (-1);
5264
5265         pdel_sta_evt->mac_id = mac_id;
5266
5267         DBG_871X("report_del_sta_event: delete STA, mac_id =%d\n", mac_id);
5268
5269         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
5270 }
5271
5272 void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int cam_idx)
5273 {
5274         struct cmd_obj *pcmd_obj;
5275         u8 *pevtcmd;
5276         u32 cmdsz;
5277         struct stassoc_event            *padd_sta_evt;
5278         struct C2HEvent_Header  *pc2h_evt_hdr;
5279         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5280         struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
5281
5282         pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
5283         if (pcmd_obj == NULL)
5284                 return;
5285
5286         cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
5287         pevtcmd = rtw_zmalloc(cmdsz);
5288         if (pevtcmd == NULL) {
5289                 kfree(pcmd_obj);
5290                 return;
5291         }
5292
5293         INIT_LIST_HEAD(&pcmd_obj->list);
5294
5295         pcmd_obj->cmdcode = GEN_CMD_CODE(_Set_MLME_EVT);
5296         pcmd_obj->cmdsz = cmdsz;
5297         pcmd_obj->parmbuf = pevtcmd;
5298
5299         pcmd_obj->rsp = NULL;
5300         pcmd_obj->rspsz  = 0;
5301
5302         pc2h_evt_hdr = (struct C2HEvent_Header *)(pevtcmd);
5303         pc2h_evt_hdr->len = sizeof(struct stassoc_event);
5304         pc2h_evt_hdr->ID = GEN_EVT_CODE(_AddSTA);
5305         pc2h_evt_hdr->seq = atomic_inc_return(&pmlmeext->event_seq);
5306
5307         padd_sta_evt = (struct stassoc_event *)(pevtcmd + sizeof(struct C2HEvent_Header));
5308         memcpy((unsigned char *)(&(padd_sta_evt->macaddr)), MacAddr, ETH_ALEN);
5309         padd_sta_evt->cam_id = cam_idx;
5310
5311         DBG_871X("report_add_sta_event: add STA\n");
5312
5313         rtw_enqueue_cmd(pcmdpriv, pcmd_obj);
5314 }
5315
5316 /****************************************************************************
5317
5318 Following are the event callback functions
5319
5320 *****************************************************************************/
5321
5322 /* for sta/adhoc mode */
5323 void update_sta_info(struct adapter *padapter, struct sta_info *psta)
5324 {
5325         struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
5326         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5327         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5328
5329         /* ERP */
5330         VCS_update(padapter, psta);
5331
5332         /* HT */
5333         if (pmlmepriv->htpriv.ht_option) {
5334                 psta->htpriv.ht_option = true;
5335
5336                 psta->htpriv.ampdu_enable = pmlmepriv->htpriv.ampdu_enable;
5337
5338                 psta->htpriv.rx_ampdu_min_spacing = (pmlmeinfo->HT_caps.u.HT_cap_element.AMPDU_para&IEEE80211_HT_CAP_AMPDU_DENSITY)>>2;
5339
5340                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_20))
5341                         psta->htpriv.sgi_20m = true;
5342
5343                 if (support_short_GI(padapter, &(pmlmeinfo->HT_caps), CHANNEL_WIDTH_40))
5344                         psta->htpriv.sgi_40m = true;
5345
5346                 psta->qos_option = true;
5347
5348                 psta->htpriv.ldpc_cap = pmlmepriv->htpriv.ldpc_cap;
5349                 psta->htpriv.stbc_cap = pmlmepriv->htpriv.stbc_cap;
5350                 psta->htpriv.beamform_cap = pmlmepriv->htpriv.beamform_cap;
5351
5352                 memcpy(&psta->htpriv.ht_cap, &pmlmeinfo->HT_caps, sizeof(struct rtw_ieee80211_ht_cap));
5353         } else {
5354                 psta->htpriv.ht_option = false;
5355
5356                 psta->htpriv.ampdu_enable = false;
5357
5358                 psta->htpriv.sgi_20m = false;
5359                 psta->htpriv.sgi_40m = false;
5360                 psta->qos_option = false;
5361
5362         }
5363
5364         psta->htpriv.ch_offset = pmlmeext->cur_ch_offset;
5365
5366         psta->htpriv.agg_enable_bitmap = 0x0;/* reset */
5367         psta->htpriv.candidate_tid_bitmap = 0x0;/* reset */
5368
5369         psta->bw_mode = pmlmeext->cur_bwmode;
5370
5371         /* QoS */
5372         if (pmlmepriv->qospriv.qos_option)
5373                 psta->qos_option = true;
5374
5375         update_ldpc_stbc_cap(psta);
5376
5377         spin_lock_bh(&psta->lock);
5378         psta->state = _FW_LINKED;
5379         spin_unlock_bh(&psta->lock);
5380
5381 }
5382
5383 static void rtw_mlmeext_disconnect(struct adapter *padapter)
5384 {
5385         struct mlme_priv        *pmlmepriv = &padapter->mlmepriv;
5386         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5387         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5388         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
5389
5390         /* set_opmode_cmd(padapter, infra_client_with_mlme); */
5391
5392         /* For safety, prevent from keeping macid sleep.
5393          * If we can sure all power mode enter/leave are paired,
5394          * this check can be removed.
5395          * Lucas@20131113
5396          */
5397         /* wakeup macid after disconnect. */
5398         {
5399                 struct sta_info *psta;
5400
5401                 psta = rtw_get_stainfo(&padapter->stapriv, get_my_bssid(pnetwork));
5402                 if (psta)
5403                         rtw_hal_macid_wakeup(padapter, psta->mac_id);
5404         }
5405
5406         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
5407         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5408
5409         /* set MSR to no link state -> infra. mode */
5410         Set_MSR(padapter, _HW_STATE_STATION_);
5411
5412         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5413
5414         /* switch to the 20M Hz mode after disconnect */
5415         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
5416         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
5417
5418         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5419
5420         flush_all_cam_entry(padapter);
5421
5422         del_timer_sync(&pmlmeext->link_timer);
5423
5424         /* pmlmepriv->LinkDetectInfo.TrafficBusyState = false; */
5425         pmlmepriv->LinkDetectInfo.TrafficTransitionCount = 0;
5426         pmlmepriv->LinkDetectInfo.LowPowerTransitionCount = 0;
5427
5428 }
5429
5430 void mlmeext_joinbss_event_callback(struct adapter *padapter, int join_res)
5431 {
5432         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5433         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5434         struct wlan_bssid_ex            *cur_network = &(pmlmeinfo->network);
5435         struct sta_priv         *pstapriv = &padapter->stapriv;
5436         u8 join_type;
5437         struct sta_info *psta;
5438
5439         if (join_res < 0) {
5440                 join_type = 1;
5441                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5442                 rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, null_addr);
5443
5444                 goto exit_mlmeext_joinbss_event_callback;
5445         }
5446
5447         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE)
5448                 /* update bc/mc sta_info */
5449                 update_bmc_sta(padapter);
5450
5451
5452         /* turn on dynamic functions */
5453         Switch_DM_Func(padapter, DYNAMIC_ALL_FUNC_ENABLE, true);
5454
5455         /*  update IOT-related issue */
5456         update_IOT_info(padapter);
5457
5458         rtw_hal_set_hwreg(padapter, HW_VAR_BASIC_RATE, cur_network->SupportedRates);
5459
5460         /* BCN interval */
5461         rtw_hal_set_hwreg(padapter, HW_VAR_BEACON_INTERVAL, (u8 *)(&pmlmeinfo->bcn_interval));
5462
5463         /* update capability */
5464         update_capinfo(padapter, pmlmeinfo->capability);
5465
5466         /* WMM, Update EDCA param */
5467         WMMOnAssocRsp(padapter);
5468
5469         /* HT */
5470         HTOnAssocRsp(padapter);
5471
5472         /* Set cur_channel&cur_bwmode&cur_ch_offset */
5473         set_channel_bwmode(padapter, pmlmeext->cur_channel, pmlmeext->cur_ch_offset, pmlmeext->cur_bwmode);
5474
5475         psta = rtw_get_stainfo(pstapriv, cur_network->MacAddress);
5476         if (psta) { /* only for infra. mode */
5477
5478                 pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
5479
5480                 /* DBG_871X("set_sta_rate\n"); */
5481
5482                 psta->wireless_mode = pmlmeext->cur_wireless_mode;
5483
5484                 /* set per sta rate after updating HT cap. */
5485                 set_sta_rate(padapter, psta);
5486
5487                 rtw_sta_media_status_rpt(padapter, psta, 1);
5488
5489                 /* wakeup macid after join bss successfully to ensure
5490                         the subsequent data frames can be sent out normally */
5491                 rtw_hal_macid_wakeup(padapter, psta->mac_id);
5492         }
5493
5494         join_type = 2;
5495         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5496
5497         if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
5498                 /*  correcting TSF */
5499                 correct_TSF(padapter, pmlmeext);
5500
5501                 /* set_link_timer(pmlmeext, DISCONNECT_TO); */
5502         }
5503
5504         if (get_iface_type(padapter) == IFACE_PORT0)
5505                 rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_CONNECT, 0);
5506
5507 exit_mlmeext_joinbss_event_callback:
5508
5509         DBG_871X("=>%s\n", __func__);
5510
5511 }
5512
5513 /* currently only adhoc mode will go here */
5514 void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *psta)
5515 {
5516         struct mlme_ext_priv *pmlmeext = &(padapter->mlmeextpriv);
5517         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5518         u8 join_type;
5519
5520         DBG_871X("%s\n", __func__);
5521
5522         if ((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) {
5523                 if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) { /* adhoc master or sta_count>1 */
5524
5525                         /* nothing to do */
5526                 } else { /* adhoc client */
5527                         /* update TSF Value */
5528                         /* update_TSF(pmlmeext, pframe, len); */
5529
5530                         /*  correcting TSF */
5531                         correct_TSF(padapter, pmlmeext);
5532
5533                         /* start beacon */
5534                         if (send_beacon(padapter) == _FAIL) {
5535                                 pmlmeinfo->FW_sta_info[psta->mac_id].status = 0;
5536
5537                                 pmlmeinfo->state ^= WIFI_FW_ADHOC_STATE;
5538
5539                                 return;
5540                         }
5541
5542                         pmlmeinfo->state |= WIFI_FW_ASSOC_SUCCESS;
5543
5544                 }
5545
5546                 join_type = 2;
5547                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
5548         }
5549
5550         pmlmeinfo->FW_sta_info[psta->mac_id].psta = psta;
5551
5552         psta->bssratelen = rtw_get_rateset_len(pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates);
5553         memcpy(psta->bssrateset, pmlmeinfo->FW_sta_info[psta->mac_id].SupportedRates, psta->bssratelen);
5554
5555         /* update adhoc sta_info */
5556         update_sta_info(padapter, psta);
5557
5558         rtw_hal_update_sta_rate_mask(padapter, psta);
5559
5560         /*  ToDo: HT for Ad-hoc */
5561         psta->wireless_mode = rtw_check_network_type(psta->bssrateset, psta->bssratelen, pmlmeext->cur_channel);
5562         psta->raid = networktype_to_raid_ex(padapter, psta);
5563
5564         /* rate radaptive */
5565         Update_RA_Entry(padapter, psta);
5566 }
5567
5568 void mlmeext_sta_del_event_callback(struct adapter *padapter)
5569 {
5570         if (is_client_associated_to_ap(padapter) || is_IBSS_empty(padapter))
5571                 rtw_mlmeext_disconnect(padapter);
5572 }
5573
5574 /****************************************************************************
5575
5576 Following are the functions for the timer handlers
5577
5578 *****************************************************************************/
5579 void _linked_info_dump(struct adapter *padapter)
5580 {
5581         int i;
5582         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5583         struct mlme_ext_info    *pmlmeinfo = &(pmlmeext->mlmext_info);
5584         int UndecoratedSmoothedPWDB;
5585         struct dvobj_priv *pdvobj = adapter_to_dvobj(padapter);
5586
5587         if (padapter->bLinkInfoDump) {
5588
5589                 DBG_871X("\n ============["ADPT_FMT"] linked status check ===================\n", ADPT_ARG(padapter));
5590
5591                 if ((pmlmeinfo->state&0x03) == WIFI_FW_STATION_STATE) {
5592                         rtw_hal_get_def_var(padapter, HAL_DEF_UNDERCORATEDSMOOTHEDPWDB, &UndecoratedSmoothedPWDB);
5593
5594                         DBG_871X("AP[" MAC_FMT "] - UndecoratedSmoothedPWDB:%d\n",
5595                                 MAC_ARG(padapter->mlmepriv.cur_network.network.MacAddress), UndecoratedSmoothedPWDB);
5596                 } else if ((pmlmeinfo->state&0x03) == _HW_STATE_AP_) {
5597                         struct list_head        *phead, *plist;
5598
5599                         struct sta_info *psta = NULL;
5600                         struct sta_priv *pstapriv = &padapter->stapriv;
5601
5602                         spin_lock_bh(&pstapriv->asoc_list_lock);
5603                         phead = &pstapriv->asoc_list;
5604                         plist = get_next(phead);
5605                         while (phead != plist) {
5606                                 psta = LIST_CONTAINOR(plist, struct sta_info, asoc_list);
5607                                 plist = get_next(plist);
5608
5609                                 DBG_871X("STA[" MAC_FMT "]:UndecoratedSmoothedPWDB:%d\n",
5610                                         MAC_ARG(psta->hwaddr), psta->rssi_stat.UndecoratedSmoothedPWDB);
5611                         }
5612                         spin_unlock_bh(&pstapriv->asoc_list_lock);
5613
5614                 }
5615                 for (i = 0; i < NUM_STA; i++) {
5616                         if (pdvobj->macid[i]) {
5617                                 if (i != 1) /* skip bc/mc sta */
5618                                         /*   tx info ============ */
5619                                         rtw_hal_get_def_var(padapter, HW_DEF_RA_INFO_DUMP, &i);
5620                         }
5621                 }
5622                 rtw_hal_set_def_var(padapter, HAL_DEF_DBG_RX_INFO_DUMP, NULL);
5623
5624
5625         }
5626
5627
5628 }
5629
5630 static u8 chk_ap_is_alive(struct adapter *padapter, struct sta_info *psta)
5631 {
5632         u8 ret = false;
5633
5634         #ifdef DBG_EXPIRATION_CHK
5635         DBG_871X(FUNC_ADPT_FMT" rx:"STA_PKTS_FMT", beacon:%llu, probersp_to_self:%llu"
5636                                 /*", probersp_bm:%llu, probersp_uo:%llu, probereq:%llu, BI:%u"*/
5637                                 ", retry:%u\n"
5638                 , FUNC_ADPT_ARG(padapter)
5639                 , STA_RX_PKTS_DIFF_ARG(psta)
5640                 , psta->sta_stats.rx_beacon_pkts - psta->sta_stats.last_rx_beacon_pkts
5641                 , psta->sta_stats.rx_probersp_pkts - psta->sta_stats.last_rx_probersp_pkts
5642                 /*, psta->sta_stats.rx_probersp_bm_pkts - psta->sta_stats.last_rx_probersp_bm_pkts
5643                 , psta->sta_stats.rx_probersp_uo_pkts - psta->sta_stats.last_rx_probersp_uo_pkts
5644                 , psta->sta_stats.rx_probereq_pkts - psta->sta_stats.last_rx_probereq_pkts
5645                 , pmlmeinfo->bcn_interval*/
5646                 , pmlmeext->retry
5647         );
5648
5649         DBG_871X(FUNC_ADPT_FMT" tx_pkts:%llu, link_count:%u\n", FUNC_ADPT_ARG(padapter)
5650                 , padapter->xmitpriv.tx_pkts
5651                 , pmlmeinfo->link_count
5652         );
5653         #endif
5654
5655         if ((sta_rx_data_pkts(psta) == sta_last_rx_data_pkts(psta))
5656                 && sta_rx_beacon_pkts(psta) == sta_last_rx_beacon_pkts(psta)
5657                 && sta_rx_probersp_pkts(psta) == sta_last_rx_probersp_pkts(psta)
5658         ) {
5659                 ret = false;
5660         } else {
5661                 ret = true;
5662         }
5663
5664         sta_update_last_rx_pkts(psta);
5665
5666         return ret;
5667 }
5668
5669 void linked_status_chk(struct adapter *padapter)
5670 {
5671         u32 i;
5672         struct sta_info         *psta;
5673         struct xmit_priv        *pxmitpriv = &(padapter->xmitpriv);
5674         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5675         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5676         struct sta_priv         *pstapriv = &padapter->stapriv;
5677
5678
5679         if (is_client_associated_to_ap(padapter)) {
5680                 /* linked infrastructure client mode */
5681
5682                 int tx_chk = _SUCCESS, rx_chk = _SUCCESS;
5683                 int rx_chk_limit;
5684                 int link_count_limit;
5685
5686                 #if defined(DBG_ROAMING_TEST)
5687                 rx_chk_limit = 1;
5688                 #else
5689                 rx_chk_limit = 8;
5690                 #endif
5691                 link_count_limit = 7; /*  16 sec */
5692
5693                 /*  Marked by Kurt 20130715 */
5694                 /*  For WiDi 3.5 and latered on, they don't ask WiDi sink to do roaming, so we could not check rx limit that strictly. */
5695                 /*  todo: To check why we under miracast session, rx_chk would be false */
5696                 psta = rtw_get_stainfo(pstapriv, pmlmeinfo->network.MacAddress);
5697                 if (psta != NULL) {
5698                         if (chk_ap_is_alive(padapter, psta) == false)
5699                                 rx_chk = _FAIL;
5700
5701                         if (pxmitpriv->last_tx_pkts == pxmitpriv->tx_pkts)
5702                                 tx_chk = _FAIL;
5703
5704                         {
5705                                 if (rx_chk != _SUCCESS) {
5706                                         if (pmlmeext->retry == 0) {
5707                                                 #ifdef DBG_EXPIRATION_CHK
5708                                                 DBG_871X("issue_probereq to trigger probersp, retry =%d\n", pmlmeext->retry);
5709                                                 #endif
5710                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress, 0, 0, 0, 0);
5711                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress, 0, 0, 0, 0);
5712                                                 issue_probereq_ex(padapter, &pmlmeinfo->network.Ssid, pmlmeinfo->network.MacAddress, 0, 0, 0, 0);
5713                                         }
5714                                 }
5715
5716                                 if (tx_chk != _SUCCESS && pmlmeinfo->link_count++ == link_count_limit) {
5717                                         #ifdef DBG_EXPIRATION_CHK
5718                                         DBG_871X("%s issue_nulldata 0\n", __func__);
5719                                         #endif
5720                                         tx_chk = issue_nulldata_in_interrupt(padapter, NULL);
5721                                 }
5722                         }
5723
5724                         if (rx_chk == _FAIL) {
5725                                 pmlmeext->retry++;
5726                                 if (pmlmeext->retry > rx_chk_limit) {
5727                                         DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" disconnect or roaming\n",
5728                                                 FUNC_ADPT_ARG(padapter));
5729                                         receive_disconnect(padapter, pmlmeinfo->network.MacAddress
5730                                                 , WLAN_REASON_EXPIRATION_CHK);
5731                                         return;
5732                                 }
5733                         } else {
5734                                 pmlmeext->retry = 0;
5735                         }
5736
5737                         if (tx_chk == _FAIL) {
5738                                 pmlmeinfo->link_count %= (link_count_limit+1);
5739                         } else {
5740                                 pxmitpriv->last_tx_pkts = pxmitpriv->tx_pkts;
5741                                 pmlmeinfo->link_count = 0;
5742                         }
5743
5744                 } /* end of if ((psta = rtw_get_stainfo(pstapriv, passoc_res->network.MacAddress)) != NULL) */
5745         } else if (is_client_associated_to_ibss(padapter)) {
5746                 /* linked IBSS mode */
5747                 /* for each assoc list entry to check the rx pkt counter */
5748                 for (i = IBSS_START_MAC_ID; i < NUM_STA; i++) {
5749                         if (pmlmeinfo->FW_sta_info[i].status == 1) {
5750                                 psta = pmlmeinfo->FW_sta_info[i].psta;
5751
5752                                 if (NULL == psta)
5753                                         continue;
5754
5755                                 if (pmlmeinfo->FW_sta_info[i].rx_pkt == sta_rx_pkts(psta)) {
5756
5757                                         if (pmlmeinfo->FW_sta_info[i].retry < 3) {
5758                                                 pmlmeinfo->FW_sta_info[i].retry++;
5759                                         } else {
5760                                                 pmlmeinfo->FW_sta_info[i].retry = 0;
5761                                                 pmlmeinfo->FW_sta_info[i].status = 0;
5762                                                 report_del_sta_event(padapter, psta->hwaddr
5763                                                         , 65535/*  indicate disconnect caused by no rx */
5764                                                 );
5765                                         }
5766                                 } else {
5767                                         pmlmeinfo->FW_sta_info[i].retry = 0;
5768                                         pmlmeinfo->FW_sta_info[i].rx_pkt = (u32)sta_rx_pkts(psta);
5769                                 }
5770                         }
5771                 }
5772
5773                 /* set_link_timer(pmlmeext, DISCONNECT_TO); */
5774
5775         }
5776
5777 }
5778
5779 void survey_timer_hdl(struct timer_list *t)
5780 {
5781         struct adapter *padapter =
5782                 from_timer(padapter, t, mlmeextpriv.survey_timer);
5783         struct cmd_obj  *ph2c;
5784         struct sitesurvey_parm  *psurveyPara;
5785         struct cmd_priv                                 *pcmdpriv = &padapter->cmdpriv;
5786         struct mlme_ext_priv    *pmlmeext = &padapter->mlmeextpriv;
5787
5788         /* DBG_871X("marc: survey timer\n"); */
5789
5790         /* issue rtw_sitesurvey_cmd */
5791         if (pmlmeext->sitesurvey_res.state > SCAN_START) {
5792                 if (pmlmeext->sitesurvey_res.state ==  SCAN_PROCESS) {
5793                         pmlmeext->sitesurvey_res.channel_idx++;
5794                 }
5795
5796                 if (pmlmeext->scan_abort) {
5797                         {
5798                                 pmlmeext->sitesurvey_res.channel_idx = pmlmeext->sitesurvey_res.ch_num;
5799                                 DBG_871X("%s idx:%d\n", __func__
5800                                         , pmlmeext->sitesurvey_res.channel_idx
5801                                 );
5802                         }
5803
5804                         pmlmeext->scan_abort = false;/* reset */
5805                 }
5806
5807                 ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
5808                 if (ph2c == NULL) {
5809                         goto exit_survey_timer_hdl;
5810                 }
5811
5812                 psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));
5813                 if (psurveyPara == NULL) {
5814                         kfree(ph2c);
5815                         goto exit_survey_timer_hdl;
5816                 }
5817
5818                 init_h2fwcmd_w_parm_no_rsp(ph2c, psurveyPara, GEN_CMD_CODE(_SiteSurvey));
5819                 rtw_enqueue_cmd(pcmdpriv, ph2c);
5820         }
5821
5822
5823 exit_survey_timer_hdl:
5824
5825         return;
5826 }
5827
5828 void link_timer_hdl(struct timer_list *t)
5829 {
5830         struct adapter *padapter =
5831                 from_timer(padapter, t, mlmeextpriv.link_timer);
5832         /* static unsigned int          rx_pkt = 0; */
5833         /* static u64                           tx_cnt = 0; */
5834         /* struct xmit_priv     *pxmitpriv = &(padapter->xmitpriv); */
5835         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
5836         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
5837         /* struct sta_priv      *pstapriv = &padapter->stapriv; */
5838
5839
5840         if (pmlmeinfo->state & WIFI_FW_AUTH_NULL) {
5841                 DBG_871X("link_timer_hdl:no beacon while connecting\n");
5842                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
5843                 report_join_res(padapter, -3);
5844         } else if (pmlmeinfo->state & WIFI_FW_AUTH_STATE) {
5845                 /* re-auth timer */
5846                 if (++pmlmeinfo->reauth_count > REAUTH_LIMIT) {
5847                         /* if (pmlmeinfo->auth_algo != dot11AuthAlgrthm_Auto) */
5848                         /*  */
5849                                 pmlmeinfo->state = 0;
5850                                 report_join_res(padapter, -1);
5851                                 return;
5852                         /*  */
5853                         /* else */
5854                         /*  */
5855                         /*      pmlmeinfo->auth_algo = dot11AuthAlgrthm_Shared; */
5856                         /*      pmlmeinfo->reauth_count = 0; */
5857                         /*  */
5858                 }
5859
5860                 DBG_871X("link_timer_hdl: auth timeout and try again\n");
5861                 pmlmeinfo->auth_seq = 1;
5862                 issue_auth(padapter, NULL, 0);
5863                 set_link_timer(pmlmeext, REAUTH_TO);
5864         } else if (pmlmeinfo->state & WIFI_FW_ASSOC_STATE) {
5865                 /* re-assoc timer */
5866                 if (++pmlmeinfo->reassoc_count > REASSOC_LIMIT) {
5867                         pmlmeinfo->state = WIFI_FW_NULL_STATE;
5868                         report_join_res(padapter, -2);
5869                         return;
5870                 }
5871
5872                 DBG_871X("link_timer_hdl: assoc timeout and try again\n");
5873                 issue_assocreq(padapter);
5874                 set_link_timer(pmlmeext, REASSOC_TO);
5875         }
5876 }
5877
5878 void addba_timer_hdl(struct timer_list *t)
5879 {
5880         struct sta_info *psta = from_timer(psta, t, addba_retry_timer);
5881         struct ht_priv *phtpriv;
5882
5883         if (!psta)
5884                 return;
5885
5886         phtpriv = &psta->htpriv;
5887
5888         if (phtpriv->ht_option && phtpriv->ampdu_enable) {
5889                 if (phtpriv->candidate_tid_bitmap)
5890                         phtpriv->candidate_tid_bitmap = 0x0;
5891
5892         }
5893 }
5894
5895 void sa_query_timer_hdl(struct timer_list *t)
5896 {
5897         struct adapter *padapter =
5898                 from_timer(padapter, t, mlmeextpriv.sa_query_timer);
5899         struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
5900         /* disconnect */
5901         spin_lock_bh(&pmlmepriv->lock);
5902
5903         if (check_fwstate(pmlmepriv, _FW_LINKED)) {
5904                 rtw_disassoc_cmd(padapter, 0, true);
5905                 rtw_indicate_disconnect(padapter);
5906                 rtw_free_assoc_resources(padapter, 1);
5907         }
5908
5909         spin_unlock_bh(&pmlmepriv->lock);
5910         DBG_871X("SA query timeout disconnect\n");
5911 }
5912
5913 u8 NULL_hdl(struct adapter *padapter, u8 *pbuf)
5914 {
5915         return H2C_SUCCESS;
5916 }
5917
5918 #ifdef CONFIG_AUTO_AP_MODE
5919 static int rtw_auto_ap_start_beacon(struct adapter *adapter)
5920 {
5921         int ret = 0;
5922         u8 *pbuf = NULL;
5923         uint len;
5924         u8 supportRate[16];
5925         int     sz = 0, rateLen;
5926         u8 *ie;
5927         u8 wireless_mode, oper_channel;
5928         u8 ssid[3] = {0}; /* hidden ssid */
5929         u32 ssid_len = sizeof(ssid);
5930         struct mlme_priv *pmlmepriv = &(adapter->mlmepriv);
5931
5932
5933         if (check_fwstate(pmlmepriv, WIFI_AP_STATE) != true)
5934                 return -EINVAL;
5935
5936
5937         len = 128;
5938         pbuf = rtw_zmalloc(len);
5939         if (!pbuf)
5940                 return -ENOMEM;
5941
5942
5943         /* generate beacon */
5944         ie = pbuf;
5945
5946         /* timestamp will be inserted by hardware */
5947         sz += 8;
5948         ie += sz;
5949
5950         /* beacon interval : 2bytes */
5951         *(u16 *)ie = cpu_to_le16((u16)100);/* BCN_INTERVAL = 100; */
5952         sz += 2;
5953         ie += 2;
5954
5955         /* capability info */
5956         *(u16 *)ie = 0;
5957         *(u16 *)ie |= cpu_to_le16(cap_ESS);
5958         *(u16 *)ie |= cpu_to_le16(cap_ShortPremble);
5959         /* u16*)ie |= cpu_to_le16(cap_Privacy); */
5960         sz += 2;
5961         ie += 2;
5962
5963         /* SSID */
5964         ie = rtw_set_ie(ie, _SSID_IE_, ssid_len, ssid, &sz);
5965
5966         /* supported rates */
5967         wireless_mode = WIRELESS_11BG_24N;
5968         rtw_set_supported_rate(supportRate, wireless_mode);
5969         rateLen = rtw_get_rateset_len(supportRate);
5970         if (rateLen > 8) {
5971                 ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, 8, supportRate, &sz);
5972         } else {
5973                 ie = rtw_set_ie(ie, _SUPPORTEDRATES_IE_, rateLen, supportRate, &sz);
5974         }
5975
5976
5977         /* DS parameter set */
5978         if (check_buddy_fwstate(adapter, _FW_LINKED) &&
5979                 check_buddy_fwstate(adapter, WIFI_STATION_STATE)) {
5980                 struct adapter *pbuddystruct adapter = adapter->pbuddystruct adapter;
5981                 struct mlme_ext_priv *pbuddy_mlmeext  = &pbuddystruct adapter->mlmeextpriv;
5982
5983                 oper_channel = pbuddy_mlmeext->cur_channel;
5984         } else {
5985                 oper_channel = adapter_to_dvobj(adapter)->oper_channel;
5986         }
5987         ie = rtw_set_ie(ie, _DSSET_IE_, 1, &oper_channel, &sz);
5988
5989         /* ext supported rates */
5990         if (rateLen > 8) {
5991                 ie = rtw_set_ie(ie, _EXT_SUPPORTEDRATES_IE_, (rateLen - 8), (supportRate + 8), &sz);
5992         }
5993
5994         DBG_871X("%s, start auto ap beacon sz =%d\n", __func__, sz);
5995
5996         /* lunch ap mode & start to issue beacon */
5997         if (rtw_check_beacon_data(adapter, pbuf,  sz) == _SUCCESS) {
5998
5999         } else {
6000                 ret = -EINVAL;
6001         }
6002
6003
6004         kfree(pbuf);
6005
6006         return ret;
6007
6008 }
6009 #endif/* CONFIG_AUTO_AP_MODE */
6010
6011 u8 setopmode_hdl(struct adapter *padapter, u8 *pbuf)
6012 {
6013         u8 type;
6014         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6015         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6016         struct setopmode_parm *psetop = (struct setopmode_parm *)pbuf;
6017
6018         if (psetop->mode == Ndis802_11APMode) {
6019                 pmlmeinfo->state = WIFI_FW_AP_STATE;
6020                 type = _HW_STATE_AP_;
6021                 /* start_ap_mode(padapter); */
6022         } else if (psetop->mode == Ndis802_11Infrastructure) {
6023                 pmlmeinfo->state &= ~(BIT(0)|BIT(1));/*  clear state */
6024                 pmlmeinfo->state |= WIFI_FW_STATION_STATE;/* set to     STATION_STATE */
6025                 type = _HW_STATE_STATION_;
6026         } else if (psetop->mode == Ndis802_11IBSS) {
6027                 type = _HW_STATE_ADHOC_;
6028         } else {
6029                 type = _HW_STATE_NOLINK_;
6030         }
6031
6032         rtw_hal_set_hwreg(padapter, HW_VAR_SET_OPMODE, (u8 *)(&type));
6033         /* Set_MSR(padapter, type); */
6034
6035
6036 #ifdef CONFIG_AUTO_AP_MODE
6037         if (psetop->mode == Ndis802_11APMode)
6038                 rtw_auto_ap_start_beacon(padapter);
6039 #endif
6040
6041         if (psetop->mode == Ndis802_11APMode) {
6042                 /*  Do this after port switch to */
6043                 /*  prevent from downloading rsvd page to wrong port */
6044                 rtw_btcoex_MediaStatusNotify(padapter, 1); /* connect */
6045         }
6046
6047         return H2C_SUCCESS;
6048
6049 }
6050
6051 u8 createbss_hdl(struct adapter *padapter, u8 *pbuf)
6052 {
6053         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6054         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6055         struct wlan_bssid_ex    *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
6056         struct joinbss_parm *pparm = (struct joinbss_parm *)pbuf;
6057         /* u32 initialgain; */
6058
6059         if (pmlmeinfo->state == WIFI_FW_AP_STATE) {
6060                 struct wlan_bssid_ex *network = &padapter->mlmepriv.cur_network.network;
6061
6062                 start_bss_network(padapter, (u8 *)network);
6063                 return H2C_SUCCESS;
6064         }
6065
6066         /* below is for ad-hoc master */
6067         if (pparm->network.InfrastructureMode == Ndis802_11IBSS) {
6068                 rtw_joinbss_reset(padapter);
6069
6070                 pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
6071                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
6072                 pmlmeinfo->ERP_enable = 0;
6073                 pmlmeinfo->WMM_enable = 0;
6074                 pmlmeinfo->HT_enable = 0;
6075                 pmlmeinfo->HT_caps_enable = 0;
6076                 pmlmeinfo->HT_info_enable = 0;
6077                 pmlmeinfo->agg_enable_bitmap = 0;
6078                 pmlmeinfo->candidate_tid_bitmap = 0;
6079
6080                 /* disable dynamic functions, such as high power, DIG */
6081                 Save_DM_Func_Flag(padapter);
6082                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
6083
6084                 /* config the initial gain under linking, need to write the BB registers */
6085                 /* initialgain = 0x1E; */
6086                 /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
6087
6088                 /* cancel link timer */
6089                 del_timer_sync(&pmlmeext->link_timer);
6090
6091                 /* clear CAM */
6092                 flush_all_cam_entry(padapter);
6093
6094                 memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, IELength));
6095                 pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
6096
6097                 if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
6098                         return H2C_PARAMETERS_ERROR;
6099
6100                 memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
6101
6102                 start_create_ibss(padapter);
6103
6104         }
6105
6106         return H2C_SUCCESS;
6107
6108 }
6109
6110 u8 join_cmd_hdl(struct adapter *padapter, u8 *pbuf)
6111 {
6112         u8 join_type;
6113         struct ndis_80211_var_ie *pIE;
6114         struct registry_priv *pregpriv = &padapter->registrypriv;
6115         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6116         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6117         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
6118         u32 i;
6119         u8 cbw40_enable = 0;
6120         /* u32 initialgain; */
6121         /* u32 acparm; */
6122         u8 ch, bw, offset;
6123
6124         /* check already connecting to AP or not */
6125         if (pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) {
6126                 if (pmlmeinfo->state & WIFI_FW_STATION_STATE) {
6127                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, 1, 100);
6128                 }
6129                 pmlmeinfo->state = WIFI_FW_NULL_STATE;
6130
6131                 /* clear CAM */
6132                 flush_all_cam_entry(padapter);
6133
6134                 del_timer_sync(&pmlmeext->link_timer);
6135
6136                 /* set MSR to nolink -> infra. mode */
6137                 /* Set_MSR(padapter, _HW_STATE_NOLINK_); */
6138                 Set_MSR(padapter, _HW_STATE_STATION_);
6139
6140
6141                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_DISCONNECT, NULL);
6142         }
6143
6144         rtw_joinbss_reset(padapter);
6145
6146         pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
6147         pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
6148         pmlmeinfo->ERP_enable = 0;
6149         pmlmeinfo->WMM_enable = 0;
6150         pmlmeinfo->HT_enable = 0;
6151         pmlmeinfo->HT_caps_enable = 0;
6152         pmlmeinfo->HT_info_enable = 0;
6153         pmlmeinfo->agg_enable_bitmap = 0;
6154         pmlmeinfo->candidate_tid_bitmap = 0;
6155         pmlmeinfo->bwmode_updated = false;
6156         /* pmlmeinfo->assoc_AP_vendor = HT_IOT_PEER_MAX; */
6157         pmlmeinfo->VHT_enable = 0;
6158
6159         memcpy(pnetwork, pbuf, FIELD_OFFSET(struct wlan_bssid_ex, IELength));
6160         pnetwork->IELength = ((struct wlan_bssid_ex *)pbuf)->IELength;
6161
6162         if (pnetwork->IELength > MAX_IE_SZ)/* Check pbuf->IELength */
6163                 return H2C_PARAMETERS_ERROR;
6164
6165         memcpy(pnetwork->IEs, ((struct wlan_bssid_ex *)pbuf)->IEs, pnetwork->IELength);
6166
6167         pmlmeext->cur_channel = (u8)pnetwork->Configuration.DSConfig;
6168         pmlmeinfo->bcn_interval = get_beacon_interval(pnetwork);
6169
6170         /* Check AP vendor to move rtw_joinbss_cmd() */
6171         /* pmlmeinfo->assoc_AP_vendor = check_assoc_AP(pnetwork->IEs, pnetwork->IELength); */
6172
6173         /* sizeof(struct ndis_802_11_fix_ie) */
6174         for (i = _FIXED_IE_LENGTH_; i < pnetwork->IELength;) {
6175                 pIE = (struct ndis_80211_var_ie *)(pnetwork->IEs + i);
6176
6177                 switch (pIE->ElementID) {
6178                 case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
6179                         if (!memcmp(pIE->data, WMM_OUI, 4))
6180                                 WMM_param_handler(padapter, pIE);
6181                         break;
6182
6183                 case _HT_CAPABILITY_IE_:        /* Get HT Cap IE. */
6184                         pmlmeinfo->HT_caps_enable = 1;
6185                         break;
6186
6187                 case _HT_EXTRA_INFO_IE_:        /* Get HT Info IE. */
6188                         pmlmeinfo->HT_info_enable = 1;
6189
6190                         /* spec case only for cisco's ap because cisco's ap issue assoc rsp using mcs rate @40MHz or @20MHz */
6191                         {
6192                                 struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
6193
6194                                 if (pnetwork->Configuration.DSConfig > 14) {
6195                                         if ((pregpriv->bw_mode >> 4) > CHANNEL_WIDTH_20)
6196                                                 cbw40_enable = 1;
6197                                 } else {
6198                                         if ((pregpriv->bw_mode & 0x0f) > CHANNEL_WIDTH_20)
6199                                                 cbw40_enable = 1;
6200                                 }
6201
6202                                 if ((cbw40_enable) && (pht_info->infos[0] & BIT(2))) {
6203                                         /* switch to the 40M Hz mode according to the AP */
6204                                         pmlmeext->cur_bwmode = CHANNEL_WIDTH_40;
6205                                         switch (pht_info->infos[0] & 0x3) {
6206                                         case 1:
6207                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_LOWER;
6208                                                 break;
6209
6210                                         case 3:
6211                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_UPPER;
6212                                                 break;
6213
6214                                         default:
6215                                                 pmlmeext->cur_ch_offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
6216                                                 pmlmeext->cur_bwmode = CHANNEL_WIDTH_20;
6217                                                 break;
6218                                         }
6219
6220                                         DBG_871X("set HT ch/bw before connected\n");
6221                                 }
6222                         }
6223                         break;
6224                 default:
6225                         break;
6226                 }
6227
6228                 i += (pIE->Length + 2);
6229         }
6230
6231         /* check channel, bandwidth, offset and switch */
6232         if (rtw_chk_start_clnt_join(padapter, &ch, &bw, &offset) == _FAIL) {
6233                 report_join_res(padapter, (-4));
6234                 return H2C_SUCCESS;
6235         }
6236
6237         /* disable dynamic functions, such as high power, DIG */
6238         /* Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false); */
6239
6240         /* config the initial gain under linking, need to write the BB registers */
6241         /* initialgain = 0x1E; */
6242         /* rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain)); */
6243
6244         rtw_hal_set_hwreg(padapter, HW_VAR_BSSID, pmlmeinfo->network.MacAddress);
6245         join_type = 0;
6246         rtw_hal_set_hwreg(padapter, HW_VAR_MLME_JOIN, (u8 *)(&join_type));
6247         rtw_hal_set_hwreg(padapter, HW_VAR_DO_IQK, NULL);
6248
6249         set_channel_bwmode(padapter, ch, offset, bw);
6250
6251         /* cancel link timer */
6252         del_timer_sync(&pmlmeext->link_timer);
6253
6254         start_clnt_join(padapter);
6255
6256         return H2C_SUCCESS;
6257
6258 }
6259
6260 u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
6261 {
6262         struct disconnect_parm *param = (struct disconnect_parm *)pbuf;
6263         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6264         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6265         struct wlan_bssid_ex            *pnetwork = (struct wlan_bssid_ex *)(&(pmlmeinfo->network));
6266         u8 val8;
6267
6268         if (is_client_associated_to_ap(padapter)) {
6269                         issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms/100, 100);
6270         }
6271
6272         if (((pmlmeinfo->state&0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
6273                 /* Stop BCN */
6274                 val8 = 0;
6275                 rtw_hal_set_hwreg(padapter, HW_VAR_BCN_FUNC, (u8 *)(&val8));
6276         }
6277
6278         rtw_mlmeext_disconnect(padapter);
6279
6280         rtw_free_uc_swdec_pending_queue(padapter);
6281
6282         return  H2C_SUCCESS;
6283 }
6284
6285 static int rtw_scan_ch_decision(struct adapter *padapter, struct rtw_ieee80211_channel *out,
6286         u32 out_num, struct rtw_ieee80211_channel *in, u32 in_num)
6287 {
6288         int i, j;
6289         int set_idx;
6290         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6291
6292         /* clear first */
6293         memset(out, 0, sizeof(struct rtw_ieee80211_channel)*out_num);
6294
6295         /* acquire channels from in */
6296         j = 0;
6297         for (i = 0; i < in_num; i++) {
6298
6299                 DBG_871X(FUNC_ADPT_FMT" "CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(&in[i]));
6300
6301                 set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
6302                 if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
6303                         && set_idx >= 0
6304                         && rtw_mlme_band_check(padapter, in[i].hw_value)
6305                 ) {
6306                         if (j >= out_num) {
6307                                 DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
6308                                         FUNC_ADPT_ARG(padapter), out_num);
6309                                 break;
6310                         }
6311
6312                         memcpy(&out[j], &in[i], sizeof(struct rtw_ieee80211_channel));
6313
6314                         if (pmlmeext->channel_set[set_idx].ScanType == SCAN_PASSIVE)
6315                                 out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
6316
6317                         j++;
6318                 }
6319                 if (j >= out_num)
6320                         break;
6321         }
6322
6323         /* if out is empty, use channel_set as default */
6324         if (j == 0) {
6325                 for (i = 0; i < pmlmeext->max_chan_nums; i++) {
6326
6327                         DBG_871X(FUNC_ADPT_FMT" ch:%u\n", FUNC_ADPT_ARG(padapter), pmlmeext->channel_set[i].ChannelNum);
6328
6329                         if (rtw_mlme_band_check(padapter, pmlmeext->channel_set[i].ChannelNum)) {
6330
6331                                 if (j >= out_num) {
6332                                         DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
6333                                                 FUNC_ADPT_ARG(padapter), out_num);
6334                                         break;
6335                                 }
6336
6337                                 out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
6338
6339                                 if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
6340                                         out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
6341
6342                                 j++;
6343                         }
6344                 }
6345         }
6346
6347         return j;
6348 }
6349
6350 u8 sitesurvey_cmd_hdl(struct adapter *padapter, u8 *pbuf)
6351 {
6352         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6353         struct sitesurvey_parm  *pparm = (struct sitesurvey_parm *)pbuf;
6354         u8 bdelayscan = false;
6355         u8 val8;
6356         u32 initialgain;
6357         u32 i;
6358
6359         if (pmlmeext->sitesurvey_res.state == SCAN_DISABLE) {
6360                 pmlmeext->sitesurvey_res.state = SCAN_START;
6361                 pmlmeext->sitesurvey_res.bss_cnt = 0;
6362                 pmlmeext->sitesurvey_res.channel_idx = 0;
6363
6364                 for (i = 0; i < RTW_SSID_SCAN_AMOUNT; i++) {
6365                         if (pparm->ssid[i].SsidLength) {
6366                                 memcpy(pmlmeext->sitesurvey_res.ssid[i].Ssid, pparm->ssid[i].Ssid, IW_ESSID_MAX_SIZE);
6367                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = pparm->ssid[i].SsidLength;
6368                         } else {
6369                                 pmlmeext->sitesurvey_res.ssid[i].SsidLength = 0;
6370                         }
6371                 }
6372
6373                 pmlmeext->sitesurvey_res.ch_num = rtw_scan_ch_decision(padapter
6374                         , pmlmeext->sitesurvey_res.ch, RTW_CHANNEL_SCAN_AMOUNT
6375                         , pparm->ch, pparm->ch_num
6376                 );
6377
6378                 pmlmeext->sitesurvey_res.scan_mode = pparm->scan_mode;
6379
6380                 /* issue null data if associating to the AP */
6381                 if (is_client_associated_to_ap(padapter)) {
6382                         pmlmeext->sitesurvey_res.state = SCAN_TXNULL;
6383
6384                         issue_nulldata(padapter, NULL, 1, 3, 500);
6385
6386                         bdelayscan = true;
6387                 }
6388                 if (bdelayscan) {
6389                         /* delay 50ms to protect nulldata(1). */
6390                         set_survey_timer(pmlmeext, 50);
6391                         return H2C_SUCCESS;
6392                 }
6393         }
6394
6395         if ((pmlmeext->sitesurvey_res.state == SCAN_START) || (pmlmeext->sitesurvey_res.state == SCAN_TXNULL)) {
6396                 /* disable dynamic functions, such as high power, DIG */
6397                 Save_DM_Func_Flag(padapter);
6398                 Switch_DM_Func(padapter, DYNAMIC_FUNC_DISABLE, false);
6399
6400                 /* config the initial gain under scanning, need to write the BB
6401                  * registers
6402                  */
6403                 initialgain = 0x1e;
6404
6405                 rtw_hal_set_hwreg(padapter, HW_VAR_INITIAL_GAIN, (u8 *)(&initialgain));
6406
6407                 /* set MSR to no link state */
6408                 Set_MSR(padapter, _HW_STATE_NOLINK_);
6409
6410                 val8 = 1; /* under site survey */
6411                 rtw_hal_set_hwreg(padapter, HW_VAR_MLME_SITESURVEY, (u8 *)(&val8));
6412
6413                 pmlmeext->sitesurvey_res.state = SCAN_PROCESS;
6414         }
6415
6416         site_survey(padapter);
6417
6418         return H2C_SUCCESS;
6419
6420 }
6421
6422 u8 setauth_hdl(struct adapter *padapter, unsigned char *pbuf)
6423 {
6424         struct setauth_parm             *pparm = (struct setauth_parm *)pbuf;
6425         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6426         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6427
6428         if (pparm->mode < 4)
6429                 pmlmeinfo->auth_algo = pparm->mode;
6430
6431         return  H2C_SUCCESS;
6432 }
6433
6434 u8 setkey_hdl(struct adapter *padapter, u8 *pbuf)
6435 {
6436         u16 ctrl = 0;
6437         s16 cam_id = 0;
6438         struct setkey_parm              *pparm = (struct setkey_parm *)pbuf;
6439         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6440         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6441         unsigned char null_addr[] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
6442         u8 *addr;
6443
6444         /* main tx key for wep. */
6445         if (pparm->set_tx)
6446                 pmlmeinfo->key_index = pparm->keyid;
6447
6448         cam_id = rtw_camid_alloc(padapter, NULL, pparm->keyid);
6449
6450         if (cam_id < 0) {
6451         } else {
6452                 if (cam_id > 3) /* not default key, searched by A2 */
6453                         addr = get_bssid(&padapter->mlmepriv);
6454                 else
6455                         addr = null_addr;
6456
6457                 ctrl = BIT(15) | BIT6 | ((pparm->algorithm) << 2) | pparm->keyid;
6458                 write_cam(padapter, cam_id, ctrl, addr, pparm->key);
6459                 DBG_871X_LEVEL(_drv_always_, "set group key camid:%d, addr:"MAC_FMT", kid:%d, type:%s\n"
6460                         , cam_id, MAC_ARG(addr), pparm->keyid, security_type_str(pparm->algorithm));
6461         }
6462
6463         if (cam_id >= 0 && cam_id <= 3)
6464                 rtw_hal_set_hwreg(padapter, HW_VAR_SEC_DK_CFG, (u8 *)true);
6465
6466         /* allow multicast packets to driver */
6467         padapter->HalFunc.SetHwRegHandler(padapter, HW_VAR_ON_RCR_AM, null_addr);
6468
6469         return H2C_SUCCESS;
6470 }
6471
6472 u8 set_stakey_hdl(struct adapter *padapter, u8 *pbuf)
6473 {
6474         u16 ctrl = 0;
6475         s16 cam_id = 0;
6476         u8 ret = H2C_SUCCESS;
6477         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6478         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6479         struct set_stakey_parm  *pparm = (struct set_stakey_parm *)pbuf;
6480         struct sta_priv *pstapriv = &padapter->stapriv;
6481         struct sta_info *psta;
6482
6483         if (pparm->algorithm == _NO_PRIVACY_)
6484                 goto write_to_cam;
6485
6486         psta = rtw_get_stainfo(pstapriv, pparm->addr);
6487         if (!psta) {
6488                 DBG_871X_LEVEL(_drv_always_, "%s sta:"MAC_FMT" not found\n", __func__, MAC_ARG(pparm->addr));
6489                 ret = H2C_REJECTED;
6490                 goto exit;
6491         }
6492
6493         pmlmeinfo->enc_algo = pparm->algorithm;
6494         cam_id = rtw_camid_alloc(padapter, psta, 0);
6495         if (cam_id < 0)
6496                 goto exit;
6497
6498 write_to_cam:
6499         if (pparm->algorithm == _NO_PRIVACY_) {
6500                 while ((cam_id = rtw_camid_search(padapter, pparm->addr, -1)) >= 0) {
6501                         DBG_871X_LEVEL(_drv_always_, "clear key for addr:"MAC_FMT", camid:%d\n", MAC_ARG(pparm->addr), cam_id);
6502                         clear_cam_entry(padapter, cam_id);
6503                         rtw_camid_free(padapter, cam_id);
6504                 }
6505         } else {
6506                 DBG_871X_LEVEL(_drv_always_, "set pairwise key camid:%d, addr:"MAC_FMT", kid:%d, type:%s\n",
6507                         cam_id, MAC_ARG(pparm->addr), pparm->keyid, security_type_str(pparm->algorithm));
6508                 ctrl = BIT(15) | ((pparm->algorithm) << 2) | pparm->keyid;
6509                 write_cam(padapter, cam_id, ctrl, pparm->addr, pparm->key);
6510         }
6511         ret = H2C_SUCCESS_RSP;
6512
6513 exit:
6514         return ret;
6515 }
6516
6517 u8 add_ba_hdl(struct adapter *padapter, unsigned char *pbuf)
6518 {
6519         struct addBaReq_parm    *pparm = (struct addBaReq_parm *)pbuf;
6520         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6521         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6522
6523         struct sta_info *psta = rtw_get_stainfo(&padapter->stapriv, pparm->addr);
6524
6525         if (!psta)
6526                 return  H2C_SUCCESS;
6527
6528         if (((pmlmeinfo->state & WIFI_FW_ASSOC_SUCCESS) && (pmlmeinfo->HT_enable)) ||
6529                 ((pmlmeinfo->state&0x03) == WIFI_FW_AP_STATE)) {
6530                 /* pmlmeinfo->ADDBA_retry_count = 0; */
6531                 /* pmlmeinfo->candidate_tid_bitmap |= (0x1 << pparm->tid); */
6532                 /* psta->htpriv.candidate_tid_bitmap |= BIT(pparm->tid); */
6533                 issue_action_BA(padapter, pparm->addr, RTW_WLAN_ACTION_ADDBA_REQ, (u16)pparm->tid);
6534                 /* _set_timer(&pmlmeext->ADDBA_timer, ADDBA_TO); */
6535                 _set_timer(&psta->addba_retry_timer, ADDBA_TO);
6536         } else {
6537                 psta->htpriv.candidate_tid_bitmap &= ~BIT(pparm->tid);
6538         }
6539         return  H2C_SUCCESS;
6540 }
6541
6542
6543 u8 chk_bmc_sleepq_cmd(struct adapter *padapter)
6544 {
6545         struct cmd_obj *ph2c;
6546         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
6547         u8 res = _SUCCESS;
6548
6549         ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
6550         if (ph2c == NULL) {
6551                 res = _FAIL;
6552                 goto exit;
6553         }
6554
6555         init_h2fwcmd_w_parm_no_parm_rsp(ph2c, GEN_CMD_CODE(_ChkBMCSleepq));
6556
6557         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
6558
6559 exit:
6560         return res;
6561 }
6562
6563 u8 set_tx_beacon_cmd(struct adapter *padapter)
6564 {
6565         struct cmd_obj  *ph2c;
6566         struct Tx_Beacon_param  *ptxBeacon_parm;
6567         struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);
6568         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6569         struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info);
6570         u8 res = _SUCCESS;
6571         int len_diff = 0;
6572
6573         ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
6574         if (ph2c == NULL) {
6575                 res = _FAIL;
6576                 goto exit;
6577         }
6578
6579         ptxBeacon_parm = rtw_zmalloc(sizeof(struct Tx_Beacon_param));
6580         if (ptxBeacon_parm == NULL) {
6581                 kfree(ph2c);
6582                 res = _FAIL;
6583                 goto exit;
6584         }
6585
6586         memcpy(&(ptxBeacon_parm->network), &(pmlmeinfo->network), sizeof(struct wlan_bssid_ex));
6587
6588         len_diff = update_hidden_ssid(
6589                 ptxBeacon_parm->network.IEs+_BEACON_IE_OFFSET_
6590                 , ptxBeacon_parm->network.IELength-_BEACON_IE_OFFSET_
6591                 , pmlmeinfo->hidden_ssid_mode
6592         );
6593         ptxBeacon_parm->network.IELength += len_diff;
6594
6595         init_h2fwcmd_w_parm_no_rsp(ph2c, ptxBeacon_parm, GEN_CMD_CODE(_TX_Beacon));
6596
6597         res = rtw_enqueue_cmd(pcmdpriv, ph2c);
6598
6599 exit:
6600         return res;
6601 }
6602
6603
6604 u8 mlme_evt_hdl(struct adapter *padapter, unsigned char *pbuf)
6605 {
6606         u8 evt_code, evt_seq;
6607         u16 evt_sz;
6608         uint    *peventbuf;
6609         void (*event_callback)(struct adapter *dev, u8 *pbuf);
6610         struct evt_priv *pevt_priv = &(padapter->evtpriv);
6611
6612         if (pbuf == NULL)
6613                 goto _abort_event_;
6614
6615         peventbuf = (uint *)pbuf;
6616         evt_sz = (u16)(*peventbuf&0xffff);
6617         evt_seq = (u8)((*peventbuf>>24)&0x7f);
6618         evt_code = (u8)((*peventbuf>>16)&0xff);
6619
6620
6621         #ifdef CHECK_EVENT_SEQ
6622         /*  checking event sequence... */
6623         if (evt_seq != (atomic_read(&pevt_priv->event_seq) & 0x7f)) {
6624                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_info_,
6625                          ("Event Seq Error! %d vs %d\n", (evt_seq & 0x7f),
6626                           (atomic_read(&pevt_priv->event_seq) & 0x7f)));
6627
6628                 pevt_priv->event_seq = (evt_seq+1)&0x7f;
6629
6630                 goto _abort_event_;
6631         }
6632         #endif
6633
6634         /*  checking if event code is valid */
6635         if (evt_code >= MAX_C2HEVT) {
6636                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent Code(%d) mismatch!\n", evt_code));
6637                 goto _abort_event_;
6638         }
6639
6640         /*  checking if event size match the event parm size */
6641         if ((wlanevents[evt_code].parmsize != 0) &&
6642                         (wlanevents[evt_code].parmsize != evt_sz)) {
6643
6644                 RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\nEvent(%d) Parm Size mismatch (%d vs %d)!\n",
6645                         evt_code, wlanevents[evt_code].parmsize, evt_sz));
6646                 goto _abort_event_;
6647
6648         }
6649
6650         atomic_inc(&pevt_priv->event_seq);
6651
6652         peventbuf += 2;
6653
6654         if (peventbuf) {
6655                 event_callback = wlanevents[evt_code].event_callback;
6656                 event_callback(padapter, (u8 *)peventbuf);
6657
6658                 pevt_priv->evt_done_cnt++;
6659         }
6660
6661
6662 _abort_event_:
6663
6664
6665         return H2C_SUCCESS;
6666
6667 }
6668
6669 u8 h2c_msg_hdl(struct adapter *padapter, unsigned char *pbuf)
6670 {
6671         if (!pbuf)
6672                 return H2C_PARAMETERS_ERROR;
6673
6674         return H2C_SUCCESS;
6675 }
6676
6677 u8 chk_bmc_sleepq_hdl(struct adapter *padapter, unsigned char *pbuf)
6678 {
6679         struct sta_info *psta_bmc;
6680         struct list_head        *xmitframe_plist, *xmitframe_phead;
6681         struct xmit_frame *pxmitframe = NULL;
6682         struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
6683         struct sta_priv  *pstapriv = &padapter->stapriv;
6684
6685         /* for BC/MC Frames */
6686         psta_bmc = rtw_get_bcmc_stainfo(padapter);
6687         if (!psta_bmc)
6688                 return H2C_SUCCESS;
6689
6690         if ((pstapriv->tim_bitmap&BIT(0)) && (psta_bmc->sleepq_len > 0)) {
6691                 msleep(10);/*  10ms, ATIM(HIQ) Windows */
6692
6693                 /* spin_lock_bh(&psta_bmc->sleep_q.lock); */
6694                 spin_lock_bh(&pxmitpriv->lock);
6695
6696                 xmitframe_phead = get_list_head(&psta_bmc->sleep_q);
6697                 xmitframe_plist = get_next(xmitframe_phead);
6698
6699                 while (xmitframe_phead != xmitframe_plist) {
6700                         pxmitframe = LIST_CONTAINOR(xmitframe_plist, struct xmit_frame, list);
6701
6702                         xmitframe_plist = get_next(xmitframe_plist);
6703
6704                         list_del_init(&pxmitframe->list);
6705
6706                         psta_bmc->sleepq_len--;
6707                         if (psta_bmc->sleepq_len > 0)
6708                                 pxmitframe->attrib.mdata = 1;
6709                         else
6710                                 pxmitframe->attrib.mdata = 0;
6711
6712                         pxmitframe->attrib.triggered = 1;
6713
6714                         if (xmitframe_hiq_filter(pxmitframe))
6715                                 pxmitframe->attrib.qsel = 0x11;/* HIQ */
6716
6717                         rtw_hal_xmitframe_enqueue(padapter, pxmitframe);
6718                 }
6719
6720                 /* spin_unlock_bh(&psta_bmc->sleep_q.lock); */
6721                 spin_unlock_bh(&pxmitpriv->lock);
6722
6723                 /* check hi queue and bmc_sleepq */
6724                 rtw_chk_hi_queue_cmd(padapter);
6725         }
6726
6727         return H2C_SUCCESS;
6728 }
6729
6730 u8 tx_beacon_hdl(struct adapter *padapter, unsigned char *pbuf)
6731 {
6732         if (send_beacon(padapter) == _FAIL) {
6733                 DBG_871X("issue_beacon, fail!\n");
6734                 return H2C_PARAMETERS_ERROR;
6735         }
6736
6737         /* tx bc/mc frames after update TIM */
6738         chk_bmc_sleepq_hdl(padapter, NULL);
6739
6740         return H2C_SUCCESS;
6741 }
6742
6743 int rtw_chk_start_clnt_join(struct adapter *padapter, u8 *ch, u8 *bw, u8 *offset)
6744 {
6745         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6746         unsigned char cur_ch = pmlmeext->cur_channel;
6747         unsigned char cur_bw = pmlmeext->cur_bwmode;
6748         unsigned char cur_ch_offset = pmlmeext->cur_ch_offset;
6749         bool connect_allow = true;
6750
6751         if (!ch || !bw || !offset) {
6752                 rtw_warn_on(1);
6753                 connect_allow = false;
6754         }
6755
6756         if (connect_allow) {
6757                 DBG_871X("start_join_set_ch_bw: ch =%d, bwmode =%d, ch_offset =%d\n", cur_ch, cur_bw, cur_ch_offset);
6758                 *ch = cur_ch;
6759                 *bw = cur_bw;
6760                 *offset = cur_ch_offset;
6761         }
6762
6763         return connect_allow ? _SUCCESS : _FAIL;
6764 }
6765
6766 /* Find union about ch, bw, ch_offset of all linked/linking interfaces */
6767 int rtw_get_ch_setting_union(struct adapter *adapter, u8 *ch, u8 *bw, u8 *offset)
6768 {
6769         struct dvobj_priv *dvobj = adapter_to_dvobj(adapter);
6770         struct adapter *iface;
6771
6772         if (ch)
6773                 *ch = 0;
6774         if (bw)
6775                 *bw = CHANNEL_WIDTH_20;
6776         if (offset)
6777                 *offset = HAL_PRIME_CHNL_OFFSET_DONT_CARE;
6778
6779         iface = dvobj->padapters;
6780
6781         if (!check_fwstate(&iface->mlmepriv, _FW_LINKED|_FW_UNDER_LINKING))
6782                 return 0;
6783
6784         return 1;
6785 }
6786
6787 u8 set_ch_hdl(struct adapter *padapter, u8 *pbuf)
6788 {
6789         struct set_ch_parm *set_ch_parm;
6790         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6791
6792         if (!pbuf)
6793                 return H2C_PARAMETERS_ERROR;
6794
6795         set_ch_parm = (struct set_ch_parm *)pbuf;
6796
6797         DBG_871X(FUNC_NDEV_FMT" ch:%u, bw:%u, ch_offset:%u\n",
6798                 FUNC_NDEV_ARG(padapter->pnetdev),
6799                 set_ch_parm->ch, set_ch_parm->bw, set_ch_parm->ch_offset);
6800
6801         pmlmeext->cur_channel = set_ch_parm->ch;
6802         pmlmeext->cur_ch_offset = set_ch_parm->ch_offset;
6803         pmlmeext->cur_bwmode = set_ch_parm->bw;
6804
6805         set_channel_bwmode(padapter, set_ch_parm->ch, set_ch_parm->ch_offset, set_ch_parm->bw);
6806
6807         return  H2C_SUCCESS;
6808 }
6809
6810 u8 set_chplan_hdl(struct adapter *padapter, unsigned char *pbuf)
6811 {
6812         struct SetChannelPlan_param *setChannelPlan_param;
6813         struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;
6814
6815         if (!pbuf)
6816                 return H2C_PARAMETERS_ERROR;
6817
6818         setChannelPlan_param = (struct SetChannelPlan_param *)pbuf;
6819
6820         pmlmeext->max_chan_nums = init_channel_set(padapter, setChannelPlan_param->channel_plan, pmlmeext->channel_set);
6821         init_channel_list(padapter, pmlmeext->channel_set, pmlmeext->max_chan_nums, &pmlmeext->channel_list);
6822
6823         if ((padapter->rtw_wdev != NULL) && (padapter->rtw_wdev->wiphy)) {
6824                 struct regulatory_request request;
6825
6826                 request.initiator = NL80211_REGDOM_SET_BY_DRIVER;
6827                 rtw_reg_notifier(padapter->rtw_wdev->wiphy, &request);
6828         }
6829
6830         return  H2C_SUCCESS;
6831 }
6832
6833 u8 led_blink_hdl(struct adapter *padapter, unsigned char *pbuf)
6834 {
6835         struct LedBlink_param *ledBlink_param;
6836
6837         if (!pbuf)
6838                 return H2C_PARAMETERS_ERROR;
6839
6840         ledBlink_param = (struct LedBlink_param *)pbuf;
6841         return  H2C_SUCCESS;
6842 }
6843
6844 u8 set_csa_hdl(struct adapter *padapter, unsigned char *pbuf)
6845 {
6846         return  H2C_REJECTED;
6847 }
6848
6849 /*  TDLS_ESTABLISHED    : write RCR DATA BIT */
6850 /*  TDLS_CS_OFF         : go back to the channel linked with AP, terminating channel switch procedure */
6851 /*  TDLS_INIT_CH_SEN    : init channel sensing, receive all data and mgnt frame */
6852 /*  TDLS_DONE_CH_SEN: channel sensing and report candidate channel */
6853 /*  TDLS_OFF_CH         : first time set channel to off channel */
6854 /*  TDLS_BASE_CH                : go back tp the channel linked with AP when set base channel as target channel */
6855 /*  TDLS_P_OFF_CH       : periodically go to off channel */
6856 /*  TDLS_P_BASE_CH      : periodically go back to base channel */
6857 /*  TDLS_RS_RCR         : restore RCR */
6858 /*  TDLS_TEAR_STA       : free tdls sta */
6859 u8 tdls_hdl(struct adapter *padapter, unsigned char *pbuf)
6860 {
6861         return H2C_REJECTED;
6862 }
6863
6864 u8 run_in_thread_hdl(struct adapter *padapter, u8 *pbuf)
6865 {
6866         struct RunInThread_param *p;
6867
6868
6869         if (NULL == pbuf)
6870                 return H2C_PARAMETERS_ERROR;
6871         p = (struct RunInThread_param *)pbuf;
6872
6873         if (p->func)
6874                 p->func(p->context);
6875
6876         return H2C_SUCCESS;
6877 }